Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 1 | /* |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 2 | * TLS server-side functions |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3 | * |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 4 | * Copyright The Mbed TLS Contributors |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 18 | */ |
| 19 | |
Gilles Peskine | db09ef6 | 2020-06-03 01:43:33 +0200 | [diff] [blame] | 20 | #include "common.h" |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 21 | |
Jerry Yu | fb4b647 | 2022-01-27 15:03:26 +0800 | [diff] [blame] | 22 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Jerry Yu | c5aef88 | 2021-12-23 20:15:02 +0800 | [diff] [blame] | 23 | |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 24 | #include "mbedtls/platform.h" |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 25 | |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 26 | #include "mbedtls/ssl.h" |
Chris Jones | 84a773f | 2021-03-05 18:38:47 +0000 | [diff] [blame] | 27 | #include "ssl_misc.h" |
Janos Follath | 73c616b | 2019-12-18 15:07:04 +0000 | [diff] [blame] | 28 | #include "mbedtls/debug.h" |
| 29 | #include "mbedtls/error.h" |
Andres Amaya Garcia | 8491406 | 2018-04-24 08:40:46 -0500 | [diff] [blame] | 30 | #include "mbedtls/platform_util.h" |
Gabor Mezei | 22c9a6f | 2021-10-20 12:09:35 +0200 | [diff] [blame] | 31 | #include "constant_time_internal.h" |
Gabor Mezei | 765862c | 2021-10-19 12:22:25 +0200 | [diff] [blame] | 32 | #include "mbedtls/constant_time.h" |
Przemek Stekiel | 5166954 | 2022-09-13 12:57:05 +0200 | [diff] [blame] | 33 | #include "hash_info.h" |
Rich Evans | 00ab470 | 2015-02-06 13:43:58 +0000 | [diff] [blame] | 34 | |
| 35 | #include <string.h> |
| 36 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 37 | #if defined(MBEDTLS_ECP_C) |
Manuel Pégourié-Gonnard | 7f80997 | 2015-03-09 17:05:11 +0000 | [diff] [blame] | 38 | #include "mbedtls/ecp.h" |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 39 | #endif |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 40 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 41 | #if defined(MBEDTLS_HAVE_TIME) |
Simon Butcher | b5b6af2 | 2016-07-13 14:46:18 +0100 | [diff] [blame] | 42 | #include "mbedtls/platform_time.h" |
Paul Bakker | fa9b100 | 2013-07-03 15:31:03 +0200 | [diff] [blame] | 43 | #endif |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 44 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 45 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
| 46 | int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 43c0218 | 2014-07-22 17:32:01 +0200 | [diff] [blame] | 47 | const unsigned char *info, |
| 48 | size_t ilen ) |
| 49 | { |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 50 | if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 51 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Manuel Pégourié-Gonnard | 43c0218 | 2014-07-22 17:32:01 +0200 | [diff] [blame] | 52 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 53 | mbedtls_free( ssl->cli_id ); |
Manuel Pégourié-Gonnard | 43c0218 | 2014-07-22 17:32:01 +0200 | [diff] [blame] | 54 | |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 55 | if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL ) |
Manuel Pégourié-Gonnard | 6a8ca33 | 2015-05-28 09:33:39 +0200 | [diff] [blame] | 56 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
Manuel Pégourié-Gonnard | 43c0218 | 2014-07-22 17:32:01 +0200 | [diff] [blame] | 57 | |
| 58 | memcpy( ssl->cli_id, info, ilen ); |
| 59 | ssl->cli_id_len = ilen; |
| 60 | |
| 61 | return( 0 ); |
| 62 | } |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 63 | |
Manuel Pégourié-Gonnard | 6729e79 | 2015-05-11 09:50:24 +0200 | [diff] [blame] | 64 | void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 65 | mbedtls_ssl_cookie_write_t *f_cookie_write, |
| 66 | mbedtls_ssl_cookie_check_t *f_cookie_check, |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 67 | void *p_cookie ) |
| 68 | { |
Manuel Pégourié-Gonnard | d36e33f | 2015-05-05 10:45:39 +0200 | [diff] [blame] | 69 | conf->f_cookie_write = f_cookie_write; |
| 70 | conf->f_cookie_check = f_cookie_check; |
| 71 | conf->p_cookie = p_cookie; |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 72 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 73 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 43c0218 | 2014-07-22 17:32:01 +0200 | [diff] [blame] | 74 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 75 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 76 | MBEDTLS_CHECK_RETURN_CRITICAL |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 77 | static int ssl_conf_has_psk_or_cb( mbedtls_ssl_config const *conf ) |
| 78 | { |
| 79 | if( conf->f_psk != NULL ) |
| 80 | return( 1 ); |
| 81 | |
| 82 | if( conf->psk_identity_len == 0 || conf->psk_identity == NULL ) |
| 83 | return( 0 ); |
| 84 | |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 85 | |
| 86 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Ronald Cron | cf56a0a | 2020-08-04 09:51:30 +0200 | [diff] [blame] | 87 | if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) ) |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 88 | return( 1 ); |
Neil Armstrong | 8ecd668 | 2022-05-05 11:40:35 +0200 | [diff] [blame] | 89 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
| 90 | |
Neil Armstrong | e952a30 | 2022-05-03 10:22:14 +0200 | [diff] [blame] | 91 | if( conf->psk != NULL && conf->psk_len != 0 ) |
| 92 | return( 1 ); |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 93 | |
| 94 | return( 0 ); |
| 95 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 96 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 97 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 98 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 99 | static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl, |
Paul Bakker | 23f3680 | 2012-09-28 14:15:14 +0000 | [diff] [blame] | 100 | const unsigned char *buf, |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 101 | size_t len ) |
| 102 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 103 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 104 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 105 | { |
| 106 | /* Check verify-data in constant-time. The length OTOH is no secret */ |
| 107 | if( len != 1 + ssl->verify_data_len || |
| 108 | buf[0] != ssl->verify_data_len || |
Gabor Mezei | 90437e3 | 2021-10-20 11:59:27 +0200 | [diff] [blame] | 109 | mbedtls_ct_memcmp( buf + 1, ssl->peer_verify_data, |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 110 | ssl->verify_data_len ) != 0 ) |
| 111 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 112 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) ); |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 113 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 114 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Dave Rodgman | 43fcb8d | 2021-06-28 21:49:15 +0100 | [diff] [blame] | 115 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 116 | } |
| 117 | } |
| 118 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 119 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 120 | { |
| 121 | if( len != 1 || buf[0] != 0x0 ) |
| 122 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 123 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) ); |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 124 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 125 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Dave Rodgman | 43fcb8d | 2021-06-28 21:49:15 +0100 | [diff] [blame] | 126 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 127 | } |
| 128 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 129 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 130 | } |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 131 | |
| 132 | return( 0 ); |
| 133 | } |
| 134 | |
Robert Cragie | 136884c | 2015-10-02 13:34:31 +0100 | [diff] [blame] | 135 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Robert Cragie | ae8535d | 2015-10-06 17:11:18 +0100 | [diff] [blame] | 136 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Jerry Yu | b925f21 | 2022-01-12 11:17:02 +0800 | [diff] [blame] | 137 | /* |
Jerry Yu | d491ea4 | 2022-01-13 16:15:25 +0800 | [diff] [blame] | 138 | * Function for parsing a supported groups (TLS 1.3) or supported elliptic |
| 139 | * curves (TLS 1.2) extension. |
| 140 | * |
| 141 | * The "extension_data" field of a supported groups extension contains a |
| 142 | * "NamedGroupList" value (TLS 1.3 RFC8446): |
| 143 | * enum { |
| 144 | * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019), |
| 145 | * x25519(0x001D), x448(0x001E), |
| 146 | * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102), |
| 147 | * ffdhe6144(0x0103), ffdhe8192(0x0104), |
| 148 | * ffdhe_private_use(0x01FC..0x01FF), |
| 149 | * ecdhe_private_use(0xFE00..0xFEFF), |
| 150 | * (0xFFFF) |
| 151 | * } NamedGroup; |
| 152 | * struct { |
| 153 | * NamedGroup named_group_list<2..2^16-1>; |
| 154 | * } NamedGroupList; |
| 155 | * |
| 156 | * The "extension_data" field of a supported elliptic curves extension contains |
| 157 | * a "NamedCurveList" value (TLS 1.2 RFC 8422): |
| 158 | * enum { |
| 159 | * deprecated(1..22), |
| 160 | * secp256r1 (23), secp384r1 (24), secp521r1 (25), |
| 161 | * x25519(29), x448(30), |
| 162 | * reserved (0xFE00..0xFEFF), |
| 163 | * deprecated(0xFF01..0xFF02), |
| 164 | * (0xFFFF) |
| 165 | * } NamedCurve; |
| 166 | * struct { |
| 167 | * NamedCurve named_curve_list<2..2^16-1> |
| 168 | * } NamedCurveList; |
| 169 | * |
Jerry Yu | b925f21 | 2022-01-12 11:17:02 +0800 | [diff] [blame] | 170 | * The TLS 1.3 supported groups extension was defined to be a compatible |
| 171 | * generalization of the TLS 1.2 supported elliptic curves extension. They both |
| 172 | * share the same extension identifier. |
Jerry Yu | d491ea4 | 2022-01-13 16:15:25 +0800 | [diff] [blame] | 173 | * |
| 174 | * DHE groups are not supported yet. |
Jerry Yu | b925f21 | 2022-01-12 11:17:02 +0800 | [diff] [blame] | 175 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 176 | MBEDTLS_CHECK_RETURN_CRITICAL |
Jerry Yu | b47d0f8 | 2021-12-20 17:34:40 +0800 | [diff] [blame] | 177 | static int ssl_parse_supported_groups_ext( mbedtls_ssl_context *ssl, |
Jerry Yu | ffef9c5 | 2021-12-24 22:31:08 +0800 | [diff] [blame] | 178 | const unsigned char *buf, |
| 179 | size_t len ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 180 | { |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 181 | size_t list_size, our_size; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 182 | const unsigned char *p; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 183 | const mbedtls_ecp_curve_info *curve_info, **curves; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 184 | |
Philippe Antoine | 747fd53 | 2018-05-30 09:13:21 +0200 | [diff] [blame] | 185 | if ( len < 2 ) { |
| 186 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 187 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 188 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 189 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Philippe Antoine | 747fd53 | 2018-05-30 09:13:21 +0200 | [diff] [blame] | 190 | } |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 191 | list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
| 192 | if( list_size + 2 != len || |
| 193 | list_size % 2 != 0 ) |
| 194 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 195 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 196 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 197 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 198 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 199 | } |
| 200 | |
Manuel Pégourié-Gonnard | 43c3b28 | 2014-10-17 12:42:11 +0200 | [diff] [blame] | 201 | /* Should never happen unless client duplicates the extension */ |
| 202 | if( ssl->handshake->curves != NULL ) |
| 203 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 204 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 205 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 206 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); |
| 207 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Manuel Pégourié-Gonnard | 43c3b28 | 2014-10-17 12:42:11 +0200 | [diff] [blame] | 208 | } |
| 209 | |
Manuel Pégourié-Gonnard | c3f6b62c | 2014-02-06 10:13:09 +0100 | [diff] [blame] | 210 | /* Don't allow our peer to make us allocate too much memory, |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 211 | * and leave room for a final 0 */ |
| 212 | our_size = list_size / 2 + 1; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 213 | if( our_size > MBEDTLS_ECP_DP_MAX ) |
| 214 | our_size = MBEDTLS_ECP_DP_MAX; |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 215 | |
Manuel Pégourié-Gonnard | 7551cb9 | 2015-05-26 16:04:06 +0200 | [diff] [blame] | 216 | if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL ) |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 217 | { |
| 218 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 219 | MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); |
Manuel Pégourié-Gonnard | 6a8ca33 | 2015-05-28 09:33:39 +0200 | [diff] [blame] | 220 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 221 | } |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 222 | |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 223 | ssl->handshake->curves = curves; |
| 224 | |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 225 | p = buf + 2; |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 226 | while( list_size > 0 && our_size > 1 ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 227 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 228 | curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] ); |
Manuel Pégourié-Gonnard | 568c9cf | 2013-09-16 17:30:04 +0200 | [diff] [blame] | 229 | |
Manuel Pégourié-Gonnard | f24b4a7 | 2013-09-23 18:14:50 +0200 | [diff] [blame] | 230 | if( curve_info != NULL ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 231 | { |
Manuel Pégourié-Gonnard | d09453c | 2013-09-23 19:11:32 +0200 | [diff] [blame] | 232 | *curves++ = curve_info; |
| 233 | our_size--; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 234 | } |
| 235 | |
| 236 | list_size -= 2; |
| 237 | p += 2; |
| 238 | } |
| 239 | |
| 240 | return( 0 ); |
| 241 | } |
| 242 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 243 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 244 | static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl, |
Paul Bakker | b6c5d2e | 2013-06-25 16:25:17 +0200 | [diff] [blame] | 245 | const unsigned char *buf, |
| 246 | size_t len ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 247 | { |
| 248 | size_t list_size; |
| 249 | const unsigned char *p; |
| 250 | |
Philippe Antoine | 747fd53 | 2018-05-30 09:13:21 +0200 | [diff] [blame] | 251 | if( len == 0 || (size_t)( buf[0] + 1 ) != len ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 252 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 253 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 254 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 255 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 256 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 257 | } |
Philippe Antoine | 747fd53 | 2018-05-30 09:13:21 +0200 | [diff] [blame] | 258 | list_size = buf[0]; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 259 | |
Manuel Pégourié-Gonnard | c1b46d0 | 2015-09-16 11:18:32 +0200 | [diff] [blame] | 260 | p = buf + 1; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 261 | while( list_size > 0 ) |
| 262 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 263 | if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || |
| 264 | p[0] == MBEDTLS_ECP_PF_COMPRESSED ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 265 | { |
Neil Armstrong | 3ea0149 | 2022-04-12 14:41:50 +0200 | [diff] [blame] | 266 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ |
| 267 | ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) ) |
Manuel Pégourié-Gonnard | 5734b2d | 2013-08-15 19:04:02 +0200 | [diff] [blame] | 268 | ssl->handshake->ecdh_ctx.point_format = p[0]; |
Neil Armstrong | 3ea0149 | 2022-04-12 14:41:50 +0200 | [diff] [blame] | 269 | #endif /* !MBEDTLS_USE_PSA_CRYPTO && |
| 270 | ( MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ) */ |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 271 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ |
| 272 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Gilles Peskine | cd07e22 | 2021-05-27 23:17:34 +0200 | [diff] [blame] | 273 | mbedtls_ecjpake_set_point_format( &ssl->handshake->ecjpake_ctx, |
| 274 | p[0] ); |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 275 | #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 276 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 277 | return( 0 ); |
| 278 | } |
| 279 | |
| 280 | list_size--; |
| 281 | p++; |
| 282 | } |
| 283 | |
| 284 | return( 0 ); |
| 285 | } |
Robert Cragie | ae8535d | 2015-10-06 17:11:18 +0100 | [diff] [blame] | 286 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
| 287 | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 288 | |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 289 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 290 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 291 | static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl, |
| 292 | const unsigned char *buf, |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 293 | size_t len) |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 294 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 295 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 296 | |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 297 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 298 | if( ssl->handshake->psa_pake_ctx_is_ok != 1 ) |
| 299 | #else |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 300 | if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 ) |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 301 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 302 | { |
| 303 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) ); |
| 304 | return( 0 ); |
| 305 | } |
| 306 | |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 307 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Valerio Setti | 819de86 | 2022-11-17 18:05:19 +0100 | [diff] [blame] | 308 | if( ( ret = mbedtls_psa_ecjpake_read_round( |
| 309 | &ssl->handshake->psa_pake_ctx, buf, len, |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 310 | MBEDTLS_ECJPAKE_ROUND_ONE ) ) != 0 ) |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 311 | { |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 312 | psa_destroy_key( ssl->handshake->psa_pake_password ); |
| 313 | psa_pake_abort( &ssl->handshake->psa_pake_ctx ); |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 314 | |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 315 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_pake_input round one", ret ); |
| 316 | mbedtls_ssl_send_alert_message( |
| 317 | ssl, |
| 318 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 319 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 320 | |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 321 | return( ret ); |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 322 | } |
| 323 | #else |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 324 | if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx, |
| 325 | buf, len ) ) != 0 ) |
| 326 | { |
| 327 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 328 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 329 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 330 | return( ret ); |
| 331 | } |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 332 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 333 | |
| 334 | /* Only mark the extension as OK when we're sure it is */ |
| 335 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK; |
| 336 | |
| 337 | return( 0 ); |
| 338 | } |
| 339 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
| 340 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 341 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 342 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 343 | static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 344 | const unsigned char *buf, |
| 345 | size_t len ) |
| 346 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 347 | if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ) |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 348 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 349 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 350 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 351 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 352 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 353 | } |
| 354 | |
Manuel Pégourié-Gonnard | ed4af8b | 2013-07-18 14:07:09 +0200 | [diff] [blame] | 355 | ssl->session_negotiate->mfl_code = buf[0]; |
| 356 | |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 357 | return( 0 ); |
| 358 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 359 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 360 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 361 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 362 | MBEDTLS_CHECK_RETURN_CRITICAL |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 363 | static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl, |
| 364 | const unsigned char *buf, |
| 365 | size_t len ) |
| 366 | { |
| 367 | size_t peer_cid_len; |
| 368 | |
| 369 | /* CID extension only makes sense in DTLS */ |
| 370 | if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
| 371 | { |
| 372 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 373 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 374 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 375 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 376 | } |
| 377 | |
| 378 | /* |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 379 | * struct { |
| 380 | * opaque cid<0..2^8-1>; |
| 381 | * } ConnectionId; |
| 382 | */ |
| 383 | |
| 384 | if( len < 1 ) |
| 385 | { |
| 386 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 387 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 388 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
| 389 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 390 | } |
| 391 | |
| 392 | peer_cid_len = *buf++; |
| 393 | len--; |
| 394 | |
| 395 | if( len != peer_cid_len ) |
| 396 | { |
| 397 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 398 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 399 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
| 400 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 401 | } |
| 402 | |
| 403 | /* Ignore CID if the user has disabled its use. */ |
| 404 | if( ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED ) |
| 405 | { |
| 406 | /* Leave ssl->handshake->cid_in_use in its default |
| 407 | * value of MBEDTLS_SSL_CID_DISABLED. */ |
| 408 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "Client sent CID extension, but CID disabled" ) ); |
| 409 | return( 0 ); |
| 410 | } |
| 411 | |
| 412 | if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX ) |
| 413 | { |
| 414 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 415 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 416 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 417 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 418 | } |
| 419 | |
Hanno Becker | 08556bf | 2019-05-03 12:43:44 +0100 | [diff] [blame] | 420 | ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED; |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 421 | ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len; |
| 422 | memcpy( ssl->handshake->peer_cid, buf, peer_cid_len ); |
| 423 | |
| 424 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) ); |
| 425 | MBEDTLS_SSL_DEBUG_BUF( 3, "Client CID", buf, peer_cid_len ); |
| 426 | |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 427 | return( 0 ); |
| 428 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 429 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 430 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 431 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 432 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 433 | static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 434 | const unsigned char *buf, |
| 435 | size_t len ) |
| 436 | { |
| 437 | if( len != 0 ) |
| 438 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 439 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 440 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 441 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 442 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 443 | } |
| 444 | |
| 445 | ((void) buf); |
| 446 | |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 447 | if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED ) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 448 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 449 | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 450 | } |
| 451 | |
| 452 | return( 0 ); |
| 453 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 454 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 455 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 456 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 457 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 458 | static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 459 | const unsigned char *buf, |
| 460 | size_t len ) |
| 461 | { |
| 462 | if( len != 0 ) |
| 463 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 464 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 465 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 466 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 467 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 468 | } |
| 469 | |
| 470 | ((void) buf); |
| 471 | |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 472 | if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED ) |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 473 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 474 | ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; |
Manuel Pégourié-Gonnard | b575b54 | 2014-10-24 15:12:31 +0200 | [diff] [blame] | 475 | } |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 476 | |
| 477 | return( 0 ); |
| 478 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 479 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 480 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 481 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 482 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 483 | static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 990c51a | 2013-08-03 15:37:58 +0200 | [diff] [blame] | 484 | unsigned char *buf, |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 485 | size_t len ) |
| 486 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 487 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 488 | mbedtls_ssl_session session; |
Manuel Pégourié-Gonnard | 990c51a | 2013-08-03 15:37:58 +0200 | [diff] [blame] | 489 | |
Manuel Pégourié-Gonnard | bae389b | 2015-06-24 10:45:58 +0200 | [diff] [blame] | 490 | mbedtls_ssl_session_init( &session ); |
| 491 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 492 | if( ssl->conf->f_ticket_parse == NULL || |
| 493 | ssl->conf->f_ticket_write == NULL ) |
| 494 | { |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 495 | return( 0 ); |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 496 | } |
Manuel Pégourié-Gonnard | aa0d4d1 | 2013-08-03 13:02:31 +0200 | [diff] [blame] | 497 | |
Manuel Pégourié-Gonnard | 306827e | 2013-08-02 18:05:14 +0200 | [diff] [blame] | 498 | /* Remember the client asked us to send a new ticket */ |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 499 | ssl->handshake->new_session_ticket = 1; |
| 500 | |
Paul Elliott | d48d5c6 | 2021-01-07 14:47:05 +0000 | [diff] [blame] | 501 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %" MBEDTLS_PRINTF_SIZET, len ) ); |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 502 | |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 503 | if( len == 0 ) |
| 504 | return( 0 ); |
| 505 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 506 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 507 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 508 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 509 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) ); |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 510 | return( 0 ); |
| 511 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 512 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 513 | |
| 514 | /* |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 515 | * Failures are ok: just ignore the ticket and proceed. |
| 516 | */ |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 517 | if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session, |
| 518 | buf, len ) ) != 0 ) |
Manuel Pégourié-Gonnard | 990c51a | 2013-08-03 15:37:58 +0200 | [diff] [blame] | 519 | { |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 520 | mbedtls_ssl_session_free( &session ); |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 521 | |
| 522 | if( ret == MBEDTLS_ERR_SSL_INVALID_MAC ) |
| 523 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) ); |
| 524 | else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED ) |
| 525 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) ); |
| 526 | else |
| 527 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret ); |
| 528 | |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 529 | return( 0 ); |
Manuel Pégourié-Gonnard | 990c51a | 2013-08-03 15:37:58 +0200 | [diff] [blame] | 530 | } |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 531 | |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 532 | /* |
| 533 | * Keep the session ID sent by the client, since we MUST send it back to |
| 534 | * inform them we're accepting the ticket (RFC 5077 section 3.4) |
| 535 | */ |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 536 | session.id_len = ssl->session_negotiate->id_len; |
| 537 | memcpy( &session.id, ssl->session_negotiate->id, session.id_len ); |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 538 | |
| 539 | mbedtls_ssl_session_free( ssl->session_negotiate ); |
| 540 | memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) ); |
| 541 | |
| 542 | /* Zeroize instead of free as we copied the content */ |
Andres Amaya Garcia | 1f6301b | 2018-04-17 09:51:09 -0500 | [diff] [blame] | 543 | mbedtls_platform_zeroize( &session, sizeof( mbedtls_ssl_session ) ); |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 544 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 545 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) ); |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 546 | |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 547 | ssl->handshake->resume = 1; |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 548 | |
Manuel Pégourié-Gonnard | 306827e | 2013-08-02 18:05:14 +0200 | [diff] [blame] | 549 | /* Don't send a new ticket after all, this one is OK */ |
| 550 | ssl->handshake->new_session_ticket = 0; |
| 551 | |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 552 | return( 0 ); |
| 553 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 554 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 555 | |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 556 | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 557 | MBEDTLS_CHECK_RETURN_CRITICAL |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 558 | static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl, |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 559 | const unsigned char *buf, |
| 560 | size_t len ) |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 561 | { |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 562 | mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 563 | size_t i,j; |
Johan Pascal | f6417ec | 2020-09-22 15:15:19 +0200 | [diff] [blame] | 564 | size_t profile_length; |
| 565 | uint16_t mki_length; |
Ron Eldor | 313d7b5 | 2018-12-10 14:56:21 +0200 | [diff] [blame] | 566 | /*! 2 bytes for profile length and 1 byte for mki len */ |
| 567 | const size_t size_of_lengths = 3; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 568 | |
| 569 | /* If use_srtp is not configured, just ignore the extension */ |
Johan Pascal | c3ccd98 | 2020-10-28 17:18:18 +0100 | [diff] [blame] | 570 | if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) || |
| 571 | ( ssl->conf->dtls_srtp_profile_list == NULL ) || |
| 572 | ( ssl->conf->dtls_srtp_profile_list_len == 0 ) ) |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 573 | { |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 574 | return( 0 ); |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 575 | } |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 576 | |
| 577 | /* RFC5764 section 4.1.1 |
| 578 | * uint8 SRTPProtectionProfile[2]; |
| 579 | * |
| 580 | * struct { |
| 581 | * SRTPProtectionProfiles SRTPProtectionProfiles; |
| 582 | * opaque srtp_mki<0..255>; |
| 583 | * } UseSRTPData; |
| 584 | |
| 585 | * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 586 | */ |
| 587 | |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 588 | /* |
| 589 | * Min length is 5: at least one protection profile(2 bytes) |
| 590 | * and length(2 bytes) + srtp_mki length(1 byte) |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 591 | * Check here that we have at least 2 bytes of protection profiles length |
Johan Pascal | 76fdf1d | 2020-10-22 23:31:00 +0200 | [diff] [blame] | 592 | * and one of srtp_mki length |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 593 | */ |
Johan Pascal | 76fdf1d | 2020-10-22 23:31:00 +0200 | [diff] [blame] | 594 | if( len < size_of_lengths ) |
Ron Eldor | 313d7b5 | 2018-12-10 14:56:21 +0200 | [diff] [blame] | 595 | { |
| 596 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 597 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
| 598 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Ron Eldor | 313d7b5 | 2018-12-10 14:56:21 +0200 | [diff] [blame] | 599 | } |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 600 | |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 601 | ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET; |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 602 | |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 603 | /* first 2 bytes are protection profile length(in bytes) */ |
| 604 | profile_length = ( buf[0] << 8 ) | buf[1]; |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 605 | buf += 2; |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 606 | |
Johan Pascal | 76fdf1d | 2020-10-22 23:31:00 +0200 | [diff] [blame] | 607 | /* The profile length cannot be bigger than input buffer size - lengths fields */ |
| 608 | if( profile_length > len - size_of_lengths || |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 609 | profile_length % 2 != 0 ) /* profiles are 2 bytes long, so the length must be even */ |
Ron Eldor | 313d7b5 | 2018-12-10 14:56:21 +0200 | [diff] [blame] | 610 | { |
| 611 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 612 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
| 613 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Ron Eldor | 313d7b5 | 2018-12-10 14:56:21 +0200 | [diff] [blame] | 614 | } |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 615 | /* |
| 616 | * parse the extension list values are defined in |
| 617 | * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml |
| 618 | */ |
Johan Pascal | 76fdf1d | 2020-10-22 23:31:00 +0200 | [diff] [blame] | 619 | for( j = 0; j < profile_length; j += 2 ) |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 620 | { |
Johan Pascal | 76fdf1d | 2020-10-22 23:31:00 +0200 | [diff] [blame] | 621 | uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1]; |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 622 | client_protection = mbedtls_ssl_check_srtp_profile_value( protection_profile_value ); |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 623 | |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 624 | if( client_protection != MBEDTLS_TLS_SRTP_UNSET ) |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 625 | { |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 626 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found srtp profile: %s", |
| 627 | mbedtls_ssl_get_srtp_profile_as_string( |
| 628 | client_protection ) ) ); |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 629 | } |
Johan Pascal | 8526957 | 2020-08-25 10:01:54 +0200 | [diff] [blame] | 630 | else |
| 631 | { |
| 632 | continue; |
| 633 | } |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 634 | /* check if suggested profile is in our list */ |
Ron Eldor | a978804 | 2018-12-05 11:04:31 +0200 | [diff] [blame] | 635 | for( i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++) |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 636 | { |
| 637 | if( client_protection == ssl->conf->dtls_srtp_profile_list[i] ) |
| 638 | { |
Ron Eldor | 3adb992 | 2017-12-21 10:15:08 +0200 | [diff] [blame] | 639 | ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i]; |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 640 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected srtp profile: %s", |
| 641 | mbedtls_ssl_get_srtp_profile_as_string( |
| 642 | client_protection ) ) ); |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 643 | break; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 644 | } |
| 645 | } |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 646 | if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET ) |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 647 | break; |
| 648 | } |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 649 | buf += profile_length; /* buf points to the mki length */ |
| 650 | mki_length = *buf; |
| 651 | buf++; |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 652 | |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 653 | if( mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH || |
| 654 | mki_length + profile_length + size_of_lengths != len ) |
| 655 | { |
| 656 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 657 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
| 658 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 659 | } |
| 660 | |
| 661 | /* Parse the mki only if present and mki is supported locally */ |
| 662 | if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED && |
| 663 | mki_length > 0 ) |
| 664 | { |
| 665 | ssl->dtls_srtp_info.mki_len = mki_length; |
| 666 | |
Johan Pascal | 5ef72d2 | 2020-10-28 17:05:47 +0100 | [diff] [blame] | 667 | memcpy( ssl->dtls_srtp_info.mki_value, buf, mki_length ); |
Ron Eldor | b465539 | 2018-07-05 18:25:39 +0300 | [diff] [blame] | 668 | |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 669 | MBEDTLS_SSL_DEBUG_BUF( 3, "using mki", ssl->dtls_srtp_info.mki_value, |
| 670 | ssl->dtls_srtp_info.mki_len ); |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 671 | } |
| 672 | |
Johan Pascal | 042d456 | 2020-08-25 12:14:02 +0200 | [diff] [blame] | 673 | return( 0 ); |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 674 | } |
| 675 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 676 | |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 677 | /* |
| 678 | * Auxiliary functions for ServerHello parsing and related actions |
| 679 | */ |
| 680 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 681 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 682 | /* |
Manuel Pégourié-Gonnard | 6458e3b | 2015-01-08 14:16:56 +0100 | [diff] [blame] | 683 | * Return 0 if the given key uses one of the acceptable curves, -1 otherwise |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 684 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 685 | #if defined(MBEDTLS_ECDSA_C) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 686 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 687 | static int ssl_check_key_curve( mbedtls_pk_context *pk, |
| 688 | const mbedtls_ecp_curve_info **curves ) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 689 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 690 | const mbedtls_ecp_curve_info **crv = curves; |
| 691 | mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id; |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 692 | |
| 693 | while( *crv != NULL ) |
| 694 | { |
| 695 | if( (*crv)->grp_id == grp_id ) |
Manuel Pégourié-Gonnard | 6458e3b | 2015-01-08 14:16:56 +0100 | [diff] [blame] | 696 | return( 0 ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 697 | crv++; |
| 698 | } |
| 699 | |
Manuel Pégourié-Gonnard | 6458e3b | 2015-01-08 14:16:56 +0100 | [diff] [blame] | 700 | return( -1 ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 701 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 702 | #endif /* MBEDTLS_ECDSA_C */ |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 703 | |
| 704 | /* |
| 705 | * Try picking a certificate for this ciphersuite, |
| 706 | * return 0 on success and -1 on failure. |
| 707 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 708 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 709 | static int ssl_pick_cert( mbedtls_ssl_context *ssl, |
| 710 | const mbedtls_ssl_ciphersuite_t * ciphersuite_info ) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 711 | { |
Glenn Strauss | 041a376 | 2022-03-15 06:08:29 -0400 | [diff] [blame] | 712 | mbedtls_ssl_key_cert *cur, *list; |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 713 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 714 | psa_algorithm_t pk_alg = |
Neil Armstrong | 9f4606e | 2022-06-24 15:00:50 +0200 | [diff] [blame] | 715 | mbedtls_ssl_get_ciphersuite_sig_pk_psa_alg( ciphersuite_info ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 716 | psa_key_usage_t pk_usage = |
Neil Armstrong | 9f4606e | 2022-06-24 15:00:50 +0200 | [diff] [blame] | 717 | mbedtls_ssl_get_ciphersuite_sig_pk_psa_usage( ciphersuite_info ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 718 | #else |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 719 | mbedtls_pk_type_t pk_alg = |
| 720 | mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 721 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | e6ef16f | 2015-05-11 19:54:43 +0200 | [diff] [blame] | 722 | uint32_t flags; |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 723 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 724 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 725 | if( ssl->handshake->sni_key_cert != NULL ) |
| 726 | list = ssl->handshake->sni_key_cert; |
| 727 | else |
| 728 | #endif |
Manuel Pégourié-Gonnard | 8f618a8 | 2015-05-10 21:13:36 +0200 | [diff] [blame] | 729 | list = ssl->conf->key_cert; |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 730 | |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 731 | int pk_alg_is_none = 0; |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 732 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 733 | pk_alg_is_none = ( pk_alg == PSA_ALG_NONE ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 734 | #else |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 735 | pk_alg_is_none = ( pk_alg == MBEDTLS_PK_NONE ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 736 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 737 | if( pk_alg_is_none ) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 738 | return( 0 ); |
| 739 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 740 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 741 | |
Manuel Pégourié-Gonnard | e540b49 | 2015-07-07 12:44:38 +0200 | [diff] [blame] | 742 | if( list == NULL ) |
| 743 | { |
| 744 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) ); |
| 745 | return( -1 ); |
| 746 | } |
| 747 | |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 748 | for( cur = list; cur != NULL; cur = cur->next ) |
| 749 | { |
Andrzej Kurek | 7ed01e8 | 2020-03-18 11:51:59 -0400 | [diff] [blame] | 750 | flags = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 751 | MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate", |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 752 | cur->cert ); |
| 753 | |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 754 | int key_type_matches = 0; |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 755 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 756 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 757 | key_type_matches = ( ( ssl->conf->f_async_sign_start != NULL || |
| 758 | ssl->conf->f_async_decrypt_start != NULL || |
| 759 | mbedtls_pk_can_do_ext( cur->key, pk_alg, pk_usage ) ) && |
| 760 | mbedtls_pk_can_do_ext( &cur->cert->pk, pk_alg, pk_usage ) ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 761 | #else |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 762 | key_type_matches = ( |
| 763 | mbedtls_pk_can_do_ext( cur->key, pk_alg, pk_usage ) ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 764 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
| 765 | #else |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 766 | key_type_matches = mbedtls_pk_can_do( &cur->cert->pk, pk_alg ); |
Neil Armstrong | 0c9c10a | 2022-05-12 14:15:06 +0200 | [diff] [blame] | 767 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
David Horstmann | 3a334c2 | 2022-10-25 10:53:44 +0100 | [diff] [blame] | 768 | if( !key_type_matches ) |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 769 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 770 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 771 | continue; |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 772 | } |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 773 | |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 774 | /* |
| 775 | * This avoids sending the client a cert it'll reject based on |
| 776 | * keyUsage or other extensions. |
| 777 | * |
| 778 | * It also allows the user to provision different certificates for |
| 779 | * different uses based on keyUsage, eg if they want to avoid signing |
| 780 | * and decrypting with the same RSA key. |
| 781 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 782 | if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info, |
Manuel Pégourié-Gonnard | e6efa6f | 2015-04-20 11:01:48 +0100 | [diff] [blame] | 783 | MBEDTLS_SSL_IS_SERVER, &flags ) != 0 ) |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 784 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 785 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: " |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 786 | "(extended) key usage extension" ) ); |
Manuel Pégourié-Gonnard | 7f2a07d | 2014-04-09 09:50:57 +0200 | [diff] [blame] | 787 | continue; |
| 788 | } |
| 789 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 790 | #if defined(MBEDTLS_ECDSA_C) |
| 791 | if( pk_alg == MBEDTLS_PK_ECDSA && |
Gilles Peskine | 81d4e89 | 2017-10-27 10:18:44 +0200 | [diff] [blame] | 792 | ssl_check_key_curve( &cur->cert->pk, ssl->handshake->curves ) != 0 ) |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 793 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 794 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) ); |
Manuel Pégourié-Gonnard | 846ba47 | 2015-01-08 13:54:38 +0100 | [diff] [blame] | 795 | continue; |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 796 | } |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 797 | #endif |
Manuel Pégourié-Gonnard | 846ba47 | 2015-01-08 13:54:38 +0100 | [diff] [blame] | 798 | |
| 799 | /* If we get there, we got a winner */ |
| 800 | break; |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 801 | } |
| 802 | |
Manuel Pégourié-Gonnard | 8f618a8 | 2015-05-10 21:13:36 +0200 | [diff] [blame] | 803 | /* Do not update ssl->handshake->key_cert unless there is a match */ |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 804 | if( cur != NULL ) |
| 805 | { |
| 806 | ssl->handshake->key_cert = cur; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 807 | MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate", |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 808 | ssl->handshake->key_cert->cert ); |
Manuel Pégourié-Gonnard | df331a5 | 2015-01-08 16:43:07 +0100 | [diff] [blame] | 809 | return( 0 ); |
| 810 | } |
| 811 | |
| 812 | return( -1 ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 813 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 814 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 815 | |
| 816 | /* |
| 817 | * Check if a given ciphersuite is suitable for use with our config/keys/etc |
| 818 | * Sets ciphersuite_info only if the suite matches. |
| 819 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 820 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 821 | static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id, |
| 822 | const mbedtls_ssl_ciphersuite_t **ciphersuite_info ) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 823 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 824 | const mbedtls_ssl_ciphersuite_t *suite_info; |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 825 | |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 826 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 827 | mbedtls_pk_type_t sig_type; |
| 828 | #endif |
| 829 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 830 | suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 831 | if( suite_info == NULL ) |
| 832 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 833 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 834 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 835 | } |
| 836 | |
Hanno Becker | 5c5efdf | 2019-01-28 14:59:35 +0000 | [diff] [blame] | 837 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %#04x (%s)", |
Paul Elliott | 3891caf | 2020-12-17 18:42:40 +0000 | [diff] [blame] | 838 | (unsigned int) suite_id, suite_info->name ) ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 839 | |
Glenn Strauss | 60bfe60 | 2022-03-14 19:04:24 -0400 | [diff] [blame] | 840 | if( suite_info->min_tls_version > ssl->tls_version || |
| 841 | suite_info->max_tls_version < ssl->tls_version ) |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 842 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 843 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 844 | return( 0 ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 845 | } |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 846 | |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 847 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 848 | if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 849 | ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 ) |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 850 | { |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 851 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake " |
| 852 | "not configured or ext missing" ) ); |
Manuel Pégourié-Gonnard | e511b4e | 2015-09-16 14:11:09 +0200 | [diff] [blame] | 853 | return( 0 ); |
| 854 | } |
| 855 | #endif |
| 856 | |
| 857 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 858 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
| 859 | if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) && |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 860 | ( ssl->handshake->curves == NULL || |
| 861 | ssl->handshake->curves[0] == NULL ) ) |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 862 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 863 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: " |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 864 | "no common elliptic curve" ) ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 865 | return( 0 ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 866 | } |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 867 | #endif |
| 868 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 869 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 870 | /* If the ciphersuite requires a pre-shared key and we don't |
| 871 | * have one, skip it now rather than failing later */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 872 | if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) && |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 873 | ssl_conf_has_psk_or_cb( ssl->conf ) == 0 ) |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 874 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 875 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 876 | return( 0 ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 877 | } |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 878 | #endif |
| 879 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 880 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 881 | /* |
| 882 | * Final check: if ciphersuite requires us to have a |
| 883 | * certificate/key of a particular type: |
| 884 | * - select the appropriate certificate if we have one, or |
| 885 | * - try the next ciphersuite if we don't |
| 886 | * This must be done last since we modify the key_cert list. |
| 887 | */ |
| 888 | if( ssl_pick_cert( ssl, suite_info ) != 0 ) |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 889 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 890 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: " |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 891 | "no suitable certificate" ) ); |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 892 | return( 0 ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 893 | } |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 894 | #endif |
| 895 | |
Neil Armstrong | 9f1176a | 2022-06-24 18:19:19 +0200 | [diff] [blame] | 896 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
| 897 | /* If the ciphersuite requires signing, check whether |
| 898 | * a suitable hash algorithm is present. */ |
| 899 | sig_type = mbedtls_ssl_get_ciphersuite_sig_alg( suite_info ); |
| 900 | if( sig_type != MBEDTLS_PK_NONE && |
| 901 | mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( |
| 902 | ssl, mbedtls_ssl_sig_from_pk_alg( sig_type ) ) == MBEDTLS_SSL_HASH_NONE ) |
| 903 | { |
| 904 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm " |
| 905 | "for signature algorithm %u", (unsigned) sig_type ) ); |
| 906 | return( 0 ); |
| 907 | } |
| 908 | |
| 909 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
| 910 | |
Manuel Pégourié-Gonnard | 3252560 | 2013-11-30 17:50:32 +0100 | [diff] [blame] | 911 | *ciphersuite_info = suite_info; |
| 912 | return( 0 ); |
| 913 | } |
| 914 | |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 915 | /* This function doesn't alert on errors that happen early during |
| 916 | ClientHello parsing because they might indicate that the client is |
| 917 | not talking SSL/TLS at all and would not understand our alert. */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 918 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 919 | static int ssl_parse_client_hello( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 920 | { |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 921 | int ret, got_common_suite; |
Manuel Pégourié-Gonnard | 9de64f5 | 2015-07-01 15:51:43 +0200 | [diff] [blame] | 922 | size_t i, j; |
| 923 | size_t ciph_offset, comp_offset, ext_offset; |
| 924 | size_t msg_len, ciph_len, sess_len, comp_len, ext_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 925 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 9de64f5 | 2015-07-01 15:51:43 +0200 | [diff] [blame] | 926 | size_t cookie_offset, cookie_len; |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 927 | #endif |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 928 | unsigned char *buf, *p, *ext; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 929 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 930 | int renegotiation_info_seen = 0; |
Manuel Pégourié-Gonnard | eaecbd3 | 2014-11-06 02:38:02 +0100 | [diff] [blame] | 931 | #endif |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 932 | int handshake_failure = 0; |
Paul Bakker | 8f4ddae | 2013-04-15 15:09:54 +0200 | [diff] [blame] | 933 | const int *ciphersuites; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 934 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 935 | |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 936 | /* If there is no signature-algorithm extension present, |
| 937 | * we need to fall back to the default values for allowed |
| 938 | * signature-hash pairs. */ |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 939 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 940 | int sig_hash_alg_ext_present = 0; |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 941 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 942 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 943 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 944 | |
David Horstmann | e0af39a | 2022-10-06 18:19:18 +0100 | [diff] [blame] | 945 | int renegotiating; |
| 946 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 947 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Manuel Pégourié-Gonnard | f03c7aa | 2014-09-24 14:54:06 +0200 | [diff] [blame] | 948 | read_record_header: |
| 949 | #endif |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 950 | /* |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 951 | * If renegotiating, then the input was read with mbedtls_ssl_read_record(), |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 952 | * otherwise read it ourselves manually in order to support SSLv2 |
| 953 | * ClientHello, which doesn't use the same record layer format. |
| 954 | */ |
David Horstmann | e0af39a | 2022-10-06 18:19:18 +0100 | [diff] [blame] | 955 | renegotiating = 0; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 956 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
David Horstmann | e0af39a | 2022-10-06 18:19:18 +0100 | [diff] [blame] | 957 | renegotiating = ( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ); |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 958 | #endif |
David Horstmann | e0af39a | 2022-10-06 18:19:18 +0100 | [diff] [blame] | 959 | if( !renegotiating ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 960 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 961 | if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 ) |
Manuel Pégourié-Gonnard | 59c6f2e | 2015-01-22 11:06:40 +0000 | [diff] [blame] | 962 | { |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 963 | /* No alert on a read error. */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 964 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
Manuel Pégourié-Gonnard | 59c6f2e | 2015-01-22 11:06:40 +0000 | [diff] [blame] | 965 | return( ret ); |
| 966 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 967 | } |
| 968 | |
| 969 | buf = ssl->in_hdr; |
| 970 | |
Hanno Becker | 5903de4 | 2019-05-03 14:46:38 +0100 | [diff] [blame] | 971 | MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_in_hdr_len( ssl ) ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 972 | |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 973 | /* |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 974 | * TLS Client Hello |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 975 | * |
| 976 | * Record layer: |
| 977 | * 0 . 0 message type |
| 978 | * 1 . 2 protocol version |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 979 | * 3 . 11 DTLS: epoch + record sequence number |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 980 | * 3 . 4 message length |
| 981 | */ |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 982 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, message type: %d", |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 983 | buf[0] ) ); |
| 984 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 985 | if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE ) |
Manuel Pégourié-Gonnard | abc7e3b | 2014-02-11 18:15:03 +0100 | [diff] [blame] | 986 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 987 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 988 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
Manuel Pégourié-Gonnard | abc7e3b | 2014-02-11 18:15:03 +0100 | [diff] [blame] | 989 | } |
| 990 | |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 991 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, message len.: %d", |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 992 | ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) ); |
| 993 | |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 994 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, protocol version: [%d:%d]", |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 995 | buf[1], buf[2] ) ); |
| 996 | |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 997 | /* For DTLS if this is the initial handshake, remember the client sequence |
| 998 | * number to use it in our next message (RFC 6347 4.2.1) */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 999 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1000 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1001 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1002 | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
Manuel Pégourié-Gonnard | 3a173f4 | 2015-01-22 13:30:33 +0000 | [diff] [blame] | 1003 | #endif |
| 1004 | ) |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1005 | { |
| 1006 | /* Epoch should be 0 for initial handshakes */ |
| 1007 | if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 ) |
| 1008 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1009 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1010 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1011 | } |
| 1012 | |
Jerry Yu | d9a94fe | 2021-09-28 18:58:59 +0800 | [diff] [blame] | 1013 | memcpy( &ssl->cur_out_ctr[2], ssl->in_ctr + 2, |
Jerry Yu | d96a5c2 | 2021-09-29 17:46:51 +0800 | [diff] [blame] | 1014 | sizeof( ssl->cur_out_ctr ) - 2 ); |
Manuel Pégourié-Gonnard | f03c7aa | 2014-09-24 14:54:06 +0200 | [diff] [blame] | 1015 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1016 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
| 1017 | if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 ) |
Manuel Pégourié-Gonnard | f03c7aa | 2014-09-24 14:54:06 +0200 | [diff] [blame] | 1018 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1019 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) ); |
Manuel Pégourié-Gonnard | f03c7aa | 2014-09-24 14:54:06 +0200 | [diff] [blame] | 1020 | ssl->next_record_offset = 0; |
| 1021 | ssl->in_left = 0; |
| 1022 | goto read_record_header; |
| 1023 | } |
| 1024 | |
| 1025 | /* No MAC to check yet, so we can update right now */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1026 | mbedtls_ssl_dtls_replay_update( ssl ); |
Manuel Pégourié-Gonnard | f03c7aa | 2014-09-24 14:54:06 +0200 | [diff] [blame] | 1027 | #endif |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1028 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1029 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1030 | |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1031 | msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1]; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 1032 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1033 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1034 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Manuel Pégourié-Gonnard | b89c4f3 | 2015-01-21 13:24:10 +0000 | [diff] [blame] | 1035 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1036 | /* Set by mbedtls_ssl_read_record() */ |
Manuel Pégourié-Gonnard | b89c4f3 | 2015-01-21 13:24:10 +0000 | [diff] [blame] | 1037 | msg_len = ssl->in_hslen; |
| 1038 | } |
| 1039 | else |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1040 | #endif |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1041 | { |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 1042 | if( msg_len > MBEDTLS_SSL_IN_CONTENT_LEN ) |
Manuel Pégourié-Gonnard | d6b721c | 2014-03-24 12:13:54 +0100 | [diff] [blame] | 1043 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1044 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1045 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Manuel Pégourié-Gonnard | d6b721c | 2014-03-24 12:13:54 +0100 | [diff] [blame] | 1046 | } |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1047 | |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 1048 | if( ( ret = mbedtls_ssl_fetch_input( ssl, |
Hanno Becker | 5903de4 | 2019-05-03 14:46:38 +0100 | [diff] [blame] | 1049 | mbedtls_ssl_in_hdr_len( ssl ) + msg_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | d6b721c | 2014-03-24 12:13:54 +0100 | [diff] [blame] | 1050 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1051 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
Manuel Pégourié-Gonnard | d6b721c | 2014-03-24 12:13:54 +0100 | [diff] [blame] | 1052 | return( ret ); |
| 1053 | } |
Manuel Pégourié-Gonnard | 30d16eb | 2014-08-19 17:43:50 +0200 | [diff] [blame] | 1054 | |
| 1055 | /* Done reading this record, get ready for the next one */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1056 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1057 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Hanno Becker | 5903de4 | 2019-05-03 14:46:38 +0100 | [diff] [blame] | 1058 | ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len( ssl ); |
Manuel Pégourié-Gonnard | 30d16eb | 2014-08-19 17:43:50 +0200 | [diff] [blame] | 1059 | else |
| 1060 | #endif |
| 1061 | ssl->in_left = 0; |
Manuel Pégourié-Gonnard | d6b721c | 2014-03-24 12:13:54 +0100 | [diff] [blame] | 1062 | } |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1063 | |
| 1064 | buf = ssl->in_msg; |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1065 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1066 | MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len ); |
Manuel Pégourié-Gonnard | e89bcf0 | 2014-02-18 18:50:02 +0100 | [diff] [blame] | 1067 | |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1068 | ssl->handshake->update_checksum( ssl, buf, msg_len ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1069 | |
| 1070 | /* |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1071 | * Handshake layer: |
| 1072 | * 0 . 0 handshake type |
| 1073 | * 1 . 3 handshake length |
Shaun Case | 8b0ecbc | 2021-12-20 21:14:10 -0800 | [diff] [blame] | 1074 | * 4 . 5 DTLS only: message sequence number |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1075 | * 6 . 8 DTLS only: fragment offset |
| 1076 | * 9 . 11 DTLS only: fragment length |
Manuel Pégourié-Gonnard | ce441b3 | 2014-02-18 17:40:52 +0100 | [diff] [blame] | 1077 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1078 | if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) ) |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1079 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1080 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1081 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1082 | } |
| 1083 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1084 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) ); |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1085 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1086 | if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1087 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1088 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1089 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1090 | } |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1091 | { |
Andrzej Kurek | cbe14ec | 2022-06-15 07:17:28 -0400 | [diff] [blame] | 1092 | size_t handshake_len = MBEDTLS_GET_UINT24_BE( buf, 1 ); |
Andrzej Kurek | 755ddff | 2022-06-15 07:31:40 -0400 | [diff] [blame] | 1093 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %u", |
Andrzej Kurek | cbe14ec | 2022-06-15 07:17:28 -0400 | [diff] [blame] | 1094 | ( unsigned ) handshake_len ) ); |
| 1095 | |
| 1096 | /* The record layer has a record size limit of 2^14 - 1 and |
| 1097 | * fragmentation is not supported, so buf[1] should be zero. */ |
| 1098 | if( buf[1] != 0 ) |
| 1099 | { |
| 1100 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message: %u != 0", |
| 1101 | (unsigned) buf[1] ) ); |
| 1102 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 1103 | } |
| 1104 | |
| 1105 | /* We don't support fragmentation of ClientHello (yet?) */ |
| 1106 | if( msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + handshake_len ) |
| 1107 | { |
| 1108 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message: %u != %u + %u", |
Gilles Peskine | 364fd8b | 2022-02-15 23:53:36 +0100 | [diff] [blame] | 1109 | (unsigned) msg_len, |
| 1110 | (unsigned) mbedtls_ssl_hs_hdr_len( ssl ), |
Andrzej Kurek | cbe14ec | 2022-06-15 07:17:28 -0400 | [diff] [blame] | 1111 | (unsigned) handshake_len ) ); |
| 1112 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 1113 | } |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1114 | } |
| 1115 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1116 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1117 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | ce441b3 | 2014-02-18 17:40:52 +0100 | [diff] [blame] | 1118 | { |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1119 | /* |
Manuel Pégourié-Gonnard | 69849f8 | 2015-03-10 11:54:02 +0000 | [diff] [blame] | 1120 | * Copy the client's handshake message_seq on initial handshakes, |
