blob: 104d5b62b974af7d0910d552c7d0f8501fc09251 [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
Jerry Yub9930e72021-08-06 17:11:51 +08002 * TLS 1.3 server-side functions
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18*/
19
20#include "common.h"
21
Jerry Yufb4b6472022-01-27 15:03:26 +080022#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080023
Jerry Yu687101b2021-09-14 16:03:56 +080024#include "mbedtls/debug.h"
Xiaofei Baicba64af2022-02-15 10:00:56 +000025#include "mbedtls/error.h"
26#include "mbedtls/platform.h"
Jerry Yu1c105562022-07-10 06:32:38 +000027#include "mbedtls/constant_time.h"
Jerry Yu3bf2c642022-03-30 22:02:12 +080028
Xiaofei Bai9ca09d42022-02-14 12:57:18 +000029#include "ssl_misc.h"
30#include "ssl_tls13_keys.h"
31#include "ssl_debug_helpers.h"
32
XiaokangQian7807f9f2022-02-15 10:04:37 +000033#if defined(MBEDTLS_ECP_C)
34#include "mbedtls/ecp.h"
XiaokangQian7807f9f2022-02-15 10:04:37 +000035#endif /* MBEDTLS_ECP_C */
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080036
XiaokangQiana9c58412022-02-17 09:41:26 +000037#if defined(MBEDTLS_PLATFORM_C)
38#include "mbedtls/platform.h"
39#else
40#include <stdlib.h>
41#define mbedtls_calloc calloc
42#define mbedtls_free free
43#endif /* MBEDTLS_PLATFORM_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +000044
Jerry Yu4d3841a2022-04-16 12:37:19 +080045#include "ssl_misc.h"
46#include "ssl_tls13_keys.h"
47#include "ssl_debug_helpers.h"
48
Jerry Yue19e3b92022-07-08 12:04:51 +000049#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
50/* From RFC 8446:
51 *
52 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
53 * struct {
54 * PskKeyExchangeMode ke_modes<1..255>;
55 * } PskKeyExchangeModes;
56 */
57static int ssl_tls13_parse_key_exchange_modes_ext( mbedtls_ssl_context *ssl,
58 const unsigned char *buf,
Jerry Yu299e31f2022-07-13 23:06:36 +080059 const unsigned char *end )
Jerry Yue19e3b92022-07-08 12:04:51 +000060{
Jerry Yu299e31f2022-07-13 23:06:36 +080061 const unsigned char *p = buf;
Jerry Yue19e3b92022-07-08 12:04:51 +000062 size_t ke_modes_len;
63 int ke_modes = 0;
64
Jerry Yu854dd9e2022-07-15 14:28:27 +080065 /* Read ke_modes length (1 Byte) */
Jerry Yu299e31f2022-07-13 23:06:36 +080066 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
67 ke_modes_len = *p++;
Jerry Yue19e3b92022-07-08 12:04:51 +000068 /* Currently, there are only two PSK modes, so even without looking
69 * at the content, something's wrong if the list has more than 2 items. */
70 if( ke_modes_len > 2 )
Jerry Yu299e31f2022-07-13 23:06:36 +080071 {
72 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
73 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue19e3b92022-07-08 12:04:51 +000074 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Jerry Yu299e31f2022-07-13 23:06:36 +080075 }
Jerry Yue19e3b92022-07-08 12:04:51 +000076
Jerry Yu299e31f2022-07-13 23:06:36 +080077 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, ke_modes_len );
Jerry Yue19e3b92022-07-08 12:04:51 +000078
79 while( ke_modes_len-- != 0 )
80 {
Jerry Yu299e31f2022-07-13 23:06:36 +080081 switch( *p++ )
Jerry Yue19e3b92022-07-08 12:04:51 +000082 {
83 case MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE:
84 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
85 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Found PSK KEX MODE" ) );
86 break;
87 case MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE:
88 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
89 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Found PSK_EPHEMERAL KEX MODE" ) );
90 break;
91 default:
Jerry Yu299e31f2022-07-13 23:06:36 +080092 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
93 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue19e3b92022-07-08 12:04:51 +000094 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
95 }
96 }
97
98 ssl->handshake->tls13_kex_modes = ke_modes;
99 return( 0 );
100}
Jerry Yu1c105562022-07-10 06:32:38 +0000101
102#define SSL_TLS1_3_OFFERED_PSK_NOT_MATCH 0
103#define SSL_TLS1_3_OFFERED_PSK_MATCH 1
104static int ssl_tls13_offered_psks_check_identity_match(
105 mbedtls_ssl_context *ssl,
106 const unsigned char *identity,
107 uint16_t identity_len )
108{
109 /* Check identity with external configured function */
110 if( ssl->conf->f_psk != NULL )
111 {
112 if( ssl->conf->f_psk(
113 ssl->conf->p_psk, ssl, identity, identity_len ) == 0 )
114 {
115 return( SSL_TLS1_3_OFFERED_PSK_MATCH );
116 }
117 return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
118 }
119
120 /* Check identity with pre-configured psk */
121 if( identity_len == ssl->conf->psk_identity_len &&
122 mbedtls_ct_memcmp( ssl->conf->psk_identity,
123 identity, identity_len ) == 0 )
124 {
125 mbedtls_ssl_set_hs_psk( ssl, ssl->conf->psk, ssl->conf->psk_len );
126 return( SSL_TLS1_3_OFFERED_PSK_MATCH );
127 }
128
129 /* Add session ticket here */
130
131 return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
132}
133
134static int ssl_tls13_offered_psks_check_binder_match(
135 mbedtls_ssl_context *ssl,
136 const unsigned char *binder,
137 uint16_t binder_len,
138 const unsigned char *psk,
139 size_t psk_len )
140{
141 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
142 int psk_type;
143 mbedtls_md_type_t md_alg =
144 binder_len == 32 ? MBEDTLS_MD_SHA256 : MBEDTLS_MD_SHA384 ;
145 psa_algorithm_t psa_md_alg = mbedtls_psa_translate_md( md_alg );
146 unsigned char transcript[MBEDTLS_MD_MAX_SIZE];
147 size_t transcript_len;
148 unsigned char server_computed_binder[MBEDTLS_MD_MAX_SIZE];
149
150 if( ssl->handshake->resume == 1 )
151 psk_type = MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION;
152 else
153 psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
154
155 /* Get current state of handshake transcript. */
156 ret = mbedtls_ssl_get_handshake_transcript( ssl, md_alg,
157 transcript, sizeof( transcript ),
158 &transcript_len );
159 if( ret != 0 )
160 return( ret );
161
162 ret = mbedtls_ssl_tls13_create_psk_binder( ssl, psa_md_alg,
163 psk, psk_len, psk_type,
164 transcript,
165 server_computed_binder );
166 /* We do not check for multiple binders */
167 if( ret != 0 )
168 {
169 MBEDTLS_SSL_DEBUG_MSG( 1, ( "PSK binder calculation failed." ) );
170 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
171 }
172
173 MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder ( computed ): ",
174 server_computed_binder, binder_len );
175 MBEDTLS_SSL_DEBUG_BUF( 3, "psk binder ( received ): ", binder, binder_len );
176
177 if( mbedtls_ct_memcmp( server_computed_binder, binder, binder_len ) == 0 )
178 {
179 return( SSL_TLS1_3_OFFERED_PSK_MATCH );
180 }
181
182 return( SSL_TLS1_3_OFFERED_PSK_NOT_MATCH );
183}
184/* Parser for pre_shared_key extension in client hello
185 * struct {
186 * opaque identity<1..2^16-1>;
187 * uint32 obfuscated_ticket_age;
188 * } PskIdentity;
189 *
190 * opaque PskBinderEntry<32..255>;
191 *
192 * struct {
193 * PskIdentity identities<7..2^16-1>;
194 * PskBinderEntry binders<33..2^16-1>;
195 * } OfferedPsks;
196 *
197 * struct {
198 * select (Handshake.msg_type) {
199 * case client_hello: OfferedPsks;
200 * ....
201 * };
202 * } PreSharedKeyExtension;
203 */
204static int ssl_tls13_parse_offered_psks_ext( mbedtls_ssl_context *ssl,
205 const unsigned char *buf,
206 const unsigned char *end )
207{
208 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
209 const unsigned char *p = buf;
210 uint16_t identities_len;
211 const unsigned char *identities_end;
212 uint32_t identity_matched = SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
213 uint16_t binders_len;
214 const unsigned char *binders_end;
215 unsigned char *psk = NULL;
216 size_t psk_len = 0;
217 int binder_matched = 0;
218#if defined(MBEDTLS_USE_PSA_CRYPTO)
219 psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
220 psa_status_t status;
221#endif /* MBEDTLS_USE_PSA_CRYPTO */
222
223 MBEDTLS_SSL_DEBUG_BUF( 3, "pre_shared_key extesion", buf, end - buf );
224
225 /* identities >= 7 bytes */
226 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 7 );
227
228 identities_len = MBEDTLS_GET_UINT16_BE( p, 0 );
229 p += 2;
230 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, identities_len );
231 identities_end = p + identities_len;
232
233 while( p < identities_end )
234 {
235 uint16_t identity_len;
236 const unsigned char *identity;
237 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, identities_end, 2 );
238 identity_len = MBEDTLS_GET_UINT16_BE( p, 0 );
239 p += 2;
240 identity = p;
241 p += identity_len;
242 p += 4; // skip obfuscated_ticket_age
243 MBEDTLS_SSL_CHK_BUF_READ_PTR( identity, identities_end, identity_len );
244
245 if( identity_matched == SSL_TLS1_3_OFFERED_PSK_MATCH )
246 continue;
247
248 MBEDTLS_SSL_DEBUG_BUF( 3, "received psk identity",
249 identity, identity_len );
250 identity_matched = ssl_tls13_offered_psks_check_identity_match(
251 ssl, identity, identity_len );
252 }
253
254 if( identity_matched != SSL_TLS1_3_OFFERED_PSK_MATCH )
255 {
256 MBEDTLS_SSL_PEND_FATAL_ALERT(
257 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
258 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
259 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
260 }
261
262 if( p != identities_end )
263 {
264 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key extesion decode error" ) );
265 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
266 MBEDTLS_ERR_SSL_DECODE_ERROR );
267 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
268 }
269
270 ssl->handshake->update_checksum( ssl, buf, p - buf );
271
272 /* binders >= 33 bytes */
273 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 33 );
274 binders_len = MBEDTLS_GET_UINT16_BE( p, 0 );
275 p += 2;
276 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, binders_len );
277 binders_end = p + binders_len;
278
279#if defined(MBEDTLS_USE_PSA_CRYPTO)
280 status = psa_get_key_attributes( ssl->handshake->psk_opaque,
281 &key_attributes );
282 if( status != PSA_SUCCESS)
283 {
284 return( psa_ssl_status_to_mbedtls( status ) );
285 }
286
287 psk_len = PSA_BITS_TO_BYTES(psa_get_key_bits( &key_attributes ) );
288 psk = mbedtls_calloc( 1, psk_len );
289 if( psk == NULL )
290 {
291 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
292 }
293 status = psa_export_key(ssl->handshake->psk_opaque, psk, psk_len, &psk_len );
294 if( status != PSA_SUCCESS)
295 {
296 ret = psa_ssl_status_to_mbedtls( status );
297 goto exit_failue;
298 }
299#else
300 psk = ssl->handshake->psk;
301 psk_len = ssl->handshake->psk_len;
302#endif /* !MBEDTLS_USE_PSA_CRYPTO */
303
304 while( p < binders_end )
305 {
306 uint8_t binder_len;
307 const unsigned char *binder;
308
309 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
310 binder_len = *p++;
311 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, binder_len );
312 binder = p;
313 p += binder_len;
314
315 if( binder_matched == SSL_TLS1_3_OFFERED_PSK_MATCH)
316 continue;
317
318 binder_matched = ssl_tls13_offered_psks_check_binder_match(
319 ssl, binder, binder_len, psk, psk_len );
320 if( binder_matched < 0 )
321 {
322 MBEDTLS_SSL_DEBUG_RET( 1,
323 "ssl_tls13_offered_psks_check_binder_match" , binder_matched );
324 MBEDTLS_SSL_PEND_FATAL_ALERT(
325 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
326 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
327 ret = binder_matched;
328 goto exit_failue;
329 }
330 }
331
332 if( binder_matched != SSL_TLS1_3_OFFERED_PSK_MATCH )
333 {
334 MBEDTLS_SSL_DEBUG_MSG( 1,
335 ( "Received psk binder does not match computed psk binder." ) );
336 MBEDTLS_SSL_PEND_FATAL_ALERT(
337 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
338 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
339 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
340 goto exit_failue;
341 }
342
343 if( p != binders_end )
344 {
345 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key extesion decode error" ) );
346 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
347 MBEDTLS_ERR_SSL_DECODE_ERROR );
348 ret = MBEDTLS_ERR_SSL_DECODE_ERROR;
349 goto exit_failue;
350 }
351
352 /* Update the handshake transcript with the binder list. */
353 ssl->handshake->update_checksum( ssl,
354 identities_end,
355 (size_t)( p - identities_end ) );
356 ret = 0;
357
358exit_failue:
359#if defined(MBEDTLS_USE_PSA_CRYPTO)
360 mbedtls_free( (void *)psk );
361#endif
362 return( ret );
363}
Jerry Yue19e3b92022-07-08 12:04:51 +0000364#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
365
XiaokangQian7807f9f2022-02-15 10:04:37 +0000366/* From RFC 8446:
367 * struct {
XiaokangQiancfd925f2022-04-14 07:10:37 +0000368 * ProtocolVersion versions<2..254>;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000369 * } SupportedVersions;
370 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200371MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian7807f9f2022-02-15 10:04:37 +0000372static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
373 const unsigned char *buf,
374 const unsigned char *end )
375{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000376 const unsigned char *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000377 size_t versions_len;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000378 const unsigned char *versions_end;
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000379 uint16_t tls_version;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000380 int tls13_supported = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000381
