Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 1 | /* |
| 2 | * TLS 1.3 functionality shared between client and server |
| 3 | * |
| 4 | * Copyright The Mbed TLS Contributors |
| 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
| 18 | */ |
| 19 | |
| 20 | #include "common.h" |
| 21 | |
Jerry Yu | fb4b647 | 2022-01-27 15:03:26 +0800 | [diff] [blame] | 22 | #if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 23 | |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 24 | #include <string.h> |
| 25 | |
Jerry Yu | c8a392c | 2021-08-18 16:46:28 +0800 | [diff] [blame] | 26 | #include "mbedtls/error.h" |
Jerry Yu | 7533635 | 2021-09-01 15:59:36 +0800 | [diff] [blame] | 27 | #include "mbedtls/debug.h" |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 28 | #include "mbedtls/oid.h" |
| 29 | #include "mbedtls/platform.h" |
Gabor Mezei | 685472b | 2021-11-24 11:17:36 +0100 | [diff] [blame] | 30 | #include "mbedtls/constant_time.h" |
Jerry Yu | 141bbe7 | 2022-12-01 20:30:41 +0800 | [diff] [blame] | 31 | #include "psa/crypto.h" |
Manuel Pégourié-Gonnard | 02b10d8 | 2023-03-28 12:33:20 +0200 | [diff] [blame] | 32 | #include "md_psa.h" |
Jerry Yu | c8a392c | 2021-08-18 16:46:28 +0800 | [diff] [blame] | 33 | |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 34 | #include "ssl_misc.h" |
Ronald Cron | e3dac4a | 2022-06-10 17:21:51 +0200 | [diff] [blame] | 35 | #include "ssl_tls13_invasive.h" |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 36 | #include "ssl_tls13_keys.h" |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 37 | #include "ssl_debug_helpers.h" |
Jerry Yu | 65dd2cc | 2021-08-18 16:38:40 +0800 | [diff] [blame] | 38 | |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 39 | #include "psa/crypto.h" |
| 40 | #include "mbedtls/psa_util.h" |
| 41 | |
Andrzej Kurek | a6033ac | 2023-05-30 15:16:34 -0400 | [diff] [blame] | 42 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) || \ |
Valerio Setti | dbd01cb | 2023-07-04 09:11:39 +0200 | [diff] [blame] | 43 | defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH) |
Andrzej Kurek | 0064484 | 2023-05-30 05:45:00 -0400 | [diff] [blame] | 44 | /* Define a local translating function to save code size by not using too many |
| 45 | * arguments in each translating place. */ |
| 46 | static int local_err_translation(psa_status_t status) |
| 47 | { |
| 48 | return psa_status_to_mbedtls(status, psa_to_ssl_errors, |
Andrzej Kurek | 1e4a030 | 2023-05-30 09:45:17 -0400 | [diff] [blame] | 49 | ARRAY_LENGTH(psa_to_ssl_errors), |
Andrzej Kurek | 0064484 | 2023-05-30 05:45:00 -0400 | [diff] [blame] | 50 | psa_generic_status_to_mbedtls); |
| 51 | } |
| 52 | #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status) |
Andrzej Kurek | a6033ac | 2023-05-30 15:16:34 -0400 | [diff] [blame] | 53 | #endif |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 54 | |
Jerry Yu | fbe3e64 | 2022-04-25 19:31:51 +0800 | [diff] [blame] | 55 | const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 56 | MBEDTLS_SERVER_HELLO_RANDOM_LEN] = |
| 57 | { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11, |
| 58 | 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91, |
| 59 | 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E, |
| 60 | 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C }; |
Jerry Yu | 93a13f2 | 2022-04-11 23:00:01 +0800 | [diff] [blame] | 61 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 62 | int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl, |
| 63 | unsigned hs_type, |
| 64 | unsigned char **buf, |
| 65 | size_t *buf_len) |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 66 | { |
| 67 | int ret; |
| 68 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 69 | if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) { |
| 70 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret); |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 71 | goto cleanup; |
| 72 | } |
| 73 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 74 | if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || |
| 75 | ssl->in_msg[0] != hs_type) { |
| 76 | MBEDTLS_SSL_DEBUG_MSG(1, ("Receive unexpected handshake message.")); |
| 77 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE, |
| 78 | MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE); |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 79 | ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; |
| 80 | goto cleanup; |
| 81 | } |
| 82 | |
XiaokangQian | 05420b1 | 2021-09-29 08:46:37 +0000 | [diff] [blame] | 83 | /* |
| 84 | * Jump handshake header (4 bytes, see Section 4 of RFC 8446). |
| 85 | * ... |
| 86 | * HandshakeType msg_type; |
| 87 | * uint24 length; |
| 88 | * ... |
| 89 | */ |
Xiaofei Bai | eef1504 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 90 | *buf = ssl->in_msg + 4; |
| 91 | *buf_len = ssl->in_hslen - 4; |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 92 | |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 93 | cleanup: |
| 94 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 95 | return ret; |
XiaokangQian | 6b226b0 | 2021-09-24 07:51:16 +0000 | [diff] [blame] | 96 | } |
| 97 | |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 98 | int mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts( |
| 99 | mbedtls_ssl_context *ssl, |
| 100 | const unsigned char *buf, const unsigned char *end, |
Ronald Cron | eff5673 | 2023-04-03 17:36:31 +0200 | [diff] [blame] | 101 | const unsigned char **supported_versions_data, |
| 102 | const unsigned char **supported_versions_data_end) |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 103 | { |
| 104 | const unsigned char *p = buf; |
| 105 | size_t extensions_len; |
| 106 | const unsigned char *extensions_end; |
| 107 | |
Ronald Cron | eff5673 | 2023-04-03 17:36:31 +0200 | [diff] [blame] | 108 | *supported_versions_data = NULL; |
| 109 | *supported_versions_data_end = NULL; |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 110 | |
| 111 | /* Case of no extension */ |
| 112 | if (p == end) { |
| 113 | return 0; |
| 114 | } |
| 115 | |
| 116 | /* ... |
| 117 | * Extension extensions<x..2^16-1>; |
| 118 | * ... |
| 119 | * struct { |
| 120 | * ExtensionType extension_type; (2 bytes) |
| 121 | * opaque extension_data<0..2^16-1>; |
| 122 | * } Extension; |
| 123 | */ |
| 124 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); |
| 125 | extensions_len = MBEDTLS_GET_UINT16_BE(p, 0); |
| 126 | p += 2; |
| 127 | |
| 128 | /* Check extensions do not go beyond the buffer of data. */ |
| 129 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len); |
| 130 | extensions_end = p + extensions_len; |
| 131 | |
| 132 | while (p < extensions_end) { |
| 133 | unsigned int extension_type; |
| 134 | size_t extension_data_len; |
| 135 | |
| 136 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4); |
| 137 | extension_type = MBEDTLS_GET_UINT16_BE(p, 0); |
| 138 | extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2); |
| 139 | p += 4; |
| 140 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len); |
| 141 | |
| 142 | if (extension_type == MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS) { |
Ronald Cron | eff5673 | 2023-04-03 17:36:31 +0200 | [diff] [blame] | 143 | *supported_versions_data = p; |
| 144 | *supported_versions_data_end = p + extension_data_len; |
Ronald Cron | 47dce63 | 2023-02-08 17:38:29 +0100 | [diff] [blame] | 145 | return 1; |
| 146 | } |
| 147 | p += extension_data_len; |
| 148 | } |
| 149 | |
| 150 | return 0; |
| 151 | } |
| 152 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 153 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 154 | /* |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 155 | * STATE HANDLING: Read CertificateVerify |
| 156 | */ |
Jerry Yu | d0fc585 | 2021-10-29 11:09:06 +0800 | [diff] [blame] | 157 | /* Macro to express the maximum length of the verify structure. |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 158 | * |
| 159 | * The structure is computed per TLS 1.3 specification as: |
| 160 | * - 64 bytes of octet 32, |
| 161 | * - 33 bytes for the context string |
| 162 | * (which is either "TLS 1.3, client CertificateVerify" |
| 163 | * or "TLS 1.3, server CertificateVerify"), |
Jerry Yu | d0fc585 | 2021-10-29 11:09:06 +0800 | [diff] [blame] | 164 | * - 1 byte for the octet 0x0, which serves as a separator, |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 165 | * - 32 or 48 bytes for the Transcript-Hash(Handshake Context, Certificate) |
| 166 | * (depending on the size of the transcript_hash) |
| 167 | * |
| 168 | * This results in a total size of |
| 169 | * - 130 bytes for a SHA256-based transcript hash, or |
| 170 | * (64 + 33 + 1 + 32 bytes) |
| 171 | * - 146 bytes for a SHA384-based transcript hash. |
| 172 | * (64 + 33 + 1 + 48 bytes) |
| 173 | * |
| 174 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 175 | #define SSL_VERIFY_STRUCT_MAX_SIZE (64 + \ |
| 176 | 33 + \ |
| 177 | 1 + \ |
| 178 | MBEDTLS_TLS1_3_MD_MAX_SIZE \ |
| 179 | ) |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 180 | |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 181 | /* |
| 182 | * The ssl_tls13_create_verify_structure() creates the verify structure. |
| 183 | * As input, it requires the transcript hash. |
| 184 | * |
| 185 | * The caller has to ensure that the buffer has size at least |
| 186 | * SSL_VERIFY_STRUCT_MAX_SIZE bytes. |
| 187 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 188 | static void ssl_tls13_create_verify_structure(const unsigned char *transcript_hash, |
| 189 | size_t transcript_hash_len, |
| 190 | unsigned char *verify_buffer, |
| 191 | size_t *verify_buffer_len, |
| 192 | int from) |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 193 | { |
| 194 | size_t idx; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 195 | |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 196 | /* RFC 8446, Section 4.4.3: |
| 197 | * |
| 198 | * The digital signature [in the CertificateVerify message] is then |
| 199 | * computed over the concatenation of: |
| 200 | * - A string that consists of octet 32 (0x20) repeated 64 times |
| 201 | * - The context string |
| 202 | * - A single 0 byte which serves as the separator |
| 203 | * - The content to be signed |
| 204 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 205 | memset(verify_buffer, 0x20, 64); |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 206 | idx = 64; |
| 207 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 208 | if (from == MBEDTLS_SSL_IS_CLIENT) { |
| 209 | memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(client_cv)); |
| 210 | idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(client_cv); |
| 211 | } else { /* from == MBEDTLS_SSL_IS_SERVER */ |
| 212 | memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(server_cv)); |
| 213 | idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(server_cv); |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 214 | } |
| 215 | |
| 216 | verify_buffer[idx++] = 0x0; |
| 217 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 218 | memcpy(verify_buffer + idx, transcript_hash, transcript_hash_len); |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 219 | idx += transcript_hash_len; |
| 220 | |
| 221 | *verify_buffer_len = idx; |
| 222 | } |
| 223 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 224 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 225 | static int ssl_tls13_parse_certificate_verify(mbedtls_ssl_context *ssl, |
| 226 | const unsigned char *buf, |
| 227 | const unsigned char *end, |
| 228 | const unsigned char *verify_buffer, |
| 229 | size_t verify_buffer_len) |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 230 | { |
| 231 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
pespacek | a137810 | 2022-04-26 15:03:11 +0200 | [diff] [blame] | 232 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 233 | const unsigned char *p = buf; |
| 234 | uint16_t algorithm; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 235 | size_t signature_len; |
| 236 | mbedtls_pk_type_t sig_alg; |
| 237 | mbedtls_md_type_t md_alg; |
pespacek | a137810 | 2022-04-26 15:03:11 +0200 | [diff] [blame] | 238 | psa_algorithm_t hash_alg = PSA_ALG_NONE; |
| 239 | unsigned char verify_hash[PSA_HASH_MAX_SIZE]; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 240 | size_t verify_hash_len; |
| 241 | |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 242 | void const *options = NULL; |
XiaokangQian | 82d34cc | 2021-11-03 08:51:56 +0000 | [diff] [blame] | 243 | #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 244 | mbedtls_pk_rsassa_pss_options rsassa_pss_options; |
XiaokangQian | 82d34cc | 2021-11-03 08:51:56 +0000 | [diff] [blame] | 245 | #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ |
| 246 | |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 247 | /* |
| 248 | * struct { |
| 249 | * SignatureScheme algorithm; |
| 250 | * opaque signature<0..2^16-1>; |
| 251 | * } CertificateVerify; |
| 252 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 253 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); |
| 254 | algorithm = MBEDTLS_GET_UINT16_BE(p, 0); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 255 | p += 2; |
| 256 | |
| 257 | /* RFC 8446 section 4.4.3 |
| 258 | * |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 259 | * If the CertificateVerify message is sent by a server, the signature |