| 1121 | * check sequence number on renego. |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1122 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1123 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1124 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
Manuel Pégourié-Gonnard | 1aa586e | 2014-09-03 12:54:04 +0200 | [diff] [blame] | 1125 | { |
| 1126 | /* This couldn't be done in ssl_prepare_handshake_record() */ |
| 1127 | unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) | |
| 1128 | ssl->in_msg[5]; |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1129 | |
Manuel Pégourié-Gonnard | 1aa586e | 2014-09-03 12:54:04 +0200 | [diff] [blame] | 1130 | if( cli_msg_seq != ssl->handshake->in_msg_seq ) |
| 1131 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1132 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: " |
Paul Elliott | 9f35211 | 2020-12-09 14:55:45 +0000 | [diff] [blame] | 1133 | "%u (expected %u)", cli_msg_seq, |
Manuel Pégourié-Gonnard | 1aa586e | 2014-09-03 12:54:04 +0200 | [diff] [blame] | 1134 | ssl->handshake->in_msg_seq ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1135 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 1aa586e | 2014-09-03 12:54:04 +0200 | [diff] [blame] | 1136 | } |
| 1137 | |
| 1138 | ssl->handshake->in_msg_seq++; |
| 1139 | } |
Manuel Pégourié-Gonnard | 69849f8 | 2015-03-10 11:54:02 +0000 | [diff] [blame] | 1140 | else |
| 1141 | #endif |
| 1142 | { |
| 1143 | unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) | |
| 1144 | ssl->in_msg[5]; |
| 1145 | ssl->handshake->out_msg_seq = cli_msg_seq; |
| 1146 | ssl->handshake->in_msg_seq = cli_msg_seq + 1; |
| 1147 | } |
Manuel Pégourié-Gonnard | e89bcf0 | 2014-02-18 18:50:02 +0100 | [diff] [blame] | 1148 | { |
Andrzej Kurek | cbe14ec | 2022-06-15 07:17:28 -0400 | [diff] [blame] | 1149 | /* |
| 1150 | * For now we don't support fragmentation, so make sure |
| 1151 | * fragment_offset == 0 and fragment_length == length |
| 1152 | */ |
| 1153 | size_t fragment_offset, fragment_length, length; |
| 1154 | fragment_offset = MBEDTLS_GET_UINT24_BE( ssl->in_msg, 6 ); |
| 1155 | fragment_length = MBEDTLS_GET_UINT24_BE( ssl->in_msg, 9 ); |
| 1156 | length = MBEDTLS_GET_UINT24_BE( ssl->in_msg, 1 ); |
| 1157 | MBEDTLS_SSL_DEBUG_MSG( |
| 1158 | 4, ( "fragment_offset=%u fragment_length=%u length=%u", |
| 1159 | (unsigned) fragment_offset, (unsigned) fragment_length, |
| 1160 | (unsigned) length ) ); |
| 1161 | if( fragment_offset != 0 || length != fragment_length ) |
| 1162 | { |
| 1163 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) ); |
| 1164 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
| 1165 | } |
Manuel Pégourié-Gonnard | e89bcf0 | 2014-02-18 18:50:02 +0100 | [diff] [blame] | 1166 | } |
Manuel Pégourié-Gonnard | ce441b3 | 2014-02-18 17:40:52 +0100 | [diff] [blame] | 1167 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1168 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | ce441b3 | 2014-02-18 17:40:52 +0100 | [diff] [blame] | 1169 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1170 | buf += mbedtls_ssl_hs_hdr_len( ssl ); |
| 1171 | msg_len -= mbedtls_ssl_hs_hdr_len( ssl ); |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1172 | |
Manuel Pégourié-Gonnard | ce441b3 | 2014-02-18 17:40:52 +0100 | [diff] [blame] | 1173 | /* |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1174 | * ClientHello layer: |
| 1175 | * 0 . 1 protocol version |
| 1176 | * 2 . 33 random bytes (starting with 4 bytes of Unix time) |
| 1177 | * 34 . 35 session id length (1 byte) |
| 1178 | * 35 . 34+x session id |
| 1179 | * 35+x . 35+x DTLS only: cookie length (1 byte) |
| 1180 | * 36+x . .. DTLS only: cookie |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1181 | * .. . .. ciphersuite list length (2 bytes) |
| 1182 | * .. . .. ciphersuite list |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1183 | * .. . .. compression alg. list length (1 byte) |
| 1184 | * .. . .. compression alg. list |
| 1185 | * .. . .. extensions length (2 bytes, optional) |
| 1186 | * .. . .. extensions (optional) |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1187 | */ |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1188 | |
| 1189 | /* |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 1190 | * Minimal length (with everything empty and extensions omitted) is |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1191 | * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can |
| 1192 | * read at least up to session id length without worrying. |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1193 | */ |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1194 | if( msg_len < 38 ) |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1195 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1196 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1197 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1198 | } |
| 1199 | |
| 1200 | /* |
| 1201 | * Check and save the protocol version |
| 1202 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1203 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 ); |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1204 | |
Glenn Strauss | e3af4cb | 2022-03-15 03:23:42 -0400 | [diff] [blame] | 1205 | ssl->tls_version = mbedtls_ssl_read_version( buf, ssl->conf->transport ); |
Glenn Strauss | 60bfe60 | 2022-03-14 19:04:24 -0400 | [diff] [blame] | 1206 | ssl->session_negotiate->tls_version = ssl->tls_version; |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1207 | |
Glenn Strauss | 60bfe60 | 2022-03-14 19:04:24 -0400 | [diff] [blame] | 1208 | if( ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2 ) |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1209 | { |
Ronald Cron | 90f0120 | 2022-03-15 15:37:13 +0100 | [diff] [blame] | 1210 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "server only supports TLS 1.2" ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1211 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1212 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); |
Hanno Becker | bc00044 | 2021-06-24 09:18:19 +0100 | [diff] [blame] | 1213 | return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ); |
Paul Bakker | 1d29fb5 | 2012-09-28 13:28:45 +0000 | [diff] [blame] | 1214 | } |
| 1215 | |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1216 | /* |
| 1217 | * Save client random (inc. Unix time) |
| 1218 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1219 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 ); |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1220 | |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1221 | memcpy( ssl->handshake->randbytes, buf + 2, 32 ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1222 | |
| 1223 | /* |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1224 | * Check the session ID length and save session ID |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1225 | */ |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1226 | sess_len = buf[34]; |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1227 | |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1228 | if( sess_len > sizeof( ssl->session_negotiate->id ) || |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1229 | sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */ |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1230 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1231 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1232 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1233 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1234 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1235 | } |
| 1236 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1237 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len ); |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1238 | |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 1239 | ssl->session_negotiate->id_len = sess_len; |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1240 | memset( ssl->session_negotiate->id, 0, |
| 1241 | sizeof( ssl->session_negotiate->id ) ); |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1242 | memcpy( ssl->session_negotiate->id, buf + 35, |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 1243 | ssl->session_negotiate->id_len ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1244 | |
| 1245 | /* |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1246 | * Check the cookie length and content |
| 1247 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1248 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1249 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1250 | { |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1251 | cookie_offset = 35 + sess_len; |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1252 | cookie_len = buf[cookie_offset]; |
| 1253 | |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1254 | if( cookie_offset + 1 + cookie_len + 2 > msg_len ) |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1255 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1256 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1257 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1258 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
| 1259 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1260 | } |
| 1261 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1262 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie", |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1263 | buf + cookie_offset + 1, cookie_len ); |
| 1264 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1265 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1266 | if( ssl->conf->f_cookie_check != NULL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1267 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1268 | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
Manuel Pégourié-Gonnard | 69849f8 | 2015-03-10 11:54:02 +0000 | [diff] [blame] | 1269 | #endif |
| 1270 | ) |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1271 | { |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1272 | if( ssl->conf->f_cookie_check( ssl->conf->p_cookie, |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 1273 | buf + cookie_offset + 1, cookie_len, |
| 1274 | ssl->cli_id, ssl->cli_id_len ) != 0 ) |
| 1275 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1276 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) ); |
Jerry Yu | ac5ca5a | 2022-03-04 12:50:46 +0800 | [diff] [blame] | 1277 | ssl->handshake->cookie_verify_result = 1; |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 1278 | } |
| 1279 | else |
| 1280 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1281 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) ); |
Jerry Yu | ac5ca5a | 2022-03-04 12:50:46 +0800 | [diff] [blame] | 1282 | ssl->handshake->cookie_verify_result = 0; |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 1283 | } |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 1284 | } |
Manuel Pégourié-Gonnard | d7f9bc5 | 2014-07-23 11:09:27 +0200 | [diff] [blame] | 1285 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1286 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 1287 | { |
| 1288 | /* We know we didn't send a cookie, so it should be empty */ |
| 1289 | if( cookie_len != 0 ) |
| 1290 | { |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1291 | /* This may be an attacker's probe, so don't send an alert */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1292 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1293 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 1294 | } |
| 1295 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1296 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) ); |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 1297 | } |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1298 | |
| 1299 | /* |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1300 | * Check the ciphersuitelist length (will be parsed later) |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1301 | */ |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1302 | ciph_offset = cookie_offset + 1 + cookie_len; |
Manuel Pégourié-Gonnard | a06d7fe | 2015-03-13 10:36:55 +0000 | [diff] [blame] | 1303 | } |
Manuel Pégourié-Gonnard | 4128aa7 | 2014-03-21 09:40:12 +0100 | [diff] [blame] | 1304 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1305 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 19d438f | 2014-09-09 17:08:52 +0200 | [diff] [blame] | 1306 | ciph_offset = 35 + sess_len; |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1307 | |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1308 | ciph_len = ( buf[ciph_offset + 0] << 8 ) |
| 1309 | | ( buf[ciph_offset + 1] ); |
| 1310 | |
| 1311 | if( ciph_len < 2 || |
| 1312 | ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */ |
| 1313 | ( ciph_len % 2 ) != 0 ) |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1314 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1315 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1316 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1317 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1318 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1319 | } |
| 1320 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1321 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist", |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1322 | buf + ciph_offset + 2, ciph_len ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1323 | |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1324 | /* |
Thomas Daubney | 20f89a9 | 2022-06-20 15:12:19 +0100 | [diff] [blame] | 1325 | * Check the compression algorithm's length. |
| 1326 | * The list contents are ignored because implementing |
| 1327 | * MBEDTLS_SSL_COMPRESS_NULL is mandatory and is the only |
| 1328 | * option supported by Mbed TLS. |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1329 | */ |
| 1330 | comp_offset = ciph_offset + 2 + ciph_len; |
| 1331 | |
| 1332 | comp_len = buf[comp_offset]; |
| 1333 | |
| 1334 | if( comp_len < 1 || |
| 1335 | comp_len > 16 || |
| 1336 | comp_len + comp_offset + 1 > msg_len ) |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1337 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1338 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1339 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1340 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1341 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | ec636f3 | 2012-09-09 19:17:02 +0000 | [diff] [blame] | 1342 | } |
| 1343 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1344 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression", |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1345 | buf + comp_offset + 1, comp_len ); |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1346 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1347 | /* |
| 1348 | * Check the extension length |
| 1349 | */ |
| 1350 | ext_offset = comp_offset + 1 + comp_len; |
| 1351 | if( msg_len > ext_offset ) |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1352 | { |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1353 | if( msg_len < ext_offset + 2 ) |
| 1354 | { |
| 1355 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1356 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1357 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1358 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1359 | } |
| 1360 | |
| 1361 | ext_len = ( buf[ext_offset + 0] << 8 ) |
| 1362 | | ( buf[ext_offset + 1] ); |
| 1363 | |
Glenn Strauss | 8a8a83b | 2021-02-02 02:21:23 -0500 | [diff] [blame] | 1364 | if( msg_len != ext_offset + 2 + ext_len ) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1365 | { |
| 1366 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1367 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1368 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1369 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1370 | } |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1371 | } |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1372 | else |
| 1373 | ext_len = 0; |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1374 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1375 | ext = buf + ext_offset + 2; |
| 1376 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len ); |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1377 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1378 | while( ext_len != 0 ) |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1379 | { |
Philippe Antoine | 747fd53 | 2018-05-30 09:13:21 +0200 | [diff] [blame] | 1380 | unsigned int ext_id; |
| 1381 | unsigned int ext_size; |
| 1382 | if ( ext_len < 4 ) { |
| 1383 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 1384 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1385 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1386 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Philippe Antoine | 747fd53 | 2018-05-30 09:13:21 +0200 | [diff] [blame] | 1387 | } |
| 1388 | ext_id = ( ( ext[0] << 8 ) | ( ext[1] ) ); |
| 1389 | ext_size = ( ( ext[2] << 8 ) | ( ext[3] ) ); |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1390 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1391 | if( ext_size + 4 > ext_len ) |
| 1392 | { |
| 1393 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Gilles Peskine | 1cc8e34 | 2017-05-03 16:28:34 +0200 | [diff] [blame] | 1394 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1395 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1396 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1397 | } |
| 1398 | switch( ext_id ) |
| 1399 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1400 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1401 | case MBEDTLS_TLS_EXT_SERVERNAME: |
| 1402 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) ); |
XiaokangQian | 9b2b771 | 2022-05-17 02:57:00 +0000 | [diff] [blame] | 1403 | ret = mbedtls_ssl_parse_server_name_ext( ssl, ext + 4, |
| 1404 | ext + 4 + ext_size ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1405 | if( ret != 0 ) |
| 1406 | return( ret ); |
| 1407 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1408 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
Paul Bakker | 5701cdc | 2012-09-27 21:49:42 +0000 | [diff] [blame] | 1409 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1410 | case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: |
| 1411 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1412 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1413 | renegotiation_info_seen = 1; |
Manuel Pégourié-Gonnard | eaecbd3 | 2014-11-06 02:38:02 +0100 | [diff] [blame] | 1414 | #endif |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1415 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1416 | ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size ); |
| 1417 | if( ret != 0 ) |
| 1418 | return( ret ); |
| 1419 | break; |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1420 | |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 1421 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1422 | case MBEDTLS_TLS_EXT_SIG_ALG: |
Ron Eldor | 73a3817 | 2017-10-03 15:58:26 +0300 | [diff] [blame] | 1423 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) ); |
| 1424 | |
Gabor Mezei | 078e803 | 2022-04-27 21:17:56 +0200 | [diff] [blame] | 1425 | ret = mbedtls_ssl_parse_sig_alg_ext( ssl, ext + 4, ext + 4 + ext_size ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1426 | if( ret != 0 ) |
| 1427 | return( ret ); |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1428 | |
| 1429 | sig_hash_alg_ext_present = 1; |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1430 | break; |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 1431 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1432 | |
Robert Cragie | 136884c | 2015-10-02 13:34:31 +0100 | [diff] [blame] | 1433 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Robert Cragie | ae8535d | 2015-10-06 17:11:18 +0100 | [diff] [blame] | 1434 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Jerry Yu | b47d0f8 | 2021-12-20 17:34:40 +0800 | [diff] [blame] | 1435 | case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS: |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1436 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1437 | |
Jerry Yu | b47d0f8 | 2021-12-20 17:34:40 +0800 | [diff] [blame] | 1438 | ret = ssl_parse_supported_groups_ext( ssl, ext + 4, ext_size ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1439 | if( ret != 0 ) |
| 1440 | return( ret ); |
| 1441 | break; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1442 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1443 | case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: |
| 1444 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) ); |
| 1445 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1446 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1447 | ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size ); |
| 1448 | if( ret != 0 ) |
| 1449 | return( ret ); |
| 1450 | break; |
Robert Cragie | ae8535d | 2015-10-06 17:11:18 +0100 | [diff] [blame] | 1451 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
| 1452 | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1453 | |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 1454 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1455 | case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: |
| 1456 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) ); |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 1457 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1458 | ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size ); |
| 1459 | if( ret != 0 ) |
| 1460 | return( ret ); |
| 1461 | break; |
Manuel Pégourié-Gonnard | bf57be6 | 2015-09-16 15:04:01 +0200 | [diff] [blame] | 1462 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
| 1463 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1464 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1465 | case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: |
| 1466 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) ); |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 1467 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1468 | ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size ); |
| 1469 | if( ret != 0 ) |
| 1470 | return( ret ); |
| 1471 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1472 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Manuel Pégourié-Gonnard | 48f8d0d | 2013-07-17 10:25:37 +0200 | [diff] [blame] | 1473 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1474 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 1475 | case MBEDTLS_TLS_EXT_CID: |
| 1476 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) ); |
| 1477 | |
| 1478 | ret = ssl_parse_cid_ext( ssl, ext + 4, ext_size ); |
| 1479 | if( ret != 0 ) |
| 1480 | return( ret ); |
| 1481 | break; |
Thomas Daubney | e1c9a40 | 2021-06-15 11:26:43 +0100 | [diff] [blame] | 1482 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | 89dcc88 | 2019-04-26 13:56:39 +0100 | [diff] [blame] | 1483 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1484 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1485 | case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: |
| 1486 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) ); |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1487 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1488 | ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size ); |
| 1489 | if( ret != 0 ) |
| 1490 | return( ret ); |
| 1491 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1492 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1493 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1494 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1495 | case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: |
| 1496 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) ); |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1497 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1498 | ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size ); |
| 1499 | if( ret != 0 ) |
| 1500 | return( ret ); |
| 1501 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1502 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1503 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1504 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1505 | case MBEDTLS_TLS_EXT_SESSION_TICKET: |
| 1506 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) ); |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 1507 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1508 | ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size ); |
| 1509 | if( ret != 0 ) |
| 1510 | return( ret ); |
| 1511 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1512 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 1513 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1514 | #if defined(MBEDTLS_SSL_ALPN) |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1515 | case MBEDTLS_TLS_EXT_ALPN: |
| 1516 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) ); |
Manuel Pégourié-Gonnard | 89e3579 | 2014-04-07 12:10:30 +0200 | [diff] [blame] | 1517 | |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 1518 | ret = mbedtls_ssl_parse_alpn_ext( ssl, ext + 4, |
| 1519 | ext + 4 + ext_size ); |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1520 | if( ret != 0 ) |
| 1521 | return( ret ); |
| 1522 | break; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1523 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Manuel Pégourié-Gonnard | 89e3579 | 2014-04-07 12:10:30 +0200 | [diff] [blame] | 1524 | |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 1525 | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
| 1526 | case MBEDTLS_TLS_EXT_USE_SRTP: |
| 1527 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found use_srtp extension" ) ); |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 1528 | |
Johan Pascal | c3ccd98 | 2020-10-28 17:18:18 +0100 | [diff] [blame] | 1529 | ret = ssl_parse_use_srtp_ext( ssl, ext + 4, ext_size ); |
| 1530 | if( ret != 0 ) |
| 1531 | return( ret ); |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 1532 | break; |
| 1533 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 1534 | |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1535 | default: |
Paul Elliott | 9f35211 | 2020-12-09 14:55:45 +0000 | [diff] [blame] | 1536 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %u (ignoring)", |
Simon Butcher | 584a547 | 2016-05-23 16:24:52 +0100 | [diff] [blame] | 1537 | ext_id ) ); |
| 1538 | } |
| 1539 | |
| 1540 | ext_len -= 4 + ext_size; |
| 1541 | ext += 4 + ext_size; |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1542 | } |
Janos Follath | c6dab2b | 2016-05-23 14:27:02 +0100 | [diff] [blame] | 1543 | |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 1544 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1545 | |
| 1546 | /* |
| 1547 | * Try to fall back to default hash SHA1 if the client |
| 1548 | * hasn't provided any preferred signature-hash combinations. |
| 1549 | */ |
Gabor Mezei | 86acf05 | 2022-05-10 13:29:02 +0200 | [diff] [blame] | 1550 | if( ! sig_hash_alg_ext_present ) |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1551 | { |
Gabor Mezei | 86acf05 | 2022-05-10 13:29:02 +0200 | [diff] [blame] | 1552 | uint16_t *received_sig_algs = ssl->handshake->received_sig_algs; |
| 1553 | const uint16_t default_sig_algs[] = { |
Gabor Mezei | c1051b6 | 2022-05-10 13:13:58 +0200 | [diff] [blame] | 1554 | #if defined(MBEDTLS_ECDSA_C) |
| 1555 | MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, |
| 1556 | MBEDTLS_SSL_HASH_SHA1 ), |
| 1557 | #endif |
| 1558 | #if defined(MBEDTLS_RSA_C) |
| 1559 | MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, |
| 1560 | MBEDTLS_SSL_HASH_SHA1 ), |
| 1561 | #endif |
Gabor Mezei | 86acf05 | 2022-05-10 13:29:02 +0200 | [diff] [blame] | 1562 | MBEDTLS_TLS_SIG_NONE |
Gabor Mezei | 078e803 | 2022-04-27 21:17:56 +0200 | [diff] [blame] | 1563 | }; |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1564 | |
Gabor Mezei | 86acf05 | 2022-05-10 13:29:02 +0200 | [diff] [blame] | 1565 | #if defined(static_assert) |
| 1566 | static_assert( sizeof( default_sig_algs ) / sizeof( default_sig_algs[0] ) <= |
| 1567 | MBEDTLS_RECEIVED_SIG_ALGS_SIZE, "default_sig_algs is too big" ); |
| 1568 | #endif |
Gabor Mezei | 078e803 | 2022-04-27 21:17:56 +0200 | [diff] [blame] | 1569 | |
Gabor Mezei | 86acf05 | 2022-05-10 13:29:02 +0200 | [diff] [blame] | 1570 | memcpy( received_sig_algs, default_sig_algs, sizeof( default_sig_algs ) ); |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1571 | } |
| 1572 | |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 1573 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1574 | |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1575 | /* |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1576 | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
| 1577 | */ |
| 1578 | for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 ) |
| 1579 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1580 | if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO ) |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1581 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1582 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) ); |
| 1583 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1584 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1585 | { |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 1586 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV " |
| 1587 | "during renegotiation" ) ); |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 1588 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1589 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Dave Rodgman | c50b717 | 2021-06-29 14:40:23 +0100 | [diff] [blame] | 1590 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1591 | } |
Manuel Pégourié-Gonnard | 69849f8 | 2015-03-10 11:54:02 +0000 | [diff] [blame] | 1592 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1593 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1594 | break; |
| 1595 | } |
| 1596 | } |
| 1597 | |
| 1598 | /* |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1599 | * Renegotiation security checks |
| 1600 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1601 | if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION && |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1602 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE ) |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1603 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1604 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) ); |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1605 | handshake_failure = 1; |
| 1606 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1607 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1608 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
| 1609 | ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1610 | renegotiation_info_seen == 0 ) |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1611 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1612 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) ); |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1613 | handshake_failure = 1; |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1614 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1615 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
| 1616 | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1617 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1618 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1619 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) ); |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1620 | handshake_failure = 1; |
| 1621 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1622 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
| 1623 | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1624 | renegotiation_info_seen == 1 ) |
| 1625 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1626 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) ); |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1627 | handshake_failure = 1; |
| 1628 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1629 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Paul Bakker | d0f6fa7 | 2012-09-17 09:18:12 +0000 | [diff] [blame] | 1630 | |
| 1631 | if( handshake_failure == 1 ) |
| 1632 | { |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 1633 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1634 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Hanno Becker | 90d59dd | 2021-06-24 11:17:13 +0100 | [diff] [blame] | 1635 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 1636 | } |
Paul Bakker | 380da53 | 2012-04-18 16:10:25 +0000 | [diff] [blame] | 1637 | |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1638 | /* |
Glenn Strauss | 2ed9527 | 2022-01-21 18:02:17 -0500 | [diff] [blame] | 1639 | * Server certification selection (after processing TLS extensions) |
| 1640 | */ |
| 1641 | if( ssl->conf->f_cert_cb && ( ret = ssl->conf->f_cert_cb( ssl ) ) != 0 ) |
| 1642 | { |
| 1643 | MBEDTLS_SSL_DEBUG_RET( 1, "f_cert_cb", ret ); |
| 1644 | return( ret ); |
| 1645 | } |
Glenn Strauss | 6989407 | 2022-01-24 12:58:00 -0500 | [diff] [blame] | 1646 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 1647 | ssl->handshake->sni_name = NULL; |
| 1648 | ssl->handshake->sni_name_len = 0; |
| 1649 | #endif |
Glenn Strauss | 2ed9527 | 2022-01-21 18:02:17 -0500 | [diff] [blame] | 1650 | |
| 1651 | /* |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1652 | * Search for a matching ciphersuite |
Manuel Pégourié-Gonnard | 3ebb2cd | 2013-09-23 17:00:18 +0200 | [diff] [blame] | 1653 | * (At the end because we need information from the EC-based extensions |
Glenn Strauss | 2ed9527 | 2022-01-21 18:02:17 -0500 | [diff] [blame] | 1654 | * and certificate from the SNI callback triggered by the SNI extension |
| 1655 | * or certificate from server certificate selection callback.) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1656 | */ |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 1657 | got_common_suite = 0; |
Hanno Becker | d60b6c6 | 2021-04-29 12:04:11 +0100 | [diff] [blame] | 1658 | ciphersuites = ssl->conf->ciphersuite_list; |
Manuel Pégourié-Gonnard | 59b81d7 | 2013-11-30 17:46:04 +0100 | [diff] [blame] | 1659 | ciphersuite_info = NULL; |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1660 | |
TRodziewicz | 3946f79 | 2021-06-14 12:11:18 +0200 | [diff] [blame] | 1661 | if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT) |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1662 | { |
Manuel Pégourié-Gonnard | 8933a65 | 2014-03-20 17:29:27 +0100 | [diff] [blame] | 1663 | for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 ) |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1664 | for( i = 0; ciphersuites[i] != 0; i++ ) |