382 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
XiaokangQian4080a7f2022-04-11 09:55:18 +0000383 versions_len = p[0];
XiaokangQian7807f9f2022-02-15 10:04:37 +0000384 p += 1;
385
XiaokangQian4080a7f2022-04-11 09:55:18 +0000386 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, versions_len );
XiaokangQian4080a7f2022-04-11 09:55:18 +0000387 versions_end = p + versions_len;
388 while( p < versions_end )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000389 {
XiaokangQiancfd925f2022-04-14 07:10:37 +0000390 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, versions_end, 2 );
XiaokangQiande333912022-04-20 08:49:42 +0000391 tls_version = mbedtls_ssl_read_version( p, ssl->conf->transport );
XiaokangQianb67384d2022-04-19 00:02:38 +0000392 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000393
394 /* In this implementation we only support TLS 1.3 and DTLS 1.3. */
XiaokangQiande333912022-04-20 08:49:42 +0000395 if( tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000396 {
397 tls13_supported = 1;
398 break;
399 }
XiaokangQian7807f9f2022-02-15 10:04:37 +0000400 }
401
XiaokangQianb67384d2022-04-19 00:02:38 +0000402 if( !tls13_supported )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000403 {
XiaokangQian7807f9f2022-02-15 10:04:37 +0000404 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 is not supported by the client" ) );
405
406 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
407 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
408 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
409 }
410
XiaokangQiande333912022-04-20 08:49:42 +0000411 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Negotiated version. Supported is [%04x]",
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000412 (unsigned int)tls_version ) );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000413
XiaokangQian7807f9f2022-02-15 10:04:37 +0000414 return( 0 );
415}
416
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000417#if defined(MBEDTLS_ECDH_C)
XiaokangQiane8ff3502022-04-22 02:34:40 +0000418/*
XiaokangQian7807f9f2022-02-15 10:04:37 +0000419 *
420 * From RFC 8446:
421 * enum {
422 * ... (0xFFFF)
423 * } NamedGroup;
424 * struct {
425 * NamedGroup named_group_list<2..2^16-1>;
426 * } NamedGroupList;
427 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200428MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc1be19f2022-04-23 16:11:39 +0800429static int ssl_tls13_parse_supported_groups_ext( mbedtls_ssl_context *ssl,
430 const unsigned char *buf,
431 const unsigned char *end )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000432{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000433 const unsigned char *p = buf;
XiaokangQian84823772022-04-19 07:57:30 +0000434 size_t named_group_list_len;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000435 const unsigned char *named_group_list_end;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000436
437 MBEDTLS_SSL_DEBUG_BUF( 3, "supported_groups extension", p, end - buf );
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000438 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian4080a7f2022-04-11 09:55:18 +0000439 named_group_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000440 p += 2;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000441 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, named_group_list_len );
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000442 named_group_list_end = p + named_group_list_len;
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000443 ssl->handshake->hrr_selected_group = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000444
XiaokangQian08037552022-04-20 07:16:41 +0000445 while( p < named_group_list_end )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000446 {
XiaokangQian08037552022-04-20 07:16:41 +0000447 uint16_t named_group;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000448 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, named_group_list_end, 2 );
XiaokangQian08037552022-04-20 07:16:41 +0000449 named_group = MBEDTLS_GET_UINT16_BE( p, 0 );
450 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000451
Jerry Yuc1be19f2022-04-23 16:11:39 +0800452 MBEDTLS_SSL_DEBUG_MSG( 2,
453 ( "got named group: %s(%04x)",
454 mbedtls_ssl_named_group_to_str( named_group ),
455 named_group ) );
XiaokangQian08037552022-04-20 07:16:41 +0000456
457 if( ! mbedtls_ssl_named_group_is_offered( ssl, named_group ) ||
458 ! mbedtls_ssl_named_group_is_supported( named_group ) ||
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000459 ssl->handshake->hrr_selected_group != 0 )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000460 {
XiaokangQian08037552022-04-20 07:16:41 +0000461 continue;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000462 }
463
Jerry Yuc1be19f2022-04-23 16:11:39 +0800464 MBEDTLS_SSL_DEBUG_MSG( 2,
465 ( "add named group %s(%04x) into received list.",
466 mbedtls_ssl_named_group_to_str( named_group ),
467 named_group ) );
468
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000469 ssl->handshake->hrr_selected_group = named_group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000470 }
471
472 return( 0 );
473
474}
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000475#endif /* MBEDTLS_ECDH_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000476
XiaokangQian08037552022-04-20 07:16:41 +0000477#define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1
478
XiaokangQian88408882022-04-02 10:15:03 +0000479#if defined(MBEDTLS_ECDH_C)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000480/*
481 * ssl_tls13_parse_key_shares_ext() verifies whether the information in the
XiaokangQiane8ff3502022-04-22 02:34:40 +0000482 * extension is correct and stores the first acceptable key share and its associated group.
XiaokangQian7807f9f2022-02-15 10:04:37 +0000483 *
484 * Possible return values are:
485 * - 0: Successful processing of the client provided key share extension.
XiaokangQian08037552022-04-20 07:16:41 +0000486 * - SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH: The key shares provided by the client
XiaokangQian7807f9f2022-02-15 10:04:37 +0000487 * does not match a group supported by the server. A HelloRetryRequest will
488 * be needed.
XiaokangQiane8ff3502022-04-22 02:34:40 +0000489 * - A negative value for fatal errors.
Jerry Yuc1be19f2022-04-23 16:11:39 +0800490 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200491MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian7807f9f2022-02-15 10:04:37 +0000492static int ssl_tls13_parse_key_shares_ext( mbedtls_ssl_context *ssl,
493 const unsigned char *buf,
494 const unsigned char *end )
495{
XiaokangQianb67384d2022-04-19 00:02:38 +0000496 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000497 unsigned char const *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000498 unsigned char const *client_shares_end;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800499 size_t client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000500
501 /* From RFC 8446:
502 *
503 * struct {
504 * KeyShareEntry client_shares<0..2^16-1>;
505 * } KeyShareClientHello;
506 *
507 */
508
XiaokangQian7807f9f2022-02-15 10:04:37 +0000509 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000510 client_shares_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000511 p += 2;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000512 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, client_shares_len );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000513
514 ssl->handshake->offered_group_id = 0;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000515 client_shares_end = p + client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000516
517 /* We try to find a suitable key share entry and copy it to the
518 * handshake context. Later, we have to find out whether we can do
519 * something with the provided key share or whether we have to
XiaokangQianc5763b52022-04-02 03:34:37 +0000520 * dismiss it and send a HelloRetryRequest message.
521 */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000522
Jerry Yuc1be19f2022-04-23 16:11:39 +0800523 while( p < client_shares_end )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000524 {
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000525 uint16_t group;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800526 size_t key_exchange_len;
Jerry Yu086edc22022-05-05 10:50:38 +0800527 const unsigned char *key_exchange;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000528
529 /*
530 * struct {
531 * NamedGroup group;
532 * opaque key_exchange<1..2^16-1>;
533 * } KeyShareEntry;
534 */
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000535 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, client_shares_end, 4 );
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000536 group = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yuc1be19f2022-04-23 16:11:39 +0800537 key_exchange_len = MBEDTLS_GET_UINT16_BE( p, 2 );
538 p += 4;
Jerry Yu086edc22022-05-05 10:50:38 +0800539 key_exchange = p;
XiaokangQianb67384d2022-04-19 00:02:38 +0000540 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, client_shares_end, key_exchange_len );
Jerry Yu086edc22022-05-05 10:50:38 +0800541 p += key_exchange_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000542
543 /* Continue parsing even if we have already found a match,
XiaokangQianc5763b52022-04-02 03:34:37 +0000544 * for input validation purposes.
545 */
XiaokangQian060d8672022-04-21 09:24:56 +0000546 if( ! mbedtls_ssl_named_group_is_offered( ssl, group ) ||
Jerry Yuc1be19f2022-04-23 16:11:39 +0800547 ! mbedtls_ssl_named_group_is_supported( group ) ||
548 ssl->handshake->offered_group_id != 0 )
XiaokangQian060d8672022-04-21 09:24:56 +0000549 {
550 continue;
551 }
XiaokangQian060d8672022-04-21 09:24:56 +0000552
XiaokangQian7807f9f2022-02-15 10:04:37 +0000553 /*
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000554 * For now, we only support ECDHE groups.
XiaokangQian7807f9f2022-02-15 10:04:37 +0000555 */
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000556 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
557 {
Jerry Yuc1be19f2022-04-23 16:11:39 +0800558 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH group: %s (%04x)",
559 mbedtls_ssl_named_group_to_str( group ),
560 group ) );
XiaokangQian318dc762022-04-20 09:43:51 +0000561 ret = mbedtls_ssl_tls13_read_public_ecdhe_share(
Jerry Yu086edc22022-05-05 10:50:38 +0800562 ssl, key_exchange - 2, key_exchange_len + 2 );
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000563 if( ret != 0 )
564 return( ret );
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000565
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000566 }
567 else
XiaokangQian7807f9f2022-02-15 10:04:37 +0000568 {
569 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Unrecognized NamedGroup %u",
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000570 (unsigned) group ) );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000571 continue;
572 }
573
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000574 ssl->handshake->offered_group_id = group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000575 }
576
Jerry Yuc1be19f2022-04-23 16:11:39 +0800577
578 if( ssl->handshake->offered_group_id == 0 )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000579 {
580 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching key share" ) );
XiaokangQian08037552022-04-20 07:16:41 +0000581 return( SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000582 }
583 return( 0 );
584}
XiaokangQian88408882022-04-02 10:15:03 +0000585#endif /* MBEDTLS_ECDH_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000586
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000587#if defined(MBEDTLS_DEBUG_C)
XiaokangQian4080a7f2022-04-11 09:55:18 +0000588static void ssl_tls13_debug_print_client_hello_exts( mbedtls_ssl_context *ssl )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000589{
XiaokangQian3207a322022-02-23 03:15:27 +0000590 ((void) ssl);
591
XiaokangQian7807f9f2022-02-15 10:04:37 +0000592 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Extensions:" ) );
XiaokangQianb67384d2022-04-19 00:02:38 +0000593 MBEDTLS_SSL_DEBUG_MSG( 3,
594 ( "- KEY_SHARE_EXTENSION ( %s )",
595 ( ( ssl->handshake->extensions_present
596 & MBEDTLS_SSL_EXT_KEY_SHARE ) > 0 ) ? "TRUE" : "FALSE" ) );
597 MBEDTLS_SSL_DEBUG_MSG( 3,
598 ( "- PSK_KEY_EXCHANGE_MODES_EXTENSION ( %s )",
599 ( ( ssl->handshake->extensions_present
600 & MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES ) > 0 ) ?
601 "TRUE" : "FALSE" ) );
602 MBEDTLS_SSL_DEBUG_MSG( 3,
603 ( "- PRE_SHARED_KEY_EXTENSION ( %s )",
604 ( ( ssl->handshake->extensions_present
605 & MBEDTLS_SSL_EXT_PRE_SHARED_KEY ) > 0 ) ? "TRUE" : "FALSE" ) );
606 MBEDTLS_SSL_DEBUG_MSG( 3,
607 ( "- SIGNATURE_ALGORITHM_EXTENSION ( %s )",
608 ( ( ssl->handshake->extensions_present
609 & MBEDTLS_SSL_EXT_SIG_ALG ) > 0 ) ? "TRUE" : "FALSE" ) );
610 MBEDTLS_SSL_DEBUG_MSG( 3,
611 ( "- SUPPORTED_GROUPS_EXTENSION ( %s )",
612 ( ( ssl->handshake->extensions_present
613 & MBEDTLS_SSL_EXT_SUPPORTED_GROUPS ) >0 ) ?
614 "TRUE" : "FALSE" ) );
615 MBEDTLS_SSL_DEBUG_MSG( 3,
616 ( "- SUPPORTED_VERSION_EXTENSION ( %s )",
617 ( ( ssl->handshake->extensions_present
618 & MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS ) > 0 ) ?
619 "TRUE" : "FALSE" ) );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000620#if defined ( MBEDTLS_SSL_SERVER_NAME_INDICATION )
XiaokangQianb67384d2022-04-19 00:02:38 +0000621 MBEDTLS_SSL_DEBUG_MSG( 3,
622 ( "- SERVERNAME_EXTENSION ( %s )",
623 ( ( ssl->handshake->extensions_present
624 & MBEDTLS_SSL_EXT_SERVERNAME ) > 0 ) ?
625 "TRUE" : "FALSE" ) );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000626#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
XiaokangQianacb39922022-06-17 10:18:48 +0000627#if defined ( MBEDTLS_SSL_ALPN )
628 MBEDTLS_SSL_DEBUG_MSG( 3,
629 ( "- ALPN_EXTENSION ( %s )",
630 ( ( ssl->handshake->extensions_present
631 & MBEDTLS_SSL_EXT_ALPN ) > 0 ) ?
632 "TRUE" : "FALSE" ) );
633#endif /* MBEDTLS_SSL_ALPN */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000634}
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000635#endif /* MBEDTLS_DEBUG_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000636
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200637MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian4080a7f2022-04-11 09:55:18 +0000638static int ssl_tls13_client_hello_has_exts( mbedtls_ssl_context *ssl,
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000639 int exts_mask )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000640{
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000641 int masked = ssl->handshake->extensions_present & exts_mask;
642 return( masked == exts_mask );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000643}
644
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200645MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianb67384d2022-04-19 00:02:38 +0000646static int ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(
647 mbedtls_ssl_context *ssl )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000648{
XiaokangQian4080a7f2022-04-11 09:55:18 +0000649 return( ssl_tls13_client_hello_has_exts( ssl,
XiaokangQian7807f9f2022-02-15 10:04:37 +0000650 MBEDTLS_SSL_EXT_SUPPORTED_GROUPS |
651 MBEDTLS_SSL_EXT_KEY_SHARE |
652 MBEDTLS_SSL_EXT_SIG_ALG ) );
653}
654
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200655MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianb67384d2022-04-19 00:02:38 +0000656static int ssl_tls13_check_ephemeral_key_exchange( mbedtls_ssl_context *ssl )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000657{
658 if( !mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) )
659 return( 0 );
660
XiaokangQianb67384d2022-04-19 00:02:38 +0000661 if( !ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange( ssl ) )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000662 return( 0 );
663
Ronald Cron79907712022-07-20 17:05:29 +0200664 ssl->handshake->key_exchange_mode =
XiaokangQianb67384d2022-04-19 00:02:38 +0000665 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000666 return( 1 );
667}
668
XiaokangQian81802f42022-06-10 13:25:22 +0000669#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
670 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
XiaokangQian23c5be62022-06-07 02:04:34 +0000671/*
XiaokangQianfb665a82022-06-15 03:57:21 +0000672 * Pick best ( private key, certificate chain ) pair based on the signature
673 * algorithms supported by the client.
XiaokangQian23c5be62022-06-07 02:04:34 +0000674 */
Ronald Cronce7d76e2022-07-08 18:56:49 +0200675MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian07aad072022-06-14 05:35:09 +0000676static int ssl_tls13_pick_key_cert( mbedtls_ssl_context *ssl )
XiaokangQian23c5be62022-06-07 02:04:34 +0000677{
XiaokangQianfb665a82022-06-15 03:57:21 +0000678 mbedtls_ssl_key_cert *key_cert, *key_cert_list;
XiaokangQian81802f42022-06-10 13:25:22 +0000679 const uint16_t *sig_alg = ssl->handshake->received_sig_algs;
XiaokangQian23c5be62022-06-07 02:04:34 +0000680
681#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
682 if( ssl->handshake->sni_key_cert != NULL )
XiaokangQianfb665a82022-06-15 03:57:21 +0000683 key_cert_list = ssl->handshake->sni_key_cert;
XiaokangQian23c5be62022-06-07 02:04:34 +0000684 else
685#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
XiaokangQianfb665a82022-06-15 03:57:21 +0000686 key_cert_list = ssl->conf->key_cert;
XiaokangQian23c5be62022-06-07 02:04:34 +0000687
XiaokangQianfb665a82022-06-15 03:57:21 +0000688 if( key_cert_list == NULL )
XiaokangQian23c5be62022-06-07 02:04:34 +0000689 {
690 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
691 return( -1 );
692 }
693
XiaokangQian81802f42022-06-10 13:25:22 +0000694 for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
XiaokangQian23c5be62022-06-07 02:04:34 +0000695 {
XiaokangQianfb665a82022-06-15 03:57:21 +0000696 for( key_cert = key_cert_list; key_cert != NULL;
697 key_cert = key_cert->next )
XiaokangQian23c5be62022-06-07 02:04:34 +0000698 {
XiaokangQianfb665a82022-06-15 03:57:21 +0000699 MBEDTLS_SSL_DEBUG_CRT( 3, "certificate (chain) candidate",
700 key_cert->cert );
XiaokangQian81802f42022-06-10 13:25:22 +0000701
702 /*
703 * This avoids sending the client a cert it'll reject based on
704 * keyUsage or other extensions.
705 */
706 if( mbedtls_x509_crt_check_key_usage(
XiaokangQianfb665a82022-06-15 03:57:21 +0000707 key_cert->cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE ) != 0 ||
XiaokangQian81802f42022-06-10 13:25:22 +0000708 mbedtls_x509_crt_check_extended_key_usage(
XiaokangQianfb665a82022-06-15 03:57:21 +0000709 key_cert->cert, MBEDTLS_OID_SERVER_AUTH,
710 MBEDTLS_OID_SIZE( MBEDTLS_OID_SERVER_AUTH ) ) != 0 )
XiaokangQian81802f42022-06-10 13:25:22 +0000711 {
712 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
XiaokangQianfb665a82022-06-15 03:57:21 +0000713 "(extended) key usage extension" ) );
XiaokangQian81802f42022-06-10 13:25:22 +0000714 continue;
715 }
XiaokangQian23c5be62022-06-07 02:04:34 +0000716
Jerry Yucc539102022-06-27 16:27:35 +0800717 MBEDTLS_SSL_DEBUG_MSG( 3,
718 ( "ssl_tls13_pick_key_cert:"
719 "check signature algorithm %s [%04x]",
720 mbedtls_ssl_sig_alg_to_str( *sig_alg ),
721 *sig_alg ) );
Jerry Yufb526692022-06-19 11:22:49 +0800722 if( mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
Jerry Yud099cf02022-06-19 13:47:00 +0800723 *sig_alg, &key_cert->cert->pk ) )
XiaokangQian81802f42022-06-10 13:25:22 +0000724 {
XiaokangQianfb665a82022-06-15 03:57:21 +0000725 ssl->handshake->key_cert = key_cert;
Jerry Yucc539102022-06-27 16:27:35 +0800726 MBEDTLS_SSL_DEBUG_MSG( 3,
727 ( "ssl_tls13_pick_key_cert:"
728 "selected signature algorithm"
729 " %s [%04x]",
730 mbedtls_ssl_sig_alg_to_str( *sig_alg ),
731 *sig_alg ) );
XiaokangQianfb665a82022-06-15 03:57:21 +0000732 MBEDTLS_SSL_DEBUG_CRT(
XiaokangQian75fe8c72022-06-15 09:42:45 +0000733 3, "selected certificate (chain)",
XiaokangQianfb665a82022-06-15 03:57:21 +0000734 ssl->handshake->key_cert->cert );
XiaokangQian81802f42022-06-10 13:25:22 +0000735 return( 0 );
736 }
XiaokangQian81802f42022-06-10 13:25:22 +0000737 }
XiaokangQian23c5be62022-06-07 02:04:34 +0000738 }
739
Jerry Yu9d3e2fa2022-06-27 22:14:01 +0800740 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ssl_tls13_pick_key_cert:"
741 "no suitable certificate found" ) );
XiaokangQian23c5be62022-06-07 02:04:34 +0000742 return( -1 );
743}
XiaokangQian81802f42022-06-10 13:25:22 +0000744#endif /* MBEDTLS_X509_CRT_PARSE_C &&
745 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
XiaokangQian23c5be62022-06-07 02:04:34 +0000746
XiaokangQian4080a7f2022-04-11 09:55:18 +0000747/*
XiaokangQianed582dd2022-04-13 08:21:05 +0000748 *
749 * STATE HANDLING: ClientHello
750 *
XiaokangQianb67384d2022-04-19 00:02:38 +0000751 * There are three possible classes of outcomes when parsing the ClientHello:
XiaokangQianed582dd2022-04-13 08:21:05 +0000752 *
XiaokangQianb67384d2022-04-19 00:02:38 +0000753 * 1) The ClientHello was well-formed and matched the server's configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +0000754 *
755 * In this case, the server progresses to sending its ServerHello.
756 *
XiaokangQianb67384d2022-04-19 00:02:38 +0000757 * 2) The ClientHello was well-formed but didn't match the server's
758 * configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +0000759 *
760 * For example, the client might not have offered a key share which
761 * the server supports, or the server might require a cookie.
762 *
763 * In this case, the server sends a HelloRetryRequest.
764 *
XiaokangQianb67384d2022-04-19 00:02:38 +0000765 * 3) The ClientHello was ill-formed
XiaokangQianed582dd2022-04-13 08:21:05 +0000766 *
767 * In this case, we abort the handshake.
768 *
769 */
770
771/*
XiaokangQian4080a7f2022-04-11 09:55:18 +0000772 * Structure of this message:
773 *
XiaokangQiane8ff3502022-04-22 02:34:40 +0000774 * uint16 ProtocolVersion;
775 * opaque Random[32];
776 * uint8 CipherSuite[2]; // Cryptographic suite selector
XiaokangQian4080a7f2022-04-11 09:55:18 +0000777 *
XiaokangQiane8ff3502022-04-22 02:34:40 +0000778 * struct {
779 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
780 * Random random;
781 * opaque legacy_session_id<0..32>;
782 * CipherSuite cipher_suites<2..2^16-2>;
783 * opaque legacy_compression_methods<1..2^8-1>;
784 * Extension extensions<8..2^16-1>;
785 * } ClientHello;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000786 */
XiaokangQianed582dd2022-04-13 08:21:05 +0000787
788#define SSL_CLIENT_HELLO_OK 0
789#define SSL_CLIENT_HELLO_HRR_REQUIRED 1
790
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200791MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian4080a7f2022-04-11 09:55:18 +0000792static int ssl_tls13_parse_client_hello( mbedtls_ssl_context *ssl,
793 const unsigned char *buf,
794 const unsigned char *end )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000795{
XiaokangQianb67384d2022-04-19 00:02:38 +0000796 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
797 const unsigned char *p = buf;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000798 size_t legacy_session_id_len;
XiaokangQian060d8672022-04-21 09:24:56 +0000799 const unsigned char *cipher_suites;
XiaokangQian318dc762022-04-20 09:43:51 +0000800 size_t cipher_suites_len;
XiaokangQian060d8672022-04-21 09:24:56 +0000801 const unsigned char *cipher_suites_end;
XiaokangQianb67384d2022-04-19 00:02:38 +0000802 size_t extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000803 const unsigned char *extensions_end;
Jerry Yu49ca9282022-05-05 11:05:22 +0800804 int hrr_required = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000805
XiaokangQian7807f9f2022-02-15 10:04:37 +0000806 const mbedtls_ssl_ciphersuite_t* ciphersuite_info;
Jerry Yu1c105562022-07-10 06:32:38 +0000807#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
808 const unsigned char *pre_shared_key_ext_start = NULL;
809 const unsigned char *pre_shared_key_ext_end = NULL;
810#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000811
812 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
813
814 /*
XiaokangQianb67384d2022-04-19 00:02:38 +0000815 * ClientHello layout:
XiaokangQian7807f9f2022-02-15 10:04:37 +0000816 * 0 . 1 protocol version
XiaokangQiane8ff3502022-04-22 02:34:40 +0000817 * 2 . 33 random bytes
XiaokangQianc5763b52022-04-02 03:34:37 +0000818 * 34 . 34 session id length ( 1 byte )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000819 * 35 . 34+x session id
XiaokangQian7807f9f2022-02-15 10:04:37 +0000820 * .. . .. ciphersuite list length ( 2 bytes )
821 * .. . .. ciphersuite list
822 * .. . .. compression alg. list length ( 1 byte )
823 * .. . .. compression alg. list
824 * .. . .. extensions length ( 2 bytes, optional )
825 * .. . .. extensions ( optional )
826 */
827
XiaokangQianb67384d2022-04-19 00:02:38 +0000828 /*
bootstrap-prime6dbbf442022-05-17 19:30:44 -0400829 * Minimal length ( with everything empty and extensions omitted ) is
XiaokangQian7807f9f2022-02-15 10:04:37 +0000830 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
831 * read at least up to session id length without worrying.
832 */
833 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 38 );
834
835 /* ...
836 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
837 * ...
