You've already forked godot
mirror of
https://github.com/godotengine/godot.git
synced 2025-11-11 13:10:58 +00:00
mbedtls: Update to upstream version 2.28.3
Rediff patch from PR 1453, lstrlenW is no longer used upstream so
that part of the patch was dropped.
(cherry picked from commit 1fde2092d0)
This commit is contained in:
Rémi Verschelde
175
thirdparty/mbedtls/library/ssl_cookie.c
vendored
175
thirdparty/mbedtls/library/ssl_cookie.c
vendored
@@ -60,105 +60,108 @@
|
||||
* Cookies are formed of a 4-bytes timestamp (or serial number) and
|
||||
* an HMAC of timestamp and client ID.
|
||||
*/
|
||||
#define COOKIE_LEN ( 4 + COOKIE_HMAC_LEN )
|
||||
#define COOKIE_LEN (4 + COOKIE_HMAC_LEN)
|
||||
|
||||
void mbedtls_ssl_cookie_init( mbedtls_ssl_cookie_ctx *ctx )
|
||||
void mbedtls_ssl_cookie_init(mbedtls_ssl_cookie_ctx *ctx)
|
||||
{
|
||||
mbedtls_md_init( &ctx->hmac_ctx );
|
||||
mbedtls_md_init(&ctx->hmac_ctx);
|
||||
#if !defined(MBEDTLS_HAVE_TIME)
|
||||
ctx->serial = 0;
|
||||
#endif
|
||||
ctx->timeout = MBEDTLS_SSL_COOKIE_TIMEOUT;
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
mbedtls_mutex_init( &ctx->mutex );
|
||||
mbedtls_mutex_init(&ctx->mutex);
|
||||
#endif
|
||||
}
|
||||
|
||||
void mbedtls_ssl_cookie_set_timeout( mbedtls_ssl_cookie_ctx *ctx, unsigned long delay )
|
||||
void mbedtls_ssl_cookie_set_timeout(mbedtls_ssl_cookie_ctx *ctx, unsigned long delay)
|
||||
{
|
||||
ctx->timeout = delay;
|
||||
}
|
||||
|
||||
void mbedtls_ssl_cookie_free( mbedtls_ssl_cookie_ctx *ctx )
|
||||
void mbedtls_ssl_cookie_free(mbedtls_ssl_cookie_ctx *ctx)
|
||||
{
|
||||
mbedtls_md_free( &ctx->hmac_ctx );
|
||||
mbedtls_md_free(&ctx->hmac_ctx);
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
mbedtls_mutex_free( &ctx->mutex );
|
||||
mbedtls_mutex_free(&ctx->mutex);
|
||||
#endif
|
||||
|
||||
mbedtls_platform_zeroize( ctx, sizeof( mbedtls_ssl_cookie_ctx ) );
|
||||
mbedtls_platform_zeroize(ctx, sizeof(mbedtls_ssl_cookie_ctx));
|
||||
}
|
||||
|
||||
int mbedtls_ssl_cookie_setup( mbedtls_ssl_cookie_ctx *ctx,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng )
|
||||
int mbedtls_ssl_cookie_setup(mbedtls_ssl_cookie_ctx *ctx,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
unsigned char key[COOKIE_MD_OUTLEN];
|
||||
|
||||
if( ( ret = f_rng( p_rng, key, sizeof( key ) ) ) != 0 )
|
||||
return( ret );
|
||||
if ((ret = f_rng(p_rng, key, sizeof(key))) != 0) {
|
||||
return ret;
|
||||
}
|
||||
|
||||
ret = mbedtls_md_setup( &ctx->hmac_ctx, mbedtls_md_info_from_type( COOKIE_MD ), 1 );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
ret = mbedtls_md_setup(&ctx->hmac_ctx, mbedtls_md_info_from_type(COOKIE_MD), 1);
|
||||
if (ret != 0) {
|
||||
return ret;
|
||||
}
|
||||
|
||||
ret = mbedtls_md_hmac_starts( &ctx->hmac_ctx, key, sizeof( key ) );
|
||||
if( ret != 0 )
|
||||
return( ret );
|
||||
ret = mbedtls_md_hmac_starts(&ctx->hmac_ctx, key, sizeof(key));
|
||||
if (ret != 0) {
|
||||
return ret;
|
||||
}
|
||||
|
||||
mbedtls_platform_zeroize( key, sizeof( key ) );
|
||||
mbedtls_platform_zeroize(key, sizeof(key));
|
||||
|
||||
return( 0 );
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Generate the HMAC part of a cookie
|
||||
*/
|
||||
MBEDTLS_CHECK_RETURN_CRITICAL
|
||||
static int ssl_cookie_hmac( mbedtls_md_context_t *hmac_ctx,
|
||||
const unsigned char time[4],
|
||||
unsigned char **p, unsigned char *end,
|
||||
const unsigned char *cli_id, size_t cli_id_len )
|
||||
static int ssl_cookie_hmac(mbedtls_md_context_t *hmac_ctx,
|
||||
const unsigned char time[4],
|
||||
unsigned char **p, unsigned char *end,
|
||||
const unsigned char *cli_id, size_t cli_id_len)
|
||||
{
|
||||
unsigned char hmac_out[COOKIE_MD_OUTLEN];
|
||||
|
||||
MBEDTLS_SSL_CHK_BUF_PTR( *p, end, COOKIE_HMAC_LEN );
|
||||
MBEDTLS_SSL_CHK_BUF_PTR(*p, end, COOKIE_HMAC_LEN);
|
||||
|
||||
if( mbedtls_md_hmac_reset( hmac_ctx ) != 0 ||
|
||||
mbedtls_md_hmac_update( hmac_ctx, time, 4 ) != 0 ||
|
||||
mbedtls_md_hmac_update( hmac_ctx, cli_id, cli_id_len ) != 0 ||
|
||||
mbedtls_md_hmac_finish( hmac_ctx, hmac_out ) != 0 )
|
||||
{
|
||||
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
|
||||
if (mbedtls_md_hmac_reset(hmac_ctx) != 0 ||
|
||||
mbedtls_md_hmac_update(hmac_ctx, time, 4) != 0 ||
|
||||
mbedtls_md_hmac_update(hmac_ctx, cli_id, cli_id_len) != 0 ||
|
||||
mbedtls_md_hmac_finish(hmac_ctx, hmac_out) != 0) {
|
||||
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
|
||||
}
|
||||
|
||||
memcpy( *p, hmac_out, COOKIE_HMAC_LEN );
|
||||
memcpy(*p, hmac_out, COOKIE_HMAC_LEN);
|
||||
*p += COOKIE_HMAC_LEN;
|
||||
|
||||
return( 0 );
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Generate cookie for DTLS ClientHello verification
|
||||
*/
|
||||
int mbedtls_ssl_cookie_write( void *p_ctx,
|
||||
unsigned char **p, unsigned char *end,
|
||||
const unsigned char *cli_id, size_t cli_id_len )
|
||||
int mbedtls_ssl_cookie_write(void *p_ctx,
|
||||
unsigned char **p, unsigned char *end,
|
||||
const unsigned char *cli_id, size_t cli_id_len)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_ssl_cookie_ctx *ctx = (mbedtls_ssl_cookie_ctx *) p_ctx;
|
||||
unsigned long t;
|
||||
|
||||
if( ctx == NULL || cli_id == NULL )
|
||||
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
|
||||
if (ctx == NULL || cli_id == NULL) {
|
||||
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
|
||||
}
|
||||
|
||||
MBEDTLS_SSL_CHK_BUF_PTR( *p, end, COOKIE_LEN );
|
||||
MBEDTLS_SSL_CHK_BUF_PTR(*p, end, COOKIE_LEN);
|
||||
|
||||
#if defined(MBEDTLS_HAVE_TIME)
|
||||
t = (unsigned long) mbedtls_time( NULL );
|
||||
t = (unsigned long) mbedtls_time(NULL);
|
||||
#else
|
||||
t = ctx->serial++;
|
||||
#endif
|
||||
@@ -167,28 +170,30 @@ int mbedtls_ssl_cookie_write( void *p_ctx,
|
||||
*p += 4;
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
|
||||
return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret ) );
|
||||
if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) {
|
||||
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret);
|
||||
}
|
||||
#endif
|
||||
|
||||
ret = ssl_cookie_hmac( &ctx->hmac_ctx, *p - 4,
|
||||
p, end, cli_id, cli_id_len );
|
||||
ret = ssl_cookie_hmac(&ctx->hmac_ctx, *p - 4,
|
||||
p, end, cli_id, cli_id_len);
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
|
||||
return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR,
|
||||
MBEDTLS_ERR_THREADING_MUTEX_ERROR ) );
|
||||
if (mbedtls_mutex_unlock(&ctx->mutex) != 0) {
|
||||
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_SSL_INTERNAL_ERROR,
|
||||
MBEDTLS_ERR_THREADING_MUTEX_ERROR);
|
||||
}
|
||||
#endif
|
||||
|
||||
return( ret );
|
||||
return ret;
|
||||
}
|
||||
|
||||
/*
|
||||
* Check a cookie
|
||||
*/
|
||||
int mbedtls_ssl_cookie_check( void *p_ctx,
|
||||
const unsigned char *cookie, size_t cookie_len,
|
||||
const unsigned char *cli_id, size_t cli_id_len )
|
||||
int mbedtls_ssl_cookie_check(void *p_ctx,
|
||||
const unsigned char *cookie, size_t cookie_len,
|
||||
const unsigned char *cli_id, size_t cli_id_len)
|
||||
{
|
||||
unsigned char ref_hmac[COOKIE_HMAC_LEN];
|
||||
int ret = 0;
|
||||
@@ -196,58 +201,60 @@ int mbedtls_ssl_cookie_check( void *p_ctx,
|
||||
mbedtls_ssl_cookie_ctx *ctx = (mbedtls_ssl_cookie_ctx *) p_ctx;
|
||||
unsigned long cur_time, cookie_time;
|
||||
|
||||
if( ctx == NULL || cli_id == NULL )
|
||||
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
|
||||
if (ctx == NULL || cli_id == NULL) {
|
||||
return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
|
||||
}
|
||||
|
||||
if( cookie_len != COOKIE_LEN )
|
||||
return( -1 );
|
||||
if (cookie_len != COOKIE_LEN) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
|
||||
return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret ) );
|
||||
#endif
|
||||
|
||||
if( ssl_cookie_hmac( &ctx->hmac_ctx, cookie,
|
||||
&p, p + sizeof( ref_hmac ),
|
||||
cli_id, cli_id_len ) != 0 )
|
||||
ret = -1;
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
|
||||
{
|
||||
ret = MBEDTLS_ERROR_ADD( MBEDTLS_ERR_SSL_INTERNAL_ERROR,
|
||||
MBEDTLS_ERR_THREADING_MUTEX_ERROR );
|
||||
if ((ret = mbedtls_mutex_lock(&ctx->mutex)) != 0) {
|
||||
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_SSL_INTERNAL_ERROR, ret);
|
||||
}
|
||||
#endif
|
||||
|
||||
if( ret != 0 )
|
||||
goto exit;
|
||||
if (ssl_cookie_hmac(&ctx->hmac_ctx, cookie,
|
||||
&p, p + sizeof(ref_hmac),
|
||||
cli_id, cli_id_len) != 0) {
|
||||
ret = -1;
|
||||
}
|
||||
|
||||
if( mbedtls_ct_memcmp( cookie + 4, ref_hmac, sizeof( ref_hmac ) ) != 0 )
|
||||
{
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
if (mbedtls_mutex_unlock(&ctx->mutex) != 0) {
|
||||
ret = MBEDTLS_ERROR_ADD(MBEDTLS_ERR_SSL_INTERNAL_ERROR,
|
||||
MBEDTLS_ERR_THREADING_MUTEX_ERROR);
|
||||
}
|
||||
#endif
|
||||
|
||||
if (ret != 0) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (mbedtls_ct_memcmp(cookie + 4, ref_hmac, sizeof(ref_hmac)) != 0) {
|
||||
ret = -1;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_HAVE_TIME)
|
||||
cur_time = (unsigned long) mbedtls_time( NULL );
|
||||
cur_time = (unsigned long) mbedtls_time(NULL);
|
||||
#else
|
||||
cur_time = ctx->serial;
|
||||
#endif
|
||||
|
||||
cookie_time = ( (unsigned long) cookie[0] << 24 ) |
|
||||
( (unsigned long) cookie[1] << 16 ) |
|
||||
( (unsigned long) cookie[2] << 8 ) |
|
||||
( (unsigned long) cookie[3] );
|
||||
cookie_time = ((unsigned long) cookie[0] << 24) |
|
||||
((unsigned long) cookie[1] << 16) |
|
||||
((unsigned long) cookie[2] << 8) |
|
||||
((unsigned long) cookie[3]);
|
||||
|
||||
if( ctx->timeout != 0 && cur_time - cookie_time > ctx->timeout )
|
||||
{
|
||||
if (ctx->timeout != 0 && cur_time - cookie_time > ctx->timeout) {
|
||||
ret = -1;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_platform_zeroize( ref_hmac, sizeof( ref_hmac ) );
|
||||
return( ret );
|
||||
mbedtls_platform_zeroize(ref_hmac, sizeof(ref_hmac));
|
||||
return ret;
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_COOKIE_C */
|
||||
|
||||
Reference in New Issue
Block a user