luna - wolfssl/src/dtls.c

   1/* dtls.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
  23
  24/*
  25 * WOLFSSL_DTLS_NO_HVR_ON_RESUME
  26 * WOLFSSL_DTLS13_NO_HRR_ON_RESUME
  27 *     If defined, a DTLS server will not do a cookie exchange on successful
  28 *     client resumption: the resumption will be faster (one RTT less) and
  29 *     will consume less bandwidth (one ClientHello and one
  30 *     HelloVerifyRequest/HelloRetryRequest less). On the other hand, if a valid
  31 *     SessionID/ticket/psk is collected, forged clientHello messages will
  32 *     consume resources on the server. For DTLS 1.3, using this option also
  33 *     allows for the server to process Early Data/0-RTT Data. Without this, the
  34 *     Early Data would be dropped since the server doesn't enter stateful
  35 *     processing until receiving a verified ClientHello with the cookie.
  36 *
  37 *     To allow DTLS 1.3 resumption without the cookie exchange:
  38 *     - Compile wolfSSL with WOLFSSL_DTLS13_NO_HRR_ON_RESUME defined
  39 *     - Call wolfSSL_dtls13_no_hrr_on_resume(ssl, 1) on the WOLFSSL object to
  40 *       disable the cookie exchange on resumption
  41 *     - Continue like with a normal connection
  42 * WOLFSSL_DTLS_CH_FRAG
  43 *     Allow a server to process a fragmented second/verified (one containing a
  44 *     valid cookie response) ClientHello message. The first/unverified (one
  45 *     without a cookie extension) ClientHello MUST be unfragmented so that the
  46 *     DTLS server can process it statelessly. This is only implemented for
  47 *     DTLS 1.3. The user MUST call wolfSSL_dtls13_allow_ch_frag() on the server
  48 *     to explicitly enable this during runtime.
  49 */
  50
  51#ifndef WOLFCRYPT_ONLY
  52
  53#include <wolfssl/error-ssl.h>
  54#include <wolfssl/internal.h>
  55#include <wolfssl/ssl.h>
  56#ifdef NO_INLINE
  57    #include <wolfssl/wolfcrypt/misc.h>
  58#else
  59    #define WOLFSSL_MISC_INCLUDED
  60    #include <wolfcrypt/src/misc.c>
  61#endif
  62
  63#define ERROR_OUT(err, eLabel) { ret = (err); goto eLabel; }
  64
  65#ifdef WOLFSSL_DTLS
  66
  67void DtlsResetState(WOLFSSL* ssl)
  68{
  69    /* Reset the state so that we can statelessly await the
  70     * ClientHello that contains the cookie. Don't gate on IsAtLeastTLSv1_3
  71     * to handle the edge case when the peer wants a lower version. */
  72
  73    /* Reset DTLS window */
  74#ifdef WOLFSSL_DTLS13
  75    w64Zero(&ssl->dtls13Epochs[0].nextSeqNumber);
  76    w64Zero(&ssl->dtls13Epochs[0].nextPeerSeqNumber);
  77    XMEMSET(ssl->dtls13Epochs[0].window, 0,
  78        sizeof(ssl->dtls13Epochs[0].window));
  79    Dtls13FreeFsmResources(ssl);
  80#endif
  81    ssl->keys.dtls_expected_peer_handshake_number = 0;
  82    ssl->keys.dtls_handshake_number = 0;
  83    ssl->keys.dtls_sequence_number_hi = 0;
  84    ssl->keys.dtls_sequence_number_lo = 0;
  85
  86    /* Reset states */
  87    ssl->options.serverState = NULL_STATE;
  88    ssl->options.clientState = NULL_STATE;
  89    ssl->options.connectState = CONNECT_BEGIN;
  90    ssl->options.acceptState = ACCEPT_BEGIN;
  91    ssl->options.handShakeState = NULL_STATE;
  92    ssl->options.seenUnifiedHdr = 0;
  93    ssl->msgsReceived.got_client_hello = 0;
  94    ssl->keys.dtls_handshake_number = 0;
  95    ssl->keys.dtls_expected_peer_handshake_number = 0;
  96    XMEMSET(ssl->keys.peerSeq, 0, sizeof(ssl->keys.peerSeq));
  97    ssl->options.tls = 0;
  98    ssl->options.tls1_1 = 0;
  99    ssl->options.tls1_3 = 0;
 100#if defined(WOLFSSL_DTLS) && defined(WOLFSSL_DTLS_CID)
 101    ssl->buffers.dtlsCtx.processingPendingRecord = 0;
 102    /* Clear the pending peer in case user set */
 103    XFREE(ssl->buffers.dtlsCtx.pendingPeer.sa, ssl->heap,
 104          DYNAMIC_TYPE_SOCKADDR);
 105    ssl->buffers.dtlsCtx.pendingPeer.sa = NULL;
 106    ssl->buffers.dtlsCtx.pendingPeer.sz = 0;
 107    ssl->buffers.dtlsCtx.pendingPeer.bufSz = 0;
 108#endif
 109}
 110
 111int DtlsIgnoreError(int err)
 112{
 113    /* Whitelist of errors not to ignore */
 114    switch (err) {
 115    case WC_NO_ERR_TRACE(MEMORY_E):
 116    case WC_NO_ERR_TRACE(MEMORY_ERROR):
 117    case WC_NO_ERR_TRACE(ASYNC_INIT_E):
 118    case WC_NO_ERR_TRACE(ASYNC_OP_E):
 119    case WC_NO_ERR_TRACE(SOCKET_ERROR_E):
 120    case WC_NO_ERR_TRACE(WANT_READ):
 121    case WC_NO_ERR_TRACE(WANT_WRITE):
 122    case WC_NO_ERR_TRACE(COOKIE_ERROR):
 123        return 0;
 124    default:
 125        return 1;
 126    }
 127}
 128
 129void DtlsSetSeqNumForReply(WOLFSSL* ssl)
 130{
 131    /* We cover both DTLS 1.2 and 1.3 cases because we may be negotiating
 132     * protocols. */
 133    /* We should continue with the same sequence number as the
 134     * Client Hello. */
 135    ssl->keys.dtls_sequence_number_hi = ssl->keys.curSeq_hi;
 136    ssl->keys.dtls_sequence_number_lo = ssl->keys.curSeq_lo;
 137#ifdef WOLFSSL_DTLS13
 138    if (ssl->dtls13EncryptEpoch != NULL) {
 139        ssl->dtls13EncryptEpoch->nextSeqNumber =
 140                w64From32(ssl->keys.curSeq_hi, ssl->keys.curSeq_lo);
 141    }
 142#endif
 143    /* We should continue with the same handshake number as the
 144     * Client Hello. */
 145    ssl->keys.dtls_handshake_number =
 146            ssl->keys.dtls_peer_handshake_number;
 147}
 148
 149#if !defined(NO_WOLFSSL_SERVER)
 150
 151#if defined(NO_SHA) && defined(NO_SHA256)
 152#error "DTLS needs either SHA or SHA-256"
 153#endif /* NO_SHA && NO_SHA256 */
 154
 155#if !defined(NO_SHA) && defined(NO_SHA256)
 156#define DTLS_COOKIE_TYPE WC_SHA
 157#define DTLS_COOKIE_SZ WC_SHA_DIGEST_SIZE
 158#endif /* !NO_SHA && NO_SHA256 */
 159
 160#ifndef NO_SHA256
 161#define DTLS_COOKIE_TYPE WC_SHA256
 162#define DTLS_COOKIE_SZ WC_SHA256_DIGEST_SIZE
 163#endif /* !NO_SHA256 */
 164
 165#if defined(WOLFSSL_DTLS13) && (defined(HAVE_SESSION_TICKET) || \
 166                                !defined(NO_PSK))
 167typedef struct PskInfo {
 168    byte cipherSuite0;
 169    byte cipherSuite;
 170    byte isValid:1;
 171} PskInfo;
 172#endif
 173
 174typedef struct WolfSSL_ConstVector {
 175    word32 size;
 176    const byte* elements;
 177} WolfSSL_ConstVector;
 178
 179typedef struct WolfSSL_CH {
 180    ProtocolVersion* pv;
 181    const byte* random;
 182    WolfSSL_ConstVector sessionId;
 183    WolfSSL_ConstVector cookie;
 184    WolfSSL_ConstVector cipherSuite;
 185    WolfSSL_ConstVector compression;
 186    WolfSSL_ConstVector extension;
 187    WolfSSL_ConstVector cookieExt;
 188    const byte* raw;
 189    word32 length;
 190    /* Store the DTLS 1.2 cookie since we can just compute it once in dtls.c */