838 * with ProtocolVersion defined as:
839 * uint16 ProtocolVersion;
840 */
XiaokangQiande333912022-04-20 08:49:42 +0000841 if( mbedtls_ssl_read_version( p, ssl->conf->transport ) !=
842 MBEDTLS_SSL_VERSION_TLS1_2 )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000843 {
844 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
845 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
846 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
XiaokangQianb67384d2022-04-19 00:02:38 +0000847 return ( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000848 }
849 p += 2;
850
851 /*
XiaokangQianf8ceb942022-04-15 11:43:27 +0000852 * Only support TLS 1.3 currently, temporarily set the version.
853 */
XiaokangQiande333912022-04-20 08:49:42 +0000854 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
XiaokangQianf8ceb942022-04-15 11:43:27 +0000855
Jerry Yuc1be19f2022-04-23 16:11:39 +0800856 /* ...
857 * Random random;
858 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +0000859 * with Random defined as:
860 * opaque Random[32];
XiaokangQian7807f9f2022-02-15 10:04:37 +0000861 */
XiaokangQian4080a7f2022-04-11 09:55:18 +0000862 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
XiaokangQian08037552022-04-20 07:16:41 +0000863 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000864
XiaokangQian08037552022-04-20 07:16:41 +0000865 memcpy( &ssl->handshake->randbytes[0], p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
866 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000867
Jerry Yuc1be19f2022-04-23 16:11:39 +0800868 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +0000869 * opaque legacy_session_id<0..32>;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800870 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +0000871 */
XiaokangQian4080a7f2022-04-11 09:55:18 +0000872 legacy_session_id_len = p[0];
XiaokangQianc5763b52022-04-02 03:34:37 +0000873 p++;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000874
XiaokangQianb67384d2022-04-19 00:02:38 +0000875 if( legacy_session_id_len > sizeof( ssl->session_negotiate->id ) )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000876 {
877 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
878 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
879 }
880
XiaokangQian4080a7f2022-04-11 09:55:18 +0000881 ssl->session_negotiate->id_len = legacy_session_id_len;
XiaokangQianed582dd2022-04-13 08:21:05 +0000882 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
XiaokangQiane8ff3502022-04-22 02:34:40 +0000883 p, legacy_session_id_len );
XiaokangQianb67384d2022-04-19 00:02:38 +0000884 /*
885 * Check we have enough data for the legacy session identifier
886 * and the ciphersuite list length.
887 */
888 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_len + 2 );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000889
XiaokangQianed582dd2022-04-13 08:21:05 +0000890 memcpy( &ssl->session_negotiate->id[0], p, legacy_session_id_len );
XiaokangQian4080a7f2022-04-11 09:55:18 +0000891 p += legacy_session_id_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000892
XiaokangQian7807f9f2022-02-15 10:04:37 +0000893 cipher_suites_len = MBEDTLS_GET_UINT16_BE( p, 0 );
894 p += 2;
895
XiaokangQianb67384d2022-04-19 00:02:38 +0000896 /* Check we have enough data for the ciphersuite list, the legacy
897 * compression methods and the length of the extensions.
898 */
899 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cipher_suites_len + 2 + 2 );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000900
Jerry Yuc1be19f2022-04-23 16:11:39 +0800901 /* ...
XiaokangQian08037552022-04-20 07:16:41 +0000902 * CipherSuite cipher_suites<2..2^16-2>;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800903 * ...
XiaokangQian08037552022-04-20 07:16:41 +0000904 * with CipherSuite defined as:
905 * uint8 CipherSuite[2];
906 */
XiaokangQian060d8672022-04-21 09:24:56 +0000907 cipher_suites = p;
908 cipher_suites_end = p + cipher_suites_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000909 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
910 p, cipher_suites_len );
XiaokangQian17f974c2022-04-19 09:57:41 +0000911 /*
912 * Search for a matching ciphersuite
913 */
XiaokangQian318dc762022-04-20 09:43:51 +0000914 int ciphersuite_match = 0;
XiaokangQian060d8672022-04-21 09:24:56 +0000915 for ( ; p < cipher_suites_end; p += 2 )
XiaokangQian17f974c2022-04-19 09:57:41 +0000916 {
XiaokangQiane8ff3502022-04-22 02:34:40 +0000917 uint16_t cipher_suite;
918 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, cipher_suites_end, 2 );
919 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
920 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
XiaokangQian08037552022-04-20 07:16:41 +0000921 /*
XiaokangQiane8ff3502022-04-22 02:34:40 +0000922 * Check whether this ciphersuite is valid and offered.
923 */
XiaokangQian08037552022-04-20 07:16:41 +0000924 if( ( mbedtls_ssl_validate_ciphersuite(
Jerry Yuc1be19f2022-04-23 16:11:39 +0800925 ssl, ciphersuite_info, ssl->tls_version,
926 ssl->tls_version ) != 0 ) ||
927 ! mbedtls_ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) )
928 {
XiaokangQian08037552022-04-20 07:16:41 +0000929 continue;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800930 }
XiaokangQian7807f9f2022-02-15 10:04:37 +0000931
XiaokangQian08037552022-04-20 07:16:41 +0000932 ssl->session_negotiate->ciphersuite = cipher_suite;
933 ssl->handshake->ciphersuite_info = ciphersuite_info;
XiaokangQian318dc762022-04-20 09:43:51 +0000934 ciphersuite_match = 1;
XiaokangQian17f974c2022-04-19 09:57:41 +0000935
XiaokangQian08037552022-04-20 07:16:41 +0000936 break;
XiaokangQian17f974c2022-04-19 09:57:41 +0000937
XiaokangQian17f974c2022-04-19 09:57:41 +0000938 }
939
Jerry Yuc1be19f2022-04-23 16:11:39 +0800940 if( ! ciphersuite_match )
XiaokangQian318dc762022-04-20 09:43:51 +0000941 {
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000942 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
943 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
944 return ( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
XiaokangQian318dc762022-04-20 09:43:51 +0000945 }
XiaokangQian17f974c2022-04-19 09:57:41 +0000946
947 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s",
948 ciphersuite_info->name ) );
949
XiaokangQian060d8672022-04-21 09:24:56 +0000950 p = cipher_suites + cipher_suites_len;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800951
XiaokangQian4080a7f2022-04-11 09:55:18 +0000952 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +0000953 * opaque legacy_compression_methods<1..2^8-1>;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000954 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +0000955 */
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000956 if( p[0] != 1 || p[1] != MBEDTLS_SSL_COMPRESS_NULL )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000957 {
XiaokangQian4080a7f2022-04-11 09:55:18 +0000958 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
959 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
960 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
961 return ( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000962 }
XiaokangQianb67384d2022-04-19 00:02:38 +0000963 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000964
Jerry Yuc1be19f2022-04-23 16:11:39 +0800965 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +0000966 * Extension extensions<8..2^16-1>;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800967 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +0000968 * with Extension defined as:
969 * struct {
970 * ExtensionType extension_type;
971 * opaque extension_data<0..2^16-1>;
972 * } Extension;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000973 */
XiaokangQian4080a7f2022-04-11 09:55:18 +0000974 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000975 p += 2;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000976 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
XiaokangQiane8ff3502022-04-22 02:34:40 +0000977 extensions_end = p + extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000978
XiaokangQian4080a7f2022-04-11 09:55:18 +0000979 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p, extensions_len );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000980
981 while( p < extensions_end )
982 {
983 unsigned int extension_type;
984 size_t extension_data_len;
985 const unsigned char *extension_data_end;
986
XiaokangQian318dc762022-04-20 09:43:51 +0000987 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
XiaokangQian7807f9f2022-02-15 10:04:37 +0000988 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
989 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
990 p += 4;
991
992 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
993 extension_data_end = p + extension_data_len;
994
995 switch( extension_type )
996 {
XiaokangQian40a35232022-05-07 09:02:40 +0000997#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
998 case MBEDTLS_TLS_EXT_SERVERNAME:
999 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
XiaokangQian9b2b7712022-05-17 02:57:00 +00001000 ret = mbedtls_ssl_parse_server_name_ext( ssl, p,
1001 extension_data_end );
XiaokangQian40a35232022-05-07 09:02:40 +00001002 if( ret != 0 )
1003 {
1004 MBEDTLS_SSL_DEBUG_RET(
1005 1, "mbedtls_ssl_parse_servername_ext", ret );
1006 return( ret );
1007 }
1008 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SERVERNAME;
1009 break;
1010#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1011
XiaokangQianb67384d2022-04-19 00:02:38 +00001012#if defined(MBEDTLS_ECDH_C)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001013 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1014 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported group extension" ) );
1015
1016 /* Supported Groups Extension
1017 *
1018 * When sent by the client, the "supported_groups" extension
1019 * indicates the named groups which the client supports,
1020 * ordered from most preferred to least preferred.
1021 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001022 ret = ssl_tls13_parse_supported_groups_ext(
1023 ssl, p, extension_data_end );
XiaokangQian7807f9f2022-02-15 10:04:37 +00001024 if( ret != 0 )
1025 {
1026 MBEDTLS_SSL_DEBUG_RET( 1,
1027 "mbedtls_ssl_parse_supported_groups_ext", ret );
1028 return( ret );
1029 }
1030
1031 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
1032 break;
XiaokangQianb67384d2022-04-19 00:02:38 +00001033#endif /* MBEDTLS_ECDH_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001034
XiaokangQian88408882022-04-02 10:15:03 +00001035#if defined(MBEDTLS_ECDH_C)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001036 case MBEDTLS_TLS_EXT_KEY_SHARE:
1037 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key share extension" ) );
1038
1039 /*
1040 * Key Share Extension
1041 *
1042 * When sent by the client, the "key_share" extension
1043 * contains the endpoint's cryptographic parameters for
1044 * ECDHE/DHE key establishment methods.
1045 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001046 ret = ssl_tls13_parse_key_shares_ext(
1047 ssl, p, extension_data_end );
XiaokangQian08037552022-04-20 07:16:41 +00001048 if( ret == SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH )
XiaokangQian7807f9f2022-02-15 10:04:37 +00001049 {
XiaokangQianed582dd2022-04-13 08:21:05 +00001050 MBEDTLS_SSL_DEBUG_MSG( 2, ( "HRR needed " ) );
Jerry Yu49ca9282022-05-05 11:05:22 +08001051 hrr_required = 1;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001052 }
1053
Jerry Yu582dd062022-04-22 21:59:01 +08001054 if( ret < 0 )
1055 {
1056 MBEDTLS_SSL_DEBUG_RET(
1057 1, "ssl_tls13_parse_key_shares_ext", ret );
XiaokangQian7807f9f2022-02-15 10:04:37 +00001058 return( ret );
Jerry Yu582dd062022-04-22 21:59:01 +08001059 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001060
1061 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
1062 break;
XiaokangQian88408882022-04-02 10:15:03 +00001063#endif /* MBEDTLS_ECDH_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001064
1065 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
1066 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported versions extension" ) );
1067
1068 ret = ssl_tls13_parse_supported_versions_ext(
Jerry Yuc1be19f2022-04-23 16:11:39 +08001069 ssl, p, extension_data_end );
XiaokangQian7807f9f2022-02-15 10:04:37 +00001070 if( ret != 0 )
1071 {
1072 MBEDTLS_SSL_DEBUG_RET( 1,
1073 ( "ssl_tls13_parse_supported_versions_ext" ), ret );
1074 return( ret );
1075 }
1076 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS;
1077 break;
1078
Jerry Yue19e3b92022-07-08 12:04:51 +00001079#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
1080 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
1081 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found psk key exchange modes extension" ) );
1082
1083 ret = ssl_tls13_parse_key_exchange_modes_ext(
1084 ssl, p, extension_data_end );
1085 if( ret != 0 )
1086 {
1087 MBEDTLS_SSL_DEBUG_RET(
1088 1, "ssl_tls13_parse_key_exchange_modes_ext", ret );
1089 return( ret );
1090 }
1091
1092 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES;
1093 break;
1094#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1095
Jerry Yu1c105562022-07-10 06:32:38 +00001096#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
1097 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1098 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension" ) );
1099 /* Delay processing of the PSK identity once we have
1100 * found out which algorithms to use. We keep a pointer
1101 * to the buffer and the size for later processing.
