diff --git a/port/mbedtls/supp_psa_api.c b/port/mbedtls/supp_psa_api.c new file mode 100644 index 0000000000..113bd9f591 --- /dev/null +++ b/port/mbedtls/supp_psa_api.c @@ -0,0 +1,419 @@ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +/* + * Copyright 2023-2024 NXP + * + * @file supp_psa_api.c + * @brief This file provides wpa supplicant crypto mbedtls PSA APIs. + */ + +#include "supp_psa_api.h" + +#define ASSERT_STATUS(actual, expected) \ + do \ + { \ + if ((actual) != (expected)) \ + { \ + printk( \ + "\tassertion failed at %s:%d - " \ + "actual:%d expected:%d\r\n", \ + __FILE__, __LINE__, (psa_status_t)actual, (psa_status_t)expected); \ + goto exit; \ + } \ + } while (0) + +#define SUPP_PSA_MAX_OUTPUT_SIZE 2048 + +static uint8_t supp_psa_outbuf[SUPP_PSA_MAX_OUTPUT_SIZE]; + +static inline void supp_psa_set_attributes(psa_key_attributes_t *attributes, u32 type, u32 alg, u32 usage) +{ + psa_set_key_type(attributes, type); + psa_set_key_algorithm(attributes, alg); + psa_set_key_usage_flags(attributes, usage); +} + +static void supp_psa_get_hash_alg(mbedtls_md_type_t type, psa_algorithm_t *alg, int *block_size) +{ + switch (type) + { + case MBEDTLS_MD_MD5: + *alg = PSA_ALG_MD5; + break; + case MBEDTLS_MD_SHA1: + *alg = PSA_ALG_SHA_1; + break; + case MBEDTLS_MD_SHA224: + *alg = PSA_ALG_SHA_224; + break; + case MBEDTLS_MD_SHA256: + *alg = PSA_ALG_SHA_256; + break; + case MBEDTLS_MD_SHA384: + *alg = PSA_ALG_SHA_384; + break; + case MBEDTLS_MD_SHA512: + *alg = PSA_ALG_SHA_512; + break; + case MBEDTLS_MD_RIPEMD160: + *alg = PSA_ALG_RIPEMD160; + break; + default: + *alg = PSA_ALG_NONE; + break; + } + *block_size = PSA_HASH_LENGTH(*alg); +} + +static psa_status_t supp_psa_cipher_operation(psa_cipher_operation_t *operation, + const uint8_t *input, + size_t input_size, + size_t part_size, + uint8_t *output, + size_t output_size, + size_t *output_len) +{ + psa_status_t status; + size_t bytes_to_write = 0; + size_t bytes_written = 0; + size_t len = 0; + + *output_len = 0; + while (bytes_written != input_size) + { + bytes_to_write = (input_size - bytes_written > part_size ? part_size : input_size - bytes_written); + + status = psa_cipher_update(operation, input + bytes_written, bytes_to_write, output + *output_len, + output_size - *output_len, &len); + ASSERT_STATUS(status, PSA_SUCCESS); + + bytes_written += bytes_to_write; + *output_len += len; + } + + status = psa_cipher_finish(operation, output + *output_len, output_size - *output_len, &len); + ASSERT_STATUS(status, PSA_SUCCESS); + *output_len += len; + +exit: + return status; +} + +#ifdef MBEDTLS_AES_C +#define SUPP_PSA_AES_BLOCK_SIZE 16 + +int aes_128_encrypt_block_psa(const u8 *key, const u8 *in, u8 *out) +{ + psa_status_t status; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + psa_algorithm_t alg = PSA_ALG_ECB_NO_PADDING; + size_t out_len = 0; + + supp_psa_set_attributes(&attributes, PSA_KEY_TYPE_AES, alg, PSA_KEY_USAGE_ENCRYPT); + + status = psa_import_key(&attributes, key, SUPP_PSA_BLOCK_SIZE_128, &key_id); + ASSERT_STATUS(status, PSA_SUCCESS); + psa_reset_key_attributes(&attributes); + + status = psa_cipher_encrypt(key_id, alg, in, SUPP_PSA_BLOCK_SIZE_128, out, SUPP_PSA_BLOCK_SIZE_128, &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + +exit: + if (key_id != MBEDTLS_SVC_KEY_ID_INIT) + { + psa_destroy_key(key_id); + } + return (int)status; +} + +int aes_128_cbc_encrypt_psa(const u8 *key, const u8 *iv, u8 *data, size_t data_len) +{ + psa_status_t status; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; + psa_key_type_t key_type = PSA_KEY_TYPE_AES; + psa_algorithm_t alg = PSA_ALG_CBC_NO_PADDING; + size_t out_len = 0; + + if (data_len > SUPP_PSA_MAX_OUTPUT_SIZE) + { + printk("%s invalid input len %d", __func__, data_len); + return -1; + } + + supp_psa_set_attributes(&attributes, key_type, alg, PSA_KEY_USAGE_ENCRYPT); + + status = psa_import_key(&attributes, key, SUPP_PSA_BLOCK_SIZE_128, &key_id); + ASSERT_STATUS(status, PSA_SUCCESS); + psa_reset_key_attributes(&attributes); + + status = psa_cipher_encrypt_setup(&operation, key_id, alg); + ASSERT_STATUS(status, PSA_SUCCESS); + + status = psa_cipher_set_iv(&operation, iv, PSA_CIPHER_IV_LENGTH(key_type, alg)); + ASSERT_STATUS(status, PSA_SUCCESS); + + memset(supp_psa_outbuf, 0x0, data_len); + status = supp_psa_cipher_operation(&operation, data, data_len, PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type), + supp_psa_outbuf, data_len, &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + + memcpy(data, supp_psa_outbuf, out_len); +exit: + psa_cipher_abort(&operation); + if (key_id != MBEDTLS_SVC_KEY_ID_INIT) + { + psa_destroy_key(key_id); + } + return (int)status; +} + +int aes_128_cbc_decrypt_psa(const u8 *key, const u8 *iv, u8 *data, size_t data_len) +{ + psa_status_t status; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; + psa_key_type_t key_type = PSA_KEY_TYPE_AES; + psa_algorithm_t alg = PSA_ALG_CBC_NO_PADDING; + size_t out_len = 0; + + if (data_len > SUPP_PSA_MAX_OUTPUT_SIZE) + { + printk("%s invalid input len %d", __func__, data_len); + return -1; + } + + supp_psa_set_attributes(&attributes, key_type, alg, PSA_KEY_USAGE_DECRYPT); + + status = psa_import_key(&attributes, key, SUPP_PSA_BLOCK_SIZE_128, &key_id); + ASSERT_STATUS(status, PSA_SUCCESS); + psa_reset_key_attributes(&attributes); + + status = psa_cipher_decrypt_setup(&operation, key_id, alg); + ASSERT_STATUS(status, PSA_SUCCESS); + + status = psa_cipher_set_iv(&operation, iv, PSA_CIPHER_IV_LENGTH(key_type, alg)); + ASSERT_STATUS(status, PSA_SUCCESS); + + memset(supp_psa_outbuf, 0x0, data_len); + status = supp_psa_cipher_operation(&operation, data, data_len, PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type), + supp_psa_outbuf, data_len, &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + + memcpy(data, supp_psa_outbuf, out_len); +exit: + psa_cipher_abort(&operation); + if (key_id != MBEDTLS_SVC_KEY_ID_INIT) + { + psa_destroy_key(key_id); + } + return (int)status; +} + +int aes_ctr_encrypt_psa(const u8 *key, size_t key_len, const u8 *nonce, u8 *data, size_t data_len) +{ + psa_status_t status; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; + psa_key_type_t key_type = PSA_KEY_TYPE_AES; + psa_algorithm_t alg = PSA_ALG_CTR; + size_t out_len = 0; + + if (data_len > SUPP_PSA_MAX_OUTPUT_SIZE) + { + printk("%s invalid input len %d", __func__, data_len); + return -1; + } + + supp_psa_set_attributes(&attributes, key_type, alg, PSA_KEY_USAGE_ENCRYPT); + + status = psa_import_key(&attributes, key, key_len, &key_id); + ASSERT_STATUS(status, PSA_SUCCESS); + psa_reset_key_attributes(&attributes); + + status = psa_cipher_encrypt_setup(&operation, key_id, alg); + ASSERT_STATUS(status, PSA_SUCCESS); + + status = psa_cipher_set_iv(&operation, nonce, PSA_CIPHER_IV_LENGTH(key_type, alg)); + ASSERT_STATUS(status, PSA_SUCCESS); + + memset(supp_psa_outbuf, 0x0, data_len); + status = supp_psa_cipher_operation(&operation, data, data_len, PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type), + supp_psa_outbuf, data_len, &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + + memcpy(data, supp_psa_outbuf, out_len); +exit: + psa_cipher_abort(&operation); + if (key_id != MBEDTLS_SVC_KEY_ID_INIT) + { + psa_destroy_key(key_id); + } + return (int)status; +} +#endif + +#ifdef MBEDTLS_CMAC_C +int omac1_aes_vector_psa(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + psa_status_t status; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + psa_algorithm_t alg = PSA_ALG_CMAC; + int i; + size_t out_len = 0; + + switch (key_len) + { + case SUPP_PSA_BLOCK_SIZE_128: + /* fall through */ + case SUPP_PSA_BLOCK_SIZE_192: + /* fall through */ + case SUPP_PSA_BLOCK_SIZE_256: + break; + default: + return -1; + } + + supp_psa_set_attributes(&attributes, PSA_KEY_TYPE_AES, alg, PSA_KEY_USAGE_SIGN_MESSAGE); + + status = psa_import_key(&attributes, key, key_len, &key_id); + ASSERT_STATUS(status, PSA_SUCCESS); + psa_reset_key_attributes(&attributes); + + status = psa_mac_sign_setup(&operation, key_id, alg); + ASSERT_STATUS(status, PSA_SUCCESS); + + for (i = 0; i < num_elem; i++) + { + status = psa_mac_update(&operation, addr[i], len[i]); + ASSERT_STATUS(status, PSA_SUCCESS); + } + + status = psa_mac_sign_finish(&operation, mac, PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, key_len * 8, alg), &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + +exit: + psa_mac_abort(&operation); + if (key_id != MBEDTLS_SVC_KEY_ID_INIT) + { + psa_destroy_key(key_id); + } + return (int)status; +} +#endif + +int md_vector_psa(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac, mbedtls_md_type_t md_type) +{ + psa_status_t status; + psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; + psa_algorithm_t alg = PSA_ALG_NONE; + int block_size; + int i; + size_t out_len = 0; + + supp_psa_get_hash_alg(md_type, &alg, &block_size); + if (alg == PSA_ALG_NONE) + { + printk("md_vector unknown md type %d\r\n", md_type); + return -1; + } + + status = psa_hash_setup(&operation, alg); + ASSERT_STATUS(status, PSA_SUCCESS); + + for (i = 0; i < num_elem; i++) + { + status = psa_hash_update(&operation, addr[i], len[i]); + ASSERT_STATUS(status, PSA_SUCCESS); + } + + status = psa_hash_finish(&operation, mac, block_size, &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + +exit: + psa_hash_abort(&operation); + return (int)status; +} + +int hmac_vector_psa(const u8 *key, + size_t key_len, + size_t num_elem, + const u8 *addr[], + const size_t *len, + u8 *mac, + mbedtls_md_type_t md_type) +{ + psa_status_t status; + psa_algorithm_t alg = PSA_ALG_NONE; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + int block_size; + int i; + size_t out_len = 0; + + supp_psa_get_hash_alg(md_type, &alg, &block_size); + if (alg == PSA_ALG_NONE) + { + printk("hmac_vector unknown md type %d\r\n", md_type); + return -1; + } + alg = PSA_ALG_HMAC(alg); + + supp_psa_set_attributes(&attributes, PSA_KEY_TYPE_HMAC, alg, PSA_KEY_USAGE_SIGN_MESSAGE); + + status = psa_import_key(&attributes, key, key_len, &key_id); + ASSERT_STATUS(status, PSA_SUCCESS); + psa_reset_key_attributes(&attributes); + + status = psa_mac_sign_setup(&operation, key_id, alg); + ASSERT_STATUS(status, PSA_SUCCESS); + + for (i = 0; i < num_elem; i++) + { + status = psa_mac_update(&operation, addr[i], len[i]); + ASSERT_STATUS(status, PSA_SUCCESS); + } + + status = psa_mac_sign_finish(&operation, mac, PSA_MAC_LENGTH(PSA_KEY_TYPE_HMAC, key_len * 8, alg), &out_len); + ASSERT_STATUS(status, PSA_SUCCESS); + +exit: + psa_mac_abort(&operation); + if (key_id != MBEDTLS_SVC_KEY_ID_INIT) + { + psa_destroy_key(key_id); + } + return (int)status; +} + +int supp_psa_crypto_init(void) +{ + return psa_crypto_init(); +} + +void supp_psa_crypto_deinit(void) +{ + mbedtls_psa_crypto_free(); +} diff --git a/port/mbedtls/supp_psa_api.h b/port/mbedtls/supp_psa_api.h new file mode 100644 index 0000000000..b8792279e2 --- /dev/null +++ b/port/mbedtls/supp_psa_api.h @@ -0,0 +1,57 @@ +/** @file supp_psa_api.h + * + * @brief This file provides crypto mbedtls PSA APIs for wpa supplicant. + * + * Copyright 2023 NXP + * + * SPDX-License-Identifier: BSD-3-Clause + * + */ + +#ifndef SUPP_PSA_API_H +#define SUPP_PSA_API_H + +#include "includes.h" +#include "common.h" + +#include "psa/crypto.h" +#include "mbedtls/md.h" + +typedef enum +{ + SUPP_PSA_BLOCK_SIZE_128 = 16, + SUPP_PSA_BLOCK_SIZE_160 = 20, + SUPP_PSA_BLOCK_SIZE_192 = 24, + SUPP_PSA_BLOCK_SIZE_244 = 28, + SUPP_PSA_BLOCK_SIZE_256 = 32, + SUPP_PSA_BLOCK_SIZE_384 = 48, + SUPP_PSA_BLOCK_SIZE_512 = 64, +} supp_psa_block_size_e; + +typedef enum +{ + SUPP_PSA_KEY_BITS_128 = 128, + SUPP_PSA_KEY_BITS_192 = 192, + SUPP_PSA_KEY_BITS_256 = 256, +} supp_psa_key_bits_e; + +int aes_128_encrypt_block_psa(const u8 *key, const u8 *in, u8 *out); +int aes_128_cbc_encrypt_psa(const u8 *key, const u8 *iv, u8 *data, size_t data_len); +int aes_128_cbc_decrypt_psa(const u8 *key, const u8 *iv, u8 *data, size_t data_len); +int aes_ctr_encrypt_psa(const u8 *key, size_t key_len, const u8 *nonce, u8 *data, size_t data_len); + +int omac1_aes_vector_psa(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac); + +int md_vector_psa(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac, mbedtls_md_type_t md_type); + +int hmac_vector_psa(const u8 *key, + size_t key_len, + size_t num_elem, + const u8 *addr[], + const size_t *len, + u8 *mac, + mbedtls_md_type_t md_type); + +int supp_psa_crypto_init(void); +void supp_psa_crypto_deinit(void); +#endif /* SUPP_PSA_API_H */ diff --git a/port/mbedtls/wpa_supp_els_pkc_mbedtls_config.h b/port/mbedtls/wpa_supp_els_pkc_mbedtls_config.h new file mode 100644 index 0000000000..a750cc4807 --- /dev/null +++ b/port/mbedtls/wpa_supp_els_pkc_mbedtls_config.h @@ -0,0 +1,4010 @@ +/** + * \file config.h + * + * \brief Configuration options (set of defines) + * + * This set of compile-time options may be used to enable + * or disable features selectively, and reduce the global + * memory footprint. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef MBEDTLS_USER_CONFIG_H +#define MBEDTLS_USER_CONFIG_H + +#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) +#define _CRT_SECURE_NO_DEPRECATE 1 +#endif + +/**************************** MCUX CSS_PKC ********************************************/ +#include "fsl_device_registers.h" +#ifdef __ZEPHYR__ +#include +#else +#include "fsl_debug_console.h" + +#if defined(USE_RTOS) && defined(SDK_OS_FREE_RTOS) +#include "FreeRTOS.h" + +void *pvPortCalloc(size_t num, size_t size); /*Calloc for HEAP3.*/ + +#define MBEDTLS_PLATFORM_MEMORY +#define MBEDTLS_PLATFORM_STD_CALLOC pvPortCalloc +#define MBEDTLS_PLATFORM_STD_FREE vPortFree + +#endif /* USE_RTOS*/ +#endif /* __ZEPHYR__ */ + +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA +#define MBEDTLS_CTR_DRBG_ENABLED +#define MBEDTLS_CIPHER_AES_ENABLED +#define MBEDTLS_CIPHER_MODE_CBC_ENABLED +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define PSA_CRYPTO_DRIVER_ELS_PKC +#define PSA_CRYPTO_DRIVER_THREAD_EN + +#define MBEDTLS_PSA_ACCEL_ALG_MD5 +//#define MBEDTLS_PSA_ACCEL_ALG_SHA_1 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_224 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_256 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_384 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_512 +#define MBEDTLS_PSA_ACCEL_ALG_RIPEMD160 +#endif + +/**************************** MCUX CSS_PKC end ****************************************/ +/** + * \name SECTION: System support + * + * This section sets system specific settings. + * \{ + */ + +/** + * \def MBEDTLS_HAVE_ASM + * + * The compiler has support for asm(). + * + * Requires support for asm() in compiler. + * + * Used in: + * library/aria.c + * library/timing.c + * include/mbedtls/bn_mul.h + * + * Required by: + * MBEDTLS_AESNI_C + * MBEDTLS_PADLOCK_C + * + * Comment to disable the use of assembly code. + */ +#define MBEDTLS_HAVE_ASM + +/** + * \def MBEDTLS_NO_UDBL_DIVISION + * + * The platform lacks support for double-width integer division (64-bit + * division on a 32-bit platform, 128-bit division on a 64-bit platform). + * + * Used in: + * include/mbedtls/bignum.h + * library/bignum.c + * + * The bignum code uses double-width division to speed up some operations. + * Double-width division is often implemented in software that needs to + * be linked with the program. The presence of a double-width integer + * type is usually detected automatically through preprocessor macros, + * but the automatic detection cannot know whether the code needs to + * and can be linked with an implementation of division for that type. + * By default division is assumed to be usable if the type is present. + * Uncomment this option to prevent the use of double-width division. + * + * Note that division for the native integer type is always required. + * Furthermore, a 64-bit type is always required even on a 32-bit + * platform, but it need not support multiplication or division. In some + * cases it is also desirable to disable some double-width operations. For + * example, if double-width division is implemented in software, disabling + * it can reduce code size in some embedded targets. + */ +//#define MBEDTLS_NO_UDBL_DIVISION + +/** + * \def MBEDTLS_NO_64BIT_MULTIPLICATION + * + * The platform lacks support for 32x32 -> 64-bit multiplication. + * + * Used in: + * library/poly1305.c + * + * Some parts of the library may use multiplication of two unsigned 32-bit + * operands with a 64-bit result in order to speed up computations. On some + * platforms, this is not available in hardware and has to be implemented in + * software, usually in a library provided by the toolchain. + * + * Sometimes it is not desirable to have to link to that library. This option + * removes the dependency of that library on platforms that lack a hardware + * 64-bit multiplier by embedding a software implementation in Mbed TLS. + * + * Note that depending on the compiler, this may decrease performance compared + * to using the library function provided by the toolchain. + */ +//#define MBEDTLS_NO_64BIT_MULTIPLICATION + +/** + * \def MBEDTLS_HAVE_SSE2 + * + * CPU supports SSE2 instruction set. + * + * Uncomment if the CPU supports SSE2 (IA-32 specific). + */ +//#define MBEDTLS_HAVE_SSE2 + +/** + * \def MBEDTLS_HAVE_TIME + * + * System has time.h and time(). + * The time does not need to be correct, only time differences are used, + * by contrast with MBEDTLS_HAVE_TIME_DATE + * + * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, + * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and + * MBEDTLS_PLATFORM_STD_TIME. + * + * Comment if your system does not support time functions + */ +//#define MBEDTLS_HAVE_TIME + +/** + * \def MBEDTLS_HAVE_TIME_DATE + * + * System has time.h, time(), and an implementation for + * mbedtls_platform_gmtime_r() (see below). + * The time needs to be correct (not necessarily very accurate, but at least + * the date should be correct). This is used to verify the validity period of + * X.509 certificates. + * + * Comment if your system does not have a correct clock. + * + * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that + * behaves similarly to the gmtime_r() function from the C standard. Refer to + * the documentation for mbedtls_platform_gmtime_r() for more information. + * + * \note It is possible to configure an implementation for + * mbedtls_platform_gmtime_r() at compile-time by using the macro + * MBEDTLS_PLATFORM_GMTIME_R_ALT. + */ +//#define MBEDTLS_HAVE_TIME_DATE + +/** + * \def MBEDTLS_PLATFORM_MEMORY + * + * Enable the memory allocation layer. + * + * By default mbed TLS uses the system-provided calloc() and free(). + * This allows different allocators (self-implemented or provided) to be + * provided to the platform abstraction layer. + * + * Enabling MBEDTLS_PLATFORM_MEMORY without the + * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide + * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and + * free() function pointer at runtime. + * + * Enabling MBEDTLS_PLATFORM_MEMORY and specifying + * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the + * alternate function at compile time. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Enable this layer to allow use of alternative memory allocators. + */ +//#define MBEDTLS_PLATFORM_MEMORY + +/** + * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + * + * Do not assign standard functions in the platform layer (e.g. calloc() to + * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) + * + * This makes sure there are no linking errors on platforms that do not support + * these functions. You will HAVE to provide alternatives, either at runtime + * via the platform_set_xxx() functions or at compile time by setting + * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a + * MBEDTLS_PLATFORM_XXX_MACRO. + * + * Requires: MBEDTLS_PLATFORM_C + * + * Uncomment to prevent default assignment of standard functions in the + * platform layer. + */ +//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +/** + * \def MBEDTLS_PLATFORM_EXIT_ALT + * + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the + * function in the platform abstraction layer. + * + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will + * provide a function "mbedtls_platform_set_printf()" that allows you to set an + * alternative printf function pointer. + * + * All these define require MBEDTLS_PLATFORM_C to be defined! + * + * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; + * it will be enabled automatically by check_config.h + * + * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as + * MBEDTLS_PLATFORM_XXX_MACRO! + * + * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME + * + * Uncomment a macro to enable alternate implementation of specific base + * platform function + */ +//#define MBEDTLS_PLATFORM_EXIT_ALT +//#define MBEDTLS_PLATFORM_TIME_ALT +//#define MBEDTLS_PLATFORM_FPRINTF_ALT +//#define MBEDTLS_PLATFORM_PRINTF_ALT +//#define MBEDTLS_PLATFORM_SNPRINTF_ALT +//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT +//#define MBEDTLS_PLATFORM_NV_SEED_ALT +//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT + +/** + * \def MBEDTLS_DEPRECATED_WARNING + * + * Mark deprecated functions and features so that they generate a warning if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * This only works with GCC and Clang. With other compilers, you may want to + * use MBEDTLS_DEPRECATED_REMOVED + * + * Uncomment to get warnings on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_WARNING + +/** + * \def MBEDTLS_DEPRECATED_REMOVED + * + * Remove deprecated functions and features so that they generate an error if + * used. Functionality deprecated in one version will usually be removed in the + * next version. You can enable this to help you prepare the transition to a + * new major version by making sure your code is not using this functionality. + * + * Uncomment to get errors on using deprecated functions and features. + */ +//#define MBEDTLS_DEPRECATED_REMOVED + +/** + * \def MBEDTLS_CHECK_PARAMS + * + * This configuration option controls whether the library validates more of + * the parameters passed to it. + * + * When this flag is not defined, the library only attempts to validate an + * input parameter if: (1) they may come from the outside world (such as the + * network, the filesystem, etc.) or (2) not validating them could result in + * internal memory errors such as overflowing a buffer controlled by the + * library. On the other hand, it doesn't attempt to validate parameters whose + * values are fully controlled by the application (such as pointers). + * + * When this flag is defined, the library additionally attempts to validate + * parameters that are fully controlled by the application, and should always + * be valid if the application code is fully correct and trusted. + * + * For example, when a function accepts as input a pointer to a buffer that may + * contain untrusted data, and its documentation mentions that this pointer + * must not be NULL: + * - The pointer is checked to be non-NULL only if this option is enabled. + * - The content of the buffer is always validated. + * + * When this flag is defined, if a library function receives a parameter that + * is invalid: + * 1. The function will invoke the macro MBEDTLS_PARAM_FAILED(). + * 2. If MBEDTLS_PARAM_FAILED() did not terminate the program, the function + * will immediately return. If the function returns an Mbed TLS error code, + * the error code in this case is MBEDTLS_ERR_xxx_BAD_INPUT_DATA. + * + * When defining this flag, you also need to arrange a definition for + * MBEDTLS_PARAM_FAILED(). You can do this by any of the following methods: + * - By default, the library defines MBEDTLS_PARAM_FAILED() to call a + * function mbedtls_param_failed(), but the library does not define this + * function. If you do not make any other arrangements, you must provide + * the function mbedtls_param_failed() in your application. + * See `platform_util.h` for its prototype. + * - If you enable the macro #MBEDTLS_CHECK_PARAMS_ASSERT, then the + * library defines MBEDTLS_PARAM_FAILED(\c cond) to be `assert(cond)`. + * You can still supply an alternative definition of + * MBEDTLS_PARAM_FAILED(), which may call `assert`. + * - If you define a macro MBEDTLS_PARAM_FAILED() before including `config.h` + * or you uncomment the definition of MBEDTLS_PARAM_FAILED() in `config.h`, + * the library will call the macro that you defined and will not supply + * its own version. Note that if MBEDTLS_PARAM_FAILED() calls `assert`, + * you need to enable #MBEDTLS_CHECK_PARAMS_ASSERT so that library source + * files include ``. + * + * Uncomment to enable validation of application-controlled parameters. + */ +//#define MBEDTLS_CHECK_PARAMS + +/** + * \def MBEDTLS_CHECK_PARAMS_ASSERT + * + * Allow MBEDTLS_PARAM_FAILED() to call `assert`, and make it default to + * `assert`. This macro is only used if #MBEDTLS_CHECK_PARAMS is defined. + * + * If this macro is not defined, then MBEDTLS_PARAM_FAILED() defaults to + * calling a function mbedtls_param_failed(). See the documentation of + * #MBEDTLS_CHECK_PARAMS for details. + * + * Uncomment to allow MBEDTLS_PARAM_FAILED() to call `assert`. + */ +//#define MBEDTLS_CHECK_PARAMS_ASSERT + +/* \} name SECTION: System support */ + +/** + * \name SECTION: mbed TLS feature support + * + * This section sets support for features that are or are not needed + * within the modules that are enabled. + * \{ + */ + +/** + * \def MBEDTLS_TIMING_ALT + * + * Uncomment to provide your own alternate implementation for mbedtls_timing_hardclock(), + * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay() + * + * Only works if you have MBEDTLS_TIMING_C enabled. + * + * You will need to provide a header "timing_alt.h" and an implementation at + * compile time. + */ +//#define MBEDTLS_TIMING_ALT + +/** + * \def MBEDTLS_AES_ALT + * + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternate core implementation of a symmetric crypto, an arithmetic or hash + * module (e.g. platform specific assembly optimized implementations). Keep + * in mind that the function prototypes should remain the same. + * + * This replaces the whole module. If you only want to replace one of the + * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer + * provide the "struct mbedtls_aes_context" definition and omit the base + * function declarations and implementations. "aes_alt.h" will be included from + * "aes.h" to include the new function definitions. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * module. + * + * \warning MD2, MD4, MD5, ARC4, DES and SHA-1 are considered weak and their + * use constitutes a security risk. If possible, we recommend + * avoiding dependencies on them, and considering stronger message + * digests and ciphers instead. + * + */ +#ifndef __ZEPHYR__ +//#define MBEDTLS_AES_ALT +#define MBEDTLS_AES_CTX_ALT +//#define MBEDTLS_AES_XTS_ALT +//#define MBEDTLS_ARC4_ALT +//#define MBEDTLS_ARIA_ALT +//#define MBEDTLS_BLOWFISH_ALT +//#define MBEDTLS_CAMELLIA_ALT +//#define MBEDTLS_CCM_ALT +//#define MBEDTLS_CHACHA20_ALT +//#define MBEDTLS_CHACHAPOLY_ALT +//#define MBEDTLS_CMAC_ALT +#define MBEDTLS_CTR_DRBG_ALT +#define MBEDTLS_AES_CMAC_ALT +//#define MBEDTLS_DES_ALT +//#define MBEDTLS_DHM_ALT +//#define MBEDTLS_ECJPAKE_ALT +//#define MBEDTLS_GCM_ALT +//#define MBEDTLS_AES_GCM_ALT +//#define MBEDTLS_NIST_KW_ALT +//#define MBEDTLS_MD2_ALT +//#define MBEDTLS_MD4_ALT +//#define MBEDTLS_MD5_ALT +//#define MBEDTLS_POLY1305_ALT +//#define MBEDTLS_RIPEMD160_ALT +//#define MBEDTLS_RSA_ALT +#define MBEDTLS_RSA_CTX_ALT +#define MBEDTLS_RSA_PUBLIC_ALT +#define MBEDTLS_RSA_PRIVATE_ALT +//#define MBEDTLS_SHA1_ALT +//#define MBEDTLS_SHA256_ALT +#define MBEDTLS_SHA256_CTX_ALT +#define MBEDTLS_SHA256_STARTS_ALT +#define MBEDTLS_SHA256_UPDATE_ALT +#define MBEDTLS_SHA256_FINISH_ALT +#define MBEDTLS_SHA256_FULL_ALT +//#define MBEDTLS_SHA512_ALT +#define MBEDTLS_SHA512_CTX_ALT +#define MBEDTLS_SHA512_STARTS_ALT +#define MBEDTLS_SHA512_UPDATE_ALT +#define MBEDTLS_SHA512_FINISH_ALT +#define MBEDTLS_SHA512_FULL_ALT +//#define MBEDTLS_XTEA_ALT + +/* + * When replacing the elliptic curve module, pleace consider, that it is + * implemented with two .c files: + * - ecp.c + * - ecp_curves.c + * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT + * macros as described above. The only difference is that you have to make sure + * that you provide functionality for both .c files. + */ +//#define MBEDTLS_ECP_ALT + +/** + * \def MBEDTLS_MD2_PROCESS_ALT + * + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you + * alternate core implementation of symmetric crypto or hash function. Keep in + * mind that function prototypes should remain the same. + * + * This replaces only one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. + * + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will + * no longer provide the mbedtls_sha1_process() function, but it will still provide + * the other function (using your mbedtls_sha1_process() function) and the definition + * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible + * with this definition. + * + * \note Because of a signature change, the core AES encryption and decryption routines are + * currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt, + * respectively. When setting up alternative implementations, these functions should + * be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt + * must stay untouched. + * + * \note If you use the AES_xxx_ALT macros, then is is recommended to also set + * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES + * tables. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + * + * \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use + * constitutes a security risk. If possible, we recommend avoiding + * dependencies on them, and considering stronger message digests + * and ciphers instead. + * + * \warning If both MBEDTLS_ECDSA_SIGN_ALT and MBEDTLS_ECDSA_DETERMINISTIC are + * enabled, then the deterministic ECDH signature functions pass the + * the static HMAC-DRBG as RNG to mbedtls_ecdsa_sign(). Therefore + * alternative implementations should use the RNG only for generating + * the ephemeral key and nothing else. If this is not possible, then + * MBEDTLS_ECDSA_DETERMINISTIC should be disabled and an alternative + * implementation should be provided for mbedtls_ecdsa_sign_det_ext() + * (and for mbedtls_ecdsa_sign_det() too if backward compatibility is + * desirable). + * + */ +//#define MBEDTLS_MD2_PROCESS_ALT +//#define MBEDTLS_MD4_PROCESS_ALT +//#define MBEDTLS_MD5_PROCESS_ALT +//#define MBEDTLS_RIPEMD160_PROCESS_ALT +//#define MBEDTLS_SHA1_PROCESS_ALT +#define MBEDTLS_SHA256_PROCESS_ALT +#define MBEDTLS_SHA512_PROCESS_ALT +//#define MBEDTLS_DES_SETKEY_ALT +//#define MBEDTLS_DES_CRYPT_ECB_ALT +//#define MBEDTLS_DES3_CRYPT_ECB_ALT +#define MBEDTLS_AES_SETKEY_ENC_ALT +#define MBEDTLS_AES_SETKEY_DEC_ALT +#define MBEDTLS_AES_ENCRYPT_ALT +#define MBEDTLS_AES_DECRYPT_ALT +#define MBEDTLS_AES_GCM_SETKEY_ALT +#define MBEDTLS_AES_GCM_STARTS_ALT +#define MBEDTLS_AES_GCM_UPDATE_ALT +#define MBEDTLS_AES_GCM_FINISH_ALT +#define MBEDTLS_AES_CBC_ALT +#define MBEDTLS_AES_CTR_ALT +#define MBEDTLS_ECDH_GEN_PUBLIC_ALT +#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT +//#define MBEDTLS_ECP_RESTARTABLE +#define MBEDTLS_ECDH_CANDO_ALT +#define MBEDTLS_ECDSA_VERIFY_ALT +#define MBEDTLS_ECDSA_SIGN_ALT +#define MBEDTLS_ECDSA_GENKEY_ALT +#endif + +/** + * \def MBEDTLS_ECP_INTERNAL_ALT + * + * Expose a part of the internal interface of the Elliptic Curve Point module. + * + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your + * alternative core implementation of elliptic curve arithmetic. Keep in mind + * that function prototypes should remain the same. + * + * This partially replaces one function. The header file from mbed TLS is still + * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation + * is still present and it is used for group structures not supported by the + * alternative. + * + * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT + * and implementing the following functions: + * unsigned char mbedtls_internal_ecp_grp_capable( + * const mbedtls_ecp_group *grp ) + * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp ) + * void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp ) + * The mbedtls_internal_ecp_grp_capable function should return 1 if the + * replacement functions implement arithmetic for the given group and 0 + * otherwise. + * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_free are + * called before and after each point operation and provide an opportunity to + * implement optimized set up and tear down instructions. + * + * Example: In case you uncomment MBEDTLS_ECP_INTERNAL_ALT and + * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac + * function, but will use your mbedtls_internal_ecp_double_jac if the group is + * supported (your mbedtls_internal_ecp_grp_capable function returns 1 when + * receives it as an argument). If the group is not supported then the original + * implementation is used. The other functions and the definition of + * mbedtls_ecp_group and mbedtls_ecp_point will not change, so your + * implementation of mbedtls_internal_ecp_double_jac and + * mbedtls_internal_ecp_grp_capable must be compatible with this definition. + * + * Uncomment a macro to enable alternate implementation of the corresponding + * function. + */ +/* Required for all the functions in this section */ +//#define MBEDTLS_ECP_INTERNAL_ALT +/* Support for Weierstrass curves with Jacobi representation */ +//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT +//#define MBEDTLS_ECP_ADD_MIXED_ALT +//#define MBEDTLS_ECP_DOUBLE_JAC_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT +//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT +/* Support for curves with Montgomery arithmetic */ +//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT +//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT +//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT + +/** + * \def MBEDTLS_TEST_NULL_ENTROPY + * + * Enables testing and use of mbed TLS without any configured entropy sources. + * This permits use of the library on platforms before an entropy source has + * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the + * MBEDTLS_ENTROPY_NV_SEED switches). + * + * WARNING! This switch MUST be disabled in production builds, and is suitable + * only for development. + * Enabling the switch negates any security provided by the library. + * + * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + */ +//#define MBEDTLS_TEST_NULL_ENTROPY + +#ifndef __ZEPHYR__ +/** + * \def MBEDTLS_ENTROPY_HARDWARE_ALT + * + * Uncomment this macro to let mbed TLS use your own implementation of a + * hardware entropy collector. + * + * Your function must be called \c mbedtls_hardware_poll(), have the same + * prototype as declared in entropy_poll.h, and accept NULL as first argument. + * + * Uncomment to use your own hardware entropy collector. + */ +#define MBEDTLS_ENTROPY_HARDWARE_ALT +#endif + +/** + * \def MBEDTLS_AES_ROM_TABLES + * + * Use precomputed AES tables stored in ROM. + * + * Uncomment this macro to use precomputed AES tables stored in ROM. + * Comment this macro to generate AES tables in RAM at runtime. + * + * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb + * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the + * initialization time before the first AES operation can be performed. + * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c + * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded + * performance if ROM access is slower than RAM access. + * + * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. + * + */ +//#define MBEDTLS_AES_ROM_TABLES + +/** + * \def MBEDTLS_AES_FEWER_TABLES + * + * Use less ROM/RAM for AES tables. + * + * Uncommenting this macro omits 75% of the AES tables from + * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) + * by computing their values on the fly during operations + * (the tables are entry-wise rotations of one another). + * + * Tradeoff: Uncommenting this reduces the RAM / ROM footprint + * by ~6kb but at the cost of more arithmetic operations during + * runtime. Specifically, one has to compare 4 accesses within + * different tables to 4 accesses with additional arithmetic + * operations within the same table. The performance gain/loss + * depends on the system and memory details. + * + * This option is independent of \c MBEDTLS_AES_ROM_TABLES. + * + */ +//#define MBEDTLS_AES_FEWER_TABLES + +/** + * \def MBEDTLS_CAMELLIA_SMALL_MEMORY + * + * Use less ROM for the Camellia implementation (saves about 768 bytes). + * + * Uncomment this macro to use less memory for Camellia. + */ +//#define MBEDTLS_CAMELLIA_SMALL_MEMORY + +/** + * \def MBEDTLS_CIPHER_MODE_CBC + * + * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CBC + +/** + * \def MBEDTLS_CIPHER_MODE_CFB + * + * Enable Cipher Feedback mode (CFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CFB + +/** + * \def MBEDTLS_CIPHER_MODE_CTR + * + * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_CTR + +/** + * \def MBEDTLS_CIPHER_MODE_OFB + * + * Enable Output Feedback mode (OFB) for symmetric ciphers. + */ +#define MBEDTLS_CIPHER_MODE_OFB + +/** + * \def MBEDTLS_CIPHER_MODE_XTS + * + * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. + */ +#define MBEDTLS_CIPHER_MODE_XTS + +/** + * \def MBEDTLS_CIPHER_NULL_CIPHER + * + * Enable NULL cipher. + * Warning: Only do so when you know what you are doing. This allows for + * encryption or channels without any security! + * + * Requires MBEDTLS_ENABLE_WEAK_CIPHERSUITES as well to enable + * the following ciphersuites: + * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_WITH_NULL_SHA + * MBEDTLS_TLS_RSA_WITH_NULL_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA + * MBEDTLS_TLS_PSK_WITH_NULL_SHA384 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA256 + * MBEDTLS_TLS_PSK_WITH_NULL_SHA + * + * Uncomment this macro to enable the NULL cipher and ciphersuites + */ +//#define MBEDTLS_CIPHER_NULL_CIPHER + +/** + * \def MBEDTLS_CIPHER_PADDING_PKCS7 + * + * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for + * specific padding modes in the cipher layer with cipher modes that support + * padding (e.g. CBC) + * + * If you disable all padding modes, only full blocks can be used with CBC. + * + * Enable padding modes in the cipher layer. + */ +#define MBEDTLS_CIPHER_PADDING_PKCS7 +#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS +#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN +#define MBEDTLS_CIPHER_PADDING_ZEROS + +/** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + * + * Uncomment this macro to use a 128-bit key in the CTR_DRBG module. + * By default, CTR_DRBG uses a 256-bit key. + */ +//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + +/** + * \def MBEDTLS_ENABLE_WEAK_CIPHERSUITES + * + * Enable weak ciphersuites in SSL / TLS. + * Warning: Only do so when you know what you are doing. This allows for + * channels with virtually no security at all! + * + * This enables the following ciphersuites: + * MBEDTLS_TLS_RSA_WITH_DES_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_DES_CBC_SHA + * + * Uncomment this macro to enable weak ciphersuites + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +//#define MBEDTLS_ENABLE_WEAK_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_ARC4_CIPHERSUITES + * + * Remove RC4 ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on RC4 from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible to + * enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including them + * explicitly. + * + * Uncomment this macro to remove RC4 ciphersuites by default. + */ +#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES + +/** + * \def MBEDTLS_REMOVE_3DES_CIPHERSUITES + * + * Remove 3DES ciphersuites by default in SSL / TLS. + * This flag removes the ciphersuites based on 3DES from the default list as + * returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible + * to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including + * them explicitly. + * + * A man-in-the-browser attacker can recover authentication tokens sent through + * a TLS connection using a 3DES based cipher suite (see "On the Practical + * (In-)Security of 64-bit Block Ciphers" by Karthikeyan Bhargavan and GaĆ«tan + * Leurent, see https://sweet32.info/SWEET32_CCS16.pdf). If this attack falls + * in your threat model or you are unsure, then you should keep this option + * enabled to remove 3DES based cipher suites. + * + * Comment this macro to keep 3DES in the default ciphersuite list. + */ +#define MBEDTLS_REMOVE_3DES_CIPHERSUITES + +/** + * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED + * + * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve + * module. By default all