 191    byte dtls12cookie[DTLS_COOKIE_SZ];
 192    byte dtls12cookieSet:1;
 193} WolfSSL_CH;
 194
 195static word32 ReadVector8(const byte* input, WolfSSL_ConstVector* v)
 196{
 197    v->size = *input;
 198    v->elements = input + OPAQUE8_LEN;
 199    return v->size + OPAQUE8_LEN;
 200}
 201
 202static word32 ReadVector16(const byte* input, WolfSSL_ConstVector* v)
 203{
 204    word16 size16;
 205    ato16(input, &size16);
 206    v->size = (word32)size16;
 207    v->elements = input + OPAQUE16_LEN;
 208    return v->size + OPAQUE16_LEN;
 209}
 210
 211static int CreateDtls12Cookie(const WOLFSSL* ssl, const WolfSSL_CH* ch,
 212                              byte* cookie)
 213{
 214    int ret;
 215    WC_DECLARE_VAR(cookieHmac, Hmac, 1, ssl->heap);
 216
 217    if (ssl->buffers.dtlsCookieSecret.buffer == NULL ||
 218            ssl->buffers.dtlsCookieSecret.length == 0) {
 219        WOLFSSL_MSG("Missing DTLS 1.2 cookie secret");
 220        return COOKIE_ERROR;
 221    }
 222
 223    WC_ALLOC_VAR_EX(cookieHmac, Hmac, 1, ssl->heap, DYNAMIC_TYPE_HMAC,
 224                    return MEMORY_E);
 225
 226    ret = wc_HmacInit(cookieHmac, ssl->heap, ssl->devId);
 227    if (ret == 0) {
 228        ret = wc_HmacSetKey(cookieHmac, DTLS_COOKIE_TYPE,
 229            ssl->buffers.dtlsCookieSecret.buffer,
 230            ssl->buffers.dtlsCookieSecret.length);
 231        if (ret == 0) {
 232            /* peerLock not necessary. Still in handshake phase. */
 233            ret = wc_HmacUpdate(cookieHmac,
 234                   (const byte*)ssl->buffers.dtlsCtx.peer.sa,
 235                                ssl->buffers.dtlsCtx.peer.sz);
 236        }
 237        if (ret == 0)
 238            ret = wc_HmacUpdate(cookieHmac, (byte*)ch->pv, OPAQUE16_LEN);
 239        if (ret == 0)
 240            ret = wc_HmacUpdate(cookieHmac, (byte*)ch->random, RAN_LEN);
 241        if (ret == 0) {
 242            ret = wc_HmacUpdate(cookieHmac, (byte*)ch->sessionId.elements,
 243                    ch->sessionId.size);
 244        }
 245        if (ret == 0) {
 246            ret = wc_HmacUpdate(cookieHmac, (byte*)ch->cipherSuite.elements,
 247                ch->cipherSuite.size);
 248        }
 249        if (ret == 0) {
 250            ret = wc_HmacUpdate(cookieHmac, (byte*)ch->compression.elements,
 251                ch->compression.size);
 252        }
 253        if (ret == 0)
 254            ret = wc_HmacFinal(cookieHmac, cookie);
 255        wc_HmacFree(cookieHmac);
 256    }
 257
 258    WC_FREE_VAR_EX(cookieHmac, ssl->heap, DYNAMIC_TYPE_HMAC);
 259    return ret;
 260}
 261
 262static int CheckDtlsCookie(const WOLFSSL* ssl, WolfSSL_CH* ch,
 263                           byte isTls13, byte* cookieGood)
 264{
 265    int ret = 0;
 266
 267    (void)isTls13;
 268
 269    *cookieGood = 0;
 270#ifdef WOLFSSL_DTLS13
 271    if (isTls13) {
 272        word16  len;
 273        if (ch->cookieExt.size < OPAQUE16_LEN + 1)
 274            return BUFFER_E;
 275        ato16(ch->cookieExt.elements, &len);
 276        if (ch->cookieExt.size - OPAQUE16_LEN != len)
 277            return BUFFER_E;
 278        ret = TlsCheckCookie(ssl, ch->cookieExt.elements + OPAQUE16_LEN,
 279                (word16)(ch->cookieExt.size - OPAQUE16_LEN));
 280        if (ret < 0 && ret != WC_NO_ERR_TRACE(HRR_COOKIE_ERROR))
 281            return ret;
 282        *cookieGood = ret > 0;
 283        ret = 0;
 284    }
 285    else
 286#endif
 287    {
 288        if (ch->cookie.size != DTLS_COOKIE_SZ)
 289            return 0;
 290        if (!ch->dtls12cookieSet) {
 291            ret = CreateDtls12Cookie(ssl, ch, ch->dtls12cookie);
 292            if (ret != 0)
 293                return ret;
 294            ch->dtls12cookieSet = 1;
 295        }
 296        *cookieGood = ConstantCompare(ch->cookie.elements, ch->dtls12cookie,
 297                                      DTLS_COOKIE_SZ) == 0;
 298    }
 299    return ret;
 300}
 301
 302static int ParseClientHello(const byte* input, word32 helloSz, WolfSSL_CH* ch,
 303        byte isFirstCHFrag)
 304{
 305    word32 idx = 0;
 306
 307    (void)isFirstCHFrag;
 308
 309    /* protocol version, random and session id length check */
 310    if (OPAQUE16_LEN + RAN_LEN + OPAQUE8_LEN > helloSz)
 311        return BUFFER_ERROR;
 312
 313    ch->raw = input;
 314    ch->pv = (ProtocolVersion*)(input + idx);
 315    idx += OPAQUE16_LEN;
 316    ch->random = (byte*)(input + idx);
 317    idx += RAN_LEN;
 318    idx += ReadVector8(input + idx, &ch->sessionId);
 319    if (idx > helloSz - OPAQUE8_LEN)
 320        return BUFFER_ERROR;
 321    idx += ReadVector8(input + idx, &ch->cookie);
 322    if (idx > helloSz - OPAQUE16_LEN)
 323        return BUFFER_ERROR;
 324    idx += ReadVector16(input + idx, &ch->cipherSuite);
 325    if (idx > helloSz - OPAQUE8_LEN)
 326        return BUFFER_ERROR;
 327    idx += ReadVector8(input + idx, &ch->compression);
 328    if (idx < helloSz - OPAQUE16_LEN) {
 329        /* Extensions are optional */
 330#ifdef WOLFSSL_DTLS_CH_FRAG
 331        word32 extStart = idx + OPAQUE16_LEN;
 332#endif
 333        idx += ReadVector16(input + idx, &ch->extension);
 334        if (idx > helloSz) {
 335#ifdef WOLFSSL_DTLS_CH_FRAG
 336            idx = helloSz;
 337            /* Allow incomplete extensions if we are parsing a fragment */
 338            if (isFirstCHFrag && extStart < helloSz)
 339                ch->extension.size = helloSz - extStart;
 340            else
 341#endif
 342                return BUFFER_ERROR;
 343        }
 344    }
 345    if (idx != helloSz)
 346        return BUFFER_ERROR;
 347    ch->length = idx;
 348    return 0;
 349}
 350
 351#if (defined(WOLFSSL_DTLS_NO_HVR_ON_RESUME) && defined(HAVE_SESSION_TICKET)) \
 352    || defined(WOLFSSL_DTLS13)
 353static int FindExtByType(WolfSSL_ConstVector* ret, word16 extType,
 354    WolfSSL_ConstVector exts, int* tlsxFound)
 355{
 356    word32 len, idx = 0;
 357    word16 type;
 358    WolfSSL_ConstVector ext;
 359
 360    XMEMSET(ret, 0, sizeof(*ret));
 361    len = exts.size;
 362    *tlsxFound = FALSE;
 363    /* type + len */
 364    while (len >= OPAQUE16_LEN + OPAQUE16_LEN) {
 365        ato16(exts.elements + idx, &type);
 366        idx += OPAQUE16_LEN;
 367        idx += ReadVector16(exts.elements + idx, &ext);
 368        if (idx > exts.size ||
 369                ext.elements + ext.size > exts.elements + exts.size)
 370            return BUFFER_ERROR;
 371        if (type == extType) {
 372            XMEMCPY(ret, &ext, sizeof(ext));
 373            *tlsxFound = TRUE;
 374            return 0;
 375        }
 376        len = exts.size - idx;
 377    }
 378    return 0;