| 1665 | { |
Joe Subbiani | e4603ee | 2021-08-20 13:05:30 +0100 | [diff] [blame] | 1666 | if( MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i] ) |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1667 | continue; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1668 | |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1669 | got_common_suite = 1; |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 1670 | |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1671 | if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i], |
| 1672 | &ciphersuite_info ) ) != 0 ) |
| 1673 | return( ret ); |
Manuel Pégourié-Gonnard | 011a8db | 2013-11-30 18:11:07 +0100 | [diff] [blame] | 1674 | |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1675 | if( ciphersuite_info != NULL ) |
| 1676 | goto have_ciphersuite; |
| 1677 | } |
| 1678 | } else { |
| 1679 | for( i = 0; ciphersuites[i] != 0; i++ ) |
| 1680 | for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 ) |
| 1681 | { |
Joe Subbiani | e4603ee | 2021-08-20 13:05:30 +0100 | [diff] [blame] | 1682 | if( MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i] ) |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 1683 | continue; |
| 1684 | |
| 1685 | got_common_suite = 1; |
| 1686 | |
| 1687 | if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i], |
| 1688 | &ciphersuite_info ) ) != 0 ) |
| 1689 | return( ret ); |
| 1690 | |
| 1691 | if( ciphersuite_info != NULL ) |
| 1692 | goto have_ciphersuite; |
| 1693 | } |
| 1694 | } |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1695 | |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 1696 | if( got_common_suite ) |
| 1697 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1698 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, " |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 1699 | "but none of them usable" ) ); |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 1700 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1701 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Dave Rodgman | 096c411 | 2021-06-29 09:52:06 +0100 | [diff] [blame] | 1702 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 1703 | } |
| 1704 | else |
| 1705 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1706 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) ); |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 1707 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 1708 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); |
Dave Rodgman | bb05cd0 | 2021-06-29 10:37:43 +0100 | [diff] [blame] | 1709 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Manuel Pégourié-Gonnard | f01768c | 2015-01-08 17:06:16 +0100 | [diff] [blame] | 1710 | } |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1711 | |
| 1712 | have_ciphersuite: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1713 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) ); |
Manuel Pégourié-Gonnard | 607d663 | 2015-01-26 11:17:20 +0000 | [diff] [blame] | 1714 | |
Paul Bakker | 8f4ddae | 2013-04-15 15:09:54 +0200 | [diff] [blame] | 1715 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 1716 | ssl->handshake->ciphersuite_info = ciphersuite_info; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 1717 | |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 1718 | ssl->state++; |
| 1719 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1720 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 1721 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1722 | mbedtls_ssl_recv_flight_completed( ssl ); |
Manuel Pégourié-Gonnard | 5d8ba53 | 2014-09-19 15:09:21 +0200 | [diff] [blame] | 1723 | #endif |
| 1724 | |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1725 | /* Debugging-only output for testsuite */ |
| 1726 | #if defined(MBEDTLS_DEBUG_C) && \ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 1727 | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 1728 | mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg( ciphersuite_info ); |
| 1729 | if( sig_alg != MBEDTLS_PK_NONE ) |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1730 | { |
Gabor Mezei | a3d016c | 2022-05-10 12:44:09 +0200 | [diff] [blame] | 1731 | unsigned int sig_hash = mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( |
| 1732 | ssl, mbedtls_ssl_sig_from_pk_alg( sig_alg ) ); |
Gabor Mezei | 0a4298b | 2022-05-13 16:25:35 +0200 | [diff] [blame] | 1733 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %u", |
| 1734 | sig_hash ) ); |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 1735 | } |
| 1736 | else |
| 1737 | { |
| 1738 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm " |
| 1739 | "%u - should not happen", (unsigned) sig_alg ) ); |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 1740 | } |
| 1741 | #endif |
| 1742 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1743 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 1744 | |
| 1745 | return( 0 ); |
| 1746 | } |
| 1747 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1748 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | 51de2d3 | 2019-04-26 15:46:55 +0100 | [diff] [blame] | 1749 | static void ssl_write_cid_ext( mbedtls_ssl_context *ssl, |
| 1750 | unsigned char *buf, |
| 1751 | size_t *olen ) |
| 1752 | { |
| 1753 | unsigned char *p = buf; |
| 1754 | size_t ext_len; |
| 1755 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
| 1756 | |
| 1757 | *olen = 0; |
| 1758 | |
| 1759 | /* Skip writing the extension if we don't want to use it or if |
| 1760 | * the client hasn't offered it. */ |
| 1761 | if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED ) |
| 1762 | return; |
| 1763 | |
| 1764 | /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX |
| 1765 | * which is at most 255, so the increment cannot overflow. */ |
| 1766 | if( end < p || (size_t)( end - p ) < (unsigned)( ssl->own_cid_len + 5 ) ) |
| 1767 | { |
| 1768 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); |
| 1769 | return; |
| 1770 | } |
| 1771 | |
| 1772 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding CID extension" ) ); |
| 1773 | |
| 1774 | /* |
Hanno Becker | 51de2d3 | 2019-04-26 15:46:55 +0100 | [diff] [blame] | 1775 | * struct { |
| 1776 | * opaque cid<0..2^8-1>; |
| 1777 | * } ConnectionId; |
| 1778 | */ |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1779 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_CID, p, 0 ); |
| 1780 | p += 2; |
Hanno Becker | 51de2d3 | 2019-04-26 15:46:55 +0100 | [diff] [blame] | 1781 | ext_len = (size_t) ssl->own_cid_len + 1; |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1782 | MBEDTLS_PUT_UINT16_BE( ext_len, p, 0 ); |
| 1783 | p += 2; |
Hanno Becker | 51de2d3 | 2019-04-26 15:46:55 +0100 | [diff] [blame] | 1784 | |
| 1785 | *p++ = (uint8_t) ssl->own_cid_len; |
| 1786 | memcpy( p, ssl->own_cid, ssl->own_cid_len ); |
| 1787 | |
| 1788 | *olen = ssl->own_cid_len + 5; |
| 1789 | } |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 1790 | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
Hanno Becker | 51de2d3 | 2019-04-26 15:46:55 +0100 | [diff] [blame] | 1791 | |
Neil Armstrong | 76b7407 | 2022-04-06 13:43:54 +0200 | [diff] [blame] | 1792 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1793 | static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1794 | unsigned char *buf, |
| 1795 | size_t *olen ) |
| 1796 | { |
| 1797 | unsigned char *p = buf; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1798 | const mbedtls_ssl_ciphersuite_t *suite = NULL; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1799 | |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 1800 | /* |
| 1801 | * RFC 7366: "If a server receives an encrypt-then-MAC request extension |
| 1802 | * from a client and then selects a stream or Authenticated Encryption |
| 1803 | * with Associated Data (AEAD) ciphersuite, it MUST NOT send an |
| 1804 | * encrypt-then-MAC response extension back to the client." |
| 1805 | */ |
Neil Armstrong | fe635e4 | 2022-04-01 10:36:09 +0200 | [diff] [blame] | 1806 | suite = mbedtls_ssl_ciphersuite_from_id( |
| 1807 | ssl->session_negotiate->ciphersuite ); |
| 1808 | if( suite == NULL ) |
Ronald Cron | 862902d | 2022-03-24 14:15:28 +0100 | [diff] [blame] | 1809 | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; |
Neil Armstrong | fe635e4 | 2022-04-01 10:36:09 +0200 | [diff] [blame] | 1810 | else |
| 1811 | { |
| 1812 | mbedtls_ssl_mode_t ssl_mode = |
Neil Armstrong | ab555e0 | 2022-04-04 11:07:59 +0200 | [diff] [blame] | 1813 | mbedtls_ssl_get_mode_from_ciphersuite( |
Neil Armstrong | fe635e4 | 2022-04-01 10:36:09 +0200 | [diff] [blame] | 1814 | ssl->session_negotiate->encrypt_then_mac, |
| 1815 | suite ); |
| 1816 | |
| 1817 | if( ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM ) |
| 1818 | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; |
Ronald Cron | 862902d | 2022-03-24 14:15:28 +0100 | [diff] [blame] | 1819 | } |
| 1820 | |
| 1821 | if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ) |
| 1822 | { |
Manuel Pégourié-Gonnard | 78e745f | 2014-11-04 15:44:06 +0100 | [diff] [blame] | 1823 | *olen = 0; |
| 1824 | return; |
| 1825 | } |
| 1826 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1827 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) ); |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1828 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1829 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC, p, 0 ); |
| 1830 | p += 2; |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1831 | |
| 1832 | *p++ = 0x00; |
| 1833 | *p++ = 0x00; |
| 1834 | |
| 1835 | *olen = 4; |
| 1836 | } |
Neil Armstrong | 76b7407 | 2022-04-06 13:43:54 +0200 | [diff] [blame] | 1837 | #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */ |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 1838 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1839 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
| 1840 | static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1841 | unsigned char *buf, |
| 1842 | size_t *olen ) |
| 1843 | { |
| 1844 | unsigned char *p = buf; |
| 1845 | |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 1846 | if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1847 | { |
| 1848 | *olen = 0; |
| 1849 | return; |
| 1850 | } |
| 1851 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1852 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret " |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1853 | "extension" ) ); |
| 1854 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1855 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET, p, 0 ); |
| 1856 | p += 2; |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1857 | |
| 1858 | *p++ = 0x00; |
| 1859 | *p++ = 0x00; |
| 1860 | |
| 1861 | *olen = 4; |
| 1862 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1863 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 1864 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1865 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
| 1866 | static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 1867 | unsigned char *buf, |
| 1868 | size_t *olen ) |
| 1869 | { |
| 1870 | unsigned char *p = buf; |
| 1871 | |
| 1872 | if( ssl->handshake->new_session_ticket == 0 ) |
| 1873 | { |
| 1874 | *olen = 0; |
| 1875 | return; |
| 1876 | } |
| 1877 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1878 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) ); |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 1879 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1880 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SESSION_TICKET, p, 0 ); |
| 1881 | p += 2; |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 1882 | |
| 1883 | *p++ = 0x00; |
| 1884 | *p++ = 0x00; |
| 1885 | |
| 1886 | *olen = 4; |
| 1887 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1888 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 1889 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1890 | static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 1891 | unsigned char *buf, |
| 1892 | size_t *olen ) |
| 1893 | { |
| 1894 | unsigned char *p = buf; |
| 1895 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1896 | if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION ) |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 1897 | { |
| 1898 | *olen = 0; |
| 1899 | return; |
| 1900 | } |
| 1901 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1902 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) ); |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 1903 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1904 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO, p, 0 ); |
| 1905 | p += 2; |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 1906 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1907 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 1908 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1909 | { |
| 1910 | *p++ = 0x00; |
| 1911 | *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF; |
| 1912 | *p++ = ssl->verify_data_len * 2 & 0xFF; |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 1913 | |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1914 | memcpy( p, ssl->peer_verify_data, ssl->verify_data_len ); |
| 1915 | p += ssl->verify_data_len; |
| 1916 | memcpy( p, ssl->own_verify_data, ssl->verify_data_len ); |
| 1917 | p += ssl->verify_data_len; |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1918 | } |
| 1919 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1920 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1921 | { |
| 1922 | *p++ = 0x00; |
| 1923 | *p++ = 0x01; |
| 1924 | *p++ = 0x00; |
Manuel Pégourié-Gonnard | 615e677 | 2014-11-03 08:23:14 +0100 | [diff] [blame] | 1925 | } |
Manuel Pégourié-Gonnard | 1938975 | 2015-06-23 13:46:44 +0200 | [diff] [blame] | 1926 | |
| 1927 | *olen = p - buf; |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 1928 | } |
| 1929 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1930 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
| 1931 | static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 1932 | unsigned char *buf, |
| 1933 | size_t *olen ) |
| 1934 | { |
| 1935 | unsigned char *p = buf; |
| 1936 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1937 | if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) |
Manuel Pégourié-Gonnard | e048b67 | 2013-07-19 12:47:00 +0200 | [diff] [blame] | 1938 | { |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 1939 | *olen = 0; |
| 1940 | return; |
| 1941 | } |
| 1942 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1943 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) ); |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 1944 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1945 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH, p, 0 ); |
| 1946 | p += 2; |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 1947 | |
| 1948 | *p++ = 0x00; |
| 1949 | *p++ = 1; |
| 1950 | |
Manuel Pégourié-Gonnard | ed4af8b | 2013-07-18 14:07:09 +0200 | [diff] [blame] | 1951 | *p++ = ssl->session_negotiate->mfl_code; |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 1952 | |
| 1953 | *olen = 5; |
| 1954 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1955 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 1956 | |
Manuel Pégourié-Gonnard | f472179 | 2015-09-15 10:53:51 +0200 | [diff] [blame] | 1957 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Manuel Pégourié-Gonnard | eef142d | 2015-09-16 10:05:04 +0200 | [diff] [blame] | 1958 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1959 | static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl, |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 1960 | unsigned char *buf, |
| 1961 | size_t *olen ) |
| 1962 | { |
| 1963 | unsigned char *p = buf; |
| 1964 | ((void) ssl); |
| 1965 | |
Paul Bakker | 677377f | 2013-10-28 12:54:26 +0100 | [diff] [blame] | 1966 | if( ( ssl->handshake->cli_exts & |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1967 | MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 ) |
Paul Bakker | 677377f | 2013-10-28 12:54:26 +0100 | [diff] [blame] | 1968 | { |
| 1969 | *olen = 0; |
| 1970 | return; |
| 1971 | } |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 1972 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1973 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) ); |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 1974 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 1975 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS, p, 0 ); |
| 1976 | p += 2; |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 1977 | |
| 1978 | *p++ = 0x00; |
| 1979 | *p++ = 2; |
| 1980 | |
| 1981 | *p++ = 1; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 1982 | *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 1983 | |
| 1984 | *olen = 6; |
| 1985 | } |
Manuel Pégourié-Gonnard | eef142d | 2015-09-16 10:05:04 +0200 | [diff] [blame] | 1986 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 1987 | |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 1988 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 1989 | static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl, |
| 1990 | unsigned char *buf, |
| 1991 | size_t *olen ) |
| 1992 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 1993 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 1994 | unsigned char *p = buf; |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 1995 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 1996 | size_t kkpp_len; |
| 1997 | |
| 1998 | *olen = 0; |
| 1999 | |
| 2000 | /* Skip costly computation if not needed */ |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 2001 | if( ssl->handshake->ciphersuite_info->key_exchange != |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 2002 | MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
| 2003 | return; |
| 2004 | |
| 2005 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) ); |
| 2006 | |
| 2007 | if( end - p < 4 ) |
| 2008 | { |
| 2009 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); |
| 2010 | return; |
| 2011 | } |
| 2012 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 2013 | MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0 ); |
| 2014 | p += 2; |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 2015 | |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2016 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2017 | ret = mbedtls_psa_ecjpake_write_round( &ssl->handshake->psa_pake_ctx, |
| 2018 | p + 2, end - p - 2, &kkpp_len, |
| 2019 | MBEDTLS_ECJPAKE_ROUND_ONE ); |
Valerio Setti | a988364 | 2022-11-17 15:34:59 +0100 | [diff] [blame] | 2020 | if ( ret != 0 ) |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2021 | { |
Valerio Setti | a988364 | 2022-11-17 15:34:59 +0100 | [diff] [blame] | 2022 | psa_destroy_key( ssl->handshake->psa_pake_password ); |
| 2023 | psa_pake_abort( &ssl->handshake->psa_pake_ctx ); |
| 2024 | MBEDTLS_SSL_DEBUG_RET( 1 , "psa_pake_output", ret ); |
| 2025 | return; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2026 | } |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2027 | #else |
Manuel Pégourié-Gonnard | 5674a97 | 2015-10-19 15:14:03 +0200 | [diff] [blame] | 2028 | ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx, |
| 2029 | p + 2, end - p - 2, &kkpp_len, |
| 2030 | ssl->conf->f_rng, ssl->conf->p_rng ); |
| 2031 | if( ret != 0 ) |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 2032 | { |
| 2033 | MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret ); |
| 2034 | return; |
| 2035 | } |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2036 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 2037 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 2038 | MBEDTLS_PUT_UINT16_BE( kkpp_len, p, 0 ); |
| 2039 | p += 2; |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 2040 | |
| 2041 | *olen = kkpp_len + 4; |
| 2042 | } |
| 2043 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
| 2044 | |
Ron Eldor | 3adb992 | 2017-12-21 10:15:08 +0200 | [diff] [blame] | 2045 | #if defined(MBEDTLS_SSL_DTLS_SRTP ) && defined(MBEDTLS_SSL_PROTO_DTLS) |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2046 | static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl, |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 2047 | unsigned char *buf, |
| 2048 | size_t *olen ) |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2049 | { |
Ron Eldor | 75870ec | 2018-12-06 17:31:55 +0200 | [diff] [blame] | 2050 | size_t mki_len = 0, ext_len = 0; |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 2051 | uint16_t profile_value = 0; |
Johan Pascal | 8f70fba | 2020-09-02 10:32:06 +0200 | [diff] [blame] | 2052 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
| 2053 | |
| 2054 | *olen = 0; |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 2055 | |
Johan Pascal | c3ccd98 | 2020-10-28 17:18:18 +0100 | [diff] [blame] | 2056 | if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) || |
| 2057 | ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET ) ) |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2058 | { |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2059 | return; |
| 2060 | } |
| 2061 | |
| 2062 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding use_srtp extension" ) ); |
| 2063 | |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 2064 | if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED ) |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 2065 | { |
| 2066 | mki_len = ssl->dtls_srtp_info.mki_len; |
| 2067 | } |
| 2068 | |
Johan Pascal | 9bc97ca | 2020-09-21 23:44:45 +0200 | [diff] [blame] | 2069 | /* The extension total size is 9 bytes : |
| 2070 | * - 2 bytes for the extension tag |
| 2071 | * - 2 bytes for the total size |
| 2072 | * - 2 bytes for the protection profile length |
| 2073 | * - 2 bytes for the protection profile |
| 2074 | * - 1 byte for the mki length |
| 2075 | * + the actual mki length |
| 2076 | * Check we have enough room in the output buffer */ |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 2077 | if( (size_t)( end - buf ) < mki_len + 9 ) |
Johan Pascal | 8f70fba | 2020-09-02 10:32:06 +0200 | [diff] [blame] | 2078 | { |
| 2079 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); |
| 2080 | return; |
| 2081 | } |
| 2082 | |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2083 | /* extension */ |
Joe Subbiani | 6dd7364 | 2021-07-19 11:56:54 +0100 | [diff] [blame] | 2084 | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_USE_SRTP, buf, 0 ); |
Ron Eldor | ef72faf | 2018-07-12 11:54:20 +0300 | [diff] [blame] | 2085 | /* |
| 2086 | * total length 5 and mki value: only one profile(2 bytes) |
| 2087 | * and length(2 bytes) and srtp_mki ) |
| 2088 | */ |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 2089 | ext_len = 5 + mki_len; |
Joe Subbiani | 6dd7364 | 2021-07-19 11:56:54 +0100 | [diff] [blame] | 2090 | MBEDTLS_PUT_UINT16_BE( ext_len, buf, 2 ); |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2091 | |
| 2092 | /* protection profile length: 2 */ |
| 2093 | buf[4] = 0x00; |
| 2094 | buf[5] = 0x02; |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 2095 | profile_value = mbedtls_ssl_check_srtp_profile_value( |
Johan Pascal | d576fdb | 2020-09-22 10:39:53 +0200 | [diff] [blame] | 2096 | ssl->dtls_srtp_info.chosen_dtls_srtp_profile ); |
Johan Pascal | 43f9490 | 2020-09-22 12:25:52 +0200 | [diff] [blame] | 2097 | if( profile_value != MBEDTLS_TLS_SRTP_UNSET ) |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 2098 | { |
Joe Subbiani | 6dd7364 | 2021-07-19 11:56:54 +0100 | [diff] [blame] | 2099 | MBEDTLS_PUT_UINT16_BE( profile_value, buf, 6 ); |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 2100 | } |
| 2101 | else |
| 2102 | { |
Johan Pascal | 8f70fba | 2020-09-02 10:32:06 +0200 | [diff] [blame] | 2103 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "use_srtp extension invalid profile" ) ); |
Ron Eldor | 089c9fe | 2018-12-06 17:12:49 +0200 | [diff] [blame] | 2104 | return; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2105 | } |
| 2106 | |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 2107 | buf[8] = mki_len & 0xFF; |
Ron Eldor | 75870ec | 2018-12-06 17:31:55 +0200 | [diff] [blame] | 2108 | memcpy( &buf[9], ssl->dtls_srtp_info.mki_value, mki_len ); |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2109 | |
Ron Eldor | 591f162 | 2018-01-22 12:30:04 +0200 | [diff] [blame] | 2110 | *olen = 9 + mki_len; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2111 | } |
| 2112 | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
| 2113 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2114 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2115 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2116 | static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl ) |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2117 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 2118 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2119 | unsigned char *p = ssl->out_msg + 4; |
Manuel Pégourié-Gonnard | d7f9bc5 | 2014-07-23 11:09:27 +0200 | [diff] [blame] | 2120 | unsigned char *cookie_len_byte; |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2121 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2122 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2123 | |
| 2124 | /* |
| 2125 | * struct { |
| 2126 | * ProtocolVersion server_version; |
| 2127 | * opaque cookie<0..2^8-1>; |
| 2128 | * } HelloVerifyRequest; |
| 2129 | */ |
| 2130 | |
Manuel Pégourié-Gonnard | b35fe56 | 2014-08-09 17:00:46 +0200 | [diff] [blame] | 2131 | /* The RFC is not clear on this point, but sending the actual negotiated |
| 2132 | * version looks like the most interoperable thing to do. */ |
Glenn Strauss | e3af4cb | 2022-03-15 03:23:42 -0400 | [diff] [blame] | 2133 | mbedtls_ssl_write_version( p, ssl->conf->transport, ssl->tls_version ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2134 | MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2135 | p += 2; |
| 2136 | |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 2137 | /* If we get here, f_cookie_check is not null */ |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 2138 | if( ssl->conf->f_cookie_write == NULL ) |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 2139 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2140 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) ); |
| 2141 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Manuel Pégourié-Gonnard | 7d38d21 | 2014-07-23 17:52:09 +0200 | [diff] [blame] | 2142 | } |
| 2143 | |
Manuel Pégourié-Gonnard | d7f9bc5 | 2014-07-23 11:09:27 +0200 | [diff] [blame] | 2144 | /* Skip length byte until we know the length */ |
| 2145 | cookie_len_byte = p++; |
| 2146 | |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 2147 | if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie, |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 2148 | &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN, |
Manuel Pégourié-Gonnard | d485d19 | 2014-07-23 14:56:15 +0200 | [diff] [blame] | 2149 | ssl->cli_id, ssl->cli_id_len ) ) != 0 ) |
Manuel Pégourié-Gonnard | d7f9bc5 | 2014-07-23 11:09:27 +0200 | [diff] [blame] | 2150 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2151 | MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret ); |
Manuel Pégourié-Gonnard | d7f9bc5 | 2014-07-23 11:09:27 +0200 | [diff] [blame] | 2152 | return( ret ); |
| 2153 | } |
| 2154 | |
| 2155 | *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) ); |
| 2156 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2157 | MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2158 | |
| 2159 | ssl->out_msglen = p - ssl->out_msg; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2160 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
| 2161 | ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2162 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2163 | ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT; |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2164 | |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 2165 | if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2166 | { |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 2167 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2168 | return( ret ); |
| 2169 | } |
| 2170 | |
Manuel Pégourié-Gonnard | 87a346f | 2017-09-13 12:45:21 +0200 | [diff] [blame] | 2171 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 2172 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
| 2173 | ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 ) |
| 2174 | { |
| 2175 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret ); |
| 2176 | return( ret ); |
| 2177 | } |
Hanno Becker | bc2498a | 2018-08-28 10:13:29 +0100 | [diff] [blame] | 2178 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 87a346f | 2017-09-13 12:45:21 +0200 | [diff] [blame] | 2179 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2180 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2181 | |
| 2182 | return( 0 ); |
| 2183 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2184 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2185 | |
Hanno Becker | f6e09c6 | 2021-05-13 06:12:38 +0100 | [diff] [blame] | 2186 | static void ssl_handle_id_based_session_resumption( mbedtls_ssl_context *ssl ) |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2187 | { |
| 2188 | int ret; |
Hanno Becker | a5b1a39 | 2021-04-15 16:48:01 +0100 | [diff] [blame] | 2189 | mbedtls_ssl_session session_tmp; |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2190 | mbedtls_ssl_session * const session = ssl->session_negotiate; |
| 2191 | |
| 2192 | /* Resume is 0 by default, see ssl_handshake_init(). |
| 2193 | * It may be already set to 1 by ssl_parse_session_ticket_ext(). */ |
| 2194 | if( ssl->handshake->resume == 1 ) |
| 2195 | return; |
Hanno Becker | 7ad7796 | 2021-05-13 06:13:34 +0100 | [diff] [blame] | 2196 | if( session->id_len == 0 ) |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2197 | return; |
| 2198 | if( ssl->conf->f_get_cache == NULL ) |
| 2199 | return; |
| 2200 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
| 2201 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
| 2202 | return; |
| 2203 | #endif |
| 2204 | |
Hanno Becker | a5b1a39 | 2021-04-15 16:48:01 +0100 | [diff] [blame] | 2205 | mbedtls_ssl_session_init( &session_tmp ); |
| 2206 | |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2207 | ret = ssl->conf->f_get_cache( ssl->conf->p_cache, |
Hanno Becker | ccdaf6e | 2021-04-15 09:26:17 +0100 | [diff] [blame] | 2208 | session->id, |
| 2209 | session->id_len, |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2210 | &session_tmp ); |
| 2211 | if( ret != 0 ) |
| 2212 | goto exit; |
| 2213 | |
Thomas Daubney | 20f89a9 | 2022-06-20 15:12:19 +0100 | [diff] [blame] | 2214 | if( session->ciphersuite != session_tmp.ciphersuite ) |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2215 | { |
| 2216 | /* Mismatch between cached and negotiated session */ |
| 2217 | goto exit; |
| 2218 | } |
| 2219 | |
| 2220 | /* Move semantics */ |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2221 | mbedtls_ssl_session_free( session ); |
| 2222 | *session = session_tmp; |
Hanno Becker | fc1f413 | 2021-05-14 14:57:54 +0100 | [diff] [blame] | 2223 | memset( &session_tmp, 0, sizeof( session_tmp ) ); |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2224 | |
| 2225 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) ); |
| 2226 | ssl->handshake->resume = 1; |
| 2227 | |
| 2228 | exit: |
| 2229 | |
Hanno Becker | df56402 | 2021-05-13 06:26:37 +0100 | [diff] [blame] | 2230 | mbedtls_ssl_session_free( &session_tmp ); |
Hanno Becker | 64ce974 | 2021-04-15 08:19:40 +0100 | [diff] [blame] | 2231 | } |
| 2232 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2233 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2234 | static int ssl_write_server_hello( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2235 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2236 | #if defined(MBEDTLS_HAVE_TIME) |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 2237 | mbedtls_time_t t; |
Paul Bakker | fa9b100 | 2013-07-03 15:31:03 +0200 | [diff] [blame] | 2238 | #endif |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 2239 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 2240 | size_t olen, ext_len = 0, n; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2241 | unsigned char *buf, *p; |
| 2242 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2243 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2244 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2245 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 2246 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
Jerry Yu | ac5ca5a | 2022-03-04 12:50:46 +0800 | [diff] [blame] | 2247 | ssl->handshake->cookie_verify_result != 0 ) |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2248 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2249 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) ); |
| 2250 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2251 | |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 2252 | return( ssl_write_hello_verify_request( ssl ) ); |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2253 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2254 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Manuel Pégourié-Gonnard | 2c9ee81 | 2014-07-22 11:45:03 +0200 | [diff] [blame] | 2255 | |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 2256 | if( ssl->conf->f_rng == NULL ) |
Paul Bakker | a9a028e | 2013-11-21 17:31:06 +0100 | [diff] [blame] | 2257 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2258 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") ); |
| 2259 | return( MBEDTLS_ERR_SSL_NO_RNG ); |
Paul Bakker | a9a028e | 2013-11-21 17:31:06 +0100 | [diff] [blame] | 2260 | } |
| 2261 | |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2262 | /* |
| 2263 | * 0 . 0 handshake type |
| 2264 | * 1 . 3 handshake length |
| 2265 | * 4 . 5 protocol version |
| 2266 | * 6 . 9 UNIX time() |
| 2267 | * 10 . 37 random bytes |
| 2268 | */ |
| 2269 | buf = ssl->out_msg; |
| 2270 | p = buf + 4; |
| 2271 | |
Glenn Strauss | e3af4cb | 2022-03-15 03:23:42 -0400 | [diff] [blame] | 2272 | mbedtls_ssl_write_version( p, ssl->conf->transport, ssl->tls_version ); |
Manuel Pégourié-Gonnard | abc7e3b | 2014-02-11 18:15:03 +0100 | [diff] [blame] | 2273 | p += 2; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2274 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2275 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]", |