| 260 | * algorithm MUST be one offered in the client's "signature_algorithms" |
| 261 | * extension unless no valid certificate chain can be produced without |
| 262 | * unsupported algorithms |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 263 | * |
| 264 | * RFC 8446 section 4.4.2.2 |
| 265 | * |
| 266 | * If the client cannot construct an acceptable chain using the provided |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 267 | * certificates and decides to abort the handshake, then it MUST abort the |
| 268 | * handshake with an appropriate certificate-related alert |
| 269 | * (by default, "unsupported_certificate"). |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 270 | * |
Jerry Yu | 6f87f25 | 2021-10-29 20:12:51 +0800 | [diff] [blame] | 271 | * Check if algorithm is an offered signature algorithm. |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 272 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 273 | if (!mbedtls_ssl_sig_alg_is_offered(ssl, algorithm)) { |
Jerry Yu | 982d9e5 | 2021-10-14 15:59:37 +0800 | [diff] [blame] | 274 | /* algorithm not in offered signature algorithms list */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 275 | MBEDTLS_SSL_DEBUG_MSG(1, ("Received signature algorithm(%04x) is not " |
| 276 | "offered.", |
| 277 | (unsigned int) algorithm)); |
Jerry Yu | 6f87f25 | 2021-10-29 20:12:51 +0800 | [diff] [blame] | 278 | goto error; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 279 | } |
| 280 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 281 | if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( |
| 282 | algorithm, &sig_alg, &md_alg) != 0) { |
Jerry Yu | 8c33886 | 2022-03-23 13:34:04 +0800 | [diff] [blame] | 283 | goto error; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 284 | } |
| 285 | |
Manuel Pégourié-Gonnard | 2d6d993 | 2023-03-28 11:38:08 +0200 | [diff] [blame] | 286 | hash_alg = mbedtls_md_psa_alg_from_type(md_alg); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 287 | if (hash_alg == 0) { |
pespacek | a137810 | 2022-04-26 15:03:11 +0200 | [diff] [blame] | 288 | goto error; |
| 289 | } |
| 290 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 291 | MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate Verify: Signature algorithm ( %04x )", |
| 292 | (unsigned int) algorithm)); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 293 | |
| 294 | /* |
| 295 | * Check the certificate's key type matches the signature alg |
| 296 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 297 | if (!mbedtls_pk_can_do(&ssl->session_negotiate->peer_cert->pk, sig_alg)) { |
| 298 | MBEDTLS_SSL_DEBUG_MSG(1, ("signature algorithm doesn't match cert key")); |
Jerry Yu | 6f87f25 | 2021-10-29 20:12:51 +0800 | [diff] [blame] | 299 | goto error; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 300 | } |
| 301 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 302 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); |
| 303 | signature_len = MBEDTLS_GET_UINT16_BE(p, 0); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 304 | p += 2; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 305 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, signature_len); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 306 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 307 | status = psa_hash_compute(hash_alg, |
| 308 | verify_buffer, |
| 309 | verify_buffer_len, |
| 310 | verify_hash, |
| 311 | sizeof(verify_hash), |
| 312 | &verify_hash_len); |
| 313 | if (status != PSA_SUCCESS) { |
| 314 | MBEDTLS_SSL_DEBUG_RET(1, "hash computation PSA error", status); |
Jerry Yu | 6f87f25 | 2021-10-29 20:12:51 +0800 | [diff] [blame] | 315 | goto error; |
Jerry Yu | 133690c | 2021-10-25 14:01:13 +0800 | [diff] [blame] | 316 | } |
| 317 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 318 | MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); |
XiaokangQian | 82d34cc | 2021-11-03 08:51:56 +0000 | [diff] [blame] | 319 | #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 320 | if (sig_alg == MBEDTLS_PK_RSASSA_PSS) { |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 321 | rsassa_pss_options.mgf1_hash_id = md_alg; |
Przemek Stekiel | 6a5e018 | 2022-06-27 11:53:13 +0200 | [diff] [blame] | 322 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 323 | rsassa_pss_options.expected_salt_len = PSA_HASH_LENGTH(hash_alg); |
| 324 | options = (const void *) &rsassa_pss_options; |
XiaokangQian | 82d34cc | 2021-11-03 08:51:56 +0000 | [diff] [blame] | 325 | } |
| 326 | #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 327 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 328 | if ((ret = mbedtls_pk_verify_ext(sig_alg, options, |
| 329 | &ssl->session_negotiate->peer_cert->pk, |
| 330 | md_alg, verify_hash, verify_hash_len, |
| 331 | p, signature_len)) == 0) { |
| 332 | return 0; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 333 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 334 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify_ext", ret); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 335 | |
Jerry Yu | 6f87f25 | 2021-10-29 20:12:51 +0800 | [diff] [blame] | 336 | error: |
| 337 | /* RFC 8446 section 4.4.3 |
| 338 | * |
| 339 | * If the verification fails, the receiver MUST terminate the handshake |
| 340 | * with a "decrypt_error" alert. |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 341 | */ |
| 342 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR, |
| 343 | MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE); |
| 344 | return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; |
Jerry Yu | 6f87f25 | 2021-10-29 20:12:51 +0800 | [diff] [blame] | 345 | |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 346 | } |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 347 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 348 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 349 | int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl) |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 350 | { |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 351 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 352 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 353 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 354 | unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE]; |
| 355 | size_t verify_buffer_len; |
| 356 | unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
| 357 | size_t transcript_len; |
| 358 | unsigned char *buf; |
| 359 | size_t buf_len; |
| 360 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 361 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 362 | |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 363 | MBEDTLS_SSL_PROC_CHK( |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 364 | mbedtls_ssl_tls13_fetch_handshake_msg( |
| 365 | ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, &buf_len)); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 366 | |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 367 | /* Need to calculate the hash of the transcript first |
Jerry Yu | 0b32c50 | 2021-10-28 13:41:59 +0800 | [diff] [blame] | 368 | * before reading the message since otherwise it gets |
| 369 | * included in the transcript |
| 370 | */ |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 371 | ret = mbedtls_ssl_get_handshake_transcript( |
| 372 | ssl, |
| 373 | ssl->handshake->ciphersuite_info->mac, |
| 374 | transcript, sizeof(transcript), |
| 375 | &transcript_len); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 376 | if (ret != 0) { |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 377 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 378 | MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 379 | MBEDTLS_ERR_SSL_INTERNAL_ERROR); |
| 380 | return ret; |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 381 | } |
| 382 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 383 | MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash", transcript, transcript_len); |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 384 | |
| 385 | /* Create verify structure */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 386 | ssl_tls13_create_verify_structure(transcript, |
| 387 | transcript_len, |
| 388 | verify_buffer, |
| 389 | &verify_buffer_len, |
| 390 | (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) ? |
| 391 | MBEDTLS_SSL_IS_SERVER : |
| 392 | MBEDTLS_SSL_IS_CLIENT); |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 393 | |
| 394 | /* Process the message contents */ |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 395 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_verify( |
| 396 | ssl, buf, buf + buf_len, |
| 397 | verify_buffer, verify_buffer_len)); |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 398 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 399 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum( |
| 400 | ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, |
| 401 | buf, buf_len)); |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 402 | |
| 403 | cleanup: |
| 404 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 405 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify")); |
| 406 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_process_certificate_verify", ret); |
| 407 | return ret; |
Jerry Yu | da8cdf2 | 2021-10-25 15:06:49 +0800 | [diff] [blame] | 408 | #else |
| 409 | ((void) ssl); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 410 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
| 411 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 412 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Jerry Yu | 30b071c | 2021-09-12 20:16:03 +0800 | [diff] [blame] | 413 | } |
| 414 | |
| 415 | /* |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 416 | * |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 417 | * STATE HANDLING: Incoming Certificate. |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 418 | * |
| 419 | */ |
| 420 | |
Ronald Cron | de08cf3 | 2022-10-04 17:15:35 +0200 | [diff] [blame] | 421 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 422 | #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
| 423 | /* |
| 424 | * Structure of Certificate message: |
| 425 | * |
| 426 | * enum { |
| 427 | * X509(0), |
| 428 | * RawPublicKey(2), |
| 429 | * (255) |
| 430 | * } CertificateType; |
| 431 | * |
| 432 | * struct { |
| 433 | * select (certificate_type) { |
| 434 | * case RawPublicKey: |
| 435 | * * From RFC 7250 ASN.1_subjectPublicKeyInfo * |
| 436 | * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; |
| 437 | * case X509: |
| 438 | * opaque cert_data<1..2^24-1>; |
| 439 | * }; |
| 440 | * Extension extensions<0..2^16-1>; |
| 441 | * } CertificateEntry; |
| 442 | * |
| 443 | * struct { |
| 444 | * opaque certificate_request_context<0..2^8-1>; |
| 445 | * CertificateEntry certificate_list<0..2^24-1>; |
| 446 | * } Certificate; |
| 447 | * |
| 448 | */ |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 449 | |
| 450 | /* Parse certificate chain send by the server. */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 451 | MBEDTLS_CHECK_RETURN_CRITICAL |
Ronald Cron | e3dac4a | 2022-06-10 17:21:51 +0200 | [diff] [blame] | 452 | MBEDTLS_STATIC_TESTABLE |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 453 | int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl, |
| 454 | const unsigned char *buf, |
| 455 | const unsigned char *end) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 456 | { |
| 457 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 458 | size_t certificate_request_context_len = 0; |
| 459 | size_t certificate_list_len = 0; |
| 460 | const unsigned char *p = buf; |
| 461 | const unsigned char *certificate_list_end; |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 462 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 463 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 464 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 465 | certificate_request_context_len = p[0]; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 466 | certificate_list_len = MBEDTLS_GET_UINT24_BE(p, 1); |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 467 | p += 4; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 468 | |
| 469 | /* In theory, the certificate list can be up to 2^24 Bytes, but we don't |
| 470 | * support anything beyond 2^16 = 64K. |
| 471 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 472 | if ((certificate_request_context_len != 0) || |
| 473 | (certificate_list_len >= 0x10000)) { |
| 474 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message")); |
| 475 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, |
| 476 | MBEDTLS_ERR_SSL_DECODE_ERROR); |
| 477 | return MBEDTLS_ERR_SSL_DECODE_ERROR; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 478 | } |
| 479 | |
| 480 | /* In case we tried to reuse a session but it failed */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 481 | if (ssl->session_negotiate->peer_cert != NULL) { |
| 482 | mbedtls_x509_crt_free(ssl->session_negotiate->peer_cert); |
| 483 | mbedtls_free(ssl->session_negotiate->peer_cert); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 484 | } |
| 485 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 486 | if (certificate_list_len == 0) { |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 487 | ssl->session_negotiate->peer_cert = NULL; |
| 488 | ret = 0; |