 379}
 380#endif
 381
 382#if defined(WOLFSSL_DTLS_NO_HVR_ON_RESUME)
 383#ifdef HAVE_SESSION_TICKET
 384static int TlsTicketIsValid(const WOLFSSL* ssl, WolfSSL_ConstVector exts,
 385                            int* resume)
 386{
 387    WolfSSL_ConstVector tlsxSessionTicket;
 388    byte tempTicket[SESSION_TICKET_LEN];
 389    InternalTicket* it = NULL;
 390    int ret = 0;
 391    int tlsxFound;
 392
 393    *resume = FALSE;
 394
 395    ret = FindExtByType(&tlsxSessionTicket, TLSX_SESSION_TICKET, exts,
 396                         &tlsxFound);
 397    if (ret != 0)
 398        return ret;
 399    if (tlsxSessionTicket.size == 0)
 400        return 0;
 401    if (tlsxSessionTicket.size > SESSION_TICKET_LEN)
 402        return 0;
 403    XMEMCPY(tempTicket, tlsxSessionTicket.elements, tlsxSessionTicket.size);
 404    ret = DoDecryptTicket(ssl, tempTicket, (word32)tlsxSessionTicket.size, &it);
 405    if (ret == WOLFSSL_TICKET_RET_OK || ret == WOLFSSL_TICKET_RET_CREATE) {
 406        /* This logic is only for TLS <= 1.2 tickets. Don't accept TLS 1.3. */
 407        if (!IsAtLeastTLSv1_3(it->pv))
 408            *resume = TRUE;
 409    }
 410    /* `it` points into tempTicket on successful decryption so clearing it will
 411     * also satisfy the WOLFSSL_CHECK_MEM_ZERO check. */
 412    ForceZero(tempTicket, SESSION_TICKET_LEN);
 413    return 0;
 414}
 415#endif /* HAVE_SESSION_TICKET */
 416
 417static int TlsSessionIdIsValid(const WOLFSSL* ssl, WolfSSL_ConstVector sessionID,
 418                               int* resume)
 419{
 420    const WOLFSSL_SESSION* sess;
 421    word32 sessRow;
 422    int ret;
 423#ifdef HAVE_EXT_CACHE
 424    int copy;
 425#endif
 426    *resume = FALSE;
 427
 428    if (ssl->options.sessionCacheOff)
 429        return 0;
 430    if (sessionID.size != ID_LEN)
 431        return 0;
 432
 433#ifdef HAVE_EXT_CACHE
 434    if (ssl->ctx->get_sess_cb != NULL) {
 435        WOLFSSL_SESSION* extSess =
 436            ssl->ctx->get_sess_cb((WOLFSSL*)ssl, sessionID.elements, ID_LEN,
 437                                  &copy);
 438        if (extSess != NULL) {
 439#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
 440                           defined(HAVE_SESSION_TICKET))
 441            /* This logic is only for TLS <= 1.2 tickets. Don't accept
 442             * TLS 1.3. */
 443            if (!IsAtLeastTLSv1_3(extSess->version))
 444#endif
 445                *resume = TRUE;
 446            if (!copy)
 447                wolfSSL_FreeSession(ssl->ctx, extSess);
 448            if (*resume)
 449                return 0;
 450        }
 451    }
 452    if (ssl->ctx->internalCacheLookupOff)
 453        return 0;
 454#endif
 455
 456
 457    ret = TlsSessionCacheGetAndRdLock(sessionID.elements, &sess, &sessRow,
 458            ssl->options.side);
 459    if (ret == 0 && sess != NULL) {
 460#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
 461                               defined(HAVE_SESSION_TICKET))
 462        /* This logic is only for TLS <= 1.2 tickets. Don't accept
 463         * TLS 1.3. */
 464        if (!IsAtLeastTLSv1_3(sess->version))
 465#endif
 466            *resume = TRUE;
 467        TlsSessionCacheUnlockRow(sessRow);
 468    }
 469
 470    return 0;
 471}
 472
 473static int TlsResumptionIsValid(const WOLFSSL* ssl, WolfSSL_CH* ch,
 474                                int* resume)
 475{
 476    int ret;
 477
 478#ifdef HAVE_SESSION_TICKET
 479    ret = TlsTicketIsValid(ssl, ch->extension, resume);
 480    if (ret != 0)
 481        return ret;
 482    if (*resume)
 483        return 0;
 484#endif /* HAVE_SESSION_TICKET */
 485    ret = TlsSessionIdIsValid(ssl, ch->sessionId, resume);
 486    return ret;
 487}
 488#endif /* WOLFSSL_DTLS13 || WOLFSSL_DTLS_NO_HVR_ON_RESUME */
 489
 490#ifdef WOLFSSL_DTLS13
 491static int TlsCheckSupportedVersion(const WOLFSSL* ssl,
 492        WolfSSL_CH* ch, byte *isTls13)
 493{
 494    WolfSSL_ConstVector tlsxSupportedVersions;
 495    int ret;
 496    ProtocolVersion pv = ssl->version;
 497    int tlsxFound;
 498
 499    ret = FindExtByType(&tlsxSupportedVersions, TLSX_SUPPORTED_VERSIONS,
 500                         ch->extension, &tlsxFound);
 501    if (ret != 0)
 502        return ret;
 503    if (!tlsxFound || tlsxSupportedVersions.elements == NULL) {
 504        *isTls13 = 0;
 505        return 0;
 506    }
 507    ret = TLSX_SupportedVersions_Parse(ssl, tlsxSupportedVersions.elements,
 508            (word16)tlsxSupportedVersions.size, client_hello, &pv, NULL, NULL);
 509    if (ret != 0)
 510        return ret;
 511    if (IsAtLeastTLSv1_3(pv))
 512        *isTls13 = 1;
 513    else
 514        *isTls13 = 0;
 515
 516    return 0;
 517}
 518#endif
 519
 520#if defined(WOLFSSL_DTLS13) && \
 521        (!defined(NO_PSK) || defined(HAVE_SESSION_TICKET))
 522/* Very simplified version of CheckPreSharedKeys to find the current suite */
 523static void FindPskSuiteFromExt(const WOLFSSL* ssl, TLSX* extensions,
 524                                PskInfo* pskInfo, Suites* suites)
 525{
 526    TLSX* pskExt = TLSX_Find(extensions, TLSX_PRE_SHARED_KEY);
 527    PreSharedKey* current;
 528    int i;
 529    int ret;
 530
 531    if (pskExt == NULL)
 532        return;
 533
 534    for (i = 0; i < suites->suiteSz; i += 2) {
 535        for (current = (PreSharedKey*)pskExt->data; current != NULL;
 536                current = current->next) {
 537#ifdef HAVE_SESSION_TICKET
 538            {
 539                /* Decode the identity. */
 540                switch (current->decryptRet) {
 541                    case PSK_DECRYPT_NONE:
 542                        ret = DoClientTicket_ex(ssl, current, 0);
 543                        break;
 544                    case PSK_DECRYPT_OK:
 545                        ret = WOLFSSL_TICKET_RET_OK;
 546                        break;
 547                    case PSK_DECRYPT_CREATE:
 548                        ret = WOLFSSL_TICKET_RET_CREATE;
 549                        break;
 550                    case PSK_DECRYPT_FAIL:
 551                    default:
 552                        ret = WOLFSSL_TICKET_RET_REJECT;
 553                        break;
 554                }
 555                if (ret == WOLFSSL_TICKET_RET_OK) {
 556                    if (DoClientTicketCheck(ssl, current, ssl->timeout,
 557                            suites->suites + i) != 0) {
 558                        continue;
 559                    }
 560
 561                    pskInfo->cipherSuite0 = current->it->suite[0];
 562                    pskInfo->cipherSuite  = current->it->suite[1];
 563                    pskInfo->isValid      = 1;