supported curves are enabled. + * + * Comment macros to disable the curve and functions for it + */ +/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */ +#define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#define MBEDTLS_ECP_DP_SECP224R1_ENABLED +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#define MBEDTLS_ECP_DP_SECP224K1_ENABLED +#define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#define MBEDTLS_ECP_DP_BP256R1_ENABLED +#define MBEDTLS_ECP_DP_BP384R1_ENABLED +#define MBEDTLS_ECP_DP_BP512R1_ENABLED +/* Montgomery curves (supporting ECP), NOT supported by CSS PKC*/ +//#define MBEDTLS_ECP_DP_CURVE25519_ENABLED +//#define MBEDTLS_ECP_DP_CURVE448_ENABLED + +/** + * \def MBEDTLS_ECP_NIST_OPTIM + * + * Enable specific 'modulo p' routines for each NIST prime. + * Depending on the prime and architecture, makes operations 4 to 8 times + * faster on the corresponding curve. + * + * Comment this macro to disable NIST curves optimisation. + */ +#define MBEDTLS_ECP_NIST_OPTIM + +/** + * \def MBEDTLS_ECP_NO_INTERNAL_RNG + * + * When this option is disabled, mbedtls_ecp_mul() will make use of an + * internal RNG when called with a NULL \c f_rng argument, in order to protect + * against some side-channel attacks. + * + * This protection introduces a dependency of the ECP module on one of the + * DRBG modules. For very constrained implementations that don't require this + * protection (for example, because you're only doing signature verification, + * so not manipulating any secret, or because local/physical side-channel + * attacks are outside your threat model), it might be desirable to get rid of + * that dependency. + * + * \warning Enabling this option makes some uses of ECP vulnerable to some + * side-channel attacks. Only enable it if you know that's not a problem for + * your use case. + * + * Uncomment this macro to disable some counter-measures in ECP. + */ +//#define MBEDTLS_ECP_NO_INTERNAL_RNG + +/** + * \def MBEDTLS_ECP_RESTARTABLE + * + * Enable "non-blocking" ECC operations that can return early and be resumed. + * + * This allows various functions to pause by returning + * #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module, + * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in + * order to further progress and eventually complete their operation. This is + * controlled through mbedtls_ecp_set_max_ops() which limits the maximum + * number of ECC operations a function may perform before pausing; see + * mbedtls_ecp_set_max_ops() for more information. + * + * This is useful in non-threaded environments if you want to avoid blocking + * for too long on ECC (and, hence, X.509 or SSL/TLS) operations. + * + * Uncomment this macro to enable restartable ECC computations. + * + * \note This option only works with the default software implementation of + * elliptic curve functionality. It is incompatible with + * MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT, MBEDTLS_ECDSA_XXX_ALT + * and MBEDTLS_ECDH_LEGACY_CONTEXT. + */ +//#define MBEDTLS_ECP_RESTARTABLE + +/** + * \def MBEDTLS_ECDH_LEGACY_CONTEXT + * + * Use a backward compatible ECDH context. + * + * Mbed TLS supports two formats for ECDH contexts (#mbedtls_ecdh_context + * defined in `ecdh.h`). For most applications, the choice of format makes + * no difference, since all library functions can work with either format, + * except that the new format is incompatible with MBEDTLS_ECP_RESTARTABLE. + + * The new format used when this option is disabled is smaller + * (56 bytes on a 32-bit platform). In future versions of the library, it + * will support alternative implementations of ECDH operations. + * The new format is incompatible with applications that access + * context fields directly and with restartable ECP operations. + * + * Define this macro if you enable MBEDTLS_ECP_RESTARTABLE or if you + * want to access ECDH context fields directly. Otherwise you should + * comment out this macro definition. + * + * This option has no effect if #MBEDTLS_ECDH_C is not enabled. + * + * \note This configuration option is experimental. Future versions of the + * library may modify the way the ECDH context layout is configured + * and may modify the layout of the new context type. + */ +#ifdef MBEDTLS_ECDH_LEGACY_CONTEXT +#undef MBEDTLS_ECDH_LEGACY_CONTEXT +#endif + +/** + * \def MBEDTLS_ECDSA_DETERMINISTIC + * + * Enable deterministic ECDSA (RFC 6979). + * Standard ECDSA is "fragile" in the sense that lack of entropy when signing + * may result in a compromise of the long-term signing key. This is avoided by + * the deterministic variant. + * + * Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C + * + * Comment this macro to disable deterministic ECDSA. + */ +#define MBEDTLS_ECDSA_DETERMINISTIC + +/** + * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + * + * Enable the PSK based ciphersuite modes in SSL / TLS. + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + * + * Enable the DHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + * + * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + * + * Enable the RSA-PSK based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + * + * Enable the RSA-only based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + */ +#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + * + * Enable the DHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + * + * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15, + * MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + * + * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C, + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + */ +#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + * + * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_ECDSA_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + * + * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS. + * + * Requires: MBEDTLS_ECDH_C, MBEDTLS_RSA_C, MBEDTLS_X509_CRT_PARSE_C + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + */ +#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED + +/** + * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + * + * Enable the ECJPAKE based ciphersuite modes in SSL / TLS. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Requires: MBEDTLS_ECJPAKE_C + * MBEDTLS_SHA256_C + * MBEDTLS_ECP_DP_SECP256R1_ENABLED + * + * This enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 + */ +//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED + +/** + * \def MBEDTLS_PK_PARSE_EC_EXTENDED + * + * Enhance support for reading EC keys using variants of SEC1 not allowed by + * RFC 5915 and RFC 5480. + * + * Currently this means parsing the SpecifiedECDomain choice of EC + * parameters (only known groups are supported, not arbitrary domains, to + * avoid validation issues). + * + * Disable if you only need to support RFC 5915 + 5480 key formats. + */ +#define MBEDTLS_PK_PARSE_EC_EXTENDED + +/** + * \def MBEDTLS_ERROR_STRERROR_DUMMY + * + * Enable a dummy error function to make use of mbedtls_strerror() in + * third party libraries easier when MBEDTLS_ERROR_C is disabled + * (no effect when MBEDTLS_ERROR_C is enabled). + * + * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're + * not using mbedtls_strerror() or error_strerror() in your application. + * + * Disable if you run into name conflicts and want to really remove the + * mbedtls_strerror() + */ +#define MBEDTLS_ERROR_STRERROR_DUMMY + +/** + * \def MBEDTLS_GENPRIME + * + * Enable the prime-number generation code. + * + * Requires: MBEDTLS_BIGNUM_C + */ +#define MBEDTLS_GENPRIME + +/** + * \def MBEDTLS_FS_IO + * + * Enable functions that use the filesystem. + */ +//#define MBEDTLS_FS_IO + +/** + * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + * + * Do not add default entropy sources. These are the platform specific, + * mbedtls_timing_hardclock and HAVEGE based poll functions. + * + * This is useful to have more control over the added entropy sources in an + * application. + * + * Uncomment this macro to prevent loading of default entropy functions. + */ +//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + +/** + * \def MBEDTLS_NO_PLATFORM_ENTROPY + * + * Do not use built-in platform entropy functions. + * This is useful if your platform does not support + * standards like the /dev/urandom or Windows CryptoAPI. + * + * Uncomment this macro to disable the built-in platform entropy functions. + */ +#define MBEDTLS_NO_PLATFORM_ENTROPY + +/** + * \def MBEDTLS_ENTROPY_FORCE_SHA256 + * + * Force the entropy accumulator to use a SHA-256 accumulator instead of the + * default SHA-512 based one (if both are available). + * + * Requires: MBEDTLS_SHA256_C + * + * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option + * if you have performance concerns. + * + * This option is only useful if both MBEDTLS_SHA256_C and + * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. + */ +//#define MBEDTLS_ENTROPY_FORCE_SHA256 + +/** + * \def MBEDTLS_ENTROPY_NV_SEED + * + * Enable the non-volatile (NV) seed file-based entropy source. + * (Also enables the NV seed read/write functions in the platform layer) + * + * This is crucial (if not required) on systems that do not have a + * cryptographic entropy source (in hardware or kernel) available. + * + * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C + * + * \note The read/write functions that are used by the entropy source are + * determined in the platform layer, and can be modified at runtime and/or + * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. + * + * \note If you use the default implementation functions that read a seedfile + * with regular fopen(), please make sure you make a seedfile with the + * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at + * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from + * and written to or you will get an entropy source error! The default + * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE + * bytes from the file. + * + * \note The entropy collector will write to the seed file before entropy is + * given to an external source, to update it. + */ +//#define MBEDTLS_ENTROPY_NV_SEED + +/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + * + * Enable key identifiers that encode a key owner identifier. + * + * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t + * which is currently hard-coded to be int32_t. + * + * Note that this option is meant for internal use only and may be removed + * without notice. It is incompatible with MBEDTLS_USE_PSA_CRYPTO. + */ +//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +/** + * \def MBEDTLS_MEMORY_DEBUG + * + * Enable debugging of buffer allocator memory issues. Automatically prints + * (to stderr) all (fatal) messages on memory allocation issues. Enables + * function for 'debug output' of allocated memory. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Uncomment this macro to let the buffer allocator print out error messages. + */ +//#define MBEDTLS_MEMORY_DEBUG + +/** + * \def MBEDTLS_MEMORY_BACKTRACE + * + * Include backtrace information with each allocated block. + * + * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C + * GLIBC-compatible backtrace() an backtrace_symbols() support + * + * Uncomment this macro to include backtrace information + */ +//#define MBEDTLS_MEMORY_BACKTRACE + +/** + * \def MBEDTLS_PK_RSA_ALT_SUPPORT + * + * Support external private RSA keys (eg from a HSM) in the PK layer. + * + * Comment this macro to disable support for external private RSA keys. + */ +#define MBEDTLS_PK_RSA_ALT_SUPPORT + +/** + * \def MBEDTLS_PKCS1_V15 + * + * Enable support for PKCS#1 v1.5 encoding. + * + * Requires: MBEDTLS_RSA_C + * + * This enables support for PKCS#1 v1.5 operations. + */ +#define MBEDTLS_PKCS1_V15 + +/** + * \def MBEDTLS_PKCS1_V21 + * + * Enable support for PKCS#1 v2.1 encoding. + * + * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C + * + * This enables support for RSAES-OAEP and RSASSA-PSS operations. + */ +#define MBEDTLS_PKCS1_V21 + +/** \def MBEDTLS_PSA_CRYPTO_DRIVERS + * + * Enable support for the experimental PSA crypto driver interface. + * + * Requires: MBEDTLS_PSA_CRYPTO_C + * + * \warning This interface is experimental and may change or be removed + * without notice. + */ +//#define MBEDTLS_PSA_CRYPTO_DRIVERS + +/** + * \def MBEDTLS_PSA_CRYPTO_SPM + * + * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure + * Partition Manager) integration which separates the code into two parts: a + * NSPE (Non-Secure Process Environment) and an SPE (Secure Process + * Environment). + * + * Module: library/psa_crypto.c + * Requires: MBEDTLS_PSA_CRYPTO_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SPM + +/** + * \def MBEDTLS_PSA_INJECT_ENTROPY + * + * Enable support for entropy injection at first boot. This feature is + * required on systems that do not have a built-in entropy source (TRNG). + * This feature is currently not supported on systems that have a built-in + * entropy source. + * + * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED + * + */ +//#define MBEDTLS_PSA_INJECT_ENTROPY + +/** + * \def MBEDTLS_RSA_NO_CRT + * + * Do not use the Chinese Remainder Theorem + * for the RSA private operation. + * + * Uncomment this macro to disable the use of CRT in RSA. + * + */ +//#define MBEDTLS_RSA_NO_CRT + +/** + * \def MBEDTLS_SELF_TEST + * + * Enable the checkup functions (*_self_test). + */ +#define MBEDTLS_SELF_TEST + +/** + * \def MBEDTLS_SHA256_SMALLER + * + * Enable an implementation of SHA-256 that has lower ROM footprint but also + * lower performance. + * + * The default implementation is meant to be a reasonnable compromise between + * performance and size. This version optimizes more aggressively for size at + * the expense of performance. Eg on Cortex-M4 it reduces the size of + * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about + * 30%. + * + * Uncomment to enable the smaller implementation of SHA256. + */ +//#define MBEDTLS_SHA256_SMALLER + +/** + * \def MBEDTLS_SHA512_SMALLER + * + * Enable an implementation of SHA-512 that has lower ROM footprint but also + * lower performance. + * + * Uncomment to enable the smaller implementation of SHA512. + */ +//#define MBEDTLS_SHA512_SMALLER + +/** + * \def MBEDTLS_SHA512_NO_SHA384 + * + * Disable the SHA-384 option of the SHA-512 module. Use this to save some + * code size on devices that don't use SHA-384. + * + * Requires: MBEDTLS_SHA512_C + * + * Uncomment to disable SHA-384 + */ +//#define MBEDTLS_SHA512_NO_SHA384 + +/** + * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES + * + * Enable sending of alert messages in case of encountered errors as per RFC. + * If you choose not to send the alert messages, mbed TLS can still communicate + * with other servers, only debugging of failures is harder. + * + * The advantage of not sending alert messages, is that no information is given + * about reasons for failures thus preventing adversaries of gaining intel. + * + * Enable sending of all alert messages + */ +#define MBEDTLS_SSL_ALL_ALERT_MESSAGES + +/** + * \def MBEDTLS_SSL_RECORD_CHECKING + * + * Enable the function mbedtls_ssl_check_record() which can be used to check + * the validity and authenticity of an incoming record, to verify that it has + * not been seen before. These checks are performed without modifying the + * externally visible state of the SSL context. + * + * See mbedtls_ssl_check_record() for more information. + * + * Uncomment to enable support for record checking. + */ +#define MBEDTLS_SSL_RECORD_CHECKING + +/** + * \def MBEDTLS_SSL_DTLS_CONNECTION_ID + * + * Enable support for the DTLS Connection ID extension + * (version draft-ietf-tls-dtls-connection-id-05, + * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05) + * which allows to identify DTLS connections across changes + * in the underlying transport. + * + * Setting this option enables the SSL APIs `mbedtls_ssl_set_cid()`, + * `mbedtls_ssl_get_peer_cid()` and `mbedtls_ssl_conf_cid()`. + * See the corresponding documentation for more information. + * + * \warning The Connection ID extension is still in draft state. + * We make no stability promises for the availability + * or the shape of the API controlled by this option. + * + * The maximum lengths of outgoing and incoming CIDs can be configured + * through the options + * - MBEDTLS_SSL_CID_OUT_LEN_MAX + * - MBEDTLS_SSL_CID_IN_LEN_MAX. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment to enable the Connection ID extension. + */ +//#define MBEDTLS_SSL_DTLS_CONNECTION_ID + +/** + * \def MBEDTLS_SSL_ASYNC_PRIVATE + * + * Enable asynchronous external private key operations in SSL. This allows + * you to configure an SSL connection to call an external cryptographic + * module to perform private key operations instead of performing the + * operation inside the library. + * + */ +//#define MBEDTLS_SSL_ASYNC_PRIVATE + +/** + * \def MBEDTLS_SSL_CONTEXT_SERIALIZATION + * + * Enable serialization of the TLS context structures, through use of the + * functions mbedtls_ssl_context_save() and mbedtls_ssl_context_load(). + * + * This pair of functions allows one side of a connection to serialize the + * context associated with the connection, then free or re-use that context + * while the serialized state is persisted elsewhere, and finally deserialize + * that state to a live context for resuming read/write operations on the + * connection. From a protocol perspective, the state of the connection is + * unaffected, in particular this is entirely transparent to the peer. + * + * Note: this is distinct from TLS session resumption, which is part of the + * protocol and fully visible by the peer. TLS session resumption enables + * establishing new connections associated to a saved session with shorter, + * lighter handshakes, while context serialization is a local optimization in + * handling a single, potentially long-lived connection. + * + * Enabling these APIs makes some SSL structures larger, as 64 extra bytes are + * saved after the handshake to allow for more efficient serialization, so if + * you don't need this feature you'll save RAM by disabling it. + * + * Comment to disable the context serialization APIs. + */ +#define MBEDTLS_SSL_CONTEXT_SERIALIZATION + +/** + * \def MBEDTLS_SSL_DEBUG_ALL + * + * Enable the debug messages in SSL module for all issues. + * Debug messages have been disabled in some places to prevent timing + * attacks due to (unbalanced) debugging function calls. + * + * If you need all error reporting you should enable this during debugging, + * but remove this for production servers that should log as well. + * + * Uncomment this macro to report all debug messages on errors introducing + * a timing side-channel. + * + */ +//#define MBEDTLS_SSL_DEBUG_ALL + +/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC + * + * Enable support for Encrypt-then-MAC, RFC 7366. + * + * This allows peers that both support it to use a more robust protection for + * ciphersuites using CBC, providing deep resistance against timing attacks + * on the padding or underlying cipher. + * + * This only affects CBC ciphersuites, and is useless if none is defined. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Encrypt-then-MAC + */ +#define MBEDTLS_SSL_ENCRYPT_THEN_MAC + +/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET + * + * Enable support for RFC 7627: Session Hash and Extended Master Secret + * Extension. + * + * This was introduced as "the proper fix" to the Triple Handshake familiy of + * attacks, but it is recommended to always use it (even if you disable + * renegotiation), since it actually fixes a more fundamental issue in the + * original SSL/TLS design, and has implications beyond Triple Handshake. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1 or + * MBEDTLS_SSL_PROTO_TLS1_1 or + * MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for Extended Master Secret. + */ +#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET + +/** + * \def MBEDTLS_SSL_FALLBACK_SCSV + * + * Enable support for RFC 7507: Fallback Signaling Cipher Suite Value (SCSV) + * for Preventing Protocol Downgrade Attacks. + * + * For servers, it is recommended to always enable this, unless you support + * only one version of TLS, or know for sure that none of your clients + * implements a fallback strategy. + * + * For clients, you only need this if you're using a fallback strategy, which + * is not recommended in the first place, unless you absolutely need it to + * interoperate with buggy (version-intolerant) servers. + * + * Comment this macro to disable support for FALLBACK_SCSV + */ +#define MBEDTLS_SSL_FALLBACK_SCSV + +/** + * \def MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + * + * This option controls the availability of the API mbedtls_ssl_get_peer_cert() + * giving access to the peer's certificate after completion of the handshake. + * + * Unless you need mbedtls_ssl_peer_cert() in your application, it is + * recommended to disable this option for reduced RAM usage. + * + * \note If this option is disabled, mbedtls_ssl_get_peer_cert() is still + * defined, but always returns \c NULL. + * + * \note This option has no influence on the protection against the + * triple handshake attack. Even if it is disabled, Mbed TLS will + * still ensure that certificates do not change during renegotiation, + * for exaple by keeping a hash of the peer's certificate. + * + * Comment this macro to disable storing the peer's certificate + * after the handshake. + */ +#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE + +/** + * \def MBEDTLS_SSL_HW_RECORD_ACCEL + * + * Enable hooking functions in SSL module for hardware acceleration of + * individual records. + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Uncomment this macro to enable hooking functions. + */ +//#define MBEDTLS_SSL_HW_RECORD_ACCEL + +/** + * \def MBEDTLS_SSL_CBC_RECORD_SPLITTING + * + * Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0. + * + * This is a countermeasure to the BEAST attack, which also minimizes the risk + * of interoperability issues compared to sending 0-length records. + * + * Comment this macro to disable 1/n-1 record splitting. + */ +#define MBEDTLS_SSL_CBC_RECORD_SPLITTING + +/** + * \def MBEDTLS_SSL_RENEGOTIATION + * + * Enable support for TLS renegotiation. + * + * The two main uses of renegotiation are (1) refresh keys on long-lived + * connections and (2) client authentication after the initial handshake. + * If you don't need renegotiation, it's probably better to disable it, since + * it has been associated with security issues in the past and is easy to + * misuse/misunderstand. + * + * Comment this to disable support for renegotiation. + * + * \note Even if this option is disabled, both client and server are aware + * of the Renegotiation Indication Extension (RFC 5746) used to + * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1). + * (See \c mbedtls_ssl_conf_legacy_renegotiation for the + * configuration of this extension). + * + */ +#define MBEDTLS_SSL_RENEGOTIATION + +/** + * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + * + * Enable support for receiving and parsing SSLv2 Client Hello messages for the + * SSL Server module (MBEDTLS_SSL_SRV_C). + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Uncomment this macro to enable support for SSLv2 Client Hello messages. + */ +//#define MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO + +/** + * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + * + * Pick the ciphersuite according to the client's preferences rather than ours + * in the SSL Server module (MBEDTLS_SSL_SRV_C). + * + * Uncomment this macro to respect client's ciphersuite order + */ +//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE + +/** + * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + * + * Enable support for RFC 6066 max_fragment_length extension in SSL. + * + * Comment this macro to disable support for the max_fragment_length extension + */ +#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH + +/** + * \def MBEDTLS_SSL_PROTO_SSL3 + * + * Enable support for SSL 3.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Comment this macro to disable support for SSL 3.0 + */ +//#define MBEDTLS_SSL_PROTO_SSL3 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1 + * + * Enable support for TLS 1.0. + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_1 + * + * Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled). + * + * Requires: MBEDTLS_MD5_C + * MBEDTLS_SHA1_C + * + * Comment this macro to disable support for TLS 1.1 / DTLS 1.0 + */ +#define MBEDTLS_SSL_PROTO_TLS1_1 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_2 + * + * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). + * + * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C + * (Depends on ciphersuites) + * + * Comment this macro to disable support for TLS 1.2 / DTLS 1.2 + */ +#define MBEDTLS_SSL_PROTO_TLS1_2 + +/** + * \def MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL + * + * This macro is used to selectively enable experimental parts + * of the code that contribute to the ongoing development of + * the prototype TLS 1.3 and DTLS 1.3 implementation, and provide + * no other purpose. + * + * \warning TLS 1.3 and DTLS 1.3 aren't yet supported in Mbed TLS, + * and no feature exposed through this macro is part of the + * public API. In particular, features under the control + * of this macro are experimental and don't come with any + * stability guarantees. + * + * Uncomment this macro to enable experimental and partial + * functionality specific to TLS 1.3. + */ +//#define MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL + +/** + * \def MBEDTLS_SSL_PROTO_DTLS + * + * Enable support for DTLS (all available versions). + * + * Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0, + * and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2. + * + * Requires: MBEDTLS_SSL_PROTO_TLS1_1 + * or MBEDTLS_SSL_PROTO_TLS1_2 + * + * Comment this macro to disable support for DTLS + */ +#define MBEDTLS_SSL_PROTO_DTLS + +/** + * \def MBEDTLS_SSL_ALPN + * + * Enable support for RFC 7301 Application Layer Protocol Negotiation. + * + * Comment this macro to disable support for ALPN. + */ +#define MBEDTLS_SSL_ALPN + +/** + * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY + * + * Enable support for the anti-replay mechanism in DTLS. + * + * Requires: MBEDTLS_SSL_TLS_C + * MBEDTLS_SSL_PROTO_DTLS + * + * \warning Disabling this is often a security risk! + * See mbedtls_ssl_conf_dtls_anti_replay() for details. + * + * Comment this to disable anti-replay in DTLS. + */ +#define MBEDTLS_SSL_DTLS_ANTI_REPLAY + +/** + * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Enable support for HelloVerifyRequest on DTLS servers. + * + * This feature is highly recommended to prevent DTLS servers being used as + * amplifiers in DoS attacks against other hosts. It should always be enabled + * unless you know for sure amplification cannot be a problem in the + * environment in which your server operates. + * + * \warning Disabling this can ba a security risk! (see above) + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Comment this to disable support for HelloVerifyRequest. + */ +#define MBEDTLS_SSL_DTLS_HELLO_VERIFY + +/** + * \def MBEDTLS_SSL_DTLS_SRTP + * + * Enable support for negotation of DTLS-SRTP (RFC 5764) + * through the use_srtp extension. + * + * \note This feature provides the minimum functionality required + * to negotiate the use of DTLS-SRTP and to allow the derivation of + * the associated SRTP packet protection key material. + * In particular, the SRTP packet protection itself, as well as the + * demultiplexing of RTP and DTLS packets at the datagram layer + * (see Section 5 of RFC 5764), are not handled by this feature. + * Instead, after successful completion of a handshake negotiating + * the use of DTLS-SRTP, the extended key exporter API + * mbedtls_ssl_conf_export_keys_ext_cb() should be used to implement + * the key exporter described in Section 4.2 of RFC 5764 and RFC 5705 + * (this is implemented in the SSL example programs). + * The resulting key should then be passed to an SRTP stack. + * + * Setting this option enables the runtime API + * mbedtls_ssl_conf_dtls_srtp_protection_profiles() + * through which the supported DTLS-SRTP protection + * profiles can be configured. You must call this API at + * runtime if you wish to negotiate the use of DTLS-SRTP. + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + * + * Uncomment this to enable support for use_srtp extension. + */ +//#define MBEDTLS_SSL_DTLS_SRTP + +/** + * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + * + * Enable server-side support for clients that reconnect from the same port. + * + * Some clients unexpectedly close the connection and try to reconnect using the + * same source port. This needs special support from the server to handle the + * new connection securely, as described in section 4.2.8 of RFC 6347. This + * flag enables that support. + * + * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY + * + * Comment this to disable support for clients reusing the source port. + */ +#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE + +/** + * \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT + * + * Enable support for a limit of records with bad MAC. + * + * See mbedtls_ssl_conf_dtls_badmac_limit(). + * + * Requires: MBEDTLS_SSL_PROTO_DTLS + */ +#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT + +/** + * \def MBEDTLS_SSL_SESSION_TICKETS + * + * Enable support for RFC 5077 session tickets in SSL. + * Client-side, provides full support for session tickets (maintenance of a + * session store remains the responsibility of the application, though). + * Server-side, you also need to provide callbacks for writing and parsing + * tickets, including authenticated encryption and key management. Example + * callbacks are provided by MBEDTLS_SSL_TICKET_C. + * + * Comment this macro to disable support for SSL session tickets + */ +#define MBEDTLS_SSL_SESSION_TICKETS + +/** + * \def MBEDTLS_SSL_EXPORT_KEYS + * + * Enable support for exporting key block and master secret. + * This is required for certain users of TLS, e.g. EAP-TLS. + * + * Comment this macro to disable support for key export + */ +#define MBEDTLS_SSL_EXPORT_KEYS + +/** + * \def MBEDTLS_SSL_SERVER_NAME_INDICATION + * + * Enable support for RFC 6066 server name indication (SNI) in SSL. + * + * Requires: MBEDTLS_X509_CRT_PARSE_C + * + * Comment this macro to disable support for server name indication in SSL + */ +#define MBEDTLS_SSL_SERVER_NAME_INDICATION + +#ifndef __ZEPHYR__ +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC + * + * Enable support for RFC 6066 truncated HMAC in SSL. + * + * Comment this macro to disable support for truncated HMAC in SSL + */ +#define MBEDTLS_SSL_TRUNCATED_HMAC +#endif + +/** + * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + * + * Fallback to old (pre-2.7), non-conforming implementation of the truncated + * HMAC extension which also truncates the HMAC key. Note that this option is + * only meant for a transitory upgrade period and will be removed in a future + * version of the library. + * + * \warning The old implementation is non-compliant and has a security weakness + * (2^80 brute force attack on the HMAC key used for a single, + * uninterrupted connection). This should only be enabled temporarily + * when (1) the use of truncated HMAC is essential in order to save + * bandwidth, and (2) the peer is an Mbed TLS stack that doesn't use + * the fixed implementation yet (pre-2.7). + * + * \deprecated This option is deprecated and will be removed in a + * future version of Mbed TLS. + * + * Uncomment to fallback to old, non-compliant truncated HMAC implementation. + * + * Requires: MBEDTLS_SSL_TRUNCATED_HMAC + */ +//#define MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT + +/** + * \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + * + * Enable modifying the maximum I/O buffer size. + */ +//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + * + * Enable testing of the constant-flow nature of some sensitive functions with + * clang's MemorySanitizer. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires compiling with clang -fsanitize=memory. The test + * suites can then be run normally. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + +/** + * \def MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + * + * Enable testing of the constant-flow nature of some sensitive functions with + * valgrind's memcheck tool. This causes some existing tests to also test + * this non-functional property of the code under test. + * + * This setting requires valgrind headers for building, and is only useful for + * testing if the tests suites are run with valgrind's memcheck. This can be + * done for an individual test suite with 'valgrind ./test_suite_xxx', or when + * using CMake, this can be done for all test suites with 'make memcheck'. + * + * \warning This macro is only used for extended testing; it is not considered + * part of the library's API, so it may change or disappear at any time. + * + * Uncomment to enable testing of the constant-flow nature of selected code. + */ +//#define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + +/** + * \def MBEDTLS_TEST_HOOKS + * + * Enable features for invasive testing such as introspection functions and + * hooks for fault injection. This enables additional unit tests. + * + * Merely enabling this feature should not change the behavior of the product. + * It only adds new code, and new branching points where the default behavior + * is the same as when this feature is disabled. + * However, this feature increases the attack surface: there is an added + * risk of vulnerabilities, and more gadgets that can make exploits easier. + * Therefore this feature must never be enabled in production. + * + * See `docs/architecture/testing/mbed-crypto-invasive-testing.md` for more + * information. + * + * Uncomment to enable invasive tests. + */ +//#define MBEDTLS_TEST_HOOKS + +#ifndef __ZEPHYR__ +/** + * \def MBEDTLS_THREADING_ALT + * + * Provide your own alternate threading implementation. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to allow your own alternate threading implementation. + */ +#define MBEDTLS_THREADING_ALT +#endif +/** + * \def MBEDTLS_THREADING_PTHREAD + * + * Enable the pthread wrapper layer for the threading layer. + * + * Requires: MBEDTLS_THREADING_C + * + * Uncomment this to enable pthread mutexes. + */ +//#define MBEDTLS_THREADING_PTHREAD + +/** + * \def MBEDTLS_USE_PSA_CRYPTO + * + * Make the X.509 and TLS library use PSA for cryptographic operations, and + * enable new APIs for using keys handled by PSA Crypto. + * + * \note Development of this option is currently in progress, and parts of Mbed + * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts + * will still continue to work as usual, so enabling this option should not + * break backwards compatibility. + * + * \warning The PSA Crypto API is in beta stage. While you're welcome to + * experiment using it, incompatible API changes are still possible, and some + * parts may not have reached the same quality as the rest of Mbed TLS yet. + * + * \warning This option enables new Mbed TLS APIs that are dependent on the + * PSA Crypto API, so can't come with the same stability guarantees as the + * rest of the Mbed TLS APIs. You're welcome to experiment with them, but for + * now, access to these APIs is opt-in (via enabling the present option), in + * order to clearly differentiate them from the stable Mbed TLS APIs. + * + * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * Uncomment this to enable internal use of PSA Crypto and new associated APIs. + */ +//#define MBEDTLS_USE_PSA_CRYPTO + +/** + * \def MBEDTLS_PSA_CRYPTO_CONFIG + * + * This setting allows support for cryptographic mechanisms through the PSA + * API to be configured separately from support through the mbedtls API. + * + * Uncomment this to enable use of PSA Crypto configuration settings which + * can be found in include/psa/crypto_config.h. + * + * If you enable this option and write your own configuration file, you must + * include mbedtls/config_psa.h in your configuration file. The default + * provided mbedtls/config.h contains the necessary inclusion. + * + * This feature is still experimental and is not ready for production since + * it is not completed. + */ +//#define MBEDTLS_PSA_CRYPTO_CONFIG + +/** + * \def MBEDTLS_VERSION_FEATURES + * + * Allow run-time checking of compile-time enabled features. Thus allowing users + * to check at run-time if the library is for instance compiled with threading + * support via mbedtls_version_check_feature(). + * + * Requires: MBEDTLS_VERSION_C + * + * Comment this to disable run-time checking and save ROM space + */ +#define MBEDTLS_VERSION_FEATURES + +/** + * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an extension in a v1 or v2 certificate. + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 + +/** + * \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + * + * If set, the X509 parser will not break-off when parsing an X509 certificate + * and encountering an unknown critical extension. + * + * \warning Depending on your PKI use, enabling this can be a security risk! + * + * Uncomment to prevent an error. + */ +//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION + +/** + * \def MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + * + * If set, this enables the X.509 API `mbedtls_x509_crt_verify_with_ca_cb()` + * and the SSL API `mbedtls_ssl_conf_ca_cb()` which allow users to configure + * the set of trusted certificates through a callback instead of a linked + * list. + * + * This is useful for example in environments where a large number of trusted + * certificates is present and storing them in a linked list isn't efficient + * enough, or when the set of trusted certificates changes frequently. + * + * See the documentation of `mbedtls_x509_crt_verify_with_ca_cb()` and + * `mbedtls_ssl_conf_ca_cb()` for more information. + * + * Uncomment to enable trusted certificate callbacks. + */ +//#define MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK + +/** + * \def MBEDTLS_X509_CHECK_KEY_USAGE + * + * Enable verification of the keyUsage extension (CA and leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused + * (intermediate) CA and leaf certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip keyUsage checking for both CA and leaf certificates. + */ +#define MBEDTLS_X509_CHECK_KEY_USAGE + +/** + * \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + * + * Enable verification of the extendedKeyUsage extension (leaf certificates). + * + * Disabling this avoids problems with mis-issued and/or misused certificates. + * + * \warning Depending on your PKI use, disabling this can be a security risk! + * + * Comment to skip extendedKeyUsage checking for certificates. + */ +#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + +/** + * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT + * + * Enable parsing and verification of X.509 certificates, CRLs and CSRS + * signed with RSASSA-PSS (aka PKCS#1 v2.1). + * + * Comment this macro to disallow using RSASSA-PSS in certificates. + */ +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT + +/** + * \def MBEDTLS_ZLIB_SUPPORT + * + * If set, the SSL/TLS module uses ZLIB to support compression and + * decompression of packet data. + * + * \warning TLS-level compression MAY REDUCE SECURITY! See for example the + * CRIME attack. Before enabling this option, you should examine with care if + * CRIME or similar exploits may be applicable to your use case. + * + * \note Currently compression can't be used with DTLS. + * + * \deprecated This feature is deprecated and will be removed + * in the next major revision of the library. + * + * Used in: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This feature requires zlib library and headers to be present. + * + * Uncomment to enable use of ZLIB + */ +//#define MBEDTLS_ZLIB_SUPPORT +/* \} name SECTION: mbed TLS feature support */ + +/** + * \name SECTION: mbed TLS modules + * + * This section enables or disables entire modules in mbed TLS + * \{ + */ + +/** + * \def MBEDTLS_AESNI_C + * + * Enable AES-NI support on x86-64. + * + * Module: library/aesni.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the AES-NI instructions on x86-64 + */ +#define MBEDTLS_AESNI_C + +/** + * \def MBEDTLS_AES_C + * + * Enable the AES block cipher. + * + * Module: library/aes.c + * Caller: library/cipher.c + * library/pem.c + * library/ctr_drbg.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA + * + * PEM_PARSE uses AES for decrypting encrypted keys. + */ +#define MBEDTLS_AES_C + +#ifndef __ZEPHYR__ +/** + * \def MBEDTLS_ARC4_C + * + * Enable the ARCFOUR stream cipher. + * + * Module: library/arc4.