| 489 | goto exit; |
| 490 | } |
| 491 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 492 | if ((ssl->session_negotiate->peer_cert = |
| 493 | mbedtls_calloc(1, sizeof(mbedtls_x509_crt))) == NULL) { |
| 494 | MBEDTLS_SSL_DEBUG_MSG(1, ("alloc( %" MBEDTLS_PRINTF_SIZET " bytes ) failed", |
| 495 | sizeof(mbedtls_x509_crt))); |
| 496 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR, |
| 497 | MBEDTLS_ERR_SSL_ALLOC_FAILED); |
| 498 | return MBEDTLS_ERR_SSL_ALLOC_FAILED; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 499 | } |
| 500 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 501 | mbedtls_x509_crt_init(ssl->session_negotiate->peer_cert); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 502 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 503 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, certificate_list_len); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 504 | certificate_list_end = p + certificate_list_len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 505 | while (p < certificate_list_end) { |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 506 | size_t cert_data_len, extensions_len; |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 507 | const unsigned char *extensions_end; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 508 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 509 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 3); |
| 510 | cert_data_len = MBEDTLS_GET_UINT24_BE(p, 0); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 511 | p += 3; |
| 512 | |
| 513 | /* In theory, the CRT can be up to 2^24 Bytes, but we don't support |
| 514 | * anything beyond 2^16 = 64K. Otherwise as in the TLS 1.2 code, |
| 515 | * check that we have a minimum of 128 bytes of data, this is not |
| 516 | * clear why we need that though. |
| 517 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 518 | if ((cert_data_len < 128) || (cert_data_len >= 0x10000)) { |
| 519 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message")); |
| 520 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, |
| 521 | MBEDTLS_ERR_SSL_DECODE_ERROR); |
| 522 | return MBEDTLS_ERR_SSL_DECODE_ERROR; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 523 | } |
| 524 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 525 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, cert_data_len); |
| 526 | ret = mbedtls_x509_crt_parse_der(ssl->session_negotiate->peer_cert, |
| 527 | p, cert_data_len); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 528 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 529 | switch (ret) { |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 530 | case 0: /*ok*/ |
| 531 | break; |
| 532 | case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND: |
| 533 | /* Ignore certificate with an unknown algorithm: maybe a |
| 534 | prior certificate was already trusted. */ |
| 535 | break; |
| 536 | |
| 537 | case MBEDTLS_ERR_X509_ALLOC_FAILED: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 538 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR, |
| 539 | MBEDTLS_ERR_X509_ALLOC_FAILED); |
| 540 | MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret); |
| 541 | return ret; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 542 | |
| 543 | case MBEDTLS_ERR_X509_UNKNOWN_VERSION: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 544 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT, |
| 545 | MBEDTLS_ERR_X509_UNKNOWN_VERSION); |
| 546 | MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret); |
| 547 | return ret; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 548 | |
| 549 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 550 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT, |
| 551 | ret); |
| 552 | MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret); |
| 553 | return ret; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 554 | } |
| 555 | |
| 556 | p += cert_data_len; |
| 557 | |
| 558 | /* Certificate extensions length */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 559 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 2); |
| 560 | extensions_len = MBEDTLS_GET_UINT16_BE(p, 0); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 561 | p += 2; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 562 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, extensions_len); |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 563 | |
| 564 | extensions_end = p + extensions_len; |
Jerry Yu | 0d5cfb7 | 2022-10-31 14:15:48 +0800 | [diff] [blame] | 565 | handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE; |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 566 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 567 | while (p < extensions_end) { |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 568 | unsigned int extension_type; |
| 569 | size_t extension_data_len; |
| 570 | |
| 571 | /* |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 572 | * struct { |
| 573 | * ExtensionType extension_type; (2 bytes) |
| 574 | * opaque extension_data<0..2^16-1>; |
| 575 | * } Extension; |
| 576 | */ |
| 577 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4); |
| 578 | extension_type = MBEDTLS_GET_UINT16_BE(p, 0); |
| 579 | extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2); |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 580 | p += 4; |
| 581 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 582 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len); |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 583 | |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 584 | ret = mbedtls_ssl_tls13_check_received_extension( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 585 | ssl, MBEDTLS_SSL_HS_CERTIFICATE, extension_type, |
| 586 | MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CT); |
| 587 | if (ret != 0) { |
| 588 | return ret; |
| 589 | } |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 590 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 591 | switch (extension_type) { |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 592 | default: |
Jerry Yu | 79aa721 | 2022-11-08 21:30:21 +0800 | [diff] [blame] | 593 | MBEDTLS_SSL_PRINT_EXT( |
Jerry Yu | 0d5cfb7 | 2022-10-31 14:15:48 +0800 | [diff] [blame] | 594 | 3, MBEDTLS_SSL_HS_CERTIFICATE, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 595 | extension_type, "( ignored )"); |
Jerry Yu | 2eaa760 | 2022-08-04 17:28:15 +0800 | [diff] [blame] | 596 | break; |
| 597 | } |
| 598 | |
| 599 | p += extension_data_len; |
| 600 | } |
| 601 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 602 | MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CERTIFICATE, |
| 603 | handshake->received_extensions); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 604 | } |
| 605 | |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 606 | exit: |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 607 | /* Check that all the message is consumed. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 608 | if (p != end) { |
| 609 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message")); |
| 610 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, |
| 611 | MBEDTLS_ERR_SSL_DECODE_ERROR); |
| 612 | return MBEDTLS_ERR_SSL_DECODE_ERROR; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 613 | } |
| 614 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 615 | MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate", |
| 616 | ssl->session_negotiate->peer_cert); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 617 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 618 | return ret; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 619 | } |
| 620 | #else |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 621 | MBEDTLS_CHECK_RETURN_CRITICAL |
Ronald Cron | e3dac4a | 2022-06-10 17:21:51 +0200 | [diff] [blame] | 622 | MBEDTLS_STATIC_TESTABLE |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 623 | int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl, |
| 624 | const unsigned char *buf, |
| 625 | const unsigned char *end) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 626 | { |
| 627 | ((void) ssl); |
| 628 | ((void) buf); |
| 629 | ((void) end); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 630 | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 631 | } |
| 632 | #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
Ronald Cron | de08cf3 | 2022-10-04 17:15:35 +0200 | [diff] [blame] | 633 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 634 | |
Ronald Cron | de08cf3 | 2022-10-04 17:15:35 +0200 | [diff] [blame] | 635 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 636 | #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 637 | /* Validate certificate chain sent by the server. */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 638 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 639 | static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 640 | { |
| 641 | int ret = 0; |
XiaokangQian | 989f06d | 2022-05-17 01:50:15 +0000 | [diff] [blame] | 642 | int authmode = MBEDTLS_SSL_VERIFY_REQUIRED; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 643 | mbedtls_x509_crt *ca_chain; |
| 644 | mbedtls_x509_crl *ca_crl; |
Ronald Cron | 30c5a25 | 2022-06-16 19:31:06 +0200 | [diff] [blame] | 645 | const char *ext_oid; |
| 646 | size_t ext_len; |
Xiaofei Bai | ff45602 | 2021-10-28 06:50:17 +0000 | [diff] [blame] | 647 | uint32_t verify_result = 0; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 648 | |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 649 | /* If SNI was used, overwrite authentication mode |
| 650 | * from the configuration. */ |
XiaokangQian | 989f06d | 2022-05-17 01:50:15 +0000 | [diff] [blame] | 651 | #if defined(MBEDTLS_SSL_SRV_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 652 | if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { |
XiaokangQian | 0557c94 | 2022-05-30 08:10:53 +0000 | [diff] [blame] | 653 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 654 | if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) { |
XiaokangQian | 0557c94 | 2022-05-30 08:10:53 +0000 | [diff] [blame] | 655 | authmode = ssl->handshake->sni_authmode; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 656 | } else |
XiaokangQian | 0557c94 | 2022-05-30 08:10:53 +0000 | [diff] [blame] | 657 | #endif |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 658 | authmode = ssl->conf->authmode; |
XiaokangQian | 0557c94 | 2022-05-30 08:10:53 +0000 | [diff] [blame] | 659 | } |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 660 | #endif |
| 661 | |
| 662 | /* |
XiaokangQian | 989f06d | 2022-05-17 01:50:15 +0000 | [diff] [blame] | 663 | * If the peer hasn't sent a certificate ( i.e. it sent |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 664 | * an empty certificate chain ), this is reflected in the peer CRT |
| 665 | * structure being unset. |
| 666 | * Check for that and handle it depending on the |
XiaokangQian | 989f06d | 2022-05-17 01:50:15 +0000 | [diff] [blame] | 667 | * authentication mode. |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 668 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 669 | if (ssl->session_negotiate->peer_cert == NULL) { |
| 670 | MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate")); |
XiaokangQian | 989f06d | 2022-05-17 01:50:15 +0000 | [diff] [blame] | 671 | |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 672 | #if defined(MBEDTLS_SSL_SRV_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 673 | if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 674 | /* The client was asked for a certificate but didn't send |
| 675 | * one. The client should know what's going on, so we |
| 676 | * don't send an alert. |
| 677 | */ |
| 678 | ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 679 | if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) { |
| 680 | return 0; |
| 681 | } else { |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 682 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 683 | MBEDTLS_SSL_ALERT_MSG_NO_CERT, |
| 684 | MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 685 | return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE; |
XiaokangQian | 989f06d | 2022-05-17 01:50:15 +0000 | [diff] [blame] | 686 | } |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 687 | } |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 688 | #endif /* MBEDTLS_SSL_SRV_C */ |
| 689 | |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 690 | #if defined(MBEDTLS_SSL_CLI_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 691 | if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { |
| 692 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_NO_CERT, |
| 693 | MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE); |
| 694 | return MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE; |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 695 | } |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 696 | #endif /* MBEDTLS_SSL_CLI_C */ |
XiaokangQian | 63e713e | 2022-05-15 04:26:57 +0000 | [diff] [blame] | 697 | } |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 698 | |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 699 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 700 | if (ssl->handshake->sni_ca_chain != NULL) { |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 701 | ca_chain = ssl->handshake->sni_ca_chain; |