 564                    goto cleanup;
 565                }
 566            }
 567#endif
 568#ifndef NO_PSK
 569            {
 570                int found = 0;
 571                byte psk_key[MAX_PSK_KEY_LEN];
 572                word32 psk_keySz;
 573                byte foundSuite[SUITE_LEN];
 574                ret = FindPskSuite(ssl, current, psk_key, &psk_keySz,
 575                        suites->suites + i, &found, foundSuite);
 576                /* Clear the key just in case */
 577                ForceZero(psk_key, sizeof(psk_key));
 578                if (ret == 0 && found) {
 579                    pskInfo->cipherSuite0 = foundSuite[0];
 580                    pskInfo->cipherSuite  = foundSuite[1];
 581                    pskInfo->isValid      = 1;
 582                    goto cleanup;
 583                }
 584            }
 585#endif
 586        }
 587    }
 588
 589    /* Empty return necessary so we can have both the label and macro guard */
 590cleanup:
 591#ifdef HAVE_SESSION_TICKET
 592    CleanupClientTickets((PreSharedKey*)pskExt->data);
 593#endif
 594    return;
 595}
 596#endif
 597
 598#ifdef WOLFSSL_DTLS13
 599
 600#ifndef WOLFSSL_SEND_HRR_COOKIE
 601#error "WOLFSSL_SEND_HRR_COOKIE has to be defined to use DTLS 1.3 server"
 602#endif
 603
 604#ifdef WOLFSSL_PSK_ONE_ID
 605#error WOLFSSL_PSK_ONE_ID is not compatible with stateless DTLS 1.3 server. \
 606        wolfSSL needs to be able to make multiple calls for the same PSK.
 607#endif
 608
 609static int SendStatelessReplyDtls13(const WOLFSSL* ssl, WolfSSL_CH* ch)
 610{
 611    int ret = -1;
 612    TLSX* parsedExts = NULL;
 613    WolfSSL_ConstVector tlsx;
 614    int tlsxFound;
 615    Suites suites;
 616    byte haveSA = 0;
 617    byte haveKS = 0;
 618    byte haveSG = 0;
 619#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
 620    byte usePSK = 0;
 621    byte doKE = 0;
 622#endif
 623    CipherSuite cs;
 624    CipherSpecs specs;
 625    byte cookieHash[WC_MAX_DIGEST_SIZE];
 626    int cookieHashSz;
 627#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
 628    PskInfo pskInfo;
 629    XMEMSET(&pskInfo, 0, sizeof(pskInfo));
 630#endif
 631
 632#ifndef HAVE_SUPPORTED_CURVES
 633    (void)doKE;
 634#endif /* !HAVE_SUPPORTED_CURVES */
 635
 636    XMEMSET(&cs, 0, sizeof(cs));
 637
 638    /* We need to echo the session ID sent by the client */
 639    if (ch->sessionId.size > ID_LEN) {
 640        /* Too large. We can't echo this. */
 641        ERROR_OUT(INVALID_PARAMETER, dtls13_cleanup);
 642    }
 643
 644    /* Populate the suites struct to find a common ciphersuite */
 645    XMEMSET(&suites, 0, sizeof(suites));
 646    suites.suiteSz = (word16)ch->cipherSuite.size;
 647    if ((suites.suiteSz % 2) != 0)
 648        ERROR_OUT(INVALID_PARAMETER, dtls13_cleanup);
 649    if (suites.suiteSz > WOLFSSL_MAX_SUITE_SZ)
 650        ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
 651    XMEMCPY(suites.suites, ch->cipherSuite.elements, suites.suiteSz);
 652
 653    /* Populate extensions */
 654
 655    /* Supported versions always need to be present. Has to appear after
 656     * key share as that is the order we reconstruct it in
 657     * RestartHandshakeHashWithCookie. */
 658    ret = TLSX_Push(&parsedExts,
 659              TLSX_SUPPORTED_VERSIONS, ssl, ssl->heap);
 660    if (ret != 0)
 661        goto dtls13_cleanup;
 662    /* Set that this is a response extension */
 663    parsedExts->resp = 1;
 664
 665#if defined(HAVE_SUPPORTED_CURVES)
 666    ret = TLSX_SupportedCurve_Copy(ssl->extensions, &parsedExts, ssl->heap);
 667    if (ret != 0)
 668        goto dtls13_cleanup;
 669#endif
 670
 671#if !defined(NO_CERTS)
 672    /* Signature algs */
 673    ret = FindExtByType(&tlsx, TLSX_SIGNATURE_ALGORITHMS,
 674                         ch->extension, &tlsxFound);
 675    if (ret != 0)
 676        goto dtls13_cleanup;
 677    if (tlsxFound) {
 678        WolfSSL_ConstVector sigAlgs;
 679        if (tlsx.size < OPAQUE16_LEN)
 680            ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
 681        ReadVector16(tlsx.elements, &sigAlgs);
 682        if (sigAlgs.size != tlsx.size - OPAQUE16_LEN)
 683            ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
 684        if ((sigAlgs.size % 2) != 0)
 685            ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
 686        if (sigAlgs.size > WOLFSSL_MAX_SIGALGO)
 687            ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
 688        suites.hashSigAlgoSz = (word16)sigAlgs.size;
 689        XMEMCPY(suites.hashSigAlgo, sigAlgs.elements, sigAlgs.size);
 690        haveSA = 1;
 691    }
 692#endif /* !defined(NO_CERTS) */
 693
 694#ifdef HAVE_SUPPORTED_CURVES
 695    /* Supported groups */
 696    ret = FindExtByType(&tlsx, TLSX_SUPPORTED_GROUPS,
 697                         ch->extension, &tlsxFound);
 698    if (ret != 0)
 699        goto dtls13_cleanup;
 700    if (tlsxFound) {
 701        ret = TLSX_SupportedCurve_Parse(ssl, tlsx.elements,
 702                                     (word16)tlsx.size, 1, &parsedExts);
 703        if (ret != 0)
 704            goto dtls13_cleanup;
 705        haveSG = 1;
 706    }
 707
 708    /* Key share */
 709    ret = FindExtByType(&tlsx, TLSX_KEY_SHARE,
 710                         ch->extension, &tlsxFound);
 711    if (ret != 0)
 712        goto dtls13_cleanup;
 713    if (tlsxFound) {
 714        ret = TLSX_KeyShare_Parse_ClientHello(ssl, tlsx.elements,
 715                                        (word16)tlsx.size, &parsedExts);
 716        if (ret != 0)
 717            goto dtls13_cleanup;
 718        haveKS = 1;
 719    }
 720#endif /* HAVE_SUPPORTED_CURVES */
 721
 722#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
 723    /* Pre-shared key */
 724    ret = FindExtByType(&tlsx, TLSX_PRE_SHARED_KEY, ch->extension, &tlsxFound);
 725    if (ret != 0)
 726        goto dtls13_cleanup;
 727    if (tlsxFound) {
 728        /* Let's just assume that the binders are correct here. We will
 729         * actually verify this in the stateful part of the processing
 730         * and if they don't match we will error out there anyway. */
 731        byte modes;
 732
 733        /* TLSX_PreSharedKey_Parse_ClientHello uses word16 length */
 734        if (tlsx.size > WOLFSSL_MAX_16BIT) {
 735            ERROR_OUT(BUFFER_ERROR, dtls13_cleanup);
 736        }
 737
 738        /* Ask the user for the ciphersuite matching this identity */
 739        if (TLSX_PreSharedKey_Parse_ClientHello(&parsedExts,
 740                tlsx.elements, (word16)tlsx.size, ssl->heap) == 0) {
 741            /* suites only needs to be refined when searching for a PSK.