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + * MBEDTLS_TLS_RSA_WITH_RC4_128_MD5 + * MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA + * MBEDTLS_TLS_PSK_WITH_RC4_128_SHA + * + * \warning ARC4 is considered a weak cipher and its use constitutes a + * security risk. If possible, we recommend avoidng dependencies on + * it, and considering stronger ciphers instead. + * + */ +#define MBEDTLS_ARC4_C +#endif + +/** + * \def MBEDTLS_ASN1_PARSE_C + * + * Enable the generic ASN1 parser. + * + * Module: library/asn1.c + * Caller: library/x509.c + * library/dhm.c + * library/pkcs12.c + * library/pkcs5.c + * library/pkparse.c + */ +#define MBEDTLS_ASN1_PARSE_C + +/** + * \def MBEDTLS_ASN1_WRITE_C + * + * Enable the generic ASN1 writer. + * + * Module: library/asn1write.c + * Caller: library/ecdsa.c + * library/pkwrite.c + * library/x509_create.c + * library/x509write_crt.c + * library/x509write_csr.c + */ +#define MBEDTLS_ASN1_WRITE_C + +/** + * \def MBEDTLS_BASE64_C + * + * Enable the Base64 module. + * + * Module: library/base64.c + * Caller: library/pem.c + * + * This module is required for PEM support (required by X.509). + */ +#define MBEDTLS_BASE64_C + +/** + * \def MBEDTLS_BIGNUM_C + * + * Enable the multi-precision integer library. + * + * Module: library/bignum.c + * Caller: library/dhm.c + * library/ecp.c + * library/ecdsa.c + * library/rsa.c + * library/rsa_internal.c + * library/ssl_tls.c + * + * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support. + */ +#define MBEDTLS_BIGNUM_C + +/** + * \def MBEDTLS_BLOWFISH_C + * + * Enable the Blowfish block cipher. + * + * Module: library/blowfish.c + */ +#define MBEDTLS_BLOWFISH_C + +/** + * \def MBEDTLS_CAMELLIA_C + * + * Enable the Camellia block cipher. + * + * Module: library/camellia.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256 + */ +//#define MBEDTLS_CAMELLIA_C + +/** + * \def MBEDTLS_ARIA_C + * + * Enable the ARIA block cipher. + * + * Module: library/aria.c + * Caller: library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * + * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 + * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 + * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 + * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 + */ +//#define MBEDTLS_ARIA_C + +/** + * \def MBEDTLS_CCM_C + * + * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. + * + * Module: library/ccm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C + * + * This module enables the AES-CCM ciphersuites, if other requisites are + * enabled as well. + */ +#define MBEDTLS_CCM_C + +/** + * \def MBEDTLS_CERTS_C + * + * Enable the test certificates. + * + * Module: library/certs.c + * Caller: + * + * This module is used for testing (ssl_client/server). + */ +#define MBEDTLS_CERTS_C + +/** + * \def MBEDTLS_CHACHA20_C + * + * Enable the ChaCha20 stream cipher. + * + * Module: library/chacha20.c + */ +//#define MBEDTLS_CHACHA20_C + +/** + * \def MBEDTLS_CHACHAPOLY_C + * + * Enable the ChaCha20-Poly1305 AEAD algorithm. + * + * Module: library/chachapoly.c + * + * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C + */ +//#define MBEDTLS_CHACHAPOLY_C + +/** + * \def MBEDTLS_CIPHER_C + * + * Enable the generic cipher layer. + * + * Module: library/cipher.c + * Caller: library/ssl_tls.c + * + * Uncomment to enable generic cipher wrappers. + */ +#define MBEDTLS_CIPHER_C + +/** + * \def MBEDTLS_CMAC_C + * + * Enable the CMAC (Cipher-based Message Authentication Code) mode for block + * ciphers. + * + * Module: library/cmac.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_DES_C + * + */ +#define MBEDTLS_CMAC_C + +/** + * \def MBEDTLS_CTR_DRBG_C + * + * Enable the CTR_DRBG AES-based random generator. + * The CTR_DRBG generator uses AES-256 by default. + * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above. + * + * \note To achieve a 256-bit security strength with CTR_DRBG, + * you must use AES-256 *and* use sufficient entropy. + * See ctr_drbg.h for more details. + * + * Module: library/ctr_drbg.c + * Caller: + * + * Requires: MBEDTLS_AES_C + * + * This module provides the CTR_DRBG AES random number generator. + */ +#define MBEDTLS_CTR_DRBG_C + +/** + * \def MBEDTLS_DEBUG_C + * + * Enable the debug functions. + * + * Module: library/debug.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module provides debugging functions. + */ +//#define MBEDTLS_DEBUG_C + +/** + * \def MBEDTLS_DES_C + * + * Enable the DES block cipher. + * + * Module: library/des.c + * Caller: library/pem.c + * library/cipher.c + * + * This module enables the following ciphersuites (if other requisites are + * enabled as well): + * MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA + * MBEDTLS_TLS_PSK_WITH_3DES_EDE_CBC_SHA + * + * PEM_PARSE uses DES/3DES for decrypting encrypted keys. + * + * \warning DES is considered a weak cipher and its use constitutes a + * security risk. We recommend considering stronger ciphers instead. + */ +#define MBEDTLS_DES_C + +/** + * \def MBEDTLS_DHM_C + * + * Enable the Diffie-Hellman-Merkle module. + * + * Module: library/dhm.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * DHE-RSA, DHE-PSK + * + * \warning Using DHE constitutes a security risk as it + * is not possible to validate custom DH parameters. + * If possible, it is recommended users should consider + * preferring other methods of key exchange. + * See dhm.h for more details. + * + */ +#define MBEDTLS_DHM_C + +/** + * \def MBEDTLS_ECDH_C + * + * Enable the elliptic curve Diffie-Hellman library. + * + * Module: library/ecdh.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK + * + * Requires: MBEDTLS_ECP_C + */ +#define MBEDTLS_ECDH_C + +/** + * \def MBEDTLS_ECDSA_C + * + * Enable the elliptic curve DSA library. + * + * Module: library/ecdsa.c + * Caller: + * + * This module is used by the following key exchanges: + * ECDHE-ECDSA + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C, + * and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a + * short Weierstrass curve. + */ +#define MBEDTLS_ECDSA_C + +/** + * \def MBEDTLS_ECJPAKE_C + * + * Enable the elliptic curve J-PAKE library. + * + * \warning This is currently experimental. EC J-PAKE support is based on the + * Thread v1.0.0 specification; incompatible changes to the specification + * might still happen. For this reason, this is disabled by default. + * + * Module: library/ecjpake.c + * Caller: + * + * This module is used by the following key exchanges: + * ECJPAKE + * + * Requires: MBEDTLS_ECP_C, MBEDTLS_MD_C + */ +//#define MBEDTLS_ECJPAKE_C + +/** + * \def MBEDTLS_ECP_C + * + * Enable the elliptic curve over GF(p) library. + * + * Module: library/ecp.c + * Caller: library/ecdh.c + * library/ecdsa.c + * library/ecjpake.c + * + * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED + */ +#define MBEDTLS_ECP_C + +/** + * \def MBEDTLS_ENTROPY_C + * + * Enable the platform-specific entropy code. + * + * Module: library/entropy.c + * Caller: + * + * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C + * + * This module provides a generic entropy pool + */ +#define MBEDTLS_ENTROPY_C + +/** + * \def MBEDTLS_ERROR_C + * + * Enable error code to error string conversion. + * + * Module: library/error.c + * Caller: + * + * This module enables mbedtls_strerror(). + */ +#define MBEDTLS_ERROR_C + +/** + * \def MBEDTLS_GCM_C + * + * Enable the Galois/Counter Mode (GCM). + * + * Module: library/gcm.c + * + * Requires: MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or MBEDTLS_ARIA_C + * + * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other + * requisites are enabled as well. + */ +#define MBEDTLS_GCM_C + +/** + * \def MBEDTLS_HAVEGE_C + * + * Enable the HAVEGE random generator. + * + * Warning: the HAVEGE random generator is not suitable for virtualized + * environments + * + * Warning: the HAVEGE random generator is dependent on timing and specific + * processor traits. It is therefore not advised to use HAVEGE as + * your applications primary random generator or primary entropy pool + * input. As a secondary input to your entropy pool, it IS able add + * the (limited) extra entropy it provides. + * + * Module: library/havege.c + * Caller: + * + * Requires: MBEDTLS_TIMING_C + * + * Uncomment to enable the HAVEGE random generator. + */ +//#define MBEDTLS_HAVEGE_C + +/** + * \def MBEDTLS_HKDF_C + * + * Enable the HKDF algorithm (RFC 5869). + * + * Module: library/hkdf.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the Hashed Message Authentication Code + * (HMAC)-based key derivation function (HKDF). + */ +#define MBEDTLS_HKDF_C + +/** + * \def MBEDTLS_HMAC_DRBG_C + * + * Enable the HMAC_DRBG random generator. + * + * Module: library/hmac_drbg.c + * Caller: + * + * Requires: MBEDTLS_MD_C + * + * Uncomment to enable the HMAC_DRBG random number geerator. + */ +#define MBEDTLS_HMAC_DRBG_C + +/** + * \def MBEDTLS_NIST_KW_C + * + * Enable the Key Wrapping mode for 128-bit block ciphers, + * as defined in NIST SP 800-38F. Only KW and KWP modes + * are supported. At the moment, only AES is approved by NIST. + * + * Module: library/nist_kw.c + * + * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C + */ +#define MBEDTLS_NIST_KW_C + +/** + * \def MBEDTLS_MD_C + * + * Enable the generic message digest layer. + * + * Module: library/md.c + * Caller: + * + * Uncomment to enable generic message digest wrappers. + */ +#define MBEDTLS_MD_C + +/** + * \def MBEDTLS_MD2_C + * + * Enable the MD2 hash algorithm. + * + * Module: library/md2.c + * Caller: + * + * Uncomment to enable support for (rare) MD2-signed X.509 certs. + * + * \warning MD2 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_MD2_C + +#ifndef __ZEPHYR__ +/** + * \def MBEDTLS_MD4_C + * + * Enable the MD4 hash algorithm. + * + * Module: library/md4.c + * Caller: + * + * Uncomment to enable support for (rare) MD4-signed X.509 certs. + * + * \warning MD4 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_MD4_C +#endif + +/** + * \def MBEDTLS_MD5_C + * + * Enable the MD5 hash algorithm. + * + * Module: library/md5.c + * Caller: library/md.c + * library/pem.c + * library/ssl_tls.c + * + * This module is required for SSL/TLS up to version 1.1, and for TLS 1.2 + * depending on the handshake parameters. Further, it is used for checking + * MD5-signed certificates, and for PBKDF1 when decrypting PEM-encoded + * encrypted keys. + * + * \warning MD5 is considered a weak message digest and its use constitutes a + * security risk. If possible, we recommend avoiding dependencies on + * it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_MD5_C + +/** + * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C + * + * Enable the buffer allocator implementation that makes use of a (stack) + * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() + * calls) + * + * Module: library/memory_buffer_alloc.c + * + * Requires: MBEDTLS_PLATFORM_C + * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) + * + * Enable this module to enable the buffer memory allocator. + */ +//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C + +/** + * \def MBEDTLS_NET_C + * + * Enable the TCP and UDP over IPv6/IPv4 networking routines. + * + * \note This module only works on POSIX/Unix (including Linux, BSD and OS X) + * and Windows. For other platforms, you'll want to disable it, and write your + * own networking callbacks to be passed to \c mbedtls_ssl_set_bio(). + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/net_sockets.c + * + * This module provides networking routines. + */ +//#define MBEDTLS_NET_C + +/** + * \def MBEDTLS_OID_C + * + * Enable the OID database. + * + * Module: library/oid.c + * Caller: library/asn1write.c + * library/pkcs5.c + * library/pkparse.c + * library/pkwrite.c + * library/rsa.c + * library/x509.c + * library/x509_create.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * This modules translates between OIDs and internal values. + */ +#define MBEDTLS_OID_C + +/** + * \def MBEDTLS_PADLOCK_C + * + * Enable VIA Padlock support on x86. + * + * Module: library/padlock.c + * Caller: library/aes.c + * + * Requires: MBEDTLS_HAVE_ASM + * + * This modules adds support for the VIA PadLock on x86. + */ +#define MBEDTLS_PADLOCK_C + +/** + * \def MBEDTLS_PEM_PARSE_C + * + * Enable PEM decoding / parsing. + * + * Module: library/pem.c + * Caller: library/dhm.c + * library/pkparse.c + * library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for decoding / parsing PEM files. + */ +#define MBEDTLS_PEM_PARSE_C + +/** + * \def MBEDTLS_PEM_WRITE_C + * + * Enable PEM encoding / writing. + * + * Module: library/pem.c + * Caller: library/pkwrite.c + * library/x509write_crt.c + * library/x509write_csr.c + * + * Requires: MBEDTLS_BASE64_C + * + * This modules adds support for encoding / writing PEM files. + */ +#define MBEDTLS_PEM_WRITE_C + +/** + * \def MBEDTLS_PK_C + * + * Enable the generic public (asymetric) key layer. + * + * Module: library/pk.c + * Caller: library/ssl_tls.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_RSA_C or MBEDTLS_ECP_C + * + * Uncomment to enable generic public key wrappers. + */ +#define MBEDTLS_PK_C + +/** + * \def MBEDTLS_PK_PARSE_C + * + * Enable the generic public (asymetric) key parser. + * + * Module: library/pkparse.c + * Caller: library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key parse functions. + */ +#define MBEDTLS_PK_PARSE_C + +/** + * \def MBEDTLS_PK_WRITE_C + * + * Enable the generic public (asymetric) key writer. + * + * Module: library/pkwrite.c + * Caller: library/x509write.c + * + * Requires: MBEDTLS_PK_C + * + * Uncomment to enable generic public key write functions. + */ +#define MBEDTLS_PK_WRITE_C + +/** + * \def MBEDTLS_PKCS5_C + * + * Enable PKCS#5 functions. + * + * Module: library/pkcs5.c + * + * Requires: MBEDTLS_MD_C + * + * This module adds support for the PKCS#5 functions. + */ +#define MBEDTLS_PKCS5_C + +/** + * \def MBEDTLS_PKCS11_C + * + * Enable wrapper for PKCS#11 smartcard support via the pkcs11-helper library. + * + * \deprecated This option is deprecated and will be removed in a future + * version of Mbed TLS. + * + * Module: library/pkcs11.c + * Caller: library/pk.c + * + * Requires: MBEDTLS_PK_C + * + * This module enables SSL/TLS PKCS #11 smartcard support. + * Requires the presence of the PKCS#11 helper library (libpkcs11-helper) + */ +//#define MBEDTLS_PKCS11_C + +/** + * \def MBEDTLS_PKCS12_C + * + * Enable PKCS#12 PBE functions. + * Adds algorithms for parsing PKCS#8 encrypted private keys + * + * Module: library/pkcs12.c + * Caller: library/pkparse.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * Can use: MBEDTLS_ARC4_C + * + * This module enables PKCS#12 functions. + */ +#define MBEDTLS_PKCS12_C + +/** + * \def MBEDTLS_PLATFORM_C + * + * Enable the platform abstraction layer that allows you to re-assign + * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). + * + * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT + * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned + * above to be specified at runtime or compile time respectively. + * + * \note This abstraction layer must be enabled on Windows (including MSYS2) + * as other module rely on it for a fixed snprintf implementation. + * + * Module: library/platform.c + * Caller: Most other .c files + * + * This module enables abstraction of common (libc) functions. + */ +#define MBEDTLS_PLATFORM_C + +/** + * \def MBEDTLS_POLY1305_C + * + * Enable the Poly1305 MAC algorithm. + * + * Module: library/poly1305.c + * Caller: library/chachapoly.c + */ +#define MBEDTLS_POLY1305_C + +/** + * \def MBEDTLS_PSA_CRYPTO_C + * + * Enable the Platform Security Architecture cryptography API. + * + * \warning The PSA Crypto API is still beta status. While you're welcome to + * experiment using it, incompatible API changes are still possible, and some + * parts may not have reached the same quality as the rest of Mbed TLS yet. + * + * Module: library/psa_crypto.c + * + * Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C + * + */ +#define MBEDTLS_PSA_CRYPTO_C + +/** + * \def MBEDTLS_PSA_CRYPTO_SE_C + * + * Enable secure element support in the Platform Security Architecture + * cryptography API. + * + * \warning This feature is not yet suitable for production. It is provided + * for API evaluation and testing purposes only. + * + * Module: library/psa_crypto_se.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_C + * + */ +//#define MBEDTLS_PSA_CRYPTO_SE_C + +/** + * \def MBEDTLS_PSA_CRYPTO_STORAGE_C + * + * Enable the Platform Security Architecture persistent key storage. + * + * Module: library/psa_crypto_storage.c + * + * Requires: MBEDTLS_PSA_CRYPTO_C, + * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of + * the PSA ITS interface + */ +//#define MBEDTLS_PSA_CRYPTO_STORAGE_C + +/** + * \def MBEDTLS_PSA_ITS_FILE_C + * + * Enable the emulation of the Platform Security Architecture + * Internal Trusted Storage (PSA ITS) over files. + * + * Module: library/psa_its_file.c + * + * Requires: MBEDTLS_FS_IO + */ +//#define MBEDTLS_PSA_ITS_FILE_C + +/** + * \def MBEDTLS_RIPEMD160_C + * + * Enable the RIPEMD-160 hash algorithm. + * + * Module: library/ripemd160.c + * Caller: library/md.c + * + */ +//#define MBEDTLS_RIPEMD160_C + +/** + * \def MBEDTLS_RSA_C + * + * Enable the RSA public-key cryptosystem. + * + * Module: library/rsa.c + * library/rsa_internal.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509.c + * + * This module is used by the following key exchanges: + * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C + */ +#define MBEDTLS_RSA_C + +/** + * \def MBEDTLS_SHA1_C + * + * Enable the SHA1 cryptographic hash algorithm. + * + * Module: library/sha1.c + * Caller: library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * library/x509write_crt.c + * + * This module is required for SSL/TLS up to version 1.1, for TLS 1.2 + * depending on the handshake parameters, and for SHA1-signed certificates. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_SHA1_C + +#ifdef __ZEPHYR__ +/** + * \def MBEDTLS_SHA224_C + * + * Enable the SHA-224 cryptographic hash algorithm. + * + * Requires: MBEDTLS_SHA256_C. The library does not currently support enabling + * SHA-224 without SHA-256. + * + * Module: library/sha256.c + * Caller: library/md.c + * library/ssl_cookie.c + * + * This module adds support for SHA-224. + */ +#define MBEDTLS_SHA224_C +#endif + +/** + * \def MBEDTLS_SHA256_C + * + * Enable the SHA-224 and SHA-256 cryptographic hash algorithms. + * + * Module: library/sha256.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * This module adds support for SHA-224 and SHA-256. + * This module is required for the SSL/TLS 1.2 PRF function. + */ +#define MBEDTLS_SHA256_C + +/** + * \def MBEDTLS_SHA384_C + * + * Enable the SHA-384 cryptographic hash algorithm. + * + * Requires: MBEDTLS_SHA512_C + * + * Module: library/sha512.c + * Caller: library/md.c + * library/psa_crypto_hash.c + * library/ssl_tls.c + * library/ssl*_client.c + * library/ssl*_server.c + * + * Comment to disable SHA-384 + */ +#define MBEDTLS_SHA384_C + +/** + * \def MBEDTLS_SHA512_C + * + * Enable the SHA-384 and SHA-512 cryptographic hash algorithms. + * + * Module: library/sha512.c + * Caller: library/entropy.c + * library/md.c + * library/ssl_cli.c + * library/ssl_srv.c + * + * This module adds support for SHA-384 and SHA-512. + */ +#define MBEDTLS_SHA512_C + +/** + * \def MBEDTLS_SSL_CACHE_C + * + * Enable simple SSL cache implementation. + * + * Module: library/ssl_cache.c + * Caller: + * + * Requires: MBEDTLS_SSL_CACHE_C + */ +#define MBEDTLS_SSL_CACHE_C + +/** + * \def MBEDTLS_SSL_COOKIE_C + * + * Enable basic implementation of DTLS cookies for hello verification. + * + * Module: library/ssl_cookie.c + * Caller: + */ +#define MBEDTLS_SSL_COOKIE_C + +/** + * \def MBEDTLS_SSL_TICKET_C + * + * Enable an implementation of TLS server-side callbacks for session tickets. + * + * Module: library/ssl_ticket.c + * Caller: + * + * Requires: MBEDTLS_CIPHER_C + */ +#define MBEDTLS_SSL_TICKET_C + +/** + * \def MBEDTLS_SSL_CLI_C + * + * Enable the SSL/TLS client code. + * + * Module: library/ssl_cli.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS client support. + */ +#define MBEDTLS_SSL_CLI_C + +/** + * \def MBEDTLS_SSL_SRV_C + * + * Enable the SSL/TLS server code. + * + * Module: library/ssl_srv.c + * Caller: + * + * Requires: MBEDTLS_SSL_TLS_C + * + * This module is required for SSL/TLS server support. + */ +#define MBEDTLS_SSL_SRV_C + +/** + * \def MBEDTLS_SSL_TLS_C + * + * Enable the generic SSL/TLS code. + * + * Module: library/ssl_tls.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * + * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C + * and at least one of the MBEDTLS_SSL_PROTO_XXX defines + * + * This module is required for SSL/TLS. + */ +#define MBEDTLS_SSL_TLS_C + +#ifndef __ZEPHYR__ +/** + * \def MBEDTLS_THREADING_C + * + * Enable the threading abstraction layer. + * By default mbed TLS assumes it is used in a non-threaded environment or that + * contexts are not shared between threads. If you do intend to use contexts + * between threads, you will need to enable this layer to prevent race + * conditions. See also our Knowledge Base article about threading: + * https://tls.mbed.org/kb/development/thread-safety-and-multi-threading + * + * Module: library/threading.c + * + * This allows different threading implementations (self-implemented or + * provided). + * + * You will have to enable either MBEDTLS_THREADING_ALT or + * MBEDTLS_THREADING_PTHREAD. + * + * Enable this layer to allow use of mutexes within mbed TLS + */ +#define MBEDTLS_THREADING_C +#endif + +/** + * \def MBEDTLS_TIMING_C + * + * Enable the semi-portable timing interface. + * + * \note The provided implementation only works on POSIX/Unix (including Linux, + * BSD and OS X) and Windows. On other platforms, you can either disable that + * module and provide your own implementations of the callbacks needed by + * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide + * your own implementation of the whole module by setting + * \c MBEDTLS_TIMING_ALT in the current file. + * + * \note See also our Knowledge Base article about porting to a new + * environment: + * https://tls.mbed.org/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS + * + * Module: library/timing.c + * Caller: library/havege.c + * + * This module is used by the HAVEGE random number generator. + */ +//#define MBEDTLS_TIMING_C + +/** + * \def MBEDTLS_VERSION_C + * + * Enable run-time version information. + * + * Module: library/version.c + * + * This module provides run-time version information. + */ +#define MBEDTLS_VERSION_C + +/** + * \def MBEDTLS_X509_USE_C + * + * Enable X.509 core for using certificates. + * + * Module: library/x509.c + * Caller: library/x509_crl.c + * library/x509_crt.c + * library/x509_csr.c + * + * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, + * MBEDTLS_PK_PARSE_C + * + * This module is required for the X.509 parsing modules. + */ +#define MBEDTLS_X509_USE_C + +/** + * \def MBEDTLS_X509_CRT_PARSE_C + * + * Enable X.509 certificate parsing. + * + * Module: library/x509_crt.c + * Caller: library/ssl_cli.c + * library/ssl_srv.c + * library/ssl_tls.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 certificate parsing. + */ +#define MBEDTLS_X509_CRT_PARSE_C + +/** + * \def MBEDTLS_X509_CRL_PARSE_C + * + * Enable X.509 CRL parsing. + * + * Module: library/x509_crl.c + * Caller: library/x509_crt.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is required for X.509 CRL parsing. + */ +#define MBEDTLS_X509_CRL_PARSE_C + +/** + * \def MBEDTLS_X509_CSR_PARSE_C + * + * Enable X.509 Certificate Signing Request (CSR) parsing. + * + * Module: library/x509_csr.c + * Caller: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_USE_C + * + * This module is used for reading X.509 certificate request. + */ +#define MBEDTLS_X509_CSR_PARSE_C + +/** + * \def MBEDTLS_X509_CREATE_C + * + * Enable X.509 core for creating certificates. + * + * Module: library/x509_create.c + * + * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C + * + * This module is the basis for creating X.509 certificates and CSRs. + */ +#define MBEDTLS_X509_CREATE_C + +/** + * \def MBEDTLS_X509_CRT_WRITE_C + * + * Enable creating X.509 certificates. + * + * Module: library/x509_crt_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate creation. + */ +#define MBEDTLS_X509_CRT_WRITE_C + +/** + * \def MBEDTLS_X509_CSR_WRITE_C + * + * Enable creating X.509 Certificate Signing Requests (CSR). + * + * Module: library/x509_csr_write.c + * + * Requires: MBEDTLS_X509_CREATE_C + * + * This module is required for X.509 certificate request writing. + */ +#define MBEDTLS_X509_CSR_WRITE_C + +/** + * \def MBEDTLS_XTEA_C + * + * Enable the XTEA block cipher. + * + * Module: library/xtea.c + * Caller: + */ +//#define MBEDTLS_XTEA_C + +/* \} name SECTION: mbed TLS modules */ + +/** + * \name SECTION: Module configuration options + * + * This section allows for the setting of module specific sizes and + * configuration options. The default values are already present in the + * relevant header files and should suffice for the regular use cases. + * + * Our advice is to enable options and change their values here + * only if you have a good reason and know the consequences. + * + * Please check the respective header file for documentation on these + * parameters (to prevent duplicate documentation). + * \{ + */ + +/* MPI / BIGNUM options */ +//#define MBEDTLS_MPI_WINDOW_SIZE 6 /**< Maximum window size used. */ +//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ + +/* CTR_DRBG options */ +//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ +//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* HMAC_DRBG options */ +//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ +//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ +//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ +//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ + +/* ECP options */ +//#define MBEDTLS_ECP_MAX_BITS 521 /**< Maximum bit size of groups */ +//#define MBEDTLS_ECP_WINDOW_SIZE 6 /**< Maximum window size used */ +//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ + +/* Entropy options */ +//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ +//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ +//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */ + +/* Memory buffer allocator options */ +//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ + +/* Platform options */ +//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ + +/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ +/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ +//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ +#ifdef __ZEPHYR__ +#define MBEDTLS_PLATFORM_PRINTF_MACRO printk /**< Default printf macro to use, can be undefined */ +#else +#define MBEDTLS_PLATFORM_PRINTF_MACRO PRINTF /**< Default printf macro to use, can be undefined */ +#endif +/* Note: your snprintf must correctly zero-terminate the buffer! */ +//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ +//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ + +/** + * \brief This macro is invoked by the library when an invalid parameter + * is detected that is only checked with #MBEDTLS_CHECK_PARAMS + * (see the documentation of that option for context). + * + * When you leave this undefined here, the library provides + * a default definition. If the macro #MBEDTLS_CHECK_PARAMS_ASSERT + * is defined, the default definition is `assert(cond)`, + * otherwise the default definition calls a function + * mbedtls_param_failed(). This function is declared in + * `platform_util.h` for the benefit of the library, but + * you need to define in your application. + * + * When you define this here, this replaces the default + * definition in platform_util.h (which no longer declares the + * function mbedtls_param_failed()) and it is your responsibility + * to make sure this macro expands to something suitable (in + * particular, that all the necessary declarations are visible + * from within the library - you can ensure that by providing + * them in this file next to the macro definition). + * If you define this macro to call `assert`, also define + * #MBEDTLS_CHECK_PARAMS_ASSERT so that library source files + * include ``. + * + * Note that you may define this macro to expand to nothing, in + * which case you don't have to worry about declarations or + * definitions. However, you will then be notified about invalid + * parameters only in non-void functions, and void function will + * just silently return early on invalid parameters, which + * partially negates the benefits of enabling + * #MBEDTLS_CHECK_PARAMS in the first place, so is discouraged. + * + * \param cond The expression that should evaluate to true, but doesn't. + */ +//#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) + +/* SSL Cache options */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */ +//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */ + +/* SSL options */ + +/** \def MBEDTLS_SSL_MAX_CONTENT_LEN + * + * Maximum length (in bytes) of incoming and outgoing plaintext fragments. + * + * This determines the size of both the incoming and outgoing TLS I/O buffers + * in such a way that both are capable of holding the specified amount of + * plaintext data, regardless of the protection mechanism used. + * + * To configure incoming and outgoing I/O buffers separately, use + * #MBEDTLS_SSL_IN_CONTENT_LEN and #MBEDTLS_SSL_OUT_CONTENT_LEN, + * which overwrite the value set by this option. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of both + * incoming and outgoing I/O buffers. + */ +#define MBEDTLS_SSL_MAX_CONTENT_LEN (1024 * 8) + +/** \def MBEDTLS_SSL_IN_CONTENT_LEN + * + * Maximum length (in bytes) of incoming plaintext fragments. + * + * This determines the size of the incoming TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option is undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * \note When using a value less than the default of 16KB on the client, it is + * recommended to use the Maximum Fragment Length (MFL) extension to + * inform the server about this limitation. On the server, there + * is no supported, standardized way of informing the client about + * restriction on the maximum size of incoming messages, and unless + * the limitation has been communicated by other means, it is recommended + * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN + * while keeping the default value of 16KB for the incoming buffer. + * + * Uncomment to set the maximum plaintext size of the incoming I/O buffer + * independently of the outgoing I/O buffer. + */ +//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_CID_IN_LEN_MAX + * + * The maximum length of CIDs used for incoming DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_IN_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_OUT_LEN_MAX + * + * The maximum length of CIDs used for outgoing DTLS messages. + * + */ +//#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32 + +/** \def MBEDTLS_SSL_CID_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * when using the Connection ID extension in DTLS 1.2. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + * + */ +//#define MBEDTLS_SSL_CID_PADDING_GRANULARITY 16 + +/** \def MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY + * + * This option controls the use of record plaintext padding + * in TLS 1.3. + * + * The padding will always be chosen so that the length of the + * padded plaintext is a multiple of the value of this option. + * + * Note: A value of \c 1 means that no padding will be used + * for outgoing records. + * + * Note: On systems lacking division instructions, + * a power of two should be preferred. + */ +//#define MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY 1 + +/** \def MBEDTLS_SSL_OUT_CONTENT_LEN + * + * Maximum length (in bytes) of outgoing plaintext fragments. + * + * This determines the size of the outgoing TLS I/O buffer in such a way + * that it is capable of holding the specified amount of plaintext data, + * regardless of the protection mechanism used. + * + * If this option undefined, it inherits its value from + * #MBEDTLS_SSL_MAX_CONTENT_LEN. + * + * It is possible to save RAM by setting a smaller outward buffer, while keeping + * the default inward 16384 byte buffer to conform to the TLS specification. + * + * The minimum required outward buffer size is determined by the handshake + * protocol's usage. Handshaking will fail if the outward buffer is too small. + * The specific size requirement depends on the configured ciphers and any + * certificate data which is sent during the handshake. + * + * Uncomment to set the maximum plaintext size of the outgoing I/O buffer + * independently of the incoming I/O buffer. + */ +//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384 + +/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING + * + * Maximum number of heap-allocated bytes for the purpose of + * DTLS handshake message reassembly and future message buffering. + * + * This should be at least 9/8 * MBEDTLSSL_IN_CONTENT_LEN + * to account for a reassembled handshake message of maximum size, + * together with its reassembly bitmap. + * + * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default) + * should be sufficient for all practical situations as it allows + * to reassembly a large handshake message (such as a certificate) + * while buffering multiple smaller handshake messages. + * + */ +//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768 + +//#define MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME 86400 /**< Lifetime of session tickets (if enabled) */ +//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */ +//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */ + +/** + * Complete list of ciphersuites to use, in order of preference. + * + * \warning No dependency checking is done on that field! This option can only + * be used to restrict the set of available ciphersuites. It is your + * responsibility to make sure the needed modules are active. + * + * Use this to save a few hundred bytes of ROM (default ordering of all + * available ciphersuites) and a few to a few hundred bytes of RAM. + * + * The value below is only an example, not the default. + */ +//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + +/* X509 options */ +//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ +//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ + +/** + * Allow SHA-1 in the default TLS configuration for certificate signing. + * Without this build-time option, SHA-1 support must be activated explicitly + * through mbedtls_ssl_conf_cert_profile. Turning on this option is not + * recommended because of it is possible to generate SHA-1 collisions, however + * this may be safe for legacy infrastructure where additional controls apply. + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES + +/** + * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake + * signature and ciphersuite selection. Without this build-time option, SHA-1 + * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. + * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by + * default. At the time of writing, there is no practical attack on the use + * of SHA-1 in handshake signatures, hence this option is turned on by default + * to preserve compatibility with existing peers, but the general + * warning applies nonetheless: + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE + +/** + * Uncomment the macro to let mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(). This replaces the default implementation in + * platform_util.c. + * + * mbedtls_platform_zeroize() is a widely used function across the library to + * zero a block of memory. The implementation is expected to be secure in the + * sense that it has been written to prevent the compiler from removing calls + * to mbedtls_platform_zeroize() as part of redundant code elimination + * optimizations. However, it is difficult to guarantee that calls to + * mbedtls_platform_zeroize() will not be optimized by the compiler as older + * versions of the C language standards do not provide a secure implementation + * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to + * configure their own implementation of mbedtls_platform_zeroize(), for + * example by using directives specific to their compiler, features from newer + * C standards (e.g using memset_s() in C11) or calling a secure memset() from + * their system (e.g explicit_bzero() in BSD). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_ALT + +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/** + * Enable the verified implementations of ECDH primitives from Project Everest + * (currently only Curve25519). This feature changes the layout of ECDH + * contexts and therefore is a compatibility break for applications that access + * fields of a mbedtls_ecdh_context structure directly. See also + * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. + */ +//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + +/** + * \def MBEDTLS_CCM_USE_AES_CBC_MAC + * + * Uncomment this macro in case CCM should be used with AES CBC-MAC calling CSS IP. + * + */ +#define MBEDTLS_CCM_USE_AES_CBC_MAC + +/** + * \def MBEDTLS_CBC_MAC_USE_CMAC + * + * Uncomment this macro in case AES CBC-MAC should be used with CSS CMAC command. + * + */ +//#define MBEDTLS_CBC_MAC_USE_CMAC + +/* Uncomment if you do not want PSA wrapper inside Mbedtls */ +//#undef MBEDTLS_USE_PSA_CRYPTO + +/* \} name SECTION: Customisation configuration options */ + +/* Target and application specific configurations + * + * Allow user to override any previous default. + * + */ + +#define MBEDTLS_ALLOW_PRIVATE_ACCESS + +#ifndef __ZEPHYR__ +#if defined(MBEDTLS_USER_CONFIG_FILE) +#include MBEDTLS_USER_CONFIG_FILE +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#include "mbedtls/config_psa.h" +#endif + +#include "mbedtls/check_config.h" +#endif /* __ZEPHYR__ */ +#endif /* MBEDTLS_USER_CONFIG_H */ diff --git a/src/common/dpp.c b/src/common/dpp.c index a5165b9b37..5c44cda798 100644 --- a/src/common/dpp.c +++ b/src/common/dpp.c @@ -3290,7 +3290,7 @@ enum dpp_status_error dpp_conf_result_rx(struct dpp_authentication *auth, size_t len[2]; u8 *unwrapped = NULL; size_t unwrapped_len = 0; - enum dpp_status_error ret = 256; + enum dpp_status_error ret = 255; wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, &wrapped_data_len); @@ -3444,7 +3444,7 @@ enum dpp_status_error dpp_conn_status_result_rx(struct dpp_authentication *auth, size_t len[2]; u8 *unwrapped = NULL; size_t unwrapped_len = 0; - enum dpp_status_error ret = 256; + enum dpp_status_error ret = 255; struct json_token *root = NULL, *token; struct wpabuf *ssid64; diff --git a/src/common/dpp_auth.c b/src/common/dpp_auth.c index f81f1eecbc..f9c83b6034 100644 --- a/src/common/dpp_auth.c +++ b/src/common/dpp_auth.c @@ -875,7 +875,7 @@ dpp_auth_req_rx(struct dpp_global *dpp, void *msg_ctx, u8 dpp_allowed_roles, wpa_printf(MSG_DEBUG, "DPP: Unexpected role in I-capabilities"); wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "Invalid role in I-capabilities 0x%02x", - auth->i_capab & DPP_CAPAB_ROLE_MASK); + (u8)(auth->i_capab & DPP_CAPAB_ROLE_MASK)); goto fail; } diff --git a/src/crypto/crypto_mbedtls_alt.c b/src/crypto/crypto_mbedtls_alt.c new file mode 100644 index 0000000000..91492add5a --- /dev/null +++ b/src/crypto/crypto_mbedtls_alt.c @@ -0,0 +1,3719 @@ +/* + * crypto wrapper functions for mbed TLS + * + * SPDX-FileCopyrightText: 2022 Glenn Strauss + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include "utils/includes.h" +#include "utils/common.h" + +#ifndef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE +#include +#include +#include +#include /* mbedtls_platform_zeroize() */ +#include +#include +#include +#include +#include +#include +#include +#include + +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA +#include "supp_psa_api.h" +#endif + +#ifndef MBEDTLS_PRIVATE +#define MBEDTLS_PRIVATE(x) x +#endif + +#define ENTROPY_MIN_PLATFORM 32 + +/* hostapd/wpa_supplicant provides forced_memzero(), + * but prefer mbedtls_platform_zeroize() */ +#define forced_memzero(ptr, sz) mbedtls_platform_zeroize(ptr, sz) + +#define IANA_SECP256R1 19 +#define IANA_SECP384R1 20 +#define IANA_SECP521R1 21 + +#ifdef CONFIG_MBEDTLS_ECDH_LEGACY_CONTEXT +#define ACCESS_ECDH(S, var) S->MBEDTLS_PRIVATE(var) +#else +#define ACCESS_ECDH(S, var) S->MBEDTLS_PRIVATE(ctx).MBEDTLS_PRIVATE(mbed_ecdh).MBEDTLS_PRIVATE(var) +#endif + +#ifndef __has_attribute +#define __has_attribute(x) 0 +#endif + +#ifndef __GNUC_PREREQ +#define __GNUC_PREREQ(maj, min) 0 +#endif + +#ifndef __attribute_cold__ +#if __has_attribute(cold) || __GNUC_PREREQ(4, 3) +#define __attribute_cold__ __attribute__((__cold__)) +#else +#define __attribute_cold__ +#endif +#endif + +#ifndef __attribute_noinline__ +#if __has_attribute(noinline) || __GNUC_PREREQ(3, 1) +#define __attribute_noinline__ __attribute__((__noinline__)) +#else +#define __attribute_noinline__ +#endif +#endif + +#include "crypto.h" +#include "aes_wrap.h" +#include "aes.h" +#include "md5.h" +#include "sha1.h" +#include "sha256.h" +#include "sha384.h" +#include "sha512.h" + +/* + * selective code inclusion based on preprocessor defines + * + * future: additional code could be wrapped with preprocessor checks if + * wpa_supplicant/Makefile and hostap/Makefile were more consistent with + * setting preprocessor defines for named groups of functionality + */ + +#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \ + defined(EAP_TEAP_DYNAMIC) || defined(EAP_SERVER_FAST) +#define CRYPTO_MBEDTLS_SHA1_T_PRF +#endif + +#if !defined(CONFIG_NO_PBKDF2) +#define CRYPTO_MBEDTLS_PBKDF2_SHA1 +#endif /* pbkdf2_sha1() */ + +#if defined(EAP_IKEV2) || defined(EAP_IKEV2_DYNAMIC) || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */ +#define CRYPTO_MBEDTLS_CRYPTO_CIPHER +#endif /* crypto_cipher_*() */ + +#if defined(EAP_PWD) || defined(EAP_SERVER_PWD) /* CONFIG_EAP_PWD=y */ \ + || defined(CONFIG_SAE) /* CONFIG_SAE=y */ +#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM +#endif /* crypto_bignum_*() */ + +#if defined(EAP_PWD) /* CONFIG_EAP_PWD=y */ \ + || defined(EAP_EKE) /* CONFIG_EAP_EKE=y */ \ + || defined(EAP_EKE_DYNAMIC) /* CONFIG_EAP_EKE=y */ \ + || defined(EAP_SERVER_EKE) /* CONFIG_EAP_EKE=y */ \ + || defined(EAP_IKEV2) /* CONFIG_EAP_IKEV2y */ \ + || defined(EAP_IKEV2_DYNAMIC) /* CONFIG_EAP_IKEV2=y */ \ + || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */ \ + || defined(CONFIG_SAE) /* CONFIG_SAE=y */ \ + || defined(CONFIG_WPS) /* CONFIG_WPS=y */ +#define CRYPTO_MBEDTLS_CRYPTO_DH +#if defined(CONFIG_WPS_NFC) +#define CRYPTO_MBEDTLS_DH5_INIT_FIXED +#endif /* dh5_init_fixed() */ +#endif /* crypto_dh_*() */ + +#if !defined(CONFIG_NO_WPA) /* CONFIG_NO_WPA= */ +#define CRYPTO_MBEDTLS_CRYPTO_ECDH +#endif /* crypto_ecdh_*() */ + +#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM +#define CRYPTO_MBEDTLS_CRYPTO_EC + +#if defined(CONFIG_DPP) /* CONFIG_DPP=y */ +#define CRYPTO_MBEDTLS_CRYPTO_EC_DPP /* extra for DPP */ +#define CRYPTO_MBEDTLS_CRYPTO_CSR +#endif /* crypto_csr_*() */ + +#if defined(CONFIG_DPP2) /* CONFIG_DPP2=y */ +#define CRYPTO_MBEDTLS_CRYPTO_PKCS7 +#endif /* crypto_pkcs7_*() */ + +#if defined(EAP_SIM) || defined(EAP_SIM_DYNAMIC) || defined(EAP_SERVER_SIM) || defined(EAP_AKA) || \ + defined(EAP_AKA_DYNAMIC) || defined(EAP_SERVER_AKA) || defined(CONFIG_AP) || defined(HOSTAPD) +/* CONFIG_EAP_SIM=y CONFIG_EAP_AKA=y CONFIG_AP=y HOSTAPD */ +#if defined(CRYPTO_RSA_OAEP_SHA256) +#define CRYPTO_MBEDTLS_CRYPTO_RSA +#endif +#endif /* crypto_rsa_*() */ + +static int ctr_drbg_init_state; +static mbedtls_ctr_drbg_context ctr_drbg; +static mbedtls_entropy_context entropy; + +#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM +#include +static mbedtls_mpi mpi_sw_A; +#endif + +static int wm_wrap_entropy_poll(void *data, unsigned char *output, size_t len, size_t *olen) +{ + ((void)data); + os_get_random(output, len); + *olen = len; + return 0; +} + +__attribute_cold__ __attribute_noinline__ static mbedtls_ctr_drbg_context *ctr_drbg_init(void) +{ + const unsigned char *custom_name = (const unsigned char *)"WPA_SUPPLICANT/HOSTAPD"; + size_t custom_name_len = os_strlen((const char *)custom_name); + + mbedtls_ctr_drbg_init(&ctr_drbg); + mbedtls_entropy_init(&entropy); + + mbedtls_entropy_add_source(&entropy, wm_wrap_entropy_poll, NULL, ENTROPY_MIN_PLATFORM, + MBEDTLS_ENTROPY_SOURCE_STRONG); + + if (mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, custom_name, custom_name_len)) + { + wpa_printf(MSG_ERROR, "Init of random number generator failed"); + /* XXX: abort? */ + } + else + ctr_drbg_init_state = 1; + + return &ctr_drbg; +} + +__attribute_cold__ void crypto_unload(void) +{ + if (ctr_drbg_init_state) + { + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); +#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM + mbedtls_mpi_free(&mpi_sw_A); +#endif + ctr_drbg_init_state = 0; + } +} + +/* init ctr_drbg on first use + * crypto_global_init() and crypto_global_deinit() are not available here + * (available only when CONFIG_TLS=internal, which is not CONFIG_TLS=mbedtls) */ +mbedtls_ctr_drbg_context *crypto_mbedtls_ctr_drbg(void); /*(not in header)*/ +inline mbedtls_ctr_drbg_context *crypto_mbedtls_ctr_drbg(void) +{ + return ctr_drbg_init_state ? &ctr_drbg : ctr_drbg_init(); +} + +/* tradeoff: slightly smaller code size here at cost of slight increase + * in instructions and function calls at runtime versus the expanded + * per-message-digest code that follows in #else (~0.5 kib .text larger) */ +__attribute_noinline__ static int md_vector( + size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac, mbedtls_md_type_t md_type) +{ +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA + return md_vector_psa(num_elem, addr, len, mac, md_type); +#else + if (TEST_FAIL()) + return -1; + + mbedtls_md_context_t ctx; + mbedtls_md_init(&ctx); + if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 0) != 0) + { + mbedtls_md_free(&ctx); + return -1; + } + mbedtls_md_starts(&ctx); + for (size_t i = 0; i < num_elem; ++i) + mbedtls_md_update(&ctx, addr[i], len[i]); + mbedtls_md_finish(&ctx, mac); + mbedtls_md_free(&ctx); + return 0; +#endif +} + +int sha512_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA512); +} + +int sha384_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA384); +} + +int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA256); +} + +#ifdef MBEDTLS_SHA1_C +int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA1); +} +#endif + +#ifdef MBEDTLS_MD5_C +int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD5); +} +#endif + +#ifdef MBEDTLS_MD4_C +#include +int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD4); +} +#endif + +struct crypto_hash +{ + mbedtls_md_context_t ctx; +}; + +struct crypto_hash *crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, size_t key_len) +{ + struct crypto_hash *ctx; + mbedtls_md_type_t md_type; + const mbedtls_md_info_t *md_info; + int ret = 0; + + switch (alg) + { + case CRYPTO_HASH_ALG_HMAC_MD5: + md_type = MBEDTLS_MD_MD5; + break; + case CRYPTO_HASH_ALG_HMAC_SHA1: + md_type = MBEDTLS_MD_SHA1; + break; + case CRYPTO_HASH_ALG_HMAC_SHA256: + md_type = MBEDTLS_MD_SHA256; + break; + case CRYPTO_HASH_ALG_SHA384: + md_type = MBEDTLS_MD_SHA384; + break; + case CRYPTO_HASH_ALG_SHA512: + md_type = MBEDTLS_MD_SHA512; + break; + default: + return NULL; + } + + ctx = os_zalloc(sizeof(*ctx)); + if (ctx == NULL) + { + return NULL; + } + + mbedtls_md_init(&ctx->ctx); + md_info = mbedtls_md_info_from_type(md_type); + if (!md_info) + { + os_free(ctx); + return NULL; + } + ret = mbedtls_md_setup(&ctx->ctx, md_info, 1); + if (ret != 0) + { + os_free(ctx); + return NULL; + } + mbedtls_md_hmac_starts(&ctx->ctx, key, key_len); + + return ctx; +} + +void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len) +{ + if (ctx == NULL) + { + return; + } + mbedtls_md_hmac_update(&ctx->ctx, data, len); +} + +int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len) +{ + if (ctx == NULL) + { + return -2; + } + + if (mac == NULL || len == NULL) + { + mbedtls_md_free(&ctx->ctx); + bin_clear_free(ctx, sizeof(*ctx)); + return 0; + } + mbedtls_md_hmac_finish(&ctx->ctx, mac); + mbedtls_md_free(&ctx->ctx); + bin_clear_free(ctx, sizeof(*ctx)); + + return 0; +} + +__attribute_noinline__ static int hmac_vector(const u8 *key, + size_t key_len, + size_t num_elem, + const u8 *addr[], + const size_t *len, + u8 *mac, + mbedtls_md_type_t md_type) +{ +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA + return hmac_vector_psa(key, key_len, num_elem, addr, len, mac, md_type); +#else + if (TEST_FAIL()) + return -1; + + mbedtls_md_context_t ctx; + mbedtls_md_init(&ctx); + if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 1) != 0) + { + mbedtls_md_free(&ctx); + return -1; + } + mbedtls_md_hmac_starts(&ctx, key, key_len); + for (size_t i = 0; i < num_elem; ++i) + mbedtls_md_hmac_update(&ctx, addr[i], len[i]); + mbedtls_md_hmac_finish(&ctx, mac); + mbedtls_md_free(&ctx); + return 0; +#endif +} + +int hmac_sha512_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA512); +} + +int hmac_sha512(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac) +{ + return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA512); +} + +int hmac_sha384_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA384); +} + +int hmac_sha384(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac) +{ + return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA384); +} + +int hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA256); +} + +int hmac_sha256(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac) +{ + return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA256); +} + +#ifdef MBEDTLS_SHA1_C +int hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA1); +} + +int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac) +{ + return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA1); +} +#endif + +#ifdef MBEDTLS_MD5_C +int hmac_md5_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_MD5); +} + +int hmac_md5(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac) +{ + return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_MD5); +} +#endif + +#ifdef MBEDTLS_HKDF_C +#include + +/* sha256-kdf.c sha384-kdf.c sha512-kdf.c */ + +/* HMAC-SHA256 KDF (RFC 5295) and HKDF-Expand(SHA256) (RFC 5869) */ +/* HMAC-SHA384 KDF (RFC 5295) and HKDF-Expand(SHA384) (RFC 5869) */ +/* HMAC-SHA512 KDF (RFC 5295) and HKDF-Expand(SHA512) (RFC 5869) */ +__attribute_noinline__ static int hmac_kdf_expand(const u8 *prk, + size_t prk_len, + const char *label, + const u8 *info, + size_t info_len, + u8 *okm, + size_t okm_len, + mbedtls_md_type_t md_type) +{ + if (TEST_FAIL()) + return -1; + + const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type); + if (label == NULL) /* RFC 5869 HKDF-Expand when (label == NULL) */ + return mbedtls_hkdf_expand(md_info, prk, prk_len, info, info_len, okm, okm_len) ? -1 : 0; + + const size_t mac_len = mbedtls_md_get_size(md_info); + /* okm_len must not exceed 255 times hash len (RFC 5869 Section 2.3) */ + if (okm_len > ((mac_len << 8) - mac_len)) + return -1; + + mbedtls_md_context_t ctx; + mbedtls_md_init(&ctx); + if (mbedtls_md_setup(&ctx, md_info, 1) != 0) + { + mbedtls_md_free(&ctx); + return -1; + } + mbedtls_md_hmac_starts(&ctx, prk, prk_len); + + u8 iter = 1; + const u8 *addr[4] = {okm, (const u8 *)label, info, &iter}; + size_t len[4] = {0, label ? os_strlen(label) + 1 : 0, info_len, 1}; + + for (; okm_len >= mac_len; okm_len -= mac_len, ++iter) + { + for (size_t i = 0; i < ARRAY_SIZE(addr); ++i) + mbedtls_md_hmac_update(&ctx, addr[i], len[i]); + mbedtls_md_hmac_finish(&ctx, okm); + mbedtls_md_hmac_reset(&ctx); + addr[0] = okm; + okm += mac_len; + len[0] = mac_len; /*(include digest in subsequent rounds)*/ + } + + if (okm_len) + { + u8 hash[MBEDTLS_MD_MAX_SIZE]; + for (size_t i = 0; i < ARRAY_SIZE(addr); ++i) + mbedtls_md_hmac_update(&ctx, addr[i], len[i]); + mbedtls_md_hmac_finish(&ctx, hash); + os_memcpy(okm, hash, okm_len); + forced_memzero(hash, mac_len); + } + + mbedtls_md_free(&ctx); + return 0; +} + +int hmac_sha512_kdf( + const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen) +{ + return hmac_kdf_expand(secret, secret_len, label, seed, seed_len, out, outlen, MBEDTLS_MD_SHA512); +} + +int hmac_sha384_kdf( + const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen) +{ + return hmac_kdf_expand(secret, secret_len, label, seed, seed_len, out, outlen, MBEDTLS_MD_SHA384); +} + +int hmac_sha256_kdf( + const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen) +{ + return hmac_kdf_expand(secret, secret_len, label, seed, seed_len, out, outlen, MBEDTLS_MD_SHA256); +} +#endif /* MBEDTLS_HKDF_C */ + +/* sha256-prf.c sha384-prf.c sha512-prf.c */ + +/* hmac_prf_bits - IEEE Std 802.11ac-2013, 11.6.1.7.2 Key derivation function */ +__attribute_noinline__ static int hmac_prf_bits(const u8 *key, + size_t key_len, + const char *label, + const u8 *data, + size_t data_len, + u8 *buf, + size_t buf_len_bits, + mbedtls_md_type_t md_type) +{ + if (TEST_FAIL()) + return -1; + + mbedtls_md_context_t ctx; + mbedtls_md_init(&ctx); + const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type); + if (mbedtls_md_setup(&ctx, md_info, 1) != 0) + { + mbedtls_md_free(&ctx); + return -1; + } + mbedtls_md_hmac_starts(&ctx, key, key_len); + + u16 ctr, n_le = host_to_le16(buf_len_bits); + const u8 *const addr[] = {(u8 *)&ctr, (u8 *)label, data, (u8 *)&n_le}; + const size_t len[] = {2, os_strlen(label), data_len, 2}; + const size_t mac_len = mbedtls_md_get_size(md_info); + size_t buf_len = (buf_len_bits + 7) / 8; + for (ctr = 1; buf_len >= mac_len; buf_len -= mac_len, ++ctr) + { +#if __BYTE_ORDER == __BIG_ENDIAN + ctr = host_to_le16(ctr); +#endif + for (size_t i = 0; i < ARRAY_SIZE(addr); ++i) + mbedtls_md_hmac_update(&ctx, addr[i], len[i]); + mbedtls_md_hmac_finish(&ctx, buf); + mbedtls_md_hmac_reset(&ctx); + buf += mac_len; +#if __BYTE_ORDER == __BIG_ENDIAN + ctr = le_to_host16(ctr); +#endif + } + + if (buf_len) + { + u8 hash[MBEDTLS_MD_MAX_SIZE]; +#if __BYTE_ORDER == __BIG_ENDIAN + ctr = host_to_le16(ctr); +#endif + for (size_t i = 0; i < ARRAY_SIZE(addr); ++i) + mbedtls_md_hmac_update(&ctx, addr[i], len[i]); + mbedtls_md_hmac_finish(&ctx, hash); + os_memcpy(buf, hash, buf_len); + buf += buf_len; + forced_memzero(hash, mac_len); + } + + /* Mask out unused bits in last octet if it does not use all the bits */ + if ((buf_len_bits &= 0x7)) + buf[-1] &= (u8)(0xff << (8 - buf_len_bits)); + + mbedtls_md_free(&ctx); + return 0; +} + +int sha512_prf( + const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len) +{ + return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len * 8, MBEDTLS_MD_SHA512); +} + +int sha384_prf( + const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len) +{ + return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len * 8, MBEDTLS_MD_SHA384); +} + +int sha256_prf( + const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len) +{ + return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len * 8, MBEDTLS_MD_SHA256); +} + +int sha256_prf_bits( + const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len_bits) +{ + return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len_bits, MBEDTLS_MD_SHA256); +} + +#ifdef MBEDTLS_SHA1_C + +/* sha1-prf.c */ + +/* sha1_prf - SHA1-based Pseudo-Random Function (PRF) (IEEE 802.11i, 8.5.1.1) */ + +int sha1_prf(const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len) +{ + /*(note: algorithm differs from hmac_prf_bits() */ + /*(note: smaller code size instead of expanding hmac_sha1_vector() + * as is done in hmac_prf_bits(); not expecting large num of loops) */ + u8 counter = 0; + const u8 *addr[] = {(u8 *)label, data, &counter}; + const size_t len[] = {os_strlen(label) + 1, data_len, 1}; + + for (; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++counter) + { + if (hmac_sha1_vector(key, key_len, 3, addr, len, buf)) + return -1; + buf += SHA1_MAC_LEN; + } + + if (buf_len) + { + u8 hash[SHA1_MAC_LEN]; + if (hmac_sha1_vector(key, key_len, 3, addr, len, hash)) + return -1; + os_memcpy(buf, hash, buf_len); + forced_memzero(hash, sizeof(hash)); + } + + return 0; +} + +#ifdef CRYPTO_MBEDTLS_SHA1_T_PRF + +/* sha1-tprf.c */ + +/* sha1_t_prf - EAP-FAST Pseudo-Random Function (T-PRF) (RFC 4851,Section 5.5)*/ + +int sha1_t_prf( + const u8 *key, size_t key_len, const char *label, const u8 *seed, size_t seed_len, u8 *buf, size_t buf_len) +{ + /*(note: algorithm differs from hmac_prf_bits() and hmac_kdf() above)*/ + /*(note: smaller code size instead of expanding hmac_sha1_vector() + * as is done in hmac_prf_bits(); not expecting large num of loops) */ + u8 ctr; + u16 olen = host_to_be16(buf_len); + const u8 *addr[] = {buf, (u8 *)label, seed, (u8 *)&olen, &ctr}; + size_t len[] = {0, os_strlen(label) + 1, seed_len, 2, 1}; + + for (ctr = 1; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++ctr) + { + if (hmac_sha1_vector(key, key_len, 5, addr, len, buf)) + return -1; + addr[0] = buf; + buf += SHA1_MAC_LEN; + len[0] = SHA1_MAC_LEN; /*(include digest in subsequent rounds)*/ + } + + if (buf_len) + { + u8 hash[SHA1_MAC_LEN]; + if (hmac_sha1_vector(key, key_len, 5, addr, len, hash)) + return -1; + os_memcpy(buf, hash, buf_len); + forced_memzero(hash, sizeof(hash)); + } + + return 0; +} + +#endif /* CRYPTO_MBEDTLS_SHA1_T_PRF */ +#endif /* MBEDTLS_SHA1_C */ + +#ifdef MBEDTLS_DES_C +#include +int des_encrypt(const u8 *clear, const u8 *key, u8 *cypher) +{ + u8 pkey[8], next, tmp; + int i; + + /* Add parity bits to the key */ + next = 0; + for (i = 0; i < 7; i++) + { + tmp = key[i]; + pkey[i] = (tmp >> i) | next | 1; + next = tmp << (7 - i); + } + pkey[i] = next | 1; + + mbedtls_des_context des; + mbedtls_des_init(&des); + int ret = mbedtls_des_setkey_enc(&des, pkey) || mbedtls_des_crypt_ecb(&des, clear, cypher) ? -1 : 0; + mbedtls_des_free(&des); + return ret; +} +#endif + +#ifdef CRYPTO_MBEDTLS_PBKDF2_SHA1 +/* sha1-pbkdf2.c */ +#include +int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len, int iterations, u8 *buf, size_t buflen) +{ +#if MBEDTLS_VERSION_NUMBER >= 0x03020200 /* mbedtls 3.2.2 */ + return mbedtls_pkcs5_pbkdf2_hmac_ext(MBEDTLS_MD_SHA1, (const u8 *)passphrase, os_strlen(passphrase), ssid, ssid_len, + iterations, 32, buf) ? + -1 : + 0; +#else + const mbedtls_md_info_t *md_info; + md_info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA1); + if (md_info == NULL) + return -1; + mbedtls_md_context_t ctx; + mbedtls_md_init(&ctx); + int ret = mbedtls_md_setup(&ctx, md_info, 1) || + mbedtls_pkcs5_pbkdf2_hmac(&ctx, (const u8 *)passphrase, os_strlen(passphrase), ssid, ssid_len, + iterations, 32, buf) ? + -1 : + 0; + mbedtls_md_free(&ctx); + return ret; +#endif +} +#endif + +#ifdef MBEDTLS_AES_C + +/*#include "aes.h"*/ /* prototypes also included in "crypto.h" */ + +static void *aes_crypt_init_mode(const u8 *key, size_t len, int mode) +{ + if (TEST_FAIL()) + return NULL; + + mbedtls_aes_context *aes = os_malloc(sizeof(*aes)); + if (!aes) + return NULL; + + mbedtls_aes_init(aes); + if ((mode == MBEDTLS_AES_ENCRYPT ? mbedtls_aes_setkey_enc(aes, key, len * 8) : + mbedtls_aes_setkey_dec(aes, key, len * 8)) == 0) + return aes; + + mbedtls_aes_free(aes); + os_free(aes); + return NULL; +} + +void *aes_encrypt_init(const u8 *key, size_t len) +{ + return aes_crypt_init_mode(key, len, MBEDTLS_AES_ENCRYPT); +} + +int aes_encrypt(void *ctx, const u8 *plain, u8 *crypt) +{ + return mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, plain, crypt); +} + +void aes_encrypt_deinit(void *ctx) +{ + mbedtls_aes_free(ctx); + os_free(ctx); +} + +void *aes_decrypt_init(const u8 *key, size_t len) +{ + return aes_crypt_init_mode(key, len, MBEDTLS_AES_DECRYPT); +} + +int aes_decrypt(void *ctx, const u8 *crypt, u8 *plain) +{ + return mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_DECRYPT, crypt, plain); +} + +void aes_decrypt_deinit(void *ctx) +{ + mbedtls_aes_free(ctx); + os_free(ctx); +} +#endif + +#include "aes_wrap.h" + +#ifdef MBEDTLS_NIST_KW_C + +#include + +/* aes-wrap.c */ +int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher) +{ + if (TEST_FAIL()) + return -1; + + mbedtls_nist_kw_context ctx; + mbedtls_nist_kw_init(&ctx); + size_t olen; + int ret = mbedtls_nist_kw_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, kek, kek_len * 8, 1) || + mbedtls_nist_kw_wrap(&ctx, MBEDTLS_KW_MODE_KW, plain, n * 8, cipher, &olen, (n + 1) * 8) ? + -1 : + 0; + mbedtls_nist_kw_free(&ctx); + return ret; +} + +/* aes-unwrap.c */ +int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, u8 *plain) +{ + if (TEST_FAIL()) + return -1; + + mbedtls_nist_kw_context ctx; + mbedtls_nist_kw_init(&ctx); + size_t olen; + int ret = mbedtls_nist_kw_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, kek, kek_len * 8, 0) || + mbedtls_nist_kw_unwrap(&ctx, MBEDTLS_KW_MODE_KW, cipher, (n + 1) * 8, plain, &olen, n * 8) ? + -1 : + 0; + mbedtls_nist_kw_free(&ctx); + return ret; +} +#endif /* MBEDTLS_NIST_KW_C */ + +#ifdef MBEDTLS_CMAC_C + +/* aes-omac1.c */ + +#include + +int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA + return omac1_aes_vector_psa(key, key_len, num_elem, addr, len, mac); +#else + if (TEST_FAIL()) + return -1; + + mbedtls_cipher_type_t cipher_type; + switch (key_len) + { + case 16: + cipher_type = MBEDTLS_CIPHER_AES_128_ECB; + break; + case 24: + cipher_type = MBEDTLS_CIPHER_AES_192_ECB; + break; + case 32: + cipher_type = MBEDTLS_CIPHER_AES_256_ECB; + break; + default: + return -1; + } + const mbedtls_cipher_info_t *cipher_info; + cipher_info = mbedtls_cipher_info_from_type(cipher_type); + if (cipher_info == NULL) + return -1; + + mbedtls_cipher_context_t ctx; + mbedtls_cipher_init(&ctx); + int ret = -1; + if (mbedtls_cipher_setup(&ctx, cipher_info) == 0 && mbedtls_cipher_cmac_starts(&ctx, key, key_len * 8) == 0) + { + ret = 0; + for (size_t i = 0; i < num_elem && ret == 0; ++i) + ret = mbedtls_cipher_cmac_update(&ctx, addr[i], len[i]); + } + if (ret == 0) + ret = mbedtls_cipher_cmac_finish(&ctx, mac); + mbedtls_cipher_free(&ctx); + return ret ? -1 : 0; +#endif +} + +int omac1_aes_128_vector(const u8 *key, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) +{ + return omac1_aes_vector(key, 16, num_elem, addr, len, mac); +} + +int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac) +{ + return omac1_aes_vector(key, 16, 1, &data, &data_len, mac); +} + +int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac) +{ + return omac1_aes_vector(key, 32, 1, &data, &data_len, mac); +} + +#else + +//#include "aes-omac1.c" /* pull in hostap local implementation */ + +#ifndef MBEDTLS_AES_BLOCK_SIZE +#define MBEDTLS_AES_BLOCK_SIZE 16 +#endif + +#endif /* MBEDTLS_CMAC_C */ + +#ifdef MBEDTLS_AES_C + +/* These interfaces can be inefficient when used in loops, as the overhead of + * initialization each call is large for each block input (e.g. 16 bytes) */ + +/* aes-encblock.c */ +int aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out) +{ +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA + return aes_128_encrypt_block_psa(key, in, out); +#else + if (TEST_FAIL()) + return -1; + + mbedtls_aes_context aes; + mbedtls_aes_init(&aes); + int ret = + mbedtls_aes_setkey_enc(&aes, key, 128) || mbedtls_aes_crypt_ecb(&aes, MBEDTLS_AES_ENCRYPT, in, out) ? -1 : 0; + mbedtls_aes_free(&aes); + return ret; +#endif +} + +/* aes-ctr.c */ +int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce, u8 *data, size_t data_len) +{ +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA + return aes_ctr_encrypt_psa(key, key_len, nonce, data, data_len); +#else + if (TEST_FAIL()) + return -1; + + unsigned char counter[MBEDTLS_AES_BLOCK_SIZE]; + unsigned char stream_block[MBEDTLS_AES_BLOCK_SIZE]; + os_memcpy(counter, nonce, MBEDTLS_AES_BLOCK_SIZE); /*(must be writable)*/ + + mbedtls_aes_context ctx; + mbedtls_aes_init(&ctx); + size_t nc_off = 0; + int ret = mbedtls_aes_setkey_enc(&ctx, key, key_len * 8) || + mbedtls_aes_crypt_ctr(&ctx, data_len, &nc_off, counter, stream_block, data, data) ? + -1 : + 0; + forced_memzero(stream_block, sizeof(stream_block)); + mbedtls_aes_free(&ctx); + return ret; +#endif +} + +int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce, u8 *data, size_t data_len) +{ + return aes_ctr_encrypt(key, 16, nonce, data, data_len); +} + +/* aes-cbc.c */ +static int aes_128_cbc_oper(const u8 *key, const u8 *iv, u8 *data, size_t data_len, int mode) +{ +#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA + if (mode == MBEDTLS_AES_ENCRYPT) + return aes_128_cbc_encrypt_psa(key, iv, data, data_len); + else + return aes_128_cbc_decrypt_psa(key, iv, data, data_len); +#else + unsigned char ivec[MBEDTLS_AES_BLOCK_SIZE]; + os_memcpy(ivec, iv, MBEDTLS_AES_BLOCK_SIZE); /*(must be writable)*/ + + mbedtls_aes_context ctx; + mbedtls_aes_init(&ctx); + int ret = (mode == MBEDTLS_AES_ENCRYPT ? mbedtls_aes_setkey_enc(&ctx, key, 128) : + mbedtls_aes_setkey_dec(&ctx, key, 128)) || + mbedtls_aes_crypt_cbc(&ctx, mode, data_len, ivec, data, data); + mbedtls_aes_free(&ctx); + return ret ? -1 : 0; +#endif +} + +int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) +{ + if (TEST_FAIL()) + return -1; + + return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_ENCRYPT); +} + +int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) +{ + if (TEST_FAIL()) + return -1; + + return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_DECRYPT); +} +#endif + +/* + * Much of the following is documented in crypto.h as for CONFIG_TLS=internal + * but such comments are not accurate: + * + * "This function is only used with internal TLSv1 implementation + * (CONFIG_TLS=internal). If that is not used, the crypto wrapper does not need + * to implement this." + */ + +#ifdef CRYPTO_MBEDTLS_CRYPTO_CIPHER + +#include + +struct crypto_cipher +{ + mbedtls_cipher_context_t ctx_enc; + mbedtls_cipher_context_t ctx_dec; +}; + +struct crypto_cipher *crypto_cipher_init(enum crypto_cipher_alg alg, const u8 *iv, const u8 *key, size_t key_len) +{ + /* IKEv2 src/eap_common/ikev2_common.c:ikev2_{encr,decr}_encrypt() + * uses one of CRYPTO_CIPHER_ALG_AES or CRYPTO_CIPHER_ALG_3DES */ + + mbedtls_cipher_type_t cipher_type; + size_t iv_len; + switch (alg) + { +#ifdef MBEDTLS_AES_C + case CRYPTO_CIPHER_ALG_AES: + if (key_len == 16) + cipher_type = MBEDTLS_CIPHER_AES_128_CTR; + if (key_len == 24) + cipher_type = MBEDTLS_CIPHER_AES_192_CTR; + if (key_len == 32) + cipher_type = MBEDTLS_CIPHER_AES_256_CTR; + iv_len = 16; + break; +#endif +#ifdef MBEDTLS_DES_C + case CRYPTO_CIPHER_ALG_3DES: + cipher_type = MBEDTLS_CIPHER_DES_EDE3_CBC; + iv_len = 8; + break; +#endif + default: + return NULL; + } + + const mbedtls_cipher_info_t *cipher_info; + cipher_info = mbedtls_cipher_info_from_type(cipher_type); + if (cipher_info == NULL) + return NULL; + + key_len *= 8; /* key_bitlen */ + + struct crypto_cipher *ctx = os_malloc(sizeof(*ctx)); + if (!ctx) + return NULL; + + mbedtls_cipher_init(&ctx->ctx_enc); + mbedtls_cipher_init(&ctx->ctx_dec); + if (mbedtls_cipher_setup(&ctx->ctx_enc, cipher_info) == 0 && + mbedtls_cipher_setup(&ctx->ctx_dec, cipher_info) == 0 && + mbedtls_cipher_setkey(&ctx->ctx_enc, key, key_len, MBEDTLS_ENCRYPT) == 0 && + mbedtls_cipher_setkey(&ctx->ctx_dec, key, key_len, MBEDTLS_DECRYPT) == 0 && + mbedtls_cipher_set_iv(&ctx->ctx_enc, iv, iv_len) == 0 && + mbedtls_cipher_set_iv(&ctx->ctx_dec, iv, iv_len) == 0 && mbedtls_cipher_reset(&ctx->ctx_enc) == 0 && + mbedtls_cipher_reset(&ctx->ctx_dec) == 0) + { + return ctx; + } + + mbedtls_cipher_free(&ctx->ctx_enc); + mbedtls_cipher_free(&ctx->ctx_dec); + os_free(ctx); + return NULL; +} + +int crypto_cipher_encrypt(struct crypto_cipher *ctx, const u8 *plain, u8 *crypt, size_t len) +{ + size_t olen = 0; /*(poor interface above; unknown size of u8 *crypt)*/ + return (mbedtls_cipher_update(&ctx->ctx_enc, plain, len, crypt, &olen) || + mbedtls_cipher_finish(&ctx->ctx_enc, crypt + olen, &olen)) ? + -1 : + 0; +} + +int crypto_cipher_decrypt(struct crypto_cipher *ctx, const u8 *crypt, u8 *plain, size_t len) +{ + size_t olen = 0; /*(poor interface above; unknown size of u8 *plain)*/ + return (mbedtls_cipher_update(&ctx->ctx_dec, crypt, len, plain, &olen) || + mbedtls_cipher_finish(&ctx->ctx_dec, plain + olen, &olen)) ? + -1 : + 0; +} + +void crypto_cipher_deinit(struct crypto_cipher *ctx) +{ + mbedtls_cipher_free(&ctx->ctx_enc); + mbedtls_cipher_free(&ctx->ctx_dec); + os_free(ctx); +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_CIPHER */ + +#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM + +#include + +/* crypto.h bignum interfaces */ + +struct crypto_bignum *crypto_bignum_init(void) +{ + if (TEST_FAIL()) + return NULL; + + mbedtls_mpi *bn = os_malloc(sizeof(*bn)); + if (bn) + mbedtls_mpi_init(bn); + return (struct crypto_bignum *)bn; +} + +struct crypto_bignum *crypto_bignum_init_set(const u8 *buf, size_t len) +{ + if (TEST_FAIL()) + return NULL; + + mbedtls_mpi *bn = os_malloc(sizeof(*bn)); + if (bn) + { + mbedtls_mpi_init(bn); + if (mbedtls_mpi_read_binary(bn, buf, len) == 0) + return (struct crypto_bignum *)bn; + } + + os_free(bn); + return NULL; +} + +struct crypto_bignum *crypto_bignum_init_uint(unsigned int val) +{ + if (TEST_FAIL()) + return NULL; + + mbedtls_mpi *bn = os_malloc(sizeof(*bn)); + if (bn) + { + mbedtls_mpi_init(bn); + if (mbedtls_mpi_lset(bn, (int)val) == 0) + return (struct crypto_bignum *)bn; + } + + os_free(bn); + return NULL; +} + +void crypto_bignum_deinit(struct crypto_bignum *n, int clear) +{ + mbedtls_mpi_free((mbedtls_mpi *)n); + os_free(n); +} + +int crypto_bignum_to_bin(const struct crypto_bignum *a, u8 *buf, size_t buflen, size_t padlen) +{ + if (TEST_FAIL()) + return -1; + + size_t n = mbedtls_mpi_size((mbedtls_mpi *)a); + if (n < padlen) + n = padlen; + return n > buflen || mbedtls_mpi_write_binary((mbedtls_mpi *)a, buf, n) ? -1 : (int)(n); +} + +int crypto_bignum_rand(struct crypto_bignum *r, const struct crypto_bignum *m) +{ + if (TEST_FAIL()) + return -1; + + /*assert(r != m);*/ /* r must not be same as m for mbedtls_mpi_random()*/ +#if MBEDTLS_VERSION_NUMBER >= 0x021B0000 /* mbedtls 2.27.0 */ + return mbedtls_mpi_random((mbedtls_mpi *)r, 0, (mbedtls_mpi *)m, mbedtls_ctr_drbg_random, + crypto_mbedtls_ctr_drbg()) ? + -1 : + 0; +#else + /* (needed by EAP_PWD, SAE, DPP) */ + wpa_printf(MSG_ERROR, "mbedtls 2.27.0 or later required for mbedtls_mpi_random()"); + return -1; +#endif +} + +int crypto_bignum_add(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c) +{ + return mbedtls_mpi_add_mpi((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0; +} + +int crypto_bignum_mod(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c) +{ + return mbedtls_mpi_mod_mpi((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0; +} + +int crypto_bignum_exptmod(const struct crypto_bignum *a, + const struct crypto_bignum *b, + const struct crypto_bignum *c, + struct crypto_bignum *d) +{ + if (TEST_FAIL()) + return -1; + + /* (check if input params match d; d is the result) */ + /* (a == d) is ok in current mbedtls implementation */ + if (b == d || c == d) + { /*(not ok; store result in intermediate)*/ + mbedtls_mpi R; + mbedtls_mpi_init(&R); + int rc = + mbedtls_mpi_exp_mod(&R, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b, (const mbedtls_mpi *)c, NULL) || + mbedtls_mpi_copy((mbedtls_mpi *)d, &R) ? + -1 : + 0; + mbedtls_mpi_free(&R); + return rc; + } + else + { + return mbedtls_mpi_exp_mod((mbedtls_mpi *)d, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b, + (const mbedtls_mpi *)c, NULL) ? + -1 : + 0; + } +} + +int crypto_bignum_inverse(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c) +{ + if (TEST_FAIL()) + return -1; + + return mbedtls_mpi_inv_mod((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0; +} + +int crypto_bignum_sub(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c) +{ + if (TEST_FAIL()) + return -1; + + return mbedtls_mpi_sub_mpi((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0; +} + +int crypto_bignum_div(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c) +{ + if (TEST_FAIL()) + return -1; + + /*(most current use of this crypto.h interface has a == c (result), + * so store result in an intermediate to avoid overwritten input)*/ + mbedtls_mpi R; + mbedtls_mpi_init(&R); + int rc = mbedtls_mpi_div_mpi(&R, NULL, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) || + mbedtls_mpi_copy((mbedtls_mpi *)c, &R) ? + -1 : + 0; + mbedtls_mpi_free(&R); + return rc; +} + +int crypto_bignum_addmod(const struct crypto_bignum *a, + const struct crypto_bignum *b, + const struct crypto_bignum *c, + struct crypto_bignum *d) +{ + if (TEST_FAIL()) + return -1; + + return mbedtls_mpi_add_mpi((mbedtls_mpi *)d, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) || + mbedtls_mpi_mod_mpi((mbedtls_mpi *)d, (mbedtls_mpi *)d, (const mbedtls_mpi *)c) ? + -1 : + 0; +} + +int crypto_bignum_mulmod(const struct crypto_bignum *a, + const struct crypto_bignum *b, + const struct crypto_bignum *c, + struct crypto_bignum *d) +{ + if (TEST_FAIL()) + return -1; + + return mbedtls_mpi_mul_mpi((mbedtls_mpi *)d, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) || + mbedtls_mpi_mod_mpi((mbedtls_mpi *)d, (mbedtls_mpi *)d, (const mbedtls_mpi *)c) ? + -1 : + 0; +} + +int crypto_bignum_sqrmod(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c) +{ + if (TEST_FAIL()) + return -1; + +#if 1 + return crypto_bignum_mulmod(a, a, b, c); +#else + mbedtls_mpi bn; + mbedtls_mpi_init(&bn); + if (mbedtls_mpi_lset(&bn, 2)) /* alt?: mbedtls_mpi_set_bit(&bn, 1) */ + return -1; + int ret = mbedtls_mpi_exp_mod((mbedtls_mpi *)c, (const mbedtls_mpi *)a, &bn, (const mbedtls_mpi *)b, NULL) ? -1 : 0; + mbedtls_mpi_free(&bn); + return ret; +#endif +} + +int crypto_bignum_rshift(const struct crypto_bignum *a, int n, struct crypto_bignum *r) +{ + return mbedtls_mpi_copy((mbedtls_mpi *)r, (const mbedtls_mpi *)a) || mbedtls_mpi_shift_r((mbedtls_mpi *)r, n) ? -1 : + 0; +} + +int crypto_bignum_cmp(const struct crypto_bignum *a, const struct crypto_bignum *b) +{ + return mbedtls_mpi_cmp_mpi((const mbedtls_mpi *)a, (const mbedtls_mpi *)b); +} + +int crypto_bignum_is_zero(const struct crypto_bignum *a) +{ + /* XXX: src/common/sae.c:sswu() contains comment: + * "TODO: Make sure crypto_bignum_is_zero() is constant time" + * Note: mbedtls_mpi_cmp_int() *is not* constant time */ + return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 0) == 0); +} + +int crypto_bignum_is_one(const struct crypto_bignum *a) +{ + return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 1) == 0); +} + +int crypto_bignum_is_odd(const struct crypto_bignum *a) +{ + return mbedtls_mpi_get_bit((const mbedtls_mpi *)a, 0); +} + +#include "utils/const_time.h" +int crypto_bignum_legendre(const struct crypto_bignum *a, const struct crypto_bignum *p) +{ + if (TEST_FAIL()) + return -2; + + /* Security Note: + * mbedtls_mpi_exp_mod() is not documented to run in constant time, + * though mbedtls/library/bignum.c uses constant_time_internal.h funcs. + * Compare to crypto_openssl.c:crypto_bignum_legendre() + * which uses openssl BN_mod_exp_mont_consttime() + * mbedtls/library/ecp.c has further countermeasures to timing attacks, + * (but ecp.c funcs are not used here) */ + + mbedtls_mpi exp, tmp; + mbedtls_mpi_init(&exp); + mbedtls_mpi_init(&tmp); + + /* exp = (p-1) / 2 */ + int res; + if (mbedtls_mpi_sub_int(&exp, (const mbedtls_mpi *)p, 1) == 0 && mbedtls_mpi_shift_r(&exp, 1) == 0 && + mbedtls_mpi_exp_mod(&tmp, (const mbedtls_mpi *)a, &exp, (const mbedtls_mpi *)p, NULL) == 0) + { + /*(modified from crypto_openssl.c:crypto_bignum_legendre())*/ + /* Return 1 if tmp == 1, 0 if tmp == 0, or -1 otherwise. Need + * to use constant time selection to avoid branches here. */ + unsigned int mask; + res = -1; + mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 1) == 0), 1); + res = const_time_select_int(mask, 1, res); + mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 0) == 0), 1); + res = const_time_select_int(mask, 0, res); + } + else + { + res = -2; + } + + mbedtls_mpi_free(&tmp); + mbedtls_mpi_free(&exp); + return res; +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_BIGNUM */ + +#ifdef CRYPTO_MBEDTLS_CRYPTO_DH + +/* crypto_internal-modexp.c */ + +#include +#include + +static int crypto_mbedtls_dh_set_bin_pg(mbedtls_dhm_context *ctx, u8 generator, const u8 *prime, size_t prime_len) +{ + /*(could set these directly in MBEDTLS_PRIVATE members)*/ + mbedtls_mpi P, G; + mbedtls_mpi_init(&P); + mbedtls_mpi_init(&G); + int ret = mbedtls_mpi_lset(&G, generator) || mbedtls_mpi_read_binary(&P, prime, prime_len) || + mbedtls_dhm_set_group(ctx, &P, &G); + mbedtls_mpi_free(&P); + mbedtls_mpi_free(&G); + return ret; +} + +__attribute_noinline__ static int crypto_mbedtls_dh_init_public( + mbedtls_dhm_context *ctx, u8 generator, const u8 *prime, size_t prime_len, u8 *privkey, u8 *pubkey) +{ + if (crypto_mbedtls_dh_set_bin_pg(ctx, generator, prime, prime_len) || + mbedtls_dhm_make_public(ctx, (int)prime_len, pubkey, prime_len, mbedtls_ctr_drbg_random, + crypto_mbedtls_ctr_drbg())) + return -1; + + return mbedtls_mpi_write_binary(&ctx->MBEDTLS_PRIVATE(X), privkey, prime_len) ? -1 : 0; +} + +int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey, u8 *pubkey) +{ + if (TEST_FAIL()) + return -1; + + /* Prefer to use mbedtls to derive our public/private key, as doing so + * leverages mbedtls to properly format output and to perform blinding*/ + mbedtls_dhm_context ctx; + mbedtls_dhm_init(&ctx); + int ret = crypto_mbedtls_dh_init_public(&ctx, generator, prime, prime_len, privkey, pubkey); + mbedtls_dhm_free(&ctx); + return ret; +} + +/*(crypto_dh_derive_secret() could be implemented using crypto.h APIs + * instead of being reimplemented in each crypto_*.c)*/ +int crypto_dh_derive_secret(u8 generator, + const u8 *prime, + size_t prime_len, + const u8 *order, + size_t order_len, + const u8 *privkey, + size_t privkey_len, + const u8 *pubkey, + size_t pubkey_len, + u8 *secret, + size_t *len) +{ + if (TEST_FAIL()) + return -1; + + /* Prefer to use mbedtls to derive DH shared secret, as doing so + * leverages mbedtls to validate params and to perform blinding. + * + * Attempt to reconstitute DH context to derive shared secret + * (due to limitations of the interface, which ought to pass context). + * Force provided G (our private key) into context without validation. + * Regenerating GX (our public key) not needed to derive shared secret. + */ + /*(older compilers might not support VLAs)*/ + /*unsigned char buf[2+prime_len+2+1+2+pubkey_len];*/ + unsigned char buf[2 + MBEDTLS_MPI_MAX_SIZE + 2 + 1 + 2 + MBEDTLS_MPI_MAX_SIZE]; + unsigned char *p = buf + 2 + prime_len; + if (2 + prime_len + 2 + 1 + 2 + pubkey_len > sizeof(buf)) + return -1; + WPA_PUT_BE16(buf, prime_len); /*(2-byte big-endian size of prime)*/ + p[0] = 0; /*(2-byte big-endian size of generator)*/ + p[1] = 1; + p[2] = generator; + WPA_PUT_BE16(p + 3, pubkey_len); /*(2-byte big-endian size of pubkey)*/ + os_memcpy(p + 5, pubkey, pubkey_len); + os_memcpy(buf + 2, prime, prime_len); + + mbedtls_dhm_context ctx; + mbedtls_dhm_init(&ctx); + p = buf; + int ret = + mbedtls_dhm_read_params(&ctx, &p, p + 2 + prime_len + 5 + pubkey_len) || + mbedtls_mpi_read_binary(&ctx.MBEDTLS_PRIVATE(X), privkey, privkey_len) || + mbedtls_dhm_calc_secret(&ctx, secret, *len, len, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) ? + -1 : + 0; + mbedtls_dhm_free(&ctx); + return ret; +} + +/* dh_group5.c */ + +#include "dh_group5.h" + +/* RFC3526_PRIME_1536[] and RFC3526_GENERATOR_1536[] from crypto_wolfssl.c */ + +static const unsigned char RFC3526_PRIME_1536[] = { + 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, + 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1, 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6, + 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD, 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, + 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45, + 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, + 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED, 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11, + 0x7C, 0x4B, 0x1F, 0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D, 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, + 0xBF, 0x05, 0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F, + 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB, 0x9E, 0xD5, + 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D, 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, 0xF1, 0x74, 0x6C, 0x08, + 0xCA, 0x23, 0x73, 0x27, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}; + +static const unsigned char RFC3526_GENERATOR_1536[] = {0x02}; + +void *dh5_init(struct wpabuf **priv, struct wpabuf **publ) +{ + const unsigned char *const prime = RFC3526_PRIME_1536; + const size_t prime_len = sizeof(RFC3526_PRIME_1536); + const u8 generator = *RFC3526_GENERATOR_1536; + struct wpabuf *wpubl = NULL, *wpriv = NULL; + + mbedtls_dhm_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + return NULL; + mbedtls_dhm_init(ctx); + + if ((wpubl = wpabuf_alloc(prime_len)) && (wpriv = wpabuf_alloc(prime_len)) && + crypto_mbedtls_dh_init_public(ctx, generator, prime, prime_len, wpabuf_put(wpriv, prime_len), + wpabuf_put(wpubl, prime_len)) == 0) + { + wpabuf_free(*publ); + wpabuf_clear_free(*priv); + *publ = wpubl; + *priv = wpriv; + return ctx; + } + + wpabuf_clear_free(wpriv); + wpabuf_free(wpubl); + mbedtls_dhm_free(ctx); + os_free(ctx); + return NULL; +} + +#ifdef CRYPTO_MBEDTLS_DH5_INIT_FIXED +void *dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ) +{ + const unsigned char *const prime = RFC3526_PRIME_1536; + const size_t prime_len = sizeof(RFC3526_PRIME_1536); + const u8 generator = *RFC3526_GENERATOR_1536; + + mbedtls_dhm_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + return NULL; + mbedtls_dhm_init(ctx); + + if (crypto_mbedtls_dh_set_bin_pg(ctx, generator, prime, prime_len) == 0 + && mbedtls_mpi_read_binary(&ctx->MBEDTLS_PRIVATE(X), wpabuf_head(priv), wpabuf_len(priv)) == 0) + { + return ctx; + } + + mbedtls_dhm_free(ctx); + os_free(ctx); + return NULL; +} +#endif + +struct wpabuf *dh5_derive_shared(void *ctx, const struct wpabuf *peer_public, const struct wpabuf *own_private) +{ + /*((mbedtls_dhm_context *)ctx must already contain own_private)*/ + /* mbedtls 2.x: prime_len = ctx->len; */ + /* mbedtls 3.x: prime_len = mbedtls_dhm_get_len(ctx); */ + size_t olen = sizeof(RFC3526_PRIME_1536); /*(sizeof(); prime known)*/ + struct wpabuf *buf = wpabuf_alloc(olen); + if (buf == NULL) + return NULL; + if (mbedtls_dhm_read_public((mbedtls_dhm_context *)ctx, wpabuf_head(peer_public), wpabuf_len(peer_public)) == 0 && + mbedtls_dhm_calc_secret(ctx, wpabuf_mhead(buf), olen, &olen, mbedtls_ctr_drbg_random, + crypto_mbedtls_ctr_drbg()) == 0) + { + wpabuf_put(buf, olen); + return buf; + } + + wpabuf_free(buf); + return NULL; +} + +void dh5_free(void *ctx) +{ + mbedtls_dhm_free(ctx); + os_free(ctx); +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_DH */ + +#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC) + +#include + +#define CRYPTO_EC_pbits(e) (((mbedtls_ecp_group *)(e))->pbits) +#define CRYPTO_EC_plen(e) ((((mbedtls_ecp_group *)(e))->pbits + 7) >> 3) +#define CRYPTO_EC_P(e) (&((mbedtls_ecp_group *)(e))->P) +#define CRYPTO_EC_N(e) (&((mbedtls_ecp_group *)(e))->N) +#define CRYPTO_EC_A(e) (&((mbedtls_ecp_group *)(e))->A) +#define CRYPTO_EC_B(e) (&((mbedtls_ecp_group *)(e))->B) +#define CRYPTO_EC_G(e) (&((mbedtls_ecp_group *)(e))->G) + +static mbedtls_ecp_group_id crypto_mbedtls_ecp_group_id_from_ike_id(int group) +{ + /* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */ + switch (group) + { +#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED + case 19: + return MBEDTLS_ECP_DP_SECP256R1; +#endif +#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED + case 20: + return MBEDTLS_ECP_DP_SECP384R1; +#endif +#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED + case 21: + return MBEDTLS_ECP_DP_SECP521R1; +#endif +#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED + case 25: + return MBEDTLS_ECP_DP_SECP192R1; +#endif +#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED + case 26: + return MBEDTLS_ECP_DP_SECP224R1; +#endif +#ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED + case 28: + return MBEDTLS_ECP_DP_BP256R1; +#endif +#ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED + case 29: + return MBEDTLS_ECP_DP_BP384R1; +#endif +#ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED + case 30: + return MBEDTLS_ECP_DP_BP512R1; +#endif +#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED + case 31: + return MBEDTLS_ECP_DP_CURVE25519; +#endif +#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED + case 32: + return MBEDTLS_ECP_DP_CURVE448; +#endif + default: + return MBEDTLS_ECP_DP_NONE; + } +} + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC +static int crypto_mbedtls_ike_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id) +{ + /* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */ + /*(for crypto_ec_key_group())*/ + switch (grp_id) + { +#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED + case MBEDTLS_ECP_DP_SECP256R1: + return 19; +#endif +#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED + case MBEDTLS_ECP_DP_SECP384R1: + return 20; +#endif +#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED + case MBEDTLS_ECP_DP_SECP521R1: + return 21; +#endif +#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED + case MBEDTLS_ECP_DP_SECP192R1: + return 25; +#endif +#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED + case MBEDTLS_ECP_DP_SECP224R1: + return 26; +#endif +#ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED + case MBEDTLS_ECP_DP_BP256R1: + return 28; +#endif +#ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED + case MBEDTLS_ECP_DP_BP384R1: + return 29; +#endif +#ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED + case MBEDTLS_ECP_DP_BP512R1: + return 30; +#endif +#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED + case MBEDTLS_ECP_DP_CURVE25519: + return 31; +#endif +#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED + case MBEDTLS_ECP_DP_CURVE448: + return 32; +#endif + default: + return -1; + } +} +#endif + +#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH || CRYPTO_MBEDTLS_CRYPTO_EC */ + +#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC_DPP) + +#include +#include + +static int crypto_mbedtls_keypair_gen(int group, mbedtls_pk_context *pk) +{ + mbedtls_ecp_group_id grp_id = crypto_mbedtls_ecp_group_id_from_ike_id(group); + if (grp_id == MBEDTLS_ECP_DP_NONE) + return -1; + const mbedtls_pk_info_t *pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY); + if (pk_info == NULL) + return -1; + return mbedtls_pk_setup(pk, pk_info) || + mbedtls_ecp_gen_key(grp_id, mbedtls_pk_ec(*pk), mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) ? + -1 : + 0; +} + +#endif + +#ifdef CRYPTO_MBEDTLS_CRYPTO_ECDH + +#include +#include +#include +#include + +/* wrap mbedtls_ecdh_context for more future-proof direct access to components + * (mbedtls_ecdh_context internal implementation may change between releases) + * + * If mbedtls_pk_context -- specifically underlying mbedtls_ecp_keypair -- + * lifetime were guaranteed to be longer than that of mbedtls_ecdh_context, + * then mbedtls_pk_context or mbedtls_ecp_keypair could be stored in crypto_ecdh + * (or crypto_ec_key could be stored in crypto_ecdh, and crypto_ec_key could + * wrap mbedtls_ecp_keypair and components, to avoid MBEDTLS_PRIVATE access) */ +struct crypto_ecdh +{ + mbedtls_ecdh_context ctx; + mbedtls_ecp_group grp; + mbedtls_ecp_point Q; +}; + +struct crypto_ec +{ + mbedtls_ecp_group group; +}; + +struct crypto_ec_group; + +static struct crypto_key *crypto_alloc_key(void) +{ + mbedtls_pk_context *key = os_malloc(sizeof(*key)); + + if (!key) + { + wpa_printf(MSG_ERROR, "%s: memory allocation failed\n", __func__); + return NULL; + } + mbedtls_pk_init(key); + + return (struct crypto_key *)key; +} + +int crypto_ec_point_solve_y_coord(struct crypto_ec *e, + struct crypto_ec_point *p, + const struct crypto_bignum *x, + int y_bit) +{ + mbedtls_mpi temp; + mbedtls_mpi *y_sqr, *y; + mbedtls_mpi_init(&temp); + int ret = 0; + + y = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y); + + /* Faster way to find sqrt + * Works only with curves having prime p + * such that p ā‰” 3 (mod 4) + * y_ = (y2 ^ ((p+1)/4)) mod p + * + * if LSB of both x and y are same: y = y_ + * else y = p - y_ + * y_bit is LSB of x + */ + y_bit = (y_bit != 0); + + y_sqr = (mbedtls_mpi *)crypto_ec_point_compute_y_sqr(e, x); + + if (y_sqr) + { + MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&temp, &e->group.P, 1)); + MBEDTLS_MPI_CHK(mbedtls_mpi_div_int(&temp, NULL, &temp, 4)); + MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(y, y_sqr, &temp, &e->group.P, NULL)); + + if (y_bit != mbedtls_mpi_get_bit(y, 0)) + MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(y, &e->group.P, y)); + + MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X), (const mbedtls_mpi *)x)); + MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Z), 1)); + } + else + { + ret = 1; + } +cleanup: + mbedtls_mpi_free(&temp); + mbedtls_mpi_free(y_sqr); + os_free(y_sqr); + return ret ? -1 : 0; +} + +struct crypto_key *crypto_ec_set_pubkey_point(const struct crypto_ec_group *group, const u8 *buf, size_t len) +{ + mbedtls_ecp_point *point = NULL; + struct crypto_key *pkey = NULL; + int ret; + mbedtls_pk_context *key = (mbedtls_pk_context *)crypto_alloc_key(); + + if (!key) + { + wpa_printf(MSG_ERROR, "%s: memory allocation failed", __func__); + return NULL; + } + + point = (mbedtls_ecp_point *)crypto_ec_point_from_bin((struct crypto_ec *)group, buf); + if (!point) + { + wpa_printf(MSG_ERROR, "%s: Point initialization failed", __func__); + goto fail; + } + if (crypto_ec_point_is_at_infinity((struct crypto_ec *)group, (struct crypto_ec_point *)point)) + { + wpa_printf(MSG_ERROR, "Point is at infinity"); + goto fail; + } + if (!crypto_ec_point_is_on_curve((struct crypto_ec *)group, (struct crypto_ec_point *)point)) + { + wpa_printf(MSG_ERROR, "Point not on curve"); + goto fail; + } + + if (mbedtls_ecp_check_pubkey((mbedtls_ecp_group *)group, point) < 0) + { // typecast + // ideally should have failed in upper condition, duplicate code?? + wpa_printf(MSG_ERROR, "Invalid key"); + goto fail; + } + /* Assign values */ + if ((ret = mbedtls_pk_setup(key, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY))) != 0) + goto fail; + mbedtls_ecp_copy(&mbedtls_pk_ec(*key)->MBEDTLS_PRIVATE(Q), point); + mbedtls_ecp_group_load(&mbedtls_pk_ec(*key)->MBEDTLS_PRIVATE(grp), MBEDTLS_ECP_DP_SECP256R1); + + pkey = (struct crypto_key *)key; + crypto_ec_point_deinit((struct crypto_ec_point *)point, 0); + return pkey; +fail: + if (point) + crypto_ec_point_deinit((struct crypto_ec_point *)point, 0); + if (key) + mbedtls_pk_free(key); + pkey = NULL; + return pkey; +} + +int crypto_mbedtls_get_grp_id(int group) +{ + switch (group) + { + case IANA_SECP256R1: + return MBEDTLS_ECP_DP_SECP256R1; + case IANA_SECP384R1: + return MBEDTLS_ECP_DP_SECP384R1; + case IANA_SECP521R1: + return MBEDTLS_ECP_DP_SECP521R1; + default: + return MBEDTLS_ECP_DP_NONE; + } +} + +void crypto_ec_free_key(struct crypto_key *key) +{ + mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; + mbedtls_pk_free(pkey); + os_free(key); +} + +struct crypto_ecdh *crypto_ecdh_init_owe(int group) +{ + mbedtls_ctr_drbg_context ctr_drbg; + mbedtls_entropy_context entropy; + mbedtls_ecdh_context *ctx; + /* Initialize CTR_DRBG context */ + mbedtls_ctr_drbg_init(&ctr_drbg); + mbedtls_entropy_init(&entropy); + +#ifdef __ZEPHYR__ + mbedtls_entropy_add_source(&entropy, wm_wrap_entropy_poll, NULL, ENTROPY_MIN_PLATFORM, + MBEDTLS_ENTROPY_SOURCE_STRONG); +#endif + + ctx = os_zalloc(sizeof(*ctx)); + if (!ctx) + { + wpa_printf(MSG_ERROR, "Memory allocation failed for ecdh context"); + goto fail; + } + mbedtls_ecdh_init(ctx); +#ifndef CONFIG_MBEDTLS_ECDH_LEGACY_CONTEXT + ctx->MBEDTLS_PRIVATE(var) = MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0; +#endif + + if ((mbedtls_ecp_group_load(ACCESS_ECDH(&ctx, grp), crypto_mbedtls_get_grp_id(group))) != 0) + { + wpa_printf(MSG_ERROR, "Failed to set up ECDH context with group info"); + goto fail; + } + + /* Seed and setup CTR_DRBG entropy source for future reseeds */ + if (mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0) != 0) + { + wpa_printf(MSG_ERROR, "Seeding entropy source failed"); + goto fail; + } + + /* Generates ECDH keypair on elliptic curve */ + if (mbedtls_ecdh_gen_public(ACCESS_ECDH(&ctx, grp), ACCESS_ECDH(&ctx, d), ACCESS_ECDH(&ctx, Q), + mbedtls_ctr_drbg_random, &ctr_drbg) != 0) + { + wpa_printf(MSG_ERROR, "ECDH keypair on curve failed"); + goto fail; + } + + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); + return (struct crypto_ecdh *)ctx; +fail: + if (ctx) + { + mbedtls_ecdh_free(ctx); + os_free(ctx); + ctx = NULL; + } + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); + return NULL; +} + +struct crypto_ecdh *crypto_ecdh_init(int group) +{ + mbedtls_pk_context pk; + mbedtls_pk_init(&pk); + struct crypto_ecdh *ecdh = + crypto_mbedtls_keypair_gen(group, &pk) == 0 ? crypto_ecdh_init2(group, (struct crypto_ec_key *)&pk) : NULL; + mbedtls_pk_free(&pk); + return ecdh; +} + +struct crypto_ecdh *crypto_ecdh_init2(int group, struct crypto_ec_key *own_key) +{ + mbedtls_ecp_group_id grp_id = crypto_mbedtls_ecp_group_id_from_ike_id(group); + if (grp_id == MBEDTLS_ECP_DP_NONE) + return NULL; + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)own_key); + struct crypto_ecdh *ecdh = os_malloc(sizeof(*ecdh)); + if (ecdh == NULL) + return NULL; + mbedtls_ecdh_init(&ecdh->ctx); + mbedtls_ecp_group_init(&ecdh->grp); + mbedtls_ecp_point_init(&ecdh->Q); + if (mbedtls_ecdh_setup(&ecdh->ctx, grp_id) == 0 && + mbedtls_ecdh_get_params(&ecdh->ctx, ecp_kp, MBEDTLS_ECDH_OURS) == 0) + { + /* copy grp and Q for later use + * (retrieving this info later is more convoluted + * even if mbedtls_ecdh_make_public() is considered)*/ +#if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */ + mbedtls_mpi d; + mbedtls_mpi_init(&d); + if (mbedtls_ecp_export(ecp_kp, &ecdh->grp, &d, &ecdh->Q) == 0) + { + mbedtls_mpi_free(&d); + return ecdh; + } + mbedtls_mpi_free(&d); +#else + if (mbedtls_ecp_group_load(&ecdh->grp, grp_id) == 0 && + mbedtls_ecp_copy(&ecdh->Q, &ecp_kp->MBEDTLS_PRIVATE(Q)) == 0) + return ecdh; +#endif + } + + mbedtls_ecp_point_free(&ecdh->Q); + mbedtls_ecp_group_free(&ecdh->grp); + mbedtls_ecdh_free(&ecdh->ctx); + os_free(ecdh); + return NULL; +} + +struct wpabuf *crypto_ecdh_get_pubkey_owe(struct crypto_ecdh *ecdh, int y) +{ + struct wpabuf *public_key = NULL; + uint8_t *buf = NULL; + mbedtls_ecdh_context *ctx = (mbedtls_ecdh_context *)ecdh; + size_t prime_len = ACCESS_ECDH(ctx, grp).pbits / 8; + + buf = os_zalloc(y ? prime_len : 2 * prime_len); + if (!buf) + { + wpa_printf(MSG_ERROR, "Memory allocation failed"); + return NULL; + } + /* Export an MPI into unsigned big endian binary data of fixed size */ + mbedtls_mpi_write_binary(ACCESS_ECDH(&ctx, Q).MBEDTLS_PRIVATE(X), buf, prime_len); + public_key = wpabuf_alloc_copy(buf, 32); + os_free(buf); + return public_key; +} + +struct wpabuf *crypto_ecdh_get_pubkey(struct crypto_ecdh *ecdh, int inc_y) +{ + mbedtls_ecp_group *grp = &ecdh->grp; + size_t len = CRYPTO_EC_plen(grp); +#ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED + /* len */ +#endif +#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED + if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) + len = inc_y ? len * 2 + 1 : len + 1; +#endif + struct wpabuf *buf = wpabuf_alloc(len); + if (buf == NULL) + return NULL; + inc_y = inc_y ? MBEDTLS_ECP_PF_UNCOMPRESSED : MBEDTLS_ECP_PF_COMPRESSED; + if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &len, wpabuf_mhead_u8(buf), len) == 0) + { + wpabuf_put(buf, len); + return buf; + } + + wpabuf_free(buf); + return NULL; +} + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) +static int crypto_mbedtls_short_weierstrass_derive_y(mbedtls_ecp_group *grp, mbedtls_mpi *bn, int parity_bit) +{ + /* y^2 = x^3 + ax + b + * sqrt(w) = w^((p+1)/4) mod p (for prime p where p = 3 mod 4) */ + mbedtls_mpi *cy2 = + (mbedtls_mpi *)crypto_ec_point_compute_y_sqr((struct crypto_ec *)grp, (const struct crypto_bignum *)bn); /*x*/ + if (cy2 == NULL) + return -1; + + /*mbedtls_mpi_free(bn);*/ + /*(reuse bn to store result (y))*/ + + mbedtls_mpi exp; + mbedtls_mpi_init(&exp); + int ret = mbedtls_mpi_get_bit(&grp->P, 0) != 1 /*(p = 3 mod 4)*/ + || mbedtls_mpi_get_bit(&grp->P, 1) != 1 /*(p = 3 mod 4)*/ + || mbedtls_mpi_add_int(&exp, &grp->P, 1) || mbedtls_mpi_shift_r(&exp, 2) || + mbedtls_mpi_exp_mod(bn, cy2, &exp, &grp->P, NULL) || + (mbedtls_mpi_get_bit(bn, 0) != parity_bit && mbedtls_mpi_sub_mpi(bn, &grp->P, bn)); + mbedtls_mpi_free(&exp); + mbedtls_mpi_free(cy2); + os_free(cy2); + return ret; +} +#endif + +struct wpabuf *crypto_ecdh_set_peerkey_owe(struct crypto_ecdh *ecdh, int inc_y, const u8 *key, size_t len) +{ + uint8_t *secret = 0; + size_t olen = 0, len_prime = 0; + struct crypto_bignum *bn_x = NULL; + struct crypto_ec_point *ec_pt = NULL; + uint8_t *px = NULL, *py = NULL, *buf = NULL; + struct crypto_key *pkey = NULL; + struct wpabuf *sh_secret = NULL; + int secret_key = 0; + + mbedtls_ecdh_context *ctx = (mbedtls_ecdh_context *)ecdh; + + mbedtls_ctr_drbg_context ctr_drbg; + mbedtls_entropy_context entropy; + + /* Initialize CTR_DRBG context */ + mbedtls_ctr_drbg_init(&ctr_drbg); + mbedtls_entropy_init(&entropy); +#ifdef __ZEPHYR__ + mbedtls_entropy_add_source(&entropy, wm_wrap_entropy_poll, NULL, ENTROPY_MIN_PLATFORM, + MBEDTLS_ENTROPY_SOURCE_STRONG); +#endif + + /* Seed and setup CTR_DRBG entropy source for future reseeds */ + if (mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0) != 0) + { + wpa_printf(MSG_ERROR, "Seeding entropy source failed"); + goto cleanup; + } + len_prime = ACCESS_ECDH(ctx, grp).pbits / 8; + bn_x = crypto_bignum_init_set(key, len); + /* Initialize data for EC point */ + ec_pt = crypto_ec_point_init((struct crypto_ec *)ACCESS_ECDH(&ctx, grp)); + if (!ec_pt) + { + wpa_printf(MSG_ERROR, "Initializing for EC point failed"); + goto cleanup; + } + if (crypto_ec_point_solve_y_coord((struct crypto_ec *)ACCESS_ECDH(&ctx, grp), ec_pt, bn_x, inc_y) != 0) + { + wpa_printf(MSG_ERROR, "Failed to solve for y coordinate"); + goto cleanup; + } + px = os_zalloc(len); + py = os_zalloc(len); + buf = os_zalloc(2 * len); + + if (!px || !py || !buf) + { + wpa_printf(MSG_ERROR, "Memory allocation failed"); + goto cleanup; + } + + if (crypto_ec_point_to_bin((struct crypto_ec *)ACCESS_ECDH(&ctx, grp), ec_pt, px, py) != 0) + { + wpa_printf(MSG_ERROR, "Failed to write EC point value as binary data"); + goto cleanup; + } + os_memcpy(buf, px, len); + os_memcpy(buf + len, py, len); + + pkey = crypto_ec_set_pubkey_point((struct crypto_ec_group *)ACCESS_ECDH(&ctx, grp), buf, len); + if (!pkey) + { + wpa_printf(MSG_ERROR, "Failed to set point for peer's public key"); + goto cleanup; + } + + mbedtls_pk_context *peer = (mbedtls_pk_context *)pkey; + + /* Setup ECDH context from EC key */ + /* Call to mbedtls_ecdh_get_params() will initialize the context when not LEGACY context */ + if (ctx != NULL && peer != NULL) + { + mbedtls_ecp_copy(ACCESS_ECDH(&ctx, Qp), &(mbedtls_pk_ec(*peer))->MBEDTLS_PRIVATE(Q)); +#ifndef CONFIG_MBEDTLS_ECDH_LEGACY_CONTEXT + ctx->MBEDTLS_PRIVATE(var) = MBEDTLS_ECDH_VARIANT_MBEDTLS_2_0; +#endif + } + else + { + wpa_printf(MSG_ERROR, "Failed to set peer's ECDH context"); + goto cleanup; + } + int len_secret = inc_y ? 2 * len : len; + secret = os_zalloc(len_secret); + if (!secret) + { + wpa_printf(MSG_ERROR, "Allocation failed for secret"); + goto cleanup; + } + + /* Calculate secret + z = F(DH(x,Y)) */ + secret_key = mbedtls_ecdh_calc_secret(ctx, &olen, secret, len_prime, mbedtls_ctr_drbg_random, &ctr_drbg); + if (secret_key != 0) + { + wpa_printf(MSG_ERROR, "Calculation of secret failed"); + goto cleanup; + } + sh_secret = wpabuf_alloc_copy(secret, len_secret); + +cleanup: + os_free(px); + os_free(py); + os_free(buf); + os_free(secret); + crypto_ec_free_key(pkey); + crypto_bignum_deinit(bn_x, 1); + crypto_ec_point_deinit(ec_pt, 1); + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); + return sh_secret; +} + +struct wpabuf *crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y, const u8 *key, size_t len) +{ + if (len == 0) /*(invalid peer key)*/ + return NULL; + + mbedtls_ecp_group *grp = &ecdh->grp; + +#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) + if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) + { + /* add header for mbedtls_ecdh_read_public() */ + u8 buf[256]; + if (sizeof(buf) - 1 < len) + return NULL; + buf[0] = (u8)(len); + os_memcpy(buf + 1, key, len); + + if (inc_y) + { + if (!(len & 1)) + { /*(dpp code/tests does not include tag?!?)*/ + if (sizeof(buf) - 2 < len) + return NULL; + buf[0] = (u8)(1 + len); + buf[1] = 0x04; + os_memcpy(buf + 2, key, len); + } + len >>= 1; /*(repurpose len to prime_len)*/ + } + else if (key[0] == 0x02 || key[0] == 0x03) + { /* (inc_y == 0) */ + --len; /*(repurpose len to prime_len)*/ + + /* mbedtls_ecp_point_read_binary() does not currently support + * MBEDTLS_ECP_PF_COMPRESSED format (buf[1] = 0x02 or 0x03) + * (returns MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) */ + + /* derive y, amend buf[] with y for UNCOMPRESSED format */ + if (sizeof(buf) - 2 < len * 2 || len == 0) + return NULL; + buf[0] = (u8)(1 + len * 2); + buf[1] = 0x04; + mbedtls_mpi bn; + mbedtls_mpi_init(&bn); + int ret = mbedtls_mpi_read_binary(&bn, key + 1, len) || + crypto_mbedtls_short_weierstrass_derive_y(grp, &bn, key[0] & 1) || + mbedtls_mpi_write_binary(&bn, buf + 2 + len, len); + mbedtls_mpi_free(&bn); + if (ret != 0) + return NULL; + } + + if (key[0] == 0) /*(repurpose len to prime_len)*/ + len = CRYPTO_EC_plen(grp); + + if (mbedtls_ecdh_read_public(&ecdh->ctx, buf, buf[0] + 1)) + return NULL; + } +#endif +#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) + if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) + { + if (mbedtls_ecdh_read_public(&ecdh->ctx, key, len)) + return NULL; + } +#endif + + struct wpabuf *buf = wpabuf_alloc(len); + if (buf == NULL) + return NULL; + + if (mbedtls_ecdh_calc_secret(&ecdh->ctx, &len, wpabuf_mhead(buf), len, mbedtls_ctr_drbg_random, + crypto_mbedtls_ctr_drbg()) == 0) + { + wpabuf_put(buf, len); + return buf; + } + + wpabuf_clear_free(buf); + return NULL; +} + +void crypto_ecdh_deinit_owe(struct crypto_ecdh *ecdh) +{ + mbedtls_ecdh_context *ctx = (mbedtls_ecdh_context *)ecdh; + if (!ctx) + { + return; + } + mbedtls_ecdh_free(ctx); + os_free(ctx); + ctx = NULL; +} + +void crypto_ecdh_deinit(struct crypto_ecdh *ecdh) +{ + if (ecdh == NULL) + return; + mbedtls_ecp_point_free(&ecdh->Q); + mbedtls_ecp_group_free(&ecdh->grp); + mbedtls_ecdh_free(&ecdh->ctx); + os_free(ecdh); +} + +size_t crypto_ecdh_prime_len(struct crypto_ecdh *ecdh) +{ + return CRYPTO_EC_plen(&ecdh->grp); +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH */ + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC + +#include + +struct crypto_ec *crypto_ec_init(int group) +{ + mbedtls_ecp_group_id grp_id = crypto_mbedtls_ecp_group_id_from_ike_id(group); + if (grp_id == MBEDTLS_ECP_DP_NONE) + return NULL; + mbedtls_ecp_group *e = os_malloc(sizeof(*e)); + if (e == NULL) + return NULL; + mbedtls_ecp_group_init(e); + if (mbedtls_ecp_group_load(e, grp_id) == 0) + return (struct crypto_ec *)e; + + mbedtls_ecp_group_free(e); + os_free(e); + return NULL; +} + +void crypto_ec_deinit(struct crypto_ec *e) +{ + mbedtls_ecp_group_free((mbedtls_ecp_group *)e); + os_free(e); +} + +size_t crypto_ec_prime_len(struct crypto_ec *e) +{ + return CRYPTO_EC_plen(e); +} + +size_t crypto_ec_prime_len_bits(struct crypto_ec *e) +{ + return CRYPTO_EC_pbits(e); +} + +size_t crypto_ec_order_len(struct crypto_ec *e) +{ + return (mbedtls_mpi_bitlen(CRYPTO_EC_N(e)) + 7) / 8; +} + +const struct crypto_bignum *crypto_ec_get_prime(struct crypto_ec *e) +{ + return (const struct crypto_bignum *)CRYPTO_EC_P(e); +} + +const struct crypto_bignum *crypto_ec_get_order(struct crypto_ec *e) +{ + return (const struct crypto_bignum *)CRYPTO_EC_N(e); +} + +const struct crypto_bignum *crypto_ec_get_a(struct crypto_ec *e) +{ +#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED + static const uint8_t secp256r1_a[] = {0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc}; +#endif +#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED + static const uint8_t secp384r1_a[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xfc}; +#endif +#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED + static const uint8_t secp521r1_a[] = { + 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc}; +#endif +#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED + static const uint8_t secp192r1_a[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc}; +#endif +#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED + static const uint8_t secp224r1_a[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, + 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe}; +#endif + + const uint8_t *bin = NULL; + size_t len = 0; + + /* (mbedtls groups matching supported sswu_curve_param() IKE groups) */ + switch (((mbedtls_ecp_group *)e)->id) + { +#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED + case MBEDTLS_ECP_DP_SECP256R1: + bin = secp256r1_a; + len = sizeof(secp256r1_a); + break; +#endif +#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED + case MBEDTLS_ECP_DP_SECP384R1: + bin = secp384r1_a; + len = sizeof(secp384r1_a); + break; +#endif +#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED + case MBEDTLS_ECP_DP_SECP521R1: + bin = secp521r1_a; + len = sizeof(secp521r1_a); + break; +#endif +#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED + case MBEDTLS_ECP_DP_SECP192R1: + bin = secp192r1_a; + len = sizeof(secp192r1_a); + break; +#endif +#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED + case MBEDTLS_ECP_DP_SECP224R1: + bin = secp224r1_a; + len = sizeof(secp224r1_a); + break; +#endif +#ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED + case MBEDTLS_ECP_DP_BP256R1: + return (const struct crypto_bignum *)CRYPTO_EC_A(e); +#endif +#ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED + case MBEDTLS_ECP_DP_BP384R1: + return (const struct crypto_bignum *)CRYPTO_EC_A(e); +#endif +#ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED + case MBEDTLS_ECP_DP_BP512R1: + return (const struct crypto_bignum *)CRYPTO_EC_A(e); +#endif +#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED + case MBEDTLS_ECP_DP_CURVE25519: + return (const struct crypto_bignum *)CRYPTO_EC_A(e); +#endif +#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED + case MBEDTLS_ECP_DP_CURVE448: + return (const struct crypto_bignum *)CRYPTO_EC_A(e); +#endif + default: + return NULL; + } + + /*(note: not thread-safe; returns file-scoped static storage)*/ + if (mbedtls_mpi_read_binary(&mpi_sw_A, bin, len) == 0) + return (const struct crypto_bignum *)&mpi_sw_A; + return NULL; +} + +const struct crypto_bignum *crypto_ec_get_b(struct crypto_ec *e) +{ + return (const struct crypto_bignum *)CRYPTO_EC_B(e); +} + +const struct crypto_ec_point *crypto_ec_get_generator(struct crypto_ec *e) +{ + return (const struct crypto_ec_point *)CRYPTO_EC_G(e); +} + +struct crypto_ec_point *crypto_ec_point_init(struct crypto_ec *e) +{ + if (TEST_FAIL()) + return NULL; + + mbedtls_ecp_point *p = os_malloc(sizeof(*p)); + if (p != NULL) + mbedtls_ecp_point_init(p); + return (struct crypto_ec_point *)p; +} + +void crypto_ec_point_deinit(struct crypto_ec_point *p, int clear) +{ + mbedtls_ecp_point_free((mbedtls_ecp_point *)p); + os_free(p); +} + +int crypto_ec_point_x(struct crypto_ec *e, const struct crypto_ec_point *p, struct crypto_bignum *x) +{ + mbedtls_mpi *px = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X); + return mbedtls_mpi_copy((mbedtls_mpi *)x, px) ? -1 : 0; +} + +int crypto_ec_point_to_bin(struct crypto_ec *e, const struct crypto_ec_point *point, u8 *x, u8 *y) +{ + if (TEST_FAIL()) + return -1; + + /* crypto.h documents crypto_ec_point_to_bin() output is big-endian */ + size_t len = CRYPTO_EC_plen(e); + if (x) + { + mbedtls_mpi *px = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(X); + if (mbedtls_mpi_write_binary(px, x, len)) + return -1; + } + if (y) + { + mbedtls_mpi *py = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(Y); + if (mbedtls_mpi_write_binary(py, y, len)) + return -1; + } + return 0; +} + +struct crypto_ec_point *crypto_ec_point_from_bin(struct crypto_ec *e, const u8 *val) +{ + if (TEST_FAIL()) + return NULL; + + size_t len = CRYPTO_EC_plen(e); + mbedtls_ecp_point *p = os_malloc(sizeof(*p)); + u8 buf[1 + MBEDTLS_MPI_MAX_SIZE * 2]; + if (p == NULL) + return NULL; + mbedtls_ecp_point_init(p); + +#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED + if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) + { + buf[0] = 0x04; + os_memcpy(buf + 1, val, len * 2); + if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p, buf, 1 + len * 2) == 0) + return (struct crypto_ec_point *)p; + } +#endif +#ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED + if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_MONTGOMERY) + { + /* crypto.h interface documents crypto_ec_point_from_bin() + * val is length: prime_len * 2 and is big-endian + * (Short Weierstrass is assumed by hostap) + * Reverse to little-endian format for Montgomery */ + for (unsigned int i = 0; i < len; ++i) + buf[i] = val[len - 1 - i]; + if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p, buf, len) == 0) + return (struct crypto_ec_point *)p; + } +#endif + + mbedtls_ecp_point_free(p); + os_free(p); + return NULL; +} + +int crypto_ec_point_add(struct crypto_ec *e, + const struct crypto_ec_point *a, + const struct crypto_ec_point *b, + struct crypto_ec_point *c) +{ + if (TEST_FAIL()) + return -1; + + /* mbedtls does not provide an mbedtls_ecp_point add function */ + mbedtls_mpi one; + mbedtls_mpi_init(&one); + int ret = mbedtls_mpi_lset(&one, 1) || + mbedtls_ecp_muladd((mbedtls_ecp_group *)e, (mbedtls_ecp_point *)c, &one, + (const mbedtls_ecp_point *)a, &one, (const mbedtls_ecp_point *)b) ? + -1 : + 0; + mbedtls_mpi_free(&one); + return ret; +} + +int crypto_ec_point_mul(struct crypto_ec *e, + const struct crypto_ec_point *p, + const struct crypto_bignum *b, + struct crypto_ec_point *res) +{ + if (TEST_FAIL()) + return -1; + + return mbedtls_ecp_mul((mbedtls_ecp_group *)e, (mbedtls_ecp_point *)res, (const mbedtls_mpi *)b, + (const mbedtls_ecp_point *)p, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) ? + -1 : + 0; +} + +int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p) +{ + if (TEST_FAIL()) + return -1; + + if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_MONTGOMERY) + { + /* e.g. MBEDTLS_ECP_DP_CURVE25519 and MBEDTLS_ECP_DP_CURVE448 */ + wpa_printf(MSG_ERROR, "%s not implemented for Montgomery curves", __func__); + return -1; + } + + /* mbedtls does not provide an mbedtls_ecp_point invert function */ + /* below works for Short Weierstrass; incorrect for Montgomery curves */ + mbedtls_mpi *py = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y); + return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p) /*point at infinity*/ + || mbedtls_mpi_cmp_int(py, 0) == 0 /*point is its own inverse*/ + || mbedtls_mpi_sub_abs(py, CRYPTO_EC_P(e), py) == 0 ? + 0 : + -1; +} + +#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED +static int crypto_ec_point_y_sqr_weierstrass(mbedtls_ecp_group *e, const mbedtls_mpi *x, mbedtls_mpi *y2) +{ + /* MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS y^2 = x^3 + a x + b */ + + /* Short Weierstrass elliptic curve group w/o A set treated as A = -3 */ + /* Attempt to match mbedtls/library/ecp.c:ecp_check_pubkey_sw() behavior + * and elsewhere in mbedtls/library/ecp.c where if A is not set, it is + * treated as if A = -3. */ + + /* y^2 = x^3 + ax + b = (x^2 + a)x + b */ + return /* x^2 */ + mbedtls_mpi_mul_mpi(y2, x, x) || + mbedtls_mpi_mod_mpi(y2, y2, &e->P) + /* x^2 + a */ + || (e->A.MBEDTLS_PRIVATE(p) ? mbedtls_mpi_add_mpi(y2, y2, &e->A) : mbedtls_mpi_sub_int(y2, y2, 3)) || + mbedtls_mpi_mod_mpi(y2, y2, &e->P) + /* (x^2 + a)x */ + || mbedtls_mpi_mul_mpi(y2, y2, x) || + mbedtls_mpi_mod_mpi(y2, y2, &e->P) + /* (x^2 + a)x + b */ + || mbedtls_mpi_add_mpi(y2, y2, &e->B) || mbedtls_mpi_mod_mpi(y2, y2, &e->P); +} +#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ + +struct crypto_bignum *crypto_ec_point_compute_y_sqr(struct crypto_ec *e, const struct crypto_bignum *x) +{ + if (TEST_FAIL()) + return NULL; + + mbedtls_mpi *y2 = os_malloc(sizeof(*y2)); + if (y2 == NULL) + return NULL; + mbedtls_mpi_init(y2); + +#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED + if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS && + crypto_ec_point_y_sqr_weierstrass((mbedtls_ecp_group *)e, (const mbedtls_mpi *)x, y2) == 0) + return (struct crypto_bignum *)y2; +#endif + + mbedtls_mpi_free(y2); + os_free(y2); + return NULL; +} + +int crypto_ec_point_is_at_infinity(struct crypto_ec *e, const struct crypto_ec_point *p) +{ + return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p); +} + +int crypto_ec_point_is_on_curve(struct crypto_ec *e, const struct crypto_ec_point *p) +{ + return mbedtls_ecp_check_pubkey((const mbedtls_ecp_group *)e, (const mbedtls_ecp_point *)p) == 0; +} + +int crypto_ec_point_cmp(const struct crypto_ec *e, const struct crypto_ec_point *a, const struct crypto_ec_point *b) +{ + return mbedtls_ecp_point_cmp((const mbedtls_ecp_point *)a, (const mbedtls_ecp_point *)b); +} + +#if !defined(CONFIG_NO_STDOUT_DEBUG) +void crypto_ec_point_debug_print(const struct crypto_ec *e, const struct crypto_ec_point *p, const char *title) +{ + u8 x[MBEDTLS_MPI_MAX_SIZE]; + u8 y[MBEDTLS_MPI_MAX_SIZE]; + size_t len = CRYPTO_EC_plen(e); + /* crypto_ec_point_to_bin ought to take (const struct crypto_ec *e) */ + struct crypto_ec *ee; + *(const struct crypto_ec **)&ee = e; /*(cast away const)*/ + if (crypto_ec_point_to_bin(ee, p, x, y) == 0) + { + if (title) + wpa_printf(MSG_DEBUG, "%s", title); + wpa_hexdump(MSG_DEBUG, "x:", x, len); + wpa_hexdump(MSG_DEBUG, "y:", y, len); + } +} +#else +void crypto_ec_point_debug_print(const struct crypto_ec *e, const struct crypto_ec_point *p, const char *title) +{ + // Fixing linking error undefined reference to `crypto_ec_point_debug_print' +} +#endif + +struct crypto_ec_key *crypto_ec_key_parse_priv(const u8 *der, size_t der_len) +{ + mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + return NULL; + mbedtls_pk_init(ctx); +#if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */ + if (mbedtls_pk_parse_key(ctx, der, der_len, NULL, 0) == 0) +#else + if (mbedtls_pk_parse_key(ctx, der, der_len, NULL, 0, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) == 0) +#endif + return (struct crypto_ec_key *)ctx; + + mbedtls_pk_free(ctx); + os_free(ctx); + return NULL; +} + +#include +#include +static int crypto_mbedtls_pk_parse_subpubkey_compressed(mbedtls_pk_context *ctx, const u8 *der, size_t der_len) +{ + /* The following is modified from: + * mbedtls/library/pkparse.c:mbedtls_pk_parse_subpubkey() + * mbedtls/library/pkparse.c:pk_get_pk_alg() + * mbedtls/library/pkparse.c:pk_use_ecparams() + */ + mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE; + const mbedtls_pk_info_t *pk_info; + int ret; + size_t len; + const unsigned char *end = der + der_len; + unsigned char *p; + *(const unsigned char **)&p = der; + + if ((ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) + { + return (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret)); + } + + end = p + len; + + /* + if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &alg_params ) ) != 0 ) + return( ret ); + */ + mbedtls_asn1_buf alg_oid, params; + memset(¶ms, 0, sizeof(mbedtls_asn1_buf)); + if ((ret = mbedtls_asn1_get_alg(&p, end, &alg_oid, ¶ms)) != 0) + return (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_ALG, ret)); + if (mbedtls_oid_get_pk_alg(&alg_oid, &pk_alg) != 0) + return (MBEDTLS_ERR_PK_UNKNOWN_PK_ALG); + + if ((ret = mbedtls_asn1_get_bitstring_null(&p, end, &len)) != 0) + return (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, ret)); + + if (p + len != end) + return (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_INVALID_PUBKEY, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH)); + + if ((pk_info = mbedtls_pk_info_from_type(pk_alg)) == NULL) + return (MBEDTLS_ERR_PK_UNKNOWN_PK_ALG); + + if ((ret = mbedtls_pk_setup(ctx, pk_info)) != 0) + return (ret); + + /* assume mbedtls_pk_parse_subpubkey(&der, der+der_len, ctx) + * has already run with ctx initialized up to pk_get_ecpubkey(), + * and pk_get_ecpubkey() has returned MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE + * + * mbedtls mbedtls_ecp_point_read_binary() + * does not handle point in COMPRESSED format + * + * (validate assumption that algorithm is EC) */ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*ctx); + if (ecp_kp == NULL) + return (MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE); + mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp); + mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q); + mbedtls_ecp_group_id grp_id; + + /* mbedtls/library/pkparse.c:pk_use_ecparams() */ + + if (params.tag == MBEDTLS_ASN1_OID) + { + if (mbedtls_oid_get_ec_grp(¶ms, &grp_id) != 0) + return (MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE); + } + else + { + return (MBEDTLS_ERR_PK_KEY_INVALID_FORMAT); + } + + /* + * grp may already be initialized; if so, make sure IDs match + */ + if (ecp_kp_grp->id != MBEDTLS_ECP_DP_NONE && ecp_kp_grp->id != grp_id) + return (MBEDTLS_ERR_PK_KEY_INVALID_FORMAT); + + if ((ret = mbedtls_ecp_group_load(ecp_kp_grp, grp_id)) != 0) + return (ret); + + /* (validate assumption that EC point is in COMPRESSED format) */ + len = CRYPTO_EC_plen(ecp_kp_grp); + if (mbedtls_ecp_get_type(ecp_kp_grp) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS || (end - p) != 1 + len || + (*p != 0x02 && *p != 0x03)) + return (MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE); + + /* Instead of calling mbedtls/library/pkparse.c:pk_get_ecpubkey() to call + * mbedtls_ecp_point_read_binary(), manually parse point into ecp_kp_Q */ + mbedtls_mpi *X = &ecp_kp_Q->MBEDTLS_PRIVATE(X); + mbedtls_mpi *Y = &ecp_kp_Q->MBEDTLS_PRIVATE(Y); + mbedtls_mpi *Z = &ecp_kp_Q->MBEDTLS_PRIVATE(Z); + ret = mbedtls_mpi_lset(Z, 1); + if (ret != 0) + return (ret); + ret = mbedtls_mpi_read_binary(X, p + 1, len); + if (ret != 0) + return (ret); + /* derive Y + * (similar derivation of Y in crypto_mbedtls.c:crypto_ecdh_set_peerkey())*/ + ret = mbedtls_mpi_copy(Y, X) /*(Y is used as input and output obj below)*/ + || crypto_mbedtls_short_weierstrass_derive_y(ecp_kp_grp, Y, (*p & 1)); + if (ret != 0) + return (ret); + + return mbedtls_ecp_check_pubkey(ecp_kp_grp, ecp_kp_Q); +} + +struct crypto_ec_key *crypto_ec_key_parse_pub(const u8 *der, size_t der_len) +{ + mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + return NULL; + mbedtls_pk_init(ctx); + /*int rc = mbedtls_pk_parse_subpubkey(&der, der+der_len, ctx);*/ + int rc = mbedtls_pk_parse_public_key(ctx, der, der_len); + if (rc == 0) + return (struct crypto_ec_key *)ctx; + else if (rc == MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) + { + /* mbedtls mbedtls_ecp_point_read_binary() + * does not handle point in COMPRESSED format; parse internally */ + rc = crypto_mbedtls_pk_parse_subpubkey_compressed(ctx, der, der_len); + if (rc == 0) + return (struct crypto_ec_key *)ctx; + } + + mbedtls_pk_free(ctx); + os_free(ctx); + return NULL; +} + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP + +static struct crypto_ec_key *crypto_ec_key_set_pub_point_for_group(mbedtls_ecp_group_id grp_id, + const mbedtls_ecp_point *pub, + const u8 *buf, + size_t len) +{ + const mbedtls_pk_info_t *pk_info = mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY); + if (pk_info == NULL) + return NULL; + mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + return NULL; + mbedtls_pk_init(ctx); + if (mbedtls_pk_setup(ctx, pk_info) == 0) + { + /* (Is private key generation necessary for callers?) + * alt: gen key then overwrite Q + * mbedtls_ecp_gen_key(grp_id, ecp_kp, + * mbedtls_ctr_drbg_random, + * crypto_mbedtls_ctr_drbg()) == 0 + */ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*ctx); + mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp); + mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q); + mbedtls_mpi *ecp_kp_d = &ecp_kp->MBEDTLS_PRIVATE(d); + if (mbedtls_ecp_group_load(ecp_kp_grp, grp_id) == 0 && + (pub ? mbedtls_ecp_copy(ecp_kp_Q, pub) == 0 : + mbedtls_ecp_point_read_binary(ecp_kp_grp, ecp_kp_Q, buf, len) == 0) && + mbedtls_ecp_gen_privkey(ecp_kp_grp, ecp_kp_d, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) == 0) + { + return (struct crypto_ec_key *)ctx; + } + } + + mbedtls_pk_free(ctx); + os_free(ctx); + return NULL; +} + +struct crypto_ec_key *crypto_ec_key_set_pub(int group, const u8 *x, const u8 *y, size_t len) +{ + mbedtls_ecp_group_id grp_id = crypto_mbedtls_ecp_group_id_from_ike_id(group); + if (grp_id == MBEDTLS_ECP_DP_NONE) + return NULL; + if (len > MBEDTLS_MPI_MAX_SIZE) + return NULL; + u8 buf[1 + MBEDTLS_MPI_MAX_SIZE * 2]; + buf[0] = 0x04; /* assume x,y for Short Weierstrass */ + os_memcpy(buf + 1, x, len); + os_memcpy(buf + 1 + len, y, len); + + return crypto_ec_key_set_pub_point_for_group(grp_id, NULL, buf, 1 + len * 2); +} + +struct crypto_ec_key *crypto_ec_key_set_pub_point(struct crypto_ec *e, const struct crypto_ec_point *pub) +{ + mbedtls_ecp_group_id grp_id = ((mbedtls_ecp_group *)e)->id; + mbedtls_ecp_point *p = (mbedtls_ecp_point *)pub; + return crypto_ec_key_set_pub_point_for_group(grp_id, p, NULL, 0); +} + +struct crypto_ec_key *crypto_ec_key_gen(int group) +{ + mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + return NULL; + mbedtls_pk_init(ctx); + if (crypto_mbedtls_keypair_gen(group, ctx) == 0) + return (struct crypto_ec_key *)ctx; + mbedtls_pk_free(ctx); + os_free(ctx); + return NULL; +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */ + +void crypto_ec_key_deinit(struct crypto_ec_key *key) +{ + mbedtls_pk_free((mbedtls_pk_context *)key); + os_free(key); +} + +struct wpabuf *crypto_ec_key_get_subject_public_key(struct crypto_ec_key *key) +{ + /* (similar to crypto_ec_key_get_pubkey_point(), + * but compressed point format and ASN.1 DER wrapping)*/ +#ifndef MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES /*(mbedtls/library/pkwrite.h)*/ +#define MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES (30 + 2 * MBEDTLS_ECP_MAX_BYTES) +#endif + unsigned char buf[MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES]; + int len = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)key, buf, sizeof(buf)); + if (len < 0) + return NULL; + /* Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer */ + unsigned char *p = buf + sizeof(buf) - len; + +#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return NULL; + mbedtls_ecp_group *grp = &ecp_kp->MBEDTLS_PRIVATE(grp); + /* Note: sae_pk.c expects pubkey point in compressed format, + * but mbedtls_pk_write_pubkey_der() writes uncompressed format. + * Manually translate format and update lengths in DER format */ + if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) + { + unsigned char *end = buf + sizeof(buf); + size_t n; + /* SubjectPublicKeyInfo SEQUENCE */ + mbedtls_asn1_get_tag(&p, end, &n, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + /* algorithm AlgorithmIdentifier */ + unsigned char *a = p; + size_t alen; + mbedtls_asn1_get_tag(&p, end, &alen, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + p += alen; + alen = (size_t)(p - a); + /* subjectPublicKey BIT STRING */ + mbedtls_asn1_get_tag(&p, end, &n, MBEDTLS_ASN1_BIT_STRING); + /* rewrite into compressed point format and rebuild ASN.1 */ + p[1] = (buf[sizeof(buf) - 1] & 1) ? 0x03 : 0x02; + n = 1 + 1 + (n - 2) / 2; + len = mbedtls_asn1_write_len(&p, buf, n) + (int)n; + len += mbedtls_asn1_write_tag(&p, buf, MBEDTLS_ASN1_BIT_STRING); + os_memmove(p - alen, a, alen); + len += alen; + p -= alen; + len += mbedtls_asn1_write_len(&p, buf, (size_t)len); + len += mbedtls_asn1_write_tag(&p, buf, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + } +#endif + return wpabuf_alloc_copy(p, (size_t)len); +} + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP + +struct wpabuf *crypto_ec_key_get_ecprivate_key(struct crypto_ec_key *key, bool include_pub) +{ +#ifndef MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES /*(mbedtls/library/pkwrite.h)*/ +#define MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES (29 + 3 * MBEDTLS_ECP_MAX_BYTES) +#endif + unsigned char priv[MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES]; + int privlen = mbedtls_pk_write_key_der((mbedtls_pk_context *)key, priv, sizeof(priv)); + if (privlen < 0) + return NULL; + + struct wpabuf *wbuf; + + /* Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer */ + /* mbedtls_pk_write_key_der() includes publicKey in DER */ + if (include_pub) + wbuf = wpabuf_alloc_copy(priv + sizeof(priv) - privlen, privlen); + else + { + /* calculate publicKey offset and skip from end of buffer */ + unsigned char *p = priv + sizeof(priv) - privlen; + unsigned char *end = priv + sizeof(priv); + size_t len; + /* ECPrivateKey SEQUENCE */ + mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + /* version INTEGER */ + unsigned char *v = p; + mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER); + p += len; + /* privateKey OCTET STRING */ + mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING); + p += len; + /* parameters ECParameters */ + mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED); + p += len; + + /* write new SEQUENCE header (we know that it fits in priv[]) */ + len = (size_t)(p - v); + p = v; + len += mbedtls_asn1_write_len(&p, priv, len); + len += mbedtls_asn1_write_tag(&p, priv, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + wbuf = wpabuf_alloc_copy(p, len); + } + + forced_memzero(priv, sizeof(priv)); + return wbuf; +} + +struct wpabuf *crypto_ec_key_get_pubkey_point(struct crypto_ec_key *key, int prefix) +{ + /*(similarities to crypto_ecdh_get_pubkey(), but different struct)*/ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return NULL; + mbedtls_ecp_group *grp = &ecp_kp->MBEDTLS_PRIVATE(grp); + size_t len = CRYPTO_EC_plen(grp); +#ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED + /* len */ +#endif +#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED + if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) + len = len * 2 + 1; +#endif + struct wpabuf *buf = wpabuf_alloc(len); + if (buf == NULL) + return NULL; + mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q); + if (mbedtls_ecp_point_write_binary(grp, ecp_kp_Q, MBEDTLS_ECP_PF_UNCOMPRESSED, &len, wpabuf_mhead_u8(buf), len) == + 0) + { + if (!prefix) /* Remove 0x04 prefix if requested */ + os_memmove(wpabuf_mhead(buf), ((u8 *)wpabuf_mhead(buf) + 1), --len); + wpabuf_put(buf, len); + return buf; + } + + wpabuf_free(buf); + return NULL; +} + +const struct crypto_ec_point *crypto_ec_key_get_public_key(struct crypto_ec_key *key) +{ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return NULL; + mbedtls_ecp_point *p = os_malloc(sizeof(*p)); + if (p != NULL) + { + /*(mbedtls_ecp_export() uses &ecp_kp->MBEDTLS_PRIVATE(grp))*/ + mbedtls_ecp_point_init(p); + mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q); + if (mbedtls_ecp_copy(p, ecp_kp_Q)) + { + mbedtls_ecp_point_free(p); + os_free(p); + p = NULL; + } + } + return (struct crypto_ec_point *)p; +} + +const struct crypto_bignum *crypto_ec_key_get_private_key(struct crypto_ec_key *key) +{ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return NULL; + mbedtls_mpi *bn = os_malloc(sizeof(*bn)); + if (bn) + { + /*(mbedtls_ecp_export() uses &ecp_kp->MBEDTLS_PRIVATE(grp))*/ + mbedtls_mpi_init(bn); + mbedtls_mpi *ecp_kp_d = &ecp_kp->MBEDTLS_PRIVATE(d); + if (mbedtls_mpi_copy(bn, ecp_kp_d)) + { + mbedtls_mpi_free(bn); + os_free(bn); + bn = NULL; + } + } + return (struct crypto_bignum *)bn; +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */ + +static mbedtls_md_type_t crypto_ec_key_sign_md(size_t len) +{ + /* get mbedtls_md_type_t from length of hash data to be signed */ + switch (len) + { + case 64: + return MBEDTLS_MD_SHA512; + case 48: + return MBEDTLS_MD_SHA384; + case 32: + return MBEDTLS_MD_SHA256; + case 20: + return MBEDTLS_MD_SHA1; + case 16: + return MBEDTLS_MD_MD5; + default: + return MBEDTLS_MD_NONE; + } +} + +struct wpabuf *crypto_ec_key_sign(struct crypto_ec_key *key, const u8 *data, size_t len) +{ +#ifndef MBEDTLS_PK_SIGNATURE_MAX_SIZE /*(defined since mbedtls 2.20.0)*/ +#if MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_MPI_MAX_SIZE +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN +#else +#define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE +#endif +#endif + size_t sig_len = MBEDTLS_PK_SIGNATURE_MAX_SIZE; + struct wpabuf *buf = wpabuf_alloc(sig_len); + if (buf == NULL) + return NULL; + if (mbedtls_pk_sign((mbedtls_pk_context *)key, crypto_ec_key_sign_md(len), data, len, wpabuf_mhead_u8(buf), +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + sig_len, +#endif + &sig_len, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) == 0) + { + wpabuf_put(buf, sig_len); + return buf; + } + + wpabuf_free(buf); + return NULL; +} + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP +struct wpabuf *crypto_ec_key_sign_r_s(struct crypto_ec_key *key, const u8 *data, size_t len) +{ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return NULL; + + size_t sig_len = MBEDTLS_ECDSA_MAX_LEN; + u8 buf[MBEDTLS_ECDSA_MAX_LEN]; + if (mbedtls_ecdsa_write_signature(ecp_kp, crypto_ec_key_sign_md(len), data, len, buf, +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + sig_len, +#endif + &sig_len, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg())) + { + return NULL; + } + + /*(mbedtls_ecdsa_write_signature() writes signature in ASN.1)*/ + /* parse ASN.1 to get r and s and lengths */ + u8 *p = buf, *r, *s; + u8 *end = p + sig_len; + size_t rlen, slen; + mbedtls_asn1_get_tag(&p, end, &rlen, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + mbedtls_asn1_get_tag(&p, end, &rlen, MBEDTLS_ASN1_INTEGER); + r = p; + p += rlen; + mbedtls_asn1_get_tag(&p, end, &slen, MBEDTLS_ASN1_INTEGER); + s = p; + + /* write raw r and s into out + * (including removal of leading 0 if added for ASN.1 integer) + * note: DPP caller expects raw r, s each padded to prime len */ + mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp); + size_t plen = CRYPTO_EC_plen(ecp_kp_grp); + if (rlen > plen) + { + r += (rlen - plen); + rlen = plen; + } + if (slen > plen) + { + s += (slen - plen); + slen = plen; + } + struct wpabuf *out = wpabuf_alloc(plen * 2); + if (out) + { + wpabuf_put(out, plen * 2); + p = wpabuf_mhead_u8(out); + os_memset(p, 0, plen * 2); + os_memcpy(p + plen * 1 - rlen, r, rlen); + os_memcpy(p + plen * 2 - slen, s, slen); + } + return out; +} +#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */ + +int crypto_ec_key_verify_signature(struct crypto_ec_key *key, const u8 *data, size_t len, const u8 *sig, size_t sig_len) +{ + switch (mbedtls_pk_verify((mbedtls_pk_context *)key, crypto_ec_key_sign_md(len), data, len, sig, sig_len)) + { + case 0: + /*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*/ /* XXX: allow? */ + return 1; + case MBEDTLS_ERR_ECP_VERIFY_FAILED: + return 0; + default: + return -1; + } +} + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP +int crypto_ec_key_verify_signature_r_s( + struct crypto_ec_key *key, const u8 *data, size_t len, const u8 *r, size_t r_len, const u8 *s, size_t s_len) +{ + /* reimplement mbedtls_ecdsa_read_signature() without encoding r and s + * into ASN.1 just for mbedtls_ecdsa_read_signature() to decode ASN.1 */ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return -1; + mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp); + mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q); + + mbedtls_mpi mpi_r; + mbedtls_mpi mpi_s; + mbedtls_mpi_init(&mpi_r); + mbedtls_mpi_init(&mpi_s); + int ret = mbedtls_mpi_read_binary(&mpi_r, r, r_len) || mbedtls_mpi_read_binary(&mpi_s, s, s_len) ? -1 : 0; + if (ret == 0) + { + ret = mbedtls_ecdsa_verify(ecp_kp_grp, data, len, ecp_kp_Q, &mpi_r, &mpi_s); + ret = ret ? ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA ? 0 : -1 : 1; + } + mbedtls_mpi_free(&mpi_r); + mbedtls_mpi_free(&mpi_s); + return ret; +} +#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */ + +int crypto_ec_key_group(struct crypto_ec_key *key) +{ + mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key); + if (ecp_kp == NULL) + return -1; + mbedtls_ecp_group *ecp_group = &ecp_kp->MBEDTLS_PRIVATE(grp); + return crypto_mbedtls_ike_id_from_ecp_group_id(ecp_group->id); +} + +#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP + +int crypto_ec_key_cmp(struct crypto_ec_key *key1, struct crypto_ec_key *key2) +{ + mbedtls_ecp_keypair *ecp_kp1 = mbedtls_pk_ec(*(mbedtls_pk_context *)key1); + mbedtls_ecp_keypair *ecp_kp2 = mbedtls_pk_ec(*(mbedtls_pk_context *)key2); + if (ecp_kp1 == NULL || ecp_kp2 == NULL) + return -1; + mbedtls_ecp_group *ecp_kp1_grp = &ecp_kp1->MBEDTLS_PRIVATE(grp); + mbedtls_ecp_group *ecp_kp2_grp = &ecp_kp2->MBEDTLS_PRIVATE(grp); + mbedtls_ecp_point *ecp_kp1_Q = &ecp_kp1->MBEDTLS_PRIVATE(Q); + mbedtls_ecp_point *ecp_kp2_Q = &ecp_kp2->MBEDTLS_PRIVATE(Q); + return ecp_kp1_grp->id != ecp_kp2_grp->id || mbedtls_ecp_point_cmp(ecp_kp1_Q, ecp_kp2_Q) ? -1 : 0; +} + +void crypto_ec_key_debug_print(const struct crypto_ec_key *key, const char *title) +{ + /* TBD: what info is desirable here and in what human readable format?*/ + /*(crypto_openssl.c prints a human-readably public key and attributes)*/ + wpa_printf(MSG_DEBUG, "%s: %s not implemented", title, __func__); +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */ + +#endif /* CRYPTO_MBEDTLS_CRYPTO_EC */ + +#ifdef CRYPTO_MBEDTLS_CRYPTO_CSR + +#include +#include + +struct crypto_csr *crypto_csr_init(void) +{ + mbedtls_x509write_csr *csr = os_malloc(sizeof(*csr)); + if (csr != NULL) + mbedtls_x509write_csr_init(csr); + return (struct crypto_csr *)csr; +} + +struct crypto_csr *crypto_csr_verify(const struct wpabuf *req) +{ + /* future: look for alternatives to MBEDTLS_PRIVATE() access */ + + /* sole caller src/common/dpp_crypto.c:dpp_validate_csr() + * uses (mbedtls_x509_csr *) to obtain CSR_ATTR_CHALLENGE_PASSWORD + * so allocate different object (mbedtls_x509_csr *) and special-case + * object when used in crypto_csr_get_attribute() and when free()d in + * crypto_csr_deinit(). */ + + mbedtls_x509_csr *csr = os_malloc(sizeof(*csr)); + if (csr == NULL) + return NULL; + mbedtls_x509_csr_init(csr); + const mbedtls_md_info_t *md_info; + unsigned char digest[MBEDTLS_MD_MAX_SIZE]; + if (mbedtls_x509_csr_parse_der(csr, wpabuf_head(req), wpabuf_len(req)) == 0 && + (md_info = mbedtls_md_info_from_type(csr->MBEDTLS_PRIVATE(sig_md))) != NULL && + mbedtls_md(md_info, csr->cri.p, csr->cri.len, digest) == 0) + { + switch (mbedtls_pk_verify(&csr->pk, csr->MBEDTLS_PRIVATE(sig_md), digest, mbedtls_md_get_size(md_info), + csr->MBEDTLS_PRIVATE(sig).p, csr->MBEDTLS_PRIVATE(sig).len)) + { + case 0: + /*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*/ /* XXX: allow? */ + return (struct crypto_csr *)((uintptr_t)csr | 1uL); + default: + break; + } + } + + mbedtls_x509_csr_free(csr); + os_free(csr); + return NULL; +} + +void crypto_csr_deinit(struct crypto_csr *csr) +{ + if ((uintptr_t)csr & 1uL) + { + csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL); + mbedtls_x509_csr_free((mbedtls_x509_csr *)csr); + } + else + mbedtls_x509write_csr_free((mbedtls_x509write_csr *)csr); + os_free(csr); +} + +int crypto_csr_set_ec_public_key(struct crypto_csr *csr, struct crypto_ec_key *key) +{ + mbedtls_x509write_csr_set_key((mbedtls_x509write_csr *)csr, (mbedtls_pk_context *)key); + return 0; +} + +int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type, const char *name) +{ + /* specialized for src/common/dpp_crypto.c */ + + /* sole caller src/common/dpp_crypto.c:dpp_build_csr() + * calls this function only once, using type == CSR_NAME_CN + * (If called more than once, this code would need to append + * components to the subject name, which we could do by + * appending to (mbedtls_x509write_csr *) private member + * mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject)) */ + + const char *label; + switch (type) + { + case CSR_NAME_CN: + label = "CN="; + break; + case CSR_NAME_SN: + label = "SN="; + break; + case CSR_NAME_C: + label = "C="; + break; + case CSR_NAME_O: + label = "O="; + break; + case CSR_NAME_OU: + label = "OU="; + break; + default: + return -1; + } + + size_t len = strlen(name); + struct wpabuf *buf = wpabuf_alloc(3 + len + 1); + if (buf == NULL) + return -1; + wpabuf_put_data(buf, label, strlen(label)); + wpabuf_put_data(buf, name, len + 1); /*(include trailing '\0')*/ + /* Note: 'name' provided is set as given and should be backslash-escaped + * by caller when necessary, e.g. literal ',' which are not separating + * components should be backslash-escaped */ + + int ret = mbedtls_x509write_csr_set_subject_name((mbedtls_x509write_csr *)csr, wpabuf_head(buf)) ? -1 : 0; + wpabuf_free(buf); + return ret; +} + +/* OBJ_pkcs9_challengePassword 1 2 840 113549 1 9 7 */ +static const char OBJ_pkcs9_challengePassword[] = MBEDTLS_OID_PKCS9 "\x07"; + +int crypto_csr_set_attribute( + struct crypto_csr *csr, enum crypto_csr_attr attr, int attr_type, const u8 *value, size_t len) +{ + /* specialized for src/common/dpp_crypto.c */ + /* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes + * attr == CSR_ATTR_CHALLENGE_PASSWORD + * attr_type == ASN1_TAG_UTF8STRING */ + + const char *oid; + size_t oid_len; + switch (attr) + { + case CSR_ATTR_CHALLENGE_PASSWORD: + oid = OBJ_pkcs9_challengePassword; + oid_len = sizeof(OBJ_pkcs9_challengePassword) - 1; + break; + default: + return -1; + } + + (void)oid; + (void)oid_len; + + /* mbedtls does not currently provide way to set an attribute in a CSR: + * https://github.com/Mbed-TLS/mbedtls/issues/4886 */ + wpa_printf(MSG_ERROR, + "mbedtls does not currently support setting challengePassword " + "attribute in CSR"); + return -1; +} + +const u8 *mbedtls_x509_csr_attr_oid_value( + mbedtls_x509_csr *csr, const char *oid, size_t oid_len, size_t *vlen, int *vtype) +{ + /* Note: mbedtls_x509_csr_parse_der() has parsed and validated CSR, + * so validation checks are not repeated here + * + * It would be nicer if (mbedtls_x509_csr *) had an mbedtls_x509_buf of + * Attributes (or at least a pointer) since mbedtls_x509_csr_parse_der() + * already parsed the rest of CertificationRequestInfo, some of which is + * repeated here to step to Attributes. Since csr->subject_raw.p points + * into csr->cri.p, which points into csr->raw.p, step over version and + * subject of CertificationRequestInfo (SEQUENCE) */ + unsigned char *p = csr->subject_raw.p + csr->subject_raw.len; + unsigned char *end = csr->cri.p + csr->cri.len, *ext; + size_t len; + + /* step over SubjectPublicKeyInfo */ + mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE); + p += len; + + /* Attributes + * { ATTRIBUTE:IOSet } ::= SET OF { SEQUENCE { OID, value } } + */ + if (mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC) != 0) + { + return NULL; + } + while (p < end) + { + if (mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) != 0) + { + return NULL; + } + ext = p; + p += len; + + if (mbedtls_asn1_get_tag(&ext, end, &len, MBEDTLS_ASN1_OID) != 0) + return NULL; + if (oid_len != len || 0 != memcmp(ext, oid, oid_len)) + continue; + + /* found oid; return value */ + *vtype = *ext++; /* tag */ + return (mbedtls_asn1_get_len(&ext, end, vlen) == 0) ? ext : NULL; + } + + return NULL; +} + +const u8 *crypto_csr_get_attribute(struct crypto_csr *csr, enum crypto_csr_attr attr, size_t *len, int *type) +{ + /* specialized for src/common/dpp_crypto.c */ + /* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes + * attr == CSR_ATTR_CHALLENGE_PASSWORD */ + + const char *oid; + size_t oid_len; + switch (attr) + { + case CSR_ATTR_CHALLENGE_PASSWORD: + oid = OBJ_pkcs9_challengePassword; + oid_len = sizeof(OBJ_pkcs9_challengePassword) - 1; + break; + default: + return NULL; + } + + /* see crypto_csr_verify(); expecting (mbedtls_x509_csr *) tagged |=1 */ + if (!((uintptr_t)csr & 1uL)) + return NULL; + csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL); + + return mbedtls_x509_csr_attr_oid_value((mbedtls_x509_csr *)csr, oid, oid_len, len, type); +} + +struct wpabuf *crypto_csr_sign(struct crypto_csr *csr, struct crypto_ec_key *key, enum crypto_hash_alg algo) +{ + mbedtls_md_type_t sig_md; + switch (algo) + { + case CRYPTO_HASH_ALG_SHA256: + sig_md = MBEDTLS_MD_SHA256; + break; + case CRYPTO_HASH_ALG_SHA384: + sig_md = MBEDTLS_MD_SHA384; + break; + case CRYPTO_HASH_ALG_SHA512: + sig_md = MBEDTLS_MD_SHA512; + break; + default: + return NULL; + } + mbedtls_x509write_csr_set_md_alg((mbedtls_x509write_csr *)csr, sig_md); + + unsigned char buf[4096]; /* XXX: large enough? too large? */ + int len = mbedtls_x509write_csr_der((mbedtls_x509write_csr *)csr, buf, sizeof(buf), mbedtls_ctr_drbg_random, + crypto_mbedtls_ctr_drbg()); + if (len < 0) + return NULL; + /* Note: data is written at the end of the buffer! Use the + * return value to determine where you should start + * using the buffer */ + return wpabuf_alloc_copy(buf + sizeof(buf) - len, (size_t)len); +} + +#endif /* CRYPTO_MBEDTLS_CRYPTO_CSR */ + +#ifdef CRYPTO_MBEDTLS_CRYPTO_PKCS7 +struct wpabuf *crypto_pkcs7_get_certificates(const struct wpabuf *pkcs7) +{ + return NULL; +} +#endif /* CRYPTO_MBEDTLS_CRYPTO_PKCS7 */ + +#ifdef MBEDTLS_ARC4_C +#include +int rc4_skip(const u8 *key, size_t keylen, size_t skip, u8 *data, size_t data_len) +{ + mbedtls_arc4_context ctx; + mbedtls_arc4_init(&ctx); + mbedtls_arc4_setup(&ctx, key, keylen); + + if (skip) + { + /*(prefer [16] on ancient hardware with smaller cache lines)*/ + unsigned char skip_buf[64]; /*('skip' is generally small)*/ + /*os_memset(skip_buf, 0, sizeof(skip_buf));*/ /*(necessary?)*/ + size_t len; + do + { + len = skip > sizeof(skip_buf) ? sizeof(skip_buf) : skip; + mbedtls_arc4_crypt(&ctx, len, skip_buf, skip_buf); + } while ((skip -= len)); + } + + int ret = mbedtls_arc4_crypt(&ctx, data_len, data, data); + mbedtls_arc4_free(&ctx); + return ret; +} +#endif + +#ifdef CRYPTO_MBEDTLS_CRYPTO_RSA +#ifdef MBEDTLS_RSA_C + +/* duplicated in tls_mbedtls.c:tls_mbedtls_readfile()*/ +__attribute_noinline__ static int crypto_mbedtls_readfile(const char *path, u8 **buf, size_t *n) +{ + /*(use os_readfile() so that we can use os_free() + *(if we use mbedtls_pk_load_file() above, macros prevent calling free() + * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free() + * on buf aborts in tests if buf not allocated via os_malloc())*/ + *buf = (u8 *)os_readfile(path, n); + if (!*buf) + { + wpa_printf(MSG_ERROR, "error: os_readfile %s", path); + return -1; + } + u8 *buf0 = os_realloc(*buf, *n + 1); + if (!buf0) + { + bin_clear_free(*buf, *n); + *buf = NULL; + return -1; + } + buf0[(*n)++] = '\0'; + *buf = buf0; + return 0; +} + +#include +#include + +struct crypto_rsa_key *crypto_rsa_key_read(const char *file, bool private_key) +{ + /* mbedtls_pk_parse_keyfile() and mbedtls_pk_parse_public_keyfile() + * require #ifdef MBEDTLS_FS_IO in mbedtls library. Prefer to use + * crypto_mbedtls_readfile(), which wraps os_readfile() */ + u8 *data; + size_t len; + if (crypto_mbedtls_readfile(file, &data, &len) != 0) + return NULL; + + mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx)); + if (ctx == NULL) + { + bin_clear_free(data, len); + return NULL; + } + mbedtls_pk_init(ctx); + + int rc; + rc = (private_key ? mbedtls_pk_parse_key(ctx, data, len, NULL, 0 +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + , + mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg() +#endif + ) : + mbedtls_pk_parse_public_key(ctx, data, len)) == 0 && + mbedtls_pk_can_do(ctx, MBEDTLS_PK_RSA); + + bin_clear_free(data, len); + + if (rc) + { + /* use MBEDTLS_RSA_PKCS_V21 padding for RSAES-OAEP */ + /* use MBEDTLS_MD_SHA256 for these hostap interfaces */ +#if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */ + /*(no return value in mbedtls 2.x)*/ + mbedtls_rsa_set_padding(mbedtls_pk_rsa(*ctx), MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA256); +#else + if (mbedtls_rsa_set_padding(mbedtls_pk_rsa(*ctx), MBEDTLS_RSA_PKCS_V21, MBEDTLS_MD_SHA256) == 0) +#endif + return (struct crypto_rsa_key *)ctx; + } + + mbedtls_pk_free(ctx); + os_free(ctx); + return NULL; +} + +struct wpabuf *crypto_rsa_oaep_sha256_encrypt(struct crypto_rsa_key *key, const struct wpabuf *in) +{ + mbedtls_rsa_context *pk_rsa = mbedtls_pk_rsa(*(mbedtls_pk_context *)key); + size_t olen = mbedtls_rsa_get_len(pk_rsa); + struct wpabuf *buf = wpabuf_alloc(olen); + if (buf == NULL) + return NULL; + + /* mbedtls_pk_encrypt() takes a few more hops to get to same func */ + if (mbedtls_rsa_rsaes_oaep_encrypt(pk_rsa, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg(), +#if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */ + MBEDTLS_RSA_PRIVATE, +#endif + NULL, 0, wpabuf_len(in), wpabuf_head(in), wpabuf_put(buf, olen)) == 0) + { + return buf; + } + + wpabuf_clear_free(buf); + return NULL; +} + +struct wpabuf *crypto_rsa_oaep_sha256_decrypt(struct crypto_rsa_key *key, const struct wpabuf *in) +{ + mbedtls_rsa_context *pk_rsa = mbedtls_pk_rsa(*(mbedtls_pk_context *)key); + size_t olen = mbedtls_rsa_get_len(pk_rsa); + struct wpabuf *buf = wpabuf_alloc(olen); + if (buf == NULL) + return NULL; + + /* mbedtls_pk_decrypt() takes a few more hops to get to same func */ + if (mbedtls_rsa_rsaes_oaep_decrypt(pk_rsa, mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg(), +#if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */ + MBEDTLS_RSA_PUBLIC, +#endif + NULL, 0, &olen, wpabuf_head(in), wpabuf_mhead(buf), olen) == 0) + { + wpabuf_put(buf, olen); + return buf; + } + + wpabuf_clear_free(buf); + return NULL; +} + +void crypto_rsa_key_free(struct crypto_rsa_key *key) +{ + mbedtls_pk_free((mbedtls_pk_context *)key); + os_free(key); +} + +#endif /* MBEDTLS_RSA_C */ +#endif /* CRYPTO_MBEDTLS_CRYPTO_RSA */ +#endif diff --git a/src/crypto/tls_mbedtls_alt.c b/src/crypto/tls_mbedtls_alt.c new file mode 100644 index 0000000000..1c8ebcfcc7 --- /dev/null +++ b/src/crypto/tls_mbedtls_alt.c @@ -0,0 +1,3289 @@ +/* + * SSL/TLS interface functions for mbed TLS + * + * SPDX-FileCopyrightText: 2022 Glenn Strauss + * SPDX-License-Identifier: BSD-3-Clause + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + * + * template: src/crypto/tls_none.c + * reference: src/crypto/tls_*.c + * + * Known Limitations: + * - no TLSv1.3 (not available in mbedtls 2.x; experimental in mbedtls 3.x) + * - no OCSP (not yet available in mbedtls) + * - mbedtls does not support all certificate encodings used by hwsim tests + * PCKS#5 v1.5 + * PCKS#12 + * DH DSA + * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c + * - mbedtls does not currently provide way to set an attribute in a CSR + * https://github.com/Mbed-TLS/mbedtls/issues/4886 + * so tests/hwsim dpp_enterprise tests fail + * - DPP2 not supported + * PKCS#7 parsing is not supported in mbedtls + * See crypto_mbedtls.c:crypto_pkcs7_get_certificates() comments + * - DPP3 not supported + * hpke_base_seal() and hpke_base_seal() not implemented in crypto_mbedtls.c + * + * Status: + * - code written to be compatible with mbedtls 2.x and mbedtls 3.x + * (currently requires mbedtls >= 2.27.0 for mbedtls_mpi_random()) + * (currently requires mbedtls >= 2.18.0 for mbedtls_ssl_tls_prf()) + * - builds with tests/build/build-wpa_supplicant-mbedtls.config + * - passes all tests/ crypto module tests (incomplete coverage) + * ($ cd tests; make clean; make -j 4 run-tests CONFIG_TLS=mbedtls) + * - passes almost all tests/hwsim tests + * (hwsim tests skipped for missing features) + * + * RFE: + * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c + * - client/server session resumption, and/or save client session ticket + */ + +#include "includes.h" +#include "utils/common.h" + +#ifndef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE + +#include +#include +#include +#include +#include +#include /* mbedtls_calloc() mbedtls_free() */ +#include /* mbedtls_platform_zeroize() */ +#include +#include +#include +#include + +#ifdef MBEDTLS_DEBUG_C +#define DEBUG_THRESHOLD 4 +#include +#ifdef __ZEPHYR__ +#define PRINTF printk +#else +#include "fsl_debug_console.h" +#endif +#define tls_mbedtls_d(...) PRINTF("tls_mbedtls", ##__VA_ARGS__) +#else +#define tls_mbedtls_d(...) +#endif /* MBEDTLS_DEBUG_C */ + +#if MBEDTLS_VERSION_NUMBER >= 0x02040000 /* mbedtls 2.4.0 */ +#include +#else +#include +#endif + +#ifndef MBEDTLS_PRIVATE +#define MBEDTLS_PRIVATE(x) x +#endif + +#if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */ +#define mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl) \ + ((ssl)->MBEDTLS_PRIVATE(session) ? (ssl)->MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(ciphersuite) : 0) +#define mbedtls_ssl_ciphersuite_get_name(info) (info)->MBEDTLS_PRIVATE(name) +#endif + +#include "crypto.h" /* sha256_vector() */ +#include "tls.h" + +#ifndef SHA256_DIGEST_LENGTH +#define SHA256_DIGEST_LENGTH 32 +#endif + +#ifndef MBEDTLS_EXPKEY_FIXED_SECRET_LEN +#define MBEDTLS_EXPKEY_FIXED_SECRET_LEN 48 +#endif + +#ifndef MBEDTLS_EXPKEY_RAND_LEN +#define MBEDTLS_EXPKEY_RAND_LEN 32 +#endif + +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ +static mbedtls_ssl_export_keys_t tls_connection_export_keys_cb; +#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ +static mbedtls_ssl_export_keys_ext_t tls_connection_export_keys_cb; +#else /*(not implemented; return error)*/ +#define mbedtls_ssl_tls_prf(a, b, c, d, e, f, g, h) (-1) +typedef mbedtls_tls_prf_types int; +#endif + +/* hostapd/wpa_supplicant provides forced_memzero(), + * but prefer mbedtls_platform_zeroize() */ +#define forced_memzero(ptr, sz) mbedtls_platform_zeroize(ptr, sz) + +/* much of fine-grained certificate subject matching (300+ LoC) could probably + * be replaced by sending a DN hint with ServerHello Certificate Request, and + * then checking the client cert against the DN hint in certificate verify_cb. + * Comment out to disable feature and remove ~3k from binary .text segment */ +/* needs mbedtls private access, so temporarily comment out and see what happens */ +//#define TLS_MBEDTLS_CERT_VERIFY_EXTMATCH +//#define TLS_MBEDTLS_CERT_DISABLE_KEY_USAGE_CHECK + +#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \ + defined(EAP_SERVER_TEAP) +#ifdef MBEDTLS_SSL_SESSION_TICKETS +#ifdef MBEDTLS_SSL_TICKET_C +#define TLS_MBEDTLS_SESSION_TICKETS +#if defined(EAP_TEAP) || defined(EAP_SERVER_TEAP) +#define TLS_MBEDTLS_EAP_TEAP +#endif +#if !defined(CONFIG_FIPS) /* EAP-FAST keys cannot be exported in FIPS mode */ +#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) +#define TLS_MBEDTLS_EAP_FAST +#endif +#endif +#endif +#endif +#endif + +struct tls_conf +{ + mbedtls_ssl_config conf; + + unsigned int verify_peer : 1; + unsigned int verify_depth0_only : 1; + unsigned int check_crl : 2; /*(needs :2 bits for 0, 1, 2)*/ + unsigned int check_crl_strict : 1; /*(needs :1 bit for 0, 1)*/ + unsigned int ca_cert_probe : 1; + unsigned int has_ca_cert : 1; + unsigned int has_client_cert : 1; + unsigned int has_private_key : 1; + unsigned int suiteb128 : 1; + unsigned int suiteb192 : 1; + mbedtls_x509_crl *crl; + mbedtls_x509_crt ca_cert; + mbedtls_x509_crt client_cert; + mbedtls_pk_context private_key; + + uint32_t refcnt; + + unsigned int flags; +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + char *subject_match; + char *altsubject_match; + char *suffix_match; + char *domain_match; + char *check_cert_subject; +#endif + u8 ca_cert_hash[SHA256_DIGEST_LENGTH]; + + int *ciphersuites; /* list of ciphersuite ids for mbedtls_ssl_config */ +#if MBEDTLS_VERSION_NUMBER < 0x03010000 /* mbedtls 3.1.0 */ + mbedtls_ecp_group_id *curves; +#else + uint16_t *curves; /* list of curve ids for mbedtls_ssl_config */ +#endif +}; + +struct tls_global +{ + struct tls_conf *tls_conf; + char *ocsp_stapling_response; + mbedtls_ctr_drbg_context *ctr_drbg; /*(see crypto_mbedtls.c)*/ +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_context ticket_ctx; +#endif + char *ca_cert_file; + struct os_reltime crl_reload_previous; + unsigned int crl_reload_interval; + uint32_t refcnt; + struct tls_config init_conf; +}; + +static struct tls_global tls_ctx_global; + +struct tls_connection +{ + struct tls_conf *tls_conf; + struct wpabuf *push_buf; + struct wpabuf *pull_buf; + size_t pull_buf_offset; + + unsigned int established : 1; + unsigned int resumed : 1; + unsigned int verify_peer : 1; + unsigned int is_server : 1; + + mbedtls_ssl_context ssl; + + mbedtls_tls_prf_types tls_prf_type; + size_t expkey_keyblock_size; + size_t expkey_secret_len; +#if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */ + unsigned char expkey_secret[MBEDTLS_EXPKEY_FIXED_SECRET_LEN]; +#else + unsigned char expkey_secret[MBEDTLS_MD_MAX_SIZE]; +#endif + unsigned char expkey_randbytes[MBEDTLS_EXPKEY_RAND_LEN * 2]; + + int read_alerts, write_alerts, failed; + +#ifdef TLS_MBEDTLS_SESSION_TICKETS + tls_session_ticket_cb session_ticket_cb; + void *session_ticket_cb_ctx; + unsigned char *clienthello_session_ticket; + size_t clienthello_session_ticket_len; +#endif + char *peer_subject; /* peer subject info for authenticated peer */ + struct wpabuf *success_data; +}; + +#ifndef __has_attribute +#define __has_attribute(x) 0 +#endif + +#ifndef __GNUC_PREREQ +#define __GNUC_PREREQ(maj, min) 0 +#endif + +#ifndef __attribute_cold__ +#if __has_attribute(cold) || __GNUC_PREREQ(4, 3) +#define __attribute_cold__ __attribute__((__cold__)) +#else +#define __attribute_cold__ +#endif +#endif + +#ifndef __attribute_noinline__ +#if __has_attribute(noinline) || __GNUC_PREREQ(3, 1) +#define __attribute_noinline__ __attribute__((__noinline__)) +#else +#define __attribute_noinline__ +#endif +#endif + +__attribute_cold__ __attribute_noinline__ static void emsg(int level, const char *const msg) +{ + wpa_printf(level, "MTLS: %s", msg); +} + +__attribute_cold__ __attribute_noinline__ static void emsgrc(int level, const char *const msg, int rc) +{ +#ifdef MBEDTLS_ERROR_C + /* error logging convenience function that decodes mbedtls result codes */ + char buf[256]; + mbedtls_strerror(rc, buf, sizeof(buf)); + wpa_printf(level, "MTLS: %s: %s (-0x%04x)", msg, buf, -rc); +#else + wpa_printf(level, "MTLS: %s: (-0x%04x)", msg, -rc); +#endif +} + +#define elog(rc, msg) emsgrc(MSG_ERROR, (msg), (rc)) +#define ilog(rc, msg) emsgrc(MSG_INFO, (msg), (rc)) + +#ifdef MBEDTLS_DEBUG_C +static void (*g_f_dbg)(void *, int, const char *, int, const char *); + +#ifdef __ICCARM__ +#define PATH_SEPARATOR '\\' +#else +#define PATH_SEPARATOR '/' +#endif /* __ICCARM__ */ + +/* + * This function will return basename of filename i.e. + * it will return a pointer to basename in the filename after ignoring '/'. + * + * e.g. for filename "abc/xyx/some_name.c", this function will return + * pointer to basename i.e. "some_name.c" + */ +static char *get_basename(char *file_name) +{ + char *p = strrchr(file_name, PATH_SEPARATOR); + return p ? ++p : file_name; +} + +static void tls_mbedtls_f_dbg(void *ctx, int level, const char *file, int line, const char *str) +{ + (void)PRINTF("%s:%04d: |%d| %s\r\n", get_basename((char *)file), line, level, str); +} + +void tls_mbedtls_set_debug_cb(mbedtls_ssl_config *conf, + int threshold, + void (*f_dbg)(void *, int, const char *, int, const char *)) +{ + if (!conf) + { + elog(-1, "Invalid SSL configuration context"); + return; + } + + if (!f_dbg && !g_f_dbg) + { + /** + * If 'NULL' dbg function and 'g_f_dbg' has not been set yet, + * then set 'g_f_dbg' pointing to global dbg function, + * and set it in conf. + */ + g_f_dbg = tls_mbedtls_f_dbg; + mbedtls_ssl_conf_dbg(conf, g_f_dbg, NULL); + } + else if (!f_dbg && g_f_dbg) + { + /** + * If 'NULL' dbg function and already set 'g_f_dbg', + * we will not override 'g_f_dbg', + * but set it in conf. + */ + mbedtls_ssl_conf_dbg(conf, g_f_dbg, NULL); + } + else if (f_dbg) + { + /** + * If valid dbg function then set it in conf. + */ + mbedtls_ssl_conf_dbg(conf, f_dbg, NULL); + } + mbedtls_debug_set_threshold(threshold); +} +#endif /* MBEDTLS_DEBUG_C */ + +struct tls_conf *tls_conf_init(void *tls_ctx) +{ + struct tls_conf *tls_conf = os_zalloc(sizeof(*tls_conf)); + if (tls_conf == NULL) + return NULL; + tls_conf->refcnt = 1; + + mbedtls_ssl_config_init(&tls_conf->conf); + mbedtls_ssl_conf_rng(&tls_conf->conf, mbedtls_ctr_drbg_random, tls_ctx_global.ctr_drbg); + mbedtls_x509_crt_init(&tls_conf->ca_cert); + mbedtls_x509_crt_init(&tls_conf->client_cert); + mbedtls_pk_init(&tls_conf->private_key); + +#ifdef MBEDTLS_DEBUG_C + tls_mbedtls_set_debug_cb(&tls_conf->conf, DEBUG_THRESHOLD, NULL); +#endif + return tls_conf; +} + +void tls_conf_deinit(struct tls_conf *tls_conf) +{ + if (tls_conf == NULL || --tls_conf->refcnt != 0) + return; + + mbedtls_x509_crt_free(&tls_conf->ca_cert); + mbedtls_x509_crt_free(&tls_conf->client_cert); + if (tls_conf->crl) + { + mbedtls_x509_crl_free(tls_conf->crl); + os_free(tls_conf->crl); + } + mbedtls_pk_free(&tls_conf->private_key); + mbedtls_ssl_config_free(&tls_conf->conf); + os_free(tls_conf->curves); + os_free(tls_conf->ciphersuites); +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + os_free(tls_conf->subject_match); + os_free(tls_conf->altsubject_match); + os_free(tls_conf->suffix_match); + os_free(tls_conf->domain_match); + os_free(tls_conf->check_cert_subject); +#endif + os_free(tls_conf); +} + +mbedtls_ctr_drbg_context *crypto_mbedtls_ctr_drbg(void); /*(not in header)*/ + +__attribute_cold__ void *tls_init(const struct tls_config *conf) +{ + /* RFE: review struct tls_config *conf (different from tls_conf) */ + + if (++tls_ctx_global.refcnt > 1) + return &tls_ctx_global; + + tls_ctx_global.ctr_drbg = crypto_mbedtls_ctr_drbg(); +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_init(&tls_ctx_global.ticket_ctx); + mbedtls_ssl_ticket_setup(&tls_ctx_global.ticket_ctx, mbedtls_ctr_drbg_random, tls_ctx_global.ctr_drbg, + MBEDTLS_CIPHER_AES_256_GCM, 43200); /* ticket timeout: 12 hours */ +#endif + /* copy struct for future use */ + tls_ctx_global.init_conf = *conf; + if (conf->openssl_ciphers) + tls_ctx_global.init_conf.openssl_ciphers = os_strdup(conf->openssl_ciphers); + + tls_ctx_global.crl_reload_interval = conf->crl_reload_interval; + os_get_reltime(&tls_ctx_global.crl_reload_previous); + + return &tls_ctx_global; +} + +__attribute_cold__ void tls_deinit(void *tls_ctx) +{ + if (tls_ctx == NULL || --tls_ctx_global.refcnt != 0) + return; + + tls_conf_deinit(tls_ctx_global.tls_conf); + os_free(tls_ctx_global.ca_cert_file); + os_free(tls_ctx_global.ocsp_stapling_response); + char *openssl_ciphers; /*(allocated in tls_init())*/ + *(const char **)&openssl_ciphers = tls_ctx_global.init_conf.openssl_ciphers; + os_free(openssl_ciphers); +#ifdef MBEDTLS_SSL_SESSION_TICKETS + mbedtls_ssl_ticket_free(&tls_ctx_global.ticket_ctx); +#endif + os_memset(&tls_ctx_global, 0, sizeof(tls_ctx_global)); +} + +int tls_get_errors(void *tls_ctx) +{ + return 0; +} + +static void tls_connection_deinit_expkey(struct tls_connection *conn) +{ + conn->tls_prf_type = 0; /* MBEDTLS_SSL_TLS_PRF_NONE; */ + conn->expkey_keyblock_size = 0; + conn->expkey_secret_len = 0; + forced_memzero(conn->expkey_secret, sizeof(conn->expkey_secret)); + forced_memzero(conn->expkey_randbytes, sizeof(conn->expkey_randbytes)); +} + +#ifdef TLS_MBEDTLS_SESSION_TICKETS +void tls_connection_deinit_clienthello_session_ticket(struct tls_connection *conn) +{ + if (conn->clienthello_session_ticket) + { + mbedtls_platform_zeroize(conn->clienthello_session_ticket, conn->clienthello_session_ticket_len); + mbedtls_free(conn->clienthello_session_ticket); + conn->clienthello_session_ticket = NULL; + conn->clienthello_session_ticket_len = 0; + } +} +#endif + +void tls_connection_deinit(void *tls_ctx, struct tls_connection *conn) +{ + if (conn == NULL) + return; + + if (conn->tls_prf_type) + tls_connection_deinit_expkey(conn); + +#ifdef TLS_MBEDTLS_SESSION_TICKETS + if (conn->clienthello_session_ticket) + tls_connection_deinit_clienthello_session_ticket(conn); +#endif + + os_free(conn->peer_subject); + wpabuf_free(conn->success_data); + wpabuf_free(conn->push_buf); + wpabuf_free(conn->pull_buf); + mbedtls_ssl_free(&conn->ssl); + tls_conf_deinit(conn->tls_conf); + os_free(conn); +} + +static void tls_mbedtls_refresh_crl(void); +static int tls_mbedtls_ssl_setup(struct tls_connection *conn); + +struct tls_connection *tls_connection_init(void *tls_ctx) +{ + struct tls_connection *conn = os_zalloc(sizeof(*conn)); + if (conn == NULL) + return NULL; + + mbedtls_ssl_init(&conn->ssl); + + conn->tls_conf = tls_ctx_global.tls_conf; /*(inherit global conf, if set)*/ + if (conn->tls_conf) + { + ++conn->tls_conf->refcnt; + /* check for CRL refresh if inheriting from global config */ + tls_mbedtls_refresh_crl(); + + conn->verify_peer = conn->tls_conf->verify_peer; + if (tls_mbedtls_ssl_setup(conn) != 0) + { + tls_connection_deinit(&tls_ctx_global, conn); + return NULL; + } + } + + return conn; +} + +int tls_connection_established(void *tls_ctx, struct tls_connection *conn) +{ + return conn ? conn->established : 0; +} + +__attribute_noinline__ char *tls_mbedtls_peer_serial_num(const mbedtls_x509_crt *crt, char *serial_num, size_t len) +{ + /* mbedtls_x509_serial_gets() inefficiently formats to hex separated by + * colons, so generate the hex serial number here. The func + * wpa_snprintf_hex_uppercase() is similarly inefficient. */ + size_t i = 0; /* skip leading 0's per Distinguished Encoding Rules (DER) */ + while (i < crt->serial.len && crt->serial.p[i] == 0) + ++i; + if (i == crt->serial.len) + --i; + + const unsigned char *s = crt->serial.p + i; + const size_t e = (crt->serial.len - i) * 2; + if (e >= len) + return NULL; + + for (i = 0; i < e; i += 2, ++s) + { + serial_num[i + 0] = "0123456789ABCDEF"[(*s >> 4)]; + serial_num[i + 1] = "0123456789ABCDEF"[(*s & 0xF)]; + } + serial_num[e] = '\0'; + + return serial_num; +} + +char *tls_connection_peer_serial_num(void *tls_ctx, struct tls_connection *conn) +{ + const mbedtls_x509_crt *crt = mbedtls_ssl_get_peer_cert(&conn->ssl); + if (crt == NULL) + return NULL; + size_t len = crt->serial.len * 2 + 1; + char *serial_num = os_malloc(len); + if (!serial_num) + return NULL; + return tls_mbedtls_peer_serial_num(crt, serial_num, len); +} + +static void tls_pull_buf_reset(struct tls_connection *conn); + +int tls_connection_shutdown(void *tls_ctx, struct tls_connection *conn) +{ + /* Note: this function called from eap_peer_tls_reauth_init() + * for session resumption, not for connection shutdown */ + + if (conn == NULL) + return -1; + + tls_pull_buf_reset(conn); + wpabuf_free(conn->push_buf); + conn->push_buf = NULL; + conn->established = 0; + conn->resumed = 0; + if (conn->tls_prf_type) + tls_connection_deinit_expkey(conn); + + /* RFE: prepare for session resumption? (see doc in crypto/tls.h) */ + + return mbedtls_ssl_session_reset(&conn->ssl); +} + +static int tls_wpabuf_resize_put_data(struct wpabuf **buf, const unsigned char *data, size_t dlen) +{ + if (wpabuf_resize(buf, dlen) < 0) + return 0; + wpabuf_put_data(*buf, data, dlen); + return 1; +} + +static int tls_pull_buf_append(struct tls_connection *conn, const struct wpabuf *in_data) +{ + /*(interface does not lend itself to move semantics)*/ + return tls_wpabuf_resize_put_data(&conn->pull_buf, wpabuf_head(in_data), wpabuf_len(in_data)); +} + +static void tls_pull_buf_reset(struct tls_connection *conn) +{ + /*(future: might consider reusing conn->pull_buf)*/ + wpabuf_free(conn->pull_buf); + conn->pull_buf = NULL; + conn->pull_buf_offset = 0; +} + +__attribute_cold__ static void tls_pull_buf_discard(struct tls_connection *conn, const char *func) +{ + size_t discard = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset; + if (discard) + wpa_printf(MSG_DEBUG, "%s - %zu bytes remaining in pull_buf; discarding", func, discard); + tls_pull_buf_reset(conn); +} + +static int tls_pull_func(void *ptr, unsigned char *buf, size_t len) +{ + struct tls_connection *conn = (struct tls_connection *)ptr; + if (conn->pull_buf == NULL) + return MBEDTLS_ERR_SSL_WANT_READ; + const size_t dlen = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset; + if (dlen == 0) + return MBEDTLS_ERR_SSL_WANT_READ; + + if (len > dlen) + len = dlen; + os_memcpy(buf, (u8 *)wpabuf_head(conn->pull_buf) + conn->pull_buf_offset, len); + + if (len == dlen) + { + tls_pull_buf_reset(conn); + /*wpa_printf(MSG_DEBUG, "%s - emptied pull_buf", __func__);*/ + } + else + { + conn->pull_buf_offset += len; + /*wpa_printf(MSG_DEBUG, "%s - %zu bytes remaining in pull_buf", + __func__, dlen - len);*/ + } + return (int)len; +} + +static int tls_push_func(void *ptr, const unsigned char *buf, size_t len) +{ + struct tls_connection *conn = (struct tls_connection *)ptr; + return tls_wpabuf_resize_put_data(&conn->push_buf, buf, len) ? (int)len : MBEDTLS_ERR_SSL_ALLOC_FAILED; +} + +static int tls_mbedtls_verify_cb(void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags); + +static int tls_mbedtls_ssl_setup(struct tls_connection *conn) +{ + int ret = mbedtls_ssl_setup(&conn->ssl, &conn->tls_conf->conf); + if (ret != 0) + { + elog(ret, "mbedtls_ssl_setup"); + return -1; + } + + mbedtls_ssl_set_bio(&conn->ssl, conn, tls_push_func, tls_pull_func, NULL); +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + mbedtls_ssl_set_export_keys_cb(&conn->ssl, tls_connection_export_keys_cb, conn); +#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ + mbedtls_ssl_conf_export_keys_ext_cb(&conn->tls_conf->conf, tls_connection_export_keys_cb, conn); +#endif + if (conn->verify_peer) + mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn); + + return 0; +} + +static int tls_mbedtls_data_is_pem(const u8 *data) +{ + return (NULL != os_strstr((char *)data, "-----")); +} + +static void tls_mbedtls_set_allowed_tls_vers(struct tls_conf *tls_conf, mbedtls_ssl_config *conf) +{ +#if !defined(MBEDTLS_SSL_PROTO_TLS1_3) + tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_3; +#endif + + /* unconditionally require TLSv1.2+ for TLS_CONN_SUITEB */ + if (tls_conf->flags & TLS_CONN_SUITEB) + { + tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_0; + tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_1; + } + + const unsigned int flags = tls_conf->flags; + + /* attempt to map flags to min and max TLS protocol version */ + + int min = (flags & TLS_CONN_DISABLE_TLSv1_0) ? + (flags & TLS_CONN_DISABLE_TLSv1_1) ? + (flags & TLS_CONN_DISABLE_TLSv1_2) ? (flags & TLS_CONN_DISABLE_TLSv1_3) ? 