| 702 | ca_crl = ssl->handshake->sni_ca_crl; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 703 | } else |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 704 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
| 705 | { |
| 706 | ca_chain = ssl->conf->ca_chain; |
| 707 | ca_crl = ssl->conf->ca_crl; |
| 708 | } |
| 709 | |
| 710 | /* |
| 711 | * Main check: verify certificate |
| 712 | */ |
| 713 | ret = mbedtls_x509_crt_verify_with_profile( |
| 714 | ssl->session_negotiate->peer_cert, |
| 715 | ca_chain, ca_crl, |
| 716 | ssl->conf->cert_profile, |
| 717 | ssl->hostname, |
Xiaofei Bai | ff45602 | 2021-10-28 06:50:17 +0000 | [diff] [blame] | 718 | &verify_result, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 719 | ssl->conf->f_vrfy, ssl->conf->p_vrfy); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 720 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 721 | if (ret != 0) { |
| 722 | MBEDTLS_SSL_DEBUG_RET(1, "x509_verify_cert", ret); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 723 | } |
| 724 | |
| 725 | /* |
| 726 | * Secondary checks: always done, but change 'ret' only if it was 0 |
| 727 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 728 | if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { |
Ronald Cron | 30c5a25 | 2022-06-16 19:31:06 +0200 | [diff] [blame] | 729 | ext_oid = MBEDTLS_OID_SERVER_AUTH; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 730 | ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH); |
| 731 | } else { |
Ronald Cron | 30c5a25 | 2022-06-16 19:31:06 +0200 | [diff] [blame] | 732 | ext_oid = MBEDTLS_OID_CLIENT_AUTH; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 733 | ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_CLIENT_AUTH); |
Ronald Cron | 30c5a25 | 2022-06-16 19:31:06 +0200 | [diff] [blame] | 734 | } |
| 735 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 736 | if ((mbedtls_x509_crt_check_key_usage( |
| 737 | ssl->session_negotiate->peer_cert, |
| 738 | MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0) || |
| 739 | (mbedtls_x509_crt_check_extended_key_usage( |
| 740 | ssl->session_negotiate->peer_cert, |
| 741 | ext_oid, ext_len) != 0)) { |
| 742 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)")); |
| 743 | if (ret == 0) { |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 744 | ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 745 | } |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 746 | } |
| 747 | |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 748 | /* mbedtls_x509_crt_verify_with_profile is supposed to report a |
| 749 | * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED, |
| 750 | * with details encoded in the verification flags. All other kinds |
| 751 | * of error codes, including those from the user provided f_vrfy |
| 752 | * functions, are treated as fatal and lead to a failure of |
Ronald Cron | e3dac4a | 2022-06-10 17:21:51 +0200 | [diff] [blame] | 753 | * mbedtls_ssl_tls13_parse_certificate even if verification was optional. |
| 754 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 755 | if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL && |
| 756 | (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED || |
| 757 | ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE)) { |
XiaokangQian | 6b916b1 | 2022-04-25 07:29:34 +0000 | [diff] [blame] | 758 | ret = 0; |
| 759 | } |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 760 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 761 | if (ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) { |
| 762 | MBEDTLS_SSL_DEBUG_MSG(1, ("got no CA chain")); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 763 | ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED; |
| 764 | } |
| 765 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 766 | if (ret != 0) { |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 767 | /* The certificate may have been rejected for several reasons. |
| 768 | Pick one and send the corresponding alert. Which alert to send |
| 769 | may be a subject of debate in some cases. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 770 | if (verify_result & MBEDTLS_X509_BADCERT_OTHER) { |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 771 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 772 | MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED, ret); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 773 | } else if (verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) { |
| 774 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT, ret); |
| 775 | } else if (verify_result & (MBEDTLS_X509_BADCERT_KEY_USAGE | |
| 776 | MBEDTLS_X509_BADCERT_EXT_KEY_USAGE | |
| 777 | MBEDTLS_X509_BADCERT_NS_CERT_TYPE | |
| 778 | MBEDTLS_X509_BADCERT_BAD_PK | |
| 779 | MBEDTLS_X509_BADCERT_BAD_KEY)) { |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 780 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 781 | MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT, ret); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 782 | } else if (verify_result & MBEDTLS_X509_BADCERT_EXPIRED) { |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 783 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 784 | MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED, ret); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 785 | } else if (verify_result & MBEDTLS_X509_BADCERT_REVOKED) { |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 786 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 787 | MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED, ret); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 788 | } else if (verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) { |
| 789 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA, ret); |
| 790 | } else { |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 791 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 792 | MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN, ret); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 793 | } |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 794 | } |
| 795 | |
| 796 | #if defined(MBEDTLS_DEBUG_C) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 797 | if (verify_result != 0) { |
| 798 | MBEDTLS_SSL_DEBUG_MSG(3, ("! Certificate verification flags %08x", |
| 799 | (unsigned int) verify_result)); |
| 800 | } else { |
| 801 | MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate verification flags clear")); |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 802 | } |
| 803 | #endif /* MBEDTLS_DEBUG_C */ |
| 804 | |
Xiaofei Bai | ff45602 | 2021-10-28 06:50:17 +0000 | [diff] [blame] | 805 | ssl->session_negotiate->verify_result = verify_result; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 806 | return ret; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 807 | } |
| 808 | #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 809 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 810 | static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 811 | { |
| 812 | ((void) ssl); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 813 | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 814 | } |
| 815 | #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
Ronald Cron | de08cf3 | 2022-10-04 17:15:35 +0200 | [diff] [blame] | 816 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 817 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 818 | int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl) |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 819 | { |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 820 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 821 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate")); |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 822 | |
Ronald Cron | de08cf3 | 2022-10-04 17:15:35 +0200 | [diff] [blame] | 823 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 824 | unsigned char *buf; |
| 825 | size_t buf_len; |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 826 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 827 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( |
| 828 | ssl, MBEDTLS_SSL_HS_CERTIFICATE, |
| 829 | &buf, &buf_len)); |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 830 | |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 831 | /* Parse the certificate chain sent by the peer. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 832 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_parse_certificate(ssl, buf, |
| 833 | buf + buf_len)); |
XiaokangQian | c3017f6 | 2022-05-13 05:55:41 +0000 | [diff] [blame] | 834 | /* Validate the certificate chain and set the verification results. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 835 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_validate_certificate(ssl)); |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 836 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 837 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum( |
| 838 | ssl, MBEDTLS_SSL_HS_CERTIFICATE, buf, buf_len)); |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 839 | |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 840 | cleanup: |
Ronald Cron | de08cf3 | 2022-10-04 17:15:35 +0200 | [diff] [blame] | 841 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Xiaofei Bai | 79595ac | 2021-10-26 07:16:45 +0000 | [diff] [blame] | 842 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 843 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate")); |
| 844 | return ret; |
Xiaofei Bai | 947571e | 2021-09-29 09:12:03 +0000 | [diff] [blame] | 845 | } |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 846 | #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) |
Jerry Yu | 7399d0d | 2022-01-30 17:54:19 +0800 | [diff] [blame] | 847 | /* |
| 848 | * enum { |
| 849 | * X509(0), |
| 850 | * RawPublicKey(2), |
| 851 | * (255) |
| 852 | * } CertificateType; |
| 853 | * |
| 854 | * struct { |
| 855 | * select (certificate_type) { |
| 856 | * case RawPublicKey: |
| 857 | * // From RFC 7250 ASN.1_subjectPublicKeyInfo |
| 858 | * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; |
| 859 | * |
| 860 | * case X509: |
| 861 | * opaque cert_data<1..2^24-1>; |
| 862 | * }; |
| 863 | * Extension extensions<0..2^16-1>; |
| 864 | * } CertificateEntry; |
| 865 | * |
| 866 | * struct { |
| 867 | * opaque certificate_request_context<0..2^8-1>; |
| 868 | * CertificateEntry certificate_list<0..2^24-1>; |
| 869 | * } Certificate; |
| 870 | */ |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 871 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 872 | static int ssl_tls13_write_certificate_body(mbedtls_ssl_context *ssl, |
| 873 | unsigned char *buf, |
| 874 | unsigned char *end, |
| 875 | size_t *out_len) |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 876 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 877 | const mbedtls_x509_crt *crt = mbedtls_ssl_own_cert(ssl); |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 878 | unsigned char *p = buf; |
Jerry Yu | c8d8d4e | 2022-02-18 12:10:03 +0800 | [diff] [blame] | 879 | unsigned char *certificate_request_context = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 880 | ssl->handshake->certificate_request_context; |
Jerry Yu | c8d8d4e | 2022-02-18 12:10:03 +0800 | [diff] [blame] | 881 | unsigned char certificate_request_context_len = |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 882 | ssl->handshake->certificate_request_context_len; |
Jerry Yu | c8d8d4e | 2022-02-18 12:10:03 +0800 | [diff] [blame] | 883 | unsigned char *p_certificate_list_len; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 884 | |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 885 | |
Jerry Yu | 3391ac0 | 2022-02-16 11:21:37 +0800 | [diff] [blame] | 886 | /* ... |
| 887 | * opaque certificate_request_context<0..2^8-1>; |
| 888 | * ... |
| 889 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 890 | MBEDTLS_SSL_CHK_BUF_PTR(p, end, certificate_request_context_len + 1); |
Jerry Yu | c8d8d4e | 2022-02-18 12:10:03 +0800 | [diff] [blame] | 891 | *p++ = certificate_request_context_len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 892 | if (certificate_request_context_len > 0) { |
| 893 | memcpy(p, certificate_request_context, certificate_request_context_len); |
Jerry Yu | c8d8d4e | 2022-02-18 12:10:03 +0800 | [diff] [blame] | 894 | p += certificate_request_context_len; |
Jerry Yu | 537530d | 2022-02-15 14:00:57 +0800 | [diff] [blame] | 895 | } |
| 896 | |
Jerry Yu | 3391ac0 | 2022-02-16 11:21:37 +0800 | [diff] [blame] | 897 | /* ... |
| 898 | * CertificateEntry certificate_list<0..2^24-1>; |
| 899 | * ... |
| 900 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 901 | MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3); |
Jerry Yu | c8d8d4e | 2022-02-18 12:10:03 +0800 | [diff] [blame] | 902 | p_certificate_list_len = p; |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 903 | p += 3; |
| 904 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 905 | MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", crt); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 906 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 907 | while (crt != NULL) { |
Jerry Yu | 7399d0d | 2022-01-30 17:54:19 +0800 | [diff] [blame] | 908 | size_t cert_data_len = crt->raw.len; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 909 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 910 | MBEDTLS_SSL_CHK_BUF_PTR(p, end, cert_data_len + 3 + 2); |
