mirror of
https://github.com/vlang/v.git
synced 2025-09-14 06:52:36 +03:00
thirdparty,net.mbedtls: update mbedtls to latest compatible version v3.3.0 (#21118)
This commit is contained in:
Turiiya
GitHub
parent
cb402a3340
commit
64a336932c
156 changed files with 16293 additions and 4396 deletions
149
thirdparty/mbedtls/library/ssl_client.c
vendored
149
thirdparty/mbedtls/library/ssl_client.c
vendored
|
|
@ -24,13 +24,7 @@
|
|||
#if defined(MBEDTLS_SSL_CLI_C)
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
|
||||
#if defined(MBEDTLS_PLATFORM_C)
|
||||
#include "mbedtls/platform.h"
|
||||
#else
|
||||
#include <stdlib.h>
|
||||
#define mbedtls_calloc calloc
|
||||
#define mbedtls_free free
|
||||
#endif
|
||||
|
||||
#include <string.h>
|
||||
|
||||
|
|
@ -112,6 +106,9 @@ static int ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
|
|||
|
||||
*olen = hostname_len + 9;
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
||||
mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_SERVERNAME );
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
|
||||
|
|
@ -183,6 +180,9 @@ static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
|
|||
/* Extension length = *out_len - 2 (ext_type) - 2 (ext_len) */
|
||||
MBEDTLS_PUT_UINT16_BE( *out_len - 4, buf, 2 );
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
||||
mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_ALPN );
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
|
||||
return( 0 );
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_ALPN */
|
||||
|
|
@ -302,7 +302,8 @@ static int ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
|
|||
*out_len = p - buf;
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
||||
ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
|
||||
mbedtls_ssl_tls13_set_hs_sent_ext_mask(
|
||||
ssl, MBEDTLS_TLS_EXT_SUPPORTED_GROUPS );
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
|
||||
|
||||
return( 0 );
|
||||
|
|
@ -376,9 +377,11 @@ static int ssl_write_client_hello_cipher_suites(
|
|||
/*
|
||||
* Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
|
||||
*/
|
||||
int renegotiating = 0;
|
||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||
if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
|
||||
renegotiating = ( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE );
|
||||
#endif
|
||||
if( !renegotiating )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
|
||||
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
||||
|
|
@ -432,7 +435,8 @@ MBEDTLS_CHECK_RETURN_CRITICAL
|
|||
static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
||||
unsigned char *buf,
|
||||
unsigned char *end,
|
||||
size_t *out_len )
|
||||
size_t *out_len,
|
||||
size_t *binders_len )
|
||||
{
|
||||
int ret;
|
||||
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
|
||||
|
|
@ -443,6 +447,7 @@ static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|||
int tls12_uses_ec = 0;
|
||||
|
||||
*out_len = 0;
|
||||
*binders_len = 0;
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
unsigned char propose_tls12 =
|
||||
|
|
@ -559,7 +564,7 @@ static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
||||
/* Keeping track of the included extensions */
|
||||
handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
|
||||
handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
|
||||
#endif
|
||||
|
||||
/* First write extensions, then the total length */
|
||||
|
|
@ -612,7 +617,7 @@ static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|||
}
|
||||
#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
|
||||
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
|
||||
if(
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
||||
( propose_tls13 && mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) ) ||
|
||||
|
|
@ -627,7 +632,7 @@ static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|||
return( ret );
|
||||
p += output_len;
|
||||
}
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
|
||||
#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
if( propose_tls12 )
|
||||
|
|
@ -641,6 +646,20 @@ static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|||
}
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
||||
|
||||
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
|
||||
/* The "pre_shared_key" extension (RFC 8446 Section 4.2.11)
|
||||
* MUST be the last extension in the ClientHello.
|
||||
*/
|
||||
if( propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
|
||||
{
|
||||
ret = mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
|
||||
ssl, p, end, &output_len, binders_len );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
p += output_len;
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
|
||||
|
||||
/* Write the length of the list of extensions. */
|
||||
extensions_len = p - p_extensions_len - 2;
|
||||
|
||||
|
|
@ -655,6 +674,11 @@ static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|||
p_extensions_len, extensions_len );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
||||
MBEDTLS_SSL_PRINT_EXTS(
|
||||
3, MBEDTLS_SSL_HS_CLIENT_HELLO, handshake->sent_extensions );
|
||||
#endif
|
||||
|
||||
*out_len = p - buf;
|
||||
return( 0 );
|
||||
}
|
||||
|
|
@ -702,6 +726,34 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
|||
{
|
||||
int ret;
|
||||
size_t session_id_len;
|
||||
mbedtls_ssl_session *session_negotiate = ssl->session_negotiate;
|
||||
|
||||
if( session_negotiate == NULL )
|
||||
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
|
||||
defined(MBEDTLS_SSL_SESSION_TICKETS) && \
|
||||
defined(MBEDTLS_HAVE_TIME)
|
||||
|
||||
/* Check if a tls13 ticket has been configured. */
|
||||
if( ssl->handshake->resume != 0 &&
|
||||
session_negotiate->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
|
||||
session_negotiate->ticket != NULL )
|
||||
{
|
||||
mbedtls_time_t now = mbedtls_time( NULL );
|
||||
uint64_t age = (uint64_t)( now - session_negotiate->ticket_received );
|
||||
if( session_negotiate->ticket_received > now ||
|
||||
age > session_negotiate->ticket_lifetime )
|
||||
{
|
||||
/* Without valid ticket, disable session resumption.*/
|
||||
MBEDTLS_SSL_DEBUG_MSG(
|
||||
3, ( "Ticket expired, disable session resumption" ) );
|
||||
ssl->handshake->resume = 0;
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
|
||||
MBEDTLS_SSL_SESSION_TICKETS &&
|
||||
MBEDTLS_HAVE_TIME */
|
||||
|
||||
if( ssl->conf->f_rng == NULL )
|
||||
{
|
||||
|
|
@ -720,7 +772,7 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
|||
{
|
||||
if( ssl->handshake->resume )
|
||||
{
|
||||
ssl->tls_version = ssl->session_negotiate->tls_version;
|
||||
ssl->tls_version = session_negotiate->tls_version;
|
||||
ssl->handshake->min_tls_version = ssl->tls_version;
|
||||
}
|
||||
else
|
||||
|
|
@ -754,7 +806,7 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
|||
* to zero, except in the case of a TLS 1.2 session renegotiation or
|
||||
* session resumption.
