1 /* 2 * DTLS cookie callbacks implementation 3 * 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 6 * 7 * This file is provided under the Apache License 2.0, or the 8 * GNU General Public License v2.0 or later. 9 * 10 * ********** 11 * Apache License 2.0: 12 * 13 * Licensed under the Apache License, Version 2.0 (the "License"); you may 14 * not use this file except in compliance with the License. 15 * You may obtain a copy of the License at 16 * 17 * http://www.apache.org/licenses/LICENSE-2.0 18 * 19 * Unless required by applicable law or agreed to in writing, software 20 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 21 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 22 * See the License for the specific language governing permissions and 23 * limitations under the License. 24 * 25 * ********** 26 * 27 * ********** 28 * GNU General Public License v2.0 or later: 29 * 30 * This program is free software; you can redistribute it and/or modify 31 * it under the terms of the GNU General Public License as published by 32 * the Free Software Foundation; either version 2 of the License, or 33 * (at your option) any later version. 34 * 35 * This program is distributed in the hope that it will be useful, 36 * but WITHOUT ANY WARRANTY; without even the implied warranty of 37 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 38 * GNU General Public License for more details. 39 * 40 * You should have received a copy of the GNU General Public License along 41 * with this program; if not, write to the Free Software Foundation, Inc., 42 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 43 * 44 * ********** 45 * 46 * This file is part of mbed TLS (https://tls.mbed.org) 47 */ 48 /* 49 * These session callbacks use a simple chained list 50 * to store and retrieve the session information. 51 */ 52 53 #if !defined(MBEDTLS_CONFIG_FILE) 54 #include "mbedtls/config.h" 55 #else 56 #include MBEDTLS_CONFIG_FILE 57 #endif 58 59 #if defined(MBEDTLS_SSL_COOKIE_C) 60 61 #if defined(MBEDTLS_PLATFORM_C) 62 #include "mbedtls/platform.h" 63 #else 64 #define mbedtls_calloc calloc 65 #define mbedtls_free free 66 #endif 67 68 #include "mbedtls/ssl_cookie.h" 69 #include "mbedtls/ssl_internal.h" 70 71 #include <string.h> 72 73 /* Implementation that should never be optimized out by the compiler */ 74 static void mbedtls_zeroize( void *v, size_t n ) { 75 volatile unsigned char *p = v; while( n-- ) *p++ = 0; 76 } 77 78 /* 79 * If DTLS is in use, then at least one of SHA-1, SHA-256, SHA-512 is 80 * available. Try SHA-256 first, 512 wastes resources since we need to stay 81 * with max 32 bytes of cookie for DTLS 1.0 82 */ 83 #if defined(MBEDTLS_SHA256_C) 84 #define COOKIE_MD MBEDTLS_MD_SHA224 85 #define COOKIE_MD_OUTLEN 32 86 #define COOKIE_HMAC_LEN 28 87 #elif defined(MBEDTLS_SHA512_C) 88 #define COOKIE_MD MBEDTLS_MD_SHA384 89 #define COOKIE_MD_OUTLEN 48 90 #define COOKIE_HMAC_LEN 28 91 #elif defined(MBEDTLS_SHA1_C) 92 #define COOKIE_MD MBEDTLS_MD_SHA1 93 #define COOKIE_MD_OUTLEN 20 94 #define COOKIE_HMAC_LEN 20 95 #else 96 #error "DTLS hello verify needs SHA-1 or SHA-2" 97 #endif 98 99 /* 100 * Cookies are formed of a 4-bytes timestamp (or serial number) and 101 * an HMAC of timestemp and client ID. 102 */ 103 #define COOKIE_LEN ( 4 + COOKIE_HMAC_LEN ) 104 105 void mbedtls_ssl_cookie_init( mbedtls_ssl_cookie_ctx *ctx ) 106 { 107 mbedtls_md_init( &ctx->hmac_ctx ); 108 #if !defined(MBEDTLS_HAVE_TIME) 109 ctx->serial = 0; 110 #endif 111 ctx->timeout = MBEDTLS_SSL_COOKIE_TIMEOUT; 112 113 #if defined(MBEDTLS_THREADING_C) 114 mbedtls_mutex_init( &ctx->mutex ); 115 #endif 116 } 117 118 void mbedtls_ssl_cookie_set_timeout( mbedtls_ssl_cookie_ctx *ctx, unsigned long delay ) 119 { 120 ctx->timeout = delay; 121 } 122 123 void mbedtls_ssl_cookie_free( mbedtls_ssl_cookie_ctx *ctx ) 124 { 125 mbedtls_md_free( &ctx->hmac_ctx ); 126 127 #if defined(MBEDTLS_THREADING_C) 128 mbedtls_mutex_free( &ctx->mutex ); 129 #endif 130 131 mbedtls_zeroize( ctx, sizeof( mbedtls_ssl_cookie_ctx ) ); 132 } 133 134 int mbedtls_ssl_cookie_setup( mbedtls_ssl_cookie_ctx *ctx, 135 int (*f_rng)(void *, unsigned char *, size_t), 136 void *p_rng ) 137 { 138 int ret; 139 unsigned char