| 911 | MBEDTLS_PUT_UINT24_BE(cert_data_len, p, 0); |
Jerry Yu | 7399d0d | 2022-01-30 17:54:19 +0800 | [diff] [blame] | 912 | p += 3; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 913 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 914 | memcpy(p, crt->raw.p, cert_data_len); |
Jerry Yu | 7399d0d | 2022-01-30 17:54:19 +0800 | [diff] [blame] | 915 | p += cert_data_len; |
| 916 | crt = crt->next; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 917 | |
| 918 | /* Currently, we don't have any certificate extensions defined. |
| 919 | * Hence, we are sending an empty extension with length zero. |
| 920 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 921 | MBEDTLS_PUT_UINT16_BE(0, p, 0); |
Jerry Yu | 7399d0d | 2022-01-30 17:54:19 +0800 | [diff] [blame] | 922 | p += 2; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 923 | } |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 924 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 925 | MBEDTLS_PUT_UINT24_BE(p - p_certificate_list_len - 3, |
| 926 | p_certificate_list_len, 0); |
Jerry Yu | 7399d0d | 2022-01-30 17:54:19 +0800 | [diff] [blame] | 927 | |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 928 | *out_len = p - buf; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 929 | |
Jerry Yu | 7de2ff0 | 2022-11-08 21:43:46 +0800 | [diff] [blame] | 930 | MBEDTLS_SSL_PRINT_EXTS( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 931 | 3, MBEDTLS_SSL_HS_CERTIFICATE, ssl->handshake->sent_extensions); |
Jerry Yu | 4b8f2f7 | 2022-10-31 13:31:22 +0800 | [diff] [blame] | 932 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 933 | return 0; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 934 | } |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 935 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 936 | int mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context *ssl) |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 937 | { |
| 938 | int ret; |
Ronald Cron | 5bb8fc8 | 2022-03-09 07:00:13 +0100 | [diff] [blame] | 939 | unsigned char *buf; |
| 940 | size_t buf_len, msg_len; |
| 941 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 942 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate")); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 943 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 944 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg( |
| 945 | ssl, MBEDTLS_SSL_HS_CERTIFICATE, &buf, &buf_len)); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 946 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 947 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_body(ssl, |
| 948 | buf, |
| 949 | buf + buf_len, |
| 950 | &msg_len)); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 951 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 952 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum( |
| 953 | ssl, MBEDTLS_SSL_HS_CERTIFICATE, buf, msg_len)); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 954 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 955 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg( |
| 956 | ssl, buf_len, msg_len)); |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 957 | cleanup: |
| 958 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 959 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate")); |
| 960 | return ret; |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 961 | } |
| 962 | |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 963 | /* |
| 964 | * STATE HANDLING: Output Certificate Verify |
| 965 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 966 | int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg, |
| 967 | mbedtls_pk_context *key) |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 968 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 969 | mbedtls_pk_type_t pk_type = mbedtls_ssl_sig_from_pk(key); |
| 970 | size_t key_size = mbedtls_pk_get_bitlen(key); |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 971 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 972 | switch (pk_type) { |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 973 | case MBEDTLS_SSL_SIG_ECDSA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 974 | switch (key_size) { |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 975 | case 256: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 976 | return |
| 977 | sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256; |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 978 | |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 979 | case 384: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 980 | return |
| 981 | sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384; |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 982 | |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 983 | case 521: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 984 | return |
| 985 | sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512; |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 986 | default: |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 987 | break; |
| 988 | } |
| 989 | break; |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 990 | |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 991 | case MBEDTLS_SSL_SIG_RSA: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 992 | switch (sig_alg) { |
Ronald Cron | 38391bf | 2022-09-16 11:19:27 +0200 | [diff] [blame] | 993 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: /* Intentional fallthrough */ |
| 994 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: /* Intentional fallthrough */ |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 995 | case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 996 | return 1; |
Jerry Yu | c2e0493 | 2022-06-27 22:13:03 +0800 | [diff] [blame] | 997 | |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 998 | default: |
| 999 | break; |
Jerry Yu | cef3f33 | 2022-03-22 23:00:13 +0800 | [diff] [blame] | 1000 | } |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 1001 | break; |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 1002 | |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 1003 | default: |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 1004 | break; |
| 1005 | } |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 1006 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1007 | return 0; |
Jerry Yu | 0c6be8f | 2022-06-20 20:42:00 +0800 | [diff] [blame] | 1008 | } |
| 1009 | |
Ronald Cron | ce7d76e | 2022-07-08 18:56:49 +0200 | [diff] [blame] | 1010 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1011 | static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl, |
| 1012 | unsigned char *buf, |
| 1013 | unsigned char *end, |
| 1014 | size_t *out_len) |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1015 | { |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1016 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 1017 | unsigned char *p = buf; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1018 | mbedtls_pk_context *own_key; |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 1019 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1020 | unsigned char handshake_hash[MBEDTLS_TLS1_3_MD_MAX_SIZE]; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1021 | size_t handshake_hash_len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1022 | unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE]; |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 1023 | size_t verify_buffer_len; |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1024 | |
| 1025 | uint16_t *sig_alg = ssl->handshake->received_sig_algs; |
Jerry Yu | 3e53644 | 2022-02-15 11:05:59 +0800 | [diff] [blame] | 1026 | size_t signature_len = 0; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1027 | |
Jerry Yu | 0b7b101 | 2022-02-23 12:23:05 +0800 | [diff] [blame] | 1028 | *out_len = 0; |
| 1029 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1030 | own_key = mbedtls_ssl_own_key(ssl); |
| 1031 | if (own_key == NULL) { |
| 1032 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
| 1033 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1034 | } |
| 1035 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1036 | ret = mbedtls_ssl_get_handshake_transcript( |
| 1037 | ssl, ssl->handshake->ciphersuite_info->mac, |
| 1038 | handshake_hash, sizeof(handshake_hash), &handshake_hash_len); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1039 | if (ret != 0) { |
| 1040 | return ret; |
| 1041 | } |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1042 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1043 | MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash", |
| 1044 | handshake_hash, |
| 1045 | handshake_hash_len); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1046 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1047 | ssl_tls13_create_verify_structure(handshake_hash, handshake_hash_len, |
| 1048 | verify_buffer, &verify_buffer_len, |
| 1049 | ssl->conf->endpoint); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1050 | |
| 1051 | /* |
| 1052 | * struct { |
| 1053 | * SignatureScheme algorithm; |
| 1054 | * opaque signature<0..2^16-1>; |
| 1055 | * } CertificateVerify; |
| 1056 | */ |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1057 | /* Check there is space for the algorithm identifier (2 bytes) and the |
| 1058 | * signature length (2 bytes). |
| 1059 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1060 | MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4); |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1061 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1062 | for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) { |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1063 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| 1064 | mbedtls_pk_type_t pk_type = MBEDTLS_PK_NONE; |
| 1065 | mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE; |
| 1066 | psa_algorithm_t psa_algorithm = PSA_ALG_NONE; |
| 1067 | unsigned char verify_hash[PSA_HASH_MAX_SIZE]; |
| 1068 | size_t verify_hash_len; |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 1069 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1070 | if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) { |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1071 | continue; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1072 | } |
Jerry Yu | 67eced0 | 2022-02-25 13:37:36 +0800 | [diff] [blame] | 1073 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1074 | if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) { |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1075 | continue; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1076 | } |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1077 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1078 | if (!mbedtls_ssl_tls13_check_sig_alg_cert_key_match(*sig_alg, own_key)) { |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1079 | continue; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1080 | } |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1081 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1082 | if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( |
| 1083 | *sig_alg, &pk_type, &md_alg) != 0) { |
| 1084 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1085 | } |
| 1086 | |
| 1087 | /* Hash verify buffer with indicated hash function */ |
Manuel Pégourié-Gonnard | 2d6d993 | 2023-03-28 11:38:08 +0200 | [diff] [blame] | 1088 | psa_algorithm = mbedtls_md_psa_alg_from_type(md_alg); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1089 | status = psa_hash_compute(psa_algorithm, |
| 1090 | verify_buffer, |
| 1091 | verify_buffer_len, |
| 1092 | verify_hash, sizeof(verify_hash), |
| 1093 | &verify_hash_len); |
| 1094 | if (status != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 1095 | return PSA_TO_MBEDTLS_ERR(status); |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1096 | } |
| 1097 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1098 | MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); |
| 1099 | |
| 1100 | if ((ret = mbedtls_pk_sign_ext(pk_type, own_key, |
| 1101 | md_alg, verify_hash, verify_hash_len, |
| 1102 | p + 4, (size_t) (end - (p + 4)), &signature_len, |
| 1103 | ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { |
| 1104 | MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s", |
| 1105 | mbedtls_ssl_sig_alg_to_str(*sig_alg))); |
| 1106 | MBEDTLS_SSL_DEBUG_RET(2, "mbedtls_pk_sign_ext", ret); |
| 1107 | |
| 1108 | /* The signature failed. This is possible if the private key |
| 1109 | * was not suitable for the signature operation as purposely we |
| 1110 | * did not check its suitability completely. Let's try with |
| 1111 | * another signature algorithm. |
| 1112 | */ |
| 1113 | continue; |
| 1114 | } |
| 1115 | |
| 1116 | MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature with %s", |
| 1117 | mbedtls_ssl_sig_alg_to_str(*sig_alg))); |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1118 | |
| 1119 | break; |
| 1120 | } |
| 1121 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1122 | if (*sig_alg == MBEDTLS_TLS1_3_SIG_NONE) { |
| 1123 | MBEDTLS_SSL_DEBUG_MSG(1, ("no suitable signature algorithm")); |
| 1124 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE, |
| 1125 | MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE); |
| 1126 | return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1127 | } |
| 1128 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1129 | MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0); |
| 1130 | MBEDTLS_PUT_UINT16_BE(signature_len, p, 2); |
Jerry Yu | f3b46b5 | 2022-06-19 16:52:27 +0800 | [diff] [blame] | 1131 | |
Ronald Cron | 067a1e7 | 2022-09-16 13:44:49 +0200 | [diff] [blame] | 1132 | *out_len = 4 + signature_len; |
Jerry Yu | 8c33886 | 2022-03-23 13:34:04 +0800 | [diff] [blame] | 1133 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1134 | return 0; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1135 | } |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1136 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1137 | int mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl) |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1138 | { |
| 1139 | int ret = 0; |
Jerry Yu | ca133a3 | 2022-02-15 14:22:05 +0800 | [diff] [blame] | 1140 | unsigned char *buf; |
| 1141 | size_t buf_len, msg_len; |
| 1142 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1143 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate verify")); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1144 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1145 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg( |
| 1146 | ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, |
| 1147 | &buf, &buf_len)); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1148 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1149 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_verify_body( |
| 1150 | ssl, buf, buf + buf_len, &msg_len)); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1151 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1152 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum( |
| 1153 | ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, |
| 1154 | buf, msg_len)); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1155 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1156 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg( |
| 1157 | ssl, buf_len, msg_len)); |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1158 | |
| 1159 | cleanup: |
| 1160 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1161 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate verify")); |
| 1162 | return ret; |
Jerry Yu | 8511f12 | 2022-01-29 10:01:04 +0800 | [diff] [blame] | 1163 | } |
| 1164 | |
Ronald Cron | 928cbd3 | 2022-10-04 16:14:26 +0200 | [diff] [blame] | 1165 | #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ |
Jerry Yu | 90f152d | 2022-01-29 22:12:42 +0800 | [diff] [blame] | 1166 | |
Jerry Yu | 5cc3506 | 2022-01-28 16:16:08 +0800 | [diff] [blame] | 1167 | /* |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1168 | * |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1169 | * STATE HANDLING: Incoming Finished message. |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1170 | */ |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1171 | /* |
| 1172 | * Implementation |
| 1173 | */ |
| 1174 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 1175 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1176 | static int ssl_tls13_preprocess_finished_message(mbedtls_ssl_context *ssl) |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1177 | { |
| 1178 | int ret; |
| 1179 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1180 | ret = mbedtls_ssl_tls13_calculate_verify_data( |
| 1181 | ssl, |
| 1182 | ssl->handshake->state_local.finished_in.digest, |
| 1183 | sizeof(ssl->handshake->state_local.finished_in.digest), |
| 1184 | &ssl->handshake->state_local.finished_in.digest_len, |
| 1185 | ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ? |
| 1186 | MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1187 | if (ret != 0) { |
| 1188 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_calculate_verify_data", ret); |
| 1189 | return ret; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1190 | } |
| 1191 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1192 | return 0; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1193 | } |
| 1194 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 1195 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1196 | static int ssl_tls13_parse_finished_message(mbedtls_ssl_context *ssl, |
| 1197 | const unsigned char *buf, |
| 1198 | const unsigned char *end) |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1199 | { |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1200 | /* |
| 1201 | * struct { |
XiaokangQian | c13f935 | 2021-11-11 06:13:22 +0000 | [diff] [blame] | 1202 | * opaque verify_data[Hash.length]; |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1203 | * } Finished; |
| 1204 | */ |
| 1205 | const unsigned char *expected_verify_data = |
| 1206 | ssl->handshake->state_local.finished_in.digest; |
| 1207 | size_t expected_verify_data_len = |
| 1208 | ssl->handshake->state_local.finished_in.digest_len; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1209 | /* Structural validation */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1210 | if ((size_t) (end - buf) != expected_verify_data_len) { |
| 1211 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message")); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1212 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1213 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, |
| 1214 | MBEDTLS_ERR_SSL_DECODE_ERROR); |
| 1215 | return MBEDTLS_ERR_SSL_DECODE_ERROR; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1216 | } |
| 1217 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1218 | MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (self-computed):", |
| 1219 | expected_verify_data, |
| 1220 | expected_verify_data_len); |
| 1221 | MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (received message):", buf, |
| 1222 | expected_verify_data_len); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1223 | |
| 1224 | /* Semantic validation */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1225 | if (mbedtls_ct_memcmp(buf, |
| 1226 | expected_verify_data, |
| 1227 | expected_verify_data_len) != 0) { |
| 1228 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message")); |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1229 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1230 | MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR, |
| 1231 | MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE); |
| 1232 | return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1233 | } |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1234 | return 0; |
XiaokangQian | aa5f5c1 | 2021-09-18 06:20:25 +0000 | [diff] [blame] | 1235 | } |
| 1236 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1237 | int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl) |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1238 | { |
XiaokangQian | 3306284 | 2021-11-11 03:37:45 +0000 | [diff] [blame] | 1239 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1240 | unsigned char *buf; |
Xiaofei Bai | eef1504 | 2021-11-18 07:29:56 +0000 | [diff] [blame] | 1241 | size_t buf_len; |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1242 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1243 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message")); |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1244 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1245 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( |
| 1246 | ssl, MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len)); |
Jerry Yu | 0a92d6c | 2022-05-16 16:54:46 +0800 | [diff] [blame] | 1247 | |
| 1248 | /* Preprocessing step: Compute handshake digest */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1249 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl)); |
Jerry Yu | 0a92d6c | 2022-05-16 16:54:46 +0800 | [diff] [blame] | 1250 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1251 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_finished_message( |
| 1252 | ssl, buf, buf + buf_len)); |
Jerry Yu | 0a92d6c | 2022-05-16 16:54:46 +0800 | [diff] [blame] | 1253 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1254 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum( |
| 1255 | ssl, MBEDTLS_SSL_HS_FINISHED, buf, buf_len)); |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1256 | |
| 1257 | cleanup: |
| 1258 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1259 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished message")); |
| 1260 | return ret; |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1261 | } |
| 1262 | |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1263 | /* |
| 1264 | * |
XiaokangQian | cc90c94 | 2021-11-09 12:30:09 +0000 | [diff] [blame] | 1265 | * STATE HANDLING: Write and send Finished message. |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1266 | * |
| 1267 | */ |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1268 | /* |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1269 | * Implement |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1270 | */ |
| 1271 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 1272 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1273 | static int ssl_tls13_prepare_finished_message(mbedtls_ssl_context *ssl) |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1274 | { |
| 1275 | int ret; |
| 1276 | |
| 1277 | /* Compute transcript of handshake up to now. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1278 | ret = mbedtls_ssl_tls13_calculate_verify_data(ssl, |
| 1279 | ssl->handshake->state_local.finished_out.digest, |
| 1280 | sizeof(ssl->handshake->state_local.finished_out. |
| 1281 | digest), |
| 1282 | &ssl->handshake->state_local.finished_out.digest_len, |
| 1283 | ssl->conf->endpoint); |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1284 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1285 | if (ret != 0) { |
| 1286 | MBEDTLS_SSL_DEBUG_RET(1, "calculate_verify_data failed", ret); |
| 1287 | return ret; |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1288 | } |
| 1289 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1290 | return 0; |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1291 | } |
| 1292 | |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 1293 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1294 | static int ssl_tls13_write_finished_message_body(mbedtls_ssl_context *ssl, |
| 1295 | unsigned char *buf, |
| 1296 | unsigned char *end, |
| 1297 | size_t *out_len) |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1298 | { |
XiaokangQian | 8773aa0 | 2021-11-10 07:33:09 +0000 | [diff] [blame] | 1299 | size_t verify_data_len = ssl->handshake->state_local.finished_out.digest_len; |
XiaokangQian | 0fa6643 | 2021-11-15 03:33:57 +0000 | [diff] [blame] | 1300 | /* |
| 1301 | * struct { |
| 1302 | * opaque verify_data[Hash.length]; |
| 1303 | * } Finished; |
| 1304 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1305 | MBEDTLS_SSL_CHK_BUF_PTR(buf, end, verify_data_len); |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1306 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1307 | memcpy(buf, ssl->handshake->state_local.finished_out.digest, |
| 1308 | verify_data_len); |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1309 | |
Xiaofei Bai | d25fab6 | 2021-12-02 06:36:27 +0000 | [diff] [blame] | 1310 | *out_len = verify_data_len; |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1311 | return 0; |
XiaokangQian | 74af2a8 | 2021-09-22 07:40:30 +0000 | [diff] [blame] | 1312 | } |
XiaokangQian | c5c39d5 | 2021-11-09 11:55:10 +0000 | [diff] [blame] | 1313 | |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1314 | /* Main entry point: orchestrates the other functions */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1315 | int mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context *ssl) |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1316 | { |
| 1317 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 1318 | unsigned char *buf; |
| 1319 | size_t buf_len, msg_len; |
| 1320 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1321 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished message")); |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1322 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1323 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_finished_message(ssl)); |
XiaokangQian | dce8224 | 2021-11-15 06:01:26 +0000 | [diff] [blame] | 1324 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1325 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl, |
| 1326 | MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len)); |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1327 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1328 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_finished_message_body( |
| 1329 | ssl, buf, buf + buf_len, &msg_len)); |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1330 | |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 1331 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, |
Manuel Pégourié-Gonnard | 43cc127 | 2023-02-06 11:48:19 +0100 | [diff] [blame] | 1332 | MBEDTLS_SSL_HS_FINISHED, buf, msg_len)); |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1333 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1334 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg( |