4 : 3 : 2 : + 1 : + 0; + + int max = (flags & TLS_CONN_DISABLE_TLSv1_3) ? + (flags & TLS_CONN_DISABLE_TLSv1_2) ? + (flags & TLS_CONN_DISABLE_TLSv1_1) ? (flags & TLS_CONN_DISABLE_TLSv1_0) ? -1 : 0 : 1 : + 2 : + 3; + + if ((flags & TLS_CONN_ENABLE_TLSv1_2) && min > 2) + min = 2; + if ((flags & TLS_CONN_ENABLE_TLSv1_1) && min > 1) + min = 1; + if ((flags & TLS_CONN_ENABLE_TLSv1_0) && min > 0) + min = 0; + if (max < min) + { + emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring"); + return; + } +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + /* mbed TLS 3.0.0 removes support for protocols < TLSv1.2 */ + if (min < 2 || max < 2) + { + emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring"); + if (min < 2) + min = 2; + if (max < 2) + max = 2; + } +#endif + +#if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */ + /* MBEDTLS_SSL_VERSION_TLS1_2 = 0x0303 */ /*!< (D)TLS 1.2 */ + /* MBEDTLS_SSL_VERSION_TLS1_3 = 0x0304 */ /*!< (D)TLS 1.3 */ + min = (min == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3; + max = (max == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3; + mbedtls_ssl_conf_min_tls_version(conf, min); + mbedtls_ssl_conf_max_tls_version(conf, max); +#else +#ifndef MBEDTLS_SSL_MINOR_VERSION_4 + if (min == 3) + min = 2; + if (max == 3) + max = 2; +#endif + /* MBEDTLS_SSL_MINOR_VERSION_0 0 */ /*!< SSL v3.0 */ + /* MBEDTLS_SSL_MINOR_VERSION_1 1 */ /*!< TLS v1.0 */ + /* MBEDTLS_SSL_MINOR_VERSION_2 2 */ /*!< TLS v1.1 */ + /* MBEDTLS_SSL_MINOR_VERSION_3 3 */ /*!< TLS v1.2 */ + /* MBEDTLS_SSL_MINOR_VERSION_4 4 */ /*!< TLS v1.3 */ + mbedtls_ssl_conf_min_version(conf, MBEDTLS_SSL_MAJOR_VERSION_3, min + 1); + mbedtls_ssl_conf_max_version(conf, MBEDTLS_SSL_MAJOR_VERSION_3, max + 1); +#endif +} + +__attribute_noinline__ static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n); + +#ifdef MBEDTLS_DHM_C +static int tls_mbedtls_set_dhparams(struct tls_conf *tls_conf, const struct tls_connection_params *params) +{ + size_t len; + const u8 *data; + // if (tls_mbedtls_readfile(dh_file, &data, &len)) + // return 0; + + data = params->dh_blob; + len = params->dh_blob_len; + + /* parse only if DH parameters if in PEM format */ + if (tls_mbedtls_data_is_pem(data) && NULL == os_strstr((char *)data, "-----BEGIN DH PARAMETERS-----")) + { + if (os_strstr((char *)data, "-----BEGIN DSA PARAMETERS-----")) + wpa_printf(MSG_WARNING, "DSA parameters not handled (%s)", "dh_file"); + else + wpa_printf(MSG_WARNING, "unexpected DH param content (%s)", "dh_file"); + //forced_memzero(data, len); + // os_free(data); + return 0; + } + + /* mbedtls_dhm_parse_dhm() expects "-----BEGIN DH PARAMETERS-----" if PEM */ + mbedtls_dhm_context dhm; + mbedtls_dhm_init(&dhm); + int rc = mbedtls_dhm_parse_dhm(&dhm, data, len); + if (0 == rc) + rc = mbedtls_ssl_conf_dh_param_ctx(&tls_conf->conf, &dhm); + if (0 != rc) + elog(rc, "dh_file"); + mbedtls_dhm_free(&dhm); + + // forced_memzero(data, len); + // os_free(data); + return (0 == rc); +} +#endif + +/* reference: lighttpd src/mod_mbedtls.c:mod_mbedtls_ssl_append_curve() + * (same author: gstrauss@gluelogic.com; same license: BSD-3-Clause) */ +#if MBEDTLS_VERSION_NUMBER < 0x03010000 /* mbedtls 3.1.0 */ +static int tls_mbedtls_append_curve(mbedtls_ecp_group_id *ids, int nids, int idsz, const mbedtls_ecp_group_id id) +{ + if (1 >= idsz - (nids + 1)) + { + emsg(MSG_ERROR, "error: too many curves during list expand"); + return -1; + } + ids[++nids] = id; + return nids; +} + +static int tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist) +{ + mbedtls_ecp_group_id ids[512]; + int nids = -1; + const int idsz = (int)(sizeof(ids) / sizeof(*ids) - 1); + const mbedtls_ecp_curve_info *const curve_info = mbedtls_ecp_curve_list(); + + for (const char *e = curvelist - 1; e;) + { + const char *const n = e + 1; + e = os_strchr(n, ':'); + size_t len = e ? (size_t)(e - n) : os_strlen(n); + mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE; + switch (len) + { + case 5: + if (0 == os_memcmp("P-521", n, 5)) + grp_id = MBEDTLS_ECP_DP_SECP521R1; + else if (0 == os_memcmp("P-384", n, 5)) + grp_id = MBEDTLS_ECP_DP_SECP384R1; + else if (0 == os_memcmp("P-256", n, 5)) + grp_id = MBEDTLS_ECP_DP_SECP256R1; + break; + case 6: + if (0 == os_memcmp("BP-521", n, 6)) + grp_id = MBEDTLS_ECP_DP_BP512R1; + else if (0 == os_memcmp("BP-384", n, 6)) + grp_id = MBEDTLS_ECP_DP_BP384R1; + else if (0 == os_memcmp("BP-256", n, 6)) + grp_id = MBEDTLS_ECP_DP_BP256R1; + break; + default: + break; + } + if (grp_id != MBEDTLS_ECP_DP_NONE) + { + nids = tls_mbedtls_append_curve(ids, nids, idsz, grp_id); + if (-1 == nids) + return 0; + continue; + } + /* similar to mbedtls_ecp_curve_info_from_name() */ + const mbedtls_ecp_curve_info *info; + for (info = curve_info; info->grp_id != MBEDTLS_ECP_DP_NONE; ++info) + { + if (0 == os_strncmp(info->name, n, len) && info->name[len] == '\0') + break; + } + if (info->grp_id == MBEDTLS_ECP_DP_NONE) + { + wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s", (int)len, n); + return 0; + } + + nids = tls_mbedtls_append_curve(ids, nids, idsz, info->grp_id); + if (-1 == nids) + return 0; + } + + /* mod_openssl configures "prime256v1" if curve list not specified, + * but mbedtls provides a list of supported curves if not explicitly set */ + if (-1 == nids) + return 1; /* empty list; no-op */ + + ids[++nids] = MBEDTLS_ECP_DP_NONE; /* terminate list */ + ++nids; + + /* curves list must be persistent for lifetime of mbedtls_ssl_config */ + tls_conf->curves = os_malloc(nids * sizeof(mbedtls_ecp_group_id)); + if (tls_conf->curves == NULL) + return 0; + os_memcpy(tls_conf->curves, ids, nids * sizeof(mbedtls_ecp_group_id)); + + mbedtls_ssl_conf_curves(&tls_conf->conf, tls_conf->curves); + return 1; +} +#else +static int tls_mbedtls_append_curve(uint16_t *ids, int nids, int idsz, const uint16_t id) +{ + if (1 >= idsz - (nids + 1)) + { + emsg(MSG_ERROR, "error: too many curves during list expand"); + return -1; + } + ids[++nids] = id; + return nids; +} + +static int tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist) +{ + /* TLS Supported Groups (renamed from "EC Named Curve Registry") + * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 + */ + uint16_t ids[512]; + int nids = -1; + const int idsz = (int)(sizeof(ids) / sizeof(*ids) - 1); + const mbedtls_ecp_curve_info *const curve_info = mbedtls_ecp_curve_list(); + + for (const char *e = curvelist - 1; e;) + { + const char *const n = e + 1; + e = os_strchr(n, ':'); + size_t len = e ? (size_t)(e - n) : os_strlen(n); + uint16_t tls_id = 0; + switch (len) + { + case 5: + if (0 == os_memcmp("P-521", n, 5)) + tls_id = 25; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP521R1 */ + else if (0 == os_memcmp("P-384", n, 5)) + tls_id = 24; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP384R1 */ + else if (0 == os_memcmp("P-256", n, 5)) + tls_id = 23; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP256R1 */ + break; + case 6: + if (0 == os_memcmp("BP-521", n, 6)) + tls_id = 28; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP512R1 */ + else if (0 == os_memcmp("BP-384", n, 6)) + tls_id = 27; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP384R1 */ + else if (0 == os_memcmp("BP-256", n, 6)) + tls_id = 26; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP256R1 */ + break; + default: + break; + } + if (tls_id != 0) + { + nids = tls_mbedtls_append_curve(ids, nids, idsz, tls_id); + if (-1 == nids) + return 0; + continue; + } + /* similar to mbedtls_ecp_curve_info_from_name() */ + const mbedtls_ecp_curve_info *info; + for (info = curve_info; info->tls_id != 0; ++info) + { + if (0 == os_strncmp(info->name, n, len) && info->name[len] == '\0') + break; + } + if (info->tls_id == 0) + { + wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s", (int)len, n); + return 0; + } + + nids = tls_mbedtls_append_curve(ids, nids, idsz, info->tls_id); + if (-1 == nids) + return 0; + } + + /* mod_openssl configures "prime256v1" if curve list not specified, + * but mbedtls provides a list of supported curves if not explicitly set */ + if (-1 == nids) + return 1; /* empty list; no-op */ + + ids[++nids] = 0; /* terminate list */ + ++nids; + + /* curves list must be persistent for lifetime of mbedtls_ssl_config */ + tls_conf->curves = os_malloc(nids * sizeof(uint16_t)); + if (tls_conf->curves == NULL) + return 0; + os_memcpy(tls_conf->curves, ids, nids * sizeof(uint16_t)); + + mbedtls_ssl_conf_groups(&tls_conf->conf, tls_conf->curves); + return 1; +} +#endif /* MBEDTLS_VERSION_NUMBER >= 0x03010000 */ /* mbedtls 3.1.0 */ + +/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */ +static const int suite_AES_256_ephemeral[] = { + /* All AES-256 ephemeral suites */ + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8}; + +/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */ +static const int suite_AES_128_ephemeral[] = { + /* All AES-128 ephemeral suites */ + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8}; + +/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */ +/* HIGH cipher list (mapped from openssl list to mbedtls) */ +static const int suite_HIGH[] = {MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, + MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8, + MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA, + MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256, + MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256, + MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM, + MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, + MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384, + MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8, + MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM, + MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8, + MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256, + MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_RSA_WITH_AES_256_CCM, + MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256, + MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8, + MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256, + MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA, + MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_RSA_WITH_AES_128_CCM, + MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8, + MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA, + MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256, + MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384, + MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256, + MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256, + MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384, + MBEDTLS_TLS_PSK_WITH_AES_256_CCM, + MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384, + MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA, + MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384, + MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8, + MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384, + MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256, + MBEDTLS_TLS_PSK_WITH_AES_128_CCM, + MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256, + MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA, + MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256, + MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8, + MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256}; + +__attribute_noinline__ static int tls_mbedtls_append_ciphersuite(int *ids, int nids, int idsz, const int *x, int xsz) +{ + if (xsz >= idsz - (nids + 1)) + { + emsg(MSG_ERROR, "error: too many ciphers during list expand"); + return -1; + } + + for (int i = 0; i < xsz; ++i) + ids[++nids] = x[i]; + + return nids; +} + +static int tls_mbedtls_translate_ciphername(int id, char *buf, size_t buflen) +{ + const mbedtls_ssl_ciphersuite_t *info = mbedtls_ssl_ciphersuite_from_id(id); + if (info == NULL) + return 0; + const char *name = mbedtls_ssl_ciphersuite_get_name(info); + const size_t len = os_strlen(name); + if (len == 7 && 0 == os_memcmp(name, "unknown", 7)) + return 0; + if (len >= buflen) + return 0; + os_strlcpy(buf, name, buflen); + + /* attempt to translate mbedtls string to openssl string + * (some heuristics; incomplete) */ + size_t i = 0, j = 0; + if (buf[0] == 'T') + { + if (os_strncmp(buf, "TLS1-3-", 7) == 0) + { + buf[3] = '-'; + j = 4; /* remove "1-3" from "TLS1-3-" prefix */ + i = 7; + } + else if (os_strncmp(buf, "TLS-", 4) == 0) + i = 4; /* remove "TLS-" prefix */ + } + for (; buf[i]; ++i) + { + if (buf[i] == '-') + { + if (i >= 3) + { + if (0 == os_memcmp(buf + i - 3, "AES", 3)) + continue; /* "AES-" -> "AES" */ + } + if (i >= 4) + { + if (0 == os_memcmp(buf + i - 4, "WITH", 4)) + { + j -= 4; /* remove "WITH-" */ + continue; + } + } + } + buf[j++] = buf[i]; + } + buf[j] = '\0'; + + return j; +} + +__attribute_noinline__ static int tls_mbedtls_set_ciphersuites(struct tls_conf *tls_conf, int *ids, int nids) +{ + /* ciphersuites list must be persistent for lifetime of mbedtls_ssl_config*/ + os_free(tls_conf->ciphersuites); + tls_conf->ciphersuites = os_malloc(nids * sizeof(int)); + if (tls_conf->ciphersuites == NULL) + return 0; + os_memcpy(tls_conf->ciphersuites, ids, nids * sizeof(int)); + mbedtls_ssl_conf_ciphersuites(&tls_conf->conf, tls_conf->ciphersuites); + return 1; +} + +static int tls_mbedtls_set_ciphers(struct tls_conf *tls_conf, const char *ciphers) +{ + char buf[64]; + int ids[512]; + int nids = -1; + const int idsz = (int)(sizeof(ids) / sizeof(*ids) - 1); + const char *next; + size_t blen, clen; + do + { + next = os_strchr(ciphers, ':'); + clen = next ? (size_t)(next - ciphers) : os_strlen(ciphers); + if (!clen) + continue; + + /* special-case a select set of openssl group names for hwsim tests */ + /* (review; remove excess code if tests are not run for non-OpenSSL?) */ + if (clen == 9 && os_memcmp(ciphers, "SUITEB192", 9) == 0) + { + static int ssl_preset_suiteb192_ciphersuites[] = {MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 0}; + return tls_mbedtls_set_ciphersuites(tls_conf, ssl_preset_suiteb192_ciphersuites, 2); + } + if (clen == 9 && os_memcmp(ciphers, "SUITEB128", 9) == 0) + { + static int ssl_preset_suiteb128_ciphersuites[] = {MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0}; + return tls_mbedtls_set_ciphersuites(tls_conf, ssl_preset_suiteb128_ciphersuites, 2); + } + if (clen == 7 && os_memcmp(ciphers, "DEFAULT", 7) == 0) + continue; + if (clen == 6 && os_memcmp(ciphers, "AES128", 6) == 0) + { + nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_AES_128_ephemeral, + (int)ARRAY_SIZE(suite_AES_128_ephemeral)); + if (nids == -1) + return 0; + continue; + } + if (clen == 6 && os_memcmp(ciphers, "AES256", 6) == 0) + { + nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_AES_256_ephemeral, + (int)ARRAY_SIZE(suite_AES_256_ephemeral)); + if (nids == -1) + return 0; + continue; + } + if (clen == 4 && os_memcmp(ciphers, "HIGH", 4) == 0) + { + nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_HIGH, (int)ARRAY_SIZE(suite_HIGH)); + if (nids == -1) + return 0; + continue; + } + /* ignore anonymous cipher group names (?not supported by mbedtls?) */ + if (clen == 4 && os_memcmp(ciphers, "!ADH", 4) == 0) + continue; + if (clen == 6 && os_memcmp(ciphers, "-aECDH", 6) == 0) + continue; + if (clen == 7 && os_memcmp(ciphers, "-aECDSA", 7) == 0) + continue; + + /* attempt to match mbedtls cipher names + * nb: does not support openssl group names or list manipulation syntax + * (alt: could copy almost 1200 lines (!!!) of lighttpd mod_mbedtls.c + * mod_mbedtls_ssl_conf_ciphersuites() to translate strings) + * note: not efficient to rewrite list for each ciphers entry, + * but this code is expected to run only at startup + */ + const int *list = mbedtls_ssl_list_ciphersuites(); + for (; *list; ++list) + { + blen = tls_mbedtls_translate_ciphername(*list, buf, sizeof(buf)); + if (!blen) + continue; + + /* matching heuristics additional to translate_ciphername above */ + if (blen == clen + 4) + { + char *cbc = os_strstr(buf, "CBC-"); + if (cbc) + { + os_memmove(cbc, cbc + 4, blen - (cbc + 4 - buf) + 1); /*(w/ '\0')*/ + blen -= 4; + } + } + if (blen >= clen && os_memcmp(ciphers, buf, clen) == 0 && + (blen == clen || (blen == clen + 7 && os_memcmp(buf + clen, "-SHA256", 7)))) + { + if (1 >= idsz - (nids + 1)) + { + emsg(MSG_ERROR, "error: too many ciphers during list expand"); + return 0; + } + ids[++nids] = *list; + break; + } + } + if (*list == 0) + { + wpa_printf(MSG_ERROR, "MTLS: unrecognized cipher: %.*s", (int)clen, ciphers); + return 0; + } + } while ((ciphers = next ? next + 1 : NULL)); + + if (-1 == nids) + return 1; /* empty list; no-op */ + + ids[++nids] = 0; /* terminate list */ + ++nids; + + return tls_mbedtls_set_ciphersuites(tls_conf, ids, nids); +} + +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + +__attribute_noinline__ static int tls_mbedtls_set_item(char **config_item, const char *item) +{ + os_free(*config_item); + *config_item = NULL; + return item ? (*config_item = os_strdup(item)) != NULL : 1; +} + +static int tls_connection_set_subject_match(struct tls_conf *tls_conf, const struct tls_connection_params *params) +{ + int rc = 1; + rc &= tls_mbedtls_set_item(&tls_conf->subject_match, params->subject_match); + rc &= tls_mbedtls_set_item(&tls_conf->altsubject_match, params->altsubject_match); + rc &= tls_mbedtls_set_item(&tls_conf->suffix_match, params->suffix_match); + rc &= tls_mbedtls_set_item(&tls_conf->domain_match, params->domain_match); + rc &= tls_mbedtls_set_item(&tls_conf->check_cert_subject, params->check_cert_subject); + return rc; +} + +#endif /* TLS_MBEDTLS_CERT_VERIFY_EXTMATCH */ + +/* duplicated in crypto_mbedtls.c:crypto_mbedtls_readfile()*/ +__attribute_noinline__ static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n) +{ + /*(use os_readfile() so that we can use os_free() + *(if we use mbedtls_pk_load_file() above, macros prevent calling free() + * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free() + * on buf aborts in tests if buf not allocated via os_malloc())*/ + *buf = (u8 *)os_readfile(path, n); + if (!*buf) + { + wpa_printf(MSG_ERROR, "error: os_readfile %s", path); + return -1; + } + u8 *buf0 = os_realloc(*buf, *n + 1); + if (!buf0) + { + bin_clear_free(*buf, *n); + *buf = NULL; + return -1; + } + buf0[(*n)++] = '\0'; + *buf = buf0; + return 0; +} + +static int tls_mbedtls_set_crl(struct tls_conf *tls_conf, const u8 *data, size_t len) +{ + /* do not use mbedtls_x509_crl_parse() on PEM unless it contains CRL */ + if (len && data[len - 1] == '\0' && NULL == os_strstr((const char *)data, "-----BEGIN X509 CRL-----") && + tls_mbedtls_data_is_pem(data)) + return 0; + + mbedtls_x509_crl crl; + mbedtls_x509_crl_init(&crl); + int rc = mbedtls_x509_crl_parse(&crl, data, len); + if (rc < 0) + { + mbedtls_x509_crl_free(&crl); + return rc == MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ? 0 : rc; + } + + mbedtls_x509_crl *crl_new = os_malloc(sizeof(crl)); + if (crl_new == NULL) + { + mbedtls_x509_crl_free(&crl); + return MBEDTLS_ERR_X509_ALLOC_FAILED; + } + os_memcpy(crl_new, &crl, sizeof(crl)); + + mbedtls_x509_crl *crl_old = tls_conf->crl; + tls_conf->crl = crl_new; + if (crl_old) + { + mbedtls_x509_crl_free(crl_old); + os_free(crl_old); + } + return 0; +} + +static int tls_mbedtls_set_ca(struct tls_conf *tls_conf, u8 *data, size_t len) +{ + /* load crt struct onto stack and then copy into tls_conf in + * order to preserve existing tls_conf value if error occurs + * + * hostapd is not threaded, or else should allocate memory and swap in + * pointer reduce race condition. (If threaded, would also need to + * keep reference count of use to avoid freeing while still in use.) */ + + mbedtls_x509_crt crt; + mbedtls_x509_crt_init(&crt); + int rc = mbedtls_x509_crt_parse(&crt, data, len); + if (rc < 0) + { + mbedtls_x509_crt_free(&crt); + return rc; + } + + mbedtls_x509_crt_free(&tls_conf->ca_cert); + os_memcpy(&tls_conf->ca_cert, &crt, sizeof(crt)); + return 0; +} + +static int tls_mbedtls_set_ca_and_crl(struct tls_conf *tls_conf, const char *ca_cert_file) +{ + size_t len; + u8 *data; + if (tls_mbedtls_readfile(ca_cert_file, &data, &len)) + return -1; + + int rc; + if (0 == (rc = tls_mbedtls_set_ca(tls_conf, data, len)) && + (!tls_mbedtls_data_is_pem(data) /*skip parse for CRL if not PEM*/ + || 0 == (rc = tls_mbedtls_set_crl(tls_conf, data, len)))) + { + mbedtls_ssl_conf_ca_chain(&tls_conf->conf, &tls_conf->ca_cert, tls_conf->crl); + } + else + { + elog(rc, __func__); + emsg(MSG_ERROR, ca_cert_file); + } + + forced_memzero(data, len); + os_free(data); + return rc; +} + +static void tls_mbedtls_refresh_crl(void) +{ + /* check for CRL refresh + * continue even if error occurs; continue with previous cert, CRL */ + unsigned int crl_reload_interval = tls_ctx_global.crl_reload_interval; + const char *ca_cert_file = tls_ctx_global.ca_cert_file; + if (!crl_reload_interval || !ca_cert_file) + return; + + struct os_reltime *previous = &tls_ctx_global.crl_reload_previous; + struct os_reltime now; + if (os_get_reltime(&now) != 0 || !os_reltime_expired(&now, previous, crl_reload_interval)) + return; + + /* Note: modifying global state is not thread-safe + * if in use by existing connections + * + * src/utils/os.h does not provide a portable stat() + * or else it would be a good idea to check mtime and size, + * and avoid reloading if file has not changed */ + + if (tls_mbedtls_set_ca_and_crl(tls_ctx_global.tls_conf, ca_cert_file) == 0) + *previous = now; +} + +static int tls_mbedtls_set_ca_cert(struct tls_conf *tls_conf, const struct tls_connection_params *params) +{ + if (params->ca_cert) + { + if (os_strncmp(params->ca_cert, "probe://", 8) == 0) + { + tls_conf->ca_cert_probe = 1; + tls_conf->has_ca_cert = 1; + return 0; + } + + if (os_strncmp(params->ca_cert, "hash://", 7) == 0) + { + const char *pos = params->ca_cert + 7; + if (os_strncmp(pos, "server/sha256/", 14) != 0) + { + emsg(MSG_ERROR, "unsupported ca_cert hash value"); + return -1; + } + pos += 14; + if (os_strlen(pos) != SHA256_DIGEST_LENGTH * 2) + { + emsg(MSG_ERROR, "unexpected ca_cert hash length"); + return -1; + } + if (hexstr2bin(pos, tls_conf->ca_cert_hash, SHA256_DIGEST_LENGTH) < 0) + { + emsg(MSG_ERROR, "invalid ca_cert hash value"); + return -1; + } + emsg(MSG_DEBUG, "checking only server certificate match"); + tls_conf->verify_depth0_only = 1; + tls_conf->has_ca_cert = 1; + return 0; + } + + if (tls_mbedtls_set_ca_and_crl(tls_conf, params->ca_cert) != 0) + return -1; + } + if (params->ca_cert_blob) + { + size_t len = params->ca_cert_blob_len; + int is_pem = tls_mbedtls_data_is_pem(params->ca_cert_blob); + if (len && params->ca_cert_blob[len - 1] != '\0' && is_pem) + ++len; /*(include '\0' in len for PEM)*/ + int ret = mbedtls_x509_crt_parse(&tls_conf->ca_cert, params->ca_cert_blob, len); + if (ret != 0) + { + elog(ret, "mbedtls_x509_crt_parse"); + return -1; + } + if (is_pem) + { /*(ca_cert_blob in DER format contains ca cert only)*/ + ret = tls_mbedtls_set_crl(tls_conf, params->ca_cert_blob, len); + if (ret != 0) + { + elog(ret, "mbedtls_x509_crl_parse"); + return -1; + } + } + } + + if (mbedtls_x509_time_is_future(&tls_conf->ca_cert.valid_from) || + mbedtls_x509_time_is_past(&tls_conf->ca_cert.valid_to)) + { + emsg(MSG_WARNING, "ca_cert expired or not yet valid"); + if (params->ca_cert) + emsg(MSG_WARNING, params->ca_cert); + } + + tls_conf->has_ca_cert = 1; + return 0; +} + +static int tls_mbedtls_set_certs(struct tls_conf *tls_conf, const struct tls_connection_params *params) +{ + int ret = -1; + + if (params->ca_cert || params->ca_cert_blob) + { + if (tls_mbedtls_set_ca_cert(tls_conf, params) != 0) + return -1; + } + else if (params->ca_path) + { + emsg(MSG_INFO, "ca_path support not implemented"); + return -1; + } + + if (!tls_conf->has_ca_cert) + mbedtls_ssl_conf_authmode(&tls_conf->conf, MBEDTLS_SSL_VERIFY_NONE); + else + { + /* Initial setting: REQUIRED for client, OPTIONAL for server + * (see also tls_connection_set_verify()) */ + tls_conf->verify_peer = (tls_ctx_global.tls_conf == NULL); + int authmode = tls_conf->verify_peer ? MBEDTLS_SSL_VERIFY_REQUIRED : MBEDTLS_SSL_VERIFY_OPTIONAL; + mbedtls_ssl_conf_authmode(&tls_conf->conf, authmode); + mbedtls_ssl_conf_ca_chain(&tls_conf->conf, &tls_conf->ca_cert, tls_conf->crl); + +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + if (!tls_connection_set_subject_match(tls_conf, params)) + return -1; +#endif + } + + if (params->client_cert2) /*(yes, server_cert2 in msg below)*/ + emsg(MSG_INFO, "server_cert2 support not implemented"); + + if (params->client_cert) + { + size_t len; + u8 *data; + if (tls_mbedtls_readfile(params->client_cert, &data, &len)) + return -1; + ret = mbedtls_x509_crt_parse(&tls_conf->client_cert, data, len); + forced_memzero(data, len); + os_free(data); + } + if (params->client_cert_blob) + { + size_t len = params->client_cert_blob_len; + if (len && params->client_cert_blob[len - 1] != '\0' && tls_mbedtls_data_is_pem(params->client_cert_blob)) + ++len; /*(include '\0' in len for PEM)*/ + ret = mbedtls_x509_crt_parse(&tls_conf->client_cert, params->client_cert_blob, len); + } + if (params->client_cert || params->client_cert_blob) + { + if (ret < 0) + { + elog(ret, "mbedtls_x509_crt_parse"); + if (params->client_cert) + emsg(MSG_ERROR, params->client_cert); + return -1; + } + if (mbedtls_x509_time_is_future(&tls_conf->client_cert.valid_from) || + mbedtls_x509_time_is_past(&tls_conf->client_cert.valid_to)) + { + emsg(MSG_WARNING, "cert expired or not yet valid"); + if (params->client_cert) + emsg(MSG_WARNING, params->client_cert); + } + tls_conf->has_client_cert = 1; + } + + if (params->private_key || params->private_key_blob) + { + size_t len = params->private_key_blob_len; + u8 *data; + *(const u8 **)&data = params->private_key_blob; + if (len && data[len - 1] != '\0' && tls_mbedtls_data_is_pem(data)) + ++len; /*(include '\0' in len for PEM)*/ + if (params->private_key && tls_mbedtls_readfile(params->private_key, &data, &len)) + { + return -1; + } + const char *pwd = params->private_key_passwd; +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + ret = mbedtls_pk_parse_key(&tls_conf->private_key, data, len, (const unsigned char *)pwd, + pwd ? os_strlen(pwd) : 0, mbedtls_ctr_drbg_random, tls_ctx_global.ctr_drbg); +#else + ret = mbedtls_pk_parse_key(&tls_conf->private_key, data, len, (const unsigned char *)pwd, + pwd ? os_strlen(pwd) : 0); +#endif + if (params->private_key) + { + forced_memzero(data, len); + os_free(data); + } + if (ret < 0) + { + elog(ret, "mbedtls_pk_parse_key"); + return -1; + } + tls_conf->has_private_key = 1; + } + + if (tls_conf->has_client_cert && tls_conf->has_private_key) + { + ret = mbedtls_ssl_conf_own_cert(&tls_conf->conf, &tls_conf->client_cert, &tls_conf->private_key); + if (ret < 0) + { + elog(ret, "mbedtls_ssl_conf_own_cert"); + return -1; + } + } + + return 0; +} + +/* mbedtls_x509_crt_profile_suiteb plus rsa_min_bitlen 2048 */ +/* (reference: see also mbedtls_x509_crt_profile_next) */ +/* ??? should permit SHA-512, too, and additional curves ??? */ +static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb128 = { + /* Only SHA-256 and 384 */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) | MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384), + /* Only ECDSA */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_ECDSA) | MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_ECKEY), +#if defined(MBEDTLS_ECP_C) + /* Only NIST P-256 and P-384 */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP256R1) | MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1), +#else + 0, +#endif + 2048, +}; + +/* stricter than mbedtls_x509_crt_profile_suiteb */ +/* (reference: see also mbedtls_x509_crt_profile_next) */ +/* ??? should permit SHA-512, too, and additional curves ??? */ +static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192 = { + /* Only SHA-384 */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384), + /* Only ECDSA */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_ECDSA) | MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_ECKEY), +#if defined(MBEDTLS_ECP_C) + /* Only NIST P-384 */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1), +#else + 0, +#endif + 3072, +}; + +/* stricter than mbedtls_x509_crt_profile_suiteb except allow any PK alg */ +/* (reference: see also mbedtls_x509_crt_profile_next) */ +/* ??? should permit SHA-512, too, and additional curves ??? */ +static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192_anypk = { + /* Only SHA-384 */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384), + 0xFFFFFFF, /* Any PK alg */ +#if defined(MBEDTLS_ECP_C) + /* Only NIST P-384 */ + MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1), +#else + 0, +#endif + 3072, +}; + +static int tls_mbedtls_set_params(struct tls_conf *tls_conf, const struct tls_connection_params *params) +{ + tls_conf->flags = params->flags; + + if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP_ALL) + { + emsg(MSG_INFO, "ocsp=3 not supported"); + return -1; + } + + if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP) + { + emsg(MSG_INFO, "ocsp not supported"); + return -1; + } + + int suiteb128 = 0; + int suiteb192 = 0; + if (params->openssl_ciphers) + { + if (os_strcmp(params->openssl_ciphers, "SUITEB192") == 0) + { + suiteb192 = 1; + tls_conf->flags |= TLS_CONN_SUITEB; + } + if (os_strcmp(params->openssl_ciphers, "SUITEB128") == 0) + { + suiteb128 = 1; + tls_conf->flags |= TLS_CONN_SUITEB; + } + } + + int ret = mbedtls_ssl_config_defaults( + &tls_conf->conf, tls_ctx_global.tls_conf ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT, + MBEDTLS_SSL_TRANSPORT_STREAM, + (tls_conf->flags & TLS_CONN_SUITEB) ? MBEDTLS_SSL_PRESET_SUITEB : MBEDTLS_SSL_PRESET_DEFAULT); + if (ret != 0) + { + elog(ret, "mbedtls_ssl_config_defaults"); + return -1; + } + + if (suiteb128) + { + mbedtls_ssl_conf_cert_profile(&tls_conf->conf, &tls_mbedtls_crt_profile_suiteb128); + mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 2048); + } + else if (suiteb192) + { + mbedtls_ssl_conf_cert_profile(&tls_conf->conf, &tls_mbedtls_crt_profile_suiteb192); + mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 3072); + } + else if (tls_conf->flags & TLS_CONN_SUITEB) + { + /* treat as suiteb192 while allowing any PK algorithm */ + mbedtls_ssl_conf_cert_profile(&tls_conf->conf, &tls_mbedtls_crt_profile_suiteb192_anypk); + mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 3072); + } + + tls_mbedtls_set_allowed_tls_vers(tls_conf, &tls_conf->conf); + ret = tls_mbedtls_set_certs(tls_conf, params); + if (ret != 0) + return -1; + +#ifdef MBEDTLS_DHM_C + if (params->dh_blob && !tls_mbedtls_set_dhparams(tls_conf, params)) + { + return -1; + } +#endif + + if (params->openssl_ecdh_curves && !tls_mbedtls_set_curves(tls_conf, params->openssl_ecdh_curves)) + { + return -1; + } + + if (params->openssl_ciphers) + { + if (!tls_mbedtls_set_ciphers(tls_conf, params->openssl_ciphers)) + return -1; + } + else if (tls_conf->flags & TLS_CONN_SUITEB) + { + /* special-case a select set of ciphers for hwsim tests */ + if (!tls_mbedtls_set_ciphers(tls_conf, (tls_conf->flags & TLS_CONN_SUITEB_NO_ECDH) ? + "DHE-RSA-AES256-GCM-SHA384" : + "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384")) + return -1; + } + + return 0; +} + +int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, const struct tls_connection_params *params) +{ + if (conn == NULL || params == NULL) + return -1; + + tls_conf_deinit(conn->tls_conf); + struct tls_conf *tls_conf = conn->tls_conf = tls_conf_init(tls_ctx); + if (tls_conf == NULL) + return -1; + + if (tls_ctx_global.tls_conf) + { + tls_conf->check_crl = tls_ctx_global.tls_conf->check_crl; + tls_conf->check_crl_strict = tls_ctx_global.tls_conf->check_crl_strict; +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + /*(tls_openssl.c inherits check_cert_subject from global conf)*/ + if (tls_ctx_global.tls_conf->check_cert_subject) + { + tls_conf->check_cert_subject = os_strdup(tls_ctx_global.tls_conf->check_cert_subject); + if (tls_conf->check_cert_subject == NULL) + return -1; + } +#endif + } + + if (tls_mbedtls_set_params(tls_conf, params) != 0) + return -1; + conn->verify_peer = tls_conf->verify_peer; + + return tls_mbedtls_ssl_setup(conn); +} + +#ifdef TLS_MBEDTLS_SESSION_TICKETS + +static int tls_mbedtls_clienthello_session_ticket_prep(struct tls_connection *conn, const u8 *data, size_t len) +{ + if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET) + return -1; + if (conn->clienthello_session_ticket) + tls_connection_deinit_clienthello_session_ticket(conn); + if (len) + { + conn->clienthello_session_ticket = mbedtls_calloc(1, len); + if (conn->clienthello_session_ticket == NULL) + return -1; + conn->clienthello_session_ticket_len = len; + os_memcpy(conn->clienthello_session_ticket, data, len); + } + return 0; +} + +static void tls_mbedtls_clienthello_session_ticket_set(struct tls_connection *conn) +{ + mbedtls_ssl_session *sess = conn->ssl.MBEDTLS_PRIVATE(session_negotiate); + if (sess->MBEDTLS_PRIVATE(ticket)) + { + mbedtls_platform_zeroize(sess->MBEDTLS_PRIVATE(ticket), sess->MBEDTLS_PRIVATE(ticket_len)); + mbedtls_free(sess->MBEDTLS_PRIVATE(ticket)); + } + sess->MBEDTLS_PRIVATE(ticket) = conn->clienthello_session_ticket; + sess->MBEDTLS_PRIVATE(ticket_len) = conn->clienthello_session_ticket_len; + sess->MBEDTLS_PRIVATE(ticket_lifetime) = 86400; /* XXX: can hint be 0? */ + + conn->clienthello_session_ticket = NULL; + conn->clienthello_session_ticket_len = 0; +} + +static int tls_mbedtls_ssl_ticket_write(void *p_ticket, + const mbedtls_ssl_session *session, + unsigned char *start, + const unsigned char *end, + size_t *tlen, + uint32_t *lifetime) +{ + struct tls_connection *conn = p_ticket; + if (conn && conn->session_ticket_cb) + { + /* see tls_mbedtls_clienthello_session_ticket_prep() */ + /* see tls_mbedtls_clienthello_session_ticket_set() */ + *tlen = 0; + return 0; + } + + return mbedtls_ssl_ticket_write(&tls_ctx_global.ticket_ctx, session, start, end, tlen, lifetime); +} + +static int tls_mbedtls_ssl_ticket_parse(void *p_ticket, mbedtls_ssl_session *session, unsigned char *buf, size_t len) +{ + /* XXX: TODO: not implemented in client; + * mbedtls_ssl_conf_session_tickets_cb() callbacks only for TLS server*/ + + if (len == 0) + return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; + + struct tls_connection *conn = p_ticket; + if (conn && conn->session_ticket_cb) + { + /* XXX: have random and secret been initialized yet? + * or must keys first be exported? + * EAP-FAST uses all args, EAP-TEAP only uses secret */ + struct tls_random data; + if (tls_connection_get_random(NULL, conn, &data) != 0) + return MBEDTLS_ERR_SSL_INTERNAL_ERROR; + int ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, buf, len, data.client_random, data.server_random, + conn->expkey_secret); + if (ret == 1) + { + conn->resumed = 1; + return 0; + } + emsg(MSG_ERROR, "EAP session ticket ext not implemented"); + return MBEDTLS_ERR_SSL_INVALID_MAC; + /*(non-zero return used for mbedtls debug logging)*/ + } + + /* XXX: TODO always use tls_mbedtls_ssl_ticket_parse() for callback? */ + int rc = mbedtls_ssl_ticket_parse(&tls_ctx_global.ticket_ctx, session, buf, len); + if (conn) + conn->resumed = (rc == 0); + return rc; +} + +#endif /* TLS_MBEDTLS_SESSION_TICKETS */ + +__attribute_cold__ int tls_global_set_params(void *tls_ctx, const struct tls_connection_params *params) +{ + /* XXX: why might global_set_params be called more than once? */ + if (tls_ctx_global.tls_conf) + tls_conf_deinit(tls_ctx_global.tls_conf); + tls_ctx_global.tls_conf = tls_conf_init(tls_ctx); + if (tls_ctx_global.tls_conf == NULL) + return -1; + +#ifdef MBEDTLS_SSL_SESSION_TICKETS +#ifdef MBEDTLS_SSL_TICKET_C + if (!