 742             * MatchSuite_ex handles refining internally. */
 743            refineSuites(WOLFSSL_SUITES(ssl), &suites, &suites,
 744                    ssl->options.useClientOrder);
 745            FindPskSuiteFromExt(ssl, parsedExts, &pskInfo, &suites);
 746        }
 747        /* Revert to full handshake if PSK parsing failed */
 748
 749        if (pskInfo.isValid) {
 750            ret = FindExtByType(&tlsx, TLSX_PSK_KEY_EXCHANGE_MODES,
 751                                 ch->extension, &tlsxFound);
 752            if (ret != 0)
 753                goto dtls13_cleanup;
 754            if (!tlsxFound)
 755                ERROR_OUT(PSK_KEY_ERROR, dtls13_cleanup);
 756            ret = TLSX_PskKeyModes_Parse_Modes(tlsx.elements, (word16)tlsx.size,
 757                                               client_hello, &modes);
 758            if (ret != 0)
 759                goto dtls13_cleanup;
 760            if ((modes & (1 << PSK_DHE_KE)) &&
 761                    !ssl->options.noPskDheKe) {
 762                if (!haveKS)
 763                    ERROR_OUT(PSK_KEY_ERROR, dtls13_cleanup);
 764                doKE = 1;
 765            }
 766            else if ((modes & (1 << PSK_KE)) == 0 ||
 767                    ssl->options.onlyPskDheKe) {
 768                ERROR_OUT(PSK_KEY_ERROR, dtls13_cleanup);
 769            }
 770            usePSK = 1;
 771        }
 772    }
 773#endif
 774
 775#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
 776    if (usePSK && pskInfo.isValid) {
 777        cs.cipherSuite0 = pskInfo.cipherSuite0;
 778        cs.cipherSuite = pskInfo.cipherSuite;
 779
 780        /* https://datatracker.ietf.org/doc/html/rfc8446#section-9.2 */
 781        if (haveSG ^ haveKS) {
 782            WOLFSSL_MSG("Client needs to send both or none of KeyShare and "
 783                        "SupportedGroups");
 784            ERROR_OUT(INCOMPLETE_DATA, dtls13_cleanup);
 785        }
 786
 787#ifdef HAVE_SUPPORTED_CURVES
 788        if (doKE) {
 789            byte searched = 0;
 790            ret = TLSX_KeyShare_Choose(ssl, parsedExts, cs.cipherSuite0,
 791                    cs.cipherSuite, &cs.clientKSE, &searched);
 792            if (ret != 0)
 793                goto dtls13_cleanup;
 794            if (cs.clientKSE == NULL && searched)
 795                cs.doHelloRetry = 1;
 796        }
 797#endif /* HAVE_SUPPORTED_CURVES */
 798    }
 799    else
 800#endif /* defined(HAVE_SESSION_TICKET) || !defined(NO_PSK) */
 801    {
 802        /* https://datatracker.ietf.org/doc/html/rfc8446#section-9.2 */
 803        if (!haveKS || !haveSA || !haveSG) {
 804            WOLFSSL_MSG("Client didn't send KeyShare or SigAlgs or "
 805                        "SupportedGroups.");
 806            ERROR_OUT(INCOMPLETE_DATA, dtls13_cleanup);
 807        }
 808        /* TLSX_KeyShare_Choose is done deep inside MatchSuite_ex */
 809        ret = MatchSuite_ex(ssl, &suites, &cs, parsedExts);
 810        if (ret < 0) {
 811            WOLFSSL_MSG("Unsupported cipher suite, ClientHello DTLS 1.3");
 812            ERROR_OUT(INCOMPLETE_DATA, dtls13_cleanup);
 813        }
 814    }
 815
 816#ifdef WOLFSSL_DTLS13_NO_HRR_ON_RESUME
 817    if (ssl->options.dtls13NoHrrOnResume && usePSK && pskInfo.isValid &&
 818            !cs.doHelloRetry) {
 819        /* Skip HRR on resumption */
 820        ((WOLFSSL*)ssl)->options.dtlsStateful = 1;
 821        goto dtls13_cleanup;
 822    }
 823#endif
 824
 825#ifdef HAVE_SUPPORTED_CURVES
 826    if (cs.doHelloRetry) {
 827        ret = TLSX_KeyShare_SetSupported(ssl, &parsedExts);
 828        if (ret != 0)
 829            goto dtls13_cleanup;
 830    }
 831    else {
 832        /* Need to remove the keyshare ext if we found a common group
 833         * and are not doing curve negotiation. */
 834        TLSX_Remove(&parsedExts, TLSX_KEY_SHARE, ssl->heap);
 835    }
 836#endif /* HAVE_SUPPORTED_CURVES */
 837
 838    /* This is required to correctly generate the hash */
 839    ret = GetCipherSpec(WOLFSSL_SERVER_END, cs.cipherSuite0,
 840                         cs.cipherSuite, &specs, NULL);
 841    if (ret != 0)
 842        goto dtls13_cleanup;
 843
 844    /* Calculate the cookie hash */
 845    ret = Dtls13HashClientHello(ssl, cookieHash, &cookieHashSz, ch->raw,
 846                                ch->length, &specs);
 847    if (ret != 0)
 848        goto dtls13_cleanup;
 849
 850    /* Push the cookie to extensions */
 851    ret = CreateCookieExt(ssl, cookieHash, (word16)cookieHashSz,
 852                          &parsedExts, cs.cipherSuite0, cs.cipherSuite);
 853    if (ret != 0)
 854        goto dtls13_cleanup;
 855
 856    {
 857        WOLFSSL* nonConstSSL = (WOLFSSL*)ssl;
 858        TLSX* sslExts = nonConstSSL->extensions;
 859
 860        nonConstSSL->options.tls = 1;
 861        nonConstSSL->options.tls1_1 = 1;
 862        nonConstSSL->options.tls1_3 = 1;
 863
 864        /* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
 865         * legacy_session_id_echo. Don't copy the client's session ID. */
 866        nonConstSSL->session->sessionIDSz = 0;
 867        nonConstSSL->options.cipherSuite0 = cs.cipherSuite0;
 868        nonConstSSL->options.cipherSuite = cs.cipherSuite;
 869        nonConstSSL->extensions = parsedExts;
 870
 871        ret = SendTls13ServerHello(nonConstSSL, hello_retry_request);
 872
 873        /* Can be modified inside SendTls13ServerHello */
 874        parsedExts = nonConstSSL->extensions;
 875
 876        nonConstSSL->session->sessionIDSz = 0;
 877        nonConstSSL->options.cipherSuite0 = 0;
 878        nonConstSSL->options.cipherSuite = 0;
 879        nonConstSSL->extensions = sslExts;
 880
 881        nonConstSSL->options.tls = 0;
 882        nonConstSSL->options.tls1_1 = 0;
 883        nonConstSSL->options.tls1_3 = 0;
 884    }
 885dtls13_cleanup:
 886    TLSX_FreeAll(parsedExts, ssl->heap);
 887    return ret;
 888}
 889#endif
 890