| 1335 | ssl, buf_len, msg_len)); |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1336 | cleanup: |
| 1337 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1338 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished message")); |
| 1339 | return ret; |
XiaokangQian | 35dc625 | 2021-11-11 08:16:19 +0000 | [diff] [blame] | 1340 | } |
| 1341 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1342 | void mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl) |
Jerry Yu | 378254d | 2021-10-30 21:44:47 +0800 | [diff] [blame] | 1343 | { |
| 1344 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1345 | MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup")); |
Jerry Yu | 378254d | 2021-10-30 21:44:47 +0800 | [diff] [blame] | 1346 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1347 | MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for inbound traffic")); |
| 1348 | mbedtls_ssl_set_inbound_transform(ssl, ssl->transform_application); |
Jerry Yu | e8c1fca | 2022-05-18 14:48:56 +0800 | [diff] [blame] | 1349 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1350 | MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for outbound traffic")); |
| 1351 | mbedtls_ssl_set_outbound_transform(ssl, ssl->transform_application); |
Jerry Yu | e8c1fca | 2022-05-18 14:48:56 +0800 | [diff] [blame] | 1352 | |
Jerry Yu | 378254d | 2021-10-30 21:44:47 +0800 | [diff] [blame] | 1353 | /* |
Jerry Yu | cfe64f0 | 2021-11-15 13:54:06 +0800 | [diff] [blame] | 1354 | * Free the previous session and switch to the current one. |
Jerry Yu | 378254d | 2021-10-30 21:44:47 +0800 | [diff] [blame] | 1355 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1356 | if (ssl->session) { |
| 1357 | mbedtls_ssl_session_free(ssl->session); |
| 1358 | mbedtls_free(ssl->session); |
Jerry Yu | 378254d | 2021-10-30 21:44:47 +0800 | [diff] [blame] | 1359 | } |
| 1360 | ssl->session = ssl->session_negotiate; |
| 1361 | ssl->session_negotiate = NULL; |
| 1362 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1363 | MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup")); |
Jerry Yu | 378254d | 2021-10-30 21:44:47 +0800 | [diff] [blame] | 1364 | } |
| 1365 | |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1366 | /* |
| 1367 | * |
| 1368 | * STATE HANDLING: Write ChangeCipherSpec |
| 1369 | * |
| 1370 | */ |
| 1371 | #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) |
Manuel Pégourié-Gonnard | a3115dc | 2022-06-17 10:52:54 +0200 | [diff] [blame] | 1372 | MBEDTLS_CHECK_RETURN_CRITICAL |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1373 | static int ssl_tls13_write_change_cipher_spec_body(mbedtls_ssl_context *ssl, |
| 1374 | unsigned char *buf, |
| 1375 | unsigned char *end, |
| 1376 | size_t *olen) |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1377 | { |
| 1378 | ((void) ssl); |
| 1379 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1380 | MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 1); |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1381 | buf[0] = 1; |
| 1382 | *olen = 1; |
| 1383 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1384 | return 0; |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1385 | } |
| 1386 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1387 | int mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context *ssl) |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1388 | { |
| 1389 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
| 1390 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1391 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write change cipher spec")); |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1392 | |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1393 | /* Write CCS message */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1394 | MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_change_cipher_spec_body( |
| 1395 | ssl, ssl->out_msg, |
| 1396 | ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN, |
| 1397 | &ssl->out_msglen)); |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1398 | |
| 1399 | ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC; |
| 1400 | |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1401 | /* Dispatch message */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1402 | MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_write_record(ssl, 0)); |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1403 | |
| 1404 | cleanup: |
| 1405 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1406 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write change cipher spec")); |
| 1407 | return ret; |
Ronald Cron | 49ad619 | 2021-11-24 16:25:31 +0100 | [diff] [blame] | 1408 | } |
| 1409 | |
| 1410 | #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ |
| 1411 | |
Xiaokang Qian | ecc2948 | 2022-11-02 07:52:47 +0000 | [diff] [blame] | 1412 | /* Early Data Indication Extension |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1413 | * |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1414 | * struct { |
| 1415 | * select ( Handshake.msg_type ) { |
Xiaokang Qian | ecc2948 | 2022-11-02 07:52:47 +0000 | [diff] [blame] | 1416 | * ... |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1417 | * case client_hello: Empty; |
| 1418 | * case encrypted_extensions: Empty; |
| 1419 | * }; |
| 1420 | * } EarlyDataIndication; |
| 1421 | */ |
| 1422 | #if defined(MBEDTLS_SSL_EARLY_DATA) |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1423 | int mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context *ssl, |
| 1424 | unsigned char *buf, |
| 1425 | const unsigned char *end, |
| 1426 | size_t *out_len) |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1427 | { |
| 1428 | unsigned char *p = buf; |
| 1429 | *out_len = 0; |
| 1430 | ((void) ssl); |
| 1431 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1432 | MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4); |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1433 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1434 | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EARLY_DATA, p, 0); |
| 1435 | MBEDTLS_PUT_UINT16_BE(0, p, 2); |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1436 | |
| 1437 | *out_len = 4; |
Xiaokang Qian | 2cd5ce0 | 2022-11-15 10:33:53 +0000 | [diff] [blame] | 1438 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1439 | mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_EARLY_DATA); |
Xiaokang Qian | 2cd5ce0 | 2022-11-15 10:33:53 +0000 | [diff] [blame] | 1440 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1441 | return 0; |
Xiaokang Qian | 0e97d4d | 2022-10-24 11:12:51 +0000 | [diff] [blame] | 1442 | } |
| 1443 | #endif /* MBEDTLS_SSL_EARLY_DATA */ |
| 1444 | |
XiaokangQian | 78b1fa7 | 2022-01-19 06:56:30 +0000 | [diff] [blame] | 1445 | /* Reset SSL context and update hash for handling HRR. |
| 1446 | * |
| 1447 | * Replace Transcript-Hash(X) by |
| 1448 | * Transcript-Hash( message_hash || |
| 1449 | * 00 00 Hash.length || |
| 1450 | * X ) |
| 1451 | * A few states of the handshake are preserved, including: |
| 1452 | * - session ID |
| 1453 | * - session ticket |
| 1454 | * - negotiated ciphersuite |
| 1455 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1456 | int mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context *ssl) |
XiaokangQian | 78b1fa7 | 2022-01-19 06:56:30 +0000 | [diff] [blame] | 1457 | { |
| 1458 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
Przemyslaw Stekiel | da64525 | 2022-09-14 12:50:51 +0200 | [diff] [blame] | 1459 | unsigned char hash_transcript[PSA_HASH_MAX_SIZE + 4]; |
XiaokangQian | 0ece998 | 2022-01-24 08:56:23 +0000 | [diff] [blame] | 1460 | size_t hash_len; |
Xiaokang Qian | 6b98001 | 2023-02-07 03:17:45 +0000 | [diff] [blame] | 1461 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
| 1462 | ssl->handshake->ciphersuite_info; |
XiaokangQian | 78b1fa7 | 2022-01-19 06:56:30 +0000 | [diff] [blame] | 1463 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1464 | MBEDTLS_SSL_DEBUG_MSG(3, ("Reset SSL session for HRR")); |
XiaokangQian | 78b1fa7 | 2022-01-19 06:56:30 +0000 | [diff] [blame] | 1465 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1466 | ret = mbedtls_ssl_get_handshake_transcript(ssl, ciphersuite_info->mac, |
| 1467 | hash_transcript + 4, |
| 1468 | PSA_HASH_MAX_SIZE, |
| 1469 | &hash_len); |
| 1470 | if (ret != 0) { |
Manuel Pégourié-Gonnard | da7979b | 2023-02-21 09:31:10 +0100 | [diff] [blame] | 1471 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_get_handshake_transcript", ret); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1472 | return ret; |
XiaokangQian | 0ece998 | 2022-01-24 08:56:23 +0000 | [diff] [blame] | 1473 | } |
| 1474 | |
| 1475 | hash_transcript[0] = MBEDTLS_SSL_HS_MESSAGE_HASH; |
| 1476 | hash_transcript[1] = 0; |
| 1477 | hash_transcript[2] = 0; |
| 1478 | hash_transcript[3] = (unsigned char) hash_len; |
| 1479 | |
| 1480 | hash_len += 4; |
| 1481 | |
Manuel Pégourié-Gonnard | da7979b | 2023-02-21 09:31:10 +0100 | [diff] [blame] | 1482 | MBEDTLS_SSL_DEBUG_BUF(4, "Truncated handshake transcript", |
| 1483 | hash_transcript, hash_len); |
| 1484 | |
Manuel Pégourié-Gonnard | d7a7a23 | 2023-02-05 10:26:49 +0100 | [diff] [blame] | 1485 | /* Reset running hash and replace it with a hash of the transcript */ |
Manuel Pégourié-Gonnard | b8b07aa | 2023-02-06 00:34:21 +0100 | [diff] [blame] | 1486 | ret = mbedtls_ssl_reset_checksum(ssl); |
| 1487 | if (ret != 0) { |
| 1488 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_checksum", ret); |
| 1489 | return ret; |
| 1490 | } |
| 1491 | ret = ssl->handshake->update_checksum(ssl, hash_transcript, hash_len); |
| 1492 | if (ret != 0) { |
| 1493 | MBEDTLS_SSL_DEBUG_RET(1, "update_checksum", ret); |
| 1494 | return ret; |
| 1495 | } |
Przemyslaw Stekiel | 4b3fff4 | 2022-02-14 16:39:52 +0100 | [diff] [blame] | 1496 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1497 | return ret; |
XiaokangQian | 78b1fa7 | 2022-01-19 06:56:30 +0000 | [diff] [blame] | 1498 | } |
| 1499 | |
Przemek Stekiel | 6370662 | 2023-05-23 16:31:56 +0200 | [diff] [blame] | 1500 | #if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH) |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 1501 | |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 1502 | int mbedtls_ssl_tls13_read_public_xxdhe_share(mbedtls_ssl_context *ssl, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1503 | const unsigned char *buf, |
| 1504 | size_t buf_len) |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 1505 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1506 | uint8_t *p = (uint8_t *) buf; |
XiaokangQian | cfd925f | 2022-04-14 07:10:37 +0000 | [diff] [blame] | 1507 | const uint8_t *end = buf + buf_len; |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 1508 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 1509 | |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 1510 | /* Get size of the TLS opaque key_exchange field of the KeyShareEntry struct. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1511 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); |
| 1512 | uint16_t peerkey_len = MBEDTLS_GET_UINT16_BE(p, 0); |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 1513 | p += 2; |
XiaokangQian | 3207a32 | 2022-02-23 03:15:27 +0000 | [diff] [blame] | 1514 | |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 1515 | /* Check if key size is consistent with given buffer length. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1516 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, peerkey_len); |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 1517 | |
| 1518 | /* Store peer's ECDH public key. */ |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 1519 | memcpy(handshake->xxdh_psa_peerkey, p, peerkey_len); |
| 1520 | handshake->xxdh_psa_peerkey_len = peerkey_len; |
XiaokangQian | 9b5d04b | 2022-04-10 10:20:43 +0000 | [diff] [blame] | 1521 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1522 | return 0; |
XiaokangQian | 3207a32 | 2022-02-23 03:15:27 +0000 | [diff] [blame] | 1523 | } |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1524 | |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1525 | static psa_status_t mbedtls_ssl_get_psa_ffdh_info_from_tls_id( |
Przemek Stekiel | 75a5a9c | 2023-06-12 11:21:18 +0200 | [diff] [blame] | 1526 | uint16_t tls_id, size_t *bits, psa_key_type_t *key_type) |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1527 | { |
Przemek Stekiel | 75a5a9c | 2023-06-12 11:21:18 +0200 | [diff] [blame] | 1528 | switch (tls_id) { |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1529 | case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048: |
| 1530 | *bits = 2048; |
| 1531 | *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919); |
| 1532 | return PSA_SUCCESS; |
| 1533 | case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072: |
| 1534 | *bits = 3072; |
| 1535 | *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919); |
| 1536 | return PSA_SUCCESS; |
| 1537 | case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096: |
| 1538 | *bits = 4096; |
| 1539 | *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919); |
| 1540 | return PSA_SUCCESS; |
| 1541 | case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144: |