(params->flags & TLS_CONN_DISABLE_SESSION_TICKET)) +#ifdef TLS_MBEDTLS_SESSION_TICKETS + mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf, tls_mbedtls_ssl_ticket_write, + tls_mbedtls_ssl_ticket_parse, NULL); +#else + mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf, mbedtls_ssl_ticket_write, + mbedtls_ssl_ticket_parse, &tls_ctx_global.ticket_ctx); +#endif +#endif +#endif + + os_free(tls_ctx_global.ocsp_stapling_response); + tls_ctx_global.ocsp_stapling_response = NULL; + if (params->ocsp_stapling_response) + tls_ctx_global.ocsp_stapling_response = os_strdup(params->ocsp_stapling_response); + + // os_free(tls_ctx_global.ca_cert_file); + tls_ctx_global.ca_cert_file = NULL; + if (params->ca_cert) + tls_ctx_global.ca_cert_file = os_strdup(params->ca_cert); + return tls_mbedtls_set_params(tls_ctx_global.tls_conf, params); +} + +int tls_global_set_verify(void *tls_ctx, int check_crl, int strict) +{ + tls_ctx_global.tls_conf->check_crl = check_crl; + tls_ctx_global.tls_conf->check_crl_strict = strict; /*(time checks)*/ + return 0; +} + +int tls_connection_set_verify(void *tls_ctx, + struct tls_connection *conn, + int verify_peer, + unsigned int flags, + const u8 *session_ctx, + size_t session_ctx_len) +{ + /*(EAP server-side calls this from eap_server_tls_ssl_init())*/ + if (conn == NULL) + return -1; + + conn->tls_conf->flags |= flags; /* TODO: reprocess flags, if necessary */ + + int authmode; + switch (verify_peer) + { + case 2: + authmode = MBEDTLS_SSL_VERIFY_OPTIONAL; + break; /*(eap_teap_init())*/ + case 1: + authmode = MBEDTLS_SSL_VERIFY_REQUIRED; + break; + default: + authmode = MBEDTLS_SSL_VERIFY_NONE; + break; + } +#ifdef MBEDTLS_SSL_SERVER_NAME_INDICATION + mbedtls_ssl_set_hs_authmode(&conn->ssl, authmode); +#endif + if ((conn->verify_peer = (authmode != MBEDTLS_SSL_VERIFY_NONE))) + mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn); + else + mbedtls_ssl_set_verify(&conn->ssl, NULL, NULL); + + return 0; +} + +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ +static void tls_connection_export_keys_cb(void *p_expkey, + mbedtls_ssl_key_export_type secret_type, + const unsigned char *secret, + size_t secret_len, + const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN], + const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN], + mbedtls_tls_prf_types tls_prf_type) +{ + struct tls_connection *conn = p_expkey; + conn->tls_prf_type = tls_prf_type; + if (!tls_prf_type) + return; + if (secret_len > sizeof(conn->expkey_secret)) + { + emsg(MSG_ERROR, "tls_connection_export_keys_cb secret too long"); + conn->tls_prf_type = MBEDTLS_SSL_TLS_PRF_NONE; /* 0 */ + return; + } + conn->expkey_secret_len = secret_len; + os_memcpy(conn->expkey_secret, secret, secret_len); + os_memcpy(conn->expkey_randbytes, client_random, MBEDTLS_EXPKEY_RAND_LEN); + os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN, server_random, MBEDTLS_EXPKEY_RAND_LEN); +} +#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ +static int tls_connection_export_keys_cb(void *p_expkey, + const unsigned char *ms, + const unsigned char *kb, + size_t maclen, + size_t keylen, + size_t ivlen, + const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN], + const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN], + mbedtls_tls_prf_types tls_prf_type) +{ + struct tls_connection *conn = p_expkey; + conn->tls_prf_type = tls_prf_type; + if (!tls_prf_type) + return -1; /*(return value ignored by mbedtls)*/ + conn->expkey_keyblock_size = maclen + keylen + ivlen; + conn->expkey_secret_len = MBEDTLS_EXPKEY_FIXED_SECRET_LEN; + os_memcpy(conn->expkey_secret, ms, MBEDTLS_EXPKEY_FIXED_SECRET_LEN); + os_memcpy(conn->expkey_randbytes, client_random, MBEDTLS_EXPKEY_RAND_LEN); + os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN, server_random, MBEDTLS_EXPKEY_RAND_LEN); + return 0; +} +#endif + +int tls_connection_get_random(void *tls_ctx, struct tls_connection *conn, struct tls_random *data) +{ + if (!conn || !conn->tls_prf_type) + return -1; + data->client_random = conn->expkey_randbytes; + data->client_random_len = MBEDTLS_EXPKEY_RAND_LEN; + data->server_random = conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN; + data->server_random_len = MBEDTLS_EXPKEY_RAND_LEN; + return 0; +} + +int tls_connection_export_key(void *tls_ctx, + struct tls_connection *conn, + const char *label, + const u8 *context, + size_t context_len, + u8 *out, + size_t out_len) +{ + /* (EAP-PEAP EAP-TLS EAP-TTLS) */ +#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ + return (conn && conn->established && conn->tls_prf_type) ? + mbedtls_ssl_tls_prf(conn->tls_prf_type, conn->expkey_secret, conn->expkey_secret_len, label, + conn->expkey_randbytes, sizeof(conn->expkey_randbytes), out, out_len) : + -1; +#else + /* not implemented here for mbedtls < 2.18.0 */ + return -1; +#endif +} + +#ifdef TLS_MBEDTLS_EAP_FAST + +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ +/* keyblock size info is not exposed in mbed TLS 3.0.0 */ +/* extracted from mbedtls library/ssl_tls.c:ssl_tls12_populate_transform() */ +#include +#include +static size_t tls_mbedtls_ssl_keyblock_size(mbedtls_ssl_context *ssl) +{ +#if !defined(MBEDTLS_USE_PSA_CRYPTO) /* XXX: (not extracted for PSA crypto) */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) + return 0; /* (calculation not extracted) */ +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + + int ciphersuite = mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl); + const mbedtls_ssl_ciphersuite_t *ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(ciphersuite); + if (ciphersuite_info == NULL) + return 0; + + const mbedtls_cipher_info_t *cipher_info = mbedtls_cipher_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(cipher)); + if (cipher_info == NULL) + return 0; + +#if MBEDTLS_VERSION_NUMBER >= 0x03010000 /* mbedtls 3.1.0 */ + size_t keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8; + mbedtls_cipher_mode_t mode = mbedtls_cipher_info_get_mode(cipher_info); +#else + size_t keylen = cipher_info->MBEDTLS_PRIVATE(key_bitlen) / 8; + mbedtls_cipher_mode_t mode = cipher_info->MBEDTLS_PRIVATE(mode); +#endif +#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C) + if (mode == MBEDTLS_MODE_GCM || mode == MBEDTLS_MODE_CCM) + return keylen + 4; + else if (mode == MBEDTLS_MODE_CHACHAPOLY) + return keylen + 12; + else +#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */ +#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) + { + const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(mac)); + if (md_info == NULL) + return 0; + size_t mac_key_len = mbedtls_md_get_size(md_info); + size_t ivlen = mbedtls_cipher_info_get_iv_size(cipher_info); + return keylen + mac_key_len + ivlen; + } +#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */ +#endif /* !MBEDTLS_USE_PSA_CRYPTO */ /* (not extracted for PSA crypto) */ + return 0; +} +#endif /* MBEDTLS_VERSION_NUMBER >= 0x03000000 */ /* mbedtls 3.0.0 */ + +int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn, u8 *out, size_t out_len) +{ + /* XXX: has export keys callback been run? */ + if (!conn || !conn->tls_prf_type) + return -1; + +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + conn->expkey_keyblock_size = tls_mbedtls_ssl_keyblock_size(&conn->ssl); + if (conn->expkey_keyblock_size == 0) + return -1; +#endif + size_t skip = conn->expkey_keyblock_size * 2; + unsigned char *tmp_out = os_malloc(skip + out_len); + if (!tmp_out) + return -1; + + /* server_random and then client_random */ + unsigned char seed[MBEDTLS_EXPKEY_RAND_LEN * 2]; + os_memcpy(seed, conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN, MBEDTLS_EXPKEY_RAND_LEN); + os_memcpy(seed + MBEDTLS_EXPKEY_RAND_LEN, conn->expkey_randbytes, MBEDTLS_EXPKEY_RAND_LEN); + +#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ + int ret = mbedtls_ssl_tls_prf(conn->tls_prf_type, conn->expkey_secret, conn->expkey_secret_len, "key expansion", + seed, sizeof(seed), tmp_out, skip + out_len); + if (ret == 0) + os_memcpy(out, tmp_out + skip, out_len); +#else + int ret = -1; /*(not reached if not impl; return -1 at top of func)*/ +#endif + + bin_clear_free(tmp_out, skip + out_len); + forced_memzero(seed, sizeof(seed)); + return ret; +} + +#endif /* TLS_MBEDTLS_EAP_FAST */ + +__attribute_cold__ static void tls_mbedtls_suiteb_handshake_alert(struct tls_connection *conn) +{ + /* tests/hwsim/test_suite_b.py test_suite_b_192_rsa_insufficient_dh */ + if (!(conn->tls_conf->flags & TLS_CONN_SUITEB)) + return; + if (tls_ctx_global.tls_conf) /*(is server; want issue event on client)*/ + return; + + struct tls_config *init_conf = &tls_ctx_global.init_conf; + if (init_conf->event_cb) + { + union tls_event_data ev; + os_memset(&ev, 0, sizeof(ev)); + ev.alert.is_local = 1; + ev.alert.type = "fatal"; + /*"internal error" string for tests/hwsim/test_suiteb.py */ + ev.alert.description = "internal error: handshake failure"; + /*ev.alert.description = "insufficient security";*/ + init_conf->event_cb(init_conf->cb_ctx, TLS_ALERT, &ev); + } +} + +struct wpabuf *tls_connection_handshake(void *tls_ctx, + struct tls_connection *conn, + const struct wpabuf *in_data, + struct wpabuf **appl_data) +{ + if (appl_data) + *appl_data = NULL; + + if (in_data && wpabuf_len(in_data)) + { + /*(unsure why tls_gnutls.c discards buffer contents; skip here)*/ + if (conn->pull_buf && 0) /* disable; appears unwise */ + tls_pull_buf_discard(conn, __func__); + if (!tls_pull_buf_append(conn, in_data)) + return NULL; + } + + if (conn->tls_conf == NULL) + { + struct tls_connection_params params; + os_memset(¶ms, 0, sizeof(params)); + params.openssl_ciphers = tls_ctx_global.init_conf.openssl_ciphers; + params.flags = tls_ctx_global.tls_conf->flags; + if (tls_connection_set_params(tls_ctx, conn, ¶ms) != 0) + return NULL; + } + + if (conn->verify_peer) /*(call here might be redundant; nbd)*/ + mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn); + +#ifdef TLS_MBEDTLS_SESSION_TICKETS + if (conn->clienthello_session_ticket) + /*(starting handshake for EAP-FAST and EAP-TEAP)*/ + tls_mbedtls_clienthello_session_ticket_set(conn); + + /* (not thread-safe due to need to set userdata 'conn' for callback) */ + /* (unable to use mbedtls_ssl_set_user_data_p() with mbedtls 3.2.0+ + * since ticket write and parse callbacks take (mbedtls_ssl_session *) + * param instead of (mbedtls_ssl_context *) param) */ + if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET) + mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf, NULL, NULL, NULL); + else + mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf, tls_mbedtls_ssl_ticket_write, + tls_mbedtls_ssl_ticket_parse, conn); +#endif + +#if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */ + int ret = mbedtls_ssl_handshake(&conn->ssl); +#else + int ret = 0; + while (conn->ssl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER) + { + ret = mbedtls_ssl_handshake_step(&conn->ssl); + if (ret != 0) + break; + } +#endif + +#ifdef TLS_MBEDTLS_SESSION_TICKETS + mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf, tls_mbedtls_ssl_ticket_write, + tls_mbedtls_ssl_ticket_parse, NULL); +#endif + + switch (ret) + { + case 0: + conn->established = 1; + if (conn->push_buf == NULL) + /* Need to return something to get final TLS ACK. */ + conn->push_buf = wpabuf_alloc(0); + + if (appl_data /*&& conn->pull_buf && wpabuf_len(conn->pull_buf)*/) + *appl_data = NULL; /* RFE: check for application data */ + break; + case MBEDTLS_ERR_SSL_WANT_WRITE: + case MBEDTLS_ERR_SSL_WANT_READ: + case MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS: + case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: + if (tls_ctx_global.tls_conf /*(is server)*/ + && conn->established && conn->push_buf == NULL) + /* Need to return something to trigger completion of EAP-TLS. */ + conn->push_buf = wpabuf_alloc(0); + break; + default: + ++conn->failed; + switch (ret) + { + case MBEDTLS_ERR_SSL_CLIENT_RECONNECT: + case MBEDTLS_ERR_NET_CONN_RESET: + case MBEDTLS_ERR_NET_SEND_FAILED: + ++conn->write_alerts; + break; +#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */ + case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE: +#else + case MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE: +#endif + tls_mbedtls_suiteb_handshake_alert(conn); + /* fall through */ + case MBEDTLS_ERR_NET_RECV_FAILED: + case MBEDTLS_ERR_SSL_CONN_EOF: + case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY: + case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE: + ++conn->read_alerts; + break; + default: + break; + } + + ilog(ret, "mbedtls_ssl_handshake"); + break; + } + + struct wpabuf *out_data = conn->push_buf; + conn->push_buf = NULL; + return out_data; +} + +struct wpabuf *tls_connection_server_handshake(void *tls_ctx, + struct tls_connection *conn, + const struct wpabuf *in_data, + struct wpabuf **appl_data) +{ + conn->is_server = 1; + return tls_connection_handshake(tls_ctx, conn, in_data, appl_data); +} + +struct wpabuf *tls_connection_encrypt(void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data) +{ + int res = mbedtls_ssl_write(&conn->ssl, wpabuf_head_u8(in_data), wpabuf_len(in_data)); + if (res < 0) + { + elog(res, "mbedtls_ssl_write"); + return NULL; + } + + struct wpabuf *buf = conn->push_buf; + conn->push_buf = NULL; + return buf; +} + +struct wpabuf *tls_connection_decrypt(void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data) +{ + int res; + struct wpabuf *out; + + /*assert(in_data != NULL);*/ + if (!tls_pull_buf_append(conn, in_data)) + return NULL; + +#if defined(MBEDTLS_ZLIB_SUPPORT) /* removed in mbedtls 3.x */ + /* Add extra buffer space to handle the possibility of decrypted + * data being longer than input data due to TLS compression. */ + out = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3); +#else /* TLS compression is disabled in mbedtls 3.x */ + out = wpabuf_alloc(wpabuf_len(in_data)); +#endif + if (out == NULL) + return NULL; + + while ((conn->pull_buf) && ((wpabuf_len(conn->pull_buf) - conn->pull_buf_offset) > 0)) + { + res = mbedtls_ssl_read(&conn->ssl, wpabuf_mhead(out), wpabuf_size(out)); + if (res < 0) + { + /*(seems like a different error if wpabuf_len(in_data) == 0)*/ + if (res == MBEDTLS_ERR_SSL_WANT_READ) + { + return out; + } + elog(res, "mbedtls_ssl_read"); + wpabuf_free(out); + return NULL; + } + wpabuf_put(out, res); + } + + return out; +} + +int tls_connection_resumed(void *tls_ctx, struct tls_connection *conn) +{ + /* XXX: might need to detect if session resumed from TLS session ticket + * even if not special session ticket handling for EAP-FAST, EAP-TEAP */ + /* (?ssl->handshake->resume during session ticket validation?) */ + return conn && conn->resumed; +} + +#ifdef TLS_MBEDTLS_EAP_FAST +int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn, u8 *ciphers) +{ + /* ciphers is list of TLS_CIPHER_* from hostap/src/crypto/tls.h */ + int ids[7]; + const int idsz = (int)sizeof(ids); + int nids = -1, id; + for (; *ciphers != TLS_CIPHER_NONE; ++ciphers) + { + switch (*ciphers) + { + case TLS_CIPHER_RC4_SHA: +#ifdef MBEDTLS_TLS_RSA_WITH_RC4_128_SHA + id = MBEDTLS_TLS_RSA_WITH_RC4_128_SHA; + break; +#else + continue; /*(not supported in mbedtls 3.x; ignore)*/ +#endif + case TLS_CIPHER_AES128_SHA: + id = MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA; + break; + case TLS_CIPHER_RSA_DHE_AES128_SHA: + id = MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA; + break; + case TLS_CIPHER_ANON_DH_AES128_SHA: + continue; /*(not supported in mbedtls; ignore)*/ + case TLS_CIPHER_RSA_DHE_AES256_SHA: + id = MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA; + break; + case TLS_CIPHER_AES256_SHA: + id = MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA; + break; + default: + return -1; /* should not happen */ + } + if (++nids == idsz) + return -1; /* should not happen */ + ids[nids] = id; + } + if (nids < 0) + return 0; /* nothing to do */ + if (++nids == idsz) + return -1; /* should not happen */ + ids[nids] = 0; /* terminate list */ + ++nids; + + return tls_mbedtls_set_ciphersuites(conn->tls_conf, ids, nids) ? 0 : -1; +} +#endif + +int tls_get_version(void *ssl_ctx, struct tls_connection *conn, char *buf, size_t buflen) +{ + if (conn == NULL) + return -1; + os_strlcpy(buf, mbedtls_ssl_get_version(&conn->ssl), buflen); + return buf[0] != 'u' ? 0 : -1; /*(-1 if "unknown")*/ +} + +#ifdef TLS_MBEDTLS_EAP_TEAP +u16 tls_connection_get_cipher_suite(struct tls_connection *conn) +{ + if (conn == NULL) + return 0; + return (u16)mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl); +} +#endif + +int tls_get_cipher(void *tls_ctx, struct tls_connection *conn, char *buf, size_t buflen) +{ + if (conn == NULL) + return -1; + const int id = mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl); + return tls_mbedtls_translate_ciphername(id, buf, buflen) ? 0 : -1; +} + +#ifdef TLS_MBEDTLS_SESSION_TICKETS + +int tls_connection_enable_workaround(void *tls_ctx, struct tls_connection *conn) +{ + /* (see comment in src/eap_peer/eap_fast.c:eap_fast_init()) */ + /* XXX: is there a relevant setting for this in mbed TLS? */ + /* (do we even care that much about older CBC ciphers?) */ + return 0; +} + +int tls_connection_client_hello_ext( + void *tls_ctx, struct tls_connection *conn, int ext_type, const u8 *data, size_t data_len) +{ + /* (EAP-FAST and EAP-TEAP) */ + if (ext_type == MBEDTLS_TLS_EXT_SESSION_TICKET) /*(ext_type == 35)*/ + return tls_mbedtls_clienthello_session_ticket_prep(conn, data, data_len); + + return -1; +} + +#endif /* TLS_MBEDTLS_SESSION_TICKETS */ + +int tls_connection_get_failed(void *tls_ctx, struct tls_connection *conn) +{ + return conn ? conn->failed : -1; +} + +int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn) +{ + return conn ? conn->read_alerts : -1; +} + +int tls_connection_get_write_alerts(void *tls_ctx, struct tls_connection *conn) +{ + return conn ? conn->write_alerts : -1; +} + +#ifdef TLS_MBEDTLS_SESSION_TICKETS +int tls_connection_set_session_ticket_cb(void *tls_ctx, + struct tls_connection *conn, + tls_session_ticket_cb cb, + void *ctx) +{ + if (!(conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)) + { + /* (EAP-FAST and EAP-TEAP) */ + conn->session_ticket_cb = cb; + conn->session_ticket_cb_ctx = ctx; + return 0; + } + return -1; +} +#endif + +int tls_get_library_version(char *buf, size_t buf_len) +{ +#ifndef MBEDTLS_VERSION_C + const char *const ver = "n/a"; +#else + char ver[9]; + mbedtls_version_get_string(ver); +#endif + return os_snprintf(buf, buf_len, "mbed TLS build=" MBEDTLS_VERSION_STRING " run=%s", ver); +} + +void tls_connection_set_success_data(struct tls_connection *conn, struct wpabuf *data) +{ + wpabuf_free(conn->success_data); + conn->success_data = data; +} + +void tls_connection_set_success_data_resumed(struct tls_connection *conn) +{ +} + +const struct wpabuf *tls_connection_get_success_data(struct tls_connection *conn) +{ + return conn->success_data; +} + +void tls_connection_remove_session(struct tls_connection *conn) +{ +} + +#ifdef TLS_MBEDTLS_EAP_TEAP +int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len) +{ +#if defined(MBEDTLS_SSL_RENEGOTIATION) /* XXX: renegotiation or resumption? */ + /* data from TLS handshake Finished message */ + size_t verify_len = conn->ssl.MBEDTLS_PRIVATE(verify_data_len); + char *verify_data = (conn->is_server ^ conn->resumed) ? conn->ssl.MBEDTLS_PRIVATE(peer_verify_data) : + conn->ssl.MBEDTLS_PRIVATE(own_verify_data); + if (verify_len && verify_len <= max_len) + { + os_memcpy(buf, verify_data, verify_len); + return (int)verify_len; + } +#endif + return -1; +} +#endif + +__attribute_noinline__ static void tls_mbedtls_set_peer_subject(struct tls_connection *conn, + const mbedtls_x509_crt *crt) +{ + if (conn->peer_subject) + return; + char buf[MBEDTLS_X509_MAX_DN_NAME_SIZE * 2]; + int buflen = mbedtls_x509_dn_gets(buf, sizeof(buf), &crt->subject); + if (buflen >= 0 && (conn->peer_subject = os_malloc((size_t)buflen + 1))) + os_memcpy(conn->peer_subject, buf, (size_t)buflen + 1); +} + +#ifdef TLS_MBEDTLS_EAP_TEAP +const char *tls_connection_get_peer_subject(struct tls_connection *conn) +{ + if (!conn) + return NULL; + if (!conn->peer_subject) + { /*(if not set during cert verify)*/ + const mbedtls_x509_crt *peer_cert = mbedtls_ssl_get_peer_cert(&conn->ssl); + if (peer_cert) + tls_mbedtls_set_peer_subject(conn, peer_cert); + } + return conn->peer_subject; +} +#endif + +#ifdef TLS_MBEDTLS_EAP_TEAP +bool tls_connection_get_own_cert_used(struct tls_connection *conn) +{ + /* XXX: availability of cert does not necessary mean that client + * received certificate request from server and then sent cert. + * ? step handshake in tls_connection_handshake() looking for + * MBEDTLS_SSL_CERTIFICATE_REQUEST ? */ + const struct tls_conf *const tls_conf = conn->tls_conf; + return (tls_conf->has_client_cert && tls_conf->has_private_key); +} +#endif + +#if defined(CONFIG_FIPS) +#define TLS_MBEDTLS_CONFIG_FIPS +#endif + +#if defined(CONFIG_SHA256) +#define TLS_MBEDTLS_TLS_PRF_SHA256 +#endif + +#if defined(CONFIG_SHA384) +#define TLS_MBEDTLS_TLS_PRF_SHA384 +#endif + +#ifndef TLS_MBEDTLS_CONFIG_FIPS +#if defined(CONFIG_MODULE_TESTS) +/* unused with CONFIG_TLS=mbedtls except in crypto_module_tests.c */ +#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ \ + && MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */ +/* sha1-tlsprf.c */ +#include "sha1.h" +int tls_prf_sha1_md5( + const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen) +{ + return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_TLS1, secret, secret_len, label, seed, seed_len, out, outlen) ? -1 : + 0; +} +#else +#include "sha1-tlsprf.c" /* pull in hostap local implementation */ +#endif +#endif +#endif + +#ifdef TLS_MBEDTLS_TLS_PRF_SHA256 +/* sha256-tlsprf.c */ +#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ +#include "sha256.h" +int tls_prf_sha256( + const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen) +{ + return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_SHA256, secret, secret_len, label, seed, seed_len, out, outlen) ? + -1 : + 0; +} +#else +#include "sha256-tlsprf.c" /* pull in hostap local implementation */ +#endif +#endif + +#ifdef TLS_MBEDTLS_TLS_PRF_SHA384 +/* sha384-tlsprf.c */ +#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ +#include "sha384.h" +int tls_prf_sha384( + const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen) +{ + return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_SHA384, secret, secret_len, label, seed, seed_len, out, outlen) ? + -1 : + 0; +} +#else +#include "sha384-tlsprf.c" /* pull in hostap local implementation */ +#endif +#endif + +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + +#if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */ +#define mbedtls_x509_crt_has_ext_type(crt, ext_type) ((crt)->MBEDTLS_PRIVATE(ext_types) & (ext_type)) +#endif + +struct mlist +{ + const char *p; + size_t n; +}; + +static int tls_mbedtls_match_altsubject(mbedtls_x509_crt *crt, const char *match) +{ + /* RFE: this could be pre-parsed into structured data at config time */ + struct mlist list[256]; /*(much larger than expected)*/ + int nlist = 0; + if (os_strncmp(match, "EMAIL:", 6) != 0 && os_strncmp(match, "DNS:", 4) != 0 && os_strncmp(match, "URI:", 4) != 0) + { + wpa_printf(MSG_INFO, "MTLS: Invalid altSubjectName match '%s'", match); + return 0; + } + for (const char *s = match, *tok; *s; s = tok ? tok + 1 : "") + { + do + { + } while ((tok = os_strchr(s, ';')) && os_strncmp(tok + 1, "EMAIL:", 6) != 0 && + os_strncmp(tok + 1, "DNS:", 4) != 0 && os_strncmp(tok + 1, "URI:", 4) != 0); + list[nlist].p = s; + list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s); + if (list[nlist].n && ++nlist == sizeof(list) / sizeof(*list)) + { + wpa_printf(MSG_INFO, "MTLS: excessive altSubjectName match '%s'", match); + break; /* truncate huge list and continue */ + } + } + + if (!mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME)) + return 0; + + const mbedtls_x509_sequence *cur = &crt->subject_alt_names; + for (; cur != NULL; cur = cur->next) + { + const unsigned char san_type = (unsigned char)cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK; + char t; + size_t step = 4; + switch (san_type) + { /* "EMAIL:" or "DNS:" or "URI:" */ + case MBEDTLS_X509_SAN_RFC822_NAME: + step = 6; + t = 'E'; + break; + case MBEDTLS_X509_SAN_DNS_NAME: + t = 'D'; + break; + case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: + t = 'U'; + break; + default: + continue; + } + + for (int i = 0; i < nlist; ++i) + { + /* step over "EMAIL:" or "DNS:" or "URI:" in list[i].p */ + /* Note: v is not '\0'-terminated, but is a known length vlen, + * so okay to pass to os_strncasecmp() even though not z-string */ + if (cur->buf.len == list[i].n - step && t == *list[i].p && + 0 == os_strncasecmp((char *)cur->buf.p, list[i].p + step, cur->buf.len)) + { + return 1; /* match */ + } + } + } + return 0; /* no match */ +} + +static int tls_mbedtls_match_suffix(const char *v, size_t vlen, const struct mlist *list, int nlist, int full) +{ + /* Note: v is not '\0'-terminated, but is a known length vlen, + * so okay to pass to os_strncasecmp() even though not z-string */ + for (int i = 0; i < nlist; ++i) + { + size_t n = list[i].n; + if ((n == vlen || (n < vlen && v[vlen - n - 1] == '.' && !full)) && + 0 == os_strncasecmp(v + vlen - n, list[i].p, n)) + return 1; /* match */ + } + return 0; /* no match */ +} + +static int tls_mbedtls_match_suffixes(mbedtls_x509_crt *crt, const char *match, int full) +{ + /* RFE: this could be pre-parsed into structured data at config time */ + struct mlist list[256]; /*(much larger than expected)*/ + int nlist = 0; + for (const char *s = match, *tok; *s; s = tok ? tok + 1 : "") + { + tok = os_strchr(s, ';'); + list[nlist].p = s; + list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s); + if (list[nlist].n && ++nlist == sizeof(list) / sizeof(*list)) + { + wpa_printf(MSG_INFO, "MTLS: excessive suffix match '%s'", match); + break; /* truncate huge list and continue */ + } + } + + /* check subjectAltNames */ + if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME)) + { + const mbedtls_x509_sequence *cur = &crt->subject_alt_names; + for (; cur != NULL; cur = cur->next) + { + const unsigned char san_type = (unsigned char)cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK; + if (san_type == MBEDTLS_X509_SAN_DNS_NAME && + tls_mbedtls_match_suffix((char *)cur->buf.p, cur->buf.len, list, nlist, full)) + { + return 1; /* match */ + } + } + } + + /* check subject CN */ + const mbedtls_x509_name *name = &crt->subject; + for (; name != NULL; name = name->next) + { + if (name->oid.p && MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0) + break; + } + if (name && tls_mbedtls_match_suffix((char *)name->val.p, name->val.len, list, nlist, full)) + { + return 1; /* match */ + } + + return 0; /* no match */ +} + +static int tls_mbedtls_match_dn_field(mbedtls_x509_crt *crt, const char *match) +{ + /* RFE: this could be pre-parsed into structured data at config time */ + struct mlistoid + { + const char *p; + size_t n; + const char *oid; + size_t olen; + int prefix; + }; + struct mlistoid list[32]; /*(much larger than expected)*/ + int nlist = 0; + for (const char *s = match, *tok, *e; *s; s = tok ? tok + 1 : "") + { + tok = os_strchr(s, '/'); + list[nlist].oid = NULL; + list[nlist].olen = 0; + list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s); + e = memchr(s, '=', list[nlist].n); + if (e == NULL) + { + if (list[nlist].n == 0) + continue; /* skip consecutive, repeated '/' */ + if (list[nlist].n == 1 && *s == '*') + { + /* special-case "*" to match any OID and value */ + s = e = "=*"; + list[nlist].n = 2; + list[nlist].oid = ""; + } + else + { + wpa_printf(MSG_INFO, "MTLS: invalid check_cert_subject '%s' missing '='", match); + return 0; + } + } + switch (e - s) + { + case 1: + if (*s == 'C') + { + list[nlist].oid = MBEDTLS_OID_AT_COUNTRY; + list[nlist].olen = sizeof(MBEDTLS_OID_AT_COUNTRY) - 1; + } + else if (*s == 'L') + { + list[nlist].oid = MBEDTLS_OID_AT_LOCALITY; + list[nlist].olen = sizeof(MBEDTLS_OID_AT_LOCALITY) - 1; + } + else if (*s == 'O') + { + list[nlist].oid = MBEDTLS_OID_AT_ORGANIZATION; + list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORGANIZATION) - 1; + } + break; + case 2: + if (s[0] == 'C' && s[1] == 'N') + { + list[nlist].oid = MBEDTLS_OID_AT_CN; + list[nlist].olen = sizeof(MBEDTLS_OID_AT_CN) - 1; + } + else if (s[0] == 'S' && s[1] == 'T') + { + list[nlist].oid = MBEDTLS_OID_AT_STATE; + list[nlist].olen = sizeof(MBEDTLS_OID_AT_STATE) - 1; + } + else if (s[0] == 'O' && s[1] == 'U') + { + list[nlist].oid = MBEDTLS_OID_AT_ORG_UNIT; + list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORG_UNIT) - 1; + } + break; + case 12: + if (os_memcmp(s, "emailAddress", 12) == 0) + { + list[nlist].oid = MBEDTLS_OID_PKCS9_EMAIL; + list[nlist].olen = sizeof(MBEDTLS_OID_PKCS9_EMAIL) - 1; + } + break; + default: + break; + } + if (list[nlist].oid == NULL) + { + wpa_printf(MSG_INFO, "MTLS: Unknown field in check_cert_subject '%s'", match); + return 0; + } + list[nlist].n -= (size_t)(++e - s); + list[nlist].p = e; + if (list[nlist].n && e[list[nlist].n - 1] == '*') + { + --list[nlist].n; + list[nlist].prefix = 1; + } + /*(could easily add support for suffix matches if value begins with '*', + * but suffix match is not currently supported by other TLS modules)*/ + + if (list[nlist].n && ++nlist == sizeof(list) / sizeof(*list)) + { + wpa_printf(MSG_INFO, "MTLS: excessive check_cert_subject match '%s'", match); + break; /* truncate huge list and continue */ + } + } + + /* each component in match string must match cert Subject in order listed + * The behavior below preserves ordering but is slightly different than + * the grossly inefficient contortions implemented in tls_openssl.c */ + const mbedtls_x509_name *name = &crt->subject; + for (int i = 0; i < nlist; ++i) + { + int found = 0; + for (; name != NULL && !found; name = name->next) + { + if (!name->oid.p) + continue; + /* special-case "*" to match any OID and value */ + if (list[i].olen == 0) + { + found = 1; + continue; + } + /* perform equalent of !MBEDTLS_OID_CMP() with oid ptr and len */ + if (list[i].olen != name->oid.len || os_memcmp(list[i].oid, name->oid.p, name->oid.len) != 0) + continue; + /* Note: v is not '\0'-terminated, but is a known length vlen, + * so okay to pass to os_strncasecmp() even though not z-string */ + if ((list[i].prefix ? list[i].n <= name->val.len /* prefix match */ + : + list[i].n == name->val.len) /* full match */ + && 0 == os_strncasecmp((char *)name->val.p, list[i].p, list[i].n)) + { + found = 1; + continue; + } + } + if (!found) + return 0; /* no match */ + } + return 1; /* match */ +} + +#endif /* TLS_MBEDTLS_CERT_VERIFY_EXTMATCH */ + +__attribute_cold__ static void tls_mbedtls_verify_fail_event(mbedtls_x509_crt *crt, + int depth, + const char *errmsg, + enum tls_fail_reason reason) +{ + struct tls_config *init_conf = &tls_ctx_global.init_conf; + if (init_conf->event_cb == NULL) + return; + + struct wpabuf *certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len); + char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE * 2]; + if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0) + subject[0] = '\0'; + union tls_event_data ev; + os_memset(&ev, 0, sizeof(ev)); + ev.cert_fail.reason = reason; + ev.cert_fail.depth = depth; + ev.cert_fail.subject = subject; + ev.cert_fail.reason_txt = errmsg; + ev.cert_fail.cert = certbuf; + + init_conf->event_cb(init_conf->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev); + + wpabuf_free(certbuf); +} + +__attribute_noinline__ static void tls_mbedtls_verify_cert_event(struct tls_connection *conn, + mbedtls_x509_crt *crt, + int depth) +{ + struct tls_config *init_conf = &tls_ctx_global.init_conf; + if (init_conf->event_cb == NULL) + return; + + struct wpabuf *certbuf = NULL; + union tls_event_data ev; + os_memset(&ev, 0, sizeof(ev)); + +#ifdef MBEDTLS_SHA256_C + u8 hash[SHA256_DIGEST_LENGTH]; + const u8 *addr[] = {(u8 *)crt->raw.p}; + if (sha256_vector(1, addr, &crt->raw.len, hash) == 0) + { + ev.peer_cert.hash = hash; + ev.peer_cert.hash_len = sizeof(hash); + } +#endif + ev.peer_cert.depth = depth; + char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE * 2]; + if (depth == 0) + ev.peer_cert.subject = conn->peer_subject; + if (ev.peer_cert.subject == NULL) + { + ev.peer_cert.subject = subject; + if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0) + subject[0] = '\0'; + } + + char serial_num[128 + 1]; + ev.peer_cert.serial_num = tls_mbedtls_peer_serial_num(crt, serial_num, sizeof(serial_num)); + + const mbedtls_x509_sequence *cur; + + cur = NULL; + if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME)) + cur = &crt->subject_alt_names; + for (; cur != NULL; cur = cur->next) + { + const unsigned char san_type = (unsigned char)cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK; + size_t prelen = 4; + const char *pre; + switch (san_type) + { + case MBEDTLS_X509_SAN_RFC822_NAME: + prelen = 6; + pre = "EMAIL:"; + break; + case MBEDTLS_X509_SAN_DNS_NAME: + pre = "DNS:"; + break; + case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: + pre = "URI:"; + break; + default: + continue; + } + + char *pos = os_malloc(prelen + cur->buf.len + 1); + if (pos == NULL) + break; + ev.peer_cert.altsubject[ev.peer_cert.num_altsubject] = pos; + os_memcpy(pos, pre, prelen); + /* data should be properly backslash-escaped if needed, + * so code below does not re-escape, but does replace CTLs */ + /*os_memcpy(pos+prelen, cur->buf.p, cur->buf.len);*/ + /*pos[prelen+cur->buf.len] = '\0';*/ + pos += prelen; + for (size_t i = 0; i < cur->buf.len; ++i) + { + unsigned char c = cur->buf.p[i]; + *pos++ = (c >= 32 && c != 127) ? c : '?'; + } + *pos = '\0'; + + if (++ev.peer_cert.num_altsubject == TLS_MAX_ALT_SUBJECT) + break; + } + + cur = NULL; + if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_CERTIFICATE_POLICIES)) + cur = &crt->certificate_policies; + for (; cur != NULL; cur = cur->next) + { + if (cur->buf.len != 11) /* len of OID_TOD_STRICT or OID_TOD_TOFU */ + continue; +/* TOD-STRICT "1.3.6.1.4.1.40808.1.3.1" */ +/* TOD-TOFU "1.3.6.1.4.1.40808.1.3.2" */ +#define OID_TOD_STRICT "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x01" +#define OID_TOD_TOFU "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x02" + if (os_memcmp(cur->buf.p, OID_TOD_STRICT, sizeof(OID_TOD_STRICT) - 1) == 0) + { + ev.peer_cert.tod = 1; /* TOD-STRICT */ + break; + } + if (os_memcmp(cur->buf.p, OID_TOD_TOFU, sizeof(OID_TOD_TOFU) - 1) == 0) + { + ev.peer_cert.tod = 2; /* TOD-TOFU */ + break; + } + } + + struct tls_conf *tls_conf = conn->tls_conf; + if (tls_conf->ca_cert_probe || (tls_conf->flags & TLS_CONN_EXT_CERT_CHECK) || init_conf->cert_in_cb) + { + certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len); + ev.peer_cert.cert = certbuf; + } + + init_conf->event_cb(init_conf->cb_ctx, TLS_PEER_CERTIFICATE, &ev); + + wpabuf_free(certbuf); + char **altsubject; + *(const char ***)&altsubject = ev.peer_cert.altsubject; + for (size_t i = 0; i < ev.peer_cert.num_altsubject; ++i) + os_free(altsubject[i]); +} + +static int tls_mbedtls_verify_cb(void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags) +{ + /* XXX: N.B. verify code not carefully tested besides hwsim tests + * + * RFE: mbedtls_x509_crt_verify_info() and enhance log trace messages + * RFE: review and add support for additional TLS_CONN_* flags + * not handling OCSP (not available in mbedtls) + * ... */ + + struct tls_connection *conn = (struct tls_connection *)arg; + struct tls_conf *tls_conf = conn->tls_conf; + uint32_t flags_in = *flags; + +#if defined(TLS_MBEDTLS_CERT_DISABLE_KEY_USAGE_CHECK) + crt->ext_types &= ~MBEDTLS_X509_EXT_KEY_USAGE; + crt->ext_types &= ~MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE; +#endif + + if (depth > 8) + { /*(depth 8 picked as arbitrary limit)*/ + emsg(MSG_WARNING, "client cert chain too long"); + *flags |= MBEDTLS_X509_BADCERT_OTHER; /* cert chain too long */ + tls_mbedtls_verify_fail_event(crt, depth, "client cert chain too long", TLS_FAIL_BAD_CERTIFICATE); + } + else if (tls_conf->verify_depth0_only) + { + if (depth > 0) + *flags = 0; + else + { +#ifdef MBEDTLS_SHA256_C + u8 hash[SHA256_DIGEST_LENGTH]; + const u8 *addr[] = {(u8 *)crt->raw.p}; + if (sha256_vector(1, addr, &crt->raw.len, hash) < 0 || + os_memcmp(tls_conf->ca_cert_hash, hash, sizeof(hash)) != 0) + { + *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED; + tls_mbedtls_verify_fail_event(crt, depth, "cert hash mismatch", TLS_FAIL_UNTRUSTED); + } + else /* hash matches; ignore other issues *except* if revoked)*/ + *flags &= MBEDTLS_X509_BADCERT_REVOKED; +#endif + } + } + else if (depth == 0) + { + if (!conn->peer_subject) + tls_mbedtls_set_peer_subject(conn, crt); + /*(use same labels to tls_mbedtls_verify_fail_event() as used in + * other TLS modules so that hwsim tests find exact string match)*/ + if (!conn->peer_subject) + { /* error copying subject string */ + *flags |= MBEDTLS_X509_BADCERT_OTHER; + tls_mbedtls_verify_fail_event(crt, depth, "internal error", TLS_FAIL_UNSPECIFIED); + } +#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH + /*(use os_strstr() for subject match as is done in tls_mbedtls.c + * to follow the same behavior, even though a suffix match would + * make more sense. Also, note that strstr match does not + * normalize whitespace (between components) for comparison)*/ + else if (tls_conf->subject_match && os_strstr(conn->peer_subject, tls_conf->subject_match) == NULL) + { + wpa_printf(MSG_WARNING, "MTLS: Subject '%s' did not match with '%s'", conn->peer_subject, + tls_conf->subject_match); + *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH; + tls_mbedtls_verify_fail_event(crt, depth, "Subject mismatch", TLS_FAIL_SUBJECT_MISMATCH); + } + if (tls_conf->altsubject_match && !tls_mbedtls_match_altsubject(crt, tls_conf->altsubject_match)) + { + wpa_printf(MSG_WARNING, "MTLS: altSubjectName match '%s' not found", tls_conf->altsubject_match); + *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH; + tls_mbedtls_verify_fail_event(crt, depth, "AltSubject mismatch", TLS_FAIL_ALTSUBJECT_MISMATCH); + } + if (tls_conf->suffix_match && !tls_mbedtls_match_suffixes(crt, tls_conf->suffix_match, 0)) + { + wpa_printf(MSG_WARNING, "MTLS: Domain suffix match '%s' not found", tls_conf->suffix_match); + *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH; + tls_mbedtls_verify_fail_event(crt, depth, "Domain suffix mismatch", TLS_FAIL_DOMAIN_SUFFIX_MISMATCH); + } + if (tls_conf->domain_match && !tls_mbedtls_match_suffixes(crt, tls_conf->domain_match, 1)) + { + wpa_printf(MSG_WARNING, "MTLS: Domain match '%s' not found", tls_conf->domain_match); + *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH; + tls_mbedtls_verify_fail_event(crt, depth, "Domain mismatch", TLS_FAIL_DOMAIN_MISMATCH); + } + if (tls_conf->check_cert_subject && !tls_mbedtls_match_dn_field(crt, tls_conf->check_cert_subject)) + { + *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH; + tls_mbedtls_verify_fail_event(crt, depth, "Distinguished Name", TLS_FAIL_DN_MISMATCH); + } +#endif + if (tls_conf->flags & TLS_CONN_SUITEB) + { + /* check RSA modulus size (public key bitlen) */ + const mbedtls_pk_type_t pk_alg = mbedtls_pk_get_type(&crt->pk); + if ((pk_alg == MBEDTLS_PK_RSA || pk_alg == MBEDTLS_PK_RSASSA_PSS) +#ifdef CONFIG_SUITEB192 + && mbedtls_pk_get_bitlen(&crt->pk) < 3072 +#else + && mbedtls_pk_get_bitlen(&crt->pk) < 2048 +#endif + ) + { + /* hwsim suite_b RSA tests expect 3072 + * suite_b_192_rsa_ecdhe_radius_rsa2048_client + * suite_b_192_rsa_dhe_radius_rsa2048_client */ + *flags |= MBEDTLS_X509_BADCERT_BAD_KEY; + tls_mbedtls_verify_fail_event(crt, depth, "Insufficient RSA modulus size", + TLS_FAIL_INSUFFICIENT_KEY_LEN); + } + } + if (tls_conf->check_crl && tls_conf->crl == NULL) + { + /* see tests/hwsim test_ap_eap.py ap_wpa2_eap_tls_check_crl */ + emsg(MSG_WARNING, "check_crl set but no CRL loaded; reject all?"); + *flags |= MBEDTLS_X509_BADCERT_OTHER; + tls_mbedtls_verify_fail_event(crt, depth, + "check_crl set but no CRL loaded; " + "reject all?", + TLS_FAIL_BAD_CERTIFICATE); + } + } + else + { + if (tls_conf->check_crl != 2) /* 2 == verify CRLs for all certs */ + *flags &= ~MBEDTLS_X509_BADCERT_REVOKED; + } + + if (!tls_conf->check_crl_strict) + { + *flags &= ~MBEDTLS_X509_BADCRL_EXPIRED; + *flags &= ~MBEDTLS_X509_BADCRL_FUTURE; + } + + if (tls_conf->flags & TLS_CONN_DISABLE_TIME_CHECKS) + { + *flags &= ~MBEDTLS_X509_BADCERT_EXPIRED; + *flags &= ~MBEDTLS_X509_BADCERT_FUTURE; + } + + tls_mbedtls_verify_cert_event(conn, crt, depth); + + if (*flags) + { + if (*flags & + (MBEDTLS_X509_BADCERT_NOT_TRUSTED | MBEDTLS_X509_BADCERT_CN_MISMATCH | MBEDTLS_X509_BADCERT_REVOKED)) + { + emsg(MSG_WARNING, "client cert not trusted"); + } + /* report event if flags set but no additional flags set above */ + /* (could translate flags to more detailed TLS_FAIL_* if needed) */ + if (!(*flags & ~flags_in)) + { + enum tls_fail_reason reason = TLS_FAIL_UNSPECIFIED; + const char *errmsg = "cert verify fail unspecified"; + if (*flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED) + { + reason = TLS_FAIL_UNTRUSTED; + errmsg = "certificate not trusted"; + } + if (*flags & MBEDTLS_X509_BADCERT_REVOKED) + { + reason = TLS_FAIL_REVOKED; + errmsg = "certificate has been revoked"; + } + if (*flags & MBEDTLS_X509_BADCERT_FUTURE) + { + reason = TLS_FAIL_NOT_YET_VALID; + errmsg = "certificate not yet valid"; + } + if (*flags & MBEDTLS_X509_BADCERT_EXPIRED) + { + reason = TLS_FAIL_EXPIRED; + errmsg = "certificate has expired"; + } + if (*flags & MBEDTLS_X509_BADCERT_BAD_MD) + { + reason = TLS_FAIL_BAD_CERTIFICATE; + errmsg = "certificate uses insecure algorithm"; + } + tls_mbedtls_verify_fail_event(crt, depth, errmsg, reason); + } + + /*(do not preserve subject if verification failed but was optional)*/ + if (depth == 0 && conn->peer_subject) + { + os_free(conn->peer_subject); + conn->peer_subject = NULL; + } + } + else if (depth == 0) + { + struct tls_config *init_conf = &tls_ctx_global.init_conf; + if (tls_conf->ca_cert_probe) + { + /* reject server certificate on probe-only run */ + *flags |= MBEDTLS_X509_BADCERT_OTHER; + tls_mbedtls_verify_fail_event(crt, depth, "server chain probe", TLS_FAIL_SERVER_CHAIN_PROBE); + } + else if (init_conf->event_cb) + { + /* ??? send event as soon as depth == 0 is verified ??? + * What about rest of chain? + * Follows tls_mbedtls.c behavior: */ + init_conf->event_cb(init_conf->cb_ctx, TLS_CERT_CHAIN_SUCCESS, NULL); + } + } + + return 0; +} +#endif