Manuel Pégourié-Gonnard | abc7e3b | 2014-02-11 18:15:03 +0100 | [diff] [blame] | 2276 | buf[4], buf[5] ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2277 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2278 | #if defined(MBEDTLS_HAVE_TIME) |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 2279 | t = mbedtls_time( NULL ); |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 2280 | MBEDTLS_PUT_UINT32_BE( t, p, 0 ); |
| 2281 | p += 4; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2282 | |
Paul Elliott | d48d5c6 | 2021-01-07 14:47:05 +0000 | [diff] [blame] | 2283 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %" MBEDTLS_PRINTF_LONGLONG, |
| 2284 | (long long) t ) ); |
Paul Bakker | fa9b100 | 2013-07-03 15:31:03 +0200 | [diff] [blame] | 2285 | #else |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 2286 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 ) |
Paul Bakker | fa9b100 | 2013-07-03 15:31:03 +0200 | [diff] [blame] | 2287 | return( ret ); |
| 2288 | |
| 2289 | p += 4; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2290 | #endif /* MBEDTLS_HAVE_TIME */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2291 | |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 2292 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 ) |
Paul Bakker | a3d195c | 2011-11-27 21:07:34 +0000 | [diff] [blame] | 2293 | return( ret ); |
| 2294 | |
| 2295 | p += 28; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2296 | |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 2297 | memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2298 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2299 | MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2300 | |
Hanno Becker | f6e09c6 | 2021-05-13 06:12:38 +0100 | [diff] [blame] | 2301 | ssl_handle_id_based_session_resumption( ssl ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2302 | |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 2303 | if( ssl->handshake->resume == 0 ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2304 | { |
| 2305 | /* |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 2306 | * New session, create a new session id, |
| 2307 | * unless we're about to issue a session ticket |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2308 | */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2309 | ssl->state++; |
| 2310 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2311 | #if defined(MBEDTLS_HAVE_TIME) |
SimonB | d5800b7 | 2016-04-26 07:43:27 +0100 | [diff] [blame] | 2312 | ssl->session_negotiate->start = mbedtls_time( NULL ); |
Manuel Pégourié-Gonnard | 164d894 | 2013-09-23 22:01:39 +0200 | [diff] [blame] | 2313 | #endif |
| 2314 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2315 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | 164d894 | 2013-09-23 22:01:39 +0200 | [diff] [blame] | 2316 | if( ssl->handshake->new_session_ticket != 0 ) |
| 2317 | { |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 2318 | ssl->session_negotiate->id_len = n = 0; |
Manuel Pégourié-Gonnard | 164d894 | 2013-09-23 22:01:39 +0200 | [diff] [blame] | 2319 | memset( ssl->session_negotiate->id, 0, 32 ); |
| 2320 | } |
| 2321 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2322 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 2323 | { |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 2324 | ssl->session_negotiate->id_len = n = 32; |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 2325 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 2326 | n ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 2327 | return( ret ); |
| 2328 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2329 | } |
| 2330 | else |
| 2331 | { |
| 2332 | /* |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 2333 | * Resuming a session |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2334 | */ |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 2335 | n = ssl->session_negotiate->id_len; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2336 | ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; |
Paul Bakker | ff60ee6 | 2010-03-16 21:09:09 +0000 | [diff] [blame] | 2337 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2338 | if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) |
Paul Bakker | ff60ee6 | 2010-03-16 21:09:09 +0000 | [diff] [blame] | 2339 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2340 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); |
Paul Bakker | ff60ee6 | 2010-03-16 21:09:09 +0000 | [diff] [blame] | 2341 | return( ret ); |
| 2342 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2343 | } |
| 2344 | |
Manuel Pégourié-Gonnard | 3ffa3db | 2013-08-02 11:59:05 +0200 | [diff] [blame] | 2345 | /* |
| 2346 | * 38 . 38 session id length |
| 2347 | * 39 . 38+n session id |
| 2348 | * 39+n . 40+n chosen ciphersuite |
| 2349 | * 41+n . 41+n chosen compression alg. |
| 2350 | * 42+n . 43+n extensions length |
| 2351 | * 44+n . 43+n+m extensions |
| 2352 | */ |
Manuel Pégourié-Gonnard | 12ad798 | 2015-06-18 15:50:37 +0200 | [diff] [blame] | 2353 | *p++ = (unsigned char) ssl->session_negotiate->id_len; |
| 2354 | memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len ); |
| 2355 | p += ssl->session_negotiate->id_len; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2356 | |
Paul Elliott | d48d5c6 | 2021-01-07 14:47:05 +0000 | [diff] [blame] | 2357 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n ) ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2358 | MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n ); |
| 2359 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed", |
Paul Bakker | 0a59707 | 2012-09-25 21:55:46 +0000 | [diff] [blame] | 2360 | ssl->handshake->resume ? "a" : "no" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2361 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 2362 | MBEDTLS_PUT_UINT16_BE( ssl->session_negotiate->ciphersuite, p, 0 ); |
| 2363 | p += 2; |
Thomas Daubney | 20f89a9 | 2022-06-20 15:12:19 +0100 | [diff] [blame] | 2364 | *p++ = MBEDTLS_BYTE_0( MBEDTLS_SSL_COMPRESS_NULL ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2365 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2366 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", |
| 2367 | mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) ); |
| 2368 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X", |
Thomas Daubney | 20f89a9 | 2022-06-20 15:12:19 +0100 | [diff] [blame] | 2369 | (unsigned int) MBEDTLS_SSL_COMPRESS_NULL ) ); |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 2370 | |
Manuel Pégourié-Gonnard | f11a6d7 | 2013-07-17 11:17:14 +0200 | [diff] [blame] | 2371 | /* |
| 2372 | * First write extensions, then the total length |
| 2373 | */ |
| 2374 | ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen ); |
| 2375 | ext_len += olen; |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 2376 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2377 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 2378 | ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen ); |
| 2379 | ext_len += olen; |
Paul Bakker | 05decb2 | 2013-08-15 13:33:48 +0200 | [diff] [blame] | 2380 | #endif |
Manuel Pégourié-Gonnard | 7bb7899 | 2013-07-17 13:50:08 +0200 | [diff] [blame] | 2381 | |
Hanno Becker | a0e20d0 | 2019-05-15 14:03:01 +0100 | [diff] [blame] | 2382 | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
Hanno Becker | 51de2d3 | 2019-04-26 15:46:55 +0100 | [diff] [blame] | 2383 | ssl_write_cid_ext( ssl, p + 2 + ext_len, &olen ); |
| 2384 | ext_len += olen; |
| 2385 | #endif |
| 2386 | |
Neil Armstrong | 76b7407 | 2022-04-06 13:43:54 +0200 | [diff] [blame] | 2387 | #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) |
Manuel Pégourié-Gonnard | 699cafa | 2014-10-27 13:57:03 +0100 | [diff] [blame] | 2388 | ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen ); |
| 2389 | ext_len += olen; |
| 2390 | #endif |
| 2391 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2392 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Manuel Pégourié-Gonnard | 367381f | 2014-10-20 18:40:56 +0200 | [diff] [blame] | 2393 | ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen ); |
| 2394 | ext_len += olen; |
| 2395 | #endif |
| 2396 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2397 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 2398 | ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen ); |
| 2399 | ext_len += olen; |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 2400 | #endif |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 2401 | |
Manuel Pégourié-Gonnard | f472179 | 2015-09-15 10:53:51 +0200 | [diff] [blame] | 2402 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Robert Cragie | ae8535d | 2015-10-06 17:11:18 +0100 | [diff] [blame] | 2403 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Leonid Rozenboim | 2875270 | 2022-04-21 18:00:52 -0700 | [diff] [blame] | 2404 | const mbedtls_ssl_ciphersuite_t *suite = |
| 2405 | mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite ); |
| 2406 | if ( suite != NULL && mbedtls_ssl_ciphersuite_uses_ec( suite) ) |
Ron Eldor | 755bb6a | 2018-02-14 19:30:48 +0200 | [diff] [blame] | 2407 | { |
| 2408 | ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen ); |
| 2409 | ext_len += olen; |
| 2410 | } |
Manuel Pégourié-Gonnard | 7b19c16 | 2013-08-15 18:01:11 +0200 | [diff] [blame] | 2411 | #endif |
| 2412 | |
Manuel Pégourié-Gonnard | 55c7f99 | 2015-09-16 15:35:27 +0200 | [diff] [blame] | 2413 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 2414 | ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen ); |
| 2415 | ext_len += olen; |
| 2416 | #endif |
| 2417 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2418 | #if defined(MBEDTLS_SSL_ALPN) |
XiaokangQian | acb3992 | 2022-06-17 10:18:48 +0000 | [diff] [blame] | 2419 | unsigned char *end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN - 4; |
Paul Elliott | f518f81 | 2022-07-11 12:36:20 +0100 | [diff] [blame] | 2420 | if( ( ret = mbedtls_ssl_write_alpn_ext( ssl, p + 2 + ext_len, end, &olen ) ) |
| 2421 | != 0 ) |
| 2422 | return ret; |
| 2423 | |
Manuel Pégourié-Gonnard | 89e3579 | 2014-04-07 12:10:30 +0200 | [diff] [blame] | 2424 | ext_len += olen; |
| 2425 | #endif |
| 2426 | |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2427 | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
Johan Pascal | c3ccd98 | 2020-10-28 17:18:18 +0100 | [diff] [blame] | 2428 | ssl_write_use_srtp_ext( ssl, p + 2 + ext_len, &olen ); |
| 2429 | ext_len += olen; |
Johan Pascal | b62bb51 | 2015-12-03 21:56:45 +0100 | [diff] [blame] | 2430 | #endif |
| 2431 | |
Paul Elliott | d48d5c6 | 2021-01-07 14:47:05 +0000 | [diff] [blame] | 2432 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %" MBEDTLS_PRINTF_SIZET, |
| 2433 | ext_len ) ); |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 2434 | |
Paul Bakker | a703663 | 2014-04-30 10:15:38 +0200 | [diff] [blame] | 2435 | if( ext_len > 0 ) |
| 2436 | { |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 2437 | MBEDTLS_PUT_UINT16_BE( ext_len, p, 0 ); |
Joe Subbiani | 94180e7 | 2021-08-20 16:20:44 +0100 | [diff] [blame] | 2438 | p += 2 + ext_len; |
Paul Bakker | a703663 | 2014-04-30 10:15:38 +0200 | [diff] [blame] | 2439 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2440 | |
| 2441 | ssl->out_msglen = p - buf; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2442 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
| 2443 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2444 | |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 2445 | ret = mbedtls_ssl_write_handshake_msg( ssl ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2446 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2447 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2448 | |
| 2449 | return( ret ); |
| 2450 | } |
| 2451 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2452 | #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2453 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2454 | static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2455 | { |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 2456 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 2457 | ssl->handshake->ciphersuite_info; |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2458 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2459 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2460 | |
Hanno Becker | 77adddc | 2019-02-07 12:32:43 +0000 | [diff] [blame] | 2461 | if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2462 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2463 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2464 | ssl->state++; |
| 2465 | return( 0 ); |
| 2466 | } |
| 2467 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2468 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 2469 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2470 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2471 | #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2472 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2473 | static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2474 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2475 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 2476 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 2477 | ssl->handshake->ciphersuite_info; |
irwir | c9bc300 | 2020-04-01 13:46:36 +0300 | [diff] [blame] | 2478 | uint16_t dn_size, total_dn_size; /* excluding length bytes */ |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2479 | size_t ct_len, sa_len; /* including length bytes */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2480 | unsigned char *buf, *p; |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 2481 | const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2482 | const mbedtls_x509_crt *crt; |
Manuel Pégourié-Gonnard | cdc26ae | 2015-06-19 12:16:31 +0200 | [diff] [blame] | 2483 | int authmode; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2484 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2485 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2486 | |
| 2487 | ssl->state++; |
| 2488 | |
Manuel Pégourié-Gonnard | cdc26ae | 2015-06-19 12:16:31 +0200 | [diff] [blame] | 2489 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 2490 | if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET ) |
| 2491 | authmode = ssl->handshake->sni_authmode; |
| 2492 | else |
| 2493 | #endif |
| 2494 | authmode = ssl->conf->authmode; |
| 2495 | |
Hanno Becker | 77adddc | 2019-02-07 12:32:43 +0000 | [diff] [blame] | 2496 | if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) || |
Manuel Pégourié-Gonnard | cdc26ae | 2015-06-19 12:16:31 +0200 | [diff] [blame] | 2497 | authmode == MBEDTLS_SSL_VERIFY_NONE ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2498 | { |
Johan Pascal | 4f09926 | 2020-09-22 10:59:26 +0200 | [diff] [blame] | 2499 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) ); |
| 2500 | return( 0 ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2501 | } |
| 2502 | |
| 2503 | /* |
| 2504 | * 0 . 0 handshake type |
| 2505 | * 1 . 3 handshake length |
| 2506 | * 4 . 4 cert type count |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2507 | * 5 .. m-1 cert types |
| 2508 | * m .. m+1 sig alg length (TLS 1.2 only) |
Paul Bakker | 9af723c | 2014-05-01 13:03:14 +0200 | [diff] [blame] | 2509 | * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2510 | * n .. n+1 length of all DNs |
| 2511 | * n+2 .. n+3 length of DN 1 |
| 2512 | * n+4 .. ... Distinguished Name #1 |
| 2513 | * ... .. ... length of DN 2, etc. |
| 2514 | */ |
| 2515 | buf = ssl->out_msg; |
| 2516 | p = buf + 4; |
| 2517 | |
| 2518 | /* |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2519 | * Supported certificate types |
| 2520 | * |
| 2521 | * ClientCertificateType certificate_types<1..2^8-1>; |
| 2522 | * enum { (255) } ClientCertificateType; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2523 | */ |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2524 | ct_len = 0; |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2525 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2526 | #if defined(MBEDTLS_RSA_C) |
| 2527 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN; |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2528 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2529 | #if defined(MBEDTLS_ECDSA_C) |
| 2530 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN; |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2531 | #endif |
| 2532 | |
Paul Bakker | b9cfaa0 | 2013-10-11 18:58:55 +0200 | [diff] [blame] | 2533 | p[0] = (unsigned char) ct_len++; |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2534 | p += ct_len; |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2535 | |
Paul Bakker | 577e006 | 2013-08-28 11:57:20 +0200 | [diff] [blame] | 2536 | sa_len = 0; |
Jerry Yu | e754193 | 2022-01-28 10:21:24 +0800 | [diff] [blame] | 2537 | |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2538 | /* |
| 2539 | * Add signature_algorithms for verify (TLS 1.2) |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2540 | * |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2541 | * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; |
| 2542 | * |
| 2543 | * struct { |
| 2544 | * HashAlgorithm hash; |
| 2545 | * SignatureAlgorithm signature; |
| 2546 | * } SignatureAndHashAlgorithm; |
| 2547 | * |
| 2548 | * enum { (255) } HashAlgorithm; |
| 2549 | * enum { (255) } SignatureAlgorithm; |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2550 | */ |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 2551 | const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs( ssl ); |
| 2552 | if( sig_alg == NULL ) |
| 2553 | return( MBEDTLS_ERR_SSL_BAD_CONFIG ); |
| 2554 | |
Gabor Mezei | 15b95a6 | 2022-05-09 16:37:58 +0200 | [diff] [blame] | 2555 | for( ; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++ ) |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2556 | { |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 2557 | unsigned char hash = MBEDTLS_BYTE_1( *sig_alg ); |
Jerry Yu | 6106fdc | 2022-01-12 16:36:14 +0800 | [diff] [blame] | 2558 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 2559 | if( mbedtls_ssl_set_calc_verify_md( ssl, hash ) ) |
| 2560 | continue; |
| 2561 | if( ! mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg ) ) |
| 2562 | continue; |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 2563 | |
Paul Elliott | 96a0fd9 | 2022-11-08 17:09:56 +0000 | [diff] [blame] | 2564 | /* Write elements at offsets starting from 1 (offset 0 is for the |
| 2565 | * length). Thus the offset of each element is the length of the |
| 2566 | * partial list including that element. */ |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2567 | sa_len += 2; |
Paul Elliott | 96a0fd9 | 2022-11-08 17:09:56 +0000 | [diff] [blame] | 2568 | MBEDTLS_PUT_UINT16_BE( *sig_alg, p, sa_len ); |
| 2569 | |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2570 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2571 | |
Paul Elliott | 96a0fd9 | 2022-11-08 17:09:56 +0000 | [diff] [blame] | 2572 | /* Fill in list length. */ |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 2573 | MBEDTLS_PUT_UINT16_BE( sa_len, p, 0 ); |
| 2574 | sa_len += 2; |
| 2575 | p += sa_len; |
| 2576 | |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 2577 | /* |
| 2578 | * DistinguishedName certificate_authorities<0..2^16-1>; |
| 2579 | * opaque DistinguishedName<1..2^16-1>; |
| 2580 | */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2581 | p += 2; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2582 | |
Paul Bakker | bc3d984 | 2012-11-26 16:12:02 +0100 | [diff] [blame] | 2583 | total_dn_size = 0; |
Janos Follath | 088ce43 | 2017-04-10 12:42:31 +0100 | [diff] [blame] | 2584 | |
| 2585 | if( ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2586 | { |
Hanno Becker | 8bf74f3 | 2019-03-27 11:01:30 +0000 | [diff] [blame] | 2587 | /* NOTE: If trusted certificates are provisioned |
| 2588 | * via a CA callback (configured through |
| 2589 | * `mbedtls_ssl_conf_ca_cb()`, then the |
| 2590 | * CertificateRequest is currently left empty. */ |
| 2591 | |
Glenn Strauss | 999ef70 | 2022-03-11 01:37:23 -0500 | [diff] [blame] | 2592 | #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) |
| 2593 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 2594 | if( ssl->handshake->dn_hints != NULL ) |
| 2595 | crt = ssl->handshake->dn_hints; |
| 2596 | else |
| 2597 | #endif |
| 2598 | if( ssl->conf->dn_hints != NULL ) |
| 2599 | crt = ssl->conf->dn_hints; |
| 2600 | else |
| 2601 | #endif |
Janos Follath | 088ce43 | 2017-04-10 12:42:31 +0100 | [diff] [blame] | 2602 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
| 2603 | if( ssl->handshake->sni_ca_chain != NULL ) |
| 2604 | crt = ssl->handshake->sni_ca_chain; |
| 2605 | else |
| 2606 | #endif |
| 2607 | crt = ssl->conf->ca_chain; |
Manuel Pégourié-Gonnard | bc1babb | 2015-10-02 11:16:47 +0200 | [diff] [blame] | 2608 | |
Janos Follath | 088ce43 | 2017-04-10 12:42:31 +0100 | [diff] [blame] | 2609 | while( crt != NULL && crt->version != 0 ) |
Manuel Pégourié-Gonnard | bc1babb | 2015-10-02 11:16:47 +0200 | [diff] [blame] | 2610 | { |
irwir | c9bc300 | 2020-04-01 13:46:36 +0300 | [diff] [blame] | 2611 | /* It follows from RFC 5280 A.1 that this length |
| 2612 | * can be represented in at most 11 bits. */ |
| 2613 | dn_size = (uint16_t) crt->subject_raw.len; |
Janos Follath | 088ce43 | 2017-04-10 12:42:31 +0100 | [diff] [blame] | 2614 | |
irwir | c9bc300 | 2020-04-01 13:46:36 +0300 | [diff] [blame] | 2615 | if( end < p || (size_t)( end - p ) < 2 + (size_t) dn_size ) |
Janos Follath | 088ce43 | 2017-04-10 12:42:31 +0100 | [diff] [blame] | 2616 | { |
| 2617 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) ); |
| 2618 | break; |
| 2619 | } |
| 2620 | |
Joe Subbiani | 1f6c3ae | 2021-08-20 11:44:44 +0100 | [diff] [blame] | 2621 | MBEDTLS_PUT_UINT16_BE( dn_size, p, 0 ); |
| 2622 | p += 2; |
Janos Follath | 088ce43 | 2017-04-10 12:42:31 +0100 | [diff] [blame] | 2623 | memcpy( p, crt->subject_raw.p, dn_size ); |
| 2624 | p += dn_size; |
| 2625 | |
| 2626 | MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size ); |
| 2627 | |
| 2628 | total_dn_size += 2 + dn_size; |
| 2629 | crt = crt->next; |
Manuel Pégourié-Gonnard | bc1babb | 2015-10-02 11:16:47 +0200 | [diff] [blame] | 2630 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2631 | } |
| 2632 | |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 2633 | ssl->out_msglen = p - buf; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2634 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
| 2635 | ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST; |
Joe Subbiani | 6dd7364 | 2021-07-19 11:56:54 +0100 | [diff] [blame] | 2636 | MBEDTLS_PUT_UINT16_BE( total_dn_size, ssl->out_msg, 4 + ct_len + sa_len ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2637 | |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 2638 | ret = mbedtls_ssl_write_handshake_msg( ssl ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2639 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2640 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2641 | |
| 2642 | return( ret ); |
| 2643 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2644 | #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2645 | |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2646 | #if defined(MBEDTLS_USE_PSA_CRYPTO) && \ |
| 2647 | ( defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
| 2648 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) ) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2649 | MBEDTLS_CHECK_RETURN_CRITICAL |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2650 | static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl ) |
| 2651 | { |
| 2652 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 2653 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Neil Armstrong | 4f33fbc | 2022-03-22 16:30:01 +0100 | [diff] [blame] | 2654 | unsigned char buf[ |
| 2655 | PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2656 | psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2657 | size_t ecdh_bits = 0; |
| 2658 | size_t key_len; |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2659 | mbedtls_pk_context *pk; |
| 2660 | mbedtls_ecp_keypair *key; |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2661 | |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2662 | pk = mbedtls_ssl_own_key( ssl ); |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2663 | |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2664 | if( pk == NULL ) |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2665 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 2666 | |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2667 | switch( mbedtls_pk_get_type( pk ) ) |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2668 | { |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2669 | case MBEDTLS_PK_OPAQUE: |
| 2670 | if( ! mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) ) |
| 2671 | return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); |
| 2672 | |
| 2673 | ssl->handshake->ecdh_psa_privkey = |
| 2674 | *( (mbedtls_svc_key_id_t*) pk->pk_ctx ); |
| 2675 | |
Neil Armstrong | e88d190 | 2022-04-04 11:25:23 +0200 | [diff] [blame] | 2676 | /* Key should not be destroyed in the TLS library */ |
| 2677 | ssl->handshake->ecdh_psa_privkey_is_external = 1; |
| 2678 | |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2679 | status = psa_get_key_attributes( ssl->handshake->ecdh_psa_privkey, |
| 2680 | &key_attributes ); |
| 2681 | if( status != PSA_SUCCESS) |
Neil Armstrong | e88d190 | 2022-04-04 11:25:23 +0200 | [diff] [blame] | 2682 | { |
| 2683 | ssl->handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
Neil Armstrong | 1335222 | 2022-03-25 15:08:11 +0100 | [diff] [blame] | 2684 | return( psa_ssl_status_to_mbedtls( status ) ); |
Neil Armstrong | e88d190 | 2022-04-04 11:25:23 +0200 | [diff] [blame] | 2685 | } |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2686 | |
| 2687 | ssl->handshake->ecdh_psa_type = psa_get_key_type( &key_attributes ); |
| 2688 | ssl->handshake->ecdh_bits = psa_get_key_bits( &key_attributes ); |
| 2689 | |
| 2690 | psa_reset_key_attributes( &key_attributes ); |
| 2691 | |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2692 | ret = 0; |
| 2693 | break; |
| 2694 | case MBEDTLS_PK_ECKEY: |
| 2695 | case MBEDTLS_PK_ECKEY_DH: |
| 2696 | case MBEDTLS_PK_ECDSA: |
| 2697 | key = mbedtls_pk_ec( *pk ); |
| 2698 | if( key == NULL ) |
| 2699 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 2700 | |
| 2701 | /* Convert EC group to PSA key type. */ |
| 2702 | if( ( ssl->handshake->ecdh_psa_type = |
| 2703 | mbedtls_ecc_group_to_psa( key->grp.id, |
| 2704 | &ecdh_bits ) ) == 0 ) |
| 2705 | { |
| 2706 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
| 2707 | } |
| 2708 | |
Neil Armstrong | 91477a7 | 2022-03-25 15:42:20 +0100 | [diff] [blame] | 2709 | ssl->handshake->ecdh_bits = ecdh_bits; |
Neil Armstrong | 104a7c1 | 2022-03-23 10:58:03 +0100 | [diff] [blame] | 2710 | |
| 2711 | key_attributes = psa_key_attributes_init(); |
| 2712 | psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE ); |
| 2713 | psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH ); |
| 2714 | psa_set_key_type( &key_attributes, |
| 2715 | PSA_KEY_TYPE_ECC_KEY_PAIR( ssl->handshake->ecdh_psa_type ) ); |
| 2716 | psa_set_key_bits( &key_attributes, ssl->handshake->ecdh_bits ); |
| 2717 | |
| 2718 | key_len = PSA_BITS_TO_BYTES( key->grp.pbits ); |
| 2719 | ret = mbedtls_ecp_write_key( key, buf, key_len ); |
| 2720 | if( ret != 0 ) |
| 2721 | goto cleanup; |
| 2722 | |
| 2723 | status = psa_import_key( &key_attributes, buf, key_len, |
| 2724 | &ssl->handshake->ecdh_psa_privkey ); |
| 2725 | if( status != PSA_SUCCESS ) |
| 2726 | { |
| 2727 | ret = psa_ssl_status_to_mbedtls( status ); |
| 2728 | goto cleanup; |
| 2729 | } |
| 2730 | |
| 2731 | ret = 0; |
| 2732 | break; |
| 2733 | default: |
| 2734 | ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2735 | } |
| 2736 | |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2737 | cleanup: |
Neil Armstrong | 5cd5f76 | 2022-03-22 17:28:51 +0100 | [diff] [blame] | 2738 | mbedtls_platform_zeroize( buf, sizeof( buf ) ); |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 2739 | |
| 2740 | return( ret ); |
| 2741 | } |
| 2742 | #elif defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2743 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2744 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2745 | static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl ) |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2746 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 2747 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2748 | |
Leonid Rozenboim | 2875270 | 2022-04-21 18:00:52 -0700 | [diff] [blame] | 2749 | const mbedtls_pk_context *private_key = mbedtls_ssl_own_key( ssl ); |
| 2750 | if( private_key == NULL) |
| 2751 | { |
Paul Elliott | dd428d3 | 2022-05-13 17:43:16 +0100 | [diff] [blame] | 2752 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no server private key" ) ); |
Leonid Rozenboim | 2875270 | 2022-04-21 18:00:52 -0700 | [diff] [blame] | 2753 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
| 2754 | } |
| 2755 | |
| 2756 | if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_ECKEY ) ) |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2757 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2758 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) ); |
| 2759 | return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2760 | } |
| 2761 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2762 | if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, |
| 2763 | mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ), |
| 2764 | MBEDTLS_ECDH_OURS ) ) != 0 ) |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2765 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2766 | MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret ); |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2767 | return( ret ); |
| 2768 | } |
| 2769 | |
| 2770 | return( 0 ); |
| 2771 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2772 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || |
| 2773 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
Manuel Pégourié-Gonnard | 5538970 | 2013-12-12 11:14:16 +0100 | [diff] [blame] | 2774 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2775 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2776 | defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2777 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 2778 | static int ssl_resume_server_key_exchange( mbedtls_ssl_context *ssl, |
Gilles Peskine | 0fd90dd | 2018-04-26 07:41:09 +0200 | [diff] [blame] | 2779 | size_t *signature_len ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2780 | { |
Gilles Peskine | 0fd90dd | 2018-04-26 07:41:09 +0200 | [diff] [blame] | 2781 | /* Append the signature to ssl->out_msg, leaving 2 bytes for the |
| 2782 | * signature length which will be added in ssl_write_server_key_exchange |
| 2783 | * after the call to ssl_prepare_server_key_exchange. |
| 2784 | * ssl_write_server_key_exchange also takes care of incrementing |
| 2785 | * ssl->out_msglen. */ |
| 2786 | unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2; |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 2787 | size_t sig_max_len = ( ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN |
Gilles Peskine | 0fd90dd | 2018-04-26 07:41:09 +0200 | [diff] [blame] | 2788 | - sig_start ); |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 2789 | int ret = ssl->conf->f_async_resume( ssl, |
Gilles Peskine | 0fd90dd | 2018-04-26 07:41:09 +0200 | [diff] [blame] | 2790 | sig_start, signature_len, sig_max_len ); |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 2791 | if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ) |
| 2792 | { |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 2793 | ssl->handshake->async_in_progress = 0; |
Gilles Peskine | 1febfef | 2018-04-30 11:54:39 +0200 | [diff] [blame] | 2794 | mbedtls_ssl_set_async_operation_data( ssl, NULL ); |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 2795 | } |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 2796 | MBEDTLS_SSL_DEBUG_RET( 2, "ssl_resume_server_key_exchange", ret ); |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 2797 | return( ret ); |
| 2798 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2799 | #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 2800 | defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 2801 | |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 2802 | /* Prepare the ServerKeyExchange message, up to and including |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 2803 | * calculating the signature if any, but excluding formatting the |
| 2804 | * signature and sending the message. */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 2805 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 2806 | static int ssl_prepare_server_key_exchange( mbedtls_ssl_context *ssl, |
| 2807 | size_t *signature_len ) |
Paul Bakker | 5690efc | 2011-05-26 13:16:06 +0000 | [diff] [blame] | 2808 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2809 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 2810 | ssl->handshake->ciphersuite_info; |
| 2811 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2812 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) |
Jerry Yu | c5aef88 | 2021-12-23 20:15:02 +0800 | [diff] [blame] | 2813 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Gilles Peskine | 3ce9b90 | 2018-01-06 01:34:21 +0100 | [diff] [blame] | 2814 | unsigned char *dig_signed = NULL; |
Jerry Yu | c5aef88 | 2021-12-23 20:15:02 +0800 | [diff] [blame] | 2815 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2816 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2817 | |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 2818 | (void) ciphersuite_info; /* unused in some configurations */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2819 | #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Gilles Peskine | 22e695f | 2018-04-26 00:22:50 +0200 | [diff] [blame] | 2820 | (void) signature_len; |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2821 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2822 | |
Gilles Peskine | 16fe8fc | 2021-06-22 09:45:56 +0200 | [diff] [blame] | 2823 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Gilles Peskine | f00f152 | 2021-06-22 00:09:00 +0200 | [diff] [blame] | 2824 | #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) |
| 2825 | size_t out_buf_len = ssl->out_buf_len - ( ssl->out_msg - ssl->out_buf ); |
| 2826 | #else |
| 2827 | size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN - ( ssl->out_msg - ssl->out_buf ); |
| 2828 | #endif |