|
||||
*/
|
||||
session_id_len = ssl->session_negotiate->id_len;
|
||||
session_id_len = session_negotiate->id_len;
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
|
||||
|
|
@ -773,12 +825,15 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
|||
* RFC 5077 section 3.4: "When presenting a ticket, the client MAY
|
||||
* generate and include a Session ID in the TLS ClientHello."
|
||||
*/
|
||||
int renegotiating = 0;
|
||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||
if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
|
||||
if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
|
||||
renegotiating = 1;
|
||||
#endif
|
||||
if( !renegotiating )
|
||||
{
|
||||
if( ( ssl->session_negotiate->ticket != NULL ) &&
|
||||
( ssl->session_negotiate->ticket_len != 0 ) )
|
||||
if( ( session_negotiate->ticket != NULL ) &&
|
||||
( session_negotiate->ticket_len != 0 ) )
|
||||
{
|
||||
session_id_len = 32;
|
||||
}
|
||||
|
|
@ -810,13 +865,13 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
|||
}
|
||||
#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
|
||||
|
||||
if( session_id_len != ssl->session_negotiate->id_len )
|
||||
if( session_id_len != session_negotiate->id_len )
|
||||
{
|
||||
ssl->session_negotiate->id_len = session_id_len;
|
||||
session_negotiate->id_len = session_id_len;
|
||||
if( session_id_len > 0 )
|
||||
{
|
||||
ret = ssl->conf->f_rng( ssl->conf->p_rng,
|
||||
ssl->session_negotiate->id,
|
||||
session_negotiate->id,
|
||||
session_id_len );
|
||||
if( ret != 0 )
|
||||
{
|
||||
|
|
@ -826,9 +881,39 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
|||
}
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
|
||||
defined(MBEDTLS_SSL_SESSION_TICKETS) && \
|
||||
defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
|
||||
if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
|
||||
ssl->handshake->resume )
|
||||
{
|
||||
int hostname_mismatch = ssl->hostname != NULL ||
|
||||
session_negotiate->hostname != NULL;
|
||||
if( ssl->hostname != NULL && session_negotiate->hostname != NULL )
|
||||
{
|
||||
hostname_mismatch = strcmp(
|
||||
ssl->hostname, session_negotiate->hostname ) != 0;
|
||||
}
|
||||
|
||||
if( hostname_mismatch )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG(
|
||||
1, ( "Hostname mismatch the session ticket, "
|
||||
"disable session resumption." ) );
|
||||
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
return mbedtls_ssl_session_set_hostname( session_negotiate,
|
||||
ssl->hostname );
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
|
||||
MBEDTLS_SSL_SESSION_TICKETS &&
|
||||
MBEDTLS_SSL_SERVER_NAME_INDICATION */
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
/*
|
||||
* Write ClientHello handshake message.
|
||||
* Handler for MBEDTLS_SSL_CLIENT_HELLO
|
||||
|
|
@ -837,7 +922,7 @@ int mbedtls_ssl_write_client_hello( mbedtls_ssl_context *ssl )
|
|||
{
|
||||
int ret = 0;
|
||||
unsigned char *buf;
|
||||
size_t buf_len, msg_len;
|
||||
size_t buf_len, msg_len, binders_len;
|
||||
|
||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
|
||||
|
||||
|
|
@ -849,7 +934,8 @@ int mbedtls_ssl_write_client_hello( mbedtls_ssl_context *ssl )
|
|||
|
||||
MBEDTLS_SSL_PROC_CHK( ssl_write_client_hello_body( ssl, buf,
|
||||
buf + buf_len,
|
||||
&msg_len ) );
|
||||
&msg_len,
|
||||
&binders_len ) );
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
|
||||
if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
|
||||
|
|
@ -883,8 +969,21 @@ int mbedtls_ssl_write_client_hello( mbedtls_ssl_context *ssl )
|
|||
else
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
|
||||
{
|
||||
mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
|
||||
buf, msg_len );
|
||||
|
||||
mbedtls_ssl_add_hs_hdr_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
|
||||
msg_len );
|
||||
ssl->handshake->update_checksum( ssl, buf, msg_len - binders_len );
|
||||
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
|
||||
if( binders_len > 0 )
|
||||
{
|
||||
MBEDTLS_SSL_PROC_CHK(
|
||||
mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
|
||||
ssl, buf + msg_len - binders_len, buf + msg_len ) );
|
||||
ssl->handshake->update_checksum( ssl, buf + msg_len - binders_len,
|
||||
binders_len );
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
|
||||
|
||||
MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg( ssl,
|
||||
buf_len,
|
||||
msg_len ) );
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue