blob: 0331486b8d10277fe7cebd772da2feb372909422 [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
2 * TLS 1.3 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS ( https://tls.mbed.org )
20 */
21
22#include "common.h"
23
Ronald Cron6f135e12021-12-08 16:57:54 +010024#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080025
26#if defined(MBEDTLS_SSL_CLI_C)
27
Jerry Yubc20bdd2021-08-24 15:59:48 +080028#include <string.h>
29
Jerry Yu56fc07f2021-09-01 17:48:49 +080030#include "mbedtls/debug.h"
31#include "mbedtls/error.h"
Jerry Yue1b9c292021-09-10 10:08:31 +080032#include "mbedtls/platform.h"
Jerry Yua13c7e72021-08-17 10:44:40 +080033
Jerry Yubdc71882021-09-14 19:30:36 +080034#include "ssl_misc.h"
35#include "ecdh_misc.h"
Jerry Yue1b9c292021-09-10 10:08:31 +080036#include "ssl_tls13_keys.h"
Gilles Peskine923d5c92021-12-15 12:56:54 +010037#include "ssl_debug_helpers.h"
Jerry Yubdc71882021-09-14 19:30:36 +080038
Jerry Yubc20bdd2021-08-24 15:59:48 +080039/* Write extensions */
40
Jerry Yu92c6b402021-08-27 16:59:09 +080041/*
42 * ssl_tls13_write_supported_versions_ext():
43 *
44 * struct {
45 * ProtocolVersion versions<2..254>;
46 * } SupportedVersions;
47 */
Jerry Yuf4436812021-08-26 22:59:56 +080048static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl,
Jerry Yueecfbf02021-08-30 18:32:07 +080049 unsigned char *buf,
50 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +000051 size_t *out_len )
Jerry Yu92c6b402021-08-27 16:59:09 +080052{
53 unsigned char *p = buf;
54
Xiaofei Baid25fab62021-12-02 06:36:27 +000055 *out_len = 0;
Jerry Yu92c6b402021-08-27 16:59:09 +080056
Jerry Yu159c5a02021-08-31 12:51:25 +080057 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) );
Jerry Yu92c6b402021-08-27 16:59:09 +080058
Jerry Yu388bd0d2021-09-15 18:41:02 +080059 /* Check if we have space to write the extension:
Jerry Yub60e3cf2021-09-08 16:41:02 +080060 * - extension_type (2 bytes)
61 * - extension_data_length (2 bytes)
62 * - versions_length (1 byte )
63 * - versions (2 bytes)
Jerry Yu159c5a02021-08-31 12:51:25 +080064 */
Jerry Yu92c6b402021-08-27 16:59:09 +080065 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
66
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080067 /* Write extension_type */
Jerry Yueecfbf02021-08-30 18:32:07 +080068 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
Jerry Yu92c6b402021-08-27 16:59:09 +080069
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080070 /* Write extension_data_length */
Jerry Yub7ab3362021-08-31 16:16:19 +080071 MBEDTLS_PUT_UINT16_BE( 3, p, 2 );
Jerry Yueecfbf02021-08-30 18:32:07 +080072 p += 4;
Jerry Yu92c6b402021-08-27 16:59:09 +080073
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080074 /* Length of versions */
Jerry Yu92c6b402021-08-27 16:59:09 +080075 *p++ = 0x2;
76
Jerry Yu0c63af62021-09-02 12:59:12 +080077 /* Write values of supported versions.
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080078 *
Jerry Yu0c63af62021-09-02 12:59:12 +080079 * They are defined by the configuration.
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080080 *
Jerry Yu0c63af62021-09-02 12:59:12 +080081 * Currently, only one version is advertised.
Jerry Yu92c6b402021-08-27 16:59:09 +080082 */
Jerry Yueecfbf02021-08-30 18:32:07 +080083 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
84 ssl->conf->max_minor_ver,
85 ssl->conf->transport, p );
Jerry Yu92c6b402021-08-27 16:59:09 +080086
87 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]",
Jerry Yueecfbf02021-08-30 18:32:07 +080088 ssl->conf->max_major_ver,
89 ssl->conf->max_minor_ver ) );
Jerry Yu92c6b402021-08-27 16:59:09 +080090
Xiaofei Baid25fab62021-12-02 06:36:27 +000091 *out_len = 7;
Jerry Yu92c6b402021-08-27 16:59:09 +080092
93 return( 0 );
94}
Jerry Yubc20bdd2021-08-24 15:59:48 +080095
Jerry Yuc068b662021-10-11 22:30:19 +080096static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
97 const unsigned char *buf,
Jerry Yub85277e2021-10-13 13:36:05 +080098 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +080099{
Jerry Yue1b9c292021-09-10 10:08:31 +0800100 ((void) ssl);
101
Jerry Yub85277e2021-10-13 13:36:05 +0800102 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2);
103 if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 ||
Jerry Yue1b9c292021-09-10 10:08:31 +0800104 buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 )
105 {
106 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) );
Jerry Yu4a173382021-10-11 21:45:31 +0800107
108 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
109 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
110 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue1b9c292021-09-10 10:08:31 +0800111 }
112
113 return( 0 );
114}
115
Jerry Yubc20bdd2021-08-24 15:59:48 +0800116#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
117
XiaokangQian16acd4b2022-01-14 07:35:47 +0000118static int ssl_tls13_reset_key_share( mbedtls_ssl_context *ssl )
XiaokangQian647719a2021-12-07 09:16:29 +0000119{
120 uint16_t group_id = ssl->handshake->offered_group_id;
121 if( group_id == 0 )
122 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
123
XiaokangQian355e09a2022-01-20 11:14:50 +0000124#if defined(MBEDTLS_ECDH_C)
XiaokangQian647719a2021-12-07 09:16:29 +0000125 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
XiaokangQian78b1fa72022-01-19 06:56:30 +0000126 {
127 mbedtls_ecdh_free( &ssl->handshake->ecdh_ctx );
128 return( 0 );
129 }
XiaokangQian355e09a2022-01-20 11:14:50 +0000130 else
131#endif /* MBEDTLS_ECDH_C */
132 if( 0 /* other KEMs? */ )
XiaokangQian647719a2021-12-07 09:16:29 +0000133 {
134 /* Do something */
135 }
136
137 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
138}
139
140/*
Jerry Yu56fc07f2021-09-01 17:48:49 +0800141 * Functions for writing key_share extension.
142 */
143#if defined(MBEDTLS_ECDH_C)
Jerry Yu7c522d42021-09-08 17:55:09 +0800144static int ssl_tls13_generate_and_write_ecdh_key_exchange(
Jerry Yub60e3cf2021-09-08 16:41:02 +0800145 mbedtls_ssl_context *ssl,
Jerry Yub60e3cf2021-09-08 16:41:02 +0800146 unsigned char *buf,
147 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000148 size_t *out_len )
Jerry Yu92c6b402021-08-27 16:59:09 +0800149{
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100150 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
151 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
152 psa_key_attributes_t key_attributes;
153 unsigned char own_pubkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH];
154 size_t own_pubkey_len;
155 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800156
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100157 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Perform PSA-based ECDH computation." ) );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800158
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100159 key_attributes = psa_key_attributes_init();
160 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
161 psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH );
162 psa_set_key_type( &key_attributes, handshake->ecdh_psa_type );
163 psa_set_key_bits( &key_attributes, handshake->ecdh_bits );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800164
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100165 /* Generate ECDH private key. */
166 status = psa_generate_key( &key_attributes,
167 &handshake->ecdh_psa_privkey );
168 if( status != PSA_SUCCESS )
169 {
170 ret = psa_ssl_status_to_mbedtls( status );
171 MBEDTLS_SSL_DEBUG_RET( 1, "psa_generate_key", ret );
172 return( ret );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800173
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100174 }
Jerry Yu56fc07f2021-09-01 17:48:49 +0800175
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100176 /* Export the public part of the ECDH private key from PSA. */
177 status = psa_export_public_key( handshake->ecdh_psa_privkey,
178 own_pubkey, sizeof( own_pubkey ),
179 &own_pubkey_len );
180 if( status != PSA_SUCCESS )
181 {
182 ret = psa_ssl_status_to_mbedtls( status );
183 MBEDTLS_SSL_DEBUG_RET( 1, "psa_export_public_key", ret );
184 return( ret );
185
186 }
187
188 if( own_pubkey_len > (size_t)( end - buf ) )
189 {
190 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No space in the buffer for ECDH public key." ) );
191 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
192 }
193
194 *out_len = own_pubkey_len;
195
196 memcpy( buf, &own_pubkey, own_pubkey_len );
197
Jerry Yu75336352021-09-01 15:59:36 +0800198 return( 0 );
Jerry Yu92c6b402021-08-27 16:59:09 +0800199}
Jerry Yu56fc07f2021-09-01 17:48:49 +0800200#endif /* MBEDTLS_ECDH_C */
201
Jerry Yub60e3cf2021-09-08 16:41:02 +0800202static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl,
203 uint16_t *group_id )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800204{
205 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
206
Jerry Yu56fc07f2021-09-01 17:48:49 +0800207
Jerry Yu56fc07f2021-09-01 17:48:49 +0800208#if defined(MBEDTLS_ECDH_C)
Brett Warren14efd332021-10-06 09:32:11 +0100209 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Jerry Yu388bd0d2021-09-15 18:41:02 +0800210 /* Pick first available ECDHE group compatible with TLS 1.3 */
Brett Warren14efd332021-10-06 09:32:11 +0100211 if( group_list == NULL )
Jerry Yu388bd0d2021-09-15 18:41:02 +0800212 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
213
Brett Warren14efd332021-10-06 09:32:11 +0100214 for ( ; *group_list != 0; group_list++ )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800215 {
Xiaofei Baieef15042021-11-18 07:29:56 +0000216 const mbedtls_ecp_curve_info *curve_info;
217 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
218 if( curve_info != NULL &&
Brett Warren14efd332021-10-06 09:32:11 +0100219 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800220 {
Brett Warren14efd332021-10-06 09:32:11 +0100221 *group_id = *group_list;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800222 return( 0 );
223 }
224 }
225#else
226 ((void) ssl);
Jerry Yub60e3cf2021-09-08 16:41:02 +0800227 ((void) group_id);
Jerry Yu56fc07f2021-09-01 17:48:49 +0800228#endif /* MBEDTLS_ECDH_C */
229
230 /*
231 * Add DHE named groups here.