 891static int SendStatelessReply(const WOLFSSL* ssl, WolfSSL_CH* ch, byte isTls13)
 892{
 893    int ret;
 894    (void)isTls13;
 895#ifdef WOLFSSL_DTLS13
 896    if (isTls13) {
 897        ret = SendStatelessReplyDtls13(ssl, ch);
 898    }
 899    else
 900#endif
 901    {
 902#if !defined(WOLFSSL_NO_TLS12)
 903        if (!ch->dtls12cookieSet) {
 904            ret = CreateDtls12Cookie(ssl, ch, ch->dtls12cookie);
 905            if (ret != 0)
 906                return ret;
 907            ch->dtls12cookieSet = 1;
 908        }
 909        ret = SendHelloVerifyRequest((WOLFSSL*)ssl, ch->dtls12cookie,
 910                DTLS_COOKIE_SZ);
 911#else
 912        WOLFSSL_MSG("DTLS1.2 disabled with WOLFSSL_NO_TLS12");
 913        WOLFSSL_ERROR_VERBOSE(NOT_COMPILED_IN);
 914        ret = NOT_COMPILED_IN;
 915#endif
 916    }
 917    return ret;
 918}
 919
 920static int ClientHelloSanityCheck(WolfSSL_CH* ch, byte isTls13)
 921{
 922    /* Do basic checks on the basic fields */
 923
 924    /* Check the protocol version */
 925    if (ch->pv->major != DTLS_MAJOR)
 926        return VERSION_ERROR;
 927    if (ch->pv->minor != DTLSv1_2_MINOR && ch->pv->minor != DTLS_MINOR)
 928        return VERSION_ERROR;
 929    if (isTls13) {
 930        if (ch->cookie.size != 0)
 931            return INVALID_PARAMETER;
 932        if (ch->compression.size != COMP_LEN)
 933            return INVALID_PARAMETER;
 934        if (ch->compression.elements[0] != NO_COMPRESSION)
 935            return INVALID_PARAMETER;
 936    }
 937
 938    return 0;
 939}
 940
 941int DoClientHelloStateless(WOLFSSL* ssl, const byte* input, word32 helloSz,
 942        byte isFirstCHFrag, byte* tls13)
 943{
 944    int ret;
 945    WolfSSL_CH ch;
 946    byte isTls13 = 0;
 947
 948    WOLFSSL_ENTER("DoClientHelloStateless");
 949    if (isFirstCHFrag) {
 950#ifdef WOLFSSL_DTLS_CH_FRAG
 951        WOLFSSL_MSG("\tProcessing fragmented ClientHello");
 952#else
 953        WOLFSSL_MSG("\tProcessing fragmented ClientHello but "
 954                "WOLFSSL_DTLS_CH_FRAG is not defined. This should not happen.");
 955        return BAD_STATE_E;
 956#endif
 957    }
 958    if (tls13 != NULL)
 959        *tls13 = 0;
 960
 961    XMEMSET(&ch, 0, sizeof(ch));
 962
 963    ssl->options.dtlsStateful = 0;
 964    ret = ParseClientHello(input, helloSz, &ch, isFirstCHFrag);
 965    if (ret != 0)
 966        return ret;
 967
 968#ifdef WOLFSSL_DTLS13
 969    if (IsAtLeastTLSv1_3(ssl->version)) {
 970        ret = TlsCheckSupportedVersion(ssl, &ch, &isTls13);
 971        if (ret != 0)
 972            return ret;
 973        if (tls13 != NULL)
 974            *tls13 = isTls13;
 975        if (isTls13) {
 976            int tlsxFound;
 977            ret = FindExtByType(&ch.cookieExt, TLSX_COOKIE, ch.extension,
 978                                 &tlsxFound);
 979            if (ret != 0) {
 980                if (isFirstCHFrag) {
 981                    WOLFSSL_MSG("\t\tCookie probably missing from first "
 982                                "fragment. Dropping.");
 983                }
 984                return ret;
 985            }
 986        }
 987    }
 988#endif
 989
 990    ret = ClientHelloSanityCheck(&ch, isTls13);
 991    if (ret != 0)
 992        return ret;
 993
 994#ifdef WOLFSSL_DTLS_NO_HVR_ON_RESUME
 995    if (!isTls13 && !isFirstCHFrag) {
 996        int resume = FALSE;
 997        ret = TlsResumptionIsValid(ssl, &ch, &resume);
 998        if (ret != 0)
 999            return ret;
1000        if (resume) {
1001            ssl->options.dtlsStateful = 1;
1002            return 0;
1003        }
1004    }
1005#endif
1006
1007    if (ch.cookie.size == 0 && ch.cookieExt.size == 0) {
1008#ifdef WOLFSSL_DTLS_CH_FRAG
1009        /* Don't send anything here when processing fragment */
1010        if (isFirstCHFrag)
1011            ret = COOKIE_ERROR;
1012        else
1013#endif
1014            ret = SendStatelessReply(ssl, &ch, isTls13);
1015    }
1016    else {
1017        byte cookieGood;
1018        ret = CheckDtlsCookie(ssl, &ch, isTls13, &cookieGood);
1019        if (ret != 0)
1020            return ret;
1021        if (!cookieGood) {
1022#ifdef WOLFSSL_DTLS13
1023            /* Invalid cookie for DTLS 1.3 results in an alert. Alert to be sent
1024             * in DoTls13ClientHello. */
1025            if (isTls13)
1026                ret = INVALID_PARAMETER;
1027            else
1028#endif
1029#ifdef WOLFSSL_DTLS_CH_FRAG
1030            /* Don't send anything here when processing fragment */
1031            if (isFirstCHFrag)
1032                ret = COOKIE_ERROR;
1033            else
1034#endif
1035                ret = SendStatelessReply(ssl, &ch, isTls13);
1036        }
1037        else {
1038            ssl->options.dtlsStateful = 1;
1039            /* Update the window now that we enter the stateful parsing */
1040#ifdef WOLFSSL_DTLS13
1041            if (isTls13) {
1042                /* Set record numbers before current record number as read */
1043                Dtls13Epoch* e;
1044                ret = Dtls13UpdateWindowRecordRecvd(ssl);
1045                e = Dtls13GetEpoch(ssl, ssl->keys.curEpoch64);
1046                if (e != NULL)
1047                    XMEMSET(e->window, 0xFF, sizeof(e->window));
1048            }
1049            else
1050#endif
1051                DtlsUpdateWindow(ssl);
1052            /* Set record numbers before current record number as read */
1053            XMEMSET(ssl->keys.peerSeq->window, 0xFF,
1054                    sizeof(ssl->keys.peerSeq->window));
1055        }
1056    }
1057
1058    return ret;
1059}
1060#endif /* !defined(NO_WOLFSSL_SERVER) */
1061
1062#if defined(WOLFSSL_DTLS_CID)
1063
1064static ConnectionID* DtlsCidNew(const byte* cid, byte size, void* heap)
1065{
1066    ConnectionID* ret;
1067
1068    ret = (ConnectionID*)XMALLOC(sizeof(ConnectionID) + size, heap,
1069        DYNAMIC_TYPE_TLSX);
1070    if (ret == NULL)
1071        return NULL;
1072
1073    ret->length = size;
1074    XMEMCPY(ret->id, cid, size);
1075
1076    return ret;
1077}
1078
1079static WC_INLINE CIDInfo* DtlsCidGetInfo(WOLFSSL* ssl)
1080{
1081    return ssl->dtlsCidInfo;
1082}
1083
1084static int DtlsCidGetSize(WOLFSSL* ssl, unsigned int* size, int rx)
1085{
1086    ConnectionID* id;
1087    CIDInfo* info;
1088
1089    if (ssl == NULL || size == NULL)
1090        return BAD_FUNC_ARG;
1091
1092    info = DtlsCidGetInfo(ssl);
1093    if (info == NULL)
1094        return WOLFSSL_FAILURE;
1095
1096    id = rx ? info->rx : info->tx;
1097    if (id == NULL) {
1098        *size = 0;
1099        return WOLFSSL_SUCCESS;
1100    }
1101
1102    *size = id->length;
1103    return WOLFSSL_SUCCESS;
1104}
1105
1106static int DtlsCidGet(WOLFSSL* ssl, unsigned char* buf, int bufferSz, int rx)
1107{
1108    ConnectionID* id;
1109    CIDInfo* info;
1110
1111    if (ssl == NULL || buf == NULL)
1112        return BAD_FUNC_ARG;
1113
1114    info = DtlsCidGetInfo(ssl);
1115    if (info == NULL)
1116        return WOLFSSL_FAILURE;
1117
1118    id = rx ? info->rx : info->tx;
1119    if (id == NULL || id->length == 0)
1120        return WOLFSSL_SUCCESS;
1121
1122    if (id->length > bufferSz)
1123        return LENGTH_ERROR;
1124
1125    XMEMCPY(buf, id->id, id->length);
1126    return WOLFSSL_SUCCESS;
1127}
1128
1129static int DtlsCidGet0(WOLFSSL* ssl, unsigned char** cid, int rx)
1130{
1131    ConnectionID* id;
1132    CIDInfo* info;
1133
1134    if (ssl == NULL || cid == NULL)
1135        return BAD_FUNC_ARG;
1136
1137    info = DtlsCidGetInfo(ssl);
1138    if (info == NULL)
1139        return WOLFSSL_FAILURE;
1140
1141    id = rx ? info->rx : info->tx;
1142    if (id == NULL || id->length == 0)
1143        return WOLFSSL_SUCCESS;
1144
1145    *cid = id->id;
1146    return WOLFSSL_SUCCESS;
1147}
1148
1149static CIDInfo* DtlsCidGetInfoFromExt(byte* ext)
1150{
1151    WOLFSSL** sslPtr;
1152    WOLFSSL* ssl;
1153
1154    if (ext == NULL)
1155        return NULL;
1156    sslPtr = (WOLFSSL**)ext;
1157    ssl = *sslPtr;
1158    if (ssl == NULL)
1159        return NULL;
1160    return ssl->dtlsCidInfo;
1161}
1162
1163static void DtlsCidUnsetInfoFromExt(byte* ext)
1164{
1165    WOLFSSL** sslPtr;
1166    WOLFSSL* ssl;
1167
1168    if (ext == NULL)
1169        return;
1170    sslPtr = (WOLFSSL**)ext;
1171    ssl = *sslPtr;
1172    if (ssl == NULL)
1173        return;
1174    ssl->dtlsCidInfo = NULL;
1175}
1176
1177void TLSX_ConnectionID_Free(byte* ext, void* heap)
1178{
1179    CIDInfo* info;
1180    (void)heap;
1181
1182    info = DtlsCidGetInfoFromExt(ext);
1183    if (info == NULL)
1184        return;
1185    XFREE(info->rx, heap, DYNAMIC_TYPE_TLSX);
1186    XFREE(info->tx, heap, DYNAMIC_TYPE_TLSX);
1187    XFREE(info, heap, DYNAMIC_TYPE_TLSX);
1188    DtlsCidUnsetInfoFromExt(ext);
1189    XFREE(ext, heap, DYNAMIC_TYPE_TLSX);
1190}
1191
1192word16 TLSX_ConnectionID_Write(byte* ext, byte* output)
1193{
1194    CIDInfo* info;
1195
1196    info = DtlsCidGetInfoFromExt(ext);
1197    if (info == NULL)
1198        return 0;
1199
1200    /* empty CID */
1201    if (info->rx == NULL) {
1202        *output = 0;
1203        return OPAQUE8_LEN;
1204    }
1205
1206    *output = info->rx->length;
1207    XMEMCPY(output + OPAQUE8_LEN, info->rx->id, info->rx->length);
1208    return OPAQUE8_LEN + info->rx->length;
1209}
1210
1211word16 TLSX_ConnectionID_GetSize(byte* ext)
1212{
1213    CIDInfo* info = DtlsCidGetInfoFromExt(ext);
1214    if (info == NULL)
1215        return 0;
1216    return info->rx == NULL ? OPAQUE8_LEN : OPAQUE8_LEN + info->rx->length;
1217}
1218
1219int TLSX_ConnectionID_Use(WOLFSSL* ssl)
1220{
1221    CIDInfo* info;
1222    WOLFSSL** ext;
1223    int ret;
1224
1225    ext = (WOLFSSL**)TLSX_Find(ssl->extensions, TLSX_CONNECTION_ID);
1226    if (ext != NULL)
1227        return 0;
1228
1229    info = (CIDInfo*)XMALLOC(sizeof(CIDInfo), ssl->heap, DYNAMIC_TYPE_TLSX);
1230    if (info == NULL)
1231        return MEMORY_ERROR;
1232    ext = (WOLFSSL**)XMALLOC(sizeof(WOLFSSL*), ssl->heap, DYNAMIC_TYPE_TLSX);
1233    if (ext == NULL) {
1234        XFREE(info, ssl->heap, DYNAMIC_TYPE_TLSX);
1235        return MEMORY_ERROR;
1236    }
1237    XMEMSET(info, 0, sizeof(CIDInfo));
1238    /* CIDInfo needs to be accessed every time we send or receive a record. To
1239     * avoid the cost of the extension lookup save a pointer to the structure
1240     * inside the SSL object itself, and save a pointer to the SSL object in the
1241     * extension. The extension freeing routine uses the pointer to the SSL
1242     * object to find the structure and to set ssl->dtlsCidInfo pointer to NULL
1243     * after freeing the structure. */
1244    ssl->dtlsCidInfo = info;
1245    *ext = ssl;
1246    ret =
1247        TLSX_Push(&ssl->extensions, TLSX_CONNECTION_ID, (void*)ext, ssl->heap);
1248    if (ret != 0) {
1249        XFREE(info, ssl->heap, DYNAMIC_TYPE_TLSX);
1250        XFREE(ext, ssl->heap, DYNAMIC_TYPE_TLSX);
1251        ssl->dtlsCidInfo = NULL;
1252        return ret;
1253    }
1254
1255    return 0;
1256}
1257
1258int TLSX_ConnectionID_Parse(WOLFSSL* ssl, const byte* input, word16 length,
1259    byte isRequest)
1260{
1261    CIDInfo* info;
1262    byte cidSz;
1263    TLSX* ext;
1264
1265    ext = TLSX_Find(ssl->extensions, TLSX_CONNECTION_ID);
1266    if (ext == NULL) {
1267        /* CID not enabled */
1268        if (isRequest) {
1269            WOLFSSL_MSG("Received CID ext but it's not enabled, ignoring");
1270            return 0;
1271        }
1272        else {
1273            WOLFSSL_MSG("CID ext not requested by the Client, aborting");
1274            return UNSUPPORTED_EXTENSION;
1275        }
1276    }
1277
1278    if (length < OPAQUE8_LEN)
1279        return BUFFER_ERROR;
1280
1281    cidSz = *input;
1282    if (cidSz + OPAQUE8_LEN > length)
1283        return BUFFER_ERROR;
1284
1285    info = DtlsCidGetInfo(ssl);
1286    if (info == NULL)