Gilles Peskine | 16fe8fc | 2021-06-22 09:45:56 +0200 | [diff] [blame] | 2829 | #endif |
Gilles Peskine | f00f152 | 2021-06-22 00:09:00 +0200 | [diff] [blame] | 2830 | |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2831 | ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2832 | |
Hanno Becker | cf7ae7e | 2017-05-11 14:07:25 +0100 | [diff] [blame] | 2833 | /* |
| 2834 | * |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 2835 | * Part 1: Provide key exchange parameters for chosen ciphersuite. |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 2836 | * |
| 2837 | */ |
| 2838 | |
| 2839 | /* |
| 2840 | * - ECJPAKE key exchanges |
| 2841 | */ |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 2842 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 2843 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
| 2844 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 2845 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2846 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 2847 | unsigned char *out_p = ssl->out_msg + ssl->out_msglen; |
| 2848 | unsigned char *end_p = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN - |
| 2849 | ssl->out_msglen; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2850 | size_t output_offset = 0; |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2851 | size_t output_len = 0; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2852 | const mbedtls_ecp_curve_info *curve_info; |
| 2853 | |
Valerio Setti | 6f1b574 | 2022-11-16 10:00:32 +0100 | [diff] [blame] | 2854 | /* |
| 2855 | * The first 3 bytes are: |
| 2856 | * [0] MBEDTLS_ECP_TLS_NAMED_CURVE |
| 2857 | * [1, 2] elliptic curve's TLS ID |
| 2858 | * |
| 2859 | * However since we only support secp256r1 for now, we hardcode its |
| 2860 | * TLS ID here |
| 2861 | */ |
| 2862 | if( ( curve_info = mbedtls_ecp_curve_info_from_grp_id( |
| 2863 | MBEDTLS_ECP_DP_SECP256R1 ) ) == NULL ) |
| 2864 | { |
| 2865 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
| 2866 | } |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2867 | *out_p = MBEDTLS_ECP_TLS_NAMED_CURVE; |
Valerio Setti | 6f1b574 | 2022-11-16 10:00:32 +0100 | [diff] [blame] | 2868 | MBEDTLS_PUT_UINT16_BE( curve_info->tls_id, out_p, 1 ); |
Valerio Setti | 819de86 | 2022-11-17 18:05:19 +0100 | [diff] [blame] | 2869 | output_offset += 3; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2870 | |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2871 | ret = mbedtls_psa_ecjpake_write_round( &ssl->handshake->psa_pake_ctx, |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2872 | out_p + output_offset, |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 2873 | end_p - out_p - output_offset, &output_len, |
| 2874 | MBEDTLS_ECJPAKE_ROUND_TWO ); |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2875 | if( ret != 0 ) |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2876 | { |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2877 | psa_destroy_key( ssl->handshake->psa_pake_password ); |
| 2878 | psa_pake_abort( &ssl->handshake->psa_pake_ctx ); |
| 2879 | MBEDTLS_SSL_DEBUG_RET( 1 , "psa_pake_output", ret ); |
| 2880 | return( ret ); |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2881 | } |
| 2882 | |
Valerio Setti | 02c25b5 | 2022-11-15 14:08:42 +0100 | [diff] [blame] | 2883 | output_offset += output_len; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2884 | ssl->out_msglen += output_offset; |
| 2885 | #else |
Simon Butcher | 600c5e6 | 2018-06-14 08:58:59 +0100 | [diff] [blame] | 2886 | size_t len = 0; |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 2887 | |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2888 | ret = mbedtls_ecjpake_write_round_two( |
| 2889 | &ssl->handshake->ecjpake_ctx, |
| 2890 | ssl->out_msg + ssl->out_msglen, |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 2891 | MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len, |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2892 | ssl->conf->f_rng, ssl->conf->p_rng ); |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 2893 | if( ret != 0 ) |
| 2894 | { |
| 2895 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret ); |
| 2896 | return( ret ); |
| 2897 | } |
| 2898 | |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2899 | ssl->out_msglen += len; |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 2900 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 2901 | } |
| 2902 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
| 2903 | |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 2904 | /* |
| 2905 | * For (EC)DHE key exchanges with PSK, parameters are prefixed by support |
| 2906 | * identity hint (RFC 4279, Sec. 3). Until someone needs this feature, |
| 2907 | * we use empty support identity hints here. |
| 2908 | **/ |
| 2909 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2910 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
| 2911 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
| 2912 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2913 | { |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2914 | ssl->out_msg[ssl->out_msglen++] = 0x00; |
| 2915 | ssl->out_msg[ssl->out_msglen++] = 0x00; |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2916 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2917 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || |
| 2918 | MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2919 | |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 2920 | /* |
Hanno Becker | cf7ae7e | 2017-05-11 14:07:25 +0100 | [diff] [blame] | 2921 | * - DHE key exchanges |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 2922 | */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2923 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 2924 | if( mbedtls_ssl_ciphersuite_uses_dhe( ciphersuite_info ) ) |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 2925 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 2926 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Simon Butcher | 600c5e6 | 2018-06-14 08:58:59 +0100 | [diff] [blame] | 2927 | size_t len = 0; |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 2928 | |
Manuel Pégourié-Gonnard | 1028b74 | 2015-05-06 17:33:07 +0100 | [diff] [blame] | 2929 | if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL ) |
| 2930 | { |
| 2931 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) ); |
| 2932 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| 2933 | } |
| 2934 | |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2935 | /* |
| 2936 | * Ephemeral DH parameters: |
| 2937 | * |
| 2938 | * struct { |
| 2939 | * opaque dh_p<1..2^16-1>; |
| 2940 | * opaque dh_g<1..2^16-1>; |
| 2941 | * opaque dh_Ys<1..2^16-1>; |
| 2942 | * } ServerDHParams; |
| 2943 | */ |
Hanno Becker | ab74056 | 2017-10-04 13:15:37 +0100 | [diff] [blame] | 2944 | if( ( ret = mbedtls_dhm_set_group( &ssl->handshake->dhm_ctx, |
| 2945 | &ssl->conf->dhm_P, |
| 2946 | &ssl->conf->dhm_G ) ) != 0 ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2947 | { |
Hanno Becker | ab74056 | 2017-10-04 13:15:37 +0100 | [diff] [blame] | 2948 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_set_group", ret ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2949 | return( ret ); |
| 2950 | } |
Paul Bakker | 48916f9 | 2012-09-16 19:57:18 +0000 | [diff] [blame] | 2951 | |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2952 | if( ( ret = mbedtls_dhm_make_params( |
| 2953 | &ssl->handshake->dhm_ctx, |
Gilles Peskine | 487bbf6 | 2021-05-27 22:17:07 +0200 | [diff] [blame] | 2954 | (int) mbedtls_dhm_get_len( &ssl->handshake->dhm_ctx ), |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2955 | ssl->out_msg + ssl->out_msglen, &len, |
| 2956 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2957 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2958 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2959 | return( ret ); |
| 2960 | } |
| 2961 | |
Jerry Yu | c5aef88 | 2021-12-23 20:15:02 +0800 | [diff] [blame] | 2962 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2963 | dig_signed = ssl->out_msg + ssl->out_msglen; |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 2964 | #endif |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2965 | |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 2966 | ssl->out_msglen += len; |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 2967 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2968 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X ); |
| 2969 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P ); |
| 2970 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G ); |
| 2971 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX ); |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2972 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2973 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */ |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2974 | |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 2975 | /* |
Hanno Becker | cf7ae7e | 2017-05-11 14:07:25 +0100 | [diff] [blame] | 2976 | * - ECDHE key exchanges |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 2977 | */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 2978 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 2979 | if( mbedtls_ssl_ciphersuite_uses_ecdhe( ciphersuite_info ) ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 2980 | { |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 2981 | /* |
| 2982 | * Ephemeral ECDH parameters: |
| 2983 | * |
| 2984 | * struct { |
| 2985 | * ECParameters curve_params; |
| 2986 | * ECPoint public; |
| 2987 | * } ServerECDHParams; |
| 2988 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 2989 | const mbedtls_ecp_curve_info **curve = NULL; |
Brett Warren | 01f3dae | 2021-08-17 13:50:51 +0100 | [diff] [blame] | 2990 | const uint16_t *group_list = mbedtls_ssl_get_groups( ssl ); |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 2991 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Simon Butcher | 600c5e6 | 2018-06-14 08:58:59 +0100 | [diff] [blame] | 2992 | size_t len = 0; |
Gergely Budai | 987bfb5 | 2014-01-19 21:48:42 +0100 | [diff] [blame] | 2993 | |
Manuel Pégourié-Gonnard | c3f6b62c | 2014-02-06 10:13:09 +0100 | [diff] [blame] | 2994 | /* Match our preference list against the offered curves */ |
Brett Warren | 01f3dae | 2021-08-17 13:50:51 +0100 | [diff] [blame] | 2995 | if( group_list == NULL ) |
| 2996 | return( MBEDTLS_ERR_SSL_BAD_CONFIG ); |
| 2997 | for( ; *group_list != 0; group_list++ ) |
Manuel Pégourié-Gonnard | c3f6b62c | 2014-02-06 10:13:09 +0100 | [diff] [blame] | 2998 | for( curve = ssl->handshake->curves; *curve != NULL; curve++ ) |
Brett Warren | 01f3dae | 2021-08-17 13:50:51 +0100 | [diff] [blame] | 2999 | if( (*curve)->tls_id == *group_list ) |
Manuel Pégourié-Gonnard | c3f6b62c | 2014-02-06 10:13:09 +0100 | [diff] [blame] | 3000 | goto curve_matching_done; |
| 3001 | |
| 3002 | curve_matching_done: |
Manuel Pégourié-Gonnard | b86145e | 2015-06-23 14:11:39 +0200 | [diff] [blame] | 3003 | if( curve == NULL || *curve == NULL ) |
Gergely Budai | 987bfb5 | 2014-01-19 21:48:42 +0100 | [diff] [blame] | 3004 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3005 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) ); |
Dave Rodgman | bb05cd0 | 2021-06-29 10:37:43 +0100 | [diff] [blame] | 3006 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
Gergely Budai | 987bfb5 | 2014-01-19 21:48:42 +0100 | [diff] [blame] | 3007 | } |
Manuel Pégourié-Gonnard | de05390 | 2014-02-04 13:58:39 +0100 | [diff] [blame] | 3008 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3009 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) ); |
Gergely Budai | 987bfb5 | 2014-01-19 21:48:42 +0100 | [diff] [blame] | 3010 | |
Przemek Stekiel | b6ce0b6 | 2022-03-09 15:38:24 +0100 | [diff] [blame] | 3011 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Neil Armstrong | d91526c | 2022-04-12 14:38:52 +0200 | [diff] [blame] | 3012 | psa_status_t status = PSA_ERROR_GENERIC_ERROR; |
| 3013 | psa_key_attributes_t key_attributes; |
| 3014 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 3015 | size_t ecdh_bits = 0; |
| 3016 | uint8_t *p = ssl->out_msg + ssl->out_msglen; |
| 3017 | const size_t header_size = 4; // curve_type(1), namedcurve(2), |
| 3018 | // data length(1) |
| 3019 | const size_t data_length_size = 1; |
| 3020 | |
| 3021 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Perform PSA-based ECDH computation." ) ); |
| 3022 | |
| 3023 | /* Convert EC group to PSA key type. */ |
| 3024 | handshake->ecdh_psa_type = mbedtls_psa_parse_tls_ecc_group( |
| 3025 | (*curve)->tls_id, &ecdh_bits ); |
| 3026 | |
| 3027 | if( handshake->ecdh_psa_type == 0 ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 3028 | { |
Neil Armstrong | d91526c | 2022-04-12 14:38:52 +0200 | [diff] [blame] | 3029 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid ecc group parse." ) ); |
| 3030 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Przemek Stekiel | b6ce0b6 | 2022-03-09 15:38:24 +0100 | [diff] [blame] | 3031 | } |
Neil Armstrong | d91526c | 2022-04-12 14:38:52 +0200 | [diff] [blame] | 3032 | handshake->ecdh_bits = ecdh_bits; |
| 3033 | |
| 3034 | key_attributes = psa_key_attributes_init(); |
| 3035 | psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE ); |
| 3036 | psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH ); |
| 3037 | psa_set_key_type( &key_attributes, handshake->ecdh_psa_type ); |
| 3038 | psa_set_key_bits( &key_attributes, handshake->ecdh_bits ); |
| 3039 | |
| 3040 | /* |
| 3041 | * ECParameters curve_params |
| 3042 | * |
| 3043 | * First byte is curve_type, always named_curve |
| 3044 | */ |
| 3045 | *p++ = MBEDTLS_ECP_TLS_NAMED_CURVE; |
| 3046 | |
| 3047 | /* |
| 3048 | * Next two bytes are the namedcurve value |
| 3049 | */ |
| 3050 | MBEDTLS_PUT_UINT16_BE( (*curve)->tls_id, p, 0 ); |
| 3051 | p += 2; |
| 3052 | |
| 3053 | /* Generate ECDH private key. */ |
| 3054 | status = psa_generate_key( &key_attributes, |
| 3055 | &handshake->ecdh_psa_privkey ); |
| 3056 | if( status != PSA_SUCCESS ) |
| 3057 | { |
| 3058 | ret = psa_ssl_status_to_mbedtls( status ); |
| 3059 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_generate_key", ret ); |
| 3060 | return( ret ); |
| 3061 | } |
| 3062 | |
| 3063 | /* |
| 3064 | * ECPoint public |
| 3065 | * |
| 3066 | * First byte is data length. |
| 3067 | * It will be filled later. p holds now the data length location. |
| 3068 | */ |
| 3069 | |
| 3070 | /* Export the public part of the ECDH private key from PSA. |
| 3071 | * Make one byte space for the length. |
| 3072 | */ |
| 3073 | unsigned char *own_pubkey = p + data_length_size; |
| 3074 | |
| 3075 | size_t own_pubkey_max_len = (size_t)( MBEDTLS_SSL_OUT_CONTENT_LEN |
| 3076 | - ( own_pubkey - ssl->out_msg ) ); |
| 3077 | |
| 3078 | status = psa_export_public_key( handshake->ecdh_psa_privkey, |
| 3079 | own_pubkey, own_pubkey_max_len, |
| 3080 | &len ); |
| 3081 | if( status != PSA_SUCCESS ) |
| 3082 | { |
| 3083 | ret = psa_ssl_status_to_mbedtls( status ); |
| 3084 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_export_public_key", ret ); |
| 3085 | (void) psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 3086 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 3087 | return( ret ); |
| 3088 | } |
| 3089 | |
| 3090 | /* Store the length of the exported public key. */ |
| 3091 | *p = (uint8_t) len; |
| 3092 | |
| 3093 | /* Determine full message length. */ |
| 3094 | len += header_size; |
| 3095 | #else |
| 3096 | if( ( ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx, |
| 3097 | (*curve)->grp_id ) ) != 0 ) |
| 3098 | { |
| 3099 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret ); |
| 3100 | return( ret ); |
| 3101 | } |
| 3102 | |
| 3103 | if( ( ret = mbedtls_ecdh_make_params( |
| 3104 | &ssl->handshake->ecdh_ctx, &len, |
| 3105 | ssl->out_msg + ssl->out_msglen, |
| 3106 | MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, |
| 3107 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
| 3108 | { |
| 3109 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret ); |
| 3110 | return( ret ); |
| 3111 | } |
| 3112 | |
| 3113 | MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, |
| 3114 | MBEDTLS_DEBUG_ECDH_Q ); |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3115 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 3116 | |
Jerry Yu | c5aef88 | 2021-12-23 20:15:02 +0800 | [diff] [blame] | 3117 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 3118 | dig_signed = ssl->out_msg + ssl->out_msglen; |
Hanno Becker | cf7ae7e | 2017-05-11 14:07:25 +0100 | [diff] [blame] | 3119 | #endif |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3120 | |
Gilles Peskine | f9f15ae | 2018-01-08 17:13:01 +0100 | [diff] [blame] | 3121 | ssl->out_msglen += len; |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 3122 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3123 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3124 | |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 3125 | /* |
Hanno Becker | cf7ae7e | 2017-05-11 14:07:25 +0100 | [diff] [blame] | 3126 | * |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3127 | * Part 2: For key exchanges involving the server signing the |
Hanno Becker | cf7ae7e | 2017-05-11 14:07:25 +0100 | [diff] [blame] | 3128 | * exchange parameters, compute and add the signature here. |
| 3129 | * |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 3130 | */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3131 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Hanno Becker | 1aa267c | 2017-04-28 17:08:27 +0100 | [diff] [blame] | 3132 | if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) ) |
Paul Bakker | 1ef83d6 | 2012-04-11 12:09:53 +0000 | [diff] [blame] | 3133 | { |
Paul Elliott | 1142038 | 2022-05-13 17:43:47 +0100 | [diff] [blame] | 3134 | if( dig_signed == NULL ) |
| 3135 | { |
| 3136 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 3137 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 3138 | } |
| 3139 | |
Gilles Peskine | 1004c19 | 2018-01-08 16:59:14 +0100 | [diff] [blame] | 3140 | size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed; |
Gilles Peskine | ca1d742 | 2018-04-24 11:53:22 +0200 | [diff] [blame] | 3141 | size_t hashlen = 0; |
Przemek Stekiel | 5166954 | 2022-09-13 12:57:05 +0200 | [diff] [blame] | 3142 | unsigned char hash[MBEDTLS_HASH_MAX_SIZE]; |
| 3143 | |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 3144 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 23f3680 | 2012-09-28 14:15:14 +0000 | [diff] [blame] | 3145 | |
Manuel Pégourié-Gonnard | abae74c | 2013-08-20 13:53:44 +0200 | [diff] [blame] | 3146 | /* |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3147 | * 2.1: Choose hash algorithm: |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 3148 | * For TLS 1.2, obey signature-hash-algorithm extension |
| 3149 | * to choose appropriate hash. |
Manuel Pégourié-Gonnard | 4bd1284 | 2013-08-27 13:31:28 +0200 | [diff] [blame] | 3150 | */ |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 3151 | |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 3152 | mbedtls_pk_type_t sig_alg = |
| 3153 | mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ); |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 3154 | |
Gabor Mezei | a3d016c | 2022-05-10 12:44:09 +0200 | [diff] [blame] | 3155 | unsigned int sig_hash = |
| 3156 | mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( |
| 3157 | ssl, mbedtls_ssl_sig_from_pk_alg( sig_alg ) ); |
| 3158 | |
| 3159 | mbedtls_md_type_t md_alg = mbedtls_ssl_md_alg_from_hash( sig_hash ); |
| 3160 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 3161 | /* For TLS 1.2, obey signature-hash-algorithm extension |
| 3162 | * (RFC 5246, Sec. 7.4.1.4.1). */ |
Gabor Mezei | 696956d | 2022-05-13 16:27:29 +0200 | [diff] [blame] | 3163 | if( sig_alg == MBEDTLS_PK_NONE || md_alg == MBEDTLS_MD_NONE ) |
Manuel Pégourié-Gonnard | 4bd1284 | 2013-08-27 13:31:28 +0200 | [diff] [blame] | 3164 | { |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 3165 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 3166 | /* (... because we choose a cipher suite |
| 3167 | * only if there is a matching hash.) */ |
TRodziewicz | 4ca18aa | 2021-05-20 14:46:20 +0200 | [diff] [blame] | 3168 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Manuel Pégourié-Gonnard | 4bd1284 | 2013-08-27 13:31:28 +0200 | [diff] [blame] | 3169 | } |
| 3170 | |
Paul Elliott | 3891caf | 2020-12-17 18:42:40 +0000 | [diff] [blame] | 3171 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "pick hash algorithm %u for signing", (unsigned) md_alg ) ); |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 3172 | |
Manuel Pégourié-Gonnard | 4bd1284 | 2013-08-27 13:31:28 +0200 | [diff] [blame] | 3173 | /* |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3174 | * 2.2: Compute the hash to be signed |
Manuel Pégourié-Gonnard | abae74c | 2013-08-20 13:53:44 +0200 | [diff] [blame] | 3175 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3176 | if( md_alg != MBEDTLS_MD_NONE ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3177 | { |
Gilles Peskine | ca1d742 | 2018-04-24 11:53:22 +0200 | [diff] [blame] | 3178 | ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen, |
Andres Amaya Garcia | 46f5a3e | 2017-07-20 16:17:51 +0100 | [diff] [blame] | 3179 | dig_signed, |
| 3180 | dig_signed_len, |
| 3181 | md_alg ); |
| 3182 | if( ret != 0 ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3183 | return( ret ); |
Paul Bakker | 23f3680 | 2012-09-28 14:15:14 +0000 | [diff] [blame] | 3184 | } |
Paul Bakker | d2f068e | 2013-08-27 21:19:20 +0200 | [diff] [blame] | 3185 | else |
Paul Bakker | 577e006 | 2013-08-28 11:57:20 +0200 | [diff] [blame] | 3186 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3187 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 3188 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Paul Bakker | 577e006 | 2013-08-28 11:57:20 +0200 | [diff] [blame] | 3189 | } |
Paul Bakker | c70b982 | 2013-04-07 22:00:46 +0200 | [diff] [blame] | 3190 | |
Gilles Peskine | ebd652f | 2018-01-05 21:18:59 +0100 | [diff] [blame] | 3191 | MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3192 | |
Manuel Pégourié-Gonnard | abae74c | 2013-08-20 13:53:44 +0200 | [diff] [blame] | 3193 | /* |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3194 | * 2.3: Compute and add the signature |
Manuel Pégourié-Gonnard | abae74c | 2013-08-20 13:53:44 +0200 | [diff] [blame] | 3195 | */ |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 3196 | /* |
| 3197 | * We need to specify signature and hash algorithm explicitly through |
| 3198 | * a prefix to the signature. |
| 3199 | * |
| 3200 | * struct { |
| 3201 | * HashAlgorithm hash; |
| 3202 | * SignatureAlgorithm signature; |
| 3203 | * } SignatureAndHashAlgorithm; |
| 3204 | * |
| 3205 | * struct { |
| 3206 | * SignatureAndHashAlgorithm algorithm; |
| 3207 | * opaque signature<0..2^16-1>; |
| 3208 | * } DigitallySigned; |
| 3209 | * |
| 3210 | */ |
Hanno Becker | 7e5437a | 2017-04-28 17:15:26 +0100 | [diff] [blame] | 3211 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 3212 | ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_hash_from_md_alg( md_alg ); |
| 3213 | ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_sig_from_pk_alg( sig_alg ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3214 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3215 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 4bf9a28 | 2018-01-05 21:20:50 +0100 | [diff] [blame] | 3216 | if( ssl->conf->f_async_sign_start != NULL ) |
| 3217 | { |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 3218 | ret = ssl->conf->f_async_sign_start( ssl, |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3219 | mbedtls_ssl_own_cert( ssl ), |
| 3220 | md_alg, hash, hashlen ); |
Gilles Peskine | 4bf9a28 | 2018-01-05 21:20:50 +0100 | [diff] [blame] | 3221 | switch( ret ) |
| 3222 | { |
| 3223 | case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: |
| 3224 | /* act as if f_async_sign was null */ |
| 3225 | break; |
| 3226 | case 0: |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3227 | ssl->handshake->async_in_progress = 1; |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 3228 | return( ssl_resume_server_key_exchange( ssl, signature_len ) ); |
Gilles Peskine | 4bf9a28 | 2018-01-05 21:20:50 +0100 | [diff] [blame] | 3229 | case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3230 | ssl->handshake->async_in_progress = 1; |
Gilles Peskine | 4bf9a28 | 2018-01-05 21:20:50 +0100 | [diff] [blame] | 3231 | return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ); |
| 3232 | default: |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3233 | MBEDTLS_SSL_DEBUG_RET( 1, "f_async_sign_start", ret ); |
Gilles Peskine | 4bf9a28 | 2018-01-05 21:20:50 +0100 | [diff] [blame] | 3234 | return( ret ); |
| 3235 | } |
| 3236 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3237 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 4bf9a28 | 2018-01-05 21:20:50 +0100 | [diff] [blame] | 3238 | |
| 3239 | if( mbedtls_ssl_own_key( ssl ) == NULL ) |
| 3240 | { |
| 3241 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) ); |
| 3242 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
| 3243 | } |
| 3244 | |
Gilles Peskine | 0fd90dd | 2018-04-26 07:41:09 +0200 | [diff] [blame] | 3245 | /* Append the signature to ssl->out_msg, leaving 2 bytes for the |
| 3246 | * signature length which will be added in ssl_write_server_key_exchange |
| 3247 | * after the call to ssl_prepare_server_key_exchange. |
| 3248 | * ssl_write_server_key_exchange also takes care of incrementing |
| 3249 | * ssl->out_msglen. */ |
Gilles Peskine | 1004c19 | 2018-01-08 16:59:14 +0100 | [diff] [blame] | 3250 | if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), |
| 3251 | md_alg, hash, hashlen, |
| 3252 | ssl->out_msg + ssl->out_msglen + 2, |
Gilles Peskine | f00f152 | 2021-06-22 00:09:00 +0200 | [diff] [blame] | 3253 | out_buf_len - ssl->out_msglen - 2, |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 3254 | signature_len, |
Gilles Peskine | 1004c19 | 2018-01-08 16:59:14 +0100 | [diff] [blame] | 3255 | ssl->conf->f_rng, |
| 3256 | ssl->conf->p_rng ) ) != 0 ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3257 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3258 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret ); |
Paul Bakker | c70b982 | 2013-04-07 22:00:46 +0200 | [diff] [blame] | 3259 | return( ret ); |
Paul Bakker | 23f3680 | 2012-09-28 14:15:14 +0000 | [diff] [blame] | 3260 | } |
Paul Bakker | 1ef83d6 | 2012-04-11 12:09:53 +0000 | [diff] [blame] | 3261 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3262 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
Paul Bakker | 1ef83d6 | 2012-04-11 12:09:53 +0000 | [diff] [blame] | 3263 | |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3264 | return( 0 ); |
| 3265 | } |
Paul Bakker | 1ef83d6 | 2012-04-11 12:09:53 +0000 | [diff] [blame] | 3266 | |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 3267 | /* Prepare the ServerKeyExchange message and send it. For ciphersuites |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 3268 | * that do not include a ServerKeyExchange message, do nothing. Either |
| 3269 | * way, if successful, move on to the next step in the SSL state |
| 3270 | * machine. */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3271 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3272 | static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl ) |
| 3273 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 3274 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 3275 | size_t signature_len = 0; |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3276 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3277 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 3278 | ssl->handshake->ciphersuite_info; |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3279 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3280 | |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 3281 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) ); |
| 3282 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3283 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 3284 | /* Extract static ECDH parameters and abort if ServerKeyExchange |
| 3285 | * is not needed. */ |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3286 | if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) ) |
| 3287 | { |
| 3288 | /* For suites involving ECDH, extract DH parameters |
| 3289 | * from certificate at this point. */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3290 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3291 | if( mbedtls_ssl_ciphersuite_uses_ecdh( ciphersuite_info ) ) |
| 3292 | { |
Manuel Pégourié-Gonnard | b64fb62 | 2022-06-10 09:34:20 +0200 | [diff] [blame] | 3293 | ret = ssl_get_ecdh_params_from_cert( ssl ); |
| 3294 | if( ret != 0 ) |
| 3295 | { |
| 3296 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret ); |
| 3297 | return( ret ); |
| 3298 | } |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3299 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3300 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3301 | |
| 3302 | /* Key exchanges not involving ephemeral keys don't use |
| 3303 | * ServerKeyExchange, so end here. */ |
| 3304 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) ); |
| 3305 | ssl->state++; |
| 3306 | return( 0 ); |
| 3307 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3308 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3309 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3310 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3311 | defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 3312 | /* If we have already prepared the message and there is an ongoing |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 3313 | * signature operation, resume signing. */ |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3314 | if( ssl->handshake->async_in_progress != 0 ) |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 3315 | { |
| 3316 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming signature operation" ) ); |
| 3317 | ret = ssl_resume_server_key_exchange( ssl, &signature_len ); |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 3318 | } |
| 3319 | else |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3320 | #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3321 | defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 3322 | { |
| 3323 | /* ServerKeyExchange is needed. Prepare the message. */ |
| 3324 | ret = ssl_prepare_server_key_exchange( ssl, &signature_len ); |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 3325 | } |
| 3326 | |
| 3327 | if( ret != 0 ) |
| 3328 | { |
Gilles Peskine | ad28bf0 | 2018-04-26 00:19:16 +0200 | [diff] [blame] | 3329 | /* If we're starting to write a new message, set ssl->out_msglen |
| 3330 | * to 0. But if we're resuming after an asynchronous message, |
| 3331 | * out_msglen is the amount of data written so far and mst be |
| 3332 | * preserved. */ |
Gilles Peskine | d3eb061 | 2018-01-08 17:07:44 +0100 | [diff] [blame] | 3333 | if( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ) |
| 3334 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange (pending)" ) ); |
| 3335 | else |
| 3336 | ssl->out_msglen = 0; |
| 3337 | return( ret ); |
Gilles Peskine | ebd30ae | 2018-01-06 03:34:20 +0100 | [diff] [blame] | 3338 | } |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3339 | |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 3340 | /* If there is a signature, write its length. |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 3341 | * ssl_prepare_server_key_exchange already wrote the signature |
| 3342 | * itself at its proper place in the output buffer. */ |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3343 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 3344 | if( signature_len != 0 ) |
| 3345 | { |
Joe Subbiani | fbeb692 | 2021-07-16 14:27:50 +0100 | [diff] [blame] | 3346 | ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_1( signature_len ); |
| 3347 | ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_0( signature_len ); |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 3348 | |
| 3349 | MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", |
| 3350 | ssl->out_msg + ssl->out_msglen, |
| 3351 | signature_len ); |
| 3352 | |
| 3353 | /* Skip over the already-written signature */ |
| 3354 | ssl->out_msglen += signature_len; |
| 3355 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3356 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
Gilles Peskine | 7ab013a | 2018-01-08 17:04:16 +0100 | [diff] [blame] | 3357 | |
Gilles Peskine | 184a3fa | 2018-01-06 01:46:17 +0100 | [diff] [blame] | 3358 | /* Add header and send. */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3359 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
| 3360 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3361 | |
| 3362 | ssl->state++; |
| 3363 | |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 3364 | if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3365 | { |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 3366 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3367 | return( ret ); |
| 3368 | } |
| 3369 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3370 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3371 | return( 0 ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3372 | } |
| 3373 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3374 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3375 | static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3376 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 3377 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3378 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3379 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3380 | |
| 3381 | ssl->out_msglen = 4; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3382 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
| 3383 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3384 | |
| 3385 | ssl->state++; |
| 3386 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3387 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 3388 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3389 | mbedtls_ssl_send_flight_completed( ssl ); |
Manuel Pégourié-Gonnard | 7de3c9e | 2014-09-29 15:29:48 +0200 | [diff] [blame] | 3390 | #endif |
| 3391 | |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 3392 | if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3393 | { |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 3394 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3395 | return( ret ); |
| 3396 | } |
| 3397 | |