1102 */
1103 pre_shared_key_ext_start = p;
1104 pre_shared_key_ext_end = extension_data_end;
1105
1106 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_PRE_SHARED_KEY;
1107 break;
1108#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1109
XiaokangQianacb39922022-06-17 10:18:48 +00001110#if defined(MBEDTLS_SSL_ALPN)
1111 case MBEDTLS_TLS_EXT_ALPN:
1112 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
1113
1114 ret = mbedtls_ssl_parse_alpn_ext( ssl, p, extension_data_end );
1115 if( ret != 0 )
1116 {
1117 MBEDTLS_SSL_DEBUG_RET(
1118 1, ( "mbedtls_ssl_parse_alpn_ext" ), ret );
1119 return( ret );
1120 }
1121 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_ALPN;
1122 break;
1123#endif /* MBEDTLS_SSL_ALPN */
1124
XiaokangQian7807f9f2022-02-15 10:04:37 +00001125#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1126 case MBEDTLS_TLS_EXT_SIG_ALG:
1127 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1128
Gabor Mezei078e8032022-04-27 21:17:56 +02001129 ret = mbedtls_ssl_parse_sig_alg_ext(
Jerry Yuc1be19f2022-04-23 16:11:39 +08001130 ssl, p, extension_data_end );
XiaokangQian7807f9f2022-02-15 10:04:37 +00001131 if( ret != 0 )
1132 {
1133 MBEDTLS_SSL_DEBUG_MSG( 1,
1134 ( "ssl_parse_supported_signature_algorithms_server_ext ( %d )",
1135 ret ) );
1136 return( ret );
1137 }
1138 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG;
1139 break;
1140#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1141
1142 default:
1143 MBEDTLS_SSL_DEBUG_MSG( 3,
1144 ( "unknown extension found: %ud ( ignoring )",
1145 extension_type ) );
1146 }
1147
1148 p += extension_data_len;
1149 }
1150
Jerry Yu1c105562022-07-10 06:32:38 +00001151
1152#if defined(MBEDTLS_DEBUG_C)
1153 /* List all the extensions we have received */
1154 ssl_tls13_debug_print_client_hello_exts( ssl );
1155#endif /* MBEDTLS_DEBUG_C */
1156
1157 mbedtls_ssl_add_hs_hdr_to_checksum( ssl,
1158 MBEDTLS_SSL_HS_CLIENT_HELLO,
1159 p - buf );
1160#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001161 /* Update checksum with either
1162 * - The entire content of the CH message, if no PSK extension is present
1163 * - The content up to but excluding the PSK extension, if present.
1164 */
Jerry Yu1c105562022-07-10 06:32:38 +00001165 /* If we've settled on a PSK-based exchange, parse PSK identity ext */
1166 if( mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) &&
1167 ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PRE_SHARED_KEY ) )
1168 {
1169 ssl->handshake->update_checksum( ssl, buf,
1170 pre_shared_key_ext_start - buf );
1171 ret = ssl_tls13_parse_offered_psks_ext( ssl,
1172 pre_shared_key_ext_start,
1173 pre_shared_key_ext_end );
1174 if( ret != 0 )
1175 {
1176 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_tls13_parse_offered_psks_ext" ),
1177 ret );
1178 return( ret );
1179 }
1180 /* If pre_shared_key is not last extension */
1181 if( p - pre_shared_key_ext_end )
1182 {
1183 ssl->handshake->update_checksum( ssl,
1184 pre_shared_key_ext_end,
1185 p - pre_shared_key_ext_end );
1186 }
1187 }
1188 else
1189#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
1190 {
1191 ssl->handshake->update_checksum( ssl, buf, p - buf );
1192 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001193
XiaokangQian75fe8c72022-06-15 09:42:45 +00001194 return( hrr_required ? SSL_CLIENT_HELLO_HRR_REQUIRED : SSL_CLIENT_HELLO_OK );
1195}
1196
1197/* Update the handshake state machine */
1198
Ronald Cronce7d76e2022-07-08 18:56:49 +02001199MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQian75fe8c72022-06-15 09:42:45 +00001200static int ssl_tls13_postprocess_client_hello( mbedtls_ssl_context* ssl )
1201{
1202 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1203
XiaokangQian7807f9f2022-02-15 10:04:37 +00001204 /*
XiaokangQianb67384d2022-04-19 00:02:38 +00001205 * Here we only support the ephemeral or (EC)DHE key echange mode
XiaokangQian7807f9f2022-02-15 10:04:37 +00001206 */
XiaokangQianb67384d2022-04-19 00:02:38 +00001207 if( !ssl_tls13_check_ephemeral_key_exchange( ssl ) )
XiaokangQian7807f9f2022-02-15 10:04:37 +00001208 {
1209 MBEDTLS_SSL_DEBUG_MSG(
1210 1,
1211 ( "ClientHello message misses mandatory extensions." ) );
1212 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION ,
1213 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1214 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1215 }
1216
XiaokangQianfb665a82022-06-15 03:57:21 +00001217 /*
1218 * Server certificate selection
1219 */
1220 if( ssl->conf->f_cert_cb && ( ret = ssl->conf->f_cert_cb( ssl ) ) != 0 )
1221 {
1222 MBEDTLS_SSL_DEBUG_RET( 1, "f_cert_cb", ret );
1223 return( ret );
1224 }
1225#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1226 ssl->handshake->sni_name = NULL;
1227 ssl->handshake->sni_name_len = 0;
1228#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001229
XiaokangQian7807f9f2022-02-15 10:04:37 +00001230 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
1231 if( ret != 0 )
1232 {
1233 MBEDTLS_SSL_DEBUG_RET( 1,
1234 "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret );
1235 return( ret );
1236 }
1237
XiaokangQian7807f9f2022-02-15 10:04:37 +00001238 return( 0 );
1239
1240}
1241
1242/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001243 * Main entry point from the state machine; orchestrates the otherfunctions.
1244 */
1245
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001246MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianed582dd2022-04-13 08:21:05 +00001247static int ssl_tls13_process_client_hello( mbedtls_ssl_context *ssl )
1248{
1249
XiaokangQian08037552022-04-20 07:16:41 +00001250 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQianed582dd2022-04-13 08:21:05 +00001251 unsigned char* buf = NULL;
1252 size_t buflen = 0;
Jerry Yu4ca91402022-05-09 15:50:57 +08001253 int parse_client_hello_ret;
1254
XiaokangQianed582dd2022-04-13 08:21:05 +00001255 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
1256
XiaokangQianed582dd2022-04-13 08:21:05 +00001257 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg(
1258 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
1259 &buf, &buflen ) );
1260
1261 MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_parse_client_hello( ssl, buf,
1262 buf + buflen ) );
Jerry Yuf41553b2022-05-09 22:20:30 +08001263 parse_client_hello_ret = ret; /* Store return value of parse_client_hello,
1264 * only SSL_CLIENT_HELLO_OK or
1265 * SSL_CLIENT_HELLO_HRR_REQUIRED at this
1266 * stage as negative error codes are handled
1267 * by MBEDTLS_SSL_PROC_CHK_NEG. */
Jerry Yu4ca91402022-05-09 15:50:57 +08001268
XiaokangQiancfd925f2022-04-14 07:10:37 +00001269 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_client_hello( ssl ) );
Jerry Yu582dd062022-04-22 21:59:01 +08001270
Jerry Yu4ca91402022-05-09 15:50:57 +08001271 if( parse_client_hello_ret == SSL_CLIENT_HELLO_OK )
1272 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
1273 else
1274 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST );
XiaokangQianed582dd2022-04-13 08:21:05 +00001275
1276cleanup:
1277
1278 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
1279 return( ret );
1280}
1281
1282/*
Jerry Yu1c3e6882022-04-20 21:23:40 +08001283 * Handler for MBEDTLS_SSL_SERVER_HELLO
Jerry Yu5b64ae92022-03-30 17:15:02 +08001284 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001285MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf4b27e42022-03-30 17:32:21 +08001286static int ssl_tls13_prepare_server_hello( mbedtls_ssl_context *ssl )
1287{
Jerry Yu637a3f12022-04-20 21:37:58 +08001288 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1289 unsigned char *server_randbytes =
Jerry Yu3bf2c642022-03-30 22:02:12 +08001290 ssl->handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001291 if( ssl->conf->f_rng == NULL )
1292 {
1293 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
1294 return( MBEDTLS_ERR_SSL_NO_RNG );
1295 }
1296
Jerry Yu637a3f12022-04-20 21:37:58 +08001297 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, server_randbytes,
Jerry Yuf4b27e42022-03-30 17:32:21 +08001298 MBEDTLS_SERVER_HELLO_RANDOM_LEN ) ) != 0 )
1299 {
1300 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
1301 return( ret );
1302 }
1303
Jerry Yu637a3f12022-04-20 21:37:58 +08001304 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", server_randbytes,
Jerry Yuf4b27e42022-03-30 17:32:21 +08001305 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1306
1307#if defined(MBEDTLS_HAVE_TIME)
1308 ssl->session_negotiate->start = time( NULL );
1309#endif /* MBEDTLS_HAVE_TIME */
1310
1311 return( ret );
1312}
1313
Jerry Yu3bf2c642022-03-30 22:02:12 +08001314/*
Jerry Yue74e04a2022-04-21 09:23:16 +08001315 * ssl_tls13_write_server_hello_supported_versions_ext ():
Jerry Yu3bf2c642022-03-30 22:02:12 +08001316 *
1317 * struct {
Jerry Yufb9f54d2022-04-06 10:08:34 +08001318 * ProtocolVersion selected_version;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001319 * } SupportedVersions;
1320 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001321MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yue74e04a2022-04-21 09:23:16 +08001322static int ssl_tls13_write_server_hello_supported_versions_ext(
1323 mbedtls_ssl_context *ssl,
1324 unsigned char *buf,
1325 unsigned char *end,
1326 size_t *out_len )
Jerry Yu3bf2c642022-03-30 22:02:12 +08001327{
Jerry Yu3bf2c642022-03-30 22:02:12 +08001328 *out_len = 0;
1329
Jerry Yu955ddd72022-04-22 22:27:33 +08001330 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, write selected version" ) );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001331
1332 /* Check if we have space to write the extension:
1333 * - extension_type (2 bytes)
1334 * - extension_data_length (2 bytes)
Jerry Yu349a6132022-04-14 20:52:56 +08001335 * - selected_version (2 bytes)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001336 */
Jerry Yu349a6132022-04-14 20:52:56 +08001337 MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 6 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001338
Jerry Yu349a6132022-04-14 20:52:56 +08001339 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, buf, 0 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001340
Jerry Yu349a6132022-04-14 20:52:56 +08001341 MBEDTLS_PUT_UINT16_BE( 2, buf, 2 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001342
Jerry Yu349a6132022-04-14 20:52:56 +08001343 mbedtls_ssl_write_version( buf + 4,
1344 ssl->conf->transport,
1345 ssl->tls_version );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001346
1347 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%04x]",
1348 ssl->tls_version ) );
1349
Jerry Yu349a6132022-04-14 20:52:56 +08001350 *out_len = 6;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001351
1352 return( 0 );
1353}
1354
Jerry Yud9436a12022-04-20 22:28:09 +08001355
Jerry Yu3bf2c642022-03-30 22:02:12 +08001356
1357/* Generate and export a single key share. For hybrid KEMs, this can
1358 * be called multiple times with the different components of the hybrid. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001359MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu955ddd72022-04-22 22:27:33 +08001360static int ssl_tls13_generate_and_write_key_share( mbedtls_ssl_context *ssl,
1361 uint16_t named_group,
1362 unsigned char *buf,
1363 unsigned char *end,
1364 size_t *out_len )
Jerry Yu3bf2c642022-03-30 22:02:12 +08001365{
1366 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu955ddd72022-04-22 22:27:33 +08001367
1368 *out_len = 0;
1369
Jerry Yu89e103c2022-03-30 22:43:29 +08001370#if defined(MBEDTLS_ECDH_C)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001371 if( mbedtls_ssl_tls13_named_group_is_ecdhe( named_group ) )
1372 {
Jerry Yu89e103c2022-03-30 22:43:29 +08001373 ret = mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange(
1374 ssl, named_group, buf, end, out_len );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001375 if( ret != 0 )
1376 {
Jerry Yu89e103c2022-03-30 22:43:29 +08001377 MBEDTLS_SSL_DEBUG_RET(
1378 1, "mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange",
1379 ret );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001380 return( ret );
1381 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08001382 }
Jerry Yu89e103c2022-03-30 22:43:29 +08001383 else
1384#endif /* MBEDTLS_ECDH_C */
1385 if( 0 /* Other kinds of KEMs */ )
Jerry Yu3bf2c642022-03-30 22:02:12 +08001386 {
1387 }
1388 else
1389 {
Jerry Yu955ddd72022-04-22 22:27:33 +08001390 ((void) ssl);
1391 ((void) named_group);
1392 ((void) buf);
1393 ((void) end);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001394 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1395 }
1396
1397 return( ret );
1398}
1399
1400/*
1401 * ssl_tls13_write_key_share_ext
1402 *
1403 * Structure of key_share extension in ServerHello:
1404 *
Jerry Yu1c3e6882022-04-20 21:23:40 +08001405 * struct {
1406 * NamedGroup group;
1407 * opaque key_exchange<1..2^16-1>;
1408 * } KeyShareEntry;
1409 * struct {
1410 * KeyShareEntry server_share;
1411 * } KeyShareServerHello;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001412 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001413MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu3bf2c642022-03-30 22:02:12 +08001414static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
1415 unsigned char *buf,
1416 unsigned char *end,
1417 size_t *out_len )
1418{
Jerry Yu955ddd72022-04-22 22:27:33 +08001419 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001420 unsigned char *p = buf;
Jerry Yu57d48412022-04-20 21:50:42 +08001421 uint16_t group = ssl->handshake->offered_group_id;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001422 unsigned char *server_share = buf + 4;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001423 size_t key_exchange_length;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001424
1425 *out_len = 0;
1426
1427 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding key share extension" ) );
1428
1429 /* Check if we have space for header and length fields:
1430 * - extension_type (2 bytes)
1431 * - extension_data_length (2 bytes)
1432 * - group (2 bytes)
1433 * - key_exchange_length (2 bytes)
1434 */
1435 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 8 );
Jerry Yu57d48412022-04-20 21:50:42 +08001436 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, p, 0 );
1437 MBEDTLS_PUT_UINT16_BE( group, server_share, 0 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001438 p += 8;
Jerry Yu57d48412022-04-20 21:50:42 +08001439
Jerry Yu3bf2c642022-03-30 22:02:12 +08001440 /* When we introduce PQC-ECDHE hybrids, we'll want to call this
1441 * function multiple times. */
Jerry Yu955ddd72022-04-22 22:27:33 +08001442 ret = ssl_tls13_generate_and_write_key_share(
Jerry Yue65d8012022-04-23 10:34:35 +08001443 ssl, group, server_share + 4, end, &key_exchange_length );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001444 if( ret != 0 )
1445 return( ret );
1446 p += key_exchange_length;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001447
Jerry Yu955ddd72022-04-22 22:27:33 +08001448 MBEDTLS_PUT_UINT16_BE( key_exchange_length, server_share + 2, 0 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001449
Jerry Yu57d48412022-04-20 21:50:42 +08001450 MBEDTLS_PUT_UINT16_BE( p - server_share, buf, 2 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001451
Jerry Yu57d48412022-04-20 21:50:42 +08001452 *out_len = p - buf;
Jerry Yu955ddd72022-04-22 22:27:33 +08001453
Jerry Yu3bf2c642022-03-30 22:02:12 +08001454 return( 0 );
1455}
Jerry Yud9436a12022-04-20 22:28:09 +08001456
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001457MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001458static int ssl_tls13_write_hrr_key_share_ext( mbedtls_ssl_context *ssl,
1459 unsigned char *buf,
1460 unsigned char *end,
1461 size_t *out_len )
1462{
1463 uint16_t selected_group = ssl->handshake->hrr_selected_group;
1464 /* key_share Extension
1465 *
1466 * struct {
1467 * select (Handshake.msg_type) {
1468 * ...
1469 * case hello_retry_request:
1470 * NamedGroup selected_group;
1471 * ...
1472 * };
1473 * } KeyShare;
1474 */
1475
1476 *out_len = 0;
1477
Jerry Yub0ac10b2022-05-05 11:10:08 +08001478 /*
1479 * For a pure PSK key exchange, there is no group to agree upon. The purpose
1480 * of the HRR is then to transmit a cookie to force the client to demonstrate
1481 * reachability at their apparent network address (primarily useful for DTLS).
1482 */
Ronald Cron79907712022-07-20 17:05:29 +02001483 if( ! mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral( ssl ) )
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001484 return( 0 );
1485
1486 /* We should only send the key_share extension if the client's initial
1487 * key share was not acceptable. */
1488 if( ssl->handshake->offered_group_id != 0 )
1489 {
1490 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Skip key_share extension in HRR" ) );
1491 return( 0 );
1492 }
1493
1494 if( selected_group == 0 )
1495 {
1496 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching named group found" ) );
1497 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1498 }
1499
Jerry Yub0ac10b2022-05-05 11:10:08 +08001500 /* Check if we have enough space:
1501 * - extension_type (2 bytes)
1502 * - extension_data_length (2 bytes)
1503 * - selected_group (2 bytes)
1504 */
Ronald Cron154d1b62022-06-01 15:33:26 +02001505 MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 6 );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001506
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001507 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001508 MBEDTLS_PUT_UINT16_BE( 2, buf, 2 );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001509 MBEDTLS_PUT_UINT16_BE( selected_group, buf, 4 );
1510
1511 MBEDTLS_SSL_DEBUG_MSG( 3,
1512 ( "HRR selected_group: %s (%x)",
1513 mbedtls_ssl_named_group_to_str( selected_group ),
1514 selected_group ) );
1515
1516 *out_len = 6;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001517
Jerry Yub0ac10b2022-05-05 11:10:08 +08001518 return( 0 );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001519}
Jerry Yu3bf2c642022-03-30 22:02:12 +08001520
1521/*
1522 * Structure of ServerHello message:
1523 *
1524 * struct {
1525 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
1526 * Random random;
1527 * opaque legacy_session_id_echo<0..32>;
1528 * CipherSuite cipher_suite;
1529 * uint8 legacy_compression_method = 0;
1530 * Extension extensions<6..2^16-1>;
1531 * } ServerHello;
1532 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001533MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu3bf2c642022-03-30 22:02:12 +08001534static int ssl_tls13_write_server_hello_body( mbedtls_ssl_context *ssl,
Jerry Yu56404d72022-03-30 17:36:13 +08001535 unsigned char *buf,
1536 unsigned char *end,
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001537 size_t *out_len,
1538 int is_hrr )
Jerry Yu56404d72022-03-30 17:36:13 +08001539{
Jerry Yu955ddd72022-04-22 22:27:33 +08001540 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001541 unsigned char *p = buf;
Jerry Yud9436a12022-04-20 22:28:09 +08001542 unsigned char *p_extensions_len;
Jerry Yufbe3e642022-04-25 19:31:51 +08001543 size_t output_len;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001544
1545 *out_len = 0;
1546
Jerry Yucfc04b32022-04-21 09:31:58 +08001547 /* ...
1548 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1549 * ...
1550 * with ProtocolVersion defined as:
1551 * uint16 ProtocolVersion;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001552 */
1553 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1554 MBEDTLS_PUT_UINT16_BE( 0x0303, p, 0 );
1555 p += 2;
1556
Jerry Yu1c3e6882022-04-20 21:23:40 +08001557 /* ...
1558 * Random random;
1559 * ...
Jerry Yucfc04b32022-04-21 09:31:58 +08001560 * with Random defined as:
1561 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu1c3e6882022-04-20 21:23:40 +08001562 */
Jerry Yu3bf2c642022-03-30 22:02:12 +08001563 MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001564 if( is_hrr )
1565 {
1566 memcpy( p, mbedtls_ssl_tls13_hello_retry_request_magic,
Jerry Yufbe3e642022-04-25 19:31:51 +08001567 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001568 }
1569 else
1570 {
1571 memcpy( p, &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN],
Jerry Yufbe3e642022-04-25 19:31:51 +08001572 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001573 }
Jerry Yu955ddd72022-04-22 22:27:33 +08001574 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
Jerry Yu3bf2c642022-03-30 22:02:12 +08001575 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1576 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
1577
Jerry Yucfc04b32022-04-21 09:31:58 +08001578 /* ...
1579 * opaque legacy_session_id_echo<0..32>;
1580 * ...
Jerry Yu3bf2c642022-03-30 22:02:12 +08001581 */
1582 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 + ssl->session_negotiate->id_len );
1583 *p++ = (unsigned char)ssl->session_negotiate->id_len;
1584 if( ssl->session_negotiate->id_len > 0 )
1585 {
1586 memcpy( p, &ssl->session_negotiate->id[0],
1587 ssl->session_negotiate->id_len );
1588 p += ssl->session_negotiate->id_len;
Jerry Yu955ddd72022-04-22 22:27:33 +08001589
Jerry Yu3bf2c642022-03-30 22:02:12 +08001590 MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
1591 ssl->session_negotiate->id_len );
1592 }
1593
Jerry Yucfc04b32022-04-21 09:31:58 +08001594 /* ...
1595 * CipherSuite cipher_suite;
1596 * ...
1597 * with CipherSuite defined as:
1598 * uint8 CipherSuite[2];
Jerry Yu3bf2c642022-03-30 22:02:12 +08001599 */
1600 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1601 MBEDTLS_PUT_UINT16_BE( ssl->session_negotiate->ciphersuite, p, 0 );
1602 p += 2;
1603 MBEDTLS_SSL_DEBUG_MSG( 3,
1604 ( "server hello, chosen ciphersuite: %s ( id=%d )",
1605 mbedtls_ssl_get_ciphersuite_name(
1606 ssl->session_negotiate->ciphersuite ),
1607 ssl->session_negotiate->ciphersuite ) );
1608
Jerry Yucfc04b32022-04-21 09:31:58 +08001609 /* ...
1610 * uint8 legacy_compression_method = 0;
1611 * ...
1612 */
Jerry Yu3bf2c642022-03-30 22:02:12 +08001613 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
1614 *p++ = 0x0;
1615
Jerry Yucfc04b32022-04-21 09:31:58 +08001616 /* ...
1617 * Extension extensions<6..2^16-1>;
1618 * ...
1619 * struct {
1620 * ExtensionType extension_type; (2 bytes)
1621 * opaque extension_data<0..2^16-1>;
1622 * } Extension;
1623 */
Jerry Yu3bf2c642022-03-30 22:02:12 +08001624 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Jerry Yud9436a12022-04-20 22:28:09 +08001625 p_extensions_len = p;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001626 p += 2;
1627
Jerry Yue74e04a2022-04-21 09:23:16 +08001628 if( ( ret = ssl_tls13_write_server_hello_supported_versions_ext(
Jerry Yu3bf2c642022-03-30 22:02:12 +08001629 ssl, p, end, &output_len ) ) != 0 )
1630 {
Jerry Yu955ddd72022-04-22 22:27:33 +08001631 MBEDTLS_SSL_DEBUG_RET(
1632 1, "ssl_tls13_write_server_hello_supported_versions_ext", ret );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001633 return( ret );
1634 }
1635 p += output_len;
1636
Jerry Yu3bf2c642022-03-30 22:02:12 +08001637 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1638 {
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001639 if( is_hrr )
1640 ret = ssl_tls13_write_hrr_key_share_ext( ssl, p, end, &output_len );
1641 else
1642 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &output_len );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001643 if( ret != 0 )
1644 return( ret );
1645 p += output_len;
1646 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08001647
Jerry Yud9436a12022-04-20 22:28:09 +08001648 MBEDTLS_PUT_UINT16_BE( p - p_extensions_len - 2, p_extensions_len, 0 );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001649
Jerry Yud9436a12022-04-20 22:28:09 +08001650 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello extensions",
1651 p_extensions_len, p - p_extensions_len );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001652
Jerry Yud9436a12022-04-20 22:28:09 +08001653 *out_len = p - buf;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001654
Jerry Yud9436a12022-04-20 22:28:09 +08001655 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello", buf, *out_len );
Jerry Yu3bf2c642022-03-30 22:02:12 +08001656
1657 return( ret );
Jerry Yu56404d72022-03-30 17:36:13 +08001658}
1659
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001660MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yue110d252022-05-05 10:19:22 +08001661static int ssl_tls13_finalize_write_server_hello( mbedtls_ssl_context *ssl )
1662{
1663 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yuf86eb752022-05-06 11:16:55 +08001664 ret = mbedtls_ssl_tls13_compute_handshake_transform( ssl );
Jerry Yue110d252022-05-05 10:19:22 +08001665 if( ret != 0 )
1666 {
Jerry Yuf86eb752022-05-06 11:16:55 +08001667 MBEDTLS_SSL_DEBUG_RET( 1,
1668 "mbedtls_ssl_tls13_compute_handshake_transform",
Jerry Yue110d252022-05-05 10:19:22 +08001669 ret );
1670 return( ret );
1671 }
1672
Jerry Yue110d252022-05-05 10:19:22 +08001673 return( ret );
1674}
1675
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001676MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu5b64ae92022-03-30 17:15:02 +08001677static int ssl_tls13_write_server_hello( mbedtls_ssl_context *ssl )
1678{
Jerry Yu637a3f12022-04-20 21:37:58 +08001679 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001680 unsigned char *buf;
1681 size_t buf_len, msg_len;
1682
1683 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
1684
Jerry Yuf4b27e42022-03-30 17:32:21 +08001685 MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_server_hello( ssl ) );
1686
Jerry Yu3bf2c642022-03-30 22:02:12 +08001687 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg( ssl,
Jerry Yuf4b27e42022-03-30 17:32:21 +08001688 MBEDTLS_SSL_HS_SERVER_HELLO, &buf, &buf_len ) );
1689
Jerry Yu3bf2c642022-03-30 22:02:12 +08001690 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_server_hello_body( ssl, buf,
1691 buf + buf_len,
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001692 &msg_len,
1693 0 ) );
Jerry Yuf4b27e42022-03-30 17:32:21 +08001694
Jerry Yu3bf2c642022-03-30 22:02:12 +08001695 mbedtls_ssl_add_hs_msg_to_checksum(
Jerry Yuf4b27e42022-03-30 17:32:21 +08001696 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len );
1697
Jerry Yu3bf2c642022-03-30 22:02:12 +08001698 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg(
Jerry Yuf4b27e42022-03-30 17:32:21 +08001699 ssl, buf_len, msg_len ) );
Jerry Yu637a3f12022-04-20 21:37:58 +08001700
Jerry Yue110d252022-05-05 10:19:22 +08001701 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_write_server_hello( ssl ) );
1702
Gabor Mezei7b39bf12022-05-24 16:04:14 +02001703#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1704 /* The server sends a dummy change_cipher_spec record immediately
1705 * after its first handshake message. This may either be after
1706 * a ServerHello or a HelloRetryRequest.