1287        return BAD_STATE_E;
1288
1289    /* it may happen if we process two ClientHello because the server sent an
1290     * HRR/HVR request */
1291    if (info->tx != NULL || info->negotiated) {
1292        if (ssl->options.side != WOLFSSL_SERVER_END &&
1293            ssl->options.serverState != SERVER_HELLO_RETRY_REQUEST_COMPLETE &&
1294            !IsSCR(ssl))
1295            return BAD_STATE_E;
1296
1297        /* Should not be null if negotiated */
1298        if (info->tx == NULL)
1299            return BAD_STATE_E;
1300
1301        /* For now we don't support changing the CID on a rehandshake */
1302        if (cidSz != info->tx->length ||
1303                XMEMCMP(info->tx->id, input + OPAQUE8_LEN, cidSz) != 0)
1304            return DTLS_CID_ERROR;
1305    }
1306    else if (cidSz > 0) {
1307        ConnectionID* id = (ConnectionID*)XMALLOC(sizeof(*id) + cidSz,
1308                ssl->heap, DYNAMIC_TYPE_TLSX);
1309        if (id == NULL)
1310            return MEMORY_ERROR;
1311        XMEMCPY(id->id, input + OPAQUE8_LEN, cidSz);
1312        id->length = cidSz;
1313        info->tx = id;
1314    }
1315
1316    info->negotiated = 1;
1317    if (isRequest)
1318        ext->resp = 1;
1319
1320    return 0;
1321}
1322
1323void DtlsCIDOnExtensionsParsed(WOLFSSL* ssl)
1324{
1325    CIDInfo* info;
1326
1327    info = DtlsCidGetInfo(ssl);
1328    if (info == NULL)
1329        return;
1330
1331    if (!info->negotiated) {
1332        TLSX_Remove(&ssl->extensions, TLSX_CONNECTION_ID, ssl->heap);
1333        return;
1334    }
1335}
1336
1337byte DtlsCIDCheck(WOLFSSL* ssl, const byte* input, word16 inputSize)
1338{
1339    CIDInfo* info;
1340    info = DtlsCidGetInfo(ssl);
1341    if (info == NULL || info->rx == NULL || info->rx->length == 0)
1342        return 0;
1343    if (inputSize < info->rx->length)
1344        return 0;
1345    return XMEMCMP(input, info->rx->id, info->rx->length) == 0;
1346}
1347
1348int wolfSSL_dtls_cid_use(WOLFSSL* ssl)
1349{
1350    int ret;
1351
1352    ssl->options.useDtlsCID = 1;
1353    ret = TLSX_ConnectionID_Use(ssl);
1354    if (ret != 0)
1355        return ret;
1356    return WOLFSSL_SUCCESS;
1357}
1358
1359int wolfSSL_dtls_cid_is_enabled(WOLFSSL* ssl)
1360{
1361    return DtlsCidGetInfo(ssl) != NULL;
1362}
1363
1364int wolfSSL_dtls_cid_set(WOLFSSL* ssl, unsigned char* cid, unsigned int size)
1365{
1366    ConnectionID* newCid;
1367    CIDInfo* cidInfo;
1368
1369    if (!ssl->options.useDtlsCID)
1370        return WOLFSSL_FAILURE;
1371
1372    cidInfo = DtlsCidGetInfo(ssl);
1373    if (cidInfo == NULL)
1374        return WOLFSSL_FAILURE;
1375
1376    if (cidInfo->rx != NULL) {
1377        WOLFSSL_MSG("wolfSSL doesn't support changing the CID during a "
1378                    "connection");
1379        return WOLFSSL_FAILURE;
1380    }
1381
1382    /* empty CID */
1383    if (size == 0)
1384        return WOLFSSL_SUCCESS;
1385
1386    if (size > DTLS_CID_MAX_SIZE)
1387        return LENGTH_ERROR;
1388
1389    newCid = DtlsCidNew(cid, (byte)size, ssl->heap);
1390    if (newCid == NULL)
1391        return MEMORY_ERROR;
1392    cidInfo->rx = newCid;
1393    return WOLFSSL_SUCCESS;
1394}
1395
1396int wolfSSL_dtls_cid_get_rx_size(WOLFSSL* ssl, unsigned int* size)
1397{
1398    return DtlsCidGetSize(ssl, size, 1);
1399}
1400
1401int wolfSSL_dtls_cid_get_rx(WOLFSSL* ssl, unsigned char* buf,
1402    unsigned int bufferSz)
1403{
1404    return DtlsCidGet(ssl, buf, bufferSz, 1);
1405}
1406
1407int wolfSSL_dtls_cid_get0_rx(WOLFSSL* ssl, unsigned char** cid)
1408{
1409    return DtlsCidGet0(ssl, cid, 1);
1410}
1411
1412int wolfSSL_dtls_cid_get_tx_size(WOLFSSL* ssl, unsigned int* size)
1413{
1414    return DtlsCidGetSize(ssl, size, 0);
1415}
1416
1417int wolfSSL_dtls_cid_get_tx(WOLFSSL* ssl, unsigned char* buf,
1418    unsigned int bufferSz)
1419{
1420    return DtlsCidGet(ssl, buf, bufferSz, 0);
1421}
1422
1423int wolfSSL_dtls_cid_get0_tx(WOLFSSL* ssl, unsigned char** cid)
1424{
1425    return DtlsCidGet0(ssl, cid, 0);
1426}
1427
1428int wolfSSL_dtls_cid_max_size(void)
1429{
1430    return DTLS_CID_MAX_SIZE;
1431}
1432
1433const unsigned char* wolfSSL_dtls_cid_parse(const unsigned char* msg,
1434        unsigned int msgSz, unsigned int cidSz)
1435{
1436    /* we need at least the first byte to check version */
1437    if (msg == NULL || cidSz == 0 || msgSz < OPAQUE8_LEN + cidSz)
1438        return NULL;
1439    if (msg[0] == dtls12_cid) {
1440        /* DTLS 1.2 CID packet */
1441        if (msgSz < DTLS_RECORD_HEADER_SZ + cidSz)
1442            return NULL;
1443        /* content type(1) + version(2) + epoch(2) + sequence(6) */
1444        return msg + ENUM_LEN + VERSION_SZ + OPAQUE16_LEN + OPAQUE16_LEN +
1445                OPAQUE32_LEN;
1446    }
1447#ifdef WOLFSSL_DTLS13
1448    else if (Dtls13UnifiedHeaderCIDPresent(msg[0])) {
1449        /* DTLS 1.3 CID packet */
1450        if (msgSz < OPAQUE8_LEN + cidSz)
1451            return NULL;
1452        return msg + OPAQUE8_LEN;
1453    }
1454#endif
1455    return NULL;
1456}
1457#endif /* WOLFSSL_DTLS_CID */
1458
1459byte DtlsGetCidTxSize(WOLFSSL* ssl)
1460{
1461#ifdef WOLFSSL_DTLS_CID
1462    unsigned int cidSz;
1463    int ret;
1464    ret = wolfSSL_dtls_cid_get_tx_size(ssl, &cidSz);
1465    if (ret != WOLFSSL_SUCCESS)
1466        return 0;
1467    return (byte)cidSz;
1468#else
1469    (void)ssl;
1470    return 0;
1471#endif
1472}
1473
1474byte DtlsGetCidRxSize(WOLFSSL* ssl)
1475{
1476#ifdef WOLFSSL_DTLS_CID
1477    unsigned int cidSz;
1478    int ret;
1479    ret = wolfSSL_dtls_cid_get_rx_size(ssl, &cidSz);
1480    if (ret != WOLFSSL_SUCCESS)
1481        return 0;
1482    return (byte)cidSz;
1483#else
1484    (void)ssl;
1485    return 0;
1486#endif
1487}
1488
1489byte wolfSSL_is_stateful(WOLFSSL* ssl)
1490{
1491    return (byte)(ssl != NULL ? ssl->options.dtlsStateful : 0);
1492}
1493
1494#endif /* WOLFSSL_DTLS */
1495
1496#endif /* WOLFCRYPT_ONLY */