31266 lines
1 MiB
31266 lines
1 MiB
/* internal.c
|
|
*
|
|
* Copyright (C) 2006-2020 wolfSSL Inc.
|
|
*
|
|
* This file is part of wolfSSL.
|
|
*
|
|
* wolfSSL is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* wolfSSL is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
#include <config.h>
|
|
#endif
|
|
|
|
#include <wolfssl/wolfcrypt/settings.h>
|
|
|
|
/*
|
|
* WOLFSSL_SMALL_CERT_VERIFY:
|
|
* Verify the certificate signature without using DecodedCert. Doubles up
|
|
* on some code but allows smaller peak heap memory usage.
|
|
* Cannot be used with WOLFSSL_NONBLOCK_OCSP.
|
|
* WOLFSSL_ALT_CERT_CHAINS:
|
|
* Allows CA's to be presented by peer, but not part of a valid chain.
|
|
* Default wolfSSL behavior is to require validation of all presented peer
|
|
* certificates. This also allows loading intermediate CA's as trusted
|
|
* and ignoring no signer failures for CA's up the chain to root.
|
|
* WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT:
|
|
* Enable resending the previous DTLS handshake flight only on a network
|
|
* read timeout. By default we resend in two more cases, when we receive:
|
|
* - an out of order last msg of the peer's flight
|
|
* - a duplicate of the first msg from the peer's flight
|
|
* WOLFSSL_NO_DEF_TICKET_ENC_CB:
|
|
* No default ticket encryption callback.
|
|
* Server only.
|
|
* Application must set its own callback to use session tickets.
|
|
* WOLFSSL_TICKET_ENC_CHACHA20_POLY1305
|
|
* Use ChaCha20-Poly1305 to encrypt/decrypt session tickets in default
|
|
* callback. Default algorithm if none defined and algorithms compiled in.
|
|
* Server only.
|
|
* WOLFSSL_TICKET_ENC_AES128_GCM
|
|
* Use AES128-GCM to encrypt/decrypt session tickets in default callback.
|
|
* Server only. Default algorithm if ChaCha20/Poly1305 not compiled in.
|
|
* WOLFSSL_TICKET_ENC_AES256_GCM
|
|
* Use AES256-GCM to encrypt/decrypt session tickets in default callback.
|
|
* Server only.
|
|
* WOLFSSL_TICKET_DECRYPT_NO_CREATE
|
|
* Default callback will not request creation of new ticket on successful
|
|
* decryption.
|
|
* Server only.
|
|
*/
|
|
|
|
|
|
#ifdef EXTERNAL_OPTS_OPENVPN
|
|
#error EXTERNAL_OPTS_OPENVPN should not be defined\
|
|
when building wolfSSL
|
|
#endif
|
|
|
|
#ifndef WOLFCRYPT_ONLY
|
|
|
|
#include <wolfssl/internal.h>
|
|
#include <wolfssl/error-ssl.h>
|
|
#include <wolfssl/wolfcrypt/asn.h>
|
|
#include <wolfssl/wolfcrypt/dh.h>
|
|
#ifdef NO_INLINE
|
|
#include <wolfssl/wolfcrypt/misc.h>
|
|
#else
|
|
#define WOLFSSL_MISC_INCLUDED
|
|
#include <wolfcrypt/src/misc.c>
|
|
#endif
|
|
#if defined(OPENSSL_EXTRA) && defined(WOLFCRYPT_HAVE_SRP) && !defined(NO_SHA)
|
|
#include <wolfssl/wolfcrypt/srp.h>
|
|
#endif
|
|
|
|
#ifdef HAVE_LIBZ
|
|
#include "zlib.h"
|
|
#endif
|
|
|
|
#ifdef HAVE_NTRU
|
|
#include "libntruencrypt/ntru_crypto.h"
|
|
#endif
|
|
|
|
#if defined(DEBUG_WOLFSSL) || defined(SHOW_SECRETS) || \
|
|
defined(CHACHA_AEAD_TEST) || defined(WOLFSSL_SESSION_EXPORT_DEBUG)
|
|
#ifndef NO_STDIO_FILESYSTEM
|
|
#ifdef FUSION_RTOS
|
|
#include <fclstdio.h>
|
|
#else
|
|
#include <stdio.h>
|
|
#endif
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef __sun
|
|
#include <sys/filio.h>
|
|
#endif
|
|
|
|
|
|
#define ERROR_OUT(err, eLabel) { ret = (err); goto eLabel; }
|
|
|
|
#ifdef _MSC_VER
|
|
/* disable for while(0) cases at the .c level for now */
|
|
#pragma warning(disable:4127)
|
|
#endif
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) && !defined(LARGE_STATIC_BUFFERS)
|
|
#error \
|
|
WOLFSSL_CALLBACKS needs LARGE_STATIC_BUFFERS, please add LARGE_STATIC_BUFFERS
|
|
#endif
|
|
|
|
#if defined(HAVE_SECURE_RENEGOTIATION) && defined(HAVE_RENEGOTIATION_INDICATION)
|
|
#error Cannot use both secure-renegotiation and renegotiation-indication
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
static int DoHelloVerifyRequest(WOLFSSL* ssl, const byte* input, word32*,
|
|
word32);
|
|
static int DoServerKeyExchange(WOLFSSL* ssl, const byte* input, word32*,
|
|
word32);
|
|
#ifndef NO_CERTS
|
|
static int DoCertificateRequest(WOLFSSL* ssl, const byte* input, word32*,
|
|
word32);
|
|
#endif
|
|
#ifdef HAVE_SESSION_TICKET
|
|
static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32*,
|
|
word32);
|
|
#endif
|
|
#endif
|
|
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
static int DoClientKeyExchange(WOLFSSL* ssl, byte* input, word32*, word32);
|
|
#if (!defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \
|
|
defined(HAVE_ED448)) && !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
static int DoCertificateVerify(WOLFSSL* ssl, byte*, word32*, word32);
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
static int SendHelloVerifyRequest(WOLFSSL*, const byte*, byte);
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
#endif /* !NO_WOLFSSL_SERVER */
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
#if defined(HAVE_SESSION_TICKET) && !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB)
|
|
static int TicketEncCbCtx_Init(WOLFSSL_CTX* ctx,
|
|
TicketEncCbCtx* keyCtx);
|
|
static void TicketEncCbCtx_Free(TicketEncCbCtx* keyCtx);
|
|
static int DefTicketEncCb(WOLFSSL* ssl,
|
|
byte key_name[WOLFSSL_TICKET_NAME_SZ],
|
|
byte iv[WOLFSSL_TICKET_IV_SZ],
|
|
byte mac[WOLFSSL_TICKET_MAC_SZ],
|
|
int enc, byte* ticket, int inLen, int* outLen,
|
|
void* userCtx);
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
static WC_INLINE int DtlsCheckWindow(WOLFSSL* ssl);
|
|
static WC_INLINE int DtlsUpdateWindow(WOLFSSL* ssl);
|
|
#endif
|
|
|
|
|
|
enum processReply {
|
|
doProcessInit = 0,
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
runProcessOldClientHello,
|
|
#endif
|
|
getRecordLayerHeader,
|
|
getData,
|
|
verifyEncryptedMessage,
|
|
decryptMessage,
|
|
verifyMessage,
|
|
runProcessingOneMessage
|
|
};
|
|
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_WOLFSSL_CLIENT)
|
|
|
|
/* Server random bytes for TLS v1.3 described downgrade protection mechanism. */
|
|
static const byte tls13Downgrade[7] = {
|
|
0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44
|
|
};
|
|
#define TLS13_DOWNGRADE_SZ sizeof(tls13Downgrade)
|
|
|
|
#endif /* !NO_WOLFSSL_SERVER || !NO_WOLFSSL_CLIENT */
|
|
|
|
#if !defined(NO_OLD_TLS) && !defined(WOLFSSL_AEAD_ONLY)
|
|
static int SSL_hmac(WOLFSSL* ssl, byte* digest, const byte* in, word32 sz,
|
|
int padSz, int content, int verify, int epochOrder);
|
|
|
|
#endif
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifdef HAVE_QSH
|
|
int QSH_Init(WOLFSSL* ssl);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_RENESAS_TSIP_TLS
|
|
int tsip_useable(const WOLFSSL *ssl);
|
|
int tsip_generatePremasterSecret();
|
|
int tsip_generateEncryptPreMasterSecret(WOLFSSL *ssl, byte *out, word32 *outSz);
|
|
#endif
|
|
int IsTLS(const WOLFSSL* ssl)
|
|
{
|
|
if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_MINOR)
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
int IsAtLeastTLSv1_2(const WOLFSSL* ssl)
|
|
{
|
|
if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_2_MINOR)
|
|
return 1;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->version.major == DTLS_MAJOR && ssl->version.minor <= DTLSv1_2_MINOR)
|
|
return 1;
|
|
#endif
|
|
|
|
return 0;
|
|
}
|
|
|
|
int IsAtLeastTLSv1_3(const ProtocolVersion pv)
|
|
{
|
|
return (pv.major == SSLv3_MAJOR && pv.minor >= TLSv1_3_MINOR);
|
|
}
|
|
|
|
static WC_INLINE int IsEncryptionOn(WOLFSSL* ssl, int isSend)
|
|
{
|
|
#ifdef WOLFSSL_DTLS
|
|
/* For DTLS, epoch 0 is always not encrypted. */
|
|
if (ssl->options.dtls && !isSend && ssl->keys.curEpoch == 0)
|
|
return 0;
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
return ssl->keys.encryptionOn &&
|
|
(isSend ? ssl->encrypt.setup : ssl->decrypt.setup);
|
|
}
|
|
|
|
|
|
#if defined(WOLFSSL_DTLS) || !defined(WOLFSSL_NO_TLS12)
|
|
/* If SCTP is not enabled returns the state of the dtls option.
|
|
* If SCTP is enabled returns dtls && !sctp. */
|
|
static WC_INLINE int IsDtlsNotSctpMode(WOLFSSL* ssl)
|
|
{
|
|
#ifdef WOLFSSL_SCTP
|
|
return ssl->options.dtls && !ssl->options.dtlsSctp;
|
|
#else
|
|
return ssl->options.dtls;
|
|
#endif
|
|
}
|
|
#endif /* DTLS || !WOLFSSL_NO_TLS12 */
|
|
|
|
|
|
#ifdef HAVE_QSH
|
|
/* free all structs that where used with QSH */
|
|
static int QSH_FreeAll(WOLFSSL* ssl)
|
|
{
|
|
QSHKey* key = ssl->QSH_Key;
|
|
QSHKey* preKey = NULL;
|
|
QSHSecret* secret = ssl->QSH_secret;
|
|
QSHScheme* list = NULL;
|
|
QSHScheme* preList = NULL;
|
|
|
|
/* free elements in struct */
|
|
while (key) {
|
|
preKey = key;
|
|
if (key->pri.buffer) {
|
|
ForceZero(key->pri.buffer, key->pri.length);
|
|
XFREE(key->pri.buffer, ssl->heap, DYNAMIC_TYPE_PRIVATE_KEY);
|
|
}
|
|
if (key->pub.buffer)
|
|
XFREE(key->pub.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
key = (QSHKey*)key->next;
|
|
|
|
/* free struct */
|
|
XFREE(preKey, ssl->heap, DYNAMIC_TYPE_QSH);
|
|
}
|
|
|
|
|
|
/* free all of peers QSH keys */
|
|
key = ssl->peerQSHKey;
|
|
while (key) {
|
|
preKey = key;
|
|
if (key->pri.buffer) {
|
|
ForceZero(key->pri.buffer, key->pri.length);
|
|
XFREE(key->pri.buffer, ssl->heap, DYNAMIC_TYPE_PRIVATE_KEY);
|
|
}
|
|
if (key->pub.buffer)
|
|
XFREE(key->pub.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
key = (QSHKey*)key->next;
|
|
|
|
/* free struct */
|
|
XFREE(preKey, ssl->heap, DYNAMIC_TYPE_QSH);
|
|
}
|
|
key = NULL;
|
|
|
|
/* free secret information */
|
|
if (secret) {
|
|
/* free up the QSHScheme list in QSHSecret */
|
|
if (secret->list)
|
|
list = secret->list;
|
|
while (list) {
|
|
preList = list;
|
|
if (list->PK)
|
|
XFREE(list->PK, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
list = (QSHScheme*)list->next;
|
|
XFREE(preList, ssl->heap, DYNAMIC_TYPE_QSH);
|
|
}
|
|
|
|
/* free secret buffers */
|
|
if (secret->SerSi) {
|
|
if (secret->SerSi->buffer) {
|
|
/* clear extra secret material that supplemented Master Secret*/
|
|
ForceZero(secret->SerSi->buffer, secret->SerSi->length);
|
|
XFREE(secret->SerSi->buffer, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
}
|
|
XFREE(secret->SerSi, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
}
|
|
if (secret->CliSi) {
|
|
if (secret->CliSi->buffer) {
|
|
/* clear extra secret material that supplemented Master Secret*/
|
|
ForceZero(secret->CliSi->buffer, secret->CliSi->length);
|
|
XFREE(secret->CliSi->buffer, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
}
|
|
XFREE(secret->CliSi, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
}
|
|
}
|
|
XFREE(secret, ssl->heap, DYNAMIC_TYPE_QSH);
|
|
secret = NULL;
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
|
|
#ifdef HAVE_NTRU
|
|
static WOLFSSL_GLOBAL WC_RNG* rng;
|
|
static WOLFSSL_GLOBAL wolfSSL_Mutex* rngMutex;
|
|
|
|
static word32 GetEntropy(unsigned char* out, word32 num_bytes)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (rng == NULL) {
|
|
if ((rng = (WC_RNG*)XMALLOC(sizeof(WC_RNG), 0,
|
|
DYNAMIC_TYPE_RNG)) == NULL)
|
|
return DRBG_OUT_OF_MEMORY;
|
|
wc_InitRng(rng);
|
|
}
|
|
|
|
if (rngMutex == NULL) {
|
|
if ((rngMutex = (wolfSSL_Mutex*)XMALLOC(sizeof(wolfSSL_Mutex), 0,
|
|
DYNAMIC_TYPE_MUTEX)) == NULL)
|
|
return DRBG_OUT_OF_MEMORY;
|
|
wc_InitMutex(rngMutex);
|
|
}
|
|
|
|
ret |= wc_LockMutex(rngMutex);
|
|
ret |= wc_RNG_GenerateBlock(rng, out, num_bytes);
|
|
ret |= wc_UnLockMutex(rngMutex);
|
|
|
|
if (ret != 0)
|
|
return DRBG_ENTROPY_FAIL;
|
|
|
|
return DRBG_OK;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
|
|
#ifdef HAVE_LIBZ
|
|
|
|
/* alloc user allocs to work with zlib */
|
|
static void* myAlloc(void* opaque, unsigned int item, unsigned int size)
|
|
{
|
|
(void)opaque;
|
|
return (void *)XMALLOC(item * size, opaque, DYNAMIC_TYPE_LIBZ);
|
|
}
|
|
|
|
|
|
static void myFree(void* opaque, void* memory)
|
|
{
|
|
(void)opaque;
|
|
XFREE(memory, opaque, DYNAMIC_TYPE_LIBZ);
|
|
}
|
|
|
|
|
|
/* init zlib comp/decomp streams, 0 on success */
|
|
static int InitStreams(WOLFSSL* ssl)
|
|
{
|
|
ssl->c_stream.zalloc = (alloc_func)myAlloc;
|
|
ssl->c_stream.zfree = (free_func)myFree;
|
|
ssl->c_stream.opaque = (voidpf)ssl->heap;
|
|
|
|
if (deflateInit(&ssl->c_stream, Z_DEFAULT_COMPRESSION) != Z_OK)
|
|
return ZLIB_INIT_ERROR;
|
|
|
|
ssl->didStreamInit = 1;
|
|
|
|
ssl->d_stream.zalloc = (alloc_func)myAlloc;
|
|
ssl->d_stream.zfree = (free_func)myFree;
|
|
ssl->d_stream.opaque = (voidpf)ssl->heap;
|
|
|
|
if (inflateInit(&ssl->d_stream) != Z_OK) return ZLIB_INIT_ERROR;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
static void FreeStreams(WOLFSSL* ssl)
|
|
{
|
|
if (ssl->didStreamInit) {
|
|
deflateEnd(&ssl->c_stream);
|
|
inflateEnd(&ssl->d_stream);
|
|
}
|
|
}
|
|
|
|
|
|
/* compress in to out, return out size or error */
|
|
static int myCompress(WOLFSSL* ssl, byte* in, int inSz, byte* out, int outSz)
|
|
{
|
|
int err;
|
|
int currTotal = (int)ssl->c_stream.total_out;
|
|
|
|
ssl->c_stream.next_in = in;
|
|
ssl->c_stream.avail_in = inSz;
|
|
ssl->c_stream.next_out = out;
|
|
ssl->c_stream.avail_out = outSz;
|
|
|
|
err = deflate(&ssl->c_stream, Z_SYNC_FLUSH);
|
|
if (err != Z_OK && err != Z_STREAM_END) return ZLIB_COMPRESS_ERROR;
|
|
|
|
return (int)ssl->c_stream.total_out - currTotal;
|
|
}
|
|
|
|
|
|
/* decompress in to out, return out size or error */
|
|
static int myDeCompress(WOLFSSL* ssl, byte* in,int inSz, byte* out,int outSz)
|
|
{
|
|
int err;
|
|
int currTotal = (int)ssl->d_stream.total_out;
|
|
|
|
ssl->d_stream.next_in = in;
|
|
ssl->d_stream.avail_in = inSz;
|
|
ssl->d_stream.next_out = out;
|
|
ssl->d_stream.avail_out = outSz;
|
|
|
|
err = inflate(&ssl->d_stream, Z_SYNC_FLUSH);
|
|
if (err != Z_OK && err != Z_STREAM_END) return ZLIB_DECOMPRESS_ERROR;
|
|
|
|
return (int)ssl->d_stream.total_out - currTotal;
|
|
}
|
|
|
|
#endif /* HAVE_LIBZ */
|
|
|
|
|
|
#ifdef WOLFSSL_SESSION_EXPORT
|
|
#ifdef WOLFSSL_DTLS
|
|
/* serializes the cipher specs struct for exporting */
|
|
static int ExportCipherSpecState(WOLFSSL* ssl, byte* exp, word32 len, byte ver)
|
|
{
|
|
word32 idx = 0;
|
|
CipherSpecs* specs;
|
|
|
|
WOLFSSL_ENTER("ExportCipherSpecState");
|
|
|
|
if (exp == NULL || ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
specs= &(ssl->specs);
|
|
|
|
if (DTLS_EXPORT_SPC_SZ > len) {
|
|
return BUFFER_E;
|
|
}
|
|
|
|
XMEMSET(exp, 0, DTLS_EXPORT_SPC_SZ);
|
|
|
|
c16toa(specs->key_size, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(specs->iv_size, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(specs->block_size, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(specs->aead_mac_size, exp + idx); idx += OPAQUE16_LEN;
|
|
exp[idx++] = specs->bulk_cipher_algorithm;
|
|
exp[idx++] = specs->cipher_type;
|
|
exp[idx++] = specs->mac_algorithm;
|
|
exp[idx++] = specs->kea;
|
|
exp[idx++] = specs->sig_algo;
|
|
exp[idx++] = specs->hash_size;
|
|
exp[idx++] = specs->pad_size;
|
|
exp[idx++] = specs->static_ecdh;
|
|
|
|
if (idx != DTLS_EXPORT_SPC_SZ) {
|
|
WOLFSSL_MSG("DTLS_EXPORT_SPC_SZ needs updated and export version");
|
|
return DTLS_EXPORT_VER_E;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("ExportCipherSpecState", idx);
|
|
(void)ver;
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* serializes the key struct for exporting */
|
|
static int ExportKeyState(WOLFSSL* ssl, byte* exp, word32 len, byte ver,
|
|
byte small)
|
|
{
|
|
word32 idx = 0;
|
|
byte sz;
|
|
Keys* keys;
|
|
|
|
WOLFSSL_ENTER("ExportKeyState");
|
|
|
|
if (exp == NULL || ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
keys = &(ssl->keys);
|
|
|
|
if (DTLS_EXPORT_MIN_KEY_SZ > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for minimum key struct size");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
XMEMSET(exp, 0, DTLS_EXPORT_MIN_KEY_SZ);
|
|
|
|
c32toa(keys->peer_sequence_number_hi, exp + idx); idx += OPAQUE32_LEN;
|
|
c32toa(keys->peer_sequence_number_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
c32toa(keys->sequence_number_hi, exp + idx); idx += OPAQUE32_LEN;
|
|
c32toa(keys->sequence_number_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
|
|
c16toa(keys->peerSeq[0].nextEpoch, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(keys->peerSeq[0].nextSeq_hi, exp + idx); idx += OPAQUE16_LEN;
|
|
c32toa(keys->peerSeq[0].nextSeq_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
c16toa(keys->curEpoch, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(keys->curSeq_hi, exp + idx); idx += OPAQUE16_LEN;
|
|
c32toa(keys->curSeq_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
c16toa(keys->peerSeq[0].prevSeq_hi, exp + idx); idx += OPAQUE16_LEN;
|
|
c32toa(keys->peerSeq[0].prevSeq_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
|
|
c16toa(keys->dtls_peer_handshake_number, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(keys->dtls_expected_peer_handshake_number, exp + idx);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
c16toa(keys->dtls_sequence_number_hi, exp + idx); idx += OPAQUE16_LEN;
|
|
c32toa(keys->dtls_sequence_number_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
c16toa(keys->dtls_prev_sequence_number_hi, exp + idx); idx += OPAQUE16_LEN;
|
|
c32toa(keys->dtls_prev_sequence_number_lo, exp + idx); idx += OPAQUE32_LEN;
|
|
c16toa(keys->dtls_epoch, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(keys->dtls_handshake_number, exp + idx); idx += OPAQUE16_LEN;
|
|
c32toa(keys->encryptSz, exp + idx); idx += OPAQUE32_LEN;
|
|
c32toa(keys->padSz, exp + idx); idx += OPAQUE32_LEN;
|
|
exp[idx++] = keys->encryptionOn;
|
|
exp[idx++] = keys->decryptedCur;
|
|
|
|
/* from here on the buffer needs checked because is variable length that
|
|
* can be larger than DTLS_EXPORT_MIN_KEY_SZ */
|
|
{
|
|
word32 i;
|
|
if ((OPAQUE16_LEN * 2) + idx +
|
|
(2 * (WOLFSSL_DTLS_WINDOW_WORDS * OPAQUE32_LEN)) > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for WOLFSSL_DTLS_WINDOW_WORDS");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
c16toa(WOLFSSL_DTLS_WINDOW_WORDS, exp + idx); idx += OPAQUE16_LEN;
|
|
for (i = 0; i < WOLFSSL_DTLS_WINDOW_WORDS; i++) {
|
|
c32toa(keys->peerSeq[0].window[i], exp + idx);
|
|
idx += OPAQUE32_LEN;
|
|
}
|
|
c16toa(WOLFSSL_DTLS_WINDOW_WORDS, exp + idx); idx += OPAQUE16_LEN;
|
|
for (i = 0; i < WOLFSSL_DTLS_WINDOW_WORDS; i++) {
|
|
c32toa(keys->peerSeq[0].prevWindow[i], exp + idx);
|
|
idx += OPAQUE32_LEN;
|
|
}
|
|
}
|
|
|
|
if (idx >= len) {
|
|
WOLFSSL_MSG("Buffer not large enough for truncated hmac flag");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
sz = ssl->truncated_hmac ? TRUNCATED_HMAC_SZ: ssl->specs.hash_size;
|
|
exp[idx++] = ssl->truncated_hmac;
|
|
#else
|
|
sz = ssl->specs.hash_size;
|
|
exp[idx++] = 0; /* no truncated hmac */
|
|
#endif
|
|
|
|
sz = (small)? 0: sz;
|
|
if (idx + (sz * 2) + OPAQUE8_LEN > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for MAC secret");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
exp[idx++] = sz;
|
|
if (sz > 0) {
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
XMEMCPY(exp + idx, keys->client_write_MAC_secret, sz); idx += sz;
|
|
XMEMCPY(exp + idx, keys->server_write_MAC_secret, sz); idx += sz;
|
|
#else
|
|
XMEMSET(exp + idx, 0, sz); idx += sz;
|
|
XMEMSET(exp + idx, 0, sz); idx += sz;
|
|
#endif
|
|
}
|
|
|
|
sz = (small)? 0: ssl->specs.key_size;
|
|
if (idx + (sz * 2) + OPAQUE8_LEN > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for write key");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
exp[idx++] = sz;
|
|
if (sz > 0) {
|
|
XMEMCPY(exp + idx, keys->client_write_key, sz); idx += sz;
|
|
XMEMCPY(exp + idx, keys->server_write_key, sz); idx += sz;
|
|
}
|
|
|
|
sz = (small)? 0: ssl->specs.iv_size;
|
|
if (idx + (sz * 2) + OPAQUE8_LEN + AEAD_MAX_EXP_SZ > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for IVs");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
exp[idx++] = sz;
|
|
if (sz > 0) {
|
|
XMEMCPY(exp + idx, keys->client_write_IV, sz); idx += sz;
|
|
XMEMCPY(exp + idx, keys->server_write_IV, sz); idx += sz;
|
|
}
|
|
XMEMCPY(exp + idx, keys->aead_exp_IV, AEAD_MAX_EXP_SZ);
|
|
idx += AEAD_MAX_EXP_SZ;
|
|
|
|
sz = (small)? 0: AEAD_MAX_IMP_SZ;
|
|
if (idx + (sz * 2) + OPAQUE8_LEN > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for imp IVs");
|
|
return BUFFER_E;
|
|
}
|
|
exp[idx++] = sz;
|
|
if (sz > 0) {
|
|
XMEMCPY(exp + idx, keys->aead_enc_imp_IV, sz); idx += sz;
|
|
XMEMCPY(exp + idx, keys->aead_dec_imp_IV, sz); idx += sz;
|
|
}
|
|
|
|
/* DTLS_EXPORT_KEY_SZ is max value. idx size can vary */
|
|
if (idx > DTLS_EXPORT_KEY_SZ) {
|
|
WOLFSSL_MSG("DTLS_EXPORT_KEY_SZ needs updated and export version");
|
|
return DTLS_EXPORT_VER_E;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("ExportKeyState", idx);
|
|
(void)ver;
|
|
return idx;
|
|
}
|
|
|
|
static int ImportCipherSpecState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver)
|
|
{
|
|
word32 idx = 0;
|
|
CipherSpecs* specs;
|
|
|
|
WOLFSSL_ENTER("ImportCipherSpecState");
|
|
|
|
if (exp == NULL || ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
specs= &(ssl->specs);
|
|
|
|
if (DTLS_EXPORT_SPC_SZ > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for max spec struct size");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
ato16(exp + idx, &specs->key_size); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &specs->iv_size); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &specs->block_size); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &specs->aead_mac_size); idx += OPAQUE16_LEN;
|
|
specs->bulk_cipher_algorithm = exp[idx++];
|
|
specs->cipher_type = exp[idx++];
|
|
specs->mac_algorithm = exp[idx++];
|
|
specs->kea = exp[idx++];
|
|
specs->sig_algo = exp[idx++];
|
|
specs->hash_size = exp[idx++];
|
|
specs->pad_size = exp[idx++];
|
|
specs->static_ecdh = exp[idx++];
|
|
|
|
WOLFSSL_LEAVE("ImportCipherSpecState", idx);
|
|
(void)ver;
|
|
return idx;
|
|
}
|
|
|
|
|
|
static int ImportKeyState(WOLFSSL* ssl, const byte* exp, word32 len, byte ver)
|
|
{
|
|
word32 idx = 0;
|
|
byte sz;
|
|
Keys* keys;
|
|
|
|
WOLFSSL_ENTER("ImportKeyState");
|
|
|
|
if (exp == NULL || ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
keys = &(ssl->keys);
|
|
|
|
/* check minimum length -- includes byte used for size indicators */
|
|
if (len < DTLS_EXPORT_MIN_KEY_SZ) {
|
|
WOLFSSL_MSG("Buffer not large enough for minimum expected size");
|
|
return BUFFER_E;
|
|
}
|
|
ato32(exp + idx, &keys->peer_sequence_number_hi); idx += OPAQUE32_LEN;
|
|
ato32(exp + idx, &keys->peer_sequence_number_lo); idx += OPAQUE32_LEN;
|
|
ato32(exp + idx, &keys->sequence_number_hi); idx += OPAQUE32_LEN;
|
|
ato32(exp + idx, &keys->sequence_number_lo); idx += OPAQUE32_LEN;
|
|
|
|
ato16(exp + idx, &keys->peerSeq[0].nextEpoch); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &keys->peerSeq[0].nextSeq_hi); idx += OPAQUE16_LEN;
|
|
ato32(exp + idx, &keys->peerSeq[0].nextSeq_lo); idx += OPAQUE32_LEN;
|
|
ato16(exp + idx, &keys->curEpoch); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &keys->curSeq_hi); idx += OPAQUE16_LEN;
|
|
ato32(exp + idx, &keys->curSeq_lo); idx += OPAQUE32_LEN;
|
|
ato16(exp + idx, &keys->peerSeq[0].prevSeq_hi); idx += OPAQUE16_LEN;
|
|
ato32(exp + idx, &keys->peerSeq[0].prevSeq_lo); idx += OPAQUE32_LEN;
|
|
|
|
ato16(exp + idx, &keys->dtls_peer_handshake_number); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &keys->dtls_expected_peer_handshake_number);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
ato16(exp + idx, &keys->dtls_sequence_number_hi); idx += OPAQUE16_LEN;
|
|
ato32(exp + idx, &keys->dtls_sequence_number_lo); idx += OPAQUE32_LEN;
|
|
ato16(exp + idx, &keys->dtls_prev_sequence_number_hi); idx += OPAQUE16_LEN;
|
|
ato32(exp + idx, &keys->dtls_prev_sequence_number_lo); idx += OPAQUE32_LEN;
|
|
ato16(exp + idx, &keys->dtls_epoch); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &keys->dtls_handshake_number); idx += OPAQUE16_LEN;
|
|
ato32(exp + idx, &keys->encryptSz); idx += OPAQUE32_LEN;
|
|
ato32(exp + idx, &keys->padSz); idx += OPAQUE32_LEN;
|
|
keys->encryptionOn = exp[idx++];
|
|
keys->decryptedCur = exp[idx++];
|
|
|
|
{
|
|
word16 i, wordCount, wordAdj = 0;
|
|
|
|
/* do window */
|
|
ato16(exp + idx, &wordCount);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
if (wordCount > WOLFSSL_DTLS_WINDOW_WORDS) {
|
|
wordCount = WOLFSSL_DTLS_WINDOW_WORDS;
|
|
wordAdj = (WOLFSSL_DTLS_WINDOW_WORDS - wordCount) * sizeof(word32);
|
|
}
|
|
|
|
XMEMSET(keys->peerSeq[0].window, 0xFF, DTLS_SEQ_SZ);
|
|
for (i = 0; i < wordCount; i++) {
|
|
ato32(exp + idx, &keys->peerSeq[0].window[i]);
|
|
idx += OPAQUE32_LEN;
|
|
}
|
|
idx += wordAdj;
|
|
|
|
/* do prevWindow */
|
|
ato16(exp + idx, &wordCount);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
if (wordCount > WOLFSSL_DTLS_WINDOW_WORDS) {
|
|
wordCount = WOLFSSL_DTLS_WINDOW_WORDS;
|
|
wordAdj = (WOLFSSL_DTLS_WINDOW_WORDS - wordCount) * sizeof(word32);
|
|
}
|
|
|
|
XMEMSET(keys->peerSeq[0].prevWindow, 0xFF, DTLS_SEQ_SZ);
|
|
for (i = 0; i < wordCount; i++) {
|
|
ato32(exp + idx, &keys->peerSeq[0].prevWindow[i]);
|
|
idx += OPAQUE32_LEN;
|
|
}
|
|
idx += wordAdj;
|
|
|
|
}
|
|
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
ssl->truncated_hmac = exp[idx++];
|
|
#else
|
|
idx++; /* no truncated hmac */
|
|
#endif
|
|
sz = exp[idx++];
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (sz > sizeof(keys->client_write_MAC_secret) || (sz * 2) + idx > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for MAC import");
|
|
return BUFFER_E;
|
|
}
|
|
if (sz > 0) {
|
|
XMEMCPY(keys->client_write_MAC_secret, exp + idx, sz); idx += sz;
|
|
XMEMCPY(keys->server_write_MAC_secret, exp + idx, sz); idx += sz;
|
|
}
|
|
#else
|
|
if (sz + idx > len) {
|
|
return BUFFER_E;
|
|
}
|
|
idx += sz; idx += sz;
|
|
#endif
|
|
|
|
sz = exp[idx++];
|
|
if (sz > sizeof(keys->client_write_key) || (sz * 2) + idx > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for key import");
|
|
return BUFFER_E;
|
|
}
|
|
if (sz > 0) {
|
|
XMEMCPY(keys->client_write_key, exp + idx, sz); idx += sz;
|
|
XMEMCPY(keys->server_write_key, exp + idx, sz); idx += sz;
|
|
}
|
|
|
|
sz = exp[idx++];
|
|
if (sz > sizeof(keys->client_write_IV) || (sz * 2) + idx > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for write IV import");
|
|
return BUFFER_E;
|
|
}
|
|
if (sz > 0) {
|
|
XMEMCPY(keys->client_write_IV, exp + idx, sz); idx += sz;
|
|
XMEMCPY(keys->server_write_IV, exp + idx, sz); idx += sz;
|
|
}
|
|
XMEMCPY(keys->aead_exp_IV, exp + idx, AEAD_MAX_EXP_SZ);
|
|
idx += AEAD_MAX_EXP_SZ;
|
|
|
|
sz = exp[idx++];
|
|
if (sz > sizeof(keys->aead_enc_imp_IV) || (sz * 2) + idx > len) {
|
|
WOLFSSL_MSG("Buffer not large enough for imp IV import");
|
|
return BUFFER_E;
|
|
}
|
|
if (sz > 0) {
|
|
XMEMCPY(keys->aead_enc_imp_IV, exp + idx, sz); idx += sz;
|
|
XMEMCPY(keys->aead_dec_imp_IV, exp + idx, sz); idx += sz;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("ImportKeyState", idx);
|
|
(void)ver;
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* copy over necessary information from Options struct to buffer
|
|
* On success returns size of buffer used on failure returns a negative value */
|
|
static int dtls_export_new(WOLFSSL* ssl, byte* exp, word32 len, byte ver)
|
|
{
|
|
int idx = 0;
|
|
word16 zero = 0;
|
|
Options* options = &ssl->options;
|
|
|
|
WOLFSSL_ENTER("dtls_export_new");
|
|
|
|
if (exp == NULL || options == NULL || len < DTLS_EXPORT_OPT_SZ) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
XMEMSET(exp, 0, DTLS_EXPORT_OPT_SZ);
|
|
|
|
/* these options are kept and sent to indicate verify status and strength
|
|
* of handshake */
|
|
exp[idx++] = options->sendVerify;
|
|
exp[idx++] = options->verifyPeer;
|
|
exp[idx++] = options->verifyNone;
|
|
exp[idx++] = options->downgrade;
|
|
#ifndef NO_DH
|
|
c16toa(options->minDhKeySz, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(options->maxDhKeySz, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(options->dhKeySz, exp + idx); idx += OPAQUE16_LEN;
|
|
#else
|
|
c16toa(zero, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(zero, exp + idx); idx += OPAQUE16_LEN;
|
|
c16toa(zero, exp + idx); idx += OPAQUE16_LEN;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
c16toa((word16)(options->minRsaKeySz), exp + idx); idx += OPAQUE16_LEN;
|
|
#else
|
|
c16toa(zero, exp + idx); idx += OPAQUE16_LEN;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
c16toa((word16)(options->minEccKeySz), exp + idx); idx += OPAQUE16_LEN;
|
|
#else
|
|
c16toa(zero, exp + idx); idx += OPAQUE16_LEN;
|
|
#endif
|
|
|
|
/* these options are kept to indicate state and behavior */
|
|
#ifndef NO_PSK
|
|
exp[idx++] = options->havePSK;
|
|
#else
|
|
exp[idx++] = 0;
|
|
#endif
|
|
exp[idx++] = options->sessionCacheOff;
|
|
exp[idx++] = options->sessionCacheFlushOff;
|
|
exp[idx++] = options->side;
|
|
exp[idx++] = options->resuming;
|
|
exp[idx++] = options->haveSessionId;
|
|
exp[idx++] = options->tls;
|
|
exp[idx++] = options->tls1_1;
|
|
exp[idx++] = options->dtls;
|
|
exp[idx++] = options->connReset;
|
|
exp[idx++] = options->isClosed;
|
|
exp[idx++] = options->closeNotify;
|
|
exp[idx++] = options->sentNotify;
|
|
exp[idx++] = options->usingCompression;
|
|
exp[idx++] = options->haveRSA;
|
|
exp[idx++] = options->haveECC;
|
|
exp[idx++] = options->haveDH;
|
|
exp[idx++] = options->haveNTRU;
|
|
exp[idx++] = options->haveQSH;
|
|
exp[idx++] = options->haveECDSAsig;
|
|
exp[idx++] = options->haveStaticECC;
|
|
exp[idx++] = options->havePeerVerify;
|
|
exp[idx++] = options->usingPSK_cipher;
|
|
exp[idx++] = options->usingAnon_cipher;
|
|
exp[idx++] = options->sendAlertState;
|
|
exp[idx++] = options->partialWrite;
|
|
exp[idx++] = options->quietShutdown;
|
|
exp[idx++] = options->groupMessages;
|
|
#ifdef HAVE_POLY1305
|
|
exp[idx++] = options->oldPoly;
|
|
#else
|
|
exp[idx++] = 0;
|
|
#endif
|
|
#ifdef HAVE_ANON
|
|
exp[idx++] = options->haveAnon;
|
|
#else
|
|
exp[idx++] = 0;
|
|
#endif
|
|
#ifdef HAVE_SESSION_TICKET
|
|
exp[idx++] = options->createTicket;
|
|
exp[idx++] = options->useTicket;
|
|
exp[idx++] = options->noTicketTls12;
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ver > DTLS_EXPORT_VERSION_3) {
|
|
exp[idx++] = options->noTicketTls13;
|
|
}
|
|
#else
|
|
if (ver > DTLS_EXPORT_VERSION_3) {
|
|
exp[idx++] = 0;
|
|
}
|
|
#endif
|
|
#else
|
|
exp[idx++] = 0;
|
|
exp[idx++] = 0;
|
|
if (ver > DTLS_EXPORT_VERSION_3) {
|
|
exp[idx++] = 0;
|
|
}
|
|
#endif
|
|
exp[idx++] = options->processReply;
|
|
exp[idx++] = options->cipherSuite0;
|
|
exp[idx++] = options->cipherSuite;
|
|
exp[idx++] = options->serverState;
|
|
exp[idx++] = options->clientState;
|
|
exp[idx++] = options->handShakeState;
|
|
exp[idx++] = options->handShakeDone;
|
|
exp[idx++] = options->minDowngrade;
|
|
exp[idx++] = options->connectState;
|
|
exp[idx++] = options->acceptState;
|
|
exp[idx++] = options->asyncState;
|
|
|
|
/* version of connection */
|
|
exp[idx++] = ssl->version.major;
|
|
exp[idx++] = ssl->version.minor;
|
|
|
|
(void)zero;
|
|
|
|
/* check if changes were made and notify of need to update export version */
|
|
switch (ver) {
|
|
case DTLS_EXPORT_VERSION_3:
|
|
if (idx != DTLS_EXPORT_OPT_SZ_3) {
|
|
WOLFSSL_MSG("Update DTLS_EXPORT_OPT_SZ and version of export");
|
|
return DTLS_EXPORT_VER_E;
|
|
}
|
|
break;
|
|
|
|
case DTLS_EXPORT_VERSION:
|
|
if (idx != DTLS_EXPORT_OPT_SZ) {
|
|
WOLFSSL_MSG("Update DTLS_EXPORT_OPT_SZ and version of export");
|
|
return DTLS_EXPORT_VER_E;
|
|
}
|
|
break;
|
|
|
|
default:
|
|
WOLFSSL_MSG("New version case needs added to wolfSSL export");
|
|
return DTLS_EXPORT_VER_E;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("dtls_export_new", idx);
|
|
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* copy items from Export struct to Options struct
|
|
* On success returns size of buffer used on failure returns a negative value */
|
|
static int dtls_export_load(WOLFSSL* ssl, const byte* exp, word32 len, byte ver)
|
|
{
|
|
int idx = 0;
|
|
Options* options = &ssl->options;
|
|
|
|
switch (ver) {
|
|
case DTLS_EXPORT_VERSION:
|
|
if (len < DTLS_EXPORT_OPT_SZ) {
|
|
WOLFSSL_MSG("Sanity check on buffer size failed");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
break;
|
|
|
|
case DTLS_EXPORT_VERSION_3:
|
|
if (len < DTLS_EXPORT_OPT_SZ_3) {
|
|
WOLFSSL_MSG("Sanity check on buffer size failed");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
break;
|
|
|
|
default:
|
|
WOLFSSL_MSG("Export version not supported");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (exp == NULL || options == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
|
|
/* these options are kept and sent to indicate verify status and strength
|
|
* of handshake */
|
|
options->sendVerify = exp[idx++];
|
|
options->verifyPeer = exp[idx++];
|
|
options->verifyNone = exp[idx++];
|
|
options->downgrade = exp[idx++];
|
|
#ifndef NO_DH
|
|
ato16(exp + idx, &(options->minDhKeySz)); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &(options->maxDhKeySz)); idx += OPAQUE16_LEN;
|
|
ato16(exp + idx, &(options->dhKeySz)); idx += OPAQUE16_LEN;
|
|
#else
|
|
idx += OPAQUE16_LEN;
|
|
idx += OPAQUE16_LEN;
|
|
idx += OPAQUE16_LEN;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
ato16(exp + idx, (word16*)&(options->minRsaKeySz)); idx += OPAQUE16_LEN;
|
|
#else
|
|
idx += OPAQUE16_LEN;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
ato16(exp + idx, (word16*)&(options->minEccKeySz)); idx += OPAQUE16_LEN;
|
|
#else
|
|
idx += OPAQUE16_LEN;
|
|
#endif
|
|
|
|
/* these options are kept to indicate state and behavior */
|
|
#ifndef NO_PSK
|
|
options->havePSK = exp[idx++];
|
|
#else
|
|
idx++;
|
|
#endif
|
|
options->sessionCacheOff = exp[idx++];
|
|
options->sessionCacheFlushOff = exp[idx++];
|
|
options->side = exp[idx++];
|
|
options->resuming = exp[idx++];
|
|
options->haveSessionId = exp[idx++];
|
|
options->tls = exp[idx++];
|
|
options->tls1_1 = exp[idx++];
|
|
options->dtls = exp[idx++];
|
|
options->connReset = exp[idx++];
|
|
options->isClosed = exp[idx++];
|
|
options->closeNotify = exp[idx++];
|
|
options->sentNotify = exp[idx++];
|
|
options->usingCompression = exp[idx++];
|
|
options->haveRSA = exp[idx++];
|
|
options->haveECC = exp[idx++];
|
|
options->haveDH = exp[idx++];
|
|
options->haveNTRU = exp[idx++];
|
|
options->haveQSH = exp[idx++];
|
|
options->haveECDSAsig = exp[idx++];
|
|
options->haveStaticECC = exp[idx++];
|
|
options->havePeerVerify = exp[idx++];
|
|
options->usingPSK_cipher = exp[idx++];
|
|
options->usingAnon_cipher = exp[idx++];
|
|
options->sendAlertState = exp[idx++];
|
|
options->partialWrite = exp[idx++];
|
|
options->quietShutdown = exp[idx++];
|
|
options->groupMessages = exp[idx++];
|
|
#ifdef HAVE_POLY1305
|
|
options->oldPoly = exp[idx++]; /* set when to use old rfc way of poly*/
|
|
#else
|
|
idx++;
|
|
#endif
|
|
#ifdef HAVE_ANON
|
|
options->haveAnon = exp[idx++]; /* User wants to allow Anon suites */
|
|
#else
|
|
idx++;
|
|
#endif
|
|
#ifdef HAVE_SESSION_TICKET
|
|
options->createTicket = exp[idx++]; /* Server to create new Ticket */
|
|
options->useTicket = exp[idx++]; /* Use Ticket not session cache */
|
|
options->noTicketTls12 = exp[idx++]; /* Server won't create new Ticket */
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ver > DTLS_EXPORT_VERSION_3) {
|
|
options->noTicketTls13 = exp[idx++];/* Server won't create new Ticket */
|
|
}
|
|
#else
|
|
if (ver > DTLS_EXPORT_VERSION_3) {
|
|
exp[idx++] = 0;
|
|
}
|
|
#endif
|
|
#else
|
|
idx++;
|
|
idx++;
|
|
if (ver > DTLS_EXPORT_VERSION_3) {
|
|
idx++;
|
|
}
|
|
#endif
|
|
options->processReply = exp[idx++];
|
|
options->cipherSuite0 = exp[idx++];
|
|
options->cipherSuite = exp[idx++];
|
|
options->serverState = exp[idx++];
|
|
options->clientState = exp[idx++];
|
|
options->handShakeState = exp[idx++];
|
|
options->handShakeDone = exp[idx++];
|
|
options->minDowngrade = exp[idx++];
|
|
options->connectState = exp[idx++];
|
|
options->acceptState = exp[idx++];
|
|
options->asyncState = exp[idx++];
|
|
|
|
/* version of connection */
|
|
if (ssl->version.major != exp[idx++] || ssl->version.minor != exp[idx++]) {
|
|
WOLFSSL_MSG("Version mismatch ie DTLS v1 vs v1.2");
|
|
return VERSION_ERROR;
|
|
}
|
|
|
|
return idx;
|
|
}
|
|
|
|
#ifndef WOLFSSL_SESSION_EXPORT_NOPEER
|
|
static int ExportPeerInfo(WOLFSSL* ssl, byte* exp, word32 len, byte ver)
|
|
{
|
|
int idx = 0;
|
|
int ipSz = DTLS_EXPORT_IP; /* start as max size */
|
|
int fam = 0;
|
|
word16 port = 0;
|
|
char ip[DTLS_EXPORT_IP];
|
|
|
|
if (ver != DTLS_EXPORT_VERSION) {
|
|
WOLFSSL_MSG("Export version not supported");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (ssl == NULL || exp == NULL || len < sizeof(ip) + 3 * DTLS_EXPORT_LEN) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (ssl->ctx->CBGetPeer == NULL) {
|
|
WOLFSSL_MSG("No get peer call back set");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
if (ssl->ctx->CBGetPeer(ssl, ip, &ipSz, &port, &fam) != WOLFSSL_SUCCESS) {
|
|
WOLFSSL_MSG("Get peer callback error");
|
|
return SOCKET_ERROR_E;
|
|
}
|
|
|
|
/* check that ipSz/fam is not negative or too large since user can set cb */
|
|
if (ipSz < 0 || ipSz > DTLS_EXPORT_IP || fam < 0) {
|
|
WOLFSSL_MSG("Bad ipSz or fam returned from get peer callback");
|
|
return SOCKET_ERROR_E;
|
|
}
|
|
|
|
c16toa((word16)fam, exp + idx); idx += DTLS_EXPORT_LEN;
|
|
c16toa((word16)ipSz, exp + idx); idx += DTLS_EXPORT_LEN;
|
|
XMEMCPY(exp + idx, ip, ipSz); idx += ipSz;
|
|
c16toa(port, exp + idx); idx += DTLS_EXPORT_LEN;
|
|
|
|
return idx;
|
|
}
|
|
#endif /* !WOLFSSL_SESSION_EXPORT_NOPEER */
|
|
|
|
|
|
static int ImportPeerInfo(WOLFSSL* ssl, const byte* buf, word32 len, byte ver)
|
|
{
|
|
word16 idx = 0;
|
|
word16 ipSz;
|
|
word16 fam;
|
|
word16 port;
|
|
char ip[DTLS_EXPORT_IP];
|
|
|
|
if (ver != DTLS_EXPORT_VERSION && ver != DTLS_EXPORT_VERSION_3) {
|
|
WOLFSSL_MSG("Export version not supported");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (len == 0) {
|
|
WOLFSSL_MSG("No peer info sent");
|
|
return 0;
|
|
}
|
|
|
|
if (ssl == NULL || buf == NULL || len < 3 * DTLS_EXPORT_LEN) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* import sin family */
|
|
ato16(buf + idx, &fam); idx += DTLS_EXPORT_LEN;
|
|
|
|
/* import ip address idx, and ipSz are unsigned but cast for enum */
|
|
ato16(buf + idx, &ipSz); idx += DTLS_EXPORT_LEN;
|
|
if (ipSz >= sizeof(ip) || (word16)(idx + ipSz + DTLS_EXPORT_LEN) > len) {
|
|
return BUFFER_E;
|
|
}
|
|
XMEMSET(ip, 0, sizeof(ip));
|
|
XMEMCPY(ip, buf + idx, ipSz); idx += ipSz;
|
|
ip[ipSz] = '\0'; /* with check that ipSz less than ip this is valid */
|
|
ato16(buf + idx, &port); idx += DTLS_EXPORT_LEN;
|
|
|
|
/* sanity check for a function to call, then use it to import peer info */
|
|
if (ssl->ctx->CBSetPeer == NULL) {
|
|
WOLFSSL_MSG("No set peer function");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
if (ssl->ctx->CBSetPeer(ssl, ip, ipSz, port, fam) != WOLFSSL_SUCCESS) {
|
|
WOLFSSL_MSG("Error setting peer info");
|
|
return SOCKET_ERROR_E;
|
|
}
|
|
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* WOLFSSL_LOCAL function that serializes the current WOLFSSL session state only
|
|
* buf is used to hold the serialized WOLFSSL struct and sz is the size of buf
|
|
* passed in.
|
|
* On success returns the size of serialized session state.*/
|
|
int wolfSSL_dtls_export_state_internal(WOLFSSL* ssl, byte* buf, word32 sz)
|
|
{
|
|
int ret;
|
|
word32 idx = 0;
|
|
word32 totalLen = 0;
|
|
|
|
WOLFSSL_ENTER("wolfSSL_dtls_export_state_internal");
|
|
|
|
if (buf == NULL || ssl == NULL) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_state_internal", BAD_FUNC_ARG);
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
totalLen += DTLS_EXPORT_LEN * 2; /* 2 protocol bytes and 2 length bytes */
|
|
/* each of the following have a 2 byte length before data */
|
|
totalLen += DTLS_EXPORT_LEN + DTLS_EXPORT_MIN_KEY_SZ;
|
|
if (totalLen > sz) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_state_internal", BUFFER_E);
|
|
return BUFFER_E;
|
|
}
|
|
|
|
buf[idx++] = (byte)DTLS_EXPORT_STATE_PRO;
|
|
buf[idx++] = ((byte)DTLS_EXPORT_STATE_PRO & 0xF0) |
|
|
((byte)DTLS_EXPORT_VERSION & 0X0F);
|
|
idx += DTLS_EXPORT_LEN; /* leave room for total length */
|
|
|
|
/* export keys struct and dtls state -- variable length stored in ret */
|
|
idx += DTLS_EXPORT_LEN; /* leave room for length */
|
|
if ((ret = ExportKeyState(ssl, buf + idx, sz - idx,
|
|
DTLS_EXPORT_VERSION, 1)) < 0) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_state_internal", ret);
|
|
return ret;
|
|
}
|
|
c16toa((word16)ret, buf + idx - DTLS_EXPORT_LEN); idx += ret;
|
|
|
|
/* place total length of exported buffer minus 2 bytes protocol/version */
|
|
c16toa((word16)(idx - DTLS_EXPORT_LEN), buf + DTLS_EXPORT_LEN);
|
|
|
|
#ifdef WOLFSSL_SESSION_EXPORT_DEBUG
|
|
/* if compiled with debug options then print the version, protocol, size */
|
|
{
|
|
char debug[256];
|
|
XSNPRINTF(debug, sizeof(debug), "Exporting DTLS session state\n"
|
|
"\tVersion : %d\n\tProtocol : %02X%01X\n\tLength of: %d\n\n"
|
|
, (int)DTLS_EXPORT_VERSION, buf[0], (buf[1] >> 4), idx - 2);
|
|
WOLFSSL_MSG(debug);
|
|
}
|
|
#endif /* WOLFSSL_SESSION_EXPORT_DEBUG */
|
|
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_state_internal", idx);
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* WOLFSSL_LOCAL function that serializes the current WOLFSSL session
|
|
* buf is used to hold the serialized WOLFSSL struct and sz is the size of buf
|
|
* passed in.
|
|
* On success returns the size of serialized session.*/
|
|
int wolfSSL_dtls_export_internal(WOLFSSL* ssl, byte* buf, word32 sz)
|
|
{
|
|
int ret;
|
|
word32 idx = 0;
|
|
word32 totalLen = 0;
|
|
|
|
WOLFSSL_ENTER("wolfSSL_dtls_export_internal");
|
|
|
|
if (buf == NULL || ssl == NULL) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", BAD_FUNC_ARG);
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
totalLen += DTLS_EXPORT_LEN * 2; /* 2 protocol bytes and 2 length bytes */
|
|
/* each of the following have a 2 byte length before data */
|
|
totalLen += DTLS_EXPORT_LEN + DTLS_EXPORT_OPT_SZ;
|
|
totalLen += DTLS_EXPORT_LEN + DTLS_EXPORT_KEY_SZ;
|
|
totalLen += DTLS_EXPORT_LEN + DTLS_EXPORT_SPC_SZ;
|
|
totalLen += DTLS_EXPORT_LEN + ssl->buffers.dtlsCtx.peer.sz;
|
|
|
|
if (totalLen > sz) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", BUFFER_E);
|
|
return BUFFER_E;
|
|
}
|
|
|
|
buf[idx++] = (byte)DTLS_EXPORT_PRO;
|
|
buf[idx++] = ((byte)DTLS_EXPORT_PRO & 0xF0) |
|
|
((byte)DTLS_EXPORT_VERSION & 0X0F);
|
|
|
|
idx += DTLS_EXPORT_LEN; /* leave spot for length */
|
|
|
|
c16toa((word16)DTLS_EXPORT_OPT_SZ, buf + idx); idx += DTLS_EXPORT_LEN;
|
|
if ((ret = dtls_export_new(ssl, buf + idx, sz - idx,
|
|
DTLS_EXPORT_VERSION)) < 0) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", ret);
|
|
return ret;
|
|
}
|
|
idx += ret;
|
|
|
|
/* export keys struct and dtls state -- variable length stored in ret */
|
|
idx += DTLS_EXPORT_LEN; /* leave room for length */
|
|
if ((ret = ExportKeyState(ssl, buf + idx, sz - idx,
|
|
DTLS_EXPORT_VERSION, 0)) < 0) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", ret);
|
|
return ret;
|
|
}
|
|
c16toa((word16)ret, buf + idx - DTLS_EXPORT_LEN); idx += ret;
|
|
|
|
/* export of cipher specs struct */
|
|
c16toa((word16)DTLS_EXPORT_SPC_SZ, buf + idx); idx += DTLS_EXPORT_LEN;
|
|
if ((ret = ExportCipherSpecState(ssl, buf + idx, sz - idx,
|
|
DTLS_EXPORT_VERSION)) < 0) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", ret);
|
|
return ret;
|
|
}
|
|
idx += ret;
|
|
|
|
/* export of dtls peer information */
|
|
idx += DTLS_EXPORT_LEN;
|
|
#ifdef WOLFSSL_SESSION_EXPORT_NOPEER
|
|
ret = 0; /* not saving peer port/ip information */
|
|
#else
|
|
if ((ret = ExportPeerInfo(ssl, buf + idx, sz - idx,
|
|
DTLS_EXPORT_VERSION)) < 0) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", ret);
|
|
return ret;
|
|
}
|
|
#endif
|
|
c16toa(ret, buf + idx - DTLS_EXPORT_LEN);
|
|
idx += ret;
|
|
|
|
/* place total length of exported buffer minus 2 bytes protocol/version */
|
|
c16toa((word16)(idx - DTLS_EXPORT_LEN), buf + DTLS_EXPORT_LEN);
|
|
|
|
/* if compiled with debug options then print the version, protocol, size */
|
|
#ifdef WOLFSSL_SESSION_EXPORT_DEBUG
|
|
{
|
|
char debug[256];
|
|
XSNPRINTF(debug, sizeof(debug), "Exporting DTLS session\n"
|
|
"\tVersion : %d\n\tProtocol : %02X%01X\n\tLength of: %d\n\n"
|
|
, (int)DTLS_EXPORT_VERSION, buf[0], (buf[1] >> 4), idx - 2);
|
|
WOLFSSL_MSG(debug);
|
|
}
|
|
#endif /* WOLFSSL_SESSION_EXPORT_DEBUG */
|
|
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_export_internal", idx);
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* On success return amount of buffer consumed */
|
|
int wolfSSL_dtls_import_state_internal(WOLFSSL* ssl, const byte* buf, word32 sz)
|
|
{
|
|
word32 idx = 0;
|
|
word16 length = 0;
|
|
int version;
|
|
int ret;
|
|
|
|
WOLFSSL_ENTER("wolfSSL_dtls_import_state_internal");
|
|
/* check at least enough room for protocol and length */
|
|
if (sz < DTLS_EXPORT_LEN * 2 || ssl == NULL) {
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_import_state_internal", BAD_FUNC_ARG);
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (buf[idx++] != (byte)DTLS_EXPORT_STATE_PRO ||
|
|
(buf[idx] & 0xF0) != ((byte)DTLS_EXPORT_PRO & 0xF0)) {
|
|
WOLFSSL_MSG("Incorrect protocol");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
version = buf[idx++] & 0x0F;
|
|
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if (length > sz - DTLS_EXPORT_LEN) { /* subtract 2 for protocol */
|
|
WOLFSSL_MSG("Buffer size sanity check failed");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
#ifdef WOLFSSL_SESSION_EXPORT_DEBUG
|
|
/* if compiled with debug options then print the version, protocol, size */
|
|
{
|
|
char debug[256];
|
|
XSNPRINTF(debug, sizeof(debug), "Importing DTLS session state\n"
|
|
"\tVersion : %d\n\tProtocol : %02X%01X\n\tLength of: %d\n\n"
|
|
, (int)version, buf[0], (buf[1] >> 4), length);
|
|
WOLFSSL_MSG(debug);
|
|
}
|
|
#endif /* WOLFSSL_SESSION_EXPORT_DEBUG */
|
|
|
|
/* perform sanity checks and extract Options information used */
|
|
switch (version) {
|
|
case DTLS_EXPORT_VERSION:
|
|
break;
|
|
|
|
default:
|
|
WOLFSSL_MSG("Bad export state version");
|
|
return BAD_FUNC_ARG;
|
|
|
|
}
|
|
|
|
/* perform sanity checks and extract Keys struct */
|
|
if (DTLS_EXPORT_LEN + idx > sz) {
|
|
WOLFSSL_MSG("Import Key struct error");
|
|
return BUFFER_E;
|
|
}
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if (length > DTLS_EXPORT_KEY_SZ || length + idx > sz) {
|
|
WOLFSSL_MSG("Import Key struct error");
|
|
return BUFFER_E;
|
|
}
|
|
if ((ret = ImportKeyState(ssl, buf + idx, length, version)) < 0) {
|
|
WOLFSSL_MSG("Import Key struct error");
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_import_state_internal", ret);
|
|
return ret;
|
|
}
|
|
idx += ret;
|
|
|
|
WOLFSSL_LEAVE("wolfSSL_dtls_import_state_internal", ret);
|
|
return idx;
|
|
}
|
|
|
|
|
|
/* On success return amount of buffer consumed */
|
|
int wolfSSL_dtls_import_internal(WOLFSSL* ssl, const byte* buf, word32 sz)
|
|
{
|
|
word32 idx = 0;
|
|
word16 length = 0;
|
|
int version;
|
|
int ret;
|
|
int optSz;
|
|
|
|
WOLFSSL_ENTER("wolfSSL_dtls_import_internal");
|
|
/* check at least enough room for protocol and length */
|
|
if (sz < DTLS_EXPORT_LEN * 2 || ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* sanity check on protocol ID and size of buffer */
|
|
if (buf[idx++] != (byte)DTLS_EXPORT_PRO ||
|
|
(buf[idx] & 0xF0) != ((byte)DTLS_EXPORT_PRO & 0xF0)) {
|
|
/* don't increment on second idx to next get version */
|
|
|
|
/* check if importing state only */
|
|
return wolfSSL_dtls_import_state_internal(ssl, buf, sz);
|
|
}
|
|
version = buf[idx++] & 0x0F;
|
|
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if (length > sz - DTLS_EXPORT_LEN) { /* subtract 2 for protocol */
|
|
return BUFFER_E;
|
|
}
|
|
|
|
/* if compiled with debug options then print the version, protocol, size */
|
|
#ifdef WOLFSSL_SESSION_EXPORT_DEBUG
|
|
{
|
|
char debug[256];
|
|
XSNPRINTF(debug, sizeof(debug), "Importing DTLS session\n"
|
|
"\tVersion : %d\n\tProtocol : %02X%01X\n\tLength of: %d\n\n"
|
|
, (int)version, buf[0], (buf[1] >> 4), length);
|
|
WOLFSSL_MSG(debug);
|
|
}
|
|
#endif /* WOLFSSL_SESSION_EXPORT_DEBUG */
|
|
|
|
/* perform sanity checks and extract Options information used */
|
|
switch (version) {
|
|
case DTLS_EXPORT_VERSION:
|
|
optSz = DTLS_EXPORT_OPT_SZ;
|
|
break;
|
|
|
|
case DTLS_EXPORT_VERSION_3:
|
|
WOLFSSL_MSG("Importing older version 3");
|
|
optSz = DTLS_EXPORT_OPT_SZ_3;
|
|
break;
|
|
|
|
default:
|
|
WOLFSSL_MSG("Bad export version");
|
|
return BAD_FUNC_ARG;
|
|
|
|
}
|
|
|
|
if (DTLS_EXPORT_LEN + optSz + idx > sz) {
|
|
WOLFSSL_MSG("Import Options struct error");
|
|
return BUFFER_E;
|
|
}
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if (length != optSz) {
|
|
WOLFSSL_MSG("Import Options struct error");
|
|
return BUFFER_E;
|
|
}
|
|
if ((ret = dtls_export_load(ssl, buf + idx, length, version)) < 0) {
|
|
WOLFSSL_MSG("Import Options struct error");
|
|
return ret;
|
|
}
|
|
idx += length;
|
|
|
|
/* perform sanity checks and extract Keys struct */
|
|
if (DTLS_EXPORT_LEN + idx > sz) {
|
|
WOLFSSL_MSG("Import Key struct error");
|
|
return BUFFER_E;
|
|
}
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if (length > DTLS_EXPORT_KEY_SZ || length + idx > sz) {
|
|
WOLFSSL_MSG("Import Key struct error");
|
|
return BUFFER_E;
|
|
}
|
|
if ((ret = ImportKeyState(ssl, buf + idx, length, version)) < 0) {
|
|
WOLFSSL_MSG("Import Key struct error");
|
|
return ret;
|
|
}
|
|
idx += ret;
|
|
|
|
/* perform sanity checks and extract CipherSpecs struct */
|
|
if (DTLS_EXPORT_LEN + DTLS_EXPORT_SPC_SZ + idx > sz) {
|
|
WOLFSSL_MSG("Import CipherSpecs struct error");
|
|
return BUFFER_E;
|
|
}
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if ( length != DTLS_EXPORT_SPC_SZ) {
|
|
WOLFSSL_MSG("Import CipherSpecs struct error");
|
|
return BUFFER_E;
|
|
}
|
|
if ((ret = ImportCipherSpecState(ssl, buf + idx, length, version)) < 0) {
|
|
WOLFSSL_MSG("Import CipherSpecs struct error");
|
|
return ret;
|
|
}
|
|
idx += ret;
|
|
|
|
/* perform sanity checks and extract DTLS peer info */
|
|
if (DTLS_EXPORT_LEN + idx > sz) {
|
|
WOLFSSL_MSG("Import DTLS peer info error");
|
|
return BUFFER_E;
|
|
}
|
|
ato16(buf + idx, &length); idx += DTLS_EXPORT_LEN;
|
|
if (idx + length > sz) {
|
|
WOLFSSL_MSG("Import DTLS peer info error");
|
|
return BUFFER_E;
|
|
}
|
|
if ((ret = ImportPeerInfo(ssl, buf + idx, length, version)) < 0) {
|
|
WOLFSSL_MSG("Import Peer Addr error");
|
|
return ret;
|
|
}
|
|
idx += ret;
|
|
|
|
SetKeysSide(ssl, ENCRYPT_AND_DECRYPT_SIDE);
|
|
/* make sure is a valid suite used */
|
|
if (wolfSSL_get_cipher(ssl) == NULL) {
|
|
WOLFSSL_MSG("Can not match cipher suite imported");
|
|
return MATCH_SUITE_ERROR;
|
|
}
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
/* set hmac function to use when verifying */
|
|
if (ssl->options.tls == 1 || ssl->options.tls1_1 == 1 ||
|
|
ssl->options.dtls == 1) {
|
|
ssl->hmac = TLS_hmac;
|
|
}
|
|
|
|
/* do not allow stream ciphers with DTLS, except for NULL cipher */
|
|
if (ssl->specs.cipher_type == stream &&
|
|
ssl->specs.bulk_cipher_algorithm != wolfssl_cipher_null) {
|
|
WOLFSSL_MSG("Can not import stream ciphers for DTLS");
|
|
return SANITY_CIPHER_E;
|
|
}
|
|
#endif /* !WOLFSSL_AEAD_ONLY */
|
|
|
|
return idx;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
#endif /* WOLFSSL_SESSION_EXPORT */
|
|
|
|
|
|
void InitSSL_Method(WOLFSSL_METHOD* method, ProtocolVersion pv)
|
|
{
|
|
method->version = pv;
|
|
method->side = WOLFSSL_CLIENT_END;
|
|
method->downgrade = 0;
|
|
}
|
|
|
|
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
|
|
int InitSSL_Side(WOLFSSL* ssl, word16 side)
|
|
{
|
|
if (ssl == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
/* set side */
|
|
ssl->options.side = side;
|
|
|
|
/* reset options that are side specific */
|
|
#ifdef HAVE_NTRU
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
ssl->options.haveNTRU = 1; /* always on client side */
|
|
/* server can turn on by loading key */
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
ssl->options.haveECDSAsig = 1; /* always on client side */
|
|
ssl->options.haveECC = 1; /* server turns on with ECC key cert */
|
|
ssl->options.haveStaticECC = 1; /* server can turn on by loading key */
|
|
}
|
|
#elif defined(HAVE_ED25519) || defined(HAVE_ED448)
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
ssl->options.haveECDSAsig = 1; /* always on client side */
|
|
ssl->options.haveECC = 1; /* server turns on with ECC key cert */
|
|
}
|
|
#endif
|
|
|
|
#if defined(HAVE_EXTENDED_MASTER) && !defined(NO_WOLFSSL_CLIENT)
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if ((ssl->ctx->method->version.major == SSLv3_MAJOR) &&
|
|
(ssl->ctx->method->version.minor >= TLSv1_MINOR)) {
|
|
ssl->options.haveEMS = 1;
|
|
}
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->ctx->method->version.major == DTLS_MAJOR)
|
|
ssl->options.haveEMS = 1;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
#endif /* HAVE_EXTENDED_MASTER && !NO_WOLFSSL_CLIENT */
|
|
|
|
#if defined(WOLFSSL_DTLS) && !defined(NO_WOLFSSL_SERVER)
|
|
if (ssl->options.dtls && ssl->options.side == WOLFSSL_SERVER_END) {
|
|
int ret;
|
|
ret = wolfSSL_DTLS_SetCookieSecret(ssl, NULL, 0);
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("DTLS Cookie Secret error");
|
|
return ret;
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_DTLS && !NO_WOLFSSL_SERVER */
|
|
|
|
return InitSSL_Suites(ssl);
|
|
}
|
|
#endif /* OPENSSL_EXTRA || WOLFSSL_EITHER_SIDE */
|
|
|
|
/* Initialize SSL context, return 0 on success */
|
|
int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method, void* heap)
|
|
{
|
|
int ret = 0;
|
|
|
|
XMEMSET(ctx, 0, sizeof(WOLFSSL_CTX));
|
|
|
|
ctx->method = method;
|
|
ctx->refCount = 1; /* so either CTX_free or SSL_free can release */
|
|
ctx->heap = ctx; /* defaults to self */
|
|
ctx->timeout = WOLFSSL_SESSION_TIMEOUT;
|
|
ctx->minDowngrade = WOLFSSL_MIN_DOWNGRADE; /* current default: TLSv1_MINOR */
|
|
|
|
if (wc_InitMutex(&ctx->countMutex) < 0) {
|
|
WOLFSSL_MSG("Mutex error on CTX init");
|
|
ctx->err = CTX_INIT_MUTEX_E;
|
|
return BAD_MUTEX_E;
|
|
}
|
|
|
|
#ifndef NO_CERTS
|
|
ctx->privateKeyDevId = INVALID_DEVID;
|
|
#endif
|
|
|
|
#ifndef NO_DH
|
|
ctx->minDhKeySz = MIN_DHKEY_SZ;
|
|
ctx->maxDhKeySz = MAX_DHKEY_SZ;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
ctx->minRsaKeySz = MIN_RSAKEY_SZ;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
ctx->minEccKeySz = MIN_ECCKEY_SZ;
|
|
ctx->eccTempKeySz = ECDHE_SIZE;
|
|
#endif
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ctx->verifyDepth = MAX_CHAIN_DEPTH;
|
|
#endif
|
|
#ifdef OPENSSL_EXTRA
|
|
ctx->cbioFlag = WOLFSSL_CBIO_NONE;
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_USER_IO
|
|
#ifdef MICRIUM
|
|
ctx->CBIORecv = MicriumReceive;
|
|
ctx->CBIOSend = MicriumSend;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (method->version.major == DTLS_MAJOR) {
|
|
ctx->CBIORecv = MicriumReceiveFrom;
|
|
ctx->CBIOSend = MicriumSendTo;
|
|
}
|
|
#ifdef WOLFSSL_SESSION_EXPORT
|
|
#error Micrium port does not support DTLS session export yet
|
|
#endif
|
|
#endif
|
|
#elif defined WOLFSSL_UIP
|
|
ctx->CBIORecv = uIPReceive;
|
|
ctx->CBIOSend = uIPSend;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (method->version.major == DTLS_MAJOR) {
|
|
ctx->CBIOSendTo = uIPSendTo;
|
|
ctx->CBIORecvFrom = uIPRecvFrom;
|
|
}
|
|
#endif
|
|
#else
|
|
ctx->CBIORecv = EmbedReceive;
|
|
ctx->CBIOSend = EmbedSend;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (method->version.major == DTLS_MAJOR) {
|
|
ctx->CBIORecv = EmbedReceiveFrom;
|
|
ctx->CBIOSend = EmbedSendTo;
|
|
}
|
|
#ifdef WOLFSSL_SESSION_EXPORT
|
|
ctx->CBGetPeer = EmbedGetPeer;
|
|
ctx->CBSetPeer = EmbedSetPeer;
|
|
#endif
|
|
#endif
|
|
#endif /* MICRIUM */
|
|
#endif /* WOLFSSL_USER_IO */
|
|
|
|
#ifdef HAVE_NETX
|
|
ctx->CBIORecv = NetX_Receive;
|
|
ctx->CBIOSend = NetX_Send;
|
|
#elif defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP)
|
|
ctx->CBIORecv = Mynewt_Receive;
|
|
ctx->CBIOSend = Mynewt_Send;
|
|
#elif defined(WOLFSSL_GNRC)
|
|
ctx->CBIORecv = GNRC_ReceiveFrom;
|
|
ctx->CBIOSend = GNRC_SendTo;
|
|
#endif
|
|
|
|
#ifdef HAVE_NTRU
|
|
if (method->side == WOLFSSL_CLIENT_END)
|
|
ctx->haveNTRU = 1; /* always on client side */
|
|
/* server can turn on by loading key */
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (method->side == WOLFSSL_CLIENT_END) {
|
|
ctx->haveECDSAsig = 1; /* always on client side */
|
|
ctx->haveECC = 1; /* server turns on with ECC key cert */
|
|
ctx->haveStaticECC = 1; /* server can turn on by loading key */
|
|
}
|
|
#elif defined(HAVE_ED25519) || defined(HAVE_ED448)
|
|
if (method->side == WOLFSSL_CLIENT_END) {
|
|
ctx->haveECDSAsig = 1; /* always on client side */
|
|
ctx->haveECC = 1; /* server turns on with ECC key cert */
|
|
}
|
|
#endif
|
|
|
|
ctx->devId = INVALID_DEVID;
|
|
|
|
#if defined(WOLFSSL_DTLS)
|
|
#ifdef WOLFSSL_SCTP
|
|
ctx->dtlsMtuSz = MAX_RECORD_SIZE;
|
|
#elif defined(WOLFSSL_DTLS_MTU)
|
|
ctx->dtlsMtuSz = MAX_MTU;
|
|
#endif
|
|
#endif
|
|
|
|
#ifndef NO_CERTS
|
|
ctx->cm = wolfSSL_CertManagerNew_ex(heap);
|
|
if (ctx->cm == NULL) {
|
|
WOLFSSL_MSG("Bad Cert Manager New");
|
|
return BAD_CERT_MANAGER_ERROR;
|
|
}
|
|
#ifdef OPENSSL_EXTRA
|
|
/* setup WOLFSSL_X509_STORE */
|
|
ctx->x509_store.cm = ctx->cm;
|
|
#endif
|
|
#endif
|
|
|
|
#if defined(HAVE_EXTENDED_MASTER) && !defined(NO_WOLFSSL_CLIENT)
|
|
if (method->side == WOLFSSL_CLIENT_END) {
|
|
if ((method->version.major == SSLv3_MAJOR) &&
|
|
(method->version.minor >= TLSv1_MINOR)) {
|
|
|
|
ctx->haveEMS = 1;
|
|
}
|
|
#ifdef WOLFSSL_DTLS
|
|
if (method->version.major == DTLS_MAJOR)
|
|
ctx->haveEMS = 1;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
#endif /* HAVE_EXTENDED_MASTER && !NO_WOLFSSL_CLIENT */
|
|
|
|
#if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER)
|
|
#ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB
|
|
ret = TicketEncCbCtx_Init(ctx, &ctx->ticketKeyCtx);
|
|
if (ret != 0) return ret;
|
|
ctx->ticketEncCb = DefTicketEncCb;
|
|
ctx->ticketEncCtx = (void*)&ctx->ticketKeyCtx;
|
|
#endif
|
|
ctx->ticketHint = SESSION_TICKET_HINT_DEFAULT;
|
|
#endif
|
|
|
|
#ifdef HAVE_WOLF_EVENT
|
|
ret = wolfEventQueue_Init(&ctx->event_queue);
|
|
#endif /* HAVE_WOLF_EVENT */
|
|
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
ctx->maxEarlyDataSz = MAX_EARLY_DATA_SZ;
|
|
#endif
|
|
|
|
#if defined(WOLFSSL_TLS13) && !defined(HAVE_SUPPORTED_CURVES)
|
|
ctx->noPskDheKe = 1;
|
|
#endif
|
|
|
|
ctx->heap = heap; /* wolfSSL_CTX_load_static_memory sets */
|
|
ctx->verifyDepth = MAX_CHAIN_DEPTH;
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* In case contexts are held in array and don't want to free actual ctx */
|
|
void SSL_CtxResourceFree(WOLFSSL_CTX* ctx)
|
|
{
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) && \
|
|
defined(HAVE_TLS_EXTENSIONS) && !defined(NO_WOLFSSL_SERVER)
|
|
int i;
|
|
#endif
|
|
|
|
#ifdef HAVE_WOLF_EVENT
|
|
wolfEventQueue_Free(&ctx->event_queue);
|
|
#endif /* HAVE_WOLF_EVENT */
|
|
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
if (ctx->onHeap == 1) {
|
|
XFREE(ctx->method, ctx->heap, DYNAMIC_TYPE_METHOD);
|
|
}
|
|
else {
|
|
XFREE(ctx->method, NULL, DYNAMIC_TYPE_METHOD);
|
|
}
|
|
#else
|
|
XFREE(ctx->method, ctx->heap, DYNAMIC_TYPE_METHOD);
|
|
#endif
|
|
ctx->method = NULL;
|
|
if (ctx->suites) {
|
|
XFREE(ctx->suites, ctx->heap, DYNAMIC_TYPE_SUITES);
|
|
ctx->suites = NULL;
|
|
}
|
|
|
|
#ifndef NO_DH
|
|
XFREE(ctx->serverDH_G.buffer, ctx->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ctx->serverDH_G.buffer = NULL;
|
|
XFREE(ctx->serverDH_P.buffer, ctx->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ctx->serverDH_P.buffer = NULL;
|
|
#endif /* !NO_DH */
|
|
|
|
#ifdef SINGLE_THREADED
|
|
if (ctx->rng) {
|
|
wc_FreeRng(ctx->rng);
|
|
XFREE(ctx->rng, ctx->heap, DYNAMIC_TYPE_RNG);
|
|
ctx->rng = NULL;
|
|
}
|
|
#endif /* SINGLE_THREADED */
|
|
|
|
#ifndef NO_CERTS
|
|
FreeDer(&ctx->privateKey);
|
|
FreeDer(&ctx->certificate);
|
|
#ifdef KEEP_OUR_CERT
|
|
if (ctx->ourCert && ctx->ownOurCert) {
|
|
wolfSSL_X509_free(ctx->ourCert);
|
|
ctx->ourCert = NULL;
|
|
}
|
|
#endif /* KEEP_OUR_CERT */
|
|
FreeDer(&ctx->certChain);
|
|
wolfSSL_CertManagerFree(ctx->cm);
|
|
ctx->cm = NULL;
|
|
#ifdef OPENSSL_EXTRA
|
|
wolfSSL_X509_STORE_free(ctx->x509_store_pt);
|
|
while (ctx->ca_names != NULL) {
|
|
WOLFSSL_STACK *next = ctx->ca_names->next;
|
|
wolfSSL_X509_NAME_free(ctx->ca_names->data.name);
|
|
XFREE(ctx->ca_names, NULL, DYNAMIC_TYPE_OPENSSL);
|
|
ctx->ca_names = next;
|
|
}
|
|
#endif
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
|
|
if (ctx->x509Chain) {
|
|
wolfSSL_sk_X509_free(ctx->x509Chain);
|
|
ctx->x509Chain = NULL;
|
|
}
|
|
#endif
|
|
#endif /* !NO_CERTS */
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
TLSX_FreeAll(ctx->extensions, ctx->heap);
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
|
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
if (ctx->certOcspRequest) {
|
|
FreeOcspRequest(ctx->certOcspRequest);
|
|
XFREE(ctx->certOcspRequest, ctx->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
for (i = 0; i < MAX_CHAIN_DEPTH; i++) {
|
|
if (ctx->chainOcspRequest[i]) {
|
|
FreeOcspRequest(ctx->chainOcspRequest[i]);
|
|
XFREE(ctx->chainOcspRequest[i], ctx->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
ctx->chainOcspRequest[i] = NULL;
|
|
}
|
|
}
|
|
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST_V2 */
|
|
#endif /* !NO_WOLFSSL_SERVER */
|
|
|
|
#endif /* HAVE_TLS_EXTENSIONS */
|
|
#ifdef OPENSSL_EXTRA
|
|
if(ctx->alpn_cli_protos) {
|
|
XFREE((void *)ctx->alpn_cli_protos, NULL, DYNAMIC_TYPE_OPENSSL);
|
|
ctx->alpn_cli_protos = NULL;
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_STATIC_EPHEMERAL
|
|
#ifndef NO_DH
|
|
if (ctx->staticKE.dhKey)
|
|
FreeDer(&ctx->staticKE.dhKey);
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (ctx->staticKE.ecKey)
|
|
FreeDer(&ctx->staticKE.ecKey);
|
|
#endif
|
|
#endif
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
if (ctx->heap != NULL) {
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
/* avoid dereferencing a test value */
|
|
if (ctx->heap != (void*)WOLFSSL_HEAP_TEST)
|
|
#endif
|
|
{
|
|
WOLFSSL_HEAP_HINT* hint = (WOLFSSL_HEAP_HINT*)(ctx->heap);
|
|
wc_FreeMutex(&((WOLFSSL_HEAP*)(hint->memory))->memory_mutex);
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_STATIC_MEMORY */
|
|
}
|
|
|
|
|
|
void FreeSSL_Ctx(WOLFSSL_CTX* ctx)
|
|
{
|
|
int refCount;
|
|
|
|
/* decrement CTX reference count */
|
|
if ((refCount = SSL_CTX_RefCount(ctx, -1)) < 0) {
|
|
/* check error state, if mutex error code then mutex init failed but
|
|
* CTX was still malloc'd */
|
|
if (ctx->err == CTX_INIT_MUTEX_E) {
|
|
SSL_CtxResourceFree(ctx);
|
|
XFREE(ctx, ctx->heap, DYNAMIC_TYPE_CTX);
|
|
}
|
|
return;
|
|
}
|
|
|
|
if (refCount == 0) {
|
|
void* heap = ctx->heap;
|
|
WOLFSSL_MSG("CTX ref count down to 0, doing full free");
|
|
SSL_CtxResourceFree(ctx);
|
|
#if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER) && \
|
|
!defined(WOLFSSL_NO_DEF_TICKET_ENC_CB)
|
|
TicketEncCbCtx_Free(&ctx->ticketKeyCtx);
|
|
#endif
|
|
wc_FreeMutex(&ctx->countMutex);
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
if (ctx->onHeap == 0) {
|
|
heap = NULL;
|
|
}
|
|
#endif
|
|
XFREE(ctx, heap, DYNAMIC_TYPE_CTX);
|
|
(void)heap; /* not used in some builds */
|
|
}
|
|
else {
|
|
(void)ctx;
|
|
WOLFSSL_MSG("CTX ref count not 0 yet, no free");
|
|
}
|
|
}
|
|
|
|
|
|
/* Set cipher pointers to null */
|
|
void InitCiphers(WOLFSSL* ssl)
|
|
{
|
|
#ifdef BUILD_ARC4
|
|
ssl->encrypt.arc4 = NULL;
|
|
ssl->decrypt.arc4 = NULL;
|
|
#endif
|
|
#ifdef BUILD_DES3
|
|
ssl->encrypt.des3 = NULL;
|
|
ssl->decrypt.des3 = NULL;
|
|
#endif
|
|
#ifdef BUILD_AES
|
|
ssl->encrypt.aes = NULL;
|
|
ssl->decrypt.aes = NULL;
|
|
#endif
|
|
#ifdef HAVE_CAMELLIA
|
|
ssl->encrypt.cam = NULL;
|
|
ssl->decrypt.cam = NULL;
|
|
#endif
|
|
#ifdef HAVE_HC128
|
|
ssl->encrypt.hc128 = NULL;
|
|
ssl->decrypt.hc128 = NULL;
|
|
#endif
|
|
#ifdef BUILD_RABBIT
|
|
ssl->encrypt.rabbit = NULL;
|
|
ssl->decrypt.rabbit = NULL;
|
|
#endif
|
|
#ifdef HAVE_CHACHA
|
|
ssl->encrypt.chacha = NULL;
|
|
ssl->decrypt.chacha = NULL;
|
|
#endif
|
|
#if defined(HAVE_POLY1305) && defined(HAVE_ONE_TIME_AUTH)
|
|
ssl->auth.poly1305 = NULL;
|
|
#endif
|
|
ssl->encrypt.setup = 0;
|
|
ssl->decrypt.setup = 0;
|
|
#ifdef HAVE_ONE_TIME_AUTH
|
|
ssl->auth.setup = 0;
|
|
#endif
|
|
#ifdef HAVE_IDEA
|
|
ssl->encrypt.idea = NULL;
|
|
ssl->decrypt.idea = NULL;
|
|
#endif
|
|
}
|
|
|
|
|
|
/* Free ciphers */
|
|
void FreeCiphers(WOLFSSL* ssl)
|
|
{
|
|
(void)ssl;
|
|
#ifdef BUILD_ARC4
|
|
wc_Arc4Free(ssl->encrypt.arc4);
|
|
wc_Arc4Free(ssl->decrypt.arc4);
|
|
XFREE(ssl->encrypt.arc4, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.arc4, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#ifdef BUILD_DES3
|
|
wc_Des3Free(ssl->encrypt.des3);
|
|
wc_Des3Free(ssl->decrypt.des3);
|
|
XFREE(ssl->encrypt.des3, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.des3, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#if defined(BUILD_AES) || defined(BUILD_AESGCM) /* See: InitKeys() in keys.c
|
|
* on addition of BUILD_AESGCM
|
|
* check (enc->aes, dec->aes) */
|
|
wc_AesFree(ssl->encrypt.aes);
|
|
wc_AesFree(ssl->decrypt.aes);
|
|
#if (defined(BUILD_AESGCM) || defined(HAVE_AESCCM)) && \
|
|
!defined(WOLFSSL_NO_TLS12)
|
|
XFREE(ssl->decrypt.additional, ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
XFREE(ssl->encrypt.additional, ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
#endif
|
|
XFREE(ssl->encrypt.aes, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.aes, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#ifdef CIPHER_NONCE
|
|
XFREE(ssl->decrypt.nonce, ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
XFREE(ssl->encrypt.nonce, ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
#endif
|
|
#ifdef HAVE_CAMELLIA
|
|
XFREE(ssl->encrypt.cam, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.cam, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#ifdef HAVE_HC128
|
|
XFREE(ssl->encrypt.hc128, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.hc128, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#ifdef BUILD_RABBIT
|
|
XFREE(ssl->encrypt.rabbit, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.rabbit, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#ifdef HAVE_CHACHA
|
|
XFREE(ssl->encrypt.chacha, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.chacha, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#if defined(HAVE_POLY1305) && defined(HAVE_ONE_TIME_AUTH)
|
|
XFREE(ssl->auth.poly1305, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#ifdef HAVE_IDEA
|
|
XFREE(ssl->encrypt.idea, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.idea, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
#if defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER)
|
|
wc_HmacFree(ssl->encrypt.hmac);
|
|
wc_HmacFree(ssl->decrypt.hmac);
|
|
XFREE(ssl->encrypt.hmac, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
XFREE(ssl->decrypt.hmac, ssl->heap, DYNAMIC_TYPE_CIPHER);
|
|
#endif
|
|
}
|
|
|
|
|
|
void InitCipherSpecs(CipherSpecs* cs)
|
|
{
|
|
XMEMSET(cs, 0, sizeof(CipherSpecs));
|
|
|
|
cs->bulk_cipher_algorithm = INVALID_BYTE;
|
|
cs->cipher_type = INVALID_BYTE;
|
|
cs->mac_algorithm = INVALID_BYTE;
|
|
cs->kea = INVALID_BYTE;
|
|
cs->sig_algo = INVALID_BYTE;
|
|
}
|
|
|
|
#if defined(USE_ECDSA_KEYSZ_HASH_ALGO) || (defined(WOLFSSL_TLS13) && \
|
|
defined(HAVE_ECC))
|
|
static int GetMacDigestSize(byte macAlgo)
|
|
{
|
|
switch (macAlgo) {
|
|
#ifndef NO_SHA
|
|
case sha_mac:
|
|
return WC_SHA_DIGEST_SIZE;
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
case sha256_mac:
|
|
return WC_SHA256_DIGEST_SIZE;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
case sha384_mac:
|
|
return WC_SHA384_DIGEST_SIZE;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
case sha512_mac:
|
|
return WC_SHA512_DIGEST_SIZE;
|
|
#endif
|
|
default:
|
|
break;
|
|
}
|
|
return NOT_COMPILED_IN;
|
|
}
|
|
#endif /* USE_ECDSA_KEYSZ_HASH_ALGO */
|
|
|
|
static WC_INLINE void AddSuiteHashSigAlgo(Suites* suites, byte macAlgo, byte sigAlgo,
|
|
int keySz, word16* inOutIdx)
|
|
{
|
|
int addSigAlgo = 1;
|
|
|
|
#ifdef USE_ECDSA_KEYSZ_HASH_ALGO
|
|
if (sigAlgo == ecc_dsa_sa_algo) {
|
|
int digestSz = GetMacDigestSize(macAlgo);
|
|
/* do not add sig/algos with digest size larger than key size */
|
|
if (digestSz <= 0 || (keySz > 0 && digestSz > keySz)) {
|
|
addSigAlgo = 0;
|
|
}
|
|
}
|
|
#else
|
|
(void)keySz;
|
|
#endif /* USE_ECDSA_KEYSZ_HASH_ALGO */
|
|
|
|
if (addSigAlgo) {
|
|
#ifdef WC_RSA_PSS
|
|
if (sigAlgo == rsa_pss_sa_algo) {
|
|
/* RSA PSS is sig then mac */
|
|
suites->hashSigAlgo[*inOutIdx] = sigAlgo;
|
|
*inOutIdx += 1;
|
|
suites->hashSigAlgo[*inOutIdx] = macAlgo;
|
|
*inOutIdx += 1;
|
|
#ifdef WOLFSSL_TLS13
|
|
/* Add the certificate algorithm as well */
|
|
suites->hashSigAlgo[*inOutIdx] = sigAlgo;
|
|
*inOutIdx += 1;
|
|
suites->hashSigAlgo[*inOutIdx] = PSS_RSAE_TO_PSS_PSS(macAlgo);
|
|
*inOutIdx += 1;
|
|
#endif
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
suites->hashSigAlgo[*inOutIdx] = macAlgo;
|
|
*inOutIdx += 1;
|
|
suites->hashSigAlgo[*inOutIdx] = sigAlgo;
|
|
*inOutIdx += 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig, int haveRSAsig,
|
|
int haveAnon, int tls1_2, int keySz)
|
|
{
|
|
word16 idx = 0;
|
|
|
|
(void)tls1_2;
|
|
(void)keySz;
|
|
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
|
|
if (haveECDSAsig) {
|
|
#ifdef HAVE_ECC
|
|
#ifdef WOLFSSL_SHA512
|
|
AddSuiteHashSigAlgo(suites, sha512_mac, ecc_dsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
AddSuiteHashSigAlgo(suites, sha384_mac, ecc_dsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
AddSuiteHashSigAlgo(suites, sha256_mac, ecc_dsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \
|
|
defined(WOLFSSL_ALLOW_TLS_SHA1))
|
|
AddSuiteHashSigAlgo(suites, sha_mac, ecc_dsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
AddSuiteHashSigAlgo(suites, ED25519_SA_MAJOR, ED25519_SA_MINOR, keySz,
|
|
&idx);
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
AddSuiteHashSigAlgo(suites, ED448_SA_MAJOR, ED448_SA_MINOR, keySz,
|
|
&idx);
|
|
#endif
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_ED25519 || defined(HAVE_ED448 */
|
|
|
|
if (haveRSAsig) {
|
|
#ifdef WC_RSA_PSS
|
|
if (tls1_2) {
|
|
#ifdef WOLFSSL_SHA512
|
|
AddSuiteHashSigAlgo(suites, sha512_mac, rsa_pss_sa_algo, keySz,
|
|
&idx);
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
AddSuiteHashSigAlgo(suites, sha384_mac, rsa_pss_sa_algo, keySz,
|
|
&idx);
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
AddSuiteHashSigAlgo(suites, sha256_mac, rsa_pss_sa_algo, keySz,
|
|
&idx);
|
|
#endif
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
AddSuiteHashSigAlgo(suites, sha512_mac, rsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
AddSuiteHashSigAlgo(suites, sha384_mac, rsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
AddSuiteHashSigAlgo(suites, sha256_mac, rsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#ifdef WOLFSSL_SHA224
|
|
AddSuiteHashSigAlgo(suites, sha224_mac, rsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
#if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \
|
|
defined(WOLFSSL_ALLOW_TLS_SHA1))
|
|
AddSuiteHashSigAlgo(suites, sha_mac, rsa_sa_algo, keySz, &idx);
|
|
#endif
|
|
}
|
|
|
|
#ifdef HAVE_ANON
|
|
if (haveAnon) {
|
|
AddSuiteHashSigAlgo(suites, sha_mac, anonymous_sa_algo, keySz, &idx);
|
|
}
|
|
#endif
|
|
|
|
(void)haveAnon;
|
|
(void)haveECDSAsig;
|
|
suites->hashSigAlgoSz = idx;
|
|
}
|
|
|
|
void InitSuites(Suites* suites, ProtocolVersion pv, int keySz, word16 haveRSA,
|
|
word16 havePSK, word16 haveDH, word16 haveNTRU,
|
|
word16 haveECDSAsig, word16 haveECC,
|
|
word16 haveStaticECC, int side)
|
|
{
|
|
word16 idx = 0;
|
|
int tls = pv.major == SSLv3_MAJOR && pv.minor >= TLSv1_MINOR;
|
|
int tls1_2 = pv.major == SSLv3_MAJOR && pv.minor >= TLSv1_2_MINOR;
|
|
#ifdef WOLFSSL_TLS13
|
|
int tls1_3 = IsAtLeastTLSv1_3(pv);
|
|
#endif
|
|
int dtls = 0;
|
|
int haveRSAsig = 1;
|
|
|
|
(void)tls; /* shut up compiler */
|
|
(void)tls1_2;
|
|
(void)dtls;
|
|
(void)haveDH;
|
|
(void)havePSK;
|
|
(void)haveNTRU;
|
|
(void)haveStaticECC;
|
|
(void)haveECC;
|
|
(void)side;
|
|
(void)haveRSA; /* some builds won't read */
|
|
(void)haveRSAsig; /* non ecc builds won't read */
|
|
|
|
if (suites == NULL) {
|
|
WOLFSSL_MSG("InitSuites pointer error");
|
|
return;
|
|
}
|
|
|
|
if (suites->setSuites)
|
|
return; /* trust user settings, don't override */
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
#ifdef BUILD_TLS_AES_128_GCM_SHA256
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = TLS13_BYTE;
|
|
suites->suites[idx++] = TLS_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_AES_256_GCM_SHA384
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = TLS13_BYTE;
|
|
suites->suites[idx++] = TLS_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_CHACHA20_POLY1305_SHA256
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = TLS13_BYTE;
|
|
suites->suites[idx++] = TLS_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_AES_128_CCM_SHA256
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = TLS13_BYTE;
|
|
suites->suites[idx++] = TLS_AES_128_CCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_AES_128_CCM_8_SHA256
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = TLS13_BYTE;
|
|
suites->suites[idx++] = TLS_AES_128_CCM_8_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_NULL_CIPHER
|
|
#ifdef BUILD_TLS_SHA256_SHA256
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_SHA256_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_SHA384_SHA384
|
|
if (tls1_3) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_SHA384_SHA384;
|
|
}
|
|
#endif
|
|
#endif
|
|
#endif /* WOLFSSL_TLS13 */
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_RSA)
|
|
if (side == WOLFSSL_SERVER_END && haveStaticECC) {
|
|
haveRSA = 0; /* can't do RSA with ECDSA key */
|
|
}
|
|
|
|
if (side == WOLFSSL_SERVER_END && haveECDSAsig) {
|
|
haveRSAsig = 0; /* can't have RSA sig if signed by ECDSA */
|
|
}
|
|
#endif /* !NO_WOLFSSL_SERVER */
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (pv.major == DTLS_MAJOR) {
|
|
dtls = 1;
|
|
tls = 1;
|
|
/* May be dead assignments dependent upon configuration */
|
|
(void) dtls;
|
|
(void) tls;
|
|
tls1_2 = pv.minor <= DTLSv1_2_MINOR;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_RENEGOTIATION_INDICATION
|
|
if (side == WOLFSSL_CLIENT_END) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_QSH
|
|
if (tls) {
|
|
suites->suites[idx++] = QSH_BYTE;
|
|
suites->suites[idx++] = TLS_QSH;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveNTRU && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_NTRU_RSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveNTRU && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_NTRU_RSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_RC4_128_SHA
|
|
if (!dtls && tls && haveNTRU && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_NTRU_RSA_WITH_RC4_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
|
|
if (tls && haveNTRU && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveDH && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA
|
|
if (tls1_2 && haveDH) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DH_anon_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DH_anon_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && haveDH) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DH_anon_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && haveDH && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
|
|
if (tls1_2 && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_256_GCM_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
|
|
if (tls1_2 && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_128_GCM_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
/* Place as higher priority for MYSQL */
|
|
#if defined(WOLFSSL_MYSQL_COMPATIBLE)
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
|
|
if (tls1_2 && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
|
|
if (tls1_2 && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
|
|
if (tls1_2 && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
|
|
if (tls1_2 && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
|
|
if (!dtls && tls && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
|
|
if (!dtls && tls && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
|
|
if (tls && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
|
|
if (tls && haveECC && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
|
|
if (!dtls && tls && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_RC4_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
|
|
if (!dtls && tls && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_RC4_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
|
|
if (tls && haveRSAsig && haveStaticECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CCM;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_CCM_8
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_128_CCM_8;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_CCM_8
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_256_CCM_8;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && haveRSA)
|
|
#else
|
|
if (tls && haveDH && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && haveRSA)
|
|
#else
|
|
if (tls && haveDH && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
/* Place as higher priority for MYSQL testing */
|
|
#if !defined(WOLFSSL_MYSQL_COMPATIBLE)
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
if (tls && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveRSA)
|
|
#else
|
|
if (tls && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_256_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveRSA)
|
|
#else
|
|
if (tls && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256
|
|
if (tls1_2 && haveECC) {
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] =
|
|
TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
|
|
if (tls1_2 && haveRSA) {
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_NULL_SHA
|
|
if (tls && haveECC) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_NULL_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_NULL_MD5
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_NULL_MD5;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_NULL_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_NULL_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_NULL_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveRSA)
|
|
#else
|
|
if (tls && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_NULL_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && havePSK)
|
|
#else
|
|
if (tls && haveDH && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_256_CBC_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_256_CBC_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && havePSK)
|
|
#else
|
|
if (tls && haveDH && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls1 && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
|
|
if (tls && haveDH && havePSK) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_128_CCM;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
|
|
if (tls && haveDH && havePSK) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_256_CCM;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CHACHA_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CCM
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_128_CCM;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CCM
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_256_CCM;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CCM_8
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_128_CCM_8;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CCM_8
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_AES_256_CCM_8;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && havePSK)
|
|
#else
|
|
if (tls && haveDH && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_NULL_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_NULL_SHA384
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_NULL_SHA384;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_PSK_WITH_NULL_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = ECC_BYTE;
|
|
suites->suites[idx++] = TLS_ECDHE_PSK_WITH_NULL_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && havePSK)
|
|
#else
|
|
if (tls && haveDH && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_PSK_WITH_NULL_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_NULL_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && havePSK)
|
|
#else
|
|
if (tls && havePSK)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_NULL_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_NULL_SHA
|
|
if (tls && havePSK) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_PSK_WITH_NULL_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_RC4_128_SHA
|
|
if (!dtls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = SSL_RSA_WITH_RC4_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_RC4_128_MD5
|
|
if (!dtls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = SSL_RSA_WITH_RC4_128_MD5;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
|
|
if (haveRSA ) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = SSL_RSA_WITH_3DES_EDE_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_HC_128_MD5
|
|
if (!dtls && tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_HC_128_MD5;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_HC_128_SHA
|
|
if (!dtls && tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_HC_128_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_RABBIT_SHA
|
|
if (!dtls && tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_RABBIT_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
|
|
if (tls && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
|
if (tls && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
|
|
if (tls && haveDH && haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveRSA)
|
|
#else
|
|
if (tls && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && haveRSA)
|
|
#else
|
|
if (tls && haveDH && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveRSA)
|
|
#else
|
|
if (tls && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
|
#ifndef WOLFSSL_OLDTLS_SHA2_CIPHERSUITES
|
|
if (tls1_2 && haveDH && haveRSA)
|
|
#else
|
|
if (tls && haveDH && haveRSA)
|
|
#endif
|
|
{
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256;
|
|
}
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_IDEA_CBC_SHA
|
|
if (haveRSA) {
|
|
suites->suites[idx++] = CIPHER_BYTE;
|
|
suites->suites[idx++] = SSL_RSA_WITH_IDEA_CBC_SHA;
|
|
}
|
|
#endif
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
suites->suiteSz = idx;
|
|
|
|
InitSuitesHashSigAlgo(suites, haveECDSAsig | haveECC, haveRSAsig | haveRSA,
|
|
0, tls1_2, keySz);
|
|
}
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_CERTS) || \
|
|
(!defined(NO_WOLFSSL_CLIENT) && (!defined(NO_DH) || defined(HAVE_ECC)))
|
|
|
|
/* Decode the signature algorithm.
|
|
*
|
|
* input The encoded signature algorithm.
|
|
* hashalgo The hash algorithm.
|
|
* hsType The signature type.
|
|
*/
|
|
static WC_INLINE void DecodeSigAlg(const byte* input, byte* hashAlgo, byte* hsType)
|
|
{
|
|
switch (input[0]) {
|
|
case NEW_SA_MAJOR:
|
|
#ifdef HAVE_ED25519
|
|
/* ED25519: 0x0807 */
|
|
if (input[1] == ED25519_SA_MINOR) {
|
|
*hsType = ed25519_sa_algo;
|
|
/* Hash performed as part of sign/verify operation. */
|
|
*hashAlgo = sha512_mac;
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
/* ED448: 0x0808 */
|
|
if (input[1] == ED448_SA_MINOR) {
|
|
*hsType = ed448_sa_algo;
|
|
/* Hash performed as part of sign/verify operation. */
|
|
*hashAlgo = sha512_mac;
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef WC_RSA_PSS
|
|
/* PSS PSS signatures: 0x080[9-b] */
|
|
if (input[1] >= pss_sha256 && input[1] <= pss_sha512) {
|
|
*hsType = rsa_pss_pss_algo;
|
|
*hashAlgo = PSS_PSS_HASH_TO_MAC(input[1]);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
*hsType = input[0];
|
|
*hashAlgo = input[1];
|
|
}
|
|
break;
|
|
default:
|
|
*hashAlgo = input[0];
|
|
*hsType = input[1];
|
|
break;
|
|
}
|
|
}
|
|
#endif /* !NO_WOLFSSL_SERVER || !NO_CERTS */
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_WOLFSSL_CLIENT)
|
|
#if !defined(NO_DH) || defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448) || (!defined(NO_RSA) && defined(WC_RSA_PSS))
|
|
|
|
static enum wc_HashType HashAlgoToType(int hashAlgo)
|
|
{
|
|
switch (hashAlgo) {
|
|
#ifdef WOLFSSL_SHA512
|
|
case sha512_mac:
|
|
return WC_HASH_TYPE_SHA512;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
case sha384_mac:
|
|
return WC_HASH_TYPE_SHA384;
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
case sha256_mac:
|
|
return WC_HASH_TYPE_SHA256;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA224
|
|
case sha224_mac:
|
|
return WC_HASH_TYPE_SHA224;
|
|
#endif
|
|
#if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \
|
|
defined(WOLFSSL_ALLOW_TLS_SHA1))
|
|
case sha_mac:
|
|
return WC_HASH_TYPE_SHA;
|
|
#endif
|
|
default:
|
|
WOLFSSL_MSG("Bad hash sig algo");
|
|
break;
|
|
}
|
|
|
|
return WC_HASH_TYPE_NONE;
|
|
}
|
|
#endif /* !NO_DH || HAVE_ECC || (!NO_RSA && WC_RSA_PSS) */
|
|
#endif /* !NO_WOLFSSL_SERVER || !NO_WOLFSSL_CLIENT */
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifndef NO_CERTS
|
|
|
|
void InitX509Name(WOLFSSL_X509_NAME* name, int dynamicFlag, void* heap)
|
|
{
|
|
(void)dynamicFlag;
|
|
(void)heap;
|
|
|
|
if (name != NULL) {
|
|
name->name = name->staticName;
|
|
name->dynamicName = 0;
|
|
name->sz = 0;
|
|
name->heap = heap;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
XMEMSET(name->entry, 0, sizeof(name->entry));
|
|
name->x509 = NULL;
|
|
name->entrySz = 0;
|
|
#endif /* OPENSSL_EXTRA */
|
|
}
|
|
}
|
|
|
|
|
|
void FreeX509Name(WOLFSSL_X509_NAME* name)
|
|
{
|
|
if (name != NULL) {
|
|
if (name->dynamicName) {
|
|
XFREE(name->name, name->heap, DYNAMIC_TYPE_SUBJECT_CN);
|
|
name->name = NULL;
|
|
}
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
{
|
|
int i;
|
|
for (i = 0; i < MAX_NAME_ENTRIES; i++) {
|
|
if (name->entry[i].set) {
|
|
wolfSSL_ASN1_OBJECT_free(name->entry[i].object);
|
|
wolfSSL_ASN1_STRING_free(name->entry[i].value);
|
|
}
|
|
}
|
|
}
|
|
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
|
|
}
|
|
}
|
|
|
|
|
|
/* Initialize wolfSSL X509 type */
|
|
void InitX509(WOLFSSL_X509* x509, int dynamicFlag, void* heap)
|
|
{
|
|
if (x509 == NULL) {
|
|
WOLFSSL_MSG("Null parameter passed in!");
|
|
return;
|
|
}
|
|
|
|
XMEMSET(x509, 0, sizeof(WOLFSSL_X509));
|
|
|
|
x509->heap = heap;
|
|
InitX509Name(&x509->issuer, 0, heap);
|
|
InitX509Name(&x509->subject, 0, heap);
|
|
x509->dynamicMemory = (byte)dynamicFlag;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
|
|
x509->refCount = 1;
|
|
(void)wc_InitMutex(&x509->refMutex);
|
|
#endif
|
|
}
|
|
|
|
|
|
/* Free wolfSSL X509 type */
|
|
void FreeX509(WOLFSSL_X509* x509)
|
|
{
|
|
if (x509 == NULL)
|
|
return;
|
|
|
|
FreeX509Name(&x509->issuer);
|
|
FreeX509Name(&x509->subject);
|
|
if (x509->pubKey.buffer) {
|
|
XFREE(x509->pubKey.buffer, x509->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
x509->pubKey.buffer = NULL;
|
|
}
|
|
FreeDer(&x509->derCert);
|
|
XFREE(x509->sig.buffer, x509->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
x509->sig.buffer = NULL;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
XFREE(x509->authKeyId, x509->heap, DYNAMIC_TYPE_X509_EXT);
|
|
x509->authKeyId = NULL;
|
|
XFREE(x509->subjKeyId, x509->heap, DYNAMIC_TYPE_X509_EXT);
|
|
x509->subjKeyId = NULL;
|
|
if (x509->authInfo != NULL) {
|
|
XFREE(x509->authInfo, x509->heap, DYNAMIC_TYPE_X509_EXT);
|
|
x509->authInfo = NULL;
|
|
}
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
|
if (x509->authInfoCaIssuer != NULL) {
|
|
XFREE(x509->authInfoCaIssuer, x509->heap, DYNAMIC_TYPE_X509_EXT);
|
|
}
|
|
if (x509->ext_sk != NULL) {
|
|
wolfSSL_sk_X509_EXTENSION_free(x509->ext_sk);
|
|
}
|
|
if (x509->ext_sk_full != NULL) {
|
|
wolfSSL_sk_X509_EXTENSION_free(x509->ext_sk_full);
|
|
}
|
|
#endif /* OPENSSL_ALL || WOLFSSL_QT */
|
|
#ifdef OPENSSL_EXTRA
|
|
/* Free serialNumber that was set by wolfSSL_X509_get_serialNumber */
|
|
if (x509->serialNumber != NULL) {
|
|
wolfSSL_ASN1_INTEGER_free(x509->serialNumber);
|
|
}
|
|
#endif
|
|
if (x509->extKeyUsageSrc != NULL) {
|
|
XFREE(x509->extKeyUsageSrc, x509->heap, DYNAMIC_TYPE_X509_EXT);
|
|
x509->extKeyUsageSrc= NULL;
|
|
}
|
|
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
|
|
#if defined(OPENSSL_ALL)
|
|
if (x509->algor.algorithm) {
|
|
wolfSSL_ASN1_OBJECT_free(x509->algor.algorithm);
|
|
x509->algor.algorithm = NULL;
|
|
}
|
|
if (x509->key.algor) {
|
|
wolfSSL_X509_ALGOR_free(x509->key.algor);
|
|
x509->key.algor = NULL;
|
|
}
|
|
if (x509->key.pkey) {
|
|
wolfSSL_EVP_PKEY_free(x509->key.pkey);
|
|
x509->key.pkey = NULL;
|
|
}
|
|
#endif /* OPENSSL_ALL */
|
|
#if defined(WOLFSSL_CERT_REQ) && defined(OPENSSL_ALL)
|
|
if (x509->challengePwAttr) {
|
|
wolfSSL_X509_ATTRIBUTE_free(x509->challengePwAttr);
|
|
}
|
|
#endif /* WOLFSSL_CERT_REQ */
|
|
if (x509->altNames) {
|
|
FreeAltNames(x509->altNames, x509->heap);
|
|
x509->altNames = NULL;
|
|
}
|
|
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
|
|
wc_FreeMutex(&x509->refMutex);
|
|
#endif
|
|
}
|
|
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_WOLFSSL_CLIENT)
|
|
#if !defined(WOLFSSL_NO_TLS12)
|
|
/* Encode the signature algorithm into buffer.
|
|
*
|
|
* hashalgo The hash algorithm.
|
|
* hsType The signature type.
|
|
* output The buffer to encode into.
|
|
*/
|
|
static WC_INLINE void EncodeSigAlg(byte hashAlgo, byte hsType, byte* output)
|
|
{
|
|
switch (hsType) {
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
output[0] = hashAlgo;
|
|
output[1] = ecc_dsa_sa_algo;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
case ed25519_sa_algo:
|
|
output[0] = ED25519_SA_MAJOR;
|
|
output[1] = ED25519_SA_MINOR;
|
|
(void)hashAlgo;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
case ed448_sa_algo:
|
|
output[0] = ED448_SA_MAJOR;
|
|
output[1] = ED448_SA_MINOR;
|
|
(void)hashAlgo;
|
|
break;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
case rsa_sa_algo:
|
|
output[0] = hashAlgo;
|
|
output[1] = rsa_sa_algo;
|
|
break;
|
|
#ifdef WC_RSA_PSS
|
|
/* PSS signatures: 0x080[4-6] */
|
|
case rsa_pss_sa_algo:
|
|
output[0] = rsa_pss_sa_algo;
|
|
output[1] = hashAlgo;
|
|
break;
|
|
#endif
|
|
#endif
|
|
}
|
|
(void)hashAlgo;
|
|
(void)output;
|
|
}
|
|
#endif
|
|
|
|
#if !defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
static void SetDigest(WOLFSSL* ssl, int hashAlgo)
|
|
{
|
|
switch (hashAlgo) {
|
|
#ifndef NO_SHA
|
|
case sha_mac:
|
|
ssl->buffers.digest.buffer = ssl->hsHashes->certHashes.sha;
|
|
ssl->buffers.digest.length = WC_SHA_DIGEST_SIZE;
|
|
break;
|
|
#endif /* !NO_SHA */
|
|
#ifndef NO_SHA256
|
|
case sha256_mac:
|
|
ssl->buffers.digest.buffer = ssl->hsHashes->certHashes.sha256;
|
|
ssl->buffers.digest.length = WC_SHA256_DIGEST_SIZE;
|
|
break;
|
|
#endif /* !NO_SHA256 */
|
|
#ifdef WOLFSSL_SHA384
|
|
case sha384_mac:
|
|
ssl->buffers.digest.buffer = ssl->hsHashes->certHashes.sha384;
|
|
ssl->buffers.digest.length = WC_SHA384_DIGEST_SIZE;
|
|
break;
|
|
#endif /* WOLFSSL_SHA384 */
|
|
#ifdef WOLFSSL_SHA512
|
|
case sha512_mac:
|
|
ssl->buffers.digest.buffer = ssl->hsHashes->certHashes.sha512;
|
|
ssl->buffers.digest.length = WC_SHA512_DIGEST_SIZE;
|
|
break;
|
|
#endif /* WOLFSSL_SHA512 */
|
|
} /* switch */
|
|
}
|
|
#endif /* !WOLFSSL_NO_TLS12 && !WOLFSSL_NO_CLIENT_AUTH */
|
|
#endif /* !NO_WOLFSSL_SERVER || !NO_WOLFSSL_CLIENT */
|
|
#endif /* !NO_CERTS */
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
static word32 MacSize(WOLFSSL* ssl)
|
|
{
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
word32 digestSz = ssl->truncated_hmac ? (byte)TRUNCATED_HMAC_SZ
|
|
: ssl->specs.hash_size;
|
|
#else
|
|
word32 digestSz = ssl->specs.hash_size;
|
|
#endif
|
|
|
|
return digestSz;
|
|
}
|
|
#endif /* HAVE_ENCRYPT_THEN_MAC && !WOLFSSL_AEAD_ONLY */
|
|
|
|
#ifndef NO_RSA
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_WOLFSSL_CLIENT)
|
|
static int TypeHash(int hashAlgo)
|
|
{
|
|
switch (hashAlgo) {
|
|
#ifdef WOLFSSL_SHA512
|
|
case sha512_mac:
|
|
return SHA512h;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
case sha384_mac:
|
|
return SHA384h;
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
case sha256_mac:
|
|
return SHA256h;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA224
|
|
case sha224_mac:
|
|
return SHA224h;
|
|
#endif
|
|
#ifndef NO_SHA
|
|
case sha_mac:
|
|
return SHAh;
|
|
#endif
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
#endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT */
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#if defined(WC_RSA_PSS)
|
|
int ConvertHashPss(int hashAlgo, enum wc_HashType* hashType, int* mgf)
|
|
{
|
|
switch (hashAlgo) {
|
|
#ifdef WOLFSSL_SHA512
|
|
case sha512_mac:
|
|
*hashType = WC_HASH_TYPE_SHA512;
|
|
if (mgf != NULL)
|
|
*mgf = WC_MGF1SHA512;
|
|
break;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
case sha384_mac:
|
|
*hashType = WC_HASH_TYPE_SHA384;
|
|
if (mgf != NULL)
|
|
*mgf = WC_MGF1SHA384;
|
|
break;
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
case sha256_mac:
|
|
*hashType = WC_HASH_TYPE_SHA256;
|
|
if (mgf != NULL)
|
|
*mgf = WC_MGF1SHA256;
|
|
break;
|
|
#endif
|
|
default:
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
int RsaSign(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out,
|
|
word32* outSz, int sigAlgo, int hashAlgo, RsaKey* key,
|
|
DerBuffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
(void)sigAlgo;
|
|
(void)hashAlgo;
|
|
|
|
WOLFSSL_ENTER("RsaSign");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
if (key) {
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#if defined(WC_RSA_PSS)
|
|
if (sigAlgo == rsa_pss_sa_algo) {
|
|
enum wc_HashType hashType = WC_HASH_TYPE_NONE;
|
|
int mgf = 0;
|
|
|
|
ret = ConvertHashPss(hashAlgo, &hashType, &mgf);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#if defined(HAVE_PK_CALLBACKS)
|
|
if (ssl->ctx->RsaPssSignCb) {
|
|
void* ctx = wolfSSL_GetRsaPssSignCtx(ssl);
|
|
ret = ssl->ctx->RsaPssSignCb(ssl, in, inSz, out, outSz,
|
|
TypeHash(hashAlgo), mgf,
|
|
keyBuf, keySz, ctx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_RsaPSS_Sign(in, inSz, out, *outSz, hashType, mgf, key,
|
|
ssl->rng);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
#if defined(HAVE_PK_CALLBACKS)
|
|
if (ssl->ctx->RsaSignCb) {
|
|
void* ctx = wolfSSL_GetRsaSignCtx(ssl);
|
|
ret = ssl->ctx->RsaSignCb(ssl, in, inSz, out, outSz, keyBuf, keySz,
|
|
ctx);
|
|
}
|
|
else
|
|
#endif /*HAVE_PK_CALLBACKS */
|
|
ret = wc_RsaSSL_Sign(in, inSz, out, *outSz, key, ssl->rng);
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (key && ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* For positive response return in outSz */
|
|
if (ret > 0) {
|
|
*outSz = ret;
|
|
ret = 0;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("RsaSign", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
int RsaVerify(WOLFSSL* ssl, byte* in, word32 inSz, byte** out, int sigAlgo,
|
|
int hashAlgo, RsaKey* key, buffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
(void)sigAlgo;
|
|
(void)hashAlgo;
|
|
|
|
WOLFSSL_ENTER("RsaVerify");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#if defined(WC_RSA_PSS)
|
|
if (sigAlgo == rsa_pss_sa_algo) {
|
|
enum wc_HashType hashType = WC_HASH_TYPE_NONE;
|
|
int mgf = 0;
|
|
|
|
ret = ConvertHashPss(hashAlgo, &hashType, &mgf);
|
|
if (ret != 0)
|
|
return ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->RsaPssVerifyCb) {
|
|
void* ctx = wolfSSL_GetRsaPssVerifyCtx(ssl);
|
|
ret = ssl->ctx->RsaPssVerifyCb(ssl, in, inSz, out,
|
|
TypeHash(hashAlgo), mgf,
|
|
keyBuf, keySz, ctx);
|
|
}
|
|
else
|
|
#endif /*HAVE_PK_CALLBACKS */
|
|
ret = wc_RsaPSS_VerifyInline(in, inSz, out, hashType, mgf, key);
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->RsaVerifyCb) {
|
|
void* ctx = wolfSSL_GetRsaVerifyCtx(ssl);
|
|
ret = ssl->ctx->RsaVerifyCb(ssl, in, inSz, out, keyBuf, keySz, ctx);
|
|
}
|
|
else
|
|
#endif /*HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_RsaSSL_VerifyInline(in, inSz, out, key);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("RsaVerify", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Verify RSA signature, 0 on success */
|
|
/* This function is used to check the sign result */
|
|
int VerifyRsaSign(WOLFSSL* ssl, byte* verifySig, word32 sigSz,
|
|
const byte* plain, word32 plainSz, int sigAlgo, int hashAlgo, RsaKey* key,
|
|
DerBuffer* keyBufInfo)
|
|
{
|
|
byte* out = NULL; /* inline result */
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
(void)sigAlgo;
|
|
(void)hashAlgo;
|
|
|
|
WOLFSSL_ENTER("VerifyRsaSign");
|
|
|
|
if (verifySig == NULL || plain == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (sigSz > ENCRYPT_LEN) {
|
|
WOLFSSL_MSG("Signature buffer too big");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
if (key) {
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#if defined(WC_RSA_PSS)
|
|
if (sigAlgo == rsa_pss_sa_algo) {
|
|
enum wc_HashType hashType = WC_HASH_TYPE_NONE;
|
|
int mgf = 0;
|
|
|
|
ret = ConvertHashPss(hashAlgo, &hashType, &mgf);
|
|
if (ret != 0)
|
|
return ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->RsaPssSignCheckCb) {
|
|
/* The key buffer includes private/public portion,
|
|
but only public is used */
|
|
/* If HSM hardware is checking the signature result you can
|
|
optionally skip the sign check and return 0 */
|
|
/* The ctx here is the RsaSignCtx set using wolfSSL_SetRsaSignCtx */
|
|
void* ctx = wolfSSL_GetRsaPssSignCtx(ssl);
|
|
ret = ssl->ctx->RsaPssSignCheckCb(ssl, verifySig, sigSz, &out,
|
|
TypeHash(hashAlgo), mgf,
|
|
keyBuf, keySz, ctx);
|
|
if (ret > 0) {
|
|
ret = wc_RsaPSS_CheckPadding(plain, plainSz, out, ret,
|
|
hashType);
|
|
if (ret != 0)
|
|
ret = VERIFY_CERT_ERROR;
|
|
}
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_RsaPSS_VerifyInline(verifySig, sigSz, &out, hashType, mgf,
|
|
key);
|
|
if (ret > 0) {
|
|
#ifdef HAVE_SELFTEST
|
|
ret = wc_RsaPSS_CheckPadding(plain, plainSz, out, ret,
|
|
hashType);
|
|
#else
|
|
ret = wc_RsaPSS_CheckPadding_ex(plain, plainSz, out, ret,
|
|
hashType, -1,
|
|
mp_count_bits(&key->n));
|
|
#endif
|
|
if (ret != 0)
|
|
ret = VERIFY_CERT_ERROR;
|
|
}
|
|
}
|
|
|
|
}
|
|
else
|
|
#endif /* WC_RSA_PSS */
|
|
{
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->RsaSignCheckCb) {
|
|
/* The key buffer includes private/public portion,
|
|
but only public is used */
|
|
/* If HSM hardware is checking the signature result you can
|
|
optionally skip the sign check and return 0 */
|
|
/* The ctx here is the RsaSignCtx set using wolfSSL_SetRsaSignCtx */
|
|
void* ctx = wolfSSL_GetRsaSignCtx(ssl);
|
|
ret = ssl->ctx->RsaSignCheckCb(ssl, verifySig, sigSz, &out,
|
|
keyBuf, keySz, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_RsaSSL_VerifyInline(verifySig, sigSz, &out, key);
|
|
}
|
|
|
|
if (ret > 0) {
|
|
if (ret != (int)plainSz || !out ||
|
|
XMEMCMP(plain, out, plainSz) != 0) {
|
|
WOLFSSL_MSG("RSA Signature verification failed");
|
|
ret = RSA_SIGN_FAULT;
|
|
} else {
|
|
ret = 0; /* RSA reset */
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (key && ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("VerifyRsaSign", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
int RsaDec(WOLFSSL* ssl, byte* in, word32 inSz, byte** out, word32* outSz,
|
|
RsaKey* key, DerBuffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("RsaDec");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->RsaDecCb) {
|
|
void* ctx = wolfSSL_GetRsaDecCtx(ssl);
|
|
ret = ssl->ctx->RsaDecCb(ssl, in, inSz, out, keyBuf, keySz, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
#ifdef WC_RSA_BLINDING
|
|
ret = wc_RsaSetRNG(key, ssl->rng);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
ret = wc_RsaPrivateDecryptInline(in, inSz, out, key);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* For positive response return in outSz */
|
|
if (ret > 0) {
|
|
*outSz = ret;
|
|
ret = 0;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("RsaDec", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* !NO_WOLFSSL_SERVER) || !WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
int RsaEnc(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out, word32* outSz,
|
|
RsaKey* key, buffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("RsaEnc");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->RsaEncCb) {
|
|
void* ctx = wolfSSL_GetRsaEncCtx(ssl);
|
|
ret = ssl->ctx->RsaEncCb(ssl, in, inSz, out, outSz, keyBuf, keySz, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_RsaPublicEncrypt(in, inSz, out, *outSz, key, ssl->rng);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* For positive response return in outSz */
|
|
if (ret > 0) {
|
|
*outSz = ret;
|
|
ret = 0;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("RsaEnc", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#endif /* NO_RSA */
|
|
|
|
#ifdef HAVE_ECC
|
|
|
|
int EccSign(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out,
|
|
word32* outSz, ecc_key* key, DerBuffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("EccSign");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
if (key) {
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#if defined(HAVE_PK_CALLBACKS)
|
|
if (ssl->ctx->EccSignCb) {
|
|
void* ctx = wolfSSL_GetEccSignCtx(ssl);
|
|
ret = ssl->ctx->EccSignCb(ssl, in, inSz, out, outSz, keyBuf,
|
|
keySz, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_ecc_sign_hash(in, inSz, out, outSz, ssl->rng, key);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (key && ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("EccSign", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int EccVerify(WOLFSSL* ssl, const byte* in, word32 inSz, const byte* out,
|
|
word32 outSz, ecc_key* key, buffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("EccVerify");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->EccVerifyCb) {
|
|
void* ctx = wolfSSL_GetEccVerifyCtx(ssl);
|
|
ret = ssl->ctx->EccVerifyCb(ssl, in, inSz, out, outSz, keyBuf, keySz,
|
|
&ssl->eccVerifyRes, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_ecc_verify_hash(in, inSz, out, outSz, &ssl->eccVerifyRes, key);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
else
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
{
|
|
ret = (ret != 0 || ssl->eccVerifyRes == 0) ? VERIFY_SIGN_ERROR : 0;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("EccVerify", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* Gets ECC key for shared secret callback testing
|
|
* Client side: returns peer key
|
|
* Server side: returns private key
|
|
*/
|
|
static int EccGetKey(WOLFSSL* ssl, ecc_key** otherKey)
|
|
{
|
|
int ret = NO_PEER_KEY;
|
|
ecc_key* tmpKey = NULL;
|
|
|
|
if (ssl == NULL || otherKey == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if (ssl->specs.static_ecdh) {
|
|
if (!ssl->peerEccDsaKey || !ssl->peerEccDsaKeyPresent ||
|
|
!ssl->peerEccDsaKey->dp) {
|
|
return NO_PEER_KEY;
|
|
}
|
|
tmpKey = (struct ecc_key*)ssl->peerEccDsaKey;
|
|
}
|
|
else {
|
|
if (!ssl->peerEccKey || !ssl->peerEccKeyPresent ||
|
|
!ssl->peerEccKey->dp) {
|
|
return NO_PEER_KEY;
|
|
}
|
|
tmpKey = (struct ecc_key*)ssl->peerEccKey;
|
|
}
|
|
}
|
|
else if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
if (ssl->specs.static_ecdh) {
|
|
if (ssl->hsKey == NULL) {
|
|
return NO_PRIVATE_KEY;
|
|
}
|
|
tmpKey = (struct ecc_key*)ssl->hsKey;
|
|
}
|
|
else {
|
|
if (!ssl->eccTempKeyPresent) {
|
|
return NO_PRIVATE_KEY;
|
|
}
|
|
tmpKey = (struct ecc_key*)ssl->eccTempKey;
|
|
}
|
|
}
|
|
|
|
if (tmpKey) {
|
|
*otherKey = tmpKey;
|
|
ret = 0;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
int EccSharedSecret(WOLFSSL* ssl, ecc_key* priv_key, ecc_key* pub_key,
|
|
byte* pubKeyDer, word32* pubKeySz, byte* out, word32* outlen,
|
|
int side)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ecc_key* otherKey = NULL;
|
|
#endif
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
WC_ASYNC_DEV* asyncDev = &priv_key->asyncDev;
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)pubKeyDer;
|
|
(void)pubKeySz;
|
|
(void)side;
|
|
|
|
WOLFSSL_ENTER("EccSharedSecret");
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->EccSharedSecretCb) {
|
|
ret = EccGetKey(ssl, &otherKey);
|
|
if (ret != 0)
|
|
return ret;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
asyncDev = &otherKey->asyncDev;
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->EccSharedSecretCb) {
|
|
void* ctx = wolfSSL_GetEccSharedSecretCtx(ssl);
|
|
ret = ssl->ctx->EccSharedSecretCb(ssl, otherKey, pubKeyDer,
|
|
pubKeySz, out, outlen, side, ctx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
#if defined(ECC_TIMING_RESISTANT) && (!defined(HAVE_FIPS) || \
|
|
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION != 2))) && \
|
|
!defined(HAVE_SELFTEST)
|
|
ret = wc_ecc_set_rng(priv_key, ssl->rng);
|
|
if (ret == 0)
|
|
#endif
|
|
ret = wc_ecc_shared_secret(priv_key, pub_key, out, outlen);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("EccSharedSecret", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int EccMakeKey(WOLFSSL* ssl, ecc_key* key, ecc_key* peer)
|
|
{
|
|
int ret = 0;
|
|
int keySz = 0;
|
|
int ecc_curve = ECC_CURVE_DEF;
|
|
|
|
WOLFSSL_ENTER("EccMakeKey");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_NONE);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
/* get key size */
|
|
if (peer == NULL || peer->dp == NULL) {
|
|
keySz = ssl->eccTempKeySz;
|
|
}
|
|
else {
|
|
keySz = peer->dp->size;
|
|
ecc_curve = peer->dp->id;
|
|
}
|
|
|
|
/* get curve type */
|
|
if (ssl->ecdhCurveOID > 0) {
|
|
ecc_curve = wc_ecc_get_oid(ssl->ecdhCurveOID, NULL, NULL);
|
|
}
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->EccKeyGenCb) {
|
|
void* ctx = wolfSSL_GetEccKeyGenCtx(ssl);
|
|
ret = ssl->ctx->EccKeyGenCb(ssl, key, keySz, ecc_curve, ctx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_ecc_make_key_ex(ssl->rng, keySz, key, ecc_curve);
|
|
}
|
|
|
|
/* make sure the curve is set for TLS */
|
|
if (ret == 0 && key->dp) {
|
|
ssl->ecdhCurveOID = key->dp->oidSum;
|
|
#if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE)
|
|
ssl->namedGroup = 0;
|
|
#endif
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("EccMakeKey", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
|
|
#ifdef HAVE_ED25519
|
|
/* Check whether the key contains a public key.
|
|
* If not then pull it out of the leaf certificate.
|
|
*
|
|
* ssl SSL/TLS object.
|
|
* returns MEMORY_E when unable to allocate memory, a parsing error, otherwise
|
|
* 0 on success.
|
|
*/
|
|
int Ed25519CheckPubKey(WOLFSSL* ssl)
|
|
{
|
|
ed25519_key* key = (ed25519_key*)ssl->hsKey;
|
|
int ret = 0;
|
|
|
|
/* Public key required for signing. */
|
|
if (!key->pubKeySet) {
|
|
DerBuffer* leaf = ssl->buffers.certificate;
|
|
DecodedCert* cert = (DecodedCert*)XMALLOC(sizeof(*cert),
|
|
ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
if (cert == NULL)
|
|
ret = MEMORY_E;
|
|
|
|
if (ret == 0) {
|
|
InitDecodedCert(cert, leaf->buffer, leaf->length, ssl->heap);
|
|
ret = DecodeToKey(cert, 0);
|
|
}
|
|
if (ret == 0) {
|
|
ret = wc_ed25519_import_public(cert->publicKey, cert->pubKeySize,
|
|
key);
|
|
}
|
|
if (cert != NULL) {
|
|
FreeDecodedCert(cert);
|
|
XFREE(cert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Sign the data using EdDSA and key using Ed25519.
|
|
*
|
|
* ssl SSL object.
|
|
* in Data or message to sign.
|
|
* inSz Length of the data.
|
|
* out Buffer to hold signature.
|
|
* outSz On entry, size of the buffer. On exit, the size of the signature.
|
|
* key The private Ed25519 key data.
|
|
* keySz The length of the private key data in bytes.
|
|
* ctx The callback context.
|
|
* returns 0 on success, otherwise the value is an error.
|
|
*/
|
|
int Ed25519Sign(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out,
|
|
word32* outSz, ed25519_key* key, DerBuffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("Ed25519Sign");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#if defined(HAVE_PK_CALLBACKS)
|
|
if (ssl->ctx->Ed25519SignCb) {
|
|
void* ctx = wolfSSL_GetEd25519SignCtx(ssl);
|
|
ret = ssl->ctx->Ed25519SignCb(ssl, in, inSz, out, outSz, keyBuf,
|
|
keySz, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_ed25519_sign_msg(in, inSz, out, outSz, key);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("Ed25519Sign", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Verify the data using EdDSA and key using Ed25519.
|
|
*
|
|
* ssl SSL object.
|
|
* in Signature data.
|
|
* inSz Length of the signature data in bytes.
|
|
* msg Message to verify.
|
|
* outSz Length of message in bytes.
|
|
* key The public Ed25519 key data.
|
|
* keySz The length of the private key data in bytes.
|
|
* ctx The callback context.
|
|
* returns 0 on success, otherwise the value is an error.
|
|
*/
|
|
int Ed25519Verify(WOLFSSL* ssl, const byte* in, word32 inSz, const byte* msg,
|
|
word32 msgSz, ed25519_key* key, buffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("Ed25519Verify");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->Ed25519VerifyCb) {
|
|
void* ctx = wolfSSL_GetEd25519VerifyCtx(ssl);
|
|
ret = ssl->ctx->Ed25519VerifyCb(ssl, in, inSz, msg, msgSz, keyBuf,
|
|
keySz, &ssl->eccVerifyRes, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_ed25519_verify_msg(in, inSz, msg, msgSz,
|
|
&ssl->eccVerifyRes, key);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
else
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
{
|
|
ret = (ret != 0 || ssl->eccVerifyRes == 0) ? VERIFY_SIGN_ERROR : 0;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("Ed25519Verify", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_ED25519 */
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* Gets X25519 key for shared secret callback testing
|
|
* Client side: returns peer key
|
|
* Server side: returns private key
|
|
*/
|
|
static int X25519GetKey(WOLFSSL* ssl, curve25519_key** otherKey)
|
|
{
|
|
int ret = NO_PEER_KEY;
|
|
struct curve25519_key* tmpKey = NULL;
|
|
|
|
if (ssl == NULL || otherKey == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if (!ssl->peerX25519Key || !ssl->peerX25519KeyPresent ||
|
|
!ssl->peerX25519Key->dp) {
|
|
return NO_PEER_KEY;
|
|
}
|
|
tmpKey = (struct curve25519_key*)ssl->peerX25519Key;
|
|
}
|
|
else if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
if (!ssl->eccTempKeyPresent) {
|
|
return NO_PRIVATE_KEY;
|
|
}
|
|
tmpKey = (struct curve25519_key*)ssl->eccTempKey;
|
|
}
|
|
|
|
if (tmpKey) {
|
|
*otherKey = (curve25519_key *)tmpKey;
|
|
ret = 0;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
static int X25519SharedSecret(WOLFSSL* ssl, curve25519_key* priv_key,
|
|
curve25519_key* pub_key, byte* pubKeyDer, word32* pubKeySz,
|
|
byte* out, word32* outlen, int side)
|
|
{
|
|
int ret;
|
|
|
|
(void)ssl;
|
|
(void)pubKeyDer;
|
|
(void)pubKeySz;
|
|
(void)side;
|
|
|
|
WOLFSSL_ENTER("X25519SharedSecret");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &priv_key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->X25519SharedSecretCb) {
|
|
curve25519_key* otherKey = NULL;
|
|
|
|
ret = X25519GetKey(ssl, &otherKey);
|
|
if (ret == 0) {
|
|
void* ctx = wolfSSL_GetX25519SharedSecretCtx(ssl);
|
|
ret = ssl->ctx->X25519SharedSecretCb(ssl, otherKey, pubKeyDer,
|
|
pubKeySz, out, outlen, side, ctx);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_curve25519_shared_secret_ex(priv_key, pub_key, out, outlen,
|
|
EC25519_LITTLE_ENDIAN);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &priv_key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("X25519SharedSecret", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int X25519MakeKey(WOLFSSL* ssl, curve25519_key* key,
|
|
curve25519_key* peer)
|
|
{
|
|
int ret = 0;
|
|
|
|
(void)peer;
|
|
|
|
WOLFSSL_ENTER("X25519MakeKey");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_NONE);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->X25519KeyGenCb) {
|
|
void* ctx = wolfSSL_GetX25519KeyGenCtx(ssl);
|
|
ret = ssl->ctx->X25519KeyGenCb(ssl, key, CURVE25519_KEYSIZE, ctx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_curve25519_make_key(ssl->rng, CURVE25519_KEYSIZE, key);
|
|
}
|
|
|
|
if (ret == 0) {
|
|
ssl->ecdhCurveOID = ECC_X25519_OID;
|
|
#if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE)
|
|
ssl->namedGroup = 0;
|
|
#endif
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("X25519MakeKey", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_CURVE25519 */
|
|
|
|
#ifdef HAVE_ED448
|
|
/* Check whether the key contains a public key.
|
|
* If not then pull it out of the leaf certificate.
|
|
*
|
|
* ssl SSL/TLS object.
|
|
* returns MEMORY_E when unable to allocate memory, a parsing error, otherwise
|
|
* 0 on success.
|
|
*/
|
|
int Ed448CheckPubKey(WOLFSSL* ssl)
|
|
{
|
|
ed448_key* key = (ed448_key*)ssl->hsKey;
|
|
int ret = 0;
|
|
|
|
/* Public key required for signing. */
|
|
if (!key->pubKeySet) {
|
|
DerBuffer* leaf = ssl->buffers.certificate;
|
|
DecodedCert* cert = (DecodedCert*)XMALLOC(sizeof(*cert), ssl->heap,
|
|
DYNAMIC_TYPE_DCERT);
|
|
if (cert == NULL)
|
|
ret = MEMORY_E;
|
|
|
|
if (ret == 0) {
|
|
InitDecodedCert(cert, leaf->buffer, leaf->length, ssl->heap);
|
|
ret = DecodeToKey(cert, 0);
|
|
}
|
|
if (ret == 0) {
|
|
ret = wc_ed448_import_public(cert->publicKey, cert->pubKeySize,
|
|
key);
|
|
}
|
|
if (cert != NULL) {
|
|
FreeDecodedCert(cert);
|
|
XFREE(cert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Sign the data using EdDSA and key using Ed448.
|
|
*
|
|
* ssl SSL object.
|
|
* in Data or message to sign.
|
|
* inSz Length of the data.
|
|
* out Buffer to hold signature.
|
|
* outSz On entry, size of the buffer. On exit, the size of the signature.
|
|
* key The private Ed448 key data.
|
|
* keySz The length of the private key data in bytes.
|
|
* ctx The callback context.
|
|
* returns 0 on success, otherwise the value is an error.
|
|
*/
|
|
int Ed448Sign(WOLFSSL* ssl, const byte* in, word32 inSz, byte* out,
|
|
word32* outSz, ed448_key* key, DerBuffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("Ed448Sign");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#if defined(HAVE_PK_CALLBACKS)
|
|
if (ssl->ctx->Ed448SignCb) {
|
|
void* ctx = wolfSSL_GetEd448SignCtx(ssl);
|
|
ret = ssl->ctx->Ed448SignCb(ssl, in, inSz, out, outSz, keyBuf, keySz,
|
|
ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_ed448_sign_msg(in, inSz, out, outSz, key, NULL, 0);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("Ed448Sign", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Verify the data using EdDSA and key using Ed448.
|
|
*
|
|
* ssl SSL object.
|
|
* in Signature data.
|
|
* inSz Length of the signature data in bytes.
|
|
* msg Message to verify.
|
|
* outSz Length of message in bytes.
|
|
* key The public Ed448 key data.
|
|
* keySz The length of the private key data in bytes.
|
|
* ctx The callback context.
|
|
* returns 0 on success, otherwise the value is an error.
|
|
*/
|
|
int Ed448Verify(WOLFSSL* ssl, const byte* in, word32 inSz, const byte* msg,
|
|
word32 msgSz, ed448_key* key, buffer* keyBufInfo)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
const byte* keyBuf = NULL;
|
|
word32 keySz = 0;
|
|
|
|
if (keyBufInfo) {
|
|
keyBuf = keyBufInfo->buffer;
|
|
keySz = keyBufInfo->length;
|
|
}
|
|
#endif
|
|
|
|
(void)ssl;
|
|
(void)keyBufInfo;
|
|
|
|
WOLFSSL_ENTER("Ed448Verify");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->Ed448VerifyCb) {
|
|
void* ctx = wolfSSL_GetEd448VerifyCtx(ssl);
|
|
ret = ssl->ctx->Ed448VerifyCb(ssl, in, inSz, msg, msgSz, keyBuf, keySz,
|
|
&ssl->eccVerifyRes, ctx);
|
|
}
|
|
else
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
{
|
|
ret = wc_ed448_verify_msg(in, inSz, msg, msgSz, &ssl->eccVerifyRes, key,
|
|
NULL, 0);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
else
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
{
|
|
ret = (ret != 0 || ssl->eccVerifyRes == 0) ? VERIFY_SIGN_ERROR : 0;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("Ed448Verify", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_ED448 */
|
|
|
|
#ifdef HAVE_CURVE448
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* Gets X448 key for shared secret callback testing
|
|
* Client side: returns peer key
|
|
* Server side: returns private key
|
|
*/
|
|
static int X448GetKey(WOLFSSL* ssl, curve448_key** otherKey)
|
|
{
|
|
int ret = NO_PEER_KEY;
|
|
struct curve448_key* tmpKey = NULL;
|
|
|
|
if (ssl == NULL || otherKey == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if (!ssl->peerX448Key || !ssl->peerX448KeyPresent) {
|
|
return NO_PEER_KEY;
|
|
}
|
|
tmpKey = (struct curve448_key*)ssl->peerX448Key;
|
|
}
|
|
else if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
if (!ssl->eccTempKeyPresent) {
|
|
return NO_PRIVATE_KEY;
|
|
}
|
|
tmpKey = (struct curve448_key*)ssl->eccTempKey;
|
|
}
|
|
|
|
if (tmpKey) {
|
|
*otherKey = (curve448_key *)tmpKey;
|
|
ret = 0;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
static int X448SharedSecret(WOLFSSL* ssl, curve448_key* priv_key,
|
|
curve448_key* pub_key, byte* pubKeyDer,
|
|
word32* pubKeySz, byte* out, word32* outlen,
|
|
int side)
|
|
{
|
|
int ret;
|
|
|
|
(void)ssl;
|
|
(void)pubKeyDer;
|
|
(void)pubKeySz;
|
|
(void)side;
|
|
|
|
WOLFSSL_ENTER("X448SharedSecret");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &priv_key->asyncDev, WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->X448SharedSecretCb) {
|
|
curve448_key* otherKey = NULL;
|
|
|
|
ret = X448GetKey(ssl, &otherKey);
|
|
if (ret == 0) {
|
|
void* ctx = wolfSSL_GetX448SharedSecretCtx(ssl);
|
|
ret = ssl->ctx->X448SharedSecretCb(ssl, otherKey, pubKeyDer,
|
|
pubKeySz, out, outlen, side, ctx);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_curve448_shared_secret_ex(priv_key, pub_key, out, outlen,
|
|
EC448_LITTLE_ENDIAN);
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &priv_key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("X448SharedSecret", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static int X448MakeKey(WOLFSSL* ssl, curve448_key* key, curve448_key* peer)
|
|
{
|
|
int ret = 0;
|
|
|
|
(void)peer;
|
|
|
|
WOLFSSL_ENTER("X448MakeKey");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &key->asyncDev, WC_ASYNC_FLAG_NONE);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->X448KeyGenCb) {
|
|
void* ctx = wolfSSL_GetX448KeyGenCtx(ssl);
|
|
ret = ssl->ctx->X448KeyGenCb(ssl, key, CURVE448_KEY_SIZE, ctx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_curve448_make_key(ssl->rng, CURVE448_KEY_SIZE, key);
|
|
}
|
|
|
|
if (ret == 0) {
|
|
ssl->ecdhCurveOID = ECC_X448_OID;
|
|
#if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE)
|
|
ssl->namedGroup = 0;
|
|
#endif
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &key->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("X448MakeKey", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_CURVE448 */
|
|
|
|
#if !defined(NO_CERTS) || !defined(NO_PSK)
|
|
#if !defined(NO_DH)
|
|
|
|
int DhGenKeyPair(WOLFSSL* ssl, DhKey* dhKey,
|
|
byte* priv, word32* privSz,
|
|
byte* pub, word32* pubSz)
|
|
{
|
|
int ret;
|
|
|
|
WOLFSSL_ENTER("DhGenKeyPair");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &dhKey->asyncDev, WC_ASYNC_FLAG_NONE);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
ret = wc_DhGenerateKeyPair(dhKey, ssl->rng, priv, privSz, pub, pubSz);
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &dhKey->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("DhGenKeyPair", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int DhAgree(WOLFSSL* ssl, DhKey* dhKey,
|
|
const byte* priv, word32 privSz,
|
|
const byte* otherPub, word32 otherPubSz,
|
|
byte* agree, word32* agreeSz)
|
|
{
|
|
int ret;
|
|
|
|
(void)ssl;
|
|
|
|
WOLFSSL_ENTER("DhAgree");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &dhKey->asyncDev, WC_ASYNC_FLAG_NONE);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->ctx->DhAgreeCb) {
|
|
void* ctx = wolfSSL_GetDhAgreeCtx(ssl);
|
|
|
|
WOLFSSL_MSG("Calling DhAgree Callback Function");
|
|
ret = ssl->ctx->DhAgreeCb(ssl, dhKey, priv, privSz,
|
|
otherPub, otherPubSz, agree, agreeSz, ctx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)
|
|
ret = wc_DhCheckPubValue(ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length, otherPub, otherPubSz);
|
|
if (ret != 0) {
|
|
#ifdef OPENSSL_EXTRA
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_DhAgree(dhKey, agree, agreeSz, priv, privSz, otherPub,
|
|
otherPubSz);
|
|
}
|
|
}
|
|
|
|
/* Handle async pending response */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &dhKey->asyncDev);
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
WOLFSSL_LEAVE("DhAgree", ret);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#endif /* !NO_CERTS || !NO_PSK */
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
int wolfSSL_IsPrivatePkSet(WOLFSSL* ssl)
|
|
{
|
|
int pkcbset = 0;
|
|
(void)ssl;
|
|
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \
|
|
!defined(NO_RSA)
|
|
if (0
|
|
#ifdef HAVE_ECC
|
|
|| (ssl->ctx->EccSignCb != NULL &&
|
|
ssl->buffers.keyType == ecc_dsa_sa_algo)
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
|| (ssl->ctx->Ed25519SignCb != NULL &&
|
|
ssl->buffers.keyType == ed25519_sa_algo)
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
|| (ssl->ctx->Ed448SignCb != NULL &&
|
|
ssl->buffers.keyType == ed448_sa_algo)
|
|
#endif
|
|
#ifndef NO_RSA
|
|
|| (ssl->ctx->RsaSignCb != NULL && ssl->buffers.keyType == rsa_sa_algo)
|
|
|| (ssl->ctx->RsaDecCb != NULL && ssl->buffers.keyType == rsa_kea)
|
|
#ifdef WC_RSA_PSS
|
|
|| (ssl->ctx->RsaPssSignCb != NULL &&
|
|
ssl->buffers.keyType == rsa_pss_sa_algo)
|
|
#endif
|
|
#endif
|
|
) {
|
|
pkcbset = 1;
|
|
}
|
|
#endif
|
|
return pkcbset;
|
|
}
|
|
|
|
int wolfSSL_CTX_IsPrivatePkSet(WOLFSSL_CTX* ctx)
|
|
{
|
|
int pkcbset = 0;
|
|
(void)ctx;
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \
|
|
!defined(NO_RSA)
|
|
if (0
|
|
#ifdef HAVE_ECC
|
|
|| ctx->EccSignCb != NULL
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
|| ctx->Ed25519SignCb != NULL
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
|| ctx->Ed448SignCb != NULL
|
|
#endif
|
|
#ifndef NO_RSA
|
|
|| ctx->RsaSignCb != NULL
|
|
|| ctx->RsaDecCb != NULL
|
|
#ifdef WC_RSA_PSS
|
|
|| ctx->RsaPssSignCb != NULL
|
|
#endif
|
|
#endif
|
|
) {
|
|
pkcbset = 1;
|
|
}
|
|
#endif
|
|
return pkcbset;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
|
|
int InitSSL_Suites(WOLFSSL* ssl)
|
|
{
|
|
int keySz = 0;
|
|
byte havePSK = 0;
|
|
byte haveAnon = 0;
|
|
byte haveRSA = 0;
|
|
byte haveMcast = 0;
|
|
|
|
(void)haveAnon; /* Squash unused var warnings */
|
|
(void)haveMcast;
|
|
|
|
if (!ssl)
|
|
return BAD_FUNC_ARG;
|
|
|
|
#ifndef NO_RSA
|
|
haveRSA = 1;
|
|
#endif
|
|
#ifndef NO_PSK
|
|
havePSK = (byte)ssl->options.havePSK;
|
|
#endif /* NO_PSK */
|
|
#ifdef HAVE_ANON
|
|
haveAnon = (byte)ssl->options.haveAnon;
|
|
#endif /* HAVE_ANON*/
|
|
#ifdef WOLFSSL_MULTICAST
|
|
haveMcast = (byte)ssl->options.haveMcast;
|
|
#endif /* WOLFSSL_MULTICAST */
|
|
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->options.side == WOLFSSL_SERVER_END)
|
|
ssl->options.maxEarlyDataSz = ssl->ctx->maxEarlyDataSz;
|
|
#endif
|
|
#if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
|
|
((defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
|
|
(defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)))
|
|
ssl->options.cacheMessages = ssl->options.side == WOLFSSL_SERVER_END ||
|
|
ssl->buffers.keyType == ed25519_sa_algo ||
|
|
ssl->buffers.keyType == ed448_sa_algo;
|
|
#endif
|
|
|
|
#ifndef NO_CERTS
|
|
keySz = ssl->buffers.keySz;
|
|
#endif
|
|
|
|
/* make sure server has DH parms, and add PSK if there, add NTRU too */
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
|
|
ssl->options.haveDH, ssl->options.haveNTRU,
|
|
ssl->options.haveECDSAsig, ssl->options.haveECC,
|
|
ssl->options.haveStaticECC, ssl->options.side);
|
|
}
|
|
else {
|
|
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
|
|
TRUE, ssl->options.haveNTRU,
|
|
ssl->options.haveECDSAsig, ssl->options.haveECC,
|
|
ssl->options.haveStaticECC, ssl->options.side);
|
|
}
|
|
|
|
#if !defined(NO_CERTS) && !defined(WOLFSSL_SESSION_EXPORT)
|
|
/* make sure server has cert and key unless using PSK, Anon, or
|
|
* Multicast. This should be true even if just switching ssl ctx */
|
|
if (ssl->options.side == WOLFSSL_SERVER_END &&
|
|
!havePSK && !haveAnon && !haveMcast) {
|
|
|
|
/* server certificate must be loaded */
|
|
if (!ssl->buffers.certificate || !ssl->buffers.certificate->buffer) {
|
|
WOLFSSL_MSG("Server missing certificate");
|
|
return NO_PRIVATE_KEY;
|
|
}
|
|
|
|
/* allow no private key if using PK callbacks and CB is set */
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (wolfSSL_CTX_IsPrivatePkSet(ssl->ctx)) {
|
|
WOLFSSL_MSG("Using PK for server private key");
|
|
}
|
|
else
|
|
#endif
|
|
if (!ssl->buffers.key || !ssl->buffers.key->buffer) {
|
|
WOLFSSL_MSG("Server missing private key");
|
|
return NO_PRIVATE_KEY;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
return WOLFSSL_SUCCESS;
|
|
}
|
|
|
|
/* returns new reference count. Arg incr positive=up or negative=down */
|
|
int SSL_CTX_RefCount(WOLFSSL_CTX* ctx, int incr)
|
|
{
|
|
int refCount;
|
|
|
|
if (ctx == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (wc_LockMutex(&ctx->countMutex) != 0) {
|
|
WOLFSSL_MSG("Couldn't lock CTX count mutex");
|
|
return BAD_MUTEX_E;
|
|
}
|
|
|
|
ctx->refCount += incr;
|
|
/* make sure refCount is never negative */
|
|
if (ctx->refCount < 0) {
|
|
ctx->refCount = 0;
|
|
}
|
|
refCount = ctx->refCount;
|
|
|
|
wc_UnLockMutex(&ctx->countMutex);
|
|
|
|
return refCount;
|
|
}
|
|
|
|
/* This function inherits a WOLFSSL_CTX's fields into an SSL object.
|
|
It is used during initialization and to switch an ssl's CTX with
|
|
wolfSSL_Set_SSL_CTX. Requires ssl->suites alloc and ssl-arrays with PSK
|
|
unless writeDup is on.
|
|
|
|
ssl object to initialize
|
|
ctx parent factory
|
|
writeDup flag indicating this is a write dup only
|
|
|
|
WOLFSSL_SUCCESS return value on success */
|
|
int SetSSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
|
|
{
|
|
int ret;
|
|
byte newSSL;
|
|
|
|
if (!ssl || !ctx)
|
|
return BAD_FUNC_ARG;
|
|
|
|
#ifndef SINGLE_THREADED
|
|
if (ssl->suites == NULL && !writeDup)
|
|
return BAD_FUNC_ARG;
|
|
#endif
|
|
|
|
newSSL = ssl->ctx == NULL; /* Assign after null check */
|
|
|
|
#ifndef NO_PSK
|
|
if (ctx->server_hint[0] && ssl->arrays == NULL && !writeDup) {
|
|
return BAD_FUNC_ARG; /* needed for copy below */
|
|
}
|
|
#endif
|
|
|
|
/* decrement previous CTX reference count if exists.
|
|
* This should only happen if switching ctxs!*/
|
|
if (!newSSL) {
|
|
WOLFSSL_MSG("freeing old ctx to decrement reference count. Switching ctx.");
|
|
wolfSSL_CTX_free(ssl->ctx);
|
|
}
|
|
|
|
/* increment CTX reference count */
|
|
if ((ret = SSL_CTX_RefCount(ctx, 1)) < 0) {
|
|
return ret;
|
|
}
|
|
ret = WOLFSSL_SUCCESS; /* set default ret */
|
|
|
|
ssl->ctx = ctx; /* only for passing to calls, options could change */
|
|
ssl->version = ctx->method->version;
|
|
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
|
|
ssl->options.mask = ctx->mask;
|
|
#endif
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->version.minor == TLSv1_3_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_3) == SSL_OP_NO_TLSv1_3) {
|
|
if (!ctx->method->downgrade) {
|
|
WOLFSSL_MSG("\tInconsistent protocol options. TLS 1.3 set but not "
|
|
"allowed and downgrading disabled.");
|
|
return VERSION_ERROR;
|
|
}
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.3, Downgrading");
|
|
ssl->version.minor = TLSv1_2_MINOR;
|
|
}
|
|
if (ssl->version.minor == TLSv1_2_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_2) == SSL_OP_NO_TLSv1_2) {
|
|
if (!ctx->method->downgrade) {
|
|
WOLFSSL_MSG("\tInconsistent protocol options. TLS 1.2 set but not "
|
|
"allowed and downgrading disabled.");
|
|
return VERSION_ERROR;
|
|
}
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.2, Downgrading");
|
|
ssl->version.minor = TLSv1_1_MINOR;
|
|
}
|
|
if (ssl->version.minor == TLSv1_1_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_1) == SSL_OP_NO_TLSv1_1) {
|
|
if (!ctx->method->downgrade) {
|
|
WOLFSSL_MSG("\tInconsistent protocol options. TLS 1.1 set but not "
|
|
"allowed and downgrading disabled.");
|
|
return VERSION_ERROR;
|
|
}
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.1, Downgrading");
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = TLSv1_MINOR;
|
|
}
|
|
if (ssl->version.minor == TLSv1_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1) == SSL_OP_NO_TLSv1) {
|
|
if (!ctx->method->downgrade) {
|
|
WOLFSSL_MSG("\tInconsistent protocol options. TLS 1 set but not "
|
|
"allowed and downgrading disabled.");
|
|
return VERSION_ERROR;
|
|
}
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1, Downgrading");
|
|
ssl->options.tls = 0;
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = SSLv3_MINOR;
|
|
}
|
|
if (ssl->version.minor == SSLv3_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_SSLv3) == SSL_OP_NO_SSLv3) {
|
|
WOLFSSL_MSG("\tError, option set to not allow SSLv3");
|
|
return VERSION_ERROR;
|
|
}
|
|
|
|
if (ssl->version.minor < ssl->options.minDowngrade) {
|
|
WOLFSSL_MSG("\tversion below minimum allowed, fatal error");
|
|
return VERSION_ERROR;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_ECC
|
|
ssl->eccTempKeySz = ctx->eccTempKeySz;
|
|
ssl->ecdhCurveOID = ctx->ecdhCurveOID;
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
|
|
ssl->pkCurveOID = ctx->pkCurveOID;
|
|
#endif
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->CBIS = ctx->CBIS;
|
|
#endif
|
|
ssl->timeout = ctx->timeout;
|
|
ssl->verifyCallback = ctx->verifyCallback;
|
|
ssl->options.side = ctx->method->side;
|
|
ssl->options.downgrade = ctx->method->downgrade;
|
|
ssl->options.minDowngrade = ctx->minDowngrade;
|
|
|
|
ssl->options.haveDH = ctx->haveDH;
|
|
ssl->options.haveNTRU = ctx->haveNTRU;
|
|
ssl->options.haveECDSAsig = ctx->haveECDSAsig;
|
|
ssl->options.haveECC = ctx->haveECC;
|
|
ssl->options.haveStaticECC = ctx->haveStaticECC;
|
|
|
|
#ifndef NO_PSK
|
|
ssl->options.havePSK = ctx->havePSK;
|
|
ssl->options.client_psk_cb = ctx->client_psk_cb;
|
|
ssl->options.server_psk_cb = ctx->server_psk_cb;
|
|
ssl->options.psk_ctx = ctx->psk_ctx;
|
|
#ifdef WOLFSSL_TLS13
|
|
ssl->options.client_psk_tls13_cb = ctx->client_psk_tls13_cb;
|
|
ssl->options.server_psk_tls13_cb = ctx->server_psk_tls13_cb;
|
|
#endif
|
|
#endif /* NO_PSK */
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->options.side == WOLFSSL_SERVER_END)
|
|
ssl->options.maxEarlyDataSz = ctx->maxEarlyDataSz;
|
|
#endif
|
|
|
|
#ifdef HAVE_ANON
|
|
ssl->options.haveAnon = ctx->haveAnon;
|
|
#endif
|
|
#ifndef NO_DH
|
|
ssl->options.minDhKeySz = ctx->minDhKeySz;
|
|
ssl->options.maxDhKeySz = ctx->maxDhKeySz;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
ssl->options.minRsaKeySz = ctx->minRsaKeySz;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
ssl->options.minEccKeySz = ctx->minEccKeySz;
|
|
#endif
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->options.verifyDepth = ctx->verifyDepth;
|
|
#endif
|
|
|
|
ssl->options.sessionCacheOff = ctx->sessionCacheOff;
|
|
ssl->options.sessionCacheFlushOff = ctx->sessionCacheFlushOff;
|
|
#ifdef HAVE_EXT_CACHE
|
|
ssl->options.internalCacheOff = ctx->internalCacheOff;
|
|
#endif
|
|
|
|
ssl->options.verifyPeer = ctx->verifyPeer;
|
|
ssl->options.verifyNone = ctx->verifyNone;
|
|
ssl->options.failNoCert = ctx->failNoCert;
|
|
ssl->options.failNoCertxPSK = ctx->failNoCertxPSK;
|
|
ssl->options.sendVerify = ctx->sendVerify;
|
|
|
|
ssl->options.partialWrite = ctx->partialWrite;
|
|
ssl->options.quietShutdown = ctx->quietShutdown;
|
|
ssl->options.groupMessages = ctx->groupMessages;
|
|
|
|
#ifndef NO_DH
|
|
#if !defined(WOLFSSL_OLD_PRIME_CHECK) && !defined(HAVE_FIPS) && \
|
|
!defined(HAVE_SELFTEST)
|
|
ssl->options.dhKeyTested = ctx->dhKeyTested;
|
|
#endif
|
|
ssl->buffers.serverDH_P = ctx->serverDH_P;
|
|
ssl->buffers.serverDH_G = ctx->serverDH_G;
|
|
#endif
|
|
|
|
#ifndef NO_CERTS
|
|
/* ctx still owns certificate, certChain, key, dh, and cm */
|
|
ssl->buffers.certificate = ctx->certificate;
|
|
ssl->buffers.certChain = ctx->certChain;
|
|
#ifdef WOLFSSL_TLS13
|
|
ssl->buffers.certChainCnt = ctx->certChainCnt;
|
|
#endif
|
|
ssl->buffers.key = ctx->privateKey;
|
|
ssl->buffers.keyType = ctx->privateKeyType;
|
|
ssl->buffers.keyId = ctx->privateKeyId;
|
|
ssl->buffers.keyLabel = ctx->privateKeyLabel;
|
|
ssl->buffers.keySz = ctx->privateKeySz;
|
|
ssl->buffers.keyDevId = ctx->privateKeyDevId;
|
|
#endif
|
|
#if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
|
|
((defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
|
|
(defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)))
|
|
ssl->options.cacheMessages = ssl->options.side == WOLFSSL_SERVER_END ||
|
|
ssl->buffers.keyType == ed25519_sa_algo ||
|
|
ssl->buffers.keyType == ed448_sa_algo;
|
|
#endif
|
|
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->devId = ctx->devId;
|
|
#endif
|
|
|
|
if (writeDup == 0) {
|
|
#ifndef NO_PSK
|
|
if (ctx->server_hint[0]) { /* set in CTX */
|
|
XSTRNCPY(ssl->arrays->server_hint, ctx->server_hint,
|
|
sizeof(ssl->arrays->server_hint));
|
|
ssl->arrays->server_hint[MAX_PSK_ID_LEN] = '\0'; /* null term */
|
|
}
|
|
#endif /* NO_PSK */
|
|
|
|
if (ctx->suites) {
|
|
#ifndef SINGLE_THREADED
|
|
*ssl->suites = *ctx->suites;
|
|
#else
|
|
ssl->suites = ctx->suites;
|
|
#endif
|
|
}
|
|
else {
|
|
XMEMSET(ssl->suites, 0, sizeof(Suites));
|
|
}
|
|
|
|
if (ssl->options.side != WOLFSSL_NEITHER_END) {
|
|
/* Defer initializing suites until accept or connect */
|
|
ret = InitSSL_Suites(ssl);
|
|
}
|
|
} /* writeDup check */
|
|
|
|
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL)
|
|
if (ctx->mask != 0 && wolfSSL_set_options(ssl, ctx->mask) == 0) {
|
|
WOLFSSL_MSG("wolfSSL_set_options error");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SESSION_EXPORT
|
|
#ifdef WOLFSSL_DTLS
|
|
ssl->dtls_export = ctx->dtls_export; /* export function for session */
|
|
#endif
|
|
#endif
|
|
|
|
ssl->CBIORecv = ctx->CBIORecv;
|
|
ssl->CBIOSend = ctx->CBIOSend;
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->readAhead = ctx->readAhead;
|
|
#endif
|
|
ssl->verifyDepth = ctx->verifyDepth;
|
|
|
|
return ret;
|
|
}
|
|
|
|
int InitHandshakeHashes(WOLFSSL* ssl)
|
|
{
|
|
int ret;
|
|
|
|
/* make sure existing handshake hashes are free'd */
|
|
if (ssl->hsHashes != NULL) {
|
|
FreeHandshakeHashes(ssl);
|
|
}
|
|
|
|
/* allocate handshake hashes */
|
|
ssl->hsHashes = (HS_Hashes*)XMALLOC(sizeof(HS_Hashes), ssl->heap,
|
|
DYNAMIC_TYPE_HASHES);
|
|
if (ssl->hsHashes == NULL) {
|
|
WOLFSSL_MSG("HS_Hashes Memory error");
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl->hsHashes, 0, sizeof(HS_Hashes));
|
|
|
|
#ifndef NO_OLD_TLS
|
|
#ifndef NO_MD5
|
|
ret = wc_InitMd5_ex(&ssl->hsHashes->hashMd5, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
#if defined(WOLFSSL_HASH_FLAGS) || defined(WOLF_CRYPTO_CB)
|
|
wc_Md5SetFlags(&ssl->hsHashes->hashMd5, WC_HASH_FLAG_WILLCOPY);
|
|
#endif
|
|
#endif
|
|
#ifndef NO_SHA
|
|
ret = wc_InitSha_ex(&ssl->hsHashes->hashSha, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
#if defined(WOLFSSL_HASH_FLAGS) || defined(WOLF_CRYPTO_CB)
|
|
wc_ShaSetFlags(&ssl->hsHashes->hashSha, WC_HASH_FLAG_WILLCOPY);
|
|
#endif
|
|
#endif
|
|
#endif /* !NO_OLD_TLS */
|
|
#ifndef NO_SHA256
|
|
ret = wc_InitSha256_ex(&ssl->hsHashes->hashSha256, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
#if defined(WOLFSSL_HASH_FLAGS) || defined(WOLF_CRYPTO_CB)
|
|
wc_Sha256SetFlags(&ssl->hsHashes->hashSha256, WC_HASH_FLAG_WILLCOPY);
|
|
#endif
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
ret = wc_InitSha384_ex(&ssl->hsHashes->hashSha384, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
#if defined(WOLFSSL_HASH_FLAGS) || defined(WOLF_CRYPTO_CB)
|
|
wc_Sha384SetFlags(&ssl->hsHashes->hashSha384, WC_HASH_FLAG_WILLCOPY);
|
|
#endif
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
ret = wc_InitSha512_ex(&ssl->hsHashes->hashSha512, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
#if defined(WOLFSSL_HASH_FLAGS) || defined(WOLF_CRYPTO_CB)
|
|
wc_Sha512SetFlags(&ssl->hsHashes->hashSha512, WC_HASH_FLAG_WILLCOPY);
|
|
#endif
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
void FreeHandshakeHashes(WOLFSSL* ssl)
|
|
{
|
|
if (ssl->hsHashes) {
|
|
#ifndef NO_OLD_TLS
|
|
#ifndef NO_MD5
|
|
wc_Md5Free(&ssl->hsHashes->hashMd5);
|
|
#endif
|
|
#ifndef NO_SHA
|
|
wc_ShaFree(&ssl->hsHashes->hashSha);
|
|
#endif
|
|
#endif /* !NO_OLD_TLS */
|
|
#ifndef NO_SHA256
|
|
wc_Sha256Free(&ssl->hsHashes->hashSha256);
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
wc_Sha384Free(&ssl->hsHashes->hashSha384);
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
wc_Sha512Free(&ssl->hsHashes->hashSha512);
|
|
#endif
|
|
#if (defined(HAVE_ED25519) || defined(HAVE_ED448)) && \
|
|
!defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
if (ssl->hsHashes->messages != NULL) {
|
|
XFREE(ssl->hsHashes->messages, ssl->heap, DYNAMIC_TYPE_HASHES);
|
|
ssl->hsHashes->messages = NULL;
|
|
}
|
|
#endif
|
|
|
|
XFREE(ssl->hsHashes, ssl->heap, DYNAMIC_TYPE_HASHES);
|
|
ssl->hsHashes = NULL;
|
|
}
|
|
}
|
|
|
|
|
|
/* init everything to 0, NULL, default values before calling anything that may
|
|
fail so that destructor has a "good" state to cleanup
|
|
|
|
ssl object to initialize
|
|
ctx parent factory
|
|
writeDup flag indicating this is a write dup only
|
|
|
|
0 on success */
|
|
int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
|
|
{
|
|
int ret;
|
|
|
|
XMEMSET(ssl, 0, sizeof(WOLFSSL));
|
|
|
|
#if defined(WOLFSSL_STATIC_MEMORY)
|
|
if (ctx->heap != NULL) {
|
|
WOLFSSL_HEAP_HINT* ssl_hint;
|
|
WOLFSSL_HEAP_HINT* ctx_hint;
|
|
|
|
/* avoid dereferencing a test value */
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
if (ctx->heap == (void*)WOLFSSL_HEAP_TEST) {
|
|
ssl->heap = ctx->heap;
|
|
}
|
|
else {
|
|
#endif
|
|
ssl->heap = (WOLFSSL_HEAP_HINT*)XMALLOC(sizeof(WOLFSSL_HEAP_HINT),
|
|
ctx->heap, DYNAMIC_TYPE_SSL);
|
|
if (ssl->heap == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl->heap, 0, sizeof(WOLFSSL_HEAP_HINT));
|
|
ssl_hint = ((WOLFSSL_HEAP_HINT*)(ssl->heap));
|
|
ctx_hint = ((WOLFSSL_HEAP_HINT*)(ctx->heap));
|
|
|
|
/* lock and check IO count / handshake count */
|
|
if (wc_LockMutex(&(ctx_hint->memory->memory_mutex)) != 0) {
|
|
WOLFSSL_MSG("Bad memory_mutex lock");
|
|
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
|
|
ssl->heap = NULL; /* free and set to NULL for IO counter */
|
|
return BAD_MUTEX_E;
|
|
}
|
|
if (ctx_hint->memory->maxHa > 0 &&
|
|
ctx_hint->memory->maxHa <= ctx_hint->memory->curHa) {
|
|
WOLFSSL_MSG("At max number of handshakes for static memory");
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
|
|
ssl->heap = NULL; /* free and set to NULL for IO counter */
|
|
return MEMORY_E;
|
|
}
|
|
|
|
if (ctx_hint->memory->maxIO > 0 &&
|
|
ctx_hint->memory->maxIO <= ctx_hint->memory->curIO) {
|
|
WOLFSSL_MSG("At max number of IO allowed for static memory");
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
XFREE(ssl->heap, ctx->heap, DYNAMIC_TYPE_SSL);
|
|
ssl->heap = NULL; /* free and set to NULL for IO counter */
|
|
return MEMORY_E;
|
|
}
|
|
ctx_hint->memory->curIO++;
|
|
ctx_hint->memory->curHa++;
|
|
ssl_hint->memory = ctx_hint->memory;
|
|
ssl_hint->haFlag = 1;
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
|
|
/* check if tracking stats */
|
|
if (ctx_hint->memory->flag & WOLFMEM_TRACK_STATS) {
|
|
ssl_hint->stats = (WOLFSSL_MEM_CONN_STATS*)XMALLOC(
|
|
sizeof(WOLFSSL_MEM_CONN_STATS), ctx->heap, DYNAMIC_TYPE_SSL);
|
|
if (ssl_hint->stats == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl_hint->stats, 0, sizeof(WOLFSSL_MEM_CONN_STATS));
|
|
}
|
|
|
|
/* check if using fixed IO buffers */
|
|
if (ctx_hint->memory->flag & WOLFMEM_IO_POOL_FIXED) {
|
|
if (wc_LockMutex(&(ctx_hint->memory->memory_mutex)) != 0) {
|
|
WOLFSSL_MSG("Bad memory_mutex lock");
|
|
return BAD_MUTEX_E;
|
|
}
|
|
if (SetFixedIO(ctx_hint->memory, &(ssl_hint->inBuf)) != 1) {
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
return MEMORY_E;
|
|
}
|
|
if (SetFixedIO(ctx_hint->memory, &(ssl_hint->outBuf)) != 1) {
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
return MEMORY_E;
|
|
}
|
|
if (ssl_hint->outBuf == NULL || ssl_hint->inBuf == NULL) {
|
|
WOLFSSL_MSG("Not enough memory to create fixed IO buffers");
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
return MEMORY_E;
|
|
}
|
|
wc_UnLockMutex(&(ctx_hint->memory->memory_mutex));
|
|
}
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
}
|
|
#endif
|
|
}
|
|
else {
|
|
ssl->heap = ctx->heap;
|
|
}
|
|
#else
|
|
ssl->heap = ctx->heap; /* carry over user heap without static memory */
|
|
#endif /* WOLFSSL_STATIC_MEMORY */
|
|
|
|
ssl->buffers.inputBuffer.buffer = ssl->buffers.inputBuffer.staticBuffer;
|
|
ssl->buffers.inputBuffer.bufferSize = STATIC_BUFFER_LEN;
|
|
|
|
ssl->buffers.outputBuffer.buffer = ssl->buffers.outputBuffer.staticBuffer;
|
|
ssl->buffers.outputBuffer.bufferSize = STATIC_BUFFER_LEN;
|
|
|
|
#ifdef KEEP_PEER_CERT
|
|
InitX509(&ssl->peerCert, 0, ssl->heap);
|
|
#endif
|
|
|
|
ssl->rfd = -1; /* set to invalid descriptor */
|
|
ssl->wfd = -1;
|
|
ssl->devId = ctx->devId; /* device for async HW (from wolfAsync_DevOpen) */
|
|
|
|
ssl->IOCB_ReadCtx = &ssl->rfd; /* prevent invalid pointer access if not */
|
|
ssl->IOCB_WriteCtx = &ssl->wfd; /* correctly set */
|
|
|
|
#ifdef HAVE_NETX
|
|
ssl->IOCB_ReadCtx = &ssl->nxCtx; /* default NetX IO ctx, same for read */
|
|
ssl->IOCB_WriteCtx = &ssl->nxCtx; /* and write */
|
|
#elif defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP)
|
|
ssl->mnCtx = mynewt_ctx_new();
|
|
if(!ssl->mnCtx) {
|
|
return MEMORY_E;
|
|
}
|
|
ssl->IOCB_ReadCtx = ssl->mnCtx; /* default Mynewt IO ctx, same for read */
|
|
ssl->IOCB_WriteCtx = ssl->mnCtx; /* and write */
|
|
#elif defined (WOLFSSL_GNRC)
|
|
ssl->IOCB_ReadCtx = ssl->gnrcCtx;
|
|
ssl->IOCB_WriteCtx = ssl->gnrcCtx;
|
|
#endif
|
|
/* initialize states */
|
|
ssl->options.serverState = NULL_STATE;
|
|
ssl->options.clientState = NULL_STATE;
|
|
ssl->options.connectState = CONNECT_BEGIN;
|
|
ssl->options.acceptState = ACCEPT_BEGIN;
|
|
ssl->options.handShakeState = NULL_STATE;
|
|
ssl->options.processReply = doProcessInit;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
ssl->options.buildMsgState = BUILD_MSG_BEGIN;
|
|
ssl->encrypt.state = CIPHER_STATE_BEGIN;
|
|
ssl->decrypt.state = CIPHER_STATE_BEGIN;
|
|
#ifndef NO_DH
|
|
#if !defined(WOLFSSL_OLD_PRIME_CHECK) && !defined(HAVE_FIPS) && \
|
|
!defined(HAVE_SELFTEST)
|
|
ssl->options.dhDoKeyTest = 1;
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
#ifdef WOLFSSL_SCTP
|
|
ssl->options.dtlsSctp = ctx->dtlsSctp;
|
|
#endif
|
|
#if defined(WOLFSSL_SCTP) || defined(WOLFSSL_DTLS_MTU)
|
|
ssl->dtlsMtuSz = ctx->dtlsMtuSz;
|
|
ssl->dtls_expected_rx = ssl->dtlsMtuSz;
|
|
#else
|
|
ssl->dtls_expected_rx = MAX_MTU;
|
|
#endif
|
|
ssl->dtls_timeout_init = DTLS_TIMEOUT_INIT;
|
|
ssl->dtls_timeout_max = DTLS_TIMEOUT_MAX;
|
|
ssl->dtls_timeout = ssl->dtls_timeout_init;
|
|
ssl->buffers.dtlsCtx.rfd = -1;
|
|
ssl->buffers.dtlsCtx.wfd = -1;
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
#ifndef NO_OLD_TLS
|
|
ssl->hmac = SSL_hmac; /* default to SSLv3 */
|
|
#elif !defined(WOLFSSL_NO_TLS12)
|
|
ssl->hmac = TLS_hmac;
|
|
#endif
|
|
#endif
|
|
|
|
#if defined(WOLFSSL_OPENVPN) && defined(HAVE_KEYING_MATERIAL)
|
|
/* Save arrays by default for OpenVPN */
|
|
ssl->options.saveArrays = 1;
|
|
#endif
|
|
|
|
ssl->cipher.ssl = ssl;
|
|
|
|
#ifdef HAVE_EXTENDED_MASTER
|
|
ssl->options.haveEMS = ctx->haveEMS;
|
|
#endif
|
|
ssl->options.useClientOrder = ctx->useClientOrder;
|
|
ssl->options.mutualAuth = ctx->mutualAuth;
|
|
|
|
#ifdef WOLFSSL_STATIC_EPHEMERAL
|
|
ssl->staticKE = ctx->staticKE;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
#ifdef HAVE_SESSION_TICKET
|
|
ssl->options.noTicketTls13 = ctx->noTicketTls13;
|
|
#endif
|
|
ssl->options.noPskDheKe = ctx->noPskDheKe;
|
|
#if defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
ssl->options.postHandshakeAuth = ctx->postHandshakeAuth;
|
|
#endif
|
|
|
|
if (ctx->numGroups > 0) {
|
|
XMEMCPY(ssl->group, ctx->group, sizeof(*ctx->group) * ctx->numGroups);
|
|
ssl->numGroups = ctx->numGroups;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
#ifdef HAVE_MAX_FRAGMENT
|
|
ssl->max_fragment = MAX_RECORD_SIZE;
|
|
#endif
|
|
#ifdef HAVE_ALPN
|
|
ssl->alpn_client_list = NULL;
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
|
|
ssl->alpnSelect = ctx->alpnSelect;
|
|
ssl->alpnSelectArg = ctx->alpnSelectArg;
|
|
#endif
|
|
#endif
|
|
#ifdef HAVE_SUPPORTED_CURVES
|
|
ssl->options.userCurves = ctx->userCurves;
|
|
#endif
|
|
#endif /* HAVE_TLS_EXTENSIONS */
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
ssl->options.disallowEncThenMac = ctx->disallowEncThenMac;
|
|
#endif
|
|
|
|
/* default alert state (none) */
|
|
ssl->alert_history.last_rx.code = -1;
|
|
ssl->alert_history.last_rx.level = -1;
|
|
ssl->alert_history.last_tx.code = -1;
|
|
ssl->alert_history.last_tx.level = -1;
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
/* copy over application session context ID */
|
|
ssl->sessionCtxSz = ctx->sessionCtxSz;
|
|
XMEMCPY(ssl->sessionCtx, ctx->sessionCtx, ctx->sessionCtxSz);
|
|
ssl->cbioFlag = ctx->cbioFlag;
|
|
|
|
#endif
|
|
|
|
InitCiphers(ssl);
|
|
InitCipherSpecs(&ssl->specs);
|
|
|
|
/* all done with init, now can return errors, call other stuff */
|
|
|
|
if (!writeDup) {
|
|
/* arrays */
|
|
ssl->arrays = (Arrays*)XMALLOC(sizeof(Arrays), ssl->heap,
|
|
DYNAMIC_TYPE_ARRAYS);
|
|
if (ssl->arrays == NULL) {
|
|
WOLFSSL_MSG("Arrays Memory error");
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl->arrays, 0, sizeof(Arrays));
|
|
#if defined(WOLFSSL_TLS13) || defined(WOLFSSL_SNIFFER)
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN;
|
|
ssl->arrays->preMasterSecret = (byte*)XMALLOC(ENCRYPT_LEN, ssl->heap,
|
|
DYNAMIC_TYPE_SECRET);
|
|
if (ssl->arrays->preMasterSecret == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl->arrays->preMasterSecret, 0, ENCRYPT_LEN);
|
|
#endif
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
if ((ssl->param = (WOLFSSL_X509_VERIFY_PARAM*)XMALLOC(
|
|
sizeof(WOLFSSL_X509_VERIFY_PARAM),
|
|
ssl->heap, DYNAMIC_TYPE_OPENSSL)) == NULL) {
|
|
WOLFSSL_MSG("ssl->param memory error");
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl->param, 0, sizeof(WOLFSSL_X509_VERIFY_PARAM));
|
|
#endif
|
|
|
|
#ifdef SINGLE_THREADED
|
|
if (ctx->suites == NULL)
|
|
#endif
|
|
{
|
|
/* suites */
|
|
ssl->suites = (Suites*)XMALLOC(sizeof(Suites), ssl->heap,
|
|
DYNAMIC_TYPE_SUITES);
|
|
if (ssl->suites == NULL) {
|
|
WOLFSSL_MSG("Suites Memory error");
|
|
return MEMORY_E;
|
|
}
|
|
#ifdef OPENSSL_ALL
|
|
ssl->suites->stack = NULL;
|
|
#endif
|
|
#ifdef SINGLE_THREADED
|
|
ssl->options.ownSuites = 1;
|
|
#endif
|
|
}
|
|
#ifdef SINGLE_THREADED
|
|
else {
|
|
ssl->options.ownSuites = 0;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
/* Initialize SSL with the appropriate fields from it's ctx */
|
|
/* requires valid arrays and suites unless writeDup ing */
|
|
if ((ret = SetSSL_CTX(ssl, ctx, writeDup)) != WOLFSSL_SUCCESS)
|
|
return ret;
|
|
|
|
ssl->options.dtls = ssl->version.major == DTLS_MAJOR;
|
|
|
|
#ifdef SINGLE_THREADED
|
|
ssl->rng = ctx->rng; /* CTX may have one, if so use it */
|
|
#endif
|
|
|
|
if (ssl->rng == NULL) {
|
|
/* RNG */
|
|
ssl->rng = (WC_RNG*)XMALLOC(sizeof(WC_RNG), ssl->heap,DYNAMIC_TYPE_RNG);
|
|
if (ssl->rng == NULL) {
|
|
WOLFSSL_MSG("RNG Memory error");
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(ssl->rng, 0, sizeof(WC_RNG));
|
|
ssl->options.weOwnRng = 1;
|
|
|
|
/* FIPS RNG API does not accept a heap hint */
|
|
#ifndef HAVE_FIPS
|
|
if ( (ret = wc_InitRng_ex(ssl->rng, ssl->heap, ssl->devId)) != 0) {
|
|
WOLFSSL_MSG("RNG Init error");
|
|
return ret;
|
|
}
|
|
#else
|
|
if ( (ret = wc_InitRng(ssl->rng)) != 0) {
|
|
WOLFSSL_MSG("RNG Init error");
|
|
return ret;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
#ifdef HAVE_WRITE_DUP
|
|
if (writeDup) {
|
|
/* all done */
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/* hsHashes */
|
|
ret = InitHandshakeHashes(ssl);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#if defined(WOLFSSL_DTLS) && !defined(NO_WOLFSSL_SERVER)
|
|
if (ssl->options.dtls && ssl->options.side == WOLFSSL_SERVER_END) {
|
|
ret = wolfSSL_DTLS_SetCookieSecret(ssl, NULL, 0);
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("DTLS Cookie Secret error");
|
|
return ret;
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_DTLS && !NO_WOLFSSL_SERVER */
|
|
|
|
#ifdef HAVE_SECRET_CALLBACK
|
|
ssl->sessionSecretCb = NULL;
|
|
ssl->sessionSecretCtx = NULL;
|
|
#ifdef WOLFSSL_TLS13
|
|
ssl->tls13SecretCb = NULL;
|
|
ssl->tls13SecretCtx = NULL;
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
ssl->options.noTicketTls12 = ctx->noTicketTls12;
|
|
ssl->session.ticket = ssl->session.staticTicket;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_MULTICAST
|
|
if (ctx->haveMcast) {
|
|
int i;
|
|
|
|
ssl->options.haveMcast = 1;
|
|
ssl->options.mcastID = ctx->mcastID;
|
|
|
|
/* Force the state to look like handshake has completed. */
|
|
/* Keying material is supplied externally. */
|
|
ssl->options.serverState = SERVER_FINISHED_COMPLETE;
|
|
ssl->options.clientState = CLIENT_FINISHED_COMPLETE;
|
|
ssl->options.connectState = SECOND_REPLY_DONE;
|
|
ssl->options.acceptState = ACCEPT_THIRD_REPLY_DONE;
|
|
ssl->options.handShakeState = HANDSHAKE_DONE;
|
|
ssl->options.handShakeDone = 1;
|
|
|
|
for (i = 0; i < WOLFSSL_DTLS_PEERSEQ_SZ; i++)
|
|
ssl->keys.peerSeq[i].peerId = INVALID_PEER_ID;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
int useSecureReneg = ssl->ctx->useSecureReneg;
|
|
/* use secure renegotiation by default (not recommend) */
|
|
#ifdef WOLFSSL_SECURE_RENEGOTIATION_ON_BY_DEFAULT
|
|
useSecureReneg = 1;
|
|
#endif
|
|
if (useSecureReneg) {
|
|
ret = wolfSSL_UseSecureRenegotiation(ssl);
|
|
if (ret != WOLFSSL_SUCCESS)
|
|
return ret;
|
|
}
|
|
}
|
|
#endif /* HAVE_SECURE_RENEGOTIATION */
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* free use of temporary arrays */
|
|
void FreeArrays(WOLFSSL* ssl, int keep)
|
|
{
|
|
if (ssl->arrays) {
|
|
if (keep) {
|
|
/* keeps session id for user retrieval */
|
|
XMEMCPY(ssl->session.sessionID, ssl->arrays->sessionID, ID_LEN);
|
|
ssl->session.sessionIDSz = ssl->arrays->sessionIDSz;
|
|
}
|
|
if (ssl->arrays->preMasterSecret) {
|
|
XFREE(ssl->arrays->preMasterSecret, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
ssl->arrays->preMasterSecret = NULL;
|
|
}
|
|
XFREE(ssl->arrays->pendingMsg, ssl->heap, DYNAMIC_TYPE_ARRAYS);
|
|
ssl->arrays->pendingMsg = NULL;
|
|
ForceZero(ssl->arrays, sizeof(Arrays)); /* clear arrays struct */
|
|
}
|
|
XFREE(ssl->arrays, ssl->heap, DYNAMIC_TYPE_ARRAYS);
|
|
ssl->arrays = NULL;
|
|
}
|
|
|
|
void FreeKey(WOLFSSL* ssl, int type, void** pKey)
|
|
{
|
|
if (ssl && pKey && *pKey) {
|
|
switch (type) {
|
|
#ifndef NO_RSA
|
|
case DYNAMIC_TYPE_RSA:
|
|
wc_FreeRsaKey((RsaKey*)*pKey);
|
|
break;
|
|
#endif /* ! NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case DYNAMIC_TYPE_ECC:
|
|
wc_ecc_free((ecc_key*)*pKey);
|
|
break;
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case DYNAMIC_TYPE_ED25519:
|
|
wc_ed25519_free((ed25519_key*)*pKey);
|
|
break;
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_CURVE25519
|
|
case DYNAMIC_TYPE_CURVE25519:
|
|
wc_curve25519_free((curve25519_key*)*pKey);
|
|
break;
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_ED448
|
|
case DYNAMIC_TYPE_ED448:
|
|
wc_ed448_free((ed448_key*)*pKey);
|
|
break;
|
|
#endif /* HAVE_ED448 */
|
|
#ifdef HAVE_CURVE448
|
|
case DYNAMIC_TYPE_CURVE448:
|
|
wc_curve448_free((curve448_key*)*pKey);
|
|
break;
|
|
#endif /* HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case DYNAMIC_TYPE_DH:
|
|
wc_FreeDhKey((DhKey*)*pKey);
|
|
break;
|
|
#endif /* !NO_DH */
|
|
default:
|
|
break;
|
|
}
|
|
XFREE(*pKey, ssl->heap, type);
|
|
|
|
/* Reset pointer */
|
|
*pKey = NULL;
|
|
}
|
|
}
|
|
|
|
int AllocKey(WOLFSSL* ssl, int type, void** pKey)
|
|
{
|
|
int ret = BAD_FUNC_ARG;
|
|
int sz = 0;
|
|
|
|
if (ssl == NULL || pKey == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* Sanity check key destination */
|
|
if (*pKey != NULL) {
|
|
WOLFSSL_MSG("Key already present!");
|
|
return BAD_STATE_E;
|
|
}
|
|
|
|
/* Determine size */
|
|
switch (type) {
|
|
#ifndef NO_RSA
|
|
case DYNAMIC_TYPE_RSA:
|
|
sz = sizeof(RsaKey);
|
|
break;
|
|
#endif /* ! NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case DYNAMIC_TYPE_ECC:
|
|
sz = sizeof(ecc_key);
|
|
break;
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case DYNAMIC_TYPE_ED25519:
|
|
sz = sizeof(ed25519_key);
|
|
break;
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_CURVE25519
|
|
case DYNAMIC_TYPE_CURVE25519:
|
|
sz = sizeof(curve25519_key);
|
|
break;
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_ED448
|
|
case DYNAMIC_TYPE_ED448:
|
|
sz = sizeof(ed448_key);
|
|
break;
|
|
#endif /* HAVE_ED448 */
|
|
#ifdef HAVE_CURVE448
|
|
case DYNAMIC_TYPE_CURVE448:
|
|
sz = sizeof(curve448_key);
|
|
break;
|
|
#endif /* HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case DYNAMIC_TYPE_DH:
|
|
sz = sizeof(DhKey);
|
|
break;
|
|
#endif /* !NO_DH */
|
|
default:
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
if (sz == 0) {
|
|
return NOT_COMPILED_IN;
|
|
}
|
|
|
|
/* Allocate memory for key */
|
|
*pKey = (void *)XMALLOC(sz, ssl->heap, type);
|
|
if (*pKey == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
|
|
/* Initialize key */
|
|
switch (type) {
|
|
#ifndef NO_RSA
|
|
case DYNAMIC_TYPE_RSA:
|
|
ret = wc_InitRsaKey_ex((RsaKey*)*pKey, ssl->heap, ssl->devId);
|
|
break;
|
|
#endif /* ! NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case DYNAMIC_TYPE_ECC:
|
|
ret = wc_ecc_init_ex((ecc_key*)*pKey, ssl->heap, ssl->devId);
|
|
break;
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case DYNAMIC_TYPE_ED25519:
|
|
wc_ed25519_init((ed25519_key*)*pKey);
|
|
ret = 0;
|
|
break;
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_CURVE25519
|
|
case DYNAMIC_TYPE_CURVE25519:
|
|
wc_curve25519_init((curve25519_key*)*pKey);
|
|
ret = 0;
|
|
break;
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_ED448
|
|
case DYNAMIC_TYPE_ED448:
|
|
wc_ed448_init((ed448_key*)*pKey);
|
|
ret = 0;
|
|
break;
|
|
#endif /* HAVE_CURVE448 */
|
|
#ifdef HAVE_CURVE448
|
|
case DYNAMIC_TYPE_CURVE448:
|
|
wc_curve448_init((curve448_key*)*pKey);
|
|
ret = 0;
|
|
break;
|
|
#endif /* HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case DYNAMIC_TYPE_DH:
|
|
ret = wc_InitDhKey_ex((DhKey*)*pKey, ssl->heap, ssl->devId);
|
|
break;
|
|
#endif /* !NO_DH */
|
|
default:
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* On error free handshake key */
|
|
if (ret != 0) {
|
|
FreeKey(ssl, type, pKey);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
#if !defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \
|
|
defined(HAVE_CURVE25519) || defined(HHAVE_ED448) || defined(HAVE_CURVE448)
|
|
static int ReuseKey(WOLFSSL* ssl, int type, void* pKey)
|
|
{
|
|
int ret = 0;
|
|
|
|
(void)ssl;
|
|
|
|
switch (type) {
|
|
#ifndef NO_RSA
|
|
case DYNAMIC_TYPE_RSA:
|
|
wc_FreeRsaKey((RsaKey*)pKey);
|
|
ret = wc_InitRsaKey_ex((RsaKey*)pKey, ssl->heap, ssl->devId);
|
|
break;
|
|
#endif /* ! NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case DYNAMIC_TYPE_ECC:
|
|
wc_ecc_free((ecc_key*)pKey);
|
|
ret = wc_ecc_init_ex((ecc_key*)pKey, ssl->heap, ssl->devId);
|
|
break;
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case DYNAMIC_TYPE_ED25519:
|
|
wc_ed25519_free((ed25519_key*)pKey);
|
|
ret = wc_ed25519_init((ed25519_key*)pKey);
|
|
break;
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_CURVE25519
|
|
case DYNAMIC_TYPE_CURVE25519:
|
|
wc_curve25519_free((curve25519_key*)pKey);
|
|
ret = wc_curve25519_init((curve25519_key*)pKey);
|
|
break;
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_ED448
|
|
case DYNAMIC_TYPE_ED448:
|
|
wc_ed448_free((ed448_key*)pKey);
|
|
ret = wc_ed448_init((ed448_key*)pKey);
|
|
break;
|
|
#endif /* HAVE_CURVE448 */
|
|
#ifdef HAVE_CURVE448
|
|
case DYNAMIC_TYPE_CURVE448:
|
|
wc_curve448_free((curve448_key*)pKey);
|
|
ret = wc_curve448_init((curve448_key*)pKey);
|
|
break;
|
|
#endif /* HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case DYNAMIC_TYPE_DH:
|
|
wc_FreeDhKey((DhKey*)pKey);
|
|
ret = wc_InitDhKey_ex((DhKey*)pKey, ssl->heap, ssl->devId);
|
|
break;
|
|
#endif /* !NO_DH */
|
|
default:
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
void FreeKeyExchange(WOLFSSL* ssl)
|
|
{
|
|
/* Cleanup signature buffer */
|
|
if (ssl->buffers.sig.buffer) {
|
|
XFREE(ssl->buffers.sig.buffer, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
ssl->buffers.sig.buffer = NULL;
|
|
ssl->buffers.sig.length = 0;
|
|
}
|
|
|
|
/* Cleanup digest buffer */
|
|
if (ssl->buffers.digest.buffer) {
|
|
XFREE(ssl->buffers.digest.buffer, ssl->heap, DYNAMIC_TYPE_DIGEST);
|
|
ssl->buffers.digest.buffer = NULL;
|
|
ssl->buffers.digest.length = 0;
|
|
}
|
|
|
|
/* Free handshake key */
|
|
FreeKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
|
|
#ifndef NO_DH
|
|
/* Free temp DH key */
|
|
FreeKey(ssl, DYNAMIC_TYPE_DH, (void**)&ssl->buffers.serverDH_Key);
|
|
#endif
|
|
|
|
/* Cleanup async */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ssl->async.freeArgs) {
|
|
ssl->async.freeArgs(ssl, ssl->async.args);
|
|
ssl->async.freeArgs = NULL;
|
|
}
|
|
FreeBuildMsgArgs(ssl, &ssl->async.buildArgs);
|
|
#endif
|
|
}
|
|
|
|
|
|
/* Free up all memory used by Suites structure from WOLFSSL */
|
|
void FreeSuites(WOLFSSL* ssl)
|
|
{
|
|
#ifdef SINGLE_THREADED
|
|
if (ssl->options.ownSuites)
|
|
#endif
|
|
{
|
|
#ifdef OPENSSL_ALL
|
|
wolfSSL_sk_SSL_CIPHER_free(ssl->suites->stack);
|
|
#endif
|
|
XFREE(ssl->suites, ssl->heap, DYNAMIC_TYPE_SUITES);
|
|
}
|
|
ssl->suites = NULL;
|
|
}
|
|
|
|
|
|
/* In case holding SSL object in array and don't want to free actual ssl */
|
|
void SSL_ResourceFree(WOLFSSL* ssl)
|
|
{
|
|
/* Note: any resources used during the handshake should be released in the
|
|
* function FreeHandshakeResources(). Be careful with the special cases
|
|
* like the RNG which may optionally be kept for the whole session. (For
|
|
* example with the RNG, it isn't used beyond the handshake except when
|
|
* using stream ciphers where it is retained. */
|
|
|
|
FreeCiphers(ssl);
|
|
FreeArrays(ssl, 0);
|
|
FreeKeyExchange(ssl);
|
|
if (ssl->options.weOwnRng) {
|
|
wc_FreeRng(ssl->rng);
|
|
XFREE(ssl->rng, ssl->heap, DYNAMIC_TYPE_RNG);
|
|
}
|
|
FreeSuites(ssl);
|
|
FreeHandshakeHashes(ssl);
|
|
XFREE(ssl->buffers.domainName.buffer, ssl->heap, DYNAMIC_TYPE_DOMAIN);
|
|
|
|
/* clear keys struct after session */
|
|
ForceZero(&ssl->keys, sizeof(Keys));
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3) {
|
|
ForceZero(&ssl->clientSecret, sizeof(ssl->clientSecret));
|
|
ForceZero(&ssl->serverSecret, sizeof(ssl->serverSecret));
|
|
}
|
|
#endif
|
|
|
|
#ifndef NO_DH
|
|
if (ssl->buffers.serverDH_Priv.buffer) {
|
|
ForceZero(ssl->buffers.serverDH_Priv.buffer,
|
|
ssl->buffers.serverDH_Priv.length);
|
|
}
|
|
XFREE(ssl->buffers.serverDH_Priv.buffer, ssl->heap, DYNAMIC_TYPE_PRIVATE_KEY);
|
|
XFREE(ssl->buffers.serverDH_Pub.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
/* parameters (p,g) may be owned by ctx */
|
|
if (ssl->buffers.weOwnDH) {
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
}
|
|
#endif /* !NO_DH */
|
|
#ifndef NO_CERTS
|
|
ssl->keepCert = 0; /* make sure certificate is free'd */
|
|
wolfSSL_UnloadCertsKeys(ssl);
|
|
#endif
|
|
#ifndef NO_RSA
|
|
FreeKey(ssl, DYNAMIC_TYPE_RSA, (void**)&ssl->peerRsaKey);
|
|
ssl->peerRsaKeyPresent = 0;
|
|
#endif
|
|
#ifdef WOLFSSL_RENESAS_TSIP_TLS
|
|
XFREE(ssl->peerTsipEncRsaKeyIndex, ssl->heap, DYNAMIC_TYPE_RSA);
|
|
#endif
|
|
if (ssl->buffers.inputBuffer.dynamicFlag)
|
|
ShrinkInputBuffer(ssl, FORCED_FREE);
|
|
if (ssl->buffers.outputBuffer.dynamicFlag)
|
|
ShrinkOutputBuffer(ssl);
|
|
#if defined(WOLFSSL_SEND_HRR_COOKIE) && !defined(NO_WOLFSSL_SERVER)
|
|
XFREE(ssl->buffers.tls13CookieSecret.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_COOKIE_PWD);
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
DtlsMsgPoolReset(ssl);
|
|
if (ssl->dtls_rx_msg_list != NULL) {
|
|
DtlsMsgListDelete(ssl->dtls_rx_msg_list, ssl->heap);
|
|
ssl->dtls_rx_msg_list = NULL;
|
|
ssl->dtls_rx_msg_list_sz = 0;
|
|
}
|
|
XFREE(ssl->buffers.dtlsCtx.peer.sa, ssl->heap, DYNAMIC_TYPE_SOCKADDR);
|
|
ssl->buffers.dtlsCtx.peer.sa = NULL;
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
XFREE(ssl->buffers.dtlsCookieSecret.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_COOKIE_PWD);
|
|
#endif
|
|
#endif /* WOLFSSL_DTLS */
|
|
#ifdef OPENSSL_EXTRA
|
|
#ifndef NO_BIO
|
|
if (ssl->biord != ssl->biowr) /* only free write if different */
|
|
wolfSSL_BIO_free(ssl->biowr);
|
|
wolfSSL_BIO_free(ssl->biord); /* always free read bio */
|
|
ssl->biowr = NULL;
|
|
ssl->biord = NULL;
|
|
#endif
|
|
#endif
|
|
#ifdef HAVE_LIBZ
|
|
FreeStreams(ssl);
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC, (void**)&ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC, (void**)&ssl->peerEccDsaKey);
|
|
ssl->peerEccDsaKeyPresent = 0;
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) ||defined(HAVE_CURVE448)
|
|
{
|
|
int dtype = 0;
|
|
#ifdef HAVE_ECC
|
|
dtype = DYNAMIC_TYPE_ECC;
|
|
#endif
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->peerX25519KeyPresent
|
|
#ifdef HAVE_ECC
|
|
|| ssl->eccTempKeyPresent == DYNAMIC_TYPE_CURVE25519
|
|
#endif /* HAVE_ECC */
|
|
)
|
|
{
|
|
dtype = DYNAMIC_TYPE_CURVE25519;
|
|
}
|
|
#endif /* HAVE_CURVE25519 */
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->peerX448KeyPresent
|
|
#ifdef HAVE_ECC
|
|
|| ssl->eccTempKeyPresent == DYNAMIC_TYPE_CURVE448
|
|
#endif /* HAVE_ECC */
|
|
)
|
|
{
|
|
dtype = DYNAMIC_TYPE_CURVE448;
|
|
}
|
|
#endif /* HAVE_CURVE448 */
|
|
FreeKey(ssl, dtype, (void**)&ssl->eccTempKey);
|
|
ssl->eccTempKeyPresent = 0;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifdef HAVE_CURVE25519
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE25519, (void**)&ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
FreeKey(ssl, DYNAMIC_TYPE_ED25519, (void**)&ssl->peerEd25519Key);
|
|
ssl->peerEd25519KeyPresent = 0;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->buffers.peerEd25519Key.buffer != NULL) {
|
|
XFREE(ssl->buffers.peerEd25519Key.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_ED25519);
|
|
ssl->buffers.peerEd25519Key.buffer = NULL;
|
|
}
|
|
#endif
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE448, (void**)&ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
FreeKey(ssl, DYNAMIC_TYPE_ED448, (void**)&ssl->peerEd448Key);
|
|
ssl->peerEd448KeyPresent = 0;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->buffers.peerEd448Key.buffer != NULL) {
|
|
XFREE(ssl->buffers.peerEd448Key.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_ED448);
|
|
ssl->buffers.peerEd448Key.buffer = NULL;
|
|
}
|
|
#endif
|
|
#endif
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
#ifdef HAVE_ECC
|
|
XFREE(ssl->buffers.peerEccDsaKey.buffer, ssl->heap, DYNAMIC_TYPE_ECC);
|
|
#endif /* HAVE_ECC */
|
|
#ifndef NO_RSA
|
|
XFREE(ssl->buffers.peerRsaKey.buffer, ssl->heap, DYNAMIC_TYPE_RSA);
|
|
#endif /* NO_RSA */
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
TLSX_FreeAll(ssl->extensions, ssl->heap);
|
|
|
|
#ifdef HAVE_ALPN
|
|
if (ssl->alpn_client_list != NULL) {
|
|
XFREE(ssl->alpn_client_list, ssl->heap, DYNAMIC_TYPE_ALPN);
|
|
ssl->alpn_client_list = NULL;
|
|
}
|
|
#endif
|
|
#endif /* HAVE_TLS_EXTENSIONS */
|
|
#if defined(WOLFSSL_APACHE_MYNEWT) && !defined(WOLFSSL_LWIP)
|
|
if (ssl->mnCtx) {
|
|
mynewt_ctx_clear(ssl->mnCtx);
|
|
ssl->mnCtx = NULL;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_NETX
|
|
if (ssl->nxCtx.nxPacket)
|
|
nx_packet_release(ssl->nxCtx.nxPacket);
|
|
#endif
|
|
#ifdef KEEP_PEER_CERT
|
|
FreeX509(&ssl->peerCert);
|
|
#endif
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->session.isDynamic) {
|
|
XFREE(ssl->session.ticket, ssl->heap, DYNAMIC_TYPE_SESSION_TICK);
|
|
ssl->session.ticket = ssl->session.staticTicket;
|
|
ssl->session.isDynamic = 0;
|
|
ssl->session.ticketLen = 0;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_EXT_CACHE
|
|
wolfSSL_SESSION_free(ssl->extSession);
|
|
#endif
|
|
#ifdef HAVE_WRITE_DUP
|
|
if (ssl->dupWrite) {
|
|
FreeWriteDup(ssl);
|
|
}
|
|
#endif
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->param) {
|
|
XFREE(ssl->param, ssl->heap, DYNAMIC_TYPE_OPENSSL);
|
|
}
|
|
#endif
|
|
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
while (ssl->certReqCtx != NULL) {
|
|
CertReqCtx* curr = ssl->certReqCtx;
|
|
ssl->certReqCtx = curr->next;
|
|
XFREE(curr, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_STATIC_EPHEMERAL
|
|
#ifndef NO_DH
|
|
if (ssl->staticKE.dhKey && ssl->staticKE.dhKey != ssl->ctx->staticKE.dhKey)
|
|
FreeDer(&ssl->staticKE.dhKey);
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (ssl->staticKE.ecKey && ssl->staticKE.ecKey != ssl->ctx->staticKE.ecKey)
|
|
FreeDer(&ssl->staticKE.ecKey);
|
|
#endif
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
/* check if using fixed io buffers and free them */
|
|
if (ssl->heap != NULL) {
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
/* avoid dereferencing a test value */
|
|
if (ssl->heap != (void*)WOLFSSL_HEAP_TEST) {
|
|
#endif
|
|
WOLFSSL_HEAP_HINT* ssl_hint = (WOLFSSL_HEAP_HINT*)ssl->heap;
|
|
WOLFSSL_HEAP* ctx_heap;
|
|
void* heap = ssl->ctx ? ssl->ctx->heap : ssl->heap;
|
|
|
|
ctx_heap = ssl_hint->memory;
|
|
if (wc_LockMutex(&(ctx_heap->memory_mutex)) != 0) {
|
|
WOLFSSL_MSG("Bad memory_mutex lock");
|
|
}
|
|
ctx_heap->curIO--;
|
|
if (FreeFixedIO(ctx_heap, &(ssl_hint->outBuf)) != 1) {
|
|
WOLFSSL_MSG("Error freeing fixed output buffer");
|
|
}
|
|
if (FreeFixedIO(ctx_heap, &(ssl_hint->inBuf)) != 1) {
|
|
WOLFSSL_MSG("Error freeing fixed output buffer");
|
|
}
|
|
if (ssl_hint->haFlag) { /* check if handshake count has been decreased*/
|
|
ctx_heap->curHa--;
|
|
}
|
|
wc_UnLockMutex(&(ctx_heap->memory_mutex));
|
|
|
|
/* check if tracking stats */
|
|
if (ctx_heap->flag & WOLFMEM_TRACK_STATS) {
|
|
XFREE(ssl_hint->stats, heap, DYNAMIC_TYPE_SSL);
|
|
}
|
|
XFREE(ssl->heap, heap, DYNAMIC_TYPE_SSL);
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
}
|
|
#endif
|
|
}
|
|
#endif /* WOLFSSL_STATIC_MEMORY */
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
|
wolfSSL_sk_CIPHER_free(ssl->supportedCiphers);
|
|
wolfSSL_sk_X509_free(ssl->peerCertChain);
|
|
#endif
|
|
}
|
|
|
|
/* Free any handshake resources no longer needed */
|
|
void FreeHandshakeResources(WOLFSSL* ssl)
|
|
{
|
|
WOLFSSL_ENTER("FreeHandshakeResources");
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
/* DTLS_POOL */
|
|
if (ssl->options.dtls) {
|
|
DtlsMsgPoolReset(ssl);
|
|
DtlsMsgListDelete(ssl->dtls_rx_msg_list, ssl->heap);
|
|
ssl->dtls_rx_msg_list = NULL;
|
|
ssl->dtls_rx_msg_list_sz = 0;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) {
|
|
WOLFSSL_MSG("Secure Renegotiation needs to retain handshake resources");
|
|
return;
|
|
}
|
|
#endif
|
|
|
|
/* input buffer */
|
|
if (ssl->buffers.inputBuffer.dynamicFlag)
|
|
ShrinkInputBuffer(ssl, NO_FORCED_FREE);
|
|
|
|
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
if (!ssl->options.tls1_3)
|
|
#endif
|
|
{
|
|
#ifndef OPENSSL_ALL
|
|
/* free suites unless using compatibility layer */
|
|
FreeSuites(ssl);
|
|
#endif
|
|
/* hsHashes */
|
|
FreeHandshakeHashes(ssl);
|
|
}
|
|
|
|
/* RNG */
|
|
if (ssl->options.tls1_1 == 0
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
|| ssl->specs.cipher_type == stream
|
|
#endif
|
|
#if defined(WOLFSSL_TLS13)
|
|
#if !defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
|| ssl->options.tls1_3
|
|
#elif !defined(HAVE_SESSION_TICKET)
|
|
|| (ssl->options.tls1_3 && ssl->options.side == WOLFSSL_SERVER_END)
|
|
#endif
|
|
#endif
|
|
) {
|
|
if (ssl->options.weOwnRng) {
|
|
wc_FreeRng(ssl->rng);
|
|
XFREE(ssl->rng, ssl->heap, DYNAMIC_TYPE_RNG);
|
|
ssl->rng = NULL;
|
|
ssl->options.weOwnRng = 0;
|
|
}
|
|
}
|
|
|
|
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH) && \
|
|
defined(HAVE_SESSION_TICKET)
|
|
if (!ssl->options.tls1_3)
|
|
#endif
|
|
/* arrays */
|
|
if (ssl->options.saveArrays == 0)
|
|
FreeArrays(ssl, 1);
|
|
|
|
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
if (!ssl->options.tls1_3 || ssl->options.side == WOLFSSL_CLIENT_END)
|
|
#endif
|
|
{
|
|
#ifndef NO_RSA
|
|
/* peerRsaKey */
|
|
FreeKey(ssl, DYNAMIC_TYPE_RSA, (void**)&ssl->peerRsaKey);
|
|
ssl->peerRsaKeyPresent = 0;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC, (void**)&ssl->peerEccDsaKey);
|
|
ssl->peerEccDsaKeyPresent = 0;
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
FreeKey(ssl, DYNAMIC_TYPE_ED25519, (void**)&ssl->peerEd25519Key);
|
|
ssl->peerEd25519KeyPresent = 0;
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_ED448
|
|
FreeKey(ssl, DYNAMIC_TYPE_ED448, (void**)&ssl->peerEd448Key);
|
|
ssl->peerEd448KeyPresent = 0;
|
|
#endif /* HAVE_ED448 */
|
|
}
|
|
|
|
#ifdef HAVE_ECC
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC, (void**)&ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
{
|
|
int dtype;
|
|
#ifdef HAVE_ECC
|
|
dtype = DYNAMIC_TYPE_ECC;
|
|
#elif defined(HAVE_CURVE25519)
|
|
dtype = DYNAMIC_TYPE_CURVE25519;
|
|
#else
|
|
dtype = DYNAMIC_TYPE_CURVE448;
|
|
#endif
|
|
#if defined(HAVE_ECC) && defined(HAVE_CURVE25519)
|
|
if (ssl->peerX25519KeyPresent ||
|
|
ssl->eccTempKeyPresent == DYNAMIC_TYPE_CURVE25519)
|
|
{
|
|
dtype = DYNAMIC_TYPE_CURVE25519;
|
|
}
|
|
#endif
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519)) && \
|
|
defined(HAVE_CURVE448)
|
|
if (ssl->peerX448KeyPresent ||
|
|
ssl->eccTempKeyPresent == DYNAMIC_TYPE_CURVE448)
|
|
{
|
|
dtype = DYNAMIC_TYPE_CURVE448;
|
|
}
|
|
#endif
|
|
FreeKey(ssl, dtype, (void**)&ssl->eccTempKey);
|
|
ssl->eccTempKeyPresent = 0;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifdef HAVE_CURVE25519
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE25519, (void**)&ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE448, (void**)&ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
#endif
|
|
|
|
#ifndef NO_DH
|
|
if (ssl->buffers.serverDH_Priv.buffer) {
|
|
ForceZero(ssl->buffers.serverDH_Priv.buffer,
|
|
ssl->buffers.serverDH_Priv.length);
|
|
}
|
|
XFREE(ssl->buffers.serverDH_Priv.buffer, ssl->heap, DYNAMIC_TYPE_PRIVATE_KEY);
|
|
ssl->buffers.serverDH_Priv.buffer = NULL;
|
|
XFREE(ssl->buffers.serverDH_Pub.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_Pub.buffer = NULL;
|
|
/* parameters (p,g) may be owned by ctx */
|
|
if (ssl->buffers.weOwnDH) {
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_G.buffer = NULL;
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
}
|
|
#endif /* !NO_DH */
|
|
|
|
#ifndef NO_CERTS
|
|
wolfSSL_UnloadCertsKeys(ssl);
|
|
#endif
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
#if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
if (!ssl->options.tls1_3 || ssl->options.side == WOLFSSL_CLIENT_END)
|
|
#endif
|
|
{
|
|
#ifdef HAVE_ECC
|
|
XFREE(ssl->buffers.peerEccDsaKey.buffer, ssl->heap, DYNAMIC_TYPE_ECC);
|
|
ssl->buffers.peerEccDsaKey.buffer = NULL;
|
|
#endif /* HAVE_ECC */
|
|
#ifndef NO_RSA
|
|
XFREE(ssl->buffers.peerRsaKey.buffer, ssl->heap, DYNAMIC_TYPE_RSA);
|
|
ssl->buffers.peerRsaKey.buffer = NULL;
|
|
#endif /* NO_RSA */
|
|
#ifdef HAVE_ED25519
|
|
XFREE(ssl->buffers.peerEd25519Key.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_ED25519);
|
|
ssl->buffers.peerEd25519Key.buffer = NULL;
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
XFREE(ssl->buffers.peerEd448Key.buffer, ssl->heap, DYNAMIC_TYPE_ED448);
|
|
ssl->buffers.peerEd448Key.buffer = NULL;
|
|
#endif
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
#ifdef HAVE_QSH
|
|
QSH_FreeAll(ssl);
|
|
#endif
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->session.isDynamic) {
|
|
XFREE(ssl->session.ticket, ssl->heap, DYNAMIC_TYPE_SESSION_TICK);
|
|
ssl->session.ticket = ssl->session.staticTicket;
|
|
ssl->session.isDynamic = 0;
|
|
ssl->session.ticketLen = 0;
|
|
}
|
|
#endif
|
|
|
|
#if defined(HAVE_TLS_EXTENSIONS) && !defined(HAVE_SNI) && \
|
|
!defined(HAVE_ALPN) && !defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
/* Some extensions need to be kept for post-handshake querying. */
|
|
TLSX_FreeAll(ssl->extensions, ssl->heap);
|
|
ssl->extensions = NULL;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
/* when done with handshake decrement current handshake count */
|
|
if (ssl->heap != NULL) {
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
/* avoid dereferencing a test value */
|
|
if (ssl->heap != (void*)WOLFSSL_HEAP_TEST) {
|
|
#endif
|
|
WOLFSSL_HEAP_HINT* ssl_hint = (WOLFSSL_HEAP_HINT*)ssl->heap;
|
|
WOLFSSL_HEAP* ctx_heap;
|
|
|
|
ctx_heap = ssl_hint->memory;
|
|
if (wc_LockMutex(&(ctx_heap->memory_mutex)) != 0) {
|
|
WOLFSSL_MSG("Bad memory_mutex lock");
|
|
}
|
|
ctx_heap->curHa--;
|
|
ssl_hint->haFlag = 0; /* set to zero since handshake has been dec */
|
|
wc_UnLockMutex(&(ctx_heap->memory_mutex));
|
|
#ifdef WOLFSSL_HEAP_TEST
|
|
}
|
|
#endif
|
|
}
|
|
#endif /* WOLFSSL_STATIC_MEMORY */
|
|
}
|
|
|
|
|
|
/* heap argument is the heap hint used when creating SSL */
|
|
void FreeSSL(WOLFSSL* ssl, void* heap)
|
|
{
|
|
if (ssl->ctx) {
|
|
FreeSSL_Ctx(ssl->ctx); /* will decrement and free underlying CTX if 0 */
|
|
}
|
|
SSL_ResourceFree(ssl);
|
|
XFREE(ssl, heap, DYNAMIC_TYPE_SSL);
|
|
(void)heap;
|
|
}
|
|
|
|
#if !defined(NO_OLD_TLS) || defined(WOLFSSL_DTLS) || \
|
|
!defined(WOLFSSL_NO_TLS12) || \
|
|
((defined(HAVE_CHACHA) || defined(HAVE_AESCCM) || defined(HAVE_AESGCM)) \
|
|
&& defined(HAVE_AEAD))
|
|
|
|
#if defined(WOLFSSL_DTLS) || !defined(WOLFSSL_NO_TLS12)
|
|
static WC_INLINE void GetSEQIncrement(WOLFSSL* ssl, int verify, word32 seq[2])
|
|
{
|
|
if (verify) {
|
|
seq[0] = ssl->keys.peer_sequence_number_hi;
|
|
seq[1] = ssl->keys.peer_sequence_number_lo++;
|
|
if (seq[1] > ssl->keys.peer_sequence_number_lo) {
|
|
/* handle rollover */
|
|
ssl->keys.peer_sequence_number_hi++;
|
|
}
|
|
}
|
|
else {
|
|
seq[0] = ssl->keys.sequence_number_hi;
|
|
seq[1] = ssl->keys.sequence_number_lo++;
|
|
if (seq[1] > ssl->keys.sequence_number_lo) {
|
|
/* handle rollover */
|
|
ssl->keys.sequence_number_hi++;
|
|
}
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_DTLS || !WOLFSSL_NO_TLS12 */
|
|
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
static WC_INLINE void DtlsGetSEQ(WOLFSSL* ssl, int order, word32 seq[2])
|
|
{
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
order = DtlsCheckOrder(ssl, order);
|
|
#endif
|
|
if (order == PREV_ORDER) {
|
|
/* Previous epoch case */
|
|
if (ssl->options.haveMcast) {
|
|
#ifdef WOLFSSL_MULTICAST
|
|
seq[0] = (((word32)ssl->keys.dtls_epoch - 1) << 16) |
|
|
(ssl->options.mcastID << 8) |
|
|
(ssl->keys.dtls_prev_sequence_number_hi & 0xFF);
|
|
#endif
|
|
}
|
|
else
|
|
seq[0] = (((word32)ssl->keys.dtls_epoch - 1) << 16) |
|
|
(ssl->keys.dtls_prev_sequence_number_hi & 0xFFFF);
|
|
seq[1] = ssl->keys.dtls_prev_sequence_number_lo;
|
|
}
|
|
else if (order == PEER_ORDER) {
|
|
if (ssl->options.haveMcast) {
|
|
#ifdef WOLFSSL_MULTICAST
|
|
seq[0] = ((word32)ssl->keys.curEpoch << 16) |
|
|
(ssl->keys.curPeerId << 8) |
|
|
(ssl->keys.curSeq_hi & 0xFF);
|
|
#endif
|
|
}
|
|
else
|
|
seq[0] = ((word32)ssl->keys.curEpoch << 16) |
|
|
(ssl->keys.curSeq_hi & 0xFFFF);
|
|
seq[1] = ssl->keys.curSeq_lo; /* explicit from peer */
|
|
}
|
|
else {
|
|
if (ssl->options.haveMcast) {
|
|
#ifdef WOLFSSL_MULTICAST
|
|
seq[0] = ((word32)ssl->keys.dtls_epoch << 16) |
|
|
(ssl->options.mcastID << 8) |
|
|
(ssl->keys.dtls_sequence_number_hi & 0xFF);
|
|
#endif
|
|
}
|
|
else
|
|
seq[0] = ((word32)ssl->keys.dtls_epoch << 16) |
|
|
(ssl->keys.dtls_sequence_number_hi & 0xFFFF);
|
|
seq[1] = ssl->keys.dtls_sequence_number_lo;
|
|
}
|
|
}
|
|
|
|
static WC_INLINE void DtlsSEQIncrement(WOLFSSL* ssl, int order)
|
|
{
|
|
word32 seq;
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
order = DtlsCheckOrder(ssl, order);
|
|
#endif
|
|
|
|
if (order == PREV_ORDER) {
|
|
seq = ssl->keys.dtls_prev_sequence_number_lo++;
|
|
if (seq > ssl->keys.dtls_prev_sequence_number_lo) {
|
|
/* handle rollover */
|
|
ssl->keys.dtls_prev_sequence_number_hi++;
|
|
}
|
|
}
|
|
else if (order == PEER_ORDER) {
|
|
seq = ssl->keys.peer_sequence_number_lo++;
|
|
if (seq > ssl->keys.peer_sequence_number_lo) {
|
|
/* handle rollover */
|
|
ssl->keys.peer_sequence_number_hi++;
|
|
}
|
|
}
|
|
else {
|
|
seq = ssl->keys.dtls_sequence_number_lo++;
|
|
if (seq > ssl->keys.dtls_sequence_number_lo) {
|
|
/* handle rollover */
|
|
ssl->keys.dtls_sequence_number_hi++;
|
|
}
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
#if defined(WOLFSSL_DTLS) || !defined(WOLFSSL_NO_TLS12)
|
|
void WriteSEQ(WOLFSSL* ssl, int verifyOrder, byte* out)
|
|
{
|
|
word32 seq[2] = {0, 0};
|
|
|
|
if (!ssl->options.dtls) {
|
|
GetSEQIncrement(ssl, verifyOrder, seq);
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
DtlsGetSEQ(ssl, verifyOrder, seq);
|
|
#endif
|
|
}
|
|
|
|
c32toa(seq[0], out);
|
|
c32toa(seq[1], out + OPAQUE32_LEN);
|
|
}
|
|
#endif /* WOLFSSL_DTLS || !WOLFSSL_NO_TLS12 */
|
|
#endif /* !NO_OLD_TLS || WOLFSSL_DTLS || !WOLFSSL_NO_TLS12 ||
|
|
* ((HAVE_CHACHA || HAVE_AESCCM || HAVE_AESGCM) && HAVE_AEAD) */
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
|
|
/* functions for managing DTLS datagram reordering */
|
|
|
|
/* Need to allocate space for the handshake message header. The hashing
|
|
* routines assume the message pointer is still within the buffer that
|
|
* has the headers, and will include those headers in the hash. The store
|
|
* routines need to take that into account as well. New will allocate
|
|
* extra space for the headers. */
|
|
DtlsMsg* DtlsMsgNew(word32 sz, void* heap)
|
|
{
|
|
DtlsMsg* msg;
|
|
WOLFSSL_ENTER("DtlsMsgNew()");
|
|
|
|
(void)heap;
|
|
msg = (DtlsMsg*)XMALLOC(sizeof(DtlsMsg), heap, DYNAMIC_TYPE_DTLS_MSG);
|
|
|
|
if (msg != NULL) {
|
|
XMEMSET(msg, 0, sizeof(DtlsMsg));
|
|
msg->buf = (byte*)XMALLOC(sz + DTLS_HANDSHAKE_HEADER_SZ,
|
|
heap, DYNAMIC_TYPE_DTLS_BUFFER);
|
|
if (msg->buf != NULL) {
|
|
msg->sz = sz;
|
|
msg->type = no_shake;
|
|
msg->msg = msg->buf + DTLS_HANDSHAKE_HEADER_SZ;
|
|
}
|
|
else {
|
|
XFREE(msg, heap, DYNAMIC_TYPE_DTLS_MSG);
|
|
msg = NULL;
|
|
}
|
|
}
|
|
|
|
return msg;
|
|
}
|
|
|
|
void DtlsMsgDelete(DtlsMsg* item, void* heap)
|
|
{
|
|
(void)heap;
|
|
WOLFSSL_ENTER("DtlsMsgDelete()");
|
|
|
|
if (item != NULL) {
|
|
DtlsFrag* cur = item->fragList;
|
|
while (cur != NULL) {
|
|
DtlsFrag* next = cur->next;
|
|
XFREE(cur, heap, DYNAMIC_TYPE_DTLS_FRAG);
|
|
cur = next;
|
|
}
|
|
if (item->buf != NULL)
|
|
XFREE(item->buf, heap, DYNAMIC_TYPE_DTLS_BUFFER);
|
|
XFREE(item, heap, DYNAMIC_TYPE_DTLS_MSG);
|
|
}
|
|
}
|
|
|
|
|
|
void DtlsMsgListDelete(DtlsMsg* head, void* heap)
|
|
{
|
|
DtlsMsg* next;
|
|
WOLFSSL_ENTER("DtlsMsgListDelete()");
|
|
while (head) {
|
|
next = head->next;
|
|
DtlsMsgDelete(head, heap);
|
|
head = next;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Drop messages when they are no longer going to be retransmitted
|
|
*/
|
|
void DtlsTxMsgListClean(WOLFSSL* ssl)
|
|
{
|
|
DtlsMsg* head = ssl->dtls_tx_msg_list;
|
|
DtlsMsg* next;
|
|
WOLFSSL_ENTER("DtlsTxMsgListClean()");
|
|
while (head) {
|
|
next = head->next;
|
|
if (VerifyForTxDtlsMsgDelete(ssl, head))
|
|
DtlsMsgDelete(head, ssl->heap);
|
|
else
|
|
/* Stored packets should be in order so break on first failed
|
|
* verify */
|
|
break;
|
|
ssl->dtls_tx_msg_list_sz--;
|
|
/* Reset timer as deleting a node means that state has progressed */
|
|
ssl->dtls_timeout = ssl->dtls_timeout_init;
|
|
head = next;
|
|
}
|
|
ssl->dtls_tx_msg_list = head;
|
|
}
|
|
|
|
/* Create a DTLS Fragment from *begin - end, adjust new *begin and bytesLeft */
|
|
static DtlsFrag* CreateFragment(word32* begin, word32 end, const byte* data,
|
|
byte* buf, word32* bytesLeft, void* heap)
|
|
{
|
|
DtlsFrag* newFrag;
|
|
word32 added = end - *begin + 1;
|
|
|
|
WOLFSSL_ENTER("CreateFragment()");
|
|
|
|
(void)heap;
|
|
newFrag = (DtlsFrag*)XMALLOC(sizeof(DtlsFrag), heap,
|
|
DYNAMIC_TYPE_DTLS_FRAG);
|
|
if (newFrag != NULL) {
|
|
newFrag->next = NULL;
|
|
newFrag->begin = *begin;
|
|
newFrag->end = end;
|
|
|
|
XMEMCPY(buf + *begin, data, added);
|
|
*bytesLeft -= added;
|
|
*begin = newFrag->end + 1;
|
|
}
|
|
|
|
return newFrag;
|
|
}
|
|
|
|
|
|
int DtlsMsgSet(DtlsMsg* msg, word32 seq, word16 epoch, const byte* data, byte type,
|
|
word32 fragOffset, word32 fragSz, void* heap)
|
|
{
|
|
WOLFSSL_ENTER("DtlsMsgSet()");
|
|
if (msg != NULL && data != NULL && msg->fragSz <= msg->sz &&
|
|
(fragOffset + fragSz) <= msg->sz) {
|
|
DtlsFrag* cur = msg->fragList;
|
|
DtlsFrag* prev = cur;
|
|
DtlsFrag* newFrag;
|
|
word32 bytesLeft = fragSz; /* could be overlapping fragment */
|
|
word32 startOffset = fragOffset;
|
|
word32 added;
|
|
|
|
msg->seq = seq;
|
|
msg->epoch = epoch;
|
|
msg->type = type;
|
|
|
|
if (fragOffset == 0) {
|
|
XMEMCPY(msg->buf, data - DTLS_HANDSHAKE_HEADER_SZ,
|
|
DTLS_HANDSHAKE_HEADER_SZ);
|
|
c32to24(msg->sz, msg->msg - DTLS_HANDSHAKE_FRAG_SZ);
|
|
}
|
|
|
|
/* if no message data, just return */
|
|
if (fragSz == 0)
|
|
return 0;
|
|
|
|
/* if list is empty add full fragment to front */
|
|
if (cur == NULL) {
|
|
newFrag = CreateFragment(&fragOffset, fragOffset + fragSz - 1, data,
|
|
msg->msg, &bytesLeft, heap);
|
|
if (newFrag == NULL)
|
|
return MEMORY_E;
|
|
|
|
msg->fragSz = fragSz;
|
|
msg->fragList = newFrag;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* add to front if before current front, up to next->begin */
|
|
if (fragOffset < cur->begin) {
|
|
word32 end = fragOffset + fragSz - 1;
|
|
|
|
if (end >= cur->begin)
|
|
end = cur->begin - 1;
|
|
|
|
added = end - fragOffset + 1;
|
|
newFrag = CreateFragment(&fragOffset, end, data, msg->msg,
|
|
&bytesLeft, heap);
|
|
if (newFrag == NULL)
|
|
return MEMORY_E;
|
|
|
|
msg->fragSz += added;
|
|
|
|
newFrag->next = cur;
|
|
msg->fragList = newFrag;
|
|
}
|
|
|
|
/* while we have bytes left, try to find a gap to fill */
|
|
while (bytesLeft > 0) {
|
|
/* get previous packet in list */
|
|
while (cur && (fragOffset >= cur->begin)) {
|
|
prev = cur;
|
|
cur = cur->next;
|
|
}
|
|
|
|
/* don't add duplicate data */
|
|
if (prev->end >= fragOffset) {
|
|
if ( (fragOffset + bytesLeft - 1) <= prev->end)
|
|
return 0;
|
|
fragOffset = prev->end + 1;
|
|
bytesLeft = startOffset + fragSz - fragOffset;
|
|
}
|
|
|
|
if (cur == NULL)
|
|
/* we're at the end */
|
|
added = bytesLeft;
|
|
else
|
|
/* we're in between two frames */
|
|
added = min(bytesLeft, cur->begin - fragOffset);
|
|
|
|
/* data already there */
|
|
if (added == 0)
|
|
continue;
|
|
|
|
newFrag = CreateFragment(&fragOffset, fragOffset + added - 1,
|
|
data + fragOffset - startOffset,
|
|
msg->msg, &bytesLeft, heap);
|
|
if (newFrag == NULL)
|
|
return MEMORY_E;
|
|
|
|
msg->fragSz += added;
|
|
|
|
newFrag->next = prev->next;
|
|
prev->next = newFrag;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
DtlsMsg* DtlsMsgFind(DtlsMsg* head, word32 epoch, word32 seq)
|
|
{
|
|
WOLFSSL_ENTER("DtlsMsgFind()");
|
|
while (head != NULL && !(head->epoch == epoch && head->seq == seq)) {
|
|
head = head->next;
|
|
}
|
|
return head;
|
|
}
|
|
|
|
|
|
void DtlsMsgStore(WOLFSSL* ssl, word32 epoch, word32 seq, const byte* data,
|
|
word32 dataSz, byte type, word32 fragOffset, word32 fragSz, void* heap)
|
|
{
|
|
/* See if seq exists in the list. If it isn't in the list, make
|
|
* a new item of size dataSz, copy fragSz bytes from data to msg->msg
|
|
* starting at offset fragOffset, and add fragSz to msg->fragSz. If
|
|
* the seq is in the list and it isn't full, copy fragSz bytes from
|
|
* data to msg->msg starting at offset fragOffset, and add fragSz to
|
|
* msg->fragSz. Insertions take into account data already in the list
|
|
* in case there are overlaps in the handshake message due to retransmit
|
|
* messages. The new item should be inserted into the list in its
|
|
* proper position.
|
|
*
|
|
* 1. Find seq in list, or where seq should go in list. If seq not in
|
|
* list, create new item and insert into list. Either case, keep
|
|
* pointer to item.
|
|
* 2. Copy the data from the message to the stored message where it
|
|
* belongs without overlaps.
|
|
*/
|
|
|
|
DtlsMsg* head = ssl->dtls_rx_msg_list;
|
|
WOLFSSL_ENTER("DtlsMsgStore()");
|
|
|
|
if (head != NULL) {
|
|
DtlsMsg* cur = DtlsMsgFind(head, epoch, seq);
|
|
if (cur == NULL) {
|
|
cur = DtlsMsgNew(dataSz, heap);
|
|
if (cur != NULL) {
|
|
if (DtlsMsgSet(cur, seq, epoch, data, type,
|
|
fragOffset, fragSz, heap) < 0) {
|
|
DtlsMsgDelete(cur, heap);
|
|
}
|
|
else {
|
|
ssl->dtls_rx_msg_list_sz++;
|
|
head = DtlsMsgInsert(head, cur);
|
|
}
|
|
}
|
|
}
|
|
else {
|
|
/* If this fails, the data is just dropped. */
|
|
DtlsMsgSet(cur, seq, epoch, data, type, fragOffset,
|
|
fragSz, heap);
|
|
}
|
|
}
|
|
else {
|
|
head = DtlsMsgNew(dataSz, heap);
|
|
if (DtlsMsgSet(head, seq, epoch, data, type, fragOffset,
|
|
fragSz, heap) < 0) {
|
|
DtlsMsgDelete(head, heap);
|
|
head = NULL;
|
|
}
|
|
else {
|
|
ssl->dtls_rx_msg_list_sz++;
|
|
}
|
|
}
|
|
|
|
ssl->dtls_rx_msg_list = head;
|
|
}
|
|
|
|
|
|
/* DtlsMsgInsert() is an in-order insert. */
|
|
DtlsMsg* DtlsMsgInsert(DtlsMsg* head, DtlsMsg* item)
|
|
{
|
|
WOLFSSL_ENTER("DtlsMsgInsert()");
|
|
if (head == NULL || (item->epoch <= head->epoch &&
|
|
item->seq < head->seq)) {
|
|
item->next = head;
|
|
head = item;
|
|
}
|
|
else if (head->next == NULL) {
|
|
head->next = item;
|
|
}
|
|
else {
|
|
DtlsMsg* cur = head->next;
|
|
DtlsMsg* prev = head;
|
|
while (cur) {
|
|
if (item->epoch <= cur->epoch &&
|
|
item->seq < cur->seq) {
|
|
item->next = cur;
|
|
prev->next = item;
|
|
break;
|
|
}
|
|
prev = cur;
|
|
cur = cur->next;
|
|
}
|
|
if (cur == NULL) {
|
|
prev->next = item;
|
|
}
|
|
}
|
|
|
|
return head;
|
|
}
|
|
|
|
|
|
/**
|
|
* DtlsMsgPoolSave() adds the message to the end of the stored transmit
|
|
* list. Must be called BEFORE BuildMessage or DtlsSEQIncrement or
|
|
* anything else that increments ssl->keys.dtls_handshake_number.
|
|
*/
|
|
int DtlsMsgPoolSave(WOLFSSL* ssl, const byte* data, word32 dataSz,
|
|
enum HandShakeType type)
|
|
{
|
|
DtlsMsg* item;
|
|
int ret = 0;
|
|
|
|
WOLFSSL_ENTER("DtlsMsgPoolSave()");
|
|
|
|
if (ssl->dtls_tx_msg_list_sz > DTLS_POOL_SZ) {
|
|
WOLFSSL_ERROR(DTLS_POOL_SZ_E);
|
|
return DTLS_POOL_SZ_E;
|
|
}
|
|
|
|
item = DtlsMsgNew(dataSz, ssl->heap);
|
|
|
|
if (item != NULL) {
|
|
DtlsMsg* cur = ssl->dtls_tx_msg_list;
|
|
|
|
XMEMCPY(item->buf, data, dataSz);
|
|
item->sz = dataSz;
|
|
item->epoch = ssl->keys.dtls_epoch;
|
|
item->seq = ssl->keys.dtls_handshake_number;
|
|
item->type = type;
|
|
|
|
if (cur == NULL)
|
|
ssl->dtls_tx_msg_list = item;
|
|
else {
|
|
while (cur->next)
|
|
cur = cur->next;
|
|
cur->next = item;
|
|
}
|
|
ssl->dtls_tx_msg_list_sz++;
|
|
}
|
|
else
|
|
ret = MEMORY_E;
|
|
|
|
WOLFSSL_LEAVE("DtlsMsgPoolSave()", ret);
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* DtlsMsgPoolTimeout() updates the timeout time. */
|
|
int DtlsMsgPoolTimeout(WOLFSSL* ssl)
|
|
{
|
|
int result = -1;
|
|
WOLFSSL_ENTER("DtlsMsgPoolTimeout()");
|
|
if (ssl->dtls_timeout < ssl->dtls_timeout_max) {
|
|
ssl->dtls_timeout *= DTLS_TIMEOUT_MULTIPLIER;
|
|
result = 0;
|
|
}
|
|
WOLFSSL_LEAVE("DtlsMsgPoolTimeout()", result);
|
|
return result;
|
|
}
|
|
|
|
|
|
/* DtlsMsgPoolReset() deletes the stored transmit list and resets the timeout
|
|
* value. */
|
|
void DtlsMsgPoolReset(WOLFSSL* ssl)
|
|
{
|
|
WOLFSSL_ENTER("DtlsMsgPoolReset()");
|
|
if (ssl->dtls_tx_msg_list) {
|
|
DtlsMsgListDelete(ssl->dtls_tx_msg_list, ssl->heap);
|
|
ssl->dtls_tx_msg_list = NULL;
|
|
ssl->dtls_tx_msg = NULL;
|
|
ssl->dtls_tx_msg_list_sz = 0;
|
|
}
|
|
ssl->dtls_timeout = ssl->dtls_timeout_init;
|
|
}
|
|
|
|
|
|
int VerifyForDtlsMsgPoolSend(WOLFSSL* ssl, byte type, word32 fragOffset)
|
|
{
|
|
/**
|
|
* only the first message from previous flight should be valid
|
|
* to be used for triggering retransmission of whole DtlsMsgPool.
|
|
* change cipher suite type is not verified here
|
|
*/
|
|
return ((fragOffset == 0) &&
|
|
(((ssl->options.side == WOLFSSL_SERVER_END) &&
|
|
((type == client_hello) ||
|
|
((ssl->options.verifyPeer) && (type == certificate)) ||
|
|
((!ssl->options.verifyPeer) && (type == client_key_exchange)))) ||
|
|
((ssl->options.side == WOLFSSL_CLIENT_END) &&
|
|
(type == hello_request || type == server_hello))));
|
|
}
|
|
|
|
|
|
/**
|
|
* Verify if message `item` from `ssl->dtls_tx_msg_list` should be deleted
|
|
* depending on the current state of the handshake negotiation.
|
|
*/
|
|
int VerifyForTxDtlsMsgDelete(WOLFSSL* ssl, DtlsMsg* item)
|
|
{
|
|
WOLFSSL_ENTER("VerifyForTxDtlsMsgDelete()");
|
|
if (item->epoch < ssl->keys.dtls_epoch - 1)
|
|
/* Messages not from current or previous epoch can be deleted */
|
|
return 1;
|
|
switch (ssl->options.side) {
|
|
case WOLFSSL_CLIENT_END:
|
|
if (item->type == client_hello &&
|
|
ssl->options.serverState >= SERVER_HELLODONE_COMPLETE)
|
|
return 1; /* client can forget first client_hello if received full
|
|
* flight of packets from server */
|
|
else
|
|
return 0;
|
|
case WOLFSSL_SERVER_END:
|
|
if (ssl->options.clientState >= CLIENT_HELLO_COMPLETE &&
|
|
item->type == hello_request)
|
|
return 1; /* Server can forget HelloRequest if client sent a valid
|
|
* ClientHello */
|
|
if (ssl->options.clientState >= CLIENT_FINISHED_COMPLETE &&
|
|
item->type <= server_hello_done)
|
|
return 1; /* server can forget everything up to ServerHelloDone if
|
|
* a client finished message has been received and
|
|
* successfully processed */
|
|
else
|
|
return 0;
|
|
default:
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
|
|
/* DtlsMsgPoolSend() will send the stored transmit list. The stored list is
|
|
* updated with new sequence numbers, and will be re-encrypted if needed. */
|
|
int DtlsMsgPoolSend(WOLFSSL* ssl, int sendOnlyFirstPacket)
|
|
{
|
|
int ret = 0;
|
|
DtlsMsg* pool;
|
|
int epochOrder;
|
|
|
|
WOLFSSL_ENTER("DtlsMsgPoolSend()");
|
|
|
|
pool = ssl->dtls_tx_msg == NULL ? ssl->dtls_tx_msg_list : ssl->dtls_tx_msg;
|
|
|
|
if (pool != NULL) {
|
|
if ((ssl->options.side == WOLFSSL_SERVER_END &&
|
|
!(ssl->options.acceptState == ACCEPT_BEGIN_RENEG ||
|
|
ssl->options.acceptState == SERVER_HELLO_DONE ||
|
|
ssl->options.acceptState == ACCEPT_FINISHED_DONE ||
|
|
ssl->options.acceptState == ACCEPT_THIRD_REPLY_DONE)) ||
|
|
(ssl->options.side == WOLFSSL_CLIENT_END &&
|
|
!(ssl->options.connectState == CLIENT_HELLO_SENT ||
|
|
ssl->options.connectState == HELLO_AGAIN_REPLY ||
|
|
ssl->options.connectState == FINISHED_DONE ||
|
|
ssl->options.connectState == SECOND_REPLY_DONE))) {
|
|
|
|
WOLFSSL_ERROR(DTLS_RETX_OVER_TX);
|
|
ssl->error = DTLS_RETX_OVER_TX;
|
|
return WOLFSSL_FATAL_ERROR;
|
|
}
|
|
|
|
while (pool != NULL) {
|
|
if (pool->epoch == 0) {
|
|
DtlsRecordLayerHeader* dtls;
|
|
|
|
dtls = (DtlsRecordLayerHeader*)pool->buf;
|
|
/* If the stored record's epoch is 0, and the currently set
|
|
* epoch is 0, use the "current order" sequence number.
|
|
* If the stored record's epoch is 0 and the currently set
|
|
* epoch is not 0, the stored record is considered a "previous
|
|
* order" sequence number. */
|
|
epochOrder = (ssl->keys.dtls_epoch == 0) ?
|
|
CUR_ORDER : PREV_ORDER;
|
|
|
|
WriteSEQ(ssl, epochOrder, dtls->sequence_number);
|
|
DtlsSEQIncrement(ssl, epochOrder);
|
|
if ((ret = CheckAvailableSize(ssl, pool->sz)) != 0) {
|
|
WOLFSSL_ERROR(ret);
|
|
return ret;
|
|
}
|
|
|
|
XMEMCPY(ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.idx +
|
|
ssl->buffers.outputBuffer.length,
|
|
pool->buf, pool->sz);
|
|
ssl->buffers.outputBuffer.length += pool->sz;
|
|
}
|
|
else {
|
|
/* Handle sending packets from previous epoch */
|
|
byte* input;
|
|
byte* output;
|
|
int inputSz, sendSz;
|
|
|
|
input = pool->buf;
|
|
inputSz = pool->sz;
|
|
sendSz = inputSz + MAX_MSG_EXTRA;
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
/*
|
|
* CUR_ORDER will use ssl->secure_renegotiation from epoch 2+.
|
|
* ssl->keys otherwise
|
|
* PREV_ORDER will always use ssl->keys
|
|
*/
|
|
if (DtlsSCRKeysSet(ssl)) {
|
|
if (pool->epoch == ssl->secure_renegotiation->tmp_keys.dtls_epoch)
|
|
epochOrder = CUR_ORDER;
|
|
else
|
|
epochOrder = PREV_ORDER;
|
|
}
|
|
else {
|
|
epochOrder = CUR_ORDER;
|
|
}
|
|
#else
|
|
epochOrder = CUR_ORDER;
|
|
#endif
|
|
|
|
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0) {
|
|
WOLFSSL_ERROR(ret);
|
|
return ret;
|
|
}
|
|
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
if (inputSz != ENUM_LEN)
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 0, 0, 0, epochOrder);
|
|
else
|
|
/* inputSz == ENUM_LEN must mean that this is a change cipher
|
|
* spec message */
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
change_cipher_spec, 0, 0, 0, epochOrder);
|
|
|
|
if (sendSz < 0) {
|
|
WOLFSSL_ERROR(BUILD_MSG_ERROR);
|
|
return BUILD_MSG_ERROR;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
}
|
|
|
|
|
|
if (!ssl->options.groupMessages)
|
|
ret = SendBuffered(ssl);
|
|
|
|
/**
|
|
* on server side, retransmission is being triggered only by sending
|
|
* first message of given flight, in order to trigger client
|
|
* to retransmit its whole flight. Sending the whole previous flight
|
|
* could lead to retransmission of previous client flight for each
|
|
* server message from previous flight. Therefore one message should
|
|
* be enough to do the trick.