1707 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02001708 mbedtls_ssl_handshake_set_state(
1709 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO );
Gabor Mezei7b39bf12022-05-24 16:04:14 +02001710#else
Jerry Yu637a3f12022-04-20 21:37:58 +08001711 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
Gabor Mezei7b39bf12022-05-24 16:04:14 +02001712#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yue110d252022-05-05 10:19:22 +08001713
Jerry Yuf4b27e42022-03-30 17:32:21 +08001714cleanup:
1715
1716 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
1717 return( ret );
Jerry Yu5b64ae92022-03-30 17:15:02 +08001718}
1719
Jerry Yu23d1a252022-05-12 18:08:59 +08001720
1721/*
1722 * Handler for MBEDTLS_SSL_HELLO_RETRY_REQUEST
1723 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001724MBEDTLS_CHECK_RETURN_CRITICAL
Ronald Cron7b840462022-06-01 17:05:53 +02001725static int ssl_tls13_prepare_hello_retry_request( mbedtls_ssl_context *ssl )
Jerry Yu23d1a252022-05-12 18:08:59 +08001726{
1727 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1728 if( ssl->handshake->hello_retry_request_count > 0 )
1729 {
1730 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Too many HRRs" ) );
1731 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1732 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1733 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1734 }
1735
1736 /*
1737 * Create stateless transcript hash for HRR
1738 */
1739 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Reset transcript for HRR" ) );
1740 ret = mbedtls_ssl_reset_transcript_for_hrr( ssl );
1741 if( ret != 0 )
1742 {
1743 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_reset_transcript_for_hrr", ret );
1744 return( ret );
1745 }
1746 mbedtls_ssl_session_reset_msg_layer( ssl, 0 );
1747
1748 return( 0 );
1749}
1750
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001751MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu23d1a252022-05-12 18:08:59 +08001752static int ssl_tls13_write_hello_retry_request( mbedtls_ssl_context *ssl )
1753{
1754 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1755 unsigned char *buf;
1756 size_t buf_len, msg_len;
1757
1758 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello retry request" ) );
1759
Ronald Cron7b840462022-06-01 17:05:53 +02001760 MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_hello_retry_request( ssl ) );
Jerry Yu23d1a252022-05-12 18:08:59 +08001761
1762 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg(
1763 ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
1764 &buf, &buf_len ) );
1765
1766 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_server_hello_body( ssl, buf,
1767 buf + buf_len,
1768 &msg_len,
1769 1 ) );
1770 mbedtls_ssl_add_hs_msg_to_checksum(
1771 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len );
1772
1773
1774 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg( ssl, buf_len,
1775 msg_len ) );
1776
1777 ssl->handshake->hello_retry_request_count++;
1778
Gabor Mezei7b39bf12022-05-24 16:04:14 +02001779#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1780 /* The server sends a dummy change_cipher_spec record immediately
1781 * after its first handshake message. This may either be after
1782 * a ServerHello or a HelloRetryRequest.
1783 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02001784 mbedtls_ssl_handshake_set_state(
Gabor Mezeif7044ea2022-06-28 16:01:49 +02001785 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST );
Gabor Mezei7b39bf12022-05-24 16:04:14 +02001786#else
Jerry Yu23d1a252022-05-12 18:08:59 +08001787 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
Gabor Mezei7b39bf12022-05-24 16:04:14 +02001788#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yu23d1a252022-05-12 18:08:59 +08001789
1790cleanup:
1791 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello retry request" ) );
1792 return( ret );
1793}
1794
Jerry Yu5b64ae92022-03-30 17:15:02 +08001795/*
Jerry Yu4d3841a2022-04-16 12:37:19 +08001796 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
1797 */
Jerry Yu4d3841a2022-04-16 12:37:19 +08001798
1799/*
1800 * struct {
1801 * Extension extensions<0..2 ^ 16 - 1>;
1802 * } EncryptedExtensions;
1803 *
1804 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001805MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu4d3841a2022-04-16 12:37:19 +08001806static int ssl_tls13_write_encrypted_extensions_body( mbedtls_ssl_context *ssl,
1807 unsigned char *buf,
1808 unsigned char *end,
1809 size_t *out_len )
1810{
XiaokangQianacb39922022-06-17 10:18:48 +00001811 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu4d3841a2022-04-16 12:37:19 +08001812 unsigned char *p = buf;
1813 size_t extensions_len = 0;
Jerry Yu8937eb42022-05-03 12:12:14 +08001814 unsigned char *p_extensions_len;
XiaokangQianacb39922022-06-17 10:18:48 +00001815 size_t output_len;
Jerry Yu9da5e5a2022-05-03 15:46:09 +08001816
Jerry Yu4d3841a2022-04-16 12:37:19 +08001817 *out_len = 0;
1818
1819 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Jerry Yu8937eb42022-05-03 12:12:14 +08001820 p_extensions_len = p;
Jerry Yu4d3841a2022-04-16 12:37:19 +08001821 p += 2;
1822
Jerry Yu8937eb42022-05-03 12:12:14 +08001823 ((void) ssl);
XiaokangQianacb39922022-06-17 10:18:48 +00001824 ((void) ret);
1825 ((void) output_len);
1826
1827#if defined(MBEDTLS_SSL_ALPN)
1828 ret = mbedtls_ssl_write_alpn_ext( ssl, p, end, &output_len );
1829 if( ret != 0 )
1830 return( ret );
XiaokangQian95d5f542022-06-24 02:29:26 +00001831 p += output_len;
XiaokangQianacb39922022-06-17 10:18:48 +00001832#endif /* MBEDTLS_SSL_ALPN */
Jerry Yu4d3841a2022-04-16 12:37:19 +08001833
Jerry Yu8937eb42022-05-03 12:12:14 +08001834 extensions_len = ( p - p_extensions_len ) - 2;
1835 MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
1836
1837 *out_len = p - buf;
Jerry Yu4d3841a2022-04-16 12:37:19 +08001838
1839 MBEDTLS_SSL_DEBUG_BUF( 4, "encrypted extensions", buf, *out_len );
1840
1841 return( 0 );
1842}
1843
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001844MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu4d3841a2022-04-16 12:37:19 +08001845static int ssl_tls13_write_encrypted_extensions( mbedtls_ssl_context *ssl )
1846{
1847 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1848 unsigned char *buf;
Jerry Yu39730a72022-05-03 12:14:04 +08001849 size_t buf_len, msg_len;
Jerry Yu4d3841a2022-04-16 12:37:19 +08001850
Gabor Mezei54719122022-06-28 11:34:56 +02001851 mbedtls_ssl_set_outbound_transform( ssl,
1852 ssl->handshake->transform_handshake );
1853 MBEDTLS_SSL_DEBUG_MSG(
1854 3, ( "switching to handshake transform for outbound data" ) );
1855
Jerry Yuab452cc2022-04-28 15:27:08 +08001856 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write encrypted extensions" ) );
Jerry Yu4d3841a2022-04-16 12:37:19 +08001857
Jerry Yu4d3841a2022-04-16 12:37:19 +08001858 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg( ssl,
1859 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, &buf, &buf_len ) );
1860
1861 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_encrypted_extensions_body(
1862 ssl, buf, buf + buf_len, &msg_len ) );
1863
1864 mbedtls_ssl_add_hs_msg_to_checksum(
1865 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, msg_len );
1866
Jerry Yu4d3841a2022-04-16 12:37:19 +08001867 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg(
1868 ssl, buf_len, msg_len ) );
1869
Jerry Yu8937eb42022-05-03 12:12:14 +08001870#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Ronald Cron79907712022-07-20 17:05:29 +02001871 if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) )
Jerry Yu8937eb42022-05-03 12:12:14 +08001872 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1873 else
XiaokangQiana987e1d2022-05-07 01:25:58 +00001874 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
Jerry Yu8937eb42022-05-03 12:12:14 +08001875#else
1876 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1877#endif
1878
Jerry Yu4d3841a2022-04-16 12:37:19 +08001879cleanup:
1880
Jerry Yuab452cc2022-04-28 15:27:08 +08001881 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write encrypted extensions" ) );
Jerry Yu4d3841a2022-04-16 12:37:19 +08001882 return( ret );
1883}
1884
XiaokangQiancec9ae62022-05-06 07:28:50 +00001885#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
XiaokangQiana987e1d2022-05-07 01:25:58 +00001886#define SSL_CERTIFICATE_REQUEST_SEND_REQUEST 0
1887#define SSL_CERTIFICATE_REQUEST_SKIP 1
1888/* Coordination:
1889 * Check whether a CertificateRequest message should be written.
1890 * Returns a negative code on failure, or
1891 * - SSL_CERTIFICATE_REQUEST_SEND_REQUEST
1892 * - SSL_CERTIFICATE_REQUEST_SKIP
1893 * indicating if the writing of the CertificateRequest
1894 * should be skipped or not.
1895 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001896MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQiana987e1d2022-05-07 01:25:58 +00001897static int ssl_tls13_certificate_request_coordinate( mbedtls_ssl_context *ssl )
1898{
1899 int authmode;
1900
XiaokangQian40a35232022-05-07 09:02:40 +00001901#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1902 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
1903 authmode = ssl->handshake->sni_authmode;
1904 else
1905#endif
XiaokangQiana987e1d2022-05-07 01:25:58 +00001906 authmode = ssl->conf->authmode;
1907
1908 if( authmode == MBEDTLS_SSL_VERIFY_NONE )
1909 return( SSL_CERTIFICATE_REQUEST_SKIP );
1910
XiaokangQianc3017f62022-05-13 05:55:41 +00001911 ssl->handshake->certificate_request_sent = 1;
XiaokangQian189ded22022-05-10 08:12:17 +00001912
XiaokangQiana987e1d2022-05-07 01:25:58 +00001913 return( SSL_CERTIFICATE_REQUEST_SEND_REQUEST );
1914}
1915
XiaokangQiancec9ae62022-05-06 07:28:50 +00001916/*
1917 * struct {
1918 * opaque certificate_request_context<0..2^8-1>;
1919 * Extension extensions<2..2^16-1>;
1920 * } CertificateRequest;
1921 *
1922 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001923MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQiancec9ae62022-05-06 07:28:50 +00001924static int ssl_tls13_write_certificate_request_body( mbedtls_ssl_context *ssl,
1925 unsigned char *buf,
1926 const unsigned char *end,
1927 size_t *out_len )
1928{
1929 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1930 unsigned char *p = buf;
XiaokangQianec6efb92022-05-06 09:53:10 +00001931 size_t output_len = 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00001932 unsigned char *p_extensions_len;
1933
1934 *out_len = 0;
1935
1936 /* Check if we have enough space:
1937 * - certificate_request_context (1 byte)
1938 * - extensions length (2 bytes)
1939 */
1940 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 3 );
1941
1942 /*
1943 * Write certificate_request_context
1944 */
1945 /*
1946 * We use a zero length context for the normal handshake
1947 * messages. For post-authentication handshake messages
1948 * this request context would be set to a non-zero value.
1949 */
1950 *p++ = 0x0;
1951
1952 /*
1953 * Write extensions
1954 */
1955 /* The extensions must contain the signature_algorithms. */
1956 p_extensions_len = p;
1957 p += 2;
XiaokangQianec6efb92022-05-06 09:53:10 +00001958 ret = mbedtls_ssl_write_sig_alg_ext( ssl, p, end, &output_len );
XiaokangQiancec9ae62022-05-06 07:28:50 +00001959 if( ret != 0 )
1960 return( ret );
1961
XiaokangQianec6efb92022-05-06 09:53:10 +00001962 p += output_len;
XiaokangQianaad9b0a2022-05-09 01:11:21 +00001963 MBEDTLS_PUT_UINT16_BE( p - p_extensions_len - 2, p_extensions_len, 0 );
XiaokangQiancec9ae62022-05-06 07:28:50 +00001964
1965 *out_len = p - buf;
1966
1967 return( 0 );
1968}
1969
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001970MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQiancec9ae62022-05-06 07:28:50 +00001971static int ssl_tls13_write_certificate_request( mbedtls_ssl_context *ssl )
1972{
1973 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1974
1975 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
1976
1977 MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_certificate_request_coordinate( ssl ) );
1978
1979 if( ret == SSL_CERTIFICATE_REQUEST_SEND_REQUEST )
1980 {
1981 unsigned char *buf;
1982 size_t buf_len, msg_len;
1983
1984 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg( ssl,
1985 MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, &buf, &buf_len ) );
1986
1987 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_certificate_request_body(
1988 ssl, buf, buf + buf_len, &msg_len ) );
1989
1990 mbedtls_ssl_add_hs_msg_to_checksum(
1991 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, buf, msg_len );
1992
1993 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg(
1994 ssl, buf_len, msg_len ) );
1995 }
1996 else if( ret == SSL_CERTIFICATE_REQUEST_SKIP )
1997 {
1998 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
1999 ret = 0;
2000 }
2001 else
2002 {
2003 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2004 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2005 goto cleanup;
2006 }
2007
2008 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
2009cleanup:
2010
2011 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
2012 return( ret );
2013}
XiaokangQiancec9ae62022-05-06 07:28:50 +00002014
Jerry Yu4d3841a2022-04-16 12:37:19 +08002015/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002016 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
Jerry Yu83da34e2022-04-16 13:59:52 +08002017 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002018MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002019static int ssl_tls13_write_server_certificate( mbedtls_ssl_context *ssl )
Jerry Yu83da34e2022-04-16 13:59:52 +08002020{
Jerry Yu5a26f302022-05-10 20:46:40 +08002021 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQianfb665a82022-06-15 03:57:21 +00002022
2023#if defined(MBEDTLS_X509_CRT_PARSE_C)
2024 if( ( ssl_tls13_pick_key_cert( ssl ) != 0 ) ||
2025 mbedtls_ssl_own_cert( ssl ) == NULL )
Jerry Yu5a26f302022-05-10 20:46:40 +08002026 {
Jerry Yub89125b2022-05-13 15:45:49 +08002027 MBEDTLS_SSL_DEBUG_MSG( 2, ( "No certificate available." ) );
Jerry Yu5a26f302022-05-10 20:46:40 +08002028 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2029 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
Jerry Yuf1c3c4e2022-05-10 11:36:35 +08002030 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Jerry Yu5a26f302022-05-10 20:46:40 +08002031 }
XiaokangQianfb665a82022-06-15 03:57:21 +00002032#endif /* MBEDTLS_X509_CRT_PARSE_C */
Jerry Yu5a26f302022-05-10 20:46:40 +08002033
Jerry Yuf1c3c4e2022-05-10 11:36:35 +08002034 ret = mbedtls_ssl_tls13_write_certificate( ssl );
2035 if( ret != 0 )
Jerry Yu1bff7112022-04-16 14:29:11 +08002036 return( ret );
Jerry Yu1bff7112022-04-16 14:29:11 +08002037 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
2038 return( 0 );
Jerry Yu83da34e2022-04-16 13:59:52 +08002039}
2040
2041/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002042 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
Jerry Yu83da34e2022-04-16 13:59:52 +08002043 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002044MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002045static int ssl_tls13_write_certificate_verify( mbedtls_ssl_context *ssl )
Jerry Yu83da34e2022-04-16 13:59:52 +08002046{
Jerry Yu4ff9e142022-04-16 14:57:49 +08002047 int ret = mbedtls_ssl_tls13_write_certificate_verify( ssl );
Jerry Yuf1c3c4e2022-05-10 11:36:35 +08002048 if( ret != 0 )
Jerry Yu4ff9e142022-04-16 14:57:49 +08002049 return( ret );
Jerry Yu4ff9e142022-04-16 14:57:49 +08002050 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
2051 return( 0 );
Jerry Yu83da34e2022-04-16 13:59:52 +08002052}
Jerry Yu5a26f302022-05-10 20:46:40 +08002053#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08002054
2055/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002056 * Handler for MBEDTLS_SSL_SERVER_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002057 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002058MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu4d8567f2022-04-17 10:57:57 +08002059static int ssl_tls13_write_server_finished( mbedtls_ssl_context *ssl )
Jerry Yu69dd8d42022-04-16 12:51:26 +08002060{
Jerry Yud6e253d2022-05-18 13:59:24 +08002061 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002062
2063 ret = mbedtls_ssl_tls13_write_finished_message( ssl );
2064 if( ret != 0 )
2065 return( ret );
2066
Jerry Yue3d67cb2022-05-19 15:33:10 +08002067 ret = mbedtls_ssl_tls13_compute_application_transform( ssl );
2068 if( ret != 0 )
2069 {
2070 MBEDTLS_SSL_PEND_FATAL_ALERT(
2071 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2072 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
2073 return( ret );
2074 }
XiaokangQianc3017f62022-05-13 05:55:41 +00002075
Ronald Cron63dc4632022-05-31 14:41:53 +02002076 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
2077 mbedtls_ssl_set_inbound_transform( ssl, ssl->handshake->transform_handshake );
XiaokangQian189ded22022-05-10 08:12:17 +00002078
Ronald Cron63dc4632022-05-31 14:41:53 +02002079 if( ssl->handshake->certificate_request_sent )
2080 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE );
XiaokangQian189ded22022-05-10 08:12:17 +00002081 else
Ronald Cron19385882022-06-15 16:26:13 +02002082 {
2083 MBEDTLS_SSL_DEBUG_MSG( 2, ( "skip parse certificate" ) );
2084 MBEDTLS_SSL_DEBUG_MSG( 2, ( "skip parse certificate verify" ) );
XiaokangQian189ded22022-05-10 08:12:17 +00002085 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
Ronald Cron19385882022-06-15 16:26:13 +02002086 }
Ronald Cron63dc4632022-05-31 14:41:53 +02002087
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002088 return( 0 );
Jerry Yu69dd8d42022-04-16 12:51:26 +08002089}
2090
2091/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002092 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002093 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002094MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu4d8567f2022-04-17 10:57:57 +08002095static int ssl_tls13_process_client_finished( mbedtls_ssl_context *ssl )
Jerry Yu69dd8d42022-04-16 12:51:26 +08002096{
Jerry Yud6e253d2022-05-18 13:59:24 +08002097 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2098
Jerry Yuff226982022-04-16 16:52:57 +08002099 ret = mbedtls_ssl_tls13_process_finished_message( ssl );
2100 if( ret != 0 )
2101 return( ret );
2102
Jerry Yue3d67cb2022-05-19 15:33:10 +08002103 ret = mbedtls_ssl_tls13_generate_resumption_master_secret( ssl );
2104 if( ret != 0 )
2105 {
2106 MBEDTLS_SSL_DEBUG_RET( 1,
2107 "mbedtls_ssl_tls13_generate_resumption_master_secret ", ret );
2108 }
2109
Jerry Yu03ed50b2022-04-16 17:13:30 +08002110 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
Jerry Yuff226982022-04-16 16:52:57 +08002111 return( 0 );
Jerry Yu69dd8d42022-04-16 12:51:26 +08002112}
2113
2114/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002115 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
Jerry Yu69dd8d42022-04-16 12:51:26 +08002116 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002117MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu4d8567f2022-04-17 10:57:57 +08002118static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
Jerry Yu69dd8d42022-04-16 12:51:26 +08002119{
Jerry Yu03ed50b2022-04-16 17:13:30 +08002120 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
2121
Jerry Yu03ed50b2022-04-16 17:13:30 +08002122 mbedtls_ssl_tls13_handshake_wrapup( ssl );
2123 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
2124 return( 0 );
Jerry Yu69dd8d42022-04-16 12:51:26 +08002125}
2126
2127/*
XiaokangQiane8ff3502022-04-22 02:34:40 +00002128 * TLS 1.3 State Machine -- server side
XiaokangQian7807f9f2022-02-15 10:04:37 +00002129 */
Jerry Yu27561932021-08-27 17:07:38 +08002130int mbedtls_ssl_tls13_handshake_server_step( mbedtls_ssl_context *ssl )
Jerry Yub9930e72021-08-06 17:11:51 +08002131{
XiaokangQian08037552022-04-20 07:16:41 +00002132 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +00002133
2134 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
2135 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2136
Jerry Yue3b34122021-09-28 17:53:35 +08002137 MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 server state: %s(%d)",
2138 mbedtls_ssl_states_str( ssl->state ),
2139 ssl->state ) );
Jerry Yu6e81b272021-09-27 11:16:17 +08002140
XiaokangQian7807f9f2022-02-15 10:04:37 +00002141 switch( ssl->state )
2142 {
2143 /* start state */
2144 case MBEDTLS_SSL_HELLO_REQUEST:
XiaokangQian7807f9f2022-02-15 10:04:37 +00002145 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
XiaokangQian08037552022-04-20 07:16:41 +00002146 ret = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00002147 break;
2148
XiaokangQian7807f9f2022-02-15 10:04:37 +00002149 case MBEDTLS_SSL_CLIENT_HELLO:
XiaokangQian4080a7f2022-04-11 09:55:18 +00002150 ret = ssl_tls13_process_client_hello( ssl );
XiaokangQian7807f9f2022-02-15 10:04:37 +00002151 if( ret != 0 )
XiaokangQian4080a7f2022-04-11 09:55:18 +00002152 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_process_client_hello", ret );
Jerry Yuf41553b2022-05-09 22:20:30 +08002153 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00002154
Jerry Yuf41553b2022-05-09 22:20:30 +08002155 case MBEDTLS_SSL_HELLO_RETRY_REQUEST:
2156 ret = ssl_tls13_write_hello_retry_request( ssl );
2157 if( ret != 0 )
2158 {
2159 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_hello_retry_request", ret );
2160 return( ret );
2161 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00002162 break;
2163
Jerry Yu5b64ae92022-03-30 17:15:02 +08002164 case MBEDTLS_SSL_SERVER_HELLO:
2165 ret = ssl_tls13_write_server_hello( ssl );
2166 break;
2167
Xiaofei Baicba64af2022-02-15 10:00:56 +00002168 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
Jerry Yu4d3841a2022-04-16 12:37:19 +08002169 ret = ssl_tls13_write_encrypted_extensions( ssl );
Xiaofei Baicba64af2022-02-15 10:00:56 +00002170 if( ret != 0 )
2171 {
Jerry Yu4d3841a2022-04-16 12:37:19 +08002172 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_encrypted_extensions", ret );
2173 return( ret );
Xiaofei Baicba64af2022-02-15 10:00:56 +00002174 }
Jerry Yu48330562022-05-06 21:35:44 +08002175 break;
Jerry Yu6a2cd9e2022-05-05 11:14:19 +08002176
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00002177#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
2178 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Xiaofei Bai5ee73d82022-03-14 02:48:30 +00002179 ret = ssl_tls13_write_certificate_request( ssl );
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00002180 break;
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00002181
Jerry Yu83da34e2022-04-16 13:59:52 +08002182 case MBEDTLS_SSL_SERVER_CERTIFICATE:
2183 ret = ssl_tls13_write_server_certificate( ssl );
2184 break;
2185
2186 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
2187 ret = ssl_tls13_write_certificate_verify( ssl );
2188 break;
Jerry Yu5a26f302022-05-10 20:46:40 +08002189#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08002190
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002191 /*
2192 * Injection of dummy-CCS's for middlebox compatibility
2193 */
2194#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
Gabor Mezeif7044ea2022-06-28 16:01:49 +02002195 case MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST:
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002196 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
2197 if( ret == 0 )
2198 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
2199 break;
2200
2201 case MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO:
2202 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
2203 if( ret == 0 )
2204 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
2205 break;
2206#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
2207
Jerry Yu69dd8d42022-04-16 12:51:26 +08002208 case MBEDTLS_SSL_SERVER_FINISHED:
2209 ret = ssl_tls13_write_server_finished( ssl );
2210 break;
2211
2212 case MBEDTLS_SSL_CLIENT_FINISHED:
2213 ret = ssl_tls13_process_client_finished( ssl );
2214 break;
2215
Jerry Yu69dd8d42022-04-16 12:51:26 +08002216 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
2217 ret = ssl_tls13_handshake_wrapup( ssl );
2218 break;
2219
XiaokangQian6b916b12022-04-25 07:29:34 +00002220 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
2221 ret = mbedtls_ssl_tls13_process_certificate( ssl );
Ronald Cron209cae92022-06-07 10:30:19 +02002222 if( ret == 0 )
XiaokangQian6b916b12022-04-25 07:29:34 +00002223 {
Ronald Cron209cae92022-06-07 10:30:19 +02002224 if( ssl->session_negotiate->peer_cert != NULL )
2225 {
2226 mbedtls_ssl_handshake_set_state(
2227 ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY );
2228 }
2229 else
Ronald Cron19385882022-06-15 16:26:13 +02002230 {
2231 MBEDTLS_SSL_DEBUG_MSG( 2, ( "skip parse certificate verify" ) );
Ronald Cron209cae92022-06-07 10:30:19 +02002232 mbedtls_ssl_handshake_set_state(
2233 ssl, MBEDTLS_SSL_CLIENT_FINISHED );
Ronald Cron19385882022-06-15 16:26:13 +02002234 }
XiaokangQian6b916b12022-04-25 07:29:34 +00002235 }
2236 break;
2237
2238 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
2239 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
2240 if( ret == 0 )
2241 {
2242 mbedtls_ssl_handshake_set_state(
2243 ssl, MBEDTLS_SSL_CLIENT_FINISHED );
2244 }
2245 break;
2246
XiaokangQian7807f9f2022-02-15 10:04:37 +00002247 default:
2248 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
XiaokangQian060d8672022-04-21 09:24:56 +00002249 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
XiaokangQian7807f9f2022-02-15 10:04:37 +00002250 }
2251
2252 return( ret );
Jerry Yub9930e72021-08-06 17:11:51 +08002253}
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08002254
Jerry Yufb4b6472022-01-27 15:03:26 +08002255#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */