Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1 | /* |
| 2 | * SSL client with options |
| 3 | * |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 4 | * Copyright The Mbed TLS Contributors |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 18 | */ |
| 19 | |
Mateusz Starzyk | 6c2e9b6 | 2021-05-19 17:54:54 +0200 | [diff] [blame] | 20 | #define MBEDTLS_ALLOW_PRIVATE_ACCESS |
| 21 | |
Gilles Peskine | ab7ce96 | 2021-01-05 21:27:53 +0100 | [diff] [blame] | 22 | #include "ssl_test_lib.h" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 23 | |
Gilles Peskine | ab7ce96 | 2021-01-05 21:27:53 +0100 | [diff] [blame] | 24 | #if defined(MBEDTLS_SSL_TEST_IMPOSSIBLE) |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 25 | int main( void ) |
| 26 | { |
Gilles Peskine | ab7ce96 | 2021-01-05 21:27:53 +0100 | [diff] [blame] | 27 | mbedtls_printf( MBEDTLS_SSL_TEST_IMPOSSIBLE ); |
| 28 | mbedtls_exit( 0 ); |
| 29 | } |
| 30 | #elif !defined(MBEDTLS_SSL_SRV_C) |
| 31 | int main( void ) |
| 32 | { |
| 33 | mbedtls_printf( "MBEDTLS_SSL_SRV_C not defined.\n" ); |
Krzysztof Stachowiak | 5e1b195 | 2019-04-24 14:24:46 +0200 | [diff] [blame] | 34 | mbedtls_exit( 0 ); |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 35 | } |
Gilles Peskine | b4df754 | 2021-01-08 21:20:09 +0100 | [diff] [blame] | 36 | #else /* !MBEDTLS_SSL_TEST_IMPOSSIBLE && MBEDTLS_SSL_SRV_C */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 37 | |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 38 | #include <stdint.h> |
Andres AG | 0b736db | 2017-02-08 14:05:57 +0000 | [diff] [blame] | 39 | |
| 40 | #if !defined(_MSC_VER) |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 41 | #include <inttypes.h> |
Andres AG | 0b736db | 2017-02-08 14:05:57 +0000 | [diff] [blame] | 42 | #endif |
Rich Evans | 18b78c7 | 2015-02-11 14:06:19 +0000 | [diff] [blame] | 43 | |
| 44 | #if !defined(_WIN32) |
| 45 | #include <signal.h> |
| 46 | #endif |
| 47 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 48 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 49 | #include "mbedtls/ssl_cache.h" |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 50 | #endif |
| 51 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 52 | #if defined(MBEDTLS_SSL_TICKET_C) |
| 53 | #include "mbedtls/ssl_ticket.h" |
| 54 | #endif |
| 55 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 56 | #if defined(MBEDTLS_SSL_COOKIE_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 57 | #include "mbedtls/ssl_cookie.h" |
Manuel Pégourié-Gonnard | 232edd4 | 2014-07-23 16:56:27 +0200 | [diff] [blame] | 58 | #endif |
| 59 | |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 60 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_FS_IO) |
| 61 | #define SNI_OPTION |
| 62 | #endif |
| 63 | |
| 64 | #if defined(_WIN32) |
| 65 | #include <windows.h> |
| 66 | #endif |
| 67 | |
Simon Butcher | cce68be | 2018-07-23 14:26:09 +0100 | [diff] [blame] | 68 | /* Size of memory to be allocated for the heap, when using the library's memory |
| 69 | * management and MBEDTLS_MEMORY_BUFFER_ALLOC_C is enabled. */ |
| 70 | #define MEMORY_HEAP_SIZE 120000 |
| 71 | |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 72 | #define DFL_SERVER_ADDR NULL |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 73 | #define DFL_SERVER_PORT "4433" |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 74 | #define DFL_RESPONSE_SIZE -1 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 75 | #define DFL_DEBUG_LEVEL 0 |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 76 | #define DFL_NBIO 0 |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 77 | #define DFL_EVENT 0 |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 78 | #define DFL_READ_TIMEOUT 0 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 79 | #define DFL_CA_FILE "" |
| 80 | #define DFL_CA_PATH "" |
| 81 | #define DFL_CRT_FILE "" |
| 82 | #define DFL_KEY_FILE "" |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 83 | #define DFL_KEY_PWD "" |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 84 | #define DFL_CRT_FILE2 "" |
| 85 | #define DFL_KEY_FILE2 "" |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 86 | #define DFL_KEY_PWD2 "" |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 87 | #define DFL_ASYNC_OPERATIONS "-" |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 88 | #define DFL_ASYNC_PRIVATE_DELAY1 ( -1 ) |
| 89 | #define DFL_ASYNC_PRIVATE_DELAY2 ( -1 ) |
Gilles Peskine | 3665f1d | 2018-01-05 21:22:12 +0100 | [diff] [blame] | 90 | #define DFL_ASYNC_PRIVATE_ERROR ( 0 ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 91 | #define DFL_PSK "" |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 92 | #define DFL_PSK_OPAQUE 0 |
| 93 | #define DFL_PSK_LIST_OPAQUE 0 |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 94 | #define DFL_PSK_IDENTITY "Client_identity" |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 95 | #define DFL_ECJPAKE_PW NULL |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 96 | #define DFL_PSK_LIST NULL |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 97 | #define DFL_FORCE_CIPHER 0 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 98 | #define DFL_RENEGOTIATION MBEDTLS_SSL_RENEGOTIATION_DISABLED |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 99 | #define DFL_ALLOW_LEGACY -2 |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 100 | #define DFL_RENEGOTIATE 0 |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 101 | #define DFL_RENEGO_DELAY -2 |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 102 | #define DFL_RENEGO_PERIOD ( (uint64_t)-1 ) |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 103 | #define DFL_EXCHANGES 1 |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 104 | #define DFL_MIN_VERSION -1 |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 105 | #define DFL_MAX_VERSION -1 |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 106 | #define DFL_SHA1 -1 |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 107 | #define DFL_CID_ENABLED 0 |
| 108 | #define DFL_CID_VALUE "" |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 109 | #define DFL_CID_ENABLED_RENEGO -1 |
| 110 | #define DFL_CID_VALUE_RENEGO NULL |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 111 | #define DFL_AUTH_MODE -1 |
Janos Follath | 4817e27 | 2017-04-10 13:44:33 +0100 | [diff] [blame] | 112 | #define DFL_CERT_REQ_CA_LIST MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 113 | #define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 114 | #define DFL_TRUNC_HMAC -1 |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 115 | #define DFL_TICKETS MBEDTLS_SSL_SESSION_TICKETS_ENABLED |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 116 | #define DFL_TICKET_TIMEOUT 86400 |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 117 | #define DFL_CACHE_MAX -1 |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 118 | #define DFL_CACHE_TIMEOUT -1 |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 119 | #define DFL_SNI NULL |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 120 | #define DFL_ALPN_STRING NULL |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 121 | #define DFL_CURVES NULL |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 122 | #define DFL_DHM_FILE NULL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 123 | #define DFL_TRANSPORT MBEDTLS_SSL_TRANSPORT_STREAM |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 124 | #define DFL_COOKIES 1 |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 125 | #define DFL_ANTI_REPLAY -1 |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 126 | #define DFL_HS_TO_MIN 0 |
| 127 | #define DFL_HS_TO_MAX 0 |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 128 | #define DFL_DTLS_MTU -1 |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 129 | #define DFL_BADMAC_LIMIT -1 |
Hanno Becker | e7675d0 | 2018-08-14 13:28:56 +0100 | [diff] [blame] | 130 | #define DFL_DGRAM_PACKING 1 |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 131 | #define DFL_EXTENDED_MS -1 |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 132 | #define DFL_ETM -1 |
Jarno Lamsa | 9831c8a | 2019-05-29 13:33:32 +0300 | [diff] [blame] | 133 | #define DFL_SERIALIZE 0 |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 134 | #define DFL_CONTEXT_FILE "" |
Jarno Lamsa | 9831c8a | 2019-05-29 13:33:32 +0300 | [diff] [blame] | 135 | #define DFL_EXTENDED_MS_ENFORCE -1 |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 136 | #define DFL_CA_CALLBACK 0 |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 137 | #define DFL_EAP_TLS 0 |
Philippe Antoine | aa4d152 | 2019-06-06 21:24:31 +0200 | [diff] [blame] | 138 | #define DFL_REPRODUCIBLE 0 |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 139 | #define DFL_NSS_KEYLOG 0 |
| 140 | #define DFL_NSS_KEYLOG_FILE NULL |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 141 | #define DFL_QUERY_CONFIG_MODE 0 |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 142 | #define DFL_USE_SRTP 0 |
Ron Eldor | 311b95a | 2018-07-08 08:50:31 +0300 | [diff] [blame] | 143 | #define DFL_SRTP_FORCE_PROFILE 0 |
Ron Eldor | 12c6ead | 2018-07-03 15:08:32 +0300 | [diff] [blame] | 144 | #define DFL_SRTP_SUPPORT_MKI 0 |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 145 | |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 146 | #define LONG_RESPONSE "<p>01-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 147 | "02-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 148 | "03-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 149 | "04-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 150 | "05-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 151 | "06-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah\r\n" \ |
| 152 | "07-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah-blah</p>\r\n" |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 153 | |
Paul Bakker | 8e714d7 | 2013-07-18 11:05:13 +0200 | [diff] [blame] | 154 | /* Uncomment LONG_RESPONSE at the end of HTTP_RESPONSE to test sending longer |
| 155 | * packets (for fragmentation purposes) */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 156 | #define HTTP_RESPONSE \ |
| 157 | "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ |
Manuel Pégourié-Gonnard | 9169921 | 2015-01-22 16:26:39 +0000 | [diff] [blame] | 158 | "<h2>mbed TLS Test Server</h2>\r\n" \ |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 159 | "<p>Successful connection using: %s</p>\r\n" // LONG_RESPONSE |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 160 | |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 161 | /* |
| 162 | * Size of the basic I/O buffer. Able to hold our default response. |
| 163 | * |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 164 | * You will need to adapt the mbedtls_ssl_get_bytes_avail() test in ssl-opt.sh |
Manuel Pégourié-Gonnard | 95c0a63 | 2014-06-11 18:32:36 +0200 | [diff] [blame] | 165 | * if you change this value to something outside the range <= 100 or > 500 |
| 166 | */ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 167 | #define DFL_IO_BUF_LEN 200 |
Manuel Pégourié-Gonnard | e7a3b10 | 2014-06-11 18:21:20 +0200 | [diff] [blame] | 168 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 169 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 170 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 171 | #define USAGE_IO \ |
Paul Bakker | 1f9d02d | 2012-11-20 10:30:55 +0100 | [diff] [blame] | 172 | " ca_file=%%s The single file containing the top-level CA(s) you fully trust\n" \ |
| 173 | " default: \"\" (pre-loaded)\n" \ |
Hanno Becker | 422d199 | 2019-05-01 11:16:28 +0100 | [diff] [blame] | 174 | " use \"none\" to skip loading any top-level CAs.\n" \ |
Paul Bakker | 1f9d02d | 2012-11-20 10:30:55 +0100 | [diff] [blame] | 175 | " ca_path=%%s The path containing the top-level CA(s) you fully trust\n" \ |
| 176 | " default: \"\" (pre-loaded) (overrides ca_file)\n" \ |
Hanno Becker | 422d199 | 2019-05-01 11:16:28 +0100 | [diff] [blame] | 177 | " use \"none\" to skip loading any top-level CAs.\n" \ |
Paul Bakker | 1f9d02d | 2012-11-20 10:30:55 +0100 | [diff] [blame] | 178 | " crt_file=%%s Your own cert and chain (in bottom to top order, top may be omitted)\n" \ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 179 | " default: see note after key_file2\n" \ |
| 180 | " key_file=%%s default: see note after key_file2\n" \ |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 181 | " key_pwd=%%s Password for key specified by key_file argument\n"\ |
| 182 | " default: none\n" \ |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 183 | " crt_file2=%%s Your second cert and chain (in bottom to top order, top may be omitted)\n" \ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 184 | " default: see note after key_file2\n" \ |
| 185 | " key_file2=%%s default: see note below\n" \ |
| 186 | " note: if neither crt_file/key_file nor crt_file2/key_file2 are used,\n" \ |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 187 | " preloaded certificate(s) and key(s) are used if available\n" \ |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 188 | " key_pwd2=%%s Password for key specified by key_file2 argument\n"\ |
| 189 | " default: none\n" \ |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 190 | " dhm_file=%%s File containing Diffie-Hellman parameters\n" \ |
| 191 | " default: preloaded parameters\n" |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 192 | #else |
| 193 | #define USAGE_IO \ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 194 | "\n" \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 195 | " No file operations available (MBEDTLS_FS_IO not defined)\n" \ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 196 | "\n" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 197 | #endif /* MBEDTLS_FS_IO */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 198 | #else |
| 199 | #define USAGE_IO "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 200 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 201 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 202 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 203 | #define USAGE_SSL_ASYNC \ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 204 | " async_operations=%%c... d=decrypt, s=sign (default: -=off)\n" \ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 205 | " async_private_delay1=%%d Asynchronous delay for key_file or preloaded key\n" \ |
Gilles Peskine | 166ce74 | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 206 | " async_private_delay2=%%d Asynchronous delay for key_file2 and sni\n" \ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 207 | " default: -1 (not asynchronous)\n" \ |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 208 | " async_private_error=%%d Async callback error injection (default=0=none,\n" \ |
Gilles Peskine | c912572 | 2018-04-26 07:15:40 +0200 | [diff] [blame] | 209 | " 1=start, 2=cancel, 3=resume, negative=first time only)" |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 210 | #else |
| 211 | #define USAGE_SSL_ASYNC "" |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 212 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 213 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 214 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 215 | #define USAGE_CID \ |
| 216 | " cid=%%d Disable (0) or enable (1) the use of the DTLS Connection ID extension.\n" \ |
| 217 | " default: 0 (disabled)\n" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 218 | " cid_renego=%%d Disable (0) or enable (1) the use of the DTLS Connection ID extension during renegotiation.\n" \ |
Hanno Becker | 3279822 | 2019-05-23 17:01:06 +0100 | [diff] [blame] | 219 | " default: same as 'cid' parameter\n" \ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 220 | " cid_val=%%s The CID to use for incoming messages (in hex, without 0x).\n" \ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 221 | " default: \"\"\n" \ |
| 222 | " cid_val_renego=%%s The CID to use for incoming messages (in hex, without 0x) after renegotiation.\n" \ |
Hanno Becker | 3279822 | 2019-05-23 17:01:06 +0100 | [diff] [blame] | 223 | " default: same as 'cid_val' parameter\n" |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 224 | #else /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 225 | #define USAGE_CID "" |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 226 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 227 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 228 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 229 | #define USAGE_PSK_RAW \ |
Piotr Nowicki | 9926eaf | 2019-11-20 14:54:36 +0100 | [diff] [blame] | 230 | " psk=%%s default: \"\" (disabled)\n" \ |
| 231 | " The PSK values are in hex, without 0x.\n" \ |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 232 | " psk_list=%%s default: \"\"\n" \ |
Andrzej Kurek | b274f27 | 2019-02-05 05:06:35 -0500 | [diff] [blame] | 233 | " A list of (PSK identity, PSK value) pairs.\n" \ |
| 234 | " The PSK values are in hex, without 0x.\n" \ |
| 235 | " id1,psk1[,id2,psk2[,...]]\n" \ |
| 236 | " psk_identity=%%s default: \"Client_identity\"\n" |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 237 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 238 | #define USAGE_PSK_SLOT \ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 239 | " psk_opaque=%%d default: 0 (don't use opaque static PSK)\n" \ |
| 240 | " Enable this to store the PSK configured through command line\n" \ |
| 241 | " parameter `psk` in a PSA-based key slot.\n" \ |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 242 | " Note: Currently only supported in conjunction with\n" \ |
| 243 | " the use of min_version to force TLS 1.2 and force_ciphersuite \n" \ |
| 244 | " to force a particular PSK-only ciphersuite.\n" \ |
| 245 | " Note: This is to test integration of PSA-based opaque PSKs with\n" \ |
| 246 | " Mbed TLS only. Production systems are likely to configure Mbed TLS\n" \ |
| 247 | " with prepopulated key slots instead of importing raw key material.\n" \ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 248 | " psk_list_opaque=%%d default: 0 (don't use opaque dynamic PSKs)\n" \ |
| 249 | " Enable this to store the list of dynamically chosen PSKs configured\n" \ |
| 250 | " through the command line parameter `psk_list` in PSA-based key slots.\n" \ |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 251 | " Note: Currently only supported in conjunction with\n" \ |
| 252 | " the use of min_version to force TLS 1.2 and force_ciphersuite \n" \ |
| 253 | " to force a particular PSK-only ciphersuite.\n" \ |
| 254 | " Note: This is to test integration of PSA-based opaque PSKs with\n" \ |
| 255 | " Mbed TLS only. Production systems are likely to configure Mbed TLS\n" \ |
| 256 | " with prepopulated key slots instead of importing raw key material.\n" |
| 257 | #else |
| 258 | #define USAGE_PSK_SLOT "" |
| 259 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 260 | #define USAGE_PSK USAGE_PSK_RAW USAGE_PSK_SLOT |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 261 | #else |
| 262 | #define USAGE_PSK "" |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 263 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 264 | #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) |
| 265 | #define USAGE_CA_CALLBACK \ |
| 266 | " ca_callback=%%d default: 0 (disabled)\n" \ |
| 267 | " Enable this to use the trusted certificate callback function\n" |
| 268 | #else |
| 269 | #define USAGE_CA_CALLBACK "" |
| 270 | #endif /* MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 271 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 272 | #define USAGE_TICKETS \ |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 273 | " tickets=%%d default: 1 (enabled)\n" \ |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 274 | " ticket_timeout=%%d default: 86400 (one day)\n" |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 275 | #else |
| 276 | #define USAGE_TICKETS "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 277 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 278 | |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 279 | #if defined(MBEDTLS_SSL_EXPORT_KEYS) |
| 280 | #define USAGE_EAP_TLS \ |
| 281 | " eap_tls=%%d default: 0 (disabled)\n" |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 282 | #define USAGE_NSS_KEYLOG \ |
Hanno Becker | bc5308c | 2019-09-09 11:38:51 +0100 | [diff] [blame] | 283 | " nss_keylog=%%d default: 0 (disabled)\n" \ |
| 284 | " This cannot be used with eap_tls=1\n" |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 285 | #define USAGE_NSS_KEYLOG_FILE \ |
| 286 | " nss_keylog_file=%%s\n" |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 287 | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
| 288 | #define USAGE_SRTP \ |
| 289 | " use_srtp=%%d default: 0 (disabled)\n" \ |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 290 | " srtp_force_profile=%%d default: 0 (all enabled)\n" \ |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 291 | " available profiles:\n" \ |
| 292 | " 1 - SRTP_AES128_CM_HMAC_SHA1_80\n" \ |
| 293 | " 2 - SRTP_AES128_CM_HMAC_SHA1_32\n" \ |
| 294 | " 3 - SRTP_NULL_HMAC_SHA1_80\n" \ |
| 295 | " 4 - SRTP_NULL_HMAC_SHA1_32\n" \ |
| 296 | " support_mki=%%d default: 0 (not supported)\n" |
| 297 | #else /* MBEDTLS_SSL_DTLS_SRTP */ |
| 298 | #define USAGE_SRTP "" |
| 299 | #endif |
| 300 | #else /* MBEDTLS_SSL_EXPORT_KEYS */ |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 301 | #define USAGE_EAP_TLS "" |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 302 | #define USAGE_NSS_KEYLOG "" |
| 303 | #define USAGE_NSS_KEYLOG_FILE "" |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 304 | #define USAGE_SRTP "" |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 305 | #endif /* MBEDTLS_SSL_EXPORT_KEYS */ |
| 306 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 307 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 308 | #define USAGE_CACHE \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 309 | " cache_max=%%d default: cache default (50)\n" \ |
| 310 | " cache_timeout=%%d default: cache default (1d)\n" |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 311 | #else |
| 312 | #define USAGE_CACHE "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 313 | #endif /* MBEDTLS_SSL_CACHE_C */ |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 314 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 315 | #if defined(SNI_OPTION) |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 316 | #if defined(MBEDTLS_X509_CRL_PARSE_C) |
| 317 | #define SNI_CRL ",crl" |
| 318 | #else |
| 319 | #define SNI_CRL "" |
| 320 | #endif |
| 321 | |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 322 | #define USAGE_SNI \ |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 323 | " sni=%%s name1,cert1,key1,ca1"SNI_CRL",auth1[,...]\n" \ |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 324 | " default: disabled\n" |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 325 | #else |
| 326 | #define USAGE_SNI "" |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 327 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 328 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 329 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 330 | #define USAGE_MAX_FRAG_LEN \ |
| 331 | " max_frag_len=%%d default: 16384 (tls default)\n" \ |
| 332 | " options: 512, 1024, 2048, 4096\n" |
| 333 | #else |
| 334 | #define USAGE_MAX_FRAG_LEN "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 335 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 336 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 337 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 338 | #define USAGE_ALPN \ |
| 339 | " alpn=%%s default: \"\" (disabled)\n" \ |
| 340 | " example: spdy/1,http/1.1\n" |
| 341 | #else |
| 342 | #define USAGE_ALPN "" |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 343 | #endif /* MBEDTLS_SSL_ALPN */ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 344 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 345 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 346 | #define USAGE_COOKIES \ |
| 347 | " cookies=0/1/-1 default: 1 (enabled)\n" \ |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 348 | " 0: disabled, -1: library default (broken)\n" |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 349 | #else |
| 350 | #define USAGE_COOKIES "" |
| 351 | #endif |
| 352 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 353 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 354 | #define USAGE_ANTI_REPLAY \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 355 | " anti_replay=0/1 default: (library default: enabled)\n" |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 356 | #else |
| 357 | #define USAGE_ANTI_REPLAY "" |
| 358 | #endif |
| 359 | |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 360 | #define USAGE_BADMAC_LIMIT \ |
| 361 | " badmac_limit=%%d default: (library default: disabled)\n" |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 362 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 363 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 364 | #define USAGE_DTLS \ |
| 365 | " dtls=%%d default: 0 (TLS)\n" \ |
| 366 | " hs_timeout=%%d-%%d default: (library default: 1000-60000)\n" \ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 367 | " range of DTLS handshake timeouts in millisecs\n" \ |
Hanno Becker | e7675d0 | 2018-08-14 13:28:56 +0100 | [diff] [blame] | 368 | " mtu=%%d default: (library default: unlimited)\n" \ |
| 369 | " dgram_packing=%%d default: 1 (allowed)\n" \ |
| 370 | " allow or forbid packing of multiple\n" \ |
| 371 | " records within a single datgram.\n" |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 372 | #else |
| 373 | #define USAGE_DTLS "" |
| 374 | #endif |
| 375 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 376 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 377 | #define USAGE_EMS \ |
| 378 | " extended_ms=0/1 default: (library default: on)\n" |
| 379 | #else |
| 380 | #define USAGE_EMS "" |
| 381 | #endif |
| 382 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 383 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 384 | #define USAGE_ETM \ |
| 385 | " etm=0/1 default: (library default: on)\n" |
| 386 | #else |
| 387 | #define USAGE_ETM "" |
| 388 | #endif |
| 389 | |
Philippe Antoine | 738153a | 2019-06-18 20:16:43 +0200 | [diff] [blame] | 390 | #define USAGE_REPRODUCIBLE \ |
| 391 | " reproducible=0/1 default: 0 (disabled)\n" |
| 392 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 393 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 394 | #define USAGE_RENEGO \ |
| 395 | " renegotiation=%%d default: 0 (disabled)\n" \ |
| 396 | " renegotiate=%%d default: 0 (disabled)\n" \ |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 397 | " renego_delay=%%d default: -2 (library default)\n" \ |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 398 | " renego_period=%%d default: (2^64 - 1 for TLS, 2^48 - 1 for DTLS)\n" |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 399 | #else |
| 400 | #define USAGE_RENEGO "" |
| 401 | #endif |
| 402 | |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 403 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 404 | #define USAGE_ECJPAKE \ |
| 405 | " ecjpake_pw=%%s default: none (disabled)\n" |
| 406 | #else |
| 407 | #define USAGE_ECJPAKE "" |
| 408 | #endif |
| 409 | |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 410 | #if defined(MBEDTLS_ECP_C) |
| 411 | #define USAGE_CURVES \ |
| 412 | " curves=a,b,c,d default: \"default\" (library default)\n" \ |
| 413 | " example: \"secp521r1,brainpoolP512r1\"\n" \ |
| 414 | " - use \"none\" for empty list\n" \ |
| 415 | " - see mbedtls_ecp_curve_list()\n" \ |
| 416 | " for acceptable curve names\n" |
| 417 | #else |
| 418 | #define USAGE_CURVES "" |
| 419 | #endif |
| 420 | |
Jarno Lamsa | bbc7b41 | 2019-06-04 11:06:31 +0300 | [diff] [blame] | 421 | #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) |
| 422 | #define USAGE_SERIALIZATION \ |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 423 | " serialize=%%d default: 0 (do not serialize/deserialize)\n" \ |
| 424 | " options: 1 (serialize)\n" \ |
| 425 | " 2 (serialize with re-initialization)\n" \ |
| 426 | " context_file=%%s The file path to write a serialized connection\n"\ |
| 427 | " in the form of base64 code (serialize option\n" \ |
| 428 | " must be set)\n" \ |
| 429 | " default: \"\" (do nothing)\n" \ |
| 430 | " option: a file path\n" |
Jarno Lamsa | bbc7b41 | 2019-06-04 11:06:31 +0300 | [diff] [blame] | 431 | #else |
| 432 | #define USAGE_SERIALIZATION "" |
| 433 | #endif |
| 434 | |
Gilles Peskine | b2971ff | 2020-04-14 19:41:01 +0200 | [diff] [blame] | 435 | /* USAGE is arbitrarily split to stay under the portable string literal |
| 436 | * length limit: 4095 bytes in C99. */ |
| 437 | #define USAGE1 \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 438 | "\n usage: ssl_server2 param=<>...\n" \ |
| 439 | "\n acceptable parameters:\n" \ |
Ron Eldor | 71f68c4 | 2017-09-26 11:29:11 +0300 | [diff] [blame] | 440 | " server_addr=%%s default: (all interfaces)\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 441 | " server_port=%%d default: 4433\n" \ |
| 442 | " debug_level=%%d default: 0 (disabled)\n" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 443 | " buffer_size=%%d default: 200 \n" \ |
David Horstmann | fba138a | 2021-05-11 15:23:56 +0100 | [diff] [blame] | 444 | " (minimum: 1)\n" \ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 445 | " response_size=%%d default: about 152 (basic response)\n" \ |
| 446 | " (minimum: 0, max: 16384)\n" \ |
| 447 | " increases buffer_size if bigger\n"\ |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 448 | " nbio=%%d default: 0 (blocking I/O)\n" \ |
| 449 | " options: 1 (non-blocking), 2 (added delays)\n" \ |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 450 | " event=%%d default: 0 (loop)\n" \ |
| 451 | " options: 1 (level-triggered, implies nbio=1),\n" \ |
Manuel Pégourié-Gonnard | 22311ae | 2015-09-09 11:22:58 +0200 | [diff] [blame] | 452 | " read_timeout=%%d default: 0 ms (no timeout)\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 453 | "\n" \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 454 | USAGE_DTLS \ |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 455 | USAGE_SRTP \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 456 | USAGE_COOKIES \ |
| 457 | USAGE_ANTI_REPLAY \ |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 458 | USAGE_BADMAC_LIMIT \ |
Gilles Peskine | b2971ff | 2020-04-14 19:41:01 +0200 | [diff] [blame] | 459 | "\n" |
| 460 | #define USAGE2 \ |
Manuel Pégourié-Gonnard | ee6139c | 2015-05-07 10:18:26 +0100 | [diff] [blame] | 461 | " auth_mode=%%s default: (library default: none)\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 462 | " options: none, optional, required\n" \ |
Janos Follath | 4817e27 | 2017-04-10 13:44:33 +0100 | [diff] [blame] | 463 | " cert_req_ca_list=%%d default: 1 (send ca list)\n" \ |
| 464 | " options: 1 (send ca list), 0 (don't send)\n" \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 465 | USAGE_IO \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 466 | "\n" \ |
| 467 | USAGE_PSK \ |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 468 | USAGE_CA_CALLBACK \ |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 469 | USAGE_ECJPAKE \ |
Gilles Peskine | b2971ff | 2020-04-14 19:41:01 +0200 | [diff] [blame] | 470 | "\n" |
| 471 | #define USAGE3 \ |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 472 | " allow_legacy=%%d default: (library default: no)\n" \ |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 473 | USAGE_RENEGO \ |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 474 | " exchanges=%%d default: 1\n" \ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 475 | "\n" \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 476 | USAGE_TICKETS \ |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 477 | USAGE_EAP_TLS \ |
Philippe Antoine | 738153a | 2019-06-18 20:16:43 +0200 | [diff] [blame] | 478 | USAGE_REPRODUCIBLE \ |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 479 | USAGE_NSS_KEYLOG \ |
| 480 | USAGE_NSS_KEYLOG_FILE \ |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 481 | USAGE_CACHE \ |
Manuel Pégourié-Gonnard | 2fc243d | 2014-02-19 18:22:59 +0100 | [diff] [blame] | 482 | USAGE_MAX_FRAG_LEN \ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 483 | USAGE_ALPN \ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 484 | USAGE_EMS \ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 485 | USAGE_ETM \ |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 486 | USAGE_CURVES \ |
Gilles Peskine | b2971ff | 2020-04-14 19:41:01 +0200 | [diff] [blame] | 487 | "\n" |
| 488 | #define USAGE4 \ |
Hanno Becker | 34ce81f | 2020-08-17 09:40:54 +0100 | [diff] [blame] | 489 | USAGE_SSL_ASYNC \ |
| 490 | USAGE_SNI \ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 491 | " allow_sha1=%%d default: 0\n" \ |
TRodziewicz | 55bd84b | 2021-05-13 11:40:46 +0200 | [diff] [blame] | 492 | " min_version=%%s default: (library default: tls1_2)\n" \ |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 493 | " max_version=%%s default: (library default: tls1_2)\n" \ |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 494 | " force_version=%%s default: \"\" (none)\n" \ |
TRodziewicz | 55bd84b | 2021-05-13 11:40:46 +0200 | [diff] [blame] | 495 | " options: tls1_2, dtls1_2\n" \ |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 496 | "\n" \ |
Manuel Pégourié-Gonnard | 6dc0781 | 2014-06-11 13:50:34 +0200 | [diff] [blame] | 497 | " force_ciphersuite=<name> default: all enabled\n" \ |
Andres Amaya Garcia | bc81884 | 2018-10-16 21:08:38 +0100 | [diff] [blame] | 498 | " query_config=<name> return 0 if the specified\n" \ |
| 499 | " configuration macro is defined and 1\n" \ |
| 500 | " otherwise. The expansion of the macro\n" \ |
| 501 | " is printed if it is defined\n" \ |
Jarno Lamsa | bbc7b41 | 2019-06-04 11:06:31 +0300 | [diff] [blame] | 502 | USAGE_SERIALIZATION \ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 503 | " acceptable ciphersuite names:\n" |
| 504 | |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 505 | #define ALPN_LIST_SIZE 10 |
| 506 | #define CURVE_LIST_SIZE 20 |
| 507 | |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 508 | #define PUT_UINT64_BE(out_be,in_le,i) \ |
| 509 | { \ |
| 510 | (out_be)[(i) + 0] = (unsigned char)( ( (in_le) >> 56 ) & 0xFF ); \ |
| 511 | (out_be)[(i) + 1] = (unsigned char)( ( (in_le) >> 48 ) & 0xFF ); \ |
| 512 | (out_be)[(i) + 2] = (unsigned char)( ( (in_le) >> 40 ) & 0xFF ); \ |
| 513 | (out_be)[(i) + 3] = (unsigned char)( ( (in_le) >> 32 ) & 0xFF ); \ |
| 514 | (out_be)[(i) + 4] = (unsigned char)( ( (in_le) >> 24 ) & 0xFF ); \ |
| 515 | (out_be)[(i) + 5] = (unsigned char)( ( (in_le) >> 16 ) & 0xFF ); \ |
| 516 | (out_be)[(i) + 6] = (unsigned char)( ( (in_le) >> 8 ) & 0xFF ); \ |
| 517 | (out_be)[(i) + 7] = (unsigned char)( ( (in_le) >> 0 ) & 0xFF ); \ |
| 518 | } |
| 519 | |
Manuel Pégourié-Gonnard | 6f19ce3 | 2021-06-16 12:08:34 +0200 | [diff] [blame] | 520 | /* This is global so it can be easily accessed by callback functions */ |
| 521 | rng_context_t rng; |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 522 | |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 523 | /* |
| 524 | * global options |
| 525 | */ |
| 526 | struct options |
| 527 | { |
| 528 | const char *server_addr; /* address on which the ssl service runs */ |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 529 | const char *server_port; /* port on which the ssl service runs */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 530 | int debug_level; /* level of debugging */ |
| 531 | int nbio; /* should I/O be blocking? */ |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 532 | int event; /* loop or event-driven IO? level or edge triggered? */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 533 | uint32_t read_timeout; /* timeout on mbedtls_ssl_read() in milliseconds */ |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 534 | int response_size; /* pad response with header to requested size */ |
| 535 | uint16_t buffer_size; /* IO buffer size */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 536 | const char *ca_file; /* the file with the CA certificate(s) */ |
| 537 | const char *ca_path; /* the path with the CA certificate(s) reside */ |
| 538 | const char *crt_file; /* the file with the server certificate */ |
| 539 | const char *key_file; /* the file with the server key */ |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 540 | const char *key_pwd; /* the password for the server key */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 541 | const char *crt_file2; /* the file with the 2nd server certificate */ |
| 542 | const char *key_file2; /* the file with the 2nd server key */ |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 543 | const char *key_pwd2; /* the password for the 2nd server key */ |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 544 | const char *async_operations; /* supported SSL asynchronous operations */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 545 | int async_private_delay1; /* number of times f_async_resume needs to be called for key 1, or -1 for no async */ |
| 546 | int async_private_delay2; /* number of times f_async_resume needs to be called for key 2, or -1 for no async */ |
| 547 | int async_private_error; /* inject error in async private callback */ |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 548 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 549 | int psk_opaque; |
| 550 | int psk_list_opaque; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 551 | #endif |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 552 | #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) |
Hanno Becker | cbb5903 | 2019-03-28 14:14:22 +0000 | [diff] [blame] | 553 | int ca_callback; /* Use callback for trusted certificate list */ |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 554 | #endif |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 555 | const char *psk; /* the pre-shared key */ |
| 556 | const char *psk_identity; /* the pre-shared key identity */ |
| 557 | char *psk_list; /* list of PSK id/key pairs for callback */ |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 558 | const char *ecjpake_pw; /* the EC J-PAKE password */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 559 | int force_ciphersuite[2]; /* protocol/ciphersuite to use, or all */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 560 | int renegotiation; /* enable / disable renegotiation */ |
| 561 | int allow_legacy; /* allow legacy renegotiation */ |
| 562 | int renegotiate; /* attempt renegotiation? */ |
| 563 | int renego_delay; /* delay before enforcing renegotiation */ |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 564 | uint64_t renego_period; /* period for automatic renegotiation */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 565 | int exchanges; /* number of data exchanges */ |
| 566 | int min_version; /* minimum protocol version accepted */ |
| 567 | int max_version; /* maximum protocol version accepted */ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 568 | int allow_sha1; /* flag for SHA-1 support */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 569 | int auth_mode; /* verify mode for connection */ |
Janos Follath | 4817e27 | 2017-04-10 13:44:33 +0100 | [diff] [blame] | 570 | int cert_req_ca_list; /* should we send the CA list? */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 571 | unsigned char mfl_code; /* code for maximum fragment length */ |
| 572 | int trunc_hmac; /* accept truncated hmac? */ |
| 573 | int tickets; /* enable / disable session tickets */ |
| 574 | int ticket_timeout; /* session ticket lifetime */ |
| 575 | int cache_max; /* max number of session cache entries */ |
| 576 | int cache_timeout; /* expiration delay of session cache entries */ |
| 577 | char *sni; /* string describing sni information */ |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 578 | const char *curves; /* list of supported elliptic curves */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 579 | const char *alpn_string; /* ALPN supported protocols */ |
| 580 | const char *dhm_file; /* the file with the DH parameters */ |
| 581 | int extended_ms; /* allow negotiation of extended MS? */ |
| 582 | int etm; /* allow negotiation of encrypt-then-MAC? */ |
Manuel Pégourié-Gonnard | d901d17 | 2015-02-16 18:37:53 +0000 | [diff] [blame] | 583 | int transport; /* TLS or DTLS? */ |
| 584 | int cookies; /* Use cookies for DTLS? -1 to break them */ |
| 585 | int anti_replay; /* Use anti-replay for DTLS? -1 for default */ |
| 586 | uint32_t hs_to_min; /* Initial value of DTLS handshake timer */ |
| 587 | uint32_t hs_to_max; /* Max value of DTLS handshake timer */ |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 588 | int dtls_mtu; /* UDP Maximum tranport unit for DTLS */ |
Hanno Becker | e7675d0 | 2018-08-14 13:28:56 +0100 | [diff] [blame] | 589 | int dgram_packing; /* allow/forbid datagram packing */ |
Manuel Pégourié-Gonnard | d901d17 | 2015-02-16 18:37:53 +0000 | [diff] [blame] | 590 | int badmac_limit; /* Limit of records with bad MAC */ |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 591 | int eap_tls; /* derive EAP-TLS keying material? */ |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 592 | int nss_keylog; /* export NSS key log material */ |
| 593 | const char *nss_keylog_file; /* NSS key log file */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 594 | int cid_enabled; /* whether to use the CID extension or not */ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 595 | int cid_enabled_renego; /* whether to use the CID extension or not |
| 596 | * during renegotiation */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 597 | const char *cid_val; /* the CID to use for incoming messages */ |
Jarno Lamsa | 9831c8a | 2019-05-29 13:33:32 +0300 | [diff] [blame] | 598 | int serialize; /* serialize/deserialize connection */ |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 599 | const char *context_file; /* the file to write a serialized connection |
| 600 | * in the form of base64 code (serialize |
| 601 | * option must be set) */ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 602 | const char *cid_val_renego; /* the CID to use for incoming messages |
| 603 | * after renegotiation */ |
Philippe Antoine | 154feb2 | 2019-06-11 17:50:23 +0200 | [diff] [blame] | 604 | int reproducible; /* make communication reproducible */ |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 605 | int query_config_mode; /* whether to read config */ |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 606 | int use_srtp; /* Support SRTP */ |
| 607 | int force_srtp_profile; /* SRTP protection profile to use or all */ |
Ron Eldor | 12c6ead | 2018-07-03 15:08:32 +0300 | [diff] [blame] | 608 | int support_mki; /* The dtls mki mki support */ |
Rich Evans | 85b05ec | 2015-02-12 11:37:29 +0000 | [diff] [blame] | 609 | } opt; |
| 610 | |
Gilles Peskine | 0d980b8 | 2021-01-05 23:34:27 +0100 | [diff] [blame] | 611 | #include "ssl_test_common_source.c" |
Hanno Becker | dcc94e6 | 2019-07-03 17:05:43 +0100 | [diff] [blame] | 612 | |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 613 | /* |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 614 | * Return authmode from string, or -1 on error |
| 615 | */ |
| 616 | static int get_auth_mode( const char *s ) |
| 617 | { |
| 618 | if( strcmp( s, "none" ) == 0 ) |
| 619 | return( MBEDTLS_SSL_VERIFY_NONE ); |
| 620 | if( strcmp( s, "optional" ) == 0 ) |
| 621 | return( MBEDTLS_SSL_VERIFY_OPTIONAL ); |
| 622 | if( strcmp( s, "required" ) == 0 ) |
| 623 | return( MBEDTLS_SSL_VERIFY_REQUIRED ); |
| 624 | |
| 625 | return( -1 ); |
| 626 | } |
| 627 | |
| 628 | /* |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 629 | * Used by sni_parse and psk_parse to handle coma-separated lists |
| 630 | */ |
| 631 | #define GET_ITEM( dst ) \ |
Hanno Becker | 1eeca41 | 2018-10-15 12:01:35 +0100 | [diff] [blame] | 632 | do \ |
| 633 | { \ |
| 634 | (dst) = p; \ |
| 635 | while( *p != ',' ) \ |
| 636 | if( ++p > end ) \ |
| 637 | goto error; \ |
| 638 | *p++ = '\0'; \ |
| 639 | } while( 0 ) |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 640 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 641 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 642 | typedef struct _sni_entry sni_entry; |
| 643 | |
| 644 | struct _sni_entry { |
| 645 | const char *name; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 646 | mbedtls_x509_crt *cert; |
| 647 | mbedtls_pk_context *key; |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 648 | mbedtls_x509_crt* ca; |
| 649 | mbedtls_x509_crl* crl; |
| 650 | int authmode; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 651 | sni_entry *next; |
| 652 | }; |
| 653 | |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 654 | void sni_free( sni_entry *head ) |
| 655 | { |
| 656 | sni_entry *cur = head, *next; |
| 657 | |
| 658 | while( cur != NULL ) |
| 659 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 660 | mbedtls_x509_crt_free( cur->cert ); |
| 661 | mbedtls_free( cur->cert ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 662 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 663 | mbedtls_pk_free( cur->key ); |
| 664 | mbedtls_free( cur->key ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 665 | |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 666 | mbedtls_x509_crt_free( cur->ca ); |
| 667 | mbedtls_free( cur->ca ); |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 668 | #if defined(MBEDTLS_X509_CRL_PARSE_C) |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 669 | mbedtls_x509_crl_free( cur->crl ); |
| 670 | mbedtls_free( cur->crl ); |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 671 | #endif |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 672 | next = cur->next; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 673 | mbedtls_free( cur ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 674 | cur = next; |
| 675 | } |
| 676 | } |
| 677 | |
| 678 | /* |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 679 | * Parse a string of sextuples name1,crt1,key1,ca1,crl1,auth1[,...] |
| 680 | * into a usable sni_entry list. For ca1, crl1, auth1, the special value |
| 681 | * '-' means unset. If ca1 is unset, then crl1 is ignored too. |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 682 | * |
| 683 | * Modifies the input string! This is not production quality! |
| 684 | */ |
Manuel Pégourié-Gonnard | 6f19ce3 | 2021-06-16 12:08:34 +0200 | [diff] [blame] | 685 | sni_entry *sni_parse( char *sni_string ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 686 | { |
| 687 | sni_entry *cur = NULL, *new = NULL; |
| 688 | char *p = sni_string; |
| 689 | char *end = p; |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 690 | char *crt_file, *key_file, *ca_file, *auth_str; |
| 691 | #if defined(MBEDTLS_X509_CRL_PARSE_C) |
| 692 | char *crl_file; |
| 693 | #endif |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 694 | |
| 695 | while( *end != '\0' ) |
| 696 | ++end; |
| 697 | *end = ','; |
| 698 | |
| 699 | while( p <= end ) |
| 700 | { |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 701 | if( ( new = mbedtls_calloc( 1, sizeof( sni_entry ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 702 | { |
| 703 | sni_free( cur ); |
| 704 | return( NULL ); |
| 705 | } |
| 706 | |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 707 | GET_ITEM( new->name ); |
| 708 | GET_ITEM( crt_file ); |
| 709 | GET_ITEM( key_file ); |
| 710 | GET_ITEM( ca_file ); |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 711 | #if defined(MBEDTLS_X509_CRL_PARSE_C) |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 712 | GET_ITEM( crl_file ); |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 713 | #endif |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 714 | GET_ITEM( auth_str ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 715 | |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 716 | if( ( new->cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL || |
| 717 | ( new->key = mbedtls_calloc( 1, sizeof( mbedtls_pk_context ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 718 | goto error; |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 719 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 720 | mbedtls_x509_crt_init( new->cert ); |
| 721 | mbedtls_pk_init( new->key ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 722 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 723 | if( mbedtls_x509_crt_parse_file( new->cert, crt_file ) != 0 || |
Manuel Pégourié-Gonnard | 6f19ce3 | 2021-06-16 12:08:34 +0200 | [diff] [blame] | 724 | mbedtls_pk_parse_keyfile( new->key, key_file, "", rng_get, &rng ) != 0 ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 725 | goto error; |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 726 | |
| 727 | if( strcmp( ca_file, "-" ) != 0 ) |
| 728 | { |
| 729 | if( ( new->ca = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL ) |
| 730 | goto error; |
| 731 | |
| 732 | mbedtls_x509_crt_init( new->ca ); |
| 733 | |
| 734 | if( mbedtls_x509_crt_parse_file( new->ca, ca_file ) != 0 ) |
| 735 | goto error; |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 736 | } |
| 737 | |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 738 | #if defined(MBEDTLS_X509_CRL_PARSE_C) |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 739 | if( strcmp( crl_file, "-" ) != 0 ) |
| 740 | { |
| 741 | if( ( new->crl = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) ) ) == NULL ) |
| 742 | goto error; |
| 743 | |
| 744 | mbedtls_x509_crl_init( new->crl ); |
| 745 | |
| 746 | if( mbedtls_x509_crl_parse_file( new->crl, crl_file ) != 0 ) |
| 747 | goto error; |
| 748 | } |
Ron Eldor | 80d0419 | 2019-04-04 15:02:01 +0300 | [diff] [blame] | 749 | #endif |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 750 | |
| 751 | if( strcmp( auth_str, "-" ) != 0 ) |
| 752 | { |
| 753 | if( ( new->authmode = get_auth_mode( auth_str ) ) < 0 ) |
| 754 | goto error; |
| 755 | } |
| 756 | else |
| 757 | new->authmode = DFL_AUTH_MODE; |
| 758 | |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 759 | new->next = cur; |
| 760 | cur = new; |
| 761 | } |
| 762 | |
| 763 | return( cur ); |
| 764 | |
| 765 | error: |
| 766 | sni_free( new ); |
| 767 | sni_free( cur ); |
| 768 | return( NULL ); |
| 769 | } |
| 770 | |
| 771 | /* |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 772 | * SNI callback. |
| 773 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 774 | int sni_callback( void *p_info, mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 775 | const unsigned char *name, size_t name_len ) |
| 776 | { |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 777 | const sni_entry *cur = (const sni_entry *) p_info; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 778 | |
| 779 | while( cur != NULL ) |
| 780 | { |
| 781 | if( name_len == strlen( cur->name ) && |
| 782 | memcmp( name, cur->name, name_len ) == 0 ) |
| 783 | { |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 784 | if( cur->ca != NULL ) |
| 785 | mbedtls_ssl_set_hs_ca_chain( ssl, cur->ca, cur->crl ); |
| 786 | |
| 787 | if( cur->authmode != DFL_AUTH_MODE ) |
| 788 | mbedtls_ssl_set_hs_authmode( ssl, cur->authmode ); |
| 789 | |
Manuel Pégourié-Gonnard | 1af6c85 | 2015-05-10 23:10:37 +0200 | [diff] [blame] | 790 | return( mbedtls_ssl_set_hs_own_cert( ssl, cur->cert, cur->key ) ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 791 | } |
| 792 | |
Mateusz Starzyk | 55768f2 | 2021-05-27 14:57:03 +0200 | [diff] [blame] | 793 | cur = cur->next; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 794 | } |
| 795 | |
| 796 | return( -1 ); |
| 797 | } |
| 798 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 799 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 800 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 801 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Hanno Becker | 554b6ea | 2019-04-30 14:18:06 +0100 | [diff] [blame] | 802 | |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 803 | typedef struct _psk_entry psk_entry; |
| 804 | |
| 805 | struct _psk_entry |
| 806 | { |
| 807 | const char *name; |
| 808 | size_t key_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 809 | unsigned char key[MBEDTLS_PSK_MAX_LEN]; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 810 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 811 | psa_key_id_t slot; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 812 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 813 | psk_entry *next; |
| 814 | }; |
| 815 | |
| 816 | /* |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 817 | * Free a list of psk_entry's |
| 818 | */ |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 819 | int psk_free( psk_entry *head ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 820 | { |
| 821 | psk_entry *next; |
| 822 | |
| 823 | while( head != NULL ) |
| 824 | { |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 825 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 826 | psa_status_t status; |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 827 | psa_key_id_t const slot = head->slot; |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 828 | |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 829 | if( slot != 0 ) |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 830 | { |
| 831 | status = psa_destroy_key( slot ); |
| 832 | if( status != PSA_SUCCESS ) |
| 833 | return( status ); |
| 834 | } |
| 835 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 836 | |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 837 | next = head->next; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 838 | mbedtls_free( head ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 839 | head = next; |
| 840 | } |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 841 | |
| 842 | return( 0 ); |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 843 | } |
| 844 | |
| 845 | /* |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 846 | * Parse a string of pairs name1,key1[,name2,key2[,...]] |
| 847 | * into a usable psk_entry list. |
| 848 | * |
| 849 | * Modifies the input string! This is not production quality! |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 850 | */ |
| 851 | psk_entry *psk_parse( char *psk_string ) |
| 852 | { |
| 853 | psk_entry *cur = NULL, *new = NULL; |
| 854 | char *p = psk_string; |
| 855 | char *end = p; |
| 856 | char *key_hex; |
| 857 | |
| 858 | while( *end != '\0' ) |
| 859 | ++end; |
| 860 | *end = ','; |
| 861 | |
| 862 | while( p <= end ) |
| 863 | { |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 864 | if( ( new = mbedtls_calloc( 1, sizeof( psk_entry ) ) ) == NULL ) |
Manuel Pégourié-Gonnard | b199095 | 2015-02-18 09:32:06 +0000 | [diff] [blame] | 865 | goto error; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 866 | |
| 867 | memset( new, 0, sizeof( psk_entry ) ); |
| 868 | |
Manuel Pégourié-Gonnard | fdee74b | 2014-06-10 15:15:06 +0200 | [diff] [blame] | 869 | GET_ITEM( new->name ); |
| 870 | GET_ITEM( key_hex ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 871 | |
Ronald Cron | 7d86616 | 2020-06-18 10:36:26 +0200 | [diff] [blame] | 872 | if( mbedtls_test_unhexify( new->key, MBEDTLS_PSK_MAX_LEN, |
| 873 | key_hex, &new->key_len ) != 0 ) |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 874 | goto error; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 875 | |
| 876 | new->next = cur; |
| 877 | cur = new; |
| 878 | } |
| 879 | |
| 880 | return( cur ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 881 | |
Manuel Pégourié-Gonnard | 5c078e1 | 2015-02-14 13:56:39 +0000 | [diff] [blame] | 882 | error: |
| 883 | psk_free( new ); |
| 884 | psk_free( cur ); |
| 885 | return( 0 ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 886 | } |
| 887 | |
| 888 | /* |
| 889 | * PSK callback |
| 890 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 891 | int psk_callback( void *p_info, mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 892 | const unsigned char *name, size_t name_len ) |
| 893 | { |
| 894 | psk_entry *cur = (psk_entry *) p_info; |
| 895 | |
| 896 | while( cur != NULL ) |
| 897 | { |
| 898 | if( name_len == strlen( cur->name ) && |
| 899 | memcmp( name, cur->name, name_len ) == 0 ) |
| 900 | { |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 901 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 902 | if( cur->slot != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 903 | return( mbedtls_ssl_set_hs_psk_opaque( ssl, cur->slot ) ); |
| 904 | else |
| 905 | #endif |
Manuel Pégourié-Gonnard | 4b68296 | 2015-05-07 15:59:54 +0100 | [diff] [blame] | 906 | return( mbedtls_ssl_set_hs_psk( ssl, cur->key, cur->key_len ) ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 907 | } |
| 908 | |
Mateusz Starzyk | 55768f2 | 2021-05-27 14:57:03 +0200 | [diff] [blame] | 909 | cur = cur->next; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 910 | } |
| 911 | |
| 912 | return( -1 ); |
| 913 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 914 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
Manuel Pégourié-Gonnard | 9e27163 | 2014-06-09 19:06:00 +0200 | [diff] [blame] | 915 | |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 916 | static mbedtls_net_context listen_fd, client_fd; |
Paul Bakker | bc3e54c | 2014-08-18 14:36:17 +0200 | [diff] [blame] | 917 | |
| 918 | /* Interruption handler to ensure clean exit (for valgrind testing) */ |
| 919 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 920 | static int received_sigterm = 0; |
| 921 | void term_handler( int sig ) |
| 922 | { |
| 923 | ((void) sig); |
| 924 | received_sigterm = 1; |
Manuel Pégourié-Gonnard | 3d7d00a | 2015-06-30 15:55:03 +0200 | [diff] [blame] | 925 | mbedtls_net_free( &listen_fd ); /* causes mbedtls_net_accept() to abort */ |
| 926 | mbedtls_net_free( &client_fd ); /* causes net_read() to abort */ |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 927 | } |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 928 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 929 | |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 930 | /** Return true if \p ret is a status code indicating that there is an |
| 931 | * operation in progress on an SSL connection, and false if it indicates |
| 932 | * success or a fatal error. |
| 933 | * |
| 934 | * The possible operations in progress are: |
| 935 | * |
| 936 | * - A read, when the SSL input buffer does not contain a full message. |
| 937 | * - A write, when the SSL output buffer contains some data that has not |
| 938 | * been sent over the network yet. |
| 939 | * - An asynchronous callback that has not completed yet. */ |
| 940 | static int mbedtls_status_is_ssl_in_progress( int ret ) |
| 941 | { |
| 942 | return( ret == MBEDTLS_ERR_SSL_WANT_READ || |
| 943 | ret == MBEDTLS_ERR_SSL_WANT_WRITE || |
| 944 | ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ); |
| 945 | } |
| 946 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 947 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 948 | typedef struct |
| 949 | { |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 950 | mbedtls_x509_crt *cert; /*!< Certificate corresponding to the key */ |
| 951 | mbedtls_pk_context *pk; /*!< Private key */ |
| 952 | unsigned delay; /*!< Number of resume steps to go through */ |
| 953 | unsigned pk_owned : 1; /*!< Whether to free the pk object on exit */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 954 | } ssl_async_key_slot_t; |
| 955 | |
| 956 | typedef enum { |
Gilles Peskine | ad28bf0 | 2018-04-26 00:19:16 +0200 | [diff] [blame] | 957 | SSL_ASYNC_INJECT_ERROR_NONE = 0, /*!< Let the callbacks succeed */ |
| 958 | SSL_ASYNC_INJECT_ERROR_START, /*!< Inject error during start */ |
| 959 | SSL_ASYNC_INJECT_ERROR_CANCEL, /*!< Close the connection after async start */ |
| 960 | SSL_ASYNC_INJECT_ERROR_RESUME, /*!< Inject error during resume */ |
Gilles Peskine | c912572 | 2018-04-26 07:15:40 +0200 | [diff] [blame] | 961 | #define SSL_ASYNC_INJECT_ERROR_MAX SSL_ASYNC_INJECT_ERROR_RESUME |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 962 | } ssl_async_inject_error_t; |
| 963 | |
| 964 | typedef struct |
| 965 | { |
Gilles Peskine | e247989 | 2018-06-13 18:06:51 +0200 | [diff] [blame] | 966 | ssl_async_key_slot_t slots[4]; /* key, key2, sni1, sni2 */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 967 | size_t slots_used; |
| 968 | ssl_async_inject_error_t inject_error; |
| 969 | int (*f_rng)(void *, unsigned char *, size_t); |
| 970 | void *p_rng; |
| 971 | } ssl_async_key_context_t; |
| 972 | |
Gilles Peskine | d6fbfde | 2018-04-30 10:23:56 +0200 | [diff] [blame] | 973 | int ssl_async_set_key( ssl_async_key_context_t *ctx, |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 974 | mbedtls_x509_crt *cert, |
| 975 | mbedtls_pk_context *pk, |
| 976 | int pk_take_ownership, |
| 977 | unsigned delay ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 978 | { |
Gilles Peskine | d6fbfde | 2018-04-30 10:23:56 +0200 | [diff] [blame] | 979 | if( ctx->slots_used >= sizeof( ctx->slots ) / sizeof( *ctx->slots ) ) |
| 980 | return( -1 ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 981 | ctx->slots[ctx->slots_used].cert = cert; |
| 982 | ctx->slots[ctx->slots_used].pk = pk; |
| 983 | ctx->slots[ctx->slots_used].delay = delay; |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 984 | ctx->slots[ctx->slots_used].pk_owned = pk_take_ownership; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 985 | ++ctx->slots_used; |
Gilles Peskine | d6fbfde | 2018-04-30 10:23:56 +0200 | [diff] [blame] | 986 | return( 0 ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 987 | } |
| 988 | |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 989 | #define SSL_ASYNC_INPUT_MAX_SIZE 512 |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 990 | |
| 991 | typedef enum |
| 992 | { |
| 993 | ASYNC_OP_SIGN, |
| 994 | ASYNC_OP_DECRYPT, |
| 995 | } ssl_async_operation_type_t; |
| 996 | /* Note that the enum above and the array below need to be kept in sync! |
| 997 | * `ssl_async_operation_names[op]` is the name of op for each value `op` |
| 998 | * of type `ssl_async_operation_type_t`. */ |
| 999 | static const char *const ssl_async_operation_names[] = |
| 1000 | { |
| 1001 | "sign", |
| 1002 | "decrypt", |
| 1003 | }; |
| 1004 | |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1005 | typedef struct |
| 1006 | { |
Gilles Peskine | 6331d78 | 2018-04-26 13:27:43 +0200 | [diff] [blame] | 1007 | unsigned slot; |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1008 | ssl_async_operation_type_t operation_type; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1009 | mbedtls_md_type_t md_alg; |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1010 | unsigned char input[SSL_ASYNC_INPUT_MAX_SIZE]; |
| 1011 | size_t input_len; |
Gilles Peskine | ceb541b | 2018-04-26 06:30:45 +0200 | [diff] [blame] | 1012 | unsigned remaining_delay; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1013 | } ssl_async_operation_context_t; |
| 1014 | |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1015 | static int ssl_async_start( mbedtls_ssl_context *ssl, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1016 | mbedtls_x509_crt *cert, |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1017 | ssl_async_operation_type_t op_type, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1018 | mbedtls_md_type_t md_alg, |
| 1019 | const unsigned char *input, |
| 1020 | size_t input_len ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1021 | { |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1022 | ssl_async_key_context_t *config_data = |
| 1023 | mbedtls_ssl_conf_get_async_config_data( ssl->conf ); |
Gilles Peskine | 6331d78 | 2018-04-26 13:27:43 +0200 | [diff] [blame] | 1024 | unsigned slot; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1025 | ssl_async_operation_context_t *ctx = NULL; |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1026 | const char *op_name = ssl_async_operation_names[op_type]; |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1027 | |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1028 | { |
| 1029 | char dn[100]; |
Gilles Peskine | d5d983e | 2018-06-15 14:05:10 +0200 | [diff] [blame] | 1030 | if( mbedtls_x509_dn_gets( dn, sizeof( dn ), &cert->subject ) > 0 ) |
| 1031 | mbedtls_printf( "Async %s callback: looking for DN=%s\n", |
| 1032 | op_name, dn ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1033 | } |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1034 | |
Gilles Peskine | 3dae1cf | 2018-04-30 12:07:56 +0200 | [diff] [blame] | 1035 | /* Look for a private key that matches the public key in cert. |
| 1036 | * Since this test code has the private key inside Mbed TLS, |
| 1037 | * we call mbedtls_pk_check_pair to match a private key with the |
| 1038 | * public key. */ |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 1039 | for( slot = 0; slot < config_data->slots_used; slot++ ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1040 | { |
Gilles Peskine | 3dae1cf | 2018-04-30 12:07:56 +0200 | [diff] [blame] | 1041 | if( mbedtls_pk_check_pair( &cert->pk, |
Manuel Pégourié-Gonnard | 6f19ce3 | 2021-06-16 12:08:34 +0200 | [diff] [blame] | 1042 | config_data->slots[slot].pk, |
| 1043 | rng_get, &rng ) == 0 ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1044 | break; |
| 1045 | } |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 1046 | if( slot == config_data->slots_used ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1047 | { |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1048 | mbedtls_printf( "Async %s callback: no key matches this certificate.\n", |
| 1049 | op_name ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1050 | return( MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH ); |
| 1051 | } |
Gilles Peskine | 6331d78 | 2018-04-26 13:27:43 +0200 | [diff] [blame] | 1052 | mbedtls_printf( "Async %s callback: using key slot %u, delay=%u.\n", |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 1053 | op_name, slot, config_data->slots[slot].delay ); |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1054 | |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 1055 | if( config_data->inject_error == SSL_ASYNC_INJECT_ERROR_START ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1056 | { |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1057 | mbedtls_printf( "Async %s callback: injected error\n", op_name ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1058 | return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ); |
| 1059 | } |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1060 | |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1061 | if( input_len > SSL_ASYNC_INPUT_MAX_SIZE ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1062 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1063 | |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1064 | ctx = mbedtls_calloc( 1, sizeof( *ctx ) ); |
| 1065 | if( ctx == NULL ) |
| 1066 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
| 1067 | ctx->slot = slot; |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1068 | ctx->operation_type = op_type; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1069 | ctx->md_alg = md_alg; |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1070 | memcpy( ctx->input, input, input_len ); |
| 1071 | ctx->input_len = input_len; |
Gilles Peskine | ceb541b | 2018-04-26 06:30:45 +0200 | [diff] [blame] | 1072 | ctx->remaining_delay = config_data->slots[slot].delay; |
Gilles Peskine | a668c60 | 2018-04-30 11:54:39 +0200 | [diff] [blame] | 1073 | mbedtls_ssl_set_async_operation_data( ssl, ctx ); |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1074 | |
Gilles Peskine | ceb541b | 2018-04-26 06:30:45 +0200 | [diff] [blame] | 1075 | if( ctx->remaining_delay == 0 ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1076 | return( 0 ); |
| 1077 | else |
| 1078 | return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ); |
| 1079 | } |
| 1080 | |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1081 | static int ssl_async_sign( mbedtls_ssl_context *ssl, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1082 | mbedtls_x509_crt *cert, |
| 1083 | mbedtls_md_type_t md_alg, |
| 1084 | const unsigned char *hash, |
| 1085 | size_t hash_len ) |
| 1086 | { |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1087 | return( ssl_async_start( ssl, cert, |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1088 | ASYNC_OP_SIGN, md_alg, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1089 | hash, hash_len ) ); |
| 1090 | } |
| 1091 | |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1092 | static int ssl_async_decrypt( mbedtls_ssl_context *ssl, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1093 | mbedtls_x509_crt *cert, |
| 1094 | const unsigned char *input, |
| 1095 | size_t input_len ) |
| 1096 | { |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1097 | return( ssl_async_start( ssl, cert, |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1098 | ASYNC_OP_DECRYPT, MBEDTLS_MD_NONE, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1099 | input, input_len ) ); |
| 1100 | } |
| 1101 | |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1102 | static int ssl_async_resume( mbedtls_ssl_context *ssl, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1103 | unsigned char *output, |
| 1104 | size_t *output_len, |
| 1105 | size_t output_size ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1106 | { |
Gilles Peskine | a668c60 | 2018-04-30 11:54:39 +0200 | [diff] [blame] | 1107 | ssl_async_operation_context_t *ctx = mbedtls_ssl_get_async_operation_data( ssl ); |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1108 | ssl_async_key_context_t *config_data = |
| 1109 | mbedtls_ssl_conf_get_async_config_data( ssl->conf ); |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 1110 | ssl_async_key_slot_t *key_slot = &config_data->slots[ctx->slot]; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1111 | int ret; |
Gilles Peskine | f5a9996 | 2018-04-30 16:37:23 +0200 | [diff] [blame] | 1112 | const char *op_name; |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1113 | |
Gilles Peskine | ceb541b | 2018-04-26 06:30:45 +0200 | [diff] [blame] | 1114 | if( ctx->remaining_delay > 0 ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1115 | { |
Gilles Peskine | ceb541b | 2018-04-26 06:30:45 +0200 | [diff] [blame] | 1116 | --ctx->remaining_delay; |
Gilles Peskine | 6331d78 | 2018-04-26 13:27:43 +0200 | [diff] [blame] | 1117 | mbedtls_printf( "Async resume (slot %u): call %u more times.\n", |
Gilles Peskine | ceb541b | 2018-04-26 06:30:45 +0200 | [diff] [blame] | 1118 | ctx->slot, ctx->remaining_delay ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1119 | return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ); |
| 1120 | } |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1121 | |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1122 | switch( ctx->operation_type ) |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1123 | { |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1124 | case ASYNC_OP_DECRYPT: |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1125 | ret = mbedtls_pk_decrypt( key_slot->pk, |
| 1126 | ctx->input, ctx->input_len, |
| 1127 | output, output_len, output_size, |
| 1128 | config_data->f_rng, config_data->p_rng ); |
| 1129 | break; |
| 1130 | case ASYNC_OP_SIGN: |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1131 | ret = mbedtls_pk_sign( key_slot->pk, |
| 1132 | ctx->md_alg, |
| 1133 | ctx->input, ctx->input_len, |
Gilles Peskine | f00f152 | 2021-06-22 00:09:00 +0200 | [diff] [blame] | 1134 | output, output_size, output_len, |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1135 | config_data->f_rng, config_data->p_rng ); |
| 1136 | break; |
| 1137 | default: |
Gilles Peskine | 6331d78 | 2018-04-26 13:27:43 +0200 | [diff] [blame] | 1138 | mbedtls_printf( "Async resume (slot %u): unknown operation type %ld. This shouldn't happen.\n", |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1139 | ctx->slot, (long) ctx->operation_type ); |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 1140 | mbedtls_free( ctx ); |
Gilles Peskine | d326883 | 2018-04-26 06:23:59 +0200 | [diff] [blame] | 1141 | return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ); |
| 1142 | break; |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1143 | } |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1144 | |
Gilles Peskine | f5a9996 | 2018-04-30 16:37:23 +0200 | [diff] [blame] | 1145 | op_name = ssl_async_operation_names[ctx->operation_type]; |
| 1146 | |
Gilles Peskine | c912572 | 2018-04-26 07:15:40 +0200 | [diff] [blame] | 1147 | if( config_data->inject_error == SSL_ASYNC_INJECT_ERROR_RESUME ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1148 | { |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1149 | mbedtls_printf( "Async resume callback: %s done but injected error\n", |
| 1150 | op_name ); |
Gilles Peskine | 2636fad | 2018-06-12 14:17:39 +0200 | [diff] [blame] | 1151 | mbedtls_free( ctx ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1152 | return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ); |
| 1153 | } |
Gilles Peskine | f112725 | 2018-04-24 13:05:39 +0200 | [diff] [blame] | 1154 | |
Gilles Peskine | 6331d78 | 2018-04-26 13:27:43 +0200 | [diff] [blame] | 1155 | mbedtls_printf( "Async resume (slot %u): %s done, status=%d.\n", |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1156 | ctx->slot, op_name, ret ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1157 | mbedtls_free( ctx ); |
| 1158 | return( ret ); |
| 1159 | } |
| 1160 | |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 1161 | static void ssl_async_cancel( mbedtls_ssl_context *ssl ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1162 | { |
Gilles Peskine | a668c60 | 2018-04-30 11:54:39 +0200 | [diff] [blame] | 1163 | ssl_async_operation_context_t *ctx = mbedtls_ssl_get_async_operation_data( ssl ); |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1164 | mbedtls_printf( "Async cancel callback.\n" ); |
| 1165 | mbedtls_free( ctx ); |
| 1166 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 1167 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1168 | |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1169 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 1170 | static psa_status_t psa_setup_psk_key_slot( psa_key_id_t *slot, |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1171 | psa_algorithm_t alg, |
| 1172 | unsigned char *psk, |
| 1173 | size_t psk_len ) |
| 1174 | { |
| 1175 | psa_status_t status; |
Janos Follath | be4efc2 | 2019-08-08 11:38:18 +0100 | [diff] [blame] | 1176 | psa_key_attributes_t key_attributes; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1177 | |
Janos Follath | be4efc2 | 2019-08-08 11:38:18 +0100 | [diff] [blame] | 1178 | key_attributes = psa_key_attributes_init(); |
| 1179 | psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE ); |
| 1180 | psa_set_key_algorithm( &key_attributes, alg ); |
| 1181 | psa_set_key_type( &key_attributes, PSA_KEY_TYPE_DERIVE ); |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1182 | |
Janos Follath | be4efc2 | 2019-08-08 11:38:18 +0100 | [diff] [blame] | 1183 | status = psa_import_key( &key_attributes, psk, psk_len, slot ); |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1184 | if( status != PSA_SUCCESS ) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1185 | { |
| 1186 | fprintf( stderr, "IMPORT\n" ); |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1187 | return( status ); |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1188 | } |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1189 | |
| 1190 | return( PSA_SUCCESS ); |
| 1191 | } |
| 1192 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1193 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1194 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1195 | int report_cid_usage( mbedtls_ssl_context *ssl, |
| 1196 | const char *additional_description ) |
| 1197 | { |
| 1198 | int ret; |
| 1199 | unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ]; |
| 1200 | size_t peer_cid_len; |
| 1201 | int cid_negotiated; |
| 1202 | |
| 1203 | if( opt.transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
| 1204 | return( 0 ); |
| 1205 | |
| 1206 | /* Check if the use of a CID has been negotiated */ |
| 1207 | ret = mbedtls_ssl_get_peer_cid( ssl, &cid_negotiated, |
| 1208 | peer_cid, &peer_cid_len ); |
| 1209 | if( ret != 0 ) |
| 1210 | { |
| 1211 | mbedtls_printf( " failed\n ! mbedtls_ssl_get_peer_cid returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 1212 | (unsigned int) -ret ); |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1213 | return( ret ); |
| 1214 | } |
| 1215 | |
| 1216 | if( cid_negotiated == MBEDTLS_SSL_CID_DISABLED ) |
| 1217 | { |
| 1218 | if( opt.cid_enabled == MBEDTLS_SSL_CID_ENABLED ) |
| 1219 | { |
| 1220 | mbedtls_printf( "(%s) Use of Connection ID was not offered by client.\n", |
| 1221 | additional_description ); |
| 1222 | } |
| 1223 | } |
| 1224 | else |
| 1225 | { |
| 1226 | size_t idx=0; |
| 1227 | mbedtls_printf( "(%s) Use of Connection ID has been negotiated.\n", |
| 1228 | additional_description ); |
| 1229 | mbedtls_printf( "(%s) Peer CID (length %u Bytes): ", |
| 1230 | additional_description, |
| 1231 | (unsigned) peer_cid_len ); |
| 1232 | while( idx < peer_cid_len ) |
| 1233 | { |
| 1234 | mbedtls_printf( "%02x ", peer_cid[ idx ] ); |
| 1235 | idx++; |
| 1236 | } |
| 1237 | mbedtls_printf( "\n" ); |
| 1238 | } |
| 1239 | |
| 1240 | return( 0 ); |
| 1241 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1242 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1243 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1244 | int main( int argc, char *argv[] ) |
| 1245 | { |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 1246 | int ret = 0, len, written, frags, exchanges_left; |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 1247 | int query_config_ret = 0; |
Hanno Becker | dcc94e6 | 2019-07-03 17:05:43 +0100 | [diff] [blame] | 1248 | io_ctx_t io_ctx; |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1249 | unsigned char* buf = 0; |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 1250 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1251 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1252 | psa_algorithm_t alg = 0; |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 1253 | psa_key_id_t psk_slot = 0; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1254 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1255 | unsigned char psk[MBEDTLS_PSK_MAX_LEN]; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1256 | size_t psk_len = 0; |
Paul Bakker | 9b7fb6f | 2014-06-12 23:01:43 +0200 | [diff] [blame] | 1257 | psk_entry *psk_info = NULL; |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1258 | #endif |
Paul Bakker | ef3f8c7 | 2013-06-24 13:01:08 +0200 | [diff] [blame] | 1259 | const char *pers = "ssl_server2"; |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 1260 | unsigned char client_ip[16] = { 0 }; |
Manuel Pégourié-Gonnard | 0b104b0 | 2015-05-14 21:52:40 +0200 | [diff] [blame] | 1261 | size_t cliip_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1262 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 1263 | mbedtls_ssl_cookie_ctx cookie_ctx; |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 1264 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1265 | |
Gilles Peskine | ef86ab2 | 2017-05-05 18:59:02 +0200 | [diff] [blame] | 1266 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 1267 | mbedtls_x509_crt_profile crt_profile_for_test = mbedtls_x509_crt_profile_default; |
| 1268 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1269 | mbedtls_ssl_context ssl; |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 1270 | mbedtls_ssl_config conf; |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 1271 | #if defined(MBEDTLS_TIMING_C) |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 1272 | mbedtls_timing_delay_context timer; |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 1273 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1274 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1275 | unsigned char renego_period[8] = { 0 }; |
| 1276 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1277 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | db1cc76 | 2015-05-12 11:27:25 +0200 | [diff] [blame] | 1278 | uint32_t flags; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1279 | mbedtls_x509_crt cacert; |
| 1280 | mbedtls_x509_crt srvcert; |
| 1281 | mbedtls_pk_context pkey; |
| 1282 | mbedtls_x509_crt srvcert2; |
| 1283 | mbedtls_pk_context pkey2; |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 1284 | int key_cert_init = 0, key_cert_init2 = 0; |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 1285 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1286 | ssl_async_key_context_t ssl_async_keys; |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 1287 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1288 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1289 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 1290 | mbedtls_dhm_context dhm; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1291 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1292 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 1293 | mbedtls_ssl_cache_context cache; |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 1294 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 1295 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 1296 | mbedtls_ssl_ticket_context ticket_ctx; |
| 1297 | #endif |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 1298 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1299 | sni_entry *sni_info = NULL; |
| 1300 | #endif |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 1301 | #if defined(MBEDTLS_ECP_C) |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 1302 | mbedtls_ecp_group_id curve_list[CURVE_LIST_SIZE]; |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 1303 | const mbedtls_ecp_curve_info * curve_cur; |
| 1304 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1305 | #if defined(MBEDTLS_SSL_ALPN) |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 1306 | const char *alpn_list[ALPN_LIST_SIZE]; |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1307 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1308 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
Simon Butcher | cce68be | 2018-07-23 14:26:09 +0100 | [diff] [blame] | 1309 | unsigned char alloc_buf[MEMORY_HEAP_SIZE]; |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 1310 | #endif |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1311 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1312 | unsigned char cid[MBEDTLS_SSL_CID_IN_LEN_MAX]; |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1313 | unsigned char cid_renego[MBEDTLS_SSL_CID_IN_LEN_MAX]; |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1314 | size_t cid_len = 0; |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1315 | size_t cid_renego_len = 0; |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1316 | #endif |
Manuel Pégourié-Gonnard | 3309a67 | 2019-07-15 10:31:11 +0200 | [diff] [blame] | 1317 | #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) |
| 1318 | unsigned char *context_buf = NULL; |
Gilles Peskine | 4e8b594 | 2019-09-20 19:12:31 +0200 | [diff] [blame] | 1319 | size_t context_buf_len = 0; |
Manuel Pégourié-Gonnard | 3309a67 | 2019-07-15 10:31:11 +0200 | [diff] [blame] | 1320 | #endif |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1321 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1322 | int i; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1323 | char *p, *q; |
| 1324 | const int *list; |
Hanno Becker | 5a9942e | 2018-11-12 17:47:48 +0000 | [diff] [blame] | 1325 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1326 | psa_status_t status; |
| 1327 | #endif |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 1328 | #if defined(MBEDTLS_SSL_EXPORT_KEYS) |
| 1329 | unsigned char eap_tls_keymaterial[16]; |
| 1330 | unsigned char eap_tls_iv[8]; |
| 1331 | const char* eap_tls_label = "client EAP encryption"; |
| 1332 | eap_tls_keys eap_tls_keying; |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 1333 | #if defined( MBEDTLS_SSL_DTLS_SRTP ) |
| 1334 | /*! master keys and master salt for SRTP generated during handshake */ |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 1335 | unsigned char dtls_srtp_key_material[MBEDTLS_TLS_SRTP_MAX_KEY_MATERIAL_LENGTH]; |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 1336 | const char* dtls_srtp_label = "EXTRACTOR-dtls_srtp"; |
| 1337 | dtls_srtp_keys dtls_srtp_keying; |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 1338 | const mbedtls_ssl_srtp_profile default_profiles[] = { |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 1339 | MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_80, |
| 1340 | MBEDTLS_TLS_SRTP_AES128_CM_HMAC_SHA1_32, |
| 1341 | MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_80, |
Johan Pascal | 253d026 | 2020-09-22 13:04:45 +0200 | [diff] [blame] | 1342 | MBEDTLS_TLS_SRTP_NULL_HMAC_SHA1_32, |
| 1343 | MBEDTLS_TLS_SRTP_UNSET |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 1344 | }; |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 1345 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 1346 | #endif /* MBEDTLS_SSL_EXPORT_KEYS */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1347 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1348 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
| 1349 | mbedtls_memory_buffer_alloc_init( alloc_buf, sizeof(alloc_buf) ); |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 1350 | #if defined(MBEDTLS_MEMORY_DEBUG) |
| 1351 | size_t current_heap_memory, peak_heap_memory, heap_blocks; |
| 1352 | #endif /* MBEDTLS_MEMORY_DEBUG */ |
| 1353 | #endif /* MBEDTLS_MEMORY_BUFFER_ALLOC_C */ |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 1354 | |
Gilles Peskine | 60fe660 | 2021-02-16 18:56:42 +0100 | [diff] [blame] | 1355 | #if defined(MBEDTLS_TEST_HOOKS) |
Gilles Peskine | 53dea74 | 2021-02-02 22:55:06 +0100 | [diff] [blame] | 1356 | test_hooks_init( ); |
Gilles Peskine | 60fe660 | 2021-02-16 18:56:42 +0100 | [diff] [blame] | 1357 | #endif /* MBEDTLS_TEST_HOOKS */ |
Gilles Peskine | 53dea74 | 2021-02-02 22:55:06 +0100 | [diff] [blame] | 1358 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1359 | /* |
Manuel Pégourié-Gonnard | 3bd2aae | 2013-09-20 13:10:13 +0200 | [diff] [blame] | 1360 | * Make sure memory references are valid in case we exit early. |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1361 | */ |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 1362 | mbedtls_net_init( &client_fd ); |
| 1363 | mbedtls_net_init( &listen_fd ); |
Manuel Pégourié-Gonnard | 41d479e | 2015-04-29 00:48:22 +0200 | [diff] [blame] | 1364 | mbedtls_ssl_init( &ssl ); |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 1365 | mbedtls_ssl_config_init( &conf ); |
Gilles Peskine | f1cb75f | 2021-01-13 18:46:01 +0100 | [diff] [blame] | 1366 | rng_init( &rng ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1367 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 1368 | mbedtls_x509_crt_init( &cacert ); |
| 1369 | mbedtls_x509_crt_init( &srvcert ); |
| 1370 | mbedtls_pk_init( &pkey ); |
| 1371 | mbedtls_x509_crt_init( &srvcert2 ); |
| 1372 | mbedtls_pk_init( &pkey2 ); |
Gilles Peskine | 4d9ec4d | 2018-04-26 14:33:43 +0200 | [diff] [blame] | 1373 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
| 1374 | memset( &ssl_async_keys, 0, sizeof( ssl_async_keys ) ); |
| 1375 | #endif |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1376 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1377 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 1378 | mbedtls_dhm_init( &dhm ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1379 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1380 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 1381 | mbedtls_ssl_cache_init( &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 1382 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 1383 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 1384 | mbedtls_ssl_ticket_init( &ticket_ctx ); |
| 1385 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1386 | #if defined(MBEDTLS_SSL_ALPN) |
Paul Bakker | 525f875 | 2014-05-01 10:58:57 +0200 | [diff] [blame] | 1387 | memset( (void *) alpn_list, 0, sizeof( alpn_list ) ); |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1388 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1389 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 1390 | mbedtls_ssl_cookie_init( &cookie_ctx ); |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 1391 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1392 | |
Hanno Becker | 5a9942e | 2018-11-12 17:47:48 +0000 | [diff] [blame] | 1393 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 1394 | status = psa_crypto_init(); |
| 1395 | if( status != PSA_SUCCESS ) |
| 1396 | { |
| 1397 | mbedtls_fprintf( stderr, "Failed to initialize PSA Crypto implementation: %d\n", |
| 1398 | (int) status ); |
| 1399 | ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; |
| 1400 | goto exit; |
| 1401 | } |
Gilles Peskine | 48113eb | 2021-02-09 10:25:20 +0100 | [diff] [blame] | 1402 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Gilles Peskine | 2146211 | 2021-01-13 23:53:09 +0100 | [diff] [blame] | 1403 | #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) |
| 1404 | mbedtls_test_enable_insecure_external_rng( ); |
Gilles Peskine | 94ad831 | 2021-01-25 13:42:28 +0100 | [diff] [blame] | 1405 | #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ |
Hanno Becker | 5a9942e | 2018-11-12 17:47:48 +0000 | [diff] [blame] | 1406 | |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 1407 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | 403a86f | 2014-11-17 12:46:49 +0100 | [diff] [blame] | 1408 | /* Abort cleanly on SIGTERM and SIGINT */ |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1409 | signal( SIGTERM, term_handler ); |
Manuel Pégourié-Gonnard | 403a86f | 2014-11-17 12:46:49 +0100 | [diff] [blame] | 1410 | signal( SIGINT, term_handler ); |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 1411 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 1412 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1413 | if( argc == 0 ) |
| 1414 | { |
| 1415 | usage: |
| 1416 | if( ret == 0 ) |
| 1417 | ret = 1; |
| 1418 | |
Gilles Peskine | b2971ff | 2020-04-14 19:41:01 +0200 | [diff] [blame] | 1419 | mbedtls_printf( USAGE1 ); |
| 1420 | mbedtls_printf( USAGE2 ); |
| 1421 | mbedtls_printf( USAGE3 ); |
| 1422 | mbedtls_printf( USAGE4 ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1423 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1424 | list = mbedtls_ssl_list_ciphersuites(); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1425 | while( *list ) |
| 1426 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1427 | mbedtls_printf(" %-42s", mbedtls_ssl_get_ciphersuite_name( *list ) ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 1428 | list++; |
| 1429 | if( !*list ) |
| 1430 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1431 | mbedtls_printf(" %s\n", mbedtls_ssl_get_ciphersuite_name( *list ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1432 | list++; |
| 1433 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1434 | mbedtls_printf("\n"); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1435 | goto exit; |
| 1436 | } |
| 1437 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1438 | opt.buffer_size = DFL_IO_BUF_LEN; |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 1439 | opt.server_addr = DFL_SERVER_ADDR; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1440 | opt.server_port = DFL_SERVER_PORT; |
| 1441 | opt.debug_level = DFL_DEBUG_LEVEL; |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 1442 | opt.event = DFL_EVENT; |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1443 | opt.response_size = DFL_RESPONSE_SIZE; |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1444 | opt.nbio = DFL_NBIO; |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1445 | opt.cid_enabled = DFL_CID_ENABLED; |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1446 | opt.cid_enabled_renego = DFL_CID_ENABLED_RENEGO; |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1447 | opt.cid_val = DFL_CID_VALUE; |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1448 | opt.cid_val_renego = DFL_CID_VALUE_RENEGO; |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 1449 | opt.read_timeout = DFL_READ_TIMEOUT; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1450 | opt.ca_file = DFL_CA_FILE; |
| 1451 | opt.ca_path = DFL_CA_PATH; |
| 1452 | opt.crt_file = DFL_CRT_FILE; |
| 1453 | opt.key_file = DFL_KEY_FILE; |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 1454 | opt.key_pwd = DFL_KEY_PWD; |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 1455 | opt.crt_file2 = DFL_CRT_FILE2; |
| 1456 | opt.key_file2 = DFL_KEY_FILE2; |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 1457 | opt.key_pwd2 = DFL_KEY_PWD2; |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1458 | opt.async_operations = DFL_ASYNC_OPERATIONS; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1459 | opt.async_private_delay1 = DFL_ASYNC_PRIVATE_DELAY1; |
| 1460 | opt.async_private_delay2 = DFL_ASYNC_PRIVATE_DELAY2; |
| 1461 | opt.async_private_error = DFL_ASYNC_PRIVATE_ERROR; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1462 | opt.psk = DFL_PSK; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1463 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1464 | opt.psk_opaque = DFL_PSK_OPAQUE; |
| 1465 | opt.psk_list_opaque = DFL_PSK_LIST_OPAQUE; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1466 | #endif |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 1467 | #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) |
| 1468 | opt.ca_callback = DFL_CA_CALLBACK; |
| 1469 | #endif |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1470 | opt.psk_identity = DFL_PSK_IDENTITY; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1471 | opt.psk_list = DFL_PSK_LIST; |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 1472 | opt.ecjpake_pw = DFL_ECJPAKE_PW; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1473 | opt.force_ciphersuite[0]= DFL_FORCE_CIPHER; |
| 1474 | opt.renegotiation = DFL_RENEGOTIATION; |
| 1475 | opt.allow_legacy = DFL_ALLOW_LEGACY; |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1476 | opt.renegotiate = DFL_RENEGOTIATE; |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1477 | opt.renego_delay = DFL_RENEGO_DELAY; |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1478 | opt.renego_period = DFL_RENEGO_PERIOD; |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 1479 | opt.exchanges = DFL_EXCHANGES; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1480 | opt.min_version = DFL_MIN_VERSION; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1481 | opt.max_version = DFL_MAX_VERSION; |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1482 | opt.allow_sha1 = DFL_SHA1; |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1483 | opt.auth_mode = DFL_AUTH_MODE; |
Janos Follath | 4817e27 | 2017-04-10 13:44:33 +0100 | [diff] [blame] | 1484 | opt.cert_req_ca_list = DFL_CERT_REQ_CA_LIST; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1485 | opt.mfl_code = DFL_MFL_CODE; |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1486 | opt.trunc_hmac = DFL_TRUNC_HMAC; |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 1487 | opt.tickets = DFL_TICKETS; |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1488 | opt.ticket_timeout = DFL_TICKET_TIMEOUT; |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1489 | opt.cache_max = DFL_CACHE_MAX; |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1490 | opt.cache_timeout = DFL_CACHE_TIMEOUT; |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1491 | opt.sni = DFL_SNI; |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1492 | opt.alpn_string = DFL_ALPN_STRING; |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 1493 | opt.curves = DFL_CURVES; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1494 | opt.dhm_file = DFL_DHM_FILE; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 1495 | opt.transport = DFL_TRANSPORT; |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1496 | opt.cookies = DFL_COOKIES; |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1497 | opt.anti_replay = DFL_ANTI_REPLAY; |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1498 | opt.hs_to_min = DFL_HS_TO_MIN; |
| 1499 | opt.hs_to_max = DFL_HS_TO_MAX; |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 1500 | opt.dtls_mtu = DFL_DTLS_MTU; |
Hanno Becker | e7675d0 | 2018-08-14 13:28:56 +0100 | [diff] [blame] | 1501 | opt.dgram_packing = DFL_DGRAM_PACKING; |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1502 | opt.badmac_limit = DFL_BADMAC_LIMIT; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1503 | opt.extended_ms = DFL_EXTENDED_MS; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1504 | opt.etm = DFL_ETM; |
Jarno Lamsa | 9831c8a | 2019-05-29 13:33:32 +0300 | [diff] [blame] | 1505 | opt.serialize = DFL_SERIALIZE; |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 1506 | opt.context_file = DFL_CONTEXT_FILE; |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 1507 | opt.eap_tls = DFL_EAP_TLS; |
Philippe Antoine | aa4d152 | 2019-06-06 21:24:31 +0200 | [diff] [blame] | 1508 | opt.reproducible = DFL_REPRODUCIBLE; |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 1509 | opt.nss_keylog = DFL_NSS_KEYLOG; |
| 1510 | opt.nss_keylog_file = DFL_NSS_KEYLOG_FILE; |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 1511 | opt.query_config_mode = DFL_QUERY_CONFIG_MODE; |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 1512 | opt.use_srtp = DFL_USE_SRTP; |
| 1513 | opt.force_srtp_profile = DFL_SRTP_FORCE_PROFILE; |
Ron Eldor | 12c6ead | 2018-07-03 15:08:32 +0300 | [diff] [blame] | 1514 | opt.support_mki = DFL_SRTP_SUPPORT_MKI; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1515 | |
| 1516 | for( i = 1; i < argc; i++ ) |
| 1517 | { |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1518 | p = argv[i]; |
| 1519 | if( ( q = strchr( p, '=' ) ) == NULL ) |
| 1520 | goto usage; |
| 1521 | *q++ = '\0'; |
| 1522 | |
| 1523 | if( strcmp( p, "server_port" ) == 0 ) |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 1524 | opt.server_port = q; |
Manuel Pégourié-Gonnard | 18d31f8 | 2013-12-13 16:21:41 +0100 | [diff] [blame] | 1525 | else if( strcmp( p, "server_addr" ) == 0 ) |
| 1526 | opt.server_addr = q; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 1527 | else if( strcmp( p, "dtls" ) == 0 ) |
| 1528 | { |
| 1529 | int t = atoi( q ); |
| 1530 | if( t == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1531 | opt.transport = MBEDTLS_SSL_TRANSPORT_STREAM; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 1532 | else if( t == 1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1533 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | e29fd4b | 2014-02-06 14:02:55 +0100 | [diff] [blame] | 1534 | else |
| 1535 | goto usage; |
| 1536 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1537 | else if( strcmp( p, "debug_level" ) == 0 ) |
| 1538 | { |
| 1539 | opt.debug_level = atoi( q ); |
| 1540 | if( opt.debug_level < 0 || opt.debug_level > 65535 ) |
| 1541 | goto usage; |
| 1542 | } |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 1543 | else if( strcmp( p, "nbio" ) == 0 ) |
| 1544 | { |
| 1545 | opt.nbio = atoi( q ); |
| 1546 | if( opt.nbio < 0 || opt.nbio > 2 ) |
| 1547 | goto usage; |
| 1548 | } |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 1549 | else if( strcmp( p, "event" ) == 0 ) |
| 1550 | { |
| 1551 | opt.event = atoi( q ); |
| 1552 | if( opt.event < 0 || opt.event > 2 ) |
| 1553 | goto usage; |
| 1554 | } |
Manuel Pégourié-Gonnard | 6b65141 | 2014-10-01 18:29:03 +0200 | [diff] [blame] | 1555 | else if( strcmp( p, "read_timeout" ) == 0 ) |
| 1556 | opt.read_timeout = atoi( q ); |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1557 | else if( strcmp( p, "buffer_size" ) == 0 ) |
| 1558 | { |
| 1559 | opt.buffer_size = atoi( q ); |
David Horstmann | fba138a | 2021-05-11 15:23:56 +0100 | [diff] [blame] | 1560 | if( opt.buffer_size < 1 ) |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1561 | goto usage; |
| 1562 | } |
| 1563 | else if( strcmp( p, "response_size" ) == 0 ) |
| 1564 | { |
| 1565 | opt.response_size = atoi( q ); |
David Horstmann | 95d516f | 2021-05-04 18:36:56 +0100 | [diff] [blame] | 1566 | if( opt.response_size < 0 || opt.response_size > MBEDTLS_SSL_OUT_CONTENT_LEN ) |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1567 | goto usage; |
| 1568 | if( opt.buffer_size < opt.response_size ) |
| 1569 | opt.buffer_size = opt.response_size; |
| 1570 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1571 | else if( strcmp( p, "ca_file" ) == 0 ) |
| 1572 | opt.ca_file = q; |
| 1573 | else if( strcmp( p, "ca_path" ) == 0 ) |
| 1574 | opt.ca_path = q; |
| 1575 | else if( strcmp( p, "crt_file" ) == 0 ) |
| 1576 | opt.crt_file = q; |
| 1577 | else if( strcmp( p, "key_file" ) == 0 ) |
| 1578 | opt.key_file = q; |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 1579 | else if( strcmp( p, "key_pwd" ) == 0 ) |
| 1580 | opt.key_pwd = q; |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 1581 | else if( strcmp( p, "crt_file2" ) == 0 ) |
| 1582 | opt.crt_file2 = q; |
| 1583 | else if( strcmp( p, "key_file2" ) == 0 ) |
| 1584 | opt.key_file2 = q; |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 1585 | else if( strcmp( p, "key_pwd2" ) == 0 ) |
| 1586 | opt.key_pwd2 = q; |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 1587 | else if( strcmp( p, "dhm_file" ) == 0 ) |
| 1588 | opt.dhm_file = q; |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 1589 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 1590 | else if( strcmp( p, "async_operations" ) == 0 ) |
| 1591 | opt.async_operations = q; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1592 | else if( strcmp( p, "async_private_delay1" ) == 0 ) |
| 1593 | opt.async_private_delay1 = atoi( q ); |
| 1594 | else if( strcmp( p, "async_private_delay2" ) == 0 ) |
| 1595 | opt.async_private_delay2 = atoi( q ); |
| 1596 | else if( strcmp( p, "async_private_error" ) == 0 ) |
| 1597 | { |
| 1598 | int n = atoi( q ); |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 1599 | if( n < -SSL_ASYNC_INJECT_ERROR_MAX || |
| 1600 | n > SSL_ASYNC_INJECT_ERROR_MAX ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 1601 | { |
| 1602 | ret = 2; |
| 1603 | goto usage; |
| 1604 | } |
| 1605 | opt.async_private_error = n; |
| 1606 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 1607 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1608 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1609 | else if( strcmp( p, "cid" ) == 0 ) |
| 1610 | { |
| 1611 | opt.cid_enabled = atoi( q ); |
| 1612 | if( opt.cid_enabled != 0 && opt.cid_enabled != 1 ) |
| 1613 | goto usage; |
| 1614 | } |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1615 | else if( strcmp( p, "cid_renego" ) == 0 ) |
| 1616 | { |
| 1617 | opt.cid_enabled_renego = atoi( q ); |
| 1618 | if( opt.cid_enabled_renego != 0 && opt.cid_enabled_renego != 1 ) |
| 1619 | goto usage; |
| 1620 | } |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 1621 | else if( strcmp( p, "cid_val" ) == 0 ) |
| 1622 | { |
| 1623 | opt.cid_val = q; |
| 1624 | } |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 1625 | else if( strcmp( p, "cid_val_renego" ) == 0 ) |
| 1626 | { |
| 1627 | opt.cid_val_renego = q; |
| 1628 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1629 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1630 | else if( strcmp( p, "psk" ) == 0 ) |
| 1631 | opt.psk = q; |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1632 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1633 | else if( strcmp( p, "psk_opaque" ) == 0 ) |
| 1634 | opt.psk_opaque = atoi( q ); |
| 1635 | else if( strcmp( p, "psk_list_opaque" ) == 0 ) |
| 1636 | opt.psk_list_opaque = atoi( q ); |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1637 | #endif |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 1638 | #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) |
| 1639 | else if( strcmp( p, "ca_callback" ) == 0) |
| 1640 | opt.ca_callback = atoi( q ); |
| 1641 | #endif |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 1642 | else if( strcmp( p, "psk_identity" ) == 0 ) |
| 1643 | opt.psk_identity = q; |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 1644 | else if( strcmp( p, "psk_list" ) == 0 ) |
| 1645 | opt.psk_list = q; |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 1646 | else if( strcmp( p, "ecjpake_pw" ) == 0 ) |
| 1647 | opt.ecjpake_pw = q; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1648 | else if( strcmp( p, "force_ciphersuite" ) == 0 ) |
| 1649 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1650 | opt.force_ciphersuite[0] = mbedtls_ssl_get_ciphersuite_id( q ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1651 | |
Manuel Pégourié-Gonnard | 8de259b | 2014-06-11 14:19:06 +0200 | [diff] [blame] | 1652 | if( opt.force_ciphersuite[0] == 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1653 | { |
| 1654 | ret = 2; |
| 1655 | goto usage; |
| 1656 | } |
| 1657 | opt.force_ciphersuite[1] = 0; |
| 1658 | } |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 1659 | else if( strcmp( p, "curves" ) == 0 ) |
| 1660 | opt.curves = q; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1661 | else if( strcmp( p, "renegotiation" ) == 0 ) |
| 1662 | { |
Hanno Becker | 4cb1f4d | 2017-10-10 15:59:57 +0100 | [diff] [blame] | 1663 | opt.renegotiation = (atoi( q )) ? |
| 1664 | MBEDTLS_SSL_RENEGOTIATION_ENABLED : |
| 1665 | MBEDTLS_SSL_RENEGOTIATION_DISABLED; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1666 | } |
| 1667 | else if( strcmp( p, "allow_legacy" ) == 0 ) |
| 1668 | { |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1669 | switch( atoi( q ) ) |
| 1670 | { |
Hanno Becker | 4cb1f4d | 2017-10-10 15:59:57 +0100 | [diff] [blame] | 1671 | case -1: |
| 1672 | opt.allow_legacy = MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE; |
| 1673 | break; |
| 1674 | case 0: |
| 1675 | opt.allow_legacy = MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION; |
| 1676 | break; |
| 1677 | case 1: |
| 1678 | opt.allow_legacy = MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION; |
| 1679 | break; |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 1680 | default: goto usage; |
| 1681 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1682 | } |
Manuel Pégourié-Gonnard | 780d671 | 2014-02-20 17:19:59 +0100 | [diff] [blame] | 1683 | else if( strcmp( p, "renegotiate" ) == 0 ) |
| 1684 | { |
| 1685 | opt.renegotiate = atoi( q ); |
| 1686 | if( opt.renegotiate < 0 || opt.renegotiate > 1 ) |
| 1687 | goto usage; |
| 1688 | } |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 1689 | else if( strcmp( p, "renego_delay" ) == 0 ) |
| 1690 | { |
| 1691 | opt.renego_delay = atoi( q ); |
| 1692 | } |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1693 | else if( strcmp( p, "renego_period" ) == 0 ) |
| 1694 | { |
Andres AG | 0b736db | 2017-02-08 14:05:57 +0000 | [diff] [blame] | 1695 | #if defined(_MSC_VER) |
| 1696 | opt.renego_period = _strtoui64( q, NULL, 10 ); |
| 1697 | #else |
| 1698 | if( sscanf( q, "%" SCNu64, &opt.renego_period ) != 1 ) |
| 1699 | goto usage; |
| 1700 | #endif /* _MSC_VER */ |
| 1701 | if( opt.renego_period < 2 ) |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 1702 | goto usage; |
| 1703 | } |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 1704 | else if( strcmp( p, "exchanges" ) == 0 ) |
| 1705 | { |
| 1706 | opt.exchanges = atoi( q ); |
Manuel Pégourié-Gonnard | 6a2bc23 | 2014-10-09 15:33:13 +0200 | [diff] [blame] | 1707 | if( opt.exchanges < 0 ) |
Manuel Pégourié-Gonnard | 67686c4 | 2014-08-15 11:17:27 +0200 | [diff] [blame] | 1708 | goto usage; |
| 1709 | } |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1710 | else if( strcmp( p, "min_version" ) == 0 ) |
| 1711 | { |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame] | 1712 | if( strcmp( q, "tls1_2" ) == 0 || |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 1713 | strcmp( q, "dtls1_2" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1714 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1715 | else |
| 1716 | goto usage; |
| 1717 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1718 | else if( strcmp( p, "max_version" ) == 0 ) |
| 1719 | { |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame] | 1720 | if( strcmp( q, "tls1_2" ) == 0 || |
Manuel Pégourié-Gonnard | 83218f1 | 2014-02-12 11:11:12 +0100 | [diff] [blame] | 1721 | strcmp( q, "dtls1_2" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1722 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1723 | else |
| 1724 | goto usage; |
| 1725 | } |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 1726 | else if( strcmp( p, "allow_sha1" ) == 0 ) |
| 1727 | { |
| 1728 | switch( atoi( q ) ) |
| 1729 | { |
| 1730 | case 0: opt.allow_sha1 = 0; break; |
| 1731 | case 1: opt.allow_sha1 = 1; break; |
| 1732 | default: goto usage; |
| 1733 | } |
| 1734 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1735 | else if( strcmp( p, "force_version" ) == 0 ) |
| 1736 | { |
TRodziewicz | 0f82ec6 | 2021-05-12 17:49:18 +0200 | [diff] [blame] | 1737 | if( strcmp( q, "tls1_2" ) == 0 ) |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1738 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1739 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1740 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1741 | } |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1742 | else if( strcmp( q, "dtls1_2" ) == 0 ) |
| 1743 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1744 | opt.min_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1745 | opt.max_version = MBEDTLS_SSL_MINOR_VERSION_3; |
| 1746 | opt.transport = MBEDTLS_SSL_TRANSPORT_DATAGRAM; |
Manuel Pégourié-Gonnard | fe3f73b | 2014-03-26 12:16:44 +0100 | [diff] [blame] | 1747 | } |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1748 | else |
| 1749 | goto usage; |
| 1750 | } |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1751 | else if( strcmp( p, "auth_mode" ) == 0 ) |
| 1752 | { |
Manuel Pégourié-Gonnard | 4d6f178 | 2015-06-19 14:40:39 +0200 | [diff] [blame] | 1753 | if( ( opt.auth_mode = get_auth_mode( q ) ) < 0 ) |
Paul Bakker | 91ebfb5 | 2012-11-23 14:04:08 +0100 | [diff] [blame] | 1754 | goto usage; |
| 1755 | } |
Janos Follath | 4817e27 | 2017-04-10 13:44:33 +0100 | [diff] [blame] | 1756 | else if( strcmp( p, "cert_req_ca_list" ) == 0 ) |
| 1757 | { |
| 1758 | opt.cert_req_ca_list = atoi( q ); |
| 1759 | if( opt.cert_req_ca_list < 0 || opt.cert_req_ca_list > 1 ) |
| 1760 | goto usage; |
| 1761 | } |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1762 | else if( strcmp( p, "max_frag_len" ) == 0 ) |
| 1763 | { |
| 1764 | if( strcmp( q, "512" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1765 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_512; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1766 | else if( strcmp( q, "1024" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1767 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_1024; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1768 | else if( strcmp( q, "2048" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1769 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_2048; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1770 | else if( strcmp( q, "4096" ) == 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1771 | opt.mfl_code = MBEDTLS_SSL_MAX_FRAG_LEN_4096; |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 1772 | else |
| 1773 | goto usage; |
| 1774 | } |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 1775 | else if( strcmp( p, "alpn" ) == 0 ) |
| 1776 | { |
| 1777 | opt.alpn_string = q; |
| 1778 | } |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1779 | else if( strcmp( p, "trunc_hmac" ) == 0 ) |
| 1780 | { |
| 1781 | switch( atoi( q ) ) |
| 1782 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1783 | case 0: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_DISABLED; break; |
| 1784 | case 1: opt.trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; break; |
Manuel Pégourié-Gonnard | e117a8f | 2015-01-09 12:39:35 +0100 | [diff] [blame] | 1785 | default: goto usage; |
| 1786 | } |
| 1787 | } |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1788 | else if( strcmp( p, "extended_ms" ) == 0 ) |
| 1789 | { |
| 1790 | switch( atoi( q ) ) |
| 1791 | { |
Hanno Becker | 4cb1f4d | 2017-10-10 15:59:57 +0100 | [diff] [blame] | 1792 | case 0: |
| 1793 | opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_DISABLED; |
| 1794 | break; |
| 1795 | case 1: |
| 1796 | opt.extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; |
| 1797 | break; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1798 | default: goto usage; |
| 1799 | } |
| 1800 | } |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1801 | else if( strcmp( p, "etm" ) == 0 ) |
| 1802 | { |
| 1803 | switch( atoi( q ) ) |
| 1804 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1805 | case 0: opt.etm = MBEDTLS_SSL_ETM_DISABLED; break; |
| 1806 | case 1: opt.etm = MBEDTLS_SSL_ETM_ENABLED; break; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1807 | default: goto usage; |
| 1808 | } |
| 1809 | } |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 1810 | else if( strcmp( p, "tickets" ) == 0 ) |
| 1811 | { |
| 1812 | opt.tickets = atoi( q ); |
| 1813 | if( opt.tickets < 0 || opt.tickets > 1 ) |
| 1814 | goto usage; |
| 1815 | } |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 1816 | else if( strcmp( p, "ticket_timeout" ) == 0 ) |
| 1817 | { |
| 1818 | opt.ticket_timeout = atoi( q ); |
| 1819 | if( opt.ticket_timeout < 0 ) |
| 1820 | goto usage; |
| 1821 | } |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 1822 | else if( strcmp( p, "cache_max" ) == 0 ) |
| 1823 | { |
| 1824 | opt.cache_max = atoi( q ); |
| 1825 | if( opt.cache_max < 0 ) |
| 1826 | goto usage; |
| 1827 | } |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 1828 | else if( strcmp( p, "cache_timeout" ) == 0 ) |
| 1829 | { |
| 1830 | opt.cache_timeout = atoi( q ); |
| 1831 | if( opt.cache_timeout < 0 ) |
| 1832 | goto usage; |
| 1833 | } |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 1834 | else if( strcmp( p, "cookies" ) == 0 ) |
| 1835 | { |
| 1836 | opt.cookies = atoi( q ); |
| 1837 | if( opt.cookies < -1 || opt.cookies > 1) |
| 1838 | goto usage; |
| 1839 | } |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 1840 | else if( strcmp( p, "anti_replay" ) == 0 ) |
| 1841 | { |
| 1842 | opt.anti_replay = atoi( q ); |
| 1843 | if( opt.anti_replay < 0 || opt.anti_replay > 1) |
| 1844 | goto usage; |
| 1845 | } |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 1846 | else if( strcmp( p, "badmac_limit" ) == 0 ) |
| 1847 | { |
| 1848 | opt.badmac_limit = atoi( q ); |
| 1849 | if( opt.badmac_limit < 0 ) |
| 1850 | goto usage; |
| 1851 | } |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 1852 | else if( strcmp( p, "hs_timeout" ) == 0 ) |
| 1853 | { |
| 1854 | if( ( p = strchr( q, '-' ) ) == NULL ) |
| 1855 | goto usage; |
| 1856 | *p++ = '\0'; |
| 1857 | opt.hs_to_min = atoi( q ); |
| 1858 | opt.hs_to_max = atoi( p ); |
| 1859 | if( opt.hs_to_min == 0 || opt.hs_to_max < opt.hs_to_min ) |
| 1860 | goto usage; |
| 1861 | } |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 1862 | else if( strcmp( p, "mtu" ) == 0 ) |
| 1863 | { |
| 1864 | opt.dtls_mtu = atoi( q ); |
| 1865 | if( opt.dtls_mtu < 0 ) |
| 1866 | goto usage; |
| 1867 | } |
Hanno Becker | e7675d0 | 2018-08-14 13:28:56 +0100 | [diff] [blame] | 1868 | else if( strcmp( p, "dgram_packing" ) == 0 ) |
| 1869 | { |
| 1870 | opt.dgram_packing = atoi( q ); |
| 1871 | if( opt.dgram_packing != 0 && |
| 1872 | opt.dgram_packing != 1 ) |
| 1873 | { |
| 1874 | goto usage; |
| 1875 | } |
| 1876 | } |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 1877 | else if( strcmp( p, "sni" ) == 0 ) |
| 1878 | { |
| 1879 | opt.sni = q; |
| 1880 | } |
Andres Amaya Garcia | bc81884 | 2018-10-16 21:08:38 +0100 | [diff] [blame] | 1881 | else if( strcmp( p, "query_config" ) == 0 ) |
| 1882 | { |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 1883 | opt.query_config_mode = 1; |
| 1884 | query_config_ret = query_config( q ); |
gabor-mezei-arm | 7859585 | 2020-04-28 10:40:30 +0200 | [diff] [blame] | 1885 | goto exit; |
Andres Amaya Garcia | bc81884 | 2018-10-16 21:08:38 +0100 | [diff] [blame] | 1886 | } |
Jarno Lamsa | 9831c8a | 2019-05-29 13:33:32 +0300 | [diff] [blame] | 1887 | else if( strcmp( p, "serialize") == 0 ) |
| 1888 | { |
| 1889 | opt.serialize = atoi( q ); |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 1890 | if( opt.serialize < 0 || opt.serialize > 2) |
Jarno Lamsa | 9831c8a | 2019-05-29 13:33:32 +0300 | [diff] [blame] | 1891 | goto usage; |
| 1892 | } |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 1893 | else if( strcmp( p, "context_file") == 0 ) |
| 1894 | { |
| 1895 | opt.context_file = q; |
| 1896 | } |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 1897 | else if( strcmp( p, "eap_tls" ) == 0 ) |
| 1898 | { |
| 1899 | opt.eap_tls = atoi( q ); |
| 1900 | if( opt.eap_tls < 0 || opt.eap_tls > 1 ) |
| 1901 | goto usage; |
| 1902 | } |
Philippe Antoine | aa4d152 | 2019-06-06 21:24:31 +0200 | [diff] [blame] | 1903 | else if( strcmp( p, "reproducible" ) == 0 ) |
| 1904 | { |
| 1905 | opt.reproducible = 1; |
| 1906 | } |
Hanno Becker | 48f3a3d | 2019-08-29 06:31:22 +0100 | [diff] [blame] | 1907 | else if( strcmp( p, "nss_keylog" ) == 0 ) |
| 1908 | { |
| 1909 | opt.nss_keylog = atoi( q ); |
| 1910 | if( opt.nss_keylog < 0 || opt.nss_keylog > 1 ) |
| 1911 | goto usage; |
| 1912 | } |
| 1913 | else if( strcmp( p, "nss_keylog_file" ) == 0 ) |
| 1914 | { |
| 1915 | opt.nss_keylog_file = q; |
| 1916 | } |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 1917 | else if( strcmp( p, "use_srtp" ) == 0 ) |
| 1918 | { |
| 1919 | opt.use_srtp = atoi ( q ); |
| 1920 | } |
| 1921 | else if( strcmp( p, "srtp_force_profile" ) == 0 ) |
| 1922 | { |
| 1923 | opt.force_srtp_profile = atoi( q ); |
| 1924 | } |
Ron Eldor | 12c6ead | 2018-07-03 15:08:32 +0300 | [diff] [blame] | 1925 | else if( strcmp( p, "support_mki" ) == 0 ) |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 1926 | { |
Ron Eldor | 12c6ead | 2018-07-03 15:08:32 +0300 | [diff] [blame] | 1927 | opt.support_mki = atoi( q ); |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 1928 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 1929 | else |
| 1930 | goto usage; |
| 1931 | } |
| 1932 | |
Hanno Becker | bc5308c | 2019-09-09 11:38:51 +0100 | [diff] [blame] | 1933 | if( opt.nss_keylog != 0 && opt.eap_tls != 0 ) |
| 1934 | { |
| 1935 | mbedtls_printf( "Error: eap_tls and nss_keylog options cannot be used together.\n" ); |
| 1936 | goto usage; |
| 1937 | } |
| 1938 | |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 1939 | /* Event-driven IO is incompatible with the above custom |
| 1940 | * receive and send functions, as the polling builds on |
| 1941 | * refers to the underlying net_context. */ |
| 1942 | if( opt.event == 1 && opt.nbio != 1 ) |
| 1943 | { |
Hanno Becker | df4180a | 2017-10-27 13:43:58 +0100 | [diff] [blame] | 1944 | mbedtls_printf( "Warning: event-driven IO mandates nbio=1 - overwrite\n" ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 1945 | opt.nbio = 1; |
| 1946 | } |
| 1947 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1948 | #if defined(MBEDTLS_DEBUG_C) |
| 1949 | mbedtls_debug_set_threshold( opt.debug_level ); |
Paul Bakker | c73079a | 2014-04-25 16:34:30 +0200 | [diff] [blame] | 1950 | #endif |
Andrzej Kurek | da4029d | 2018-06-20 07:07:55 -0400 | [diff] [blame] | 1951 | buf = mbedtls_calloc( 1, opt.buffer_size + 1 ); |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1952 | if( buf == NULL ) |
| 1953 | { |
Andrzej Kurek | 755890f | 2018-06-20 08:17:04 -0400 | [diff] [blame] | 1954 | mbedtls_printf( "Could not allocate %u bytes\n", opt.buffer_size ); |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 1955 | ret = 3; |
| 1956 | goto exit; |
| 1957 | } |
Paul Bakker | c73079a | 2014-04-25 16:34:30 +0200 | [diff] [blame] | 1958 | |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1959 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1960 | if( opt.psk_opaque != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1961 | { |
| 1962 | if( strlen( opt.psk ) == 0 ) |
| 1963 | { |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1964 | mbedtls_printf( "psk_opaque set but no psk to be imported specified.\n" ); |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1965 | ret = 2; |
| 1966 | goto usage; |
| 1967 | } |
| 1968 | |
| 1969 | if( opt.force_ciphersuite[0] <= 0 ) |
| 1970 | { |
| 1971 | mbedtls_printf( "opaque PSKs are only supported in conjunction with forcing TLS 1.2 and a PSK-only ciphersuite through the 'force_ciphersuite' option.\n" ); |
| 1972 | ret = 2; |
| 1973 | goto usage; |
| 1974 | } |
| 1975 | } |
| 1976 | |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 1977 | if( opt.psk_list_opaque != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 1978 | { |
| 1979 | if( opt.psk_list == NULL ) |
| 1980 | { |
| 1981 | mbedtls_printf( "psk_slot set but no psk to be imported specified.\n" ); |
| 1982 | ret = 2; |
| 1983 | goto usage; |
| 1984 | } |
| 1985 | |
| 1986 | if( opt.force_ciphersuite[0] <= 0 ) |
| 1987 | { |
| 1988 | mbedtls_printf( "opaque PSKs are only supported in conjunction with forcing TLS 1.2 and a PSK-only ciphersuite through the 'force_ciphersuite' option.\n" ); |
| 1989 | ret = 2; |
| 1990 | goto usage; |
| 1991 | } |
| 1992 | } |
| 1993 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 1994 | |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 1995 | if( opt.force_ciphersuite[0] > 0 ) |
| 1996 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1997 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
Hanno Becker | 4cb1f4d | 2017-10-10 15:59:57 +0100 | [diff] [blame] | 1998 | ciphersuite_info = |
| 1999 | mbedtls_ssl_ciphersuite_from_id( opt.force_ciphersuite[0] ); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 2000 | |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 2001 | if( opt.max_version != -1 && |
| 2002 | ciphersuite_info->min_minor_ver > opt.max_version ) |
| 2003 | { |
Hanno Becker | 4cb1f4d | 2017-10-10 15:59:57 +0100 | [diff] [blame] | 2004 | mbedtls_printf( "forced ciphersuite not allowed with this protocol version\n" ); |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 2005 | ret = 2; |
| 2006 | goto usage; |
| 2007 | } |
| 2008 | if( opt.min_version != -1 && |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 2009 | ciphersuite_info->max_minor_ver < opt.min_version ) |
| 2010 | { |
Hanno Becker | 4cb1f4d | 2017-10-10 15:59:57 +0100 | [diff] [blame] | 2011 | mbedtls_printf( "forced ciphersuite not allowed with this protocol version\n" ); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 2012 | ret = 2; |
| 2013 | goto usage; |
| 2014 | } |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 2015 | |
| 2016 | /* If we select a version that's not supported by |
| 2017 | * this suite, then there will be no common ciphersuite... */ |
| 2018 | if( opt.max_version == -1 || |
| 2019 | opt.max_version > ciphersuite_info->max_minor_ver ) |
| 2020 | { |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 2021 | opt.max_version = ciphersuite_info->max_minor_ver; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 2022 | } |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 2023 | if( opt.min_version < ciphersuite_info->min_minor_ver ) |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 2024 | { |
Paul Bakker | 5b55b79 | 2013-07-19 13:43:43 +0200 | [diff] [blame] | 2025 | opt.min_version = ciphersuite_info->min_minor_ver; |
Manuel Pégourié-Gonnard | 798f15a | 2014-03-26 18:12:04 +0100 | [diff] [blame] | 2026 | } |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 2027 | |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2028 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2029 | if( opt.psk_opaque != 0 || opt.psk_list_opaque != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2030 | { |
| 2031 | /* Ensure that the chosen ciphersuite is PSK-only; we must know |
| 2032 | * the ciphersuite in advance to set the correct policy for the |
| 2033 | * PSK key slot. This limitation might go away in the future. */ |
| 2034 | if( ciphersuite_info->key_exchange != MBEDTLS_KEY_EXCHANGE_PSK || |
| 2035 | opt.min_version != MBEDTLS_SSL_MINOR_VERSION_3 ) |
| 2036 | { |
| 2037 | mbedtls_printf( "opaque PSKs are only supported in conjunction with forcing TLS 1.2 and a PSK-only ciphersuite through the 'force_ciphersuite' option.\n" ); |
| 2038 | ret = 2; |
| 2039 | goto usage; |
| 2040 | } |
| 2041 | |
| 2042 | /* Determine KDF algorithm the opaque PSK will be used in. */ |
Mateusz Starzyk | 3352a53 | 2021-04-06 14:28:22 +0200 | [diff] [blame] | 2043 | #if defined(MBEDTLS_SHA384_C) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2044 | if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 ) |
| 2045 | alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_384); |
| 2046 | else |
Mateusz Starzyk | 3352a53 | 2021-04-06 14:28:22 +0200 | [diff] [blame] | 2047 | #endif /* MBEDTLS_SHA384_C */ |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2048 | alg = PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA_256); |
| 2049 | } |
| 2050 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 2051 | } |
| 2052 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2053 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Ronald Cron | 7d86616 | 2020-06-18 10:36:26 +0200 | [diff] [blame] | 2054 | if( mbedtls_test_unhexify( cid, sizeof( cid ), |
| 2055 | opt.cid_val, &cid_len ) != 0 ) |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2056 | { |
| 2057 | mbedtls_printf( "CID not valid hex\n" ); |
| 2058 | goto exit; |
| 2059 | } |
| 2060 | |
| 2061 | /* Keep CID settings for renegotiation unless |
| 2062 | * specified otherwise. */ |
| 2063 | if( opt.cid_enabled_renego == DFL_CID_ENABLED_RENEGO ) |
| 2064 | opt.cid_enabled_renego = opt.cid_enabled; |
| 2065 | if( opt.cid_val_renego == DFL_CID_VALUE_RENEGO ) |
| 2066 | opt.cid_val_renego = opt.cid_val; |
| 2067 | |
Ronald Cron | 7d86616 | 2020-06-18 10:36:26 +0200 | [diff] [blame] | 2068 | if( mbedtls_test_unhexify( cid_renego, sizeof( cid_renego ), |
| 2069 | opt.cid_val_renego, &cid_renego_len ) != 0 ) |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2070 | { |
| 2071 | mbedtls_printf( "CID not valid hex\n" ); |
| 2072 | goto exit; |
| 2073 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2074 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 2075 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2076 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2077 | /* |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 2078 | * Unhexify the pre-shared key and parse the list if any given |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2079 | */ |
Ronald Cron | 7d86616 | 2020-06-18 10:36:26 +0200 | [diff] [blame] | 2080 | if( mbedtls_test_unhexify( psk, sizeof( psk ), |
| 2081 | opt.psk, &psk_len ) != 0 ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2082 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2083 | mbedtls_printf( "pre-shared key not valid hex\n" ); |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 2084 | goto exit; |
| 2085 | } |
| 2086 | |
| 2087 | if( opt.psk_list != NULL ) |
| 2088 | { |
| 2089 | if( ( psk_info = psk_parse( opt.psk_list ) ) == NULL ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2090 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2091 | mbedtls_printf( "psk_list invalid" ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2092 | goto exit; |
| 2093 | } |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2094 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2095 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2096 | |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 2097 | #if defined(MBEDTLS_ECP_C) |
| 2098 | if( opt.curves != NULL ) |
| 2099 | { |
| 2100 | p = (char *) opt.curves; |
| 2101 | i = 0; |
| 2102 | |
| 2103 | if( strcmp( p, "none" ) == 0 ) |
| 2104 | { |
| 2105 | curve_list[0] = MBEDTLS_ECP_DP_NONE; |
| 2106 | } |
| 2107 | else if( strcmp( p, "default" ) != 0 ) |
| 2108 | { |
| 2109 | /* Leave room for a final NULL in curve list */ |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 2110 | while( i < CURVE_LIST_SIZE - 1 && *p != '\0' ) |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 2111 | { |
| 2112 | q = p; |
| 2113 | |
| 2114 | /* Terminate the current string */ |
| 2115 | while( *p != ',' && *p != '\0' ) |
| 2116 | p++; |
| 2117 | if( *p == ',' ) |
| 2118 | *p++ = '\0'; |
| 2119 | |
| 2120 | if( ( curve_cur = mbedtls_ecp_curve_info_from_name( q ) ) != NULL ) |
| 2121 | { |
| 2122 | curve_list[i++] = curve_cur->grp_id; |
| 2123 | } |
| 2124 | else |
| 2125 | { |
| 2126 | mbedtls_printf( "unknown curve %s\n", q ); |
| 2127 | mbedtls_printf( "supported curves: " ); |
| 2128 | for( curve_cur = mbedtls_ecp_curve_list(); |
| 2129 | curve_cur->grp_id != MBEDTLS_ECP_DP_NONE; |
| 2130 | curve_cur++ ) |
| 2131 | { |
| 2132 | mbedtls_printf( "%s ", curve_cur->name ); |
| 2133 | } |
| 2134 | mbedtls_printf( "\n" ); |
| 2135 | goto exit; |
| 2136 | } |
| 2137 | } |
| 2138 | |
| 2139 | mbedtls_printf("Number of curves: %d\n", i ); |
| 2140 | |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 2141 | if( i == CURVE_LIST_SIZE - 1 && *p != '\0' ) |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 2142 | { |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 2143 | mbedtls_printf( "curves list too long, maximum %d", |
| 2144 | CURVE_LIST_SIZE - 1 ); |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 2145 | goto exit; |
| 2146 | } |
| 2147 | |
| 2148 | curve_list[i] = MBEDTLS_ECP_DP_NONE; |
| 2149 | } |
| 2150 | } |
| 2151 | #endif /* MBEDTLS_ECP_C */ |
| 2152 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2153 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2154 | if( opt.alpn_string != NULL ) |
| 2155 | { |
| 2156 | p = (char *) opt.alpn_string; |
| 2157 | i = 0; |
| 2158 | |
| 2159 | /* Leave room for a final NULL in alpn_list */ |
Hanno Becker | 8651a43 | 2017-06-09 16:13:22 +0100 | [diff] [blame] | 2160 | while( i < ALPN_LIST_SIZE - 1 && *p != '\0' ) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2161 | { |
| 2162 | alpn_list[i++] = p; |
| 2163 | |
| 2164 | /* Terminate the current string and move on to next one */ |
| 2165 | while( *p != ',' && *p != '\0' ) |
| 2166 | p++; |
| 2167 | if( *p == ',' ) |
| 2168 | *p++ = '\0'; |
| 2169 | } |
| 2170 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2171 | #endif /* MBEDTLS_SSL_ALPN */ |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2172 | |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 2173 | /* |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2174 | * 0. Initialize the RNG and the session data |
| 2175 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2176 | mbedtls_printf( "\n . Seeding the random number generator..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2177 | fflush( stdout ); |
| 2178 | |
Gilles Peskine | 4a23c98 | 2021-02-03 13:54:41 +0100 | [diff] [blame] | 2179 | ret = rng_seed( &rng, opt.reproducible, pers ); |
| 2180 | if( ret != 0 ) |
Gilles Peskine | daa94c4 | 2021-01-13 18:38:27 +0100 | [diff] [blame] | 2181 | goto exit; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2182 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2183 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2184 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2185 | /* |
| 2186 | * 1.1. Load the trusted CA |
| 2187 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2188 | mbedtls_printf( " . Loading the CA root certificate ..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2189 | fflush( stdout ); |
| 2190 | |
Hanno Becker | 8174bdf | 2019-03-05 16:22:07 +0000 | [diff] [blame] | 2191 | if( strcmp( opt.ca_path, "none" ) == 0 || |
| 2192 | strcmp( opt.ca_file, "none" ) == 0 ) |
| 2193 | { |
| 2194 | ret = 0; |
| 2195 | } |
| 2196 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2197 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2198 | if( strlen( opt.ca_path ) ) |
Hanno Becker | 8174bdf | 2019-03-05 16:22:07 +0000 | [diff] [blame] | 2199 | ret = mbedtls_x509_crt_parse_path( &cacert, opt.ca_path ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2200 | else if( strlen( opt.ca_file ) ) |
Hanno Becker | 8174bdf | 2019-03-05 16:22:07 +0000 | [diff] [blame] | 2201 | ret = mbedtls_x509_crt_parse_file( &cacert, opt.ca_file ); |
Paul Bakker | ddf26b4 | 2013-09-18 13:46:23 +0200 | [diff] [blame] | 2202 | else |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2203 | #endif |
Hanno Becker | 09b8cae | 2019-02-01 08:13:19 +0000 | [diff] [blame] | 2204 | { |
| 2205 | #if defined(MBEDTLS_PEM_PARSE_C) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2206 | for( i = 0; mbedtls_test_cas[i] != NULL; i++ ) |
Manuel Pégourié-Gonnard | 2f16506 | 2015-03-27 10:20:26 +0100 | [diff] [blame] | 2207 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2208 | ret = mbedtls_x509_crt_parse( &cacert, |
| 2209 | (const unsigned char *) mbedtls_test_cas[i], |
| 2210 | mbedtls_test_cas_len[i] ); |
Manuel Pégourié-Gonnard | 2f16506 | 2015-03-27 10:20:26 +0100 | [diff] [blame] | 2211 | if( ret != 0 ) |
| 2212 | break; |
| 2213 | } |
Hanno Becker | 09b8cae | 2019-02-01 08:13:19 +0000 | [diff] [blame] | 2214 | if( ret == 0 ) |
| 2215 | #endif /* MBEDTLS_PEM_PARSE_C */ |
| 2216 | for( i = 0; mbedtls_test_cas_der[i] != NULL; i++ ) |
| 2217 | { |
| 2218 | ret = mbedtls_x509_crt_parse_der( &cacert, |
| 2219 | (const unsigned char *) mbedtls_test_cas_der[i], |
| 2220 | mbedtls_test_cas_der_len[i] ); |
| 2221 | if( ret != 0 ) |
| 2222 | break; |
| 2223 | } |
| 2224 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2225 | if( ret < 0 ) |
| 2226 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2227 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", (unsigned int) -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2228 | goto exit; |
| 2229 | } |
| 2230 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2231 | mbedtls_printf( " ok (%d skipped)\n", ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2232 | |
| 2233 | /* |
| 2234 | * 1.2. Load own certificate and private key |
| 2235 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2236 | mbedtls_printf( " . Loading the server cert. and key..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2237 | fflush( stdout ); |
| 2238 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2239 | #if defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2240 | if( strlen( opt.crt_file ) && strcmp( opt.crt_file, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2241 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2242 | key_cert_init++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2243 | if( ( ret = mbedtls_x509_crt_parse_file( &srvcert, opt.crt_file ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2244 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2245 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2246 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2247 | goto exit; |
| 2248 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2249 | } |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2250 | if( strlen( opt.key_file ) && strcmp( opt.key_file, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2251 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2252 | key_cert_init++; |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 2253 | if( ( ret = mbedtls_pk_parse_keyfile( &pkey, opt.key_file, |
Manuel Pégourié-Gonnard | 84dea01 | 2021-06-15 11:29:26 +0200 | [diff] [blame] | 2254 | opt.key_pwd, rng_get, &rng ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2255 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2256 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile returned -0x%x\n\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2257 | goto exit; |
| 2258 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2259 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2260 | if( key_cert_init == 1 ) |
| 2261 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2262 | mbedtls_printf( " failed\n ! crt_file without key_file or vice-versa\n\n" ); |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2263 | goto exit; |
| 2264 | } |
| 2265 | |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2266 | if( strlen( opt.crt_file2 ) && strcmp( opt.crt_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2267 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2268 | key_cert_init2++; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2269 | if( ( ret = mbedtls_x509_crt_parse_file( &srvcert2, opt.crt_file2 ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2270 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2271 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse_file(2) returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2272 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2273 | goto exit; |
| 2274 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2275 | } |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2276 | if( strlen( opt.key_file2 ) && strcmp( opt.key_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2277 | { |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2278 | key_cert_init2++; |
Hanno Becker | e58a630 | 2018-11-07 16:20:16 +0000 | [diff] [blame] | 2279 | if( ( ret = mbedtls_pk_parse_keyfile( &pkey2, opt.key_file2, |
Manuel Pégourié-Gonnard | 84dea01 | 2021-06-15 11:29:26 +0200 | [diff] [blame] | 2280 | opt.key_pwd2, rng_get, &rng ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2281 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2282 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_keyfile(2) returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2283 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2284 | goto exit; |
| 2285 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2286 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2287 | if( key_cert_init2 == 1 ) |
| 2288 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2289 | mbedtls_printf( " failed\n ! crt_file2 without key_file2 or vice-versa\n\n" ); |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2290 | goto exit; |
| 2291 | } |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2292 | #endif |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2293 | if( key_cert_init == 0 && |
| 2294 | strcmp( opt.crt_file, "none" ) != 0 && |
| 2295 | strcmp( opt.key_file, "none" ) != 0 && |
| 2296 | key_cert_init2 == 0 && |
| 2297 | strcmp( opt.crt_file2, "none" ) != 0 && |
| 2298 | strcmp( opt.key_file2, "none" ) != 0 ) |
Manuel Pégourié-Gonnard | b095a7b | 2013-09-24 21:14:51 +0200 | [diff] [blame] | 2299 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2300 | #if defined(MBEDTLS_RSA_C) |
| 2301 | if( ( ret = mbedtls_x509_crt_parse( &srvcert, |
| 2302 | (const unsigned char *) mbedtls_test_srv_crt_rsa, |
| 2303 | mbedtls_test_srv_crt_rsa_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2304 | { |
Hanno Becker | df4180a | 2017-10-27 13:43:58 +0100 | [diff] [blame] | 2305 | mbedtls_printf( " failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2306 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2307 | goto exit; |
| 2308 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2309 | if( ( ret = mbedtls_pk_parse_key( &pkey, |
| 2310 | (const unsigned char *) mbedtls_test_srv_key_rsa, |
Manuel Pégourié-Gonnard | 84dea01 | 2021-06-15 11:29:26 +0200 | [diff] [blame] | 2311 | mbedtls_test_srv_key_rsa_len, NULL, 0, |
| 2312 | rng_get, &rng ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2313 | { |
Hanno Becker | df4180a | 2017-10-27 13:43:58 +0100 | [diff] [blame] | 2314 | mbedtls_printf( " failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2315 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2316 | goto exit; |
| 2317 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2318 | key_cert_init = 2; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2319 | #endif /* MBEDTLS_RSA_C */ |
| 2320 | #if defined(MBEDTLS_ECDSA_C) |
| 2321 | if( ( ret = mbedtls_x509_crt_parse( &srvcert2, |
| 2322 | (const unsigned char *) mbedtls_test_srv_crt_ec, |
| 2323 | mbedtls_test_srv_crt_ec_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2324 | { |
Hanno Becker | df4180a | 2017-10-27 13:43:58 +0100 | [diff] [blame] | 2325 | mbedtls_printf( " failed\n ! x509_crt_parse2 returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2326 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2327 | goto exit; |
| 2328 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2329 | if( ( ret = mbedtls_pk_parse_key( &pkey2, |
| 2330 | (const unsigned char *) mbedtls_test_srv_key_ec, |
Manuel Pégourié-Gonnard | 84dea01 | 2021-06-15 11:29:26 +0200 | [diff] [blame] | 2331 | mbedtls_test_srv_key_ec_len, NULL, 0, |
| 2332 | rng_get, &rng ) ) != 0 ) |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2333 | { |
Hanno Becker | df4180a | 2017-10-27 13:43:58 +0100 | [diff] [blame] | 2334 | mbedtls_printf( " failed\n ! pk_parse_key2 returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2335 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2336 | goto exit; |
| 2337 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2338 | key_cert_init2 = 2; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2339 | #endif /* MBEDTLS_ECDSA_C */ |
Manuel Pégourié-Gonnard | ac8474f | 2013-09-25 11:35:15 +0200 | [diff] [blame] | 2340 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2341 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2342 | mbedtls_printf( " ok\n" ); |
| 2343 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2344 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2345 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2346 | if( opt.dhm_file != NULL ) |
| 2347 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2348 | mbedtls_printf( " . Loading DHM parameters..." ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2349 | fflush( stdout ); |
| 2350 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2351 | if( ( ret = mbedtls_dhm_parse_dhmfile( &dhm, opt.dhm_file ) ) != 0 ) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2352 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2353 | mbedtls_printf( " failed\n ! mbedtls_dhm_parse_dhmfile returned -0x%04X\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2354 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2355 | goto exit; |
| 2356 | } |
| 2357 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2358 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2359 | } |
| 2360 | #endif |
| 2361 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 2362 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2363 | if( opt.sni != NULL ) |
| 2364 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2365 | mbedtls_printf( " . Setting up SNI information..." ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2366 | fflush( stdout ); |
| 2367 | |
Manuel Pégourié-Gonnard | 6f19ce3 | 2021-06-16 12:08:34 +0200 | [diff] [blame] | 2368 | if( ( sni_info = sni_parse( opt.sni ) ) == NULL ) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2369 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2370 | mbedtls_printf( " failed\n" ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2371 | goto exit; |
| 2372 | } |
| 2373 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2374 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2375 | } |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 2376 | #endif /* SNI_OPTION */ |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2377 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2378 | /* |
| 2379 | * 2. Setup the listening TCP socket |
| 2380 | */ |
Manuel Pégourié-Gonnard | c0d7494 | 2015-06-23 12:30:57 +0200 | [diff] [blame] | 2381 | mbedtls_printf( " . Bind on %s://%s:%s/ ...", |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2382 | opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? "tcp" : "udp", |
Manuel Pégourié-Gonnard | 8a06d9c | 2014-03-23 18:23:41 +0100 | [diff] [blame] | 2383 | opt.server_addr ? opt.server_addr : "*", |
| 2384 | opt.server_port ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2385 | fflush( stdout ); |
| 2386 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2387 | if( ( ret = mbedtls_net_bind( &listen_fd, opt.server_addr, opt.server_port, |
| 2388 | opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ? |
| 2389 | MBEDTLS_NET_PROTO_TCP : MBEDTLS_NET_PROTO_UDP ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2390 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2391 | mbedtls_printf( " failed\n ! mbedtls_net_bind returned -0x%x\n\n", (unsigned int) -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2392 | goto exit; |
| 2393 | } |
| 2394 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2395 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2396 | |
| 2397 | /* |
| 2398 | * 3. Setup stuff |
| 2399 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2400 | mbedtls_printf( " . Setting up the SSL/TLS structure..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2401 | fflush( stdout ); |
| 2402 | |
Manuel Pégourié-Gonnard | 419d5ae | 2015-05-04 19:32:36 +0200 | [diff] [blame] | 2403 | if( ( ret = mbedtls_ssl_config_defaults( &conf, |
| 2404 | MBEDTLS_SSL_IS_SERVER, |
Manuel Pégourié-Gonnard | b31c5f6 | 2015-06-17 13:53:47 +0200 | [diff] [blame] | 2405 | opt.transport, |
| 2406 | MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 ) |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 2407 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2408 | mbedtls_printf( " failed\n ! mbedtls_ssl_config_defaults returned -0x%x\n\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 2409 | goto exit; |
| 2410 | } |
| 2411 | |
Gilles Peskine | ef86ab2 | 2017-05-05 18:59:02 +0200 | [diff] [blame] | 2412 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 2413 | /* The default algorithms profile disables SHA-1, but our tests still |
| 2414 | rely on it heavily. Hence we allow it here. A real-world server |
| 2415 | should use the default profile unless there is a good reason not to. */ |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2416 | if( opt.allow_sha1 > 0 ) |
| 2417 | { |
| 2418 | crt_profile_for_test.allowed_mds |= MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA1 ); |
| 2419 | mbedtls_ssl_conf_cert_profile( &conf, &crt_profile_for_test ); |
Gilles Peskine | 682df09 | 2017-05-11 19:01:11 +0200 | [diff] [blame] | 2420 | mbedtls_ssl_conf_sig_hashes( &conf, ssl_sig_hashes_for_test ); |
Gilles Peskine | bc70a18 | 2017-05-09 15:59:24 +0200 | [diff] [blame] | 2421 | } |
Gilles Peskine | ef86ab2 | 2017-05-05 18:59:02 +0200 | [diff] [blame] | 2422 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
| 2423 | |
Manuel Pégourié-Gonnard | fa44f20 | 2015-03-27 17:52:25 +0100 | [diff] [blame] | 2424 | if( opt.auth_mode != DFL_AUTH_MODE ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2425 | mbedtls_ssl_conf_authmode( &conf, opt.auth_mode ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2426 | |
Janos Follath | 4817e27 | 2017-04-10 13:44:33 +0100 | [diff] [blame] | 2427 | if( opt.cert_req_ca_list != DFL_CERT_REQ_CA_LIST ) |
| 2428 | mbedtls_ssl_conf_cert_req_ca_list( &conf, opt.cert_req_ca_list ); |
| 2429 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2430 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 2431 | if( opt.hs_to_min != DFL_HS_TO_MIN || opt.hs_to_max != DFL_HS_TO_MAX ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2432 | mbedtls_ssl_conf_handshake_timeout( &conf, opt.hs_to_min, opt.hs_to_max ); |
Manuel Pégourié-Gonnard | b747c6c | 2018-08-12 13:28:53 +0200 | [diff] [blame] | 2433 | |
Hanno Becker | e7675d0 | 2018-08-14 13:28:56 +0100 | [diff] [blame] | 2434 | if( opt.dgram_packing != DFL_DGRAM_PACKING ) |
Hanno Becker | 1841b0a | 2018-08-24 11:13:57 +0100 | [diff] [blame] | 2435 | mbedtls_ssl_set_datagram_packing( &ssl, opt.dgram_packing ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2436 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | d823bd0 | 2014-10-01 14:40:56 +0200 | [diff] [blame] | 2437 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2438 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2439 | if( ( ret = mbedtls_ssl_conf_max_frag_len( &conf, opt.mfl_code ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2440 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2441 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_max_frag_len returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2442 | goto exit; |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2443 | } |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 2444 | #endif |
Manuel Pégourié-Gonnard | 0c017a5 | 2013-07-18 14:07:36 +0200 | [diff] [blame] | 2445 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2446 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2447 | if( opt.cid_enabled == 1 || opt.cid_enabled_renego == 1 ) |
Hanno Becker | ad4a137 | 2019-05-03 13:06:44 +0100 | [diff] [blame] | 2448 | { |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2449 | if( opt.cid_enabled == 1 && |
| 2450 | opt.cid_enabled_renego == 1 && |
| 2451 | cid_len != cid_renego_len ) |
| 2452 | { |
| 2453 | mbedtls_printf( "CID length must not change during renegotiation\n" ); |
| 2454 | goto usage; |
| 2455 | } |
| 2456 | |
| 2457 | if( opt.cid_enabled == 1 ) |
Hanno Becker | 8367ccc | 2019-05-14 11:30:10 +0100 | [diff] [blame] | 2458 | ret = mbedtls_ssl_conf_cid( &conf, cid_len, |
| 2459 | MBEDTLS_SSL_UNEXPECTED_CID_IGNORE ); |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2460 | else |
Hanno Becker | 8367ccc | 2019-05-14 11:30:10 +0100 | [diff] [blame] | 2461 | ret = mbedtls_ssl_conf_cid( &conf, cid_renego_len, |
| 2462 | MBEDTLS_SSL_UNEXPECTED_CID_IGNORE ); |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 2463 | |
Hanno Becker | ad4a137 | 2019-05-03 13:06:44 +0100 | [diff] [blame] | 2464 | if( ret != 0 ) |
| 2465 | { |
Hanno Becker | d5eed42 | 2019-05-23 16:58:22 +0100 | [diff] [blame] | 2466 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_cid_len returned -%#04x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2467 | (unsigned int) -ret ); |
Hanno Becker | ad4a137 | 2019-05-03 13:06:44 +0100 | [diff] [blame] | 2468 | goto exit; |
| 2469 | } |
| 2470 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2471 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | ad4a137 | 2019-05-03 13:06:44 +0100 | [diff] [blame] | 2472 | |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2473 | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
Bence Szépkúti | 880334c | 2020-12-14 14:42:13 +0100 | [diff] [blame] | 2474 | const mbedtls_ssl_srtp_profile forced_profile[] = { opt.force_srtp_profile, MBEDTLS_TLS_SRTP_UNSET }; |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 2475 | if( opt.use_srtp == 1 ) |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2476 | { |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 2477 | if( opt.force_srtp_profile != 0 ) |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2478 | { |
Johan Pascal | 253d026 | 2020-09-22 13:04:45 +0200 | [diff] [blame] | 2479 | ret = mbedtls_ssl_conf_dtls_srtp_protection_profiles( &conf, forced_profile ); |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2480 | } |
| 2481 | else |
| 2482 | { |
Johan Pascal | 253d026 | 2020-09-22 13:04:45 +0200 | [diff] [blame] | 2483 | ret = mbedtls_ssl_conf_dtls_srtp_protection_profiles( &conf, default_profiles ); |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2484 | } |
| 2485 | |
| 2486 | if( ret != 0 ) |
| 2487 | { |
| 2488 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_dtls_srtp_protection_profiles returned %d\n\n", ret ); |
| 2489 | goto exit; |
| 2490 | } |
| 2491 | |
Ron Eldor | 12c6ead | 2018-07-03 15:08:32 +0300 | [diff] [blame] | 2492 | mbedtls_ssl_conf_srtp_mki_value_supported( &conf, |
| 2493 | opt.support_mki ? |
| 2494 | MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED : |
| 2495 | MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED ); |
| 2496 | |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2497 | } |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 2498 | else if( opt.force_srtp_profile != 0 ) |
Ron Eldor | 6ea6451 | 2018-07-02 10:08:07 +0300 | [diff] [blame] | 2499 | { |
| 2500 | mbedtls_printf( " failed\n ! must enable use_srtp to force srtp profile\n\n" ); |
| 2501 | goto exit; |
| 2502 | } |
| 2503 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 2504 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2505 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 2506 | if( opt.extended_ms != DFL_EXTENDED_MS ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2507 | mbedtls_ssl_conf_extended_master_secret( &conf, opt.extended_ms ); |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 2508 | #endif |
| 2509 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2510 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2511 | if( opt.etm != DFL_ETM ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2512 | mbedtls_ssl_conf_encrypt_then_mac( &conf, opt.etm ); |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2513 | #endif |
| 2514 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2515 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2516 | if( opt.alpn_string != NULL ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2517 | if( ( ret = mbedtls_ssl_conf_alpn_protocols( &conf, alpn_list ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2518 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2519 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_alpn_protocols returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2520 | goto exit; |
| 2521 | } |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 2522 | #endif |
| 2523 | |
Philippe Antoine | 986b6f2 | 2019-06-07 15:04:32 +0200 | [diff] [blame] | 2524 | if (opt.reproducible) |
| 2525 | { |
Philippe Antoine | f91b372 | 2019-06-11 16:02:43 +0200 | [diff] [blame] | 2526 | #if defined(MBEDTLS_HAVE_TIME) |
Philippe Antoine | aa4d152 | 2019-06-06 21:24:31 +0200 | [diff] [blame] | 2527 | #if defined(MBEDTLS_PLATFORM_TIME_ALT) |
| 2528 | mbedtls_platform_set_time( dummy_constant_time ); |
| 2529 | #else |
Philippe Antoine | 7c9d724 | 2019-06-11 12:11:36 +0200 | [diff] [blame] | 2530 | fprintf( stderr, "Warning: reproducible option used without constant time\n" ); |
Philippe Antoine | aa4d152 | 2019-06-06 21:24:31 +0200 | [diff] [blame] | 2531 | #endif |
Gilles Peskine | 34babfc | 2021-02-16 15:44:37 +0100 | [diff] [blame] | 2532 | #endif /* MBEDTLS_HAVE_TIME */ |
Philippe Antoine | 986b6f2 | 2019-06-07 15:04:32 +0200 | [diff] [blame] | 2533 | } |
Gilles Peskine | 535fb37 | 2021-01-13 18:59:46 +0100 | [diff] [blame] | 2534 | mbedtls_ssl_conf_rng( &conf, rng_get, &rng ); |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2535 | mbedtls_ssl_conf_dbg( &conf, my_debug, stdout ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2536 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2537 | #if defined(MBEDTLS_SSL_CACHE_C) |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 2538 | if( opt.cache_max != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2539 | mbedtls_ssl_cache_set_max_entries( &cache, opt.cache_max ); |
Manuel Pégourié-Gonnard | 4c88345 | 2014-02-20 21:32:41 +0100 | [diff] [blame] | 2540 | |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 2541 | if( opt.cache_timeout != -1 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2542 | mbedtls_ssl_cache_set_timeout( &cache, opt.cache_timeout ); |
Manuel Pégourié-Gonnard | c55a5b7 | 2014-02-20 22:50:56 +0100 | [diff] [blame] | 2543 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2544 | mbedtls_ssl_conf_session_cache( &conf, &cache, |
Manuel Pégourié-Gonnard | 5cb3308 | 2015-05-06 18:06:26 +0100 | [diff] [blame] | 2545 | mbedtls_ssl_cache_get, |
| 2546 | mbedtls_ssl_cache_set ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 2547 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2548 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2549 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 2550 | if( opt.tickets == MBEDTLS_SSL_SESSION_TICKETS_ENABLED ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2551 | { |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 2552 | if( ( ret = mbedtls_ssl_ticket_setup( &ticket_ctx, |
Gilles Peskine | 535fb37 | 2021-01-13 18:59:46 +0100 | [diff] [blame] | 2553 | rng_get, &rng, |
Manuel Pégourié-Gonnard | a0adc1b | 2015-05-25 10:35:16 +0200 | [diff] [blame] | 2554 | MBEDTLS_CIPHER_AES_256_GCM, |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 2555 | opt.ticket_timeout ) ) != 0 ) |
| 2556 | { |
| 2557 | mbedtls_printf( " failed\n ! mbedtls_ssl_ticket_setup returned %d\n\n", ret ); |
| 2558 | goto exit; |
| 2559 | } |
Manuel Pégourié-Gonnard | dbe1ee1 | 2014-02-21 09:18:13 +0100 | [diff] [blame] | 2560 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 2561 | mbedtls_ssl_conf_session_tickets_cb( &conf, |
| 2562 | mbedtls_ssl_ticket_write, |
| 2563 | mbedtls_ssl_ticket_parse, |
| 2564 | &ticket_ctx ); |
| 2565 | } |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 2566 | #endif |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 2567 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2568 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 2569 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 2570 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2571 | #if defined(MBEDTLS_SSL_COOKIE_C) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2572 | if( opt.cookies > 0 ) |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 2573 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2574 | if( ( ret = mbedtls_ssl_cookie_setup( &cookie_ctx, |
Gilles Peskine | 535fb37 | 2021-01-13 18:59:46 +0100 | [diff] [blame] | 2575 | rng_get, &rng ) ) != 0 ) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2576 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2577 | mbedtls_printf( " failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2578 | goto exit; |
| 2579 | } |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 2580 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2581 | mbedtls_ssl_conf_dtls_cookies( &conf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2582 | &cookie_ctx ); |
| 2583 | } |
| 2584 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2585 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 2586 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2587 | if( opt.cookies == 0 ) |
| 2588 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2589 | mbedtls_ssl_conf_dtls_cookies( &conf, NULL, NULL, NULL ); |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2590 | } |
| 2591 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2592 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 26820e3 | 2014-07-23 19:34:59 +0200 | [diff] [blame] | 2593 | { |
| 2594 | ; /* Nothing to do */ |
| 2595 | } |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 2596 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2597 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | 2739313 | 2014-09-24 14:41:11 +0200 | [diff] [blame] | 2598 | if( opt.anti_replay != DFL_ANTI_REPLAY ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2599 | mbedtls_ssl_conf_dtls_anti_replay( &conf, opt.anti_replay ); |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 2600 | #endif |
| 2601 | |
Manuel Pégourié-Gonnard | e698f59 | 2014-10-14 19:36:36 +0200 | [diff] [blame] | 2602 | if( opt.badmac_limit != DFL_BADMAC_LIMIT ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2603 | mbedtls_ssl_conf_dtls_badmac_limit( &conf, opt.badmac_limit ); |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 2604 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2605 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 98545f1 | 2014-07-22 22:10:43 +0200 | [diff] [blame] | 2606 | |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2607 | if( opt.force_ciphersuite[0] != DFL_FORCE_CIPHER ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2608 | mbedtls_ssl_conf_ciphersuites( &conf, opt.force_ciphersuite ); |
Manuel Pégourié-Gonnard | d42b7c8 | 2015-03-20 19:44:04 +0000 | [diff] [blame] | 2609 | |
Manuel Pégourié-Gonnard | 85d915b | 2014-11-03 20:10:36 +0100 | [diff] [blame] | 2610 | if( opt.allow_legacy != DFL_ALLOW_LEGACY ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2611 | mbedtls_ssl_conf_legacy_renegotiation( &conf, opt.allow_legacy ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2612 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2613 | mbedtls_ssl_conf_renegotiation( &conf, opt.renegotiation ); |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 2614 | |
Manuel Pégourié-Gonnard | fae355e | 2014-07-04 14:32:27 +0200 | [diff] [blame] | 2615 | if( opt.renego_delay != DFL_RENEGO_DELAY ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2616 | mbedtls_ssl_conf_renegotiation_enforced( &conf, opt.renego_delay ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2617 | |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 2618 | if( opt.renego_period != DFL_RENEGO_PERIOD ) |
| 2619 | { |
Andres AG | 692ad84 | 2017-01-19 16:30:57 +0000 | [diff] [blame] | 2620 | PUT_UINT64_BE( renego_period, opt.renego_period, 0 ); |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2621 | mbedtls_ssl_conf_renegotiation_period( &conf, renego_period ); |
Manuel Pégourié-Gonnard | 590f416 | 2014-11-05 14:23:03 +0100 | [diff] [blame] | 2622 | } |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 2623 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2624 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2625 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2626 | if( strcmp( opt.ca_path, "none" ) != 0 && |
| 2627 | strcmp( opt.ca_file, "none" ) != 0 ) |
| 2628 | { |
Jarno Lamsa | 1b4a2ba | 2019-03-27 17:55:27 +0200 | [diff] [blame] | 2629 | #if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) |
| 2630 | if( opt.ca_callback != 0 ) |
| 2631 | mbedtls_ssl_conf_ca_cb( &conf, ca_callback, &cacert); |
| 2632 | else |
| 2633 | #endif |
| 2634 | mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL ); |
Manuel Pégourié-Gonnard | 3e1b178 | 2014-02-27 13:35:00 +0100 | [diff] [blame] | 2635 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2636 | if( key_cert_init ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2637 | { |
| 2638 | mbedtls_pk_context *pk = &pkey; |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2639 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2640 | if( opt.async_private_delay1 >= 0 ) |
| 2641 | { |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 2642 | ret = ssl_async_set_key( &ssl_async_keys, &srvcert, pk, 0, |
Gilles Peskine | d6fbfde | 2018-04-30 10:23:56 +0200 | [diff] [blame] | 2643 | opt.async_private_delay1 ); |
| 2644 | if( ret < 0 ) |
| 2645 | { |
| 2646 | mbedtls_printf( " Test error: ssl_async_set_key failed (%d)\n", |
| 2647 | ret ); |
| 2648 | goto exit; |
| 2649 | } |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2650 | pk = NULL; |
| 2651 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2652 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2653 | if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert, pk ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2654 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2655 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2656 | goto exit; |
| 2657 | } |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2658 | } |
Manuel Pégourié-Gonnard | a0fdf8b | 2013-09-25 14:05:49 +0200 | [diff] [blame] | 2659 | if( key_cert_init2 ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2660 | { |
| 2661 | mbedtls_pk_context *pk = &pkey2; |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2662 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2663 | if( opt.async_private_delay2 >= 0 ) |
| 2664 | { |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 2665 | ret = ssl_async_set_key( &ssl_async_keys, &srvcert2, pk, 0, |
Gilles Peskine | d6fbfde | 2018-04-30 10:23:56 +0200 | [diff] [blame] | 2666 | opt.async_private_delay2 ); |
| 2667 | if( ret < 0 ) |
| 2668 | { |
| 2669 | mbedtls_printf( " Test error: ssl_async_set_key failed (%d)\n", |
| 2670 | ret ); |
| 2671 | goto exit; |
| 2672 | } |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2673 | pk = NULL; |
| 2674 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2675 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2676 | if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert2, pk ) ) != 0 ) |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2677 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2678 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | c5fd391 | 2014-07-08 14:05:52 +0200 | [diff] [blame] | 2679 | goto exit; |
| 2680 | } |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2681 | } |
| 2682 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2683 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 2684 | if( opt.async_operations[0] != '-' ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2685 | { |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 2686 | mbedtls_ssl_async_sign_t *sign = NULL; |
| 2687 | mbedtls_ssl_async_decrypt_t *decrypt = NULL; |
Gilles Peskine | 12ab5d4 | 2018-04-24 12:32:04 +0200 | [diff] [blame] | 2688 | const char *r; |
| 2689 | for( r = opt.async_operations; *r; r++ ) |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 2690 | { |
Gilles Peskine | 12ab5d4 | 2018-04-24 12:32:04 +0200 | [diff] [blame] | 2691 | switch( *r ) |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 2692 | { |
| 2693 | case 'd': |
| 2694 | decrypt = ssl_async_decrypt; |
| 2695 | break; |
| 2696 | case 's': |
| 2697 | sign = ssl_async_sign; |
| 2698 | break; |
| 2699 | } |
| 2700 | } |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 2701 | ssl_async_keys.inject_error = ( opt.async_private_error < 0 ? |
| 2702 | - opt.async_private_error : |
| 2703 | opt.async_private_error ); |
Gilles Peskine | 535fb37 | 2021-01-13 18:59:46 +0100 | [diff] [blame] | 2704 | ssl_async_keys.f_rng = rng_get; |
| 2705 | ssl_async_keys.p_rng = &rng; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2706 | mbedtls_ssl_conf_async_private_cb( &conf, |
Gilles Peskine | fcca9d8 | 2018-01-12 13:47:48 +0100 | [diff] [blame] | 2707 | sign, |
| 2708 | decrypt, |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2709 | ssl_async_resume, |
| 2710 | ssl_async_cancel, |
| 2711 | &ssl_async_keys ); |
| 2712 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2713 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2714 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 2715 | |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 2716 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2717 | if( opt.sni != NULL ) |
Gilles Peskine | 166ce74 | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 2718 | { |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2719 | mbedtls_ssl_conf_sni( &conf, sni_callback, sni_info ); |
Gilles Peskine | 166ce74 | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 2720 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
| 2721 | if( opt.async_private_delay2 >= 0 ) |
| 2722 | { |
Gilles Peskine | e247989 | 2018-06-13 18:06:51 +0200 | [diff] [blame] | 2723 | sni_entry *cur; |
| 2724 | for( cur = sni_info; cur != NULL; cur = cur->next ) |
Gilles Peskine | 166ce74 | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 2725 | { |
Gilles Peskine | e247989 | 2018-06-13 18:06:51 +0200 | [diff] [blame] | 2726 | ret = ssl_async_set_key( &ssl_async_keys, |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 2727 | cur->cert, cur->key, 1, |
Gilles Peskine | e247989 | 2018-06-13 18:06:51 +0200 | [diff] [blame] | 2728 | opt.async_private_delay2 ); |
| 2729 | if( ret < 0 ) |
| 2730 | { |
| 2731 | mbedtls_printf( " Test error: ssl_async_set_key failed (%d)\n", |
| 2732 | ret ); |
| 2733 | goto exit; |
| 2734 | } |
| 2735 | cur->key = NULL; |
Gilles Peskine | 166ce74 | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 2736 | } |
Gilles Peskine | 166ce74 | 2018-04-30 10:30:49 +0200 | [diff] [blame] | 2737 | } |
| 2738 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
| 2739 | } |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 2740 | #endif |
| 2741 | |
Hanno Becker | e6706e6 | 2017-05-15 16:05:15 +0100 | [diff] [blame] | 2742 | #if defined(MBEDTLS_ECP_C) |
| 2743 | if( opt.curves != NULL && |
| 2744 | strcmp( opt.curves, "default" ) != 0 ) |
| 2745 | { |
| 2746 | mbedtls_ssl_conf_curves( &conf, curve_list ); |
| 2747 | } |
| 2748 | #endif |
| 2749 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2750 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2751 | |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 2752 | if( strlen( opt.psk ) != 0 && strlen( opt.psk_identity ) != 0 ) |
| 2753 | { |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2754 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2755 | if( opt.psk_opaque != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2756 | { |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2757 | /* The algorithm has already been determined earlier. */ |
Janos Follath | be4efc2 | 2019-08-08 11:38:18 +0100 | [diff] [blame] | 2758 | status = psa_setup_psk_key_slot( &psk_slot, alg, psk, psk_len ); |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2759 | if( status != PSA_SUCCESS ) |
| 2760 | { |
| 2761 | fprintf( stderr, "SETUP FAIL\n" ); |
| 2762 | ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; |
| 2763 | goto exit; |
| 2764 | } |
| 2765 | if( ( ret = mbedtls_ssl_conf_psk_opaque( &conf, psk_slot, |
| 2766 | (const unsigned char *) opt.psk_identity, |
| 2767 | strlen( opt.psk_identity ) ) ) != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2768 | { |
| 2769 | mbedtls_printf( " failed\n ! mbedtls_ssl_conf_psk_opaque returned %d\n\n", |
| 2770 | ret ); |
| 2771 | goto exit; |
| 2772 | } |
| 2773 | } |
| 2774 | else |
| 2775 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Piotr Nowicki | 9926eaf | 2019-11-20 14:54:36 +0100 | [diff] [blame] | 2776 | if( psk_len > 0 ) |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 2777 | { |
Piotr Nowicki | 9926eaf | 2019-11-20 14:54:36 +0100 | [diff] [blame] | 2778 | ret = mbedtls_ssl_conf_psk( &conf, psk, psk_len, |
| 2779 | (const unsigned char *) opt.psk_identity, |
| 2780 | strlen( opt.psk_identity ) ); |
| 2781 | if( ret != 0 ) |
| 2782 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2783 | mbedtls_printf( " failed\n mbedtls_ssl_conf_psk returned -0x%04X\n\n", (unsigned int) -ret ); |
Piotr Nowicki | 9926eaf | 2019-11-20 14:54:36 +0100 | [diff] [blame] | 2784 | goto exit; |
| 2785 | } |
Manuel Pégourié-Gonnard | dc019b9 | 2014-06-10 15:24:51 +0200 | [diff] [blame] | 2786 | } |
| 2787 | } |
| 2788 | |
Manuel Pégourié-Gonnard | 80c8553 | 2014-06-10 14:01:52 +0200 | [diff] [blame] | 2789 | if( opt.psk_list != NULL ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2790 | { |
| 2791 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2792 | if( opt.psk_list_opaque != 0 ) |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2793 | { |
| 2794 | psk_entry *cur_psk; |
| 2795 | for( cur_psk = psk_info; cur_psk != NULL; cur_psk = cur_psk->next ) |
| 2796 | { |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2797 | |
Janos Follath | be4efc2 | 2019-08-08 11:38:18 +0100 | [diff] [blame] | 2798 | status = psa_setup_psk_key_slot( &cur_psk->slot, alg, |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2799 | cur_psk->key, |
| 2800 | cur_psk->key_len ); |
| 2801 | if( status != PSA_SUCCESS ) |
| 2802 | { |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2803 | ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; |
| 2804 | goto exit; |
| 2805 | } |
| 2806 | } |
| 2807 | } |
| 2808 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 2809 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2810 | mbedtls_ssl_conf_psk_cb( &conf, psk_callback, psk_info ); |
Hanno Becker | b64ba5f | 2018-10-26 11:28:08 +0100 | [diff] [blame] | 2811 | } |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 2812 | #endif |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2813 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2814 | #if defined(MBEDTLS_DHM_C) |
Paul Bakker | 5d19f86 | 2012-09-28 07:33:00 +0000 | [diff] [blame] | 2815 | /* |
| 2816 | * Use different group than default DHM group |
| 2817 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2818 | #if defined(MBEDTLS_FS_IO) |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2819 | if( opt.dhm_file != NULL ) |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2820 | ret = mbedtls_ssl_conf_dh_param_ctx( &conf, &dhm ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2821 | #endif |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2822 | if( ret != 0 ) |
| 2823 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2824 | mbedtls_printf( " failed\n mbedtls_ssl_conf_dh_param returned -0x%04X\n\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | 736699c | 2014-06-09 11:29:50 +0200 | [diff] [blame] | 2825 | goto exit; |
| 2826 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2827 | #endif |
| 2828 | |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 2829 | if( opt.min_version != DFL_MIN_VERSION ) |
Manuel Pégourié-Gonnard | 01e5e8c | 2015-05-11 10:11:56 +0200 | [diff] [blame] | 2830 | mbedtls_ssl_conf_min_version( &conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.min_version ); |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 2831 | |
Manuel Pégourié-Gonnard | 8c8be1e | 2015-03-31 14:21:11 +0200 | [diff] [blame] | 2832 | if( opt.max_version != DFL_MIN_VERSION ) |
Manuel Pégourié-Gonnard | 01e5e8c | 2015-05-11 10:11:56 +0200 | [diff] [blame] | 2833 | mbedtls_ssl_conf_max_version( &conf, MBEDTLS_SSL_MAJOR_VERSION_3, opt.max_version ); |
Paul Bakker | c1516be | 2013-06-29 16:01:32 +0200 | [diff] [blame] | 2834 | |
Manuel Pégourié-Gonnard | 06939ce | 2015-05-11 11:25:46 +0200 | [diff] [blame] | 2835 | if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 ) |
| 2836 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2837 | mbedtls_printf( " failed\n ! mbedtls_ssl_setup returned -0x%x\n\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | 06939ce | 2015-05-11 11:25:46 +0200 | [diff] [blame] | 2838 | goto exit; |
| 2839 | } |
| 2840 | |
Hanno Becker | 7e6c178 | 2021-06-08 09:24:55 +0100 | [diff] [blame] | 2841 | #if defined(MBEDTLS_SSL_EXPORT_KEYS) |
| 2842 | if( opt.eap_tls != 0 ) |
| 2843 | { |
| 2844 | mbedtls_ssl_set_export_keys_cb( &ssl, eap_tls_key_derivation, |
| 2845 | &eap_tls_keying ); |
| 2846 | } |
| 2847 | else if( opt.nss_keylog != 0 ) |
| 2848 | { |
| 2849 | mbedtls_ssl_set_export_keys_cb( &ssl, |
| 2850 | nss_keylog_export, |
| 2851 | NULL ); |
| 2852 | } |
| 2853 | #if defined( MBEDTLS_SSL_DTLS_SRTP ) |
| 2854 | else if( opt.use_srtp != 0 ) |
| 2855 | { |
| 2856 | mbedtls_ssl_set_export_keys_cb( &ssl, dtls_srtp_key_derivation, |
| 2857 | &dtls_srtp_keying ); |
| 2858 | } |
| 2859 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 2860 | #endif /* MBEDTLS_SSL_EXPORT_KEYS */ |
| 2861 | |
Hanno Becker | dcc94e6 | 2019-07-03 17:05:43 +0100 | [diff] [blame] | 2862 | io_ctx.ssl = &ssl; |
| 2863 | io_ctx.net = &client_fd; |
| 2864 | mbedtls_ssl_set_bio( &ssl, &io_ctx, send_cb, recv_cb, |
| 2865 | opt.nbio == 0 ? recv_timeout_cb : NULL ); |
Manuel Pégourié-Gonnard | 06939ce | 2015-05-11 11:25:46 +0200 | [diff] [blame] | 2866 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2867 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 2868 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
| 2869 | { |
| 2870 | if( ( ret = mbedtls_ssl_set_cid( &ssl, opt.cid_enabled, |
| 2871 | cid, cid_len ) ) != 0 ) |
| 2872 | { |
| 2873 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_cid returned %d\n\n", |
| 2874 | ret ); |
| 2875 | goto exit; |
| 2876 | } |
| 2877 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2878 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 2879 | |
Manuel Pégourié-Gonnard | 6e7aaca | 2018-08-20 10:37:23 +0200 | [diff] [blame] | 2880 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 2881 | if( opt.dtls_mtu != DFL_DTLS_MTU ) |
| 2882 | mbedtls_ssl_set_mtu( &ssl, opt.dtls_mtu ); |
| 2883 | #endif |
| 2884 | |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 2885 | #if defined(MBEDTLS_TIMING_C) |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 2886 | mbedtls_ssl_set_timer_cb( &ssl, &timer, mbedtls_timing_set_delay, |
| 2887 | mbedtls_timing_get_delay ); |
Manuel Pégourié-Gonnard | d2377e7 | 2015-05-13 13:58:56 +0200 | [diff] [blame] | 2888 | #endif |
Manuel Pégourié-Gonnard | e3c41ad | 2015-05-13 10:04:32 +0200 | [diff] [blame] | 2889 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2890 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2891 | |
| 2892 | reset: |
Manuel Pégourié-Gonnard | b6440a4 | 2014-09-20 12:03:00 +0200 | [diff] [blame] | 2893 | #if !defined(_WIN32) |
| 2894 | if( received_sigterm ) |
| 2895 | { |
Manuel Pégourié-Gonnard | 4fa619f | 2018-01-22 10:55:10 +0100 | [diff] [blame] | 2896 | mbedtls_printf( " interrupted by SIGTERM (not in net_accept())\n" ); |
| 2897 | if( ret == MBEDTLS_ERR_NET_INVALID_CONTEXT ) |
| 2898 | ret = 0; |
| 2899 | |
Manuel Pégourié-Gonnard | b6440a4 | 2014-09-20 12:03:00 +0200 | [diff] [blame] | 2900 | goto exit; |
| 2901 | } |
| 2902 | #endif |
| 2903 | |
Manuel Pégourié-Gonnard | 3f09b6d | 2015-09-08 11:58:14 +0200 | [diff] [blame] | 2904 | if( ret == MBEDTLS_ERR_SSL_CLIENT_RECONNECT ) |
| 2905 | { |
| 2906 | mbedtls_printf( " ! Client initiated reconnection from same port\n" ); |
| 2907 | goto handshake; |
| 2908 | } |
| 2909 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2910 | #ifdef MBEDTLS_ERROR_C |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2911 | if( ret != 0 ) |
| 2912 | { |