|
|
*/
|
|
if (sendOnlyFirstPacket &&
|
|
ssl->options.side == WOLFSSL_SERVER_END)
|
|
pool = NULL;
|
|
else
|
|
pool = pool->next;
|
|
ssl->dtls_tx_msg = pool;
|
|
}
|
|
|
|
if (ret == 0 && ssl->options.groupMessages)
|
|
ret = SendBuffered(ssl);
|
|
}
|
|
|
|
WOLFSSL_LEAVE("DtlsMsgPoolSend()", ret);
|
|
return ret;
|
|
}
|
|
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
#if defined(WOLFSSL_ALLOW_SSLV3) && !defined(NO_OLD_TLS)
|
|
|
|
ProtocolVersion MakeSSLv3(void)
|
|
{
|
|
ProtocolVersion pv;
|
|
pv.major = SSLv3_MAJOR;
|
|
pv.minor = SSLv3_MINOR;
|
|
|
|
return pv;
|
|
}
|
|
|
|
#endif /* WOLFSSL_ALLOW_SSLV3 && !NO_OLD_TLS */
|
|
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
|
|
ProtocolVersion MakeDTLSv1(void)
|
|
{
|
|
ProtocolVersion pv;
|
|
pv.major = DTLS_MAJOR;
|
|
pv.minor = DTLS_MINOR;
|
|
|
|
return pv;
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
ProtocolVersion MakeDTLSv1_2(void)
|
|
{
|
|
ProtocolVersion pv;
|
|
pv.major = DTLS_MAJOR;
|
|
pv.minor = DTLSv1_2_MINOR;
|
|
|
|
return pv;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
|
|
#ifndef NO_ASN_TIME
|
|
#if defined(USER_TICKS)
|
|
#if 0
|
|
word32 LowResTimer(void)
|
|
{
|
|
/*
|
|
write your own clock tick function if don't want time(0)
|
|
needs second accuracy but doesn't have to correlated to EPOCH
|
|
*/
|
|
}
|
|
#endif
|
|
|
|
#elif defined(TIME_OVERRIDES)
|
|
|
|
/* use same asn time overrides unless user wants tick override above */
|
|
|
|
#ifndef HAVE_TIME_T_TYPE
|
|
typedef long time_t;
|
|
#endif
|
|
extern time_t XTIME(time_t * timer);
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32) XTIME(0);
|
|
}
|
|
|
|
#elif defined(USE_WINDOWS_API)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
static int init = 0;
|
|
static LARGE_INTEGER freq;
|
|
LARGE_INTEGER count;
|
|
|
|
if (!init) {
|
|
QueryPerformanceFrequency(&freq);
|
|
init = 1;
|
|
}
|
|
|
|
QueryPerformanceCounter(&count);
|
|
|
|
return (word32)(count.QuadPart / freq.QuadPart);
|
|
}
|
|
|
|
#elif defined(HAVE_RTP_SYS)
|
|
|
|
#include "rtptime.h"
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32)rtp_get_system_sec();
|
|
}
|
|
|
|
#elif defined(WOLFSSL_DEOS)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
const word32 systemTickTimeInHz = 1000000 / systemTickInMicroseconds();
|
|
word32 *systemTickPtr = systemTickPointer();
|
|
|
|
return (word32) *systemTickPtr/systemTickTimeInHz;
|
|
}
|
|
|
|
#elif defined(MICRIUM)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
OS_TICK ticks = 0;
|
|
OS_ERR err;
|
|
|
|
ticks = OSTimeGet(&err);
|
|
|
|
return (word32) (ticks / OSCfg_TickRate_Hz);
|
|
}
|
|
|
|
|
|
#elif defined(MICROCHIP_TCPIP_V5)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32) (TickGet() / TICKS_PER_SECOND);
|
|
}
|
|
|
|
|
|
#elif defined(MICROCHIP_TCPIP)
|
|
|
|
#if defined(MICROCHIP_MPLAB_HARMONY)
|
|
|
|
#include <system/tmr/sys_tmr.h>
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32) (SYS_TMR_TickCountGet() /
|
|
SYS_TMR_TickCounterFrequencyGet());
|
|
}
|
|
|
|
#else
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32) (SYS_TICK_Get() / SYS_TICK_TicksPerSecondGet());
|
|
}
|
|
|
|
#endif
|
|
|
|
#elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
TIME_STRUCT mqxTime;
|
|
|
|
_time_get_elapsed(&mqxTime);
|
|
|
|
return (word32) mqxTime.SECONDS;
|
|
}
|
|
#elif defined(FREESCALE_FREE_RTOS) || defined(FREESCALE_KSDK_FREERTOS)
|
|
|
|
#include "include/task.h"
|
|
|
|
unsigned int LowResTimer(void)
|
|
{
|
|
return (unsigned int)(((float)xTaskGetTickCount())/configTICK_RATE_HZ);
|
|
}
|
|
|
|
#elif defined(FREERTOS)
|
|
|
|
#include "task.h"
|
|
|
|
unsigned int LowResTimer(void)
|
|
{
|
|
return (unsigned int)(((float)xTaskGetTickCount())/configTICK_RATE_HZ);
|
|
}
|
|
|
|
#elif defined(FREESCALE_KSDK_BM)
|
|
|
|
#include "lwip/sys.h" /* lwIP */
|
|
word32 LowResTimer(void)
|
|
{
|
|
return sys_now()/1000;
|
|
}
|
|
|
|
#elif defined(WOLFSSL_TIRTOS)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32) Seconds_get();
|
|
}
|
|
#elif defined(WOLFSSL_XILINX)
|
|
#include "xrtcpsu.h"
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
XRtcPsu_Config* con;
|
|
XRtcPsu rtc;
|
|
|
|
con = XRtcPsu_LookupConfig(XPAR_XRTCPSU_0_DEVICE_ID);
|
|
if (con != NULL) {
|
|
if (XRtcPsu_CfgInitialize(&rtc, con, con->BaseAddr)
|
|
== XST_SUCCESS) {
|
|
return (word32)XRtcPsu_GetCurrentTime(&rtc);
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Unable to initialize RTC");
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
#elif defined(WOLFSSL_UTASKER)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32)(uTaskerSystemTick / TICK_RESOLUTION);
|
|
}
|
|
|
|
#elif defined(WOLFSSL_NUCLEUS_1_2)
|
|
|
|
#define NU_TICKS_PER_SECOND 100
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
/* returns number of 10ms ticks, so 100 ticks/sec */
|
|
return NU_Retrieve_Clock() / NU_TICKS_PER_SECOND;
|
|
}
|
|
#elif defined(WOLFSSL_APACHE_MYNEWT)
|
|
|
|
#include "os/os_time.h"
|
|
word32 LowResTimer(void)
|
|
{
|
|
word32 now;
|
|
struct os_timeval tv;
|
|
os_gettimeofday(&tv, NULL);
|
|
now = (word32)tv.tv_sec;
|
|
return now;
|
|
}
|
|
|
|
#elif defined(WOLFSSL_ZEPHYR)
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return k_uptime_get() / 1000;
|
|
}
|
|
|
|
#elif defined(WOLFSSL_LINUXKM)
|
|
#include <linux/time.h>
|
|
#include <linux/ktime.h>
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32)ktime_get_real_ns();
|
|
}
|
|
|
|
#else
|
|
/* Posix style time */
|
|
#if !defined(USER_TIME) && !defined(USE_WOLF_TM)
|
|
#include <time.h>
|
|
#endif
|
|
|
|
word32 LowResTimer(void)
|
|
{
|
|
return (word32)XTIME(0);
|
|
}
|
|
#endif
|
|
#endif /* !NO_ASN_TIME */
|
|
#if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
|
|
((defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
|
|
(defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)))
|
|
/* Store the message for use with CertificateVerify using EdDSA.
|
|
*
|
|
* ssl SSL/TLS object.
|
|
* data Message to store.
|
|
* sz Size of message to store.
|
|
* returns MEMORY_E if not able to reallocate, otherwise 0.
|
|
*/
|
|
static int EdDSA_Update(WOLFSSL* ssl, const byte* data, int sz)
|
|
{
|
|
int ret = 0;
|
|
byte* msgs;
|
|
|
|
if (ssl->options.cacheMessages) {
|
|
msgs = (byte*)XREALLOC(ssl->hsHashes->messages,
|
|
ssl->hsHashes->length + sz,
|
|
ssl->heap, DYNAMIC_TYPE_HASHES);
|
|
if (msgs == NULL)
|
|
ret = MEMORY_E;
|
|
if (ret == 0) {
|
|
ssl->hsHashes->messages = msgs;
|
|
XMEMCPY(msgs + ssl->hsHashes->length, data, sz);
|
|
ssl->hsHashes->prevLen = ssl->hsHashes->length;
|
|
ssl->hsHashes->length += sz;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif /* (HAVE_ED25519 || HAVE_ED448) && !WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
int HashRaw(WOLFSSL* ssl, const byte* data, int sz)
|
|
{
|
|
int ret = 0;
|
|
|
|
(void)data;
|
|
(void)sz;
|
|
|
|
if (ssl->hsHashes == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
#ifndef NO_OLD_TLS
|
|
#ifndef NO_SHA
|
|
wc_ShaUpdate(&ssl->hsHashes->hashSha, data, sz);
|
|
#endif
|
|
#ifndef NO_MD5
|
|
wc_Md5Update(&ssl->hsHashes->hashMd5, data, sz);
|
|
#endif
|
|
#endif /* NO_OLD_TLS */
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
#ifndef NO_SHA256
|
|
ret = wc_Sha256Update(&ssl->hsHashes->hashSha256, data, sz);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
ret = wc_Sha384Update(&ssl->hsHashes->hashSha384, data, sz);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
ret = wc_Sha512Update(&ssl->hsHashes->hashSha512, data, sz);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
|
|
((defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
|
|
(defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)))
|
|
ret = EdDSA_Update(ssl, data, sz);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* add output to md5 and sha handshake hashes, exclude record header */
|
|
int HashOutput(WOLFSSL* ssl, const byte* output, int sz, int ivSz)
|
|
{
|
|
const byte* adj;
|
|
|
|
if (ssl->hsHashes == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
adj = output + RECORD_HEADER_SZ + ivSz;
|
|
sz -= RECORD_HEADER_SZ;
|
|
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb)
|
|
ssl->fuzzerCb(ssl, output, sz, FUZZ_HASH, ssl->fuzzerCtx);
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
adj += DTLS_RECORD_EXTRA;
|
|
sz -= DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
return HashRaw(ssl, adj, sz);
|
|
}
|
|
|
|
|
|
/* add input to md5 and sha handshake hashes, include handshake header */
|
|
int HashInput(WOLFSSL* ssl, const byte* input, int sz)
|
|
{
|
|
const byte* adj;
|
|
|
|
if (ssl->hsHashes == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
adj = input - HANDSHAKE_HEADER_SZ;
|
|
sz += HANDSHAKE_HEADER_SZ;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
adj -= DTLS_HANDSHAKE_EXTRA;
|
|
sz += DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
return HashRaw(ssl, adj, sz);
|
|
}
|
|
|
|
|
|
/* add record layer header for message */
|
|
static void AddRecordHeader(byte* output, word32 length, byte type, WOLFSSL* ssl, int epochOrder)
|
|
{
|
|
RecordLayerHeader* rl;
|
|
|
|
(void)epochOrder;
|
|
|
|
/* record layer header */
|
|
rl = (RecordLayerHeader*)output;
|
|
if (rl == NULL) {
|
|
return;
|
|
}
|
|
rl->type = type;
|
|
rl->pvMajor = ssl->version.major; /* type and version same in each */
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version)) {
|
|
rl->pvMinor = TLSv1_2_MINOR;
|
|
}
|
|
else
|
|
#endif
|
|
rl->pvMinor = ssl->version.minor;
|
|
|
|
#ifdef WOLFSSL_ALTERNATIVE_DOWNGRADE
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END
|
|
&& ssl->options.connectState == CONNECT_BEGIN
|
|
&& !ssl->options.resuming) {
|
|
rl->pvMinor = ssl->options.downgrade ? ssl->options.minDowngrade
|
|
: ssl->version.minor;
|
|
}
|
|
#endif
|
|
|
|
if (!ssl->options.dtls) {
|
|
c16toa((word16)length, rl->length);
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
DtlsRecordLayerHeader* dtls;
|
|
|
|
/* dtls record layer header extensions */
|
|
dtls = (DtlsRecordLayerHeader*)output;
|
|
WriteSEQ(ssl, epochOrder, dtls->sequence_number);
|
|
c16toa((word16)length, dtls->length);
|
|
#endif
|
|
}
|
|
}
|
|
|
|
|
|
#if !defined(WOLFSSL_NO_TLS12) || (defined(HAVE_SESSION_TICKET) && \
|
|
!defined(NO_WOLFSSL_SERVER))
|
|
/* add handshake header for message */
|
|
static void AddHandShakeHeader(byte* output, word32 length,
|
|
word32 fragOffset, word32 fragLength,
|
|
byte type, WOLFSSL* ssl)
|
|
{
|
|
HandShakeHeader* hs;
|
|
(void)fragOffset;
|
|
(void)fragLength;
|
|
(void)ssl;
|
|
|
|
/* handshake header */
|
|
hs = (HandShakeHeader*)output;
|
|
if (hs == NULL)
|
|
return;
|
|
|
|
hs->type = type;
|
|
c32to24(length, hs->length); /* type and length same for each */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
DtlsHandShakeHeader* dtls;
|
|
|
|
/* dtls handshake header extensions */
|
|
dtls = (DtlsHandShakeHeader*)output;
|
|
c16toa(ssl->keys.dtls_handshake_number++, dtls->message_seq);
|
|
c32to24(fragOffset, dtls->fragment_offset);
|
|
c32to24(fragLength, dtls->fragment_length);
|
|
}
|
|
#endif
|
|
}
|
|
|
|
/* add both headers for handshake message */
|
|
static void AddHeaders(byte* output, word32 length, byte type, WOLFSSL* ssl)
|
|
{
|
|
word32 lengthAdj = HANDSHAKE_HEADER_SZ;
|
|
word32 outputAdj = RECORD_HEADER_SZ;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
lengthAdj += DTLS_HANDSHAKE_EXTRA;
|
|
outputAdj += DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
AddRecordHeader(output, length + lengthAdj, handshake, ssl, CUR_ORDER);
|
|
AddHandShakeHeader(output + outputAdj, length, 0, length, type, ssl);
|
|
}
|
|
#endif /* !WOLFSSL_NO_TLS12 || (HAVE_SESSION_TICKET && !NO_WOLFSSL_SERVER) */
|
|
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
#if !defined(NO_CERTS) && (!defined(NO_WOLFSSL_SERVER) || \
|
|
!defined(WOLFSSL_NO_CLIENT_AUTH))
|
|
static void AddFragHeaders(byte* output, word32 fragSz, word32 fragOffset,
|
|
word32 length, byte type, WOLFSSL* ssl)
|
|
{
|
|
word32 lengthAdj = HANDSHAKE_HEADER_SZ;
|
|
word32 outputAdj = RECORD_HEADER_SZ;
|
|
(void)fragSz;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
lengthAdj += DTLS_HANDSHAKE_EXTRA;
|
|
outputAdj += DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
AddRecordHeader(output, fragSz + lengthAdj, handshake, ssl, CUR_ORDER);
|
|
AddHandShakeHeader(output + outputAdj, length, fragOffset, fragSz, type, ssl);
|
|
}
|
|
#endif /* NO_CERTS */
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
|
|
/* return bytes received, -1 on error */
|
|
static int wolfSSLReceive(WOLFSSL* ssl, byte* buf, word32 sz)
|
|
{
|
|
int recvd;
|
|
|
|
if (ssl->CBIORecv == NULL) {
|
|
WOLFSSL_MSG("Your IO Recv callback is null, please set");
|
|
return -1;
|
|
}
|
|
|
|
retry:
|
|
recvd = ssl->CBIORecv(ssl, (char *)buf, (int)sz, ssl->IOCB_ReadCtx);
|
|
if (recvd < 0) {
|
|
switch (recvd) {
|
|
case WOLFSSL_CBIO_ERR_GENERAL: /* general/unknown error */
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_APACHE_HTTPD)
|
|
#ifndef NO_BIO
|
|
if (ssl->biord) {
|
|
/* If retry and read flags are set, return WANT_READ */
|
|
if ((ssl->biord->flags & WOLFSSL_BIO_FLAG_READ) &&
|
|
(ssl->biord->flags & WOLFSSL_BIO_FLAG_RETRY)) {
|
|
return WANT_READ;
|
|
}
|
|
}
|
|
#endif
|
|
#endif
|
|
return -1;
|
|
|
|
case WOLFSSL_CBIO_ERR_WANT_READ: /* want read, would block */
|
|
return WANT_READ;
|
|
|
|
case WOLFSSL_CBIO_ERR_CONN_RST: /* connection reset */
|
|
#ifdef USE_WINDOWS_API
|
|
if (ssl->options.dtls) {
|
|
goto retry;
|
|
}
|
|
#endif
|
|
ssl->options.connReset = 1;
|
|
return -1;
|
|
|
|
case WOLFSSL_CBIO_ERR_ISR: /* interrupt */
|
|
/* see if we got our timeout */
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->toInfoOn) {
|
|
struct itimerval timeout;
|
|
getitimer(ITIMER_REAL, &timeout);
|
|
if (timeout.it_value.tv_sec == 0 &&
|
|
timeout.it_value.tv_usec == 0) {
|
|
XSTRNCPY(ssl->timeoutInfo.timeoutName,
|
|
"recv() timeout", MAX_TIMEOUT_NAME_SZ);
|
|
ssl->timeoutInfo.timeoutName[
|
|
MAX_TIMEOUT_NAME_SZ] = '\0';
|
|
|
|
WOLFSSL_MSG("Got our timeout");
|
|
return WANT_READ;
|
|
}
|
|
}
|
|
#endif
|
|
goto retry;
|
|
|
|
case WOLFSSL_CBIO_ERR_CONN_CLOSE: /* peer closed connection */
|
|
ssl->options.isClosed = 1;
|
|
return -1;
|
|
|
|
case WOLFSSL_CBIO_ERR_TIMEOUT:
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
ssl->options.handShakeState != HANDSHAKE_DONE &&
|
|
DtlsMsgPoolTimeout(ssl) == 0 &&
|
|
DtlsMsgPoolSend(ssl, 0) == 0) {
|
|
|
|
/* retry read for DTLS during handshake only */
|
|
goto retry;
|
|
}
|
|
#endif
|
|
return -1;
|
|
|
|
default:
|
|
WOLFSSL_MSG("Unexpected recv return code");
|
|
return recvd;
|
|
}
|
|
}
|
|
|
|
return recvd;
|
|
}
|
|
|
|
|
|
/* Switch dynamic output buffer back to static, buffer is assumed clear */
|
|
void ShrinkOutputBuffer(WOLFSSL* ssl)
|
|
{
|
|
WOLFSSL_MSG("Shrinking output buffer\n");
|
|
XFREE(ssl->buffers.outputBuffer.buffer - ssl->buffers.outputBuffer.offset,
|
|
ssl->heap, DYNAMIC_TYPE_OUT_BUFFER);
|
|
ssl->buffers.outputBuffer.buffer = ssl->buffers.outputBuffer.staticBuffer;
|
|
ssl->buffers.outputBuffer.bufferSize = STATIC_BUFFER_LEN;
|
|
ssl->buffers.outputBuffer.dynamicFlag = 0;
|
|
ssl->buffers.outputBuffer.offset = 0;
|
|
}
|
|
|
|
|
|
/* Switch dynamic input buffer back to static, keep any remaining input */
|
|
/* forced free means cleaning up */
|
|
void ShrinkInputBuffer(WOLFSSL* ssl, int forcedFree)
|
|
{
|
|
int usedLength = ssl->buffers.inputBuffer.length -
|
|
ssl->buffers.inputBuffer.idx;
|
|
if (!forcedFree && usedLength > STATIC_BUFFER_LEN)
|
|
return;
|
|
|
|
WOLFSSL_MSG("Shrinking input buffer\n");
|
|
|
|
if (!forcedFree && usedLength > 0)
|
|
XMEMCPY(ssl->buffers.inputBuffer.staticBuffer,
|
|
ssl->buffers.inputBuffer.buffer + ssl->buffers.inputBuffer.idx,
|
|
usedLength);
|
|
|
|
XFREE(ssl->buffers.inputBuffer.buffer - ssl->buffers.inputBuffer.offset,
|
|
ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
ssl->buffers.inputBuffer.buffer = ssl->buffers.inputBuffer.staticBuffer;
|
|
ssl->buffers.inputBuffer.bufferSize = STATIC_BUFFER_LEN;
|
|
ssl->buffers.inputBuffer.dynamicFlag = 0;
|
|
ssl->buffers.inputBuffer.offset = 0;
|
|
ssl->buffers.inputBuffer.idx = 0;
|
|
ssl->buffers.inputBuffer.length = usedLength;
|
|
}
|
|
|
|
int SendBuffered(WOLFSSL* ssl)
|
|
{
|
|
if (ssl->CBIOSend == NULL) {
|
|
WOLFSSL_MSG("Your IO Send callback is null, please set");
|
|
return SOCKET_ERROR_E;
|
|
}
|
|
|
|
#ifdef WOLFSSL_DEBUG_TLS
|
|
if (ssl->buffers.outputBuffer.idx == 0) {
|
|
WOLFSSL_MSG("Data to send");
|
|
WOLFSSL_BUFFER(ssl->buffers.outputBuffer.buffer,
|
|
ssl->buffers.outputBuffer.length);
|
|
}
|
|
#endif
|
|
|
|
while (ssl->buffers.outputBuffer.length > 0) {
|
|
int sent = ssl->CBIOSend(ssl,
|
|
(char*)ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.idx,
|
|
(int)ssl->buffers.outputBuffer.length,
|
|
ssl->IOCB_WriteCtx);
|
|
if (sent < 0) {
|
|
switch (sent) {
|
|
|
|
case WOLFSSL_CBIO_ERR_WANT_WRITE: /* would block */
|
|
return WANT_WRITE;
|
|
|
|
case WOLFSSL_CBIO_ERR_CONN_RST: /* connection reset */
|
|
ssl->options.connReset = 1;
|
|
break;
|
|
|
|
case WOLFSSL_CBIO_ERR_ISR: /* interrupt */
|
|
/* see if we got our timeout */
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->toInfoOn) {
|
|
struct itimerval timeout;
|
|
getitimer(ITIMER_REAL, &timeout);
|
|
if (timeout.it_value.tv_sec == 0 &&
|
|
timeout.it_value.tv_usec == 0) {
|
|
XSTRNCPY(ssl->timeoutInfo.timeoutName,
|
|
"send() timeout", MAX_TIMEOUT_NAME_SZ);
|
|
ssl->timeoutInfo.timeoutName[
|
|
MAX_TIMEOUT_NAME_SZ] = '\0';
|
|
|
|
WOLFSSL_MSG("Got our timeout");
|
|
return WANT_WRITE;
|
|
}
|
|
}
|
|
#endif
|
|
continue;
|
|
|
|
case WOLFSSL_CBIO_ERR_CONN_CLOSE: /* epipe / conn closed */
|
|
ssl->options.connReset = 1; /* treat same as reset */
|
|
break;
|
|
|
|
default:
|
|
return SOCKET_ERROR_E;
|
|
}
|
|
|
|
return SOCKET_ERROR_E;
|
|
}
|
|
|
|
if (sent > (int)ssl->buffers.outputBuffer.length) {
|
|
WOLFSSL_MSG("SendBuffered() out of bounds read");
|
|
return SEND_OOB_READ_E;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.idx += sent;
|
|
ssl->buffers.outputBuffer.length -= sent;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.idx = 0;
|
|
|
|
if (ssl->buffers.outputBuffer.dynamicFlag)
|
|
ShrinkOutputBuffer(ssl);
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Grow the output buffer */
|
|
static WC_INLINE int GrowOutputBuffer(WOLFSSL* ssl, int size)
|
|
{
|
|
byte* tmp;
|
|
#if WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
byte hdrSz = ssl->options.dtls ? DTLS_RECORD_HEADER_SZ :
|
|
RECORD_HEADER_SZ;
|
|
byte align = WOLFSSL_GENERAL_ALIGNMENT;
|
|
#else
|
|
const byte align = WOLFSSL_GENERAL_ALIGNMENT;
|
|
#endif
|
|
|
|
#if WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
/* the encrypted data will be offset from the front of the buffer by
|
|
the header, if the user wants encrypted alignment they need
|
|
to define their alignment requirement */
|
|
|
|
if (align) {
|
|
while (align < hdrSz)
|
|
align *= 2;
|
|
}
|
|
#endif
|
|
|
|
tmp = (byte*)XMALLOC(size + ssl->buffers.outputBuffer.length + align,
|
|
ssl->heap, DYNAMIC_TYPE_OUT_BUFFER);
|
|
WOLFSSL_MSG("growing output buffer\n");
|
|
|
|
if (tmp == NULL)
|
|
return MEMORY_E;
|
|
|
|
#if WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
if (align)
|
|
tmp += align - hdrSz;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
/* can be from IO memory pool which does not need copy if same buffer */
|
|
if (ssl->buffers.outputBuffer.length &&
|
|
tmp == ssl->buffers.outputBuffer.buffer) {
|
|
ssl->buffers.outputBuffer.bufferSize =
|
|
size + ssl->buffers.outputBuffer.length;
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
if (ssl->buffers.outputBuffer.length)
|
|
XMEMCPY(tmp, ssl->buffers.outputBuffer.buffer,
|
|
ssl->buffers.outputBuffer.length);
|
|
|
|
if (ssl->buffers.outputBuffer.dynamicFlag)
|
|
XFREE(ssl->buffers.outputBuffer.buffer -
|
|
ssl->buffers.outputBuffer.offset, ssl->heap,
|
|
DYNAMIC_TYPE_OUT_BUFFER);
|
|
ssl->buffers.outputBuffer.dynamicFlag = 1;
|
|
|
|
#if WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
if (align)
|
|
ssl->buffers.outputBuffer.offset = align - hdrSz;
|
|
else
|
|
#endif
|
|
ssl->buffers.outputBuffer.offset = 0;
|
|
|
|
ssl->buffers.outputBuffer.buffer = tmp;
|
|
ssl->buffers.outputBuffer.bufferSize = size +
|
|
ssl->buffers.outputBuffer.length;
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Grow the input buffer, should only be to read cert or big app data */
|
|
int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength)
|
|
{
|
|
byte* tmp;
|
|
#if defined(WOLFSSL_DTLS) || WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
byte align = ssl->options.dtls ? WOLFSSL_GENERAL_ALIGNMENT : 0;
|
|
byte hdrSz = DTLS_RECORD_HEADER_SZ;
|
|
#else
|
|
const byte align = WOLFSSL_GENERAL_ALIGNMENT;
|
|
#endif
|
|
|
|
#if defined(WOLFSSL_DTLS) || WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
/* the encrypted data will be offset from the front of the buffer by
|
|
the dtls record header, if the user wants encrypted alignment they need
|
|
to define their alignment requirement. in tls we read record header
|
|
to get size of record and put actual data back at front, so don't need */
|
|
|
|
if (align) {
|
|
while (align < hdrSz)
|
|
align *= 2;
|
|
}
|
|
#endif
|
|
|
|
if (usedLength < 0 || size < 0) {
|
|
WOLFSSL_MSG("GrowInputBuffer() called with negative number");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
tmp = (byte*)XMALLOC(size + usedLength + align,
|
|
ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
WOLFSSL_MSG("growing input buffer\n");
|
|
|
|
if (tmp == NULL)
|
|
return MEMORY_E;
|
|
|
|
#if defined(WOLFSSL_DTLS) || WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
if (align)
|
|
tmp += align - hdrSz;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_STATIC_MEMORY
|
|
/* can be from IO memory pool which does not need copy if same buffer */
|
|
if (usedLength && tmp == ssl->buffers.inputBuffer.buffer) {
|
|
ssl->buffers.inputBuffer.bufferSize = size + usedLength;
|
|
ssl->buffers.inputBuffer.idx = 0;
|
|
ssl->buffers.inputBuffer.length = usedLength;
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
if (usedLength)
|
|
XMEMCPY(tmp, ssl->buffers.inputBuffer.buffer +
|
|
ssl->buffers.inputBuffer.idx, usedLength);
|
|
|
|
if (ssl->buffers.inputBuffer.dynamicFlag)
|
|
XFREE(ssl->buffers.inputBuffer.buffer - ssl->buffers.inputBuffer.offset,
|
|
ssl->heap,DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
ssl->buffers.inputBuffer.dynamicFlag = 1;
|
|
#if defined(WOLFSSL_DTLS) || WOLFSSL_GENERAL_ALIGNMENT > 0
|
|
if (align)
|
|
ssl->buffers.inputBuffer.offset = align - hdrSz;
|
|
else
|
|
#endif
|
|
ssl->buffers.inputBuffer.offset = 0;
|
|
|
|
ssl->buffers.inputBuffer.buffer = tmp;
|
|
ssl->buffers.inputBuffer.bufferSize = size + usedLength;
|
|
ssl->buffers.inputBuffer.idx = 0;
|
|
ssl->buffers.inputBuffer.length = usedLength;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Check available size into output buffer, make room if needed.
|
|
* This function needs to be called before anything gets put
|
|
* into the output buffers since it flushes pending data if it
|
|
* predicts that the msg will exceed MTU. */
|
|
int CheckAvailableSize(WOLFSSL *ssl, int size)
|
|
{
|
|
if (size < 0) {
|
|
WOLFSSL_MSG("CheckAvailableSize() called with negative number");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls &&
|
|
size + ssl->buffers.outputBuffer.length -
|
|
ssl->buffers.outputBuffer.idx > ssl->dtls_expected_rx) {
|
|
int ret;
|
|
WOLFSSL_MSG("CheckAvailableSize() flushing buffer "
|
|
"to make room for new message");
|
|
if ((ret = SendBuffered(ssl)) != 0) {
|
|
return ret;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
if (ssl->buffers.outputBuffer.bufferSize - ssl->buffers.outputBuffer.length
|
|
< (word32)size) {
|
|
if (GrowOutputBuffer(ssl, size) < 0)
|
|
return MEMORY_E;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* do all verify and sanity checks on record header */
|
|
static int GetRecordHeader(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
RecordLayerHeader* rh, word16 *size)
|
|
{
|
|
if (!ssl->options.dtls) {
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb)
|
|
ssl->fuzzerCb(ssl, input + *inOutIdx, RECORD_HEADER_SZ, FUZZ_HEAD,
|
|
ssl->fuzzerCtx);
|
|
#endif
|
|
XMEMCPY(rh, input + *inOutIdx, RECORD_HEADER_SZ);
|
|
*inOutIdx += RECORD_HEADER_SZ;
|
|
ato16(rh->length, size);
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb)
|
|
ssl->fuzzerCb(ssl, input + *inOutIdx, DTLS_RECORD_HEADER_SZ,
|
|
FUZZ_HEAD, ssl->fuzzerCtx);
|
|
#endif
|
|
/* type and version in same sport */
|
|
XMEMCPY(rh, input + *inOutIdx, ENUM_LEN + VERSION_SZ);
|
|
*inOutIdx += ENUM_LEN + VERSION_SZ;
|
|
ato16(input + *inOutIdx, &ssl->keys.curEpoch);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
if (ssl->options.haveMcast) {
|
|
#ifdef WOLFSSL_MULTICAST
|
|
ssl->keys.curPeerId = input[*inOutIdx];
|
|
ssl->keys.curSeq_hi = input[*inOutIdx+1];
|
|
#endif
|
|
}
|
|
else
|
|
ato16(input + *inOutIdx, &ssl->keys.curSeq_hi);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
ato32(input + *inOutIdx, &ssl->keys.curSeq_lo);
|
|
*inOutIdx += OPAQUE32_LEN; /* advance past rest of seq */
|
|
ato16(input + *inOutIdx, size);
|
|
*inOutIdx += LENGTH_SZ;
|
|
#endif
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if (!DtlsCheckWindow(ssl) ||
|
|
(rh->type == application_data && ssl->keys.curEpoch == 0) ||
|
|
(rh->type == alert && ssl->options.handShakeDone &&
|
|
ssl->keys.curEpoch == 0 && ssl->keys.dtls_epoch != 0)) {
|
|
WOLFSSL_LEAVE("GetRecordHeader()", SEQUENCE_ERROR);
|
|
return SEQUENCE_ERROR;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* catch version mismatch */
|
|
#ifndef WOLFSSL_TLS13
|
|
if (rh->pvMajor != ssl->version.major || rh->pvMinor != ssl->version.minor)
|
|
#else
|
|
if (rh->pvMajor != ssl->version.major ||
|
|
(rh->pvMinor != ssl->version.minor &&
|
|
(!IsAtLeastTLSv1_3(ssl->version) || rh->pvMinor != TLSv1_2_MINOR)
|
|
))
|
|
#endif
|
|
{
|
|
if (ssl->options.side == WOLFSSL_SERVER_END &&
|
|
ssl->options.acceptState < ACCEPT_FIRST_REPLY_DONE)
|
|
|
|
WOLFSSL_MSG("Client attempting to connect with different version");
|
|
else if (ssl->options.side == WOLFSSL_CLIENT_END &&
|
|
ssl->options.downgrade &&
|
|
ssl->options.connectState < FIRST_REPLY_DONE)
|
|
WOLFSSL_MSG("Server attempting to accept with different version");
|
|
else if (ssl->options.dtls && rh->type == handshake)
|
|
/* Check the DTLS handshake message RH version later. */
|
|
WOLFSSL_MSG("DTLS handshake, skip RH version number check");
|
|
else {
|
|
WOLFSSL_MSG("SSL version error");
|
|
/* send alert per RFC5246 Appendix E. Backward Compatibility */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
#ifdef WOLFSSL_MYSQL_COMPATIBLE
|
|
SendAlert(ssl, alert_fatal, wc_protocol_version);
|
|
#else
|
|
SendAlert(ssl, alert_fatal, protocol_version);
|
|
#endif
|
|
}
|
|
return VERSION_ERROR; /* only use requested version */
|
|
}
|
|
}
|
|
|
|
/* record layer length check */
|
|
#ifdef HAVE_MAX_FRAGMENT
|
|
if (*size > (ssl->max_fragment + MAX_COMP_EXTRA + MAX_MSG_EXTRA)) {
|
|
SendAlert(ssl, alert_fatal, record_overflow);
|
|
return LENGTH_ERROR;
|
|
}
|
|
#else
|
|
if (*size > (MAX_RECORD_SIZE + MAX_COMP_EXTRA + MAX_MSG_EXTRA))
|
|
return LENGTH_ERROR;
|
|
#endif
|
|
|
|
/* verify record type here as well */
|
|
switch (rh->type) {
|
|
case handshake:
|
|
case change_cipher_spec:
|
|
case application_data:
|
|
case alert:
|
|
break;
|
|
case no_type:
|
|
default:
|
|
WOLFSSL_MSG("Unknown Record Type");
|
|
return UNKNOWN_RECORD_TYPE;
|
|
}
|
|
|
|
/* haven't decrypted this record yet */
|
|
ssl->keys.decryptedCur = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
static int GetHandShakeHeader(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
byte *type, word32 *size, word32 totalSz)
|
|
{
|
|
const byte *ptr = input + *inOutIdx;
|
|
(void)ssl;
|
|
|
|
*inOutIdx += HANDSHAKE_HEADER_SZ;
|
|
if (*inOutIdx > totalSz)
|
|
return BUFFER_E;
|
|
|
|
*type = ptr[0];
|
|
c24to32(&ptr[1], size);
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
static int GetDtlsHandShakeHeader(WOLFSSL* ssl, const byte* input,
|
|
word32* inOutIdx, byte *type, word32 *size,
|
|
word32 *fragOffset, word32 *fragSz,
|
|
word32 totalSz)
|
|
{
|
|
word32 idx = *inOutIdx;
|
|
|
|
*inOutIdx += HANDSHAKE_HEADER_SZ + DTLS_HANDSHAKE_EXTRA;
|
|
if (*inOutIdx > totalSz) {
|
|
WOLFSSL_ERROR(BUFFER_E);
|
|
return BUFFER_E;
|
|
}
|
|
|
|
*type = input[idx++];
|
|
c24to32(input + idx, size);
|
|
idx += OPAQUE24_LEN;
|
|
|
|
ato16(input + idx, &ssl->keys.dtls_peer_handshake_number);
|
|
idx += DTLS_HANDSHAKE_SEQ_SZ;
|
|
|
|
c24to32(input + idx, fragOffset);
|
|
idx += DTLS_HANDSHAKE_FRAG_SZ;
|
|
c24to32(input + idx, fragSz);
|
|
|
|
if (ssl->curRL.pvMajor != ssl->version.major ||
|
|
ssl->curRL.pvMinor != ssl->version.minor) {
|
|
|
|
if (*type != client_hello && *type != hello_verify_request) {
|
|
WOLFSSL_ERROR(VERSION_ERROR);
|
|
return VERSION_ERROR;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("DTLS Handshake ignoring hello or verify version");
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
|
|
#if !defined(NO_OLD_TLS) || \
|
|
(defined(NO_OLD_TLS) && defined(WOLFSSL_ALLOW_TLS_SHA1))
|
|
/* fill with MD5 pad size since biggest required */
|
|
static const byte PAD1[PAD_MD5] =
|
|
{ 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
|
|
0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
|
|
0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
|
|
0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
|
|
0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
|
|
0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
|
|
};
|
|
static const byte PAD2[PAD_MD5] =
|
|
{ 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
|
|
0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
|
|
0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
|
|
0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
|
|
0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
|
|
0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
|
|
};
|
|
#endif /* !NO_OLD_TLS || (NO_OLD_TLS && WOLFSSL_ALLOW_TLS_SHA1) */
|
|
|
|
#ifndef NO_OLD_TLS
|
|
|
|
/* calculate MD5 hash for finished */
|
|
#ifdef WOLFSSL_TI_HASH
|
|
#include <wolfssl/wolfcrypt/hash.h>
|
|
#endif
|
|
|
|
static int BuildMD5(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
|
|
{
|
|
int ret;
|
|
byte md5_result[WC_MD5_DIGEST_SIZE];
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
wc_Md5* md5 = (wc_Md5*)XMALLOC(sizeof(wc_Md5), ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
if (md5 == NULL)
|
|
return MEMORY_E;
|
|
#else
|
|
wc_Md5 md5[1];
|
|
#endif
|
|
|
|
/* make md5 inner */
|
|
ret = wc_Md5Copy(&ssl->hsHashes->hashMd5, md5);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, sender, SIZEOF_SENDER);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, PAD1, PAD_MD5);
|
|
if (ret == 0)
|
|
ret = wc_Md5Final(md5, md5_result);
|
|
|
|
/* make md5 outer */
|
|
if (ret == 0) {
|
|
ret = wc_InitMd5_ex(md5, ssl->heap, ssl->devId);
|
|
if (ret == 0) {
|
|
ret = wc_Md5Update(md5, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, PAD2, PAD_MD5);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, md5_result, WC_MD5_DIGEST_SIZE);
|
|
if (ret == 0)
|
|
ret = wc_Md5Final(md5, hashes->md5);
|
|
wc_Md5Free(md5);
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(md5, ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* calculate SHA hash for finished */
|
|
static int BuildSHA(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
|
|
{
|
|
int ret;
|
|
byte sha_result[WC_SHA_DIGEST_SIZE];
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
wc_Sha* sha = (wc_Sha*)XMALLOC(sizeof(wc_Sha), ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
if (sha == NULL)
|
|
return MEMORY_E;
|
|
#else
|
|
wc_Sha sha[1];
|
|
#endif
|
|
/* make sha inner */
|
|
ret = wc_ShaCopy(&ssl->hsHashes->hashSha, sha); /* Save current position */
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, sender, SIZEOF_SENDER);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, PAD1, PAD_SHA);
|
|
if (ret == 0)
|
|
ret = wc_ShaFinal(sha, sha_result);
|
|
|
|
/* make sha outer */
|
|
if (ret == 0) {
|
|
ret = wc_InitSha_ex(sha, ssl->heap, ssl->devId);
|
|
if (ret == 0) {
|
|
ret = wc_ShaUpdate(sha, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, PAD2, PAD_SHA);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, sha_result, WC_SHA_DIGEST_SIZE);
|
|
if (ret == 0)
|
|
ret = wc_ShaFinal(sha, hashes->sha);
|
|
wc_ShaFree(sha);
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(sha, ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
/* Finished doesn't support SHA512, not SHA512 cipher suites yet */
|
|
static int BuildFinished(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (ssl == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
#ifndef NO_TLS
|
|
if (ssl->options.tls) {
|
|
ret = BuildTlsFinished(ssl, hashes, sender);
|
|
}
|
|
#endif
|
|
#ifndef NO_OLD_TLS
|
|
if (!ssl->options.tls) {
|
|
ret = BuildMD5(ssl, hashes, sender);
|
|
if (ret == 0) {
|
|
ret = BuildSHA(ssl, hashes, sender);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* WOLFSSL_NO_TLS12 */
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_WOLFSSL_CLIENT)
|
|
/* cipher requirements */
|
|
enum {
|
|
REQUIRES_RSA,
|
|
REQUIRES_DHE,
|
|
REQUIRES_ECC,
|
|
REQUIRES_ECC_STATIC,
|
|
REQUIRES_PSK,
|
|
REQUIRES_NTRU,
|
|
REQUIRES_RSA_SIG,
|
|
REQUIRES_AEAD
|
|
};
|
|
|
|
|
|
|
|
/* Does this cipher suite (first, second) have the requirement
|
|
an ephemeral key exchange will still require the key for signing
|
|
the key exchange so ECHDE_RSA requires an rsa key thus rsa_kea */
|
|
static int CipherRequires(byte first, byte second, int requirement)
|
|
{
|
|
|
|
(void)requirement;
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifdef HAVE_CHACHA
|
|
if (first == CHACHA_BYTE) {
|
|
|
|
switch (second) {
|
|
case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
|
|
|
|
case TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
}
|
|
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
|
|
}
|
|
#endif /* HAVE_CHACHA */
|
|
|
|
/* ECC extensions */
|
|
if (first == ECC_BYTE) {
|
|
|
|
switch (second) {
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
#ifndef NO_RSA
|
|
case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
break;
|
|
|
|
#ifndef NO_DES3
|
|
case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_DES3 */
|
|
|
|
#ifndef NO_RC4
|
|
case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_RC4_128_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_RC4 */
|
|
#endif /* NO_RSA */
|
|
|
|
#ifndef NO_DES3
|
|
case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_DES3 */
|
|
#ifndef NO_RC4
|
|
case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_RC4 */
|
|
#ifndef NO_RSA
|
|
case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_RSA */
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
#ifndef NO_RSA
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifdef HAVE_AESCCM
|
|
case TLS_RSA_WITH_AES_128_CCM_8 :
|
|
case TLS_RSA_WITH_AES_256_CCM_8 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_AESCCM */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
|
|
case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 :
|
|
case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
|
|
case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#endif /* !NO_RSA */
|
|
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
case TLS_ECDHE_ECDSA_WITH_AES_128_CCM :
|
|
case TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 :
|
|
case TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 :
|
|
case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 :
|
|
case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
if (requirement == REQUIRES_ECC_STATIC)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
#ifndef NO_PSK
|
|
case TLS_PSK_WITH_AES_128_CCM:
|
|
case TLS_PSK_WITH_AES_256_CCM:
|
|
case TLS_PSK_WITH_AES_128_CCM_8:
|
|
case TLS_PSK_WITH_AES_256_CCM_8:
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_PSK_WITH_AES_128_CCM:
|
|
case TLS_DHE_PSK_WITH_AES_256_CCM:
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_PSK */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
case TLS_ECDHE_ECDSA_WITH_NULL_SHA :
|
|
if (requirement == REQUIRES_ECC)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_PSK_WITH_NULL_SHA256 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
#if defined(WOLFSSL_TLS13) && defined(HAVE_NULL_CIPHER)
|
|
case TLS_SHA256_SHA256:
|
|
break;
|
|
case TLS_SHA384_SHA384:
|
|
break;
|
|
#endif
|
|
|
|
default:
|
|
WOLFSSL_MSG("Unsupported cipher suite, CipherRequires ECC");
|
|
return 0;
|
|
} /* switch */
|
|
} /* if */
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
/* Distinct TLS v1.3 cipher suites with cipher and digest only. */
|
|
if (first == TLS13_BYTE) {
|
|
|
|
switch (second) {
|
|
#ifdef WOLFSSL_TLS13
|
|
case TLS_AES_128_GCM_SHA256:
|
|
case TLS_AES_256_GCM_SHA384:
|
|
case TLS_CHACHA20_POLY1305_SHA256:
|
|
case TLS_AES_128_CCM_SHA256:
|
|
case TLS_AES_128_CCM_8_SHA256:
|
|
break;
|
|
#endif
|
|
|
|
default:
|
|
WOLFSSL_MSG("Unsupported cipher suite, CipherRequires "
|
|
"TLS v1.3");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
if (first != ECC_BYTE && first != CHACHA_BYTE &&
|
|
first != TLS13_BYTE) { /* normal suites */
|
|
switch (second) {
|
|
|
|
#ifndef NO_RSA
|
|
#ifndef NO_RC4
|
|
case SSL_RSA_WITH_RC4_128_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case SSL_RSA_WITH_RC4_128_MD5 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
#endif /* NO_RC4 */
|
|
|
|
case SSL_RSA_WITH_3DES_EDE_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
#ifdef HAVE_NTRU
|
|
case TLS_NTRU_RSA_WITH_RC4_128_SHA :
|
|
if (requirement == REQUIRES_NTRU)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_NTRU */
|
|
|
|
case TLS_RSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_RSA_WITH_AES_128_CBC_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
#ifdef HAVE_NTRU
|
|
case TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA :
|
|
if (requirement == REQUIRES_NTRU)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_NTRU */
|
|
|
|
case TLS_RSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
#ifdef HAVE_NTRU
|
|
case TLS_NTRU_RSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_NTRU)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_NTRU */
|
|
|
|
case TLS_RSA_WITH_AES_256_CBC_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_RSA_WITH_NULL_MD5 :
|
|
case TLS_RSA_WITH_NULL_SHA :
|
|
case TLS_RSA_WITH_NULL_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
#ifdef HAVE_NTRU
|
|
case TLS_NTRU_RSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_NTRU)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_NTRU */
|
|
|
|
#ifdef HAVE_IDEA
|
|
case SSL_RSA_WITH_IDEA_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_IDEA */
|
|
#endif /* !NO_RSA */
|
|
|
|
#ifndef NO_PSK
|
|
case TLS_PSK_WITH_AES_128_GCM_SHA256 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_PSK_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_PSK_WITH_AES_128_CBC_SHA256 :
|
|
case TLS_PSK_WITH_AES_256_CBC_SHA384 :
|
|
case TLS_PSK_WITH_AES_128_CBC_SHA :
|
|
case TLS_PSK_WITH_AES_256_CBC_SHA :
|
|
case TLS_PSK_WITH_NULL_SHA384 :
|
|
case TLS_PSK_WITH_NULL_SHA256 :
|
|
case TLS_PSK_WITH_NULL_SHA :
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
|
|
case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
|
|
case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
|
|
case TLS_DHE_PSK_WITH_NULL_SHA384 :
|
|
case TLS_DHE_PSK_WITH_NULL_SHA256 :
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
if (requirement == REQUIRES_PSK)
|
|
return 1;
|
|
break;
|
|
#endif /* NO_PSK */
|
|
|
|
#ifndef NO_RSA
|
|
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
|
|
#ifndef NO_HC128
|
|
case TLS_RSA_WITH_HC_128_MD5 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_RSA_WITH_HC_128_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
#endif /* NO_HC128 */
|
|
|
|
#ifndef NO_RABBIT
|
|
case TLS_RSA_WITH_RABBIT_SHA :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
#endif /* !NO_RABBIT */
|
|
|
|
case TLS_RSA_WITH_AES_128_GCM_SHA256 :
|
|
case TLS_RSA_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
|
|
case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
|
|
#ifdef HAVE_CAMELLIA
|
|
case TLS_RSA_WITH_CAMELLIA_128_CBC_SHA :
|
|
case TLS_RSA_WITH_CAMELLIA_256_CBC_SHA :
|
|
case TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 :
|
|
case TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
break;
|
|
|
|
case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA :
|
|
case TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA :
|
|
case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 :
|
|
case TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 :
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
#endif /* HAVE_CAMELLIA */
|
|
|
|
case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
|
|
if (requirement == REQUIRES_RSA)
|
|
return 1;
|
|
if (requirement == REQUIRES_RSA_SIG)
|
|
return 1;
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_ANON
|
|
case TLS_DH_anon_WITH_AES_128_CBC_SHA :
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
break;
|
|
case TLS_DH_anon_WITH_AES_256_GCM_SHA384:
|
|
if (requirement == REQUIRES_DHE)
|
|
return 1;
|
|
if (requirement == REQUIRES_AEAD)
|
|
return 1;
|
|
break;
|
|
#endif
|
|
#ifdef WOLFSSL_MULTICAST
|
|
case WDM_WITH_NULL_SHA256 :
|
|
break;
|
|
#endif
|
|
|
|
default:
|
|
WOLFSSL_MSG("Unsupported cipher suite, CipherRequires");
|
|
return 0;
|
|
} /* switch */
|
|
} /* if ECC / Normal suites else */
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT */
|
|
|
|
|
|
#ifndef NO_CERTS
|
|
|
|
|
|
/* Match names with wildcards, each wildcard can represent a single name
|
|
component or fragment but not multiple names, i.e.,
|
|
*.z.com matches y.z.com but not x.y.z.com
|
|
|
|
return 1 on success */
|
|
int MatchDomainName(const char* pattern, int len, const char* str)
|
|
{
|
|
int ret = 0;
|
|
char p, s;
|
|
|
|
if (pattern == NULL || str == NULL || len <= 0)
|
|
return 0;
|
|
|
|
while (len > 0) {
|
|
|
|
p = (char)XTOLOWER((unsigned char)*pattern++);
|
|
if (p == '\0')
|
|
break;
|
|
|
|
if (p == '*') {
|
|
while (--len > 0 &&
|
|
(p = (char)XTOLOWER((unsigned char)*pattern++)) == '*') {
|
|
}
|
|
|
|
if (len == 0)
|
|
p = '\0';
|
|
|
|
while ( (s = (char)XTOLOWER((unsigned char) *str)) != '\0') {
|
|
if (s == p)
|
|
break;
|
|
if (s == '.')
|
|
return 0;
|
|
str++;
|
|
}
|
|
}
|
|
else {
|
|
if (p != (char)XTOLOWER((unsigned char) *str))
|
|
return 0;
|
|
}
|
|
|
|
|
|
if (len > 0) {
|
|
str++;
|
|
len--;
|
|
}
|
|
}
|
|
|
|
if (*str == '\0' && len == 0) {
|
|
ret = 1; /* success */
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* Check that alternative names, if they exists, match the domain.
|
|
* Fail if there are wild patterns and they didn't match.
|
|
* Check the common name if no alternative names matched.
|
|
*
|
|
* dCert Decoded cert to get the alternative names from.
|
|
* domain Domain name to compare against.
|
|
* checkCN Whether to check the common name.
|
|
* returns 1 : match was found.
|
|
* 0 : no match found.
|
|
* -1 : No matches and wild pattern match failed.
|
|
*/
|
|
int CheckForAltNames(DecodedCert* dCert, const char* domain, int* checkCN)
|
|
{
|
|
int match = 0;
|
|
DNS_entry* altName = NULL;
|
|
char *buf;
|
|
word32 len;
|
|
|
|
WOLFSSL_MSG("Checking AltNames");
|
|
|
|
if (dCert)
|
|
altName = dCert->altNames;
|
|
|
|
if (checkCN != NULL) {
|
|
*checkCN = (altName == NULL) ? 1 : 0;
|
|
}
|
|
|
|
while (altName) {
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME)
|
|
char name[WOLFSSL_MAX_IPSTR] = {0};
|
|
#endif
|
|
|
|
WOLFSSL_MSG("\tindividual AltName check");
|
|
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME)
|
|
/* check if alt name is stored as IP addr octet */
|
|
if (altName->type == ASN_IP_TYPE) {
|
|
char tmp[4];
|
|
int i;
|
|
word32 idx = 0;
|
|
for (i = 0; (idx < WOLFSSL_MAX_IPSTR) && (i < altName->len); i++) {
|
|
XMEMSET(tmp, 0, sizeof(tmp));
|
|
XSNPRINTF(tmp, sizeof(tmp), (altName->len <= 4) ? "%u" : "%02X",
|
|
altName->name[i]);
|
|
idx += (word32)XSTRLEN(tmp);
|
|
XSTRNCAT(name, tmp, (altName->len <= 4) ? 3 : 2);
|
|
if ((idx < WOLFSSL_MAX_IPSTR ) && ((i + 1) < altName->len)) {
|
|
name[idx++] = (altName->len <= 4) ? '.' : ':';
|
|
}
|
|
}
|
|
if (idx >= WOLFSSL_MAX_IPSTR) {
|
|
idx = WOLFSSL_MAX_IPSTR -1;
|
|
}
|
|
name[idx] = '\0';
|
|
buf = name;
|
|
len = (word32)XSTRLEN(name);
|
|
}
|
|
else
|
|
#endif /* OPENSSL_ALL || WOLFSSL_IP_ALT_NAME */
|
|
{
|
|
buf = altName->name;
|
|
len = altName->len;
|
|
}
|
|
|
|
if (MatchDomainName(buf, len, domain)) {
|
|
match = 1;
|
|
if (checkCN != NULL) {
|
|
*checkCN = 0;
|
|
}
|
|
WOLFSSL_MSG("\tmatch found");
|
|
break;
|
|
}
|
|
/* No matches and wild pattern match failed. */
|
|
else if (buf && (len >=1) && (buf[0] == '*')) {
|
|
match = -1;
|
|
WOLFSSL_MSG("\twildcard match failed");
|
|
}
|
|
|
|
altName = altName->next;
|
|
}
|
|
|
|
return match;
|
|
}
|
|
|
|
|
|
/* Check the domain name matches the subject alternative name or the subject
|
|
* name.
|
|
*
|
|
* dcert Decoded certificate.
|
|
* domainName The domain name.
|
|
* domainNameLen The length of the domain name.
|
|
* returns DOMAIN_NAME_MISMATCH when no match found and 0 on success.
|
|
*/
|
|
int CheckHostName(DecodedCert* dCert, const char *domainName, size_t domainNameLen)
|
|
{
|
|
int checkCN;
|
|
int ret = DOMAIN_NAME_MISMATCH;
|
|
|
|
/* Assume name is NUL terminated. */
|
|
(void)domainNameLen;
|
|
|
|
if (CheckForAltNames(dCert, domainName, &checkCN) != 1) {
|
|
WOLFSSL_MSG("DomainName match on alt names failed");
|
|
}
|
|
else {
|
|
ret = 0;
|
|
}
|
|
|
|
if (checkCN == 1) {
|
|
if (MatchDomainName(dCert->subjectCN, dCert->subjectCNLen,
|
|
domainName) == 1) {
|
|
ret = 0;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("DomainName match on common name failed");
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
int CheckIPAddr(DecodedCert* dCert, const char* ipasc)
|
|
{
|
|
WOLFSSL_MSG("Checking IPAddr");
|
|
|
|
return CheckHostName(dCert, ipasc, (size_t)XSTRLEN(ipasc));
|
|
}
|
|
|
|
|
|
#ifdef SESSION_CERTS
|
|
static void AddSessionCertToChain(WOLFSSL_X509_CHAIN* chain,
|
|
byte* certBuf, word32 certSz)
|
|
{
|
|
if (chain->count < MAX_CHAIN_DEPTH &&
|
|
certSz < MAX_X509_SIZE) {
|
|
chain->certs[chain->count].length = certSz;
|
|
XMEMCPY(chain->certs[chain->count].buffer, certBuf, certSz);
|
|
chain->count++;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Couldn't store chain cert for session");
|
|
}
|
|
}
|
|
#endif
|
|
|
|
#if defined(KEEP_PEER_CERT) || defined(SESSION_CERTS) || \
|
|
defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
/* Copy parts X509 needs from Decoded cert, 0 on success */
|
|
/* The same DecodedCert cannot be copied to WOLFSSL_X509 twice otherwise the
|
|
* altNames pointers could be free'd by second x509 still active by first */
|
|
int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (x509 == NULL || dCert == NULL ||
|
|
dCert->subjectCNLen < 0)
|
|
return BAD_FUNC_ARG;
|
|
|
|
if (x509->issuer.name == NULL || x509->subject.name == NULL) {
|
|
WOLFSSL_MSG("Either init was not called on X509 or programming error");
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
x509->version = dCert->version + 1;
|
|
|
|
XSTRNCPY(x509->issuer.name, dCert->issuer, ASN_NAME_MAX);
|
|
x509->issuer.name[ASN_NAME_MAX - 1] = '\0';
|
|
x509->issuer.sz = (int)XSTRLEN(x509->issuer.name) + 1;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (dCert->issuerName != NULL) {
|
|
wolfSSL_X509_set_issuer_name(x509,
|
|
(WOLFSSL_X509_NAME*)dCert->issuerName);
|
|
x509->issuer.x509 = x509;
|
|
}
|
|
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
|
|
|
|
XSTRNCPY(x509->subject.name, dCert->subject, ASN_NAME_MAX);
|
|
x509->subject.name[ASN_NAME_MAX - 1] = '\0';
|
|
x509->subject.sz = (int)XSTRLEN(x509->subject.name) + 1;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (dCert->subjectName != NULL) {
|
|
wolfSSL_X509_set_subject_name(x509,
|
|
(WOLFSSL_X509_NAME*)dCert->subjectName);
|
|
x509->subject.x509 = x509;
|
|
}
|
|
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX)
|
|
x509->subject.rawLen = min(dCert->subjectRawLen, sizeof(x509->subject.raw));
|
|
XMEMCPY(x509->subject.raw, dCert->subjectRaw, x509->subject.rawLen);
|
|
#ifdef WOLFSSL_CERT_EXT
|
|
x509->issuer.rawLen = min(dCert->issuerRawLen, sizeof(x509->issuer.raw));
|
|
XMEMCPY(x509->issuer.raw, dCert->issuerRaw, x509->issuer.rawLen);
|
|
#endif
|
|
#endif
|
|
|
|
XMEMCPY(x509->serial, dCert->serial, EXTERNAL_SERIAL_SIZE);
|
|
x509->serialSz = dCert->serialSz;
|
|
if (dCert->subjectCN && dCert->subjectCNLen < ASN_NAME_MAX) {
|
|
XMEMCPY(x509->subjectCN, dCert->subjectCN, dCert->subjectCNLen);
|
|
x509->subjectCN[dCert->subjectCNLen] = '\0';
|
|
}
|
|
else
|
|
x509->subjectCN[0] = '\0';
|
|
|
|
#ifdef WOLFSSL_CERT_REQ
|
|
x509->isCSR = dCert->isCSR;
|
|
/* CSR attributes */
|
|
if (dCert->cPwd) {
|
|
if (dCert->cPwdLen < CTC_NAME_SIZE) {
|
|
XMEMCPY(x509->challengePw, dCert->cPwd, dCert->cPwdLen);
|
|
x509->challengePw[dCert->cPwdLen] = '\0';
|
|
#ifdef OPENSSL_ALL
|
|
if (x509->challengePwAttr) {
|
|
wolfSSL_X509_ATTRIBUTE_free(x509->challengePwAttr);
|
|
}
|
|
x509->challengePwAttr = wolfSSL_X509_ATTRIBUTE_new();
|
|
if (x509->challengePwAttr) {
|
|
x509->challengePwAttr->value->value.asn1_string =
|
|
wolfSSL_ASN1_STRING_new();
|
|
if (wolfSSL_ASN1_STRING_set(
|
|
x509->challengePwAttr->value->value.asn1_string,
|
|
dCert->cPwd, dCert->cPwdLen) != WOLFSSL_SUCCESS) {
|
|
ret = MEMORY_E;
|
|
}
|
|
x509->challengePwAttr->value->type = V_ASN1_PRINTABLESTRING;
|
|
}
|
|
else {
|
|
ret = MEMORY_E;
|
|
}
|
|
#endif
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Challenge password too long");
|
|
ret = MEMORY_E;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SEP
|
|
{
|
|
int minSz = min(dCert->deviceTypeSz, EXTERNAL_SERIAL_SIZE);
|
|
if (minSz > 0) {
|
|
x509->deviceTypeSz = minSz;
|
|
XMEMCPY(x509->deviceType, dCert->deviceType, minSz);
|
|
}
|
|
else
|
|
x509->deviceTypeSz = 0;
|
|
minSz = min(dCert->hwTypeSz, EXTERNAL_SERIAL_SIZE);
|
|
if (minSz > 0) {
|
|
x509->hwTypeSz = minSz;
|
|
XMEMCPY(x509->hwType, dCert->hwType, minSz);
|
|
}
|
|
else
|
|
x509->hwTypeSz = 0;
|
|
minSz = min(dCert->hwSerialNumSz, EXTERNAL_SERIAL_SIZE);
|
|
if (minSz > 0) {
|
|
x509->hwSerialNumSz = minSz;
|
|
XMEMCPY(x509->hwSerialNum, dCert->hwSerialNum, minSz);
|
|
}
|
|
else
|
|
x509->hwSerialNumSz = 0;
|
|
}
|
|
#endif /* WOLFSSL_SEP */
|
|
{
|
|
int minSz;
|
|
if (dCert->beforeDateLen > 0) {
|
|
minSz = min(dCert->beforeDate[1], MAX_DATE_SZ);
|
|
x509->notBefore.type = dCert->beforeDate[0];
|
|
x509->notBefore.length = minSz;
|
|
XMEMCPY(x509->notBefore.data, &dCert->beforeDate[2], minSz);
|
|
}
|
|
else
|
|
x509->notBefore.length = 0;
|
|
if (dCert->afterDateLen > 0) {
|
|
minSz = min(dCert->afterDate[1], MAX_DATE_SZ);
|
|
x509->notAfter.type = dCert->afterDate[0];
|
|
x509->notAfter.length = minSz;
|
|
XMEMCPY(x509->notAfter.data, &dCert->afterDate[2], minSz);
|
|
}
|
|
else
|
|
x509->notAfter.length = 0;
|
|
}
|
|
|
|
if (dCert->publicKey != NULL && dCert->pubKeySize != 0) {
|
|
x509->pubKey.buffer = (byte*)XMALLOC(
|
|
dCert->pubKeySize, x509->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
if (x509->pubKey.buffer != NULL) {
|
|
x509->pubKeyOID = dCert->keyOID;
|
|
x509->pubKey.length = dCert->pubKeySize;
|
|
XMEMCPY(x509->pubKey.buffer, dCert->publicKey, dCert->pubKeySize);
|
|
}
|
|
else
|
|
ret = MEMORY_E;
|
|
#if defined(OPENSSL_ALL)
|
|
if (ret == 0) {
|
|
x509->key.pubKeyOID = dCert->keyOID;
|
|
|
|
if (!x509->key.algor) {
|
|
x509->key.algor = wolfSSL_X509_ALGOR_new();
|
|
} else {
|
|
wolfSSL_ASN1_OBJECT_free(x509->key.algor->algorithm);
|
|
}
|
|
if (!(x509->key.algor->algorithm =
|
|
wolfSSL_OBJ_nid2obj(dCert->keyOID))) {
|
|
ret = PUBLIC_KEY_E;
|
|
}
|
|
|
|
wolfSSL_EVP_PKEY_free(x509->key.pkey);
|
|
if (!(x509->key.pkey = wolfSSL_d2i_PUBKEY(NULL,
|
|
&dCert->publicKey,
|
|
dCert->pubKeySize))) {
|
|
ret = PUBLIC_KEY_E;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
if (dCert->signature != NULL && dCert->sigLength != 0 &&
|
|
dCert->sigLength <= MAX_ENCODED_SIG_SZ) {
|
|
x509->sig.buffer = (byte*)XMALLOC(
|
|
dCert->sigLength, x509->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (x509->sig.buffer == NULL) {
|
|
ret = MEMORY_E;
|
|
}
|
|
else {
|
|
XMEMCPY(x509->sig.buffer, dCert->signature, dCert->sigLength);
|
|
x509->sig.length = dCert->sigLength;
|
|
x509->sigOID = dCert->signatureOID;
|
|
}
|
|
#if defined(OPENSSL_ALL)
|
|
wolfSSL_ASN1_OBJECT_free(x509->algor.algorithm);
|
|
if (!(x509->algor.algorithm =
|
|
wolfSSL_OBJ_nid2obj(dCert->signatureOID))) {
|
|
ret = PUBLIC_KEY_E;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
/* store cert for potential retrieval */
|
|
if (AllocDer(&x509->derCert, dCert->maxIdx, CERT_TYPE, x509->heap) == 0) {
|
|
XMEMCPY(x509->derCert->buffer, dCert->source, dCert->maxIdx);
|
|
}
|
|
else {
|
|
ret = MEMORY_E;
|
|
}
|
|
|
|
x509->altNames = dCert->altNames;
|
|
dCert->weOwnAltNames = 0;
|
|
x509->altNamesNext = x509->altNames; /* index hint */
|
|
|
|
#if (defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)) && \
|
|
!defined(IGNORE_NAME_CONSTRAINTS)
|
|
/* add copies of alternate emails from dCert to X509 */
|
|
if (dCert->altEmailNames != NULL) {
|
|
DNS_entry* cur = dCert->altEmailNames;
|
|
|
|
while (cur != NULL) {
|
|
if (cur->type == ASN_RFC822_TYPE) {
|
|
DNS_entry* dnsEntry;
|
|
int strLen = cur->len;
|
|
|
|
dnsEntry = (DNS_entry*)XMALLOC(sizeof(DNS_entry), x509->heap,
|
|
DYNAMIC_TYPE_ALTNAME);
|
|
if (dnsEntry == NULL) {
|
|
WOLFSSL_MSG("\tOut of Memory");
|
|
return MEMORY_E;
|
|
}
|
|
|
|
dnsEntry->type = ASN_RFC822_TYPE;
|
|
dnsEntry->name = (char*)XMALLOC(strLen + 1, x509->heap,
|
|
DYNAMIC_TYPE_ALTNAME);
|
|
if (dnsEntry->name == NULL) {
|
|
WOLFSSL_MSG("\tOut of Memory");
|
|
XFREE(dnsEntry, x509->heap, DYNAMIC_TYPE_ALTNAME);
|
|
return MEMORY_E;
|
|
}
|
|
dnsEntry->len = strLen;
|
|
XMEMCPY(dnsEntry->name, cur->name, strLen);
|
|
dnsEntry->name[strLen] = '\0';
|
|
|
|
dnsEntry->next = x509->altNames;
|
|
x509->altNames = dnsEntry;
|
|
}
|
|
cur = cur->next;
|
|
}
|
|
}
|
|
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
|
|
|
|
x509->isCa = dCert->isCA;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
x509->pathLength = dCert->pathLength;
|
|
x509->keyUsage = dCert->extKeyUsage;
|
|
|
|
x509->CRLdistSet = dCert->extCRLdistSet;
|
|
x509->CRLdistCrit = dCert->extCRLdistCrit;
|
|
x509->CRLInfo = dCert->extCrlInfo;
|
|
x509->CRLInfoSz = dCert->extCrlInfoSz;
|
|
x509->authInfoSet = dCert->extAuthInfoSet;
|
|
x509->authInfoCrit = dCert->extAuthInfoCrit;
|
|
if (dCert->extAuthInfo != NULL && dCert->extAuthInfoSz > 0) {
|
|
x509->authInfo = (byte*)XMALLOC(dCert->extAuthInfoSz, x509->heap,
|
|
DYNAMIC_TYPE_X509_EXT);
|
|
if (x509->authInfo != NULL) {
|
|
XMEMCPY(x509->authInfo, dCert->extAuthInfo, dCert->extAuthInfoSz);
|
|
x509->authInfoSz = dCert->extAuthInfoSz;
|
|
}
|
|
else {
|
|
ret = MEMORY_E;
|
|
}
|
|
}
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
|
if (dCert->extAuthInfoCaIssuer != NULL && dCert->extAuthInfoCaIssuerSz > 0) {
|
|
x509->authInfoCaIssuer = (byte*)XMALLOC(dCert->extAuthInfoCaIssuerSz, x509->heap,
|
|
DYNAMIC_TYPE_X509_EXT);
|
|
if (x509->authInfoCaIssuer != NULL) {
|
|
XMEMCPY(x509->authInfoCaIssuer, dCert->extAuthInfoCaIssuer, dCert->extAuthInfoCaIssuerSz);
|
|
x509->authInfoCaIssuerSz = dCert->extAuthInfoCaIssuerSz;
|
|
}
|
|
else {
|
|
ret = MEMORY_E;
|
|
}
|
|
}
|
|
#endif
|
|
x509->basicConstSet = dCert->extBasicConstSet;
|
|
x509->basicConstCrit = dCert->extBasicConstCrit;
|
|
x509->basicConstPlSet = dCert->pathLengthSet;
|
|
x509->subjAltNameSet = dCert->extSubjAltNameSet;
|
|
x509->subjAltNameCrit = dCert->extSubjAltNameCrit;
|
|
x509->authKeyIdSet = dCert->extAuthKeyIdSet;
|
|
x509->authKeyIdCrit = dCert->extAuthKeyIdCrit;
|
|
if (dCert->extAuthKeyIdSrc != NULL && dCert->extAuthKeyIdSz != 0) {
|
|
x509->authKeyId = (byte*)XMALLOC(dCert->extAuthKeyIdSz, x509->heap,
|
|
DYNAMIC_TYPE_X509_EXT);
|
|
if (x509->authKeyId != NULL) {
|
|
XMEMCPY(x509->authKeyId,
|
|
dCert->extAuthKeyIdSrc, dCert->extAuthKeyIdSz);
|
|
x509->authKeyIdSz = dCert->extAuthKeyIdSz;
|
|
}
|
|
else
|
|
ret = MEMORY_E;
|
|
}
|
|
x509->subjKeyIdSet = dCert->extSubjKeyIdSet;
|
|
x509->subjKeyIdCrit = dCert->extSubjKeyIdCrit;
|
|
if (dCert->extSubjKeyIdSrc != NULL && dCert->extSubjKeyIdSz != 0) {
|
|
x509->subjKeyId = (byte*)XMALLOC(dCert->extSubjKeyIdSz, x509->heap,
|
|
DYNAMIC_TYPE_X509_EXT);
|
|
if (x509->subjKeyId != NULL) {
|
|
XMEMCPY(x509->subjKeyId,
|
|
dCert->extSubjKeyIdSrc, dCert->extSubjKeyIdSz);
|
|
x509->subjKeyIdSz = dCert->extSubjKeyIdSz;
|
|
}
|
|
else
|
|
ret = MEMORY_E;
|
|
}
|
|
x509->keyUsageSet = dCert->extKeyUsageSet;
|
|
x509->keyUsageCrit = dCert->extKeyUsageCrit;
|
|
if (dCert->extExtKeyUsageSrc != NULL && dCert->extExtKeyUsageSz > 0) {
|
|
x509->extKeyUsageSrc = (byte*)XMALLOC(dCert->extExtKeyUsageSz,
|
|
x509->heap, DYNAMIC_TYPE_X509_EXT);
|
|
if (x509->extKeyUsageSrc != NULL) {
|
|
XMEMCPY(x509->extKeyUsageSrc, dCert->extExtKeyUsageSrc,
|
|
dCert->extExtKeyUsageSz);
|
|
x509->extKeyUsageSz = dCert->extExtKeyUsageSz;
|
|
x509->extKeyUsageCrit = dCert->extExtKeyUsageCrit;
|
|
x509->extKeyUsageCount = dCert->extExtKeyUsageCount;
|
|
}
|
|
else {
|
|
ret = MEMORY_E;
|
|
}
|
|
}
|
|
#if defined(WOLFSSL_SEP) || defined(WOLFSSL_QT)
|
|
x509->certPolicySet = dCert->extCertPolicySet;
|
|
x509->certPolicyCrit = dCert->extCertPolicyCrit;
|
|
#endif /* WOLFSSL_SEP || WOLFSSL_QT */
|
|
#ifdef WOLFSSL_CERT_EXT
|
|
{
|
|
int i;
|
|
for (i = 0; i < dCert->extCertPoliciesNb && i < MAX_CERTPOL_NB; i++)
|
|
XMEMCPY(x509->certPolicies[i], dCert->extCertPolicies[i],
|
|
MAX_CERTPOL_SZ);
|
|
x509->certPoliciesNb = dCert->extCertPoliciesNb;
|
|
}
|
|
#endif /* WOLFSSL_CERT_EXT */
|
|
#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
|
|
x509->pkCurveOID = dCert->pkCurveOID;
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* KEEP_PEER_CERT || SESSION_CERTS */
|
|
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
|
|
(defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) && !defined(WOLFSSL_NO_TLS12))
|
|
static int ProcessCSR(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 status_length)
|
|
{
|
|
int ret = 0;
|
|
OcspRequest* request;
|
|
WOLFSSL_ENTER("ProcessCSR");
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
CertStatus* status;
|
|
OcspEntry* single;
|
|
OcspResponse* response;
|
|
#else
|
|
CertStatus status[1];
|
|
OcspEntry single[1];
|
|
OcspResponse response[1];
|
|
#endif
|
|
|
|
do {
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
|
|
if (ssl->status_request) {
|
|
request = (OcspRequest*)TLSX_CSR_GetRequest(ssl->extensions);
|
|
ssl->status_request = 0;
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
if (ssl->status_request_v2) {
|
|
request = (OcspRequest*)TLSX_CSR2_GetRequest(ssl->extensions,
|
|
WOLFSSL_CSR2_OCSP, 0);
|
|
ssl->status_request_v2 = 0;
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
return BUFFER_ERROR;
|
|
} while(0);
|
|
|
|
if (request == NULL)
|
|
return BAD_CERTIFICATE_STATUS_ERROR; /* not expected */
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
status = (CertStatus*)XMALLOC(sizeof(CertStatus), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_STATUS);
|
|
single = (OcspEntry*)XMALLOC(sizeof(OcspEntry), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_ENTRY);
|
|
response = (OcspResponse*)XMALLOC(sizeof(OcspResponse), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_REQUEST);
|
|
|
|
if (status == NULL || single == NULL || response == NULL) {
|
|
if (status)
|
|
XFREE(status, ssl->heap, DYNAMIC_TYPE_OCSP_STATUS);
|
|
if (single)
|
|
XFREE(single, ssl->heap, DYNAMIC_TYPE_OCSP_ENTRY);
|
|
if (response)
|
|
XFREE(response, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
|
|
return MEMORY_ERROR;
|
|
}
|
|
#endif
|
|
|
|
InitOcspResponse(response, single, status, input +*inOutIdx, status_length, ssl->heap);
|
|
|
|
if (OcspResponseDecode(response, ssl->ctx->cm, ssl->heap, 0) != 0)
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
else if (CompareOcspReqResp(request, response) != 0)
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
else if (response->responseStatus != OCSP_SUCCESSFUL)
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
else if (response->single->status->status == CERT_REVOKED)
|
|
ret = OCSP_CERT_REVOKED;
|
|
else if (response->single->status->status != CERT_GOOD)
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
|
|
else {
|
|
XMEMCPY(ssl->ocspProducedDate, response->producedDate, sizeof ssl->ocspProducedDate);
|
|
ssl->ocspProducedDateFormat = response->producedDateFormat;
|
|
}
|
|
|
|
*inOutIdx += status_length;
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(status, ssl->heap, DYNAMIC_TYPE_OCSP_STATUS);
|
|
XFREE(single, ssl->heap, DYNAMIC_TYPE_OCSP_ENTRY);
|
|
XFREE(response, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
#endif
|
|
|
|
WOLFSSL_LEAVE("ProcessCSR", ret);
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
|
|
#ifdef HAVE_ECC
|
|
static int SigPkCbEccVerify(const unsigned char* sig, unsigned int sigSz,
|
|
const unsigned char* hash, unsigned int hashSz,
|
|
const unsigned char* keyDer, unsigned int keySz,
|
|
int* result, void* ctx)
|
|
{
|
|
int ret = NOT_COMPILED_IN;
|
|
WOLFSSL* ssl = (WOLFSSL*)ctx;
|
|
|
|
if (ssl && ssl->ctx->EccVerifyCb) {
|
|
ret = ssl->ctx->EccVerifyCb(ssl, sig, sigSz, hash, hashSz,
|
|
keyDer, keySz, result, ssl->EccVerifyCtx);
|
|
}
|
|
return ret;
|
|
}
|
|
#endif
|
|
#ifndef NO_RSA
|
|
static int SigPkCbRsaVerify(unsigned char* sig, unsigned int sigSz,
|
|
unsigned char** out, const unsigned char* keyDer, unsigned int keySz,
|
|
void* ctx)
|
|
{
|
|
int ret = NOT_COMPILED_IN;
|
|
WOLFSSL* ssl = (WOLFSSL*)ctx;
|
|
|
|
if (ssl && ssl->ctx->RsaVerifyCb) {
|
|
ret = ssl->ctx->RsaVerifyCb(ssl, sig, sigSz, out, keyDer, keySz,
|
|
ssl->RsaVerifyCtx);
|
|
}
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
int InitSigPkCb(WOLFSSL* ssl, SignatureCtx* sigCtx)
|
|
{
|
|
if (ssl == NULL || sigCtx == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
/* only setup the verify callback if a PK is set */
|
|
#ifdef HAVE_ECC
|
|
if (ssl->ctx->EccVerifyCb) {
|
|
sigCtx->pkCbEcc = SigPkCbEccVerify;
|
|
sigCtx->pkCtxEcc = ssl;
|
|
}
|
|
#endif
|
|
#ifndef NO_RSA
|
|
/* only setup the verify callback if a PK is set */
|
|
if (ssl->ctx->RsaVerifyCb) {
|
|
sigCtx->pkCbRsa = SigPkCbRsaVerify;
|
|
sigCtx->pkCtxRsa = ssl;
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
|
|
#if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
static void DoCertFatalAlert(WOLFSSL* ssl, int ret)
|
|
{
|
|
int alertWhy;
|
|
if (ssl == NULL || ret == 0) {
|
|
return;
|
|
}
|
|
|
|
/* Determine alert reason */
|
|
alertWhy = bad_certificate;
|
|
if (ret == ASN_AFTER_DATE_E || ret == ASN_BEFORE_DATE_E) {
|
|
alertWhy = certificate_expired;
|
|
} else if (ret == ASN_NO_SIGNER_E) {
|
|
alertWhy = unknown_ca;
|
|
}
|
|
#if (defined(OPENSSL_ALL) || defined(WOLFSSL_APACHE_HTTPD))
|
|
else if (ret == CRL_CERT_REVOKED) {
|
|
alertWhy = certificate_revoked;
|
|
}
|
|
#endif
|
|
else if (ret == NO_PEER_CERT) {
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3) {
|
|
alertWhy = certificate_required;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
alertWhy = handshake_failure;
|
|
}
|
|
}
|
|
|
|
/* send fatal alert and mark connection closed */
|
|
SendAlert(ssl, alert_fatal, alertWhy); /* try to send */
|
|
ssl->options.isClosed = 1;
|
|
}
|
|
|
|
/* WOLFSSL_ALWAYS_VERIFY_CB: Use verify callback for success or failure cases */
|
|
/* WOLFSSL_VERIFY_CB_ALL_CERTS: Issue callback for all intermediate certificates */
|
|
|
|
/* Callback is issued for certificate presented in TLS Certificate (11) packet.
|
|
* The intermediates are done first then peer leaf cert last. Use the
|
|
* store->error_depth member to determine index (0=peer, >1 intermediates)
|
|
*/
|
|
|
|
int DoVerifyCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, int ret,
|
|
ProcPeerCertArgs* args)
|
|
{
|
|
int verify_ok = 0, use_cb = 0;
|
|
void *heap;
|
|
|
|
if (cm == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
heap = (ssl != NULL) ? ssl->heap : cm->heap;
|
|
|
|
/* Determine if verify was okay */
|
|
if (ret == 0) {
|
|
verify_ok = 1;
|
|
}
|
|
|
|
/* Determine if verify callback should be used */
|
|
if (ret != 0) {
|
|
if ((ssl != NULL) && (!ssl->options.verifyNone)) {
|
|
use_cb = 1; /* always report errors */
|
|
}
|
|
}
|
|
#ifdef WOLFSSL_ALWAYS_VERIFY_CB
|
|
/* always use verify callback on peer leaf cert */
|
|
if (args->certIdx == 0) {
|
|
use_cb = 1;
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_VERIFY_CB_ALL_CERTS
|
|
/* perform verify callback on other intermediate certs (not just peer) */
|
|
if (args->certIdx > 0) {
|
|
use_cb = 1;
|
|
}
|
|
#endif
|
|
#if defined(OPENSSL_EXTRA)
|
|
/* perform domain name check on the peer certificate */
|
|
if (args->dCertInit && args->dCert && (ssl != NULL) &&
|
|
ssl->param && ssl->param->hostName[0]) {
|
|
/* If altNames names is present, then subject common name is ignored */
|
|
if (args->dCert->altNames != NULL) {
|
|
if (CheckForAltNames(args->dCert, ssl->param->hostName, NULL) != 1) {
|
|
if (ret == 0) {
|
|
ret = DOMAIN_NAME_MISMATCH;
|
|
}
|
|
}
|
|
}
|
|
else {
|
|
if (args->dCert->subjectCN) {
|
|
if (MatchDomainName(args->dCert->subjectCN,
|
|
args->dCert->subjectCNLen,
|
|
ssl->param->hostName) == 0) {
|
|
if (ret == 0) {
|
|
ret = DOMAIN_NAME_MISMATCH;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/* perform IP address check on the peer certificate */
|
|
if ((args->dCertInit != 0) && (args->dCert != NULL) && (ssl != NULL) &&
|
|
(ssl->param != NULL) && (XSTRLEN(ssl->param->ipasc) > 0)) {
|
|
if (CheckIPAddr(args->dCert, ssl->param->ipasc) != 0) {
|
|
if (ret == 0) {
|
|
ret = IPADDR_MISMATCH;
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
/* if verify callback has been set */
|
|
if ((use_cb && (ssl != NULL) && ((ssl->verifyCallback != NULL)
|
|
#ifdef OPENSSL_ALL
|
|
|| (ssl->ctx->verifyCertCb != NULL)
|
|
#endif
|
|
))
|
|
#ifndef NO_WOLFSSL_CM_VERIFY
|
|
|| (cm->verifyCallback != NULL)
|
|
#endif
|
|
) {
|
|
int verifyFail = 0;
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
WOLFSSL_X509_STORE_CTX* store;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
WOLFSSL_X509* x509;
|
|
#endif
|
|
char* domain = NULL;
|
|
#else
|
|
WOLFSSL_X509_STORE_CTX store[1];
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
WOLFSSL_X509 x509[1];
|
|
#endif
|
|
char domain[ASN_NAME_MAX];
|
|
#endif
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
int x509Free = 0;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
store = (WOLFSSL_X509_STORE_CTX*)XMALLOC(
|
|
sizeof(WOLFSSL_X509_STORE_CTX), heap, DYNAMIC_TYPE_X509_STORE);
|
|
if (store == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
x509 = (WOLFSSL_X509*)XMALLOC(sizeof(WOLFSSL_X509), heap,
|
|
DYNAMIC_TYPE_X509);
|
|
if (x509 == NULL) {
|
|
XFREE(store, heap, DYNAMIC_TYPE_X509);
|
|
return MEMORY_E;
|
|
}
|
|
#endif
|
|
domain = (char*)XMALLOC(ASN_NAME_MAX, heap, DYNAMIC_TYPE_STRING);
|
|
if (domain == NULL) {
|
|
XFREE(store, heap, DYNAMIC_TYPE_X509);
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
XFREE(x509, heap, DYNAMIC_TYPE_X509);
|
|
#endif
|
|
return MEMORY_E;
|
|
}
|
|
#endif /* WOLFSSL_SMALL_STACK */
|
|
|
|
XMEMSET(store, 0, sizeof(WOLFSSL_X509_STORE_CTX));
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
XMEMSET(x509, 0, sizeof(WOLFSSL_X509));
|
|
#endif
|
|
domain[0] = '\0';
|
|
|
|
/* build subject CN as string to return in store */
|
|
if (args->dCertInit && args->dCert && args->dCert->subjectCN) {
|
|
int subjectCNLen = args->dCert->subjectCNLen;
|
|
if (subjectCNLen > ASN_NAME_MAX-1)
|
|
subjectCNLen = ASN_NAME_MAX-1;
|
|
if (subjectCNLen > 0) {
|
|
XMEMCPY(domain, args->dCert->subjectCN, subjectCNLen);
|
|
domain[subjectCNLen] = '\0';
|
|
}
|
|
}
|
|
|
|
store->error = ret;
|
|
store->error_depth = args->certIdx;
|
|
store->discardSessionCerts = 0;
|
|
store->domain = domain;
|
|
store->userCtx = (ssl != NULL) ? ssl->verifyCbCtx : cm;
|
|
store->certs = args->certs;
|
|
store->totalCerts = args->totalCerts;
|
|
#if (defined(HAVE_EX_DATA) || defined(FORTRESS)) && \
|
|
(defined(OPENSSL_EXTRA) || defined(WOLFSSL_WPAS_SMALL))
|
|
if (wolfSSL_CRYPTO_set_ex_data(&store->ex_data, 0, ssl)
|
|
!= WOLFSSL_SUCCESS) {
|
|
WOLFSSL_MSG("Failed to store ssl context in WOLFSSL_X509_STORE_CTX");
|
|
}
|
|
#endif
|
|
|
|
if (ssl != NULL) {
|
|
#if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
|
|
if (ssl->ctx->x509_store_pt != NULL) {
|
|
store->store = ssl->ctx->x509_store_pt;
|
|
}
|
|
else {
|
|
store->store = &ssl->ctx->x509_store;
|
|
}
|
|
#if defined(OPENSSL_EXTRA)
|
|
store->depth = args->count;
|
|
store->param = (WOLFSSL_X509_VERIFY_PARAM*)XMALLOC(
|
|
sizeof(WOLFSSL_X509_VERIFY_PARAM),
|
|
heap, DYNAMIC_TYPE_OPENSSL);
|
|
if (store->param == NULL) {
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(domain, heap, DYNAMIC_TYPE_STRING);
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
XFREE(x509, heap, DYNAMIC_TYPE_X509);
|
|
#endif
|
|
XFREE(store, heap, DYNAMIC_TYPE_X509_STORE);
|
|
#endif
|
|
return MEMORY_E;
|
|
}
|
|
XMEMSET(store->param, 0, sizeof(WOLFSSL_X509_VERIFY_PARAM));
|
|
/* Overwrite with non-default param values in SSL */
|
|
if (ssl->param) {
|
|
if (ssl->param->check_time)
|
|
store->param->check_time = ssl->param->check_time;
|
|
|
|
if (ssl->param->flags)
|
|
store->param->flags = ssl->param->flags;
|
|
|
|
if (ssl->param->hostName[0])
|
|
XMEMCPY(store->param->hostName, ssl->param->hostName,
|
|
WOLFSSL_HOST_NAME_MAX);
|
|
|
|
}
|
|
#endif /* defined(OPENSSL_EXTRA) */
|
|
#endif /* defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)*/
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
#ifdef KEEP_PEER_CERT
|
|
if (args->certIdx == 0) {
|
|
store->current_cert = &ssl->peerCert; /* use existing X509 */
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
InitX509(x509, 0, heap);
|
|
if (CopyDecodedToX509(x509, args->dCert) == 0) {
|
|
store->current_cert = x509;
|
|
x509Free = 1;
|
|
}
|
|
else {
|
|
FreeX509(x509);
|
|
}
|
|
}
|
|
#endif
|
|
#ifdef SESSION_CERTS
|
|
store->sesChain = &ssl->session.chain;
|
|
#endif
|
|
}
|
|
#ifndef NO_WOLFSSL_CM_VERIFY
|
|
/* non-zero return code indicates failure override */
|
|
if (cm->verifyCallback != NULL) {
|
|
store->userCtx = cm;
|
|
if (cm->verifyCallback(verify_ok, store)) {
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("Verify CM callback overriding error!");
|
|
ret = 0;
|
|
}
|
|
}
|
|
else {
|
|
verifyFail = 1;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
if (ssl != NULL) {
|
|
#ifdef OPENSSL_ALL
|
|
/* non-zero return code indicates failure override */
|
|
if (ssl->ctx->verifyCertCb) {
|
|
if (ssl->ctx->verifyCertCb(store, ssl->ctx->verifyCertCbArg)) {
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("Verify Cert callback overriding error!");
|
|
ret = 0;
|
|
}
|
|
}
|
|
else {
|
|
verifyFail = 1;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* non-zero return code indicates failure override */
|
|
if (ssl->verifyCallback) {
|
|
if (ssl->verifyCallback(verify_ok, store)) {
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("Verify callback overriding error!");
|
|
ret = 0;
|
|
}
|
|
}
|
|
else {
|
|
verifyFail = 1;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (verifyFail) {
|
|
/* induce error if one not present */
|
|
if (ret == 0) {
|
|
ret = VERIFY_CERT_ERROR;
|
|
}
|
|
|
|
/* mark as verify error */
|
|
args->verifyErr = 1;
|
|
}
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (x509Free) {
|
|
FreeX509(x509);
|
|
}
|
|
#endif
|
|
#if defined(SESSION_CERTS) && defined(OPENSSL_EXTRA)
|
|
wolfSSL_sk_X509_free(store->chain);
|
|
store->chain = NULL;
|
|
#endif
|
|
#ifdef SESSION_CERTS
|
|
if ((ssl != NULL) && (store->discardSessionCerts)) {
|
|
WOLFSSL_MSG("Verify callback requested discard sess certs");
|
|
ssl->session.chain.count = 0;
|
|
#ifdef WOLFSSL_ALT_CERT_CHAINS
|
|
ssl->session.altChain.count = 0;
|
|
#endif
|
|
}
|
|
#endif /* SESSION_CERTS */
|
|
#ifdef OPENSSL_EXTRA
|
|
if ((ssl != NULL) && (store->param)) {
|
|
XFREE(store->param, heap, DYNAMIC_TYPE_OPENSSL);
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(domain, heap, DYNAMIC_TYPE_STRING);
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
XFREE(x509, heap, DYNAMIC_TYPE_X509);
|
|
#endif
|
|
XFREE(store, heap, DYNAMIC_TYPE_X509_STORE);
|
|
#endif
|
|
}
|
|
|
|
(void)heap;
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void FreeProcPeerCertArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
ProcPeerCertArgs* args = (ProcPeerCertArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
|
|
if (args->certs) {
|
|
XFREE(args->certs, ssl->heap, DYNAMIC_TYPE_DER);
|
|
args->certs = NULL;
|
|
}
|
|
#ifdef WOLFSSL_TLS13
|
|
if (args->exts) {
|
|
XFREE(args->exts, ssl->heap, DYNAMIC_TYPE_CERT_EXT);
|
|
args->exts = NULL;
|
|
}
|
|
#endif
|
|
if (args->dCert) {
|
|
if (args->dCertInit) {
|
|
FreeDecodedCert(args->dCert);
|
|
args->dCertInit = 0;
|
|
}
|
|
XFREE(args->dCert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
args->dCert = NULL;
|
|
}
|
|
}
|
|
|
|
static int ProcessPeerCertParse(WOLFSSL* ssl, ProcPeerCertArgs* args,
|
|
int certType, int verify, byte** pSubjectHash, int* pAlreadySigner)
|
|
{
|
|
int ret = 0;
|
|
buffer* cert;
|
|
byte* subjectHash = NULL;
|
|
int alreadySigner = 0;
|
|
#ifdef WOLFSSL_SMALL_CERT_VERIFY
|
|
int sigRet = 0;
|
|
#endif
|
|
|
|
if (ssl == NULL || args == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
/* check to make sure certificate index is valid */
|
|
if (args->certIdx > args->count)
|
|
return BUFFER_E;
|
|
|
|
/* check if returning from non-blocking OCSP */
|
|
/* skip this section because cert is already initialized and parsed */
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
if (args->lastErr == OCSP_WANT_READ) {
|
|
args->lastErr = 0; /* clear error */
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TRUST_PEER_CERT
|
|
/* we have trusted peer */
|
|
if (args->haveTrustPeer) {
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/* get certificate buffer */
|
|
cert = &args->certs[args->certIdx];
|
|
|
|
#ifdef WOLFSSL_SMALL_CERT_VERIFY
|
|
if (verify == VERIFY) {
|
|
/* for small cert verify, release decoded cert during signature check to
|
|
reduce peak memory usage */
|
|
if (args->dCert != NULL) {
|
|
if (args->dCertInit) {
|
|
FreeDecodedCert(args->dCert);
|
|
args->dCertInit = 0;
|
|
}
|
|
XFREE(args->dCert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
args->dCert = NULL;
|
|
}
|
|
|
|
/* perform cert parsing and signature check */
|
|
sigRet = CheckCertSignature(cert->buffer, cert->length,
|
|
ssl->heap, ssl->ctx->cm);
|
|
/* fail on errors here after the ParseCertRelative call, so dCert is populated */
|
|
|
|
/* verify name only in ParseCertRelative below, signature check done */
|
|
verify = VERIFY_NAME;
|
|
}
|
|
#endif /* WOLFSSL_SMALL_CERT_VERIFY */
|
|
|
|
/* make sure the decoded cert structure is allocated and initialized */
|
|
if (!args->dCertInit
|
|
#ifdef WOLFSSL_SMALL_CERT_VERIFY
|
|
|| args->dCert == NULL
|
|
#endif
|
|
) {
|
|
#ifdef WOLFSSL_SMALL_CERT_VERIFY
|
|
if (args->dCert == NULL) {
|
|
args->dCert = (DecodedCert*)XMALLOC(
|
|
sizeof(DecodedCert), ssl->heap,
|
|
DYNAMIC_TYPE_DCERT);
|
|
if (args->dCert == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
InitDecodedCert(args->dCert, cert->buffer, cert->length, ssl->heap);
|
|
|
|
args->dCertInit = 1;
|
|
args->dCert->sigCtx.devId = ssl->devId;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
args->dCert->sigCtx.asyncCtx = ssl;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* setup the PK callback context */
|
|
ret = InitSigPkCb(ssl, &args->dCert->sigCtx);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
}
|
|
|
|
/* Parse Certificate */
|
|
ret = ParseCertRelative(args->dCert, certType, verify, ssl->ctx->cm);
|
|
/* perform below checks for date failure cases */
|
|
if (ret == 0 || ret == ASN_BEFORE_DATE_E || ret == ASN_AFTER_DATE_E) {
|
|
/* get subject and determine if already loaded */
|
|
#ifndef NO_SKID
|
|
if (args->dCert->extAuthKeyIdSet)
|
|
subjectHash = args->dCert->extSubjKeyId;
|
|
else
|
|
#endif
|
|
subjectHash = args->dCert->subjectHash;
|
|
alreadySigner = AlreadySigner(ssl->ctx->cm, subjectHash);
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_CERT_VERIFY
|
|
/* get signature check failures from above */
|
|
if (ret == 0)
|
|
ret = sigRet;
|
|
#endif
|
|
|
|
if (pSubjectHash)
|
|
*pSubjectHash = subjectHash;
|
|
if (pAlreadySigner)
|
|
*pAlreadySigner = alreadySigner;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl,
|
|
args->dCert->sigCtx.asyncDev);
|
|
}
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Check key sizes for certs. Is redundant check since
|
|
ProcessBuffer also performs this check. */
|
|
static int ProcessPeerCertCheckKey(WOLFSSL* ssl, ProcPeerCertArgs* args)
|
|
{
|
|
int ret = 0;
|
|
|
|
if (ssl->options.verifyNone) {
|
|
return ret;
|
|
}
|
|
|
|
switch (args->dCert->keyOID) {
|
|
#ifndef NO_RSA
|
|
case RSAk:
|
|
if (ssl->options.minRsaKeySz < 0 ||
|
|
args->dCert->pubKeySize <
|
|
(word16)ssl->options.minRsaKeySz) {
|
|
WOLFSSL_MSG(
|
|
"RSA key size in cert chain error");
|
|
ret = RSA_KEY_SIZE_E;
|
|
}
|
|
break;
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case ECDSAk:
|
|
if (ssl->options.minEccKeySz < 0 ||
|
|
args->dCert->pubKeySize <
|
|
(word16)ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG(
|
|
"ECC key size in cert chain error");
|
|
ret = ECC_KEY_SIZE_E;
|
|
}
|
|
break;
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case ED25519k:
|
|
if (ssl->options.minEccKeySz < 0 ||
|
|
ED25519_KEY_SIZE < (word16)ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG(
|
|
"ECC key size in cert chain error");
|
|
ret = ECC_KEY_SIZE_E;
|
|
}
|
|
break;
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_ED448
|
|
case ED448k:
|
|
if (ssl->options.minEccKeySz < 0 ||
|
|
ED448_KEY_SIZE < (word16)ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG(
|
|
"ECC key size in cert chain error");
|
|
ret = ECC_KEY_SIZE_E;
|
|
}
|
|
break;
|
|
#endif /* HAVE_ED448 */
|
|
default:
|
|
WOLFSSL_MSG("Key size not checked");
|
|
/* key not being checked for size if not in
|
|
switch */
|
|
break;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 totalSz)
|
|
{
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ProcPeerCertArgs* args = (ProcPeerCertArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#elif defined(WOLFSSL_NONBLOCK_OCSP)
|
|
ProcPeerCertArgs* args = ssl->nonblockarg;
|
|
#elif defined(WOLFSSL_SMALL_STACK)
|
|
ProcPeerCertArgs* args = NULL;
|
|
#else
|
|
ProcPeerCertArgs args[1];
|
|
#endif
|
|
byte* subjectHash = NULL;
|
|
int alreadySigner = 0;
|
|
|
|
WOLFSSL_ENTER("ProcessPeerCerts");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_ppc;
|
|
}
|
|
else
|
|
#elif defined(WOLFSSL_NONBLOCK_OCSP)
|
|
if (args == NULL) {
|
|
args = (ProcPeerCertArgs*)XMALLOC(
|
|
sizeof(ProcPeerCertArgs), ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
if (args == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_ppc);
|
|
}
|
|
}
|
|
if (ssl->nonblockarg == NULL) /* new args */
|
|
#elif defined(WOLFSSL_SMALL_STACK)
|
|
args = (ProcPeerCertArgs*)XMALLOC(
|
|
sizeof(ProcPeerCertArgs), ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
if (args == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_ppc);
|
|
}
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(ProcPeerCertArgs));
|
|
args->idx = *inOutIdx;
|
|
args->begin = *inOutIdx;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeProcPeerCertArgs;
|
|
#elif defined(WOLFSSL_NONBLOCK_OCSP)
|
|
ssl->nonblockarg = args;
|
|
#endif
|
|
}
|
|
|
|
switch (ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
word32 listSz;
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "Certificate");
|
|
if (ssl->toInfoOn)
|
|
AddLateName("Certificate", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3) {
|
|
byte ctxSz;
|
|
|
|
/* Certificate Request Context */
|
|
if ((args->idx - args->begin) + OPAQUE8_LEN > totalSz)
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
ctxSz = *(input + args->idx);
|
|
args->idx++;
|
|
if ((args->idx - args->begin) + ctxSz > totalSz)
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
/* Must be empty when received from server. */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if (ctxSz != 0) {
|
|
ERROR_OUT(INVALID_CERT_CTX_E, exit_ppc);
|
|
}
|
|
}
|
|
#endif
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
/* Must contain value sent in request. */
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
if (ssl->options.handShakeState != HANDSHAKE_DONE &&
|
|
ctxSz != 0) {
|
|
ERROR_OUT(INVALID_CERT_CTX_E, exit_ppc);
|
|
}
|
|
else if (ssl->options.handShakeState == HANDSHAKE_DONE) {
|
|
#ifdef WOLFSSL_POST_HANDSHAKE_AUTH
|
|
CertReqCtx* curr = ssl->certReqCtx;
|
|
CertReqCtx* prev = NULL;
|
|
while (curr != NULL) {
|
|
if ((ctxSz == curr->len) &&
|
|
XMEMCMP(&curr->ctx, input + args->idx, ctxSz)
|
|
== 0) {
|
|
if (prev != NULL)
|
|
prev->next = curr->next;
|
|
else
|
|
ssl->certReqCtx = curr->next;
|
|
XFREE(curr, ssl->heap,
|
|
DYNAMIC_TYPE_TMP_BUFFER);
|
|
break;
|
|
}
|
|
prev = curr;
|
|
curr = curr->next;
|
|
}
|
|
if (curr == NULL)
|
|
#endif
|
|
ERROR_OUT(INVALID_CERT_CTX_E, exit_ppc);
|
|
}
|
|
}
|
|
#endif
|
|
args->idx += ctxSz;
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
/* allocate buffer for cert extensions */
|
|
args->exts = (buffer*)XMALLOC(sizeof(buffer) *
|
|
(ssl->verifyDepth + 1), ssl->heap, DYNAMIC_TYPE_CERT_EXT);
|
|
if (args->exts == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_ppc);
|
|
}
|
|
#else
|
|
/* allocate buffer for cert extensions */
|
|
args->exts = (buffer*)XMALLOC(sizeof(buffer) * MAX_CHAIN_DEPTH,
|
|
ssl->heap, DYNAMIC_TYPE_CERT_EXT);
|
|
if (args->exts == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_ppc);
|
|
}
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
/* allocate buffer for certs */
|
|
args->certs = (buffer*)XMALLOC(sizeof(buffer) * MAX_CHAIN_DEPTH,
|
|
ssl->heap, DYNAMIC_TYPE_DER);
|
|
if (args->certs == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_ppc);
|
|
}
|
|
XMEMSET(args->certs, 0, sizeof(buffer) * MAX_CHAIN_DEPTH);
|
|
|
|
/* Certificate List */
|
|
if ((args->idx - args->begin) + OPAQUE24_LEN > totalSz) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
c24to32(input + args->idx, &listSz);
|
|
args->idx += OPAQUE24_LEN;
|
|
if (listSz > MAX_CERTIFICATE_SZ) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
if ((args->idx - args->begin) + listSz != totalSz) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
|
|
WOLFSSL_MSG("Loading peer's cert chain");
|
|
/* first put cert chain into buffer so can verify top down
|
|
we're sent bottom up */
|
|
while (listSz) {
|
|
word32 certSz;
|
|
|
|
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (args->totalCerts >= MAX_CHAIN_DEPTH) {
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_CHAIN_TOO_LONG;
|
|
ret = MAX_CHAIN_ERROR;
|
|
WOLFSSL_MSG("Too many certs for MAX_CHAIN_DEPTH");
|
|
break; /* break out to avoid reading more certs then buffer
|
|
* can hold */
|
|
}
|
|
#else
|
|
if (args->totalCerts >= ssl->verifyDepth ||
|
|
args->totalCerts >= MAX_CHAIN_DEPTH) {
|
|
ERROR_OUT(MAX_CHAIN_ERROR, exit_ppc);
|
|
}
|
|
#endif
|
|
|
|
if ((args->idx - args->begin) + OPAQUE24_LEN > totalSz) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
|
|
c24to32(input + args->idx, &certSz);
|
|
args->idx += OPAQUE24_LEN;
|
|
|
|
if ((args->idx - args->begin) + certSz > totalSz) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
|
|
args->certs[args->totalCerts].length = certSz;
|
|
args->certs[args->totalCerts].buffer = input + args->idx;
|
|
|
|
#ifdef SESSION_CERTS
|
|
AddSessionCertToChain(&ssl->session.chain,
|
|
input + args->idx, certSz);
|
|
#endif /* SESSION_CERTS */
|
|
|
|
args->idx += certSz;
|
|
listSz -= certSz + CERT_HEADER_SZ;
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
/* Extensions */
|
|
if (ssl->options.tls1_3) {
|
|
word16 extSz;
|
|
|
|
if (args->exts == NULL) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > totalSz) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
ato16(input + args->idx, &extSz);
|
|
args->idx += OPAQUE16_LEN;
|
|
if ((args->idx - args->begin) + extSz > totalSz) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_ppc);
|
|
}
|
|
/* Store extension data info for later processing. */
|
|
args->exts[args->totalCerts].length = extSz;
|
|
args->exts[args->totalCerts].buffer = input + args->idx;
|
|
args->idx += extSz;
|
|
listSz -= extSz + OPAQUE16_LEN;
|
|
ret = TLSX_Parse(ssl, args->exts[args->totalCerts].buffer,
|
|
args->exts[args->totalCerts].length, certificate, NULL);
|
|
if (ret < 0) {
|
|
ERROR_OUT(ret, exit_ppc);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
args->totalCerts++;
|
|
WOLFSSL_MSG("\tPut another cert into chain");
|
|
} /* while (listSz) */
|
|
|
|
args->count = args->totalCerts;
|
|
args->certIdx = 0; /* select peer cert (first one) */
|
|
|
|
if (args->count == 0 && (ssl->options.mutualAuth ||
|
|
(ssl->options.failNoCert && IsAtLeastTLSv1_3(ssl->version))) &&
|
|
ssl->options.side == WOLFSSL_SERVER_END) {
|
|
ret = NO_PEER_CERT;
|
|
DoCertFatalAlert(ssl, ret);
|
|
}
|
|
|
|
args->dCertInit = 0;
|
|
#ifndef WOLFSSL_SMALL_CERT_VERIFY
|
|
args->dCert = (DecodedCert*)XMALLOC(sizeof(DecodedCert), ssl->heap,
|
|
DYNAMIC_TYPE_DCERT);
|
|
if (args->dCert == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_ppc);
|
|
}
|
|
XMEMSET(args->dCert, 0, sizeof(DecodedCert));
|
|
#endif
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* case TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
if (args->count > 0) {
|
|
|
|
/* check for trusted peer and get untrustedDepth */
|
|
#if defined(WOLFSSL_TRUST_PEER_CERT) || defined(OPENSSL_EXTRA)
|
|
if (args->certIdx == 0) {
|
|
#ifdef WOLFSSL_TRUST_PEER_CERT
|
|
TrustedPeerCert* tp;
|
|
int matchType = WC_MATCH_NAME;
|
|
#endif
|
|
|
|
ret = ProcessPeerCertParse(ssl, args, CERT_TYPE, NO_VERIFY,
|
|
&subjectHash, &alreadySigner);
|
|
if (ret != 0)
|
|
goto exit_ppc;
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
/* Determine untrusted depth */
|
|
if (!alreadySigner && (!args->dCert ||
|
|
!args->dCertInit || !args->dCert->selfSigned)) {
|
|
args->untrustedDepth = 1;
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TRUST_PEER_CERT
|
|
#ifndef NO_SKID
|
|
if (args->dCert->extAuthKeyIdSet)
|
|
matchType = WC_MATCH_SKID;
|
|
#endif
|
|
tp = GetTrustedPeer(ssl->ctx->cm, subjectHash, matchType);
|
|
WOLFSSL_MSG("Checking for trusted peer cert");
|
|
|
|
if (tp && MatchTrustedPeer(tp, args->dCert)) {
|
|
WOLFSSL_MSG("Found matching trusted peer cert");
|
|
args->haveTrustPeer = 1;
|
|
}
|
|
else if (tp == NULL) {
|
|
/* no trusted peer cert */
|
|
WOLFSSL_MSG("No matching trusted peer cert. Checking CAs");
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Trusted peer cert did not match!");
|
|
}
|
|
if (!args->haveTrustPeer)
|
|
#endif
|
|
{
|
|
/* free cert if not trusted peer */
|
|
FreeDecodedCert(args->dCert);
|
|
args->dCertInit = 0;
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_TRUST_PEER_CERT || OPENSSL_EXTRA */
|
|
|
|
/* check certificate up to peer's first */
|
|
/* do not verify chain if trusted peer cert found */
|
|
while (args->count > 1
|
|
#ifdef WOLFSSL_TRUST_PEER_CERT
|
|
&& !args->haveTrustPeer
|
|
#endif /* WOLFSSL_TRUST_PEER_CERT */
|
|
) {
|
|
int skipAddCA = 0;
|
|
|
|
/* select last certificate */
|
|
args->certIdx = args->count - 1;
|
|
|
|
ret = ProcessPeerCertParse(ssl, args, CERT_TYPE,
|
|
!ssl->options.verifyNone ? VERIFY : NO_VERIFY,
|
|
&subjectHash, &alreadySigner);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
goto exit_ppc;
|
|
#endif
|
|
if (ret == 0) {
|
|
ret = ProcessPeerCertCheckKey(ssl, args);
|
|
}
|
|
|
|
if (ret == 0 && args->dCert->isCA == 0) {
|
|
WOLFSSL_MSG("Chain cert is not a CA, not adding as one");
|
|
}
|
|
else if (ret == 0 && ssl->options.verifyNone) {
|
|
WOLFSSL_MSG("Chain cert not verified by option, "
|
|
"not adding as CA");
|
|
}
|
|
else if (ret == 0) {
|
|
#ifdef OPENSSL_EXTRA
|
|
if (args->certIdx > args->untrustedDepth) {
|
|
args->untrustedDepth = (char)args->certIdx + 1;
|
|
}
|
|
#endif
|
|
|
|
if (alreadySigner) {
|
|
WOLFSSL_MSG("Verified CA from chain and already had it");
|
|
}
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Failed to verify CA from chain");
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->peerVerifyRet = X509_V_ERR_INVALID_CA;
|
|
#endif
|
|
}
|
|
|
|
#if defined(HAVE_OCSP) || defined(HAVE_CRL)
|
|
if (ret == 0) {
|
|
int doCrlLookup = 1;
|
|
#ifdef HAVE_OCSP
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
if (ssl->status_request_v2) {
|
|
ret = TLSX_CSR2_InitRequests(ssl->extensions,
|
|
args->dCert, 0, ssl->heap);
|
|
}
|
|
else /* skips OCSP and force CRL check */
|
|
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST_V2 */
|
|
if (ssl->ctx->cm->ocspEnabled &&
|
|
ssl->ctx->cm->ocspCheckAll) {
|
|
WOLFSSL_MSG("Doing Non Leaf OCSP check");
|
|
ret = CheckCertOCSP_ex(ssl->ctx->cm->ocsp,
|
|
args->dCert, NULL, ssl);
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
if (ret == OCSP_WANT_READ) {
|
|
args->lastErr = ret;
|
|
goto exit_ppc;
|
|
}
|
|
#endif
|
|
doCrlLookup = (ret == OCSP_CERT_UNKNOWN);
|
|
if (ret != 0) {
|
|
doCrlLookup = 0;
|
|
WOLFSSL_MSG("\tOCSP Lookup not ok");
|
|
}
|
|
}
|
|
#endif /* HAVE_OCSP */
|
|
|
|
#ifdef HAVE_CRL
|
|
if (ret == 0 && doCrlLookup &&
|
|
ssl->ctx->cm->crlEnabled &&
|
|
ssl->ctx->cm->crlCheckAll) {
|
|
WOLFSSL_MSG("Doing Non Leaf CRL check");
|
|
ret = CheckCertCRL(ssl->ctx->cm->crl, args->dCert);
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
if (ret == OCSP_WANT_READ) {
|
|
args->lastErr = ret;
|
|
goto exit_ppc;
|
|
}
|
|
#endif
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("\tCRL check not ok");
|
|
}
|
|
}
|
|
#endif /* HAVE_CRL */
|
|
(void)doCrlLookup;
|
|
}
|
|
#endif /* HAVE_OCSP || HAVE_CRL */
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (ret == 0 &&
|
|
/* extend the limit "+1" until reaching
|
|
* an ultimately trusted issuer.*/
|
|
args->count > (ssl->verifyDepth + 1)) {
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_CHAIN_TOO_LONG;
|
|
ret = MAX_CHAIN_ERROR;
|
|
}
|
|
#endif
|
|
/* Do verify callback */
|
|
ret = DoVerifyCallback(ssl->ctx->cm, ssl, ret, args);
|
|
if (ssl->options.verifyNone &&
|
|
(ret == CRL_MISSING || ret == CRL_CERT_REVOKED)) {
|
|
WOLFSSL_MSG("Ignoring CRL problem based on verify setting");
|
|
ret = ssl->error = 0;
|
|
}
|
|
|
|
#ifdef WOLFSSL_ALT_CERT_CHAINS
|
|
/* For alternate cert chain, its okay for a CA cert to fail
|
|
with ASN_NO_SIGNER_E here. The "alternate" certificate
|
|
chain mode only requires that the peer certificate
|
|
validate to a trusted CA */
|
|
if (ret != 0 && args->dCert->isCA) {
|
|
if (ret == ASN_NO_SIGNER_E) {
|
|
if (!ssl->options.usingAltCertChain) {
|
|
WOLFSSL_MSG("Trying alternate cert chain");
|
|
ssl->options.usingAltCertChain = 1;
|
|
}
|
|
|
|
ret = 0; /* clear errors and continue */
|
|
args->verifyErr = 0;
|
|
}
|
|
|
|
/* do not add to certificate manager */
|
|
skipAddCA = 1;
|
|
}
|
|
#endif /* WOLFSSL_ALT_CERT_CHAINS */
|
|
|
|
/* If valid CA then add to Certificate Manager */
|
|
if (ret == 0 && args->dCert->isCA &&
|
|
!ssl->options.verifyNone && !skipAddCA) {
|
|
buffer* cert = &args->certs[args->certIdx];
|
|
|
|
/* Is valid CA */
|
|
#if defined(SESSION_CERTS) && defined(WOLFSSL_ALT_CERT_CHAINS)
|
|
/* if using alternate chain, store the cert used */
|
|
if (ssl->options.usingAltCertChain) {
|
|
AddSessionCertToChain(&ssl->session.altChain,
|
|
cert->buffer, cert->length);
|
|
}
|
|
#endif /* SESSION_CERTS && WOLFSSL_ALT_CERT_CHAINS */
|
|
if (!alreadySigner) {
|
|
DerBuffer* add = NULL;
|
|
ret = AllocDer(&add, cert->length, CA_TYPE, ssl->heap);
|
|
if (ret < 0)
|
|
goto exit_ppc;
|
|
|
|
XMEMCPY(add->buffer, cert->buffer, cert->length);
|
|
|
|
/* CA already verified above in ParseCertRelative */
|
|
WOLFSSL_MSG("Adding CA from chain");
|
|
ret = AddCA(ssl->ctx->cm, &add, WOLFSSL_CHAIN_CA,
|
|
NO_VERIFY);
|
|
if (ret == WOLFSSL_SUCCESS) {
|
|
ret = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* Handle error codes */
|
|
if (ret != 0) {
|
|
if (!ssl->options.verifyNone) {
|
|
DoCertFatalAlert(ssl, ret);
|
|
}
|
|
ssl->error = ret; /* Report SSL error */
|
|
|
|
if (args->lastErr == 0) {
|
|
args->lastErr = ret; /* save error from last time */
|
|
ret = 0; /* reset error */
|
|
}
|
|
}
|
|
|
|
FreeDecodedCert(args->dCert);
|
|
args->dCertInit = 0;
|
|
args->count--;
|
|
} /* while (count > 0 && !args->haveTrustPeer) */
|
|
} /* if (count > 0) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_ppc;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* case TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
/* peer's, may not have one if blank client cert sent by TLSv1.2 */
|
|
if (args->count > 0) {
|
|
WOLFSSL_MSG("Verifying Peer's cert");
|
|
|
|
/* select peer cert (first one) */
|
|
args->certIdx = 0;
|
|
|
|
ret = ProcessPeerCertParse(ssl, args, CERT_TYPE,
|
|
!ssl->options.verifyNone ? VERIFY : NO_VERIFY,
|
|
&subjectHash, &alreadySigner);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
goto exit_ppc;
|
|
#endif
|
|
if (ret == 0) {
|
|
WOLFSSL_MSG("Verified Peer's cert");
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->peerVerifyRet = X509_V_OK;
|
|
#endif
|
|
#if defined(SESSION_CERTS) && defined(WOLFSSL_ALT_CERT_CHAINS)
|
|
/* if using alternate chain, store the cert used */
|
|
if (ssl->options.usingAltCertChain) {
|
|
buffer* cert = &args->certs[args->certIdx];
|
|
AddSessionCertToChain(&ssl->session.altChain,
|
|
cert->buffer, cert->length);
|
|
}
|
|
#endif /* SESSION_CERTS && WOLFSSL_ALT_CERT_CHAINS */
|
|
|
|
/* Check peer's certificate version number. TLS 1.2 / 1.3
|
|
* requires the clients certificate be version 3 unless a
|
|
* different version has been negotiated using RFC 7250 */
|
|
if ((ret == 0) &&
|
|
(ssl->options.side == WOLFSSL_SERVER_END)) {
|
|
if (args->dCert->version != WOLFSSL_X509_V3) {
|
|
WOLFSSL_MSG("Peers certificate was not version 3!");
|
|
args->lastErr = ASN_VERSION_E;
|
|
/* setting last error but not considering it fatal
|
|
* giving the user a chance to override */
|
|
}
|
|
}
|
|
|
|
/* check if fatal error */
|
|
if (args->verifyErr) {
|
|
args->fatal = 1;
|
|
ret = args->lastErr;
|
|
}
|
|
else {
|
|
args->fatal = 0;
|
|
}
|
|
}
|
|
else if (ret == ASN_PARSE_E || ret == BUFFER_E) {
|
|
WOLFSSL_MSG("Got Peer cert ASN PARSE or BUFFER ERROR");
|
|
#if defined(WOLFSSL_EXTRA_ALERTS) || defined(OPENSSL_EXTRA) || \
|
|
defined(OPENSSL_EXTRA_X509_SMALL)
|
|
DoCertFatalAlert(ssl, ret);
|
|
#endif
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_REJECTED;
|
|
#endif
|
|
args->fatal = 1;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Failed to verify Peer's cert");
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->peerVerifyRet = X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE;
|
|
#endif
|
|
if (ssl->verifyCallback) {
|
|
WOLFSSL_MSG(
|
|
"\tCallback override available, will continue");
|
|
/* check if fatal error */
|
|
args->fatal = (args->verifyErr) ? 1 : 0;
|
|
#if defined(WOLFSSL_EXTRA_ALERTS) || \
|
|
defined(OPENSSL_EXTRA) || \
|
|
defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (args->fatal)
|
|
DoCertFatalAlert(ssl, ret);
|
|
#endif
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("\tNo callback override available, fatal");
|
|
args->fatal = 1;
|
|
#if defined(WOLFSSL_EXTRA_ALERTS) || \
|
|
defined(OPENSSL_EXTRA) || \
|
|
defined(OPENSSL_EXTRA_X509_SMALL)
|
|
DoCertFatalAlert(ssl, ret);
|
|
#endif
|
|
}
|
|
}
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (args->fatal == 0 && !IsAtLeastTLSv1_3(ssl->version)
|
|
&& ssl->secure_renegotiation
|
|
&& ssl->secure_renegotiation->enabled) {
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
/* compare against previous time */
|
|
if (ssl->secure_renegotiation->subject_hash_set) {
|
|
if (XMEMCMP(args->dCert->subjectHash,
|
|
ssl->secure_renegotiation->subject_hash,
|
|
KEYID_SIZE) != 0) {
|
|
WOLFSSL_MSG(
|
|
"Peer sent different cert during scr, fatal");
|
|
args->fatal = 1;
|
|
ret = SCR_DIFFERENT_CERT_E;
|
|
}
|
|
}
|
|
}
|
|
|
|
/* cache peer's hash */
|
|
if (args->fatal == 0) {
|
|
XMEMCPY(ssl->secure_renegotiation->subject_hash,
|
|
args->dCert->subjectHash, KEYID_SIZE);
|
|
ssl->secure_renegotiation->subject_hash_set = 1;
|
|
}
|
|
}
|
|
#endif /* HAVE_SECURE_RENEGOTIATION */
|
|
} /* if (count > 0) */
|
|
|
|
/* Check for error */
|
|
if (args->fatal && ret != 0) {
|
|
goto exit_ppc;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* case TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
if (args->count > 0) {
|
|
#if defined(HAVE_OCSP) || defined(HAVE_CRL)
|
|
if (args->fatal == 0) {
|
|
int doLookup = 1;
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
|
|
if (ssl->status_request) {
|
|
args->fatal = TLSX_CSR_InitRequest(ssl->extensions,
|
|
args->dCert, ssl->heap);
|
|
doLookup = 0;
|
|
#if defined(WOLFSSL_TLS13)
|
|
if (ssl->options.tls1_3) {
|
|
TLSX* ext = TLSX_Find(ssl->extensions,
|
|
TLSX_STATUS_REQUEST);
|
|
if (ext != NULL) {
|
|
word32 idx = 0;
|
|
CertificateStatusRequest* csr =
|
|
(CertificateStatusRequest*)ext->data;
|
|
ret = ProcessCSR(ssl, csr->response.buffer,
|
|
&idx, csr->response.length);
|
|
if (ret < 0)
|
|
goto exit_ppc;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
/* Ensure a stapling response was seen */
|
|
else if (ssl->options.tls1_3 &&
|
|
ssl->ctx->cm->ocspMustStaple) {
|
|
ret = OCSP_CERT_UNKNOWN;
|
|
goto exit_ppc;
|
|
}
|
|
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST */
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
if (ssl->status_request_v2) {
|
|
args->fatal = TLSX_CSR2_InitRequests(ssl->extensions,
|
|
args->dCert, 1, ssl->heap);
|
|
doLookup = 0;
|
|
}
|
|
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST_V2 */
|
|
}
|
|
|
|
#ifdef HAVE_OCSP
|
|
if (doLookup && ssl->ctx->cm->ocspEnabled) {
|
|
WOLFSSL_MSG("Doing Leaf OCSP check");
|
|
ret = CheckCertOCSP_ex(ssl->ctx->cm->ocsp,
|
|
args->dCert, NULL, ssl);
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
if (ret == OCSP_WANT_READ) {
|
|
goto exit_ppc;
|
|
}
|
|
#endif
|
|
doLookup = (ret == OCSP_CERT_UNKNOWN);
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("\tOCSP Lookup not ok");
|
|
args->fatal = 0;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_REJECTED;
|
|
#endif
|
|
}
|
|
}
|
|
#endif /* HAVE_OCSP */
|
|
|
|
#ifdef HAVE_CRL
|
|
if (doLookup && ssl->ctx->cm->crlEnabled) {
|
|
WOLFSSL_MSG("Doing Leaf CRL check");
|
|
ret = CheckCertCRL(ssl->ctx->cm->crl, args->dCert);
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
if (ret == OCSP_WANT_READ) {
|
|
goto exit_ppc;
|
|
}
|
|
#endif
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("\tCRL check not ok");
|
|
args->fatal = 0;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_REJECTED;
|
|
#endif
|
|
}
|
|
}
|
|
#endif /* HAVE_CRL */
|
|
(void)doLookup;
|
|
}
|
|
#endif /* HAVE_OCSP || HAVE_CRL */
|
|
|
|
#ifdef KEEP_PEER_CERT
|
|
if (args->fatal == 0) {
|
|
int copyRet = 0;
|
|
|
|
#ifdef WOLFSSL_POST_HANDSHAKE_AUTH
|
|
if (ssl->options.handShakeDone) {
|
|
FreeX509(&ssl->peerCert);
|
|
InitX509(&ssl->peerCert, 0, ssl->heap);
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->enabled) {
|
|
/* free old peer cert */
|
|
FreeX509(&ssl->peerCert);
|
|
InitX509(&ssl->peerCert, 0, ssl->heap);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
}
|
|
|
|
/* set X509 format for peer cert */
|
|
copyRet = CopyDecodedToX509(&ssl->peerCert, args->dCert);
|
|
if (copyRet == MEMORY_E) {
|
|
args->fatal = 1;
|
|
}
|
|
}
|
|
#endif /* KEEP_PEER_CERT */
|
|
|
|
#ifndef IGNORE_KEY_EXTENSIONS
|
|
#if defined(OPENSSL_EXTRA)
|
|
/* when compatibility layer is turned on and no verify is
|
|
* set then ignore the certificate key extension */
|
|
if (args->dCert->extKeyUsageSet &&
|
|
args->dCert->extKeyUsageCrit == 0 &&
|
|
ssl->options.verifyNone) {
|
|
WOLFSSL_MSG("Not verifying certificate key usage");
|
|
}
|
|
else
|
|
#endif
|
|
if (args->dCert->extKeyUsageSet) {
|
|
if ((ssl->specs.kea == rsa_kea) &&
|
|
(ssl->options.side == WOLFSSL_CLIENT_END) &&
|
|
(args->dCert->extKeyUsage & KEYUSE_KEY_ENCIPHER) == 0) {
|
|
ret = KEYUSE_ENCIPHER_E;
|
|
}
|
|
if ((ssl->specs.sig_algo == rsa_sa_algo ||
|
|
(ssl->specs.sig_algo == ecc_dsa_sa_algo &&
|
|
!ssl->specs.static_ecdh)) &&
|
|
(args->dCert->extKeyUsage & KEYUSE_DIGITAL_SIG) == 0) {
|
|
WOLFSSL_MSG("KeyUse Digital Sig not set");
|
|
ret = KEYUSE_SIGNATURE_E;
|
|
}
|
|
}
|
|
|
|
#if defined(OPENSSL_EXTRA)
|
|
/* when compatibility layer is turned on and no verify is
|
|
* set then ignore the certificate key extension */
|
|
if (args->dCert->extExtKeyUsageSet &&
|
|
args->dCert->extExtKeyUsageCrit == 0 &&
|
|
ssl->options.verifyNone) {
|
|
WOLFSSL_MSG("Not verifying certificate ext key usage");
|
|
}
|
|
else
|
|
#endif
|
|
if (args->dCert->extExtKeyUsageSet) {
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if ((args->dCert->extExtKeyUsage &
|
|
(EXTKEYUSE_ANY | EXTKEYUSE_SERVER_AUTH)) == 0) {
|
|
WOLFSSL_MSG("ExtKeyUse Server Auth not set");
|
|
ret = EXTKEYUSE_AUTH_E;
|
|
}
|
|
}
|
|
else {
|
|
if ((args->dCert->extExtKeyUsage &
|
|
(EXTKEYUSE_ANY | EXTKEYUSE_CLIENT_AUTH)) == 0) {
|
|
WOLFSSL_MSG("ExtKeyUse Client Auth not set");
|
|
ret = EXTKEYUSE_AUTH_E;
|
|
}
|
|
}
|
|
}
|
|
#endif /* IGNORE_KEY_EXTENSIONS */
|
|
|
|
if (args->fatal) {
|
|
ssl->error = ret;
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
SendAlert(ssl, alert_fatal, bad_certificate);
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_REJECTED;
|
|
#endif
|
|
goto exit_ppc;
|
|
}
|
|
|
|
ssl->options.havePeerCert = 1;
|
|
|
|
if (!ssl->options.verifyNone && ssl->buffers.domainName.buffer) {
|
|
#ifndef WOLFSSL_ALLOW_NO_CN_IN_SAN
|
|
/* Per RFC 5280 section 4.2.1.6, "Whenever such identities
|
|
* are to be bound into a certificate, the subject
|
|
* alternative name extension MUST be used." */
|
|
if (args->dCert->altNames) {
|
|
if (CheckForAltNames(args->dCert,
|
|
(char*)ssl->buffers.domainName.buffer,
|
|
NULL) != 1) {
|
|
WOLFSSL_MSG("DomainName match on alt names failed");
|
|
/* try to get peer key still */
|
|
ret = DOMAIN_NAME_MISMATCH;
|
|
}
|
|
}
|
|
else {
|
|
if (MatchDomainName(
|
|
args->dCert->subjectCN,
|
|
args->dCert->subjectCNLen,
|
|
(char*)ssl->buffers.domainName.buffer) == 0) {
|
|
WOLFSSL_MSG("DomainName match on common name failed");
|
|
ret = DOMAIN_NAME_MISMATCH;
|
|
}
|
|
}
|
|
#else /* WOLFSSL_ALL_NO_CN_IN_SAN */
|
|
/* Old behavior. */
|
|
if (MatchDomainName(args->dCert->subjectCN,
|
|
args->dCert->subjectCNLen,
|
|
(char*)ssl->buffers.domainName.buffer) == 0) {
|
|
WOLFSSL_MSG("DomainName match on common name failed");
|
|
if (CheckForAltNames(args->dCert,
|
|
(char*)ssl->buffers.domainName.buffer,
|
|
NULL) != 1) {
|
|
WOLFSSL_MSG(
|
|
"DomainName match on alt names failed too");
|
|
/* try to get peer key still */
|
|
ret = DOMAIN_NAME_MISMATCH;
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_ALL_NO_CN_IN_SAN */
|
|
}
|
|
|
|
/* decode peer key */
|
|
switch (args->dCert->keyOID) {
|
|
#ifndef NO_RSA
|
|
case RSAk:
|
|
{
|
|
word32 keyIdx = 0;
|
|
int keyRet = 0;
|
|
|
|
if (ssl->peerRsaKey == NULL) {
|
|
keyRet = AllocKey(ssl, DYNAMIC_TYPE_RSA,
|
|
(void**)&ssl->peerRsaKey);
|
|
} else if (ssl->peerRsaKeyPresent) {
|
|
keyRet = ReuseKey(ssl, DYNAMIC_TYPE_RSA,
|
|
ssl->peerRsaKey);
|
|
ssl->peerRsaKeyPresent = 0;
|
|
}
|
|
|
|
if (keyRet != 0 || wc_RsaPublicKeyDecode(
|
|
args->dCert->publicKey, &keyIdx, ssl->peerRsaKey,
|
|
args->dCert->pubKeySize) != 0) {
|
|
ret = PEER_KEY_ERROR;
|
|
}
|
|
else {
|
|
ssl->peerRsaKeyPresent = 1;
|
|
#ifdef WOLFSSL_RENESAS_TSIP_TLS
|
|
/* copy encrypted tsip key index into ssl object */
|
|
if (args->dCert->tsip_encRsaKeyIdx) {
|
|
if (!ssl->peerTsipEncRsaKeyIndex) {
|
|
ssl->peerTsipEncRsaKeyIndex = (byte*)XMALLOC(
|
|
TSIP_TLS_ENCPUBKEY_SZ_BY_CERTVRFY,
|
|
ssl->heap, DYNAMIC_TYPE_RSA);
|
|
if (!ssl->peerTsipEncRsaKeyIndex) {
|
|
args->lastErr = MEMORY_E;
|
|
goto exit_ppc;
|
|
}
|
|
}
|
|
|
|
XMEMCPY(ssl->peerTsipEncRsaKeyIndex,
|
|
args->dCert->tsip_encRsaKeyIdx,
|
|
TSIP_TLS_ENCPUBKEY_SZ_BY_CERTVRFY);
|
|
}
|
|
#endif
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
#ifndef NO_RSA
|
|
#if defined(HAVE_SECURE_RENEGOTIATION) || \
|
|
defined(WOLFSSL_POST_HANDSHAKE_AUTH)
|
|
if (ssl->buffers.peerRsaKey.buffer) {
|
|
XFREE(ssl->buffers.peerRsaKey.buffer,
|
|
ssl->heap, DYNAMIC_TYPE_RSA);
|
|
ssl->buffers.peerRsaKey.buffer = NULL;
|
|
}
|
|
#endif
|
|
|
|
|
|
ssl->buffers.peerRsaKey.buffer =
|
|
(byte*)XMALLOC(args->dCert->pubKeySize,
|
|
ssl->heap, DYNAMIC_TYPE_RSA);
|
|
if (ssl->buffers.peerRsaKey.buffer == NULL) {
|
|
ret = MEMORY_ERROR;
|
|
}
|
|
else {
|
|
XMEMCPY(ssl->buffers.peerRsaKey.buffer,
|
|
args->dCert->publicKey,
|
|
args->dCert->pubKeySize);
|
|
ssl->buffers.peerRsaKey.length =
|
|
args->dCert->pubKeySize;
|
|
}
|
|
#endif /* NO_RSA */
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
}
|
|
|
|
/* check size of peer RSA key */
|
|
if (ret == 0 && ssl->peerRsaKeyPresent &&
|
|
!ssl->options.verifyNone &&
|
|
wc_RsaEncryptSize(ssl->peerRsaKey)
|
|
< ssl->options.minRsaKeySz) {
|
|
ret = RSA_KEY_SIZE_E;
|
|
WOLFSSL_MSG("Peer RSA key is too small");
|
|
}
|
|
break;
|
|
}
|
|
#endif /* NO_RSA */
|
|
#ifdef HAVE_NTRU
|
|
case NTRUk:
|
|
{
|
|
if (args->dCert->pubKeySize > sizeof(ssl->peerNtruKey)) {
|
|
ret = PEER_KEY_ERROR;
|
|
}
|
|
else {
|
|
XMEMCPY(ssl->peerNtruKey, args->dCert->publicKey,
|
|
args->dCert->pubKeySize);
|
|
ssl->peerNtruKeyLen =
|
|
(word16)args->dCert->pubKeySize;
|
|
ssl->peerNtruKeyPresent = 1;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#ifdef HAVE_ECC
|
|
case ECDSAk:
|
|
{
|
|
int keyRet = 0;
|
|
word32 idx = 0;
|
|
|
|
if (ssl->peerEccDsaKey == NULL) {
|
|
/* alloc/init on demand */
|
|
keyRet = AllocKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccDsaKey);
|
|
} else if (ssl->peerEccDsaKeyPresent) {
|
|
keyRet = ReuseKey(ssl, DYNAMIC_TYPE_ECC,
|
|
ssl->peerEccDsaKey);
|
|
ssl->peerEccDsaKeyPresent = 0;
|
|
}
|
|
|
|
if (keyRet != 0 ||
|
|
wc_EccPublicKeyDecode(args->dCert->publicKey, &idx,
|
|
ssl->peerEccDsaKey,
|
|
args->dCert->pubKeySize) != 0) {
|
|
ret = PEER_KEY_ERROR;
|
|
}
|
|
else {
|
|
ssl->peerEccDsaKeyPresent = 1;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (ssl->buffers.peerEccDsaKey.buffer)
|
|
XFREE(ssl->buffers.peerEccDsaKey.buffer,
|
|
ssl->heap, DYNAMIC_TYPE_ECC);
|
|
ssl->buffers.peerEccDsaKey.buffer =
|
|
(byte*)XMALLOC(args->dCert->pubKeySize,
|
|
ssl->heap, DYNAMIC_TYPE_ECC);
|
|
if (ssl->buffers.peerEccDsaKey.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_ERROR, exit_ppc);
|
|
}
|
|
else {
|
|
XMEMCPY(ssl->buffers.peerEccDsaKey.buffer,
|
|
args->dCert->publicKey,
|
|
args->dCert->pubKeySize);
|
|
ssl->buffers.peerEccDsaKey.length =
|
|
args->dCert->pubKeySize;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
}
|
|
|
|
/* check size of peer ECC key */
|
|
if (ret == 0 && ssl->peerEccDsaKeyPresent &&
|
|
!ssl->options.verifyNone &&
|
|
wc_ecc_size(ssl->peerEccDsaKey)
|
|
< ssl->options.minEccKeySz) {
|
|
ret = ECC_KEY_SIZE_E;
|
|
WOLFSSL_MSG("Peer ECC key is too small");
|
|
}
|
|
|
|
/* populate curve oid - if missing */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->ecdhCurveOID == 0)
|
|
ssl->ecdhCurveOID = args->dCert->pkCurveOID;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case ED25519k:
|
|
{
|
|
int keyRet = 0;
|
|
if (ssl->peerEd25519Key == NULL) {
|
|
/* alloc/init on demand */
|
|
keyRet = AllocKey(ssl, DYNAMIC_TYPE_ED25519,
|
|
(void**)&ssl->peerEd25519Key);
|
|
} else if (ssl->peerEd25519KeyPresent) {
|
|
keyRet = ReuseKey(ssl, DYNAMIC_TYPE_ED25519,
|
|
ssl->peerEd25519Key);
|
|
ssl->peerEd25519KeyPresent = 0;
|
|
}
|
|
|
|
if (keyRet != 0 ||
|
|
wc_ed25519_import_public(args->dCert->publicKey,
|
|
args->dCert->pubKeySize,
|
|
ssl->peerEd25519Key)
|
|
!= 0) {
|
|
ret = PEER_KEY_ERROR;
|
|
}
|
|
else {
|
|
ssl->peerEd25519KeyPresent = 1;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.peerEd25519Key.buffer =
|
|
(byte*)XMALLOC(args->dCert->pubKeySize,
|
|
ssl->heap, DYNAMIC_TYPE_ED25519);
|
|
if (ssl->buffers.peerEd25519Key.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_ERROR, exit_ppc);
|
|
}
|
|
else {
|
|
XMEMCPY(ssl->buffers.peerEd25519Key.buffer,
|
|
args->dCert->publicKey,
|
|
args->dCert->pubKeySize);
|
|
ssl->buffers.peerEd25519Key.length =
|
|
args->dCert->pubKeySize;
|
|
}
|
|
#endif /*HAVE_PK_CALLBACKS */
|
|
}
|
|
|
|
/* check size of peer ECC key */
|
|
if (ret == 0 && ssl->peerEd25519KeyPresent &&
|
|
!ssl->options.verifyNone &&
|
|
ED25519_KEY_SIZE < ssl->options.minEccKeySz) {
|
|
ret = ECC_KEY_SIZE_E;
|
|
WOLFSSL_MSG("Peer ECC key is too small");
|
|
}
|
|
|
|
/* populate curve oid - if missing */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->ecdhCurveOID == 0)
|
|
ssl->ecdhCurveOID = ECC_X25519_OID;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_ED448
|
|
case ED448k:
|
|
{
|
|
int keyRet = 0;
|
|
if (ssl->peerEd448Key == NULL) {
|
|
/* alloc/init on demand */
|
|
keyRet = AllocKey(ssl, DYNAMIC_TYPE_ED448,
|
|
(void**)&ssl->peerEd448Key);
|
|
} else if (ssl->peerEd448KeyPresent) {
|
|
keyRet = ReuseKey(ssl, DYNAMIC_TYPE_ED448,
|
|
ssl->peerEd448Key);
|
|
ssl->peerEd448KeyPresent = 0;
|
|
}
|
|
|
|
if (keyRet != 0 ||
|
|
wc_ed448_import_public(args->dCert->publicKey,
|
|
args->dCert->pubKeySize,
|
|
ssl->peerEd448Key) != 0) {
|
|
ret = PEER_KEY_ERROR;
|
|
}
|
|
else {
|
|
ssl->peerEd448KeyPresent = 1;
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.peerEd448Key.buffer =
|
|
(byte*)XMALLOC(args->dCert->pubKeySize,
|
|
ssl->heap, DYNAMIC_TYPE_ED448);
|
|
if (ssl->buffers.peerEd448Key.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_ERROR, exit_ppc);
|
|
}
|
|
else {
|
|
XMEMCPY(ssl->buffers.peerEd448Key.buffer,
|
|
args->dCert->publicKey,
|
|
args->dCert->pubKeySize);
|
|
ssl->buffers.peerEd448Key.length =
|
|
args->dCert->pubKeySize;
|
|
}
|
|
#endif /*HAVE_PK_CALLBACKS */
|
|
}
|
|
|
|
/* check size of peer ECC key */
|
|
if (ret == 0 && ssl->peerEd448KeyPresent &&
|
|
!ssl->options.verifyNone &&
|
|
ED448_KEY_SIZE < ssl->options.minEccKeySz) {
|
|
ret = ECC_KEY_SIZE_E;
|
|
WOLFSSL_MSG("Peer ECC key is too small");
|
|
}
|
|
|
|
/* populate curve oid - if missing */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->ecdhCurveOID == 0)
|
|
ssl->ecdhCurveOID = ECC_X448_OID;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED448 */
|
|
default:
|
|
break;
|
|
}
|
|
|
|
/* args->dCert free'd in function cleanup after callback */
|
|
} /* if (count > 0) */
|
|
|
|
/* Check for error */
|
|
if (args->fatal && ret != 0) {
|
|
goto exit_ppc;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* case TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
/* load last error */
|
|
if (args->lastErr != 0 && ret == 0) {
|
|
ret = args->lastErr;
|
|
}
|
|
|
|
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
|
|
if (args->untrustedDepth > ssl->options.verifyDepth) {
|
|
ssl->peerVerifyRet = X509_V_ERR_CERT_CHAIN_TOO_LONG;
|
|
ret = MAX_CHAIN_ERROR;
|
|
}
|
|
#endif
|
|
|
|
/* Do verify callback */
|
|
ret = DoVerifyCallback(ssl->ctx->cm, ssl, ret, args);
|
|
|
|
if (ssl->options.verifyNone &&
|
|
(ret == CRL_MISSING || ret == CRL_CERT_REVOKED)) {
|
|
WOLFSSL_MSG("Ignoring CRL problem based on verify setting");
|
|
ret = ssl->error = 0;
|
|
}
|
|
|
|
if (ret != 0) {
|
|
if (!ssl->options.verifyNone) {
|
|
DoCertFatalAlert(ssl, ret);
|
|
}
|
|
ssl->error = ret; /* Report SSL error */
|
|
}
|
|
|
|
if (ret == 0 && ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
ssl->options.serverState = SERVER_CERT_COMPLETE;
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
args->idx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
args->idx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* case TLS_ASYNC_FINALIZE */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
/* Set final index */
|
|
*inOutIdx = args->idx;
|
|
|
|
break;
|
|
}
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
break;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_ppc:
|
|
|
|
WOLFSSL_LEAVE("ProcessPeerCerts", ret);
|
|
|
|
|
|
#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLFSSL_NONBLOCK_OCSP)
|
|
if (ret == WC_PENDING_E || ret == OCSP_WANT_READ) {
|
|
/* Mark message as not received so it can process again */
|
|
ssl->msgsReceived.got_certificate = 0;
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT || WOLFSSL_NONBLOCK_OCSP */
|
|
|
|
#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLFSSL_NONBLOCK_OCSP) || \
|
|
defined(WOLFSSL_SMALL_STACK)
|
|
if (args)
|
|
{
|
|
FreeProcPeerCertArgs(ssl, args);
|
|
}
|
|
#else
|
|
FreeProcPeerCertArgs(ssl, args);
|
|
#endif /* WOLFSSL_ASYNC_CRYPT || WOLFSSL_NONBLOCK_OCSP || WOLFSSL_SMALL_STACK */
|
|
|
|
#if defined(WOLFSSL_ASYNC_CRYPT)
|
|
#elif defined(WOLFSSL_NONBLOCK_OCSP)
|
|
XFREE(args, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
ssl->nonblockarg = NULL;
|
|
#elif defined(WOLFSSL_SMALL_STACK)
|
|
XFREE(args, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
#endif
|
|
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
#if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
|
|
/* handle processing of certificate (11) */
|
|
static int DoCertificate(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 size)
|
|
{
|
|
int ret;
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_DO);
|
|
WOLFSSL_ENTER("DoCertificate");
|
|
|
|
#ifdef SESSION_CERTS
|
|
/* Reset the session cert chain count in case the session resume failed. */
|
|
ssl->session.chain.count = 0;
|
|
#ifdef WOLFSSL_ALT_CERT_CHAINS
|
|
ssl->session.altChain.count = 0;
|
|
#endif
|
|
#endif /* SESSION_CERTS */
|
|
|
|
ret = ProcessPeerCerts(ssl, input, inOutIdx, size);
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_ERROR || ret == ASN_PARSE_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
#endif
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->options.serverState = SERVER_CERT_COMPLETE;
|
|
#endif
|
|
|
|
WOLFSSL_LEAVE("DoCertificate", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_DO);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* handle processing of certificate_status (22) */
|
|
static int DoCertificateStatus(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 size)
|
|
{
|
|
int ret = 0;
|
|
byte status_type;
|
|
word32 status_length;
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_STATUS_DO);
|
|
WOLFSSL_ENTER("DoCertificateStatus");
|
|
|
|
if (size < ENUM_LEN + OPAQUE24_LEN)
|
|
return BUFFER_ERROR;
|
|
|
|
status_type = input[(*inOutIdx)++];
|
|
|
|
c24to32(input + *inOutIdx, &status_length);
|
|
*inOutIdx += OPAQUE24_LEN;
|
|
|
|
if (size != ENUM_LEN + OPAQUE24_LEN + status_length)
|
|
return BUFFER_ERROR;
|
|
|
|
switch (status_type) {
|
|
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
|
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
|
|
/* WOLFSSL_CSR_OCSP overlaps with WOLFSSL_CSR2_OCSP */
|
|
case WOLFSSL_CSR2_OCSP:
|
|
ret = ProcessCSR(ssl, input, inOutIdx, status_length);
|
|
break;
|
|
|
|
#endif
|
|
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
|
|
case WOLFSSL_CSR2_OCSP_MULTI: {
|
|
OcspRequest* request;
|
|
word32 list_length = status_length;
|
|
byte idx = 0;
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
CertStatus* status;
|
|
OcspEntry* single;
|
|
OcspResponse* response;
|
|
#else
|
|
CertStatus status[1];
|
|
OcspEntry single[1];
|
|
OcspResponse response[1];
|
|
#endif
|
|
|
|
do {
|
|
if (ssl->status_request_v2) {
|
|
ssl->status_request_v2 = 0;
|
|
break;
|
|
}
|
|
|
|
return BUFFER_ERROR;
|
|
} while(0);
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
status = (CertStatus*)XMALLOC(sizeof(CertStatus), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_STATUS);
|
|
single = (OcspEntry*)XMALLOC(sizeof(OcspEntry), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_ENTRY);
|
|
response = (OcspResponse*)XMALLOC(sizeof(OcspResponse), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_REQUEST);
|
|
|
|
if (status == NULL || single == NULL || response == NULL) {
|
|
if (status)
|
|
XFREE(status, ssl->heap, DYNAMIC_TYPE_OCSP_STATUS);
|
|
if (single)
|
|
XFREE(single, ssl->heap, DYNAMIC_TYPE_OCSP_ENTRY);
|
|
if (response)
|
|
XFREE(response, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
|
|
return MEMORY_ERROR;
|
|
}
|
|
#endif
|
|
|
|
while (list_length && ret == 0) {
|
|
if (OPAQUE24_LEN > list_length) {
|
|
ret = BUFFER_ERROR;
|
|
break;
|
|
}
|
|
|
|
c24to32(input + *inOutIdx, &status_length);
|
|
*inOutIdx += OPAQUE24_LEN;
|
|
list_length -= OPAQUE24_LEN;
|
|
|
|
if (status_length > list_length) {
|
|
ret = BUFFER_ERROR;
|
|
break;
|
|
}
|
|
|
|
if (status_length) {
|
|
InitOcspResponse(response, single, status, input +*inOutIdx,
|
|
status_length, ssl->heap);
|
|
|
|
if ((OcspResponseDecode(response, ssl->ctx->cm, ssl->heap,
|
|
0) != 0)
|
|
|| (response->responseStatus != OCSP_SUCCESSFUL)
|
|
|| (response->single->status->status != CERT_GOOD))
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
|
|
while (ret == 0) {
|
|
request = (OcspRequest*)TLSX_CSR2_GetRequest(
|
|
ssl->extensions, status_type, idx++);
|
|
|
|
if (request == NULL)
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
else if (CompareOcspReqResp(request, response) == 0)
|
|
break;
|
|
else if (idx == 1) /* server cert must be OK */
|
|
ret = BAD_CERTIFICATE_STATUS_ERROR;
|
|
}
|
|
FreeOcspResponse(response);
|
|
|
|
*inOutIdx += status_length;
|
|
list_length -= status_length;
|
|
}
|
|
}
|
|
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
ssl->status_request_v2 = 0;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(status, NULL, DYNAMIC_TYPE_OCSP_STATUS);
|
|
XFREE(single, NULL, DYNAMIC_TYPE_OCSP_ENTRY);
|
|
XFREE(response, NULL, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
#endif
|
|
|
|
}
|
|
break;
|
|
|
|
#endif
|
|
|
|
default:
|
|
ret = BUFFER_ERROR;
|
|
}
|
|
|
|
if (ret != 0)
|
|
SendAlert(ssl, alert_fatal, bad_certificate_status_response);
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (*inOutIdx + ssl->keys.padSz + digestSz > size)
|
|
return BUFFER_E;
|
|
*inOutIdx += ssl->keys.padSz + digestSz;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (*inOutIdx + ssl->keys.padSz > size)
|
|
return BUFFER_E;
|
|
*inOutIdx += ssl->keys.padSz;
|
|
}
|
|
}
|
|
|
|
WOLFSSL_LEAVE("DoCertificateStatus", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_STATUS_DO);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#endif /* !NO_CERTS */
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
static int DoHelloRequest(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
word32 size, word32 totalSz)
|
|
{
|
|
(void)input;
|
|
|
|
WOLFSSL_START(WC_FUNC_HELLO_REQUEST_DO);
|
|
WOLFSSL_ENTER("DoHelloRequest");
|
|
|
|
if (size) /* must be 0 */
|
|
return BUFFER_ERROR;
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
/* If size == totalSz then we are in DtlsMsgDrain so no need to worry
|
|
* about padding */
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (size != totalSz &&
|
|
*inOutIdx + ssl->keys.padSz + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += ssl->keys.padSz + digestSz;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* access beyond input + size should be checked against totalSz */
|
|
if (size != totalSz &&
|
|
*inOutIdx + ssl->keys.padSz > totalSz)
|
|
return BUFFER_E;
|
|
|
|
*inOutIdx += ssl->keys.padSz;
|
|
}
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
SendAlert(ssl, alert_fatal, unexpected_message); /* try */
|
|
return FATAL_ERROR;
|
|
}
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
else if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) {
|
|
ssl->secure_renegotiation->startScr = 1;
|
|
WOLFSSL_LEAVE("DoHelloRequest", 0);
|
|
WOLFSSL_END(WC_FUNC_HELLO_REQUEST_DO);
|
|
return 0;
|
|
}
|
|
#endif
|
|
else {
|
|
return SendAlert(ssl, alert_warning, no_renegotiation);
|
|
}
|
|
}
|
|
|
|
|
|
int DoFinished(WOLFSSL* ssl, const byte* input, word32* inOutIdx, word32 size,
|
|
word32 totalSz, int sniff)
|
|
{
|
|
word32 finishedSz = (ssl->options.tls ? TLS_FINISHED_SZ : FINISHED_SZ);
|
|
|
|
WOLFSSL_START(WC_FUNC_FINISHED_DO);
|
|
WOLFSSL_ENTER("DoFinished");
|
|
|
|
if (finishedSz != size)
|
|
return BUFFER_ERROR;
|
|
|
|
/* check against totalSz
|
|
* If size == totalSz then we are in DtlsMsgDrain so no need to worry about
|
|
* padding */
|
|
if (size != totalSz) {
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
if (*inOutIdx + size + ssl->keys.padSz + MacSize(ssl) > totalSz)
|
|
return BUFFER_E;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (*inOutIdx + size + ssl->keys.padSz > totalSz)
|
|
return BUFFER_E;
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "Finished");
|
|
if (ssl->toInfoOn) AddLateName("Finished", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
if (sniff == NO_SNIFF) {
|
|
if (XMEMCMP(input + *inOutIdx, &ssl->hsHashes->verifyHashes,size) != 0){
|
|
WOLFSSL_MSG("Verify finished error on hashes");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, decrypt_error);
|
|
#endif
|
|
return VERIFY_FINISHED_ERROR;
|
|
}
|
|
}
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation) {
|
|
/* save peer's state */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END)
|
|
XMEMCPY(ssl->secure_renegotiation->server_verify_data,
|
|
input + *inOutIdx, TLS_FINISHED_SZ);
|
|
else
|
|
XMEMCPY(ssl->secure_renegotiation->client_verify_data,
|
|
input + *inOutIdx, TLS_FINISHED_SZ);
|
|
ssl->secure_renegotiation->verifySet = 1;
|
|
}
|
|
#endif
|
|
#ifdef OPENSSL_ALL
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END)
|
|
XMEMCPY(ssl->serverFinished,
|
|
input + *inOutIdx, TLS_FINISHED_SZ);
|
|
else
|
|
XMEMCPY(ssl->clientFinished,
|
|
input + *inOutIdx, TLS_FINISHED_SZ);
|
|
#endif
|
|
|
|
/* force input exhaustion at ProcessReply consuming padSz */
|
|
*inOutIdx += size + ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
*inOutIdx += MacSize(ssl);
|
|
#endif
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
ssl->options.serverState = SERVER_FINISHED_COMPLETE;
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
ssl->options.clientState = CLIENT_FINISHED_COMPLETE;
|
|
#endif
|
|
if (!ssl->options.resuming) {
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->CBIS != NULL) {
|
|
ssl->CBIS(ssl, SSL_CB_CONNECT_LOOP, SSL_SUCCESS);
|
|
}
|
|
#endif
|
|
ssl->options.handShakeState = HANDSHAKE_DONE;
|
|
ssl->options.handShakeDone = 1;
|
|
}
|
|
}
|
|
else {
|
|
ssl->options.clientState = CLIENT_FINISHED_COMPLETE;
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->cbmode = SSL_CB_MODE_READ;
|
|
ssl->options.serverState = SERVER_FINISHED_COMPLETE;
|
|
#endif
|
|
if (ssl->options.resuming) {
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->CBIS != NULL) {
|
|
ssl->CBIS(ssl, SSL_CB_ACCEPT_LOOP, SSL_SUCCESS);
|
|
}
|
|
#endif
|
|
ssl->options.handShakeState = HANDSHAKE_DONE;
|
|
ssl->options.handShakeDone = 1;
|
|
}
|
|
}
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
if ((!ssl->options.resuming && ssl->options.side == WOLFSSL_CLIENT_END) ||
|
|
(ssl->options.resuming && ssl->options.side == WOLFSSL_SERVER_END)){
|
|
DtlsMsgPoolReset(ssl);
|
|
ssl->keys.dtls_handshake_number = 0;
|
|
ssl->keys.dtls_expected_peer_handshake_number = 0;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
WOLFSSL_LEAVE("DoFinished", 0);
|
|
WOLFSSL_END(WC_FUNC_FINISHED_DO);
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* Make sure no duplicates, no fast forward, or other problems; 0 on success */
|
|
static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
|
|
{
|
|
/* verify not a duplicate, mark received, check state */
|
|
switch (type) {
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case hello_request:
|
|
if (ssl->msgsReceived.got_hello_request) {
|
|
WOLFSSL_MSG("Duplicate HelloRequest received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_hello_request = 1;
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
case client_hello:
|
|
if (ssl->msgsReceived.got_client_hello) {
|
|
WOLFSSL_MSG("Duplicate ClientHello received");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
#endif
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_client_hello = 1;
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case server_hello:
|
|
if (ssl->msgsReceived.got_server_hello) {
|
|
WOLFSSL_MSG("Duplicate ServerHello received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_server_hello = 1;
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case hello_verify_request:
|
|
if (ssl->msgsReceived.got_hello_verify_request) {
|
|
WOLFSSL_MSG("Duplicate HelloVerifyRequest received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_hello_verify_request = 1;
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case session_ticket:
|
|
if (ssl->msgsReceived.got_session_ticket) {
|
|
WOLFSSL_MSG("Duplicate SessionTicket received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_session_ticket = 1;
|
|
|
|
break;
|
|
#endif
|
|
|
|
case certificate:
|
|
if (ssl->msgsReceived.got_certificate) {
|
|
WOLFSSL_MSG("Duplicate Certificate received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_certificate = 1;
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if ( ssl->msgsReceived.got_server_hello == 0) {
|
|
WOLFSSL_MSG("No ServerHello before Cert");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
#endif
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
if ( ssl->msgsReceived.got_client_hello == 0) {
|
|
WOLFSSL_MSG("No ClientHello before Cert");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
#endif
|
|
break;
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case certificate_status:
|
|
if (ssl->msgsReceived.got_certificate_status) {
|
|
WOLFSSL_MSG("Duplicate CertificateSatatus received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_certificate_status = 1;
|
|
|
|
if (ssl->msgsReceived.got_certificate == 0) {
|
|
WOLFSSL_MSG("No Certificate before CertificateStatus");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
if (ssl->msgsReceived.got_server_key_exchange != 0) {
|
|
WOLFSSL_MSG("CertificateStatus after ServerKeyExchange");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case server_key_exchange:
|
|
if (ssl->msgsReceived.got_server_key_exchange) {
|
|
WOLFSSL_MSG("Duplicate ServerKeyExchange received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_server_key_exchange = 1;
|
|
|
|
if (ssl->msgsReceived.got_server_hello == 0) {
|
|
WOLFSSL_MSG("No ServerHello before ServerKeyExchange");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
if (ssl->msgsReceived.got_certificate_status == 0) {
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
|
|
if (ssl->status_request) {
|
|
int ret;
|
|
|
|
WOLFSSL_MSG("No CertificateStatus before ServerKeyExchange");
|
|
if ((ret = TLSX_CSR_ForceRequest(ssl)) != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
if (ssl->status_request_v2) {
|
|
int ret;
|
|
|
|
WOLFSSL_MSG("No CertificateStatus before ServerKeyExchange");
|
|
if ((ret = TLSX_CSR2_ForceRequest(ssl)) != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
|
|
defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
/* Check that a status request extension was seen as the
|
|
* CertificateStatus wasn't when an OCSP staple is required.
|
|
*/
|
|
if (
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
|
|
!ssl->status_request &&
|
|
#endif
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
!ssl->status_request_v2 &&
|
|
#endif
|
|
ssl->ctx->cm->ocspMustStaple) {
|
|
return OCSP_CERT_UNKNOWN;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case certificate_request:
|
|
if (ssl->msgsReceived.got_certificate_request) {
|
|
WOLFSSL_MSG("Duplicate CertificateRequest received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_certificate_request = 1;
|
|
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case server_hello_done:
|
|
if (ssl->msgsReceived.got_server_hello_done) {
|
|
WOLFSSL_MSG("Duplicate ServerHelloDone received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_server_hello_done = 1;
|
|
|
|
if (ssl->msgsReceived.got_certificate == 0) {
|
|
if (ssl->specs.kea == psk_kea ||
|
|
ssl->specs.kea == dhe_psk_kea ||
|
|
ssl->specs.kea == ecdhe_psk_kea ||
|
|
ssl->options.usingAnon_cipher) {
|
|
WOLFSSL_MSG("No Cert required");
|
|
} else {
|
|
WOLFSSL_MSG("No Certificate before ServerHelloDone");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
if (ssl->msgsReceived.got_server_key_exchange == 0) {
|
|
int pskNoServerHint = 0; /* not required in this case */
|
|
|
|
#ifndef NO_PSK
|
|
if (ssl->specs.kea == psk_kea &&
|
|
ssl->arrays != NULL &&
|
|
ssl->arrays->server_hint[0] == 0)
|
|
pskNoServerHint = 1;
|
|
#endif
|
|
if (ssl->specs.static_ecdh == 1 ||
|
|
ssl->specs.kea == rsa_kea ||
|
|
ssl->specs.kea == ntru_kea ||
|
|
pskNoServerHint) {
|
|
WOLFSSL_MSG("No KeyExchange required");
|
|
} else {
|
|
WOLFSSL_MSG("No ServerKeyExchange before ServerDone");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
case certificate_verify:
|
|
if (ssl->msgsReceived.got_certificate_verify) {
|
|
WOLFSSL_MSG("Duplicate CertificateVerify received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_certificate_verify = 1;
|
|
|
|
if ( ssl->msgsReceived.got_certificate == 0) {
|
|
WOLFSSL_MSG("No Cert before CertVerify");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
break;
|
|
#endif
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
case client_key_exchange:
|
|
if (ssl->msgsReceived.got_client_key_exchange) {
|
|
WOLFSSL_MSG("Duplicate ClientKeyExchange received");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
#endif
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
ssl->msgsReceived.got_client_key_exchange = 1;
|
|
|
|
if (ssl->msgsReceived.got_client_hello == 0) {
|
|
WOLFSSL_MSG("No ClientHello before ClientKeyExchange");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
break;
|
|
#endif
|
|
|
|
case finished:
|
|
if (ssl->msgsReceived.got_finished) {
|
|
WOLFSSL_MSG("Duplicate Finished received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
if (ssl->keys.curEpoch == 0) {
|
|
WOLFSSL_MSG("Finished received with epoch 0");
|
|
return SEQUENCE_ERROR;
|
|
}
|
|
}
|
|
#endif
|
|
ssl->msgsReceived.got_finished = 1;
|
|
|
|
if (ssl->msgsReceived.got_change_cipher == 0) {
|
|
WOLFSSL_MSG("Finished received before ChangeCipher");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
#endif
|
|
return NO_CHANGE_CIPHER_E;
|
|
}
|
|
break;
|
|
|
|
case change_cipher_hs:
|
|
if (ssl->msgsReceived.got_change_cipher) {
|
|
WOLFSSL_MSG("Duplicate ChangeCipher received");
|
|
return DUPLICATE_MSG_E;
|
|
}
|
|
/* DTLS is going to ignore the CCS message if the client key
|
|
* exchange message wasn't received yet. */
|
|
if (!ssl->options.dtls)
|
|
ssl->msgsReceived.got_change_cipher = 1;
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
if (!ssl->options.resuming) {
|
|
if (ssl->msgsReceived.got_server_hello_done == 0) {
|
|
WOLFSSL_MSG("No ServerHelloDone before ChangeCipher");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
else {
|
|
if (ssl->msgsReceived.got_server_hello == 0) {
|
|
WOLFSSL_MSG("No ServerHello before ChangeCipher on Resume");
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->expect_session_ticket) {
|
|
WOLFSSL_MSG("Expected session ticket missing");
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
return OUT_OF_ORDER_E;
|
|
#endif
|
|
return SESSION_TICKET_EXPECT_E;
|
|
}
|
|
#endif
|
|
}
|
|
#endif
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
if (!ssl->options.resuming &&
|
|
ssl->msgsReceived.got_client_key_exchange == 0) {
|
|
WOLFSSL_MSG("No ClientKeyExchange before ChangeCipher");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
#endif
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
#ifndef NO_CERTS
|
|
if (ssl->options.verifyPeer &&
|
|
ssl->options.havePeerCert) {
|
|
|
|
if (!ssl->options.havePeerVerify ||
|
|
!ssl->msgsReceived.got_certificate_verify) {
|
|
WOLFSSL_MSG("client didn't send cert verify");
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
return OUT_OF_ORDER_E;
|
|
#endif
|
|
return NO_PEER_VERIFY;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
#endif
|
|
if (ssl->options.dtls)
|
|
ssl->msgsReceived.got_change_cipher = 1;
|
|
break;
|
|
|
|
default:
|
|
WOLFSSL_MSG("Unknown message type");
|
|
return SANITY_MSG_E;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
static int DoHandShakeMsgType(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
byte type, word32 size, word32 totalSz)
|
|
{
|
|
int ret = 0;
|
|
word32 expectedIdx;
|
|
|
|
WOLFSSL_ENTER("DoHandShakeMsgType");
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (type == hello_retry_request) {
|
|
return DoTls13HandShakeMsgType(ssl, input, inOutIdx, type, size,
|
|
totalSz);
|
|
}
|
|
#endif
|
|
|
|
/* make sure can read the message */
|
|
if (*inOutIdx + size > totalSz) {
|
|
WOLFSSL_MSG("Incomplete Data");
|
|
return INCOMPLETE_DATA;
|
|
}
|
|
|
|
expectedIdx = *inOutIdx + size +
|
|
(ssl->keys.encryptionOn ? ssl->keys.padSz : 0);
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead && ssl->keys.encryptionOn)
|
|
expectedIdx += MacSize(ssl);
|
|
#endif
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) && \
|
|
defined(HAVE_SECURE_RENEGOTIATION) && \
|
|
defined(HAVE_SERVER_RENEGOTIATION_INFO)
|
|
if (ssl->options.handShakeDone && type == client_hello &&
|
|
ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->enabled)
|
|
{
|
|
WOLFSSL_MSG("Reset handshake state");
|
|
XMEMSET(&ssl->msgsReceived, 0, sizeof(MsgsReceived));
|
|
ssl->options.serverState = NULL_STATE;
|
|
ssl->options.clientState = NULL_STATE;
|
|
ssl->options.connectState = CONNECT_BEGIN;
|
|
ssl->options.acceptState = ACCEPT_FIRST_REPLY_DONE;
|
|
ssl->options.handShakeState = NULL_STATE;
|
|
ssl->secure_renegotiation->cache_status = SCR_CACHE_NEEDED;
|
|
|
|
ret = InitHandshakeHashes(ssl);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
/* sanity check msg received */
|
|
if ( (ret = SanityCheckMsgReceived(ssl, type)) != 0) {
|
|
WOLFSSL_MSG("Sanity Check on handshake message type received failed");
|
|
return ret;
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
/* add name later, add on record and handshake header part back on */
|
|
if (ssl->toInfoOn) {
|
|
int add = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
AddPacketInfo(ssl, 0, handshake, input + *inOutIdx - add,
|
|
size + add, READ_PROTO, ssl->heap);
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
AddLateRecordHeader(&ssl->curRL, &ssl->timeoutInfo);
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
if (ssl->options.handShakeState == HANDSHAKE_DONE && type != hello_request){
|
|
WOLFSSL_MSG("HandShake message after handshake complete");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->options.dtls == 0 &&
|
|
ssl->options.serverState == NULL_STATE && type != server_hello) {
|
|
WOLFSSL_MSG("First server message not server hello");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->options.dtls &&
|
|
type == server_hello_done &&
|
|
ssl->options.serverState < SERVER_HELLO_COMPLETE) {
|
|
WOLFSSL_MSG("Server hello done received before server hello in DTLS");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
|
|
if (ssl->options.side == WOLFSSL_SERVER_END &&
|
|
ssl->options.clientState == NULL_STATE && type != client_hello) {
|
|
WOLFSSL_MSG("First client message not client hello");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
|
|
/* above checks handshake state */
|
|
/* hello_request not hashed */
|
|
/* Also, skip hashing the client_hello message here for DTLS. It will be
|
|
* hashed later if the DTLS cookie is correct. */
|
|
if (type != hello_request &&
|
|
!(IsDtlsNotSctpMode(ssl) && type == client_hello)
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ssl->error != WC_PENDING_E
|
|
#endif
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
&& ssl->error != OCSP_WANT_READ
|
|
#endif
|
|
) {
|
|
ret = HashInput(ssl, input + *inOutIdx, size);
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("Incomplete handshake hashes");
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->CBIS != NULL){
|
|
ssl->cbmode = SSL_CB_MODE_READ;
|
|
ssl->cbtype = type;
|
|
ssl->CBIS(ssl, SSL_CB_ACCEPT_LOOP, SSL_SUCCESS);
|
|
}
|
|
#endif
|
|
|
|
switch (type) {
|
|
|
|
case hello_request:
|
|
WOLFSSL_MSG("processing hello request");
|
|
ret = DoHelloRequest(ssl, input, inOutIdx, size, totalSz);
|
|
break;
|
|
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
case hello_verify_request:
|
|
WOLFSSL_MSG("processing hello verify request");
|
|
ret = DoHelloVerifyRequest(ssl, input,inOutIdx, size);
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (*inOutIdx + ssl->keys.padSz + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += ssl->keys.padSz + digestSz;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* access beyond input + size should be checked against totalSz
|
|
*/
|
|
if (*inOutIdx + ssl->keys.padSz > totalSz)
|
|
return BUFFER_E;
|
|
|
|
*inOutIdx += ssl->keys.padSz;
|
|
}
|
|
}
|
|
break;
|
|
|
|
case server_hello:
|
|
WOLFSSL_MSG("processing server hello");
|
|
ret = DoServerHello(ssl, input, inOutIdx, size);
|
|
#if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
|
|
((defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
|
|
(defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)))
|
|
if (ssl->options.resuming || !IsAtLeastTLSv1_2(ssl) ||
|
|
IsAtLeastTLSv1_3(ssl->version)) {
|
|
|
|
#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLFSSL_NONBLOCK_OCSP)
|
|
if (ret != WC_PENDING_E && ret != OCSP_WANT_READ)
|
|
#endif
|
|
{
|
|
ssl->options.cacheMessages = 0;
|
|
if (ssl->hsHashes->messages != NULL) {
|
|
XFREE(ssl->hsHashes->messages, ssl->heap,
|
|
DYNAMIC_TYPE_HASHES);
|
|
ssl->hsHashes->messages = NULL;
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
break;
|
|
|
|
#ifndef NO_CERTS
|
|
case certificate_request:
|
|
WOLFSSL_MSG("processing certificate request");
|
|
ret = DoCertificateRequest(ssl, input, inOutIdx, size);
|
|
break;
|
|
#endif
|
|
|
|
case server_key_exchange:
|
|
WOLFSSL_MSG("processing server key exchange");
|
|
ret = DoServerKeyExchange(ssl, input, inOutIdx, size);
|
|
break;
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
case session_ticket:
|
|
WOLFSSL_MSG("processing session ticket");
|
|
ret = DoSessionTicket(ssl, input, inOutIdx, size);
|
|
break;
|
|
#endif /* HAVE_SESSION_TICKET */
|
|
#endif
|
|
|
|
#if !defined(NO_CERTS) && (!defined(NO_WOLFSSL_CLIENT) || \
|
|
!defined(WOLFSSL_NO_CLIENT_AUTH))
|
|
case certificate:
|
|
WOLFSSL_MSG("processing certificate");
|
|
ret = DoCertificate(ssl, input, inOutIdx, size);
|
|
break;
|
|
|
|
case certificate_status:
|
|
WOLFSSL_MSG("processing certificate status");
|
|
ret = DoCertificateStatus(ssl, input, inOutIdx, size);
|
|
break;
|
|
#endif
|
|
|
|
case server_hello_done:
|
|
WOLFSSL_MSG("processing server hello done");
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ServerHelloDone");
|
|
if (ssl->toInfoOn)
|
|
AddLateName("ServerHelloDone", &ssl->timeoutInfo);
|
|
#endif
|
|
ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
*inOutIdx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
*inOutIdx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
if (ssl->options.resuming) {
|
|
WOLFSSL_MSG("Not resuming as thought");
|
|
ssl->options.resuming = 0;
|
|
}
|
|
break;
|
|
|
|
case finished:
|
|
WOLFSSL_MSG("processing finished");
|
|
ret = DoFinished(ssl, input, inOutIdx, size, totalSz, NO_SNIFF);
|
|
break;
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
case client_hello:
|
|
WOLFSSL_MSG("processing client hello");
|
|
ret = DoClientHello(ssl, input, inOutIdx, size);
|
|
#if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
|
|
((defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
|
|
(defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)))
|
|
if (ssl->options.resuming || !ssl->options.verifyPeer || \
|
|
!IsAtLeastTLSv1_2(ssl) || IsAtLeastTLSv1_3(ssl->version)) {
|
|
#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLFSSL_NONBLOCK_OCSP)
|
|
if (ret != WC_PENDING_E && ret != OCSP_WANT_READ)
|
|
#endif
|
|
{
|
|
ssl->options.cacheMessages = 0;
|
|
if (ssl->hsHashes->messages != NULL) {
|
|
XFREE(ssl->hsHashes->messages, ssl->heap, DYNAMIC_TYPE_HASHES);
|
|
ssl->hsHashes->messages = NULL;
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
/* If size == totalSz then we are in DtlsMsgDrain so no need to worry
|
|
* about padding */
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (size != totalSz &&
|
|
*inOutIdx + ssl->keys.padSz + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += ssl->keys.padSz + digestSz;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* access beyond input + size should be checked against totalSz
|
|
*/
|
|
if (size != totalSz &&
|
|
*inOutIdx + ssl->keys.padSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += ssl->keys.padSz;
|
|
}
|
|
}
|
|
break;
|
|
|
|
case client_key_exchange:
|
|
WOLFSSL_MSG("processing client key exchange");
|
|
ret = DoClientKeyExchange(ssl, input, inOutIdx, size);
|
|
break;
|
|
|
|
#if (!defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \
|
|
defined(HAVE_ED448)) && !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
case certificate_verify:
|
|
WOLFSSL_MSG("processing certificate verify");
|
|
ret = DoCertificateVerify(ssl, input, inOutIdx, size);
|
|
break;
|
|
#endif /* (!NO_RSA || ECC || ED25519 || ED448) && !WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
#endif /* !NO_WOLFSSL_SERVER */
|
|
|
|
default:
|
|
WOLFSSL_MSG("Unknown handshake message type");
|
|
ret = UNKNOWN_HANDSHAKE_TYPE;
|
|
break;
|
|
}
|
|
if (ret == 0 && expectedIdx != *inOutIdx) {
|
|
WOLFSSL_MSG("Extra data in handshake message");
|
|
if (!ssl->options.dtls)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
ret = DECODE_E;
|
|
}
|
|
|
|
if (ret == 0 && ssl->buffers.inputBuffer.dynamicFlag
|
|
#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLFSSL_NONBLOCK_OCSP)
|
|
/* do not shrink input for async or non-block */
|
|
&& ssl->error != WC_PENDING_E && ssl->error != OCSP_WANT_READ
|
|
#endif
|
|
) {
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
word32 extra = ssl->keys.padSz;
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
extra += MacSize(ssl);
|
|
#endif
|
|
|
|
if (extra > ssl->buffers.inputBuffer.idx)
|
|
return BUFFER_E;
|
|
|
|
ssl->buffers.inputBuffer.idx -= extra;
|
|
ShrinkInputBuffer(ssl, NO_FORCED_FREE);
|
|
ssl->buffers.inputBuffer.idx += extra;
|
|
}
|
|
else {
|
|
ShrinkInputBuffer(ssl, NO_FORCED_FREE);
|
|
}
|
|
}
|
|
|
|
#if defined(WOLFSSL_ASYNC_CRYPT) || defined(WOLFSSL_NONBLOCK_OCSP)
|
|
/* if async, offset index so this msg will be processed again */
|
|
if ((ret == WC_PENDING_E || ret == OCSP_WANT_READ) && *inOutIdx > 0) {
|
|
*inOutIdx -= HANDSHAKE_HEADER_SZ;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
*inOutIdx -= DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
/* make sure async error is cleared */
|
|
if (ret == 0 && (ssl->error == WC_PENDING_E || ssl->error == OCSP_WANT_READ)) {
|
|
ssl->error = 0;
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT || WOLFSSL_NONBLOCK_OCSP */
|
|
|
|
WOLFSSL_LEAVE("DoHandShakeMsgType()", ret);
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int DoHandShakeMsg(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 totalSz)
|
|
{
|
|
int ret = 0;
|
|
word32 inputLength;
|
|
|
|
WOLFSSL_ENTER("DoHandShakeMsg()");
|
|
|
|
if (ssl->arrays == NULL) {
|
|
byte type;
|
|
word32 size;
|
|
|
|
if (GetHandShakeHeader(ssl,input,inOutIdx,&type, &size, totalSz) != 0)
|
|
return PARSE_ERROR;
|
|
|
|
ssl->options.handShakeState = type;
|
|
|
|
return DoHandShakeMsgType(ssl, input, inOutIdx, type, size, totalSz);
|
|
}
|
|
|
|
inputLength = ssl->buffers.inputBuffer.length - *inOutIdx;
|
|
|
|
/* If there is a pending fragmented handshake message,
|
|
* pending message size will be non-zero. */
|
|
if (ssl->arrays->pendingMsgSz == 0) {
|
|
byte type;
|
|
word32 size;
|
|
|
|
if (GetHandShakeHeader(ssl,input, inOutIdx, &type, &size, totalSz) != 0)
|
|
return PARSE_ERROR;
|
|
|
|
/* Cap the maximum size of a handshake message to something reasonable.
|
|
* By default is the maximum size of a certificate message assuming
|
|
* nine 2048-bit RSA certificates in the chain. */
|
|
if (size > MAX_HANDSHAKE_SZ) {
|
|
WOLFSSL_MSG("Handshake message too large");
|
|
return HANDSHAKE_SIZE_ERROR;
|
|
}
|
|
|
|
/* size is the size of the certificate message payload */
|
|
if (inputLength - HANDSHAKE_HEADER_SZ < size) {
|
|
ssl->arrays->pendingMsgType = type;
|
|
ssl->arrays->pendingMsgSz = size + HANDSHAKE_HEADER_SZ;
|
|
ssl->arrays->pendingMsg = (byte*)XMALLOC(size + HANDSHAKE_HEADER_SZ,
|
|
ssl->heap,
|
|
DYNAMIC_TYPE_ARRAYS);
|
|
if (ssl->arrays->pendingMsg == NULL)
|
|
return MEMORY_E;
|
|
XMEMCPY(ssl->arrays->pendingMsg,
|
|
input + *inOutIdx - HANDSHAKE_HEADER_SZ,
|
|
inputLength);
|
|
ssl->arrays->pendingMsgOffset = inputLength;
|
|
*inOutIdx += inputLength - HANDSHAKE_HEADER_SZ;
|
|
return 0;
|
|
}
|
|
|
|
ret = DoHandShakeMsgType(ssl, input, inOutIdx, type, size, totalSz);
|
|
}
|
|
else {
|
|
word32 pendSz =
|
|
ssl->arrays->pendingMsgSz - ssl->arrays->pendingMsgOffset;
|
|
|
|
/* Catch the case where there may be the remainder of a fragmented
|
|
* handshake message and the next handshake message in the same
|
|
* record. */
|
|
if (inputLength > pendSz)
|
|
inputLength = pendSz;
|
|
|
|
XMEMCPY(ssl->arrays->pendingMsg + ssl->arrays->pendingMsgOffset,
|
|
input + *inOutIdx, inputLength);
|
|
ssl->arrays->pendingMsgOffset += inputLength;
|
|
*inOutIdx += inputLength;
|
|
|
|
if (ssl->arrays->pendingMsgOffset == ssl->arrays->pendingMsgSz)
|
|
{
|
|
word32 idx = HANDSHAKE_HEADER_SZ;
|
|
ret = DoHandShakeMsgType(ssl,
|
|
ssl->arrays->pendingMsg,
|
|
&idx, ssl->arrays->pendingMsgType,
|
|
ssl->arrays->pendingMsgSz - idx,
|
|
ssl->arrays->pendingMsgSz);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
/* setup to process fragment again */
|
|
ssl->arrays->pendingMsgOffset -= inputLength;
|
|
*inOutIdx -= inputLength;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
XFREE(ssl->arrays->pendingMsg, ssl->heap, DYNAMIC_TYPE_ARRAYS);
|
|
ssl->arrays->pendingMsg = NULL;
|
|
ssl->arrays->pendingMsgSz = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
WOLFSSL_LEAVE("DoHandShakeMsg()", ret);
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
|
|
static WC_INLINE int DtlsCheckWindow(WOLFSSL* ssl)
|
|
{
|
|
word32* window;
|
|
word16 cur_hi, next_hi;
|
|
word32 cur_lo, next_lo, diff;
|
|
int curLT;
|
|
WOLFSSL_DTLS_PEERSEQ* peerSeq = NULL;
|
|
|
|
if (!ssl->options.haveMcast)
|
|
peerSeq = ssl->keys.peerSeq;
|
|
else {
|
|
#ifdef WOLFSSL_MULTICAST
|
|
WOLFSSL_DTLS_PEERSEQ* p;
|
|
int i;
|
|
|
|
for (i = 0, p = ssl->keys.peerSeq;
|
|
i < WOLFSSL_DTLS_PEERSEQ_SZ;
|
|
i++, p++) {
|
|
|
|
if (p->peerId == ssl->keys.curPeerId) {
|
|
peerSeq = p;
|
|
break;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
if (peerSeq == NULL) {
|
|
WOLFSSL_MSG("Could not find peer sequence");
|
|
return 0;
|
|
}
|
|
|
|
if (ssl->keys.curEpoch == peerSeq->nextEpoch) {
|
|
next_hi = peerSeq->nextSeq_hi;
|
|
next_lo = peerSeq->nextSeq_lo;
|
|
window = peerSeq->window;
|
|
}
|
|
else if (ssl->keys.curEpoch == peerSeq->nextEpoch - 1) {
|
|
next_hi = peerSeq->prevSeq_hi;
|
|
next_lo = peerSeq->prevSeq_lo;
|
|
window = peerSeq->prevWindow;
|
|
}
|
|
else {
|
|
return 0;
|
|
}
|
|
|
|
cur_hi = ssl->keys.curSeq_hi;
|
|
cur_lo = ssl->keys.curSeq_lo;
|
|
|
|
/* If the difference between next and cur is > 2^32, way outside window. */
|
|
if ((cur_hi > next_hi + 1) || (next_hi > cur_hi + 1)) {
|
|
WOLFSSL_MSG("Current record from way too far in the future.");
|
|
return 0;
|
|
}
|
|
|
|
if (cur_hi == next_hi) {
|
|
curLT = cur_lo < next_lo;
|
|
diff = curLT ? next_lo - cur_lo : cur_lo - next_lo;
|
|
}
|
|
else {
|
|
curLT = cur_hi < next_hi;
|
|
diff = curLT ? cur_lo - next_lo : next_lo - cur_lo;
|
|
}
|
|
|
|
/* Check to see that the next value is greater than the number of messages
|
|
* trackable in the window, and that the difference between the next
|
|
* expected sequence number and the received sequence number is inside the
|
|
* window. */
|
|
if ((next_hi || next_lo > DTLS_SEQ_BITS) &&
|
|
curLT && (diff > DTLS_SEQ_BITS)) {
|
|
|
|
WOLFSSL_MSG("Current record sequence number from the past.");
|
|
return 0;
|
|
}
|
|
#ifndef WOLFSSL_DTLS_ALLOW_FUTURE
|
|
else if (!curLT && (diff > DTLS_SEQ_BITS)) {
|
|
WOLFSSL_MSG("Rejecting message too far into the future.");
|
|
return 0;
|
|
}
|
|
#endif
|
|
else if (curLT) {
|
|
word32 idx;
|
|
word32 newDiff;
|
|
if (diff == 0) {
|
|
WOLFSSL_MSG("DTLS sanity check failed");
|
|
return 0;
|
|
}
|
|
diff--;
|
|
idx = diff / DTLS_WORD_BITS;
|
|
newDiff = diff % DTLS_WORD_BITS;
|
|
|
|
/* verify idx is valid for window array */
|
|
if (idx >= WOLFSSL_DTLS_WINDOW_WORDS) {
|
|
WOLFSSL_MSG("Invalid DTLS windows index");
|
|
return 0;
|
|
}
|
|
|
|
if (window[idx] & (1 << newDiff)) {
|
|
WOLFSSL_MSG("Current record sequence number already received.");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
|
|
#ifdef WOLFSSL_MULTICAST
|
|
static WC_INLINE word32 UpdateHighwaterMark(word32 cur, word32 first,
|
|
word32 second, word32 high)
|
|
{
|
|
word32 newCur = 0;
|
|
|
|
if (cur < first)
|
|
newCur = first;
|
|
else if (cur < second)
|
|
newCur = second;
|
|
else if (cur < high)
|
|
newCur = high;
|
|
|
|
return newCur;
|
|
}
|
|
#endif /* WOLFSSL_MULTICAST */
|
|
|
|
|
|
static WC_INLINE int DtlsUpdateWindow(WOLFSSL* ssl)
|
|
{
|
|
word32* window;
|
|
word32* next_lo;
|
|
word16* next_hi;
|
|
int curLT;
|
|
word32 cur_lo, diff;
|
|
word16 cur_hi;
|
|
WOLFSSL_DTLS_PEERSEQ* peerSeq = ssl->keys.peerSeq;
|
|
|
|
cur_hi = ssl->keys.curSeq_hi;
|
|
cur_lo = ssl->keys.curSeq_lo;
|
|
|
|
#ifdef WOLFSSL_MULTICAST
|
|
if (ssl->options.haveMcast) {
|
|
WOLFSSL_DTLS_PEERSEQ* p;
|
|
int i;
|
|
|
|
peerSeq = NULL;
|
|
for (i = 0, p = ssl->keys.peerSeq;
|
|
i < WOLFSSL_DTLS_PEERSEQ_SZ;
|
|
i++, p++) {
|
|
|
|
if (p->peerId == ssl->keys.curPeerId) {
|
|
peerSeq = p;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (peerSeq == NULL) {
|
|
WOLFSSL_MSG("Couldn't find that peer ID to update window.");
|
|
return 0;
|
|
}
|
|
|
|
if (p->highwaterMark && cur_lo >= p->highwaterMark) {
|
|
int cbError = 0;
|
|
|
|
if (ssl->ctx->mcastHwCb)
|
|
cbError = ssl->ctx->mcastHwCb(p->peerId,
|
|
ssl->ctx->mcastMaxSeq,
|
|
cur_lo, ssl->mcastHwCbCtx);
|
|
if (cbError) {
|
|
WOLFSSL_MSG("Multicast highwater callback returned an error.");
|
|
return MCAST_HIGHWATER_CB_E;
|
|
}
|
|
|
|
p->highwaterMark = UpdateHighwaterMark(cur_lo,
|
|
ssl->ctx->mcastFirstSeq,
|
|
ssl->ctx->mcastSecondSeq,
|
|
ssl->ctx->mcastMaxSeq);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
if (ssl->keys.curEpoch == peerSeq->nextEpoch) {
|
|
next_hi = &peerSeq->nextSeq_hi;
|
|
next_lo = &peerSeq->nextSeq_lo;
|
|
window = peerSeq->window;
|
|
}
|
|
else {
|
|
next_hi = &peerSeq->prevSeq_hi;
|
|
next_lo = &peerSeq->prevSeq_lo;
|
|
window = peerSeq->prevWindow;
|
|
}
|
|
|
|
if (cur_hi == *next_hi) {
|
|
curLT = cur_lo < *next_lo;
|
|
diff = curLT ? *next_lo - cur_lo - 1 : cur_lo - *next_lo + 1;
|
|
}
|
|
else {
|
|
curLT = cur_hi < *next_hi;
|
|
diff = curLT ? cur_lo - *next_lo - 1 : *next_lo - cur_lo + 1;
|
|
}
|
|
|
|
if (curLT) {
|
|
word32 idx = diff / DTLS_WORD_BITS;
|
|
word32 newDiff = diff % DTLS_WORD_BITS;
|
|
|
|
if (idx < WOLFSSL_DTLS_WINDOW_WORDS)
|
|
window[idx] |= (1 << newDiff);
|
|
}
|
|
else {
|
|
if (diff >= DTLS_SEQ_BITS)
|
|
XMEMSET(window, 0, DTLS_SEQ_SZ);
|
|
else {
|
|
word32 idx, newDiff, temp, i;
|
|
word32 oldWindow[WOLFSSL_DTLS_WINDOW_WORDS];
|
|
|
|
temp = 0;
|
|
idx = diff / DTLS_WORD_BITS;
|
|
newDiff = diff % DTLS_WORD_BITS;
|
|
|
|
XMEMCPY(oldWindow, window, sizeof(oldWindow));
|
|
|
|
for (i = 0; i < WOLFSSL_DTLS_WINDOW_WORDS; i++) {
|
|
if (i < idx)
|
|
window[i] = 0;
|
|
else {
|
|
temp |= (oldWindow[i-idx] << newDiff);
|
|
window[i] = temp;
|
|
temp = oldWindow[i-idx] >> (DTLS_WORD_BITS - newDiff - 1);
|
|
}
|
|
}
|
|
}
|
|
window[0] |= 1;
|
|
*next_lo = cur_lo + 1;
|
|
if (*next_lo < cur_lo)
|
|
(*next_hi)++;
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
|
|
static int DtlsMsgDrain(WOLFSSL* ssl)
|
|
{
|
|
DtlsMsg* item = ssl->dtls_rx_msg_list;
|
|
int ret = 0;
|
|
|
|
WOLFSSL_ENTER("DtlsMsgDrain()");
|
|
|
|
/* While there is an item in the store list, and it is the expected
|
|
* message, and it is complete, and there hasn't been an error in the
|
|
* last message... */
|
|
while (item != NULL &&
|
|
ssl->keys.dtls_expected_peer_handshake_number == item->seq &&
|
|
item->fragSz == item->sz &&
|
|
ret == 0) {
|
|
word32 idx = 0;
|
|
if ((ret = DoHandShakeMsgType(ssl, item->msg, &idx, item->type,
|
|
item->sz, item->sz)) == 0) {
|
|
if (item->type != finished)
|
|
ssl->keys.dtls_expected_peer_handshake_number++;
|
|
DtlsTxMsgListClean(ssl);
|
|
}
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
break;
|
|
}
|
|
#endif
|
|
ssl->dtls_rx_msg_list = item->next;
|
|
DtlsMsgDelete(item, ssl->heap);
|
|
item = ssl->dtls_rx_msg_list;
|
|
ssl->dtls_rx_msg_list_sz--;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("DtlsMsgDrain()", ret);
|
|
return ret;
|
|
}
|
|
|
|
|
|
static int DoDtlsHandShakeMsg(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 totalSz)
|
|
{
|
|
byte type;
|
|
word32 size;
|
|
word32 fragOffset, fragSz;
|
|
int ret = 0;
|
|
int ignoreFinished = 0;
|
|
|
|
WOLFSSL_ENTER("DoDtlsHandShakeMsg()");
|
|
|
|
/* parse header */
|
|
if (GetDtlsHandShakeHeader(ssl, input, inOutIdx, &type,
|
|
&size, &fragOffset, &fragSz, totalSz) != 0) {
|
|
WOLFSSL_ERROR(PARSE_ERROR);
|
|
return PARSE_ERROR;
|
|
}
|
|
|
|
/* Cap the maximum size of a handshake message to something reasonable.
|
|
* By default is the maximum size of a certificate message assuming
|
|
* nine 2048-bit RSA certificates in the chain. */
|
|
if (size > MAX_HANDSHAKE_SZ) {
|
|
WOLFSSL_MSG("Handshake message too large");
|
|
return HANDSHAKE_SIZE_ERROR;
|
|
}
|
|
|
|
/* check that we have complete fragment */
|
|
if (*inOutIdx + fragSz > totalSz) {
|
|
WOLFSSL_ERROR(INCOMPLETE_DATA);
|
|
return INCOMPLETE_DATA;
|
|
}
|
|
|
|
if (type == finished && ssl->keys.dtls_peer_handshake_number >=
|
|
ssl->keys.dtls_expected_peer_handshake_number &&
|
|
ssl->keys.curEpoch == ssl->keys.dtls_epoch) {
|
|
/* finished msg should be ignore from the current epoch
|
|
* if it comes from a previous handshake */
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
ignoreFinished = ssl->options.connectState < FINISHED_DONE;
|
|
}
|
|
else {
|
|
ignoreFinished = ssl->options.acceptState < ACCEPT_FINISHED_DONE;
|
|
}
|
|
}
|
|
|
|
/* Check the handshake sequence number first. If out of order,
|
|
* add the current message to the list. If the message is in order,
|
|
* but it is a fragment, add the current message to the list, then
|
|
* check the head of the list to see if it is complete, if so, pop
|
|
* it out as the current message. If the message is complete and in
|
|
* order, process it. Check the head of the list to see if it is in
|
|
* order, if so, process it. (Repeat until list exhausted.) If the
|
|
* head is out of order, return for more processing.
|
|
*/
|
|
if (ssl->keys.dtls_peer_handshake_number >
|
|
ssl->keys.dtls_expected_peer_handshake_number &&
|
|
/* Only client_hello shouldn't be ignored if the handshake
|
|
* num is greater */
|
|
(type == client_hello ||
|
|
ssl->options.handShakeState != HANDSHAKE_DONE) &&
|
|
!ignoreFinished) {
|
|
/* Current message is out of order. It will get stored in the list.
|
|
* Storing also takes care of defragmentation. If the messages is a
|
|
* client hello, we need to process this out of order; the server
|
|
* is not supposed to keep state, but the second client hello will
|
|
* have a different handshake sequence number than is expected, and
|
|
* the server shouldn't be expecting any particular handshake sequence
|
|
* number. (If the cookie changes multiple times in quick succession,
|
|
* the client could be sending multiple new client hello messages
|
|
* with newer and newer cookies.) */
|
|
WOLFSSL_MSG("Current message is out of order");
|
|
if (type != client_hello) {
|
|
if (ssl->dtls_rx_msg_list_sz < DTLS_POOL_SZ) {
|
|
DtlsMsgStore(ssl, ssl->keys.curEpoch,
|
|
ssl->keys.dtls_peer_handshake_number,
|
|
input + *inOutIdx, size, type,
|
|
fragOffset, fragSz, ssl->heap);
|
|
}
|
|
*inOutIdx += fragSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead && ssl->keys.curEpoch != 0) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (*inOutIdx + ssl->keys.padSz + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += digestSz;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (*inOutIdx + ssl->keys.padSz > totalSz) {
|
|
WOLFSSL_ERROR(BUFFER_E);
|
|
return BUFFER_E;
|
|
}
|
|
}
|
|
*inOutIdx += ssl->keys.padSz;
|
|
ret = 0;
|
|
#ifndef WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT
|
|
/* If we receive an out of order last flight msg then retransmit */
|
|
if (type == server_hello_done || type == finished) {
|
|
ret = DtlsMsgPoolSend(ssl, 0);
|
|
}
|
|
#endif
|
|
}
|
|
else {
|
|
ret = DoHandShakeMsgType(ssl, input, inOutIdx, type, size, totalSz);
|
|
if (ret == 0) {
|
|
ssl->keys.dtls_expected_peer_handshake_number =
|
|
ssl->keys.dtls_peer_handshake_number + 1;
|
|
}
|
|
}
|
|
}
|
|
else if (ssl->keys.dtls_peer_handshake_number <
|
|
ssl->keys.dtls_expected_peer_handshake_number ||
|
|
/* ignore all handshake messages if we are done with the
|
|
* handshake */
|
|
(ssl->keys.dtls_peer_handshake_number >
|
|
ssl->keys.dtls_expected_peer_handshake_number &&
|
|
ssl->options.handShakeState == HANDSHAKE_DONE) ||
|
|
ignoreFinished) {
|
|
/* Already saw this message and processed it. It can be ignored. */
|
|
WOLFSSL_MSG("Already saw this message and processed it");
|
|
*inOutIdx += fragSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead && ssl->keys.curEpoch != 0) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (*inOutIdx + ssl->keys.padSz + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += digestSz;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (*inOutIdx + ssl->keys.padSz > totalSz) {
|
|
WOLFSSL_ERROR(BUFFER_E);
|
|
return BUFFER_E;
|
|
}
|
|
}
|
|
#ifndef WOLFSSL_DTLS_RESEND_ONLY_TIMEOUT
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
VerifyForDtlsMsgPoolSend(ssl, type, fragOffset)) {
|
|
|
|
ret = DtlsMsgPoolSend(ssl, 0);
|
|
}
|
|
#endif
|
|
*inOutIdx += ssl->keys.padSz;
|
|
}
|
|
else if (fragSz < size) {
|
|
/* Since this branch is in order, but fragmented, dtls_rx_msg_list will
|
|
* be pointing to the message with this fragment in it. Check it to see
|
|
* if it is completed. */
|
|
WOLFSSL_MSG("Branch is in order, but fragmented");
|
|
if (ssl->dtls_rx_msg_list_sz < DTLS_POOL_SZ) {
|
|
DtlsMsgStore(ssl, ssl->keys.curEpoch,
|
|
ssl->keys.dtls_peer_handshake_number,
|
|
input + *inOutIdx, size, type,
|
|
fragOffset, fragSz, ssl->heap);
|
|
}
|
|
*inOutIdx += fragSz;
|
|
*inOutIdx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead && ssl->keys.curEpoch != 0) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (*inOutIdx + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += digestSz;
|
|
}
|
|
#endif
|
|
ret = 0;
|
|
if (ssl->dtls_rx_msg_list != NULL &&
|
|
ssl->dtls_rx_msg_list->fragSz >= ssl->dtls_rx_msg_list->sz)
|
|
ret = DtlsMsgDrain(ssl);
|
|
}
|
|
else {
|
|
/* This branch is in order next, and a complete message. On success
|
|
* clean the tx list. */
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
word32 idx = *inOutIdx;
|
|
#endif
|
|
WOLFSSL_MSG("Branch is in order and a complete message");
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* In async mode always store the message and process it with
|
|
* DtlsMsgDrain because in case of a WC_PENDING_E it will be
|
|
* easier this way. */
|
|
if (ssl->dtls_rx_msg_list_sz < DTLS_POOL_SZ) {
|
|
DtlsMsgStore(ssl, ssl->keys.curEpoch,
|
|
ssl->keys.dtls_peer_handshake_number,
|
|
input + idx, size, type,
|
|
fragOffset, fragSz, ssl->heap);
|
|
}
|
|
if (idx + fragSz + ssl->keys.padSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx = idx + fragSz + ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead && ssl->keys.curEpoch != 0) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (*inOutIdx + digestSz > totalSz)
|
|
return BUFFER_E;
|
|
*inOutIdx += digestSz;
|
|
}
|
|
#endif
|
|
ret = DtlsMsgDrain(ssl);
|
|
#else
|
|
ret = DoHandShakeMsgType(ssl, input, inOutIdx, type, size, totalSz);
|
|
if (ret == 0) {
|
|
DtlsTxMsgListClean(ssl);
|
|
if (type != finished)
|
|
ssl->keys.dtls_expected_peer_handshake_number++;
|
|
if (ssl->dtls_rx_msg_list != NULL) {
|
|
ret = DtlsMsgDrain(ssl);
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
WOLFSSL_LEAVE("DoDtlsHandShakeMsg()", ret);
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifdef HAVE_AEAD
|
|
|
|
#if (!defined(NO_PUBLIC_GCM_SET_IV) && \
|
|
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
|
|
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))) || \
|
|
(defined(HAVE_POLY1305) && defined(HAVE_CHACHA))
|
|
static WC_INLINE void AeadIncrementExpIV(WOLFSSL* ssl)
|
|
{
|
|
int i;
|
|
for (i = AEAD_MAX_EXP_SZ-1; i >= 0; i--) {
|
|
if (++ssl->keys.aead_exp_IV[i]) return;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
|
|
#if defined(HAVE_POLY1305) && defined(HAVE_CHACHA)
|
|
/* Used for the older version of creating AEAD tags with Poly1305 */
|
|
static int Poly1305TagOld(WOLFSSL* ssl, byte* additional, const byte* out,
|
|
byte* cipher, word16 sz, byte* tag)
|
|
{
|
|
int ret = 0;
|
|
int msglen = (sz - ssl->specs.aead_mac_size);
|
|
word32 keySz = 32;
|
|
byte padding[8]; /* used to temporarily store lengths */
|
|
|
|
#ifdef CHACHA_AEAD_TEST
|
|
printf("Using old version of poly1305 input.\n");
|
|
#endif
|
|
|
|
if (msglen < 0)
|
|
return INPUT_CASE_ERROR;
|
|
|
|
if ((ret = wc_Poly1305SetKey(ssl->auth.poly1305, cipher, keySz)) != 0)
|
|
return ret;
|
|
|
|
if ((ret = wc_Poly1305Update(ssl->auth.poly1305, additional,
|
|
AEAD_AUTH_DATA_SZ)) != 0)
|
|
return ret;
|
|
|
|
/* length of additional input plus padding */
|
|
XMEMSET(padding, 0, sizeof(padding));
|
|
padding[0] = AEAD_AUTH_DATA_SZ;
|
|
if ((ret = wc_Poly1305Update(ssl->auth.poly1305, padding,
|
|
sizeof(padding))) != 0)
|
|
return ret;
|
|
|
|
|
|
/* add cipher info and then its length */
|
|
XMEMSET(padding, 0, sizeof(padding));
|
|
if ((ret = wc_Poly1305Update(ssl->auth.poly1305, out, msglen)) != 0)
|
|
return ret;
|
|
|
|
/* 32 bit size of cipher to 64 bit endian */
|
|
padding[0] = msglen & 0xff;
|
|
padding[1] = (msglen >> 8) & 0xff;
|
|
padding[2] = ((word32)msglen >> 16) & 0xff;
|
|
padding[3] = ((word32)msglen >> 24) & 0xff;
|
|
if ((ret = wc_Poly1305Update(ssl->auth.poly1305, padding, sizeof(padding)))
|
|
!= 0)
|
|
return ret;
|
|
|
|
/* generate tag */
|
|
if ((ret = wc_Poly1305Final(ssl->auth.poly1305, tag)) != 0)
|
|
return ret;
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* When the flag oldPoly is not set this follows RFC7905. When oldPoly is set
|
|
* the implementation follows an older draft for creating the nonce and MAC.
|
|
* The flag oldPoly gets set automatically depending on what cipher suite was
|
|
* negotiated in the handshake. This is able to be done because the IDs for the
|
|
* cipher suites was updated in RFC7905 giving unique values for the older
|
|
* draft in comparison to the more recent RFC.
|
|
*
|
|
* ssl WOLFSSL structure to get cipher and TLS state from
|
|
* out output buffer to hold encrypted data
|
|
* input data to encrypt
|
|
* sz size of input
|
|
*
|
|
* Return 0 on success negative values in error case
|
|
*/
|
|
static int ChachaAEADEncrypt(WOLFSSL* ssl, byte* out, const byte* input,
|
|
word16 sz)
|
|
{
|
|
const byte* additionalSrc = input - RECORD_HEADER_SZ;
|
|
int ret = 0;
|
|
word32 msgLen = (sz - ssl->specs.aead_mac_size);
|
|
byte tag[POLY1305_AUTH_SZ];
|
|
byte add[AEAD_AUTH_DATA_SZ];
|
|
byte nonce[CHACHA20_NONCE_SZ];
|
|
byte poly[CHACHA20_256_KEY_SIZE]; /* generated key for poly1305 */
|
|
#ifdef CHACHA_AEAD_TEST
|
|
int i;
|
|
#endif
|
|
|
|
XMEMSET(tag, 0, sizeof(tag));
|
|
XMEMSET(nonce, 0, sizeof(nonce));
|
|
XMEMSET(poly, 0, sizeof(poly));
|
|
XMEMSET(add, 0, sizeof(add));
|
|
|
|
/* opaque SEQ number stored for AD */
|
|
WriteSEQ(ssl, CUR_ORDER, add);
|
|
|
|
if (ssl->options.oldPoly != 0) {
|
|
/* get nonce. SEQ should not be incremented again here */
|
|
XMEMCPY(nonce + CHACHA20_OLD_OFFSET, add, OPAQUE32_LEN * 2);
|
|
}
|
|
|
|
/* Store the type, version. Unfortunately, they are in
|
|
* the input buffer ahead of the plaintext. */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
additionalSrc -= DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
/* add TLS message size to additional data */
|
|
add[AEAD_AUTH_DATA_SZ - 2] = (msgLen >> 8) & 0xff;
|
|
add[AEAD_AUTH_DATA_SZ - 1] = msgLen & 0xff;
|
|
|
|
XMEMCPY(add + AEAD_TYPE_OFFSET, additionalSrc, 3);
|
|
|
|
#ifdef CHACHA_AEAD_TEST
|
|
printf("Encrypt Additional : ");
|
|
for (i = 0; i < AEAD_AUTH_DATA_SZ; i++) {
|
|
printf("%02x", add[i]);
|
|
}
|
|
printf("\n\n");
|
|
printf("input before encryption :\n");
|
|
for (i = 0; i < sz; i++) {
|
|
printf("%02x", input[i]);
|
|
if ((i + 1) % 16 == 0)
|
|
printf("\n");
|
|
}
|
|
printf("\n");
|
|
#endif
|
|
|
|
if (ssl->options.oldPoly == 0) {
|
|
/* nonce is formed by 4 0x00 byte padded to the left followed by 8 byte
|
|
* record sequence number XORed with client_write_IV/server_write_IV */
|
|
XMEMCPY(nonce, ssl->keys.aead_enc_imp_IV, CHACHA20_IMP_IV_SZ);
|
|
nonce[4] ^= add[0];
|
|
nonce[5] ^= add[1];
|
|
nonce[6] ^= add[2];
|
|
nonce[7] ^= add[3];
|
|
nonce[8] ^= add[4];
|
|
nonce[9] ^= add[5];
|
|
nonce[10] ^= add[6];
|
|
nonce[11] ^= add[7];
|
|
}
|
|
|
|
/* set the nonce for chacha and get poly1305 key */
|
|
if ((ret = wc_Chacha_SetIV(ssl->encrypt.chacha, nonce, 0)) != 0) {
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ);
|
|
return ret;
|
|
}
|
|
|
|
/* create Poly1305 key using chacha20 keystream */
|
|
if ((ret = wc_Chacha_Process(ssl->encrypt.chacha, poly,
|
|
poly, sizeof(poly))) != 0) {
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ);
|
|
return ret;
|
|
}
|
|
|
|
/* set the counter after getting poly1305 key */
|
|
if ((ret = wc_Chacha_SetIV(ssl->encrypt.chacha, nonce, 1)) != 0) {
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ);
|
|
return ret;
|
|
}
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ); /* done with nonce, clear it */
|
|
|
|
/* encrypt the plain text */
|
|
if ((ret = wc_Chacha_Process(ssl->encrypt.chacha, out,
|
|
input, msgLen)) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
|
|
/* get the poly1305 tag using either old padding scheme or more recent */
|
|
if (ssl->options.oldPoly != 0) {
|
|
if ((ret = Poly1305TagOld(ssl, add, (const byte* )out,
|
|
poly, sz, tag)) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
}
|
|
else {
|
|
if ((ret = wc_Poly1305SetKey(ssl->auth.poly1305, poly,
|
|
sizeof(poly))) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
if ((ret = wc_Poly1305_MAC(ssl->auth.poly1305, add,
|
|
sizeof(add), out, msgLen, tag, sizeof(tag))) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
}
|
|
ForceZero(poly, sizeof(poly)); /* done with poly1305 key, clear it */
|
|
|
|
/* append tag to ciphertext */
|
|
XMEMCPY(out + msgLen, tag, sizeof(tag));
|
|
|
|
AeadIncrementExpIV(ssl);
|
|
|
|
#ifdef CHACHA_AEAD_TEST
|
|
printf("mac tag :\n");
|
|
for (i = 0; i < 16; i++) {
|
|
printf("%02x", tag[i]);
|
|
if ((i + 1) % 16 == 0)
|
|
printf("\n");
|
|
}
|
|
printf("\n\noutput after encrypt :\n");
|
|
for (i = 0; i < sz; i++) {
|
|
printf("%02x", out[i]);
|
|
if ((i + 1) % 16 == 0)
|
|
printf("\n");
|
|
}
|
|
printf("\n");
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* When the flag oldPoly is not set this follows RFC7905. When oldPoly is set
|
|
* the implementation follows an older draft for creating the nonce and MAC.
|
|
* The flag oldPoly gets set automatically depending on what cipher suite was
|
|
* negotiated in the handshake. This is able to be done because the IDs for the
|
|
* cipher suites was updated in RFC7905 giving unique values for the older
|
|
* draft in comparison to the more recent RFC.
|
|
*
|
|
* ssl WOLFSSL structure to get cipher and TLS state from
|
|
* plain output buffer to hold decrypted data
|
|
* input data to decrypt
|
|
* sz size of input
|
|
*
|
|
* Return 0 on success negative values in error case
|
|
*/
|
|
static int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input,
|
|
word16 sz)
|
|
{
|
|
byte add[AEAD_AUTH_DATA_SZ];
|
|
byte nonce[CHACHA20_NONCE_SZ];
|
|
byte tag[POLY1305_AUTH_SZ];
|
|
byte poly[CHACHA20_256_KEY_SIZE]; /* generated key for mac */
|
|
int ret = 0;
|
|
int msgLen = (sz - ssl->specs.aead_mac_size);
|
|
|
|
#ifdef CHACHA_AEAD_TEST
|
|
int i;
|
|
printf("input before decrypt :\n");
|
|
for (i = 0; i < sz; i++) {
|
|
printf("%02x", input[i]);
|
|
if ((i + 1) % 16 == 0)
|
|
printf("\n");
|
|
}
|
|
printf("\n");
|
|
#endif
|
|
|
|
XMEMSET(tag, 0, sizeof(tag));
|
|
XMEMSET(poly, 0, sizeof(poly));
|
|
XMEMSET(nonce, 0, sizeof(nonce));
|
|
XMEMSET(add, 0, sizeof(add));
|
|
|
|
/* sequence number field is 64-bits */
|
|
WriteSEQ(ssl, PEER_ORDER, add);
|
|
|
|
if (ssl->options.oldPoly != 0) {
|
|
/* get nonce, SEQ should not be incremented again here */
|
|
XMEMCPY(nonce + CHACHA20_OLD_OFFSET, add, OPAQUE32_LEN * 2);
|
|
}
|
|
|
|
/* get AD info */
|
|
/* Store the type, version. */
|
|
add[AEAD_TYPE_OFFSET] = ssl->curRL.type;
|
|
add[AEAD_VMAJ_OFFSET] = ssl->curRL.pvMajor;
|
|
add[AEAD_VMIN_OFFSET] = ssl->curRL.pvMinor;
|
|
|
|
/* add TLS message size to additional data */
|
|
add[AEAD_AUTH_DATA_SZ - 2] = (msgLen >> 8) & 0xff;
|
|
add[AEAD_AUTH_DATA_SZ - 1] = msgLen & 0xff;
|
|
|
|
#ifdef CHACHA_AEAD_TEST
|
|
printf("Decrypt Additional : ");
|
|
for (i = 0; i < AEAD_AUTH_DATA_SZ; i++) {
|
|
printf("%02x", add[i]);
|
|
}
|
|
printf("\n\n");
|
|
#endif
|
|
|
|
if (ssl->options.oldPoly == 0) {
|
|
/* nonce is formed by 4 0x00 byte padded to the left followed by 8 byte
|
|
* record sequence number XORed with client_write_IV/server_write_IV */
|
|
XMEMCPY(nonce, ssl->keys.aead_dec_imp_IV, CHACHA20_IMP_IV_SZ);
|
|
nonce[4] ^= add[0];
|
|
nonce[5] ^= add[1];
|
|
nonce[6] ^= add[2];
|
|
nonce[7] ^= add[3];
|
|
nonce[8] ^= add[4];
|
|
nonce[9] ^= add[5];
|
|
nonce[10] ^= add[6];
|
|
nonce[11] ^= add[7];
|
|
}
|
|
|
|
/* set nonce and get poly1305 key */
|
|
if ((ret = wc_Chacha_SetIV(ssl->decrypt.chacha, nonce, 0)) != 0) {
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ);
|
|
return ret;
|
|
}
|
|
|
|
/* use chacha20 keystream to get poly1305 key for tag */
|
|
if ((ret = wc_Chacha_Process(ssl->decrypt.chacha, poly,
|
|
poly, sizeof(poly))) != 0) {
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ);
|
|
return ret;
|
|
}
|
|
|
|
/* set counter after getting poly1305 key */
|
|
if ((ret = wc_Chacha_SetIV(ssl->decrypt.chacha, nonce, 1)) != 0) {
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ);
|
|
return ret;
|
|
}
|
|
ForceZero(nonce, CHACHA20_NONCE_SZ); /* done with nonce, clear it */
|
|
|
|
/* get the tag using Poly1305 */
|
|
if (ssl->options.oldPoly != 0) {
|
|
if ((ret = Poly1305TagOld(ssl, add, input, poly, sz, tag)) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
}
|
|
else {
|
|
if ((ret = wc_Poly1305SetKey(ssl->auth.poly1305, poly,
|
|
sizeof(poly))) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
if ((ret = wc_Poly1305_MAC(ssl->auth.poly1305, add,
|
|
sizeof(add), (byte*)input, msgLen, tag, sizeof(tag))) != 0) {
|
|
ForceZero(poly, sizeof(poly));
|
|
return ret;
|
|
}
|
|
}
|
|
ForceZero(poly, sizeof(poly)); /* done with poly1305 key, clear it */
|
|
|
|
/* check tag sent along with packet */
|
|
if (ConstantCompare(input + msgLen, tag, ssl->specs.aead_mac_size) != 0) {
|
|
WOLFSSL_MSG("MAC did not match");
|
|
if (!ssl->options.dtls)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
return VERIFY_MAC_ERROR;
|
|
}
|
|
|
|
/* if the tag was good decrypt message */
|
|
if ((ret = wc_Chacha_Process(ssl->decrypt.chacha, plain,
|
|
input, msgLen)) != 0)
|
|
return ret;
|
|
|
|
#ifdef CHACHA_AEAD_TEST
|
|
printf("plain after decrypt :\n");
|
|
for (i = 0; i < sz; i++) {
|
|
printf("%02x", plain[i]);
|
|
if ((i + 1) % 16 == 0)
|
|
printf("\n");
|
|
}
|
|
printf("\n");
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_CHACHA && HAVE_POLY1305 */
|
|
#endif /* HAVE_AEAD */
|
|
|
|
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
|
|
#if !defined(NO_GCM_ENCRYPT_EXTRA) && \
|
|
((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
|
|
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
|
|
/* The following type is used to share code between AES-GCM and AES-CCM. */
|
|
typedef int (*AesAuthEncryptFunc)(Aes* aes, byte* out,
|
|
const byte* in, word32 sz,
|
|
byte* iv, word32 ivSz,
|
|
byte* authTag, word32 authTagSz,
|
|
const byte* authIn, word32 authInSz);
|
|
#define AES_AUTH_ENCRYPT_FUNC AesAuthEncryptFunc
|
|
#define AES_GCM_ENCRYPT wc_AesGcmEncrypt_ex
|
|
#define AES_CCM_ENCRYPT wc_AesCcmEncrypt_ex
|
|
#else
|
|
#define AES_AUTH_ENCRYPT_FUNC wc_AesAuthEncryptFunc
|
|
#define AES_GCM_ENCRYPT wc_AesGcmEncrypt
|
|
#define AES_CCM_ENCRYPT wc_AesCcmEncrypt
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
static WC_INLINE int EncryptDo(WOLFSSL* ssl, byte* out, const byte* input,
|
|
word16 sz, int asyncOkay)
|
|
{
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
WC_ASYNC_DEV* asyncDev = NULL;
|
|
word32 event_flags = WC_ASYNC_FLAG_CALL_AGAIN;
|
|
#else
|
|
(void)asyncOkay;
|
|
#endif
|
|
|
|
(void)out;
|
|
(void)input;
|
|
(void)sz;
|
|
|
|
switch (ssl->specs.bulk_cipher_algorithm) {
|
|
#ifdef BUILD_ARC4
|
|
case wolfssl_rc4:
|
|
wc_Arc4Process(ssl->encrypt.arc4, out, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef BUILD_DES3
|
|
case wolfssl_triple_des:
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
asyncDev = &ssl->encrypt.des3->asyncDev;
|
|
ret = wolfSSL_AsyncInit(ssl, asyncDev, event_flags);
|
|
if (ret != 0)
|
|
break;
|
|
#endif
|
|
|
|
ret = wc_Des3_CbcEncrypt(ssl->encrypt.des3, out, input, sz);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E && asyncOkay) {
|
|
ret = wolfSSL_AsyncPush(ssl, asyncDev);
|
|
}
|
|
#endif
|
|
break;
|
|
#endif
|
|
|
|
#if defined(BUILD_AES) && defined(HAVE_AES_CBC)
|
|
case wolfssl_aes:
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
asyncDev = &ssl->encrypt.aes->asyncDev;
|
|
ret = wolfSSL_AsyncInit(ssl, asyncDev, event_flags);
|
|
if (ret != 0)
|
|
break;
|
|
#endif
|
|
#if defined(WOLFSSL_RENESAS_TSIP_TLS) && \
|
|
!defined(NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION)
|
|
if (tsip_useable(ssl)) {
|
|
ret = wc_tsip_AesCbcEncrypt(ssl->encrypt.aes, out, input, sz);
|
|
} else
|
|
#endif
|
|
ret = wc_AesCbcEncrypt(ssl->encrypt.aes, out, input, sz);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E && asyncOkay) {
|
|
ret = wolfSSL_AsyncPush(ssl, asyncDev);
|
|
}
|
|
#endif
|
|
break;
|
|
#endif
|
|
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
case wolfssl_aes_gcm:
|
|
case wolfssl_aes_ccm:/* GCM AEAD macros use same size as CCM */
|
|
{
|
|
AES_AUTH_ENCRYPT_FUNC aes_auth_fn;
|
|
const byte* additionalSrc;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
asyncDev = &ssl->encrypt.aes->asyncDev;
|
|
ret = wolfSSL_AsyncInit(ssl, asyncDev, event_flags);
|
|
if (ret != 0)
|
|
break;
|
|
#endif
|
|
|
|
#if defined(BUILD_AESGCM) && defined(HAVE_AESCCM)
|
|
aes_auth_fn = (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm)
|
|
? AES_GCM_ENCRYPT : AES_CCM_ENCRYPT;
|
|
#elif defined(BUILD_AESGCM)
|
|
aes_auth_fn = AES_GCM_ENCRYPT;
|
|
#else
|
|
aes_auth_fn = AES_CCM_ENCRYPT;
|
|
#endif
|
|
additionalSrc = input - 5;
|
|
|
|
XMEMSET(ssl->encrypt.additional, 0, AEAD_AUTH_DATA_SZ);
|
|
|
|
/* sequence number field is 64-bits */
|
|
WriteSEQ(ssl, CUR_ORDER, ssl->encrypt.additional);
|
|
|
|
/* Store the type, version. Unfortunately, they are in
|
|
* the input buffer ahead of the plaintext. */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
additionalSrc -= DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
XMEMCPY(ssl->encrypt.additional + AEAD_TYPE_OFFSET,
|
|
additionalSrc, 3);
|
|
|
|
/* Store the length of the plain text minus the explicit
|
|
* IV length minus the authentication tag size. */
|
|
c16toa(sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
|
|
ssl->encrypt.additional + AEAD_LEN_OFFSET);
|
|
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
|
|
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
|
|
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
|
|
XMEMCPY(ssl->encrypt.nonce,
|
|
ssl->keys.aead_enc_imp_IV, AESGCM_IMP_IV_SZ);
|
|
XMEMCPY(ssl->encrypt.nonce + AESGCM_IMP_IV_SZ,
|
|
ssl->keys.aead_exp_IV, AESGCM_EXP_IV_SZ);
|
|
#endif
|
|
ret = aes_auth_fn(ssl->encrypt.aes,
|
|
out + AESGCM_EXP_IV_SZ, input + AESGCM_EXP_IV_SZ,
|
|
sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
|
|
ssl->encrypt.nonce, AESGCM_NONCE_SZ,
|
|
out + sz - ssl->specs.aead_mac_size,
|
|
ssl->specs.aead_mac_size,
|
|
ssl->encrypt.additional, AEAD_AUTH_DATA_SZ);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E && asyncOkay) {
|
|
ret = wolfSSL_AsyncPush(ssl, asyncDev);
|
|
}
|
|
#endif
|
|
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
|
|
((!defined(HAVE_FIPS) && !defined(HAVE_SELFTEST)) || \
|
|
(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 2)))
|
|
XMEMCPY(out,
|
|
ssl->encrypt.nonce + AESGCM_IMP_IV_SZ, AESGCM_EXP_IV_SZ);
|
|
#endif
|
|
}
|
|
break;
|
|
#endif /* BUILD_AESGCM || HAVE_AESCCM */
|
|
|
|
#ifdef HAVE_CAMELLIA
|
|
case wolfssl_camellia:
|
|
ret = wc_CamelliaCbcEncrypt(ssl->encrypt.cam, out, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef HAVE_HC128
|
|
case wolfssl_hc128:
|
|
ret = wc_Hc128_Process(ssl->encrypt.hc128, out, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef BUILD_RABBIT
|
|
case wolfssl_rabbit:
|
|
ret = wc_RabbitProcess(ssl->encrypt.rabbit, out, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
|
|
case wolfssl_chacha:
|
|
ret = ChachaAEADEncrypt(ssl, out, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef HAVE_NULL_CIPHER
|
|
case wolfssl_cipher_null:
|
|
if (input != out) {
|
|
XMEMMOVE(out, input, sz);
|
|
}
|
|
break;
|
|
#endif
|
|
|
|
#ifdef HAVE_IDEA
|
|
case wolfssl_idea:
|
|
ret = wc_IdeaCbcEncrypt(ssl->encrypt.idea, out, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
default:
|
|
WOLFSSL_MSG("wolfSSL Encrypt programming error");
|
|
ret = ENCRYPT_ERROR;
|
|
}
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* if async is not okay, then block */
|
|
if (ret == WC_PENDING_E && !asyncOkay) {
|
|
ret = wc_AsyncWait(ret, asyncDev, event_flags);
|
|
}
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
static WC_INLINE int Encrypt(WOLFSSL* ssl, byte* out, const byte* input, word16 sz,
|
|
int asyncOkay)
|
|
{
|
|
int ret = 0;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ssl->error == WC_PENDING_E) {
|
|
ssl->error = 0; /* clear async */
|
|
}
|
|
#endif
|
|
|
|
switch (ssl->encrypt.state) {
|
|
case CIPHER_STATE_BEGIN:
|
|
{
|
|
if (ssl->encrypt.setup == 0) {
|
|
WOLFSSL_MSG("Encrypt ciphers not setup");
|
|
return ENCRYPT_ERROR;
|
|
}
|
|
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb)
|
|
ssl->fuzzerCb(ssl, input, sz, FUZZ_ENCRYPT, ssl->fuzzerCtx);
|
|
#endif
|
|
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
/* make sure AES GCM/CCM memory is allocated */
|
|
/* free for these happens in FreeCiphers */
|
|
if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm ||
|
|
ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm) {
|
|
/* make sure auth iv and auth are allocated */
|
|
if (ssl->encrypt.additional == NULL)
|
|
ssl->encrypt.additional = (byte*)XMALLOC(AEAD_AUTH_DATA_SZ,
|
|
ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
if (ssl->encrypt.nonce == NULL)
|
|
ssl->encrypt.nonce = (byte*)XMALLOC(AESGCM_NONCE_SZ,
|
|
ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
if (ssl->encrypt.additional == NULL ||
|
|
ssl->encrypt.nonce == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
}
|
|
#endif /* BUILD_AESGCM || HAVE_AESCCM */
|
|
|
|
/* Advance state and proceed */
|
|
ssl->encrypt.state = CIPHER_STATE_DO;
|
|
}
|
|
FALL_THROUGH;
|
|
|
|
case CIPHER_STATE_DO:
|
|
{
|
|
ret = EncryptDo(ssl, out, input, sz, asyncOkay);
|
|
|
|
/* Advance state */
|
|
ssl->encrypt.state = CIPHER_STATE_END;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* If pending, then leave and return will resume below */
|
|
if (ret == WC_PENDING_E) {
|
|
return ret;
|
|
}
|
|
#endif
|
|
}
|
|
FALL_THROUGH;
|
|
|
|
case CIPHER_STATE_END:
|
|
{
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm ||
|
|
ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm)
|
|
{
|
|
/* finalize authentication cipher */
|
|
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
|
|
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
|
|
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)))
|
|
AeadIncrementExpIV(ssl);
|
|
#endif
|
|
if (ssl->encrypt.nonce)
|
|
ForceZero(ssl->encrypt.nonce, AESGCM_NONCE_SZ);
|
|
}
|
|
#endif /* BUILD_AESGCM || HAVE_AESCCM */
|
|
break;
|
|
}
|
|
}
|
|
|
|
/* Reset state */
|
|
ssl->encrypt.state = CIPHER_STATE_BEGIN;
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
static WC_INLINE int DecryptDo(WOLFSSL* ssl, byte* plain, const byte* input,
|
|
word16 sz)
|
|
{
|
|
int ret = 0;
|
|
|
|
(void)plain;
|
|
(void)input;
|
|
(void)sz;
|
|
|
|
switch (ssl->specs.bulk_cipher_algorithm)
|
|
{
|
|
#ifdef BUILD_ARC4
|
|
case wolfssl_rc4:
|
|
wc_Arc4Process(ssl->decrypt.arc4, plain, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef BUILD_DES3
|
|
case wolfssl_triple_des:
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &ssl->decrypt.des3->asyncDev,
|
|
WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
break;
|
|
#endif
|
|
|
|
ret = wc_Des3_CbcDecrypt(ssl->decrypt.des3, plain, input, sz);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &ssl->decrypt.des3->asyncDev);
|
|
}
|
|
#endif
|
|
break;
|
|
#endif
|
|
|
|
#if defined(BUILD_AES) && defined(HAVE_AES_CBC)
|
|
case wolfssl_aes:
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &ssl->decrypt.aes->asyncDev,
|
|
WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
break;
|
|
#endif
|
|
#if defined(WOLFSSL_RENESAS_TSIP_TLS) && \
|
|
!defined(NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION)
|
|
if (tsip_useable(ssl)) {
|
|
ret = wc_tsip_AesCbcDecrypt(ssl->decrypt.aes, plain, input, sz);
|
|
} else
|
|
#endif
|
|
ret = wc_AesCbcDecrypt(ssl->decrypt.aes, plain, input, sz);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &ssl->decrypt.aes->asyncDev);
|
|
}
|
|
#endif
|
|
break;
|
|
#endif
|
|
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
case wolfssl_aes_gcm:
|
|
case wolfssl_aes_ccm: /* GCM AEAD macros use same size as CCM */
|
|
{
|
|
wc_AesAuthDecryptFunc aes_auth_fn;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* initialize event */
|
|
ret = wolfSSL_AsyncInit(ssl, &ssl->decrypt.aes->asyncDev,
|
|
WC_ASYNC_FLAG_CALL_AGAIN);
|
|
if (ret != 0)
|
|
break;
|
|
#endif
|
|
|
|
#if defined(BUILD_AESGCM) && defined(HAVE_AESCCM)
|
|
aes_auth_fn = (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm)
|
|
? wc_AesGcmDecrypt : wc_AesCcmDecrypt;
|
|
#elif defined(BUILD_AESGCM)
|
|
aes_auth_fn = wc_AesGcmDecrypt;
|
|
#else
|
|
aes_auth_fn = wc_AesCcmDecrypt;
|
|
#endif
|
|
|
|
XMEMSET(ssl->decrypt.additional, 0, AEAD_AUTH_DATA_SZ);
|
|
|
|
/* sequence number field is 64-bits */
|
|
WriteSEQ(ssl, PEER_ORDER, ssl->decrypt.additional);
|
|
|
|
ssl->decrypt.additional[AEAD_TYPE_OFFSET] = ssl->curRL.type;
|
|
ssl->decrypt.additional[AEAD_VMAJ_OFFSET] = ssl->curRL.pvMajor;
|
|
ssl->decrypt.additional[AEAD_VMIN_OFFSET] = ssl->curRL.pvMinor;
|
|
|
|
c16toa(sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
|
|
ssl->decrypt.additional + AEAD_LEN_OFFSET);
|
|
|
|
#if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION)
|
|
if (ssl->options.dtls && IsDtlsMsgSCRKeys(ssl))
|
|
XMEMCPY(ssl->decrypt.nonce,
|
|
ssl->secure_renegotiation->tmp_keys.aead_dec_imp_IV,
|
|
AESGCM_IMP_IV_SZ);
|
|
else
|
|
#endif
|
|
XMEMCPY(ssl->decrypt.nonce, ssl->keys.aead_dec_imp_IV,
|
|
AESGCM_IMP_IV_SZ);
|
|
XMEMCPY(ssl->decrypt.nonce + AESGCM_IMP_IV_SZ, input,
|
|
AESGCM_EXP_IV_SZ);
|
|
if ((ret = aes_auth_fn(ssl->decrypt.aes,
|
|
plain + AESGCM_EXP_IV_SZ,
|
|
input + AESGCM_EXP_IV_SZ,
|
|
sz - AESGCM_EXP_IV_SZ - ssl->specs.aead_mac_size,
|
|
ssl->decrypt.nonce, AESGCM_NONCE_SZ,
|
|
input + sz - ssl->specs.aead_mac_size,
|
|
ssl->specs.aead_mac_size,
|
|
ssl->decrypt.additional, AEAD_AUTH_DATA_SZ)) < 0) {
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wolfSSL_AsyncPush(ssl, &ssl->decrypt.aes->asyncDev);
|
|
}
|
|
#endif
|
|
}
|
|
}
|
|
break;
|
|
#endif /* BUILD_AESGCM || HAVE_AESCCM */
|
|
|
|
#ifdef HAVE_CAMELLIA
|
|
case wolfssl_camellia:
|
|
ret = wc_CamelliaCbcDecrypt(ssl->decrypt.cam, plain, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef HAVE_HC128
|
|
case wolfssl_hc128:
|
|
ret = wc_Hc128_Process(ssl->decrypt.hc128, plain, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef BUILD_RABBIT
|
|
case wolfssl_rabbit:
|
|
ret = wc_RabbitProcess(ssl->decrypt.rabbit, plain, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
|
|
case wolfssl_chacha:
|
|
ret = ChachaAEADDecrypt(ssl, plain, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
#ifdef HAVE_NULL_CIPHER
|
|
case wolfssl_cipher_null:
|
|
if (input != plain) {
|
|
XMEMMOVE(plain, input, sz);
|
|
}
|
|
break;
|
|
#endif
|
|
|
|
#ifdef HAVE_IDEA
|
|
case wolfssl_idea:
|
|
ret = wc_IdeaCbcDecrypt(ssl->decrypt.idea, plain, input, sz);
|
|
break;
|
|
#endif
|
|
|
|
default:
|
|
WOLFSSL_MSG("wolfSSL Decrypt programming error");
|
|
ret = DECRYPT_ERROR;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
static WC_INLINE int Decrypt(WOLFSSL* ssl, byte* plain, const byte* input,
|
|
word16 sz)
|
|
{
|
|
int ret = 0;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->decrypt.state);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* check for still pending */
|
|
if (ret == WC_PENDING_E)
|
|
return ret;
|
|
|
|
ssl->error = 0; /* clear async */
|
|
|
|
/* let failures through so CIPHER_STATE_END logic is run */
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->decrypt.state = CIPHER_STATE_BEGIN;
|
|
}
|
|
|
|
switch (ssl->decrypt.state) {
|
|
case CIPHER_STATE_BEGIN:
|
|
{
|
|
if (ssl->decrypt.setup == 0) {
|
|
WOLFSSL_MSG("Decrypt ciphers not setup");
|
|
return DECRYPT_ERROR;
|
|
}
|
|
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
/* make sure AES GCM/CCM memory is allocated */
|
|
/* free for these happens in FreeCiphers */
|
|
if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm ||
|
|
ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm) {
|
|
/* make sure auth iv and auth are allocated */
|
|
if (ssl->decrypt.additional == NULL)
|
|
ssl->decrypt.additional = (byte*)XMALLOC(AEAD_AUTH_DATA_SZ,
|
|
ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
if (ssl->decrypt.nonce == NULL)
|
|
ssl->decrypt.nonce = (byte*)XMALLOC(AESGCM_NONCE_SZ,
|
|
ssl->heap, DYNAMIC_TYPE_AES_BUFFER);
|
|
if (ssl->decrypt.additional == NULL ||
|
|
ssl->decrypt.nonce == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
}
|
|
#endif /* BUILD_AESGCM || HAVE_AESCCM */
|
|
|
|
/* Advance state and proceed */
|
|
ssl->decrypt.state = CIPHER_STATE_DO;
|
|
}
|
|
FALL_THROUGH;
|
|
case CIPHER_STATE_DO:
|
|
{
|
|
#if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION)
|
|
if (ssl->options.dtls && DtlsSCRKeysSet(ssl)) {
|
|
/* For epochs >1 the current cipher parameters are located in
|
|
* ssl->secure_renegotiation->tmp_keys. Previous cipher
|
|
* parameters and for epoch 1 use ssl->keys */
|
|
if (ssl->keys.curEpoch ==
|
|
ssl->secure_renegotiation->tmp_keys.dtls_epoch) {
|
|
if (ssl->decrypt.src != SCR) {
|
|
ssl->secure_renegotiation->cache_status =
|
|
SCR_CACHE_NEEDED;
|
|
if ((ret = SetKeysSide(ssl, DECRYPT_SIDE_ONLY)) != 0)
|
|
break;
|
|
}
|
|
}
|
|
else {
|
|
if (ssl->decrypt.src != KEYS) {
|
|
ssl->secure_renegotiation->cache_status =
|
|
SCR_CACHE_NULL;
|
|
if ((ret = SetKeysSide(ssl, DECRYPT_SIDE_ONLY)) != 0)
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
|
|
ret = DecryptDo(ssl, plain, input, sz);
|
|
|
|
/* Advance state */
|
|
ssl->decrypt.state = CIPHER_STATE_END;
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* If pending, leave and return below */
|
|
if (ret == WC_PENDING_E) {
|
|
return ret;
|
|
}
|
|
#endif
|
|
}
|
|
FALL_THROUGH;
|
|
case CIPHER_STATE_END:
|
|
{
|
|
#if defined(BUILD_AESGCM) || defined(HAVE_AESCCM)
|
|
/* make sure AES GCM/CCM nonce is cleared */
|
|
if (ssl->specs.bulk_cipher_algorithm == wolfssl_aes_ccm ||
|
|
ssl->specs.bulk_cipher_algorithm == wolfssl_aes_gcm) {
|
|
if (ssl->decrypt.nonce)
|
|
ForceZero(ssl->decrypt.nonce, AESGCM_NONCE_SZ);
|
|
|
|
if (ret < 0)
|
|
ret = VERIFY_MAC_ERROR;
|
|
}
|
|
#endif /* BUILD_AESGCM || HAVE_AESCCM */
|
|
break;
|
|
}
|
|
}
|
|
|
|
/* Reset state */
|
|
ssl->decrypt.state = CIPHER_STATE_BEGIN;
|
|
|
|
/* handle mac error case */
|
|
if (ret == VERIFY_MAC_ERROR) {
|
|
if (!ssl->options.dtls)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
|
|
#ifdef WOLFSSL_DTLS_DROP_STATS
|
|
ssl->macDropCount++;
|
|
#endif /* WOLFSSL_DTLS_DROP_STATS */
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
/* Check conditions for a cipher to have an explicit IV.
|
|
*
|
|
* ssl The SSL/TLS object.
|
|
* returns 1 if the cipher in use has an explicit IV and 0 otherwise.
|
|
*/
|
|
static WC_INLINE int CipherHasExpIV(WOLFSSL *ssl)
|
|
{
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3)
|
|
return 0;
|
|
#endif
|
|
return (ssl->specs.cipher_type == aead) &&
|
|
(ssl->specs.bulk_cipher_algorithm != wolfssl_chacha);
|
|
}
|
|
|
|
/* check cipher text size for sanity */
|
|
static int SanityCheckCipherText(WOLFSSL* ssl, word32 encryptSz)
|
|
{
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
word32 minLength = ssl->truncated_hmac ? (byte)TRUNCATED_HMAC_SZ
|
|
: ssl->specs.hash_size;
|
|
#else
|
|
word32 minLength = ssl->specs.hash_size; /* covers stream */
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (ssl->specs.cipher_type == block) {
|
|
#ifdef HAVE_ENCRYPT_THEN_MAC
|
|
if (ssl->options.startedETMRead) {
|
|
if ((encryptSz - MacSize(ssl)) % ssl->specs.block_size) {
|
|
WOLFSSL_MSG("Block ciphertext not block size");
|
|
return SANITY_CIPHER_E;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
if (encryptSz % ssl->specs.block_size) {
|
|
WOLFSSL_MSG("Block ciphertext not block size");
|
|
return SANITY_CIPHER_E;
|
|
}
|
|
|
|
minLength++; /* pad byte */
|
|
|
|
if (ssl->specs.block_size > minLength)
|
|
minLength = ssl->specs.block_size;
|
|
|
|
if (ssl->options.tls1_1)
|
|
minLength += ssl->specs.block_size; /* explicit IV */
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->specs.cipher_type == aead) {
|
|
minLength = ssl->specs.aead_mac_size; /* authTag size */
|
|
if (CipherHasExpIV(ssl))
|
|
minLength += AESGCM_EXP_IV_SZ; /* explicit IV */
|
|
}
|
|
|
|
if (encryptSz < minLength) {
|
|
WOLFSSL_MSG("Ciphertext not minimum size");
|
|
return SANITY_CIPHER_E;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
/* check all length bytes for the pad value, return 0 on success */
|
|
static int PadCheck(const byte* a, byte pad, int length)
|
|
{
|
|
int i;
|
|
int compareSum = 0;
|
|
|
|
for (i = 0; i < length; i++) {
|
|
compareSum |= a[i] ^ pad;
|
|
}
|
|
|
|
return compareSum;
|
|
}
|
|
|
|
|
|
/* Mask the padding bytes with the expected values.
|
|
* Constant time implementation - does maximum pad size possible.
|
|
*
|
|
* data Message data.
|
|
* sz Size of the message including MAC and padding and padding length.
|
|
* macSz Size of the MAC.
|
|
* returns 0 on success, otherwise failure.
|
|
*/
|
|
static byte MaskPadding(const byte* data, int sz, int macSz)
|
|
{
|
|
int i;
|
|
int checkSz = sz - 1;
|
|
byte paddingSz = data[sz - 1];
|
|
byte mask;
|
|
byte good = ctMaskGT(paddingSz, sz - 1 - macSz);
|
|
|
|
if (checkSz > TLS_MAX_PAD_SZ)
|
|
checkSz = TLS_MAX_PAD_SZ;
|
|
|
|
for (i = 0; i < checkSz; i++) {
|
|
mask = ctMaskLTE(i, paddingSz);
|
|
good |= mask & (data[sz - 1 - i] ^ paddingSz);
|
|
}
|
|
|
|
return good;
|
|
}
|
|
|
|
/* Mask the MAC in the message with the MAC calculated.
|
|
* Constant time implementation - starts looking for MAC where maximum padding
|
|
* size has it.
|
|
*
|
|
* data Message data.
|
|
* sz Size of the message including MAC and padding and padding length.
|
|
* macSz Size of the MAC data.
|
|
* expMac Expected MAC value.
|
|
* returns 0 on success, otherwise failure.
|
|
*/
|
|
static byte MaskMac(const byte* data, int sz, int macSz, byte* expMac)
|
|
{
|
|
int i, j;
|
|
unsigned char mac[WC_MAX_DIGEST_SIZE];
|
|
int scanStart = sz - 1 - TLS_MAX_PAD_SZ - macSz;
|
|
int macEnd = sz - 1 - data[sz - 1];
|
|
int macStart = macEnd - macSz;
|
|
int r = 0;
|
|
unsigned char started, notEnded;
|
|
unsigned char good = 0;
|
|
|
|
scanStart &= ctMaskIntGTE(scanStart, 0);
|
|
macStart &= ctMaskIntGTE(macStart, 0);
|
|
|
|
/* Div on Intel has different speeds depending on value.
|
|
* Use a bitwise AND or mod a specific value (converted to mul). */
|
|
if ((macSz & (macSz - 1)) == 0)
|
|
r = (macSz - (scanStart - macStart)) & (macSz - 1);
|
|
#ifndef NO_SHA
|
|
else if (macSz == WC_SHA_DIGEST_SIZE)
|
|
r = (macSz - (scanStart - macStart)) % WC_SHA_DIGEST_SIZE;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
else if (macSz == WC_SHA384_DIGEST_SIZE)
|
|
r = (macSz - (scanStart - macStart)) % WC_SHA384_DIGEST_SIZE;
|
|
#endif
|
|
|
|
XMEMSET(mac, 0, macSz);
|
|
for (i = scanStart; i < sz; i += macSz) {
|
|
for (j = 0; j < macSz && j + i < sz; j++) {
|
|
started = ctMaskGTE(i + j, macStart);
|
|
notEnded = ctMaskLT(i + j, macEnd);
|
|
mac[j] |= started & notEnded & data[i + j];
|
|
}
|
|
}
|
|
|
|
if ((macSz & (macSz - 1)) == 0) {
|
|
for (i = 0; i < macSz; i++)
|
|
good |= expMac[i] ^ mac[(i + r) & (macSz - 1)];
|
|
}
|
|
#ifndef NO_SHA
|
|
else if (macSz == WC_SHA_DIGEST_SIZE) {
|
|
for (i = 0; i < macSz; i++)
|
|
good |= expMac[i] ^ mac[(i + r) % WC_SHA_DIGEST_SIZE];
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
else if (macSz == WC_SHA384_DIGEST_SIZE) {
|
|
for (i = 0; i < macSz; i++)
|
|
good |= expMac[i] ^ mac[(i + r) % WC_SHA384_DIGEST_SIZE];
|
|
}
|
|
#endif
|
|
|
|
return good;
|
|
}
|
|
|
|
/* timing resistant pad/verify check, return 0 on success */
|
|
int TimingPadVerify(WOLFSSL* ssl, const byte* input, int padLen, int macSz,
|
|
int pLen, int content)
|
|
{
|
|
byte verify[WC_MAX_DIGEST_SIZE];
|
|
byte good;
|
|
int ret = 0;
|
|
|
|
good = MaskPadding(input, pLen, macSz);
|
|
/* 4th argument has potential to underflow, ssl->hmac function should
|
|
* either increment the size by (macSz + padLen + 1) before use or check on
|
|
* the size to make sure is valid. */
|
|
ret = ssl->hmac(ssl, verify, input, pLen - macSz - padLen - 1, padLen,
|
|
content, 1, PEER_ORDER);
|
|
good |= MaskMac(input, pLen, ssl->specs.hash_size, verify);
|
|
|
|
/* Non-zero on failure. */
|
|
good = (byte)~(word32)good;
|
|
good &= good >> 4;
|
|
good &= good >> 2;
|
|
good &= good >> 1;
|
|
/* Make ret negative on masking failure. */
|
|
ret -= 1 - good;
|
|
|
|
/* Treat any failure as verify MAC error. */
|
|
if (ret != 0)
|
|
ret = VERIFY_MAC_ERROR;
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
|
|
int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx)
|
|
{
|
|
word32 msgSz = ssl->keys.encryptSz;
|
|
word32 idx = *inOutIdx;
|
|
int dataSz;
|
|
int ivExtra = 0;
|
|
byte* rawData = input + idx; /* keep current for hmac */
|
|
#ifdef HAVE_LIBZ
|
|
byte decomp[MAX_RECORD_SIZE + MAX_COMP_EXTRA];
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->options.tls1_3 && ssl->options.handShakeDone == 0) {
|
|
int process = 0;
|
|
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
ssl->earlyDataSz += ssl->curSize;
|
|
if ((ssl->earlyData != no_early_data) &&
|
|
(ssl->options.clientState == CLIENT_HELLO_COMPLETE)) {
|
|
process = 1;
|
|
}
|
|
if (!process && (ssl->earlyDataSz <= ssl->options.maxEarlyDataSz)) {
|
|
WOLFSSL_MSG("Ignoring EarlyData!");
|
|
*inOutIdx = ssl->buffers.inputBuffer.length;
|
|
return 0;
|
|
}
|
|
if (ssl->earlyDataSz > ssl->options.maxEarlyDataSz) {
|
|
WOLFSSL_MSG("Too much EarlyData!");
|
|
process = 0;
|
|
}
|
|
}
|
|
if (!process) {
|
|
WOLFSSL_MSG("Received App data before a handshake completed");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->options.handShakeDone == 0) {
|
|
WOLFSSL_MSG("Received App data before a handshake completed");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return OUT_OF_ORDER_E;
|
|
}
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (ssl->specs.cipher_type == block) {
|
|
if (ssl->options.tls1_1)
|
|
ivExtra = ssl->specs.block_size;
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->specs.cipher_type == aead) {
|
|
if (CipherHasExpIV(ssl))
|
|
ivExtra = AESGCM_EXP_IV_SZ;
|
|
}
|
|
|
|
dataSz = msgSz - ivExtra - ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
dataSz -= MacSize(ssl);
|
|
#endif
|
|
if (dataSz < 0) {
|
|
WOLFSSL_MSG("App data buffer error, malicious input?");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return BUFFER_ERROR;
|
|
}
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->earlyData > early_data_ext) {
|
|
if (ssl->earlyDataSz + dataSz > ssl->options.maxEarlyDataSz) {
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return WOLFSSL_FATAL_ERROR;
|
|
}
|
|
ssl->earlyDataSz += dataSz;
|
|
}
|
|
#endif
|
|
|
|
/* read data */
|
|
if (dataSz) {
|
|
int rawSz = dataSz; /* keep raw size for idx adjustment */
|
|
|
|
#ifdef HAVE_LIBZ
|
|
if (ssl->options.usingCompression) {
|
|
dataSz = myDeCompress(ssl, rawData, dataSz, decomp, sizeof(decomp));
|
|
if (dataSz < 0) return dataSz;
|
|
}
|
|
#endif
|
|
idx += rawSz;
|
|
|
|
ssl->buffers.clearOutputBuffer.buffer = rawData;
|
|
ssl->buffers.clearOutputBuffer.length = dataSz;
|
|
}
|
|
|
|
idx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
idx += MacSize(ssl);
|
|
#endif
|
|
|
|
#ifdef HAVE_LIBZ
|
|
/* decompress could be bigger, overwrite after verify */
|
|
if (ssl->options.usingCompression)
|
|
XMEMMOVE(rawData, decomp, dataSz);
|
|
#endif
|
|
|
|
*inOutIdx = idx;
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (IsSCR(ssl)) {
|
|
/* Reset the processReply state since
|
|
* we finished processing this message. */
|
|
ssl->options.processReply = doProcessInit;
|
|
/* If we are in a secure renegotiation then APP DATA is treated
|
|
* differently */
|
|
return APP_DATA_READY;
|
|
}
|
|
#endif
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* process alert, return level */
|
|
static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type,
|
|
word32 totalSz)
|
|
{
|
|
byte level;
|
|
byte code;
|
|
word32 dataSz = totalSz - *inOutIdx;
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "Alert");
|
|
if (ssl->toInfoOn)
|
|
/* add record header back on to info + alert bytes level/code */
|
|
AddPacketInfo(ssl, "Alert", alert, input + *inOutIdx -
|
|
RECORD_HEADER_SZ, RECORD_HEADER_SZ + ALERT_SIZE,
|
|
READ_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
dataSz -= ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
dataSz -= MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
/* make sure can read the message */
|
|
if (dataSz != ALERT_SIZE) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
#endif
|
|
return BUFFER_E;
|
|
}
|
|
|
|
level = input[(*inOutIdx)++];
|
|
code = input[(*inOutIdx)++];
|
|
ssl->alert_history.last_rx.code = code;
|
|
ssl->alert_history.last_rx.level = level;
|
|
*type = code;
|
|
if (level == alert_fatal) {
|
|
ssl->options.isClosed = 1; /* Don't send close_notify */
|
|
}
|
|
|
|
if (++ssl->options.alertCount >= WOLFSSL_ALERT_COUNT_MAX) {
|
|
WOLFSSL_MSG("Alert count exceeded");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (level != alert_warning || code != close_notify)
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
#endif
|
|
return ALERT_COUNT_E;
|
|
}
|
|
|
|
WOLFSSL_MSG("Got alert");
|
|
if (*type == close_notify) {
|
|
WOLFSSL_MSG("\tclose notify");
|
|
ssl->options.closeNotify = 1;
|
|
}
|
|
#ifdef WOLFSSL_TLS13
|
|
if (*type == decode_error) {
|
|
WOLFSSL_MSG("\tdecode error");
|
|
}
|
|
if (*type == illegal_parameter) {
|
|
WOLFSSL_MSG("\tillegal parameter");
|
|
}
|
|
#endif
|
|
WOLFSSL_ERROR(*type);
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
*inOutIdx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
*inOutIdx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
return level;
|
|
}
|
|
|
|
static int GetInputData(WOLFSSL *ssl, word32 size)
|
|
{
|
|
int in;
|
|
int inSz;
|
|
int maxLength;
|
|
int usedLength;
|
|
int dtlsExtra = 0;
|
|
|
|
|
|
/* check max input length */
|
|
usedLength = ssl->buffers.inputBuffer.length - ssl->buffers.inputBuffer.idx;
|
|
maxLength = ssl->buffers.inputBuffer.bufferSize - usedLength;
|
|
inSz = (int)(size - usedLength); /* from last partial read */
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
if (size < ssl->dtls_expected_rx)
|
|
dtlsExtra = (int)(ssl->dtls_expected_rx - size);
|
|
inSz = ssl->dtls_expected_rx;
|
|
}
|
|
#endif
|
|
|
|
/* check that no lengths or size values are negative */
|
|
if (usedLength < 0 || maxLength < 0 || inSz <= 0) {
|
|
return BUFFER_ERROR;
|
|
}
|
|
|
|
if (inSz > maxLength) {
|
|
if (GrowInputBuffer(ssl, size + dtlsExtra, usedLength) < 0)
|
|
return MEMORY_E;
|
|
}
|
|
|
|
/* Put buffer data at start if not there */
|
|
if (usedLength > 0 && ssl->buffers.inputBuffer.idx != 0)
|
|
XMEMMOVE(ssl->buffers.inputBuffer.buffer,
|
|
ssl->buffers.inputBuffer.buffer + ssl->buffers.inputBuffer.idx,
|
|
usedLength);
|
|
|
|
/* remove processed data */
|
|
ssl->buffers.inputBuffer.idx = 0;
|
|
ssl->buffers.inputBuffer.length = usedLength;
|
|
|
|
/* read data from network */
|
|
do {
|
|
in = wolfSSLReceive(ssl,
|
|
ssl->buffers.inputBuffer.buffer +
|
|
ssl->buffers.inputBuffer.length,
|
|
inSz);
|
|
if (in == WANT_READ)
|
|
return WANT_READ;
|
|
|
|
if (in < 0)
|
|
return SOCKET_ERROR_E;
|
|
|
|
if (in > inSz)
|
|
return RECV_OVERFLOW_E;
|
|
|
|
ssl->buffers.inputBuffer.length += in;
|
|
inSz -= in;
|
|
|
|
} while (ssl->buffers.inputBuffer.length < size);
|
|
|
|
#ifdef WOLFSSL_DEBUG_TLS
|
|
if (ssl->buffers.inputBuffer.idx == 0) {
|
|
WOLFSSL_MSG("Data received");
|
|
WOLFSSL_BUFFER(ssl->buffers.inputBuffer.buffer,
|
|
ssl->buffers.inputBuffer.length);
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
}
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
static WC_INLINE int VerifyMacEnc(WOLFSSL* ssl, const byte* input, word32 msgSz,
|
|
int content)
|
|
{
|
|
int ret;
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
word32 digestSz = ssl->truncated_hmac ? (byte)TRUNCATED_HMAC_SZ
|
|
: ssl->specs.hash_size;
|
|
#else
|
|
word32 digestSz = ssl->specs.hash_size;
|
|
#endif
|
|
byte verify[WC_MAX_DIGEST_SIZE];
|
|
|
|
WOLFSSL_MSG("Verify MAC of Encrypted Data");
|
|
|
|
if (msgSz < digestSz) {
|
|
return VERIFY_MAC_ERROR;
|
|
}
|
|
|
|
ret = ssl->hmac(ssl, verify, input, msgSz - digestSz, -1, content, 1, PEER_ORDER);
|
|
ret |= ConstantCompare(verify, input + msgSz - digestSz, digestSz);
|
|
if (ret != 0) {
|
|
return VERIFY_MAC_ERROR;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
static WC_INLINE int VerifyMac(WOLFSSL* ssl, const byte* input, word32 msgSz,
|
|
int content, word32* padSz)
|
|
{
|
|
#if !defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_AEAD_ONLY)
|
|
int ivExtra = 0;
|
|
int ret;
|
|
word32 pad = 0;
|
|
word32 padByte = 0;
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
word32 digestSz = ssl->truncated_hmac ? (byte)TRUNCATED_HMAC_SZ
|
|
: ssl->specs.hash_size;
|
|
#else
|
|
word32 digestSz = ssl->specs.hash_size;
|
|
#endif
|
|
byte verify[WC_MAX_DIGEST_SIZE];
|
|
|
|
|
|
if (ssl->specs.cipher_type == block) {
|
|
if (ssl->options.tls1_1)
|
|
ivExtra = ssl->specs.block_size;
|
|
pad = *(input + msgSz - ivExtra - 1);
|
|
padByte = 1;
|
|
|
|
if (ssl->options.tls) {
|
|
ret = TimingPadVerify(ssl, input, pad, digestSz, msgSz - ivExtra,
|
|
content);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
else { /* sslv3, some implementations have bad padding, but don't
|
|
* allow bad read */
|
|
int badPadLen = 0;
|
|
byte dmy[sizeof(WOLFSSL) >= MAX_PAD_SIZE ? 1 : MAX_PAD_SIZE] = {0};
|
|
byte* dummy = sizeof(dmy) < MAX_PAD_SIZE ? (byte*) ssl : dmy;
|
|
|
|
(void)dmy;
|
|
|
|
if (pad > (msgSz - digestSz - 1)) {
|
|
WOLFSSL_MSG("Plain Len not long enough for pad/mac");
|
|
pad = 0; /* no bad read */
|
|
badPadLen = 1;
|
|
}
|
|
PadCheck(dummy, (byte)pad, MAX_PAD_SIZE); /* timing only */
|
|
ret = ssl->hmac(ssl, verify, input, msgSz - digestSz - pad - 1,
|
|
pad, content, 1, PEER_ORDER);
|
|
if (ConstantCompare(verify, input + msgSz - digestSz - pad - 1,
|
|
digestSz) != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
if (ret != 0 || badPadLen)
|
|
return VERIFY_MAC_ERROR;
|
|
}
|
|
}
|
|
else if (ssl->specs.cipher_type == stream) {
|
|
ret = ssl->hmac(ssl, verify, input, msgSz - digestSz, -1, content, 1,
|
|
PEER_ORDER);
|
|
if (ConstantCompare(verify, input + msgSz - digestSz, digestSz) != 0){
|
|
return VERIFY_MAC_ERROR;
|
|
}
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
}
|
|
#endif /* !WOLFSSL_NO_TLS12 && !WOLFSSL_AEAD_ONLY */
|
|
|
|
if (ssl->specs.cipher_type == aead) {
|
|
*padSz = ssl->specs.aead_mac_size;
|
|
}
|
|
#if !defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_AEAD_ONLY)
|
|
else {
|
|
*padSz = digestSz + pad + padByte;
|
|
}
|
|
#endif /* !WOLFSSL_NO_TLS12 && !WOLFSSL_AEAD_ONLY */
|
|
|
|
(void)input;
|
|
(void)msgSz;
|
|
(void)content;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
/* process input requests, return 0 is done, 1 is call again to complete, and
|
|
negative number is error */
|
|
int ProcessReply(WOLFSSL* ssl)
|
|
{
|
|
int ret = 0, type, readSz;
|
|
int atomicUser = 0;
|
|
word32 startIdx = 0;
|
|
#if defined(WOLFSSL_DTLS)
|
|
int used;
|
|
#endif
|
|
|
|
#ifdef ATOMIC_USER
|
|
if (ssl->ctx->DecryptVerifyCb)
|
|
atomicUser = 1;
|
|
#endif
|
|
|
|
if (ssl->error != 0 && ssl->error != WANT_READ && ssl->error != WANT_WRITE
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
&& ssl->error != APP_DATA_READY
|
|
#endif
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ssl->error != WC_PENDING_E
|
|
#endif
|
|
#ifdef WOLFSSL_NONBLOCK_OCSP
|
|
&& ssl->error != OCSP_WANT_READ
|
|
#endif
|
|
) {
|
|
WOLFSSL_MSG("ProcessReply retry in error state, not allowed");
|
|
return ssl->error;
|
|
}
|
|
|
|
#if defined(WOLFSSL_DTLS) && defined(WOLFSSL_ASYNC_CRYPT)
|
|
/* process any pending DTLS messages - this flow can happen with async */
|
|
if (ssl->dtls_rx_msg_list != NULL) {
|
|
ret = DtlsMsgDrain(ssl);
|
|
if (ret != 0) {
|
|
WOLFSSL_ERROR(ret);
|
|
return ret;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
for (;;) {
|
|
switch (ssl->options.processReply) {
|
|
|
|
/* in the WOLFSSL_SERVER case, get the first byte for detecting
|
|
* old client hello */
|
|
case doProcessInit:
|
|
|
|
readSz = RECORD_HEADER_SZ;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
readSz = DTLS_RECORD_HEADER_SZ;
|
|
#endif
|
|
|
|
/* get header or return error */
|
|
if (!ssl->options.dtls) {
|
|
if ((ret = GetInputData(ssl, readSz)) < 0)
|
|
return ret;
|
|
} else {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* read ahead may already have header */
|
|
used = ssl->buffers.inputBuffer.length -
|
|
ssl->buffers.inputBuffer.idx;
|
|
if (used < readSz) {
|
|
if ((ret = GetInputData(ssl, readSz)) < 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
#ifdef OLD_HELLO_ALLOWED
|
|
|
|
/* see if sending SSLv2 client hello */
|
|
if ( ssl->options.side == WOLFSSL_SERVER_END &&
|
|
ssl->options.clientState == NULL_STATE &&
|
|
ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx]
|
|
!= handshake) {
|
|
byte b0, b1;
|
|
|
|
ssl->options.processReply = runProcessOldClientHello;
|
|
|
|
/* sanity checks before getting size at front */
|
|
if (ssl->buffers.inputBuffer.buffer[
|
|
ssl->buffers.inputBuffer.idx + OPAQUE16_LEN] != OLD_HELLO_ID) {
|
|
WOLFSSL_MSG("Not a valid old client hello");
|
|
return PARSE_ERROR;
|
|
}
|
|
|
|
if (ssl->buffers.inputBuffer.buffer[
|
|
ssl->buffers.inputBuffer.idx + OPAQUE24_LEN] != SSLv3_MAJOR &&
|
|
ssl->buffers.inputBuffer.buffer[
|
|
ssl->buffers.inputBuffer.idx + OPAQUE24_LEN] != DTLS_MAJOR) {
|
|
WOLFSSL_MSG("Not a valid version in old client hello");
|
|
return PARSE_ERROR;
|
|
}
|
|
|
|
/* how many bytes need ProcessOldClientHello */
|
|
b0 =
|
|
ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx++];
|
|
b1 =
|
|
ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx++];
|
|
ssl->curSize = (word16)(((b0 & 0x7f) << 8) | b1);
|
|
}
|
|
else {
|
|
ssl->options.processReply = getRecordLayerHeader;
|
|
continue;
|
|
}
|
|
FALL_THROUGH;
|
|
|
|
/* in the WOLFSSL_SERVER case, run the old client hello */
|
|
case runProcessOldClientHello:
|
|
|
|
/* get sz bytes or return error */
|
|
if (!ssl->options.dtls) {
|
|
if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
|
|
return ret;
|
|
} else {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* read ahead may already have */
|
|
used = ssl->buffers.inputBuffer.length -
|
|
ssl->buffers.inputBuffer.idx;
|
|
if (used < ssl->curSize)
|
|
if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
|
|
return ret;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
|
|
ret = ProcessOldClientHello(ssl, ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx,
|
|
ssl->buffers.inputBuffer.length -
|
|
ssl->buffers.inputBuffer.idx,
|
|
ssl->curSize);
|
|
if (ret < 0)
|
|
return ret;
|
|
|
|
else if (ssl->buffers.inputBuffer.idx ==
|
|
ssl->buffers.inputBuffer.length) {
|
|
ssl->options.processReply = doProcessInit;
|
|
return 0;
|
|
}
|
|
|
|
#endif /* OLD_HELLO_ALLOWED */
|
|
FALL_THROUGH;
|
|
|
|
/* get the record layer header */
|
|
case getRecordLayerHeader:
|
|
|
|
ret = GetRecordHeader(ssl, ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx,
|
|
&ssl->curRL, &ssl->curSize);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls && ret == SEQUENCE_ERROR) {
|
|
WOLFSSL_MSG("Silently dropping out of order DTLS message");
|
|
ssl->options.processReply = doProcessInit;
|
|
ssl->buffers.inputBuffer.length = 0;
|
|
ssl->buffers.inputBuffer.idx = 0;
|
|
#ifdef WOLFSSL_DTLS_DROP_STATS
|
|
ssl->replayDropCount++;
|
|
#endif /* WOLFSSL_DTLS_DROP_STATS */
|
|
|
|
continue;
|
|
}
|
|
#endif
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version) && IsEncryptionOn(ssl, 0) &&
|
|
ssl->curRL.type != application_data &&
|
|
ssl->curRL.type != change_cipher_spec) {
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return PARSE_ERROR;
|
|
}
|
|
#endif
|
|
|
|
ssl->options.processReply = getData;
|
|
FALL_THROUGH;
|
|
|
|
/* retrieve record layer data */
|
|
case getData:
|
|
|
|
/* get sz bytes or return error */
|
|
if (!ssl->options.dtls) {
|
|
if ((ret = GetInputData(ssl, ssl->curSize)) < 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret != WANT_READ)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
#endif
|
|
return ret;
|
|
}
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* read ahead may already have */
|
|
used = ssl->buffers.inputBuffer.length -
|
|
ssl->buffers.inputBuffer.idx;
|
|
if (used < ssl->curSize)
|
|
if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
|
|
return ret;
|
|
#endif
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
#if defined(WOLFSSL_TLS13) || defined(WOLFSSL_EXTRA_ALERTS)
|
|
int tooLong = 0;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version)) {
|
|
tooLong = ssl->curSize > MAX_TLS13_ENC_SZ;
|
|
tooLong |= ssl->curSize - ssl->specs.aead_mac_size >
|
|
MAX_TLS13_PLAIN_SZ;
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (!IsAtLeastTLSv1_3(ssl->version))
|
|
tooLong = ssl->curSize > MAX_TLS_CIPHER_SZ;
|
|
#endif
|
|
#if defined(WOLFSSL_TLS13) || defined(WOLFSSL_EXTRA_ALERTS)
|
|
if (tooLong) {
|
|
WOLFSSL_MSG("Encrypted data too long");
|
|
SendAlert(ssl, alert_fatal, record_overflow);
|
|
return BUFFER_ERROR;
|
|
}
|
|
#endif
|
|
}
|
|
ssl->keys.padSz = 0;
|
|
|
|
ssl->options.processReply = verifyEncryptedMessage;
|
|
startIdx = ssl->buffers.inputBuffer.idx; /* in case > 1 msg per */
|
|
FALL_THROUGH;
|
|
|
|
/* verify digest of encrypted message */
|
|
case verifyEncryptedMessage:
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (IsEncryptionOn(ssl, 0) && ssl->keys.decryptedCur == 0 &&
|
|
!atomicUser && ssl->options.startedETMRead) {
|
|
ret = VerifyMacEnc(ssl, ssl->buffers.inputBuffer.buffer +
|
|
ssl->buffers.inputBuffer.idx,
|
|
ssl->curSize, ssl->curRL.type);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
return ret;
|
|
#endif
|
|
if (ret < 0) {
|
|
WOLFSSL_MSG("VerifyMacEnc failed");
|
|
WOLFSSL_ERROR(ret);
|
|
#ifdef WOLFSSL_DTLS
|
|
/* If in DTLS mode, if the decrypt fails for any
|
|
* reason, pretend the datagram never happened. */
|
|
if (ssl->options.dtls) {
|
|
ssl->options.processReply = doProcessInit;
|
|
ssl->buffers.inputBuffer.idx =
|
|
ssl->buffers.inputBuffer.length;
|
|
#ifdef WOLFSSL_DTLS_DROP_STATS
|
|
ssl->macDropCount++;
|
|
#endif /* WOLFSSL_DTLS_DROP_STATS */
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (!ssl->options.dtls)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
#endif
|
|
return DECRYPT_ERROR;
|
|
}
|
|
ssl->keys.encryptSz = ssl->curSize;
|
|
}
|
|
#endif
|
|
ssl->options.processReply = decryptMessage;
|
|
FALL_THROUGH;
|
|
|
|
/* decrypt message */
|
|
case decryptMessage:
|
|
|
|
if (IsEncryptionOn(ssl, 0) && ssl->keys.decryptedCur == 0 &&
|
|
(!IsAtLeastTLSv1_3(ssl->version) ||
|
|
ssl->curRL.type != change_cipher_spec))
|
|
{
|
|
bufferStatic* in = &ssl->buffers.inputBuffer;
|
|
|
|
ret = SanityCheckCipherText(ssl, ssl->curSize);
|
|
if (ret < 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
#endif
|
|
return ret;
|
|
}
|
|
|
|
if (atomicUser) {
|
|
#ifdef ATOMIC_USER
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
ret = ssl->ctx->VerifyDecryptCb(ssl,
|
|
in->buffer + in->idx, in->buffer + in->idx,
|
|
ssl->curSize - MacSize(ssl),
|
|
ssl->curRL.type, 1, &ssl->keys.padSz,
|
|
ssl->DecryptVerifyCtx);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = ssl->ctx->DecryptVerifyCb(ssl,
|
|
in->buffer + in->idx,
|
|
in->buffer + in->idx,
|
|
ssl->curSize, ssl->curRL.type, 1,
|
|
&ssl->keys.padSz, ssl->DecryptVerifyCtx);
|
|
}
|
|
#endif /* ATOMIC_USER */
|
|
}
|
|
else {
|
|
if (!ssl->options.tls1_3) {
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
ret = Decrypt(ssl,
|
|
in->buffer + in->idx,
|
|
in->buffer + in->idx,
|
|
ssl->curSize - digestSz);
|
|
if (ret == 0) {
|
|
ssl->keys.padSz =
|
|
in->buffer[in->idx + ssl->curSize -
|
|
digestSz - 1];
|
|
ssl->keys.padSz += 1;
|
|
ssl->keys.decryptedCur = 1;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = Decrypt(ssl,
|
|
in->buffer + in->idx,
|
|
in->buffer + in->idx,
|
|
ssl->curSize);
|
|
}
|
|
#else
|
|
ret = DECRYPT_ERROR;
|
|
#endif
|
|
}
|
|
else
|
|
{
|
|
#ifdef WOLFSSL_TLS13
|
|
ret = DecryptTls13(ssl,
|
|
in->buffer + in->idx,
|
|
in->buffer + in->idx,
|
|
ssl->curSize,
|
|
(byte*)&ssl->curRL, RECORD_HEADER_SZ);
|
|
#else
|
|
ret = DECRYPT_ERROR;
|
|
#endif /* WOLFSSL_TLS13 */
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
return ret;
|
|
#endif
|
|
|
|
if (ret >= 0) {
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
/* handle success */
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (ssl->options.tls1_1 && ssl->specs.cipher_type == block)
|
|
ssl->buffers.inputBuffer.idx += ssl->specs.block_size;
|
|
#endif
|
|
/* go past TLSv1.1 IV */
|
|
if (CipherHasExpIV(ssl))
|
|
ssl->buffers.inputBuffer.idx += AESGCM_EXP_IV_SZ;
|
|
#endif
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Decrypt failed");
|
|
WOLFSSL_ERROR(ret);
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->options.tls1_3) {
|
|
if (ssl->options.side == WOLFSSL_SERVER_END &&
|
|
ssl->earlyData != no_early_data &&
|
|
ssl->options.clientState <
|
|
CLIENT_FINISHED_COMPLETE) {
|
|
ssl->earlyDataSz += ssl->curSize;
|
|
if (ssl->earlyDataSz <=
|
|
ssl->options.maxEarlyDataSz) {
|
|
WOLFSSL_MSG("Ignoring EarlyData!");
|
|
if (ssl->keys.peer_sequence_number_lo-- == 0)
|
|
ssl->keys.peer_sequence_number_hi--;
|
|
ssl->options.processReply = doProcessInit;
|
|
ssl->buffers.inputBuffer.idx =
|
|
ssl->buffers.inputBuffer.length;
|
|
return 0;
|
|
}
|
|
WOLFSSL_MSG("Too much EarlyData!");
|
|
}
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
/* If in DTLS mode, if the decrypt fails for any
|
|
* reason, pretend the datagram never happened. */
|
|
if (ssl->options.dtls) {
|
|
ssl->options.processReply = doProcessInit;
|
|
ssl->buffers.inputBuffer.idx =
|
|
ssl->buffers.inputBuffer.length;
|
|
#ifdef WOLFSSL_DTLS_DROP_STATS
|
|
ssl->macDropCount++;
|
|
#endif /* WOLFSSL_DTLS_DROP_STATS */
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
return DECRYPT_ERROR;
|
|
}
|
|
}
|
|
|
|
ssl->options.processReply = verifyMessage;
|
|
FALL_THROUGH;
|
|
|
|
/* verify digest of message */
|
|
case verifyMessage:
|
|
|
|
if (IsEncryptionOn(ssl, 0) && ssl->keys.decryptedCur == 0 &&
|
|
(!IsAtLeastTLSv1_3(ssl->version) ||
|
|
ssl->curRL.type != change_cipher_spec))
|
|
{
|
|
if (!atomicUser
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
&& !ssl->options.startedETMRead
|
|
#endif
|
|
) {
|
|
ret = VerifyMac(ssl, ssl->buffers.inputBuffer.buffer +
|
|
ssl->buffers.inputBuffer.idx,
|
|
ssl->curSize, ssl->curRL.type,
|
|
&ssl->keys.padSz);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
return ret;
|
|
#endif
|
|
if (ret < 0) {
|
|
WOLFSSL_MSG("VerifyMac failed");
|
|
WOLFSSL_ERROR(ret);
|
|
#ifdef WOLFSSL_DTLS
|
|
/* If in DTLS mode, if the decrypt fails for any
|
|
* reason, pretend the datagram never happened. */
|
|
if (ssl->options.dtls) {
|
|
ssl->options.processReply = doProcessInit;
|
|
ssl->buffers.inputBuffer.idx =
|
|
ssl->buffers.inputBuffer.length;
|
|
#ifdef WOLFSSL_DTLS_DROP_STATS
|
|
ssl->macDropCount++;
|
|
#endif /* WOLFSSL_DTLS_DROP_STATS */
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (!ssl->options.dtls)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
#endif
|
|
return DECRYPT_ERROR;
|
|
}
|
|
}
|
|
|
|
ssl->keys.encryptSz = ssl->curSize;
|
|
ssl->keys.decryptedCur = 1;
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3) {
|
|
word16 i = (word16)(ssl->buffers.inputBuffer.length -
|
|
ssl->keys.padSz);
|
|
|
|
/* sanity check on underflow */
|
|
if (ssl->keys.padSz >= ssl->buffers.inputBuffer.length) {
|
|
WOLFSSL_ERROR(DECRYPT_ERROR);
|
|
return DECRYPT_ERROR;
|
|
}
|
|
|
|
/* Remove padding from end of plain text. */
|
|
for (--i; i > ssl->buffers.inputBuffer.idx; i--) {
|
|
if (ssl->buffers.inputBuffer.buffer[i] != 0)
|
|
break;
|
|
}
|
|
/* Get the real content type from the end of the data. */
|
|
ssl->curRL.type = ssl->buffers.inputBuffer.buffer[i];
|
|
ssl->keys.padSz = ssl->buffers.inputBuffer.length - i;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
ssl->options.processReply = runProcessingOneMessage;
|
|
FALL_THROUGH;
|
|
|
|
/* the record layer is here */
|
|
case runProcessingOneMessage:
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (IsEncryptionOn(ssl, 0) && ssl->options.startedETMRead) {
|
|
if ((ssl->buffers.inputBuffer.length -
|
|
ssl->keys.padSz -
|
|
MacSize(ssl) -
|
|
ssl->buffers.inputBuffer.idx > MAX_PLAINTEXT_SZ)
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ssl->buffers.inputBuffer.length !=
|
|
ssl->buffers.inputBuffer.idx
|
|
#endif
|
|
) {
|
|
WOLFSSL_MSG("Plaintext too long - Encrypt-Then-MAC");
|
|
#if defined(WOLFSSL_EXTRA_ALERTS)
|
|
SendAlert(ssl, alert_fatal, record_overflow);
|
|
#endif
|
|
return BUFFER_ERROR;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->buffers.inputBuffer.length -
|
|
ssl->keys.padSz -
|
|
ssl->buffers.inputBuffer.idx > MAX_PLAINTEXT_SZ
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ssl->buffers.inputBuffer.length !=
|
|
ssl->buffers.inputBuffer.idx
|
|
#endif
|
|
) {
|
|
WOLFSSL_MSG("Plaintext too long");
|
|
#if defined(WOLFSSL_TLS13) || defined(WOLFSSL_EXTRA_ALERTS)
|
|
SendAlert(ssl, alert_fatal, record_overflow);
|
|
#endif
|
|
return BUFFER_ERROR;
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
DtlsUpdateWindow(ssl);
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
WOLFSSL_MSG("received record layer msg");
|
|
|
|
switch (ssl->curRL.type) {
|
|
case handshake :
|
|
WOLFSSL_MSG("got HANDSHAKE");
|
|
/* debugging in DoHandShakeMsg */
|
|
if (ssl->options.dtls) {
|
|
#ifdef WOLFSSL_DTLS
|
|
ret = DoDtlsHandShakeMsg(ssl,
|
|
ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx,
|
|
ssl->buffers.inputBuffer.length);
|
|
#endif
|
|
}
|
|
else if (!IsAtLeastTLSv1_3(ssl->version)
|
|
#if defined(WOLFSSL_TLS13) && !defined(WOLFSSL_NO_TLS12)
|
|
|| !TLSv1_3_Capable(ssl)
|
|
#endif
|
|
) {
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
ret = DoHandShakeMsg(ssl,
|
|
ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx,
|
|
ssl->buffers.inputBuffer.length);
|
|
#else
|
|
ret = BUFFER_ERROR;
|
|
#endif
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_TLS13
|
|
ssl->msgsReceived.got_change_cipher = 0;
|
|
ret = DoTls13HandShakeMsg(ssl,
|
|
ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx,
|
|
ssl->buffers.inputBuffer.length);
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ret != 0)
|
|
return ret;
|
|
if (ssl->options.side == WOLFSSL_SERVER_END &&
|
|
ssl->earlyData > early_data_ext &&
|
|
ssl->options.handShakeState == HANDSHAKE_DONE) {
|
|
ssl->earlyData = no_early_data;
|
|
ssl->options.processReply = doProcessInit;
|
|
return ZERO_RETURN;
|
|
}
|
|
#endif
|
|
#else
|
|
ret = BUFFER_ERROR;
|
|
#endif
|
|
}
|
|
if (ret != 0
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* In async case, on pending, move onto next message.
|
|
* Current message should have been DtlsMsgStore'ed and
|
|
* should be processed with DtlsMsgDrain */
|
|
&& (!ssl->options.dtls
|
|
|| ret != WC_PENDING_E)
|
|
#endif
|
|
) {
|
|
WOLFSSL_ERROR(ret);
|
|
return ret;
|
|
}
|
|
break;
|
|
|
|
case change_cipher_spec:
|
|
WOLFSSL_MSG("got CHANGE CIPHER SPEC");
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ChangeCipher");
|
|
/* add record header back on info */
|
|
if (ssl->toInfoOn) {
|
|
AddPacketInfo(ssl, "ChangeCipher",
|
|
change_cipher_spec,
|
|
ssl->buffers.inputBuffer.buffer +
|
|
ssl->buffers.inputBuffer.idx - RECORD_HEADER_SZ -
|
|
(ssl->options.dtls ? DTLS_RECORD_EXTRA : 0),
|
|
1 + RECORD_HEADER_SZ, READ_PROTO, ssl->heap);
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
AddLateRecordHeader(&ssl->curRL, &ssl->timeoutInfo);
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version)) {
|
|
word32 i = ssl->buffers.inputBuffer.idx;
|
|
if (ssl->options.handShakeState == HANDSHAKE_DONE) {
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
return UNKNOWN_RECORD_TYPE;
|
|
}
|
|
if (ssl->curSize != 1 ||
|
|
ssl->buffers.inputBuffer.buffer[i] != 1) {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
return UNKNOWN_RECORD_TYPE;
|
|
}
|
|
ssl->buffers.inputBuffer.idx++;
|
|
if (!ssl->msgsReceived.got_change_cipher) {
|
|
ssl->msgsReceived.got_change_cipher = 1;
|
|
}
|
|
else {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
return UNKNOWN_RECORD_TYPE;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
if (ssl->buffers.inputBuffer.buffer[
|
|
ssl->buffers.inputBuffer.idx] != 1) {
|
|
WOLFSSL_MSG("ChangeCipher msg wrong value");
|
|
return LENGTH_ERROR;
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 0) && ssl->options.handShakeDone) {
|
|
#ifdef HAVE_AEAD
|
|
if (ssl->specs.cipher_type == aead) {
|
|
if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
|
|
ssl->curSize -= AESGCM_EXP_IV_SZ;
|
|
ssl->buffers.inputBuffer.idx += ssl->specs.aead_mac_size;
|
|
ssl->curSize -= ssl->specs.aead_mac_size;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ssl->buffers.inputBuffer.idx += ssl->keys.padSz;
|
|
ssl->curSize -= (word16)ssl->keys.padSz;
|
|
ssl->curSize -= ssl->specs.iv_size;
|
|
}
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
ssl->buffers.inputBuffer.idx += digestSz;
|
|
ssl->curSize -= digestSz;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
if (ssl->curSize != 1) {
|
|
WOLFSSL_MSG("Malicious or corrupted ChangeCipher msg");
|
|
return LENGTH_ERROR;
|
|
}
|
|
|
|
ssl->buffers.inputBuffer.idx++;
|
|
|
|
ret = SanityCheckMsgReceived(ssl, change_cipher_hs);
|
|
if (ret != 0) {
|
|
if (!ssl->options.dtls) {
|
|
return ret;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* Check for duplicate CCS message in DTLS mode.
|
|
* DTLS allows for duplicate messages, and it should be
|
|
* skipped. Also skip if out of order. */
|
|
if (ret != DUPLICATE_MSG_E && ret != OUT_OF_ORDER_E)
|
|
return ret;
|
|
/* Reset error */
|
|
ret = 0;
|
|
break;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
}
|
|
|
|
ssl->keys.encryptionOn = 1;
|
|
|
|
/* setup decrypt keys for following messages */
|
|
/* XXX This might not be what we want to do when
|
|
* receiving a CCS with multicast. We update the
|
|
* key when the application updates them. */
|
|
if ((ret = SetKeysSide(ssl, DECRYPT_SIDE_ONLY)) != 0)
|
|
return ret;
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
ssl->options.startedETMRead = ssl->options.encThenMac;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
WOLFSSL_DTLS_PEERSEQ* peerSeq = ssl->keys.peerSeq;
|
|
#ifdef WOLFSSL_MULTICAST
|
|
if (ssl->options.haveMcast) {
|
|
peerSeq += ssl->keys.curPeerId;
|
|
peerSeq->highwaterMark = UpdateHighwaterMark(0,
|
|
ssl->ctx->mcastFirstSeq,
|
|
ssl->ctx->mcastSecondSeq,
|
|
ssl->ctx->mcastMaxSeq);
|
|
}
|
|
#endif
|
|
peerSeq->nextEpoch++;
|
|
peerSeq->prevSeq_lo = peerSeq->nextSeq_lo;
|
|
peerSeq->prevSeq_hi = peerSeq->nextSeq_hi;
|
|
peerSeq->nextSeq_lo = 0;
|
|
peerSeq->nextSeq_hi = 0;
|
|
XMEMCPY(peerSeq->prevWindow, peerSeq->window,
|
|
DTLS_SEQ_SZ);
|
|
XMEMSET(peerSeq->window, 0, DTLS_SEQ_SZ);
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_LIBZ
|
|
if (ssl->options.usingCompression)
|
|
if ( (ret = InitStreams(ssl)) != 0)
|
|
return ret;
|
|
#endif
|
|
ret = BuildFinished(ssl, &ssl->hsHashes->verifyHashes,
|
|
ssl->options.side == WOLFSSL_CLIENT_END ?
|
|
server : client);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
break;
|
|
|
|
case application_data:
|
|
WOLFSSL_MSG("got app DATA");
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls && ssl->options.dtlsHsRetain) {
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
/*
|
|
* Only free HS resources when not in the process of a
|
|
* secure renegotiation and we have received APP DATA
|
|
* from the current epoch
|
|
*/
|
|
if (!IsSCR(ssl) && (DtlsUseSCRKeys(ssl)
|
|
|| !DtlsSCRKeysSet(ssl))) {
|
|
FreeHandshakeResources(ssl);
|
|
ssl->options.dtlsHsRetain = 0;
|
|
}
|
|
#else
|
|
FreeHandshakeResources(ssl);
|
|
ssl->options.dtlsHsRetain = 0;
|
|
#endif
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->keys.keyUpdateRespond) {
|
|
WOLFSSL_MSG("No KeyUpdate from peer seen");
|
|
return SANITY_MSG_E;
|
|
}
|
|
#endif
|
|
if ((ret = DoApplicationData(ssl,
|
|
ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx))
|
|
!= 0) {
|
|
WOLFSSL_ERROR(ret);
|
|
return ret;
|
|
}
|
|
break;
|
|
|
|
case alert:
|
|
WOLFSSL_MSG("got ALERT!");
|
|
ret = DoAlert(ssl, ssl->buffers.inputBuffer.buffer,
|
|
&ssl->buffers.inputBuffer.idx, &type,
|
|
ssl->buffers.inputBuffer.length);
|
|
if (ret == alert_fatal)
|
|
return FATAL_ERROR;
|
|
else if (ret < 0)
|
|
return ret;
|
|
|
|
/* catch warnings that are handled as errors */
|
|
if (type == close_notify)
|
|
return ssl->error = ZERO_RETURN;
|
|
|
|
if (type == decrypt_error)
|
|
return FATAL_ERROR;
|
|
|
|
/* Reset error if we got an alert level in ret */
|
|
if (ret > 0)
|
|
ret = 0;
|
|
break;
|
|
|
|
default:
|
|
WOLFSSL_ERROR(UNKNOWN_RECORD_TYPE);
|
|
return UNKNOWN_RECORD_TYPE;
|
|
}
|
|
|
|
ssl->options.processReply = doProcessInit;
|
|
|
|
/* input exhausted */
|
|
if (ssl->buffers.inputBuffer.idx >= ssl->buffers.inputBuffer.length
|
|
#ifdef WOLFSSL_DTLS
|
|
/* If app data was processed then return now to avoid
|
|
* dropping any app data. */
|
|
|| (ssl->options.dtls && ssl->curRL.type == application_data)
|
|
#endif
|
|
)
|
|
return ret;
|
|
|
|
/* more messages per record */
|
|
else if ((ssl->buffers.inputBuffer.idx - startIdx) < ssl->curSize) {
|
|
WOLFSSL_MSG("More messages in record");
|
|
|
|
ssl->options.processReply = runProcessingOneMessage;
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
WOLFSSL_MSG("Bundled encrypted messages, remove middle pad");
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead) {
|
|
word32 digestSz = MacSize(ssl);
|
|
if (ssl->buffers.inputBuffer.idx >=
|
|
ssl->keys.padSz + digestSz) {
|
|
ssl->buffers.inputBuffer.idx -=
|
|
ssl->keys.padSz + digestSz;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("\tmiddle padding error");
|
|
return FATAL_ERROR;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (ssl->buffers.inputBuffer.idx >= ssl->keys.padSz) {
|
|
ssl->buffers.inputBuffer.idx -= ssl->keys.padSz;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("\tmiddle padding error");
|
|
return FATAL_ERROR;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
/* more records */
|
|
else {
|
|
WOLFSSL_MSG("More records in input");
|
|
}
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* We are setup to read next message/record but we had an error
|
|
* (probably WC_PENDING_E) so return that so it can be handled
|
|
* by higher layers. */
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
continue;
|
|
default:
|
|
WOLFSSL_MSG("Bad process input state, programming error");
|
|
return INPUT_CASE_ERROR;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
#if !defined(WOLFSSL_NO_TLS12) || !defined(NO_OLD_TLS) || \
|
|
(defined(WOLFSSL_TLS13) && defined(WOLFSSL_TLS13_MIDDLEBOX_COMPAT))
|
|
int SendChangeCipher(WOLFSSL* ssl)
|
|
{
|
|
byte *output;
|
|
int sendSz = RECORD_HEADER_SZ + ENUM_LEN;
|
|
int idx = RECORD_HEADER_SZ;
|
|
int ret;
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
if (ssl->options.side == WOLFSSL_SERVER_END){
|
|
ssl->options.serverState = SERVER_CHANGECIPHERSPEC_COMPLETE;
|
|
if (ssl->CBIS != NULL)
|
|
ssl->CBIS(ssl, SSL_CB_ACCEPT_LOOP, SSL_SUCCESS);
|
|
}
|
|
else{
|
|
ssl->options.clientState =
|
|
CLIENT_CHANGECIPHERSPEC_COMPLETE;
|
|
if (ssl->CBIS != NULL)
|
|
ssl->CBIS(ssl, SSL_CB_CONNECT_LOOP, SSL_SUCCESS);
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
sendSz += DTLS_RECORD_EXTRA;
|
|
idx += DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
/* are we in scr */
|
|
if (IsEncryptionOn(ssl, 1) && ssl->options.handShakeDone) {
|
|
sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddRecordHeader(output, 1, change_cipher_spec, ssl, CUR_ORDER);
|
|
|
|
output[idx] = 1; /* turn it on */
|
|
|
|
if (IsEncryptionOn(ssl, 1) && ssl->options.handShakeDone) {
|
|
byte input[ENUM_LEN];
|
|
int inputSz = ENUM_LEN;
|
|
|
|
input[0] = 1; /* turn it on */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, input, inputSz, change_cipher_hs)) != 0) {
|
|
return ret;
|
|
}
|
|
#endif
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
change_cipher_spec, 0, 0, 0, CUR_ORDER);
|
|
if (sendSz < 0) {
|
|
return sendSz;
|
|
}
|
|
}
|
|
#ifdef WOLFSSL_DTLS
|
|
else {
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, change_cipher_hs)) != 0)
|
|
return ret;
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
}
|
|
}
|
|
#endif
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "ChangeCipher");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "ChangeCipher", change_cipher_spec, output,
|
|
sendSz, WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (!ssl->options.tls1_3)
|
|
#endif
|
|
{
|
|
/* setup encrypt keys */
|
|
if ((ret = SetKeysSide(ssl, ENCRYPT_SIDE_ONLY)) != 0)
|
|
return ret;
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
ssl->options.startedETMWrite = ssl->options.encThenMac;
|
|
#endif
|
|
}
|
|
|
|
if (ssl->options.groupMessages)
|
|
return 0;
|
|
#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_DEBUG_DTLS)
|
|
else if (ssl->options.dtls) {
|
|
/* If using DTLS, force the ChangeCipherSpec message to be in the
|
|
* same datagram as the finished message. */
|
|
return 0;
|
|
}
|
|
#endif
|
|
else
|
|
return SendBuffered(ssl);
|
|
}
|
|
#endif
|
|
|
|
|
|
#if !defined(NO_OLD_TLS) && !defined(WOLFSSL_AEAD_ONLY)
|
|
static int SSL_hmac(WOLFSSL* ssl, byte* digest, const byte* in, word32 sz,
|
|
int padLen, int content, int verify, int epochOrder)
|
|
{
|
|
byte result[WC_MAX_DIGEST_SIZE];
|
|
word32 digestSz = ssl->specs.hash_size; /* actual sizes */
|
|
word32 padSz = ssl->specs.pad_size;
|
|
int ret = 0;
|
|
|
|
wc_Md5 md5;
|
|
wc_Sha sha;
|
|
|
|
/* data */
|
|
byte seq[SEQ_SZ];
|
|
byte conLen[ENUM_LEN + LENGTH_SZ]; /* content & length */
|
|
const byte* macSecret = NULL;
|
|
|
|
(void)padLen;
|
|
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb)
|
|
ssl->fuzzerCb(ssl, in, sz, FUZZ_HMAC, ssl->fuzzerCtx);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
macSecret = wolfSSL_GetDtlsMacSecret(ssl, verify, epochOrder);
|
|
else
|
|
macSecret = wolfSSL_GetMacSecret(ssl, verify);
|
|
#else
|
|
macSecret = wolfSSL_GetMacSecret(ssl, verify);
|
|
#endif
|
|
|
|
XMEMSET(seq, 0, SEQ_SZ);
|
|
conLen[0] = (byte)content;
|
|
c16toa((word16)sz, &conLen[ENUM_LEN]);
|
|
WriteSEQ(ssl, epochOrder, seq);
|
|
|
|
if (ssl->specs.mac_algorithm == md5_mac) {
|
|
ret = wc_InitMd5_ex(&md5, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
/* inner */
|
|
ret = wc_Md5Update(&md5, macSecret, digestSz);
|
|
ret |= wc_Md5Update(&md5, PAD1, padSz);
|
|
ret |= wc_Md5Update(&md5, seq, SEQ_SZ);
|
|
ret |= wc_Md5Update(&md5, conLen, sizeof(conLen));
|
|
/* in buffer */
|
|
ret |= wc_Md5Update(&md5, in, sz);
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
ret = wc_Md5Final(&md5, result);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* TODO: Make non-blocking */
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wc_AsyncWait(ret, &md5.asyncDev, WC_ASYNC_FLAG_NONE);
|
|
}
|
|
#endif
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
|
|
/* outer */
|
|
ret = wc_Md5Update(&md5, macSecret, digestSz);
|
|
ret |= wc_Md5Update(&md5, PAD2, padSz);
|
|
ret |= wc_Md5Update(&md5, result, digestSz);
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
ret = wc_Md5Final(&md5, digest);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* TODO: Make non-blocking */
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wc_AsyncWait(ret, &md5.asyncDev, WC_ASYNC_FLAG_NONE);
|
|
}
|
|
#endif
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
|
|
wc_Md5Free(&md5);
|
|
}
|
|
else {
|
|
ret = wc_InitSha_ex(&sha, ssl->heap, ssl->devId);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
/* inner */
|
|
ret = wc_ShaUpdate(&sha, macSecret, digestSz);
|
|
ret |= wc_ShaUpdate(&sha, PAD1, padSz);
|
|
ret |= wc_ShaUpdate(&sha, seq, SEQ_SZ);
|
|
ret |= wc_ShaUpdate(&sha, conLen, sizeof(conLen));
|
|
/* in buffer */
|
|
ret |= wc_ShaUpdate(&sha, in, sz);
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
ret = wc_ShaFinal(&sha, result);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* TODO: Make non-blocking */
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wc_AsyncWait(ret, &sha.asyncDev, WC_ASYNC_FLAG_NONE);
|
|
}
|
|
#endif
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
|
|
/* outer */
|
|
ret = wc_ShaUpdate(&sha, macSecret, digestSz);
|
|
ret |= wc_ShaUpdate(&sha, PAD2, padSz);
|
|
ret |= wc_ShaUpdate(&sha, result, digestSz);
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
ret = wc_ShaFinal(&sha, digest);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* TODO: Make non-blocking */
|
|
if (ret == WC_PENDING_E) {
|
|
ret = wc_AsyncWait(ret, &sha.asyncDev, WC_ASYNC_FLAG_NONE);
|
|
}
|
|
#endif
|
|
if (ret != 0)
|
|
return VERIFY_MAC_ERROR;
|
|
|
|
wc_ShaFree(&sha);
|
|
}
|
|
return 0;
|
|
}
|
|
#endif /* !NO_OLD_TLS && !WOLFSSL_AEAD_ONLY */
|
|
|
|
#if !defined(NO_MD5) && !defined(NO_OLD_TLS)
|
|
static int BuildMD5_CertVerify(WOLFSSL* ssl, byte* digest)
|
|
{
|
|
int ret;
|
|
byte md5_result[WC_MD5_DIGEST_SIZE];
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
wc_Md5* md5 = (wc_Md5*)XMALLOC(sizeof(wc_Md5), ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
#else
|
|
wc_Md5 md5[1];
|
|
#endif
|
|
|
|
/* make md5 inner */
|
|
ret = wc_Md5Copy(&ssl->hsHashes->hashMd5, md5); /* Save current position */
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, PAD1, PAD_MD5);
|
|
if (ret == 0)
|
|
ret = wc_Md5Final(md5, md5_result);
|
|
|
|
/* make md5 outer */
|
|
if (ret == 0) {
|
|
ret = wc_InitMd5_ex(md5, ssl->heap, ssl->devId);
|
|
if (ret == 0) {
|
|
ret = wc_Md5Update(md5, ssl->arrays->masterSecret, SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, PAD2, PAD_MD5);
|
|
if (ret == 0)
|
|
ret = wc_Md5Update(md5, md5_result, WC_MD5_DIGEST_SIZE);
|
|
if (ret == 0)
|
|
ret = wc_Md5Final(md5, digest);
|
|
wc_Md5Free(md5);
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(md5, ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
#endif /* !NO_MD5 && !NO_OLD_TLS */
|
|
|
|
#if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \
|
|
defined(WOLFSSL_ALLOW_TLS_SHA1))
|
|
static int BuildSHA_CertVerify(WOLFSSL* ssl, byte* digest)
|
|
{
|
|
int ret;
|
|
byte sha_result[WC_SHA_DIGEST_SIZE];
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
wc_Sha* sha = (wc_Sha*)XMALLOC(sizeof(wc_Sha), ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
#else
|
|
wc_Sha sha[1];
|
|
#endif
|
|
|
|
/* make sha inner */
|
|
ret = wc_ShaCopy(&ssl->hsHashes->hashSha, sha); /* Save current position */
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, PAD1, PAD_SHA);
|
|
if (ret == 0)
|
|
ret = wc_ShaFinal(sha, sha_result);
|
|
|
|
/* make sha outer */
|
|
if (ret == 0) {
|
|
ret = wc_InitSha_ex(sha, ssl->heap, ssl->devId);
|
|
if (ret == 0) {
|
|
ret = wc_ShaUpdate(sha, ssl->arrays->masterSecret,SECRET_LEN);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, PAD2, PAD_SHA);
|
|
if (ret == 0)
|
|
ret = wc_ShaUpdate(sha, sha_result, WC_SHA_DIGEST_SIZE);
|
|
if (ret == 0)
|
|
ret = wc_ShaFinal(sha, digest);
|
|
wc_ShaFree(sha);
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(sha, ssl->heap, DYNAMIC_TYPE_HASHCTX);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
#endif /* !NO_SHA && (!NO_OLD_TLS || WOLFSSL_ALLOW_TLS_SHA1) */
|
|
|
|
int BuildCertHashes(WOLFSSL* ssl, Hashes* hashes)
|
|
{
|
|
int ret = 0;
|
|
|
|
(void)hashes;
|
|
|
|
if (ssl->options.tls) {
|
|
#if !defined(NO_MD5) && !defined(NO_OLD_TLS)
|
|
ret = wc_Md5GetHash(&ssl->hsHashes->hashMd5, hashes->md5);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#if !defined(NO_SHA)
|
|
ret = wc_ShaGetHash(&ssl->hsHashes->hashSha, hashes->sha);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
#ifndef NO_SHA256
|
|
ret = wc_Sha256GetHash(&ssl->hsHashes->hashSha256,
|
|
hashes->sha256);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
ret = wc_Sha384GetHash(&ssl->hsHashes->hashSha384,
|
|
hashes->sha384);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
ret = wc_Sha512GetHash(&ssl->hsHashes->hashSha512,
|
|
hashes->sha512);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
}
|
|
}
|
|
else {
|
|
#if !defined(NO_MD5) && !defined(NO_OLD_TLS)
|
|
ret = BuildMD5_CertVerify(ssl, hashes->md5);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
#if !defined(NO_SHA) && (!defined(NO_OLD_TLS) || \
|
|
defined(WOLFSSL_ALLOW_TLS_SHA1))
|
|
ret = BuildSHA_CertVerify(ssl, hashes->sha);
|
|
if (ret != 0)
|
|
return ret;
|
|
#endif
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
void FreeBuildMsgArgs(WOLFSSL* ssl, BuildMsgArgs* args)
|
|
{
|
|
if (args) {
|
|
if (ssl && args->iv)
|
|
XFREE(args->iv, ssl->heap, DYNAMIC_TYPE_SALT);
|
|
XMEMSET(args, 0, sizeof(BuildMsgArgs));
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* Build SSL Message, encrypted */
|
|
int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
|
|
int inSz, int type, int hashOutput, int sizeOnly, int asyncOkay,
|
|
int epochOrder)
|
|
{
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
int ret = 0;
|
|
BuildMsgArgs* args;
|
|
BuildMsgArgs lcl_args;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
args = &ssl->async.buildArgs;
|
|
#endif
|
|
#endif
|
|
|
|
WOLFSSL_ENTER("BuildMessage");
|
|
|
|
if (ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
(void)epochOrder;
|
|
|
|
#ifdef WOLFSSL_NO_TLS12
|
|
return BuildTls13Message(ssl, output, outSz, input, inSz, type,
|
|
hashOutput, sizeOnly, asyncOkay);
|
|
#else
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3) {
|
|
return BuildTls13Message(ssl, output, outSz, input, inSz, type,
|
|
hashOutput, sizeOnly, asyncOkay);
|
|
}
|
|
#endif
|
|
|
|
ret = WC_NOT_PENDING_E;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (asyncOkay) {
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.buildMsgState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_buildmsg;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
args = &lcl_args;
|
|
}
|
|
|
|
/* Reset state */
|
|
if (ret == WC_NOT_PENDING_E) {
|
|
ret = 0;
|
|
ssl->options.buildMsgState = BUILD_MSG_BEGIN;
|
|
XMEMSET(args, 0, sizeof(BuildMsgArgs));
|
|
|
|
args->sz = RECORD_HEADER_SZ + inSz;
|
|
args->idx = RECORD_HEADER_SZ;
|
|
args->headerSz = RECORD_HEADER_SZ;
|
|
}
|
|
|
|
switch (ssl->options.buildMsgState) {
|
|
case BUILD_MSG_BEGIN:
|
|
{
|
|
/* catch mistaken sizeOnly parameter */
|
|
if (!sizeOnly && (output == NULL || input == NULL) ) {
|
|
ERROR_OUT(BAD_FUNC_ARG, exit_buildmsg);
|
|
}
|
|
if (sizeOnly && (output || input) ) {
|
|
WOLFSSL_MSG("BuildMessage w/sizeOnly doesn't need input/output");
|
|
ERROR_OUT(BAD_FUNC_ARG, exit_buildmsg);
|
|
}
|
|
#if defined(WOLFSSL_DTLS) && defined(HAVE_SECURE_RENEGOTIATION)
|
|
if (ssl->options.dtls && DtlsSCRKeysSet(ssl)) {
|
|
/* For epochs >1 the current cipher parameters are located in
|
|
* ssl->secure_renegotiation->tmp_keys. Previous cipher
|
|
* parameters and for epoch 1 use ssl->keys */
|
|
switch (epochOrder) {
|
|
case PREV_ORDER:
|
|
if (ssl->encrypt.src != KEYS) {
|
|
ssl->secure_renegotiation->cache_status =
|
|
SCR_CACHE_NULL;
|
|
if ((ret = SetKeysSide(ssl, ENCRYPT_SIDE_ONLY)) != 0)
|
|
ERROR_OUT(ret, exit_buildmsg);
|
|
}
|
|
break;
|
|
case CUR_ORDER:
|
|
if (ssl->keys.dtls_epoch ==
|
|
ssl->secure_renegotiation->tmp_keys.dtls_epoch) {
|
|
if (ssl->encrypt.src != SCR) {
|
|
ssl->secure_renegotiation->cache_status =
|
|
SCR_CACHE_NEEDED;
|
|
if ((ret = SetKeysSide(ssl, ENCRYPT_SIDE_ONLY))
|
|
!= 0)
|
|
ERROR_OUT(ret, exit_buildmsg);
|
|
}
|
|
}
|
|
else {
|
|
if (ssl->encrypt.src != KEYS) {
|
|
ssl->secure_renegotiation->cache_status =
|
|
SCR_CACHE_NULL;
|
|
if ((ret = SetKeysSide(ssl, ENCRYPT_SIDE_ONLY))
|
|
!= 0)
|
|
ERROR_OUT(ret, exit_buildmsg);
|
|
}
|
|
}
|
|
break;
|
|
default:
|
|
WOLFSSL_MSG("BuildMessage only supports PREV_ORDER and "
|
|
"CUR_ORDER");
|
|
ERROR_OUT(BAD_FUNC_ARG, exit_buildmsg);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
ssl->options.buildMsgState = BUILD_MSG_SIZE;
|
|
}
|
|
FALL_THROUGH;
|
|
case BUILD_MSG_SIZE:
|
|
{
|
|
args->digestSz = ssl->specs.hash_size;
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
if (ssl->truncated_hmac)
|
|
args->digestSz = min(TRUNCATED_HMAC_SZ, args->digestSz);
|
|
#endif
|
|
args->sz += args->digestSz;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sz += DTLS_RECORD_EXTRA;
|
|
args->idx += DTLS_RECORD_EXTRA;
|
|
args->headerSz += DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (ssl->specs.cipher_type == block) {
|
|
word32 blockSz = ssl->specs.block_size;
|
|
if (ssl->options.tls1_1) {
|
|
args->ivSz = blockSz;
|
|
args->sz += args->ivSz;
|
|
|
|
if (args->ivSz > MAX_IV_SZ)
|
|
ERROR_OUT(BUFFER_E, exit_buildmsg);
|
|
}
|
|
args->sz += 1; /* pad byte */
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMWrite) {
|
|
args->pad = (args->sz - args->headerSz -
|
|
args->digestSz) % blockSz;
|
|
}
|
|
else
|
|
#endif
|
|
args->pad = (args->sz - args->headerSz) % blockSz;
|
|
#ifdef OPENSSL_EXTRA
|
|
if(args->pad != 0)
|
|
#endif
|
|
args->pad = blockSz - args->pad;
|
|
args->sz += args->pad;
|
|
}
|
|
#endif /* WOLFSSL_AEAD_ONLY */
|
|
|
|
#ifdef HAVE_AEAD
|
|
if (ssl->specs.cipher_type == aead) {
|
|
if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
|
|
args->ivSz = AESGCM_EXP_IV_SZ;
|
|
|
|
args->sz += (args->ivSz + ssl->specs.aead_mac_size - args->digestSz);
|
|
}
|
|
#endif
|
|
|
|
/* done with size calculations */
|
|
if (sizeOnly)
|
|
goto exit_buildmsg;
|
|
|
|
if (args->sz > (word32)outSz) {
|
|
WOLFSSL_MSG("Oops, want to write past output buffer size");
|
|
ERROR_OUT(BUFFER_E, exit_buildmsg);
|
|
}
|
|
|
|
if (args->ivSz > 0) {
|
|
args->iv = (byte*)XMALLOC(args->ivSz, ssl->heap, DYNAMIC_TYPE_SALT);
|
|
if (args->iv == NULL)
|
|
ERROR_OUT(MEMORY_E, exit_buildmsg);
|
|
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, args->iv, args->ivSz);
|
|
if (ret != 0)
|
|
goto exit_buildmsg;
|
|
|
|
}
|
|
#if !defined(NO_PUBLIC_GCM_SET_IV) && \
|
|
((defined(HAVE_FIPS) || defined(HAVE_SELFTEST)) && \
|
|
(!defined(HAVE_FIPS_VERSION) || (HAVE_FIPS_VERSION < 2)) && \
|
|
defined(HAVE_AEAD))
|
|
if (ssl->specs.cipher_type == aead) {
|
|
if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
|
|
XMEMCPY(args->iv, ssl->keys.aead_exp_IV, AESGCM_EXP_IV_SZ);
|
|
}
|
|
#endif
|
|
|
|
args->size = (word16)(args->sz - args->headerSz); /* include mac and digest */
|
|
AddRecordHeader(output, args->size, (byte)type, ssl, epochOrder);
|
|
|
|
/* write to output */
|
|
if (args->ivSz > 0) {
|
|
XMEMCPY(output + args->idx, args->iv,
|
|
min(args->ivSz, MAX_IV_SZ));
|
|
args->idx += args->ivSz;
|
|
}
|
|
XMEMCPY(output + args->idx, input, inSz);
|
|
args->idx += inSz;
|
|
|
|
ssl->options.buildMsgState = BUILD_MSG_HASH;
|
|
}
|
|
FALL_THROUGH;
|
|
case BUILD_MSG_HASH:
|
|
{
|
|
if (type == handshake && hashOutput) {
|
|
ret = HashOutput(ssl, output, args->headerSz + inSz, args->ivSz);
|
|
if (ret != 0)
|
|
goto exit_buildmsg;
|
|
}
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (ssl->specs.cipher_type == block) {
|
|
word32 tmpIdx;
|
|
word32 i;
|
|
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMWrite)
|
|
tmpIdx = args->idx;
|
|
else
|
|
#endif
|
|
tmpIdx = args->idx + args->digestSz;
|
|
|
|
for (i = 0; i <= args->pad; i++)
|
|
output[tmpIdx++] = (byte)args->pad; /* pad byte gets pad value */
|
|
}
|
|
#endif
|
|
|
|
ssl->options.buildMsgState = BUILD_MSG_VERIFY_MAC;
|
|
}
|
|
FALL_THROUGH;
|
|
case BUILD_MSG_VERIFY_MAC:
|
|
{
|
|
/* User Record Layer Callback handling */
|
|
#ifdef ATOMIC_USER
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMWrite) {
|
|
if (ssl->ctx->EncryptMacCb) {
|
|
ret = ssl->ctx->EncryptMacCb(ssl, output + args->idx +
|
|
args->pad + 1, type, 0,
|
|
output + args->headerSz,
|
|
output + args->headerSz,
|
|
args->size - args->digestSz,
|
|
ssl->MacEncryptCtx);
|
|
goto exit_buildmsg;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (ssl->ctx->MacEncryptCb) {
|
|
ret = ssl->ctx->MacEncryptCb(ssl, output + args->idx,
|
|
output + args->headerSz + args->ivSz, inSz,
|
|
type, 0, output + args->headerSz,
|
|
output + args->headerSz, args->size,
|
|
ssl->MacEncryptCtx);
|
|
goto exit_buildmsg;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_AEAD_ONLY
|
|
if (ssl->specs.cipher_type != aead
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
&& !ssl->options.startedETMWrite
|
|
#endif
|
|
) {
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
if (ssl->truncated_hmac &&
|
|
ssl->specs.hash_size > args->digestSz) {
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
byte* hmac;
|
|
#else
|
|
byte hmac[WC_MAX_DIGEST_SIZE];
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
hmac = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, ssl->heap,
|
|
DYNAMIC_TYPE_DIGEST);
|
|
if (hmac == NULL)
|
|
ERROR_OUT(MEMORY_E, exit_buildmsg);
|
|
#endif
|
|
|
|
ret = ssl->hmac(ssl, hmac,
|
|
output + args->headerSz + args->ivSz, inSz,
|
|
-1, type, 0, epochOrder);
|
|
XMEMCPY(output + args->idx, hmac, args->digestSz);
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(hmac, ssl->heap, DYNAMIC_TYPE_DIGEST);
|
|
#endif
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = ssl->hmac(ssl, output + args->idx, output +
|
|
args->headerSz + args->ivSz, inSz, -1, type, 0, epochOrder);
|
|
}
|
|
}
|
|
#endif /* WOLFSSL_AEAD_ONLY */
|
|
if (ret != 0)
|
|
goto exit_buildmsg;
|
|
|
|
ssl->options.buildMsgState = BUILD_MSG_ENCRYPT;
|
|
}
|
|
FALL_THROUGH;
|
|
case BUILD_MSG_ENCRYPT:
|
|
{
|
|
#if defined(HAVE_SECURE_RENEGOTIATION) && defined(WOLFSSL_DTLS)
|
|
/* If we want the PREV_ORDER then modify CUR_ORDER sequence number
|
|
* for all encryption algos that use it for encryption parameters */
|
|
word16 dtls_epoch = 0;
|
|
word16 dtls_sequence_number_hi = 0;
|
|
word32 dtls_sequence_number_lo = 0;
|
|
int swap_seq = ssl->options.dtls && epochOrder == PREV_ORDER &&
|
|
DtlsUseSCRKeys(ssl);
|
|
if (swap_seq) {
|
|
dtls_epoch = ssl->keys.dtls_epoch;
|
|
dtls_sequence_number_hi = ssl->keys.dtls_sequence_number_hi;
|
|
dtls_sequence_number_lo = ssl->keys.dtls_sequence_number_lo;
|
|
ssl->keys.dtls_epoch--;
|
|
ssl->keys.dtls_sequence_number_hi =
|
|
ssl->keys.dtls_prev_sequence_number_hi;
|
|
ssl->keys.dtls_sequence_number_lo =
|
|
ssl->keys.dtls_prev_sequence_number_lo;
|
|
}
|
|
#endif
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMWrite) {
|
|
ret = Encrypt(ssl, output + args->headerSz,
|
|
output + args->headerSz,
|
|
args->size - args->digestSz, asyncOkay);
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = Encrypt(ssl, output + args->headerSz,
|
|
output + args->headerSz, args->size, asyncOkay);
|
|
}
|
|
#if defined(HAVE_SECURE_RENEGOTIATION) && defined(WOLFSSL_DTLS)
|
|
/* Restore sequence numbers */
|
|
if (swap_seq) {
|
|
ssl->keys.dtls_epoch = dtls_epoch;
|
|
ssl->keys.dtls_sequence_number_hi = dtls_sequence_number_hi;
|
|
ssl->keys.dtls_sequence_number_lo = dtls_sequence_number_lo;
|
|
}
|
|
#endif
|
|
if (ret != 0)
|
|
goto exit_buildmsg;
|
|
ssl->options.buildMsgState = BUILD_MSG_ENCRYPTED_VERIFY_MAC;
|
|
}
|
|
FALL_THROUGH;
|
|
case BUILD_MSG_ENCRYPTED_VERIFY_MAC:
|
|
{
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMWrite) {
|
|
WOLFSSL_MSG("Calculate MAC of Encrypted Data");
|
|
|
|
#ifdef HAVE_TRUNCATED_HMAC
|
|
if (ssl->truncated_hmac &&
|
|
ssl->specs.hash_size > args->digestSz) {
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
byte* hmac = NULL;
|
|
#else
|
|
byte hmac[WC_MAX_DIGEST_SIZE];
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
hmac = (byte*)XMALLOC(WC_MAX_DIGEST_SIZE, ssl->heap,
|
|
DYNAMIC_TYPE_DIGEST);
|
|
if (hmac == NULL)
|
|
ERROR_OUT(MEMORY_E, exit_buildmsg);
|
|
#endif
|
|
|
|
ret = ssl->hmac(ssl, hmac, output + args->headerSz,
|
|
args->ivSz + inSz + args->pad + 1, -1, type,
|
|
0, epochOrder);
|
|
XMEMCPY(output + args->idx + args->pad + 1, hmac,
|
|
args->digestSz);
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(hmac, ssl->heap, DYNAMIC_TYPE_DIGEST);
|
|
#endif
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = ssl->hmac(ssl, output + args->idx + args->pad + 1,
|
|
output + args->headerSz,
|
|
args->ivSz + inSz + args->pad + 1, -1, type,
|
|
0, epochOrder);
|
|
}
|
|
}
|
|
#endif /* HAVE_ENCRYPT_THEN_MAC && !WOLFSSL_AEAD_ONLY */
|
|
}
|
|
}
|
|
|
|
exit_buildmsg:
|
|
|
|
WOLFSSL_LEAVE("BuildMessage", ret);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E) {
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
/* make sure build message state is reset */
|
|
ssl->options.buildMsgState = BUILD_MSG_BEGIN;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ret == 0 && ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, epochOrder);
|
|
#endif
|
|
|
|
/* return sz on success */
|
|
if (ret == 0)
|
|
ret = args->sz;
|
|
|
|
/* Final cleanup */
|
|
FreeBuildMsgArgs(ssl, args);
|
|
|
|
return ret;
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
int SendFinished(WOLFSSL* ssl)
|
|
{
|
|
int sendSz,
|
|
finishedSz = ssl->options.tls ? TLS_FINISHED_SZ :
|
|
FINISHED_SZ;
|
|
byte input[FINISHED_SZ + DTLS_HANDSHAKE_HEADER_SZ]; /* max */
|
|
byte *output;
|
|
Hashes* hashes;
|
|
int ret;
|
|
int headerSz = HANDSHAKE_HEADER_SZ;
|
|
int outputSz;
|
|
|
|
WOLFSSL_START(WC_FUNC_FINISHED_SEND);
|
|
WOLFSSL_ENTER("SendFinished");
|
|
|
|
/* check for available size */
|
|
outputSz = sizeof(input) + MAX_MSG_EXTRA;
|
|
if ((ret = CheckAvailableSize(ssl, outputSz)) != 0)
|
|
return ret;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
headerSz += DTLS_HANDSHAKE_EXTRA;
|
|
ssl->keys.dtls_epoch++;
|
|
ssl->keys.dtls_prev_sequence_number_hi =
|
|
ssl->keys.dtls_sequence_number_hi;
|
|
ssl->keys.dtls_prev_sequence_number_lo =
|
|
ssl->keys.dtls_sequence_number_lo;
|
|
ssl->keys.dtls_sequence_number_hi = 0;
|
|
ssl->keys.dtls_sequence_number_lo = 0;
|
|
}
|
|
#endif
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHandShakeHeader(input, finishedSz, 0, finishedSz, finished, ssl);
|
|
|
|
/* make finished hashes */
|
|
hashes = (Hashes*)&input[headerSz];
|
|
ret = BuildFinished(ssl, hashes,
|
|
ssl->options.side == WOLFSSL_CLIENT_END ? client : server);
|
|
if (ret != 0) return ret;
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation) {
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END)
|
|
XMEMCPY(ssl->secure_renegotiation->client_verify_data, hashes,
|
|
TLS_FINISHED_SZ);
|
|
else
|
|
XMEMCPY(ssl->secure_renegotiation->server_verify_data, hashes,
|
|
TLS_FINISHED_SZ);
|
|
}
|
|
#endif
|
|
#ifdef OPENSSL_ALL
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END)
|
|
XMEMCPY(ssl->clientFinished,
|
|
hashes, TLS_FINISHED_SZ);
|
|
else
|
|
XMEMCPY(ssl->serverFinished,
|
|
hashes, TLS_FINISHED_SZ);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, input, headerSz + finishedSz, finished)) != 0)
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
sendSz = BuildMessage(ssl, output, outputSz, input, headerSz + finishedSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
if (sendSz < 0)
|
|
return BUILD_MSG_ERROR;
|
|
|
|
if (!ssl->options.resuming) {
|
|
#ifndef NO_SESSION_CACHE
|
|
AddSession(ssl); /* just try */
|
|
#endif
|
|
if (ssl->options.side == WOLFSSL_SERVER_END) {
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->options.serverState = SERVER_FINISHED_COMPLETE;
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
if (ssl->CBIS != NULL)
|
|
ssl->CBIS(ssl, SSL_CB_HANDSHAKE_DONE, SSL_SUCCESS);
|
|
#endif
|
|
ssl->options.handShakeState = HANDSHAKE_DONE;
|
|
ssl->options.handShakeDone = 1;
|
|
}
|
|
}
|
|
else {
|
|
if (ssl->options.side == WOLFSSL_CLIENT_END) {
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->options.clientState = CLIENT_FINISHED_COMPLETE;
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
if (ssl->CBIS != NULL)
|
|
ssl->CBIS(ssl, SSL_CB_HANDSHAKE_DONE, SSL_SUCCESS);
|
|
#endif
|
|
ssl->options.handShakeState = HANDSHAKE_DONE;
|
|
ssl->options.handShakeDone = 1;
|
|
}
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "Finished");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "Finished", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
ret = SendBuffered(ssl);
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if ((!ssl->options.resuming &&
|
|
ssl->options.side == WOLFSSL_SERVER_END) ||
|
|
(ssl->options.resuming &&
|
|
ssl->options.side == WOLFSSL_CLIENT_END)) {
|
|
ssl->keys.dtls_handshake_number = 0;
|
|
ssl->keys.dtls_expected_peer_handshake_number = 0;
|
|
}
|
|
#endif
|
|
|
|
WOLFSSL_LEAVE("SendFinished", ret);
|
|
WOLFSSL_END(WC_FUNC_FINISHED_SEND);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_NO_TLS12 */
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
#if (!defined(WOLFSSL_NO_TLS12) && \
|
|
(defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
|
|
defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2))) || \
|
|
(defined(WOLFSSL_TLS13) && defined(HAVE_CERTIFICATE_STATUS_REQUEST))
|
|
/* Parses and decodes the certificate then initializes "request". In the case
|
|
* of !ssl->buffers.weOwnCert, ssl->ctx->certOcspRequest gets set to "request".
|
|
*
|
|
* Returns 0 on success
|
|
*/
|
|
static int CreateOcspRequest(WOLFSSL* ssl, OcspRequest* request,
|
|
DecodedCert* cert, byte* certData, word32 length)
|
|
{
|
|
int ret;
|
|
|
|
if (request != NULL)
|
|
XMEMSET(request, 0, sizeof(OcspRequest));
|
|
|
|
InitDecodedCert(cert, certData, length, ssl->heap);
|
|
/* TODO: Setup async support here */
|
|
ret = ParseCertRelative(cert, CERT_TYPE, VERIFY, ssl->ctx->cm);
|
|
if (ret != 0) {
|
|
WOLFSSL_MSG("ParseCert failed");
|
|
}
|
|
if (ret == 0)
|
|
ret = InitOcspRequest(request, cert, 0, ssl->heap);
|
|
if (ret == 0) {
|
|
/* make sure ctx OCSP request is updated */
|
|
if (!ssl->buffers.weOwnCert) {
|
|
wolfSSL_Mutex* ocspLock = &ssl->ctx->cm->ocsp_stapling->ocspLock;
|
|
if (wc_LockMutex(ocspLock) == 0) {
|
|
if (ssl->ctx->certOcspRequest == NULL)
|
|
ssl->ctx->certOcspRequest = request;
|
|
wc_UnLockMutex(ocspLock);
|
|
}
|
|
}
|
|
}
|
|
|
|
FreeDecodedCert(cert);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* Creates OCSP response and places it in variable "response". Memory
|
|
* management for "buffer* response" is up to the caller.
|
|
*
|
|
* Also creates an OcspRequest in the case that ocspRequest is null or that
|
|
* ssl->buffers.weOwnCert is set. In those cases managing ocspRequest free'ing
|
|
* is up to the caller. NOTE: in OcspCreateRequest ssl->ctx->certOcspRequest can
|
|
* be set to point to "ocspRequest" and it then should not be free'd since
|
|
* wolfSSL_CTX_free will take care of it.
|
|
*
|
|
* Returns 0 on success
|
|
*/
|
|
int CreateOcspResponse(WOLFSSL* ssl, OcspRequest** ocspRequest,
|
|
buffer* response)
|
|
{
|
|
int ret = 0;
|
|
OcspRequest* request = NULL;
|
|
byte createdRequest = 0;
|
|
|
|
if (ssl == NULL || ocspRequest == NULL || response == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
XMEMSET(response, 0, sizeof(*response));
|
|
request = *ocspRequest;
|
|
|
|
/* unable to fetch status. skip. */
|
|
if (ssl->ctx->cm == NULL || ssl->ctx->cm->ocspStaplingEnabled == 0)
|
|
return 0;
|
|
|
|
if (request == NULL || ssl->buffers.weOwnCert) {
|
|
DerBuffer* der = ssl->buffers.certificate;
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
DecodedCert* cert = NULL;
|
|
#else
|
|
DecodedCert cert[1];
|
|
#endif
|
|
|
|
/* unable to fetch status. skip. */
|
|
if (der->buffer == NULL || der->length == 0)
|
|
return 0;
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
cert = (DecodedCert*)XMALLOC(sizeof(DecodedCert), ssl->heap,
|
|
DYNAMIC_TYPE_DCERT);
|
|
if (cert == NULL)
|
|
return MEMORY_E;
|
|
#endif
|
|
request = (OcspRequest*)XMALLOC(sizeof(OcspRequest), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_REQUEST);
|
|
if (request == NULL)
|
|
ret = MEMORY_E;
|
|
|
|
createdRequest = 1;
|
|
if (ret == 0) {
|
|
ret = CreateOcspRequest(ssl, request, cert, der->buffer,
|
|
der->length);
|
|
}
|
|
|
|
if (ret != 0) {
|
|
XFREE(request, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
request = NULL;
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(cert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
#endif
|
|
}
|
|
|
|
if (ret == 0) {
|
|
request->ssl = ssl;
|
|
ret = CheckOcspRequest(ssl->ctx->cm->ocsp_stapling, request, response);
|
|
|
|
/* Suppressing, not critical */
|
|
if (ret == OCSP_CERT_REVOKED ||
|
|
ret == OCSP_CERT_UNKNOWN ||
|
|
ret == OCSP_LOOKUP_FAIL) {
|
|
ret = 0;
|
|
}
|
|
}
|
|
|
|
/* free request up if error case found otherwise return it */
|
|
if (ret != 0 && createdRequest) {
|
|
FreeOcspRequest(request);
|
|
XFREE(request, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
}
|
|
|
|
if (ret == 0)
|
|
*ocspRequest = request;
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
#endif /* !NO_WOLFSSL_SERVER */
|
|
|
|
#if (!defined(WOLFSSL_NO_TLS12) && !defined(NO_CERTS)) \
|
|
|| (defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER))
|
|
static int cipherExtraData(WOLFSSL* ssl)
|
|
{
|
|
/* Cipher data that may be added by BuildMessage */
|
|
return ssl->specs.hash_size + ssl->specs.block_size +
|
|
ssl->specs.aead_mac_size + ssl->specs.iv_size +
|
|
ssl->specs.pad_size;
|
|
}
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifndef NO_CERTS
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
/* handle generation of certificate (11) */
|
|
int SendCertificate(WOLFSSL* ssl)
|
|
{
|
|
int ret = 0;
|
|
word32 certSz, certChainSz, headerSz, listSz, payloadSz;
|
|
word32 length, maxFragment;
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_SEND);
|
|
WOLFSSL_ENTER("SendCertificate");
|
|
|
|
if (ssl->options.usingPSK_cipher || ssl->options.usingAnon_cipher)
|
|
return 0; /* not needed */
|
|
|
|
if (ssl->options.sendVerify == SEND_BLANK_CERT) {
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->version.major == SSLv3_MAJOR
|
|
&& ssl->version.minor == SSLv3_MINOR){
|
|
SendAlert(ssl, alert_warning, no_certificate);
|
|
return 0;
|
|
} else {
|
|
#endif
|
|
certSz = 0;
|
|
certChainSz = 0;
|
|
headerSz = CERT_HEADER_SZ;
|
|
length = CERT_HEADER_SZ;
|
|
listSz = 0;
|
|
#ifdef OPENSSL_EXTRA
|
|
}
|
|
#endif
|
|
}
|
|
else {
|
|
if (!ssl->buffers.certificate) {
|
|
WOLFSSL_MSG("Send Cert missing certificate buffer");
|
|
return BUFFER_ERROR;
|
|
}
|
|
certSz = ssl->buffers.certificate->length;
|
|
headerSz = 2 * CERT_HEADER_SZ;
|
|
/* list + cert size */
|
|
length = certSz + headerSz;
|
|
listSz = certSz + CERT_HEADER_SZ;
|
|
|
|
/* may need to send rest of chain, already has leading size(s) */
|
|
if (certSz && ssl->buffers.certChain) {
|
|
certChainSz = ssl->buffers.certChain->length;
|
|
length += certChainSz;
|
|
listSz += certChainSz;
|
|
}
|
|
else
|
|
certChainSz = 0;
|
|
}
|
|
|
|
payloadSz = length;
|
|
|
|
if (ssl->fragOffset != 0)
|
|
length -= (ssl->fragOffset + headerSz);
|
|
|
|
maxFragment = MAX_RECORD_SIZE;
|
|
|
|
if (ssl->options.dtls) {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* The 100 bytes is used to account for the UDP and IP headers.
|
|
It can also include the record padding and MAC if the
|
|
SendCertificate is called for a secure renegotiation. */
|
|
maxFragment = MAX_MTU - DTLS_RECORD_HEADER_SZ
|
|
- DTLS_HANDSHAKE_HEADER_SZ - 100;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
|
|
maxFragment = wolfSSL_GetMaxRecordSize(ssl, maxFragment);
|
|
|
|
while (length > 0 && ret == 0) {
|
|
byte* output = NULL;
|
|
word32 fragSz = 0;
|
|
word32 i = RECORD_HEADER_SZ;
|
|
int sendSz = RECORD_HEADER_SZ;
|
|
|
|
if (!ssl->options.dtls) {
|
|
if (ssl->fragOffset == 0) {
|
|
if (headerSz + certSz + certChainSz <=
|
|
maxFragment - HANDSHAKE_HEADER_SZ) {
|
|
|
|
fragSz = headerSz + certSz + certChainSz;
|
|
}
|
|
else {
|
|
fragSz = maxFragment - HANDSHAKE_HEADER_SZ;
|
|
}
|
|
sendSz += fragSz + HANDSHAKE_HEADER_SZ;
|
|
i += HANDSHAKE_HEADER_SZ;
|
|
}
|
|
else {
|
|
fragSz = min(length, maxFragment);
|
|
sendSz += fragSz;
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
fragSz = min(length, maxFragment);
|
|
sendSz += fragSz + DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA
|
|
+ HANDSHAKE_HEADER_SZ;
|
|
i += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA
|
|
+ HANDSHAKE_HEADER_SZ;
|
|
#endif
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += cipherExtraData(ssl);
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
if (ssl->fragOffset == 0) {
|
|
if (!ssl->options.dtls) {
|
|
AddFragHeaders(output, fragSz, 0, payloadSz, certificate, ssl);
|
|
if (!IsEncryptionOn(ssl, 1))
|
|
HashRaw(ssl, output + RECORD_HEADER_SZ,
|
|
HANDSHAKE_HEADER_SZ);
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
AddHeaders(output, payloadSz, certificate, ssl);
|
|
HashRaw(ssl,
|
|
output + RECORD_HEADER_SZ + DTLS_RECORD_EXTRA,
|
|
HANDSHAKE_HEADER_SZ + DTLS_HANDSHAKE_EXTRA);
|
|
/* Adding the headers increments these, decrement them for
|
|
* actual message header. */
|
|
ssl->keys.dtls_handshake_number--;
|
|
AddFragHeaders(output, fragSz, 0, payloadSz, certificate, ssl);
|
|
ssl->keys.dtls_handshake_number--;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
|
|
/* list total */
|
|
c32to24(listSz, output + i);
|
|
if (ssl->options.dtls || !IsEncryptionOn(ssl, 1))
|
|
HashRaw(ssl, output + i, CERT_HEADER_SZ);
|
|
i += CERT_HEADER_SZ;
|
|
length -= CERT_HEADER_SZ;
|
|
fragSz -= CERT_HEADER_SZ;
|
|
if (certSz) {
|
|
c32to24(certSz, output + i);
|
|
if (ssl->options.dtls || !IsEncryptionOn(ssl, 1))
|
|
HashRaw(ssl, output + i, CERT_HEADER_SZ);
|
|
i += CERT_HEADER_SZ;
|
|
length -= CERT_HEADER_SZ;
|
|
fragSz -= CERT_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls || !IsEncryptionOn(ssl, 1)) {
|
|
HashRaw(ssl, ssl->buffers.certificate->buffer, certSz);
|
|
if (certChainSz)
|
|
HashRaw(ssl, ssl->buffers.certChain->buffer,
|
|
certChainSz);
|
|
}
|
|
}
|
|
}
|
|
else {
|
|
if (!ssl->options.dtls) {
|
|
AddRecordHeader(output, fragSz, handshake, ssl, CUR_ORDER);
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
AddFragHeaders(output, fragSz, ssl->fragOffset + headerSz,
|
|
payloadSz, certificate, ssl);
|
|
ssl->keys.dtls_handshake_number--;
|
|
#endif /* WOLFSSL_DTLS */
|
|
}
|
|
}
|
|
|
|
/* member */
|
|
if (certSz && ssl->fragOffset < certSz) {
|
|
word32 copySz = min(certSz - ssl->fragOffset, fragSz);
|
|
XMEMCPY(output + i,
|
|
ssl->buffers.certificate->buffer + ssl->fragOffset, copySz);
|
|
i += copySz;
|
|
ssl->fragOffset += copySz;
|
|
length -= copySz;
|
|
fragSz -= copySz;
|
|
}
|
|
if (certChainSz && fragSz) {
|
|
word32 copySz = min(certChainSz + certSz - ssl->fragOffset, fragSz);
|
|
XMEMCPY(output + i,
|
|
ssl->buffers.certChain->buffer + ssl->fragOffset - certSz,
|
|
copySz);
|
|
i += copySz;
|
|
ssl->fragOffset += copySz;
|
|
length -= copySz;
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input = NULL;
|
|
int inputSz = i; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz -= recordHeaderSz;
|
|
|
|
if (inputSz < 0) {
|
|
WOLFSSL_MSG("Send Cert bad inputSz");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
if (inputSz > 0) { /* clang thinks could be zero, let's help */
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap,
|
|
DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
}
|
|
|
|
#ifndef WOLFSSL_DTLS
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
#else
|
|
if (!ssl->options.dtls)
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
else /* DTLS 1.2 has to ignore fragmentation in hashing so we need to
|
|
* calculate the hash ourselves above */ {
|
|
if ((ret = DtlsMsgPoolSave(ssl, input, inputSz, certificate)) != 0) {
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
return ret;
|
|
}
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 0, 0, 0, CUR_ORDER);
|
|
}
|
|
#endif
|
|
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
}
|
|
else {
|
|
sendSz = i;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, certificate)) != 0)
|
|
return ret;
|
|
}
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "Certificate");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "Certificate", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
if (!ssl->options.groupMessages)
|
|
ret = SendBuffered(ssl);
|
|
}
|
|
|
|
if (ret != WANT_WRITE) {
|
|
/* Clean up the fragment offset. */
|
|
ssl->fragOffset = 0;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
ssl->keys.dtls_handshake_number++;
|
|
#endif
|
|
if (ssl->options.side == WOLFSSL_SERVER_END){
|
|
ssl->options.serverState = SERVER_CERT_COMPLETE;
|
|
}
|
|
}
|
|
|
|
WOLFSSL_LEAVE("SendCertificate", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_SEND);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* !NO_WOLFSSL_SERVER || !WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
/* handle generation of certificate_request (13) */
|
|
int SendCertificateRequest(WOLFSSL* ssl)
|
|
{
|
|
byte *output;
|
|
int ret;
|
|
int sendSz;
|
|
word32 i = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
word32 dnLen = 0;
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(HAVE_LIGHTY)
|
|
WOLF_STACK_OF(WOLFSSL_X509_NAME)* names;
|
|
#endif
|
|
|
|
int typeTotal = 1; /* only 1 for now */
|
|
int reqSz = ENUM_LEN + typeTotal + REQ_HEADER_SZ; /* add auth later */
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_REQUEST_SEND);
|
|
WOLFSSL_ENTER("SendCertificateRequest");
|
|
|
|
if (IsAtLeastTLSv1_2(ssl))
|
|
reqSz += LENGTH_SZ + ssl->suites->hashSigAlgoSz;
|
|
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(HAVE_LIGHTY)
|
|
/* Certificate Authorities */
|
|
names = ssl->ctx->ca_names;
|
|
while (names != NULL) {
|
|
byte seq[MAX_SEQ_SZ];
|
|
|
|
/* 16-bit length | SEQ | Len | DER of name */
|
|
dnLen += OPAQUE16_LEN + SetSequence(names->data.name->rawLen, seq) +
|
|
names->data.name->rawLen;
|
|
names = names->next;
|
|
}
|
|
reqSz += dnLen;
|
|
#endif
|
|
|
|
if (ssl->options.usingPSK_cipher || ssl->options.usingAnon_cipher)
|
|
return 0; /* not needed */
|
|
|
|
sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ + reqSz;
|
|
|
|
if (!ssl->options.dtls) {
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
i += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
#endif
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += cipherExtraData(ssl);
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, reqSz, certificate_request, ssl);
|
|
|
|
/* write to output */
|
|
output[i++] = (byte)typeTotal; /* # of types */
|
|
#ifdef HAVE_ECC
|
|
if ((ssl->options.cipherSuite0 == ECC_BYTE ||
|
|
ssl->options.cipherSuite0 == CHACHA_BYTE) &&
|
|
ssl->specs.sig_algo == ecc_dsa_sa_algo) {
|
|
output[i++] = ecdsa_sign;
|
|
} else
|
|
#endif /* HAVE_ECC */
|
|
{
|
|
output[i++] = rsa_sign;
|
|
}
|
|
|
|
/* supported hash/sig */
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
c16toa(ssl->suites->hashSigAlgoSz, &output[i]);
|
|
i += OPAQUE16_LEN;
|
|
|
|
XMEMCPY(&output[i],
|
|
ssl->suites->hashSigAlgo, ssl->suites->hashSigAlgoSz);
|
|
i += ssl->suites->hashSigAlgoSz;
|
|
}
|
|
|
|
/* Certificate Authorities */
|
|
c16toa((word16)dnLen, &output[i]); /* auth's */
|
|
i += REQ_HEADER_SZ;
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(HAVE_LIGHTY)
|
|
names = ssl->ctx->ca_names;
|
|
while (names != NULL) {
|
|
byte seq[MAX_SEQ_SZ];
|
|
|
|
c16toa((word16)names->data.name->rawLen +
|
|
SetSequence(names->data.name->rawLen, seq), &output[i]);
|
|
i += OPAQUE16_LEN;
|
|
i += SetSequence(names->data.name->rawLen, output + i);
|
|
XMEMCPY(output + i, names->data.name->raw, names->data.name->rawLen);
|
|
i += names->data.name->rawLen;
|
|
names = names->next;
|
|
}
|
|
#endif
|
|
(void)i;
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input = NULL;
|
|
int inputSz = i; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz -= recordHeaderSz;
|
|
|
|
if (inputSz <= 0) {
|
|
WOLFSSL_MSG("Send Cert Req bad inputSz");
|
|
return BUFFER_E;
|
|
}
|
|
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, input, inputSz, certificate_request)) != 0) {
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
return ret;
|
|
}
|
|
#endif
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
} else {
|
|
sendSz = i;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, certificate_request)) != 0)
|
|
return ret;
|
|
}
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
ret = HashOutput(ssl, output, sendSz, 0);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "CertificateRequest");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "CertificateRequest", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
if (ssl->options.groupMessages)
|
|
ret = 0;
|
|
else
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendCertificateRequest", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_REQUEST_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
|
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
static int BuildCertificateStatus(WOLFSSL* ssl, byte type, buffer* status,
|
|
byte count)
|
|
{
|
|
byte* output = NULL;
|
|
word32 idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
word32 length = ENUM_LEN;
|
|
int sendSz = 0;
|
|
int ret = 0;
|
|
int i = 0;
|
|
|
|
WOLFSSL_ENTER("BuildCertificateStatus");
|
|
|
|
switch (type) {
|
|
case WOLFSSL_CSR2_OCSP_MULTI:
|
|
length += OPAQUE24_LEN;
|
|
FALL_THROUGH; /* followed by */
|
|
|
|
case WOLFSSL_CSR2_OCSP:
|
|
for (i = 0; i < count; i++)
|
|
length += OPAQUE24_LEN + status[i].length;
|
|
break;
|
|
|
|
default:
|
|
return 0;
|
|
}
|
|
|
|
sendSz = idx + length;
|
|
|
|
if (ssl->keys.encryptionOn)
|
|
sendSz += MAX_MSG_EXTRA;
|
|
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) == 0) {
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, length, certificate_status, ssl);
|
|
|
|
output[idx++] = type;
|
|
|
|
if (type == WOLFSSL_CSR2_OCSP_MULTI) {
|
|
c32to24(length - (ENUM_LEN + OPAQUE24_LEN), output + idx);
|
|
idx += OPAQUE24_LEN;
|
|
}
|
|
|
|
for (i = 0; i < count; i++) {
|
|
c32to24(status[i].length, output + idx);
|
|
idx += OPAQUE24_LEN;
|
|
|
|
XMEMCPY(output + idx, status[i].buffer, status[i].length);
|
|
idx += status[i].length;
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input;
|
|
int inputSz = idx; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz -= recordHeaderSz;
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
#ifdef WOLFSSL_DTLS
|
|
ret = DtlsMsgPoolSave(ssl, input, inputSz, certificate_status);
|
|
#endif
|
|
if (ret == 0)
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
ret = sendSz;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ret == 0 && IsDtlsNotSctpMode(ssl))
|
|
ret = DtlsMsgPoolSave(ssl, output, sendSz, certificate_status);
|
|
if (ret == 0 && ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
ret = HashOutput(ssl, output, sendSz, 0);
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ret == 0 && ssl->hsInfoOn)
|
|
AddPacketName(ssl, "CertificateStatus");
|
|
if (ret == 0 && ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "CertificateStatus", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
if (ret == 0) {
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
if (!ssl->options.groupMessages)
|
|
ret = SendBuffered(ssl);
|
|
}
|
|
}
|
|
|
|
WOLFSSL_LEAVE("BuildCertificateStatus", ret);
|
|
return ret;
|
|
}
|
|
#endif
|
|
#endif /* NO_WOLFSSL_SERVER */
|
|
|
|
/* handle generation of certificate_status (22) */
|
|
int SendCertificateStatus(WOLFSSL* ssl)
|
|
{
|
|
int ret = 0;
|
|
byte status_type = 0;
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_STATUS_SEND);
|
|
WOLFSSL_ENTER("SendCertificateStatus");
|
|
|
|
(void) ssl;
|
|
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST
|
|
status_type = ssl->status_request;
|
|
#endif
|
|
|
|
#ifdef HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
status_type = status_type ? status_type : ssl->status_request_v2;
|
|
#endif
|
|
|
|
switch (status_type) {
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) \
|
|
|| defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)
|
|
/* case WOLFSSL_CSR_OCSP: */
|
|
case WOLFSSL_CSR2_OCSP:
|
|
{
|
|
OcspRequest* request = ssl->ctx->certOcspRequest;
|
|
buffer response;
|
|
|
|
ret = CreateOcspResponse(ssl, &request, &response);
|
|
|
|
/* if a request was successfully created and not stored in
|
|
* ssl->ctx then free it */
|
|
if (ret == 0 && request != ssl->ctx->certOcspRequest) {
|
|
FreeOcspRequest(request);
|
|
XFREE(request, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
request = NULL;
|
|
}
|
|
|
|
if (ret == 0 && response.buffer) {
|
|
ret = BuildCertificateStatus(ssl, status_type, &response, 1);
|
|
|
|
XFREE(response.buffer, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
response.buffer = NULL;
|
|
}
|
|
break;
|
|
}
|
|
|
|
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST */
|
|
/* HAVE_CERTIFICATE_STATUS_REQUEST_V2 */
|
|
|
|
#if defined HAVE_CERTIFICATE_STATUS_REQUEST_V2
|
|
case WOLFSSL_CSR2_OCSP_MULTI:
|
|
{
|
|
OcspRequest* request = ssl->ctx->certOcspRequest;
|
|
buffer responses[1 + MAX_CHAIN_DEPTH];
|
|
int i = 0;
|
|
|
|
XMEMSET(responses, 0, sizeof(responses));
|
|
|
|
ret = CreateOcspResponse(ssl, &request, &responses[0]);
|
|
|
|
/* if a request was successfully created and not stored in
|
|
* ssl->ctx then free it */
|
|
if (ret == 0 && request != ssl->ctx->certOcspRequest) {
|
|
FreeOcspRequest(request);
|
|
XFREE(request, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
request = NULL;
|
|
}
|
|
|
|
if (ret == 0 && (!ssl->ctx->chainOcspRequest[0]
|
|
|| ssl->buffers.weOwnCertChain)) {
|
|
buffer der;
|
|
word32 idx = 0;
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
DecodedCert* cert;
|
|
#else
|
|
DecodedCert cert[1];
|
|
#endif
|
|
DerBuffer* chain;
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
cert = (DecodedCert*)XMALLOC(sizeof(DecodedCert), ssl->heap,
|
|
DYNAMIC_TYPE_DCERT);
|
|
if (cert == NULL)
|
|
return MEMORY_E;
|
|
#endif
|
|
request = (OcspRequest*)XMALLOC(sizeof(OcspRequest), ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_REQUEST);
|
|
if (request == NULL) {
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(cert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
#endif
|
|
return MEMORY_E;
|
|
}
|
|
|
|
/* use certChain if available, otherwise use peer certificate */
|
|
chain = ssl->buffers.certChain;
|
|
if (chain == NULL) {
|
|
chain = ssl->buffers.certificate;
|
|
}
|
|
|
|
while (chain && idx + OPAQUE24_LEN < chain->length) {
|
|
c24to32(chain->buffer + idx, &der.length);
|
|
idx += OPAQUE24_LEN;
|
|
|
|
der.buffer = chain->buffer + idx;
|
|
idx += der.length;
|
|
|
|
if (idx > chain->length)
|
|
break;
|
|
|
|
ret = CreateOcspRequest(ssl, request, cert, der.buffer,
|
|
der.length);
|
|
if (ret == 0) {
|
|
request->ssl = ssl;
|
|
ret = CheckOcspRequest(ssl->ctx->cm->ocsp_stapling,
|
|
request, &responses[i + 1]);
|
|
|
|
/* Suppressing, not critical */
|
|
if (ret == OCSP_CERT_REVOKED ||
|
|
ret == OCSP_CERT_UNKNOWN ||
|
|
ret == OCSP_LOOKUP_FAIL) {
|
|
ret = 0;
|
|
}
|
|
|
|
|
|
i++;
|
|
FreeOcspRequest(request);
|
|
}
|
|
}
|
|
|
|
XFREE(request, ssl->heap, DYNAMIC_TYPE_OCSP_REQUEST);
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(cert, ssl->heap, DYNAMIC_TYPE_DCERT);
|
|
#endif
|
|
}
|
|
else {
|
|
while (ret == 0 &&
|
|
NULL != (request = ssl->ctx->chainOcspRequest[i])) {
|
|
request->ssl = ssl;
|
|
ret = CheckOcspRequest(ssl->ctx->cm->ocsp_stapling,
|
|
request, &responses[++i]);
|
|
|
|
/* Suppressing, not critical */
|
|
if (ret == OCSP_CERT_REVOKED ||
|
|
ret == OCSP_CERT_UNKNOWN ||
|
|
ret == OCSP_LOOKUP_FAIL) {
|
|
ret = 0;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (responses[0].buffer) {
|
|
if (ret == 0) {
|
|
ret = BuildCertificateStatus(ssl, status_type, responses,
|
|
(byte)i + 1);
|
|
}
|
|
|
|
for (i = 0; i < 1 + MAX_CHAIN_DEPTH; i++) {
|
|
if (responses[i].buffer) {
|
|
XFREE(responses[i].buffer, ssl->heap,
|
|
DYNAMIC_TYPE_OCSP_REQUEST);
|
|
}
|
|
}
|
|
}
|
|
|
|
break;
|
|
}
|
|
#endif /* HAVE_CERTIFICATE_STATUS_REQUEST_V2 */
|
|
#endif /* NO_WOLFSSL_SERVER */
|
|
|
|
default:
|
|
break;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("SendCertificateStatus", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_STATUS_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !NO_CERTS */
|
|
|
|
#endif /* WOLFSSL_NO_TLS12 */
|
|
|
|
|
|
|
|
#if defined(HAVE_SECURE_RENEGOTIATION) && defined(WOLFSSL_DTLS)
|
|
/**
|
|
* Check if the SCR keys are set in ssl->secure_renegotiation->tmp_keys.
|
|
*/
|
|
int DtlsSCRKeysSet(WOLFSSL* ssl)
|
|
{
|
|
return ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->tmp_keys.dtls_epoch != 0;
|
|
}
|
|
|
|
/**
|
|
* ssl->keys contains the current cipher parameters only for epoch 1. For
|
|
* epochs >1 ssl->secure_renegotiation->tmp_keys contains the current
|
|
* cipher parameters. This function checks if the message currently being
|
|
* processed should use ssl->keys or ssl->secure_renegotiation->tmp_keys.
|
|
*/
|
|
int IsDtlsMsgSCRKeys(WOLFSSL* ssl)
|
|
{
|
|
return DtlsSCRKeysSet(ssl) &&
|
|
ssl->keys.curEpoch ==
|
|
ssl->secure_renegotiation->tmp_keys.dtls_epoch;
|
|
}
|
|
|
|
/**
|
|
* ssl->keys contains the current cipher parameters only for epoch 1. For
|
|
* epochs >1 ssl->secure_renegotiation->tmp_keys contains the current
|
|
* cipher parameters. This function checks if the message currently being
|
|
* built should use ssl->keys or ssl->secure_renegotiation->tmp_keys.
|
|
*/
|
|
int DtlsUseSCRKeys(WOLFSSL* ssl)
|
|
{
|
|
return DtlsSCRKeysSet(ssl) &&
|
|
ssl->secure_renegotiation->tmp_keys.dtls_epoch ==
|
|
ssl->keys.dtls_epoch;
|
|
}
|
|
|
|
/**
|
|
* If ssl->secure_renegotiation->tmp_keys.dtls_epoch > ssl->keys.dtls_epoch
|
|
* then PREV_ORDER refers to the current epoch.
|
|
* */
|
|
int DtlsCheckOrder(WOLFSSL* ssl, int order)
|
|
{
|
|
if (order == PREV_ORDER && ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->tmp_keys.dtls_epoch > ssl->keys.dtls_epoch) {
|
|
return CUR_ORDER;
|
|
}
|
|
else {
|
|
return order;
|
|
}
|
|
}
|
|
#endif /* HAVE_SECURE_RENEGOTIATION && WOLFSSL_DTLS */
|
|
|
|
/* If secure renegotiation is disabled, this will always return false.
|
|
* Otherwise it checks to see if we are currently renegotiating. */
|
|
int IsSCR(WOLFSSL* ssl)
|
|
{
|
|
#ifndef HAVE_SECURE_RENEGOTIATION
|
|
(void)ssl;
|
|
#else /* HAVE_SECURE_RENEGOTIATION */
|
|
if (ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->enabled && /* Is SCR enabled? */
|
|
ssl->options.handShakeDone && /* At least one handshake done? */
|
|
ssl->options.handShakeState != HANDSHAKE_DONE) /* Currently handshaking? */
|
|
return 1;
|
|
#endif /* HAVE_SECURE_RENEGOTIATION */
|
|
return 0;
|
|
}
|
|
|
|
|
|
int SendData(WOLFSSL* ssl, const void* data, int sz)
|
|
{
|
|
int sent = 0, /* plainText size */
|
|
sendSz,
|
|
ret,
|
|
dtlsExtra = 0;
|
|
int groupMsgs = 0;
|
|
|
|
if (ssl->error == WANT_WRITE
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
|| ssl->error == WC_PENDING_E
|
|
#endif
|
|
) {
|
|
ssl->error = 0;
|
|
}
|
|
|
|
/* don't allow write after decrypt or mac error */
|
|
if (ssl->error == VERIFY_MAC_ERROR || ssl->error == DECRYPT_ERROR) {
|
|
/* For DTLS allow these possible errors and allow the session
|
|
to continue despite them */
|
|
if (ssl->options.dtls) {
|
|
ssl->error = 0;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Not allowing write after decrypt or mac error");
|
|
return WOLFSSL_FATAL_ERROR;
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->earlyData != no_early_data) {
|
|
if (ssl->options.handShakeState == HANDSHAKE_DONE) {
|
|
WOLFSSL_MSG("handshake complete, trying to send early data");
|
|
ssl->error = BUILD_MSG_ERROR;
|
|
return WOLFSSL_FATAL_ERROR;
|
|
}
|
|
#ifdef WOLFSSL_EARLY_DATA_GROUP
|
|
groupMsgs = 1;
|
|
#endif
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->options.handShakeState != HANDSHAKE_DONE && !IsSCR(ssl)) {
|
|
int err;
|
|
WOLFSSL_MSG("handshake not complete, trying to finish");
|
|
if ( (err = wolfSSL_negotiate(ssl)) != WOLFSSL_SUCCESS) {
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* if async would block return WANT_WRITE */
|
|
if (ssl->error == WC_PENDING_E) {
|
|
return WOLFSSL_CBIO_ERR_WANT_WRITE;
|
|
}
|
|
#endif
|
|
return err;
|
|
}
|
|
}
|
|
|
|
/* last time system socket output buffer was full, try again to send */
|
|
if (!groupMsgs && ssl->buffers.outputBuffer.length > 0) {
|
|
WOLFSSL_MSG("output buffer was full, trying to send again");
|
|
if ( (ssl->error = SendBuffered(ssl)) < 0) {
|
|
WOLFSSL_ERROR(ssl->error);
|
|
if (ssl->error == SOCKET_ERROR_E && (ssl->options.connReset ||
|
|
ssl->options.isClosed)) {
|
|
ssl->error = SOCKET_PEER_CLOSED_E;
|
|
WOLFSSL_ERROR(ssl->error);
|
|
return 0; /* peer reset or closed */
|
|
}
|
|
return ssl->error;
|
|
}
|
|
else {
|
|
/* advance sent to previous sent + plain size just sent */
|
|
sent = ssl->buffers.prevSent + ssl->buffers.plainSz;
|
|
WOLFSSL_MSG("sent write buffered data");
|
|
|
|
if (sent > sz) {
|
|
WOLFSSL_MSG("error: write() after WANT_WRITE with short size");
|
|
return ssl->error = BAD_FUNC_ARG;
|
|
}
|
|
}
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
dtlsExtra = DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
for (;;) {
|
|
int len;
|
|
byte* out;
|
|
byte* sendBuffer = (byte*)data + sent; /* may switch on comp */
|
|
int buffSz; /* may switch on comp */
|
|
int outputSz;
|
|
#ifdef HAVE_LIBZ
|
|
byte comp[MAX_RECORD_SIZE + MAX_COMP_EXTRA];
|
|
#endif
|
|
|
|
if (sent == sz) break;
|
|
|
|
len = wolfSSL_GetMaxRecordSize(ssl, sz - sent);
|
|
|
|
#if defined(WOLFSSL_DTLS) && !defined(WOLFSSL_NO_DTLS_SIZE_CHECK)
|
|
if (ssl->options.dtls && (len < sz - sent)) {
|
|
ssl->error = DTLS_SIZE_ERROR;
|
|
WOLFSSL_ERROR(ssl->error);
|
|
return ssl->error;
|
|
}
|
|
#endif
|
|
buffSz = len;
|
|
|
|
/* check for available size */
|
|
outputSz = len + COMP_EXTRA + dtlsExtra + MAX_MSG_EXTRA;
|
|
if ((ret = CheckAvailableSize(ssl, outputSz)) != 0)
|
|
return ssl->error = ret;
|
|
|
|
/* get output buffer */
|
|
out = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
#ifdef HAVE_LIBZ
|
|
if (ssl->options.usingCompression) {
|
|
buffSz = myCompress(ssl, sendBuffer, buffSz, comp, sizeof(comp));
|
|
if (buffSz < 0) {
|
|
return buffSz;
|
|
}
|
|
sendBuffer = comp;
|
|
}
|
|
#endif
|
|
if (!ssl->options.tls1_3) {
|
|
sendSz = BuildMessage(ssl, out, outputSz, sendBuffer, buffSz,
|
|
application_data, 0, 0, 1, CUR_ORDER);
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_TLS13
|
|
sendSz = BuildTls13Message(ssl, out, outputSz, sendBuffer, buffSz,
|
|
application_data, 0, 0, 1);
|
|
#else
|
|
sendSz = BUFFER_ERROR;
|
|
#endif
|
|
}
|
|
if (sendSz < 0) {
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (sendSz == WC_PENDING_E)
|
|
ssl->error = sendSz;
|
|
#endif
|
|
return BUILD_MSG_ERROR;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
if ( (ssl->error = SendBuffered(ssl)) < 0) {
|
|
WOLFSSL_ERROR(ssl->error);
|
|
/* store for next call if WANT_WRITE or user embedSend() that
|
|
doesn't present like WANT_WRITE */
|
|
ssl->buffers.plainSz = len;
|
|
ssl->buffers.prevSent = sent;
|
|
if (ssl->error == SOCKET_ERROR_E && (ssl->options.connReset ||
|
|
ssl->options.isClosed)) {
|
|
ssl->error = SOCKET_PEER_CLOSED_E;
|
|
WOLFSSL_ERROR(ssl->error);
|
|
return 0; /* peer reset or closed */
|
|
}
|
|
return ssl->error;
|
|
}
|
|
|
|
sent += len;
|
|
|
|
/* only one message per attempt */
|
|
if (ssl->options.partialWrite == 1) {
|
|
WOLFSSL_MSG("Partial Write on, only sending one record");
|
|
break;
|
|
}
|
|
}
|
|
|
|
return sent;
|
|
}
|
|
|
|
/* process input data */
|
|
int ReceiveData(WOLFSSL* ssl, byte* output, int sz, int peek)
|
|
{
|
|
int size;
|
|
|
|
WOLFSSL_ENTER("ReceiveData()");
|
|
|
|
/* reset error state */
|
|
if (ssl->error == WANT_READ) {
|
|
ssl->error = 0;
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
/* In DTLS mode, we forgive some errors and allow the session
|
|
* to continue despite them. */
|
|
if (ssl->error == VERIFY_MAC_ERROR || ssl->error == DECRYPT_ERROR)
|
|
ssl->error = 0;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
if (ssl->error != 0 && ssl->error != WANT_WRITE
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ssl->error != WC_PENDING_E
|
|
#endif
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
&& ssl->error != APP_DATA_READY
|
|
#endif
|
|
) {
|
|
WOLFSSL_MSG("User calling wolfSSL_read in error state, not allowed");
|
|
return ssl->error;
|
|
}
|
|
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
if (ssl->earlyData != no_early_data) {
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
int negotiate = 0;
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) {
|
|
if (ssl->options.handShakeState != HANDSHAKE_DONE
|
|
&& ssl->buffers.clearOutputBuffer.length == 0)
|
|
negotiate = 1;
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->options.handShakeState != HANDSHAKE_DONE)
|
|
negotiate = 1;
|
|
|
|
if (negotiate) {
|
|
int err;
|
|
WOLFSSL_MSG("Handshake not complete, trying to finish");
|
|
if ( (err = wolfSSL_negotiate(ssl)) != WOLFSSL_SUCCESS) {
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* if async would block return WANT_WRITE */
|
|
if (ssl->error == WC_PENDING_E) {
|
|
return WOLFSSL_CBIO_ERR_WANT_READ;
|
|
}
|
|
#endif
|
|
return err;
|
|
}
|
|
}
|
|
}
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
startScr:
|
|
if (ssl->secure_renegotiation && ssl->secure_renegotiation->startScr) {
|
|
int ret;
|
|
WOLFSSL_MSG("Need to start scr, server requested");
|
|
ret = wolfSSL_Rehandshake(ssl);
|
|
ssl->secure_renegotiation->startScr = 0; /* only start once */
|
|
if (ret != WOLFSSL_SUCCESS)
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
while (ssl->buffers.clearOutputBuffer.length == 0) {
|
|
if ( (ssl->error = ProcessReply(ssl)) < 0) {
|
|
WOLFSSL_ERROR(ssl->error);
|
|
if (ssl->error == ZERO_RETURN) {
|
|
WOLFSSL_MSG("Zero return, no more data coming");
|
|
return 0; /* no more data coming */
|
|
}
|
|
if (ssl->error == SOCKET_ERROR_E) {
|
|
if (ssl->options.connReset || ssl->options.isClosed) {
|
|
WOLFSSL_MSG("Peer reset or closed, connection done");
|
|
ssl->error = SOCKET_PEER_CLOSED_E;
|
|
WOLFSSL_ERROR(ssl->error);
|
|
return 0; /* peer reset or closed */
|
|
}
|
|
}
|
|
return ssl->error;
|
|
}
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->startScr) {
|
|
goto startScr;
|
|
}
|
|
if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled &&
|
|
ssl->options.handShakeState != HANDSHAKE_DONE
|
|
&& ssl->buffers.clearOutputBuffer.length == 0) {
|
|
/* ProcessReply processed a handshake packet and not any APP DATA
|
|
* so let's move the handshake along */
|
|
int err;
|
|
WOLFSSL_MSG("Handshake not complete, trying to finish");
|
|
if ( (err = wolfSSL_negotiate(ssl)) != WOLFSSL_SUCCESS) {
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* if async would block return WANT_WRITE */
|
|
if (ssl->error == WC_PENDING_E) {
|
|
return WOLFSSL_CBIO_ERR_WANT_READ;
|
|
}
|
|
#endif
|
|
return err;
|
|
}
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version) && ssl->options.handShakeDone &&
|
|
ssl->curRL.type == handshake && peek) {
|
|
WOLFSSL_MSG("Got Handshake Messge in APP data");
|
|
if (ssl->buffers.inputBuffer.length == 0) {
|
|
ssl->error = WOLFSSL_ERROR_WANT_READ;
|
|
return 0;
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
size = min(sz, (int)ssl->buffers.clearOutputBuffer.length);
|
|
|
|
XMEMCPY(output, ssl->buffers.clearOutputBuffer.buffer, size);
|
|
|
|
if (peek == 0) {
|
|
ssl->buffers.clearOutputBuffer.length -= size;
|
|
ssl->buffers.clearOutputBuffer.buffer += size;
|
|
}
|
|
|
|
if (ssl->buffers.clearOutputBuffer.length == 0 &&
|
|
ssl->buffers.inputBuffer.dynamicFlag)
|
|
ShrinkInputBuffer(ssl, NO_FORCED_FREE);
|
|
|
|
WOLFSSL_LEAVE("ReceiveData()", size);
|
|
return size;
|
|
}
|
|
|
|
|
|
/* send alert message */
|
|
int SendAlert(WOLFSSL* ssl, int severity, int type)
|
|
{
|
|
byte input[ALERT_SIZE];
|
|
byte *output;
|
|
int sendSz;
|
|
int ret;
|
|
int outputSz;
|
|
int dtlsExtra = 0;
|
|
|
|
WOLFSSL_ENTER("SendAlert");
|
|
|
|
#ifdef HAVE_WRITE_DUP
|
|
if (ssl->dupWrite && ssl->dupSide == READ_DUP_SIDE) {
|
|
int notifyErr = 0;
|
|
|
|
WOLFSSL_MSG("Read dup side cannot write alerts, notifying sibling");
|
|
|
|
if (type == close_notify) {
|
|
notifyErr = ZERO_RETURN;
|
|
} else if (severity == alert_fatal) {
|
|
notifyErr = FATAL_ERROR;
|
|
}
|
|
|
|
if (notifyErr != 0) {
|
|
return NotifyWriteSide(ssl, notifyErr);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/* if sendalert is called again for nonblocking */
|
|
if (ssl->options.sendAlertState != 0) {
|
|
ret = SendBuffered(ssl);
|
|
if (ret == 0)
|
|
ssl->options.sendAlertState = 0;
|
|
return ret;
|
|
}
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->CBIS != NULL) {
|
|
ssl->CBIS(ssl, SSL_CB_ALERT, type);
|
|
}
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
dtlsExtra = DTLS_RECORD_EXTRA;
|
|
#endif
|
|
|
|
/* check for available size */
|
|
outputSz = ALERT_SIZE + MAX_MSG_EXTRA + dtlsExtra;
|
|
if ((ret = CheckAvailableSize(ssl, outputSz)) != 0)
|
|
return ret;
|
|
|
|
/* Check output buffer */
|
|
if (ssl->buffers.outputBuffer.buffer == NULL)
|
|
return BUFFER_E;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
input[0] = (byte)severity;
|
|
input[1] = (byte)type;
|
|
ssl->alert_history.last_tx.code = type;
|
|
ssl->alert_history.last_tx.level = severity;
|
|
if (severity == alert_fatal) {
|
|
ssl->options.isClosed = 1; /* Don't send close_notify */
|
|
}
|
|
|
|
/* send encrypted alert if encryption is on - can be a rehandshake over
|
|
* an existing encrypted channel.
|
|
* TLS 1.3 encrypts handshake packets after the ServerHello
|
|
*/
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
sendSz = BuildMessage(ssl, output, outputSz, input, ALERT_SIZE, alert,
|
|
0, 0, 0, CUR_ORDER);
|
|
}
|
|
else {
|
|
|
|
AddRecordHeader(output, ALERT_SIZE, alert, ssl, CUR_ORDER);
|
|
output += RECORD_HEADER_SZ;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
output += DTLS_RECORD_EXTRA;
|
|
#endif
|
|
XMEMCPY(output, input, ALERT_SIZE);
|
|
|
|
sendSz = RECORD_HEADER_SZ + ALERT_SIZE;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
sendSz += DTLS_RECORD_EXTRA;
|
|
#endif
|
|
}
|
|
if (sendSz < 0)
|
|
return BUILD_MSG_ERROR;
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "Alert");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "Alert", alert, output, sendSz, WRITE_PROTO,
|
|
ssl->heap);
|
|
#endif
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
ssl->options.sendAlertState = 1;
|
|
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendAlert", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
const char* wolfSSL_ERR_reason_error_string(unsigned long e)
|
|
{
|
|
#ifdef NO_ERROR_STRINGS
|
|
|
|
(void)e;
|
|
return "no support for error strings built in";
|
|
|
|
#else
|
|
|
|
int error = (int)e;
|
|
|
|
/* pass to wolfCrypt */
|
|
if (error < MAX_CODE_E && error > MIN_CODE_E) {
|
|
return wc_GetErrorString(error);
|
|
}
|
|
|
|
switch (error) {
|
|
|
|
#ifdef WOLFSSL_WPAS
|
|
case 0 :
|
|
return "ok";
|
|
#endif
|
|
|
|
case UNSUPPORTED_SUITE :
|
|
return "unsupported cipher suite";
|
|
|
|
case INPUT_CASE_ERROR :
|
|
return "input state error";
|
|
|
|
case PREFIX_ERROR :
|
|
return "bad index to key rounds";
|
|
|
|
case MEMORY_ERROR :
|
|
return "out of memory";
|
|
|
|
case VERIFY_FINISHED_ERROR :
|
|
return "verify problem on finished";
|
|
|
|
case VERIFY_MAC_ERROR :
|
|
return "verify mac problem";
|
|
|
|
case PARSE_ERROR :
|
|
return "parse error on header";
|
|
|
|
case SIDE_ERROR :
|
|
return "wrong client/server type";
|
|
|
|
case NO_PEER_CERT :
|
|
return "peer didn't send cert";
|
|
|
|
case UNKNOWN_HANDSHAKE_TYPE :
|
|
return "weird handshake type";
|
|
|
|
case SOCKET_ERROR_E :
|
|
return "error state on socket";
|
|
|
|
case SOCKET_NODATA :
|
|
return "expected data, not there";
|
|
|
|
case INCOMPLETE_DATA :
|
|
return "don't have enough data to complete task";
|
|
|
|
case UNKNOWN_RECORD_TYPE :
|
|
return "unknown type in record hdr";
|
|
|
|
case DECRYPT_ERROR :
|
|
return "error during decryption";
|
|
|
|
case FATAL_ERROR :
|
|
return "received alert fatal error";
|
|
|
|
case ENCRYPT_ERROR :
|
|
return "error during encryption";
|
|
|
|
case FREAD_ERROR :
|
|
return "fread problem";
|
|
|
|
case NO_PEER_KEY :
|
|
return "need peer's key";
|
|
|
|
case NO_PRIVATE_KEY :
|
|
return "need the private key";
|
|
|
|
case NO_DH_PARAMS :
|
|
return "server missing DH params";
|
|
|
|
case RSA_PRIVATE_ERROR :
|
|
return "error during rsa priv op";
|
|
|
|
case MATCH_SUITE_ERROR :
|
|
return "can't match cipher suite";
|
|
|
|
case COMPRESSION_ERROR :
|
|
return "compression mismatch error";
|
|
|
|
case BUILD_MSG_ERROR :
|
|
return "build message failure";
|
|
|
|
case BAD_HELLO :
|
|
return "client hello malformed";
|
|
|
|
case DOMAIN_NAME_MISMATCH :
|
|
return "peer subject name mismatch";
|
|
|
|
case IPADDR_MISMATCH :
|
|
return "peer ip address mismatch";
|
|
|
|
case WANT_READ :
|
|
case WOLFSSL_ERROR_WANT_READ :
|
|
return "non-blocking socket wants data to be read";
|
|
|
|
case NOT_READY_ERROR :
|
|
return "handshake layer not ready yet, complete first";
|
|
|
|
case VERSION_ERROR :
|
|
return "record layer version error";
|
|
|
|
case WANT_WRITE :
|
|
case WOLFSSL_ERROR_WANT_WRITE :
|
|
return "non-blocking socket write buffer full";
|
|
|
|
case BUFFER_ERROR :
|
|
return "malformed buffer input error";
|
|
|
|
case VERIFY_CERT_ERROR :
|
|
return "verify problem on certificate";
|
|
|
|
case VERIFY_SIGN_ERROR :
|
|
return "verify problem based on signature";
|
|
|
|
case CLIENT_ID_ERROR :
|
|
return "psk client identity error";
|
|
|
|
case SERVER_HINT_ERROR:
|
|
return "psk server hint error";
|
|
|
|
case PSK_KEY_ERROR:
|
|
return "psk key callback error";
|
|
|
|
case NTRU_KEY_ERROR:
|
|
return "NTRU key error";
|
|
|
|
case NTRU_DRBG_ERROR:
|
|
return "NTRU drbg error";
|
|
|
|
case NTRU_ENCRYPT_ERROR:
|
|
return "NTRU encrypt error";
|
|
|
|
case NTRU_DECRYPT_ERROR:
|
|
return "NTRU decrypt error";
|
|
|
|
case GETTIME_ERROR:
|
|
return "gettimeofday() error";
|
|
|
|
case GETITIMER_ERROR:
|
|
return "getitimer() error";
|
|
|
|
case SIGACT_ERROR:
|
|
return "sigaction() error";
|
|
|
|
case SETITIMER_ERROR:
|
|
return "setitimer() error";
|
|
|
|
case LENGTH_ERROR:
|
|
return "record layer length error";
|
|
|
|
case PEER_KEY_ERROR:
|
|
return "cant decode peer key";
|
|
|
|
case ZERO_RETURN:
|
|
case WOLFSSL_ERROR_ZERO_RETURN:
|
|
return "peer sent close notify alert";
|
|
|
|
case ECC_CURVETYPE_ERROR:
|
|
return "Bad ECC Curve Type or unsupported";
|
|
|
|
case ECC_CURVE_ERROR:
|
|
return "Bad ECC Curve or unsupported";
|
|
|
|
case ECC_PEERKEY_ERROR:
|
|
return "Bad ECC Peer Key";
|
|
|
|
case ECC_MAKEKEY_ERROR:
|
|
return "ECC Make Key failure";
|
|
|
|
case ECC_EXPORT_ERROR:
|
|
return "ECC Export Key failure";
|
|
|
|
case ECC_SHARED_ERROR:
|
|
return "ECC DHE shared failure";
|
|
|
|
case NOT_CA_ERROR:
|
|
return "Not a CA by basic constraint error";
|
|
|
|
case HTTP_TIMEOUT:
|
|
return "HTTP timeout for OCSP or CRL req";
|
|
|
|
case BAD_CERT_MANAGER_ERROR:
|
|
return "Bad Cert Manager error";
|
|
|
|
case OCSP_CERT_REVOKED:
|
|
return "OCSP Cert revoked";
|
|
|
|
case CRL_CERT_REVOKED:
|
|
return "CRL Cert revoked";
|
|
|
|
case CRL_MISSING:
|
|
return "CRL missing, not loaded";
|
|
|
|
case MONITOR_SETUP_E:
|
|
return "CRL monitor setup error";
|
|
|
|
case THREAD_CREATE_E:
|
|
return "Thread creation problem";
|
|
|
|
case OCSP_NEED_URL:
|
|
return "OCSP need URL";
|
|
|
|
case OCSP_CERT_UNKNOWN:
|
|
return "OCSP Cert unknown";
|
|
|
|
case OCSP_LOOKUP_FAIL:
|
|
return "OCSP Responder lookup fail";
|
|
|
|
case MAX_CHAIN_ERROR:
|
|
return "Maximum Chain Depth Exceeded";
|
|
|
|
case COOKIE_ERROR:
|
|
return "DTLS Cookie Error";
|
|
|
|
case SEQUENCE_ERROR:
|
|
return "DTLS Sequence Error";
|
|
|
|
case SUITES_ERROR:
|
|
return "Suites Pointer Error";
|
|
|
|
case OUT_OF_ORDER_E:
|
|
return "Out of order message, fatal";
|
|
|
|
case BAD_KEA_TYPE_E:
|
|
return "Bad KEA type found";
|
|
|
|
case SANITY_CIPHER_E:
|
|
return "Sanity check on ciphertext failed";
|
|
|
|
case RECV_OVERFLOW_E:
|
|
return "Receive callback returned more than requested";
|
|
|
|
case GEN_COOKIE_E:
|
|
return "Generate Cookie Error";
|
|
|
|
case NO_PEER_VERIFY:
|
|
return "Need peer certificate verify Error";
|
|
|
|
case FWRITE_ERROR:
|
|
return "fwrite Error";
|
|
|
|
case CACHE_MATCH_ERROR:
|
|
return "Cache restore header match Error";
|
|
|
|
case UNKNOWN_SNI_HOST_NAME_E:
|
|
return "Unrecognized host name Error";
|
|
|
|
case UNKNOWN_MAX_FRAG_LEN_E:
|
|
return "Unrecognized max frag len Error";
|
|
|
|
case KEYUSE_SIGNATURE_E:
|
|
return "Key Use digitalSignature not set Error";
|
|
|
|
case KEYUSE_ENCIPHER_E:
|
|
return "Key Use keyEncipherment not set Error";
|
|
|
|
case EXTKEYUSE_AUTH_E:
|
|
return "Ext Key Use server/client auth not set Error";
|
|
|
|
case SEND_OOB_READ_E:
|
|
return "Send Callback Out of Bounds Read Error";
|
|
|
|
case SECURE_RENEGOTIATION_E:
|
|
return "Invalid Renegotiation Error";
|
|
|
|
case SESSION_TICKET_LEN_E:
|
|
return "Session Ticket Too Long Error";
|
|
|
|
case SESSION_TICKET_EXPECT_E:
|
|
return "Session Ticket Error";
|
|
|
|
case SESSION_SECRET_CB_E:
|
|
return "Session Secret Callback Error";
|
|
|
|
case NO_CHANGE_CIPHER_E:
|
|
return "Finished received from peer before Change Cipher Error";
|
|
|
|
case SANITY_MSG_E:
|
|
return "Sanity Check on message order Error";
|
|
|
|
case DUPLICATE_MSG_E:
|
|
return "Duplicate HandShake message Error";
|
|
|
|
case SNI_UNSUPPORTED:
|
|
return "Protocol version does not support SNI Error";
|
|
|
|
case SOCKET_PEER_CLOSED_E:
|
|
return "Peer closed underlying transport Error";
|
|
|
|
case BAD_TICKET_KEY_CB_SZ:
|
|
return "Bad user session ticket key callback Size Error";
|
|
|
|
case BAD_TICKET_MSG_SZ:
|
|
return "Bad session ticket message Size Error";
|
|
|
|
case BAD_TICKET_ENCRYPT:
|
|
return "Bad user ticket callback encrypt Error";
|
|
|
|
case DH_KEY_SIZE_E:
|
|
return "DH key too small Error";
|
|
|
|
case SNI_ABSENT_ERROR:
|
|
return "No Server Name Indication extension Error";
|
|
|
|
case RSA_SIGN_FAULT:
|
|
return "RSA Signature Fault Error";
|
|
|
|
case HANDSHAKE_SIZE_ERROR:
|
|
return "Handshake message too large Error";
|
|
|
|
case UNKNOWN_ALPN_PROTOCOL_NAME_E:
|
|
return "Unrecognized protocol name Error";
|
|
|
|
case BAD_CERTIFICATE_STATUS_ERROR:
|
|
return "Bad Certificate Status Message Error";
|
|
|
|
case OCSP_INVALID_STATUS:
|
|
return "Invalid OCSP Status Error";
|
|
|
|
case OCSP_WANT_READ:
|
|
return "OCSP nonblock wants read";
|
|
|
|
case RSA_KEY_SIZE_E:
|
|
return "RSA key too small";
|
|
|
|
case ECC_KEY_SIZE_E:
|
|
return "ECC key too small";
|
|
|
|
case DTLS_EXPORT_VER_E:
|
|
return "Version needs updated after code change or version mismatch";
|
|
|
|
case INPUT_SIZE_E:
|
|
return "Input size too large Error";
|
|
|
|
case CTX_INIT_MUTEX_E:
|
|
return "Initialize ctx mutex error";
|
|
|
|
case EXT_MASTER_SECRET_NEEDED_E:
|
|
return "Extended Master Secret must be enabled to resume EMS session";
|
|
|
|
case DTLS_POOL_SZ_E:
|
|
return "Maximum DTLS pool size exceeded";
|
|
|
|
case DECODE_E:
|
|
return "Decode handshake message error";
|
|
|
|
case WRITE_DUP_READ_E:
|
|
return "Write dup write side can't read error";
|
|
|
|
case WRITE_DUP_WRITE_E:
|
|
return "Write dup read side can't write error";
|
|
|
|
case INVALID_CERT_CTX_E:
|
|
return "Certificate context does not match request or not empty";
|
|
|
|
case BAD_KEY_SHARE_DATA:
|
|
return "The Key Share data contains group that wasn't in Client Hello";
|
|
|
|
case MISSING_HANDSHAKE_DATA:
|
|
return "The handshake message is missing required data";
|
|
|
|
case BAD_BINDER:
|
|
return "Binder value does not match value server calculated";
|
|
|
|
case EXT_NOT_ALLOWED:
|
|
return "Extension type not allowed in handshake message type";
|
|
|
|
case INVALID_PARAMETER:
|
|
return "The security parameter is invalid";
|
|
|
|
case UNSUPPORTED_EXTENSION:
|
|
return "TLS Extension not requested by the client";
|
|
|
|
case PRF_MISSING:
|
|
return "Pseudo-random function is not enabled";
|
|
|
|
case KEY_SHARE_ERROR:
|
|
return "Key share extension did not contain a valid named group";
|
|
|
|
case POST_HAND_AUTH_ERROR:
|
|
return "Client will not do post handshake authentication";
|
|
|
|
case HRR_COOKIE_ERROR:
|
|
return "Cookie does not match one sent in HelloRetryRequest";
|
|
|
|
case MCAST_HIGHWATER_CB_E:
|
|
return "Multicast highwater callback returned error";
|
|
|
|
case ALERT_COUNT_E:
|
|
return "Alert Count exceeded error";
|
|
|
|
case EXT_MISSING:
|
|
return "Required TLS extension missing";
|
|
|
|
case DTLS_RETX_OVER_TX:
|
|
return "DTLS interrupting flight transmit with retransmit";
|
|
|
|
case DH_PARAMS_NOT_FFDHE_E:
|
|
return "Server DH parameters were not from the FFDHE set as required";
|
|
|
|
case TCA_INVALID_ID_TYPE:
|
|
return "TLS Extension Trusted CA ID type invalid";
|
|
|
|
case TCA_ABSENT_ERROR:
|
|
return "TLS Extension Trusted CA ID response absent";
|
|
|
|
case TSIP_MAC_DIGSZ_E:
|
|
return "TSIP MAC size invalid, must be sized for SHA-1 or SHA-256";
|
|
|
|
case CLIENT_CERT_CB_ERROR:
|
|
return "Error importing client cert or key from callback";
|
|
|
|
case SSL_SHUTDOWN_ALREADY_DONE_E:
|
|
return "Shutdown has already occurred";
|
|
|
|
case TLS13_SECRET_CB_E:
|
|
return "TLS1.3 Secret Callback Error";
|
|
|
|
case DTLS_SIZE_ERROR:
|
|
return "DTLS trying to send too much in single datagram error";
|
|
|
|
case NO_CERT_ERROR:
|
|
return "TLS1.3 No Certificate Set Error";
|
|
|
|
default :
|
|
return "unknown error number";
|
|
}
|
|
|
|
#endif /* NO_ERROR_STRINGS */
|
|
}
|
|
|
|
void SetErrorString(int error, char* str)
|
|
{
|
|
XSTRNCPY(str, wolfSSL_ERR_reason_error_string(error), WOLFSSL_MAX_ERROR_SZ);
|
|
str[WOLFSSL_MAX_ERROR_SZ-1] = 0;
|
|
}
|
|
|
|
#ifdef NO_CIPHER_SUITE_ALIASES
|
|
#ifndef NO_ERROR_STRINGS
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(y),(z),(w),(v),(u),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u)
|
|
#else
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(y),(z),(w),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u)
|
|
#endif
|
|
#else
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT)
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(z),(w),(v),(u),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u)
|
|
#else
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(z),(w),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u)
|
|
#endif
|
|
#endif
|
|
#else /* !NO_CIPHER_SUITE_ALIASES */
|
|
|
|
/* note that the comma is included at the end of the SUITE_ALIAS() macro
|
|
* definitions, to allow aliases to be gated out by the above null macros
|
|
* in the NO_CIPHER_SUITE_ALIASES section.
|
|
*/
|
|
|
|
#ifndef NO_ERROR_STRINGS
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) || \
|
|
defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_NGINX)
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(y),(z),(w),(v),(u),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u) {(x),"",(z),(w),(v),(u),WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS},
|
|
#else
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(y),(z),(w),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u) {(x),"",(z),(w),WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS},
|
|
#endif
|
|
#else
|
|
#if defined(OPENSSL_ALL) || defined(WOLFSSL_QT) || \
|
|
defined(WOLFSSL_HAPROXY) || defined(WOLFSSL_NGINX)
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(z),(w),(v),(u),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u) {(x),(z),(w),(v),(u),WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS},
|
|
#else
|
|
#define SUITE_INFO(x,y,z,w,v,u) {(x),(z),(w),WOLFSSL_CIPHER_SUITE_FLAG_NONE}
|
|
#define SUITE_ALIAS(x,z,w,v,u) {(x),(z),(w),WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS},
|
|
#endif
|
|
#endif
|
|
#endif /* NO_CIPHER_SUITE_ALIASES */
|
|
|
|
static const CipherSuiteInfo cipher_names[] =
|
|
{
|
|
|
|
#ifdef BUILD_TLS_AES_128_GCM_SHA256
|
|
SUITE_INFO("TLS13-AES128-GCM-SHA256","TLS_AES_128_GCM_SHA256",TLS13_BYTE,TLS_AES_128_GCM_SHA256, TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_AES_256_GCM_SHA384
|
|
SUITE_INFO("TLS13-AES256-GCM-SHA384","TLS_AES_256_GCM_SHA384",TLS13_BYTE,TLS_AES_256_GCM_SHA384, TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("TLS13-CHACHA20-POLY1305-SHA256","TLS_CHACHA20_POLY1305_SHA256",TLS13_BYTE,TLS_CHACHA20_POLY1305_SHA256, TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_AES_128_CCM_SHA256
|
|
SUITE_INFO("TLS13-AES128-CCM-SHA256","TLS_AES_128_CCM_SHA256",TLS13_BYTE,TLS_AES_128_CCM_SHA256, TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_AES_128_CCM_8_SHA256
|
|
SUITE_INFO("TLS13-AES128-CCM-8-SHA256","TLS_AES_128_CCM_8_SHA256",TLS13_BYTE,TLS_AES_128_CCM_8_SHA256,TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
SUITE_ALIAS("TLS13-AES128-CCM8-SHA256",TLS13_BYTE,TLS_AES_128_CCM_8_SHA256,TLSv1_3_MINOR, SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_SHA256_SHA256
|
|
SUITE_INFO("TLS13-SHA256-SHA256","TLS_SHA256_SHA256",ECC_BYTE,TLS_SHA256_SHA256,TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_SHA384_SHA384
|
|
SUITE_INFO("TLS13-SHA384-SHA384","TLS_SHA384_SHA384",ECC_BYTE,TLS_SHA384_SHA384,TLSv1_3_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_RC4_128_SHA
|
|
SUITE_INFO("RC4-SHA","SSL_RSA_WITH_RC4_128_SHA",CIPHER_BYTE,SSL_RSA_WITH_RC4_128_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_RC4_128_MD5
|
|
SUITE_INFO("RC4-MD5","SSL_RSA_WITH_RC4_128_MD5",CIPHER_BYTE,SSL_RSA_WITH_RC4_128_MD5,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("DES-CBC3-SHA","SSL_RSA_WITH_3DES_EDE_CBC_SHA",CIPHER_BYTE,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("AES128-SHA","TLS_RSA_WITH_AES_128_CBC_SHA",CIPHER_BYTE,TLS_RSA_WITH_AES_128_CBC_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("AES256-SHA","TLS_RSA_WITH_AES_256_CBC_SHA",CIPHER_BYTE,TLS_RSA_WITH_AES_256_CBC_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_NULL_MD5
|
|
SUITE_INFO("NULL-MD5","TLS_RSA_WITH_NULL_MD5",CIPHER_BYTE,TLS_RSA_WITH_NULL_MD5,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_NULL_SHA
|
|
SUITE_INFO("NULL-SHA","TLS_RSA_WITH_NULL_SHA",CIPHER_BYTE,TLS_RSA_WITH_NULL_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_NULL_SHA256
|
|
SUITE_INFO("NULL-SHA256","TLS_RSA_WITH_NULL_SHA256",CIPHER_BYTE,TLS_RSA_WITH_NULL_SHA256,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("DHE-RSA-AES128-SHA","TLS_DHE_RSA_WITH_AES_128_CBC_SHA",CIPHER_BYTE,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("DHE-RSA-AES256-SHA","TLS_DHE_RSA_WITH_AES_256_CBC_SHA",CIPHER_BYTE,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("DHE-PSK-AES256-GCM-SHA384","TLS_DHE_PSK_WITH_AES_256_GCM_SHA384",CIPHER_BYTE,TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("DHE-PSK-AES128-GCM-SHA256","TLS_DHE_PSK_WITH_AES_128_GCM_SHA256",CIPHER_BYTE,TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("PSK-AES256-GCM-SHA384","TLS_PSK_WITH_AES_256_GCM_SHA384",CIPHER_BYTE,TLS_PSK_WITH_AES_256_GCM_SHA384,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("PSK-AES128-GCM-SHA256","TLS_PSK_WITH_AES_128_GCM_SHA256",CIPHER_BYTE,TLS_PSK_WITH_AES_128_GCM_SHA256,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
|
|
SUITE_INFO("DHE-PSK-AES256-CBC-SHA384","TLS_DHE_PSK_WITH_AES_256_CBC_SHA384",CIPHER_BYTE,TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("DHE-PSK-AES128-CBC-SHA256","TLS_DHE_PSK_WITH_AES_128_CBC_SHA256",CIPHER_BYTE,TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
|
|
SUITE_INFO("PSK-AES256-CBC-SHA384","TLS_PSK_WITH_AES_256_CBC_SHA384",CIPHER_BYTE,TLS_PSK_WITH_AES_256_CBC_SHA384,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("PSK-AES128-CBC-SHA256","TLS_PSK_WITH_AES_128_CBC_SHA256",CIPHER_BYTE,TLS_PSK_WITH_AES_128_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("PSK-AES128-CBC-SHA","TLS_PSK_WITH_AES_128_CBC_SHA",CIPHER_BYTE,TLS_PSK_WITH_AES_128_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("PSK-AES256-CBC-SHA","TLS_PSK_WITH_AES_256_CBC_SHA",CIPHER_BYTE,TLS_PSK_WITH_AES_256_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
|
|
SUITE_INFO("DHE-PSK-AES128-CCM","TLS_DHE_PSK_WITH_AES_128_CCM",ECC_BYTE,TLS_DHE_PSK_WITH_AES_128_CCM,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
|
|
SUITE_INFO("DHE-PSK-AES256-CCM","TLS_DHE_PSK_WITH_AES_256_CCM",ECC_BYTE,TLS_DHE_PSK_WITH_AES_256_CCM,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CCM
|
|
SUITE_INFO("PSK-AES128-CCM","TLS_PSK_WITH_AES_128_CCM",ECC_BYTE,TLS_PSK_WITH_AES_128_CCM,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CCM
|
|
SUITE_INFO("PSK-AES256-CCM","TLS_PSK_WITH_AES_256_CCM",ECC_BYTE,TLS_PSK_WITH_AES_256_CCM,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_128_CCM_8
|
|
SUITE_INFO("PSK-AES128-CCM-8","TLS_PSK_WITH_AES_128_CCM_8",ECC_BYTE,TLS_PSK_WITH_AES_128_CCM_8,TLSv1_MINOR,SSLv3_MAJOR),
|
|
SUITE_ALIAS("PSK-AES128-CCM8",ECC_BYTE,TLS_PSK_WITH_AES_128_CCM_8,TLSv1_MINOR,SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_AES_256_CCM_8
|
|
SUITE_INFO("PSK-AES256-CCM-8","TLS_PSK_WITH_AES_256_CCM_8",ECC_BYTE,TLS_PSK_WITH_AES_256_CCM_8,TLSv1_MINOR,SSLv3_MAJOR),
|
|
SUITE_ALIAS("PSK-AES256-CCM8",ECC_BYTE,TLS_PSK_WITH_AES_256_CCM_8,TLSv1_MINOR,SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
|
|
SUITE_INFO("DHE-PSK-NULL-SHA384","TLS_DHE_PSK_WITH_NULL_SHA384",CIPHER_BYTE,TLS_DHE_PSK_WITH_NULL_SHA384,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
|
|
SUITE_INFO("DHE-PSK-NULL-SHA256","TLS_DHE_PSK_WITH_NULL_SHA256",CIPHER_BYTE,TLS_DHE_PSK_WITH_NULL_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_NULL_SHA384
|
|
SUITE_INFO("PSK-NULL-SHA384","TLS_PSK_WITH_NULL_SHA384",CIPHER_BYTE,TLS_PSK_WITH_NULL_SHA384,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_NULL_SHA256
|
|
SUITE_INFO("PSK-NULL-SHA256","TLS_PSK_WITH_NULL_SHA256",CIPHER_BYTE,TLS_PSK_WITH_NULL_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_NULL_SHA
|
|
SUITE_INFO("PSK-NULL-SHA","TLS_PSK_WITH_NULL_SHA",CIPHER_BYTE,TLS_PSK_WITH_NULL_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_HC_128_MD5
|
|
SUITE_INFO("HC128-MD5","TLS_RSA_WITH_HC_128_MD5",CIPHER_BYTE,TLS_RSA_WITH_HC_128_MD5,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_HC_128_SHA
|
|
SUITE_INFO("HC128-SHA","TLS_RSA_WITH_HC_128_SHA",CIPHER_BYTE,TLS_RSA_WITH_HC_128_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_RABBIT_SHA
|
|
SUITE_INFO("RABBIT-SHA","TLS_RSA_WITH_RABBIT_SHA",CIPHER_BYTE,TLS_RSA_WITH_RABBIT_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_RC4_128_SHA
|
|
SUITE_INFO("NTRU-RC4-SHA","TLS_NTRU_RSA_WITH_RC4_128_SHA",CIPHER_BYTE,TLS_NTRU_RSA_WITH_RC4_128_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("NTRU-DES-CBC3-SHA","TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA",CIPHER_BYTE,TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("NTRU-AES128-SHA","TLS_NTRU_RSA_WITH_AES_128_CBC_SHA",CIPHER_BYTE,TLS_NTRU_RSA_WITH_AES_128_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_NTRU_RSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("NTRU-AES256-SHA","TLS_NTRU_RSA_WITH_AES_256_CBC_SHA",CIPHER_BYTE,TLS_NTRU_RSA_WITH_AES_256_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_CCM_8
|
|
SUITE_INFO("AES128-CCM-8","TLS_RSA_WITH_AES_128_CCM_8",ECC_BYTE,TLS_RSA_WITH_AES_128_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
SUITE_ALIAS("AES128-CCM8",ECC_BYTE,TLS_RSA_WITH_AES_128_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_CCM_8
|
|
SUITE_INFO("AES256-CCM-8","TLS_RSA_WITH_AES_256_CCM_8",ECC_BYTE,TLS_RSA_WITH_AES_256_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
SUITE_ALIAS("AES256-CCM8",ECC_BYTE,TLS_RSA_WITH_AES_256_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM
|
|
SUITE_INFO("ECDHE-ECDSA-AES128-CCM","TLS_ECDHE_ECDSA_WITH_AES_128_CCM",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_128_CCM, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
|
|
SUITE_INFO("ECDHE-ECDSA-AES128-CCM-8","TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
SUITE_ALIAS("ECDHE-ECDSA-AES128-CCM8",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
|
|
SUITE_INFO("ECDHE-ECDSA-AES256-CCM-8","TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
SUITE_ALIAS("ECDHE-ECDSA-AES256-CCM8",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, TLSv1_2_MINOR, SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("ECDHE-RSA-AES128-SHA","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",ECC_BYTE,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("ECDHE-RSA-AES256-SHA","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",ECC_BYTE,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("ECDHE-ECDSA-AES128-SHA","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("ECDHE-ECDSA-AES256-SHA","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
|
|
SUITE_INFO("ECDHE-RSA-RC4-SHA","TLS_ECDHE_RSA_WITH_RC4_128_SHA",ECC_BYTE,TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("ECDHE-RSA-DES-CBC3-SHA","TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",ECC_BYTE,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
|
|
SUITE_INFO("ECDHE-ECDSA-RC4-SHA","TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("ECDHE-ECDSA-DES-CBC3-SHA","TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("AES128-SHA256","TLS_RSA_WITH_AES_128_CBC_SHA256",CIPHER_BYTE,TLS_RSA_WITH_AES_128_CBC_SHA256, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
|
|
SUITE_INFO("AES256-SHA256","TLS_RSA_WITH_AES_256_CBC_SHA256",CIPHER_BYTE,TLS_RSA_WITH_AES_256_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("DHE-RSA-AES128-SHA256","TLS_DHE_RSA_WITH_AES_128_CBC_SHA256",CIPHER_BYTE,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|
|
SUITE_INFO("DHE-RSA-AES256-SHA256","TLS_DHE_RSA_WITH_AES_256_CBC_SHA256",CIPHER_BYTE,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("ECDH-RSA-AES128-SHA","TLS_ECDH_RSA_WITH_AES_128_CBC_SHA",ECC_BYTE,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("ECDH-RSA-AES256-SHA","TLS_ECDH_RSA_WITH_AES_256_CBC_SHA",ECC_BYTE,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("ECDH-ECDSA-AES128-SHA","TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA",ECC_BYTE,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
|
|
SUITE_INFO("ECDH-ECDSA-AES256-SHA","TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA",ECC_BYTE,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
|
|
SUITE_INFO("ECDH-RSA-RC4-SHA","TLS_ECDH_RSA_WITH_RC4_128_SHA",ECC_BYTE,TLS_ECDH_RSA_WITH_RC4_128_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("ECDH-RSA-DES-CBC3-SHA","TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA",ECC_BYTE,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
|
|
SUITE_INFO("ECDH-ECDSA-RC4-SHA","TLS_ECDH_ECDSA_WITH_RC4_128_SHA",ECC_BYTE,TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("ECDH-ECDSA-DES-CBC3-SHA","TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA",ECC_BYTE,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("AES128-GCM-SHA256","TLS_RSA_WITH_AES_128_GCM_SHA256",CIPHER_BYTE,TLS_RSA_WITH_AES_128_GCM_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("AES256-GCM-SHA384","TLS_RSA_WITH_AES_256_GCM_SHA384",CIPHER_BYTE,TLS_RSA_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("DHE-RSA-AES128-GCM-SHA256","TLS_DHE_RSA_WITH_AES_128_GCM_SHA256",CIPHER_BYTE,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("DHE-RSA-AES256-GCM-SHA384","TLS_DHE_RSA_WITH_AES_256_GCM_SHA384",CIPHER_BYTE,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("ECDHE-RSA-AES128-GCM-SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",ECC_BYTE,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("ECDHE-RSA-AES256-GCM-SHA384","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",ECC_BYTE,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("ECDHE-ECDSA-AES128-GCM-SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("ECDHE-ECDSA-AES256-GCM-SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("ECDH-RSA-AES128-GCM-SHA256","TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256",ECC_BYTE,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("ECDH-RSA-AES256-GCM-SHA384","TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384",ECC_BYTE,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
|
|
SUITE_INFO("ECDH-ECDSA-AES128-GCM-SHA256","TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256",ECC_BYTE,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("ECDH-ECDSA-AES256-GCM-SHA384","TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384",ECC_BYTE,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
|
|
SUITE_INFO("CAMELLIA128-SHA","TLS_RSA_WITH_CAMELLIA_128_CBC_SHA",CIPHER_BYTE,TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
|
|
SUITE_INFO("DHE-RSA-CAMELLIA128-SHA","TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA",CIPHER_BYTE,TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
|
|
SUITE_INFO("CAMELLIA256-SHA","TLS_RSA_WITH_CAMELLIA_256_CBC_SHA",CIPHER_BYTE,TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
|
|
SUITE_INFO("DHE-RSA-CAMELLIA256-SHA","TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA",CIPHER_BYTE,TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
|
SUITE_INFO("CAMELLIA128-SHA256","TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256",CIPHER_BYTE,TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
|
|
SUITE_INFO("DHE-RSA-CAMELLIA128-SHA256","TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256",CIPHER_BYTE,TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
|
SUITE_INFO("CAMELLIA256-SHA256","TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256",CIPHER_BYTE,TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
|
|
SUITE_INFO("DHE-RSA-CAMELLIA256-SHA256","TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256",CIPHER_BYTE,TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("ECDHE-RSA-AES128-SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",ECC_BYTE,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("ECDHE-ECDSA-AES128-SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("ECDH-RSA-AES128-SHA256","TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256",ECC_BYTE,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("ECDH-ECDSA-AES128-SHA256","TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256",ECC_BYTE,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|
|
SUITE_INFO("ECDHE-RSA-AES256-SHA384","TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",ECC_BYTE,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|
|
SUITE_INFO("ECDHE-ECDSA-AES256-SHA384","TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
|
|
SUITE_INFO("ECDH-RSA-AES256-SHA384","TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384",ECC_BYTE,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
|
|
SUITE_INFO("ECDH-ECDSA-AES256-SHA384","TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384",ECC_BYTE,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("ECDHE-RSA-CHACHA20-POLY1305","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",CHACHA_BYTE,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("ECDHE-ECDSA-CHACHA20-POLY1305","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",CHACHA_BYTE,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("DHE-RSA-CHACHA20-POLY1305","TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256",CHACHA_BYTE,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
|
|
SUITE_INFO("ECDHE-RSA-CHACHA20-POLY1305-OLD","TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256",CHACHA_BYTE,TLS_ECDHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256
|
|
SUITE_INFO("ECDHE-ECDSA-CHACHA20-POLY1305-OLD","TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256",CHACHA_BYTE,TLS_ECDHE_ECDSA_WITH_CHACHA20_OLD_POLY1305_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256
|
|
SUITE_INFO("DHE-RSA-CHACHA20-POLY1305-OLD","TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256",CHACHA_BYTE,TLS_DHE_RSA_WITH_CHACHA20_OLD_POLY1305_SHA256, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA
|
|
SUITE_INFO("ADH-AES128-SHA","TLS_DH_anon_WITH_AES_128_CBC_SHA",CIPHER_BYTE,TLS_DH_anon_WITH_AES_128_CBC_SHA, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DH_anon_WITH_AES_256_GCM_SHA384
|
|
SUITE_INFO("ADH-AES256-GCM-SHA384","TLS_DH_anon_WITH_AES_256_GCM_SHA384",CIPHER_BYTE,TLS_DH_anon_WITH_AES_256_GCM_SHA384, TLSv1_2_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_QSH
|
|
SUITE_INFO("QSH","TLS_QSH",QSH_BYTE,TLS_QSH, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef HAVE_RENEGOTIATION_INDICATION
|
|
SUITE_INFO("RENEGOTIATION-INFO","TLS_EMPTY_RENEGOTIATION_INFO_SCSV",CIPHER_BYTE,TLS_EMPTY_RENEGOTIATION_INFO_SCSV,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_SSL_RSA_WITH_IDEA_CBC_SHA
|
|
SUITE_INFO("IDEA-CBC-SHA","SSL_RSA_WITH_IDEA_CBC_SHA",CIPHER_BYTE,SSL_RSA_WITH_IDEA_CBC_SHA,SSLv3_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_ECDSA_WITH_NULL_SHA
|
|
SUITE_INFO("ECDHE-ECDSA-NULL-SHA","TLS_ECDHE_ECDSA_WITH_NULL_SHA",ECC_BYTE,TLS_ECDHE_ECDSA_WITH_NULL_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_PSK_WITH_NULL_SHA256
|
|
SUITE_INFO("ECDHE-PSK-NULL-SHA256","TLS_ECDHE_PSK_WITH_NULL_SHA256",ECC_BYTE,TLS_ECDHE_PSK_WITH_NULL_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
|
|
SUITE_INFO("ECDHE-PSK-AES128-CBC-SHA256","TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256",ECC_BYTE,TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,TLSv1_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("PSK-CHACHA20-POLY1305","TLS_PSK_WITH_CHACHA20_POLY1305_SHA256",CHACHA_BYTE,TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("ECDHE-PSK-CHACHA20-POLY1305","TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256",CHACHA_BYTE,TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256
|
|
SUITE_INFO("DHE-PSK-CHACHA20-POLY1305","TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256",CHACHA_BYTE,TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256,TLSv1_2_MINOR,SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
|
|
SUITE_INFO("EDH-RSA-DES-CBC3-SHA","TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA",CIPHER_BYTE,TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLSv1_MINOR, SSLv3_MAJOR),
|
|
#endif
|
|
|
|
#ifdef BUILD_WDM_WITH_NULL_SHA256
|
|
SUITE_INFO("WDM-NULL-SHA256","WDM_WITH_NULL_SHA256",CIPHER_BYTE,WDM_WITH_NULL_SHA256, TLSv1_3_MINOR, SSLv3_MAJOR)
|
|
#endif
|
|
|
|
#endif /* WOLFSSL_NO_TLS12 */
|
|
};
|
|
|
|
|
|
/* returns the cipher_names array */
|
|
const CipherSuiteInfo* GetCipherNames(void)
|
|
{
|
|
return cipher_names;
|
|
}
|
|
|
|
|
|
/* returns the number of elements in the cipher_names array */
|
|
int GetCipherNamesSize(void)
|
|
{
|
|
return (int)(sizeof(cipher_names) / sizeof(CipherSuiteInfo));
|
|
}
|
|
|
|
|
|
const char* GetCipherNameInternal(const byte cipherSuite0, const byte cipherSuite)
|
|
{
|
|
int i;
|
|
const char* nameInternal = "None";
|
|
|
|
for (i = 0; i < GetCipherNamesSize(); i++) {
|
|
if ((cipher_names[i].cipherSuite0 == cipherSuite0) &&
|
|
(cipher_names[i].cipherSuite == cipherSuite)
|
|
#ifndef NO_CIPHER_SUITE_ALIASES
|
|
&& (! (cipher_names[i].flags & WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS))
|
|
#endif
|
|
) {
|
|
nameInternal = cipher_names[i].name;
|
|
break;
|
|
}
|
|
}
|
|
return nameInternal;
|
|
}
|
|
|
|
#if defined(WOLFSSL_QT) || defined(OPENSSL_ALL)
|
|
const char* GetCipherKeaStr(char n[][MAX_SEGMENT_SZ]) {
|
|
const char* keaStr = NULL;
|
|
const char *n0,*n1,*n2,*n3,*n4;
|
|
n0 = n[0];
|
|
n1 = n[1];
|
|
n2 = n[2];
|
|
n3 = n[3];
|
|
n4 = n[4];
|
|
|
|
#ifdef HAVE_NTRU
|
|
if (XSTRNCMP(n0,"NTRU",4) == 0)
|
|
return "NTRU";
|
|
#endif
|
|
|
|
if (XSTRNCMP(n0,"ECDHE",5) == 0 && XSTRNCMP(n1,"PSK",3) == 0)
|
|
keaStr = "ECDHEPSK";
|
|
else if (XSTRNCMP(n0,"ECDH",4) == 0)
|
|
keaStr = "ECDH";
|
|
else if (XSTRNCMP(n0,"DHE",3) == 0 && XSTRNCMP(n1,"PSK",3) == 0)
|
|
keaStr = "DHEPSK";
|
|
else if (XSTRNCMP(n0,"DHE",3) == 0)
|
|
keaStr = "DH";
|
|
else if (XSTRNCMP(n0,"RSA",3) == 0 && XSTRNCMP(n1,"PSK",3) == 0)
|
|
keaStr = "RSAPSK";
|
|
else if (XSTRNCMP(n0,"SRP",3) == 0)
|
|
keaStr = "SRP";
|
|
else if (XSTRNCMP(n0,"PSK",3) == 0)
|
|
keaStr = "PSK";
|
|
else if (XSTRNCMP(n0,"EDH",3) == 0)
|
|
keaStr = "EDH";
|
|
else if ((XSTRNCMP(n1,"SHA",3) == 0) || (XSTRNCMP(n2,"SHA",3) == 0) ||
|
|
(XSTRNCMP(n3,"SHA",3) == 0) || (XSTRNCMP(n4,"SHA",3) == 0) ||
|
|
(XSTRNCMP(n2,"RSA",3) == 0) || (XSTRNCMP(n0,"AES128",6) == 0) ||
|
|
(XSTRNCMP(n0,"AES256",6) == 0) || (XSTRNCMP(n1,"MD5",3) == 0))
|
|
keaStr = "RSA";
|
|
else
|
|
keaStr = "unknown";
|
|
|
|
return keaStr;
|
|
}
|
|
|
|
const char* GetCipherAuthStr(char n[][MAX_SEGMENT_SZ]) {
|
|
|
|
const char* authStr = NULL;
|
|
const char *n0,*n1,*n2;
|
|
n0 = n[0];
|
|
n1 = n[1];
|
|
n2 = n[2];
|
|
|
|
#ifdef HAVE_NTRU
|
|
if (XSTRNCMP(n0,"NTRU",4) == 0)
|
|
return "NTRU";
|
|
#endif
|
|
|
|
if ((XSTRNCMP(n0,"AES128",6) == 0) || (XSTRNCMP(n0,"AES256",6) == 0) ||
|
|
((XSTRNCMP(n0,"TLS13",5) == 0) && ((XSTRNCMP(n1,"AES128",6) == 0) ||
|
|
(XSTRNCMP(n1,"AES256",6) == 0) || (XSTRNCMP(n1,"CHACHA20",8) == 0))) ||
|
|
(XSTRNCMP(n0,"RSA",3) == 0) || (XSTRNCMP(n1,"RSA",3) == 0) ||
|
|
(XSTRNCMP(n1,"SHA",3) == 0) || (XSTRNCMP(n2,"SHA",3) == 0) ||
|
|
(XSTRNCMP(n1,"MD5",3) == 0))
|
|
authStr = "RSA";
|
|
else if (XSTRNCMP(n0,"PSK",3) == 0 || XSTRNCMP(n1,"PSK",3) == 0)
|
|
authStr = "PSK";
|
|
else if (XSTRNCMP(n0,"SRP",3) == 0 && XSTRNCMP(n1,"AES",3) == 0)
|
|
authStr = "SRP";
|
|
else if (XSTRNCMP(n1,"ECDSA",5) == 0)
|
|
authStr = "ECDSA";
|
|
else if (XSTRNCMP(n0,"ADH",3) == 0)
|
|
authStr = "None";
|
|
else
|
|
authStr = "unknown";
|
|
|
|
return authStr;
|
|
}
|
|
|
|
const char* GetCipherEncStr(char n[][MAX_SEGMENT_SZ]) {
|
|
const char* encStr = NULL;
|
|
const char *n0,*n1,*n2,*n3;
|
|
n0 = n[0];
|
|
n1 = n[1];
|
|
n2 = n[2];
|
|
n3 = n[3];
|
|
|
|
if ((XSTRNCMP(n0,"AES256",6) == 0 && XSTRNCMP(n1,"GCM",3) == 0) ||
|
|
(XSTRNCMP(n1,"AES256",6) == 0 && XSTRNCMP(n2,"GCM",3) == 0) ||
|
|
(XSTRNCMP(n2,"AES256",6) == 0 && XSTRNCMP(n3,"GCM",3) == 0))
|
|
encStr = "AESGCM(256)";
|
|
|
|
else if ((XSTRNCMP(n0,"AES128",6) == 0 && XSTRNCMP(n1,"GCM",3) == 0) ||
|
|
(XSTRNCMP(n1,"AES128",6) == 0 && XSTRNCMP(n2,"GCM",3) == 0) ||
|
|
(XSTRNCMP(n2,"AES128",6) == 0 && XSTRNCMP(n3,"GCM",3) == 0))
|
|
encStr = "AESGCM(128)";
|
|
|
|
else if ((XSTRNCMP(n0,"AES128",6) == 0 && XSTRNCMP(n1,"CCM",3) == 0) ||
|
|
(XSTRNCMP(n1,"AES128",6) == 0 && XSTRNCMP(n2,"CCM",3) == 0) ||
|
|
(XSTRNCMP(n2,"AES128",6) == 0 && XSTRNCMP(n3,"CCM",3) == 0))
|
|
encStr = "AESCCM(128)";
|
|
|
|
else if ((XSTRNCMP(n0,"AES128",6) == 0) ||
|
|
(XSTRNCMP(n1,"AES128",6) == 0) ||
|
|
(XSTRNCMP(n2,"AES128",6) == 0) ||
|
|
(XSTRNCMP(n1,"AES",3) == 0 && XSTRNCMP(n2,"128",3) == 0) ||
|
|
(XSTRNCMP(n2,"AES",3) == 0 && XSTRNCMP(n3,"128",3) == 0))
|
|
encStr = "AES(128)";
|
|
|
|
else if ((XSTRNCMP(n0,"AES256",6) == 0) ||
|
|
(XSTRNCMP(n1,"AES256",6) == 0) ||
|
|
(XSTRNCMP(n2,"AES256",6) == 0) ||
|
|
(XSTRNCMP(n1,"AES",3) == 0 && XSTRNCMP(n2,"256",3) == 0) ||
|
|
(XSTRNCMP(n2,"AES",3) == 0 && XSTRNCMP(n3,"256",3) == 0))
|
|
encStr = "AES(256)";
|
|
|
|
else if ((XSTRNCMP(n0,"CAMELLIA256",11) == 0) ||
|
|
(XSTRNCMP(n2,"CAMELLIA256",11) == 0))
|
|
encStr = "CAMELLIA(256)";
|
|
else if ((XSTRNCMP(n0,"CAMELLIA128",11) == 0) ||
|
|
(XSTRNCMP(n2,"CAMELLIA128",11) == 0))
|
|
encStr = "CAMELLIA(128)";
|
|
else if ((XSTRNCMP(n0,"RC4",3) == 0) || (XSTRNCMP(n1,"RC4",3) == 0) ||
|
|
(XSTRNCMP(n2,"RC4",3) == 0))
|
|
encStr = "RC4";
|
|
else if (((XSTRNCMP(n0,"DES",3) == 0) || (XSTRNCMP(n1,"DES",3) == 0) ||
|
|
(XSTRNCMP(n2,"DES",3) == 0)) &&
|
|
((XSTRNCMP(n1,"CBC3",4) == 0) || (XSTRNCMP(n2,"CBC3",4) == 0) ||
|
|
(XSTRNCMP(n3,"CBC3",4) == 0)))
|
|
encStr = "3DES";
|
|
else if ((XSTRNCMP(n1,"CHACHA20",8) == 0 && XSTRNCMP(n2,"POLY1305",8) == 0) ||
|
|
(XSTRNCMP(n2,"CHACHA20",8) == 0 && XSTRNCMP(n3,"POLY1305",8) == 0))
|
|
encStr = "CHACHA20/POLY1305(256)";
|
|
else if ((XSTRNCMP(n0,"NULL",4) == 0) || (XSTRNCMP(n1,"NULL",4) == 0) ||
|
|
(XSTRNCMP(n2,"NULL",4) == 0) ||
|
|
((XSTRNCMP(n0,"TLS13",5) == 0) && (XSTRNCMP(n3,"",0) == 0)))
|
|
encStr = "None";
|
|
else if ((XSTRNCMP(n0,"IDEA",4) == 0))
|
|
encStr = "IDEA";
|
|
else if ((XSTRNCMP(n0,"RABBIT",4) == 0))
|
|
encStr = "RABBIT";
|
|
else if ((XSTRNCMP(n0,"HC128",5) == 0))
|
|
encStr = "HC128";
|
|
else
|
|
encStr = "unknown";
|
|
|
|
return encStr;
|
|
}
|
|
|
|
/* Returns the MAC string of a cipher or "unknown" on failure */
|
|
const char* GetCipherMacStr(char n[][MAX_SEGMENT_SZ]) {
|
|
|
|
const char* macStr = NULL;
|
|
const char *n1,*n2,*n3,*n4;
|
|
n1 = n[1];
|
|
n2 = n[2];
|
|
n3 = n[3];
|
|
n4 = n[4];
|
|
|
|
if ((XSTRNCMP(n4,"SHA256",6) == 0) || (XSTRNCMP(n3,"SHA256",6) == 0) ||
|
|
(XSTRNCMP(n2,"SHA256",6) == 0) || (XSTRNCMP(n1,"SHA256",6) == 0))
|
|
macStr = "SHA256";
|
|
else if ((XSTRNCMP(n4,"SHA384",6) == 0) ||
|
|
(XSTRNCMP(n3,"SHA384",6) == 0) ||
|
|
(XSTRNCMP(n2,"SHA384",6) == 0) ||
|
|
(XSTRNCMP(n1,"SHA384",6) == 0))
|
|
macStr = "SHA384";
|
|
else if ((XSTRNCMP(n4,"SHA",3) == 0) || (XSTRNCMP(n3,"SHA",3) == 0) ||
|
|
(XSTRNCMP(n2,"SHA",3) == 0) || (XSTRNCMP(n1,"SHA",3) == 0) ||
|
|
(XSTRNCMP(n1,"MD5",3) == 0))
|
|
macStr = "SHA1";
|
|
else if ((XSTRNCMP(n3,"GCM",3) == 0) ||
|
|
(XSTRNCMP(n1,"CCM",3) == 0) ||
|
|
(XSTRNCMP(n2,"CCM",3) == 0) || (XSTRNCMP(n3,"CCM",3) == 0) ||
|
|
(XSTRNCMP(n1,"CHACHA20",8) == 0 && XSTRNCMP(n2,"POLY1305",8) == 0) ||
|
|
(XSTRNCMP(n2,"CHACHA20",8) == 0 && XSTRNCMP(n3,"POLY1305",8) == 0))
|
|
macStr = "AEAD";
|
|
else
|
|
macStr = "unknown";
|
|
|
|
return macStr;
|
|
}
|
|
|
|
/* Returns the number of bits based on the cipher enc string, or 0 on failure */
|
|
int SetCipherBits(const char* enc) {
|
|
int ret = WOLFSSL_FAILURE;
|
|
|
|
if ((XSTRNCMP(enc,"AESGCM(256)",11) == 0) ||
|
|
(XSTRNCMP(enc,"AES(256)",8) == 0) ||
|
|
(XSTRNCMP(enc,"CAMELLIA(256)",13) == 0) ||
|
|
(XSTRNCMP(enc,"CHACHA20/POLY1305(256)",22) == 0))
|
|
ret = 256;
|
|
else if
|
|
((XSTRNCMP(enc,"3DES",4) == 0))
|
|
ret = 168;
|
|
else if
|
|
((XSTRNCMP(enc,"AESGCM(128)",11) == 0) ||
|
|
(XSTRNCMP(enc,"AES(128)",8) == 0) ||
|
|
(XSTRNCMP(enc,"CAMELLIA(128)",13) == 0) ||
|
|
(XSTRNCMP(enc,"IDEA",4) == 0) ||
|
|
(XSTRNCMP(enc,"RC4",3) == 0))
|
|
ret = 128;
|
|
else if
|
|
((XSTRNCMP(enc,"DES",3) == 0))
|
|
ret = 56;
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_QT || OPENSSL_ALL */
|
|
|
|
const char* GetCipherNameIana(const byte cipherSuite0, const byte cipherSuite)
|
|
{
|
|
#ifndef NO_ERROR_STRINGS
|
|
int i;
|
|
const char* nameIana = "NONE";
|
|
|
|
for (i = 0; i < GetCipherNamesSize(); i++) {
|
|
if ((cipher_names[i].cipherSuite0 == cipherSuite0) &&
|
|
(cipher_names[i].cipherSuite == cipherSuite)
|
|
#ifndef NO_CIPHER_SUITE_ALIASES
|
|
&& (! (cipher_names[i].flags & WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS))
|
|
#endif
|
|
) {
|
|
nameIana = cipher_names[i].name_iana;
|
|
break;
|
|
}
|
|
}
|
|
return nameIana;
|
|
#else
|
|
(void)cipherSuite0;
|
|
(void)cipherSuite;
|
|
return NULL;
|
|
#endif
|
|
}
|
|
|
|
const char* wolfSSL_get_cipher_name_internal(WOLFSSL* ssl)
|
|
{
|
|
if (ssl == NULL) {
|
|
return NULL;
|
|
}
|
|
|
|
return GetCipherNameInternal(ssl->options.cipherSuite0, ssl->options.cipherSuite);
|
|
}
|
|
|
|
const char* wolfSSL_get_cipher_name_iana(WOLFSSL* ssl)
|
|
{
|
|
if (ssl == NULL) {
|
|
return NULL;
|
|
}
|
|
|
|
return GetCipherNameIana(ssl->options.cipherSuite0, ssl->options.cipherSuite);
|
|
}
|
|
|
|
int GetCipherSuiteFromName(const char* name, byte* cipherSuite0,
|
|
byte* cipherSuite, int* flags)
|
|
{
|
|
int ret = BAD_FUNC_ARG;
|
|
int i;
|
|
unsigned long len;
|
|
const char* nameDelim;
|
|
|
|
/* Support trailing : */
|
|
nameDelim = XSTRSTR(name, ":");
|
|
if (nameDelim)
|
|
len = (unsigned long)(nameDelim - name);
|
|
else
|
|
len = (unsigned long)XSTRLEN(name);
|
|
|
|
for (i = 0; i < GetCipherNamesSize(); i++) {
|
|
if ((XSTRNCMP(name, cipher_names[i].name, len) == 0) &&
|
|
(cipher_names[i].name[len] == 0)) {
|
|
*cipherSuite0 = cipher_names[i].cipherSuite0;
|
|
*cipherSuite = cipher_names[i].cipherSuite;
|
|
*flags = cipher_names[i].flags;
|
|
ret = 0;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/**
|
|
Set the enabled cipher suites.
|
|
|
|
@param [out] suites Suites structure.
|
|
@param [in] list List of cipher suites, only supports full name from
|
|
cipher_names[] delimited by ':'.
|
|
|
|
@return true on success, else false.
|
|
*/
|
|
int SetCipherList(WOLFSSL_CTX* ctx, Suites* suites, const char* list)
|
|
{
|
|
int ret = 0;
|
|
int idx = 0;
|
|
int haveRSAsig = 0;
|
|
int haveECDSAsig = 0;
|
|
int haveAnon = 0;
|
|
const int suiteSz = GetCipherNamesSize();
|
|
char* next = (char*)list;
|
|
|
|
if (suites == NULL || list == NULL) {
|
|
WOLFSSL_MSG("SetCipherList parameter error");
|
|
return 0;
|
|
}
|
|
|
|
if (next[0] == 0 || XSTRNCMP(next, "ALL", 3) == 0 ||
|
|
XSTRNCMP(next, "DEFAULT", 7) == 0)
|
|
return 1; /* wolfSSL default */
|
|
|
|
do {
|
|
char* current = next;
|
|
char name[MAX_SUITE_NAME + 1];
|
|
int i;
|
|
word32 length;
|
|
|
|
next = XSTRSTR(next, ":");
|
|
length = min(sizeof(name), !next ? (word32)XSTRLEN(current) /* last */
|
|
: (word32)(next - current));
|
|
|
|
XSTRNCPY(name, current, length);
|
|
name[(length == sizeof(name)) ? length - 1 : length] = 0;
|
|
|
|
for (i = 0; i < suiteSz; i++) {
|
|
if (XSTRNCMP(name, cipher_names[i].name, sizeof(name)) == 0
|
|
#ifndef NO_ERROR_STRINGS
|
|
|| XSTRNCMP(name, cipher_names[i].name_iana, sizeof(name)) == 0
|
|
#endif
|
|
) {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* don't allow stream ciphers with DTLS */
|
|
if (ctx->method->version.major == DTLS_MAJOR) {
|
|
if (XSTRSTR(name, "RC4") ||
|
|
XSTRSTR(name, "HC128") ||
|
|
XSTRSTR(name, "RABBIT"))
|
|
{
|
|
WOLFSSL_MSG("Stream ciphers not supported with DTLS");
|
|
continue;
|
|
}
|
|
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
if (idx + 1 >= WOLFSSL_MAX_SUITE_SZ) {
|
|
WOLFSSL_MSG("WOLFSSL_MAX_SUITE_SZ set too low");
|
|
return 0; /* suites buffer not large enough, error out */
|
|
}
|
|
|
|
suites->suites[idx++] = cipher_names[i].cipherSuite0;
|
|
suites->suites[idx++] = cipher_names[i].cipherSuite;
|
|
/* The suites are either ECDSA, RSA, PSK, or Anon. The RSA
|
|
* suites don't necessarily have RSA in the name. */
|
|
#ifdef WOLFSSL_TLS13
|
|
if (cipher_names[i].cipherSuite0 == TLS13_BYTE ||
|
|
(cipher_names[i].cipherSuite0 == ECC_BYTE &&
|
|
(cipher_names[i].cipherSuite == TLS_SHA256_SHA256 ||
|
|
cipher_names[i].cipherSuite == TLS_SHA384_SHA384))) {
|
|
#ifndef NO_RSA
|
|
haveRSAsig = 1;
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || \
|
|
defined(HAVE_ED448)
|
|
haveECDSAsig = 1;
|
|
#endif
|
|
}
|
|
else
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || \
|
|
defined(HAVE_ED448)
|
|
if ((haveECDSAsig == 0) && XSTRSTR(name, "ECDSA"))
|
|
haveECDSAsig = 1;
|
|
else
|
|
#endif
|
|
#ifdef HAVE_ANON
|
|
if (XSTRSTR(name, "ADH"))
|
|
haveAnon = 1;
|
|
else
|
|
#endif
|
|
if (haveRSAsig == 0
|
|
#ifndef NO_PSK
|
|
&& (XSTRSTR(name, "PSK") == NULL)
|
|
#endif
|
|
) {
|
|
haveRSAsig = 1;
|
|
}
|
|
|
|
ret = 1; /* found at least one */
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
while (next++); /* ++ needed to skip ':' */
|
|
|
|
if (ret) {
|
|
int keySz = 0;
|
|
#ifndef NO_CERTS
|
|
keySz = ctx->privateKeySz;
|
|
#endif
|
|
suites->setSuites = 1;
|
|
suites->suiteSz = (word16)idx;
|
|
InitSuitesHashSigAlgo(suites, haveECDSAsig, haveRSAsig, haveAnon, 1,
|
|
keySz);
|
|
}
|
|
|
|
(void)ctx;
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_CERTS)
|
|
static int MatchSigAlgo(WOLFSSL* ssl, int sigAlgo)
|
|
{
|
|
#ifdef HAVE_ED25519
|
|
if (ssl->pkCurveOID == ECC_ED25519_OID) {
|
|
/* Certificate has Ed25519 key, only match with Ed25519 sig alg */
|
|
return sigAlgo == ed25519_sa_algo;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
if (ssl->pkCurveOID == ECC_ED448_OID) {
|
|
/* Certificate has Ed448 key, only match with Ed448 sig alg */
|
|
return sigAlgo == ed448_sa_algo;
|
|
}
|
|
#endif
|
|
#ifdef WC_RSA_PSS
|
|
/* RSA certificate and PSS sig alg. */
|
|
if (ssl->suites->sigAlgo == rsa_sa_algo) {
|
|
#if defined(WOLFSSL_TLS13)
|
|
/* TLS 1.3 only supports RSA-PSS. */
|
|
if (IsAtLeastTLSv1_3(ssl->version))
|
|
return sigAlgo == rsa_pss_sa_algo;
|
|
#endif
|
|
/* TLS 1.2 and below - RSA-PSS allowed. */
|
|
if (sigAlgo == rsa_pss_sa_algo)
|
|
return 1;
|
|
}
|
|
#endif
|
|
/* Signature algorithm matches certificate. */
|
|
return sigAlgo == ssl->suites->sigAlgo;
|
|
}
|
|
|
|
#if defined(HAVE_ECC) && defined(WOLFSSL_TLS13) || \
|
|
defined(USE_ECDSA_KEYSZ_HASH_ALGO)
|
|
static int CmpEccStrength(int hashAlgo, int curveSz)
|
|
{
|
|
int dgstSz = GetMacDigestSize(hashAlgo);
|
|
if (dgstSz <= 0)
|
|
return -1;
|
|
return dgstSz - (curveSz & (~0x3));
|
|
}
|
|
#endif
|
|
|
|
static byte MinHashAlgo(WOLFSSL* ssl)
|
|
{
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version)) {
|
|
return sha256_mac;
|
|
}
|
|
#endif
|
|
#if !defined(WOLFSSL_NO_TLS12) && !defined(WOLFSSL_ALLOW_TLS_SHA1)
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
return sha256_mac;
|
|
}
|
|
#endif /* WOLFSSL_NO_TLS12 */
|
|
return sha_mac;
|
|
}
|
|
|
|
int PickHashSigAlgo(WOLFSSL* ssl, const byte* hashSigAlgo, word32 hashSigAlgoSz)
|
|
{
|
|
word32 i;
|
|
int ret = MATCH_SUITE_ERROR;
|
|
byte minHash;
|
|
|
|
/* set defaults */
|
|
if (IsAtLeastTLSv1_3(ssl->version)) {
|
|
#ifndef NO_CERTS
|
|
/* TLS 1.3 cipher suites don't have public key algorithms in them.
|
|
* Using the one in the certificate - if any.
|
|
*/
|
|
ssl->suites->sigAlgo = ssl->buffers.keyType;
|
|
#endif
|
|
}
|
|
else
|
|
ssl->suites->sigAlgo = ssl->specs.sig_algo;
|
|
if (ssl->suites->sigAlgo == 0) {
|
|
/* PSK ciphersuite - get digest to use from cipher suite */
|
|
ssl->suites->hashAlgo = ssl->specs.mac_algorithm;
|
|
return 0;
|
|
}
|
|
ssl->suites->hashAlgo = minHash = MinHashAlgo(ssl);
|
|
|
|
/* No list means go with the defaults. */
|
|
if (hashSigAlgoSz == 0)
|
|
return 0;
|
|
|
|
/* i+1 since two bytes used to describe hash and signature algorithm */
|
|
for (i = 0; (i+1) < hashSigAlgoSz; i += HELLO_EXT_SIGALGO_SZ) {
|
|
byte hashAlgo = 0, sigAlgo = 0;
|
|
|
|
DecodeSigAlg(&hashSigAlgo[i], &hashAlgo, &sigAlgo);
|
|
/* Keep looking if hash algorithm not strong enough. */
|
|
if (hashAlgo < minHash)
|
|
continue;
|
|
/* Keep looking if signature algorithm isn't supported by cert. */
|
|
if (!MatchSigAlgo(ssl, sigAlgo))
|
|
continue;
|
|
|
|
#ifdef HAVE_ED25519
|
|
if (ssl->pkCurveOID == ECC_ED25519_OID) {
|
|
/* Matched Ed25519 - set chosen and finished. */
|
|
ssl->suites->sigAlgo = sigAlgo;
|
|
ssl->suites->hashAlgo = hashAlgo;
|
|
ret = 0;
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
if (ssl->pkCurveOID == ECC_ED448_OID) {
|
|
/* Matched Ed448 - set chosen and finished. */
|
|
ssl->suites->sigAlgo = sigAlgo;
|
|
ssl->suites->hashAlgo = hashAlgo;
|
|
ret = 0;
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
#if defined(WOLFSSL_ECDSA_MATCH_HASH) && defined(USE_ECDSA_KEYSZ_HASH_ALGO)
|
|
#error "WOLFSSL_ECDSA_MATCH_HASH and USE_ECDSA_KEYSZ_HASH_ALGO cannot "
|
|
"be used together"
|
|
#endif
|
|
|
|
#if defined(HAVE_ECC) && (defined(WOLFSSL_TLS13) || \
|
|
defined(WOLFSSL_ECDSA_MATCH_HASH))
|
|
if (sigAlgo == ecc_dsa_sa_algo
|
|
#ifndef WOLFSSL_ECDSA_MATCH_HASH
|
|
&& IsAtLeastTLSv1_3(ssl->version)
|
|
#endif
|
|
) {
|
|
/* Must be exact match. */
|
|
if (CmpEccStrength(hashAlgo, ssl->buffers.keySz) != 0)
|
|
continue;
|
|
|
|
/* Matched ECDSA exaclty - set chosen and finished. */
|
|
ssl->suites->hashAlgo = hashAlgo;
|
|
ssl->suites->sigAlgo = sigAlgo;
|
|
ret = 0;
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
/* For ECDSA the `USE_ECDSA_KEYSZ_HASH_ALGO` build option will choose a hash
|
|
* algorithm that matches the ephemeral ECDHE key size or the next highest
|
|
* available. This workaround resolves issue with some peer's that do not
|
|
* properly support scenarios such as a P-256 key hashed with SHA512.
|
|
*/
|
|
#if defined(HAVE_ECC) && defined(USE_ECDSA_KEYSZ_HASH_ALGO)
|
|
if (sigAlgo == ecc_dsa_sa_algo) {
|
|
int cmp = CmpEccStrength(hashAlgo, ssl->eccTempKeySz);
|
|
|
|
/* Keep looking if digest not strong enough. */
|
|
if (cmp < 0)
|
|
continue;
|
|
|
|
/* Looking for exact match or next highest. */
|
|
if (ret != 0 || hashAlgo <= ssl->suites->hashAlgo) {
|
|
ssl->suites->hashAlgo = hashAlgo;
|
|
ssl->suites->sigAlgo = sigAlgo;
|
|
#if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE)
|
|
ssl->namedGroup = 0;
|
|
#endif
|
|
ret = 0;
|
|
}
|
|
|
|
/* Continue looking if not the same strength. */
|
|
if (cmp > 0)
|
|
continue;
|
|
/* Exact match - finished. */
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
switch (hashAlgo) {
|
|
#ifndef NO_SHA
|
|
case sha_mac:
|
|
#endif
|
|
#ifdef WOLFSSL_SHA224
|
|
case sha224_mac:
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
case sha256_mac:
|
|
#endif
|
|
#ifdef WOLFSSL_SHA384
|
|
case sha384_mac:
|
|
#endif
|
|
#ifdef WOLFSSL_SHA512
|
|
case sha512_mac:
|
|
#endif
|
|
#ifdef WOLFSSL_STRONGEST_HASH_SIG
|
|
/* Is hash algorithm weaker than chosen/min? */
|
|
if (hashAlgo < ssl->suites->hashAlgo)
|
|
break;
|
|
#else
|
|
/* Is hash algorithm stonger than last chosen? */
|
|
if (ret == 0 && hashAlgo > ssl->suites->hashAlgo)
|
|
break;
|
|
#endif
|
|
/* The chosen one - but keep looking. */
|
|
ssl->suites->hashAlgo = hashAlgo;
|
|
ssl->suites->sigAlgo = sigAlgo;
|
|
ret = 0;
|
|
break;
|
|
default:
|
|
/* Support for hash algorithm not compiled in. */
|
|
break;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif /* !defined(NO_WOLFSSL_SERVER) || !defined(NO_CERTS) */
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
|
|
/* Initialize HandShakeInfo */
|
|
void InitHandShakeInfo(HandShakeInfo* info, WOLFSSL* ssl)
|
|
{
|
|
int i;
|
|
|
|
info->ssl = ssl;
|
|
info->cipherName[0] = 0;
|
|
for (i = 0; i < MAX_PACKETS_HANDSHAKE; i++)
|
|
info->packetNames[i][0] = 0;
|
|
info->numberPackets = 0;
|
|
info->negotiationError = 0;
|
|
}
|
|
|
|
/* Set Final HandShakeInfo parameters */
|
|
void FinishHandShakeInfo(HandShakeInfo* info)
|
|
{
|
|
int i;
|
|
int sz = GetCipherNamesSize();
|
|
|
|
for (i = 0; i < sz; i++) {
|
|
#ifndef NO_CIPHER_SUITE_ALIASES
|
|
if (cipher_names[i].flags & WOLFSSL_CIPHER_SUITE_FLAG_NAMEALIAS)
|
|
continue;
|
|
#endif
|
|
if (info->ssl->options.cipherSuite ==
|
|
(byte)cipher_names[i].cipherSuite) {
|
|
if (info->ssl->options.cipherSuite0 == ECC_BYTE)
|
|
continue; /* ECC suites at end */
|
|
XSTRNCPY(info->cipherName, cipher_names[i].name, MAX_CIPHERNAME_SZ);
|
|
info->cipherName[MAX_CIPHERNAME_SZ] = '\0';
|
|
break;
|
|
}
|
|
}
|
|
|
|
/* error max and min are negative numbers */
|
|
if (info->ssl->error <= MIN_PARAM_ERR && info->ssl->error >= MAX_PARAM_ERR)
|
|
info->negotiationError = info->ssl->error;
|
|
}
|
|
|
|
|
|
/* Add name to info packet names, increase packet name count */
|
|
void AddPacketName(WOLFSSL* ssl, const char* name)
|
|
{
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
HandShakeInfo* info = &ssl->handShakeInfo;
|
|
if (info->numberPackets < MAX_PACKETS_HANDSHAKE) {
|
|
char* packetName = info->packetNames[info->numberPackets];
|
|
XSTRNCPY(packetName, name, MAX_PACKETNAME_SZ);
|
|
packetName[MAX_PACKETNAME_SZ] = '\0';
|
|
info->numberPackets++;
|
|
}
|
|
#endif
|
|
(void)ssl;
|
|
(void)name;
|
|
}
|
|
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
/* Initialize TimeoutInfo */
|
|
void InitTimeoutInfo(TimeoutInfo* info)
|
|
{
|
|
int i;
|
|
|
|
info->timeoutName[0] = 0;
|
|
info->flags = 0;
|
|
|
|
for (i = 0; i < MAX_PACKETS_HANDSHAKE; i++) {
|
|
info->packets[i].packetName[0] = 0;
|
|
info->packets[i].timestamp.tv_sec = 0;
|
|
info->packets[i].timestamp.tv_usec = 0;
|
|
info->packets[i].bufferValue = 0;
|
|
info->packets[i].valueSz = 0;
|
|
}
|
|
info->numberPackets = 0;
|
|
info->timeoutValue.tv_sec = 0;
|
|
info->timeoutValue.tv_usec = 0;
|
|
}
|
|
|
|
|
|
/* Free TimeoutInfo */
|
|
void FreeTimeoutInfo(TimeoutInfo* info, void* heap)
|
|
{
|
|
int i;
|
|
(void)heap;
|
|
for (i = 0; i < MAX_PACKETS_HANDSHAKE; i++)
|
|
if (info->packets[i].bufferValue) {
|
|
XFREE(info->packets[i].bufferValue, heap, DYNAMIC_TYPE_INFO);
|
|
info->packets[i].bufferValue = 0;
|
|
}
|
|
|
|
}
|
|
|
|
/* Add packet name to previously added packet info */
|
|
void AddLateName(const char* name, TimeoutInfo* info)
|
|
{
|
|
/* make sure we have a valid previous one */
|
|
if (info->numberPackets > 0 && info->numberPackets <
|
|
MAX_PACKETS_HANDSHAKE) {
|
|
char* packetName = info->packets[info->numberPackets-1].packetName;
|
|
XSTRNCPY(packetName, name, MAX_PACKETNAME_SZ);
|
|
packetName[MAX_PACKETNAME_SZ] = '\0';
|
|
}
|
|
}
|
|
|
|
/* Add record header to previously added packet info */
|
|
void AddLateRecordHeader(const RecordLayerHeader* rl, TimeoutInfo* info)
|
|
{
|
|
/* make sure we have a valid previous one */
|
|
if (info->numberPackets > 0 && info->numberPackets <
|
|
MAX_PACKETS_HANDSHAKE) {
|
|
if (info->packets[info->numberPackets - 1].bufferValue)
|
|
XMEMCPY(info->packets[info->numberPackets - 1].bufferValue, rl,
|
|
RECORD_HEADER_SZ);
|
|
else
|
|
XMEMCPY(info->packets[info->numberPackets - 1].value, rl,
|
|
RECORD_HEADER_SZ);
|
|
}
|
|
}
|
|
|
|
#endif /* WOLFSSL_CALLBACKS */
|
|
|
|
|
|
/* Add PacketInfo to TimeoutInfo
|
|
*
|
|
* ssl WOLFSSL structure sending or receiving packet
|
|
* name name of packet being sent
|
|
* type type of packet being sent
|
|
* data data bing sent with packet
|
|
* sz size of data buffer
|
|
* written 1 if this packet is being written to wire, 0 if being read
|
|
* heap custom heap to use for mallocs/frees
|
|
*/
|
|
void AddPacketInfo(WOLFSSL* ssl, const char* name, int type,
|
|
const byte* data, int sz, int written, void* heap)
|
|
{
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
TimeoutInfo* info = &ssl->timeoutInfo;
|
|
|
|
if (info->numberPackets < (MAX_PACKETS_HANDSHAKE - 1)) {
|
|
WOLFSSL_TIMEVAL currTime;
|
|
|
|
/* may add name after */
|
|
if (name) {
|
|
char* packetName = info->packets[info->numberPackets].packetName;
|
|
XSTRNCPY(packetName, name, MAX_PACKETNAME_SZ);
|
|
packetName[MAX_PACKETNAME_SZ] = '\0';
|
|
}
|
|
|
|
/* add data, put in buffer if bigger than static buffer */
|
|
info->packets[info->numberPackets].valueSz = sz;
|
|
if (sz < MAX_VALUE_SZ)
|
|
XMEMCPY(info->packets[info->numberPackets].value, data, sz);
|
|
else {
|
|
info->packets[info->numberPackets].bufferValue =
|
|
(byte*)XMALLOC(sz, heap, DYNAMIC_TYPE_INFO);
|
|
if (!info->packets[info->numberPackets].bufferValue)
|
|
/* let next alloc catch, just don't fill, not fatal here */
|
|
info->packets[info->numberPackets].valueSz = 0;
|
|
else
|
|
XMEMCPY(info->packets[info->numberPackets].bufferValue,
|
|
data, sz);
|
|
}
|
|
gettimeofday(&currTime, 0);
|
|
info->packets[info->numberPackets].timestamp.tv_sec =
|
|
currTime.tv_sec;
|
|
info->packets[info->numberPackets].timestamp.tv_usec =
|
|
currTime.tv_usec;
|
|
info->numberPackets++;
|
|
}
|
|
#endif /* WOLFSSL_CALLBACKS */
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->protoMsgCb != NULL && sz > RECORD_HEADER_SZ) {
|
|
/* version from hex to dec 16 is 16^1, 256 from 16^2 and
|
|
4096 from 16^3 */
|
|
int version = (ssl->version.minor & 0X0F) +
|
|
(ssl->version.minor & 0xF0) * 16 +
|
|
(ssl->version.major & 0X0F) * 256 +
|
|
(ssl->version.major & 0xF0) * 4096;
|
|
|
|
ssl->protoMsgCb(written, version, type,
|
|
(const void *)(data + RECORD_HEADER_SZ),
|
|
(size_t)(sz - RECORD_HEADER_SZ),
|
|
ssl, ssl->protoMsgCtx);
|
|
}
|
|
#endif /* OPENSSL_EXTRA */
|
|
(void)written;
|
|
(void)name;
|
|
(void)heap;
|
|
(void)type;
|
|
(void)ssl;
|
|
}
|
|
|
|
#endif /* WOLFSSL_CALLBACKS */
|
|
|
|
#if !defined(NO_CERTS)
|
|
|
|
#ifdef WOLF_CRYPTO_CB
|
|
/* Create a private key for a device.
|
|
*
|
|
* pkey Key object.
|
|
* data Data to identify key.
|
|
* length Length of data.
|
|
* hsType Type of the key to create.
|
|
* heap Custom heap to use for mallocs/frees
|
|
* devId Id for device.
|
|
* return 0 on success.
|
|
* return NOT_COMPILED_IN if algorithm type not supported.
|
|
* return MEMORY_E on memory allocation failure.
|
|
* return other internal error
|
|
*/
|
|
int CreateDevPrivateKey(void** pkey, byte* data, word32 length, int hsType,
|
|
int label, int id, void* heap, int devId)
|
|
{
|
|
int ret = NOT_COMPILED_IN;
|
|
|
|
if (hsType == DYNAMIC_TYPE_RSA) {
|
|
#ifndef NO_RSA
|
|
RsaKey* rsaKey;
|
|
|
|
rsaKey = (RsaKey*)XMALLOC(sizeof(RsaKey), heap, DYNAMIC_TYPE_RSA);
|
|
if (rsaKey == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
|
|
if (label) {
|
|
ret = wc_InitRsaKey_Label(rsaKey, (char*)data, heap, devId);
|
|
}
|
|
else if (id) {
|
|
ret = wc_InitRsaKey_Id(rsaKey, data, length, heap, devId);
|
|
}
|
|
if (ret == 0) {
|
|
*pkey = (void*)rsaKey;
|
|
}
|
|
else {
|
|
XFREE(rsaKey, heap, DYNAMIC_TYPE_RSA);
|
|
}
|
|
#endif
|
|
}
|
|
else if (hsType == DYNAMIC_TYPE_ECC) {
|
|
#ifdef HAVE_ECC
|
|
ecc_key* ecKey;
|
|
|
|
ecKey = (ecc_key*)XMALLOC(sizeof(ecc_key), heap, DYNAMIC_TYPE_ECC);
|
|
if (ecKey == NULL) {
|
|
return MEMORY_E;
|
|
}
|
|
|
|
if (label) {
|
|
ret = wc_ecc_init_label(ecKey, (char*)data, heap, devId);
|
|
}
|
|
else if (id) {
|
|
ret = wc_ecc_init_id(ecKey, data, length, heap, devId);
|
|
}
|
|
if (ret == 0) {
|
|
*pkey = (void*)ecKey;
|
|
}
|
|
else {
|
|
XFREE(ecKey, heap, DYNAMIC_TYPE_ECC);
|
|
}
|
|
#endif
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
/* Decode the private key - RSA/ECC/Ed25519/Ed448 - and creates a key object.
|
|
* The signature type is set as well.
|
|
* The maximum length of a signature is returned.
|
|
*
|
|
* ssl The SSL/TLS object.
|
|
* length The length of a signature.
|
|
* returns 0 on success, otherwise failure.
|
|
*/
|
|
int DecodePrivateKey(WOLFSSL *ssl, word16* length)
|
|
{
|
|
int ret = BAD_FUNC_ARG;
|
|
int keySz;
|
|
word32 idx;
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* allow no private key if using PK callbacks and CB is set */
|
|
if (wolfSSL_IsPrivatePkSet(ssl)) {
|
|
*length = GetPrivateKeySigSize(ssl);
|
|
return 0;
|
|
}
|
|
else
|
|
#endif
|
|
|
|
/* make sure private key exists */
|
|
if (ssl->buffers.key == NULL || ssl->buffers.key->buffer == NULL) {
|
|
WOLFSSL_MSG("Private key missing!");
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_dpk);
|
|
}
|
|
|
|
#ifdef HAVE_PKCS11
|
|
if (ssl->buffers.keyDevId != INVALID_DEVID && (ssl->buffers.keyId ||
|
|
ssl->buffers.keyLabel)) {
|
|
if (ssl->buffers.keyType == rsa_sa_algo)
|
|
ssl->hsType = DYNAMIC_TYPE_RSA;
|
|
else if (ssl->buffers.keyType == ecc_dsa_sa_algo)
|
|
ssl->hsType = DYNAMIC_TYPE_ECC;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_dpk;
|
|
}
|
|
|
|
if (ssl->buffers.keyType == rsa_sa_algo) {
|
|
#ifndef NO_RSA
|
|
if (ssl->buffers.keyLabel) {
|
|
ret = wc_InitRsaKey_Label((RsaKey*)ssl->hsKey,
|
|
(char*)ssl->buffers.key->buffer,
|
|
ssl->heap, ssl->buffers.keyDevId);
|
|
}
|
|
else if (ssl->buffers.keyId) {
|
|
ret = wc_InitRsaKey_Id((RsaKey*)ssl->hsKey,
|
|
ssl->buffers.key->buffer,
|
|
ssl->buffers.key->length, ssl->heap,
|
|
ssl->buffers.keyDevId);
|
|
}
|
|
if (ret == 0) {
|
|
if (ssl->buffers.keySz < ssl->options.minRsaKeySz) {
|
|
WOLFSSL_MSG("RSA key size too small");
|
|
ERROR_OUT(RSA_KEY_SIZE_E, exit_dpk);
|
|
}
|
|
|
|
/* Return the maximum signature length. */
|
|
*length = (word16)ssl->buffers.keySz;
|
|
}
|
|
#else
|
|
ret = NOT_COMPILED_IN;
|
|
#endif
|
|
}
|
|
else if (ssl->buffers.keyType == ecc_dsa_sa_algo) {
|
|
#ifdef HAVE_ECC
|
|
if (ssl->buffers.keyLabel) {
|
|
ret = wc_ecc_init_label((ecc_key*)ssl->hsKey,
|
|
(char*)ssl->buffers.key->buffer,
|
|
ssl->heap, ssl->buffers.keyDevId);
|
|
}
|
|
else if (ssl->buffers.keyId) {
|
|
ret = wc_ecc_init_id((ecc_key*)ssl->hsKey,
|
|
ssl->buffers.key->buffer,
|
|
ssl->buffers.key->length, ssl->heap,
|
|
ssl->buffers.keyDevId);
|
|
}
|
|
if (ret == 0) {
|
|
if (ssl->buffers.keySz < ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG("ECC key size too small");
|
|
ERROR_OUT(ECC_KEY_SIZE_E, exit_dpk);
|
|
}
|
|
|
|
/* Return the maximum signature length. */
|
|
*length = (word16)wc_ecc_sig_size_calc(ssl->buffers.keySz);
|
|
}
|
|
#else
|
|
ret = NOT_COMPILED_IN;
|
|
#endif
|
|
}
|
|
goto exit_dpk;
|
|
}
|
|
#endif
|
|
|
|
#ifndef NO_RSA
|
|
if (ssl->buffers.keyType == rsa_sa_algo || ssl->buffers.keyType == 0) {
|
|
ssl->hsType = DYNAMIC_TYPE_RSA;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_dpk;
|
|
}
|
|
|
|
WOLFSSL_MSG("Trying RSA private key");
|
|
|
|
/* Set start of data to beginning of buffer. */
|
|
idx = 0;
|
|
/* Decode the key assuming it is an RSA private key. */
|
|
ret = wc_RsaPrivateKeyDecode(ssl->buffers.key->buffer, &idx,
|
|
(RsaKey*)ssl->hsKey, ssl->buffers.key->length);
|
|
if (ret == 0) {
|
|
WOLFSSL_MSG("Using RSA private key");
|
|
|
|
/* It worked so check it meets minimum key size requirements. */
|
|
keySz = wc_RsaEncryptSize((RsaKey*)ssl->hsKey);
|
|
if (keySz < 0) { /* check if keySz has error case */
|
|
ERROR_OUT(keySz, exit_dpk);
|
|
}
|
|
|
|
if (keySz < ssl->options.minRsaKeySz) {
|
|
WOLFSSL_MSG("RSA key size too small");
|
|
ERROR_OUT(RSA_KEY_SIZE_E, exit_dpk);
|
|
}
|
|
|
|
/* Return the maximum signature length. */
|
|
*length = (word16)keySz;
|
|
|
|
goto exit_dpk;
|
|
}
|
|
}
|
|
#endif /* !NO_RSA */
|
|
|
|
#ifdef HAVE_ECC
|
|
#ifndef NO_RSA
|
|
FreeKey(ssl, ssl->hsType, (void**)&ssl->hsKey);
|
|
#endif /* !NO_RSA */
|
|
|
|
if (ssl->buffers.keyType == ecc_dsa_sa_algo || ssl->buffers.keyType == 0) {
|
|
ssl->hsType = DYNAMIC_TYPE_ECC;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_dpk;
|
|
}
|
|
|
|
#ifndef NO_RSA
|
|
WOLFSSL_MSG("Trying ECC private key, RSA didn't work");
|
|
#else
|
|
WOLFSSL_MSG("Trying ECC private key");
|
|
#endif
|
|
|
|
/* Set start of data to beginning of buffer. */
|
|
idx = 0;
|
|
/* Decode the key assuming it is an ECC private key. */
|
|
ret = wc_EccPrivateKeyDecode(ssl->buffers.key->buffer, &idx,
|
|
(ecc_key*)ssl->hsKey,
|
|
ssl->buffers.key->length);
|
|
if (ret == 0) {
|
|
WOLFSSL_MSG("Using ECC private key");
|
|
|
|
/* Check it meets the minimum ECC key size requirements. */
|
|
keySz = wc_ecc_size((ecc_key*)ssl->hsKey);
|
|
if (keySz < ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG("ECC key size too small");
|
|
ERROR_OUT(ECC_KEY_SIZE_E, exit_dpk);
|
|
}
|
|
|
|
/* Return the maximum signature length. */
|
|
*length = (word16)wc_ecc_sig_size((ecc_key*)ssl->hsKey);
|
|
|
|
goto exit_dpk;
|
|
}
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
#if !defined(NO_RSA) || defined(HAVE_ECC)
|
|
FreeKey(ssl, ssl->hsType, (void**)&ssl->hsKey);
|
|
#endif
|
|
|
|
if (ssl->buffers.keyType == ed25519_sa_algo || ssl->buffers.keyType == 0) {
|
|
ssl->hsType = DYNAMIC_TYPE_ED25519;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_dpk;
|
|
}
|
|
|
|
#ifdef HAVE_ECC
|
|
WOLFSSL_MSG("Trying ED25519 private key, ECC didn't work");
|
|
#elif !defined(NO_RSA)
|
|
WOLFSSL_MSG("Trying ED25519 private key, RSA didn't work");
|
|
#else
|
|
WOLFSSL_MSG("Trying ED25519 private key");
|
|
#endif
|
|
|
|
/* Set start of data to beginning of buffer. */
|
|
idx = 0;
|
|
/* Decode the key assuming it is an ED25519 private key. */
|
|
ret = wc_Ed25519PrivateKeyDecode(ssl->buffers.key->buffer, &idx,
|
|
(ed25519_key*)ssl->hsKey,
|
|
ssl->buffers.key->length);
|
|
if (ret == 0) {
|
|
WOLFSSL_MSG("Using ED25519 private key");
|
|
|
|
/* Check it meets the minimum ECC key size requirements. */
|
|
if (ED25519_KEY_SIZE < ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG("ED25519 key size too small");
|
|
ERROR_OUT(ECC_KEY_SIZE_E, exit_dpk);
|
|
}
|
|
|
|
/* Return the maximum signature length. */
|
|
*length = ED25519_SIG_SIZE;
|
|
|
|
goto exit_dpk;
|
|
}
|
|
}
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_ED448
|
|
#if !defined(NO_RSA) || defined(HAVE_ECC)
|
|
FreeKey(ssl, ssl->hsType, (void**)&ssl->hsKey);
|
|
#endif
|
|
|
|
if (ssl->buffers.keyType == ed448_sa_algo || ssl->buffers.keyType == 0) {
|
|
ssl->hsType = DYNAMIC_TYPE_ED448;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_dpk;
|
|
}
|
|
|
|
#ifdef HAVE_ED25519
|
|
WOLFSSL_MSG("Trying ED448 private key, ED25519 didn't work");
|
|
#elif defined(HAVE_ECC)
|
|
WOLFSSL_MSG("Trying ED448 private key, ECC didn't work");
|
|
#elif !defined(NO_RSA)
|
|
WOLFSSL_MSG("Trying ED448 private key, RSA didn't work");
|
|
#else
|
|
WOLFSSL_MSG("Trying ED447 private key");
|
|
#endif
|
|
|
|
/* Set start of data to beginning of buffer. */
|
|
idx = 0;
|
|
/* Decode the key assuming it is an ED448 private key. */
|
|
ret = wc_Ed448PrivateKeyDecode(ssl->buffers.key->buffer, &idx,
|
|
(ed448_key*)ssl->hsKey,
|
|
ssl->buffers.key->length);
|
|
if (ret == 0) {
|
|
WOLFSSL_MSG("Using ED448 private key");
|
|
|
|
/* Check it meets the minimum ECC key size requirements. */
|
|
if (ED448_KEY_SIZE < ssl->options.minEccKeySz) {
|
|
WOLFSSL_MSG("ED448 key size too small");
|
|
ERROR_OUT(ECC_KEY_SIZE_E, exit_dpk);
|
|
}
|
|
|
|
/* Return the maximum signature length. */
|
|
*length = ED448_SIG_SIZE;
|
|
|
|
goto exit_dpk;
|
|
}
|
|
}
|
|
#endif /* HAVE_ED448 */
|
|
|
|
(void)idx;
|
|
(void)keySz;
|
|
(void)length;
|
|
exit_dpk:
|
|
return ret;
|
|
}
|
|
|
|
#endif /* WOLFSSL_TLS13 || !NO_WOLFSSL_CLIENT */
|
|
|
|
#if defined(WOLFSSL_TLS13) && !defined(WOLFSSL_NO_TLS12)
|
|
/* returns 1 if able to do TLS 1.3 otherwise 0 */
|
|
int TLSv1_3_Capable(WOLFSSL* ssl)
|
|
{
|
|
#ifndef WOLFSSL_TLS13
|
|
return 0;
|
|
#else
|
|
int ret = 0;
|
|
|
|
if (IsAtLeastTLSv1_3(ssl->ctx->method->version)) {
|
|
ret = 1;
|
|
}
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
if ((wolfSSL_get_options(ssl) & SSL_OP_NO_TLSv1_3)) {
|
|
/* option set at run time to disable TLS 1.3 */
|
|
ret = 0;
|
|
}
|
|
#endif
|
|
return ret;
|
|
#endif
|
|
}
|
|
#endif /* WOLFSSL_TLS13 */
|
|
|
|
/* client only parts */
|
|
#ifndef NO_WOLFSSL_CLIENT
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
/* handle generation of client_hello (1) */
|
|
int SendClientHello(WOLFSSL* ssl)
|
|
{
|
|
byte *output;
|
|
word32 length, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
int sendSz;
|
|
int idSz = ssl->options.resuming
|
|
? ssl->session.sessionIDSz
|
|
: 0;
|
|
int ret;
|
|
word16 extSz = 0;
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version))
|
|
return SendTls13ClientHello(ssl);
|
|
#endif
|
|
|
|
WOLFSSL_START(WC_FUNC_CLIENT_HELLO_SEND);
|
|
WOLFSSL_ENTER("SendClientHello");
|
|
|
|
if (ssl->suites == NULL) {
|
|
WOLFSSL_MSG("Bad suites pointer in SendClientHello");
|
|
return SUITES_ERROR;
|
|
}
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->options.resuming && ssl->session.ticketLen > 0) {
|
|
SessionTicket* ticket;
|
|
|
|
ticket = TLSX_SessionTicket_Create(0, ssl->session.ticket,
|
|
ssl->session.ticketLen, ssl->heap);
|
|
if (ticket == NULL) return MEMORY_E;
|
|
|
|
ret = TLSX_UseSessionTicket(&ssl->extensions, ticket, ssl->heap);
|
|
if (ret != WOLFSSL_SUCCESS) {
|
|
TLSX_SessionTicket_Free(ticket, ssl->heap);
|
|
return ret;
|
|
}
|
|
|
|
idSz = 0;
|
|
}
|
|
#endif
|
|
length = VERSION_SZ + RAN_LEN
|
|
+ idSz + ENUM_LEN
|
|
+ ssl->suites->suiteSz + SUITE_LEN
|
|
+ COMP_LEN + ENUM_LEN;
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
/* auto populate extensions supported unless user defined */
|
|
if ((ret = TLSX_PopulateExtensions(ssl, 0)) != 0)
|
|
return ret;
|
|
#ifdef HAVE_QSH
|
|
if (QSH_Init(ssl) != 0)
|
|
return MEMORY_E;
|
|
#endif
|
|
extSz = 0;
|
|
ret = TLSX_GetRequestSize(ssl, client_hello, &extSz);
|
|
if (ret != 0)
|
|
return ret;
|
|
length += extSz;
|
|
#else
|
|
if (IsAtLeastTLSv1_2(ssl) && ssl->suites->hashSigAlgoSz)
|
|
extSz += HELLO_EXT_SZ + HELLO_EXT_SIGALGO_SZ
|
|
+ ssl->suites->hashSigAlgoSz;
|
|
#ifdef HAVE_EXTENDED_MASTER
|
|
if (ssl->options.haveEMS)
|
|
extSz += HELLO_EXT_SZ;
|
|
#endif
|
|
if (extSz != 0)
|
|
length += extSz + HELLO_EXT_SZ_SZ;
|
|
#endif
|
|
sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
length += ENUM_LEN; /* cookie */
|
|
if (ssl->arrays->cookieSz != 0) length += ssl->arrays->cookieSz;
|
|
sendSz = length + DTLS_HANDSHAKE_HEADER_SZ + DTLS_RECORD_HEADER_SZ;
|
|
idx += DTLS_HANDSHAKE_EXTRA + DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += MAX_MSG_EXTRA;
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, length, client_hello, ssl);
|
|
|
|
/* client hello, first version */
|
|
output[idx++] = ssl->version.major;
|
|
output[idx++] = ssl->version.minor;
|
|
ssl->chVersion = ssl->version; /* store in case changed */
|
|
|
|
/* then random */
|
|
if (ssl->options.connectState == CONNECT_BEGIN) {
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, output + idx, RAN_LEN);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
/* store random */
|
|
XMEMCPY(ssl->arrays->clientRandom, output + idx, RAN_LEN);
|
|
} else {
|
|
#ifdef WOLFSSL_DTLS
|
|
/* send same random on hello again */
|
|
XMEMCPY(output + idx, ssl->arrays->clientRandom, RAN_LEN);
|
|
#endif
|
|
}
|
|
idx += RAN_LEN;
|
|
|
|
/* then session id */
|
|
output[idx++] = (byte)idSz;
|
|
if (idSz) {
|
|
XMEMCPY(output + idx, ssl->session.sessionID,
|
|
ssl->session.sessionIDSz);
|
|
idx += ssl->session.sessionIDSz;
|
|
}
|
|
|
|
/* then DTLS cookie */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
byte cookieSz = ssl->arrays->cookieSz;
|
|
|
|
output[idx++] = cookieSz;
|
|
if (cookieSz) {
|
|
XMEMCPY(&output[idx], ssl->arrays->cookie, cookieSz);
|
|
idx += cookieSz;
|
|
}
|
|
}
|
|
#endif
|
|
/* then cipher suites */
|
|
c16toa(ssl->suites->suiteSz, output + idx);
|
|
idx += OPAQUE16_LEN;
|
|
XMEMCPY(output + idx, &ssl->suites->suites, ssl->suites->suiteSz);
|
|
idx += ssl->suites->suiteSz;
|
|
|
|
/* last, compression */
|
|
output[idx++] = COMP_LEN;
|
|
if (ssl->options.usingCompression)
|
|
output[idx++] = ZLIB_COMPRESSION;
|
|
else
|
|
output[idx++] = NO_COMPRESSION;
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
extSz = 0;
|
|
ret = TLSX_WriteRequest(ssl, output + idx, client_hello, &extSz);
|
|
if (ret != 0)
|
|
return ret;
|
|
idx += extSz;
|
|
|
|
(void)idx; /* suppress analyzer warning, keep idx current */
|
|
#else
|
|
if (extSz != 0) {
|
|
c16toa(extSz, output + idx);
|
|
idx += HELLO_EXT_SZ_SZ;
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
if (ssl->suites->hashSigAlgoSz) {
|
|
word16 i;
|
|
/* extension type */
|
|
c16toa(HELLO_EXT_SIG_ALGO, output + idx);
|
|
idx += HELLO_EXT_TYPE_SZ;
|
|
/* extension data length */
|
|
c16toa(HELLO_EXT_SIGALGO_SZ + ssl->suites->hashSigAlgoSz,
|
|
output + idx);
|
|
idx += HELLO_EXT_SZ_SZ;
|
|
/* sig algos length */
|
|
c16toa(ssl->suites->hashSigAlgoSz, output + idx);
|
|
idx += HELLO_EXT_SIGALGO_SZ;
|
|
for (i=0; i < ssl->suites->hashSigAlgoSz; i++, idx++) {
|
|
output[idx] = ssl->suites->hashSigAlgo[i];
|
|
}
|
|
}
|
|
}
|
|
#ifdef HAVE_EXTENDED_MASTER
|
|
if (ssl->options.haveEMS) {
|
|
c16toa(HELLO_EXT_EXTMS, output + idx);
|
|
idx += HELLO_EXT_TYPE_SZ;
|
|
c16toa(0, output + idx);
|
|
idx += HELLO_EXT_SZ_SZ;
|
|
}
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input;
|
|
int inputSz = idx; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz -= recordHeaderSz;
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, input, inputSz, client_hello)) != 0) {
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
return ret;
|
|
}
|
|
#endif
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
} else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, client_hello)) != 0)
|
|
return ret;
|
|
}
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
ret = HashOutput(ssl, output, sendSz, 0);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
|
|
ssl->options.clientState = CLIENT_HELLO_COMPLETE;
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
if (ssl->CBIS != NULL)
|
|
ssl->CBIS(ssl, SSL_CB_CONNECT_LOOP, SSL_SUCCESS);
|
|
#endif
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "ClientHello");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "ClientHello", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendClientHello", ret);
|
|
WOLFSSL_END(WC_FUNC_CLIENT_HELLO_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* handle processing of DTLS hello_verify_request (3) */
|
|
static int DoHelloVerifyRequest(WOLFSSL* ssl, const byte* input,
|
|
word32* inOutIdx, word32 size)
|
|
{
|
|
ProtocolVersion pv;
|
|
byte cookieSz;
|
|
word32 begin = *inOutIdx;
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "HelloVerifyRequest");
|
|
if (ssl->toInfoOn) AddLateName("HelloVerifyRequest", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
DtlsMsgPoolReset(ssl);
|
|
}
|
|
#endif
|
|
|
|
if (OPAQUE16_LEN + OPAQUE8_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
XMEMCPY(&pv, input + *inOutIdx, OPAQUE16_LEN);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
|
|
if (pv.major != DTLS_MAJOR ||
|
|
(pv.minor != DTLS_MINOR && pv.minor != DTLSv1_2_MINOR))
|
|
return VERSION_ERROR;
|
|
|
|
cookieSz = input[(*inOutIdx)++];
|
|
|
|
if (cookieSz) {
|
|
if ((*inOutIdx - begin) + cookieSz > size)
|
|
return BUFFER_ERROR;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (cookieSz <= MAX_COOKIE_LEN) {
|
|
XMEMCPY(ssl->arrays->cookie, input + *inOutIdx, cookieSz);
|
|
ssl->arrays->cookieSz = cookieSz;
|
|
}
|
|
#endif
|
|
*inOutIdx += cookieSz;
|
|
}
|
|
|
|
ssl->options.serverState = SERVER_HELLOVERIFYREQUEST_COMPLETE;
|
|
return 0;
|
|
}
|
|
|
|
|
|
static WC_INLINE int DSH_CheckSessionId(WOLFSSL* ssl)
|
|
{
|
|
int ret = 0;
|
|
|
|
#ifdef HAVE_SECRET_CALLBACK
|
|
/* If a session secret callback exists, we are using that
|
|
* key instead of the saved session key. */
|
|
ret = ret || (ssl->sessionSecretCb != NULL);
|
|
#endif
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
/* server may send blank ticket which may not be expected to indicate
|
|
* existing one ok but will also be sending a new one */
|
|
ret = ret || (ssl->session.ticketLen > 0);
|
|
#endif
|
|
|
|
ret = ret ||
|
|
(ssl->options.haveSessionId && XMEMCMP(ssl->arrays->sessionID,
|
|
ssl->session.sessionID, ID_LEN) == 0);
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Check the version in the received message is valid and set protocol
|
|
* version to use.
|
|
*
|
|
* ssl The SSL/TLS object.
|
|
* pv The protocol version from the packet.
|
|
* returns 0 on success, otherwise failure.
|
|
*/
|
|
int CheckVersion(WOLFSSL *ssl, ProtocolVersion pv)
|
|
{
|
|
#ifdef WOLFSSL_TLS13_DRAFT
|
|
if (pv.major == TLS_DRAFT_MAJOR) {
|
|
pv.major = SSLv3_MAJOR;
|
|
pv.minor = TLSv1_3_MINOR;
|
|
}
|
|
#endif
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
if (ssl->CBIS != NULL) {
|
|
ssl->CBIS(ssl, SSL_CB_HANDSHAKE_START, SSL_SUCCESS);
|
|
}
|
|
#endif
|
|
|
|
if (pv.minor > ssl->version.minor) {
|
|
WOLFSSL_MSG("Server using higher version, fatal error");
|
|
return VERSION_ERROR;
|
|
}
|
|
if (pv.minor < ssl->version.minor) {
|
|
WOLFSSL_MSG("server using lower version");
|
|
|
|
/* Check for downgrade attack. */
|
|
if (!ssl->options.downgrade) {
|
|
WOLFSSL_MSG("\tno downgrade allowed, fatal error");
|
|
return VERSION_ERROR;
|
|
}
|
|
if (pv.minor < ssl->options.minDowngrade) {
|
|
WOLFSSL_MSG("\tversion below minimum allowed, fatal error");
|
|
return VERSION_ERROR;
|
|
}
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation &&
|
|
ssl->secure_renegotiation->enabled &&
|
|
ssl->options.handShakeDone) {
|
|
WOLFSSL_MSG("Server changed version during scr");
|
|
return VERSION_ERROR;
|
|
}
|
|
#endif
|
|
|
|
/* Checks made - OK to downgrade. */
|
|
if (pv.minor == SSLv3_MINOR) {
|
|
/* turn off tls */
|
|
WOLFSSL_MSG("\tdowngrading to SSLv3");
|
|
ssl->options.tls = 0;
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = SSLv3_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_MINOR) {
|
|
/* turn off tls 1.1+ */
|
|
WOLFSSL_MSG("\tdowngrading to TLSv1");
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = TLSv1_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_1_MINOR) {
|
|
WOLFSSL_MSG("\tdowngrading to TLSv1.1");
|
|
ssl->version.minor = TLSv1_1_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_2_MINOR) {
|
|
WOLFSSL_MSG(" downgrading to TLSv1.2");
|
|
ssl->version.minor = TLSv1_2_MINOR;
|
|
}
|
|
}
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
/* check if option is set to not allow the current version
|
|
* set from either wolfSSL_set_options or wolfSSL_CTX_set_options */
|
|
if (!ssl->options.dtls && ssl->options.downgrade &&
|
|
ssl->options.mask > 0) {
|
|
if (ssl->version.minor == TLSv1_2_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_2) == SSL_OP_NO_TLSv1_2) {
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.2, Downgrading");
|
|
ssl->version.minor = TLSv1_1_MINOR;
|
|
}
|
|
if (ssl->version.minor == TLSv1_1_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_1) == SSL_OP_NO_TLSv1_1) {
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.1, Downgrading");
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = TLSv1_MINOR;
|
|
}
|
|
if (ssl->version.minor == TLSv1_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1) == SSL_OP_NO_TLSv1) {
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1, Downgrading");
|
|
ssl->options.tls = 0;
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = SSLv3_MINOR;
|
|
}
|
|
if (ssl->version.minor == SSLv3_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_SSLv3) == SSL_OP_NO_SSLv3) {
|
|
WOLFSSL_MSG("\tError, option set to not allow SSLv3");
|
|
return VERSION_ERROR;
|
|
}
|
|
|
|
if (ssl->version.minor < ssl->options.minDowngrade) {
|
|
WOLFSSL_MSG("\tversion below minimum allowed, fatal error");
|
|
return VERSION_ERROR;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
return 0;
|
|
}
|
|
|
|
/* handle processing of server_hello (2) */
|
|
int DoServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
word32 helloSz)
|
|
{
|
|
byte cs0; /* cipher suite bytes 0, 1 */
|
|
byte cs1;
|
|
ProtocolVersion pv;
|
|
byte compression;
|
|
word32 i = *inOutIdx;
|
|
word32 begin = i;
|
|
int ret;
|
|
|
|
WOLFSSL_START(WC_FUNC_SERVER_HELLO_DO);
|
|
WOLFSSL_ENTER("DoServerHello");
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "ServerHello");
|
|
if (ssl->toInfoOn) AddLateName("ServerHello", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
/* protocol version, random and session id length check */
|
|
if (OPAQUE16_LEN + RAN_LEN + OPAQUE8_LEN > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
/* protocol version */
|
|
XMEMCPY(&pv, input + i, OPAQUE16_LEN);
|
|
i += OPAQUE16_LEN;
|
|
|
|
ret = CheckVersion(ssl, pv);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(pv)) {
|
|
byte type = server_hello;
|
|
return DoTls13ServerHello(ssl, input, inOutIdx, helloSz, &type);
|
|
}
|
|
#endif
|
|
|
|
/* random */
|
|
XMEMCPY(ssl->arrays->serverRandom, input + i, RAN_LEN);
|
|
i += RAN_LEN;
|
|
|
|
/* session id */
|
|
ssl->arrays->sessionIDSz = input[i++];
|
|
|
|
if (ssl->arrays->sessionIDSz > ID_LEN) {
|
|
WOLFSSL_MSG("Invalid session ID size");
|
|
ssl->arrays->sessionIDSz = 0;
|
|
return BUFFER_ERROR;
|
|
}
|
|
else if (ssl->arrays->sessionIDSz) {
|
|
if ((i - begin) + ssl->arrays->sessionIDSz > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
XMEMCPY(ssl->arrays->sessionID, input + i,
|
|
ssl->arrays->sessionIDSz);
|
|
i += ssl->arrays->sessionIDSz;
|
|
ssl->options.haveSessionId = 1;
|
|
}
|
|
|
|
|
|
/* suite and compression */
|
|
if ((i - begin) + OPAQUE16_LEN + OPAQUE8_LEN > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
cs0 = input[i++];
|
|
cs1 = input[i++];
|
|
|
|
#ifdef HAVE_SECURE_RENEGOTIATION
|
|
if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled &&
|
|
ssl->options.handShakeDone) {
|
|
if (ssl->options.cipherSuite0 != cs0 ||
|
|
ssl->options.cipherSuite != cs1) {
|
|
WOLFSSL_MSG("Server changed cipher suite during scr");
|
|
return MATCH_SUITE_ERROR;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
ssl->options.cipherSuite0 = cs0;
|
|
ssl->options.cipherSuite = cs1;
|
|
compression = input[i++];
|
|
|
|
#ifndef WOLFSSL_NO_STRICT_CIPHER_SUITE
|
|
{
|
|
word32 idx, found = 0;
|
|
/* confirm server_hello cipher suite is one sent in client_hello */
|
|
for (idx = 0; idx < ssl->suites->suiteSz; idx += 2) {
|
|
if (ssl->suites->suites[idx] == cs0 &&
|
|
ssl->suites->suites[idx+1] == cs1) {
|
|
found = 1;
|
|
break;
|
|
}
|
|
}
|
|
if (!found) {
|
|
WOLFSSL_MSG("ServerHello did not use cipher suite from ClientHello");
|
|
return MATCH_SUITE_ERROR;
|
|
}
|
|
}
|
|
#endif /* !WOLFSSL_NO_STRICT_CIPHER_SUITE */
|
|
|
|
if (compression != NO_COMPRESSION && !ssl->options.usingCompression) {
|
|
WOLFSSL_MSG("Server forcing compression w/o support");
|
|
return COMPRESSION_ERROR;
|
|
}
|
|
|
|
if (compression != ZLIB_COMPRESSION && ssl->options.usingCompression) {
|
|
WOLFSSL_MSG("Server refused compression, turning off");
|
|
ssl->options.usingCompression = 0; /* turn off if server refused */
|
|
}
|
|
|
|
*inOutIdx = i;
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
if ( (i - begin) < helloSz) {
|
|
if (TLSX_SupportExtensions(ssl)) {
|
|
word16 totalExtSz;
|
|
|
|
if ((i - begin) + OPAQUE16_LEN > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(&input[i], &totalExtSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
if ((i - begin) + totalExtSz > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
if ((ret = TLSX_Parse(ssl, (byte *) input + i, totalExtSz,
|
|
server_hello, NULL)))
|
|
return ret;
|
|
|
|
i += totalExtSz;
|
|
*inOutIdx = i;
|
|
}
|
|
else
|
|
*inOutIdx = begin + helloSz; /* skip extensions */
|
|
}
|
|
else
|
|
ssl->options.haveEMS = 0; /* If no extensions, no EMS */
|
|
#else
|
|
{
|
|
int allowExt = 0;
|
|
byte pendingEMS = 0;
|
|
|
|
if ( (i - begin) < helloSz) {
|
|
if (ssl->version.major == SSLv3_MAJOR &&
|
|
ssl->version.minor >= TLSv1_MINOR) {
|
|
|
|
allowExt = 1;
|
|
}
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->version.major == DTLS_MAJOR)
|
|
allowExt = 1;
|
|
#endif
|
|
|
|
if (allowExt) {
|
|
word16 totalExtSz;
|
|
|
|
if ((i - begin) + OPAQUE16_LEN > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(&input[i], &totalExtSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
if ((i - begin) + totalExtSz > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
while (totalExtSz) {
|
|
word16 extId, extSz;
|
|
|
|
if (OPAQUE16_LEN + OPAQUE16_LEN > totalExtSz)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(&input[i], &extId);
|
|
i += OPAQUE16_LEN;
|
|
ato16(&input[i], &extSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
if (OPAQUE16_LEN + OPAQUE16_LEN + extSz > totalExtSz)
|
|
return BUFFER_ERROR;
|
|
|
|
if (extId == HELLO_EXT_EXTMS)
|
|
pendingEMS = 1;
|
|
else
|
|
i += extSz;
|
|
|
|
totalExtSz -= OPAQUE16_LEN + OPAQUE16_LEN + extSz;
|
|
}
|
|
|
|
*inOutIdx = i;
|
|
}
|
|
else
|
|
*inOutIdx = begin + helloSz; /* skip extensions */
|
|
}
|
|
|
|
if (!pendingEMS && ssl->options.haveEMS)
|
|
ssl->options.haveEMS = 0;
|
|
}
|
|
#endif
|
|
|
|
ssl->options.serverState = SERVER_HELLO_COMPLETE;
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
*inOutIdx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMWrite &&
|
|
ssl->specs.cipher_type == block) {
|
|
*inOutIdx += MacSize(ssl);
|
|
}
|
|
#endif
|
|
}
|
|
|
|
#ifdef HAVE_SECRET_CALLBACK
|
|
if (ssl->sessionSecretCb != NULL) {
|
|
int secretSz = SECRET_LEN;
|
|
ret = ssl->sessionSecretCb(ssl, ssl->session.masterSecret,
|
|
&secretSz, ssl->sessionSecretCtx);
|
|
if (ret != 0 || secretSz != SECRET_LEN)
|
|
return SESSION_SECRET_CB_E;
|
|
}
|
|
#endif /* HAVE_SECRET_CALLBACK */
|
|
|
|
ret = CompleteServerHello(ssl);
|
|
|
|
WOLFSSL_LEAVE("DoServerHello", ret);
|
|
WOLFSSL_END(WC_FUNC_SERVER_HELLO_DO);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int CompleteServerHello(WOLFSSL* ssl)
|
|
{
|
|
int ret;
|
|
|
|
if (!ssl->options.resuming) {
|
|
byte* down = ssl->arrays->serverRandom + RAN_LEN -
|
|
TLS13_DOWNGRADE_SZ - 1;
|
|
byte vers = ssl->arrays->serverRandom[RAN_LEN - 1];
|
|
#ifdef WOLFSSL_TLS13
|
|
if (TLSv1_3_Capable(ssl)) {
|
|
/* TLS v1.3 capable client not allowed to downgrade when
|
|
* connecting to TLS v1.3 capable server unless cipher suite
|
|
* demands it.
|
|
*/
|
|
if (XMEMCMP(down, tls13Downgrade, TLS13_DOWNGRADE_SZ) == 0 &&
|
|
(vers == 0 || vers == 1)) {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
return VERSION_ERROR;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->ctx->method->version.major == SSLv3_MAJOR &&
|
|
ssl->ctx->method->version.minor == TLSv1_2_MINOR
|
|
#ifdef OPENSSL_EXTRA
|
|
&& (wolfSSL_get_options(ssl) & SSL_OP_NO_TLSv1_2) == 0
|
|
#endif
|
|
) {
|
|
/* TLS v1.2 capable client not allowed to downgrade when
|
|
* connecting to TLS v1.2 capable server.
|
|
*/
|
|
if (XMEMCMP(down, tls13Downgrade, TLS13_DOWNGRADE_SZ) == 0 &&
|
|
vers == 0) {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
return VERSION_ERROR;
|
|
}
|
|
}
|
|
}
|
|
else {
|
|
if (DSH_CheckSessionId(ssl)) {
|
|
if (SetCipherSpecs(ssl) == 0) {
|
|
|
|
XMEMCPY(ssl->arrays->masterSecret,
|
|
ssl->session.masterSecret, SECRET_LEN);
|
|
#ifdef NO_OLD_TLS
|
|
ret = DeriveTlsKeys(ssl);
|
|
#else
|
|
ret = -1; /* default value */
|
|
#ifndef NO_TLS
|
|
if (ssl->options.tls)
|
|
ret = DeriveTlsKeys(ssl);
|
|
#endif
|
|
if (!ssl->options.tls)
|
|
ret = DeriveKeys(ssl);
|
|
#endif /* NO_OLD_TLS */
|
|
ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
|
|
|
|
return ret;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Unsupported cipher suite, DoServerHello");
|
|
return UNSUPPORTED_SUITE;
|
|
}
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Server denied resumption attempt");
|
|
ssl->options.resuming = 0; /* server denied resumption try */
|
|
}
|
|
}
|
|
return SetCipherSpecs(ssl);
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
|
|
/* Make sure client setup is valid for this suite, true on success */
|
|
int VerifyClientSuite(WOLFSSL* ssl)
|
|
{
|
|
int havePSK = 0;
|
|
byte first = ssl->options.cipherSuite0;
|
|
byte second = ssl->options.cipherSuite;
|
|
|
|
WOLFSSL_ENTER("VerifyClientSuite");
|
|
|
|
#ifndef NO_PSK
|
|
havePSK = ssl->options.havePSK;
|
|
#endif
|
|
|
|
if (CipherRequires(first, second, REQUIRES_PSK)) {
|
|
WOLFSSL_MSG("Requires PSK");
|
|
if (havePSK == 0) {
|
|
WOLFSSL_MSG("Don't have PSK");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
return 1; /* success */
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifndef NO_CERTS
|
|
/* handle processing of certificate_request (13) */
|
|
static int DoCertificateRequest(WOLFSSL* ssl, const byte* input, word32*
|
|
inOutIdx, word32 size)
|
|
{
|
|
word16 len;
|
|
word32 begin = *inOutIdx;
|
|
#ifdef OPENSSL_EXTRA
|
|
int ret;
|
|
WOLFSSL_X509* x509 = NULL;
|
|
WOLFSSL_EVP_PKEY* pkey = NULL;
|
|
#endif
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_REQUEST_DO);
|
|
WOLFSSL_ENTER("DoCertificateRequest");
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "CertificateRequest");
|
|
if (ssl->toInfoOn)
|
|
AddLateName("CertificateRequest", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
if (OPAQUE8_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
len = input[(*inOutIdx)++];
|
|
|
|
if ((*inOutIdx - begin) + len > size)
|
|
return BUFFER_ERROR;
|
|
|
|
/* types, read in here */
|
|
*inOutIdx += len;
|
|
|
|
/* signature and hash signature algorithm */
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(input + *inOutIdx, &len);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
|
|
if ((*inOutIdx - begin) + len > size)
|
|
return BUFFER_ERROR;
|
|
|
|
if (PickHashSigAlgo(ssl, input + *inOutIdx, len) != 0 &&
|
|
ssl->buffers.certificate &&
|
|
ssl->buffers.certificate->buffer) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (wolfSSL_CTX_IsPrivatePkSet(ssl->ctx)) {
|
|
WOLFSSL_MSG("Using PK for client private key");
|
|
return INVALID_PARAMETER;
|
|
}
|
|
#endif
|
|
if (ssl->buffers.key && ssl->buffers.key->buffer) {
|
|
return INVALID_PARAMETER;
|
|
}
|
|
}
|
|
*inOutIdx += len;
|
|
#ifdef WC_RSA_PSS
|
|
ssl->pssAlgo = 0;
|
|
if (ssl->suites->sigAlgo == rsa_pss_sa_algo)
|
|
ssl->pssAlgo |= 1 << ssl->suites->hashAlgo;
|
|
#endif
|
|
}
|
|
|
|
/* authorities */
|
|
if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(input + *inOutIdx, &len);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
|
|
if ((*inOutIdx - begin) + len > size)
|
|
return BUFFER_ERROR;
|
|
|
|
while (len) {
|
|
word16 dnSz;
|
|
|
|
if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(input + *inOutIdx, &dnSz);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
|
|
if ((*inOutIdx - begin) + dnSz > size)
|
|
return BUFFER_ERROR;
|
|
|
|
*inOutIdx += dnSz;
|
|
len -= OPAQUE16_LEN + dnSz;
|
|
}
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
/* call client cert callback if no cert has been loaded */
|
|
if ((ssl->ctx->CBClientCert != NULL) &&
|
|
(!ssl->buffers.certificate || !ssl->buffers.certificate->buffer)) {
|
|
|
|
ret = ssl->ctx->CBClientCert(ssl, &x509, &pkey);
|
|
if (ret == 1) {
|
|
if ((wolfSSL_use_certificate(ssl, x509) != WOLFSSL_SUCCESS) ||
|
|
(wolfSSL_use_PrivateKey(ssl, pkey) != WOLFSSL_SUCCESS)) {
|
|
return CLIENT_CERT_CB_ERROR;
|
|
}
|
|
wolfSSL_X509_free(x509);
|
|
wolfSSL_EVP_PKEY_free(pkey);
|
|
|
|
} else if (ret < 0) {
|
|
return WOLFSSL_ERROR_WANT_X509_LOOKUP;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* don't send client cert or cert verify if user hasn't provided
|
|
cert and private key */
|
|
if (ssl->buffers.certificate && ssl->buffers.certificate->buffer) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (wolfSSL_CTX_IsPrivatePkSet(ssl->ctx)) {
|
|
WOLFSSL_MSG("Using PK for client private key");
|
|
ssl->options.sendVerify = SEND_CERT;
|
|
}
|
|
#endif
|
|
if (ssl->buffers.key && ssl->buffers.key->buffer) {
|
|
ssl->options.sendVerify = SEND_CERT;
|
|
}
|
|
}
|
|
#ifdef OPENSSL_EXTRA
|
|
else
|
|
#else
|
|
else if (IsTLS(ssl))
|
|
#endif
|
|
{
|
|
ssl->options.sendVerify = SEND_BLANK_CERT;
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
*inOutIdx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
*inOutIdx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
WOLFSSL_LEAVE("DoCertificateRequest", 0);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_REQUEST_DO);
|
|
|
|
return 0;
|
|
}
|
|
#endif /* !NO_CERTS */
|
|
|
|
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
|
|
static int CheckCurveId(int tlsCurveId)
|
|
{
|
|
int ret = ECC_CURVE_ERROR;
|
|
|
|
switch (tlsCurveId) {
|
|
#if (defined(HAVE_ECC160) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 160
|
|
#ifndef NO_ECC_SECP
|
|
case WOLFSSL_ECC_SECP160R1: return ECC_SECP160R1_OID;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_SECPR2
|
|
case WOLFSSL_ECC_SECP160R2: return ECC_SECP160R2_OID;
|
|
#endif /* HAVE_ECC_SECPR2 */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case WOLFSSL_ECC_SECP160K1: return ECC_SECP160K1_OID;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#endif
|
|
#if (defined(HAVE_ECC192) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 192
|
|
#ifndef NO_ECC_SECP
|
|
case WOLFSSL_ECC_SECP192R1: return ECC_SECP192R1_OID;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case WOLFSSL_ECC_SECP192K1: return ECC_SECP192K1_OID;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#endif
|
|
#if (defined(HAVE_ECC224) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 224
|
|
#ifndef NO_ECC_SECP
|
|
case WOLFSSL_ECC_SECP224R1: return ECC_SECP224R1_OID;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case WOLFSSL_ECC_SECP224K1: return ECC_SECP224K1_OID;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#endif
|
|
#if defined(HAVE_CURVE25519) && ECC_MIN_KEY_SZ <= 256
|
|
case WOLFSSL_ECC_X25519: return ECC_X25519_OID;
|
|
#endif
|
|
#if (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
|
|
#ifndef NO_ECC_SECP
|
|
case WOLFSSL_ECC_SECP256R1: return ECC_SECP256R1_OID;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case WOLFSSL_ECC_SECP256K1: return ECC_SECP256K1_OID;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#ifdef HAVE_ECC_BRAINPOOL
|
|
case WOLFSSL_ECC_BRAINPOOLP256R1: return ECC_BRAINPOOLP256R1_OID;
|
|
#endif /* HAVE_ECC_BRAINPOOL */
|
|
#endif
|
|
#if defined(HAVE_CURVE448) && ECC_MIN_KEY_SZ <= 448
|
|
case WOLFSSL_ECC_X448: return ECC_X448_OID;
|
|
#endif
|
|
#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384
|
|
#ifndef NO_ECC_SECP
|
|
case WOLFSSL_ECC_SECP384R1: return ECC_SECP384R1_OID;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_BRAINPOOL
|
|
case WOLFSSL_ECC_BRAINPOOLP384R1: return ECC_BRAINPOOLP384R1_OID;
|
|
#endif /* HAVE_ECC_BRAINPOOL */
|
|
#endif
|
|
#if (defined(HAVE_ECC512) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 512
|
|
#ifdef HAVE_ECC_BRAINPOOL
|
|
case WOLFSSL_ECC_BRAINPOOLP512R1: return ECC_BRAINPOOLP512R1_OID;
|
|
#endif /* HAVE_ECC_BRAINPOOL */
|
|
#endif
|
|
#if (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 521
|
|
#ifndef NO_ECC_SECP
|
|
case WOLFSSL_ECC_SECP521R1: return ECC_SECP521R1_OID;
|
|
#endif /* !NO_ECC_SECP */
|
|
#endif
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
/* Persistable DoServerKeyExchange arguments */
|
|
typedef struct DskeArgs {
|
|
byte* output; /* not allocated */
|
|
#if !defined(NO_DH) || defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
byte* verifySig;
|
|
#endif
|
|
word32 idx;
|
|
word32 begin;
|
|
#if !defined(NO_DH) || defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
word16 verifySigSz;
|
|
#endif
|
|
word16 sigSz;
|
|
byte sigAlgo;
|
|
byte hashAlgo;
|
|
#if !defined(NO_RSA) && defined(WC_RSA_PSS)
|
|
int bits;
|
|
#endif
|
|
} DskeArgs;
|
|
|
|
static void FreeDskeArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
DskeArgs* args = (DskeArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
(void)args;
|
|
|
|
#if !defined(NO_DH) || defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
if (args->verifySig) {
|
|
XFREE(args->verifySig, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
args->verifySig = NULL;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
#ifndef NO_DH
|
|
static int GetDhPublicKey(WOLFSSL* ssl, const byte* input, word32 size,
|
|
DskeArgs* args)
|
|
{
|
|
int ret = 0;
|
|
word16 length;
|
|
#ifdef HAVE_FFDHE
|
|
const DhParams* params = NULL;
|
|
int group = 0;
|
|
#endif
|
|
|
|
if (ssl->buffers.weOwnDH) {
|
|
if (ssl->buffers.serverDH_P.buffer) {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
}
|
|
|
|
if (ssl->buffers.serverDH_G.buffer) {
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_G.buffer = NULL;
|
|
}
|
|
|
|
}
|
|
|
|
if (ssl->buffers.serverDH_Pub.buffer) {
|
|
XFREE(ssl->buffers.serverDH_Pub.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_Pub.buffer = NULL;
|
|
}
|
|
|
|
/* p */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_gdpk);
|
|
}
|
|
|
|
ato16(input + args->idx, &length);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_gdpk);
|
|
}
|
|
|
|
if (length < ssl->options.minDhKeySz) {
|
|
WOLFSSL_MSG("Server using a DH key that is too small");
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
ERROR_OUT(DH_KEY_SIZE_E, exit_gdpk);
|
|
}
|
|
if (length > ssl->options.maxDhKeySz) {
|
|
WOLFSSL_MSG("Server using a DH key that is too big");
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
ERROR_OUT(DH_KEY_SIZE_E, exit_gdpk);
|
|
}
|
|
|
|
ssl->buffers.serverDH_P.buffer =
|
|
(byte*)XMALLOC(length, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
if (ssl->buffers.serverDH_P.buffer) {
|
|
ssl->buffers.serverDH_P.length = length;
|
|
}
|
|
else {
|
|
ERROR_OUT(MEMORY_ERROR, exit_gdpk);
|
|
}
|
|
|
|
XMEMCPY(ssl->buffers.serverDH_P.buffer, input + args->idx,
|
|
length);
|
|
args->idx += length;
|
|
|
|
ssl->options.dhKeySz = length;
|
|
|
|
/* g */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
ERROR_OUT(BUFFER_ERROR, exit_gdpk);
|
|
}
|
|
|
|
ato16(input + args->idx, &length);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + length > size) {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
ERROR_OUT(BUFFER_ERROR, exit_gdpk);
|
|
}
|
|
|
|
if (length > ssl->options.maxDhKeySz) {
|
|
WOLFSSL_MSG("Server using a DH key generator that is too big");
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
ERROR_OUT(DH_KEY_SIZE_E, exit_gdpk);
|
|
}
|
|
|
|
ssl->buffers.serverDH_G.buffer =
|
|
(byte*)XMALLOC(length, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
if (ssl->buffers.serverDH_G.buffer) {
|
|
ssl->buffers.serverDH_G.length = length;
|
|
}
|
|
else {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
ERROR_OUT(MEMORY_ERROR, exit_gdpk);
|
|
}
|
|
|
|
XMEMCPY(ssl->buffers.serverDH_G.buffer, input + args->idx,
|
|
length);
|
|
args->idx += length;
|
|
|
|
/* pub */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_G.buffer = NULL;
|
|
ERROR_OUT(BUFFER_ERROR, exit_gdpk);
|
|
}
|
|
|
|
ato16(input + args->idx, &length);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + length > size) {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_G.buffer = NULL;
|
|
ERROR_OUT(BUFFER_ERROR, exit_gdpk);
|
|
}
|
|
|
|
if (length > ssl->options.maxDhKeySz) {
|
|
WOLFSSL_MSG("Server using a public DH key that is too big");
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_G.buffer = NULL;
|
|
ERROR_OUT(DH_KEY_SIZE_E, exit_gdpk);
|
|
}
|
|
|
|
ssl->buffers.serverDH_Pub.buffer =
|
|
(byte*)XMALLOC(length, ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
if (ssl->buffers.serverDH_Pub.buffer) {
|
|
ssl->buffers.serverDH_Pub.length = length;
|
|
}
|
|
else {
|
|
XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_P.buffer = NULL;
|
|
XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_PUBLIC_KEY);
|
|
ssl->buffers.serverDH_G.buffer = NULL;
|
|
ERROR_OUT(MEMORY_ERROR, exit_gdpk);
|
|
}
|
|
|
|
XMEMCPY(ssl->buffers.serverDH_Pub.buffer, input + args->idx,
|
|
length);
|
|
ssl->buffers.weOwnDH = 1;
|
|
args->idx += length;
|
|
|
|
#ifdef HAVE_FFDHE
|
|
switch (ssl->options.dhKeySz) {
|
|
#ifdef HAVE_FFDHE_2048
|
|
case 2048/8:
|
|
params = wc_Dh_ffdhe2048_Get();
|
|
group = WOLFSSL_FFDHE_2048;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_FFDHE_3072
|
|
case 3072/8:
|
|
params = wc_Dh_ffdhe3072_Get();
|
|
group = WOLFSSL_FFDHE_3072;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_FFDHE_4096
|
|
case 4096/8:
|
|
params = wc_Dh_ffdhe4096_Get();
|
|
group = WOLFSSL_FFDHE_4096;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_FFDHE_6144
|
|
case 6144/8:
|
|
params = wc_Dh_ffdhe6144_Get();
|
|
group = WOLFSSL_FFDHE_6144;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_FFDHE_8192
|
|
case 8192/8:
|
|
params = wc_Dh_ffdhe8192_Get();
|
|
group = WOLFSSL_FFDHE_8192;
|
|
break;
|
|
#endif
|
|
default:
|
|
break;
|
|
}
|
|
|
|
if (params == NULL || params->g_len != ssl->buffers.serverDH_G.length ||
|
|
(XMEMCMP(ssl->buffers.serverDH_G.buffer, params->g,
|
|
params->g_len) != 0) ||
|
|
(XMEMCMP(ssl->buffers.serverDH_P.buffer, params->p,
|
|
params->p_len) != 0)) {
|
|
WOLFSSL_MSG("Server not using FFDHE parameters");
|
|
#ifdef WOLFSSL_REQUIRE_FFDHE
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
ERROR_OUT(DH_PARAMS_NOT_FFDHE_E, exit_gdpk);
|
|
#endif
|
|
}
|
|
else {
|
|
ssl->namedGroup = group;
|
|
#if !defined(WOLFSSL_OLD_PRIME_CHECK) && !defined(HAVE_FIPS) && \
|
|
!defined(HAVE_SELFTEST)
|
|
ssl->options.dhDoKeyTest = 0;
|
|
#endif
|
|
}
|
|
#endif /* HAVE_FFDHE */
|
|
|
|
exit_gdpk:
|
|
return ret;
|
|
}
|
|
#endif
|
|
|
|
/* handle processing of server_key_exchange (12) */
|
|
static int DoServerKeyExchange(WOLFSSL* ssl, const byte* input,
|
|
word32* inOutIdx, word32 size)
|
|
{
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
DskeArgs* args = (DskeArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#else
|
|
DskeArgs args[1];
|
|
#endif
|
|
|
|
(void)input;
|
|
(void)size;
|
|
|
|
WOLFSSL_START(WC_FUNC_SERVER_KEY_EXCHANGE_DO);
|
|
WOLFSSL_ENTER("DoServerKeyExchange");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_dske;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(DskeArgs));
|
|
args->idx = *inOutIdx;
|
|
args->begin = *inOutIdx;
|
|
args->sigAlgo = ssl->specs.sig_algo;
|
|
args->hashAlgo = sha_mac;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeDskeArgs;
|
|
#endif
|
|
}
|
|
|
|
switch(ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ServerKeyExchange");
|
|
if (ssl->toInfoOn)
|
|
AddLateName("ServerKeyExchange", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
int srvHintLen;
|
|
word16 length;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
ato16(input + args->idx, &length);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
/* get PSK server hint from the wire */
|
|
srvHintLen = min(length, MAX_PSK_ID_LEN);
|
|
XMEMCPY(ssl->arrays->server_hint, input + args->idx,
|
|
srvHintLen);
|
|
ssl->arrays->server_hint[srvHintLen] = '\0'; /* null term */
|
|
args->idx += length;
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
ret = GetDhPublicKey(ssl, input, size, args);
|
|
if (ret != 0)
|
|
goto exit_dske;
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
byte b;
|
|
#ifdef HAVE_ECC
|
|
int curveId;
|
|
#endif
|
|
int curveOid;
|
|
word16 length;
|
|
|
|
if ((args->idx - args->begin) + ENUM_LEN + OPAQUE16_LEN +
|
|
OPAQUE8_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
b = input[args->idx++];
|
|
if (b != named_curve) {
|
|
ERROR_OUT(ECC_CURVETYPE_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += 1; /* curve type, eat leading 0 */
|
|
b = input[args->idx++];
|
|
if ((curveOid = CheckCurveId(b)) < 0) {
|
|
ERROR_OUT(ECC_CURVE_ERROR, exit_dske);
|
|
}
|
|
ssl->ecdhCurveOID = curveOid;
|
|
#if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE)
|
|
ssl->namedGroup = 0;
|
|
#endif
|
|
|
|
length = input[args->idx++];
|
|
if ((args->idx - args->begin) + length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
if (ssl->peerX25519Key == NULL) {
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
} else if (ssl->peerX25519KeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve25519_check_public(
|
|
input + args->idx, length,
|
|
EC25519_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
if (wc_curve25519_import_public_ex(input + args->idx,
|
|
length, ssl->peerX25519Key,
|
|
EC25519_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += length;
|
|
ssl->peerX25519KeyPresent = 1;
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
if (ssl->peerX448Key == NULL) {
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
} else if (ssl->peerX448KeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve448_check_public(
|
|
input + args->idx, length,
|
|
EC448_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
if (wc_curve448_import_public_ex(input + args->idx,
|
|
length, ssl->peerX448Key,
|
|
EC448_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += length;
|
|
ssl->peerX448KeyPresent = 1;
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (ssl->peerEccKey == NULL) {
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
} else if (ssl->peerEccKeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_ECC, ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
curveId = wc_ecc_get_oid(curveOid, NULL, NULL);
|
|
if (wc_ecc_import_x963_ex(input + args->idx, length,
|
|
ssl->peerEccKey, curveId) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += length;
|
|
ssl->peerEccKeyPresent = 1;
|
|
#endif
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
int srvHintLen;
|
|
word16 length;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
ato16(input + args->idx, &length);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
/* get PSK server hint from the wire */
|
|
srvHintLen = min(length, MAX_PSK_ID_LEN);
|
|
XMEMCPY(ssl->arrays->server_hint, input + args->idx,
|
|
srvHintLen);
|
|
ssl->arrays->server_hint[srvHintLen] = '\0'; /* null term */
|
|
args->idx += length;
|
|
|
|
ret = GetDhPublicKey(ssl, input, size, args);
|
|
if (ret != 0)
|
|
goto exit_dske;
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
byte b;
|
|
int curveOid, curveId;
|
|
int srvHintLen;
|
|
word16 length;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
ato16(input + args->idx, &length);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
/* get PSK server hint from the wire */
|
|
srvHintLen = min(length, MAX_PSK_ID_LEN);
|
|
XMEMCPY(ssl->arrays->server_hint, input + args->idx,
|
|
srvHintLen);
|
|
ssl->arrays->server_hint[srvHintLen] = '\0'; /* null term */
|
|
|
|
args->idx += length;
|
|
|
|
if ((args->idx - args->begin) + ENUM_LEN + OPAQUE16_LEN +
|
|
OPAQUE8_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
/* Check curve name and ID */
|
|
b = input[args->idx++];
|
|
if (b != named_curve) {
|
|
ERROR_OUT(ECC_CURVETYPE_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += 1; /* curve type, eat leading 0 */
|
|
b = input[args->idx++];
|
|
if ((curveOid = CheckCurveId(b)) < 0) {
|
|
ERROR_OUT(ECC_CURVE_ERROR, exit_dske);
|
|
}
|
|
|
|
length = input[args->idx++];
|
|
if ((args->idx - args->begin) + length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
if (ssl->peerX25519Key == NULL) {
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
} else if (ssl->peerEccKeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve25519_check_public(
|
|
input + args->idx, length,
|
|
EC25519_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
if (wc_curve25519_import_public_ex(input + args->idx,
|
|
length, ssl->peerX25519Key,
|
|
EC25519_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += length;
|
|
ssl->peerX25519KeyPresent = 1;
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
if (ssl->peerX448Key == NULL) {
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
} else if (ssl->peerEccKeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve448_check_public(
|
|
input + args->idx, length,
|
|
EC448_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
if (wc_curve448_import_public_ex(input + args->idx,
|
|
length, ssl->peerX448Key,
|
|
EC448_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += length;
|
|
ssl->peerX448KeyPresent = 1;
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
if (ssl->peerEccKey == NULL) {
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
} else if (ssl->peerEccKeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_ECC, ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
curveId = wc_ecc_get_oid(curveOid, NULL, NULL);
|
|
if (wc_ecc_import_x963_ex(input + args->idx, length,
|
|
ssl->peerEccKey, curveId) != 0) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dske);
|
|
}
|
|
|
|
args->idx += length;
|
|
ssl->peerEccKeyPresent = 1;
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* case TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
case psk_kea:
|
|
case dhe_psk_kea:
|
|
case ecdhe_psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
|
|
case diffie_hellman_kea:
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#if defined(NO_DH) && !defined(HAVE_ECC) && \
|
|
!defined(HAVE_CURVE25519) && !defined(HAVE_CURVE448)
|
|
ERROR_OUT(NOT_COMPILED_IN, exit_dske);
|
|
#else
|
|
enum wc_HashType hashType;
|
|
word16 verifySz;
|
|
|
|
if (ssl->options.usingAnon_cipher) {
|
|
break;
|
|
}
|
|
|
|
verifySz = (word16)(args->idx - args->begin);
|
|
if (verifySz > MAX_DH_SZ) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
if ((args->idx - args->begin) + ENUM_LEN + ENUM_LEN >
|
|
size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
DecodeSigAlg(&input[args->idx], &args->hashAlgo,
|
|
&args->sigAlgo);
|
|
args->idx += 2;
|
|
hashType = HashAlgoToType(args->hashAlgo);
|
|
if (hashType == WC_HASH_TYPE_NONE) {
|
|
ERROR_OUT(ALGO_ID_E, exit_dske);
|
|
}
|
|
} else {
|
|
/* only using sha and md5 for rsa */
|
|
#ifndef NO_OLD_TLS
|
|
hashType = WC_HASH_TYPE_SHA;
|
|
if (args->sigAlgo == rsa_sa_algo) {
|
|
hashType = WC_HASH_TYPE_MD5_SHA;
|
|
}
|
|
#else
|
|
ERROR_OUT(ALGO_ID_E, exit_dske);
|
|
#endif
|
|
}
|
|
|
|
/* signature */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
ato16(input + args->idx, &args->verifySigSz);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + args->verifySigSz > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
|
|
/* buffer for signature */
|
|
ssl->buffers.sig.buffer = (byte*)XMALLOC(SEED_LEN + verifySz,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (ssl->buffers.sig.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_dske);
|
|
}
|
|
ssl->buffers.sig.length = SEED_LEN + verifySz;
|
|
|
|
/* build message to hash */
|
|
XMEMCPY(ssl->buffers.sig.buffer,
|
|
ssl->arrays->clientRandom, RAN_LEN);
|
|
XMEMCPY(&ssl->buffers.sig.buffer[RAN_LEN],
|
|
ssl->arrays->serverRandom, RAN_LEN);
|
|
XMEMCPY(&ssl->buffers.sig.buffer[RAN_LEN * 2],
|
|
input + args->begin, verifySz); /* message */
|
|
|
|
if (args->sigAlgo != ed25519_sa_algo) {
|
|
int digest_sz = wc_HashGetDigestSize(hashType);
|
|
if (digest_sz <= 0) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
ssl->buffers.digest.length = (unsigned int)digest_sz;
|
|
|
|
/* buffer for hash */
|
|
ssl->buffers.digest.buffer = (byte*)XMALLOC(
|
|
ssl->buffers.digest.length, ssl->heap,
|
|
DYNAMIC_TYPE_DIGEST);
|
|
if (ssl->buffers.digest.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_dske);
|
|
}
|
|
|
|
/* Perform hash */
|
|
ret = wc_Hash(hashType, ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length);
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
|
|
switch (args->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
if (ssl->peerRsaKey == NULL ||
|
|
!ssl->peerRsaKeyPresent) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_dske);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
{
|
|
if (!ssl->peerEccDsaKeyPresent) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_dske);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#if defined(HAVE_ED25519)
|
|
case ed25519_sa_algo:
|
|
{
|
|
if (!ssl->peerEd25519KeyPresent) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_dske);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED25519 */
|
|
#if defined(HAVE_ED448)
|
|
case ed448_sa_algo:
|
|
{
|
|
if (!ssl->peerEd448KeyPresent) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_dske);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED448 */
|
|
|
|
default:
|
|
ret = ALGO_ID_E;
|
|
} /* switch (args->sigAlgo) */
|
|
|
|
#endif /* NO_DH && !HAVE_ECC && !HAVE_ED25519 && !HAVE_ED448 */
|
|
break;
|
|
}
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* case TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
case psk_kea:
|
|
case dhe_psk_kea:
|
|
case ecdhe_psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
|
|
case diffie_hellman_kea:
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#if defined(NO_DH) && !defined(HAVE_ECC) && \
|
|
!defined(HAVE_CURVE25519) && !defined(HAVE_CURVE448)
|
|
ERROR_OUT(NOT_COMPILED_IN, exit_dske);
|
|
#else
|
|
if (ssl->options.usingAnon_cipher) {
|
|
break;
|
|
}
|
|
|
|
if (args->verifySig == NULL) {
|
|
args->verifySig = (byte*)XMALLOC(args->verifySigSz,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (args->verifySig == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_dske);
|
|
}
|
|
XMEMCPY(args->verifySig, input + args->idx,
|
|
args->verifySigSz);
|
|
}
|
|
|
|
switch (args->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
ret = RsaVerify(ssl,
|
|
args->verifySig, args->verifySigSz,
|
|
&args->output,
|
|
args->sigAlgo, args->hashAlgo,
|
|
ssl->peerRsaKey,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerRsaKey
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
|
|
if (ret >= 0) {
|
|
args->sigSz = (word16)ret;
|
|
#ifdef WC_RSA_PSS
|
|
args->bits = mp_count_bits(&ssl->peerRsaKey->n);
|
|
#endif
|
|
ret = 0;
|
|
}
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
/* peerRsaKey */
|
|
FreeKey(ssl, DYNAMIC_TYPE_RSA,
|
|
(void**)&ssl->peerRsaKey);
|
|
ssl->peerRsaKeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
{
|
|
ret = EccVerify(ssl,
|
|
args->verifySig, args->verifySigSz,
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
ssl->peerEccDsaKey,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerEccDsaKey
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
/* peerEccDsaKey */
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccDsaKey);
|
|
ssl->peerEccDsaKeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#if defined(HAVE_ED25519)
|
|
case ed25519_sa_algo:
|
|
{
|
|
ret = Ed25519Verify(ssl,
|
|
args->verifySig, args->verifySigSz,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
ssl->peerEd25519Key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerEd25519Key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
/* peerEccDsaKey */
|
|
FreeKey(ssl, DYNAMIC_TYPE_ED25519,
|
|
(void**)&ssl->peerEd25519Key);
|
|
ssl->peerEd25519KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED25519 */
|
|
#if defined(HAVE_ED448)
|
|
case ed448_sa_algo:
|
|
{
|
|
ret = Ed448Verify(ssl,
|
|
args->verifySig, args->verifySigSz,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
ssl->peerEd448Key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerEd448Key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
/* peerEccDsaKey */
|
|
FreeKey(ssl, DYNAMIC_TYPE_ED448,
|
|
(void**)&ssl->peerEd448Key);
|
|
ssl->peerEd448KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED448 */
|
|
|
|
default:
|
|
ret = ALGO_ID_E;
|
|
} /* switch (sigAlgo) */
|
|
#endif /* NO_DH && !HAVE_ECC && !HAVE_ED25519 && !HAVE_ED448 */
|
|
break;
|
|
}
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* case TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
case psk_kea:
|
|
case dhe_psk_kea:
|
|
case ecdhe_psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
|
|
case diffie_hellman_kea:
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#if defined(NO_DH) && !defined(HAVE_ECC) && \
|
|
!defined(HAVE_CURVE25519) && !defined(HAVE_CURVE448)
|
|
ERROR_OUT(NOT_COMPILED_IN, exit_dske);
|
|
#else
|
|
if (ssl->options.usingAnon_cipher) {
|
|
break;
|
|
}
|
|
|
|
/* increment index after verify is done */
|
|
args->idx += args->verifySigSz;
|
|
|
|
switch(args->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#ifdef HAVE_SELFTEST
|
|
ret = wc_RsaPSS_CheckPadding(
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
args->output, args->sigSz,
|
|
HashAlgoToType(args->hashAlgo));
|
|
#else
|
|
ret = wc_RsaPSS_CheckPadding_ex(
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
args->output, args->sigSz,
|
|
HashAlgoToType(args->hashAlgo),
|
|
-1, args->bits);
|
|
#endif
|
|
if (ret != 0)
|
|
return ret;
|
|
break;
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
byte* encodedSig;
|
|
#else
|
|
byte encodedSig[MAX_ENCODED_SIG_SZ];
|
|
#endif
|
|
word32 encSigSz;
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (encodedSig == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_dske);
|
|
}
|
|
#endif
|
|
|
|
encSigSz = wc_EncodeSignature(encodedSig,
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
TypeHash(args->hashAlgo));
|
|
if (encSigSz != args->sigSz || !args->output ||
|
|
XMEMCMP(args->output, encodedSig,
|
|
min(encSigSz, MAX_ENCODED_SIG_SZ)) != 0) {
|
|
ret = VERIFY_SIGN_ERROR;
|
|
}
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(encodedSig, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
#endif
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
}
|
|
else if (args->sigSz != FINISHED_SZ ||
|
|
!args->output ||
|
|
XMEMCMP(args->output,
|
|
ssl->buffers.digest.buffer,
|
|
FINISHED_SZ) != 0) {
|
|
ERROR_OUT(VERIFY_SIGN_ERROR, exit_dske);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
/* Nothing to do in this algo */
|
|
break;
|
|
#endif /* HAVE_ECC */
|
|
#if defined(HAVE_ED25519)
|
|
case ed25519_sa_algo:
|
|
/* Nothing to do in this algo */
|
|
break;
|
|
#endif /* HAVE_ED25519 */
|
|
#if defined(HAVE_ED448)
|
|
case ed448_sa_algo:
|
|
/* Nothing to do in this algo */
|
|
break;
|
|
#endif /* HAVE_ED448 */
|
|
default:
|
|
ret = ALGO_ID_E;
|
|
} /* switch (sigAlgo) */
|
|
#endif /* NO_DH && !HAVE_ECC && !HAVE_ED25519 && !HAVE_ED448 */
|
|
break;
|
|
}
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* case TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
args->idx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
args->idx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
/* QSH extensions */
|
|
#ifdef HAVE_QSH
|
|
if (ssl->peerQSHKeyPresent) {
|
|
word16 name;
|
|
int qshSz;
|
|
|
|
/* extension name */
|
|
ato16(input + args->idx, &name);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if (name == TLSX_QUANTUM_SAFE_HYBRID) {
|
|
/* if qshSz is larger than 0 it is the length of
|
|
buffer used */
|
|
if ((qshSz = TLSX_QSHCipher_Parse(ssl, input + args->idx,
|
|
size, 0)) < 0) {
|
|
ERROR_OUT(qshSz, exit_dske);
|
|
}
|
|
args->idx += qshSz;
|
|
}
|
|
else {
|
|
/* unknown extension sent server ignored handshake */
|
|
ERROR_OUT(BUFFER_ERROR, exit_dske);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* case TLS_ASYNC_FINALIZE */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
/* return index */
|
|
*inOutIdx = args->idx;
|
|
|
|
ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
|
|
break;
|
|
}
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_dske:
|
|
|
|
WOLFSSL_LEAVE("DoServerKeyExchange", ret);
|
|
WOLFSSL_END(WC_FUNC_SERVER_KEY_EXCHANGE_DO);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* Handle async operation */
|
|
if (ret == WC_PENDING_E) {
|
|
/* Mark message as not received so it can process again */
|
|
ssl->msgsReceived.got_server_key_exchange = 0;
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* Final cleanup */
|
|
FreeDskeArgs(ssl, args);
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
#ifdef HAVE_QSH
|
|
|
|
#ifdef HAVE_NTRU
|
|
/* Encrypt a byte array using ntru
|
|
key a struct containing the public key to use
|
|
bufIn array to be encrypted
|
|
inSz size of bufIn array
|
|
bufOut cipher text out
|
|
outSz will be set to the new size of cipher text
|
|
*/
|
|
static int NtruSecretEncrypt(QSHKey* key, byte* bufIn, word32 inSz,
|
|
byte* bufOut, word16* outSz)
|
|
{
|
|
int ret;
|
|
DRBG_HANDLE drbg;
|
|
|
|
/* sanity checks on input arguments */
|
|
if (key == NULL || bufIn == NULL || bufOut == NULL || outSz == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
if (key->pub.buffer == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
switch (key->name) {
|
|
case WOLFSSL_NTRU_EESS439:
|
|
case WOLFSSL_NTRU_EESS593:
|
|
case WOLFSSL_NTRU_EESS743:
|
|
break;
|
|
default:
|
|
WOLFSSL_MSG("Unknown QSH encryption key!");
|
|
return -1;
|
|
}
|
|
|
|
/* set up ntru drbg */
|
|
ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg);
|
|
if (ret != DRBG_OK)
|
|
return NTRU_DRBG_ERROR;
|
|
|
|
/* encrypt the byte array */
|
|
ret = ntru_crypto_ntru_encrypt(drbg, key->pub.length, key->pub.buffer,
|
|
inSz, bufIn, outSz, bufOut);
|
|
ntru_crypto_drbg_uninstantiate(drbg);
|
|
if (ret != NTRU_OK)
|
|
return NTRU_ENCRYPT_ERROR;
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Decrypt a byte array using ntru
|
|
key a struct containing the private key to use
|
|
bufIn array to be decrypted
|
|
inSz size of bufIn array
|
|
bufOut plain text out
|
|
outSz will be set to the new size of plain text
|
|
*/
|
|
|
|
static int NtruSecretDecrypt(QSHKey* key, byte* bufIn, word32 inSz,
|
|
byte* bufOut, word16* outSz)
|
|
{
|
|
int ret;
|
|
DRBG_HANDLE drbg;
|
|
|
|
/* sanity checks on input arguments */
|
|
if (key == NULL || bufIn == NULL || bufOut == NULL || outSz == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
if (key->pri.buffer == NULL)
|
|
return BAD_FUNC_ARG;
|
|
|
|
switch (key->name) {
|
|
case WOLFSSL_NTRU_EESS439:
|
|
case WOLFSSL_NTRU_EESS593:
|
|
case WOLFSSL_NTRU_EESS743:
|
|
break;
|
|
default:
|
|
WOLFSSL_MSG("Unknown QSH decryption key!");
|
|
return -1;
|
|
}
|
|
|
|
|
|
/* set up drbg */
|
|
ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg);
|
|
if (ret != DRBG_OK)
|
|
return NTRU_DRBG_ERROR;
|
|
|
|
/* decrypt cipher text */
|
|
ret = ntru_crypto_ntru_decrypt(key->pri.length, key->pri.buffer,
|
|
inSz, bufIn, outSz, bufOut);
|
|
ntru_crypto_drbg_uninstantiate(drbg);
|
|
if (ret != NTRU_OK)
|
|
return NTRU_ENCRYPT_ERROR;
|
|
|
|
return ret;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
|
|
int QSH_Init(WOLFSSL* ssl)
|
|
{
|
|
/* check so not initializing twice when running DTLS */
|
|
if (ssl->QSH_secret != NULL)
|
|
return 0;
|
|
|
|
/* malloc memory for holding generated secret information */
|
|
if ((ssl->QSH_secret = (QSHSecret*)XMALLOC(sizeof(QSHSecret), ssl->heap,
|
|
DYNAMIC_TYPE_QSH)) == NULL)
|
|
return MEMORY_E;
|
|
|
|
ssl->QSH_secret->CliSi = (buffer*)XMALLOC(sizeof(buffer), ssl->heap,
|
|
DYNAMIC_TYPE_SECRET);
|
|
if (ssl->QSH_secret->CliSi == NULL)
|
|
return MEMORY_E;
|
|
|
|
ssl->QSH_secret->SerSi = (buffer*)XMALLOC(sizeof(buffer), ssl->heap,
|
|
DYNAMIC_TYPE_SECRET);
|
|
if (ssl->QSH_secret->SerSi == NULL)
|
|
return MEMORY_E;
|
|
|
|
/* initialize variables */
|
|
ssl->QSH_secret->list = NULL;
|
|
ssl->QSH_secret->CliSi->length = 0;
|
|
ssl->QSH_secret->CliSi->buffer = NULL;
|
|
ssl->QSH_secret->SerSi->length = 0;
|
|
ssl->QSH_secret->SerSi->buffer = NULL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
|
|
static int QSH_Encrypt(QSHKey* key, byte* in, word32 szIn,
|
|
byte* out, word32* szOut)
|
|
{
|
|
int ret = 0;
|
|
word16 size = *szOut;
|
|
|
|
(void)in;
|
|
(void)szIn;
|
|
(void)out;
|
|
(void)szOut;
|
|
|
|
WOLFSSL_MSG("Encrypting QSH key material");
|
|
|
|
switch (key->name) {
|
|
#ifdef HAVE_NTRU
|
|
case WOLFSSL_NTRU_EESS439:
|
|
case WOLFSSL_NTRU_EESS593:
|
|
case WOLFSSL_NTRU_EESS743:
|
|
ret = NtruSecretEncrypt(key, in, szIn, out, &size);
|
|
break;
|
|
#endif
|
|
default:
|
|
WOLFSSL_MSG("Unknown QSH encryption key!");
|
|
return -1;
|
|
}
|
|
|
|
*szOut = size;
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* Decrypt using Quantum Safe Handshake algorithms */
|
|
int QSH_Decrypt(QSHKey* key, byte* in, word32 szIn, byte* out, word16* szOut)
|
|
{
|
|
int ret = 0;
|
|
word16 size = *szOut;
|
|
|
|
(void)in;
|
|
(void)szIn;
|
|
(void)out;
|
|
(void)szOut;
|
|
|
|
WOLFSSL_MSG("Decrypting QSH key material");
|
|
|
|
switch (key->name) {
|
|
#ifdef HAVE_NTRU
|
|
case WOLFSSL_NTRU_EESS439:
|
|
case WOLFSSL_NTRU_EESS593:
|
|
case WOLFSSL_NTRU_EESS743:
|
|
ret = NtruSecretDecrypt(key, in, szIn, out, &size);
|
|
break;
|
|
#endif
|
|
default:
|
|
WOLFSSL_MSG("Unknown QSH decryption key!");
|
|
return -1;
|
|
}
|
|
|
|
*szOut = size;
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* Get the max cipher text for corresponding encryption scheme
|
|
(encrypting 48 or max plain text whichever is smaller)
|
|
*/
|
|
static word32 QSH_MaxSecret(QSHKey* key)
|
|
{
|
|
int ret = 0;
|
|
#ifdef HAVE_NTRU
|
|
byte isNtru = 0;
|
|
word16 inSz = 48;
|
|
word16 outSz;
|
|
DRBG_HANDLE drbg = 0;
|
|
byte bufIn[48];
|
|
#endif
|
|
|
|
if (key == NULL || key->pub.length == 0)
|
|
return 0;
|
|
|
|
switch(key->name) {
|
|
#ifdef HAVE_NTRU
|
|
case WOLFSSL_NTRU_EESS439:
|
|
isNtru = 1;
|
|
break;
|
|
case WOLFSSL_NTRU_EESS593:
|
|
isNtru = 1;
|
|
break;
|
|
case WOLFSSL_NTRU_EESS743:
|
|
isNtru = 1;
|
|
break;
|
|
#endif
|
|
default:
|
|
WOLFSSL_MSG("Unknown QSH encryption scheme size!");
|
|
return 0;
|
|
}
|
|
|
|
#ifdef HAVE_NTRU
|
|
if (isNtru) {
|
|
ret = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg);
|
|
if (ret != DRBG_OK)
|
|
return NTRU_DRBG_ERROR;
|
|
ret = ntru_crypto_ntru_encrypt(drbg, key->pub.length,
|
|
key->pub.buffer, inSz, bufIn, &outSz, NULL);
|
|
if (ret != NTRU_OK) {
|
|
return NTRU_ENCRYPT_ERROR;
|
|
}
|
|
ntru_crypto_drbg_uninstantiate(drbg);
|
|
ret = outSz;
|
|
}
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Generate the secret byte material for pms
|
|
returns length on success and -1 on fail
|
|
*/
|
|
static int QSH_GenerateSerCliSecret(WOLFSSL* ssl, byte isServer)
|
|
{
|
|
int sz = 0;
|
|
int plainSz = 48; /* lesser of 48 and max plain text able to encrypt */
|
|
int offset = 0;
|
|
word32 tmpSz = 0;
|
|
buffer* buf;
|
|
QSHKey* current;
|
|
QSHScheme* schmPre = NULL;
|
|
QSHScheme* schm = NULL;
|
|
|
|
if (ssl == NULL)
|
|
return -1;
|
|
|
|
WOLFSSL_MSG("Generating QSH secret key material");
|
|
|
|
current = ssl->peerQSHKey;
|
|
/* get size of buffer needed */
|
|
while (current) {
|
|
if (current->pub.length != 0) {
|
|
sz += plainSz;
|
|
}
|
|
current = (QSHKey*)current->next;
|
|
}
|
|
|
|
/* allocate memory for buffer */
|
|
if (isServer) {
|
|
buf = ssl->QSH_secret->SerSi;
|
|
}
|
|
else {
|
|
buf = ssl->QSH_secret->CliSi;
|
|
}
|
|
buf->length = sz;
|
|
buf->buffer = (byte*)XMALLOC(sz, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
if (buf->buffer == NULL) {
|
|
WOLFSSL_ERROR(MEMORY_E);
|
|
}
|
|
|
|
/* create secret information */
|
|
sz = 0;
|
|
current = ssl->peerQSHKey;
|
|
while (current) {
|
|
schm = (QSHScheme*)XMALLOC(sizeof(QSHScheme), ssl->heap,
|
|
DYNAMIC_TYPE_QSH);
|
|
if (schm == NULL)
|
|
return MEMORY_E;
|
|
|
|
/* initialize variables */
|
|
schm->name = 0;
|
|
schm->PK = NULL;
|
|
schm->PKLen = 0;
|
|
schm->next = NULL;
|
|
if (ssl->QSH_secret->list == NULL) {
|
|
ssl->QSH_secret->list = schm;
|
|
}
|
|
else {
|
|
if (schmPre)
|
|
schmPre->next = schm;
|
|
}
|
|
|
|
tmpSz = QSH_MaxSecret(current);
|
|
|
|
if ((schm->PK = (byte*)XMALLOC(tmpSz, ssl->heap,
|
|
DYNAMIC_TYPE_SECRET)) == NULL)
|
|
return -1;
|
|
|
|
/* store info for writing extension */
|
|
schm->name = current->name;
|
|
|
|
/* no key to use for encryption */
|
|
if (tmpSz == 0) {
|
|
current = (QSHKey*)current->next;
|
|
continue;
|
|
}
|
|
|
|
if (wc_RNG_GenerateBlock(ssl->rng, buf->buffer + offset, plainSz)
|
|
!= 0) {
|
|
return -1;
|
|
}
|
|
if (QSH_Encrypt(current, buf->buffer + offset, plainSz, schm->PK,
|
|
&tmpSz) != 0) {
|
|
return -1;
|
|
}
|
|
schm->PKLen = tmpSz;
|
|
|
|
sz += tmpSz;
|
|
offset += plainSz;
|
|
schmPre = schm;
|
|
current = (QSHKey*)current->next;
|
|
}
|
|
|
|
return sz;
|
|
}
|
|
|
|
|
|
static word32 QSH_KeyGetSize(WOLFSSL* ssl)
|
|
{
|
|
word32 sz = 0;
|
|
QSHKey* current;
|
|
|
|
if (ssl == NULL)
|
|
return -1;
|
|
|
|
current = ssl->peerQSHKey;
|
|
sz += OPAQUE16_LEN; /* type of extension ie 0x00 0x18 */
|
|
sz += OPAQUE24_LEN;
|
|
/* get size of buffer needed */
|
|
while (current) {
|
|
sz += OPAQUE16_LEN; /* scheme id */
|
|
sz += OPAQUE16_LEN; /* encrypted key len*/
|
|
sz += QSH_MaxSecret(current);
|
|
current = (QSHKey*)current->next;
|
|
}
|
|
|
|
return sz;
|
|
}
|
|
|
|
|
|
/* handle QSH key Exchange
|
|
return 0 on success
|
|
*/
|
|
static word32 QSH_KeyExchangeWrite(WOLFSSL* ssl, byte isServer)
|
|
{
|
|
int ret = 0;
|
|
|
|
WOLFSSL_ENTER("QSH KeyExchange");
|
|
|
|
ret = QSH_GenerateSerCliSecret(ssl, isServer);
|
|
if (ret < 0)
|
|
return MEMORY_E;
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* HAVE_QSH */
|
|
|
|
|
|
typedef struct SckeArgs {
|
|
byte* output; /* not allocated */
|
|
byte* encSecret;
|
|
byte* input;
|
|
word32 encSz;
|
|
word32 length;
|
|
int sendSz;
|
|
int inputSz;
|
|
} SckeArgs;
|
|
|
|
static void FreeSckeArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
SckeArgs* args = (SckeArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
|
|
if (args->encSecret) {
|
|
XFREE(args->encSecret, ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
args->encSecret = NULL;
|
|
}
|
|
if (args->input) {
|
|
XFREE(args->input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
args->input = NULL;
|
|
}
|
|
}
|
|
|
|
/* handle generation client_key_exchange (16) */
|
|
int SendClientKeyExchange(WOLFSSL* ssl)
|
|
{
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
SckeArgs* args = (SckeArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#else
|
|
SckeArgs args[1];
|
|
#endif
|
|
|
|
WOLFSSL_START(WC_FUNC_CLIENT_KEY_EXCHANGE_SEND);
|
|
WOLFSSL_ENTER("SendClientKeyExchange");
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
if (ssl->CBIS != NULL)
|
|
ssl->CBIS(ssl, SSL_CB_CONNECT_LOOP, SSL_SUCCESS);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_scke;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(SckeArgs));
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeSckeArgs;
|
|
#endif
|
|
}
|
|
|
|
switch(ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
switch (ssl->specs.kea) {
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
if (ssl->peerRsaKey == NULL ||
|
|
ssl->peerRsaKeyPresent == 0) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
break;
|
|
#endif
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
if (ssl->buffers.serverDH_P.buffer == NULL ||
|
|
ssl->buffers.serverDH_G.buffer == NULL ||
|
|
ssl->buffers.serverDH_Pub.buffer == NULL) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
break;
|
|
#endif /* NO_DH */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
/* sanity check that PSK client callback has been set */
|
|
if (ssl->options.client_psk_cb == NULL) {
|
|
WOLFSSL_MSG("No client PSK callback set");
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_scke);
|
|
}
|
|
break;
|
|
#endif /* NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
if (ssl->buffers.serverDH_P.buffer == NULL ||
|
|
ssl->buffers.serverDH_G.buffer == NULL ||
|
|
ssl->buffers.serverDH_Pub.buffer == NULL) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
/* sanity check that PSK client callback has been set */
|
|
if (ssl->options.client_psk_cb == NULL) {
|
|
WOLFSSL_MSG("No client PSK callback set");
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_scke);
|
|
}
|
|
break;
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
/* sanity check that PSK client callback has been set */
|
|
if (ssl->options.client_psk_cb == NULL) {
|
|
WOLFSSL_MSG("No client PSK callback set");
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_scke);
|
|
}
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->peerX25519KeyPresent) {
|
|
/* Check client ECC public key */
|
|
if (!ssl->peerX25519Key || !ssl->peerX25519Key->dp) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X25519SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
/* create private key */
|
|
ssl->hsType = DYNAMIC_TYPE_CURVE25519;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ret = X25519MakeKey(ssl, (curve25519_key*)ssl->hsKey,
|
|
ssl->peerX25519Key);
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->peerX448KeyPresent) {
|
|
/* Check client ECC public key */
|
|
if (!ssl->peerX448Key) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X448SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
/* create private key */
|
|
ssl->hsType = DYNAMIC_TYPE_CURVE448;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ret = X448MakeKey(ssl, (curve448_key*)ssl->hsKey,
|
|
ssl->peerX448Key);
|
|
break;
|
|
}
|
|
#endif
|
|
/* Check client ECC public key */
|
|
if (!ssl->peerEccKey || !ssl->peerEccKeyPresent ||
|
|
!ssl->peerEccKey->dp) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->EccSharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
/* create ephemeral private key */
|
|
ssl->hsType = DYNAMIC_TYPE_ECC;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ret = EccMakeKey(ssl, (ecc_key*)ssl->hsKey, ssl->peerEccKey);
|
|
|
|
break;
|
|
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
if (ssl->peerNtruKeyPresent == 0) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
break;
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#ifdef HAVE_ECC
|
|
ecc_key* peerKey;
|
|
#endif
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
if (ssl->ctx->X25519SharedSecretCb != NULL)
|
|
break;
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
if (ssl->ctx->X448SharedSecretCb != NULL)
|
|
break;
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->ctx->EccSharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->peerX25519KeyPresent) {
|
|
if (!ssl->peerX25519Key || !ssl->peerX25519Key->dp) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
/* create private key */
|
|
ssl->hsType = DYNAMIC_TYPE_CURVE25519;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ret = X25519MakeKey(ssl, (curve25519_key*)ssl->hsKey,
|
|
ssl->peerX25519Key);
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->peerX448KeyPresent) {
|
|
if (!ssl->peerX448Key) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
/* create private key */
|
|
ssl->hsType = DYNAMIC_TYPE_CURVE448;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ret = X448MakeKey(ssl, (curve448_key*)ssl->hsKey,
|
|
ssl->peerX448Key);
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (ssl->specs.static_ecdh) {
|
|
/* Note: EccDsa is really fixed Ecc key here */
|
|
if (!ssl->peerEccDsaKey || !ssl->peerEccDsaKeyPresent) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
peerKey = ssl->peerEccDsaKey;
|
|
}
|
|
else {
|
|
if (!ssl->peerEccKey || !ssl->peerEccKeyPresent) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
peerKey = ssl->peerEccKey;
|
|
}
|
|
if (peerKey == NULL) {
|
|
ERROR_OUT(NO_PEER_KEY, exit_scke);
|
|
}
|
|
|
|
/* create ephemeral private key */
|
|
ssl->hsType = DYNAMIC_TYPE_ECC;
|
|
ret = AllocKey(ssl, ssl->hsType, &ssl->hsKey);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ret = EccMakeKey(ssl, (ecc_key*)ssl->hsKey, peerKey);
|
|
#endif
|
|
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* case TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
args->encSz = MAX_ENCRYPT_SZ;
|
|
args->encSecret = (byte*)XMALLOC(args->encSz, ssl->heap,
|
|
DYNAMIC_TYPE_SECRET);
|
|
if (args->encSecret == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
if (ssl->arrays->preMasterSecret == NULL) {
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN;
|
|
ssl->arrays->preMasterSecret = (byte*)XMALLOC(ENCRYPT_LEN,
|
|
ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
if (ssl->arrays->preMasterSecret == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
XMEMSET(ssl->arrays->preMasterSecret, 0, ENCRYPT_LEN);
|
|
}
|
|
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
/* build PreMasterSecret with RNG data */
|
|
#if defined(WOLFSSL_RENESAS_TSIP_TLS) && \
|
|
!defined(NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION)
|
|
if (tsip_useable(ssl)) {
|
|
ret = tsip_generatePremasterSecret(
|
|
&ssl->arrays->preMasterSecret[VERSION_SZ],
|
|
ENCRYPT_LEN - VERSION_SZ);
|
|
} else {
|
|
#endif
|
|
ret = wc_RNG_GenerateBlock(ssl->rng,
|
|
&ssl->arrays->preMasterSecret[VERSION_SZ],
|
|
SECRET_LEN - VERSION_SZ);
|
|
#if defined(WOLFSSL_RENESAS_TSIP_TLS) && \
|
|
!defined(NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION)
|
|
}
|
|
#endif
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ssl->arrays->preMasterSecret[0] = ssl->chVersion.major;
|
|
ssl->arrays->preMasterSecret[1] = ssl->chVersion.minor;
|
|
|
|
ssl->arrays->preMasterSz = SECRET_LEN;
|
|
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
ssl->buffers.sig.length = ENCRYPT_LEN;
|
|
ssl->buffers.sig.buffer = (byte*)XMALLOC(ENCRYPT_LEN,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (ssl->buffers.sig.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_DH,
|
|
(void**)&ssl->buffers.serverDH_Key);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && \
|
|
!defined(WOLFSSL_OLD_PRIME_CHECK)
|
|
if (ssl->options.dhDoKeyTest &&
|
|
!ssl->options.dhKeyTested)
|
|
{
|
|
ret = wc_DhSetCheckKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length,
|
|
NULL, 0, 0, ssl->rng);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
ssl->options.dhKeyTested = 1;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_DhSetKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
}
|
|
|
|
/* for DH, encSecret is Yc, agree is pre-master */
|
|
ret = DhGenKeyPair(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.sig.buffer, (word32*)&ssl->buffers.sig.length,
|
|
args->encSecret, &args->encSz);
|
|
|
|
/* set the max agree result size */
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN;
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
byte* pms = ssl->arrays->preMasterSecret;
|
|
ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
|
|
ssl->arrays->server_hint, ssl->arrays->client_identity,
|
|
MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
|
|
if (ssl->arrays->psk_keySz == 0 ||
|
|
ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_scke);
|
|
}
|
|
ssl->arrays->client_identity[MAX_PSK_ID_LEN] = '\0'; /* null term */
|
|
args->encSz = (word32)XSTRLEN(ssl->arrays->client_identity);
|
|
if (args->encSz > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(CLIENT_ID_ERROR, exit_scke);
|
|
}
|
|
XMEMCPY(args->encSecret, ssl->arrays->client_identity,
|
|
args->encSz);
|
|
|
|
/* make psk pre master secret */
|
|
/* length of key + length 0s + length of key + key */
|
|
c16toa((word16)ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
XMEMSET(pms, 0, ssl->arrays->psk_keySz);
|
|
pms += ssl->arrays->psk_keySz;
|
|
c16toa((word16)ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->preMasterSz = (ssl->arrays->psk_keySz * 2) +
|
|
(2 * OPAQUE16_LEN);
|
|
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->psk_keySz = 0; /* No further need */
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
word32 esSz = 0;
|
|
args->output = args->encSecret;
|
|
|
|
ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
|
|
ssl->arrays->server_hint, ssl->arrays->client_identity,
|
|
MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
|
|
if (ssl->arrays->psk_keySz == 0 ||
|
|
ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_scke);
|
|
}
|
|
ssl->arrays->client_identity[MAX_PSK_ID_LEN] = '\0'; /* null term */
|
|
esSz = (word32)XSTRLEN(ssl->arrays->client_identity);
|
|
|
|
if (esSz > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(CLIENT_ID_ERROR, exit_scke);
|
|
}
|
|
|
|
ssl->buffers.sig.length = ENCRYPT_LEN;
|
|
ssl->buffers.sig.buffer = (byte*)XMALLOC(ENCRYPT_LEN,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (ssl->buffers.sig.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
|
|
c16toa((word16)esSz, args->output);
|
|
args->output += OPAQUE16_LEN;
|
|
XMEMCPY(args->output, ssl->arrays->client_identity, esSz);
|
|
args->output += esSz;
|
|
args->length = args->encSz - esSz - OPAQUE16_LEN;
|
|
args->encSz = esSz + OPAQUE16_LEN;
|
|
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_DH,
|
|
(void**)&ssl->buffers.serverDH_Key);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
#if !defined(HAVE_FIPS) && !defined(HAVE_SELFTEST) && \
|
|
!defined(WOLFSSL_OLD_PRIME_CHECK)
|
|
if (ssl->options.dhDoKeyTest &&
|
|
!ssl->options.dhKeyTested)
|
|
{
|
|
ret = wc_DhSetCheckKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length,
|
|
NULL, 0, 0, ssl->rng);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
ssl->options.dhKeyTested = 1;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_DhSetKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
}
|
|
|
|
/* for DH, encSecret is Yc, agree is pre-master */
|
|
ret = DhGenKeyPair(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.sig.buffer, (word32*)&ssl->buffers.sig.length,
|
|
args->output + OPAQUE16_LEN, &args->length);
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
word32 esSz = 0;
|
|
args->output = args->encSecret;
|
|
|
|
/* Send PSK client identity */
|
|
ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
|
|
ssl->arrays->server_hint, ssl->arrays->client_identity,
|
|
MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
|
|
if (ssl->arrays->psk_keySz == 0 ||
|
|
ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_scke);
|
|
}
|
|
ssl->arrays->client_identity[MAX_PSK_ID_LEN] = '\0'; /* null term */
|
|
esSz = (word32)XSTRLEN(ssl->arrays->client_identity);
|
|
if (esSz > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(CLIENT_ID_ERROR, exit_scke);
|
|
}
|
|
|
|
/* place size and identity in output buffer sz:identity */
|
|
c16toa((word16)esSz, args->output);
|
|
args->output += OPAQUE16_LEN;
|
|
XMEMCPY(args->output, ssl->arrays->client_identity, esSz);
|
|
args->output += esSz;
|
|
args->encSz = esSz + OPAQUE16_LEN;
|
|
|
|
/* length is used for public key size */
|
|
args->length = MAX_ENCRYPT_SZ;
|
|
|
|
/* Create shared ECC key leaving room at the beginning
|
|
of buffer for size of shared key. */
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN - OPAQUE16_LEN;
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X25519SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
ret = wc_curve25519_export_public_ex(
|
|
(curve25519_key*)ssl->hsKey,
|
|
args->output + OPAQUE8_LEN, &args->length,
|
|
EC25519_LITTLE_ENDIAN);
|
|
if (ret != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_scke);
|
|
}
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X448SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
ret = wc_curve448_export_public_ex(
|
|
(curve448_key*)ssl->hsKey,
|
|
args->output + OPAQUE8_LEN, &args->length,
|
|
EC448_LITTLE_ENDIAN);
|
|
if (ret != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_scke);
|
|
}
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->EccSharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
/* Place ECC key in output buffer, leaving room for size */
|
|
ret = wc_ecc_export_x963((ecc_key*)ssl->hsKey,
|
|
args->output + OPAQUE8_LEN, &args->length);
|
|
if (ret != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_scke);
|
|
}
|
|
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
ret = wc_RNG_GenerateBlock(ssl->rng,
|
|
ssl->arrays->preMasterSecret, SECRET_LEN);
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
ssl->arrays->preMasterSz = SECRET_LEN;
|
|
args->encSz = MAX_ENCRYPT_SZ;
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN;
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->hsType == DYNAMIC_TYPE_CURVE25519) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X25519SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
ret = wc_curve25519_export_public_ex(
|
|
(curve25519_key*)ssl->hsKey,
|
|
args->encSecret + OPAQUE8_LEN, &args->encSz,
|
|
EC25519_LITTLE_ENDIAN);
|
|
if (ret != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_scke);
|
|
}
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->hsType == DYNAMIC_TYPE_CURVE448) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X448SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
ret = wc_curve448_export_public_ex(
|
|
(curve448_key*)ssl->hsKey,
|
|
args->encSecret + OPAQUE8_LEN, &args->encSz,
|
|
EC448_LITTLE_ENDIAN);
|
|
if (ret != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_scke);
|
|
}
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT)
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->EccSharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
/* Place ECC key in buffer, leaving room for size */
|
|
ret = wc_ecc_export_x963((ecc_key*)ssl->hsKey,
|
|
args->encSecret + OPAQUE8_LEN, &args->encSz);
|
|
if (ret != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_scke);
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* case TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
#if defined(WOLFSSL_RENESAS_TSIP_TLS) && \
|
|
!defined(NO_WOLFSSL_RENESAS_TSIP_TLS_SESSION)
|
|
if (tsip_useable(ssl) &&
|
|
wc_RsaEncryptSize(ssl->peerRsaKey) == 256) {
|
|
ret = tsip_generateEncryptPreMasterSecret(ssl,
|
|
args->encSecret,
|
|
&args->encSz);
|
|
|
|
} else
|
|
#endif
|
|
ret = RsaEnc(ssl,
|
|
ssl->arrays->preMasterSecret, SECRET_LEN,
|
|
args->encSecret, &args->encSz,
|
|
ssl->peerRsaKey,
|
|
#if defined(HAVE_PK_CALLBACKS)
|
|
&ssl->buffers.peerRsaKey
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
ret = DhAgree(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.sig.buffer, ssl->buffers.sig.length,
|
|
ssl->buffers.serverDH_Pub.buffer,
|
|
ssl->buffers.serverDH_Pub.length,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz);
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
ret = DhAgree(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.sig.buffer, ssl->buffers.sig.length,
|
|
ssl->buffers.serverDH_Pub.buffer,
|
|
ssl->buffers.serverDH_Pub.length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&ssl->arrays->preMasterSz);
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->peerX25519KeyPresent) {
|
|
ret = X25519SharedSecret(ssl,
|
|
(curve25519_key*)ssl->hsKey, ssl->peerX25519Key,
|
|
args->output + OPAQUE8_LEN, &args->length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_CLIENT_END
|
|
);
|
|
if (!ssl->specs.static_ecdh
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ret != WC_PENDING_E
|
|
#endif
|
|
) {
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->peerX448KeyPresent) {
|
|
ret = X448SharedSecret(ssl,
|
|
(curve448_key*)ssl->hsKey, ssl->peerX448Key,
|
|
args->output + OPAQUE8_LEN, &args->length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_CLIENT_END
|
|
);
|
|
if (!ssl->specs.static_ecdh
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ret != WC_PENDING_E
|
|
#endif
|
|
) {
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
ret = EccSharedSecret(ssl,
|
|
(ecc_key*)ssl->hsKey, ssl->peerEccKey,
|
|
args->output + OPAQUE8_LEN, &args->length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_CLIENT_END
|
|
);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
word32 rc;
|
|
word16 tmpEncSz = (word16)args->encSz;
|
|
DRBG_HANDLE drbg;
|
|
|
|
rc = ntru_crypto_drbg_external_instantiate(GetEntropy, &drbg);
|
|
if (rc != DRBG_OK) {
|
|
ERROR_OUT(NTRU_DRBG_ERROR, exit_scke);
|
|
}
|
|
rc = ntru_crypto_ntru_encrypt(drbg, ssl->peerNtruKeyLen,
|
|
ssl->peerNtruKey,
|
|
ssl->arrays->preMasterSz,
|
|
ssl->arrays->preMasterSecret,
|
|
&tmpEncSz,
|
|
args->encSecret);
|
|
args->encSz = tmpEncSz;
|
|
ntru_crypto_drbg_uninstantiate(drbg);
|
|
if (rc != NTRU_OK) {
|
|
ERROR_OUT(NTRU_ENCRYPT_ERROR, exit_scke);
|
|
}
|
|
ret = 0;
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#ifdef HAVE_ECC
|
|
ecc_key* peerKey;
|
|
#endif
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->peerX25519KeyPresent) {
|
|
ret = X25519SharedSecret(ssl,
|
|
(curve25519_key*)ssl->hsKey, ssl->peerX25519Key,
|
|
args->encSecret + OPAQUE8_LEN, &args->encSz,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_CLIENT_END
|
|
);
|
|
if (!ssl->specs.static_ecdh
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ret != WC_PENDING_E
|
|
#endif
|
|
) {
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->peerX448KeyPresent) {
|
|
ret = X448SharedSecret(ssl,
|
|
(curve448_key*)ssl->hsKey, ssl->peerX448Key,
|
|
args->encSecret + OPAQUE8_LEN, &args->encSz,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_CLIENT_END
|
|
);
|
|
if (!ssl->specs.static_ecdh
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ret != WC_PENDING_E
|
|
#endif
|
|
) {
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
peerKey = (ssl->specs.static_ecdh) ?
|
|
ssl->peerEccDsaKey : ssl->peerEccKey;
|
|
|
|
ret = EccSharedSecret(ssl,
|
|
(ecc_key*)ssl->hsKey, peerKey,
|
|
args->encSecret + OPAQUE8_LEN, &args->encSz,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_CLIENT_END
|
|
);
|
|
if (!ssl->specs.static_ecdh
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ret != WC_PENDING_E
|
|
#endif
|
|
&& !ssl->options.keepResources) {
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
}
|
|
#endif
|
|
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* case TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
byte* pms = ssl->arrays->preMasterSecret;
|
|
|
|
/* validate args */
|
|
if (args->output == NULL || args->length == 0) {
|
|
ERROR_OUT(BAD_FUNC_ARG, exit_scke);
|
|
}
|
|
|
|
c16toa((word16)args->length, args->output);
|
|
args->encSz += args->length + OPAQUE16_LEN;
|
|
c16toa((word16)ssl->arrays->preMasterSz, pms);
|
|
ssl->arrays->preMasterSz += OPAQUE16_LEN;
|
|
pms += ssl->arrays->preMasterSz;
|
|
|
|
/* make psk pre master secret */
|
|
/* length of key + length 0s + length of key + key */
|
|
c16toa((word16)ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->preMasterSz +=
|
|
ssl->arrays->psk_keySz + OPAQUE16_LEN;
|
|
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->psk_keySz = 0; /* No further need */
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
byte* pms = ssl->arrays->preMasterSecret;
|
|
|
|
/* validate args */
|
|
if (args->output == NULL || args->length > ENCRYPT_LEN) {
|
|
ERROR_OUT(BAD_FUNC_ARG, exit_scke);
|
|
}
|
|
|
|
/* place size of public key in output buffer */
|
|
*args->output = (byte)args->length;
|
|
args->encSz += args->length + OPAQUE8_LEN;
|
|
|
|
/* Create pre master secret is the concatenation of
|
|
eccSize + eccSharedKey + pskSize + pskKey */
|
|
c16toa((word16)ssl->arrays->preMasterSz, pms);
|
|
ssl->arrays->preMasterSz += OPAQUE16_LEN;
|
|
pms += ssl->arrays->preMasterSz;
|
|
|
|
c16toa((word16)ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->preMasterSz +=
|
|
ssl->arrays->psk_keySz + OPAQUE16_LEN;
|
|
|
|
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->psk_keySz = 0; /* No further need */
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
/* place size of public key in buffer */
|
|
*args->encSecret = (byte)args->encSz;
|
|
args->encSz += OPAQUE8_LEN;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* case TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
word32 tlsSz = 0;
|
|
word32 idx = 0;
|
|
|
|
#ifdef HAVE_QSH
|
|
word32 qshSz = 0;
|
|
if (ssl->peerQSHKeyPresent) {
|
|
qshSz = QSH_KeyGetSize(ssl);
|
|
}
|
|
#endif
|
|
|
|
if (ssl->options.tls || ssl->specs.kea == diffie_hellman_kea) {
|
|
tlsSz = 2;
|
|
}
|
|
|
|
if (ssl->specs.kea == ecc_diffie_hellman_kea ||
|
|
ssl->specs.kea == dhe_psk_kea ||
|
|
ssl->specs.kea == ecdhe_psk_kea) { /* always off */
|
|
tlsSz = 0;
|
|
}
|
|
|
|
idx = HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
|
|
args->sendSz = args->encSz + tlsSz + idx;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
idx += DTLS_HANDSHAKE_EXTRA + DTLS_RECORD_EXTRA;
|
|
args->sendSz += DTLS_HANDSHAKE_EXTRA + DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
#ifdef HAVE_QSH
|
|
args->encSz += qshSz;
|
|
args->sendSz += qshSz;
|
|
#endif
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
#ifdef HAVE_QSH
|
|
if (ssl->peerQSHKeyPresent) {
|
|
byte idxSave = idx;
|
|
idx = args->sendSz - qshSz;
|
|
|
|
if (QSH_KeyExchangeWrite(ssl, 0) != 0) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
|
|
/* extension type */
|
|
c16toa(TLSX_QUANTUM_SAFE_HYBRID, args->output + idx);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
/* write to output and check amount written */
|
|
if (TLSX_QSHPK_Write(ssl->QSH_secret->list,
|
|
args->output + idx) > qshSz - OPAQUE16_LEN) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
|
|
idx = idxSave;
|
|
}
|
|
#endif
|
|
|
|
AddHeaders(args->output, args->encSz + tlsSz, client_key_exchange, ssl);
|
|
|
|
#ifdef HAVE_QSH
|
|
if (ssl->peerQSHKeyPresent) {
|
|
args->encSz -= qshSz;
|
|
}
|
|
#endif
|
|
if (tlsSz) {
|
|
c16toa((word16)args->encSz, &args->output[idx]);
|
|
idx += OPAQUE16_LEN;
|
|
}
|
|
XMEMCPY(args->output + idx, args->encSecret, args->encSz);
|
|
idx += args->encSz;
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
args->inputSz = idx - recordHeaderSz; /* buildmsg adds rechdr */
|
|
args->input = (byte*)XMALLOC(args->inputSz, ssl->heap,
|
|
DYNAMIC_TYPE_IN_BUFFER);
|
|
if (args->input == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scke);
|
|
}
|
|
|
|
XMEMCPY(args->input, args->output + recordHeaderSz,
|
|
args->inputSz);
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* case TLS_ASYNC_FINALIZE */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, args->input, args->inputSz, client_key_exchange)) != 0) {
|
|
goto exit_scke;
|
|
}
|
|
#endif
|
|
ret = BuildMessage(ssl, args->output, args->sendSz,
|
|
args->input, args->inputSz, handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(args->input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
args->input = NULL; /* make sure its not double free'd on cleanup */
|
|
|
|
if (ret >= 0) {
|
|
args->sendSz = ret;
|
|
ret = 0;
|
|
}
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, args->output, args->sendSz, client_key_exchange)) != 0) {
|
|
goto exit_scke;
|
|
}
|
|
}
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
ret = HashOutput(ssl, args->output, args->sendSz, 0);
|
|
}
|
|
|
|
if (ret != 0) {
|
|
goto exit_scke;
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ClientKeyExchange");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "ClientKeyExchange", handshake,
|
|
args->output, args->sendSz, WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
ssl->buffers.outputBuffer.length += args->sendSz;
|
|
|
|
if (!ssl->options.groupMessages) {
|
|
ret = SendBuffered(ssl);
|
|
}
|
|
if (ret == 0 || ret == WANT_WRITE) {
|
|
int tmpRet = MakeMasterSecret(ssl);
|
|
if (tmpRet != 0) {
|
|
ret = tmpRet; /* save WANT_WRITE unless more serious */
|
|
}
|
|
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
|
|
}
|
|
break;
|
|
}
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_scke:
|
|
|
|
WOLFSSL_LEAVE("SendClientKeyExchange", ret);
|
|
WOLFSSL_END(WC_FUNC_CLIENT_KEY_EXCHANGE_SEND);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* Handle async operation */
|
|
if (ret == WC_PENDING_E)
|
|
return ret;
|
|
#endif
|
|
|
|
/* No further need for PMS */
|
|
if (ssl->arrays->preMasterSecret != NULL) {
|
|
ForceZero(ssl->arrays->preMasterSecret, ssl->arrays->preMasterSz);
|
|
}
|
|
ssl->arrays->preMasterSz = 0;
|
|
|
|
/* Final cleanup */
|
|
FreeSckeArgs(ssl, args);
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifndef NO_CERTS
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#ifndef WOLFSSL_NO_CLIENT_AUTH
|
|
typedef struct ScvArgs {
|
|
byte* output; /* not allocated */
|
|
#ifndef NO_RSA
|
|
byte* verifySig;
|
|
#endif
|
|
byte* verify; /* not allocated */
|
|
byte* input;
|
|
word32 idx;
|
|
word32 extraSz;
|
|
word32 sigSz;
|
|
int sendSz;
|
|
int inputSz;
|
|
word16 length;
|
|
byte sigAlgo;
|
|
} ScvArgs;
|
|
|
|
static void FreeScvArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
ScvArgs* args = (ScvArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
|
|
#ifndef NO_RSA
|
|
if (args->verifySig) {
|
|
XFREE(args->verifySig, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
args->verifySig = NULL;
|
|
}
|
|
#endif
|
|
if (args->input) {
|
|
XFREE(args->input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
args->input = NULL;
|
|
}
|
|
}
|
|
|
|
/* handle generation of certificate_verify (15) */
|
|
int SendCertificateVerify(WOLFSSL* ssl)
|
|
{
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ScvArgs* args = (ScvArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#else
|
|
ScvArgs args[1];
|
|
#endif
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_VERIFY_SEND);
|
|
WOLFSSL_ENTER("SendCertificateVerify");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* BuildMessage does its own Pop */
|
|
if (ssl->error != WC_PENDING_E ||
|
|
ssl->options.asyncState != TLS_ASYNC_END)
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_scv;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(ScvArgs));
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeScvArgs;
|
|
#endif
|
|
}
|
|
|
|
switch(ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
if (ssl->options.sendVerify == SEND_BLANK_CERT) {
|
|
return 0; /* sent blank cert, can't verify */
|
|
}
|
|
|
|
args->sendSz = MAX_CERT_VERIFY_SZ + MAX_MSG_EXTRA;
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_scv;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* case TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
ret = BuildCertHashes(ssl, &ssl->hsHashes->certHashes);
|
|
if (ret != 0) {
|
|
goto exit_scv;
|
|
}
|
|
|
|
if (ssl->buffers.key == NULL) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (wolfSSL_CTX_IsPrivatePkSet(ssl->ctx))
|
|
args->length = GetPrivateKeySigSize(ssl);
|
|
else
|
|
#endif
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_scv);
|
|
}
|
|
else {
|
|
/* Decode private key. */
|
|
ret = DecodePrivateKey(ssl, &args->length);
|
|
if (ret != 0) {
|
|
goto exit_scv;
|
|
}
|
|
}
|
|
|
|
if (args->length == 0) {
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_scv);
|
|
}
|
|
|
|
/* idx is used to track verify pointer offset to output */
|
|
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
args->verify = &args->output[RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ];
|
|
args->extraSz = 0; /* tls 1.2 hash/sig */
|
|
|
|
/* build encoded signature buffer */
|
|
ssl->buffers.sig.length = MAX_ENCODED_SIG_SZ;
|
|
ssl->buffers.sig.buffer = (byte*)XMALLOC(ssl->buffers.sig.length,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (ssl->buffers.sig.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scv);
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
args->verify += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
#ifndef NO_OLD_TLS
|
|
#ifndef NO_SHA
|
|
/* old tls default */
|
|
SetDigest(ssl, sha_mac);
|
|
#endif
|
|
#else
|
|
#ifndef NO_SHA256
|
|
/* new tls default */
|
|
SetDigest(ssl, sha256_mac);
|
|
#endif
|
|
#endif /* !NO_OLD_TLS */
|
|
|
|
if (ssl->hsType == DYNAMIC_TYPE_RSA) {
|
|
#ifdef WC_RSA_PSS
|
|
if (IsAtLeastTLSv1_2(ssl) &&
|
|
(ssl->pssAlgo & (1 << ssl->suites->hashAlgo))) {
|
|
args->sigAlgo = rsa_pss_sa_algo;
|
|
}
|
|
else
|
|
#endif
|
|
args->sigAlgo = rsa_sa_algo;
|
|
}
|
|
else if (ssl->hsType == DYNAMIC_TYPE_ECC)
|
|
args->sigAlgo = ecc_dsa_sa_algo;
|
|
else if (ssl->hsType == DYNAMIC_TYPE_ED25519)
|
|
args->sigAlgo = ed25519_sa_algo;
|
|
else if (ssl->hsType == DYNAMIC_TYPE_ED448)
|
|
args->sigAlgo = ed448_sa_algo;
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
EncodeSigAlg(ssl->suites->hashAlgo, args->sigAlgo,
|
|
args->verify);
|
|
args->extraSz = HASH_SIG_SIZE;
|
|
SetDigest(ssl, ssl->suites->hashAlgo);
|
|
}
|
|
#ifndef NO_OLD_TLS
|
|
else {
|
|
/* if old TLS load MD5 and SHA hash as value to sign */
|
|
XMEMCPY(ssl->buffers.sig.buffer,
|
|
(byte*)ssl->hsHashes->certHashes.md5, FINISHED_SZ);
|
|
}
|
|
#endif
|
|
|
|
#ifndef NO_RSA
|
|
if (args->sigAlgo == rsa_sa_algo) {
|
|
ssl->buffers.sig.length = FINISHED_SZ;
|
|
args->sigSz = ENCRYPT_LEN;
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
ssl->buffers.sig.length = wc_EncodeSignature(
|
|
ssl->buffers.sig.buffer, ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
TypeHash(ssl->suites->hashAlgo));
|
|
}
|
|
|
|
/* prepend hdr */
|
|
c16toa(args->length, args->verify + args->extraSz);
|
|
}
|
|
#ifdef WC_RSA_PSS
|
|
else if (args->sigAlgo == rsa_pss_sa_algo) {
|
|
XMEMCPY(ssl->buffers.sig.buffer, ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length);
|
|
ssl->buffers.sig.length = ssl->buffers.digest.length;
|
|
args->sigSz = ENCRYPT_LEN;
|
|
|
|
/* prepend hdr */
|
|
c16toa(args->length, args->verify + args->extraSz);
|
|
}
|
|
#endif
|
|
#endif /* !NO_RSA */
|
|
#if defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)
|
|
if (args->sigAlgo == ed25519_sa_algo) {
|
|
ret = Ed25519CheckPubKey(ssl);
|
|
if (ret != 0)
|
|
goto exit_scv;
|
|
}
|
|
#endif /* HAVE_ED25519 && !NO_ED25519_CLIENT_AUTH */
|
|
#if defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)
|
|
if (args->sigAlgo == ed448_sa_algo) {
|
|
ret = Ed448CheckPubKey(ssl);
|
|
if (ret != 0)
|
|
goto exit_scv;
|
|
}
|
|
#endif /* HAVE_ED448 && !NO_ED448_CLIENT_AUTH */
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* case TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
#ifdef HAVE_ECC
|
|
if (ssl->hsType == DYNAMIC_TYPE_ECC) {
|
|
ecc_key* key = (ecc_key*)ssl->hsKey;
|
|
|
|
ret = EccSign(ssl,
|
|
ssl->buffers.digest.buffer, ssl->buffers.digest.length,
|
|
ssl->buffers.sig.buffer, (word32*)&ssl->buffers.sig.length,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#if defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)
|
|
if (ssl->hsType == DYNAMIC_TYPE_ED25519) {
|
|
ed25519_key* key = (ed25519_key*)ssl->hsKey;
|
|
|
|
ret = Ed25519Sign(ssl,
|
|
ssl->hsHashes->messages, ssl->hsHashes->length,
|
|
ssl->buffers.sig.buffer, (word32*)&ssl->buffers.sig.length,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
}
|
|
#endif /* HAVE_ED25519 && !NO_ED25519_CLIENT_AUTH */
|
|
#if defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)
|
|
if (ssl->hsType == DYNAMIC_TYPE_ED448) {
|
|
ed448_key* key = (ed448_key*)ssl->hsKey;
|
|
|
|
ret = Ed448Sign(ssl,
|
|
ssl->hsHashes->messages, ssl->hsHashes->length,
|
|
ssl->buffers.sig.buffer, (word32*)&ssl->buffers.sig.length,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
}
|
|
#endif /* HAVE_ED448 && !NO_ED448_CLIENT_AUTH */
|
|
#ifndef NO_RSA
|
|
if (ssl->hsType == DYNAMIC_TYPE_RSA) {
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
/* restore verify pointer */
|
|
args->verify = &args->output[args->idx];
|
|
|
|
ret = RsaSign(ssl,
|
|
ssl->buffers.sig.buffer, ssl->buffers.sig.length,
|
|
args->verify + args->extraSz + VERIFY_HEADER, &args->sigSz,
|
|
args->sigAlgo, ssl->suites->hashAlgo, key,
|
|
ssl->buffers.key
|
|
);
|
|
}
|
|
#endif /* !NO_RSA */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_scv;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* case TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
/* restore verify pointer */
|
|
args->verify = &args->output[args->idx];
|
|
|
|
switch (ssl->hsType) {
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448)
|
|
#ifdef HAVE_ECC
|
|
case DYNAMIC_TYPE_ECC:
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
case DYNAMIC_TYPE_ED25519:
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
case DYNAMIC_TYPE_ED448:
|
|
#endif
|
|
args->length = (word16)ssl->buffers.sig.length;
|
|
/* prepend hdr */
|
|
c16toa(args->length, args->verify + args->extraSz);
|
|
XMEMCPY(args->verify + args->extraSz + VERIFY_HEADER,
|
|
ssl->buffers.sig.buffer, ssl->buffers.sig.length);
|
|
break;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
case DYNAMIC_TYPE_RSA:
|
|
{
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
if (args->verifySig == NULL) {
|
|
args->verifySig = (byte*)XMALLOC(args->sigSz, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
if (args->verifySig == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scv);
|
|
}
|
|
XMEMCPY(args->verifySig, args->verify + args->extraSz +
|
|
VERIFY_HEADER, args->sigSz);
|
|
}
|
|
|
|
/* check for signature faults */
|
|
ret = VerifyRsaSign(ssl,
|
|
args->verifySig, args->sigSz,
|
|
ssl->buffers.sig.buffer, ssl->buffers.sig.length,
|
|
args->sigAlgo, ssl->suites->hashAlgo, key,
|
|
ssl->buffers.key
|
|
);
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
default:
|
|
break;
|
|
}
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_scv;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* case TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
if (args->output == NULL) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_scv);
|
|
}
|
|
AddHeaders(args->output, (word32)args->length + args->extraSz +
|
|
VERIFY_HEADER, certificate_verify, ssl);
|
|
|
|
args->sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ +
|
|
(word32)args->length + args->extraSz + VERIFY_HEADER;
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
args->inputSz = args->sendSz - recordHeaderSz;
|
|
/* build msg adds rec hdr */
|
|
args->input = (byte*)XMALLOC(args->inputSz, ssl->heap,
|
|
DYNAMIC_TYPE_IN_BUFFER);
|
|
if (args->input == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_scv);
|
|
}
|
|
|
|
XMEMCPY(args->input, args->output + recordHeaderSz,
|
|
args->inputSz);
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* case TLS_ASYNC_FINALIZE */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, args->input, args->inputSz, certificate_verify)) != 0) {
|
|
goto exit_scv;
|
|
}
|
|
#endif
|
|
ret = BuildMessage(ssl, args->output,
|
|
MAX_CERT_VERIFY_SZ + MAX_MSG_EXTRA,
|
|
args->input, args->inputSz, handshake,
|
|
1, 0, 1, CUR_ORDER);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
goto exit_scv;
|
|
#endif
|
|
|
|
XFREE(args->input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
args->input = NULL; /* make sure its not double free'd on cleanup */
|
|
|
|
if (ret >= 0) {
|
|
args->sendSz = ret;
|
|
ret = 0;
|
|
}
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
ret = DtlsMsgPoolSave(ssl, args->output, args->sendSz, certificate_verify);
|
|
}
|
|
if (ret == 0 && ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
if (ret == 0)
|
|
ret = HashOutput(ssl, args->output, args->sendSz, 0);
|
|
}
|
|
|
|
if (ret != 0) {
|
|
goto exit_scv;
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "CertificateVerify");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "CertificateVerify", handshake,
|
|
args->output, args->sendSz, WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
ssl->buffers.outputBuffer.length += args->sendSz;
|
|
|
|
if (!ssl->options.groupMessages) {
|
|
ret = SendBuffered(ssl);
|
|
}
|
|
break;
|
|
}
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_scv:
|
|
|
|
WOLFSSL_LEAVE("SendCertificateVerify", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_VERIFY_SEND);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* Handle async operation */
|
|
if (ret == WC_PENDING_E) {
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* Digest is not allocated, so do this to prevent free */
|
|
ssl->buffers.digest.buffer = NULL;
|
|
ssl->buffers.digest.length = 0;
|
|
|
|
/* Final cleanup */
|
|
FreeScvArgs(ssl, args);
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
#endif /* WOLFSSL_NO_TLS12 */
|
|
|
|
#endif /* NO_CERTS */
|
|
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
int SetTicket(WOLFSSL* ssl, const byte* ticket, word32 length)
|
|
{
|
|
/* Free old dynamic ticket if we already had one */
|
|
if (ssl->session.isDynamic) {
|
|
XFREE(ssl->session.ticket, ssl->heap, DYNAMIC_TYPE_SESSION_TICK);
|
|
ssl->session.ticket = ssl->session.staticTicket;
|
|
ssl->session.isDynamic = 0;
|
|
}
|
|
|
|
if (length > sizeof(ssl->session.staticTicket)) {
|
|
byte* sessionTicket =
|
|
(byte*)XMALLOC(length, ssl->heap, DYNAMIC_TYPE_SESSION_TICK);
|
|
if (sessionTicket == NULL)
|
|
return MEMORY_E;
|
|
ssl->session.ticket = sessionTicket;
|
|
ssl->session.isDynamic = 1;
|
|
}
|
|
ssl->session.ticketLen = (word16)length;
|
|
|
|
if (length > 0) {
|
|
XMEMCPY(ssl->session.ticket, ticket, length);
|
|
if (ssl->session_ticket_cb != NULL) {
|
|
ssl->session_ticket_cb(ssl,
|
|
ssl->session.ticket, ssl->session.ticketLen,
|
|
ssl->session_ticket_ctx);
|
|
}
|
|
/* Create a fake sessionID based on the ticket, this will
|
|
* supersede the existing session cache info. */
|
|
ssl->options.haveSessionId = 1;
|
|
#ifdef WOLFSSL_TLS13
|
|
if (ssl->options.tls1_3) {
|
|
XMEMCPY(ssl->session.sessionID,
|
|
ssl->session.ticket + length - ID_LEN, ID_LEN);
|
|
}
|
|
else
|
|
#endif
|
|
XMEMCPY(ssl->arrays->sessionID,
|
|
ssl->session.ticket + length - ID_LEN, ID_LEN);
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
/* handle processing of session_ticket (4) */
|
|
static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
word32 size)
|
|
{
|
|
word32 begin = *inOutIdx;
|
|
word32 lifetime;
|
|
word16 length;
|
|
int ret;
|
|
|
|
if (ssl->expect_session_ticket == 0) {
|
|
WOLFSSL_MSG("Unexpected session ticket");
|
|
return SESSION_TICKET_EXPECT_E;
|
|
}
|
|
|
|
if (OPAQUE32_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
ato32(input + *inOutIdx, &lifetime);
|
|
*inOutIdx += OPAQUE32_LEN;
|
|
|
|
if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
|
|
return BUFFER_ERROR;
|
|
|
|
ato16(input + *inOutIdx, &length);
|
|
*inOutIdx += OPAQUE16_LEN;
|
|
|
|
if ((*inOutIdx - begin) + length > size)
|
|
return BUFFER_ERROR;
|
|
|
|
if ((ret = SetTicket(ssl, input + *inOutIdx, length)) != 0)
|
|
return ret;
|
|
*inOutIdx += length;
|
|
if (length > 0) {
|
|
ssl->timeout = lifetime;
|
|
#ifndef NO_SESSION_CACHE
|
|
AddSession(ssl);
|
|
#endif
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
*inOutIdx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
*inOutIdx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
ssl->expect_session_ticket = 0;
|
|
|
|
return 0;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#endif /* HAVE_SESSION_TICKET */
|
|
|
|
#endif /* NO_WOLFSSL_CLIENT */
|
|
|
|
#ifndef NO_CERTS
|
|
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
int GetPrivateKeySigSize(WOLFSSL* ssl)
|
|
{
|
|
int sigSz = 0;
|
|
|
|
if (ssl == NULL)
|
|
return 0;
|
|
|
|
switch (ssl->buffers.keyType) {
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
sigSz = ssl->buffers.keySz;
|
|
ssl->hsType = DYNAMIC_TYPE_RSA;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
sigSz = wc_ecc_sig_size_calc(ssl->buffers.keySz);
|
|
ssl->hsType = DYNAMIC_TYPE_ECC;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
case ed25519_sa_algo:
|
|
sigSz = ED25519_SIG_SIZE; /* fixed known value */
|
|
ssl->hsType = DYNAMIC_TYPE_ED25519;
|
|
break;
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
case ed448_sa_algo:
|
|
sigSz = ED448_SIG_SIZE; /* fixed known value */
|
|
ssl->hsType = DYNAMIC_TYPE_ED448;
|
|
break;
|
|
#endif
|
|
default:
|
|
break;
|
|
}
|
|
return sigSz;
|
|
}
|
|
#endif /* HAVE_PK_CALLBACKS */
|
|
|
|
#endif /* NO_CERTS */
|
|
|
|
#ifdef HAVE_ECC
|
|
/* returns the WOLFSSL_* version of the curve from the OID sum */
|
|
word16 GetCurveByOID(int oidSum) {
|
|
switch(oidSum) {
|
|
#if (defined(HAVE_ECC160) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 160
|
|
#ifndef NO_ECC_SECP
|
|
case ECC_SECP160R1_OID:
|
|
return WOLFSSL_ECC_SECP160R1;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_SECPR2
|
|
case ECC_SECP160R2_OID:
|
|
return WOLFSSL_ECC_SECP160R2;
|
|
#endif /* HAVE_ECC_SECPR2 */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case ECC_SECP160K1_OID:
|
|
return WOLFSSL_ECC_SECP160K1;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#endif
|
|
#if (defined(HAVE_ECC192) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 192
|
|
#ifndef NO_ECC_SECP
|
|
case ECC_SECP192R1_OID:
|
|
return WOLFSSL_ECC_SECP192R1;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case ECC_SECP192K1_OID:
|
|
return WOLFSSL_ECC_SECP192K1;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#endif
|
|
#if (defined(HAVE_ECC224) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 224
|
|
#ifndef NO_ECC_SECP
|
|
case ECC_SECP224R1_OID:
|
|
return WOLFSSL_ECC_SECP224R1;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case ECC_SECP224K1_OID:
|
|
return WOLFSSL_ECC_SECP224K1;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#endif
|
|
#if (!defined(NO_ECC256) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 256
|
|
#ifndef NO_ECC_SECP
|
|
case ECC_SECP256R1_OID:
|
|
return WOLFSSL_ECC_SECP256R1;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_KOBLITZ
|
|
case ECC_SECP256K1_OID:
|
|
return WOLFSSL_ECC_SECP256K1;
|
|
#endif /* HAVE_ECC_KOBLITZ */
|
|
#ifdef HAVE_ECC_BRAINPOOL
|
|
case ECC_BRAINPOOLP256R1_OID:
|
|
return WOLFSSL_ECC_BRAINPOOLP256R1;
|
|
#endif /* HAVE_ECC_BRAINPOOL */
|
|
#endif
|
|
#if (defined(HAVE_ECC384) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 384
|
|
#ifndef NO_ECC_SECP
|
|
case ECC_SECP384R1_OID:
|
|
return WOLFSSL_ECC_SECP384R1;
|
|
#endif /* !NO_ECC_SECP */
|
|
#ifdef HAVE_ECC_BRAINPOOL
|
|
case ECC_BRAINPOOLP384R1_OID:
|
|
return WOLFSSL_ECC_BRAINPOOLP384R1;
|
|
#endif /* HAVE_ECC_BRAINPOOL */
|
|
#endif
|
|
#if (defined(HAVE_ECC512) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 512
|
|
#ifdef HAVE_ECC_BRAINPOOL
|
|
case ECC_BRAINPOOLP512R1_OID:
|
|
return WOLFSSL_ECC_BRAINPOOLP512R1;
|
|
#endif /* HAVE_ECC_BRAINPOOL */
|
|
#endif
|
|
#if (defined(HAVE_ECC521) || defined(HAVE_ALL_CURVES)) && ECC_MIN_KEY_SZ <= 521
|
|
#ifndef NO_ECC_SECP
|
|
case ECC_SECP521R1_OID:
|
|
return WOLFSSL_ECC_SECP521R1;
|
|
#endif /* !NO_ECC_SECP */
|
|
#endif
|
|
default:
|
|
WOLFSSL_MSG("Curve OID not compiled in or implemented");
|
|
return 0;
|
|
}
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
/* handle generation of server_hello (2) */
|
|
int SendServerHello(WOLFSSL* ssl)
|
|
{
|
|
int ret;
|
|
byte *output;
|
|
word16 length;
|
|
word32 idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
int sendSz;
|
|
byte sessIdSz = ID_LEN;
|
|
byte echoId = 0; /* ticket echo id flag */
|
|
byte cacheOff = 0; /* session cache off flag */
|
|
|
|
WOLFSSL_START(WC_FUNC_SERVER_HELLO_SEND);
|
|
WOLFSSL_ENTER("SendServerHello");
|
|
|
|
length = VERSION_SZ + RAN_LEN
|
|
+ ID_LEN + ENUM_LEN
|
|
+ SUITE_LEN
|
|
+ ENUM_LEN;
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
ret = TLSX_GetResponseSize(ssl, server_hello, &length);
|
|
if (ret != 0)
|
|
return ret;
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->options.useTicket) {
|
|
/* echo session id sz can be 0,32 or bogus len in between */
|
|
sessIdSz = ssl->arrays->sessionIDSz;
|
|
if (sessIdSz > ID_LEN) {
|
|
WOLFSSL_MSG("Bad bogus session id len");
|
|
return BUFFER_ERROR;
|
|
}
|
|
if (!IsAtLeastTLSv1_3(ssl->version))
|
|
length -= (ID_LEN - sessIdSz); /* adjust ID_LEN assumption */
|
|
echoId = 1;
|
|
}
|
|
#endif /* HAVE_SESSION_TICKET */
|
|
#else
|
|
if (ssl->options.haveEMS) {
|
|
length += HELLO_EXT_SZ_SZ + HELLO_EXT_SZ;
|
|
}
|
|
#endif
|
|
|
|
/* is the session cache off at build or runtime */
|
|
#ifdef NO_SESSION_CACHE
|
|
cacheOff = 1;
|
|
#else
|
|
if (ssl->options.sessionCacheOff == 1) {
|
|
cacheOff = 1;
|
|
}
|
|
#endif
|
|
|
|
/* if no session cache don't send a session ID unless we're echoing
|
|
* an ID as part of session tickets */
|
|
if (echoId == 0 && cacheOff == 1) {
|
|
length -= ID_LEN; /* adjust ID_LEN assumption */
|
|
sessIdSz = 0;
|
|
}
|
|
|
|
sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
if (((ssl->keys.dtls_sequence_number_hi == ssl->keys.curSeq_hi &&
|
|
ssl->keys.dtls_sequence_number_lo < ssl->keys.curSeq_lo) ||
|
|
(ssl->keys.dtls_sequence_number_hi < ssl->keys.curSeq_hi))) {
|
|
/* Server Hello should use the same sequence number as the
|
|
* Client Hello if available. */
|
|
ssl->keys.dtls_sequence_number_hi = ssl->keys.curSeq_hi;
|
|
ssl->keys.dtls_sequence_number_lo = ssl->keys.curSeq_lo;
|
|
}
|
|
idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += MAX_MSG_EXTRA;
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, length, server_hello, ssl);
|
|
|
|
/* now write to output */
|
|
/* first version */
|
|
output[idx++] = (byte)ssl->version.major;
|
|
output[idx++] = (byte)ssl->version.minor;
|
|
|
|
/* then random and session id */
|
|
if (!ssl->options.resuming) {
|
|
/* generate random part and session id */
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, output + idx,
|
|
RAN_LEN + sizeof(sessIdSz) + sessIdSz);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (TLSv1_3_Capable(ssl)) {
|
|
/* TLS v1.3 capable server downgraded. */
|
|
XMEMCPY(output + idx + RAN_LEN - (TLS13_DOWNGRADE_SZ + 1),
|
|
tls13Downgrade, TLS13_DOWNGRADE_SZ);
|
|
output[idx + RAN_LEN - 1] = (byte)IsAtLeastTLSv1_2(ssl);
|
|
}
|
|
else
|
|
#endif
|
|
if (ssl->ctx->method->version.major == SSLv3_MAJOR &&
|
|
ssl->ctx->method->version.minor == TLSv1_2_MINOR &&
|
|
#ifdef OPENSSL_EXTRA
|
|
(wolfSSL_get_options(ssl) & SSL_OP_NO_TLSv1_2) == 0 &&
|
|
#endif
|
|
!IsAtLeastTLSv1_2(ssl)) {
|
|
/* TLS v1.2 capable server downgraded. */
|
|
XMEMCPY(output + idx + RAN_LEN - (TLS13_DOWNGRADE_SZ + 1),
|
|
tls13Downgrade, TLS13_DOWNGRADE_SZ);
|
|
output[idx + RAN_LEN - 1] = 0;
|
|
}
|
|
|
|
/* store info in SSL for later */
|
|
XMEMCPY(ssl->arrays->serverRandom, output + idx, RAN_LEN);
|
|
idx += RAN_LEN;
|
|
output[idx++] = sessIdSz;
|
|
XMEMCPY(ssl->arrays->sessionID, output + idx, sessIdSz);
|
|
ssl->arrays->sessionIDSz = sessIdSz;
|
|
}
|
|
else {
|
|
/* If resuming, use info from SSL */
|
|
XMEMCPY(output + idx, ssl->arrays->serverRandom, RAN_LEN);
|
|
idx += RAN_LEN;
|
|
output[idx++] = sessIdSz;
|
|
XMEMCPY(output + idx, ssl->arrays->sessionID, sessIdSz);
|
|
}
|
|
idx += sessIdSz;
|
|
|
|
#ifdef SHOW_SECRETS
|
|
{
|
|
int j;
|
|
printf("server random: ");
|
|
for (j = 0; j < RAN_LEN; j++)
|
|
printf("%02x", ssl->arrays->serverRandom[j]);
|
|
printf("\n");
|
|
}
|
|
#endif
|
|
|
|
/* then cipher suite */
|
|
output[idx++] = ssl->options.cipherSuite0;
|
|
output[idx++] = ssl->options.cipherSuite;
|
|
|
|
/* then compression */
|
|
if (ssl->options.usingCompression)
|
|
output[idx++] = ZLIB_COMPRESSION;
|
|
else
|
|
output[idx++] = NO_COMPRESSION;
|
|
|
|
/* last, extensions */
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
{
|
|
word16 offset = 0;
|
|
ret = TLSX_WriteResponse(ssl, output + idx, server_hello, &offset);
|
|
if (ret != 0)
|
|
return ret;
|
|
idx += offset;
|
|
}
|
|
#else
|
|
#ifdef HAVE_EXTENDED_MASTER
|
|
if (ssl->options.haveEMS) {
|
|
c16toa(HELLO_EXT_SZ, output + idx);
|
|
idx += HELLO_EXT_SZ_SZ;
|
|
|
|
c16toa(HELLO_EXT_EXTMS, output + idx);
|
|
idx += HELLO_EXT_TYPE_SZ;
|
|
c16toa(0, output + idx);
|
|
/*idx += HELLO_EXT_SZ_SZ;*/
|
|
/* idx is not used after this point. uncomment the line above
|
|
* if adding any more extensions in the future. */
|
|
}
|
|
#endif
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input;
|
|
int inputSz = idx; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz -= recordHeaderSz;
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, input, inputSz, server_hello)) != 0) {
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
return ret;
|
|
}
|
|
#endif
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
} else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, server_hello)) != 0)
|
|
return ret;
|
|
}
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
ret = HashOutput(ssl, output, sendSz, 0);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ServerHello");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "ServerHello", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
ssl->options.serverState = SERVER_HELLO_COMPLETE;
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
if (ssl->options.groupMessages)
|
|
ret = 0;
|
|
else
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendServerHello", ret);
|
|
WOLFSSL_END(WC_FUNC_SERVER_HELLO_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
#if defined(HAVE_ECC)
|
|
|
|
static byte SetCurveId(ecc_key* key)
|
|
{
|
|
if (key == NULL || key->dp == NULL) {
|
|
WOLFSSL_MSG("SetCurveId: Invalid key!");
|
|
return 0;
|
|
}
|
|
|
|
return (byte)GetCurveByOID(key->dp->oidSum);
|
|
}
|
|
|
|
#endif /* HAVE_ECC */
|
|
|
|
typedef struct SskeArgs {
|
|
byte* output; /* not allocated */
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \
|
|
!defined(NO_RSA)
|
|
byte* sigDataBuf;
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
byte* exportBuf;
|
|
#endif
|
|
#ifndef NO_RSA
|
|
byte* verifySig;
|
|
#endif
|
|
byte* input;
|
|
word32 idx;
|
|
word32 tmpSigSz;
|
|
word32 length;
|
|
word32 sigSz;
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \
|
|
!defined(NO_RSA)
|
|
word32 sigDataSz;
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
word32 exportSz;
|
|
#endif
|
|
#ifdef HAVE_QSH
|
|
word32 qshSz;
|
|
#endif
|
|
int sendSz;
|
|
int inputSz;
|
|
} SskeArgs;
|
|
|
|
static void FreeSskeArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
SskeArgs* args = (SskeArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || defined(HAVE_CURVE448)
|
|
if (args->exportBuf) {
|
|
XFREE(args->exportBuf, ssl->heap, DYNAMIC_TYPE_DER);
|
|
args->exportBuf = NULL;
|
|
}
|
|
#endif
|
|
#if defined(HAVE_ECC) || defined(HAVE_ED25519) || defined(HAVE_ED448) || \
|
|
(!defined(NO_DH) && !defined(NO_RSA))
|
|
if (args->sigDataBuf) {
|
|
XFREE(args->sigDataBuf, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
args->sigDataBuf = NULL;
|
|
}
|
|
#endif
|
|
#ifndef NO_RSA
|
|
if (args->verifySig) {
|
|
XFREE(args->verifySig, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
args->verifySig = NULL;
|
|
}
|
|
#endif
|
|
(void)args;
|
|
}
|
|
|
|
/* handle generation of server_key_exchange (12) */
|
|
int SendServerKeyExchange(WOLFSSL* ssl)
|
|
{
|
|
int ret;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
SskeArgs* args = (SskeArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#else
|
|
SskeArgs args[1];
|
|
#endif
|
|
|
|
WOLFSSL_START(WC_FUNC_SERVER_KEY_EXCHANGE_SEND);
|
|
WOLFSSL_ENTER("SendServerKeyExchange");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_sske;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(SskeArgs));
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeSskeArgs;
|
|
#endif
|
|
}
|
|
|
|
switch(ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
#ifdef HAVE_QSH
|
|
if (ssl->peerQSHKeyPresent && ssl->options.haveQSH) {
|
|
args->qshSz = QSH_KeyGetSize(ssl);
|
|
}
|
|
#endif
|
|
|
|
/* Do some checks / debug msgs */
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
WOLFSSL_MSG("Using ephemeral ECDH PSK");
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
#if defined(HAVE_ECC)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
if (ssl->specs.static_ecdh) {
|
|
WOLFSSL_MSG("Using Static ECDH, not sending "
|
|
"ServerKeyExchange");
|
|
ERROR_OUT(0, exit_sske);
|
|
}
|
|
|
|
WOLFSSL_MSG("Using ephemeral ECDH");
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
}
|
|
|
|
/* Preparing keys */
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && (!defined(NO_PSK) || !defined(NO_RSA))
|
|
#if !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
#endif
|
|
#if !defined(NO_RSA)
|
|
case diffie_hellman_kea:
|
|
#endif
|
|
{
|
|
/* Allocate DH key buffers and generate key */
|
|
if (ssl->buffers.serverDH_P.buffer == NULL ||
|
|
ssl->buffers.serverDH_G.buffer == NULL) {
|
|
ERROR_OUT(NO_DH_PARAMS, exit_sske);
|
|
}
|
|
|
|
if (ssl->buffers.serverDH_Pub.buffer == NULL) {
|
|
/* Free'd in SSL_ResourceFree and FreeHandshakeResources */
|
|
ssl->buffers.serverDH_Pub.buffer = (byte*)XMALLOC(
|
|
ssl->buffers.serverDH_P.length + OPAQUE16_LEN,
|
|
ssl->heap, DYNAMIC_TYPE_PUBLIC_KEY);
|
|
if (ssl->buffers.serverDH_Pub.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
ssl->buffers.serverDH_Pub.length =
|
|
ssl->buffers.serverDH_P.length + OPAQUE16_LEN;
|
|
}
|
|
|
|
if (ssl->buffers.serverDH_Priv.buffer == NULL) {
|
|
/* Free'd in SSL_ResourceFree and FreeHandshakeResources */
|
|
ssl->buffers.serverDH_Priv.buffer = (byte*)XMALLOC(
|
|
ssl->buffers.serverDH_P.length + OPAQUE16_LEN,
|
|
ssl->heap, DYNAMIC_TYPE_PRIVATE_KEY);
|
|
if (ssl->buffers.serverDH_Priv.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
ssl->buffers.serverDH_Priv.length =
|
|
ssl->buffers.serverDH_P.length + OPAQUE16_LEN;
|
|
}
|
|
|
|
ssl->options.dhKeySz =
|
|
(word16)ssl->buffers.serverDH_P.length;
|
|
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_DH,
|
|
(void**)&ssl->buffers.serverDH_Key);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
#if !defined(WOLFSSL_OLD_PRIME_CHECK) && \
|
|
!defined(HAVE_FIPS) && \
|
|
!defined(HAVE_SELFTEST)
|
|
if (ssl->options.dhDoKeyTest &&
|
|
!ssl->options.dhKeyTested)
|
|
{
|
|
ret = wc_DhSetCheckKey(
|
|
ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length,
|
|
NULL, 0, 0, ssl->rng);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
ssl->options.dhKeyTested = 1;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
ret = wc_DhSetKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
ret = DhGenKeyPair(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_Priv.buffer,
|
|
(word32*)&ssl->buffers.serverDH_Priv.length,
|
|
ssl->buffers.serverDH_Pub.buffer,
|
|
(word32*)&ssl->buffers.serverDH_Pub.length);
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && (!NO_PSK || !NO_RSA) */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
/* Fall through to create temp ECC key */
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
/* need ephemeral key now, create it if missing */
|
|
if (ssl->eccTempKey == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->eccTempKey);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
if (ssl->eccTempKeyPresent == 0) {
|
|
ret = X25519MakeKey(ssl,
|
|
(curve25519_key*)ssl->eccTempKey, NULL);
|
|
if (ret == 0 || ret == WC_PENDING_E) {
|
|
ssl->eccTempKeyPresent =
|
|
DYNAMIC_TYPE_CURVE25519;
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
/* need ephemeral key now, create it if missing */
|
|
if (ssl->eccTempKey == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->eccTempKey);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
if (ssl->eccTempKeyPresent == 0) {
|
|
ret = X448MakeKey(ssl,
|
|
(curve448_key*)ssl->eccTempKey, NULL);
|
|
if (ret == 0 || ret == WC_PENDING_E) {
|
|
ssl->eccTempKeyPresent =
|
|
DYNAMIC_TYPE_CURVE448;
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
/* need ephemeral key now, create it if missing */
|
|
if (ssl->eccTempKey == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->eccTempKey);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
if (ssl->eccTempKeyPresent == 0) {
|
|
ret = EccMakeKey(ssl, ssl->eccTempKey, NULL);
|
|
if (ret == 0 || ret == WC_PENDING_E) {
|
|
ssl->eccTempKeyPresent = DYNAMIC_TYPE_ECC;
|
|
}
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
default:
|
|
/* Skip ServerKeyExchange */
|
|
goto exit_sske;
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* case TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
#if (!defined(NO_DH) && !defined(NO_RSA)) || (defined(HAVE_ECC) || \
|
|
defined(HAVE_CURVE25519) || defined(HAVE_CURVE448))
|
|
word32 preSigSz, preSigIdx;
|
|
#endif
|
|
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
|
|
if (ssl->arrays->server_hint[0] == 0) {
|
|
ERROR_OUT(0, exit_sske); /* don't send */
|
|
}
|
|
|
|
/* include size part */
|
|
args->length = (word32)XSTRLEN(ssl->arrays->server_hint);
|
|
if (args->length > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(SERVER_HINT_ERROR, exit_sske);
|
|
}
|
|
|
|
args->length += HINT_LEN_SZ;
|
|
args->sendSz = args->length + HANDSHAKE_HEADER_SZ +
|
|
RECORD_HEADER_SZ;
|
|
|
|
#ifdef HAVE_QSH
|
|
args->length += args->qshSz;
|
|
args->sendSz += args->qshSz;
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
args->idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(args->output, args->length,
|
|
server_key_exchange, ssl);
|
|
|
|
/* key data */
|
|
#ifdef HAVE_QSH
|
|
c16toa((word16)(args->length - args->qshSz -
|
|
HINT_LEN_SZ), args->output + args->idx);
|
|
#else
|
|
c16toa((word16)(args->length - HINT_LEN_SZ),
|
|
args->output + args->idx);
|
|
#endif
|
|
|
|
args->idx += HINT_LEN_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->arrays->server_hint,
|
|
args->length - HINT_LEN_SZ);
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
word32 hintLen;
|
|
|
|
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
args->length = LENGTH_SZ * 3 + /* p, g, pub */
|
|
ssl->buffers.serverDH_P.length +
|
|
ssl->buffers.serverDH_G.length +
|
|
ssl->buffers.serverDH_Pub.length;
|
|
|
|
/* include size part */
|
|
hintLen = (word32)XSTRLEN(ssl->arrays->server_hint);
|
|
if (hintLen > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(SERVER_HINT_ERROR, exit_sske);
|
|
}
|
|
args->length += hintLen + HINT_LEN_SZ;
|
|
args->sendSz = args->length + HANDSHAKE_HEADER_SZ +
|
|
RECORD_HEADER_SZ;
|
|
|
|
#ifdef HAVE_QSH
|
|
args->length += args->qshSz;
|
|
args->sendSz += args->qshSz;
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
args->idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(args->output, args->length,
|
|
server_key_exchange, ssl);
|
|
|
|
/* key data */
|
|
c16toa((word16)hintLen, args->output + args->idx);
|
|
args->idx += HINT_LEN_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->arrays->server_hint, hintLen);
|
|
args->idx += hintLen;
|
|
|
|
/* add p, g, pub */
|
|
c16toa((word16)ssl->buffers.serverDH_P.length,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length);
|
|
args->idx += ssl->buffers.serverDH_P.length;
|
|
|
|
/* g */
|
|
c16toa((word16)ssl->buffers.serverDH_G.length,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
args->idx += ssl->buffers.serverDH_G.length;
|
|
|
|
/* pub */
|
|
c16toa((word16)ssl->buffers.serverDH_Pub.length,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->buffers.serverDH_Pub.buffer,
|
|
ssl->buffers.serverDH_Pub.length);
|
|
/* No need to update idx, since sizes are already set */
|
|
/* args->idx += ssl->buffers.serverDH_Pub.length; */
|
|
break;
|
|
}
|
|
#endif /* !defined(NO_DH) && !defined(NO_PSK) */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
word32 hintLen;
|
|
|
|
/* curve type, named curve, length(1) */
|
|
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
args->length = ENUM_LEN + CURVE_LEN + ENUM_LEN;
|
|
|
|
args->exportSz = MAX_EXPORT_ECC_SZ;
|
|
args->exportBuf = (byte*)XMALLOC(args->exportSz,
|
|
ssl->heap, DYNAMIC_TYPE_DER);
|
|
if (args->exportBuf == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
if (wc_curve25519_export_public_ex(
|
|
(curve25519_key*)ssl->eccTempKey,
|
|
args->exportBuf, &args->exportSz,
|
|
EC25519_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_sske);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
if (wc_curve448_export_public_ex(
|
|
(curve448_key*)ssl->eccTempKey,
|
|
args->exportBuf, &args->exportSz,
|
|
EC448_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_sske);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
if (wc_ecc_export_x963(ssl->eccTempKey,
|
|
args->exportBuf, &args->exportSz) != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_sske);
|
|
}
|
|
}
|
|
args->length += args->exportSz;
|
|
|
|
/* include size part */
|
|
hintLen = (word32)XSTRLEN(ssl->arrays->server_hint);
|
|
if (hintLen > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(SERVER_HINT_ERROR, exit_sske);
|
|
}
|
|
args->length += hintLen + HINT_LEN_SZ;
|
|
args->sendSz = args->length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
|
|
|
|
#ifdef HAVE_QSH
|
|
args->length += args->qshSz;
|
|
args->sendSz += args->qshSz;
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
args->idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
/* key data */
|
|
c16toa((word16)hintLen, args->output + args->idx);
|
|
args->idx += HINT_LEN_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->arrays->server_hint, hintLen);
|
|
args->idx += hintLen;
|
|
|
|
/* ECC key exchange data */
|
|
args->output[args->idx++] = named_curve;
|
|
args->output[args->idx++] = 0x00; /* leading zero */
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID)
|
|
args->output[args->idx++] = WOLFSSL_ECC_X25519;
|
|
else
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID)
|
|
args->output[args->idx++] = WOLFSSL_ECC_X448;
|
|
else
|
|
#endif
|
|
{
|
|
#ifdef HAVE_ECC
|
|
args->output[args->idx++] =
|
|
SetCurveId(ssl->eccTempKey);
|
|
#endif
|
|
}
|
|
args->output[args->idx++] = (byte)args->exportSz;
|
|
XMEMCPY(args->output + args->idx, args->exportBuf,
|
|
args->exportSz);
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
enum wc_HashType hashType;
|
|
|
|
/* curve type, named curve, length(1) */
|
|
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
args->length = ENUM_LEN + CURVE_LEN + ENUM_LEN;
|
|
|
|
/* Export temp ECC key and add to length */
|
|
args->exportSz = MAX_EXPORT_ECC_SZ;
|
|
args->exportBuf = (byte*)XMALLOC(args->exportSz,
|
|
ssl->heap, DYNAMIC_TYPE_DER);
|
|
if (args->exportBuf == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
if (wc_curve25519_export_public_ex(
|
|
(curve25519_key*)ssl->eccTempKey,
|
|
args->exportBuf, &args->exportSz,
|
|
EC25519_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_sske);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
if (wc_curve448_export_public_ex(
|
|
(curve448_key*)ssl->eccTempKey,
|
|
args->exportBuf, &args->exportSz,
|
|
EC448_LITTLE_ENDIAN) != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_sske);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
#if defined(HAVE_ECC) && defined(HAVE_ECC_KEY_EXPORT)
|
|
if (wc_ecc_export_x963(ssl->eccTempKey,
|
|
args->exportBuf, &args->exportSz) != 0) {
|
|
ERROR_OUT(ECC_EXPORT_ERROR, exit_sske);
|
|
}
|
|
#endif
|
|
}
|
|
args->length += args->exportSz;
|
|
|
|
preSigSz = args->length;
|
|
preSigIdx = args->idx;
|
|
|
|
if (ssl->buffers.key == NULL) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (wolfSSL_CTX_IsPrivatePkSet(ssl->ctx)) {
|
|
args->tmpSigSz = GetPrivateKeySigSize(ssl);
|
|
if (args->tmpSigSz == 0) {
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_sske);
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_sske);
|
|
}
|
|
else {
|
|
switch(ssl->suites->sigAlgo) {
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
word16 keySz;
|
|
|
|
ssl->buffers.keyType = rsa_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
args->tmpSigSz = (word32)keySz;
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
{
|
|
word16 keySz;
|
|
|
|
ssl->buffers.keyType = ecc_dsa_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
/* worst case estimate */
|
|
args->tmpSigSz = keySz;
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ED25519
|
|
case ed25519_sa_algo:
|
|
{
|
|
word16 keySz;
|
|
|
|
ssl->buffers.keyType = ed25519_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* worst case estimate */
|
|
args->tmpSigSz = ED25519_SIG_SIZE;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_ED448
|
|
case ed448_sa_algo:
|
|
{
|
|
word16 keySz;
|
|
|
|
ssl->buffers.keyType = ed448_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* worst case estimate */
|
|
args->tmpSigSz = ED448_SIG_SIZE;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ED448 */
|
|
default:
|
|
ERROR_OUT(ALGO_ID_E, exit_sske); /* unsupported type */
|
|
} /* switch(ssl->specs.sig_algo) */
|
|
}
|
|
|
|
/* sig length */
|
|
args->length += LENGTH_SZ;
|
|
args->length += args->tmpSigSz;
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
args->length += HASH_SIG_SIZE;
|
|
}
|
|
|
|
args->sendSz = args->length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
|
|
|
|
#ifdef HAVE_QSH
|
|
args->length += args->qshSz;
|
|
args->sendSz += args->qshSz;
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
args->idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
preSigIdx = args->idx;
|
|
}
|
|
#endif
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
/* record and message headers will be added below, when we're sure
|
|
of the sig length */
|
|
|
|
/* key exchange data */
|
|
args->output[args->idx++] = named_curve;
|
|
args->output[args->idx++] = 0x00; /* leading zero */
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID)
|
|
args->output[args->idx++] = WOLFSSL_ECC_X25519;
|
|
else
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID)
|
|
args->output[args->idx++] = WOLFSSL_ECC_X448;
|
|
else
|
|
#endif
|
|
{
|
|
#ifdef HAVE_ECC
|
|
args->output[args->idx++] =
|
|
SetCurveId(ssl->eccTempKey);
|
|
#endif
|
|
}
|
|
args->output[args->idx++] = (byte)args->exportSz;
|
|
XMEMCPY(args->output + args->idx, args->exportBuf, args->exportSz);
|
|
args->idx += args->exportSz;
|
|
|
|
/* Determine hash type */
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
EncodeSigAlg(ssl->suites->hashAlgo,
|
|
ssl->suites->sigAlgo,
|
|
&args->output[args->idx]);
|
|
args->idx += 2;
|
|
|
|
hashType = HashAlgoToType(ssl->suites->hashAlgo);
|
|
if (hashType == WC_HASH_TYPE_NONE) {
|
|
ERROR_OUT(ALGO_ID_E, exit_sske);
|
|
}
|
|
|
|
} else {
|
|
/* only using sha and md5 for rsa */
|
|
#ifndef NO_OLD_TLS
|
|
hashType = WC_HASH_TYPE_SHA;
|
|
if (ssl->suites->sigAlgo == rsa_sa_algo) {
|
|
hashType = WC_HASH_TYPE_MD5_SHA;
|
|
}
|
|
#else
|
|
ERROR_OUT(ALGO_ID_E, exit_sske);
|
|
#endif
|
|
}
|
|
|
|
/* Signature length will be written later, when we're sure what it is */
|
|
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb) {
|
|
ssl->fuzzerCb(ssl, args->output + preSigIdx,
|
|
preSigSz, FUZZ_SIGNATURE, ssl->fuzzerCtx);
|
|
}
|
|
#endif
|
|
|
|
/* Assemble buffer to hash for signature */
|
|
args->sigDataSz = RAN_LEN + RAN_LEN + preSigSz;
|
|
args->sigDataBuf = (byte*)XMALLOC(args->sigDataSz,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (args->sigDataBuf == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
XMEMCPY(args->sigDataBuf, ssl->arrays->clientRandom,
|
|
RAN_LEN);
|
|
XMEMCPY(args->sigDataBuf+RAN_LEN,
|
|
ssl->arrays->serverRandom, RAN_LEN);
|
|
XMEMCPY(args->sigDataBuf+RAN_LEN+RAN_LEN,
|
|
args->output + preSigIdx, preSigSz);
|
|
|
|
if (ssl->suites->sigAlgo != ed25519_sa_algo &&
|
|
ssl->suites->sigAlgo != ed448_sa_algo) {
|
|
ssl->buffers.sig.length =
|
|
wc_HashGetDigestSize(hashType);
|
|
if ((int)ssl->buffers.sig.length < 0) {
|
|
ERROR_OUT(HASH_TYPE_E, exit_sske);
|
|
}
|
|
ssl->buffers.sig.buffer = (byte*)XMALLOC(
|
|
ssl->buffers.sig.length,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (ssl->buffers.sig.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
|
|
/* Perform hash */
|
|
ret = wc_Hash(hashType, args->sigDataBuf,
|
|
args->sigDataSz,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
args->sigSz = args->tmpSigSz;
|
|
|
|
/* Sign hash to create signature */
|
|
switch (ssl->suites->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
case rsa_sa_algo:
|
|
{
|
|
/* For TLS 1.2 re-encode signature */
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
byte* encodedSig = (byte*)XMALLOC(
|
|
MAX_ENCODED_SIG_SZ, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
if (encodedSig == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
|
|
ssl->buffers.sig.length =
|
|
wc_EncodeSignature(encodedSig,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
TypeHash(ssl->suites->hashAlgo));
|
|
|
|
/* Replace sig buffer with new one */
|
|
XFREE(ssl->buffers.sig.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
ssl->buffers.sig.buffer = encodedSig;
|
|
}
|
|
|
|
/* write sig size here */
|
|
c16toa((word16)args->sigSz,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
break;
|
|
}
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
/* write sig size here */
|
|
c16toa((word16)args->sigSz,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
break;
|
|
#endif
|
|
#endif /* !NO_RSA */
|
|
case ecc_dsa_sa_algo:
|
|
{
|
|
break;
|
|
}
|
|
#ifdef HAVE_ED25519
|
|
case ed25519_sa_algo:
|
|
ret = Ed25519CheckPubKey(ssl);
|
|
if (ret != 0)
|
|
goto exit_sske;
|
|
break;
|
|
#endif /* HAVE_ED25519 */
|
|
#ifdef HAVE_ED448
|
|
case ed448_sa_algo:
|
|
ret = Ed448CheckPubKey(ssl);
|
|
if (ret != 0)
|
|
goto exit_sske;
|
|
break;
|
|
#endif /* HAVE_ED448 */
|
|
} /* switch(ssl->specs.sig_algo) */
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#if !defined(NO_DH) && !defined(NO_RSA)
|
|
case diffie_hellman_kea:
|
|
{
|
|
enum wc_HashType hashType;
|
|
|
|
args->idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
args->length = LENGTH_SZ * 3; /* p, g, pub */
|
|
args->length += ssl->buffers.serverDH_P.length +
|
|
ssl->buffers.serverDH_G.length +
|
|
ssl->buffers.serverDH_Pub.length;
|
|
|
|
preSigIdx = args->idx;
|
|
preSigSz = args->length;
|
|
|
|
if (!ssl->options.usingAnon_cipher) {
|
|
word16 keySz;
|
|
|
|
/* sig length */
|
|
args->length += LENGTH_SZ;
|
|
|
|
if (ssl->buffers.key == NULL) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
if (wolfSSL_CTX_IsPrivatePkSet(ssl->ctx))
|
|
keySz = (word32)GetPrivateKeySigSize(ssl);
|
|
else
|
|
#endif
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_sske);
|
|
}
|
|
else
|
|
{
|
|
if (ssl->buffers.keyType == 0)
|
|
ssl->buffers.keyType = rsa_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
if (keySz == 0) { /* test if keySz has error */
|
|
ERROR_OUT(keySz, exit_sske);
|
|
}
|
|
|
|
args->tmpSigSz = (word32)keySz;
|
|
args->length += args->tmpSigSz;
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
args->length += HASH_SIG_SIZE;
|
|
}
|
|
}
|
|
|
|
args->sendSz = args->length + HANDSHAKE_HEADER_SZ +
|
|
RECORD_HEADER_SZ;
|
|
|
|
#ifdef HAVE_QSH
|
|
args->length += args->qshSz;
|
|
args->sendSz += args->qshSz;
|
|
#endif
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
args->sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
args->idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
preSigIdx = args->idx;
|
|
}
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, args->sendSz)) != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* get output buffer */
|
|
args->output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(args->output, args->length,
|
|
server_key_exchange, ssl);
|
|
|
|
/* add p, g, pub */
|
|
c16toa((word16)ssl->buffers.serverDH_P.length,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length);
|
|
args->idx += ssl->buffers.serverDH_P.length;
|
|
|
|
/* g */
|
|
c16toa((word16)ssl->buffers.serverDH_G.length,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
args->idx += ssl->buffers.serverDH_G.length;
|
|
|
|
/* pub */
|
|
c16toa((word16)ssl->buffers.serverDH_Pub.length,
|
|
args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
XMEMCPY(args->output + args->idx,
|
|
ssl->buffers.serverDH_Pub.buffer,
|
|
ssl->buffers.serverDH_Pub.length);
|
|
args->idx += ssl->buffers.serverDH_Pub.length;
|
|
|
|
#ifdef HAVE_FUZZER
|
|
if (ssl->fuzzerCb) {
|
|
ssl->fuzzerCb(ssl, args->output + preSigIdx,
|
|
preSigSz, FUZZ_SIGNATURE, ssl->fuzzerCtx);
|
|
}
|
|
#endif
|
|
|
|
if (ssl->options.usingAnon_cipher) {
|
|
break;
|
|
}
|
|
|
|
/* Determine hash type */
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
EncodeSigAlg(ssl->suites->hashAlgo,
|
|
ssl->suites->sigAlgo,
|
|
&args->output[args->idx]);
|
|
args->idx += 2;
|
|
|
|
hashType = HashAlgoToType(ssl->suites->hashAlgo);
|
|
if (hashType == WC_HASH_TYPE_NONE) {
|
|
ERROR_OUT(ALGO_ID_E, exit_sske);
|
|
}
|
|
} else {
|
|
/* only using sha and md5 for rsa */
|
|
#ifndef NO_OLD_TLS
|
|
hashType = WC_HASH_TYPE_SHA;
|
|
if (ssl->suites->sigAlgo == rsa_sa_algo) {
|
|
hashType = WC_HASH_TYPE_MD5_SHA;
|
|
}
|
|
#else
|
|
ERROR_OUT(ALGO_ID_E, exit_sske);
|
|
#endif
|
|
}
|
|
|
|
/* signature size */
|
|
c16toa((word16)args->tmpSigSz, args->output + args->idx);
|
|
args->idx += LENGTH_SZ;
|
|
|
|
/* Assemble buffer to hash for signature */
|
|
args->sigDataSz = RAN_LEN + RAN_LEN + preSigSz;
|
|
args->sigDataBuf = (byte*)XMALLOC(args->sigDataSz,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (args->sigDataBuf == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
XMEMCPY(args->sigDataBuf, ssl->arrays->clientRandom,
|
|
RAN_LEN);
|
|
XMEMCPY(args->sigDataBuf+RAN_LEN,
|
|
ssl->arrays->serverRandom, RAN_LEN);
|
|
XMEMCPY(args->sigDataBuf+RAN_LEN+RAN_LEN,
|
|
args->output + preSigIdx, preSigSz);
|
|
|
|
if (ssl->suites->sigAlgo != ed25519_sa_algo &&
|
|
ssl->suites->sigAlgo != ed448_sa_algo) {
|
|
ssl->buffers.sig.length =
|
|
wc_HashGetDigestSize(hashType);
|
|
ssl->buffers.sig.buffer = (byte*)XMALLOC(
|
|
ssl->buffers.sig.length, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
if (ssl->buffers.sig.buffer == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
|
|
/* Perform hash */
|
|
ret = wc_Hash(hashType, args->sigDataBuf,
|
|
args->sigDataSz,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
args->sigSz = args->tmpSigSz;
|
|
|
|
/* Sign hash to create signature */
|
|
switch (ssl->suites->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
case rsa_sa_algo:
|
|
{
|
|
/* For TLS 1.2 re-encode signature */
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
byte* encodedSig = (byte*)XMALLOC(
|
|
MAX_ENCODED_SIG_SZ, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
if (encodedSig == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
|
|
ssl->buffers.sig.length =
|
|
wc_EncodeSignature(encodedSig,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
TypeHash(ssl->suites->hashAlgo));
|
|
|
|
/* Replace sig buffer with new one */
|
|
XFREE(ssl->buffers.sig.buffer, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
ssl->buffers.sig.buffer = encodedSig;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* NO_RSA */
|
|
} /* switch (ssl->suites->sigAlgo) */
|
|
break;
|
|
}
|
|
#endif /* !defined(NO_DH) && !defined(NO_RSA) */
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* case TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !defined(NO_DH) && !defined(NO_PSK) */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
/* Sign hash to create signature */
|
|
switch (ssl->suites->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
ret = RsaSign(ssl,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
args->output + args->idx,
|
|
&args->sigSz,
|
|
ssl->suites->sigAlgo, ssl->suites->hashAlgo,
|
|
key,
|
|
ssl->buffers.key
|
|
);
|
|
break;
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
case ecc_dsa_sa_algo:
|
|
{
|
|
ecc_key* key = (ecc_key*)ssl->hsKey;
|
|
|
|
ret = EccSign(ssl,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
args->output + LENGTH_SZ + args->idx,
|
|
&args->sigSz,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#ifdef HAVE_ED25519
|
|
case ed25519_sa_algo:
|
|
{
|
|
ed25519_key* key = (ed25519_key*)ssl->hsKey;
|
|
|
|
ret = Ed25519Sign(ssl,
|
|
args->sigDataBuf, args->sigDataSz,
|
|
args->output + LENGTH_SZ + args->idx,
|
|
&args->sigSz,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
case ed448_sa_algo:
|
|
{
|
|
ed448_key* key = (ed448_key*)ssl->hsKey;
|
|
|
|
ret = Ed448Sign(ssl,
|
|
args->sigDataBuf, args->sigDataSz,
|
|
args->output + LENGTH_SZ + args->idx,
|
|
&args->sigSz,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
break;
|
|
}
|
|
#endif
|
|
} /* switch(ssl->specs.sig_algo) */
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#if !defined(NO_DH) && !defined(NO_RSA)
|
|
case diffie_hellman_kea:
|
|
{
|
|
/* Sign hash to create signature */
|
|
switch (ssl->suites->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
if (ssl->options.usingAnon_cipher) {
|
|
break;
|
|
}
|
|
|
|
ret = RsaSign(ssl,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
args->output + args->idx,
|
|
&args->sigSz,
|
|
ssl->suites->sigAlgo, ssl->suites->hashAlgo,
|
|
key,
|
|
ssl->buffers.key
|
|
);
|
|
break;
|
|
}
|
|
#endif /* NO_RSA */
|
|
} /* switch (ssl->suites->sigAlgo) */
|
|
|
|
break;
|
|
}
|
|
#endif /* !defined(NO_DH) && !defined(NO_RSA) */
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* case TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
switch(ssl->specs.kea)
|
|
{
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
#endif /* !defined(NO_DH) && !defined(NO_PSK) */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
/* Nothing to do in this sub-state */
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
switch(ssl->suites->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifdef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
if (args->verifySig == NULL) {
|
|
if (args->sigSz == 0) {
|
|
ERROR_OUT(BAD_COND_E, exit_sske);
|
|
}
|
|
args->verifySig = (byte*)XMALLOC(
|
|
args->sigSz, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
if (!args->verifySig) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
XMEMCPY(args->verifySig,
|
|
args->output + args->idx, args->sigSz);
|
|
}
|
|
|
|
/* check for signature faults */
|
|
ret = VerifyRsaSign(ssl,
|
|
args->verifySig, args->sigSz,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
ssl->suites->sigAlgo, ssl->suites->hashAlgo,
|
|
key, ssl->buffers.key
|
|
);
|
|
break;
|
|
}
|
|
#endif
|
|
case ecc_dsa_sa_algo:
|
|
#ifdef HAVE_ED25519
|
|
case ed25519_sa_algo:
|
|
#endif
|
|
#ifdef HAVE_ED448
|
|
case ed448_sa_algo:
|
|
#endif
|
|
{
|
|
/* Now that we know the real sig size, write it. */
|
|
c16toa((word16)args->sigSz,
|
|
args->output + args->idx);
|
|
|
|
/* And adjust length and sendSz from estimates */
|
|
args->length += args->sigSz - args->tmpSigSz;
|
|
args->sendSz += args->sigSz - args->tmpSigSz;
|
|
break;
|
|
}
|
|
default:
|
|
ERROR_OUT(ALGO_ID_E, exit_sske); /* unsupported type */
|
|
} /* switch(ssl->specs.sig_algo) */
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#if !defined(NO_DH) && !defined(NO_RSA)
|
|
case diffie_hellman_kea:
|
|
{
|
|
switch (ssl->suites->sigAlgo)
|
|
{
|
|
#ifndef NO_RSA
|
|
#ifndef WC_RSA_PSS
|
|
case rsa_pss_sa_algo:
|
|
#endif
|
|
case rsa_sa_algo:
|
|
{
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
if (ssl->options.usingAnon_cipher) {
|
|
break;
|
|
}
|
|
|
|
if (args->verifySig == NULL) {
|
|
if (args->sigSz == 0) {
|
|
ERROR_OUT(BAD_COND_E, exit_sske);
|
|
}
|
|
args->verifySig = (byte*)XMALLOC(
|
|
args->sigSz, ssl->heap,
|
|
DYNAMIC_TYPE_SIGNATURE);
|
|
if (!args->verifySig) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
XMEMCPY(args->verifySig,
|
|
args->output + args->idx, args->sigSz);
|
|
}
|
|
|
|
/* check for signature faults */
|
|
ret = VerifyRsaSign(ssl,
|
|
args->verifySig, args->sigSz,
|
|
ssl->buffers.sig.buffer,
|
|
ssl->buffers.sig.length,
|
|
ssl->suites->sigAlgo, ssl->suites->hashAlgo,
|
|
key, ssl->buffers.key
|
|
);
|
|
break;
|
|
}
|
|
#endif
|
|
} /* switch (ssl->suites->sigAlgo) */
|
|
break;
|
|
}
|
|
#endif /* !defined(NO_DH) && !defined(NO_RSA) */
|
|
} /* switch(ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* case TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
#ifdef HAVE_QSH
|
|
if (ssl->peerQSHKeyPresent) {
|
|
if (args->qshSz > 0) {
|
|
args->idx = args->sendSz - args->qshSz;
|
|
if (QSH_KeyExchangeWrite(ssl, 1) != 0) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
|
|
/* extension type */
|
|
c16toa(TLSX_QUANTUM_SAFE_HYBRID,
|
|
args->output + args->idx);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
/* write to output and check amount written */
|
|
if (TLSX_QSHPK_Write(ssl->QSH_secret->list,
|
|
args->output + args->idx) >
|
|
args->qshSz - OPAQUE16_LEN) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
if (ssl->specs.kea == ecdhe_psk_kea ||
|
|
ssl->specs.kea == ecc_diffie_hellman_kea) {
|
|
/* Check output to make sure it was set */
|
|
if (args->output) {
|
|
AddHeaders(args->output, args->length,
|
|
server_key_exchange, ssl);
|
|
}
|
|
else {
|
|
ERROR_OUT(BUFFER_ERROR, exit_sske);
|
|
}
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
args->inputSz = args->length + HANDSHAKE_HEADER_SZ;
|
|
if (ssl->options.dtls)
|
|
args->inputSz += DTLS_HANDSHAKE_EXTRA;
|
|
args->input = (byte*)XMALLOC(args->inputSz, ssl->heap,
|
|
DYNAMIC_TYPE_IN_BUFFER);
|
|
if (args->input == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_sske);
|
|
}
|
|
|
|
if (args->output == NULL) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_sske);
|
|
}
|
|
|
|
if (!ssl->options.dtls)
|
|
XMEMCPY(args->input, args->output + RECORD_HEADER_SZ,
|
|
args->inputSz);
|
|
else
|
|
XMEMCPY(args->input, args->output + DTLS_RECORD_HEADER_SZ,
|
|
args->inputSz);
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, args->input, args->inputSz, server_key_exchange))
|
|
!= 0) {
|
|
goto exit_sske;
|
|
}
|
|
#endif
|
|
ret = BuildMessage(ssl, args->output, args->sendSz,
|
|
args->input, args->inputSz, handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(args->input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
args->input = NULL;
|
|
/* make sure its not double free'd on cleanup */
|
|
|
|
if (ret >= 0) {
|
|
args->sendSz = ret;
|
|
ret = 0;
|
|
}
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl,
|
|
args->output, args->sendSz, server_key_exchange)) != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
|
|
ret = HashOutput(ssl, args->output, args->sendSz, 0);
|
|
if (ret != 0) {
|
|
goto exit_sske;
|
|
}
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn) {
|
|
AddPacketName(ssl, "ServerKeyExchange");
|
|
}
|
|
if (ssl->toInfoOn) {
|
|
AddPacketInfo(ssl, "ServerKeyExchange", handshake,
|
|
args->output, args->sendSz, WRITE_PROTO, ssl->heap);
|
|
}
|
|
#endif
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* case TLS_ASYNC_FINALIZE */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
ssl->buffers.outputBuffer.length += args->sendSz;
|
|
if (!ssl->options.groupMessages) {
|
|
ret = SendBuffered(ssl);
|
|
}
|
|
|
|
ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
|
|
break;
|
|
}
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_sske:
|
|
|
|
WOLFSSL_LEAVE("SendServerKeyExchange", ret);
|
|
WOLFSSL_END(WC_FUNC_SERVER_KEY_EXCHANGE_SEND);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* Handle async operation */
|
|
if (ret == WC_PENDING_E)
|
|
return ret;
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* Final cleanup */
|
|
if (args->input != NULL) {
|
|
XFREE(args->input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
args->input = NULL;
|
|
}
|
|
FreeSskeArgs(ssl, args);
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#if defined(HAVE_SERVER_RENEGOTIATION_INFO) || defined(HAVE_FALLBACK_SCSV) || \
|
|
defined(OPENSSL_ALL)
|
|
|
|
/* search suites for specific one, idx on success, negative on error */
|
|
#ifndef WOLFSSL_TLS13
|
|
static
|
|
#endif
|
|
int FindSuite(Suites* suites, byte first, byte second)
|
|
{
|
|
int i;
|
|
|
|
if (suites == NULL || suites->suiteSz == 0) {
|
|
WOLFSSL_MSG("Suites pointer error or suiteSz 0");
|
|
return SUITES_ERROR;
|
|
}
|
|
|
|
for (i = 0; i < suites->suiteSz-1; i += SUITE_LEN) {
|
|
if (suites->suites[i] == first &&
|
|
suites->suites[i+1] == second )
|
|
return i;
|
|
}
|
|
|
|
return MATCH_SUITE_ERROR;
|
|
}
|
|
|
|
#endif
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
/* Make sure server cert/key are valid for this suite, true on success */
|
|
static int VerifyServerSuite(WOLFSSL* ssl, word16 idx)
|
|
{
|
|
int haveRSA = !ssl->options.haveStaticECC;
|
|
int havePSK = 0;
|
|
byte first;
|
|
byte second;
|
|
|
|
WOLFSSL_ENTER("VerifyServerSuite");
|
|
|
|
if (ssl->suites == NULL) {
|
|
WOLFSSL_MSG("Suites pointer error");
|
|
return 0;
|
|
}
|
|
|
|
first = ssl->suites->suites[idx];
|
|
second = ssl->suites->suites[idx+1];
|
|
|
|
#ifndef NO_PSK
|
|
havePSK = ssl->options.havePSK;
|
|
#endif
|
|
|
|
if (ssl->options.haveNTRU)
|
|
haveRSA = 0;
|
|
|
|
if (CipherRequires(first, second, REQUIRES_RSA)) {
|
|
WOLFSSL_MSG("Requires RSA");
|
|
if (haveRSA == 0) {
|
|
WOLFSSL_MSG("Don't have RSA");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
if (CipherRequires(first, second, REQUIRES_DHE)) {
|
|
WOLFSSL_MSG("Requires DHE");
|
|
if (ssl->options.haveDH == 0) {
|
|
WOLFSSL_MSG("Don't have DHE");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
if (CipherRequires(first, second, REQUIRES_ECC)) {
|
|
WOLFSSL_MSG("Requires ECC");
|
|
if (ssl->options.haveECC == 0) {
|
|
WOLFSSL_MSG("Don't have ECC");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
if (CipherRequires(first, second, REQUIRES_ECC_STATIC)) {
|
|
WOLFSSL_MSG("Requires static ECC");
|
|
if (ssl->options.haveStaticECC == 0) {
|
|
WOLFSSL_MSG("Don't have static ECC");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
if (CipherRequires(first, second, REQUIRES_PSK)) {
|
|
WOLFSSL_MSG("Requires PSK");
|
|
if (havePSK == 0) {
|
|
WOLFSSL_MSG("Don't have PSK");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
if (CipherRequires(first, second, REQUIRES_NTRU)) {
|
|
WOLFSSL_MSG("Requires NTRU");
|
|
if (ssl->options.haveNTRU == 0) {
|
|
WOLFSSL_MSG("Don't have NTRU");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
if (CipherRequires(first, second, REQUIRES_RSA_SIG)) {
|
|
WOLFSSL_MSG("Requires RSA Signature");
|
|
if (ssl->options.side == WOLFSSL_SERVER_END &&
|
|
ssl->options.haveECDSAsig == 1) {
|
|
WOLFSSL_MSG("Don't have RSA Signature");
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
#if !defined(WOLFSSL_OLDTLS_AEAD_CIPHERSUITES)
|
|
if (CipherRequires(first, second, REQUIRES_AEAD)) {
|
|
WOLFSSL_MSG("Requires AEAD");
|
|
if (ssl->version.major == SSLv3_MAJOR &&
|
|
ssl->version.minor < TLSv1_2_MINOR) {
|
|
WOLFSSL_MSG("Version of SSL does not support AEAD ciphers");
|
|
return 0;
|
|
}
|
|
|
|
}
|
|
#endif
|
|
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && defined(HAVE_SUPPORTED_CURVES)
|
|
if (!TLSX_ValidateSupportedCurves(ssl, first, second)) {
|
|
WOLFSSL_MSG("Don't have matching curves");
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
/* ECCDHE is always supported if ECC on */
|
|
|
|
#ifdef HAVE_QSH
|
|
/* need to negotiate a classic suite in addition to TLS_QSH */
|
|
if (first == QSH_BYTE && second == TLS_QSH) {
|
|
if (TLSX_SupportExtensions(ssl)) {
|
|
ssl->options.haveQSH = 1; /* matched TLS_QSH */
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Version of SSL connection does not support "
|
|
"TLS_QSH");
|
|
}
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_TLS13
|
|
if (IsAtLeastTLSv1_3(ssl->version) &&
|
|
ssl->options.side == WOLFSSL_SERVER_END) {
|
|
#ifdef HAVE_SUPPORTED_CURVES
|
|
/* Try to establish a key share. */
|
|
int ret = TLSX_KeyShare_Establish(ssl);
|
|
if (ret == KEY_SHARE_ERROR)
|
|
ssl->options.serverState = SERVER_HELLO_RETRY_REQUEST_COMPLETE;
|
|
else if (ret != 0)
|
|
return 0;
|
|
#endif
|
|
}
|
|
else if (first == TLS13_BYTE || (first == ECC_BYTE &&
|
|
(second == TLS_SHA256_SHA256 || second == TLS_SHA384_SHA384))) {
|
|
/* Can't negotiate TLS 1.3 cipher suites with lower protocol
|
|
* version. */
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
return 1;
|
|
}
|
|
|
|
#ifndef NO_WOLFSSL_SERVER
|
|
static int CompareSuites(WOLFSSL* ssl, Suites* peerSuites, word16 i,
|
|
word16 j)
|
|
{
|
|
if (ssl->suites->suites[i] == peerSuites->suites[j] &&
|
|
ssl->suites->suites[i+1] == peerSuites->suites[j+1] ) {
|
|
|
|
if (VerifyServerSuite(ssl, i)) {
|
|
int result;
|
|
WOLFSSL_MSG("Verified suite validity");
|
|
ssl->options.cipherSuite0 = ssl->suites->suites[i];
|
|
ssl->options.cipherSuite = ssl->suites->suites[i+1];
|
|
result = SetCipherSpecs(ssl);
|
|
if (result == 0) {
|
|
result = PickHashSigAlgo(ssl, peerSuites->hashSigAlgo,
|
|
peerSuites->hashSigAlgoSz);
|
|
}
|
|
return result;
|
|
}
|
|
else {
|
|
WOLFSSL_MSG("Could not verify suite validity, continue");
|
|
}
|
|
}
|
|
|
|
return MATCH_SUITE_ERROR;
|
|
}
|
|
|
|
int MatchSuite(WOLFSSL* ssl, Suites* peerSuites)
|
|
{
|
|
int ret;
|
|
word16 i, j;
|
|
|
|
WOLFSSL_ENTER("MatchSuite");
|
|
|
|
/* & 0x1 equivalent % 2 */
|
|
if (peerSuites->suiteSz == 0 || peerSuites->suiteSz & 0x1)
|
|
return BUFFER_ERROR;
|
|
|
|
if (ssl->suites == NULL)
|
|
return SUITES_ERROR;
|
|
|
|
if (!ssl->options.useClientOrder) {
|
|
/* Server order */
|
|
for (i = 0; i < ssl->suites->suiteSz; i += 2) {
|
|
for (j = 0; j < peerSuites->suiteSz; j += 2) {
|
|
ret = CompareSuites(ssl, peerSuites, i, j);
|
|
if (ret != MATCH_SUITE_ERROR)
|
|
return ret;
|
|
}
|
|
}
|
|
}
|
|
else {
|
|
/* Client order */
|
|
for (j = 0; j < peerSuites->suiteSz; j += 2) {
|
|
for (i = 0; i < ssl->suites->suiteSz; i += 2) {
|
|
ret = CompareSuites(ssl, peerSuites, i, j);
|
|
if (ret != MATCH_SUITE_ERROR)
|
|
return ret;
|
|
}
|
|
}
|
|
}
|
|
|
|
return MATCH_SUITE_ERROR;
|
|
}
|
|
#endif
|
|
|
|
#ifdef OLD_HELLO_ALLOWED
|
|
|
|
/* process old style client hello, deprecate? */
|
|
int ProcessOldClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
word32 inSz, word16 sz)
|
|
{
|
|
word32 idx = *inOutIdx;
|
|
word16 sessionSz;
|
|
word16 randomSz;
|
|
word16 i, j;
|
|
ProtocolVersion pv;
|
|
Suites clSuites;
|
|
int ret = -1;
|
|
|
|
(void)inSz;
|
|
WOLFSSL_MSG("Got old format client hello");
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ClientHello");
|
|
if (ssl->toInfoOn)
|
|
AddLateName("ClientHello", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
/* manually hash input since different format */
|
|
#ifndef NO_OLD_TLS
|
|
#ifndef NO_MD5
|
|
wc_Md5Update(&ssl->hsHashes->hashMd5, input + idx, sz);
|
|
#endif
|
|
#ifndef NO_SHA
|
|
wc_ShaUpdate(&ssl->hsHashes->hashSha, input + idx, sz);
|
|
#endif
|
|
#endif
|
|
#ifndef NO_SHA256
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
int shaRet = wc_Sha256Update(&ssl->hsHashes->hashSha256,
|
|
input + idx, sz);
|
|
if (shaRet != 0)
|
|
return shaRet;
|
|
}
|
|
#endif
|
|
|
|
/* does this value mean client_hello? */
|
|
idx++;
|
|
|
|
/* version */
|
|
pv.major = input[idx++];
|
|
pv.minor = input[idx++];
|
|
ssl->chVersion = pv; /* store */
|
|
|
|
if (ssl->version.minor > pv.minor) {
|
|
byte haveRSA = 0;
|
|
byte havePSK = 0;
|
|
int keySz = 0;
|
|
|
|
if (!ssl->options.downgrade) {
|
|
WOLFSSL_MSG("Client trying to connect with lesser version");
|
|
return VERSION_ERROR;
|
|
}
|
|
if (pv.minor < ssl->options.minDowngrade) {
|
|
WOLFSSL_MSG("\tversion below minimum allowed, fatal error");
|
|
return VERSION_ERROR;
|
|
}
|
|
if (pv.minor == SSLv3_MINOR) {
|
|
/* turn off tls */
|
|
WOLFSSL_MSG("\tdowngrading to SSLv3");
|
|
ssl->options.tls = 0;
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = SSLv3_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_MINOR) {
|
|
WOLFSSL_MSG("\tdowngrading to TLSv1");
|
|
/* turn off tls 1.1+ */
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = TLSv1_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_1_MINOR) {
|
|
WOLFSSL_MSG("\tdowngrading to TLSv1.1");
|
|
ssl->version.minor = TLSv1_1_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_2_MINOR) {
|
|
WOLFSSL_MSG(" downgrading to TLSv1.2");
|
|
ssl->version.minor = TLSv1_2_MINOR;
|
|
}
|
|
#ifndef NO_RSA
|
|
haveRSA = 1;
|
|
#endif
|
|
#ifndef NO_PSK
|
|
havePSK = ssl->options.havePSK;
|
|
#endif
|
|
#ifndef NO_CERTS
|
|
keySz = ssl->buffers.keySz;
|
|
#endif
|
|
|
|
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
|
|
ssl->options.haveDH, ssl->options.haveNTRU,
|
|
ssl->options.haveECDSAsig, ssl->options.haveECC,
|
|
ssl->options.haveStaticECC, ssl->options.side);
|
|
}
|
|
|
|
/* suite size */
|
|
ato16(&input[idx], &clSuites.suiteSz);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
if (clSuites.suiteSz > WOLFSSL_MAX_SUITE_SZ)
|
|
return BUFFER_ERROR;
|
|
/* Make sure the suiteSz is a multiple of 3. (Old Client Hello) */
|
|
if (clSuites.suiteSz % 3 != 0)
|
|
return BUFFER_ERROR;
|
|
clSuites.hashSigAlgoSz = 0;
|
|
|
|
/* session size */
|
|
ato16(&input[idx], &sessionSz);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
if (sessionSz > ID_LEN)
|
|
return BUFFER_ERROR;
|
|
|
|
/* random size */
|
|
ato16(&input[idx], &randomSz);
|
|
idx += OPAQUE16_LEN;
|
|
|
|
if (randomSz > RAN_LEN)
|
|
return BUFFER_ERROR;
|
|
|
|
/* suites */
|
|
for (i = 0, j = 0; i < clSuites.suiteSz; i += 3) {
|
|
byte first = input[idx++];
|
|
if (!first) { /* implicit: skip sslv2 type */
|
|
XMEMCPY(&clSuites.suites[j], &input[idx], SUITE_LEN);
|
|
j += SUITE_LEN;
|
|
}
|
|
idx += SUITE_LEN;
|
|
}
|
|
clSuites.suiteSz = j;
|
|
|
|
/* session id */
|
|
if (sessionSz) {
|
|
XMEMCPY(ssl->arrays->sessionID, input + idx, sessionSz);
|
|
ssl->arrays->sessionIDSz = (byte)sessionSz;
|
|
idx += sessionSz;
|
|
ssl->options.resuming = 1;
|
|
}
|
|
|
|
/* random */
|
|
if (randomSz < RAN_LEN)
|
|
XMEMSET(ssl->arrays->clientRandom, 0, RAN_LEN - randomSz);
|
|
XMEMCPY(&ssl->arrays->clientRandom[RAN_LEN - randomSz], input + idx,
|
|
randomSz);
|
|
idx += randomSz;
|
|
|
|
if (ssl->options.usingCompression)
|
|
ssl->options.usingCompression = 0; /* turn off */
|
|
|
|
ssl->options.clientState = CLIENT_HELLO_COMPLETE;
|
|
ssl->cbmode = SSL_CB_MODE_WRITE;
|
|
*inOutIdx = idx;
|
|
|
|
ssl->options.haveSessionId = 1;
|
|
/* DoClientHello uses same resume code */
|
|
if (ssl->options.resuming) { /* let's try */
|
|
WOLFSSL_SESSION* session = GetSession(ssl,
|
|
ssl->arrays->masterSecret, 1);
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->options.useTicket == 1) {
|
|
session = &ssl->session;
|
|
}
|
|
#endif
|
|
|
|
if (!session) {
|
|
WOLFSSL_MSG("Session lookup for resume failed");
|
|
ssl->options.resuming = 0;
|
|
} else {
|
|
#ifdef HAVE_EXT_CACHE
|
|
wolfSSL_SESSION_free(session);
|
|
#endif
|
|
if (MatchSuite(ssl, &clSuites) < 0) {
|
|
WOLFSSL_MSG("Unsupported cipher suite, OldClientHello");
|
|
return UNSUPPORTED_SUITE;
|
|
}
|
|
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
|
|
RAN_LEN);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#ifdef NO_OLD_TLS
|
|
ret = DeriveTlsKeys(ssl);
|
|
#else
|
|
#ifndef NO_TLS
|
|
if (ssl->options.tls)
|
|
ret = DeriveTlsKeys(ssl);
|
|
#endif
|
|
if (!ssl->options.tls)
|
|
ret = DeriveKeys(ssl);
|
|
#endif
|
|
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
|
|
|
|
return ret;
|
|
}
|
|
}
|
|
|
|
ret = MatchSuite(ssl, &clSuites);
|
|
if (ret != 0)return ret;
|
|
return SanityCheckMsgReceived(ssl, client_hello);
|
|
}
|
|
|
|
#endif /* OLD_HELLO_ALLOWED */
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
int HandleTlsResumption(WOLFSSL* ssl, int bogusID, Suites* clSuites)
|
|
{
|
|
int ret = 0;
|
|
WOLFSSL_SESSION* session;
|
|
|
|
(void)bogusID;
|
|
|
|
session = GetSession(ssl, ssl->arrays->masterSecret, 1);
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (ssl->options.useTicket == 1) {
|
|
session = &ssl->session;
|
|
} else if (bogusID == 1 && ssl->options.rejectTicket == 0) {
|
|
WOLFSSL_MSG("Bogus session ID without session ticket");
|
|
return BUFFER_ERROR;
|
|
}
|
|
#endif
|
|
|
|
if (!session) {
|
|
WOLFSSL_MSG("Session lookup for resume failed");
|
|
ssl->options.resuming = 0;
|
|
}
|
|
else if (session->haveEMS != ssl->options.haveEMS) {
|
|
/* RFC 7627, 5.3, server-side */
|
|
/* if old sess didn't have EMS, but new does, full handshake */
|
|
if (!session->haveEMS && ssl->options.haveEMS) {
|
|
WOLFSSL_MSG("Attempting to resume a session that didn't "
|
|
"use EMS with a new session with EMS. Do full "
|
|
"handshake.");
|
|
ssl->options.resuming = 0;
|
|
}
|
|
/* if old sess used EMS, but new doesn't, MUST abort */
|
|
else if (session->haveEMS && !ssl->options.haveEMS) {
|
|
WOLFSSL_MSG("Trying to resume a session with EMS without "
|
|
"using EMS");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
#endif
|
|
#ifdef HAVE_EXT_CACHE
|
|
wolfSSL_SESSION_free(session);
|
|
#endif
|
|
return EXT_MASTER_SECRET_NEEDED_E;
|
|
}
|
|
#ifdef HAVE_EXT_CACHE
|
|
wolfSSL_SESSION_free(session);
|
|
#endif
|
|
}
|
|
else {
|
|
#ifndef NO_RESUME_SUITE_CHECK
|
|
int j;
|
|
|
|
/* Check client suites include the one in session */
|
|
for (j = 0; j < clSuites->suiteSz; j += 2) {
|
|
if (clSuites->suites[j] == session->cipherSuite0 &&
|
|
clSuites->suites[j+1] == session->cipherSuite) {
|
|
break;
|
|
}
|
|
}
|
|
if (j == clSuites->suiteSz) {
|
|
WOLFSSL_MSG("Prev session's cipher suite not in ClientHello");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
return UNSUPPORTED_SUITE;
|
|
}
|
|
#endif
|
|
|
|
#ifdef HAVE_EXT_CACHE
|
|
wolfSSL_SESSION_free(session);
|
|
#endif
|
|
if (MatchSuite(ssl, clSuites) < 0) {
|
|
WOLFSSL_MSG("Unsupported cipher suite, ClientHello");
|
|
return UNSUPPORTED_SUITE;
|
|
}
|
|
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
|
|
RAN_LEN);
|
|
if (ret != 0)
|
|
return ret;
|
|
|
|
#ifdef NO_OLD_TLS
|
|
ret = DeriveTlsKeys(ssl);
|
|
#else
|
|
#ifndef NO_TLS
|
|
if (ssl->options.tls)
|
|
ret = DeriveTlsKeys(ssl);
|
|
#endif
|
|
if (!ssl->options.tls)
|
|
ret = DeriveKeys(ssl);
|
|
#endif
|
|
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* handle processing of client_hello (1) */
|
|
int DoClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
|
|
word32 helloSz)
|
|
{
|
|
byte b;
|
|
byte bogusID = 0; /* flag for a bogus session id */
|
|
ProtocolVersion pv;
|
|
Suites clSuites;
|
|
word32 i = *inOutIdx;
|
|
word32 begin = i;
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_DTLS
|
|
Hmac cookieHmac;
|
|
byte peerCookie[MAX_COOKIE_LEN];
|
|
byte peerCookieSz = 0;
|
|
byte cookieType;
|
|
byte cookieSz = 0;
|
|
|
|
XMEMSET(&cookieHmac, 0, sizeof(Hmac));
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
WOLFSSL_START(WC_FUNC_CLIENT_HELLO_DO);
|
|
WOLFSSL_ENTER("DoClientHello");
|
|
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn) AddPacketName(ssl, "ClientHello");
|
|
if (ssl->toInfoOn) AddLateName("ClientHello", &ssl->timeoutInfo);
|
|
#endif
|
|
/* protocol version, random and session id length check */
|
|
if (OPAQUE16_LEN + RAN_LEN + OPAQUE8_LEN > helloSz)
|
|
return BUFFER_ERROR;
|
|
|
|
/* protocol version */
|
|
XMEMCPY(&pv, input + i, OPAQUE16_LEN);
|
|
ssl->chVersion = pv; /* store */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) && !IsSCR(ssl) && !ssl->options.resuming) {
|
|
#if defined(NO_SHA) && defined(NO_SHA256)
|
|
#error "DTLS needs either SHA or SHA-256"
|
|
#endif /* NO_SHA && NO_SHA256 */
|
|
|
|
#if !defined(NO_SHA) && defined(NO_SHA256)
|
|
cookieType = WC_SHA;
|
|
cookieSz = WC_SHA_DIGEST_SIZE;
|
|
#endif /* NO_SHA */
|
|
#ifndef NO_SHA256
|
|
cookieType = WC_SHA256;
|
|
cookieSz = WC_SHA256_DIGEST_SIZE;
|
|
#endif /* NO_SHA256 */
|
|
ret = wc_HmacSetKey(&cookieHmac, cookieType,
|
|
ssl->buffers.dtlsCookieSecret.buffer,
|
|
ssl->buffers.dtlsCookieSecret.length);
|
|
if (ret != 0) goto out;
|
|
ret = wc_HmacUpdate(&cookieHmac,
|
|
(const byte*)ssl->buffers.dtlsCtx.peer.sa,
|
|
ssl->buffers.dtlsCtx.peer.sz);
|
|
if (ret != 0) goto out;
|
|
ret = wc_HmacUpdate(&cookieHmac, input + i, OPAQUE16_LEN);
|
|
if (ret != 0) goto out;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
i += OPAQUE16_LEN;
|
|
|
|
/* Legacy protocol version cannot negotiate TLS 1.3 or higher. */
|
|
if (pv.major == SSLv3_MAJOR && pv.minor >= TLSv1_3_MINOR)
|
|
pv.minor = TLSv1_2_MINOR;
|
|
|
|
if ((!ssl->options.dtls && ssl->version.minor > pv.minor) ||
|
|
(ssl->options.dtls && ssl->version.minor != DTLS_MINOR
|
|
&& ssl->version.minor != DTLSv1_2_MINOR && pv.minor != DTLS_MINOR
|
|
&& pv.minor != DTLSv1_2_MINOR)) {
|
|
|
|
word16 haveRSA = 0;
|
|
word16 havePSK = 0;
|
|
int keySz = 0;
|
|
|
|
if (!ssl->options.downgrade) {
|
|
WOLFSSL_MSG("Client trying to connect with lesser version");
|
|
ret = VERSION_ERROR;
|
|
goto out;
|
|
}
|
|
if (pv.minor < ssl->options.minDowngrade) {
|
|
WOLFSSL_MSG("\tversion below minimum allowed, fatal error");
|
|
ret = VERSION_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (pv.minor == SSLv3_MINOR) {
|
|
/* turn off tls */
|
|
WOLFSSL_MSG("\tdowngrading to SSLv3");
|
|
ssl->options.tls = 0;
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = SSLv3_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_MINOR) {
|
|
/* turn off tls 1.1+ */
|
|
WOLFSSL_MSG("\tdowngrading to TLSv1");
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = TLSv1_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_1_MINOR) {
|
|
WOLFSSL_MSG("\tdowngrading to TLSv1.1");
|
|
ssl->version.minor = TLSv1_1_MINOR;
|
|
}
|
|
else if (pv.minor == TLSv1_2_MINOR) {
|
|
WOLFSSL_MSG(" downgrading to TLSv1.2");
|
|
ssl->version.minor = TLSv1_2_MINOR;
|
|
}
|
|
#ifndef NO_RSA
|
|
haveRSA = 1;
|
|
#endif
|
|
#ifndef NO_PSK
|
|
havePSK = ssl->options.havePSK;
|
|
#endif
|
|
#ifndef NO_CERTS
|
|
keySz = ssl->buffers.keySz;
|
|
#endif
|
|
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
|
|
ssl->options.haveDH, ssl->options.haveNTRU,
|
|
ssl->options.haveECDSAsig, ssl->options.haveECC,
|
|
ssl->options.haveStaticECC, ssl->options.side);
|
|
}
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
/* check if option is set to not allow the current version
|
|
* set from either wolfSSL_set_options or wolfSSL_CTX_set_options */
|
|
if (!ssl->options.dtls && ssl->options.downgrade &&
|
|
ssl->options.mask > 0) {
|
|
int reset = 0;
|
|
if (ssl->version.minor == TLSv1_2_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_2) == SSL_OP_NO_TLSv1_2) {
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.2, Downgrading");
|
|
ssl->version.minor = TLSv1_1_MINOR;
|
|
reset = 1;
|
|
}
|
|
if (ssl->version.minor == TLSv1_1_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1_1) == SSL_OP_NO_TLSv1_1) {
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1.1, Downgrading");
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = TLSv1_MINOR;
|
|
reset = 1;
|
|
}
|
|
if (ssl->version.minor == TLSv1_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_TLSv1) == SSL_OP_NO_TLSv1) {
|
|
WOLFSSL_MSG("\tOption set to not allow TLSv1, Downgrading");
|
|
ssl->options.tls = 0;
|
|
ssl->options.tls1_1 = 0;
|
|
ssl->version.minor = SSLv3_MINOR;
|
|
reset = 1;
|
|
}
|
|
if (ssl->version.minor == SSLv3_MINOR &&
|
|
(ssl->options.mask & SSL_OP_NO_SSLv3) == SSL_OP_NO_SSLv3) {
|
|
WOLFSSL_MSG("\tError, option set to not allow SSLv3");
|
|
ret = VERSION_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (ssl->version.minor < ssl->options.minDowngrade) {
|
|
WOLFSSL_MSG("\tversion below minimum allowed, fatal error");
|
|
ret = VERSION_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (reset) {
|
|
word16 haveRSA = 0;
|
|
word16 havePSK = 0;
|
|
int keySz = 0;
|
|
|
|
#ifndef NO_RSA
|
|
haveRSA = 1;
|
|
#endif
|
|
#ifndef NO_PSK
|
|
havePSK = ssl->options.havePSK;
|
|
#endif
|
|
#ifndef NO_CERTS
|
|
keySz = ssl->buffers.keySz;
|
|
#endif
|
|
|
|
/* reset cipher suites to account for TLS version change */
|
|
InitSuites(ssl->suites, ssl->version, keySz, haveRSA, havePSK,
|
|
ssl->options.haveDH, ssl->options.haveNTRU,
|
|
ssl->options.haveECDSAsig, ssl->options.haveECC,
|
|
ssl->options.haveStaticECC, ssl->options.side);
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* random */
|
|
XMEMCPY(ssl->arrays->clientRandom, input + i, RAN_LEN);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) && !IsSCR(ssl) && !ssl->options.resuming) {
|
|
ret = wc_HmacUpdate(&cookieHmac, input + i, RAN_LEN);
|
|
if (ret != 0) goto out;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
i += RAN_LEN;
|
|
|
|
#ifdef SHOW_SECRETS
|
|
{
|
|
int j;
|
|
printf("client random: ");
|
|
for (j = 0; j < RAN_LEN; j++)
|
|
printf("%02x", ssl->arrays->clientRandom[j]);
|
|
printf("\n");
|
|
}
|
|
#endif
|
|
|
|
/* session id */
|
|
b = input[i++];
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
if (b > 0 && b < ID_LEN) {
|
|
bogusID = 1;
|
|
WOLFSSL_MSG("Client sent bogus session id, let's allow for echo");
|
|
}
|
|
#endif
|
|
|
|
if (b == ID_LEN || bogusID) {
|
|
if ((i - begin) + b > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
XMEMCPY(ssl->arrays->sessionID, input + i, b);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) && !IsSCR(ssl) &&
|
|
!ssl->options.resuming) {
|
|
ret = wc_HmacUpdate(&cookieHmac, input + i - 1, b + 1);
|
|
if (ret != 0) goto out;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
ssl->arrays->sessionIDSz = b;
|
|
i += b;
|
|
ssl->options.resuming = 1; /* client wants to resume */
|
|
WOLFSSL_MSG("Client wants to resume session");
|
|
}
|
|
else if (b) {
|
|
WOLFSSL_MSG("Invalid session ID size");
|
|
ret = BUFFER_ERROR; /* session ID nor 0 neither 32 bytes long */
|
|
goto out;
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
/* cookie */
|
|
if (ssl->options.dtls) {
|
|
|
|
if ((i - begin) + OPAQUE8_LEN > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
peerCookieSz = input[i++];
|
|
|
|
if (peerCookieSz) {
|
|
if (peerCookieSz > MAX_COOKIE_LEN) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if ((i - begin) + peerCookieSz > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
XMEMCPY(peerCookie, input + i, peerCookieSz);
|
|
|
|
i += peerCookieSz;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* suites */
|
|
if ((i - begin) + OPAQUE16_LEN > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
ato16(&input[i], &clSuites.suiteSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
/* Cipher suite lists are always multiples of two in length. */
|
|
if (clSuites.suiteSz % 2 != 0) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
/* suites and compression length check */
|
|
if ((i - begin) + clSuites.suiteSz + OPAQUE8_LEN > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (clSuites.suiteSz > WOLFSSL_MAX_SUITE_SZ) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
XMEMCPY(clSuites.suites, input + i, clSuites.suiteSz);
|
|
|
|
#ifdef HAVE_SERVER_RENEGOTIATION_INFO
|
|
/* check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV suite */
|
|
if (FindSuite(&clSuites, 0, TLS_EMPTY_RENEGOTIATION_INFO_SCSV) >= 0) {
|
|
TLSX* extension;
|
|
|
|
/* check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV suite */
|
|
ret = TLSX_AddEmptyRenegotiationInfo(&ssl->extensions, ssl->heap);
|
|
if (ret != WOLFSSL_SUCCESS)
|
|
goto out;
|
|
|
|
extension = TLSX_Find(ssl->extensions, TLSX_RENEGOTIATION_INFO);
|
|
if (extension) {
|
|
ssl->secure_renegotiation =
|
|
(SecureRenegotiation*)extension->data;
|
|
ssl->secure_renegotiation->enabled = 1;
|
|
}
|
|
}
|
|
#endif /* HAVE_SERVER_RENEGOTIATION_INFO */
|
|
#if defined(HAVE_FALLBACK_SCSV) || defined(OPENSSL_ALL)
|
|
/* check for TLS_FALLBACK_SCSV suite */
|
|
if (FindSuite(&clSuites, TLS_FALLBACK_SCSV, 0) >= 0) {
|
|
WOLFSSL_MSG("Found Fallback SCSV");
|
|
if (ssl->ctx->method->version.minor > pv.minor) {
|
|
WOLFSSL_MSG("Client trying to connect with lesser version");
|
|
SendAlert(ssl, alert_fatal, inappropriate_fallback);
|
|
ret = VERSION_ERROR;
|
|
goto out;
|
|
}
|
|
}
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) && !IsSCR(ssl) && !ssl->options.resuming) {
|
|
ret = wc_HmacUpdate(&cookieHmac,
|
|
input + i - OPAQUE16_LEN,
|
|
clSuites.suiteSz + OPAQUE16_LEN);
|
|
if (ret != 0) goto out;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
i += clSuites.suiteSz;
|
|
clSuites.hashSigAlgoSz = 0;
|
|
|
|
/* compression length */
|
|
b = input[i++];
|
|
|
|
if ((i - begin) + b > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (b == 0) {
|
|
WOLFSSL_MSG("No compression types in list");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
#endif
|
|
ret = COMPRESSION_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if (!IsSCR(ssl) && !ssl->options.resuming) {
|
|
byte newCookie[MAX_COOKIE_LEN];
|
|
|
|
ret = wc_HmacUpdate(&cookieHmac, input + i - 1, b + 1);
|
|
if (ret != 0) goto out;
|
|
ret = wc_HmacFinal(&cookieHmac, newCookie);
|
|
if (ret != 0) goto out;
|
|
|
|
/* If a cookie callback is set, call it to overwrite the cookie.
|
|
* This should be deprecated. The code now calculates the cookie
|
|
* using an HMAC as expected. */
|
|
if (ssl->ctx->CBIOCookie != NULL &&
|
|
ssl->ctx->CBIOCookie(ssl, newCookie, cookieSz,
|
|
ssl->IOCB_CookieCtx) != cookieSz) {
|
|
ret = COOKIE_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
/* Check the cookie, see if we progress the state machine. */
|
|
if (peerCookieSz != cookieSz ||
|
|
XMEMCMP(peerCookie, newCookie, cookieSz) != 0) {
|
|
|
|
/* Send newCookie to client in a HelloVerifyRequest message
|
|
* and let the state machine alone. */
|
|
ssl->msgsReceived.got_client_hello = 0;
|
|
ssl->keys.dtls_handshake_number = 0;
|
|
ssl->keys.dtls_expected_peer_handshake_number = 0;
|
|
*inOutIdx += helloSz;
|
|
ret = SendHelloVerifyRequest(ssl, newCookie, cookieSz);
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
/* This was skipped in the DTLS case so we could handle the hello
|
|
* verify request. */
|
|
ret = HashInput(ssl, input + *inOutIdx, helloSz);
|
|
if (ret != 0) goto out;
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
{
|
|
/* compression match types */
|
|
int matchNo = 0;
|
|
int matchZlib = 0;
|
|
|
|
while (b--) {
|
|
byte comp = input[i++];
|
|
|
|
if (comp == NO_COMPRESSION) {
|
|
matchNo = 1;
|
|
}
|
|
if (comp == ZLIB_COMPRESSION) {
|
|
matchZlib = 1;
|
|
}
|
|
}
|
|
|
|
if (ssl->options.usingCompression == 0 && matchNo) {
|
|
WOLFSSL_MSG("Matched No Compression");
|
|
} else if (ssl->options.usingCompression && matchZlib) {
|
|
WOLFSSL_MSG("Matched zlib Compression");
|
|
} else if (ssl->options.usingCompression && matchNo) {
|
|
WOLFSSL_MSG("Could only match no compression, turning off");
|
|
ssl->options.usingCompression = 0; /* turn off */
|
|
} else {
|
|
WOLFSSL_MSG("Could not match compression");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
ret = COMPRESSION_ERROR;
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
*inOutIdx = i;
|
|
|
|
/* tls extensions */
|
|
if ((i - begin) < helloSz) {
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
#ifdef HAVE_QSH
|
|
QSH_Init(ssl);
|
|
#endif
|
|
if (TLSX_SupportExtensions(ssl))
|
|
#else
|
|
if (IsAtLeastTLSv1_2(ssl))
|
|
#endif
|
|
{
|
|
/* Process the hello extension. Skip unsupported. */
|
|
word16 totalExtSz;
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
/* auto populate extensions supported unless user defined */
|
|
if ((ret = TLSX_PopulateExtensions(ssl, 1)) != 0)
|
|
goto out;
|
|
#endif
|
|
|
|
if ((i - begin) + OPAQUE16_LEN > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
ato16(&input[i], &totalExtSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
if ((i - begin) + totalExtSz > helloSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
#ifdef HAVE_TLS_EXTENSIONS
|
|
/* tls extensions */
|
|
if ((ret = TLSX_Parse(ssl, (byte *) input + i, totalExtSz,
|
|
client_hello, &clSuites)))
|
|
goto out;
|
|
#ifdef WOLFSSL_TLS13
|
|
if (TLSX_Find(ssl->extensions,
|
|
TLSX_SUPPORTED_VERSIONS) != NULL) {
|
|
WOLFSSL_MSG(
|
|
"Client attempting to connect with higher version");
|
|
ret = VERSION_ERROR;
|
|
goto out;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_SNI
|
|
if((ret=SNI_Callback(ssl)))
|
|
goto out;
|
|
ssl->options.side = WOLFSSL_SERVER_END;
|
|
#endif
|
|
|
|
i += totalExtSz;
|
|
#else
|
|
while (totalExtSz) {
|
|
word16 extId, extSz;
|
|
|
|
if (OPAQUE16_LEN + OPAQUE16_LEN > totalExtSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
ato16(&input[i], &extId);
|
|
i += OPAQUE16_LEN;
|
|
ato16(&input[i], &extSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
if (OPAQUE16_LEN + OPAQUE16_LEN + extSz > totalExtSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (extId == HELLO_EXT_SIG_ALGO) {
|
|
word16 hashSigAlgoSz;
|
|
|
|
ato16(&input[i], &hashSigAlgoSz);
|
|
i += OPAQUE16_LEN;
|
|
|
|
if (OPAQUE16_LEN + hashSigAlgoSz > extSz) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
if (hashSigAlgoSz % 2 != 0) {
|
|
ret = BUFFER_ERROR;
|
|
goto out;
|
|
}
|
|
|
|
clSuites.hashSigAlgoSz = hashSigAlgoSz;
|
|
if (clSuites.hashSigAlgoSz > WOLFSSL_MAX_SIGALGO) {
|
|
WOLFSSL_MSG("ClientHello SigAlgo list exceeds max, "
|
|
"truncating");
|
|
clSuites.hashSigAlgoSz = WOLFSSL_MAX_SIGALGO;
|
|
}
|
|
|
|
XMEMCPY(clSuites.hashSigAlgo, &input[i],
|
|
clSuites.hashSigAlgoSz);
|
|
|
|
i += hashSigAlgoSz;
|
|
}
|
|
#ifdef HAVE_EXTENDED_MASTER
|
|
else if (extId == HELLO_EXT_EXTMS)
|
|
ssl->options.haveEMS = 1;
|
|
#endif
|
|
else
|
|
i += extSz;
|
|
|
|
totalExtSz -= OPAQUE16_LEN + OPAQUE16_LEN + extSz;
|
|
}
|
|
#endif
|
|
*inOutIdx = i;
|
|
}
|
|
else
|
|
*inOutIdx = begin + helloSz; /* skip extensions */
|
|
}
|
|
|
|
ssl->options.clientState = CLIENT_HELLO_COMPLETE;
|
|
ssl->options.haveSessionId = 1;
|
|
|
|
/* ProcessOld uses same resume code */
|
|
if (ssl->options.resuming) {
|
|
ret = HandleTlsResumption(ssl, bogusID, &clSuites);
|
|
if (ret != 0)
|
|
goto out;
|
|
|
|
if (ssl->options.clientState == CLIENT_KEYEXCHANGE_COMPLETE) {
|
|
WOLFSSL_LEAVE("DoClientHello", ret);
|
|
WOLFSSL_END(WC_FUNC_CLIENT_HELLO_DO);
|
|
|
|
goto out;
|
|
}
|
|
}
|
|
|
|
#if defined(HAVE_TLS_EXTENSIONS) && defined(HAVE_DH_DEFAULT_PARAMS)
|
|
#if defined(HAVE_FFDHE) && defined(HAVE_SUPPORTED_CURVES)
|
|
if (TLSX_Find(ssl->extensions, TLSX_SUPPORTED_GROUPS) != NULL) {
|
|
/* Set FFDHE parameters or clear DHE parameters if FFDH parameters
|
|
* present and no matches in the server's list. */
|
|
ret = TLSX_SupportedFFDHE_Set(ssl);
|
|
if (ret != 0)
|
|
goto out;
|
|
}
|
|
#endif
|
|
#endif
|
|
|
|
ret = MatchSuite(ssl, &clSuites);
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_ERROR)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret < 0)
|
|
SendAlert(ssl, alert_fatal, handshake_failure);
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ret == 0 && ssl->options.dtls)
|
|
DtlsMsgPoolReset(ssl);
|
|
#endif
|
|
WOLFSSL_LEAVE("DoClientHello", ret);
|
|
WOLFSSL_END(WC_FUNC_CLIENT_HELLO_DO);
|
|
|
|
out:
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
wc_HmacFree(&cookieHmac);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
#if (!defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \
|
|
defined(HAVE_ED448)) && !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
|
|
typedef struct DcvArgs {
|
|
byte* output; /* not allocated */
|
|
word32 sendSz;
|
|
word16 sz;
|
|
word32 sigSz;
|
|
word32 idx;
|
|
word32 begin;
|
|
byte hashAlgo;
|
|
byte sigAlgo;
|
|
} DcvArgs;
|
|
|
|
static void FreeDcvArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
DcvArgs* args = (DcvArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
(void)args;
|
|
}
|
|
|
|
/* handle processing of certificate_verify (15) */
|
|
static int DoCertificateVerify(WOLFSSL* ssl, byte* input,
|
|
word32* inOutIdx, word32 size)
|
|
{
|
|
int ret = 0;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
DcvArgs* args = (DcvArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#else
|
|
DcvArgs args[1];
|
|
#endif
|
|
|
|
WOLFSSL_START(WC_FUNC_CERTIFICATE_VERIFY_DO);
|
|
WOLFSSL_ENTER("DoCertificateVerify");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_dcv;
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(DcvArgs));
|
|
args->hashAlgo = sha_mac;
|
|
args->sigAlgo = anonymous_sa_algo;
|
|
args->idx = *inOutIdx;
|
|
args->begin = *inOutIdx;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeDcvArgs;
|
|
#endif
|
|
}
|
|
|
|
switch(ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
#ifdef WOLFSSL_CALLBACKS
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "CertificateVerify");
|
|
if (ssl->toInfoOn)
|
|
AddLateName("CertificateVerify", &ssl->timeoutInfo);
|
|
#endif
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* case TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
if ((args->idx - args->begin) + ENUM_LEN + ENUM_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcv);
|
|
}
|
|
|
|
DecodeSigAlg(&input[args->idx], &args->hashAlgo,
|
|
&args->sigAlgo);
|
|
args->idx += 2;
|
|
}
|
|
#ifndef NO_RSA
|
|
else if (ssl->peerRsaKey != NULL && ssl->peerRsaKeyPresent != 0)
|
|
args->sigAlgo = rsa_sa_algo;
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
else if (ssl->peerEccDsaKeyPresent)
|
|
args->sigAlgo = ecc_dsa_sa_algo;
|
|
#endif
|
|
#if defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)
|
|
else if (ssl->peerEd25519KeyPresent)
|
|
args->sigAlgo = ed25519_sa_algo;
|
|
#endif /* HAVE_ED25519 && !NO_ED25519_CLIENT_AUTH */
|
|
#if defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)
|
|
else if (ssl->peerEd448KeyPresent)
|
|
args->sigAlgo = ed448_sa_algo;
|
|
#endif /* HAVE_ED448 && !NO_ED448_CLIENT_AUTH */
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcv);
|
|
}
|
|
|
|
ato16(input + args->idx, &args->sz);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + args->sz > size ||
|
|
args->sz > ENCRYPT_LEN) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcv);
|
|
}
|
|
|
|
#ifdef HAVE_ECC
|
|
if (ssl->peerEccDsaKeyPresent) {
|
|
|
|
WOLFSSL_MSG("Doing ECC peer cert verify");
|
|
|
|
/* make sure a default is defined */
|
|
#if !defined(NO_SHA)
|
|
SetDigest(ssl, sha_mac);
|
|
#elif !defined(NO_SHA256)
|
|
SetDigest(ssl, sha256_mac);
|
|
#elif defined(WOLFSSL_SHA384)
|
|
SetDigest(ssl, sha384_mac);
|
|
#elif defined(WOLFSSL_SHA512)
|
|
SetDigest(ssl, sha512_mac);
|
|
#else
|
|
#error No digest enabled for ECC sig verify
|
|
#endif
|
|
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
if (args->sigAlgo != ecc_dsa_sa_algo) {
|
|
WOLFSSL_MSG("Oops, peer sent ECC key but not in verify");
|
|
}
|
|
|
|
SetDigest(ssl, args->hashAlgo);
|
|
}
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#if defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)
|
|
if (ssl->peerEd25519KeyPresent) {
|
|
WOLFSSL_MSG("Doing ED25519 peer cert verify");
|
|
if (IsAtLeastTLSv1_2(ssl) &&
|
|
args->sigAlgo != ed25519_sa_algo) {
|
|
WOLFSSL_MSG(
|
|
"Oops, peer sent ED25519 key but not in verify");
|
|
}
|
|
}
|
|
#endif /* HAVE_ED25519 && !NO_ED25519_CLIENT_AUTH */
|
|
#if defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)
|
|
if (ssl->peerEd448KeyPresent) {
|
|
WOLFSSL_MSG("Doing ED448 peer cert verify");
|
|
if (IsAtLeastTLSv1_2(ssl) &&
|
|
args->sigAlgo != ed448_sa_algo) {
|
|
WOLFSSL_MSG(
|
|
"Oops, peer sent ED448 key but not in verify");
|
|
}
|
|
}
|
|
#endif /* HAVE_ED448 && !NO_ED448_CLIENT_AUTH */
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* case TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
#ifndef NO_RSA
|
|
if (ssl->peerRsaKey != NULL && ssl->peerRsaKeyPresent != 0) {
|
|
WOLFSSL_MSG("Doing RSA peer cert verify");
|
|
|
|
ret = RsaVerify(ssl,
|
|
input + args->idx,
|
|
args->sz,
|
|
&args->output,
|
|
args->sigAlgo, args->hashAlgo,
|
|
ssl->peerRsaKey,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerRsaKey
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
if (ret >= 0) {
|
|
if (args->sigAlgo == rsa_sa_algo)
|
|
args->sendSz = ret;
|
|
else {
|
|
args->sigSz = ret;
|
|
args->sendSz = ssl->buffers.digest.length;
|
|
}
|
|
ret = 0;
|
|
}
|
|
}
|
|
#endif /* !NO_RSA */
|
|
#ifdef HAVE_ECC
|
|
if (ssl->peerEccDsaKeyPresent) {
|
|
WOLFSSL_MSG("Doing ECC peer cert verify");
|
|
|
|
ret = EccVerify(ssl,
|
|
input + args->idx, args->sz,
|
|
ssl->buffers.digest.buffer, ssl->buffers.digest.length,
|
|
ssl->peerEccDsaKey,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerEccDsaKey
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
}
|
|
#endif /* HAVE_ECC */
|
|
#if defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)
|
|
if (ssl->peerEd25519KeyPresent) {
|
|
WOLFSSL_MSG("Doing Ed25519 peer cert verify");
|
|
|
|
ret = Ed25519Verify(ssl,
|
|
input + args->idx, args->sz,
|
|
ssl->hsHashes->messages, ssl->hsHashes->prevLen,
|
|
ssl->peerEd25519Key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerEd25519Key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
}
|
|
#endif /* HAVE_ED25519 && !NO_ED25519_CLIENT_AUTH */
|
|
#if defined(HAVE_ED448) && !defined(NO_ED448_CLIENT_AUTH)
|
|
if (ssl->peerEd448KeyPresent) {
|
|
WOLFSSL_MSG("Doing Ed448 peer cert verify");
|
|
|
|
ret = Ed448Verify(ssl,
|
|
input + args->idx, args->sz,
|
|
ssl->hsHashes->messages, ssl->hsHashes->prevLen,
|
|
ssl->peerEd448Key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
&ssl->buffers.peerEd448Key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
}
|
|
#endif /* HAVE_ED448 && !NO_ED448_CLIENT_AUTH */
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* handle async pending */
|
|
if (ret == WC_PENDING_E)
|
|
goto exit_dcv;
|
|
#endif
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
ret = SIG_VERIFY_E;
|
|
goto exit_dcv;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* case TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
#ifndef NO_RSA
|
|
if (ssl->peerRsaKey != NULL && ssl->peerRsaKeyPresent != 0) {
|
|
if (IsAtLeastTLSv1_2(ssl)) {
|
|
#ifdef WC_RSA_PSS
|
|
if (args->sigAlgo == rsa_pss_sa_algo) {
|
|
SetDigest(ssl, args->hashAlgo);
|
|
|
|
#ifdef HAVE_SELFTEST
|
|
ret = wc_RsaPSS_CheckPadding(
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
args->output, args->sigSz,
|
|
HashAlgoToType(args->hashAlgo));
|
|
#else
|
|
ret = wc_RsaPSS_CheckPadding_ex(
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
args->output, args->sigSz,
|
|
HashAlgoToType(args->hashAlgo), -1,
|
|
mp_count_bits(&ssl->peerRsaKey->n));
|
|
#endif
|
|
if (ret != 0) {
|
|
ret = SIG_VERIFY_E;
|
|
goto exit_dcv;
|
|
}
|
|
}
|
|
else
|
|
#endif
|
|
{
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
byte* encodedSig;
|
|
#else
|
|
byte encodedSig[MAX_ENCODED_SIG_SZ];
|
|
#endif
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ,
|
|
ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
if (encodedSig == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_dcv);
|
|
}
|
|
#endif
|
|
|
|
if (args->sigAlgo != rsa_sa_algo) {
|
|
WOLFSSL_MSG("Oops, peer sent RSA key but not "
|
|
"in verify");
|
|
}
|
|
|
|
SetDigest(ssl, args->hashAlgo);
|
|
|
|
args->sigSz = wc_EncodeSignature(encodedSig,
|
|
ssl->buffers.digest.buffer,
|
|
ssl->buffers.digest.length,
|
|
TypeHash(args->hashAlgo));
|
|
|
|
if (args->sendSz != args->sigSz || !args->output ||
|
|
XMEMCMP(args->output, encodedSig,
|
|
min(args->sigSz, MAX_ENCODED_SIG_SZ)) != 0) {
|
|
ret = VERIFY_CERT_ERROR;
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(encodedSig, ssl->heap, DYNAMIC_TYPE_SIGNATURE);
|
|
#endif
|
|
}
|
|
}
|
|
else {
|
|
if (args->sendSz != FINISHED_SZ || !args->output ||
|
|
XMEMCMP(args->output,
|
|
&ssl->hsHashes->certHashes, FINISHED_SZ) != 0) {
|
|
ret = VERIFY_CERT_ERROR;
|
|
}
|
|
}
|
|
}
|
|
#endif /* !NO_RSA */
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* case TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
args->idx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
args->idx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
ssl->options.havePeerVerify = 1;
|
|
|
|
/* Set final index */
|
|
args->idx += args->sz;
|
|
*inOutIdx = args->idx;
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* case TLS_ASYNC_FINALIZE */
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
break;
|
|
}
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_dcv:
|
|
|
|
WOLFSSL_LEAVE("DoCertificateVerify", ret);
|
|
WOLFSSL_END(WC_FUNC_CERTIFICATE_VERIFY_DO);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* Handle async operation */
|
|
if (ret == WC_PENDING_E) {
|
|
/* Mark message as not received so it can process again */
|
|
ssl->msgsReceived.got_certificate_verify = 0;
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_ERROR)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == SIG_VERIFY_E)
|
|
SendAlert(ssl, alert_fatal, decrypt_error);
|
|
else if (ret != 0)
|
|
SendAlert(ssl, alert_fatal, bad_certificate);
|
|
#endif
|
|
/* Digest is not allocated, so do this to prevent free */
|
|
ssl->buffers.digest.buffer = NULL;
|
|
ssl->buffers.digest.length = 0;
|
|
|
|
/* Final cleanup */
|
|
FreeDcvArgs(ssl, args);
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* (!NO_RSA || ECC || ED25519 || ED448) && !WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
/* handle generation of server_hello_done (14) */
|
|
int SendServerHelloDone(WOLFSSL* ssl)
|
|
{
|
|
byte* output;
|
|
int sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
int ret;
|
|
|
|
WOLFSSL_START(WC_FUNC_SERVER_HELLO_DONE_SEND);
|
|
WOLFSSL_ENTER("SendServerHelloDone");
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls)
|
|
sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
#endif
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += MAX_MSG_EXTRA;
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, 0, server_hello_done, ssl);
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input;
|
|
int inputSz = HANDSHAKE_HEADER_SZ; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls) {
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz += DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, input, inputSz, server_hello_done)) != 0) {
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
return ret;
|
|
}
|
|
#endif
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
} else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, server_hello_done)) != 0)
|
|
return ret;
|
|
}
|
|
if (ssl->options.dtls)
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
#endif
|
|
ret = HashOutput(ssl, output, sendSz, 0);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "ServerHelloDone");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "ServerHelloDone", handshake, output, sendSz,
|
|
WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendServerHelloDone", ret);
|
|
WOLFSSL_END(WC_FUNC_SERVER_HELLO_DONE_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifdef HAVE_SESSION_TICKET
|
|
|
|
#define WOLFSSL_TICKET_FIXED_SZ (WOLFSSL_TICKET_NAME_SZ + \
|
|
WOLFSSL_TICKET_IV_SZ + WOLFSSL_TICKET_MAC_SZ + LENGTH_SZ)
|
|
#define WOLFSSL_TICKET_ENC_SZ (SESSION_TICKET_LEN - WOLFSSL_TICKET_FIXED_SZ)
|
|
|
|
/* our ticket format */
|
|
typedef struct InternalTicket {
|
|
ProtocolVersion pv; /* version when ticket created */
|
|
byte suite[SUITE_LEN]; /* cipher suite when created */
|
|
byte msecret[SECRET_LEN]; /* master secret */
|
|
word32 timestamp; /* born on */
|
|
word16 haveEMS; /* have extended master secret */
|
|
#ifdef WOLFSSL_TLS13
|
|
word32 ageAdd; /* Obfuscation of age */
|
|
word16 namedGroup; /* Named group used */
|
|
TicketNonce ticketNonce; /* Ticket nonce */
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
word32 maxEarlyDataSz; /* Max size of early data */
|
|
#endif
|
|
#endif
|
|
} InternalTicket;
|
|
|
|
/* RFC 5077 defines this for session tickets */
|
|
/* fit within SESSION_TICKET_LEN */
|
|
typedef struct ExternalTicket {
|
|
byte key_name[WOLFSSL_TICKET_NAME_SZ]; /* key context name */
|
|
byte iv[WOLFSSL_TICKET_IV_SZ]; /* this ticket's iv */
|
|
byte enc_len[LENGTH_SZ]; /* encrypted length */
|
|
byte enc_ticket[WOLFSSL_TICKET_ENC_SZ]; /* encrypted internal ticket */
|
|
byte mac[WOLFSSL_TICKET_MAC_SZ]; /* total mac */
|
|
/* !! if add to structure, add to TICKET_FIXED_SZ !! */
|
|
} ExternalTicket;
|
|
|
|
/* create a new session ticket, 0 on success */
|
|
int CreateTicket(WOLFSSL* ssl)
|
|
{
|
|
InternalTicket it;
|
|
ExternalTicket* et = (ExternalTicket*)ssl->session.ticket;
|
|
int encLen;
|
|
int ret;
|
|
byte zeros[WOLFSSL_TICKET_MAC_SZ]; /* biggest cmp size */
|
|
|
|
XMEMSET(&it, 0, sizeof(it));
|
|
|
|
/* build internal */
|
|
it.pv.major = ssl->version.major;
|
|
it.pv.minor = ssl->version.minor;
|
|
|
|
it.suite[0] = ssl->options.cipherSuite0;
|
|
it.suite[1] = ssl->options.cipherSuite;
|
|
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
it.maxEarlyDataSz = ssl->options.maxEarlyDataSz;
|
|
#endif
|
|
|
|
if (!ssl->options.tls1_3) {
|
|
XMEMCPY(it.msecret, ssl->arrays->masterSecret, SECRET_LEN);
|
|
c32toa(LowResTimer(), (byte*)&it.timestamp);
|
|
it.haveEMS = ssl->options.haveEMS;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_TLS13
|
|
/* Client adds to ticket age to obfuscate. */
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, (byte*)&it.ageAdd,
|
|
sizeof(it.ageAdd));
|
|
if (ret != 0)
|
|
return BAD_TICKET_ENCRYPT;
|
|
ssl->session.ticketAdd = it.ageAdd;
|
|
it.namedGroup = ssl->session.namedGroup;
|
|
it.timestamp = TimeNowInMilliseconds();
|
|
/* Resumption master secret. */
|
|
XMEMCPY(it.msecret, ssl->session.masterSecret, SECRET_LEN);
|
|
XMEMCPY(&it.ticketNonce, &ssl->session.ticketNonce,
|
|
sizeof(TicketNonce));
|
|
#endif
|
|
}
|
|
|
|
/* encrypt */
|
|
encLen = WOLFSSL_TICKET_ENC_SZ; /* max size user can use */
|
|
if (ssl->ctx->ticketEncCb == NULL) {
|
|
ret = WOLFSSL_TICKET_RET_FATAL;
|
|
}
|
|
else {
|
|
/* build external */
|
|
XMEMCPY(et->enc_ticket, &it, sizeof(InternalTicket));
|
|
|
|
ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv, et->mac, 1,
|
|
et->enc_ticket, sizeof(InternalTicket),
|
|
&encLen, ssl->ctx->ticketEncCtx);
|
|
if (ret != WOLFSSL_TICKET_RET_OK) {
|
|
ForceZero(et->enc_ticket, sizeof(it));
|
|
}
|
|
}
|
|
if (ret == WOLFSSL_TICKET_RET_OK) {
|
|
if (encLen < (int)sizeof(InternalTicket) ||
|
|
encLen > WOLFSSL_TICKET_ENC_SZ) {
|
|
ForceZero(&it, sizeof(it));
|
|
ForceZero(et->enc_ticket, sizeof(it));
|
|
WOLFSSL_MSG("Bad user ticket encrypt size");
|
|
return BAD_TICKET_KEY_CB_SZ;
|
|
}
|
|
|
|
/* sanity checks on encrypt callback */
|
|
|
|
/* internal ticket can't be the same if encrypted */
|
|
if (XMEMCMP(et->enc_ticket, &it, sizeof(InternalTicket)) == 0) {
|
|
ForceZero(&it, sizeof(it));
|
|
ForceZero(et->enc_ticket, sizeof(it));
|
|
WOLFSSL_MSG("User ticket encrypt didn't encrypt");
|
|
return BAD_TICKET_ENCRYPT;
|
|
}
|
|
|
|
ForceZero(&it, sizeof(it));
|
|
XMEMSET(zeros, 0, sizeof(zeros));
|
|
|
|
/* name */
|
|
if (XMEMCMP(et->key_name, zeros, WOLFSSL_TICKET_NAME_SZ) == 0) {
|
|
WOLFSSL_MSG("User ticket encrypt didn't set name");
|
|
return BAD_TICKET_ENCRYPT;
|
|
}
|
|
|
|
/* iv */
|
|
if (XMEMCMP(et->iv, zeros, WOLFSSL_TICKET_IV_SZ) == 0) {
|
|
WOLFSSL_MSG("User ticket encrypt didn't set iv");
|
|
return BAD_TICKET_ENCRYPT;
|
|
}
|
|
|
|
/* mac */
|
|
if (XMEMCMP(et->mac, zeros, WOLFSSL_TICKET_MAC_SZ) == 0) {
|
|
WOLFSSL_MSG("User ticket encrypt didn't set mac");
|
|
return BAD_TICKET_ENCRYPT;
|
|
}
|
|
|
|
/* set size */
|
|
c16toa((word16)encLen, et->enc_len);
|
|
ssl->session.ticketLen = (word16)(encLen + WOLFSSL_TICKET_FIXED_SZ);
|
|
if (encLen < WOLFSSL_TICKET_ENC_SZ) {
|
|
/* move mac up since whole enc buffer not used */
|
|
XMEMMOVE(et->enc_ticket +encLen, et->mac,WOLFSSL_TICKET_MAC_SZ);
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* Parse ticket sent by client, returns callback return value */
|
|
int DoClientTicket(WOLFSSL* ssl, const byte* input, word32 len)
|
|
{
|
|
ExternalTicket* et;
|
|
InternalTicket it;
|
|
int ret;
|
|
int outLen;
|
|
word16 inLen;
|
|
|
|
WOLFSSL_START(WC_FUNC_TICKET_DO);
|
|
WOLFSSL_ENTER("DoClientTicket");
|
|
|
|
if (len > SESSION_TICKET_LEN ||
|
|
len < (word32)(sizeof(InternalTicket) + WOLFSSL_TICKET_FIXED_SZ)) {
|
|
return BAD_TICKET_MSG_SZ;
|
|
}
|
|
|
|
et = (ExternalTicket*)input;
|
|
|
|
/* decrypt */
|
|
ato16(et->enc_len, &inLen);
|
|
if (inLen > (word16)(len - WOLFSSL_TICKET_FIXED_SZ)) {
|
|
return BAD_TICKET_MSG_SZ;
|
|
}
|
|
outLen = inLen; /* may be reduced by user padding */
|
|
|
|
if (ssl->ctx->ticketEncCb == NULL) {
|
|
ret = WOLFSSL_TICKET_RET_FATAL;
|
|
}
|
|
else {
|
|
ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv,
|
|
et->enc_ticket + inLen, 0,
|
|
et->enc_ticket, inLen, &outLen,
|
|
ssl->ctx->ticketEncCtx);
|
|
}
|
|
if (ret == WOLFSSL_TICKET_RET_FATAL || ret < 0) return ret;
|
|
if (outLen > (int)inLen || outLen < (int)sizeof(InternalTicket)) {
|
|
WOLFSSL_MSG("Bad user ticket decrypt len");
|
|
return BAD_TICKET_KEY_CB_SZ;
|
|
}
|
|
|
|
/* copy the decrypted ticket to avoid alignment issues */
|
|
XMEMCPY(&it, et->enc_ticket, sizeof(InternalTicket));
|
|
ForceZero(et->enc_ticket, sizeof(it));
|
|
|
|
/* get master secret */
|
|
if (ret == WOLFSSL_TICKET_RET_OK || ret == WOLFSSL_TICKET_RET_CREATE) {
|
|
if (ssl->version.minor < it.pv.minor) {
|
|
ForceZero(&it, sizeof(it));
|
|
WOLFSSL_MSG("Ticket has greater version");
|
|
return VERSION_ERROR;
|
|
}
|
|
else if (ssl->version.minor > it.pv.minor) {
|
|
if (IsAtLeastTLSv1_3(it.pv) != IsAtLeastTLSv1_3(ssl->version)) {
|
|
ForceZero(&it, sizeof(it));
|
|
WOLFSSL_MSG("Tickets cannot be shared between "
|
|
"TLS 1.3 and TLS 1.2 and lower");
|
|
return VERSION_ERROR;
|
|
}
|
|
|
|
if (!ssl->options.downgrade) {
|
|
ForceZero(&it, sizeof(it));
|
|
WOLFSSL_MSG("Ticket has lesser version");
|
|
return VERSION_ERROR;
|
|
}
|
|
|
|
WOLFSSL_MSG("Downgrading protocol due to ticket");
|
|
|
|
if (it.pv.minor < ssl->options.minDowngrade) {
|
|
ForceZero(&it, sizeof(it));
|
|
return VERSION_ERROR;
|
|
}
|
|
ssl->version.minor = it.pv.minor;
|
|
}
|
|
|
|
|
|
if (!IsAtLeastTLSv1_3(ssl->version)) {
|
|
XMEMCPY(ssl->arrays->masterSecret, it.msecret, SECRET_LEN);
|
|
/* Copy the haveExtendedMasterSecret property from the ticket to
|
|
* the saved session, so the property may be checked later. */
|
|
ssl->session.haveEMS = it.haveEMS;
|
|
#ifndef NO_RESUME_SUITE_CHECK
|
|
ssl->session.cipherSuite0 = it.suite[0];
|
|
ssl->session.cipherSuite = it.suite[1];
|
|
#endif
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_TLS13
|
|
/* Restore information to renegotiate. */
|
|
ssl->session.ticketSeen = it.timestamp;
|
|
ssl->session.ticketAdd = it.ageAdd;
|
|
ssl->session.cipherSuite0 = it.suite[0];
|
|
ssl->session.cipherSuite = it.suite[1];
|
|
#ifdef WOLFSSL_EARLY_DATA
|
|
ssl->session.maxEarlyDataSz = it.maxEarlyDataSz;
|
|
#endif
|
|
/* Resumption master secret. */
|
|
XMEMCPY(ssl->session.masterSecret, it.msecret, SECRET_LEN);
|
|
XMEMCPY(&ssl->session.ticketNonce, &it.ticketNonce,
|
|
sizeof(TicketNonce));
|
|
ssl->session.namedGroup = it.namedGroup;
|
|
#endif
|
|
}
|
|
}
|
|
|
|
ForceZero(&it, sizeof(it));
|
|
|
|
WOLFSSL_LEAVE("DoClientTicket", ret);
|
|
WOLFSSL_END(WC_FUNC_TICKET_DO);
|
|
|
|
return ret;
|
|
}
|
|
|
|
|
|
/* send Session Ticket */
|
|
int SendTicket(WOLFSSL* ssl)
|
|
{
|
|
byte* output;
|
|
int ret;
|
|
int sendSz;
|
|
word32 length = SESSION_HINT_SZ + LENGTH_SZ;
|
|
word32 idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
|
|
WOLFSSL_START(WC_FUNC_TICKET_SEND);
|
|
WOLFSSL_ENTER("SendTicket");
|
|
|
|
if (ssl->options.createTicket) {
|
|
ret = CreateTicket(ssl);
|
|
if (ret != 0) return ret;
|
|
}
|
|
|
|
length += ssl->session.ticketLen;
|
|
sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
|
|
|
|
if (!ssl->options.dtls) {
|
|
if (IsEncryptionOn(ssl, 1) && ssl->options.handShakeDone)
|
|
sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
idx += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
#endif
|
|
}
|
|
|
|
if (IsEncryptionOn(ssl, 1) && ssl->options.handShakeDone)
|
|
sendSz += cipherExtraData(ssl);
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, length, session_ticket, ssl);
|
|
|
|
/* hint */
|
|
c32toa(ssl->ctx->ticketHint, output + idx);
|
|
idx += SESSION_HINT_SZ;
|
|
|
|
/* length */
|
|
c16toa(ssl->session.ticketLen, output + idx);
|
|
idx += LENGTH_SZ;
|
|
|
|
/* ticket */
|
|
XMEMCPY(output + idx, ssl->session.ticket, ssl->session.ticketLen);
|
|
idx += ssl->session.ticketLen;
|
|
|
|
if (IsEncryptionOn(ssl, 1) && ssl->options.handShakeDone) {
|
|
byte* input;
|
|
int inputSz = idx; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls)
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz -= recordHeaderSz;
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 1, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
}
|
|
else {
|
|
#ifdef WOLFSSL_DTLS
|
|
if (ssl->options.dtls) {
|
|
if ((ret = DtlsMsgPoolSave(ssl, output, sendSz, session_ticket)) != 0)
|
|
return ret;
|
|
|
|
DtlsSEQIncrement(ssl, CUR_ORDER);
|
|
}
|
|
#endif
|
|
ret = HashOutput(ssl, output, sendSz, 0);
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
if (!ssl->options.groupMessages)
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendTicket", ret);
|
|
WOLFSSL_END(WC_FUNC_TICKET_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB
|
|
|
|
/* Initialize the context for session ticket encryption.
|
|
*
|
|
* @param [in] ctx SSL context.
|
|
* @param [in] keyCtx Context for session ticket encryption.
|
|
* @return 0 on success.
|
|
* @return BAD_MUTEX_E when initializing mutex fails.
|
|
*/
|
|
static int TicketEncCbCtx_Init(WOLFSSL_CTX* ctx, TicketEncCbCtx* keyCtx)
|
|
{
|
|
int ret = 0;
|
|
|
|
XMEMSET(keyCtx, 0, sizeof(*keyCtx));
|
|
keyCtx->ctx = ctx;
|
|
|
|
#ifndef SINGLE_THREADED
|
|
ret = wc_InitMutex(&keyCtx->mutex);
|
|
#endif
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Setup the session ticket encryption context for this.
|
|
*
|
|
* Initialize RNG, generate name, generate primeary key and set primary key
|
|
* expirary.
|
|
*
|
|
* @param [in] keyCtx Context for session ticket encryption.
|
|
* @param [in] heap Dynamic memory allocation hint.
|
|
* @param [in] devId Device identifier.
|
|
* @return 0 on success.
|
|
* @return Other value when random number generator fails.
|
|
*/
|
|
static int TicketEncCbCtx_Setup(TicketEncCbCtx* keyCtx, void* heap, int devId)
|
|
{
|
|
int ret;
|
|
|
|
#ifndef SINGLE_THREADED
|
|
ret = 0;
|
|
|
|
/* Check that key wasn't set up while waiting. */
|
|
if (keyCtx->expirary[0] == 0)
|
|
#endif
|
|
{
|
|
ret = wc_InitRng_ex(&keyCtx->rng, heap, devId);
|
|
if (ret == 0) {
|
|
ret = wc_RNG_GenerateBlock(&keyCtx->rng, keyCtx->name,
|
|
sizeof(keyCtx->name));
|
|
}
|
|
if (ret == 0) {
|
|
/* Mask of the bottom bit - used for index of key. */
|
|
keyCtx->name[WOLFSSL_TICKET_NAME_SZ - 1] &= 0xfe;
|
|
|
|
/* Generate initial primary key. */
|
|
ret = wc_RNG_GenerateBlock(&keyCtx->rng, keyCtx->key[0],
|
|
WOLFSSL_TICKET_KEY_SZ);
|
|
}
|
|
if (ret == 0) {
|
|
keyCtx->expirary[0] = LowResTimer() + WOLFSSL_TICKET_KEY_LIFETIME;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
/* Free the context for session ticket encryption.
|
|
*
|
|
* Zeroize keys and name.
|
|
*
|
|
* @param [in] keyCtx Context for session ticket encryption.
|
|
*/
|
|
static void TicketEncCbCtx_Free(TicketEncCbCtx* keyCtx)
|
|
{
|
|
/* Zeroize sensitive data. */
|
|
ForceZero(keyCtx->name, sizeof(keyCtx->name));
|
|
ForceZero(keyCtx->key[0], sizeof(keyCtx->key[0]));
|
|
ForceZero(keyCtx->key[1], sizeof(keyCtx->key[1]));
|
|
|
|
#ifndef SINGLE_THREADED
|
|
wc_FreeMutex(&keyCtx->mutex);
|
|
#endif
|
|
wc_FreeRng(&keyCtx->rng);
|
|
}
|
|
|
|
#if defined(HAVE_CHACHA) && defined(HAVE_POLY1305) && \
|
|
!defined(WOLFSSL_TICKET_ENC_AES128_GCM) && \
|
|
!defined(WOLFSSL_TICKET_ENC_AES256_GCM)
|
|
/* Ticket encryption/decryption implementation.
|
|
*
|
|
* @param [in] key Key for encryption/decryption.
|
|
* @param [in] keyLen Length of key in bytes.
|
|
* @param [in] iv IV/Nonce for encryption/decryption.
|
|
* @param [in] aad Additional authentication data.
|
|
* @param [in] aadSz Length of additional authentication data.
|
|
* @param [in] in Data to encrypt/decrypt.
|
|
* @param [in] inLen Length of encrypted data.
|
|
* @param [out] out Resulting data from encrypt/decrypt.
|
|
* @param [out] outLen Size of resulting data.
|
|
* @param [in] tag Authentication tag for encrypted data.
|
|
* @param [in] heap Dynamic memory allocation data hint.
|
|
* @param [in] enc 1 when encrypting, 0 when decrypting.
|
|
* @return 0 on success.
|
|
* @return Other value when encryption/decryption fails.
|
|
*/
|
|
static int TicketEncDec(byte* key, int keyLen, byte* iv, byte* aad, int aadSz,
|
|
byte* in, int inLen, byte* out, int* outLen, byte* tag,
|
|
void* heap, int enc)
|
|
{
|
|
int ret;
|
|
|
|
(void)keyLen;
|
|
(void)heap;
|
|
|
|
if (enc) {
|
|
ret = wc_ChaCha20Poly1305_Encrypt(key, iv, aad, aadSz, in, inLen, out,
|
|
tag);
|
|
}
|
|
else {
|
|
ret = wc_ChaCha20Poly1305_Decrypt(key, iv, aad, aadSz, in, inLen, tag,
|
|
out);
|
|
}
|
|
|
|
*outLen = inLen;
|
|
|
|
return ret;
|
|
}
|
|
#elif defined(HAVE_AESGCM)
|
|
/* Ticket encryption/decryption implementation.
|
|
*
|
|
* @param [in] key Key for encryption/decryption.
|
|
* @param [in] keyLen Length of key in bytes.
|
|
* @param [in] iv IV/Nonce for encryption/decryption.
|
|
* @param [in] aad Additional authentication data.
|
|
* @param [in] aadSz Length of additional authentication data.
|
|
* @param [in] in Data to encrypt/decrypt.
|
|
* @param [in] inLen Length of encrypted data.
|
|
* @param [out] out Resulting data from encrypt/decrypt.
|
|
* @param [out] outLen Size of resulting data.
|
|
* @param [in] tag Authentication tag for encrypted data.
|
|
* @param [in] heap Dynamic memory allocation data hint.
|
|
* @param [in] enc 1 when encrypting, 0 when decrypting.
|
|
* @return 0 on success.
|
|
* @return MEMORY_E when dynamic memory allocation fails.
|
|
* @return Other value when encryption/decryption fails.
|
|
*/
|
|
static int TicketEncDec(byte* key, int keyLen, byte* iv, byte* aad, int aadSz,
|
|
byte* in, int inLen, byte* out, int* outLen, byte* tag,
|
|
void* heap, int enc)
|
|
{
|
|
int ret;
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
Aes* aes;
|
|
#else
|
|
Aes aes[1];
|
|
#endif
|
|
|
|
(void)heap;
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
aes = (Aes*)XMALLOC(sizeof(Aes), heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
if (aes == NULL)
|
|
return MEMORY_E;
|
|
#endif
|
|
|
|
if (enc) {
|
|
ret = wc_AesInit(aes, NULL, INVALID_DEVID);
|
|
if (ret == 0) {
|
|
ret = wc_AesGcmSetKey(aes, key, keyLen);
|
|
}
|
|
if (ret == 0) {
|
|
ret = wc_AesGcmEncrypt(aes, in, out, inLen, iv, GCM_NONCE_MID_SZ,
|
|
tag, AES_BLOCK_SIZE, aad, aadSz);
|
|
}
|
|
wc_AesFree(aes);
|
|
}
|
|
else {
|
|
ret = wc_AesInit(aes, NULL, INVALID_DEVID);
|
|
if (ret == 0) {
|
|
ret = wc_AesGcmSetKey(aes, key, keyLen);
|
|
}
|
|
if (ret == 0) {
|
|
ret = wc_AesGcmDecrypt(aes, in, out, inLen, iv, GCM_NONCE_MID_SZ,
|
|
tag, AES_BLOCK_SIZE, aad, aadSz);
|
|
}
|
|
wc_AesFree(aes);
|
|
}
|
|
|
|
#ifdef WOLFSSL_SMALL_STACK
|
|
XFREE(aes, heap, DYNAMIC_TYPE_TMP_BUFFER);
|
|
#endif
|
|
|
|
*outLen = inLen;
|
|
|
|
return ret;
|
|
}
|
|
#else
|
|
#error "No encryption algorithm available for default ticket encryption."
|
|
#endif
|
|
|
|
/* Choose a key to use for encryption.
|
|
*
|
|
* Generate a new key if the current ones are expired.
|
|
* If the secondary key has not been used and the primary key has expired then
|
|
* generate a new primary key.
|
|
*
|
|
* @param [in] Ticket encryption callback context.
|
|
* @param [in] Session ticket lifetime.
|
|
* @param [out] Index of key to use for encryption.
|
|
* @return 0 on success.
|
|
* @return Other value when random number generation fails.
|
|
*/
|
|
static int TicketEncCbCtx_ChooseKey(TicketEncCbCtx* keyCtx, int ticketHint,
|
|
int* keyIdx)
|
|
{
|
|
int ret = 0;
|
|
|
|
/* Get new current time as lock may have taken some time. */
|
|
word32 now = LowResTimer();
|
|
|
|
/* Check expirary of primary key for encrypt. */
|
|
if (keyCtx->expirary[0] >= now + ticketHint) {
|
|
*keyIdx = 0;
|
|
}
|
|
/* Check expirary of primary key for encrypt. */
|
|
else if (keyCtx->expirary[1] >= now + ticketHint) {
|
|
*keyIdx = 1;
|
|
}
|
|
/* No key available to use. */
|
|
else {
|
|
int genKey;
|
|
|
|
/* Generate which ever key is expired for decrypt - primary first. */
|
|
if (keyCtx->expirary[0] < now) {
|
|
genKey = 0;
|
|
}
|
|
else if (keyCtx->expirary[1] < now) {
|
|
genKey = 1;
|
|
}
|
|
/* Timeouts and expirary should not allow this to happen. */
|
|
else {
|
|
return BAD_STATE_E;
|
|
}
|
|
|
|
/* Generate the required key */
|
|
ret = wc_RNG_GenerateBlock(&keyCtx->rng, keyCtx->key[genKey],
|
|
WOLFSSL_TICKET_KEY_SZ);
|
|
if (ret == 0) {
|
|
keyCtx->expirary[genKey] = now + WOLFSSL_TICKET_KEY_LIFETIME;
|
|
*keyIdx = genKey;
|
|
}
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* Default Session Ticket encryption/decryption callback.
|
|
*
|
|
* Use ChaCha20-Poly1305 or AES-GCM to encrypt/decrypt the ticket.
|
|
* Two keys are used:
|
|
* - When the first expires for encryption, then use the other.
|
|
* - Don't encrypt with key if the ticket lifetime will go beyond expirary.
|
|
* - Generate a new primary key when primary key expired for decrypt and
|
|
* no secondary key is activate for encryption.
|
|
* - Generate a new secondary key when expired and needed.
|
|
* - Calculate expirary starting from first encrypted ticket.
|
|
* - Key name has last bit set to indicate index of key.
|
|
* Keys expire for decryption after ticket key lifetime from the first encrypted
|
|
* ticket.
|
|
* Keys can only be use for encryption while the ticket hint does not exceed
|
|
* the key lifetime.
|
|
* Lifetime of a key must be greater than the lifetime of a ticket. This means
|
|
* that if one ticket is only valid for decryption, then the other will be
|
|
* valid for encryption.
|
|
* AAD = key_name | iv | ticket len (16-bits network order)
|
|
*
|
|
* @param [in] ssl SSL connection.
|
|
* @param [in,out] key_name Name of key from client.
|
|
* Encrypt: name of key returned.
|
|
* Decrypt: name from ticket message to check.
|
|
* @param [in] iv IV to use in encryption/decryption.
|
|
* @param [in] mac MAC for authentication of encrypted data.
|
|
* @param [in] enc 1 when encrypting ticket, 0 when decrypting.
|
|
* @param [in,out] ticket Encrypted/decrypted session ticket bytes.
|
|
* @param [in] inLen Length of incoming ticket.
|
|
* @param [out] outLen Length of outgoing ticket.
|
|
* @param [in] userCtx Context for encryption/decryption of ticket.
|
|
* @return WOLFSSL_TICKET_RET_OK when successful.
|
|
* @return WOLFSSL_TICKET_RET_CREATE when successful and a new ticket is to
|
|
* be created for TLS 1.2 and below.
|
|
* @return WOLFSSL_TICKET_RET_REJECT when failed to produce valid encrypted or
|
|
* decrypted ticket.
|
|
* @return WOLFSSL_TICKET_RET_FATAL when key name does not match.
|
|
*/
|
|
static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
|
|
byte iv[WOLFSSL_TICKET_IV_SZ],
|
|
byte mac[WOLFSSL_TICKET_MAC_SZ],
|
|
int enc, byte* ticket, int inLen, int* outLen,
|
|
void* userCtx)
|
|
{
|
|
int ret;
|
|
TicketEncCbCtx* keyCtx = (TicketEncCbCtx*)userCtx;
|
|
WOLFSSL_CTX* ctx = keyCtx->ctx;
|
|
word16 sLen = XHTONS(inLen);
|
|
byte aad[WOLFSSL_TICKET_NAME_SZ + WOLFSSL_TICKET_IV_SZ + sizeof(sLen)];
|
|
int aadSz = WOLFSSL_TICKET_NAME_SZ + WOLFSSL_TICKET_IV_SZ + sizeof(sLen);
|
|
byte* p = aad;
|
|
int keyIdx = 0;
|
|
|
|
/* Check we have setup the RNG, name and primary key. */
|
|
if (keyCtx->expirary[0] == 0) {
|
|
#ifndef SINGLE_THREADED
|
|
/* Lock around access to expirary and key - stop initial key being
|
|
* generated twice at the same time. */
|
|
if (wc_LockMutex(&keyCtx->mutex) != 0) {
|
|
WOLFSSL_MSG("Couldn't lock key context mutex");
|
|
return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
#endif
|
|
/* Sets expirary of primary key in setup. */
|
|
ret = TicketEncCbCtx_Setup(keyCtx, ssl->ctx->heap, ssl->ctx->devId);
|
|
#ifndef SINGLE_THREADED
|
|
wc_UnLockMutex(&keyCtx->mutex);
|
|
#endif
|
|
if (ret != 0)
|
|
return ret;
|
|
}
|
|
|
|
if (enc) {
|
|
/* Return the name of the key - missing key index. */
|
|
XMEMCPY(key_name, keyCtx->name, WOLFSSL_TICKET_NAME_SZ);
|
|
|
|
/* Generate a new IV into buffer to be returned.
|
|
* Don't use the RNG in keyCtx as it's for generating private data. */
|
|
ret = wc_RNG_GenerateBlock(ssl->rng, iv, WOLFSSL_TICKET_IV_SZ);
|
|
if (ret != 0) {
|
|
return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
}
|
|
else {
|
|
/* Mask of last bit that is the key index. */
|
|
byte lastByte = key_name[WOLFSSL_TICKET_NAME_SZ - 1] & 0xfe;
|
|
|
|
/* For decryption, see if we know this key - check all but last byte. */
|
|
if (XMEMCMP(key_name, keyCtx->name, WOLFSSL_TICKET_NAME_SZ - 1) != 0) {
|
|
return WOLFSSL_TICKET_RET_FATAL;
|
|
}
|
|
/* Ensure last byte without index bit matches too. */
|
|
if (lastByte != keyCtx->name[WOLFSSL_TICKET_NAME_SZ - 1]) {
|
|
return WOLFSSL_TICKET_RET_FATAL;
|
|
}
|
|
}
|
|
|
|
/* Build AAD from: key name, iv, and length of ticket. */
|
|
XMEMCPY(p, keyCtx->name, WOLFSSL_TICKET_NAME_SZ);
|
|
p += WOLFSSL_TICKET_NAME_SZ;
|
|
XMEMCPY(p, iv, WOLFSSL_TICKET_IV_SZ);
|
|
p += WOLFSSL_TICKET_IV_SZ;
|
|
XMEMCPY(p, &sLen, sizeof(sLen));
|
|
|
|
/* Encrypt ticket. */
|
|
if (enc) {
|
|
word32 now;
|
|
|
|
now = LowResTimer();
|
|
/* As long as encryption expirary isn't imminent - no lock. */
|
|
if (keyCtx->expirary[0] > now + ctx->ticketHint) {
|
|
keyIdx = 0;
|
|
}
|
|
else if (keyCtx->expirary[1] > now + ctx->ticketHint) {
|
|
keyIdx = 1;
|
|
}
|
|
else {
|
|
#ifndef SINGLE_THREADED
|
|
/* Lock around access to expirary and key - stop key being generated
|
|
* twice at the same time. */
|
|
if (wc_LockMutex(&keyCtx->mutex) != 0) {
|
|
WOLFSSL_MSG("Couldn't lock key context mutex");
|
|
return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
#endif
|
|
ret = TicketEncCbCtx_ChooseKey(keyCtx, ctx->ticketHint, &keyIdx);
|
|
#ifndef SINGLE_THREADED
|
|
wc_UnLockMutex(&keyCtx->mutex);
|
|
#endif
|
|
if (ret != 0) {
|
|
return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
}
|
|
/* Set the name of the key to the index chosen. */
|
|
key_name[WOLFSSL_TICKET_NAME_SZ - 1] |= keyIdx;
|
|
/* Update AAD too. */
|
|
aad[WOLFSSL_TICKET_NAME_SZ - 1] |= keyIdx;
|
|
|
|
/* Encrypt ticket data. */
|
|
ret = TicketEncDec(keyCtx->key[keyIdx], WOLFSSL_TICKET_KEY_SZ, iv, aad,
|
|
aadSz, ticket, inLen, ticket, outLen, mac, ssl->heap,
|
|
1);
|
|
if (ret != 0) return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
/* Decrypt ticket. */
|
|
else {
|
|
/* Get index of key from name. */
|
|
keyIdx = key_name[WOLFSSL_TICKET_NAME_SZ - 1] & 0x1;
|
|
/* Update AAD with index. */
|
|
aad[WOLFSSL_TICKET_NAME_SZ - 1] |= keyIdx;
|
|
|
|
/* Check expirary */
|
|
if (keyCtx->expirary[keyIdx] <= LowResTimer()) {
|
|
return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
|
|
/* Decrypt ticket data. */
|
|
ret = TicketEncDec(keyCtx->key[keyIdx], WOLFSSL_TICKET_KEY_SZ, iv, aad,
|
|
aadSz, ticket, inLen, ticket, outLen, mac, ssl->heap,
|
|
0);
|
|
if (ret != 0) {
|
|
return WOLFSSL_TICKET_RET_REJECT;
|
|
}
|
|
}
|
|
|
|
#ifndef WOLFSSL_TICKET_DECRYPT_NO_CREATE
|
|
if (!IsAtLeastTLSv1_3(ssl->version) && !enc)
|
|
return WOLFSSL_TICKET_RET_CREATE;
|
|
#endif
|
|
return WOLFSSL_TICKET_RET_OK;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_DEF_TICKET_ENC_CB */
|
|
|
|
#endif /* HAVE_SESSION_TICKET */
|
|
|
|
#ifndef WOLFSSL_NO_TLS12
|
|
|
|
#if defined(HAVE_SECURE_RENEGOTIATION) && \
|
|
defined(HAVE_SERVER_RENEGOTIATION_INFO) && \
|
|
!defined(WOLFSSL_NO_SERVER)
|
|
|
|
/* handle generation of server's hello_request (0) */
|
|
int SendHelloRequest(WOLFSSL* ssl)
|
|
{
|
|
byte* output;
|
|
int sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
|
|
int ret;
|
|
|
|
WOLFSSL_START(WC_FUNC_HELLO_REQUEST_SEND);
|
|
WOLFSSL_ENTER("SendHelloRequest");
|
|
|
|
if (IsEncryptionOn(ssl, 1))
|
|
sendSz += MAX_MSG_EXTRA;
|
|
|
|
if (ssl->options.dtls)
|
|
sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
AddHeaders(output, 0, hello_request, ssl);
|
|
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input;
|
|
int inputSz = HANDSHAKE_HEADER_SZ; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls) {
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz += DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl) &&
|
|
(ret = DtlsMsgPoolSave(ssl, input, inputSz, hello_request)) != 0) {
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
return ret;
|
|
}
|
|
#endif
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 0, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
ret = SendBuffered(ssl);
|
|
|
|
WOLFSSL_LEAVE("SendHelloRequest", ret);
|
|
WOLFSSL_END(WC_FUNC_HELLO_REQUEST_SEND);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* HAVE_SECURE_RENEGOTIATION && HAVE_SERVER_RENEGOTIATION_INFO */
|
|
|
|
#ifdef WOLFSSL_DTLS
|
|
/* handle generation of DTLS hello_verify_request (3) */
|
|
static int SendHelloVerifyRequest(WOLFSSL* ssl,
|
|
const byte* cookie, byte cookieSz)
|
|
{
|
|
byte* output;
|
|
int length = VERSION_SZ + ENUM_LEN + cookieSz;
|
|
int idx = DTLS_RECORD_HEADER_SZ + DTLS_HANDSHAKE_HEADER_SZ;
|
|
int sendSz = length + idx;
|
|
int ret;
|
|
|
|
/* are we in scr */
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
sendSz += MAX_MSG_EXTRA;
|
|
}
|
|
|
|
/* check for available size */
|
|
if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
|
|
return ret;
|
|
|
|
/* get output buffer */
|
|
output = ssl->buffers.outputBuffer.buffer +
|
|
ssl->buffers.outputBuffer.length;
|
|
|
|
/* Hello Verify Request should use the same sequence number as the
|
|
* Client Hello. */
|
|
ssl->keys.dtls_sequence_number_hi = ssl->keys.curSeq_hi;
|
|
ssl->keys.dtls_sequence_number_lo = ssl->keys.curSeq_lo;
|
|
AddHeaders(output, length, hello_verify_request, ssl);
|
|
|
|
#ifdef OPENSSL_EXTRA
|
|
output[idx++] = DTLS_MAJOR;
|
|
output[idx++] = DTLS_MINOR;
|
|
#else
|
|
output[idx++] = ssl->version.major;
|
|
output[idx++] = ssl->version.minor;
|
|
#endif
|
|
|
|
output[idx++] = cookieSz;
|
|
if (cookie == NULL || cookieSz == 0)
|
|
return COOKIE_ERROR;
|
|
|
|
XMEMCPY(output + idx, cookie, cookieSz);
|
|
|
|
#if defined(WOLFSSL_CALLBACKS) || defined(OPENSSL_EXTRA)
|
|
if (ssl->hsInfoOn)
|
|
AddPacketName(ssl, "HelloVerifyRequest");
|
|
if (ssl->toInfoOn)
|
|
AddPacketInfo(ssl, "HelloVerifyRequest", handshake, output,
|
|
sendSz, WRITE_PROTO, ssl->heap);
|
|
#endif
|
|
|
|
/* are we in scr */
|
|
if (IsEncryptionOn(ssl, 1)) {
|
|
byte* input;
|
|
int inputSz = HANDSHAKE_HEADER_SZ + length; /* build msg adds rec hdr */
|
|
int recordHeaderSz = RECORD_HEADER_SZ;
|
|
|
|
if (ssl->options.dtls) {
|
|
recordHeaderSz += DTLS_RECORD_EXTRA;
|
|
inputSz += DTLS_HANDSHAKE_EXTRA;
|
|
}
|
|
|
|
input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
if (input == NULL)
|
|
return MEMORY_E;
|
|
|
|
XMEMCPY(input, output + recordHeaderSz, inputSz);
|
|
sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
|
|
handshake, 0, 0, 0, CUR_ORDER);
|
|
XFREE(input, ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
|
|
|
|
if (sendSz < 0)
|
|
return sendSz;
|
|
}
|
|
|
|
ssl->buffers.outputBuffer.length += sendSz;
|
|
|
|
return SendBuffered(ssl);
|
|
}
|
|
#endif /* WOLFSSL_DTLS */
|
|
|
|
typedef struct DckeArgs {
|
|
byte* output; /* not allocated */
|
|
word32 length;
|
|
word32 idx;
|
|
word32 begin;
|
|
word32 sigSz;
|
|
#ifndef NO_RSA
|
|
int lastErr;
|
|
#endif
|
|
} DckeArgs;
|
|
|
|
static void FreeDckeArgs(WOLFSSL* ssl, void* pArgs)
|
|
{
|
|
DckeArgs* args = (DckeArgs*)pArgs;
|
|
|
|
(void)ssl;
|
|
(void)args;
|
|
}
|
|
|
|
/* handle processing client_key_exchange (16) */
|
|
static int DoClientKeyExchange(WOLFSSL* ssl, byte* input, word32* inOutIdx,
|
|
word32 size)
|
|
{
|
|
int ret;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
DckeArgs* args = (DckeArgs*)ssl->async.args;
|
|
typedef char args_test[sizeof(ssl->async.args) >= sizeof(*args) ? 1 : -1];
|
|
(void)sizeof(args_test);
|
|
#else
|
|
DckeArgs args[1];
|
|
#endif
|
|
|
|
(void)size;
|
|
(void)input;
|
|
|
|
WOLFSSL_START(WC_FUNC_CLIENT_KEY_EXCHANGE_DO);
|
|
WOLFSSL_ENTER("DoClientKeyExchange");
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ret = wolfSSL_AsyncPop(ssl, &ssl->options.asyncState);
|
|
if (ret != WC_NOT_PENDING_E) {
|
|
/* Check for error */
|
|
if (ret < 0)
|
|
goto exit_dcke;
|
|
}
|
|
else
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
{
|
|
/* Reset state */
|
|
ret = 0;
|
|
ssl->options.asyncState = TLS_ASYNC_BEGIN;
|
|
XMEMSET(args, 0, sizeof(DckeArgs));
|
|
args->idx = *inOutIdx;
|
|
args->begin = *inOutIdx;
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
ssl->async.freeArgs = FreeDckeArgs;
|
|
#endif
|
|
}
|
|
|
|
/* Do Client Key Exchange State Machine */
|
|
switch(ssl->options.asyncState)
|
|
{
|
|
case TLS_ASYNC_BEGIN:
|
|
{
|
|
/* Sanity checks */
|
|
if (ssl->options.side != WOLFSSL_SERVER_END) {
|
|
WOLFSSL_MSG("Client received client keyexchange, attack?");
|
|
WOLFSSL_ERROR(ssl->error = SIDE_ERROR);
|
|
ERROR_OUT(WOLFSSL_FATAL_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (ssl->options.clientState < CLIENT_HELLO_COMPLETE) {
|
|
WOLFSSL_MSG("Client sending keyexchange at wrong time");
|
|
SendAlert(ssl, alert_fatal, unexpected_message);
|
|
ERROR_OUT(OUT_OF_ORDER_E, exit_dcke);
|
|
}
|
|
|
|
#if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
if (ssl->options.verifyPeer && ssl->options.failNoCert) {
|
|
if (!ssl->options.havePeerCert) {
|
|
WOLFSSL_MSG("client didn't present peer cert");
|
|
ERROR_OUT(NO_PEER_CERT, exit_dcke);
|
|
}
|
|
}
|
|
|
|
if (ssl->options.verifyPeer && ssl->options.failNoCertxPSK) {
|
|
if (!ssl->options.havePeerCert &&
|
|
!ssl->options.usingPSK_cipher) {
|
|
WOLFSSL_MSG("client didn't present peer cert");
|
|
return NO_PEER_CERT;
|
|
}
|
|
}
|
|
#endif /* !NO_CERTS && !WOLFSSL_NO_CLIENT_AUTH */
|
|
|
|
#if defined(WOLFSSL_CALLBACKS)
|
|
if (ssl->hsInfoOn) {
|
|
AddPacketName(ssl, "ClientKeyExchange");
|
|
}
|
|
if (ssl->toInfoOn) {
|
|
AddLateName("ClientKeyExchange", &ssl->timeoutInfo);
|
|
}
|
|
#endif
|
|
|
|
if (ssl->arrays->preMasterSecret == NULL) {
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN;
|
|
ssl->arrays->preMasterSecret = (byte*)XMALLOC(ENCRYPT_LEN,
|
|
ssl->heap, DYNAMIC_TYPE_SECRET);
|
|
if (ssl->arrays->preMasterSecret == NULL) {
|
|
ERROR_OUT(MEMORY_E, exit_dcke);
|
|
}
|
|
XMEMSET(ssl->arrays->preMasterSecret, 0, ENCRYPT_LEN);
|
|
}
|
|
|
|
switch (ssl->specs.kea) {
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
break;
|
|
} /* rsa_kea */
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
/* sanity check that PSK server callback has been set */
|
|
if (ssl->options.server_psk_cb == NULL) {
|
|
WOLFSSL_MSG("No server PSK callback set");
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
/* make sure private key exists */
|
|
if (ssl->buffers.key == NULL ||
|
|
ssl->buffers.key->buffer == NULL) {
|
|
ERROR_OUT(NO_PRIVATE_KEY, exit_dcke);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
/* sanity check that PSK server callback has been set */
|
|
if (ssl->options.server_psk_cb == NULL) {
|
|
WOLFSSL_MSG("No server PSK callback set");
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
/* sanity check that PSK server callback has been set */
|
|
if (ssl->options.server_psk_cb == NULL) {
|
|
WOLFSSL_MSG("No server PSK callback set");
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
|
|
}
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
default:
|
|
WOLFSSL_MSG("Bad kea type");
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch (ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_BUILD;
|
|
} /* TLS_ASYNC_BEGIN */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_BUILD:
|
|
{
|
|
switch (ssl->specs.kea) {
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
word16 keySz;
|
|
|
|
ssl->buffers.keyType = rsa_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
args->length = (word32)keySz;
|
|
ssl->arrays->preMasterSz = SECRET_LEN;
|
|
|
|
if (ssl->options.tls) {
|
|
word16 check;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &check);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((word32)check != args->length) {
|
|
WOLFSSL_MSG("RSA explicit size doesn't match");
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
#endif
|
|
ERROR_OUT(RSA_PRIVATE_ERROR, exit_dcke);
|
|
}
|
|
}
|
|
|
|
if ((args->idx - args->begin) + args->length > size) {
|
|
WOLFSSL_MSG("RSA message too big");
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
/* pre-load PreMasterSecret with RNG data */
|
|
ret = wc_RNG_GenerateBlock(ssl->rng,
|
|
&ssl->arrays->preMasterSecret[VERSION_SZ],
|
|
SECRET_LEN - VERSION_SZ);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
args->output = NULL;
|
|
break;
|
|
} /* rsa_kea */
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
byte* pms = ssl->arrays->preMasterSecret;
|
|
word16 ci_sz;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &ci_sz);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if (ci_sz > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(CLIENT_ID_ERROR, exit_dcke);
|
|
}
|
|
|
|
if ((args->idx - args->begin) + ci_sz > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
XMEMCPY(ssl->arrays->client_identity,
|
|
input + args->idx, ci_sz);
|
|
args->idx += ci_sz;
|
|
|
|
ssl->arrays->client_identity[ci_sz] = '\0'; /* null term */
|
|
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
|
|
ssl->arrays->client_identity, ssl->arrays->psk_key,
|
|
MAX_PSK_KEY_LEN);
|
|
|
|
if (ssl->arrays->psk_keySz == 0 ||
|
|
ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
|
|
#if defined(WOLFSSL_EXTRA_ALERTS) || \
|
|
defined(WOLFSSL_PSK_IDENTITY_ALERT)
|
|
SendAlert(ssl, alert_fatal,
|
|
unknown_psk_identity);
|
|
#endif
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
/* make psk pre master secret */
|
|
/* length of key + length 0s + length of key + key */
|
|
c16toa((word16) ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
|
|
XMEMSET(pms, 0, ssl->arrays->psk_keySz);
|
|
pms += ssl->arrays->psk_keySz;
|
|
|
|
c16toa((word16) ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
|
|
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->preMasterSz =
|
|
(ssl->arrays->psk_keySz * 2) + (OPAQUE16_LEN * 2);
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
word16 cipherLen;
|
|
word16 plainLen = ENCRYPT_LEN;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &cipherLen);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if (cipherLen > MAX_NTRU_ENCRYPT_SZ) {
|
|
ERROR_OUT(NTRU_KEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if ((args->idx - args->begin) + cipherLen > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (NTRU_OK != ntru_crypto_ntru_decrypt(
|
|
(word16) ssl->buffers.key->length,
|
|
ssl->buffers.key->buffer, cipherLen,
|
|
input + args->idx, &plainLen,
|
|
ssl->arrays->preMasterSecret)) {
|
|
ERROR_OUT(NTRU_DECRYPT_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (plainLen != SECRET_LEN) {
|
|
ERROR_OUT(NTRU_DECRYPT_ERROR, exit_dcke);
|
|
}
|
|
|
|
args->idx += cipherLen;
|
|
ssl->arrays->preMasterSz = plainLen;
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
#ifdef HAVE_ECC
|
|
ecc_key* private_key = ssl->eccTempKey;
|
|
|
|
/* handle static private key */
|
|
if (ssl->specs.static_ecdh &&
|
|
ssl->ecdhCurveOID != ECC_X25519_OID &&
|
|
ssl->ecdhCurveOID != ECC_X448_OID) {
|
|
word16 keySz;
|
|
|
|
ssl->buffers.keyType = ecc_dsa_sa_algo;
|
|
ret = DecodePrivateKey(ssl, &keySz);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
private_key = (ecc_key*)ssl->hsKey;
|
|
}
|
|
#endif
|
|
|
|
/* import peer ECC key */
|
|
if ((args->idx - args->begin) + OPAQUE8_LEN > size) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
#endif
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
args->length = input[args->idx++];
|
|
|
|
if ((args->idx - args->begin) + args->length > size) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
#endif
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X25519SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
if (ssl->peerX25519Key == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
} else if (ssl->peerX25519KeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve25519_check_public(
|
|
input + args->idx, args->length,
|
|
EC25519_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal,
|
|
illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (wc_curve25519_import_public_ex(
|
|
input + args->idx, args->length,
|
|
ssl->peerX25519Key,
|
|
EC25519_LITTLE_ENDIAN)) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
ssl->arrays->preMasterSz = CURVE25519_KEYSIZE;
|
|
|
|
ssl->peerX25519KeyPresent = 1;
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X448SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
if (ssl->peerX448Key == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
} else if (ssl->peerX448KeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve448_check_public(
|
|
input + args->idx, args->length,
|
|
EC448_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal,
|
|
illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (wc_curve448_import_public_ex(
|
|
input + args->idx, args->length,
|
|
ssl->peerX448Key,
|
|
EC448_LITTLE_ENDIAN)) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
ssl->arrays->preMasterSz = CURVE448_KEY_SIZE;
|
|
|
|
ssl->peerX448KeyPresent = 1;
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->EccSharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
if (!ssl->specs.static_ecdh &&
|
|
ssl->eccTempKeyPresent == 0) {
|
|
WOLFSSL_MSG("Ecc ephemeral key not made correctly");
|
|
ERROR_OUT(ECC_MAKEKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (ssl->peerEccKey == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
} else if (ssl->peerEccKeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_ECC,
|
|
ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
|
|
if (wc_ecc_import_x963_ex(input + args->idx,
|
|
args->length, ssl->peerEccKey,
|
|
private_key->dp->id)) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, illegal_parameter);
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
ssl->arrays->preMasterSz = private_key->dp->size;
|
|
|
|
ssl->peerEccKeyPresent = 1;
|
|
|
|
#if defined(WOLFSSL_TLS13) || defined(HAVE_FFDHE)
|
|
/* client_hello may have sent FFEDH2048, which sets namedGroup,
|
|
but that is not being used, so clear it */
|
|
/* resolves issue with server side wolfSSL_get_curve_name */
|
|
ssl->namedGroup = 0;
|
|
#endif
|
|
#endif /* HAVE_ECC */
|
|
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
word16 clientPubSz;
|
|
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &clientPubSz);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + clientPubSz > size) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
#endif
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
args->sigSz = clientPubSz;
|
|
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_DH,
|
|
(void**)&ssl->buffers.serverDH_Key);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
ret = wc_DhSetKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
|
|
/* set the max agree result size */
|
|
ssl->arrays->preMasterSz = ENCRYPT_LEN;
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
word16 clientSz;
|
|
|
|
/* Read in the PSK hint */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &clientSz);
|
|
args->idx += OPAQUE16_LEN;
|
|
if (clientSz > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(CLIENT_ID_ERROR, exit_dcke);
|
|
}
|
|
|
|
if ((args->idx - args->begin) + clientSz > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
XMEMCPY(ssl->arrays->client_identity, input + args->idx,
|
|
clientSz);
|
|
args->idx += clientSz;
|
|
ssl->arrays->client_identity[clientSz] = '\0'; /* null term */
|
|
|
|
/* Read in the DHE business */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &clientSz);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if ((args->idx - args->begin) + clientSz > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
args->sigSz = clientSz;
|
|
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_DH,
|
|
(void**)&ssl->buffers.serverDH_Key);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
ret = wc_DhSetKey(ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_P.buffer,
|
|
ssl->buffers.serverDH_P.length,
|
|
ssl->buffers.serverDH_G.buffer,
|
|
ssl->buffers.serverDH_G.length);
|
|
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
word16 clientSz;
|
|
|
|
/* Read in the PSK hint */
|
|
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
ato16(input + args->idx, &clientSz);
|
|
args->idx += OPAQUE16_LEN;
|
|
if (clientSz > MAX_PSK_ID_LEN) {
|
|
ERROR_OUT(CLIENT_ID_ERROR, exit_dcke);
|
|
}
|
|
if ((args->idx - args->begin) + clientSz > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
XMEMCPY(ssl->arrays->client_identity,
|
|
input + args->idx, clientSz);
|
|
args->idx += clientSz;
|
|
ssl->arrays->client_identity[clientSz] = '\0'; /* null term */
|
|
|
|
/* import peer ECC key */
|
|
if ((args->idx - args->begin) + OPAQUE8_LEN > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
args->length = input[args->idx++];
|
|
|
|
if ((args->idx - args->begin) + args->length > size) {
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
|
|
args->sigSz = ENCRYPT_LEN - OPAQUE16_LEN;
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X25519SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
if (ssl->eccTempKeyPresent == 0) {
|
|
WOLFSSL_MSG(
|
|
"X25519 ephemeral key not made correctly");
|
|
ERROR_OUT(ECC_MAKEKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (ssl->peerX25519Key == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
} else if (ssl->peerX25519KeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve25519_check_public(
|
|
input + args->idx, args->length,
|
|
EC25519_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal,
|
|
illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (wc_curve25519_import_public_ex(
|
|
input + args->idx, args->length,
|
|
ssl->peerX25519Key,
|
|
EC25519_LITTLE_ENDIAN)) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
ssl->peerX25519KeyPresent = 1;
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->X448SharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
if (ssl->eccTempKeyPresent == 0) {
|
|
WOLFSSL_MSG(
|
|
"X448 ephemeral key not made correctly");
|
|
ERROR_OUT(ECC_MAKEKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (ssl->peerX448Key == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
} else if (ssl->peerX448KeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
|
|
if ((ret = wc_curve448_check_public(
|
|
input + args->idx, args->length,
|
|
EC448_LITTLE_ENDIAN)) != 0) {
|
|
#ifdef WOLFSSL_EXTRA_ALERTS
|
|
if (ret == BUFFER_E)
|
|
SendAlert(ssl, alert_fatal, decode_error);
|
|
else if (ret == ECC_OUT_OF_RANGE_E)
|
|
SendAlert(ssl, alert_fatal, bad_record_mac);
|
|
else {
|
|
SendAlert(ssl, alert_fatal,
|
|
illegal_parameter);
|
|
}
|
|
#endif
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (wc_curve448_import_public_ex(
|
|
input + args->idx, args->length,
|
|
ssl->peerX448Key,
|
|
EC448_LITTLE_ENDIAN)) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
ssl->peerX448KeyPresent = 1;
|
|
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
/* if callback then use it for shared secret */
|
|
if (ssl->ctx->EccSharedSecretCb != NULL) {
|
|
break;
|
|
}
|
|
#endif
|
|
|
|
if (ssl->eccTempKeyPresent == 0) {
|
|
WOLFSSL_MSG("Ecc ephemeral key not made correctly");
|
|
ERROR_OUT(ECC_MAKEKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
if (ssl->peerEccKey == NULL) {
|
|
/* alloc/init on demand */
|
|
ret = AllocKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
else if (ssl->peerEccKeyPresent) {
|
|
ret = ReuseKey(ssl, DYNAMIC_TYPE_ECC,
|
|
ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
}
|
|
if (wc_ecc_import_x963_ex(input + args->idx,
|
|
args->length, ssl->peerEccKey,
|
|
ssl->eccTempKey->dp->id)) {
|
|
ERROR_OUT(ECC_PEERKEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
ssl->peerEccKeyPresent = 1;
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch (ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_DO;
|
|
} /* TLS_ASYNC_BUILD */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_DO:
|
|
{
|
|
switch (ssl->specs.kea) {
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
RsaKey* key = (RsaKey*)ssl->hsKey;
|
|
|
|
ret = RsaDec(ssl,
|
|
input + args->idx,
|
|
args->length,
|
|
&args->output,
|
|
&args->sigSz,
|
|
key,
|
|
#ifdef HAVE_PK_CALLBACKS
|
|
ssl->buffers.key
|
|
#else
|
|
NULL
|
|
#endif
|
|
);
|
|
|
|
/* Errors that can occur here that should be
|
|
* indistinguishable:
|
|
* RSA_BUFFER_E, RSA_PAD_E and RSA_PRIVATE_ERROR
|
|
*/
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret == WC_PENDING_E)
|
|
goto exit_dcke;
|
|
#endif
|
|
if (ret == BAD_FUNC_ARG)
|
|
goto exit_dcke;
|
|
|
|
args->lastErr = ret - (SECRET_LEN - args->sigSz);
|
|
ret = 0;
|
|
break;
|
|
} /* rsa_kea */
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
void* private_key = ssl->eccTempKey;
|
|
(void)private_key;
|
|
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
ret = X25519SharedSecret(ssl,
|
|
(curve25519_key*)private_key,
|
|
ssl->peerX25519Key,
|
|
input + args->idx, &args->length,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_SERVER_END
|
|
);
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
ret = X448SharedSecret(ssl,
|
|
(curve448_key*)private_key,
|
|
ssl->peerX448Key,
|
|
input + args->idx, &args->length,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_SERVER_END
|
|
);
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_ECC
|
|
if (ssl->specs.static_ecdh) {
|
|
private_key = ssl->hsKey;
|
|
}
|
|
|
|
/* Generate shared secret */
|
|
ret = EccSharedSecret(ssl,
|
|
(ecc_key*)private_key, ssl->peerEccKey,
|
|
input + args->idx, &args->length,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz,
|
|
WOLFSSL_SERVER_END
|
|
);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
}
|
|
#endif
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
ret = DhAgree(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_Priv.buffer,
|
|
ssl->buffers.serverDH_Priv.length,
|
|
input + args->idx,
|
|
(word16)args->sigSz,
|
|
ssl->arrays->preMasterSecret,
|
|
&ssl->arrays->preMasterSz);
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
ret = DhAgree(ssl, ssl->buffers.serverDH_Key,
|
|
ssl->buffers.serverDH_Priv.buffer,
|
|
ssl->buffers.serverDH_Priv.length,
|
|
input + args->idx,
|
|
(word16)args->sigSz,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&ssl->arrays->preMasterSz);
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
#ifdef HAVE_CURVE25519
|
|
if (ssl->ecdhCurveOID == ECC_X25519_OID) {
|
|
ret = X25519SharedSecret(ssl,
|
|
(curve25519_key*)ssl->eccTempKey,
|
|
ssl->peerX25519Key,
|
|
input + args->idx, &args->length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&args->sigSz,
|
|
WOLFSSL_SERVER_END
|
|
);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE25519,
|
|
(void**)&ssl->peerX25519Key);
|
|
ssl->peerX25519KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
#ifdef HAVE_CURVE448
|
|
if (ssl->ecdhCurveOID == ECC_X448_OID) {
|
|
ret = X448SharedSecret(ssl,
|
|
(curve448_key*)ssl->eccTempKey,
|
|
ssl->peerX448Key,
|
|
input + args->idx, &args->length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&args->sigSz,
|
|
WOLFSSL_SERVER_END
|
|
);
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
if (ret != WC_PENDING_E)
|
|
#endif
|
|
{
|
|
FreeKey(ssl, DYNAMIC_TYPE_CURVE448,
|
|
(void**)&ssl->peerX448Key);
|
|
ssl->peerX448KeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif
|
|
/* Generate shared secret */
|
|
ret = EccSharedSecret(ssl,
|
|
ssl->eccTempKey, ssl->peerEccKey,
|
|
input + args->idx, &args->length,
|
|
ssl->arrays->preMasterSecret + OPAQUE16_LEN,
|
|
&args->sigSz,
|
|
WOLFSSL_SERVER_END
|
|
);
|
|
if (!ssl->specs.static_ecdh
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
&& ret != WC_PENDING_E
|
|
#endif
|
|
) {
|
|
FreeKey(ssl, DYNAMIC_TYPE_ECC,
|
|
(void**)&ssl->peerEccKey);
|
|
ssl->peerEccKeyPresent = 0;
|
|
}
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch (ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_VERIFY;
|
|
} /* TLS_ASYNC_DO */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_VERIFY:
|
|
{
|
|
switch (ssl->specs.kea) {
|
|
#ifndef NO_RSA
|
|
case rsa_kea:
|
|
{
|
|
byte mask;
|
|
int i;
|
|
|
|
/* Add the signature length to idx */
|
|
args->idx += args->length;
|
|
|
|
#ifdef DEBUG_WOLFSSL
|
|
/* check version (debug warning message only) */
|
|
if (args->output != NULL) {
|
|
if (args->output[0] != ssl->chVersion.major ||
|
|
args->output[1] != ssl->chVersion.minor) {
|
|
WOLFSSL_MSG("preMasterSecret version mismatch");
|
|
}
|
|
}
|
|
#endif
|
|
|
|
/* RFC5246 7.4.7.1:
|
|
* Treat incorrectly formatted message blocks and/or
|
|
* mismatched version numbers in a manner
|
|
* indistinguishable from correctly formatted RSA blocks
|
|
*/
|
|
|
|
ret = args->lastErr;
|
|
args->lastErr = 0; /* reset */
|
|
/* On error 'ret' will be negative - top bit set */
|
|
mask = ((unsigned int)ret >>
|
|
((sizeof(ret) * 8) - 1)) - 1;
|
|
|
|
/* build PreMasterSecret */
|
|
ssl->arrays->preMasterSecret[0] = ssl->chVersion.major;
|
|
ssl->arrays->preMasterSecret[1] = ssl->chVersion.minor;
|
|
|
|
if (args->output != NULL) {
|
|
/* Use random secret on error */
|
|
for (i = VERSION_SZ; i < SECRET_LEN; i++) {
|
|
ssl->arrays->preMasterSecret[i] =
|
|
ctMaskSel(mask, args->output[i],
|
|
ssl->arrays->preMasterSecret[i]);
|
|
}
|
|
}
|
|
/* preMasterSecret has RNG and version set
|
|
* return proper length and ignore error
|
|
* error will be caught as decryption error
|
|
*/
|
|
args->sigSz = SECRET_LEN;
|
|
ret = 0;
|
|
break;
|
|
} /* rsa_kea */
|
|
#endif /* !NO_RSA */
|
|
#ifndef NO_PSK
|
|
case psk_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* !NO_PSK */
|
|
#ifdef HAVE_NTRU
|
|
case ntru_kea:
|
|
{
|
|
break;
|
|
}
|
|
#endif /* HAVE_NTRU */
|
|
#if defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)
|
|
case ecc_diffie_hellman_kea:
|
|
{
|
|
/* skip past the imported peer key */
|
|
args->idx += args->length;
|
|
break;
|
|
}
|
|
#endif /* HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448 */
|
|
#ifndef NO_DH
|
|
case diffie_hellman_kea:
|
|
{
|
|
args->idx += (word16)args->sigSz;
|
|
break;
|
|
}
|
|
#endif /* !NO_DH */
|
|
#if !defined(NO_DH) && !defined(NO_PSK)
|
|
case dhe_psk_kea:
|
|
{
|
|
byte* pms = ssl->arrays->preMasterSecret;
|
|
word16 clientSz = (word16)args->sigSz;
|
|
|
|
args->idx += clientSz;
|
|
c16toa((word16)ssl->arrays->preMasterSz, pms);
|
|
ssl->arrays->preMasterSz += OPAQUE16_LEN;
|
|
pms += ssl->arrays->preMasterSz;
|
|
|
|
/* Use the PSK hint to look up the PSK and add it to the
|
|
* preMasterSecret here. */
|
|
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
|
|
ssl->arrays->client_identity, ssl->arrays->psk_key,
|
|
MAX_PSK_KEY_LEN);
|
|
|
|
if (ssl->arrays->psk_keySz == 0 ||
|
|
ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
|
|
#if defined(WOLFSSL_EXTRA_ALERTS) || \
|
|
defined(WOLFSSL_PSK_IDENTITY_ALERT)
|
|
SendAlert(ssl, alert_fatal,
|
|
unknown_psk_identity);
|
|
#endif
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
c16toa((word16) ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
|
|
XMEMCPY(pms, ssl->arrays->psk_key,
|
|
ssl->arrays->psk_keySz);
|
|
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz +
|
|
OPAQUE16_LEN;
|
|
break;
|
|
}
|
|
#endif /* !NO_DH && !NO_PSK */
|
|
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
|
|
defined(HAVE_CURVE448)) && !defined(NO_PSK)
|
|
case ecdhe_psk_kea:
|
|
{
|
|
byte* pms = ssl->arrays->preMasterSecret;
|
|
word16 clientSz = (word16)args->sigSz;
|
|
|
|
/* skip past the imported peer key */
|
|
args->idx += args->length;
|
|
|
|
/* Add preMasterSecret */
|
|
c16toa(clientSz, pms);
|
|
ssl->arrays->preMasterSz = OPAQUE16_LEN + clientSz;
|
|
pms += ssl->arrays->preMasterSz;
|
|
|
|
/* Use the PSK hint to look up the PSK and add it to the
|
|
* preMasterSecret here. */
|
|
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
|
|
ssl->arrays->client_identity, ssl->arrays->psk_key,
|
|
MAX_PSK_KEY_LEN);
|
|
|
|
if (ssl->arrays->psk_keySz == 0 ||
|
|
ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
|
|
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
|
|
}
|
|
|
|
c16toa((word16) ssl->arrays->psk_keySz, pms);
|
|
pms += OPAQUE16_LEN;
|
|
|
|
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
|
|
ssl->arrays->preMasterSz +=
|
|
ssl->arrays->psk_keySz + OPAQUE16_LEN;
|
|
break;
|
|
}
|
|
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */
|
|
default:
|
|
ret = BAD_KEA_TYPE_E;
|
|
} /* switch (ssl->specs.kea) */
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_FINALIZE;
|
|
} /* TLS_ASYNC_VERIFY */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_FINALIZE:
|
|
{
|
|
if (IsEncryptionOn(ssl, 0)) {
|
|
args->idx += ssl->keys.padSz;
|
|
#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
|
|
if (ssl->options.startedETMRead)
|
|
args->idx += MacSize(ssl);
|
|
#endif
|
|
}
|
|
|
|
#ifdef HAVE_QSH
|
|
word16 name;
|
|
|
|
if (ssl->options.haveQSH) {
|
|
/* extension name */
|
|
ato16(input + args->idx, &name);
|
|
args->idx += OPAQUE16_LEN;
|
|
|
|
if (name == TLSX_QUANTUM_SAFE_HYBRID) {
|
|
int qshSz;
|
|
/* if qshSz is larger than 0 it is the
|
|
length of buffer used */
|
|
if ((qshSz = TLSX_QSHCipher_Parse(ssl,
|
|
input + args->idx,
|
|
size - args->idx + args->begin, 1)) < 0) {
|
|
ERROR_OUT(qshSz, exit_dcke);
|
|
}
|
|
args->idx += qshSz;
|
|
}
|
|
else {
|
|
/* unknown extension sent client ignored handshake */
|
|
ERROR_OUT(BUFFER_ERROR, exit_dcke);
|
|
}
|
|
}
|
|
#endif /* HAVE_QSH */
|
|
ret = MakeMasterSecret(ssl);
|
|
|
|
/* Check for error */
|
|
if (ret != 0) {
|
|
goto exit_dcke;
|
|
}
|
|
|
|
/* Advance state and proceed */
|
|
ssl->options.asyncState = TLS_ASYNC_END;
|
|
} /* TLS_ASYNC_FINALIZE */
|
|
FALL_THROUGH;
|
|
|
|
case TLS_ASYNC_END:
|
|
{
|
|
/* Set final index */
|
|
*inOutIdx = args->idx;
|
|
|
|
ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
|
|
#if !defined(NO_CERTS) && !defined(WOLFSSL_NO_CLIENT_AUTH)
|
|
if (ssl->options.verifyPeer) {
|
|
ret = BuildCertHashes(ssl, &ssl->hsHashes->certHashes);
|
|
}
|
|
#endif
|
|
break;
|
|
} /* TLS_ASYNC_END */
|
|
default:
|
|
ret = INPUT_CASE_ERROR;
|
|
} /* switch(ssl->options.asyncState) */
|
|
|
|
exit_dcke:
|
|
|
|
WOLFSSL_LEAVE("DoClientKeyExchange", ret);
|
|
WOLFSSL_END(WC_FUNC_CLIENT_KEY_EXCHANGE_DO);
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
/* Handle async operation */
|
|
if (ret == WC_PENDING_E) {
|
|
/* Mark message as not received so it can process again */
|
|
ssl->msgsReceived.got_client_key_exchange = 0;
|
|
|
|
return ret;
|
|
}
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
/* Cleanup PMS */
|
|
if (ssl->arrays->preMasterSecret != NULL) {
|
|
ForceZero(ssl->arrays->preMasterSecret, ssl->arrays->preMasterSz);
|
|
}
|
|
ssl->arrays->preMasterSz = 0;
|
|
|
|
/* Final cleanup */
|
|
FreeDckeArgs(ssl, args);
|
|
FreeKeyExchange(ssl);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* !WOLFSSL_NO_TLS12 */
|
|
|
|
#ifdef HAVE_SNI
|
|
int SNI_Callback(WOLFSSL* ssl)
|
|
{
|
|
/* Stunnel supports a custom sni callback to switch an SSL's ctx
|
|
* when SNI is received. Call it now if exists */
|
|
if(ssl && ssl->ctx && ssl->ctx->sniRecvCb) {
|
|
WOLFSSL_MSG("Calling custom sni callback");
|
|
if(ssl->ctx->sniRecvCb(ssl, NULL, ssl->ctx->sniRecvCbArg)
|
|
== alert_fatal) {
|
|
WOLFSSL_MSG("Error in custom sni callback. Fatal alert");
|
|
SendAlert(ssl, alert_fatal, unrecognized_name);
|
|
return FATAL_ERROR;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
#endif /* HAVE_SNI */
|
|
|
|
#endif /* NO_WOLFSSL_SERVER */
|
|
|
|
|
|
#ifdef WOLFSSL_ASYNC_CRYPT
|
|
int wolfSSL_AsyncPop(WOLFSSL* ssl, byte* state)
|
|
{
|
|
int ret = 0;
|
|
WC_ASYNC_DEV* asyncDev;
|
|
WOLF_EVENT* event;
|
|
|
|
if (ssl == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* check for pending async */
|
|
asyncDev = ssl->async.dev;
|
|
if (asyncDev) {
|
|
/* grab event pointer */
|
|
event = &asyncDev->event;
|
|
|
|
ret = wolfAsync_EventPop(event, WOLF_EVENT_TYPE_ASYNC_WOLFSSL);
|
|
if (ret != WC_NOT_PENDING_E && ret != WC_PENDING_E) {
|
|
|
|
/* advance key share state if doesn't need called again */
|
|
if (state && (asyncDev->event.flags & WC_ASYNC_FLAG_CALL_AGAIN) == 0) {
|
|
(*state)++;
|
|
}
|
|
|
|
/* clear event */
|
|
XMEMSET(&asyncDev->event, 0, sizeof(WOLF_EVENT));
|
|
|
|
/* clear async dev */
|
|
ssl->async.dev = NULL;
|
|
}
|
|
}
|
|
else {
|
|
ret = WC_NOT_PENDING_E;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("wolfSSL_AsyncPop", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int wolfSSL_AsyncInit(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev, word32 flags)
|
|
{
|
|
int ret;
|
|
WOLF_EVENT* event;
|
|
|
|
if (ssl == NULL || asyncDev == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* grab event pointer */
|
|
event = &asyncDev->event;
|
|
|
|
/* init event */
|
|
ret = wolfAsync_EventInit(event, WOLF_EVENT_TYPE_ASYNC_WOLFSSL, ssl, flags);
|
|
|
|
WOLFSSL_LEAVE("wolfSSL_AsyncInit", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
int wolfSSL_AsyncPush(WOLFSSL* ssl, WC_ASYNC_DEV* asyncDev)
|
|
{
|
|
int ret;
|
|
WOLF_EVENT* event;
|
|
|
|
if (ssl == NULL || asyncDev == NULL) {
|
|
return BAD_FUNC_ARG;
|
|
}
|
|
|
|
/* grab event pointer */
|
|
event = &asyncDev->event;
|
|
|
|
/* store reference to active async operation */
|
|
ssl->async.dev = asyncDev;
|
|
|
|
/* place event into queue */
|
|
ret = wolfAsync_EventQueuePush(&ssl->ctx->event_queue, event);
|
|
|
|
/* success means return WC_PENDING_E */
|
|
if (ret == 0) {
|
|
ret = WC_PENDING_E;
|
|
}
|
|
|
|
WOLFSSL_LEAVE("wolfSSL_AsyncPush", ret);
|
|
|
|
return ret;
|
|
}
|
|
|
|
#endif /* WOLFSSL_ASYNC_CRYPT */
|
|
|
|
|
|
/* return the max record size */
|
|
int wolfSSL_GetMaxRecordSize(WOLFSSL* ssl, int maxFragment)
|
|
{
|
|
(void) ssl; /* Avoid compiler warnings */
|
|
|
|
if (maxFragment > MAX_RECORD_SIZE) {
|
|
maxFragment = MAX_RECORD_SIZE;
|
|
}
|
|
|
|
#ifdef HAVE_MAX_FRAGMENT
|
|
if ((ssl->max_fragment != 0) && ((word16)maxFragment > ssl->max_fragment)) {
|
|
maxFragment = ssl->max_fragment;
|
|
}
|
|
#endif /* HAVE_MAX_FRAGMENT */
|
|
#ifdef WOLFSSL_DTLS
|
|
if (IsDtlsNotSctpMode(ssl)) {
|
|
if (maxFragment > MAX_UDP_SIZE) {
|
|
maxFragment = MAX_UDP_SIZE;
|
|
}
|
|
#if defined(WOLFSSL_DTLS_MTU)
|
|
if (maxFragment >
|
|
ssl->dtlsMtuSz - RECORD_HEADER_SZ - DTLS_RECORD_EXTRA) {
|
|
maxFragment = ssl->dtlsMtuSz - RECORD_HEADER_SZ - DTLS_RECORD_EXTRA;
|
|
}
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
return maxFragment;
|
|
}
|
|
|
|
|
|
#undef ERROR_OUT
|
|
|
|
#endif /* WOLFCRYPT_ONLY */
|