Manuel Pégourié-Gonnard | 87a346f | 2017-09-13 12:45:21 +0200 | [diff] [blame] | 3398 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 3399 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
| 3400 | ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 ) |
| 3401 | { |
| 3402 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret ); |
| 3403 | return( ret ); |
| 3404 | } |
Hanno Becker | bc2498a | 2018-08-28 10:13:29 +0100 | [diff] [blame] | 3405 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Manuel Pégourié-Gonnard | 87a346f | 2017-09-13 12:45:21 +0200 | [diff] [blame] | 3406 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3407 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3408 | |
| 3409 | return( 0 ); |
| 3410 | } |
| 3411 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3412 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
| 3413 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3414 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3415 | static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p, |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3416 | const unsigned char *end ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3417 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3418 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3419 | size_t n; |
| 3420 | |
| 3421 | /* |
| 3422 | * Receive G^Y mod P, premaster = (G^Y)^X mod P |
| 3423 | */ |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3424 | if( *p + 2 > end ) |
| 3425 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3426 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3427 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3428 | } |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3429 | |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3430 | n = ( (*p)[0] << 8 ) | (*p)[1]; |
| 3431 | *p += 2; |
| 3432 | |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3433 | if( *p + n > end ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3434 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3435 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3436 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3437 | } |
| 3438 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3439 | if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3440 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3441 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret ); |
Hanno Becker | b24e74b | 2021-06-24 09:52:01 +0100 | [diff] [blame] | 3442 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3443 | } |
| 3444 | |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3445 | *p += n; |
| 3446 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3447 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3448 | |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3449 | return( ret ); |
| 3450 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3451 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || |
| 3452 | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3453 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3454 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
| 3455 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3456 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3457 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3458 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3459 | static int ssl_resume_decrypt_pms( mbedtls_ssl_context *ssl, |
| 3460 | unsigned char *peer_pms, |
| 3461 | size_t *peer_pmslen, |
| 3462 | size_t peer_pmssize ) |
| 3463 | { |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 3464 | int ret = ssl->conf->f_async_resume( ssl, |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3465 | peer_pms, peer_pmslen, peer_pmssize ); |
| 3466 | if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ) |
| 3467 | { |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3468 | ssl->handshake->async_in_progress = 0; |
Gilles Peskine | 1febfef | 2018-04-30 11:54:39 +0200 | [diff] [blame] | 3469 | mbedtls_ssl_set_async_operation_data( ssl, NULL ); |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3470 | } |
| 3471 | MBEDTLS_SSL_DEBUG_RET( 2, "ssl_decrypt_encrypted_pms", ret ); |
| 3472 | return( ret ); |
| 3473 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3474 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3475 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3476 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3477 | static int ssl_decrypt_encrypted_pms( mbedtls_ssl_context *ssl, |
| 3478 | const unsigned char *p, |
| 3479 | const unsigned char *end, |
| 3480 | unsigned char *peer_pms, |
| 3481 | size_t *peer_pmslen, |
| 3482 | size_t peer_pmssize ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3483 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 3484 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Leonid Rozenboim | 70dfd4c | 2022-08-08 15:43:44 -0700 | [diff] [blame] | 3485 | |
| 3486 | mbedtls_x509_crt *own_cert = mbedtls_ssl_own_cert( ssl ); |
| 3487 | if( own_cert == NULL ) { |
| 3488 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no local certificate" ) ); |
| 3489 | return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE ); |
| 3490 | } |
| 3491 | mbedtls_pk_context *public_key = &own_cert->pk; |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3492 | mbedtls_pk_context *private_key = mbedtls_ssl_own_key( ssl ); |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3493 | size_t len = mbedtls_pk_get_len( public_key ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3494 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3495 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3496 | /* If we have already started decoding the message and there is an ongoing |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 3497 | * decryption operation, resume signing. */ |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3498 | if( ssl->handshake->async_in_progress != 0 ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3499 | { |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3500 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming decryption operation" ) ); |
| 3501 | return( ssl_resume_decrypt_pms( ssl, |
| 3502 | peer_pms, peer_pmslen, peer_pmssize ) ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3503 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3504 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3505 | |
| 3506 | /* |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3507 | * Prepare to decrypt the premaster using own private RSA key |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3508 | */ |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 3509 | if ( p + 2 > end ) { |
| 3510 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3511 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 3512 | } |
Joe Subbiani | 2194dc4 | 2021-07-14 12:31:31 +0100 | [diff] [blame] | 3513 | if( *p++ != MBEDTLS_BYTE_1( len ) || |
| 3514 | *p++ != MBEDTLS_BYTE_0( len ) ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3515 | { |
Mateusz Starzyk | 06b07fb | 2021-02-18 13:55:21 +0100 | [diff] [blame] | 3516 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3517 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3518 | } |
| 3519 | |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3520 | if( p + len != end ) |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3521 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3522 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3523 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3524 | } |
| 3525 | |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3526 | /* |
| 3527 | * Decrypt the premaster secret |
| 3528 | */ |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3529 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3530 | if( ssl->conf->f_async_decrypt_start != NULL ) |
| 3531 | { |
Gilles Peskine | 8f97af7 | 2018-04-26 11:46:10 +0200 | [diff] [blame] | 3532 | ret = ssl->conf->f_async_decrypt_start( ssl, |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3533 | mbedtls_ssl_own_cert( ssl ), |
| 3534 | p, len ); |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3535 | switch( ret ) |
| 3536 | { |
| 3537 | case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: |
| 3538 | /* act as if f_async_decrypt_start was null */ |
| 3539 | break; |
| 3540 | case 0: |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3541 | ssl->handshake->async_in_progress = 1; |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3542 | return( ssl_resume_decrypt_pms( ssl, |
| 3543 | peer_pms, |
| 3544 | peer_pmslen, |
| 3545 | peer_pmssize ) ); |
| 3546 | case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3547 | ssl->handshake->async_in_progress = 1; |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3548 | return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ); |
| 3549 | default: |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3550 | MBEDTLS_SSL_DEBUG_RET( 1, "f_async_decrypt_start", ret ); |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3551 | return( ret ); |
| 3552 | } |
| 3553 | } |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3554 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3555 | |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3556 | if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_RSA ) ) |
| 3557 | { |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3558 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) ); |
| 3559 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
| 3560 | } |
| 3561 | |
| 3562 | ret = mbedtls_pk_decrypt( private_key, p, len, |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3563 | peer_pms, peer_pmslen, peer_pmssize, |
| 3564 | ssl->conf->f_rng, ssl->conf->p_rng ); |
| 3565 | return( ret ); |
| 3566 | } |
| 3567 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3568 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3569 | static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl, |
| 3570 | const unsigned char *p, |
| 3571 | const unsigned char *end, |
| 3572 | size_t pms_offset ) |
| 3573 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 3574 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3575 | unsigned char *pms = ssl->handshake->premaster + pms_offset; |
| 3576 | unsigned char ver[2]; |
| 3577 | unsigned char fake_pms[48], peer_pms[48]; |
| 3578 | unsigned char mask; |
| 3579 | size_t i, peer_pmslen; |
| 3580 | unsigned int diff; |
| 3581 | |
Gilles Peskine | 0a8352b | 2018-06-13 18:16:41 +0200 | [diff] [blame] | 3582 | /* In case of a failure in decryption, the decryption may write less than |
| 3583 | * 2 bytes of output, but we always read the first two bytes. It doesn't |
| 3584 | * matter in the end because diff will be nonzero in that case due to |
André Maroneze | 7953329 | 2020-11-12 09:37:42 +0100 | [diff] [blame] | 3585 | * ret being nonzero, and we only care whether diff is 0. |
| 3586 | * But do initialize peer_pms and peer_pmslen for robustness anyway. This |
| 3587 | * also makes memory analyzers happy (don't access uninitialized memory, |
| 3588 | * even if it's an unsigned char). */ |
Gilles Peskine | 0a8352b | 2018-06-13 18:16:41 +0200 | [diff] [blame] | 3589 | peer_pms[0] = peer_pms[1] = ~0; |
André Maroneze | 7953329 | 2020-11-12 09:37:42 +0100 | [diff] [blame] | 3590 | peer_pmslen = 0; |
Gilles Peskine | 0a8352b | 2018-06-13 18:16:41 +0200 | [diff] [blame] | 3591 | |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3592 | ret = ssl_decrypt_encrypted_pms( ssl, p, end, |
| 3593 | peer_pms, |
| 3594 | &peer_pmslen, |
| 3595 | sizeof( peer_pms ) ); |
| 3596 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3597 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3598 | if ( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS ) |
| 3599 | return( ret ); |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3600 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3601 | |
Glenn Strauss | e3af4cb | 2022-03-15 03:23:42 -0400 | [diff] [blame] | 3602 | mbedtls_ssl_write_version( ver, ssl->conf->transport, |
| 3603 | ssl->session_negotiate->tls_version ); |
Gilles Peskine | 2e33337 | 2018-04-24 13:22:10 +0200 | [diff] [blame] | 3604 | |
| 3605 | /* Avoid data-dependent branches while checking for invalid |
| 3606 | * padding, to protect against timing-based Bleichenbacher-type |
| 3607 | * attacks. */ |
| 3608 | diff = (unsigned int) ret; |
| 3609 | diff |= peer_pmslen ^ 48; |
| 3610 | diff |= peer_pms[0] ^ ver[0]; |
| 3611 | diff |= peer_pms[1] ^ ver[1]; |
| 3612 | |
| 3613 | /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */ |
Gabor Mezei | 90437e3 | 2021-10-20 11:59:27 +0200 | [diff] [blame] | 3614 | mask = mbedtls_ct_uint_mask( diff ); |
Manuel Pégourié-Gonnard | b9c93d0 | 2015-06-23 13:53:15 +0200 | [diff] [blame] | 3615 | |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3616 | /* |
| 3617 | * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding |
| 3618 | * must not cause the connection to end immediately; instead, send a |
| 3619 | * bad_record_mac later in the handshake. |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3620 | * To protect against timing-based variants of the attack, we must |
| 3621 | * not have any branch that depends on whether the decryption was |
| 3622 | * successful. In particular, always generate the fake premaster secret, |
| 3623 | * regardless of whether it will ultimately influence the output or not. |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3624 | */ |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 3625 | ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) ); |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3626 | if( ret != 0 ) |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3627 | { |
Gilles Peskine | e141638 | 2018-04-26 10:23:21 +0200 | [diff] [blame] | 3628 | /* It's ok to abort on an RNG failure, since this does not reveal |
| 3629 | * anything about the RSA decryption. */ |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3630 | return( ret ); |
Gilles Peskine | bcd98a5 | 2018-01-11 21:30:40 +0100 | [diff] [blame] | 3631 | } |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3632 | |
Manuel Pégourié-Gonnard | 331ba57 | 2015-04-20 12:33:57 +0100 | [diff] [blame] | 3633 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
Manuel Pégourié-Gonnard | ce60fbe | 2015-04-15 16:45:52 +0200 | [diff] [blame] | 3634 | if( diff != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3635 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3636 | #endif |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3637 | |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3638 | if( sizeof( ssl->handshake->premaster ) < pms_offset || |
| 3639 | sizeof( ssl->handshake->premaster ) - pms_offset < 48 ) |
| 3640 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3641 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 3642 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3643 | } |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3644 | ssl->handshake->pmslen = 48; |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3645 | |
Gilles Peskine | 422ccab | 2018-01-11 18:29:01 +0100 | [diff] [blame] | 3646 | /* Set pms to either the true or the fake PMS, without |
| 3647 | * data-dependent branches. */ |
Manuel Pégourié-Gonnard | 6674cce | 2015-02-06 10:30:58 +0000 | [diff] [blame] | 3648 | for( i = 0; i < ssl->handshake->pmslen; i++ ) |
| 3649 | pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] ); |
| 3650 | |
| 3651 | return( 0 ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3652 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3653 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || |
| 3654 | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3655 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3656 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3657 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3658 | static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p, |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3659 | const unsigned char *end ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3660 | { |
Paul Bakker | 6db455e | 2013-09-18 17:29:31 +0200 | [diff] [blame] | 3661 | int ret = 0; |
irwir | 6527bd6 | 2019-09-21 18:51:25 +0300 | [diff] [blame] | 3662 | uint16_t n; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3663 | |
Hanno Becker | 845b946 | 2018-10-26 12:07:29 +0100 | [diff] [blame] | 3664 | if( ssl_conf_has_psk_or_cb( ssl->conf ) == 0 ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3665 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3666 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) ); |
| 3667 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3668 | } |
| 3669 | |
| 3670 | /* |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3671 | * Receive client pre-shared key identity name |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3672 | */ |
Hanno Becker | 83c9f49 | 2017-06-26 13:52:14 +0100 | [diff] [blame] | 3673 | if( end - *p < 2 ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3674 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3675 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3676 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3677 | } |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3678 | |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3679 | n = ( (*p)[0] << 8 ) | (*p)[1]; |
| 3680 | *p += 2; |
| 3681 | |
irwir | 6527bd6 | 2019-09-21 18:51:25 +0300 | [diff] [blame] | 3682 | if( n == 0 || n > end - *p ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3683 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3684 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3685 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3686 | } |
| 3687 | |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 3688 | if( ssl->conf->f_psk != NULL ) |
Paul Bakker | 6db455e | 2013-09-18 17:29:31 +0200 | [diff] [blame] | 3689 | { |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 3690 | if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 ) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3691 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
Paul Bakker | 6db455e | 2013-09-18 17:29:31 +0200 | [diff] [blame] | 3692 | } |
Manuel Pégourié-Gonnard | d27680b | 2014-07-08 14:15:55 +0200 | [diff] [blame] | 3693 | else |
Paul Bakker | 6db455e | 2013-09-18 17:29:31 +0200 | [diff] [blame] | 3694 | { |
Manuel Pégourié-Gonnard | 31ff1d2 | 2013-10-28 13:46:11 +0100 | [diff] [blame] | 3695 | /* Identity is not a big secret since clients send it in the clear, |
| 3696 | * but treat it carefully anyway, just in case */ |
Manuel Pégourié-Gonnard | 7ca4e4d | 2015-05-04 10:55:58 +0200 | [diff] [blame] | 3697 | if( n != ssl->conf->psk_identity_len || |
Gabor Mezei | 90437e3 | 2021-10-20 11:59:27 +0200 | [diff] [blame] | 3698 | mbedtls_ct_memcmp( ssl->conf->psk_identity, *p, n ) != 0 ) |
Paul Bakker | 6db455e | 2013-09-18 17:29:31 +0200 | [diff] [blame] | 3699 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3700 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
Paul Bakker | 6db455e | 2013-09-18 17:29:31 +0200 | [diff] [blame] | 3701 | } |
| 3702 | } |
| 3703 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3704 | if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3705 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3706 | MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n ); |
Gilles Peskine | c94f735 | 2017-05-10 16:37:56 +0200 | [diff] [blame] | 3707 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
| 3708 | MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ); |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3709 | return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3710 | } |
| 3711 | |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3712 | *p += n; |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3713 | |
Manuel Pégourié-Gonnard | d27680b | 2014-07-08 14:15:55 +0200 | [diff] [blame] | 3714 | return( 0 ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3715 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 3716 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3717 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 3718 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3719 | static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3720 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 3721 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3722 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
Manuel Pégourié-Gonnard | 2114d72 | 2014-09-10 13:59:41 +0000 | [diff] [blame] | 3723 | unsigned char *p, *end; |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3724 | |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 3725 | ciphersuite_info = ssl->handshake->ciphersuite_info; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3726 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3727 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3728 | |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3729 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \ |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3730 | ( defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
| 3731 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) ) |
| 3732 | if( ( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
| 3733 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) && |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3734 | ( ssl->handshake->async_in_progress != 0 ) ) |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3735 | { |
| 3736 | /* We've already read a record and there is an asynchronous |
| 3737 | * operation in progress to decrypt it. So skip reading the |
Gilles Peskine | 168dae8 | 2018-04-25 23:35:42 +0200 | [diff] [blame] | 3738 | * record. */ |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3739 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "will resume decryption of previously-read record" ) ); |
| 3740 | } |
| 3741 | else |
| 3742 | #endif |
Hanno Becker | 327c93b | 2018-08-15 13:56:18 +0100 | [diff] [blame] | 3743 | if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3744 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3745 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3746 | return( ret ); |
| 3747 | } |
| 3748 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3749 | p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); |
Manuel Pégourié-Gonnard | 2114d72 | 2014-09-10 13:59:41 +0000 | [diff] [blame] | 3750 | end = ssl->in_msg + ssl->in_hslen; |
Manuel Pégourié-Gonnard | f899583 | 2014-09-10 08:25:12 +0000 | [diff] [blame] | 3751 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3752 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3753 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3754 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3755 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3756 | } |
| 3757 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3758 | if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3759 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3760 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3761 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3762 | } |
| 3763 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3764 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) |
| 3765 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3766 | { |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3767 | if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3768 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3769 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3770 | return( ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3771 | } |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3772 | |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3773 | if( p != end ) |
| 3774 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3775 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3776 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3777 | } |
| 3778 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3779 | if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3780 | ssl->handshake->premaster, |
Manuel Pégourié-Gonnard | 3335205 | 2015-06-02 16:17:08 +0100 | [diff] [blame] | 3781 | MBEDTLS_PREMASTER_SIZE, |
Manuel Pégourié-Gonnard | 2d62764 | 2013-09-04 14:22:07 +0200 | [diff] [blame] | 3782 | &ssl->handshake->pmslen, |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 3783 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3784 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3785 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); |
Hanno Becker | d3eec78 | 2021-06-24 10:21:46 +0100 | [diff] [blame] | 3786 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3787 | } |
| 3788 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3789 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 3790 | } |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3791 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3792 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ |
Neil Armstrong | d91526c | 2022-04-12 14:38:52 +0200 | [diff] [blame] | 3793 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
| 3794 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
| 3795 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
| 3796 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3797 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
Neil Armstrong | 1f4b396 | 2022-03-09 14:54:29 +0100 | [diff] [blame] | 3798 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || |
| 3799 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || |
| 3800 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3801 | { |
Neil Armstrong | 913b364 | 2022-04-13 14:59:48 +0200 | [diff] [blame] | 3802 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3803 | size_t data_len = (size_t)( *p++ ); |
| 3804 | size_t buf_len = (size_t)( end - p ); |
| 3805 | psa_status_t status = PSA_ERROR_GENERIC_ERROR; |
| 3806 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 3807 | |
| 3808 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Read the peer's public key." ) ); |
| 3809 | |
| 3810 | /* |
Przemek Stekiel | 338b61d | 2022-03-15 08:03:43 +0100 | [diff] [blame] | 3811 | * We must have at least two bytes (1 for length, at least 1 for data) |
| 3812 | */ |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3813 | if( buf_len < 2 ) |
| 3814 | { |
| 3815 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid buffer length" ) ); |
| 3816 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 3817 | } |
| 3818 | |
| 3819 | if( data_len < 1 || data_len > buf_len ) |
| 3820 | { |
| 3821 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid data length" ) ); |
| 3822 | return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA ); |
| 3823 | } |
| 3824 | |
| 3825 | /* Store peer's ECDH public key. */ |
| 3826 | memcpy( handshake->ecdh_psa_peerkey, p, data_len ); |
| 3827 | handshake->ecdh_psa_peerkey_len = data_len; |
| 3828 | |
| 3829 | /* Compute ECDH shared secret. */ |
| 3830 | status = psa_raw_key_agreement( |
| 3831 | PSA_ALG_ECDH, handshake->ecdh_psa_privkey, |
| 3832 | handshake->ecdh_psa_peerkey, handshake->ecdh_psa_peerkey_len, |
| 3833 | handshake->premaster, sizeof( handshake->premaster ), |
| 3834 | &handshake->pmslen ); |
| 3835 | if( status != PSA_SUCCESS ) |
| 3836 | { |
| 3837 | ret = psa_ssl_status_to_mbedtls( status ); |
| 3838 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_raw_key_agreement", ret ); |
Neil Armstrong | f716a70 | 2022-04-04 11:23:46 +0200 | [diff] [blame] | 3839 | if( handshake->ecdh_psa_privkey_is_external == 0 ) |
Neil Armstrong | 8113d25 | 2022-03-23 10:57:04 +0100 | [diff] [blame] | 3840 | (void) psa_destroy_key( handshake->ecdh_psa_privkey ); |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3841 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 3842 | return( ret ); |
| 3843 | } |
| 3844 | |
Neil Armstrong | f716a70 | 2022-04-04 11:23:46 +0200 | [diff] [blame] | 3845 | if( handshake->ecdh_psa_privkey_is_external == 0 ) |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3846 | { |
Neil Armstrong | 8113d25 | 2022-03-23 10:57:04 +0100 | [diff] [blame] | 3847 | status = psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 3848 | |
| 3849 | if( status != PSA_SUCCESS ) |
| 3850 | { |
| 3851 | ret = psa_ssl_status_to_mbedtls( status ); |
| 3852 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_destroy_key", ret ); |
| 3853 | return( ret ); |
| 3854 | } |
Przemek Stekiel | ce1d792 | 2022-03-14 16:16:25 +0100 | [diff] [blame] | 3855 | } |
| 3856 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
Neil Armstrong | d91526c | 2022-04-12 14:38:52 +0200 | [diff] [blame] | 3857 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3858 | if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, |
Manuel Pégourié-Gonnard | 2114d72 | 2014-09-10 13:59:41 +0000 | [diff] [blame] | 3859 | p, end - p) ) != 0 ) |
Manuel Pégourié-Gonnard | b59d699 | 2013-10-14 12:00:45 +0200 | [diff] [blame] | 3860 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3861 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); |
Hanno Becker | b24e74b | 2021-06-24 09:52:01 +0100 | [diff] [blame] | 3862 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | b59d699 | 2013-10-14 12:00:45 +0200 | [diff] [blame] | 3863 | } |
| 3864 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3865 | MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, |
| 3866 | MBEDTLS_DEBUG_ECDH_QP ); |
Manuel Pégourié-Gonnard | b59d699 | 2013-10-14 12:00:45 +0200 | [diff] [blame] | 3867 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3868 | if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3869 | &ssl->handshake->pmslen, |
| 3870 | ssl->handshake->premaster, |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3871 | MBEDTLS_MPI_MAX_SIZE, |
Manuel Pégourié-Gonnard | 750e4d7 | 2015-05-07 12:35:38 +0100 | [diff] [blame] | 3872 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3873 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3874 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); |
Hanno Becker | d3eec78 | 2021-06-24 10:21:46 +0100 | [diff] [blame] | 3875 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3876 | } |
| 3877 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 3878 | MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, |
| 3879 | MBEDTLS_DEBUG_ECDH_Z ); |
Neil Armstrong | 913b364 | 2022-04-13 14:59:48 +0200 | [diff] [blame] | 3880 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3881 | } |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3882 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3883 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || |
| 3884 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || |
| 3885 | MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || |
| 3886 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
| 3887 | #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) |
| 3888 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3889 | { |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3890 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3891 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3892 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3893 | return( ret ); |
| 3894 | } |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3895 | |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3896 | if( p != end ) |
| 3897 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3898 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3899 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3900 | } |
| 3901 | |
Neil Armstrong | cd05f0b | 2022-05-03 10:28:37 +0200 | [diff] [blame] | 3902 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3903 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Manuel Pégourié-Gonnard | bd1ae24 | 2013-10-14 13:09:25 +0200 | [diff] [blame] | 3904 | ciphersuite_info->key_exchange ) ) != 0 ) |
| 3905 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3906 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Manuel Pégourié-Gonnard | bd1ae24 | 2013-10-14 13:09:25 +0200 | [diff] [blame] | 3907 | return( ret ); |
| 3908 | } |
Neil Armstrong | cd05f0b | 2022-05-03 10:28:37 +0200 | [diff] [blame] | 3909 | #endif /* !MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | fbb1780 | 2013-04-17 19:10:21 +0200 | [diff] [blame] | 3910 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 3911 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3912 | #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ |
| 3913 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
| 3914 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3915 | { |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3916 | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
Gilles Peskine | df13d5c | 2018-04-25 20:39:48 +0200 | [diff] [blame] | 3917 | if ( ssl->handshake->async_in_progress != 0 ) |
Gilles Peskine | 2c6078e | 2018-01-12 13:46:43 +0100 | [diff] [blame] | 3918 | { |
| 3919 | /* There is an asynchronous operation in progress to |
| 3920 | * decrypt the encrypted premaster secret, so skip |
| 3921 | * directly to resuming this operation. */ |
| 3922 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "PSK identity already parsed" ) ); |
| 3923 | /* Update p to skip the PSK identity. ssl_parse_encrypted_pms |
| 3924 | * won't actually use it, but maintain p anyway for robustness. */ |
| 3925 | p += ssl->conf->psk_identity_len + 2; |
| 3926 | } |
| 3927 | else |
Gilles Peskine | b74a1c7 | 2018-04-24 13:09:22 +0200 | [diff] [blame] | 3928 | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3929 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
| 3930 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3931 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3932 | return( ret ); |
| 3933 | } |
| 3934 | |
| 3935 | if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 ) |
| 3936 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3937 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret ); |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3938 | return( ret ); |
| 3939 | } |
| 3940 | |
Neil Armstrong | cd05f0b | 2022-05-03 10:28:37 +0200 | [diff] [blame] | 3941 | #if !defined(MBEDTLS_USE_PSA_CRYPTO) |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3942 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3943 | ciphersuite_info->key_exchange ) ) != 0 ) |
| 3944 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3945 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3946 | return( ret ); |
| 3947 | } |
Neil Armstrong | cd05f0b | 2022-05-03 10:28:37 +0200 | [diff] [blame] | 3948 | #endif /* !MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 0fae60b | 2013-10-14 17:39:48 +0200 | [diff] [blame] | 3949 | } |
| 3950 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3951 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
| 3952 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
| 3953 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3954 | { |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3955 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
| 3956 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3957 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3958 | return( ret ); |
| 3959 | } |
| 3960 | if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 ) |
| 3961 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3962 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3963 | return( ret ); |
| 3964 | } |
| 3965 | |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3966 | if( p != end ) |
| 3967 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3968 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
Hanno Becker | 666b5b4 | 2021-06-24 10:13:31 +0100 | [diff] [blame] | 3969 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 969ccc6 | 2014-03-26 19:53:25 +0100 | [diff] [blame] | 3970 | } |
| 3971 | |
Neil Armstrong | 80f6f32 | 2022-05-03 17:56:38 +0200 | [diff] [blame] | 3972 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
| 3973 | unsigned char *pms = ssl->handshake->premaster; |
| 3974 | unsigned char *pms_end = pms + sizeof( ssl->handshake->premaster ); |
| 3975 | size_t pms_len; |
| 3976 | |
| 3977 | /* Write length only when we know the actual value */ |
| 3978 | if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, |
| 3979 | pms + 2, pms_end - ( pms + 2 ), &pms_len, |
| 3980 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
| 3981 | { |
| 3982 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); |
| 3983 | return( ret ); |
| 3984 | } |
| 3985 | MBEDTLS_PUT_UINT16_BE( pms_len, pms, 0 ); |
| 3986 | pms += 2 + pms_len; |
| 3987 | |
| 3988 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); |
| 3989 | #else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3990 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Manuel Pégourié-Gonnard | bd1ae24 | 2013-10-14 13:09:25 +0200 | [diff] [blame] | 3991 | ciphersuite_info->key_exchange ) ) != 0 ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3992 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3993 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Manuel Pégourié-Gonnard | bd1ae24 | 2013-10-14 13:09:25 +0200 | [diff] [blame] | 3994 | return( ret ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3995 | } |
Neil Armstrong | 80f6f32 | 2022-05-03 17:56:38 +0200 | [diff] [blame] | 3996 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 3997 | } |
| 3998 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 3999 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
Neil Armstrong | d91526c | 2022-04-12 14:38:52 +0200 | [diff] [blame] | 4000 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4001 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
| 4002 | { |
Neil Armstrong | 913b364 | 2022-04-13 14:59:48 +0200 | [diff] [blame] | 4003 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4004 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4005 | psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED; |
| 4006 | uint8_t ecpoint_len; |
| 4007 | |
| 4008 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 4009 | |
| 4010 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
| 4011 | { |
| 4012 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
| 4013 | psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 4014 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 4015 | return( ret ); |
| 4016 | } |
| 4017 | |
| 4018 | /* Keep a copy of the peer's public key */ |
Neil Armstrong | 3cae167 | 2022-04-05 10:01:15 +0200 | [diff] [blame] | 4019 | if( p >= end ) |
| 4020 | { |
| 4021 | psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 4022 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 4023 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 4024 | } |
| 4025 | |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4026 | ecpoint_len = *(p++); |
Neil Armstrong | 3cae167 | 2022-04-05 10:01:15 +0200 | [diff] [blame] | 4027 | if( (size_t)( end - p ) < ecpoint_len ) { |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4028 | psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 4029 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 4030 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 4031 | } |
| 4032 | |
| 4033 | if( ecpoint_len > sizeof( handshake->ecdh_psa_peerkey ) ) { |
| 4034 | psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 4035 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 4036 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
| 4037 | } |
| 4038 | |
| 4039 | memcpy( handshake->ecdh_psa_peerkey, p, ecpoint_len ); |
| 4040 | handshake->ecdh_psa_peerkey_len = ecpoint_len; |
| 4041 | p += ecpoint_len; |
| 4042 | |
Neil Armstrong | 3bcef08 | 2022-03-23 18:16:54 +0100 | [diff] [blame] | 4043 | /* As RFC 5489 section 2, the premaster secret is formed as follows: |
Neil Armstrong | fdf20cb | 2022-03-24 09:43:02 +0100 | [diff] [blame] | 4044 | * - a uint16 containing the length (in octets) of the ECDH computation |
| 4045 | * - the octet string produced by the ECDH computation |
| 4046 | * - a uint16 containing the length (in octets) of the PSK |
| 4047 | * - the PSK itself |
| 4048 | */ |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4049 | unsigned char *psm = ssl->handshake->premaster; |
Neil Armstrong | d6e2759 | 2022-03-23 18:17:24 +0100 | [diff] [blame] | 4050 | const unsigned char* const psm_end = |
| 4051 | psm + sizeof( ssl->handshake->premaster ); |
Neil Armstrong | 2d63da9 | 2022-03-23 18:17:31 +0100 | [diff] [blame] | 4052 | /* uint16 to store length (in octets) of the ECDH computation */ |
| 4053 | const size_t zlen_size = 2; |
Neil Armstrong | 549a3e4 | 2022-03-23 18:16:24 +0100 | [diff] [blame] | 4054 | size_t zlen = 0; |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4055 | |
| 4056 | /* Compute ECDH shared secret. */ |
| 4057 | status = psa_raw_key_agreement( PSA_ALG_ECDH, |
| 4058 | handshake->ecdh_psa_privkey, |
| 4059 | handshake->ecdh_psa_peerkey, |
| 4060 | handshake->ecdh_psa_peerkey_len, |
Neil Armstrong | 2d63da9 | 2022-03-23 18:17:31 +0100 | [diff] [blame] | 4061 | psm + zlen_size, |
| 4062 | psm_end - ( psm + zlen_size ), |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4063 | &zlen ); |
| 4064 | |
| 4065 | destruction_status = psa_destroy_key( handshake->ecdh_psa_privkey ); |
| 4066 | handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; |
| 4067 | |
Neil Armstrong | fb0a81e | 2022-03-23 18:17:11 +0100 | [diff] [blame] | 4068 | if( status != PSA_SUCCESS ) |
| 4069 | return( psa_ssl_status_to_mbedtls( status ) ); |
| 4070 | else if( destruction_status != PSA_SUCCESS ) |
| 4071 | return( psa_ssl_status_to_mbedtls( destruction_status ) ); |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4072 | |
Neil Armstrong | 3bcef08 | 2022-03-23 18:16:54 +0100 | [diff] [blame] | 4073 | /* Write the ECDH computation length before the ECDH computation */ |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4074 | MBEDTLS_PUT_UINT16_BE( zlen, psm, 0 ); |
Neil Armstrong | 2d63da9 | 2022-03-23 18:17:31 +0100 | [diff] [blame] | 4075 | psm += zlen_size + zlen; |
Neil Armstrong | 039db29 | 2022-03-09 11:38:34 +0100 | [diff] [blame] | 4076 | |
Przemek Stekiel | 14d11b0 | 2022-04-14 08:33:29 +0200 | [diff] [blame] | 4077 | #else /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4078 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
| 4079 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4080 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4081 | return( ret ); |
| 4082 | } |
Manuel Pégourié-Gonnard | b59d699 | 2013-10-14 12:00:45 +0200 | [diff] [blame] | 4083 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4084 | if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, |
Manuel Pégourié-Gonnard | b59d699 | 2013-10-14 12:00:45 +0200 | [diff] [blame] | 4085 | p, end - p ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4086 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4087 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); |
Hanno Becker | b24e74b | 2021-06-24 09:52:01 +0100 | [diff] [blame] | 4088 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4089 | } |
| 4090 | |
Andrzej Kurek | c470b6b | 2019-01-31 08:20:20 -0500 | [diff] [blame] | 4091 | MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, |
| 4092 | MBEDTLS_DEBUG_ECDH_QP ); |
Manuel Pégourié-Gonnard | b59d699 | 2013-10-14 12:00:45 +0200 | [diff] [blame] | 4093 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4094 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Manuel Pégourié-Gonnard | bd1ae24 | 2013-10-14 13:09:25 +0200 | [diff] [blame] | 4095 | ciphersuite_info->key_exchange ) ) != 0 ) |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4096 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4097 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4098 | return( ret ); |
| 4099 | } |
Neil Armstrong | 913b364 | 2022-04-13 14:59:48 +0200 | [diff] [blame] | 4100 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 3ce3bbd | 2013-10-11 16:53:50 +0200 | [diff] [blame] | 4101 | } |
| 4102 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4103 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
| 4104 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) |
| 4105 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 4106 | { |
Manuel Pégourié-Gonnard | 2114d72 | 2014-09-10 13:59:41 +0000 | [diff] [blame] | 4107 | if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 ) |
Paul Bakker | 41c83d3 | 2013-03-20 14:39:14 +0100 | [diff] [blame] | 4108 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4109 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret ); |
Paul Bakker | 70df2fb | 2013-04-17 17:19:09 +0200 | [diff] [blame] | 4110 | return( ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4111 | } |
| 4112 | } |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4113 | else |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4114 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 4115 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
| 4116 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
| 4117 | { |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 4118 | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
Valerio Setti | 6b3dab0 | 2022-11-17 17:14:54 +0100 | [diff] [blame] | 4119 | if( ( ret = mbedtls_psa_ecjpake_read_round( |
| 4120 | &ssl->handshake->psa_pake_ctx, p, end - p, |
| 4121 | MBEDTLS_ECJPAKE_ROUND_TWO ) ) != 0 ) |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 4122 | { |
| 4123 | psa_destroy_key( ssl->handshake->psa_pake_password ); |
| 4124 | psa_pake_abort( &ssl->handshake->psa_pake_ctx ); |
| 4125 | |
| 4126 | MBEDTLS_SSL_DEBUG_RET( 1, "psa_pake_input round two", ret ); |
| 4127 | return( ret ); |
| 4128 | } |
| 4129 | #else |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 4130 | ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx, |
| 4131 | p, end - p ); |
| 4132 | if( ret != 0 ) |
| 4133 | { |
| 4134 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret ); |
Hanno Becker | cbc8f6f | 2021-06-24 10:32:31 +0100 | [diff] [blame] | 4135 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 4136 | } |
| 4137 | |
| 4138 | ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx, |
| 4139 | ssl->handshake->premaster, 32, &ssl->handshake->pmslen, |
| 4140 | ssl->conf->f_rng, ssl->conf->p_rng ); |
| 4141 | if( ret != 0 ) |
| 4142 | { |
| 4143 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret ); |
| 4144 | return( ret ); |
| 4145 | } |
Neil Armstrong | ca7d506 | 2022-05-31 14:43:23 +0200 | [diff] [blame] | 4146 | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
Manuel Pégourié-Gonnard | 0f1660a | 2015-09-16 22:41:06 +0200 | [diff] [blame] | 4147 | } |
| 4148 | else |
| 4149 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4150 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4151 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 4152 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4153 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4154 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4155 | if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) |
Paul Bakker | ff60ee6 | 2010-03-16 21:09:09 +0000 | [diff] [blame] | 4156 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4157 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); |
Paul Bakker | ff60ee6 | 2010-03-16 21:09:09 +0000 | [diff] [blame] | 4158 | return( ret ); |
| 4159 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4160 | |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4161 | ssl->state++; |
| 4162 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4163 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4164 | |
| 4165 | return( 0 ); |
| 4166 | } |
| 4167 | |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 4168 | #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 4169 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4170 | static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4171 | { |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 4172 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 4173 | ssl->handshake->ciphersuite_info; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4174 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4175 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4176 | |
Hanno Becker | 77adddc | 2019-02-07 12:32:43 +0000 | [diff] [blame] | 4177 | if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ) |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 4178 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4179 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 4180 | ssl->state++; |
| 4181 | return( 0 ); |
| 4182 | } |
| 4183 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4184 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
| 4185 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4186 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 4187 | #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 4188 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4189 | static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4190 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4191 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Manuel Pégourié-Gonnard | 4528f3f | 2014-09-10 14:17:23 +0000 | [diff] [blame] | 4192 | size_t i, sig_len; |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4193 | unsigned char hash[48]; |
Manuel Pégourié-Gonnard | 4bd1284 | 2013-08-27 13:31:28 +0200 | [diff] [blame] | 4194 | unsigned char *hash_start = hash; |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 4195 | size_t hashlen; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4196 | mbedtls_pk_type_t pk_alg; |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4197 | mbedtls_md_type_t md_alg; |
Hanno Becker | 0d0cd4b | 2017-05-11 14:06:43 +0100 | [diff] [blame] | 4198 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Hanno Becker | e694c3e | 2017-12-27 21:34:08 +0000 | [diff] [blame] | 4199 | ssl->handshake->ciphersuite_info; |
Hanno Becker | a1ab9be | 2019-02-06 18:31:04 +0000 | [diff] [blame] | 4200 | mbedtls_pk_context * peer_pk; |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4201 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4202 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4203 | |
Hanno Becker | 2a831a4 | 2019-02-07 13:17:25 +0000 | [diff] [blame] | 4204 | if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ) |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4205 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4206 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
Paul Bakker | 48f7a5d | 2013-04-19 14:30:58 +0200 | [diff] [blame] | 4207 | ssl->state++; |
| 4208 | return( 0 ); |
| 4209 | } |
| 4210 | |
Hanno Becker | 2a831a4 | 2019-02-07 13:17:25 +0000 | [diff] [blame] | 4211 | #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
| 4212 | if( ssl->session_negotiate->peer_cert == NULL ) |
| 4213 | { |
| 4214 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
| 4215 | ssl->state++; |
| 4216 | return( 0 ); |
| 4217 | } |
| 4218 | #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| 4219 | if( ssl->session_negotiate->peer_cert_digest == NULL ) |
| 4220 | { |
| 4221 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
| 4222 | ssl->state++; |
| 4223 | return( 0 ); |
| 4224 | } |
| 4225 | #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| 4226 | |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4227 | /* Read the message without adding it to the checksum */ |
Hanno Becker | 327c93b | 2018-08-15 13:56:18 +0100 | [diff] [blame] | 4228 | ret = mbedtls_ssl_read_record( ssl, 0 /* no checksum update */ ); |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4229 | if( 0 != ret ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4230 | { |
Hanno Becker | 327c93b | 2018-08-15 13:56:18 +0100 | [diff] [blame] | 4231 | MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4232 | return( ret ); |
| 4233 | } |
| 4234 | |
| 4235 | ssl->state++; |
| 4236 | |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4237 | /* Process the message contents */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4238 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || |
| 4239 | ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4240 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4241 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Hanno Becker | d934a2a | 2021-06-24 10:23:45 +0100 | [diff] [blame] | 4242 | return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4243 | } |
| 4244 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4245 | i = mbedtls_ssl_hs_hdr_len( ssl ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4246 | |
Hanno Becker | a1ab9be | 2019-02-06 18:31:04 +0000 | [diff] [blame] | 4247 | #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
| 4248 | peer_pk = &ssl->handshake->peer_pubkey; |
| 4249 | #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| 4250 | if( ssl->session_negotiate->peer_cert == NULL ) |
| 4251 | { |
| 4252 | /* Should never happen */ |
| 4253 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 4254 | } |
| 4255 | peer_pk = &ssl->session_negotiate->peer_cert->pk; |
| 4256 | #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
| 4257 | |
Manuel Pégourié-Gonnard | 4528f3f | 2014-09-10 14:17:23 +0000 | [diff] [blame] | 4258 | /* |
| 4259 | * struct { |
| 4260 | * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only |
| 4261 | * opaque signature<0..2^16-1>; |
| 4262 | * } DigitallySigned; |
| 4263 | */ |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4264 | if( i + 2 > ssl->in_hslen ) |
Manuel Pégourié-Gonnard | b3d9187 | 2013-08-14 15:56:19 +0200 | [diff] [blame] | 4265 | { |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4266 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
| 4267 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 4268 | } |
Manuel Pégourié-Gonnard | 5ee9654 | 2014-09-10 14:27:21 +0000 | [diff] [blame] | 4269 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4270 | /* |
| 4271 | * Hash |
| 4272 | */ |
| 4273 | md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] ); |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4274 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4275 | if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) ) |
| 4276 | { |
| 4277 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg" |
| 4278 | " for verify message" ) ); |
| 4279 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
| 4280 | } |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4281 | |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4282 | #if !defined(MBEDTLS_MD_SHA1) |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4283 | if( MBEDTLS_MD_SHA1 == md_alg ) |
| 4284 | hash_start += 16; |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4285 | #endif |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 4286 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4287 | /* Info from md_alg will be used instead */ |
| 4288 | hashlen = 0; |
Manuel Pégourié-Gonnard | 0b03200 | 2013-08-17 13:01:41 +0200 | [diff] [blame] | 4289 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4290 | i++; |
Manuel Pégourié-Gonnard | 4528f3f | 2014-09-10 14:17:23 +0000 | [diff] [blame] | 4291 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4292 | /* |
| 4293 | * Signature |
| 4294 | */ |
| 4295 | if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) ) |
| 4296 | == MBEDTLS_PK_NONE ) |
Paul Bakker | 577e006 | 2013-08-28 11:57:20 +0200 | [diff] [blame] | 4297 | { |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4298 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg" |
| 4299 | " for verify message" ) ); |
| 4300 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
Manuel Pégourié-Gonnard | b3d9187 | 2013-08-14 15:56:19 +0200 | [diff] [blame] | 4301 | } |
Manuel Pégourié-Gonnard | ff56da3 | 2013-07-11 10:46:21 +0200 | [diff] [blame] | 4302 | |
Ronald Cron | 8457c12 | 2022-03-07 11:32:54 +0100 | [diff] [blame] | 4303 | /* |
| 4304 | * Check the certificate's key type matches the signature alg |
| 4305 | */ |
| 4306 | if( !mbedtls_pk_can_do( peer_pk, pk_alg ) ) |
| 4307 | { |
| 4308 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) ); |
| 4309 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
| 4310 | } |
| 4311 | |
| 4312 | i++; |
| 4313 | |
Manuel Pégourié-Gonnard | 5ee9654 | 2014-09-10 14:27:21 +0000 | [diff] [blame] | 4314 | if( i + 2 > ssl->in_hslen ) |
| 4315 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4316 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Hanno Becker | d934a2a | 2021-06-24 10:23:45 +0100 | [diff] [blame] | 4317 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Manuel Pégourié-Gonnard | 5ee9654 | 2014-09-10 14:27:21 +0000 | [diff] [blame] | 4318 | } |
| 4319 | |
Manuel Pégourié-Gonnard | 4528f3f | 2014-09-10 14:17:23 +0000 | [diff] [blame] | 4320 | sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1]; |
| 4321 | i += 2; |
Paul Bakker | 926af75 | 2012-11-23 13:38:07 +0100 | [diff] [blame] | 4322 | |
Manuel Pégourié-Gonnard | 4528f3f | 2014-09-10 14:17:23 +0000 | [diff] [blame] | 4323 | if( i + sig_len != ssl->in_hslen ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4324 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4325 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Hanno Becker | d934a2a | 2021-06-24 10:23:45 +0100 | [diff] [blame] | 4326 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4327 | } |
| 4328 | |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4329 | /* Calculate hash and verify signature */ |
Manuel Pégourié-Gonnard | de718b9 | 2019-05-03 11:43:28 +0200 | [diff] [blame] | 4330 | { |
| 4331 | size_t dummy_hlen; |
| 4332 | ssl->handshake->calc_verify( ssl, hash, &dummy_hlen ); |
| 4333 | } |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4334 | |
Hanno Becker | a1ab9be | 2019-02-06 18:31:04 +0000 | [diff] [blame] | 4335 | if( ( ret = mbedtls_pk_verify( peer_pk, |
Manuel Pégourié-Gonnard | 4bd1284 | 2013-08-27 13:31:28 +0200 | [diff] [blame] | 4336 | md_alg, hash_start, hashlen, |
Manuel Pégourié-Gonnard | 4528f3f | 2014-09-10 14:17:23 +0000 | [diff] [blame] | 4337 | ssl->in_msg + i, sig_len ) ) != 0 ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4338 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4339 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4340 | return( ret ); |
| 4341 | } |
| 4342 | |
Simon Butcher | 9900014 | 2016-10-13 17:21:01 +0100 | [diff] [blame] | 4343 | mbedtls_ssl_update_handshake_status( ssl ); |
| 4344 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4345 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4346 | |
Paul Bakker | ed27a04 | 2013-04-18 22:46:23 +0200 | [diff] [blame] | 4347 | return( ret ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4348 | } |
Gilles Peskine | eccd888 | 2020-03-10 12:19:08 +0100 | [diff] [blame] | 4349 | #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4350 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4351 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 4352 | MBEDTLS_CHECK_RETURN_CRITICAL |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4353 | static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl ) |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4354 | { |
Janos Follath | 865b3eb | 2019-12-16 11:46:15 +0000 | [diff] [blame] | 4355 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 4356 | size_t tlen; |
Manuel Pégourié-Gonnard | b0394be | 2015-05-19 11:40:30 +0200 | [diff] [blame] | 4357 | uint32_t lifetime; |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4358 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4359 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) ); |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4360 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4361 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
| 4362 | ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET; |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4363 | |
| 4364 | /* |
| 4365 | * struct { |
| 4366 | * uint32 ticket_lifetime_hint; |
| 4367 | * opaque ticket<0..2^16-1>; |
| 4368 | * } NewSessionTicket; |
| 4369 | * |
| 4370 | * 4 . 7 ticket_lifetime_hint (0 = unspecified) |
| 4371 | * 8 . 9 ticket_len (n) |
| 4372 | * 10 . 9+n ticket content |
| 4373 | */ |
Manuel Pégourié-Gonnard | 164d894 | 2013-09-23 22:01:39 +0200 | [diff] [blame] | 4374 | |
Manuel Pégourié-Gonnard | d59675d | 2015-05-19 15:28:00 +0200 | [diff] [blame] | 4375 | if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket, |
Manuel Pégourié-Gonnard | 69f1728 | 2015-05-18 14:35:08 +0200 | [diff] [blame] | 4376 | ssl->session_negotiate, |
| 4377 | ssl->out_msg + 10, |
Angus Gratton | d8213d0 | 2016-05-25 20:56:48 +1000 | [diff] [blame] | 4378 | ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN, |
Manuel Pégourié-Gonnard | b0394be | 2015-05-19 11:40:30 +0200 | [diff] [blame] | 4379 | &tlen, &lifetime ) ) != 0 ) |
Manuel Pégourié-Gonnard | 990c51a | 2013-08-03 15:37:58 +0200 | [diff] [blame] | 4380 | { |
Manuel Pégourié-Gonnard | a4a4735 | 2015-05-15 15:14:54 +0200 | [diff] [blame] | 4381 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret ); |
Manuel Pégourié-Gonnard | 990c51a | 2013-08-03 15:37:58 +0200 | [diff] [blame] | 4382 | tlen = 0; |
| 4383 | } |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4384 | |
Joe Subbiani | 6dd7364 | 2021-07-19 11:56:54 +0100 | [diff] [blame] | 4385 | MBEDTLS_PUT_UINT32_BE( lifetime, ssl->out_msg, 4 ); |
| 4386 | MBEDTLS_PUT_UINT16_BE( tlen, ssl->out_msg, 8 ); |
Manuel Pégourié-Gonnard | 609bc81 | 2013-08-01 15:08:40 +0200 | [diff] [blame] | 4387 | ssl->out_msglen = 10 + tlen; |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4388 | |
Manuel Pégourié-Gonnard | 145dfcb | 2014-02-26 14:23:33 +0100 | [diff] [blame] | 4389 | /* |
| 4390 | * Morally equivalent to updating ssl->state, but NewSessionTicket and |
| 4391 | * ChangeCipherSpec share the same state. |
| 4392 | */ |
| 4393 | ssl->handshake->new_session_ticket = 0; |
| 4394 | |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 4395 | if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 ) |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4396 | { |
Manuel Pégourié-Gonnard | 31c1586 | 2017-09-13 09:38:11 +0200 | [diff] [blame] | 4397 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret ); |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4398 | return( ret ); |
| 4399 | } |
| 4400 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4401 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) ); |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4402 | |
| 4403 | return( 0 ); |
| 4404 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4405 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4406 | |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4407 | /* |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4408 | * SSL handshake -- server side -- single step |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4409 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4410 | int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4411 | { |
| 4412 | int ret = 0; |
| 4413 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4414 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4415 | |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4416 | switch( ssl->state ) |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4417 | { |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4418 | case MBEDTLS_SSL_HELLO_REQUEST: |
| 4419 | ssl->state = MBEDTLS_SSL_CLIENT_HELLO; |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4420 | break; |
| 4421 | |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4422 | /* |
| 4423 | * <== ClientHello |
| 4424 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4425 | case MBEDTLS_SSL_CLIENT_HELLO: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4426 | ret = ssl_parse_client_hello( ssl ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4427 | break; |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4428 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4429 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
| 4430 | case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: |
| 4431 | return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ); |
Manuel Pégourié-Gonnard | 579950c | 2014-09-29 17:47:33 +0200 | [diff] [blame] | 4432 | #endif |
| 4433 | |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4434 | /* |
| 4435 | * ==> ServerHello |
| 4436 | * Certificate |
| 4437 | * ( ServerKeyExchange ) |
| 4438 | * ( CertificateRequest ) |
| 4439 | * ServerHelloDone |
| 4440 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4441 | case MBEDTLS_SSL_SERVER_HELLO: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4442 | ret = ssl_write_server_hello( ssl ); |
| 4443 | break; |
| 4444 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4445 | case MBEDTLS_SSL_SERVER_CERTIFICATE: |
| 4446 | ret = mbedtls_ssl_write_certificate( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4447 | break; |
| 4448 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4449 | case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4450 | ret = ssl_write_server_key_exchange( ssl ); |
| 4451 | break; |
| 4452 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4453 | case MBEDTLS_SSL_CERTIFICATE_REQUEST: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4454 | ret = ssl_write_certificate_request( ssl ); |
| 4455 | break; |
| 4456 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4457 | case MBEDTLS_SSL_SERVER_HELLO_DONE: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4458 | ret = ssl_write_server_hello_done( ssl ); |
| 4459 | break; |
| 4460 | |
| 4461 | /* |
| 4462 | * <== ( Certificate/Alert ) |
| 4463 | * ClientKeyExchange |
| 4464 | * ( CertificateVerify ) |
| 4465 | * ChangeCipherSpec |
| 4466 | * Finished |
| 4467 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4468 | case MBEDTLS_SSL_CLIENT_CERTIFICATE: |
| 4469 | ret = mbedtls_ssl_parse_certificate( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4470 | break; |
| 4471 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4472 | case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4473 | ret = ssl_parse_client_key_exchange( ssl ); |
| 4474 | break; |
| 4475 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4476 | case MBEDTLS_SSL_CERTIFICATE_VERIFY: |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4477 | ret = ssl_parse_certificate_verify( ssl ); |
| 4478 | break; |
| 4479 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4480 | case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: |
| 4481 | ret = mbedtls_ssl_parse_change_cipher_spec( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4482 | break; |
| 4483 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4484 | case MBEDTLS_SSL_CLIENT_FINISHED: |
| 4485 | ret = mbedtls_ssl_parse_finished( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4486 | break; |
| 4487 | |
| 4488 | /* |
Manuel Pégourié-Gonnard | 7a358b8 | 2013-08-01 11:47:56 +0200 | [diff] [blame] | 4489 | * ==> ( NewSessionTicket ) |
| 4490 | * ChangeCipherSpec |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4491 | * Finished |
| 4492 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4493 | case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: |
| 4494 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Manuel Pégourié-Gonnard | 7cd5924 | 2013-08-02 13:24:41 +0200 | [diff] [blame] | 4495 | if( ssl->handshake->new_session_ticket != 0 ) |
| 4496 | ret = ssl_write_new_session_ticket( ssl ); |
| 4497 | else |
Paul Bakker | a503a63 | 2013-08-14 13:48:06 +0200 | [diff] [blame] | 4498 | #endif |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4499 | ret = mbedtls_ssl_write_change_cipher_spec( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4500 | break; |
| 4501 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4502 | case MBEDTLS_SSL_SERVER_FINISHED: |
| 4503 | ret = mbedtls_ssl_write_finished( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4504 | break; |
| 4505 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4506 | case MBEDTLS_SSL_FLUSH_BUFFERS: |
| 4507 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) ); |
| 4508 | ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4509 | break; |
| 4510 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4511 | case MBEDTLS_SSL_HANDSHAKE_WRAPUP: |
| 4512 | mbedtls_ssl_handshake_wrapup( ssl ); |
Paul Bakker | 1961b70 | 2013-01-25 14:49:24 +0100 | [diff] [blame] | 4513 | break; |
| 4514 | |
| 4515 | default: |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 4516 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) ); |
| 4517 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4518 | } |
| 4519 | |
Paul Bakker | 5121ce5 | 2009-01-03 21:22:43 +0000 | [diff] [blame] | 4520 | return( ret ); |
| 4521 | } |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 4522 | |
TRodziewicz | 3946f79 | 2021-06-14 12:11:18 +0200 | [diff] [blame] | 4523 | void mbedtls_ssl_conf_preference_order( mbedtls_ssl_config *conf, int order ) |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 4524 | { |
TRodziewicz | 3946f79 | 2021-06-14 12:11:18 +0200 | [diff] [blame] | 4525 | conf->respect_cli_pref = order; |
TRodziewicz | 8476f2f | 2021-06-02 14:34:47 +0200 | [diff] [blame] | 4526 | } |
| 4527 | |
Jerry Yu | fb4b647 | 2022-01-27 15:03:26 +0800 | [diff] [blame] | 4528 | #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_2 */ |