| 2913 | char error_buf[100]; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2914 | mbedtls_strerror( ret, error_buf, 100 ); |
| 2915 | mbedtls_printf("Last error was: %d - %s\n\n", ret, error_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2916 | } |
| 2917 | #endif |
| 2918 | |
Manuel Pégourié-Gonnard | 3d7d00a | 2015-06-30 15:55:03 +0200 | [diff] [blame] | 2919 | mbedtls_net_free( &client_fd ); |
Manuel Pégourié-Gonnard | 8a06d9c | 2014-03-23 18:23:41 +0100 | [diff] [blame] | 2920 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2921 | mbedtls_ssl_session_reset( &ssl ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2922 | |
| 2923 | /* |
| 2924 | * 3. Wait until a client connects |
| 2925 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2926 | mbedtls_printf( " . Waiting for a remote connection ..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2927 | fflush( stdout ); |
| 2928 | |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 2929 | if( ( ret = mbedtls_net_accept( &listen_fd, &client_fd, |
Manuel Pégourié-Gonnard | 0b104b0 | 2015-05-14 21:52:40 +0200 | [diff] [blame] | 2930 | client_ip, sizeof( client_ip ), &cliip_len ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2931 | { |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 2932 | #if !defined(_WIN32) |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 2933 | if( received_sigterm ) |
| 2934 | { |
Manuel Pégourié-Gonnard | 4fa619f | 2018-01-22 10:55:10 +0100 | [diff] [blame] | 2935 | mbedtls_printf( " interrupted by SIGTERM (in net_accept())\n" ); |
| 2936 | if( ret == MBEDTLS_ERR_NET_ACCEPT_FAILED ) |
| 2937 | ret = 0; |
| 2938 | |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 2939 | goto exit; |
| 2940 | } |
Paul Bakker | c1283d3 | 2014-08-18 11:05:51 +0200 | [diff] [blame] | 2941 | #endif |
Manuel Pégourié-Gonnard | db49330 | 2014-08-14 15:36:12 +0200 | [diff] [blame] | 2942 | |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2943 | mbedtls_printf( " failed\n ! mbedtls_net_accept returned -0x%x\n\n", (unsigned int) -ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2944 | goto exit; |
| 2945 | } |
| 2946 | |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 2947 | if( opt.nbio > 0 ) |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 2948 | ret = mbedtls_net_set_nonblock( &client_fd ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 2949 | else |
Manuel Pégourié-Gonnard | 5db6432 | 2015-06-30 15:40:39 +0200 | [diff] [blame] | 2950 | ret = mbedtls_net_set_block( &client_fd ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 2951 | if( ret != 0 ) |
| 2952 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2953 | mbedtls_printf( " failed\n ! net_set_(non)block() returned -0x%x\n\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | 5575316 | 2014-02-26 13:47:08 +0100 | [diff] [blame] | 2954 | goto exit; |
| 2955 | } |
| 2956 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 2957 | mbedtls_ssl_conf_read_timeout( &conf, opt.read_timeout ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2958 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2959 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
| 2960 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 2961 | { |
Manuel Pégourié-Gonnard | 0b104b0 | 2015-05-14 21:52:40 +0200 | [diff] [blame] | 2962 | if( ( ret = mbedtls_ssl_set_client_transport_id( &ssl, |
| 2963 | client_ip, cliip_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 2964 | { |
Hanno Becker | df4180a | 2017-10-27 13:43:58 +0100 | [diff] [blame] | 2965 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_client_transport_id() returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 2966 | (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 2967 | goto exit; |
| 2968 | } |
| 2969 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2970 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 336b824 | 2014-07-22 17:57:43 +0200 | [diff] [blame] | 2971 | |
Manuel Pégourié-Gonnard | 70905a7 | 2015-09-16 11:08:34 +0200 | [diff] [blame] | 2972 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 2973 | if( opt.ecjpake_pw != DFL_ECJPAKE_PW ) |
| 2974 | { |
| 2975 | if( ( ret = mbedtls_ssl_set_hs_ecjpake_password( &ssl, |
| 2976 | (const unsigned char *) opt.ecjpake_pw, |
| 2977 | strlen( opt.ecjpake_pw ) ) ) != 0 ) |
| 2978 | { |
| 2979 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_hs_ecjpake_password returned %d\n\n", ret ); |
| 2980 | goto exit; |
| 2981 | } |
| 2982 | } |
| 2983 | #endif |
| 2984 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2985 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2986 | |
| 2987 | /* |
| 2988 | * 4. Handshake |
| 2989 | */ |
Manuel Pégourié-Gonnard | 3f09b6d | 2015-09-08 11:58:14 +0200 | [diff] [blame] | 2990 | handshake: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2991 | mbedtls_printf( " . Performing the SSL/TLS handshake..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 2992 | fflush( stdout ); |
| 2993 | |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 2994 | while( ( ret = mbedtls_ssl_handshake( &ssl ) ) != 0 ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2995 | { |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2996 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2997 | if( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS && |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 2998 | ssl_async_keys.inject_error == SSL_ASYNC_INJECT_ERROR_CANCEL ) |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 2999 | { |
| 3000 | mbedtls_printf( " cancelling on injected error\n" ); |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 3001 | break; |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 3002 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3003 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | b44692f | 2018-04-24 12:18:19 +0200 | [diff] [blame] | 3004 | |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 3005 | if( ! mbedtls_status_is_ssl_in_progress( ret ) ) |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3006 | break; |
| 3007 | |
| 3008 | /* For event-driven IO, wait for socket to become available */ |
| 3009 | if( opt.event == 1 /* level triggered IO */ ) |
| 3010 | { |
| 3011 | #if defined(MBEDTLS_TIMING_C) |
Hanno Becker | adfa64f | 2018-03-15 11:35:07 +0000 | [diff] [blame] | 3012 | ret = idle( &client_fd, &timer, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3013 | #else |
Hanno Becker | adfa64f | 2018-03-15 11:35:07 +0000 | [diff] [blame] | 3014 | ret = idle( &client_fd, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3015 | #endif |
Hanno Becker | adfa64f | 2018-03-15 11:35:07 +0000 | [diff] [blame] | 3016 | if( ret != 0 ) |
| 3017 | goto reset; |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3018 | } |
Gilles Peskine | 9eb5e9a | 2018-01-05 21:15:57 +0100 | [diff] [blame] | 3019 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3020 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3021 | if( ret == MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ) |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3022 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3023 | mbedtls_printf( " hello verification requested\n" ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3024 | ret = 0; |
| 3025 | goto reset; |
| 3026 | } |
| 3027 | else if( ret != 0 ) |
| 3028 | { |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3029 | mbedtls_printf( " failed\n ! mbedtls_ssl_handshake returned -0x%x\n\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 3030 | |
| 3031 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 3032 | if( ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ) |
| 3033 | { |
| 3034 | char vrfy_buf[512]; |
Manuel Pégourié-Gonnard | ea35666 | 2015-08-27 12:02:40 +0200 | [diff] [blame] | 3035 | flags = mbedtls_ssl_get_verify_result( &ssl ); |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 3036 | |
Hanno Becker | 7ac83f9 | 2020-10-09 10:48:22 +0100 | [diff] [blame] | 3037 | x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", flags ); |
Manuel Pégourié-Gonnard | 6ea831d | 2015-06-22 16:50:52 +0200 | [diff] [blame] | 3038 | |
| 3039 | mbedtls_printf( "%s\n", vrfy_buf ); |
| 3040 | } |
| 3041 | #endif |
| 3042 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3043 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 60ee4ca | 2018-01-08 11:28:05 +0100 | [diff] [blame] | 3044 | if( opt.async_private_error < 0 ) |
| 3045 | /* Injected error only the first time round, to test reset */ |
| 3046 | ssl_async_keys.inject_error = SSL_ASYNC_INJECT_ERROR_NONE; |
| 3047 | #endif |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3048 | goto reset; |
| 3049 | } |
| 3050 | else /* ret == 0 */ |
| 3051 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3052 | mbedtls_printf( " ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n", |
| 3053 | mbedtls_ssl_get_version( &ssl ), mbedtls_ssl_get_ciphersuite( &ssl ) ); |
Manuel Pégourié-Gonnard | caecdae | 2014-10-13 19:04:37 +0200 | [diff] [blame] | 3054 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3055 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3056 | if( ( ret = mbedtls_ssl_get_record_expansion( &ssl ) ) >= 0 ) |
| 3057 | mbedtls_printf( " [ Record expansion is %d ]\n", ret ); |
Manuel Pégourié-Gonnard | 9b35f18 | 2014-10-14 17:47:31 +0200 | [diff] [blame] | 3058 | else |
Mateusz Starzyk | f5c5351 | 2021-04-15 13:28:52 +0200 | [diff] [blame] | 3059 | mbedtls_printf( " [ Record expansion is unknown ]\n" ); |
Manuel Pégourié-Gonnard | 9b35f18 | 2014-10-14 17:47:31 +0200 | [diff] [blame] | 3060 | |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 3061 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Hanno Becker | 59d3670 | 2021-06-08 05:35:29 +0100 | [diff] [blame] | 3062 | mbedtls_printf( " [ Maximum incoming record payload length is %u ]\n", |
| 3063 | (unsigned int) mbedtls_ssl_get_max_in_record_payload( &ssl ) ); |
| 3064 | mbedtls_printf( " [ Maximum outgoing record payload length is %u ]\n", |
| 3065 | (unsigned int) mbedtls_ssl_get_max_out_record_payload( &ssl ) ); |
Manuel Pégourié-Gonnard | a2cda6b | 2015-08-31 18:30:52 +0200 | [diff] [blame] | 3066 | #endif |
| 3067 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3068 | #if defined(MBEDTLS_SSL_ALPN) |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 3069 | if( opt.alpn_string != NULL ) |
| 3070 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3071 | const char *alp = mbedtls_ssl_get_alpn_protocol( &ssl ); |
| 3072 | mbedtls_printf( " [ Application Layer Protocol is %s ]\n", |
Manuel Pégourié-Gonnard | 1bd2281 | 2014-04-05 14:34:07 +0200 | [diff] [blame] | 3073 | alp ? alp : "(none)" ); |
| 3074 | } |
| 3075 | #endif |
| 3076 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3077 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3078 | /* |
Ron Eldor | 2a47be5 | 2017-06-20 15:23:23 +0300 | [diff] [blame] | 3079 | * 5. Verify the client certificate |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3080 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3081 | mbedtls_printf( " . Verifying peer X.509 certificate..." ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3082 | |
Manuel Pégourié-Gonnard | e6ef16f | 2015-05-11 19:54:43 +0200 | [diff] [blame] | 3083 | if( ( flags = mbedtls_ssl_get_verify_result( &ssl ) ) != 0 ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3084 | { |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 3085 | char vrfy_buf[512]; |
| 3086 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3087 | mbedtls_printf( " failed\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3088 | |
Hanno Becker | 7ac83f9 | 2020-10-09 10:48:22 +0100 | [diff] [blame] | 3089 | x509_crt_verify_info( vrfy_buf, sizeof( vrfy_buf ), " ! ", flags ); |
Manuel Pégourié-Gonnard | 89addc4 | 2015-04-20 10:56:18 +0100 | [diff] [blame] | 3090 | mbedtls_printf( "%s\n", vrfy_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3091 | } |
| 3092 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3093 | mbedtls_printf( " ok\n" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3094 | |
Hanno Becker | 612a2f1 | 2020-10-09 09:19:39 +0100 | [diff] [blame] | 3095 | #if !defined(MBEDTLS_X509_REMOVE_INFO) |
Manuel Pégourié-Gonnard | 1c5b9fc | 2015-06-27 14:38:51 +0200 | [diff] [blame] | 3096 | if( mbedtls_ssl_get_peer_cert( &ssl ) != NULL ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3097 | { |
Manuel Pégourié-Gonnard | 1c5b9fc | 2015-06-27 14:38:51 +0200 | [diff] [blame] | 3098 | char crt_buf[512]; |
| 3099 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3100 | mbedtls_printf( " . Peer certificate information ...\n" ); |
Manuel Pégourié-Gonnard | 1c5b9fc | 2015-06-27 14:38:51 +0200 | [diff] [blame] | 3101 | mbedtls_x509_crt_info( crt_buf, sizeof( crt_buf ), " ", |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3102 | mbedtls_ssl_get_peer_cert( &ssl ) ); |
Manuel Pégourié-Gonnard | 6755717 | 2015-07-02 11:15:48 +0200 | [diff] [blame] | 3103 | mbedtls_printf( "%s\n", crt_buf ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3104 | } |
Hanno Becker | 612a2f1 | 2020-10-09 09:19:39 +0100 | [diff] [blame] | 3105 | #endif /* MBEDTLS_X509_REMOVE_INFO */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3106 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3107 | |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 3108 | #if defined(MBEDTLS_SSL_EXPORT_KEYS) |
Ron Eldor | 51d3ab5 | 2019-05-12 14:54:30 +0300 | [diff] [blame] | 3109 | if( opt.eap_tls != 0 ) |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 3110 | { |
| 3111 | size_t j = 0; |
Ron Eldor | 51d3ab5 | 2019-05-12 14:54:30 +0300 | [diff] [blame] | 3112 | |
| 3113 | if( ( ret = mbedtls_ssl_tls_prf( eap_tls_keying.tls_prf_type, |
| 3114 | eap_tls_keying.master_secret, |
| 3115 | sizeof( eap_tls_keying.master_secret ), |
| 3116 | eap_tls_label, |
| 3117 | eap_tls_keying.randbytes, |
| 3118 | sizeof( eap_tls_keying.randbytes ), |
| 3119 | eap_tls_keymaterial, |
| 3120 | sizeof( eap_tls_keymaterial ) ) ) |
| 3121 | != 0 ) |
| 3122 | { |
| 3123 | mbedtls_printf( " failed\n ! mbedtls_ssl_tls_prf returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3124 | (unsigned int) -ret ); |
Ron Eldor | 65d8c26 | 2019-06-04 13:05:36 +0300 | [diff] [blame] | 3125 | goto reset; |
Ron Eldor | 51d3ab5 | 2019-05-12 14:54:30 +0300 | [diff] [blame] | 3126 | } |
| 3127 | |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 3128 | mbedtls_printf( " EAP-TLS key material is:" ); |
| 3129 | for( j = 0; j < sizeof( eap_tls_keymaterial ); j++ ) |
| 3130 | { |
| 3131 | if( j % 8 == 0 ) |
| 3132 | mbedtls_printf("\n "); |
| 3133 | mbedtls_printf("%02x ", eap_tls_keymaterial[j] ); |
| 3134 | } |
| 3135 | mbedtls_printf("\n"); |
| 3136 | |
Ron Eldor | 51d3ab5 | 2019-05-12 14:54:30 +0300 | [diff] [blame] | 3137 | if( ( ret = mbedtls_ssl_tls_prf( eap_tls_keying.tls_prf_type, NULL, 0, |
Ron Eldor | 51c4507 | 2019-05-15 17:49:54 +0300 | [diff] [blame] | 3138 | eap_tls_label, |
| 3139 | eap_tls_keying.randbytes, |
| 3140 | sizeof( eap_tls_keying.randbytes ), |
| 3141 | eap_tls_iv, |
| 3142 | sizeof( eap_tls_iv ) ) ) != 0 ) |
Ron Eldor | 51d3ab5 | 2019-05-12 14:54:30 +0300 | [diff] [blame] | 3143 | { |
| 3144 | mbedtls_printf( " failed\n ! mbedtls_ssl_tls_prf returned -0x%x\n\n", |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3145 | (unsigned int) -ret ); |
Ron Eldor | 65d8c26 | 2019-06-04 13:05:36 +0300 | [diff] [blame] | 3146 | goto reset; |
Ron Eldor | 51d3ab5 | 2019-05-12 14:54:30 +0300 | [diff] [blame] | 3147 | } |
| 3148 | |
Ron Eldor | b7fd64c | 2019-05-12 11:03:32 +0300 | [diff] [blame] | 3149 | mbedtls_printf( " EAP-TLS IV is:" ); |
| 3150 | for( j = 0; j < sizeof( eap_tls_iv ); j++ ) |
| 3151 | { |
| 3152 | if( j % 8 == 0 ) |
| 3153 | mbedtls_printf("\n "); |
| 3154 | mbedtls_printf("%02x ", eap_tls_iv[j] ); |
| 3155 | } |
| 3156 | mbedtls_printf("\n"); |
| 3157 | } |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3158 | |
| 3159 | #if defined( MBEDTLS_SSL_DTLS_SRTP ) |
| 3160 | else if( opt.use_srtp != 0 ) |
| 3161 | { |
| 3162 | size_t j = 0; |
Johan Pascal | 2258a4f | 2020-10-28 13:53:09 +0100 | [diff] [blame] | 3163 | mbedtls_dtls_srtp_info dtls_srtp_negotiation_result; |
| 3164 | mbedtls_ssl_get_dtls_srtp_negotiation_result( &ssl, &dtls_srtp_negotiation_result ); |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3165 | |
Johan Pascal | 5fbe9e7 | 2020-10-29 10:49:21 +0100 | [diff] [blame] | 3166 | if( dtls_srtp_negotiation_result.chosen_dtls_srtp_profile |
| 3167 | == MBEDTLS_TLS_SRTP_UNSET ) |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3168 | { |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 3169 | mbedtls_printf( " Unable to negotiate " |
| 3170 | "the use of DTLS-SRTP\n" ); |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3171 | } |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 3172 | else |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3173 | { |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 3174 | if( ( ret = mbedtls_ssl_tls_prf( dtls_srtp_keying.tls_prf_type, |
| 3175 | dtls_srtp_keying.master_secret, |
| 3176 | sizeof( dtls_srtp_keying.master_secret ), |
| 3177 | dtls_srtp_label, |
| 3178 | dtls_srtp_keying.randbytes, |
| 3179 | sizeof( dtls_srtp_keying.randbytes ), |
| 3180 | dtls_srtp_key_material, |
| 3181 | sizeof( dtls_srtp_key_material ) ) ) |
| 3182 | != 0 ) |
| 3183 | { |
| 3184 | mbedtls_printf( " failed\n ! mbedtls_ssl_tls_prf returned -0x%x\n\n", |
| 3185 | (unsigned int) -ret ); |
| 3186 | goto exit; |
| 3187 | } |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3188 | |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 3189 | mbedtls_printf( " DTLS-SRTP key material is:" ); |
| 3190 | for( j = 0; j < sizeof( dtls_srtp_key_material ); j++ ) |
| 3191 | { |
| 3192 | if( j % 8 == 0 ) |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 3193 | mbedtls_printf( "\n " ); |
| 3194 | mbedtls_printf( "%02x ", dtls_srtp_key_material[j] ); |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 3195 | } |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 3196 | mbedtls_printf( "\n" ); |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 3197 | |
Johan Pascal | 9bc50b0 | 2020-09-24 12:01:13 +0200 | [diff] [blame] | 3198 | /* produce a less readable output used to perform automatic checks |
| 3199 | * - compare client and server output |
| 3200 | * - interop test with openssl which client produces this kind of output |
| 3201 | */ |
| 3202 | mbedtls_printf( " Keying material: " ); |
| 3203 | for( j = 0; j < sizeof( dtls_srtp_key_material ); j++ ) |
| 3204 | { |
| 3205 | mbedtls_printf( "%02X", dtls_srtp_key_material[j] ); |
| 3206 | } |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 3207 | mbedtls_printf( "\n" ); |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 3208 | |
Johan Pascal | 0dbcd1d | 2020-10-28 11:03:07 +0100 | [diff] [blame] | 3209 | if ( dtls_srtp_negotiation_result.mki_len > 0 ) |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 3210 | { |
| 3211 | mbedtls_printf( " DTLS-SRTP mki value: " ); |
Johan Pascal | 0dbcd1d | 2020-10-28 11:03:07 +0100 | [diff] [blame] | 3212 | for( j = 0; j < dtls_srtp_negotiation_result.mki_len; j++ ) |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 3213 | { |
Johan Pascal | 0dbcd1d | 2020-10-28 11:03:07 +0100 | [diff] [blame] | 3214 | mbedtls_printf( "%02X", dtls_srtp_negotiation_result.mki_value[j] ); |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 3215 | } |
| 3216 | } |
| 3217 | else |
| 3218 | { |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 3219 | mbedtls_printf( " DTLS-SRTP no mki value negotiated" ); |
Johan Pascal | 20c7db3 | 2020-10-26 22:45:58 +0100 | [diff] [blame] | 3220 | } |
| 3221 | mbedtls_printf( "\n" ); |
| 3222 | |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 3223 | } |
Ron Eldor | 65b56ef | 2019-09-26 16:40:48 +0300 | [diff] [blame] | 3224 | } |
| 3225 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 3226 | #endif /* MBEDTLS_SSL_EXPORT_KEYS */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 3227 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3228 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3229 | ret = report_cid_usage( &ssl, "initial handshake" ); |
| 3230 | if( ret != 0 ) |
| 3231 | goto exit; |
| 3232 | |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 3233 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
| 3234 | { |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3235 | if( ( ret = mbedtls_ssl_set_cid( &ssl, opt.cid_enabled_renego, |
| 3236 | cid_renego, cid_renego_len ) ) != 0 ) |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 3237 | { |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3238 | mbedtls_printf( " failed\n ! mbedtls_ssl_set_cid returned %d\n\n", |
| 3239 | ret ); |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 3240 | goto exit; |
| 3241 | } |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 3242 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3243 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | a7d2542 | 2019-04-09 17:28:10 +0100 | [diff] [blame] | 3244 | |
Piotr Nowicki | 0937ed2 | 2019-11-26 16:32:40 +0100 | [diff] [blame] | 3245 | #if defined(MBEDTLS_MEMORY_DEBUG) |
| 3246 | mbedtls_memory_buffer_alloc_cur_get( ¤t_heap_memory, &heap_blocks ); |
| 3247 | mbedtls_memory_buffer_alloc_max_get( &peak_heap_memory, &heap_blocks ); |
| 3248 | mbedtls_printf( "Heap memory usage after handshake: %lu bytes. Peak memory usage was %lu\n", |
| 3249 | (unsigned long) current_heap_memory, (unsigned long) peak_heap_memory ); |
| 3250 | #endif /* MBEDTLS_MEMORY_DEBUG */ |
| 3251 | |
Manuel Pégourié-Gonnard | 6a2bc23 | 2014-10-09 15:33:13 +0200 | [diff] [blame] | 3252 | if( opt.exchanges == 0 ) |
| 3253 | goto close_notify; |
| 3254 | |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 3255 | exchanges_left = opt.exchanges; |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3256 | data_exchange: |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3257 | /* |
| 3258 | * 6. Read the HTTP Request |
| 3259 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3260 | mbedtls_printf( " < Read from client:" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3261 | fflush( stdout ); |
| 3262 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3263 | /* |
| 3264 | * TLS and DTLS need different reading styles (stream vs datagram) |
| 3265 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3266 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3267 | { |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3268 | do |
| 3269 | { |
| 3270 | int terminated = 0; |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 3271 | len = opt.buffer_size - 1; |
| 3272 | memset( buf, 0, opt.buffer_size ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3273 | ret = mbedtls_ssl_read( &ssl, buf, len ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3274 | |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 3275 | if( mbedtls_status_is_ssl_in_progress( ret ) ) |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3276 | { |
| 3277 | if( opt.event == 1 /* level triggered IO */ ) |
| 3278 | { |
| 3279 | #if defined(MBEDTLS_TIMING_C) |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3280 | idle( &client_fd, &timer, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3281 | #else |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3282 | idle( &client_fd, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3283 | #endif |
| 3284 | } |
| 3285 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3286 | continue; |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3287 | } |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3288 | |
| 3289 | if( ret <= 0 ) |
| 3290 | { |
| 3291 | switch( ret ) |
| 3292 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3293 | case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| 3294 | mbedtls_printf( " connection was closed gracefully\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3295 | goto close_notify; |
| 3296 | |
| 3297 | case 0: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3298 | case MBEDTLS_ERR_NET_CONN_RESET: |
| 3299 | mbedtls_printf( " connection was reset by peer\n" ); |
| 3300 | ret = MBEDTLS_ERR_NET_CONN_RESET; |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3301 | goto reset; |
| 3302 | |
| 3303 | default: |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3304 | mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3305 | goto reset; |
| 3306 | } |
| 3307 | } |
| 3308 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3309 | if( mbedtls_ssl_get_bytes_avail( &ssl ) == 0 ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3310 | { |
| 3311 | len = ret; |
| 3312 | buf[len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3313 | mbedtls_printf( " %d bytes read\n\n%s\n", len, (char *) buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3314 | |
| 3315 | /* End of message should be detected according to the syntax of the |
| 3316 | * application protocol (eg HTTP), just use a dummy test here. */ |
| 3317 | if( buf[len - 1] == '\n' ) |
| 3318 | terminated = 1; |
| 3319 | } |
| 3320 | else |
| 3321 | { |
| 3322 | int extra_len, ori_len; |
| 3323 | unsigned char *larger_buf; |
| 3324 | |
| 3325 | ori_len = ret; |
Manuel Pégourié-Gonnard | 9de64f5 | 2015-07-01 15:51:43 +0200 | [diff] [blame] | 3326 | extra_len = (int) mbedtls_ssl_get_bytes_avail( &ssl ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3327 | |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 3328 | larger_buf = mbedtls_calloc( 1, ori_len + extra_len + 1 ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3329 | if( larger_buf == NULL ) |
| 3330 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3331 | mbedtls_printf( " ! memory allocation failed\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3332 | ret = 1; |
| 3333 | goto reset; |
| 3334 | } |
| 3335 | |
| 3336 | memset( larger_buf, 0, ori_len + extra_len ); |
| 3337 | memcpy( larger_buf, buf, ori_len ); |
| 3338 | |
| 3339 | /* This read should never fail and get the whole cached data */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3340 | ret = mbedtls_ssl_read( &ssl, larger_buf + ori_len, extra_len ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3341 | if( ret != extra_len || |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3342 | mbedtls_ssl_get_bytes_avail( &ssl ) != 0 ) |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3343 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3344 | mbedtls_printf( " ! mbedtls_ssl_read failed on cached data\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3345 | ret = 1; |
| 3346 | goto reset; |
| 3347 | } |
| 3348 | |
| 3349 | larger_buf[ori_len + extra_len] = '\0'; |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3350 | mbedtls_printf( " %d bytes read (%d + %d)\n\n%s\n", |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3351 | ori_len + extra_len, ori_len, extra_len, |
| 3352 | (char *) larger_buf ); |
| 3353 | |
| 3354 | /* End of message should be detected according to the syntax of the |
| 3355 | * application protocol (eg HTTP), just use a dummy test here. */ |
| 3356 | if( larger_buf[ori_len + extra_len - 1] == '\n' ) |
| 3357 | terminated = 1; |
| 3358 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3359 | mbedtls_free( larger_buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3360 | } |
| 3361 | |
| 3362 | if( terminated ) |
| 3363 | { |
| 3364 | ret = 0; |
| 3365 | break; |
| 3366 | } |
| 3367 | } |
| 3368 | while( 1 ); |
| 3369 | } |
| 3370 | else /* Not stream, so datagram */ |
| 3371 | { |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 3372 | len = opt.buffer_size - 1; |
| 3373 | memset( buf, 0, opt.buffer_size ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3374 | |
Gilles Peskine | b44692f | 2018-04-24 12:18:19 +0200 | [diff] [blame] | 3375 | do |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3376 | { |
Hanno Becker | ddc3ebb | 2018-03-13 11:39:09 +0000 | [diff] [blame] | 3377 | /* Without the call to `mbedtls_ssl_check_pending`, it might |
| 3378 | * happen that the client sends application data in the same |
| 3379 | * datagram as the Finished message concluding the handshake. |
| 3380 | * In this case, the application data would be ready to be |
| 3381 | * processed while the underlying transport wouldn't signal |
| 3382 | * any further incoming data. |
| 3383 | * |
| 3384 | * See the test 'Event-driven I/O: session-id resume, UDP packing' |
| 3385 | * in tests/ssl-opt.sh. |
| 3386 | */ |
| 3387 | |
| 3388 | /* For event-driven IO, wait for socket to become available */ |
| 3389 | if( mbedtls_ssl_check_pending( &ssl ) == 0 && |
| 3390 | opt.event == 1 /* level triggered IO */ ) |
| 3391 | { |
| 3392 | #if defined(MBEDTLS_TIMING_C) |
| 3393 | idle( &client_fd, &timer, MBEDTLS_ERR_SSL_WANT_READ ); |
| 3394 | #else |
| 3395 | idle( &client_fd, MBEDTLS_ERR_SSL_WANT_READ ); |
| 3396 | #endif |
| 3397 | } |
| 3398 | |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3399 | ret = mbedtls_ssl_read( &ssl, buf, len ); |
| 3400 | |
Hanno Becker | ddc3ebb | 2018-03-13 11:39:09 +0000 | [diff] [blame] | 3401 | /* Note that even if `mbedtls_ssl_check_pending` returns true, |
| 3402 | * it can happen that the subsequent call to `mbedtls_ssl_read` |
| 3403 | * returns `MBEDTLS_ERR_SSL_WANT_READ`, because the pending messages |
| 3404 | * might be discarded (e.g. because they are retransmissions). */ |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3405 | } |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 3406 | while( mbedtls_status_is_ssl_in_progress( ret ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3407 | |
| 3408 | if( ret <= 0 ) |
| 3409 | { |
| 3410 | switch( ret ) |
| 3411 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3412 | case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: |
| 3413 | mbedtls_printf( " connection was closed gracefully\n" ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3414 | ret = 0; |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 3415 | goto close_notify; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3416 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3417 | default: |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3418 | mbedtls_printf( " mbedtls_ssl_read returned -0x%x\n", (unsigned int) -ret ); |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3419 | goto reset; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3420 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3421 | } |
| 3422 | |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3423 | len = ret; |
| 3424 | buf[len] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3425 | mbedtls_printf( " %d bytes read\n\n%s", len, (char *) buf ); |
Manuel Pégourié-Gonnard | cce220d | 2014-10-06 18:11:43 +0200 | [diff] [blame] | 3426 | ret = 0; |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3427 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3428 | |
| 3429 | /* |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3430 | * 7a. Request renegotiation while client is waiting for input from us. |
Manuel Pégourié-Gonnard | a6ace04 | 2014-10-15 12:44:41 +0200 | [diff] [blame] | 3431 | * (only on the first exchange, to be able to test retransmission) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3432 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3433 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Manuel Pégourié-Gonnard | 3a173f4 | 2015-01-22 13:30:33 +0000 | [diff] [blame] | 3434 | if( opt.renegotiate && exchanges_left == opt.exchanges ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3435 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3436 | mbedtls_printf( " . Requestion renegotiation..." ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3437 | fflush( stdout ); |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3438 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3439 | while( ( ret = mbedtls_ssl_renegotiate( &ssl ) ) != 0 ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3440 | { |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 3441 | if( ! mbedtls_status_is_ssl_in_progress( ret ) ) |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3442 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3443 | mbedtls_printf( " failed\n ! mbedtls_ssl_renegotiate returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3444 | goto reset; |
| 3445 | } |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3446 | |
| 3447 | /* For event-driven IO, wait for socket to become available */ |
| 3448 | if( opt.event == 1 /* level triggered IO */ ) |
| 3449 | { |
| 3450 | #if defined(MBEDTLS_TIMING_C) |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3451 | idle( &client_fd, &timer, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3452 | #else |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3453 | idle( &client_fd, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3454 | #endif |
| 3455 | } |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3456 | } |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3457 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3458 | mbedtls_printf( " ok\n" ); |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3459 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3460 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Manuel Pégourié-Gonnard | 296e3b1 | 2014-08-19 12:59:03 +0200 | [diff] [blame] | 3461 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3462 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3463 | ret = report_cid_usage( &ssl, "after renegotiation" ); |
| 3464 | if( ret != 0 ) |
| 3465 | goto exit; |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 3466 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | b42ec0d | 2019-05-03 17:30:59 +0100 | [diff] [blame] | 3467 | |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3468 | /* |
| 3469 | * 7. Write the 200 Response |
| 3470 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3471 | mbedtls_printf( " > Write to client:" ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3472 | fflush( stdout ); |
| 3473 | |
| 3474 | len = sprintf( (char *) buf, HTTP_RESPONSE, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3475 | mbedtls_ssl_get_ciphersuite( &ssl ) ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3476 | |
Andrzej Kurek | 30e731d | 2017-10-12 13:50:29 +0200 | [diff] [blame] | 3477 | /* Add padding to the response to reach opt.response_size in length */ |
| 3478 | if( opt.response_size != DFL_RESPONSE_SIZE && |
| 3479 | len < opt.response_size ) |
| 3480 | { |
| 3481 | memset( buf + len, 'B', opt.response_size - len ); |
| 3482 | len += opt.response_size - len; |
| 3483 | } |
| 3484 | |
| 3485 | /* Truncate if response size is smaller than the "natural" size */ |
| 3486 | if( opt.response_size != DFL_RESPONSE_SIZE && |
| 3487 | len > opt.response_size ) |
| 3488 | { |
| 3489 | len = opt.response_size; |
| 3490 | |
| 3491 | /* Still end with \r\n unless that's really not possible */ |
| 3492 | if( len >= 2 ) buf[len - 2] = '\r'; |
| 3493 | if( len >= 1 ) buf[len - 1] = '\n'; |
| 3494 | } |
| 3495 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3496 | if( opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3497 | { |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3498 | for( written = 0, frags = 0; written < len; written += ret, frags++ ) |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3499 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3500 | while( ( ret = mbedtls_ssl_write( &ssl, buf + written, len - written ) ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3501 | <= 0 ) |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 3502 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3503 | if( ret == MBEDTLS_ERR_NET_CONN_RESET ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3504 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3505 | mbedtls_printf( " failed\n ! peer closed the connection\n\n" ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3506 | goto reset; |
| 3507 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3508 | |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 3509 | if( ! mbedtls_status_is_ssl_in_progress( ret ) ) |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3510 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3511 | mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3512 | goto reset; |
| 3513 | } |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3514 | |
| 3515 | /* For event-driven IO, wait for socket to become available */ |
| 3516 | if( opt.event == 1 /* level triggered IO */ ) |
| 3517 | { |
| 3518 | #if defined(MBEDTLS_TIMING_C) |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3519 | idle( &client_fd, &timer, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3520 | #else |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3521 | idle( &client_fd, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3522 | #endif |
| 3523 | } |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 3524 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3525 | } |
| 3526 | } |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3527 | else /* Not stream, so datagram */ |
| 3528 | { |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3529 | while( 1 ) |
| 3530 | { |
| 3531 | ret = mbedtls_ssl_write( &ssl, buf, len ); |
| 3532 | |
Gilles Peskine | a36ac4f | 2018-04-26 08:05:02 +0200 | [diff] [blame] | 3533 | if( ! mbedtls_status_is_ssl_in_progress( ret ) ) |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3534 | break; |
| 3535 | |
| 3536 | /* For event-driven IO, wait for socket to become available */ |
| 3537 | if( opt.event == 1 /* level triggered IO */ ) |
| 3538 | { |
| 3539 | #if defined(MBEDTLS_TIMING_C) |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3540 | idle( &client_fd, &timer, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3541 | #else |
Hanno Becker | 197a91c | 2017-10-31 10:58:53 +0000 | [diff] [blame] | 3542 | idle( &client_fd, ret ); |
Hanno Becker | 16970d2 | 2017-10-10 15:56:37 +0100 | [diff] [blame] | 3543 | #endif |
| 3544 | } |
| 3545 | } |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3546 | |
| 3547 | if( ret < 0 ) |
| 3548 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3549 | mbedtls_printf( " failed\n ! mbedtls_ssl_write returned %d\n\n", ret ); |
Manuel Pégourié-Gonnard | 2d87e41 | 2014-10-13 18:38:36 +0200 | [diff] [blame] | 3550 | goto reset; |
| 3551 | } |
| 3552 | |
| 3553 | frags = 1; |
| 3554 | written = ret; |
| 3555 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3556 | |
Manuel Pégourié-Gonnard | bd7ce63 | 2013-07-17 15:34:17 +0200 | [diff] [blame] | 3557 | buf[written] = '\0'; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3558 | mbedtls_printf( " %d bytes written in %d fragments\n\n%s\n", written, frags, (char *) buf ); |
Manuel Pégourié-Gonnard | a92ed48 | 2015-01-14 10:46:08 +0100 | [diff] [blame] | 3559 | ret = 0; |
Manuel Pégourié-Gonnard | f3dc2f6 | 2013-10-29 18:17:41 +0100 | [diff] [blame] | 3560 | |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 3561 | /* |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3562 | * 7b. Simulate serialize/deserialize and go back to data exchange |
| 3563 | */ |
Jarno Lamsa | bbc7b41 | 2019-06-04 11:06:31 +0300 | [diff] [blame] | 3564 | #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3565 | if( opt.serialize != 0 ) |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3566 | { |
Jarno Lamsa | 15b3a7a | 2019-06-06 15:10:07 +0300 | [diff] [blame] | 3567 | size_t buf_len; |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3568 | |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3569 | mbedtls_printf( " . Serializing live connection..." ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3570 | |
Jarno Lamsa | 15b3a7a | 2019-06-06 15:10:07 +0300 | [diff] [blame] | 3571 | ret = mbedtls_ssl_context_save( &ssl, NULL, 0, &buf_len ); |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3572 | if( ret != MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ) |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3573 | { |
Jarno Lamsa | 93c6ff2 | 2019-06-04 15:36:18 +0300 | [diff] [blame] | 3574 | mbedtls_printf( " failed\n ! mbedtls_ssl_context_save returned " |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3575 | "-0x%x\n\n", (unsigned int) -ret ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3576 | |
| 3577 | goto exit; |
| 3578 | } |
| 3579 | |
Jarno Lamsa | 15b3a7a | 2019-06-06 15:10:07 +0300 | [diff] [blame] | 3580 | if( ( context_buf = mbedtls_calloc( 1, buf_len ) ) == NULL ) |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3581 | { |
Jarno Lamsa | 93c6ff2 | 2019-06-04 15:36:18 +0300 | [diff] [blame] | 3582 | mbedtls_printf( " failed\n ! Couldn't allocate buffer for " |
| 3583 | "serialized context" ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3584 | |
| 3585 | goto exit; |
| 3586 | } |
Manuel Pégourié-Gonnard | 3309a67 | 2019-07-15 10:31:11 +0200 | [diff] [blame] | 3587 | context_buf_len = buf_len; |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3588 | |
Jarno Lamsa | ddf72a1 | 2019-06-13 12:22:50 +0300 | [diff] [blame] | 3589 | if( ( ret = mbedtls_ssl_context_save( &ssl, context_buf, |
| 3590 | buf_len, &buf_len ) ) != 0 ) |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3591 | { |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3592 | mbedtls_printf( " failed\n ! mbedtls_ssl_context_save returned " |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3593 | "-0x%x\n\n", (unsigned int) -ret ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3594 | |
| 3595 | goto exit; |
| 3596 | } |
| 3597 | |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3598 | mbedtls_printf( " ok\n" ); |
| 3599 | |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 3600 | /* Save serialized context to the 'opt.context_file' as a base64 code */ |
| 3601 | if( 0 < strlen( opt.context_file ) ) |
| 3602 | { |
| 3603 | FILE *b64_file; |
| 3604 | uint8_t *b64_buf; |
| 3605 | size_t b64_len; |
| 3606 | |
| 3607 | mbedtls_printf( " . Save serialized context to a file... " ); |
| 3608 | |
| 3609 | mbedtls_base64_encode( NULL, 0, &b64_len, context_buf, buf_len ); |
| 3610 | |
| 3611 | if( ( b64_buf = mbedtls_calloc( 1, b64_len ) ) == NULL ) |
| 3612 | { |
| 3613 | mbedtls_printf( "failed\n ! Couldn't allocate buffer for " |
| 3614 | "the base64 code\n" ); |
| 3615 | goto exit; |
| 3616 | } |
| 3617 | |
| 3618 | if( ( ret = mbedtls_base64_encode( b64_buf, b64_len, &b64_len, |
| 3619 | context_buf, buf_len ) ) != 0 ) |
| 3620 | { |
| 3621 | mbedtls_printf( "failed\n ! mbedtls_base64_encode returned " |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3622 | "-0x%x\n", (unsigned int) -ret ); |
Piotr Nowicki | 3de298f | 2020-04-16 14:35:19 +0200 | [diff] [blame] | 3623 | mbedtls_free( b64_buf ); |
| 3624 | goto exit; |
| 3625 | } |
| 3626 | |
| 3627 | if( ( b64_file = fopen( opt.context_file, "w" ) ) == NULL ) |
| 3628 | { |
| 3629 | mbedtls_printf( "failed\n ! Cannot open '%s' for writing.\n", |
| 3630 | opt.context_file ); |
| 3631 | mbedtls_free( b64_buf ); |
| 3632 | goto exit; |
| 3633 | } |
| 3634 | |
| 3635 | if( b64_len != fwrite( b64_buf, 1, b64_len, b64_file ) ) |
| 3636 | { |
| 3637 | mbedtls_printf( "failed\n ! fwrite(%ld bytes) failed\n", |
| 3638 | (long) b64_len ); |
| 3639 | mbedtls_free( b64_buf ); |
| 3640 | fclose( b64_file ); |
| 3641 | goto exit; |
| 3642 | } |
| 3643 | |
| 3644 | mbedtls_free( b64_buf ); |
| 3645 | fclose( b64_file ); |
| 3646 | |
| 3647 | mbedtls_printf( "ok\n" ); |
| 3648 | } |
| 3649 | |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3650 | /* |
| 3651 | * This simulates a workflow where you have a long-lived server |
| 3652 | * instance, potentially with a pool of ssl_context objects, and you |
| 3653 | * just want to re-use one while the connection is inactive: in that |
| 3654 | * case you can just reset() it, and then it's ready to receive |
| 3655 | * serialized data from another connection (or the same here). |
| 3656 | */ |
| 3657 | if( opt.serialize == 1 ) |
| 3658 | { |
Manuel Pégourié-Gonnard | 9df5a82 | 2019-07-23 14:51:09 +0200 | [diff] [blame] | 3659 | /* nothing to do here, done by context_save() already */ |
Piotr Nowicki | 136bebf | 2020-04-17 14:37:00 +0200 | [diff] [blame] | 3660 | mbedtls_printf( " . Context has been reset... ok\n" ); |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3661 | } |
| 3662 | |
| 3663 | /* |
| 3664 | * This simulates a workflow where you have one server instance per |
| 3665 | * connection, and want to release it entire when the connection is |
| 3666 | * inactive, and spawn it again when needed again - this would happen |
| 3667 | * between ssl_free() and ssl_init() below, together with any other |
| 3668 | * teardown/startup code needed - for example, preparing the |
| 3669 | * ssl_config again (see section 3 "setup stuff" in this file). |
| 3670 | */ |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3671 | if( opt.serialize == 2 ) |
| 3672 | { |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3673 | mbedtls_printf( " . Freeing and reinitializing context..." ); |
| 3674 | |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3675 | mbedtls_ssl_free( &ssl ); |
| 3676 | |
| 3677 | mbedtls_ssl_init( &ssl ); |
| 3678 | |
| 3679 | if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 ) |
| 3680 | { |
Jarno Lamsa | ddf72a1 | 2019-06-13 12:22:50 +0300 | [diff] [blame] | 3681 | mbedtls_printf( " failed\n ! mbedtls_ssl_setup returned " |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3682 | "-0x%x\n\n", (unsigned int) -ret ); |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3683 | goto exit; |
| 3684 | } |
| 3685 | |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3686 | /* |
| 3687 | * This illustrates the minimum amount of things you need to set |
| 3688 | * up, however you could set up much more if desired, for example |
| 3689 | * if you want to share your set up code between the case of |
| 3690 | * establishing a new connection and this case. |
| 3691 | */ |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3692 | if( opt.nbio == 2 ) |
Jarno Lamsa | ddf72a1 | 2019-06-13 12:22:50 +0300 | [diff] [blame] | 3693 | mbedtls_ssl_set_bio( &ssl, &client_fd, delayed_send, |
| 3694 | delayed_recv, NULL ); |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3695 | else |
Jarno Lamsa | ddf72a1 | 2019-06-13 12:22:50 +0300 | [diff] [blame] | 3696 | mbedtls_ssl_set_bio( &ssl, &client_fd, mbedtls_net_send, |
| 3697 | mbedtls_net_recv, |
| 3698 | opt.nbio == 0 ? mbedtls_net_recv_timeout : NULL ); |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3699 | |
Jarno Lamsa | 8e25321 | 2019-06-13 11:45:06 +0300 | [diff] [blame] | 3700 | #if defined(MBEDTLS_TIMING_C) |
Jarno Lamsa | ddf72a1 | 2019-06-13 12:22:50 +0300 | [diff] [blame] | 3701 | mbedtls_ssl_set_timer_cb( &ssl, &timer, |
| 3702 | mbedtls_timing_set_delay, |
| 3703 | mbedtls_timing_get_delay ); |
Jarno Lamsa | 8e25321 | 2019-06-13 11:45:06 +0300 | [diff] [blame] | 3704 | #endif /* MBEDTLS_TIMING_C */ |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3705 | |
| 3706 | mbedtls_printf( " ok\n" ); |
Jarno Lamsa | 304d61c | 2019-06-06 10:40:52 +0300 | [diff] [blame] | 3707 | } |
| 3708 | |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3709 | mbedtls_printf( " . Deserializing connection..." ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3710 | |
Jarno Lamsa | ddf72a1 | 2019-06-13 12:22:50 +0300 | [diff] [blame] | 3711 | if( ( ret = mbedtls_ssl_context_load( &ssl, context_buf, |
| 3712 | buf_len ) ) != 0 ) |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3713 | { |
Jarno Lamsa | 93c6ff2 | 2019-06-04 15:36:18 +0300 | [diff] [blame] | 3714 | mbedtls_printf( "failed\n ! mbedtls_ssl_context_load returned " |
Kenneth Soerensen | 518d435 | 2020-04-01 17:22:45 +0200 | [diff] [blame] | 3715 | "-0x%x\n\n", (unsigned int) -ret ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3716 | |
| 3717 | goto exit; |
| 3718 | } |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3719 | |
Manuel Pégourié-Gonnard | 3309a67 | 2019-07-15 10:31:11 +0200 | [diff] [blame] | 3720 | mbedtls_free( context_buf ); |
| 3721 | context_buf = NULL; |
| 3722 | context_buf_len = 0; |
| 3723 | |
Manuel Pégourié-Gonnard | a88399c | 2019-07-12 10:41:55 +0200 | [diff] [blame] | 3724 | mbedtls_printf( " ok\n" ); |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3725 | } |
Jarno Lamsa | 93c6ff2 | 2019-06-04 15:36:18 +0300 | [diff] [blame] | 3726 | #endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ |
Jarno Lamsa | 5a3a16c | 2019-05-29 15:41:21 +0300 | [diff] [blame] | 3727 | |
| 3728 | /* |
| 3729 | * 7c. Continue doing data exchanges? |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3730 | */ |
Manuel Pégourié-Gonnard | 6a0017b | 2015-01-22 10:33:29 +0000 | [diff] [blame] | 3731 | if( --exchanges_left > 0 ) |
Manuel Pégourié-Gonnard | a8c0a0d | 2014-08-15 12:07:38 +0200 | [diff] [blame] | 3732 | goto data_exchange; |
| 3733 | |
| 3734 | /* |
| 3735 | * 8. Done, cleanly close the connection |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 3736 | */ |
| 3737 | close_notify: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3738 | mbedtls_printf( " . Closing the connection..." ); |
Manuel Pégourié-Gonnard | 6b0d268 | 2014-03-25 11:24:43 +0100 | [diff] [blame] | 3739 | |
Manuel Pégourié-Gonnard | 994f8b5 | 2014-10-09 19:56:44 +0200 | [diff] [blame] | 3740 | /* No error checking, the connection might be closed already */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3741 | do ret = mbedtls_ssl_close_notify( &ssl ); |
Manuel Pégourié-Gonnard | 8836994 | 2015-05-06 16:19:31 +0100 | [diff] [blame] | 3742 | while( ret == MBEDTLS_ERR_SSL_WANT_WRITE ); |
Manuel Pégourié-Gonnard | 994f8b5 | 2014-10-09 19:56:44 +0200 | [diff] [blame] | 3743 | ret = 0; |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 3744 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3745 | mbedtls_printf( " done\n" ); |
Rich Evans | f90016a | 2015-01-19 14:26:37 +0000 | [diff] [blame] | 3746 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3747 | goto reset; |
| 3748 | |
Manuel Pégourié-Gonnard | e08660e | 2014-08-16 11:28:40 +0200 | [diff] [blame] | 3749 | /* |
| 3750 | * Cleanup and exit |
| 3751 | */ |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3752 | exit: |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 3753 | #ifdef MBEDTLS_ERROR_C |
gabor-mezei-arm | de47217 | 2020-09-04 14:44:25 +0200 | [diff] [blame] | 3754 | if( ret != 0 ) |
| 3755 | { |
| 3756 | char error_buf[100]; |
| 3757 | mbedtls_strerror( ret, error_buf, 100 ); |
| 3758 | mbedtls_printf("Last error was: -0x%X - %s\n\n", (unsigned int) -ret, error_buf ); |
| 3759 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3760 | #endif |
| 3761 | |
gabor-mezei-arm | de47217 | 2020-09-04 14:44:25 +0200 | [diff] [blame] | 3762 | if( opt.query_config_mode == DFL_QUERY_CONFIG_MODE ) |
| 3763 | { |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 3764 | mbedtls_printf( " . Cleaning up..." ); |
| 3765 | fflush( stdout ); |
| 3766 | } |
Manuel Pégourié-Gonnard | f29e5de | 2014-11-21 11:54:41 +0100 | [diff] [blame] | 3767 | |
Manuel Pégourié-Gonnard | 3d7d00a | 2015-06-30 15:55:03 +0200 | [diff] [blame] | 3768 | mbedtls_net_free( &client_fd ); |
| 3769 | mbedtls_net_free( &listen_fd ); |
Paul Bakker | 0c22610 | 2014-04-17 16:02:36 +0200 | [diff] [blame] | 3770 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3771 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 3772 | mbedtls_dhm_free( &dhm ); |
Paul Bakker | a317a98 | 2014-06-18 16:44:11 +0200 | [diff] [blame] | 3773 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3774 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
| 3775 | mbedtls_x509_crt_free( &cacert ); |
| 3776 | mbedtls_x509_crt_free( &srvcert ); |
| 3777 | mbedtls_pk_free( &pkey ); |
| 3778 | mbedtls_x509_crt_free( &srvcert2 ); |
| 3779 | mbedtls_pk_free( &pkey2 ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 3780 | #endif |
Gilles Peskine | 4481744 | 2018-06-13 18:09:28 +0200 | [diff] [blame] | 3781 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
| 3782 | for( i = 0; (size_t) i < ssl_async_keys.slots_used; i++ ) |
| 3783 | { |
| 3784 | if( ssl_async_keys.slots[i].pk_owned ) |
| 3785 | { |
| 3786 | mbedtls_pk_free( ssl_async_keys.slots[i].pk ); |
| 3787 | mbedtls_free( ssl_async_keys.slots[i].pk ); |
| 3788 | ssl_async_keys.slots[i].pk = NULL; |
| 3789 | } |
| 3790 | } |
| 3791 | #endif |
Manuel Pégourié-Gonnard | 6c7af4c | 2015-04-03 16:41:52 +0200 | [diff] [blame] | 3792 | #if defined(SNI_OPTION) |
Manuel Pégourié-Gonnard | 5d917ff | 2014-02-21 16:52:06 +0100 | [diff] [blame] | 3793 | sni_free( sni_info ); |
| 3794 | #endif |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3795 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
gabor-mezei-arm | de47217 | 2020-09-04 14:44:25 +0200 | [diff] [blame] | 3796 | ret = psk_free( psk_info ); |
| 3797 | if( ( ret != 0 ) && ( opt.query_config_mode == DFL_QUERY_CONFIG_MODE ) ) |
| 3798 | mbedtls_printf( "Failed to list of opaque PSKs - error was %d\n", ret ); |
Manuel Pégourié-Gonnard | 4505ed3 | 2014-06-19 20:56:52 +0200 | [diff] [blame] | 3799 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3800 | #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) |
| 3801 | mbedtls_dhm_free( &dhm ); |
Manuel Pégourié-Gonnard | 4505ed3 | 2014-06-19 20:56:52 +0200 | [diff] [blame] | 3802 | #endif |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 3803 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3804 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) && \ |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 3805 | defined(MBEDTLS_USE_PSA_CRYPTO) |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 3806 | if( opt.psk_opaque != 0 ) |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 3807 | { |
| 3808 | /* This is ok even if the slot hasn't been |
| 3809 | * initialized (we might have jumed here |
| 3810 | * immediately because of bad cmd line params, |
| 3811 | * for example). */ |
Hanno Becker | 1d911cd | 2018-11-15 13:06:09 +0000 | [diff] [blame] | 3812 | status = psa_destroy_key( psk_slot ); |
gabor-mezei-arm | de47217 | 2020-09-04 14:44:25 +0200 | [diff] [blame] | 3813 | if( ( status != PSA_SUCCESS ) && |
| 3814 | ( opt.query_config_mode == DFL_QUERY_CONFIG_MODE ) ) |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 3815 | { |
Ronald Cron | adc2ff2 | 2020-09-16 16:49:27 +0200 | [diff] [blame] | 3816 | mbedtls_printf( "Failed to destroy key slot %u - error was %d", |
Ronald Cron | c985114 | 2020-11-13 10:08:52 +0100 | [diff] [blame] | 3817 | (unsigned) psk_slot, (int) status ); |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 3818 | } |
| 3819 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3820 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED && |
Hanno Becker | c43b6ea | 2018-11-05 13:48:43 +0000 | [diff] [blame] | 3821 | MBEDTLS_USE_PSA_CRYPTO */ |
| 3822 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3823 | mbedtls_ssl_free( &ssl ); |
Manuel Pégourié-Gonnard | def0bbe | 2015-05-04 14:56:36 +0200 | [diff] [blame] | 3824 | mbedtls_ssl_config_free( &conf ); |
Gilles Peskine | f1cb75f | 2021-01-13 18:46:01 +0100 | [diff] [blame] | 3825 | rng_free( &rng ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3826 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3827 | #if defined(MBEDTLS_SSL_CACHE_C) |
| 3828 | mbedtls_ssl_cache_free( &cache ); |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 3829 | #endif |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 3830 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 3831 | mbedtls_ssl_ticket_free( &ticket_ctx ); |
| 3832 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3833 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 3834 | mbedtls_ssl_cookie_free( &cookie_ctx ); |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 3835 | #endif |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 3836 | |
Hanno Becker | 095d9cf | 2018-10-09 12:39:13 +0100 | [diff] [blame] | 3837 | mbedtls_free( buf ); |
| 3838 | |
Manuel Pégourié-Gonnard | 3309a67 | 2019-07-15 10:31:11 +0200 | [diff] [blame] | 3839 | #if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) |
| 3840 | if( context_buf != NULL ) |
| 3841 | mbedtls_platform_zeroize( context_buf, context_buf_len ); |
| 3842 | mbedtls_free( context_buf ); |
| 3843 | #endif |
| 3844 | |
Gilles Peskine | 414e717 | 2021-02-03 00:04:08 +0100 | [diff] [blame] | 3845 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 3846 | mbedtls_psa_crypto_free( ); |
| 3847 | #endif |
| 3848 | |
Gilles Peskine | 60fe660 | 2021-02-16 18:56:42 +0100 | [diff] [blame] | 3849 | #if defined(MBEDTLS_TEST_HOOKS) |
Gilles Peskine | d0a46e5 | 2021-02-03 00:03:03 +0100 | [diff] [blame] | 3850 | /* Let test hooks detect errors such as resource leaks. |
| 3851 | * Don't do it in query_config mode, because some test code prints |
| 3852 | * information to stdout and this gets mixed with the regular output. */ |
| 3853 | if( opt.query_config_mode == DFL_QUERY_CONFIG_MODE ) |
Gilles Peskine | 53dea74 | 2021-02-02 22:55:06 +0100 | [diff] [blame] | 3854 | { |
Gilles Peskine | d0a46e5 | 2021-02-03 00:03:03 +0100 | [diff] [blame] | 3855 | if( test_hooks_failure_detected( ) ) |
| 3856 | { |
| 3857 | if( ret == 0 ) |
| 3858 | ret = 1; |
| 3859 | mbedtls_printf( "Test hooks detected errors.\n" ); |
| 3860 | } |
Gilles Peskine | 53dea74 | 2021-02-02 22:55:06 +0100 | [diff] [blame] | 3861 | } |
| 3862 | test_hooks_free( ); |
Gilles Peskine | 60fe660 | 2021-02-16 18:56:42 +0100 | [diff] [blame] | 3863 | #endif /* MBEDTLS_TEST_HOOKS */ |
Gilles Peskine | 53dea74 | 2021-02-02 22:55:06 +0100 | [diff] [blame] | 3864 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3865 | #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) |
| 3866 | #if defined(MBEDTLS_MEMORY_DEBUG) |
| 3867 | mbedtls_memory_buffer_alloc_status(); |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 3868 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3869 | mbedtls_memory_buffer_alloc_free(); |
Gilles Peskine | 34babfc | 2021-02-16 15:44:37 +0100 | [diff] [blame] | 3870 | #endif /* MBEDTLS_MEMORY_BUFFER_ALLOC_C */ |
Paul Bakker | 82024bf | 2013-07-04 11:52:32 +0200 | [diff] [blame] | 3871 | |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 3872 | if( opt.query_config_mode == DFL_QUERY_CONFIG_MODE ) |
| 3873 | { |
| 3874 | mbedtls_printf( " done.\n" ); |
Manuel Pégourié-Gonnard | f29e5de | 2014-11-21 11:54:41 +0100 | [diff] [blame] | 3875 | |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3876 | #if defined(_WIN32) |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 3877 | mbedtls_printf( " + Press Enter to exit this program.\n" ); |
| 3878 | fflush( stdout ); getchar(); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3879 | #endif |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 3880 | } |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3881 | |
Paul Bakker | dbd79ca | 2013-07-24 16:28:35 +0200 | [diff] [blame] | 3882 | // Shell can not handle large exit numbers -> 1 for errors |
| 3883 | if( ret < 0 ) |
| 3884 | ret = 1; |
| 3885 | |
gabor-mezei-arm | a9eecf1 | 2020-07-07 11:11:02 +0200 | [diff] [blame] | 3886 | if( opt.query_config_mode == DFL_QUERY_CONFIG_MODE ) |
| 3887 | mbedtls_exit( ret ); |
| 3888 | else |
| 3889 | mbedtls_exit( query_config_ret ); |
Paul Bakker | b60b95f | 2012-09-25 09:05:17 +0000 | [diff] [blame] | 3890 | } |
Gilles Peskine | b4df754 | 2021-01-08 21:20:09 +0100 | [diff] [blame] | 3891 | #endif /* !MBEDTLS_SSL_TEST_IMPOSSIBLE && MBEDTLS_SSL_SRV_C */ |