| 1542 | *bits = 6144; |
| 1543 | *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919); |
| 1544 | return PSA_SUCCESS; |
| 1545 | case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192: |
| 1546 | *bits = 8192; |
| 1547 | *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919); |
| 1548 | return PSA_SUCCESS; |
| 1549 | default: |
| 1550 | return PSA_ERROR_NOT_SUPPORTED; |
| 1551 | } |
| 1552 | } |
| 1553 | |
| 1554 | int mbedtls_ssl_tls13_generate_and_write_dh_key_exchange( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1555 | mbedtls_ssl_context *ssl, |
| 1556 | uint16_t named_group, |
| 1557 | unsigned char *buf, |
| 1558 | unsigned char *end, |
| 1559 | size_t *out_len) |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1560 | { |
| 1561 | psa_status_t status = PSA_ERROR_GENERIC_ERROR; |
| 1562 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
| 1563 | psa_key_attributes_t key_attributes; |
| 1564 | size_t own_pubkey_len; |
| 1565 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1566 | size_t bits = 0; |
Przemek Stekiel | 75a5a9c | 2023-06-12 11:21:18 +0200 | [diff] [blame] | 1567 | psa_key_type_t key_type = PSA_KEY_TYPE_NONE; |
| 1568 | psa_algorithm_t alg = PSA_ALG_NONE; |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1569 | size_t buf_size = (size_t) (end - buf); |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1570 | |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1571 | MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH/FFDH computation.")); |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1572 | |
Valerio Setti | 40d9ca9 | 2023-01-04 16:08:04 +0100 | [diff] [blame] | 1573 | /* Convert EC's TLS ID to PSA key type. */ |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1574 | #if defined(PSA_WANT_ALG_ECDH) |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1575 | if (mbedtls_ssl_get_psa_curve_info_from_tls_id( |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1576 | named_group, &key_type, &bits) == PSA_SUCCESS) { |
| 1577 | alg = PSA_ALG_ECDH; |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1578 | } |
| 1579 | #endif |
| 1580 | #if defined(PSA_WANT_ALG_FFDH) |
Przemek Stekiel | 75a5a9c | 2023-06-12 11:21:18 +0200 | [diff] [blame] | 1581 | if (mbedtls_ssl_get_psa_ffdh_info_from_tls_id(named_group, &bits, |
| 1582 | &key_type) == PSA_SUCCESS) { |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1583 | alg = PSA_ALG_FFDH; |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1584 | } |
| 1585 | #endif |
| 1586 | |
Przemek Stekiel | 75a5a9c | 2023-06-12 11:21:18 +0200 | [diff] [blame] | 1587 | if (key_type == PSA_KEY_TYPE_NONE) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1588 | return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; |
Valerio Setti | 40d9ca9 | 2023-01-04 16:08:04 +0100 | [diff] [blame] | 1589 | } |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1590 | |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1591 | if (buf_size < PSA_BITS_TO_BYTES(bits)) { |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1592 | return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; |
| 1593 | } |
| 1594 | |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 1595 | handshake->xxdh_psa_type = key_type; |
| 1596 | ssl->handshake->xxdh_bits = bits; |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1597 | |
| 1598 | key_attributes = psa_key_attributes_init(); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1599 | psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); |
Przemek Stekiel | da4fba6 | 2023-06-02 14:52:28 +0200 | [diff] [blame] | 1600 | psa_set_key_algorithm(&key_attributes, alg); |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 1601 | psa_set_key_type(&key_attributes, handshake->xxdh_psa_type); |
| 1602 | psa_set_key_bits(&key_attributes, handshake->xxdh_bits); |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1603 | |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1604 | /* Generate ECDH/FFDH private key. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1605 | status = psa_generate_key(&key_attributes, |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 1606 | &handshake->xxdh_psa_privkey); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1607 | if (status != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 1608 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1609 | MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret); |
| 1610 | return ret; |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1611 | |
| 1612 | } |
| 1613 | |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1614 | /* Export the public part of the ECDH/FFDH private key from PSA. */ |
Przemek Stekiel | 7ac93be | 2023-07-04 10:02:38 +0200 | [diff] [blame] | 1615 | status = psa_export_public_key(handshake->xxdh_psa_privkey, |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1616 | buf, buf_size, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1617 | &own_pubkey_len); |
Przemek Stekiel | 29c219c | 2023-05-31 15:21:04 +0200 | [diff] [blame] | 1618 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1619 | if (status != PSA_SUCCESS) { |
Andrzej Kurek | 8a045ce | 2022-12-23 11:00:06 -0500 | [diff] [blame] | 1620 | ret = PSA_TO_MBEDTLS_ERR(status); |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1621 | MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret); |
| 1622 | return ret; |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1623 | } |
| 1624 | |
| 1625 | *out_len = own_pubkey_len; |
| 1626 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1627 | return 0; |
Jerry Yu | 89e103c | 2022-03-30 22:43:29 +0800 | [diff] [blame] | 1628 | } |
Przemek Stekiel | 6370662 | 2023-05-23 16:31:56 +0200 | [diff] [blame] | 1629 | #endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */ |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 1630 | |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1631 | /* RFC 8446 section 4.2 |
| 1632 | * |
| 1633 | * If an implementation receives an extension which it recognizes and which is |
| 1634 | * not specified for the message in which it appears, it MUST abort the handshake |
| 1635 | * with an "illegal_parameter" alert. |
| 1636 | * |
| 1637 | */ |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 1638 | int mbedtls_ssl_tls13_check_received_extension( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1639 | mbedtls_ssl_context *ssl, |
| 1640 | int hs_msg_type, |
| 1641 | unsigned int received_extension_type, |
| 1642 | uint32_t hs_msg_allowed_extensions_mask) |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1643 | { |
Jerry Yu | df0ad65 | 2022-10-31 13:20:57 +0800 | [diff] [blame] | 1644 | uint32_t extension_mask = mbedtls_ssl_get_extension_mask( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1645 | received_extension_type); |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1646 | |
Jerry Yu | 79aa721 | 2022-11-08 21:30:21 +0800 | [diff] [blame] | 1647 | MBEDTLS_SSL_PRINT_EXT( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1648 | 3, hs_msg_type, received_extension_type, "received"); |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1649 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1650 | if ((extension_mask & hs_msg_allowed_extensions_mask) == 0) { |
Jerry Yu | 79aa721 | 2022-11-08 21:30:21 +0800 | [diff] [blame] | 1651 | MBEDTLS_SSL_PRINT_EXT( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1652 | 3, hs_msg_type, received_extension_type, "is illegal"); |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1653 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 1654 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1655 | MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); |
| 1656 | return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1657 | } |
| 1658 | |
| 1659 | ssl->handshake->received_extensions |= extension_mask; |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 1660 | /* |
| 1661 | * If it is a message containing extension responses, check that we |
| 1662 | * previously sent the extension. |
| 1663 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1664 | switch (hs_msg_type) { |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1665 | case MBEDTLS_SSL_HS_SERVER_HELLO: |
Jerry Yu | df0ad65 | 2022-10-31 13:20:57 +0800 | [diff] [blame] | 1666 | case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST: |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1667 | case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS: |
| 1668 | case MBEDTLS_SSL_HS_CERTIFICATE: |
Jerry Yu | c4bf5d6 | 2022-10-29 09:08:47 +0800 | [diff] [blame] | 1669 | /* Check if the received extension is sent by peer message.*/ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1670 | if ((ssl->handshake->sent_extensions & extension_mask) != 0) { |
| 1671 | return 0; |
| 1672 | } |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1673 | break; |
| 1674 | default: |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1675 | return 0; |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1676 | } |
| 1677 | |
Jerry Yu | 79aa721 | 2022-11-08 21:30:21 +0800 | [diff] [blame] | 1678 | MBEDTLS_SSL_PRINT_EXT( |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1679 | 3, hs_msg_type, received_extension_type, "is unsupported"); |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1680 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 1681 | MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 1682 | MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION); |
| 1683 | return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION; |
Jerry Yu | 0c354a2 | 2022-08-29 15:25:36 +0800 | [diff] [blame] | 1684 | } |
| 1685 | |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1686 | #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) |
Jan Bruckner | 1a38e54 | 2023-03-15 14:15:11 +0100 | [diff] [blame] | 1687 | /* RFC 8449, section 4: |
| 1688 | * |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1689 | * The ExtensionData of the "record_size_limit" extension is |
| 1690 | * RecordSizeLimit: |
| 1691 | * uint16 RecordSizeLimit; |
| 1692 | */ |
| 1693 | MBEDTLS_CHECK_RETURN_CRITICAL |
| 1694 | int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl, |
| 1695 | const unsigned char *buf, |
| 1696 | const unsigned char *end) |
| 1697 | { |
Jan Bruckner | 1a38e54 | 2023-03-15 14:15:11 +0100 | [diff] [blame] | 1698 | const unsigned char *p = buf; |
| 1699 | uint16_t record_size_limit; |
Jan Bruckner | a0589e7 | 2023-03-15 11:04:45 +0100 | [diff] [blame] | 1700 | const size_t extension_data_len = end - buf; |
Jan Bruckner | 1a38e54 | 2023-03-15 14:15:11 +0100 | [diff] [blame] | 1701 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1702 | if (extension_data_len != |
| 1703 | MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH) { |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1704 | MBEDTLS_SSL_DEBUG_MSG(2, |
Jan Bruckner | 1a38e54 | 2023-03-15 14:15:11 +0100 | [diff] [blame] | 1705 | ("record_size_limit extension has invalid length: %" |
| 1706 | MBEDTLS_PRINTF_SIZET " Bytes", |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1707 | extension_data_len)); |
| 1708 | |
| 1709 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 1710 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, |
| 1711 | MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); |
| 1712 | return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; |
| 1713 | } |
| 1714 | |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1715 | MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); |
| 1716 | record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0); |
| 1717 | |
| 1718 | MBEDTLS_SSL_DEBUG_MSG(2, ("RecordSizeLimit: %u Bytes", record_size_limit)); |
| 1719 | |
Jan Bruckner | 1a38e54 | 2023-03-15 14:15:11 +0100 | [diff] [blame] | 1720 | /* RFC 8449, section 4 |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1721 | * |
| 1722 | * Endpoints MUST NOT send a "record_size_limit" extension with a value |
| 1723 | * smaller than 64. An endpoint MUST treat receipt of a smaller value |
| 1724 | * as a fatal error and generate an "illegal_parameter" alert. |
| 1725 | */ |
Jan Bruckner | a0589e7 | 2023-03-15 11:04:45 +0100 | [diff] [blame] | 1726 | if (record_size_limit < MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN) { |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1727 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 1728 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, |
| 1729 | MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); |
| 1730 | return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; |
| 1731 | } |
| 1732 | |
Xiaokang Qian | 7343738 | 2023-03-29 08:24:12 +0000 | [diff] [blame] | 1733 | MBEDTLS_SSL_DEBUG_MSG( |
| 1734 | 2, ("record_size_limit extension is still in development. Aborting handshake.")); |
Jan Bruckner | 151f642 | 2023-02-10 12:45:19 +0100 | [diff] [blame] | 1735 | |
| 1736 | MBEDTLS_SSL_PEND_FATAL_ALERT( |
| 1737 | MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, |
| 1738 | MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION); |
| 1739 | return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION; |
| 1740 | } |
| 1741 | #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */ |
| 1742 | |
Jerry Yu | fb4b647 | 2022-01-27 15:03:26 +0800 | [diff] [blame] | 1743 | #endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */ |