Subversion Repositories Kolibri OS

Rev

Blame | Last modification | View Log | Download | RSS feed

  1. /**
  2.  * \file ssl_internal.h
  3.  *
  4.  * \brief Internal functions shared by the SSL modules
  5.  */
  6. /*
  7.  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  8.  *  SPDX-License-Identifier: GPL-2.0
  9.  *
  10.  *  This program is free software; you can redistribute it and/or modify
  11.  *  it under the terms of the GNU General Public License as published by
  12.  *  the Free Software Foundation; either version 2 of the License, or
  13.  *  (at your option) any later version.
  14.  *
  15.  *  This program is distributed in the hope that it will be useful,
  16.  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17.  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18.  *  GNU General Public License for more details.
  19.  *
  20.  *  You should have received a copy of the GNU General Public License along
  21.  *  with this program; if not, write to the Free Software Foundation, Inc.,
  22.  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  23.  *
  24.  *  This file is part of mbed TLS (https://tls.mbed.org)
  25.  */
  26. #ifndef MBEDTLS_SSL_INTERNAL_H
  27. #define MBEDTLS_SSL_INTERNAL_H
  28.  
  29. #if !defined(MBEDTLS_CONFIG_FILE)
  30. #include "config.h"
  31. #else
  32. #include MBEDTLS_CONFIG_FILE
  33. #endif
  34.  
  35. #include "ssl.h"
  36. #include "cipher.h"
  37.  
  38. #if defined(MBEDTLS_MD5_C)
  39. #include "md5.h"
  40. #endif
  41.  
  42. #if defined(MBEDTLS_SHA1_C)
  43. #include "sha1.h"
  44. #endif
  45.  
  46. #if defined(MBEDTLS_SHA256_C)
  47. #include "sha256.h"
  48. #endif
  49.  
  50. #if defined(MBEDTLS_SHA512_C)
  51. #include "sha512.h"
  52. #endif
  53.  
  54. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  55. #include "ecjpake.h"
  56. #endif
  57.  
  58. #if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
  59.     !defined(inline) && !defined(__cplusplus)
  60. #define inline __inline
  61. #endif
  62.  
  63. /* Determine minimum supported version */
  64. #define MBEDTLS_SSL_MIN_MAJOR_VERSION           MBEDTLS_SSL_MAJOR_VERSION_3
  65.  
  66. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  67. #define MBEDTLS_SSL_MIN_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_0
  68. #else
  69. #if defined(MBEDTLS_SSL_PROTO_TLS1)
  70. #define MBEDTLS_SSL_MIN_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_1
  71. #else
  72. #if defined(MBEDTLS_SSL_PROTO_TLS1_1)
  73. #define MBEDTLS_SSL_MIN_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_2
  74. #else
  75. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  76. #define MBEDTLS_SSL_MIN_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_3
  77. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  78. #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
  79. #endif /* MBEDTLS_SSL_PROTO_TLS1   */
  80. #endif /* MBEDTLS_SSL_PROTO_SSL3   */
  81.  
  82. #define MBEDTLS_SSL_MIN_VALID_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
  83. #define MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
  84.  
  85. /* Determine maximum supported version */
  86. #define MBEDTLS_SSL_MAX_MAJOR_VERSION           MBEDTLS_SSL_MAJOR_VERSION_3
  87.  
  88. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  89. #define MBEDTLS_SSL_MAX_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_3
  90. #else
  91. #if defined(MBEDTLS_SSL_PROTO_TLS1_1)
  92. #define MBEDTLS_SSL_MAX_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_2
  93. #else
  94. #if defined(MBEDTLS_SSL_PROTO_TLS1)
  95. #define MBEDTLS_SSL_MAX_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_1
  96. #else
  97. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  98. #define MBEDTLS_SSL_MAX_MINOR_VERSION           MBEDTLS_SSL_MINOR_VERSION_0
  99. #endif /* MBEDTLS_SSL_PROTO_SSL3   */
  100. #endif /* MBEDTLS_SSL_PROTO_TLS1   */
  101. #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
  102. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  103.  
  104. /* Shorthand for restartable ECC */
  105. #if defined(MBEDTLS_ECP_RESTARTABLE) && \
  106.     defined(MBEDTLS_SSL_CLI_C) && \
  107.     defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  108.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  109. #define MBEDTLS_SSL__ECP_RESTARTABLE
  110. #endif
  111.  
  112. #define MBEDTLS_SSL_INITIAL_HANDSHAKE           0
  113. #define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS   1   /* In progress */
  114. #define MBEDTLS_SSL_RENEGOTIATION_DONE          2   /* Done or aborted */
  115. #define MBEDTLS_SSL_RENEGOTIATION_PENDING       3   /* Requested (server only) */
  116.  
  117. /*
  118.  * DTLS retransmission states, see RFC 6347 4.2.4
  119.  *
  120.  * The SENDING state is merged in PREPARING for initial sends,
  121.  * but is distinct for resends.
  122.  *
  123.  * Note: initial state is wrong for server, but is not used anyway.
  124.  */
  125. #define MBEDTLS_SSL_RETRANS_PREPARING       0
  126. #define MBEDTLS_SSL_RETRANS_SENDING         1
  127. #define MBEDTLS_SSL_RETRANS_WAITING         2
  128. #define MBEDTLS_SSL_RETRANS_FINISHED        3
  129.  
  130. /*
  131.  * Allow extra bytes for record, authentication and encryption overhead:
  132.  * counter (8) + header (5) + IV(16) + MAC (16-48) + padding (0-256)
  133.  * and allow for a maximum of 1024 of compression expansion if
  134.  * enabled.
  135.  */
  136. #if defined(MBEDTLS_ZLIB_SUPPORT)
  137. #define MBEDTLS_SSL_COMPRESSION_ADD          1024
  138. #else
  139. #define MBEDTLS_SSL_COMPRESSION_ADD             0
  140. #endif
  141.  
  142. #if defined(MBEDTLS_ARC4_C) || defined(MBEDTLS_CIPHER_MODE_CBC)
  143. /* Ciphersuites using HMAC */
  144. #if defined(MBEDTLS_SHA512_C)
  145. #define MBEDTLS_SSL_MAC_ADD                 48  /* SHA-384 used for HMAC */
  146. #elif defined(MBEDTLS_SHA256_C)
  147. #define MBEDTLS_SSL_MAC_ADD                 32  /* SHA-256 used for HMAC */
  148. #else
  149. #define MBEDTLS_SSL_MAC_ADD                 20  /* SHA-1   used for HMAC */
  150. #endif
  151. #else
  152. /* AEAD ciphersuites: GCM and CCM use a 128 bits tag */
  153. #define MBEDTLS_SSL_MAC_ADD                 16
  154. #endif
  155.  
  156. #if defined(MBEDTLS_CIPHER_MODE_CBC)
  157. #define MBEDTLS_SSL_PADDING_ADD            256
  158. #else
  159. #define MBEDTLS_SSL_PADDING_ADD              0
  160. #endif
  161.  
  162. #define MBEDTLS_SSL_PAYLOAD_OVERHEAD ( MBEDTLS_SSL_COMPRESSION_ADD +    \
  163.                                        MBEDTLS_MAX_IV_LENGTH +          \
  164.                                        MBEDTLS_SSL_MAC_ADD +            \
  165.                                        MBEDTLS_SSL_PADDING_ADD          \
  166.                                        )
  167.  
  168. #define MBEDTLS_SSL_IN_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
  169.                                      ( MBEDTLS_SSL_IN_CONTENT_LEN ) )
  170.  
  171. #define MBEDTLS_SSL_OUT_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
  172.                                       ( MBEDTLS_SSL_OUT_CONTENT_LEN ) )
  173.  
  174. /* The maximum number of buffered handshake messages. */
  175. #define MBEDTLS_SSL_MAX_BUFFERED_HS 4
  176.  
  177. /* Maximum length we can advertise as our max content length for
  178.    RFC 6066 max_fragment_length extension negotiation purposes
  179.    (the lesser of both sizes, if they are unequal.)
  180.  */
  181. #define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN (                            \
  182.         (MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN)   \
  183.         ? ( MBEDTLS_SSL_OUT_CONTENT_LEN )                            \
  184.         : ( MBEDTLS_SSL_IN_CONTENT_LEN )                             \
  185.         )
  186.  