key[COOKIE_MD_OUTLEN]; 140 141 if( ( ret = f_rng( p_rng, key, sizeof( key ) ) ) != 0 ) 142 return( ret ); 143 144 ret = mbedtls_md_setup( &ctx->hmac_ctx, mbedtls_md_info_from_type( COOKIE_MD ), 1 ); 145 if( ret != 0 ) 146 return( ret ); 147 148 ret = mbedtls_md_hmac_starts( &ctx->hmac_ctx, key, sizeof( key ) ); 149 if( ret != 0 ) 150 return( ret ); 151 152 mbedtls_zeroize( key, sizeof( key ) ); 153 154 return( 0 ); 155 } 156 157 /* 158 * Generate the HMAC part of a cookie 159 */ 160 static int ssl_cookie_hmac( mbedtls_md_context_t *hmac_ctx, 161 const unsigned char time[4], 162 unsigned char **p, unsigned char *end, 163 const unsigned char *cli_id, size_t cli_id_len ) 164 { 165 unsigned char hmac_out[COOKIE_MD_OUTLEN]; 166 167 MBEDTLS_SSL_CHK_BUF_PTR( *p, end, COOKIE_HMAC_LEN ); 168 169 if( mbedtls_md_hmac_reset( hmac_ctx ) != 0 || 170 mbedtls_md_hmac_update( hmac_ctx, time, 4 ) != 0 || 171 mbedtls_md_hmac_update( hmac_ctx, cli_id, cli_id_len ) != 0 || 172 mbedtls_md_hmac_finish( hmac_ctx, hmac_out ) != 0 ) 173 { 174 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 175 } 176 177 memcpy( *p, hmac_out, COOKIE_HMAC_LEN ); 178 *p += COOKIE_HMAC_LEN; 179 180 return( 0 ); 181 } 182 183 /* 184 * Generate cookie for DTLS ClientHello verification 185 */ 186 int mbedtls_ssl_cookie_write( void *p_ctx, 187 unsigned char **p, unsigned char *end, 188 const unsigned char *cli_id, size_t cli_id_len ) 189 { 190 int ret; 191 mbedtls_ssl_cookie_ctx *ctx = (mbedtls_ssl_cookie_ctx *) p_ctx; 192 unsigned long t; 193 194 if( ctx == NULL || cli_id == NULL ) 195 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 196 197 MBEDTLS_SSL_CHK_BUF_PTR( *p, end, COOKIE_LEN ); 198 199 #if defined(MBEDTLS_HAVE_TIME) 200 t = (unsigned long) mbedtls_time( NULL ); 201 #else 202 t = ctx->serial++; 203 #endif 204 205 (*p)[0] = (unsigned char)( t >> 24 ); 206 (*p)[1] = (unsigned char)( t >> 16 ); 207 (*p)[2] = (unsigned char)( t >> 8 ); 208 (*p)[3] = (unsigned char)( t ); 209 *p += 4; 210 211 #if defined(MBEDTLS_THREADING_C) 212 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 ) 213 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR + ret ); 214 #endif 215 216 ret = ssl_cookie_hmac( &ctx->hmac_ctx, *p - 4, 217 p, end, cli_id, cli_id_len ); 218 219 #if defined(MBEDTLS_THREADING_C) 220 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 ) 221 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR + 222 MBEDTLS_ERR_THREADING_MUTEX_ERROR ); 223 #endif 224 225 return( ret ); 226 } 227 228 /* 229 * Check a cookie 230 */ 231 int mbedtls_ssl_cookie_check( void *p_ctx, 232 const unsigned char *cookie, size_t cookie_len, 233 const unsigned char *cli_id, size_t cli_id_len ) 234 { 235 unsigned char ref_hmac[COOKIE_HMAC_LEN]; 236 int ret = 0; 237 unsigned char *p = ref_hmac; 238 mbedtls_ssl_cookie_ctx *ctx = (mbedtls_ssl_cookie_ctx *) p_ctx; 239 unsigned long cur_time, cookie_time; 240 241 if( ctx == NULL || cli_id == NULL ) 242 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 243 244 if( cookie_len != COOKIE_LEN ) 245 return( -1 ); 246 247 #if defined(MBEDTLS_THREADING_C) 248 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 ) 249 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR + ret ); 250 #endif 251 252 if( ssl_cookie_hmac( &ctx->hmac_ctx, cookie, 253 &p, p + sizeof( ref_hmac ), 254 cli_id, cli_id_len ) != 0 ) 255 ret = -1; 256 257 #if defined(MBEDTLS_THREADING_C) 258 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 ) 259 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR + 260 MBEDTLS_ERR_THREADING_MUTEX_ERROR ); 261 #endif 262 263 if( ret != 0 ) 264 return( ret ); 265 266 if( mbedtls_ssl_safer_memcmp( cookie + 4, ref_hmac, sizeof( ref_hmac ) ) != 0 ) 267 return( -1 ); 268 269 #if defined(MBEDTLS_HAVE_TIME) 270 cur_time = (unsigned long) mbedtls_time( NULL ); 271 #else 272 cur_time = ctx->serial; 273 #endif 274 275 cookie_time = ( (unsigned long) cookie[0] << 24 ) | 276 ( (unsigned long) cookie[1] << 16 ) | 277 ( (unsigned long) cookie[2] << 8 ) | 278 ( (unsigned long) cookie[3] ); 279 280 if( ctx->timeout != 0 && cur_time - cookie_time > ctx->timeout ) 281 return( -1 ); 282 283 return( 0 ); 284 } 285 #endif /* MBEDTLS_SSL_COOKIE_C */ 286