  187. /*
  188.  * Check that we obey the standard's message size bounds
  189.  */
  190.  
  191. #if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384
  192. #error "Bad configuration - record content too large."
  193. #endif
  194.  
  195. #if MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN
  196. #error "Bad configuration - incoming record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN."
  197. #endif
  198.  
  199. #if MBEDTLS_SSL_OUT_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN
  200. #error "Bad configuration - outgoing record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN."
  201. #endif
  202.  
  203. #if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048
  204. #error "Bad configuration - incoming protected record payload too large."
  205. #endif
  206.  
  207. #if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048
  208. #error "Bad configuration - outgoing protected record payload too large."
  209. #endif
  210.  
  211. /* Calculate buffer sizes */
  212.  
  213. /* Note: Even though the TLS record header is only 5 bytes
  214.    long, we're internally using 8 bytes to store the
  215.    implicit sequence number. */
  216. #define MBEDTLS_SSL_HEADER_LEN 13
  217.  
  218. #define MBEDTLS_SSL_IN_BUFFER_LEN  \
  219.     ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) )
  220.  
  221. #define MBEDTLS_SSL_OUT_BUFFER_LEN  \
  222.     ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) )
  223.  
  224. #ifdef MBEDTLS_ZLIB_SUPPORT
  225. /* Compression buffer holds both IN and OUT buffers, so should be size of the larger */
  226. #define MBEDTLS_SSL_COMPRESS_BUFFER_LEN (                               \
  227.         ( MBEDTLS_SSL_IN_BUFFER_LEN > MBEDTLS_SSL_OUT_BUFFER_LEN )      \
  228.         ? MBEDTLS_SSL_IN_BUFFER_LEN                                     \
  229.         : MBEDTLS_SSL_OUT_BUFFER_LEN                                    \
  230.         )
  231. #endif
  232.  
  233. /*
  234.  * TLS extension flags (for extensions with outgoing ServerHello content
  235.  * that need it (e.g. for RENEGOTIATION_INFO the server already knows because
  236.  * of state of the renegotiation flag, so no indicator is required)
  237.  */
  238. #define MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT (1 << 0)
  239. #define MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK                 (1 << 1)
  240.  
  241. #ifdef __cplusplus
  242. extern "C" {
  243. #endif
  244.  
  245. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  246.     defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  247. /*
  248.  * Abstraction for a grid of allowed signature-hash-algorithm pairs.
  249.  */
  250. struct mbedtls_ssl_sig_hash_set_t
  251. {
  252.     /* At the moment, we only need to remember a single suitable
  253.      * hash algorithm per signature algorithm. As long as that's
  254.      * the case - and we don't need a general lookup function -
  255.      * we can implement the sig-hash-set as a map from signatures
  256.      * to hash algorithms. */
  257.     mbedtls_md_type_t rsa;
  258.     mbedtls_md_type_t ecdsa;
  259. };
  260. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  261.           MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  262.  
  263. /*
  264.  * This structure contains the parameters only needed during handshake.
  265.  */
  266. struct mbedtls_ssl_handshake_params
  267. {
  268.     /*
  269.      * Handshake specific crypto variables
  270.      */
  271.  
  272. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  273.     defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  274.     mbedtls_ssl_sig_hash_set_t hash_algs;             /*!<  Set of suitable sig-hash pairs */
  275. #endif
  276. #if defined(MBEDTLS_DHM_C)
  277.     mbedtls_dhm_context dhm_ctx;                /*!<  DHM key exchange        */
  278. #endif
  279. #if defined(MBEDTLS_ECDH_C)
  280.     mbedtls_ecdh_context ecdh_ctx;              /*!<  ECDH key exchange       */
  281. #endif
  282. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  283.     mbedtls_ecjpake_context ecjpake_ctx;        /*!< EC J-PAKE key exchange */
  284. #if defined(MBEDTLS_SSL_CLI_C)
  285.     unsigned char *ecjpake_cache;               /*!< Cache for ClientHello ext */
  286.     size_t ecjpake_cache_len;                   /*!< Length of cached data */
  287. #endif
  288. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  289. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  290.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  291.     const mbedtls_ecp_curve_info **curves;      /*!<  Supported elliptic curves */
  292. #endif
  293. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  294.     unsigned char *psk;                 /*!<  PSK from the callback         */
  295.     size_t psk_len;                     /*!<  Length of PSK from callback   */
  296. #endif
  297. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  298.     mbedtls_ssl_key_cert *key_cert;     /*!< chosen key/cert pair (server)  */
  299. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  300.     int sni_authmode;                   /*!< authmode from SNI callback     */
  301.     mbedtls_ssl_key_cert *sni_key_cert; /*!< key/cert list from SNI         */
  302.     mbedtls_x509_crt *sni_ca_chain;     /*!< trusted CAs from SNI callback  */
  303.     mbedtls_x509_crl *sni_ca_crl;       /*!< trusted CAs CRLs from SNI      */
  304. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  305. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  306. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  307.     int ecrs_enabled;                   /*!< Handshake supports EC restart? */
  308.     mbedtls_x509_crt_restart_ctx ecrs_ctx;  /*!< restart context            */
  309.     enum { /* this complements ssl->state with info on intra-state operations */
  310.         ssl_ecrs_none = 0,              /*!< nothing going on (yet)         */
  311.         ssl_ecrs_crt_verify,            /*!< Certificate: crt_verify()      */
  312.         ssl_ecrs_ske_start_processing,  /*!< ServerKeyExchange: pk_verify() */
  313.         ssl_ecrs_cke_ecdh_calc_secret,  /*!< ClientKeyExchange: ECDH step 2 */
  314.         ssl_ecrs_crt_vrfy_sign,         /*!< CertificateVerify: pk_sign()   */
  315.     } ecrs_state;                       /*!< current (or last) operation    */
  316.     size_t ecrs_n;                      /*!< place for saving a length      */
  317. #endif
  318. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  319.     unsigned int out_msg_seq;           /*!<  Outgoing handshake sequence number */
  320.     unsigned int in_msg_seq;            /*!<  Incoming handshake sequence number */
  321.  
  322.     unsigned char *verify_cookie;       /*!<  Cli: HelloVerifyRequest cookie
  323.                                               Srv: unused                    */
  324.     unsigned char verify_cookie_len;    /*!<  Cli: cookie length
  325.                                               Srv: flag for sending a cookie */
  326.  
  327.     uint32_t retransmit_timeout;        /*!<  Current value of timeout       */
  328.     unsigned char retransmit_state;     /*!<  Retransmission state           */
  329.     mbedtls_ssl_flight_item *flight;    /*!<  Current outgoing flight        */
  330.     mbedtls_ssl_flight_item *cur_msg;   /*!<  Current message in flight      */
  331.     unsigned char *cur_msg_p;           /*!<  Position in current message    */
  332.     unsigned int in_flight_start_seq;   /*!<  Minimum message sequence in the
  333.                                               flight being received          */
  334.     mbedtls_ssl_transform *alt_transform_out;   /*!<  Alternative transform for
  335.                                               resending messages             */
  336.     unsigned char alt_out_ctr[8];       /*!<  Alternative record epoch/counter
  337.                                               for resending messages         */
  338.  
  339.     struct
  340.     {
  341.         size_t total_bytes_buffered; /*!< Cumulative size of heap allocated
  342.                                       *   buffers used for message buffering. */
  343.  
  344.         uint8_t seen_ccs;               /*!< Indicates if a CCS message has
  345.                                          *   been seen in the current flight. */
  346.  
  347.         struct mbedtls_ssl_hs_buffer
  348.         {
  349.             unsigned is_valid      : 1;
  350.             unsigned is_fragmented : 1;
  351.             unsigned is_complete   : 1;
  352.             unsigned char *data;
  353.             size_t data_len;
  354.         } hs[MBEDTLS_SSL_MAX_BUFFERED_HS];
  355.  
  356.         struct
  357.         {
  358.             unsigned char *data;
  359.             size_t len;
  360.             unsigned epoch;
  361.         } future_record;
  362.  
  363.     } buffering;
  364.  
  365.     uint16_t mtu;                       /*!<  Handshake mtu, used to fragment outgoing messages */
  366. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  367.  
  368.     /*
  369.      * Checksum contexts
  370.      */
  371. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  372.     defined(MBEDTLS_SSL_PROTO_TLS1_1)
  373.        mbedtls_md5_context fin_md5;
  374.       mbedtls_sha1_context fin_sha1;
  375. #endif
  376. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  377. #if defined(MBEDTLS_SHA256_C)
  378.     mbedtls_sha256_context fin_sha256;
  379. #endif
  380. #if defined(MBEDTLS_SHA512_C)
  381.     mbedtls_sha512_context fin_sha512;
  382. #endif
  383. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  384.  
  385.     void (*update_checksum)(mbedtls_ssl_context *, const unsigned char *, size_t);
  386.     void (*calc_verify)(mbedtls_ssl_context *, unsigned char *);
  387.     void (*calc_finished)(mbedtls_ssl_context *, unsigned char *, int);
  388.     int  (*tls_prf)(const unsigned char *, size_t, const char *,
  389.                     const unsigned char *, size_t,
  390.                     unsigned char *, size_t);
  391.  
  392.     size_t pmslen;                      /*!<  premaster length        */
  393.  
  394.     unsigned char randbytes[64];        /*!<  random bytes            */
  395.     unsigned char premaster[MBEDTLS_PREMASTER_SIZE];
  396.                                         /*!<  premaster secret        */
  397.  
  398.     int resume;                         /*!<  session resume indicator*/
  399.     int max_major_ver;                  /*!< max. major version client*/
  400.     int max_minor_ver;                  /*!< max. minor version client*/
  401.     int cli_exts;                       /*!< client extension presence*/
  402.  
  403. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  404.     int new_session_ticket;             /*!< use NewSessionTicket?    */
  405. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  406. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  407.     int extended_ms;                    /*!< use Extended Master Secret? */
  408. #endif
  409.  
  410. #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
  411.     unsigned int async_in_progress : 1; /*!< an asynchronous operation is in progress */
  412. #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
  413.  
  414. #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
  415.     /** Asynchronous operation context. This field is meant for use by the
  416.      * asynchronous operation callbacks (mbedtls_ssl_config::f_async_sign_start,
  417.      * mbedtls_ssl_config::f_async_decrypt_start,
  418.      * mbedtls_ssl_config::f_async_resume, mbedtls_ssl_config::f_async_cancel).
  419.      * The library does not use it internally. */
  420.     void *user_async_ctx;
  421. #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
  422. };
  423.  
  424. typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
  425.  
  426. /*
  427.  * This structure contains a full set of runtime transform parameters
  428.  * either in negotiation or active.
  429.  */
  430. struct mbedtls_ssl_transform
  431. {
  432.     /*
  433.      * Session specific crypto layer
  434.      */
  435.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  436.                                         /*!<  Chosen cipersuite_info  */
  437.     unsigned int keylen;                /*!<  symmetric key length (bytes)  */
  438.     size_t minlen;                      /*!<  min. ciphertext length  */
  439.     size_t ivlen;                       /*!<  IV length               */
  440.     size_t fixed_ivlen;                 /*!<  Fixed part of IV (AEAD) */
  441.     size_t maclen;                      /*!<  MAC length              */
  442.  
  443.     unsigned char iv_enc[16];           /*!<  IV (encryption)         */
  444.     unsigned char iv_dec[16];           /*!<  IV (decryption)         */
  445.  
  446. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  447.     /* Needed only for SSL v3.0 secret */
  448.     unsigned char mac_enc[20];          /*!<  SSL v3.0 secret (enc)   */
  449.     unsigned char mac_dec[20];          /*!<  SSL v3.0 secret (dec)   */
  450. #endif /* MBEDTLS_SSL_PROTO_SSL3 */
  451.  
  452.     mbedtls_md_context_t md_ctx_enc;            /*!<  MAC (encryption)        */
  453.     mbedtls_md_context_t md_ctx_dec;            /*!<  MAC (decryption)        */
  454.  
  455.     mbedtls_cipher_context_t cipher_ctx_enc;    /*!<  encryption context      */
  456.     mbedtls_cipher_context_t cipher_ctx_dec;    /*!<  decryption context      */
  457.  
  458.     /*
  459.      * Session specific compression layer
  460.      */
  461. #if defined(MBEDTLS_ZLIB_SUPPORT)
  462.     z_stream ctx_deflate;               /*!<  compression context     */
  463.     z_stream ctx_inflate;               /*!<  decompression context   */
  464. #endif
  465. };
  466.  
  467. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  468. /*
  469.  * List of certificate + private key pairs
  470.  */
  471. struct mbedtls_ssl_key_cert
  472. {
  473.     mbedtls_x509_crt *cert;                 /*!< cert                       */
  474.     mbedtls_pk_context *key;                /*!< private key                */
  475.     mbedtls_ssl_key_cert *next;             /*!< next key/cert pair         */
  476. };
  477. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  478.  
  479. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  480. /*
  481.  * List of handshake messages kept around for resending
  482.  */
  483. struct mbedtls_ssl_flight_item
  484. {
  485.     unsigned char *p;       /*!< message, including handshake headers   */
  486.     size_t len;             /*!< length of p                            */
  487.     unsigned char type;     /*!< type of the message: handshake or CCS  */
  488.     mbedtls_ssl_flight_item *next;  /*!< next handshake message(s)              */
  489. };
  490. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  491.  
  492. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  493.     defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  494.  
  495. /* Find an entry in a signature-hash set matching a given hash algorithm. */
  496. mbedtls_md_type_t mbedtls_ssl_sig_hash_set_find( mbedtls_ssl_sig_hash_set_t *set,
  497.                                                  mbedtls_pk_type_t sig_alg );
  498. /* Add a signature-hash-pair to a signature-hash set */
  499. void mbedtls_ssl_sig_hash_set_add( mbedtls_ssl_sig_hash_set_t *set,
  500.                                    mbedtls_pk_type_t sig_alg,
  501.                                    mbedtls_md_type_t md_alg );
  502. /* Allow exactly one hash algorithm for each signature. */
  503. void mbedtls_ssl_sig_hash_set_const_hash( mbedtls_ssl_sig_hash_set_t *set,
  504.                                           mbedtls_md_type_t md_alg );
  505.  
  506. /* Setup an empty signature-hash set */
  507. static inline void mbedtls_ssl_sig_hash_set_init( mbedtls_ssl_sig_hash_set_t *set )
  508. {
  509.     mbedtls_ssl_sig_hash_set_const_hash( set, MBEDTLS_MD_NONE );
  510. }
  511.  
  512. #endif /* MBEDTLS_SSL_PROTO_TLS1_2) &&
  513.           MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  514.  
  515. /**
  516.  * \brief           Free referenced items in an SSL transform context and clear
  517.  *                  memory
  518.  *
  519.  * \param transform SSL transform context
  520.  */
  521. void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform );
  522.  
  523. /**
  524.  * \brief           Free referenced items in an SSL handshake context and clear
  525.  *                  memory
  526.  *
  527.  * \param ssl       SSL context
  528.  */
  529. void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl );
  530.  
  531. int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl );
  532. int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl );
  533. void mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl );
  534.  
  535. int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl );
  536.  
  537. void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl );
  538. int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl );
  539.  
  540. int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl );
  541. int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl );
  542. void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl );
  543.  
  544. /**
  545.  * \brief       Update record layer
  546.  *
  547.  *              This function roughly separates the implementation
  548.  *              of the logic of (D)TLS from the implementation
  549.  *              of the secure transport.
  550.  *
  551.  * \param  ssl              The SSL context to use.
  552.  * \param  update_hs_digest This indicates if the handshake digest
  553.  *                          should be automatically updated in case
  554.  *                          a handshake message is found.
  555.  *
  556.  * \return      0 or non-zero error code.
  557.  *
  558.  * \note        A clarification on what is called 'record layer' here
  559.  *              is in order, as many sensible definitions are possible:
  560.  *
  561.  *              The record layer takes as input an untrusted underlying
  562.  *              transport (stream or datagram) and transforms it into
  563.  *              a serially multiplexed, secure transport, which
  564.  *              conceptually provides the following:
  565.  *
  566.  *              (1) Three datagram based, content-agnostic transports
  567.  *                  for handshake, alert and CCS messages.
  568.  *              (2) One stream- or datagram-based transport
  569.  *                  for application data.
  570.  *              (3) Functionality for changing the underlying transform
  571.  *                  securing the contents.
  572.  *
  573.  *              The interface to this functionality is given as follows:
  574.  *
  575.  *              a Updating
  576.  *                [Currently implemented by mbedtls_ssl_read_record]
  577.  *
  578.  *                Check if and on which of the four 'ports' data is pending:
  579.  *                Nothing, a controlling datagram of type (1), or application
  580.  *                data (2). In any case data is present, internal buffers
  581.  *                provide access to the data for the user to process it.
  582.  *                Consumption of type (1) datagrams is done automatically
  583.  *                on the next update, invalidating that the internal buffers
  584.  *                for previous datagrams, while consumption of application
  585.  *                data (2) is user-controlled.
  586.  *
  587.  *              b Reading of application data
  588.  *                [Currently manual adaption of ssl->in_offt pointer]
  589.  *
  590.  *                As mentioned in the last paragraph, consumption of data
  591.  *                is different from the automatic consumption of control
  592.  *                datagrams (1) because application data is treated as a stream.
  593.  *
  594.  *              c Tracking availability of application data
  595.  *                [Currently manually through decreasing ssl->in_msglen]
  596.  *
  597.  *                For efficiency and to retain datagram semantics for
  598.  *                application data in case of DTLS, the record layer
  599.  *                provides functionality for checking how much application
  600.  *                data is still available in the internal buffer.
  601.  *
  602.  *              d Changing the transformation securing the communication.
  603.  *
  604.  *              Given an opaque implementation of the record layer in the
  605.  *              above sense, it should be possible to implement the logic
  606.  *              of (D)TLS on top of it without the need to know anything
  607.  *              about the record layer's internals. This is done e.g.
  608.  *              in all the handshake handling functions, and in the
  609.  *              application data reading function mbedtls_ssl_read.
  610.  *
  611.  * \note        The above tries to give a conceptual picture of the
  612.  *              record layer, but the current implementation deviates
  613.  *              from it in some places. For example, our implementation of
  614.  *              the update functionality through mbedtls_ssl_read_record
  615.  *              discards datagrams depending on the current state, which
  616.  *              wouldn't fall under the record layer's responsibility
  617.  *              following the above definition.
  618.  *
  619.  */
  620. int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
  621.                              unsigned update_hs_digest );
  622. int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want );
  623.  
  624. int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl );
  625. int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush );
  626. int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl );
  627.  
  628. int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl );
  629. int mbedtls_ssl_write_certificate( mbedtls_ssl_context *ssl );
  630.  
  631. int mbedtls_ssl_parse_change_cipher_spec( mbedtls_ssl_context *ssl );
  632. int mbedtls_ssl_write_change_cipher_spec( mbedtls_ssl_context *ssl );
  633.  
  634. int mbedtls_ssl_parse_finished( mbedtls_ssl_context *ssl );
  635. int mbedtls_ssl_write_finished( mbedtls_ssl_context *ssl );
  636.  
  637. void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
  638.                             const mbedtls_ssl_ciphersuite_t *ciphersuite_info );
  639.  
  640. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  641. int mbedtls_ssl_psk_derive_premaster( mbedtls_ssl_context *ssl, mbedtls_key_exchange_type_t key_ex );
  642. #endif
  643.  
  644. #if defined(MBEDTLS_PK_C)
  645. unsigned char mbedtls_ssl_sig_from_pk( mbedtls_pk_context *pk );
  646. unsigned char mbedtls_ssl_sig_from_pk_alg( mbedtls_pk_type_t type );
  647. mbedtls_pk_type_t mbedtls_ssl_pk_alg_from_sig( unsigned char sig );
  648. #endif
  649.  
  650. mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash );
  651. unsigned char mbedtls_ssl_hash_from_md_alg( int md );
  652. int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md );
  653.  
  654. #if defined(MBEDTLS_ECP_C)
  655. int mbedtls_ssl_check_curve( const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id );
  656. #endif
  657.  
  658. #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  659. int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl,
  660.                                 mbedtls_md_type_t md );
  661. #endif
  662.  
  663. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  664. static inline mbedtls_pk_context *mbedtls_ssl_own_key( mbedtls_ssl_context *ssl )
  665. {
  666.     mbedtls_ssl_key_cert *key_cert;
  667.  
  668.     if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL )
  669.         key_cert = ssl->handshake->key_cert;
  670.     else
  671.         key_cert = ssl->conf->key_cert;
  672.  
  673.     return( key_cert == NULL ? NULL : key_cert->key );
  674. }
  675.  
  676. static inline mbedtls_x509_crt *mbedtls_ssl_own_cert( mbedtls_ssl_context *ssl )
  677. {
  678.     mbedtls_ssl_key_cert *key_cert;
  679.  
  680.     if( ssl->handshake != NULL && ssl->handshake->key_cert != NULL )
  681.         key_cert = ssl->handshake->key_cert;
  682.     else
  683.         key_cert = ssl->conf->key_cert;
  684.  
  685.     return( key_cert == NULL ? NULL : key_cert->cert );
  686. }
  687.  
  688. /*
  689.  * Check usage of a certificate wrt extensions:
  690.  * keyUsage, extendedKeyUsage (later), and nSCertType (later).
  691.  *
  692.  * Warning: cert_endpoint is the endpoint of the cert (ie, of our peer when we
  693.  * check a cert we received from them)!
  694.  *
  695.  * Return 0 if everything is OK, -1 if not.
  696.  */
  697. int mbedtls_ssl_check_cert_usage( const mbedtls_x509_crt *cert,
  698.                           const mbedtls_ssl_ciphersuite_t *ciphersuite,
  699.                           int cert_endpoint,
  700.                           uint32_t *flags );
  701. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  702.  
  703. void mbedtls_ssl_write_version( int major, int minor, int transport,
  704.                         unsigned char ver[2] );
  705. void mbedtls_ssl_read_version( int *major, int *minor, int transport,
  706.                        const unsigned char ver[2] );
  707.  
  708. static inline size_t mbedtls_ssl_hdr_len( const mbedtls_ssl_context *ssl )
  709. {
  710. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  711.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  712.         return( 13 );
  713. #else
  714.     ((void) ssl);
  715. #endif
  716.     return( 5 );
  717. }
  718.  
  719. static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl )
  720. {
  721. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  722.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  723.         return( 12 );
  724. #else
  725.     ((void) ssl);
  726. #endif
  727.     return( 4 );
  728. }
  729.  
  730. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  731. void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl );
  732. void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl );
  733. int mbedtls_ssl_resend( mbedtls_ssl_context *ssl );
  734. int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl );
  735. #endif
  736.  
  737. /* Visible for testing purposes only */
  738. #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
  739. int mbedtls_ssl_dtls_replay_check( mbedtls_ssl_context *ssl );
  740. void mbedtls_ssl_dtls_replay_update( mbedtls_ssl_context *ssl );
  741. #endif
  742.  
  743. /* constant-time buffer comparison */
  744. static inline int mbedtls_ssl_safer_memcmp( const void *a, const void *b, size_t n )
  745. {
  746.     size_t i;
  747.     volatile const unsigned char *A = (volatile const unsigned char *) a;
  748.     volatile const unsigned char *B = (volatile const unsigned char *) b;
  749.     volatile unsigned char diff = 0;
  750.  
  751.     for( i = 0; i < n; i++ )
  752.     {
  753.         /* Read volatile data in order before computing diff.
  754.          * This avoids IAR compiler warning:
  755.          * 'the order of volatile accesses is undefined ..' */
  756.         unsigned char x = A[i], y = B[i];
  757.         diff |= x ^ y;
  758.     }
  759.  
  760.     return( diff );
  761. }
  762.  
  763. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  764.     defined(MBEDTLS_SSL_PROTO_TLS1_1)
  765. int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
  766.                                         unsigned char *output,
  767.                                         unsigned char *data, size_t data_len );
  768. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  769.           MBEDTLS_SSL_PROTO_TLS1_1 */
  770.  
  771. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  772.     defined(MBEDTLS_SSL_PROTO_TLS1_2)
  773. int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
  774.                                             unsigned char *hash, size_t *hashlen,
  775.                                             unsigned char *data, size_t data_len,
  776.                                             mbedtls_md_type_t md_alg );
  777. #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
  778.           MBEDTLS_SSL_PROTO_TLS1_2 */
  779.  
  780. #ifdef __cplusplus
  781. }
  782. #endif
  783.  
  784. #endif /* ssl_internal.h */
  785.