Jerry Yu388bd0d2021-09-15 18:41:02 +0800232 * Pick first available DHE group compatible with TLS 1.3
Jerry Yu56fc07f2021-09-01 17:48:49 +0800233 */
234
235 return( ret );
236}
237
238/*
239 * ssl_tls13_write_key_share_ext
240 *
Jerry Yu388bd0d2021-09-15 18:41:02 +0800241 * Structure of key_share extension in ClientHello:
Jerry Yu56fc07f2021-09-01 17:48:49 +0800242 *
243 * struct {
244 * NamedGroup group;
245 * opaque key_exchange<1..2^16-1>;
246 * } KeyShareEntry;
247 * struct {
248 * KeyShareEntry client_shares<0..2^16-1>;
249 * } KeyShareClientHello;
250 */
251static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
252 unsigned char *buf,
253 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000254 size_t *out_len )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800255{
256 unsigned char *p = buf;
Xiaofei Baieef15042021-11-18 07:29:56 +0000257 unsigned char *client_shares; /* Start of client_shares */
258 size_t client_shares_len; /* Length of client_shares */
Jerry Yu56fc07f2021-09-01 17:48:49 +0800259 uint16_t group_id;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800260 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
261
Xiaofei Baid25fab62021-12-02 06:36:27 +0000262 *out_len = 0;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800263
Jerry Yub60e3cf2021-09-08 16:41:02 +0800264 /* Check if we have space for header and length fields:
Jerry Yu56fc07f2021-09-01 17:48:49 +0800265 * - extension_type (2 bytes)
266 * - extension_data_length (2 bytes)
267 * - client_shares_length (2 bytes)
268 */
269 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
270 p += 6;
271
272 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) );
273
274 /* HRR could already have requested something else. */
275 group_id = ssl->handshake->offered_group_id;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800276 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) &&
277 !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800278 {
Jerry Yub60e3cf2021-09-08 16:41:02 +0800279 MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl,
Jerry Yu56fc07f2021-09-01 17:48:49 +0800280 &group_id ) );
281 }
282
283 /*
284 * Dispatch to type-specific key generation function.
285 *
286 * So far, we're only supporting ECDHE. With the introduction
287 * of PQC KEMs, we'll want to have multiple branches, one per
288 * type of KEM, and dispatch to the corresponding crypto. And
289 * only one key share entry is allowed.
290 */
Xiaofei Baieef15042021-11-18 07:29:56 +0000291 client_shares = p;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800292#if defined(MBEDTLS_ECDH_C)
Jerry Yub60e3cf2021-09-08 16:41:02 +0800293 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800294 {
Jerry Yu388bd0d2021-09-15 18:41:02 +0800295 /* Pointer to group */
Xiaofei Baieef15042021-11-18 07:29:56 +0000296 unsigned char *group = p;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800297 /* Length of key_exchange */
298 size_t key_exchange_len;
299
300 /* Check there is space for header of KeyShareEntry
301 * - group (2 bytes)
302 * - key_exchange_length (2 bytes)
303 */
304 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
305 p += 4;
Przemyslaw Stekielb1b1f362022-02-10 10:19:46 +0100306 ret = ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, p, end,
Jerry Yub60e3cf2021-09-08 16:41:02 +0800307 &key_exchange_len );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800308 p += key_exchange_len;
309 if( ret != 0 )
310 return( ret );
311
312 /* Write group */
Xiaofei Baieef15042021-11-18 07:29:56 +0000313 MBEDTLS_PUT_UINT16_BE( group_id, group, 0 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800314 /* Write key_exchange_length */
Xiaofei Baieef15042021-11-18 07:29:56 +0000315 MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800316 }
317 else
318#endif /* MBEDTLS_ECDH_C */
319 if( 0 /* other KEMs? */ )
320 {
321 /* Do something */
322 }
323 else
324 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
325
Jerry Yub60e3cf2021-09-08 16:41:02 +0800326 /* Length of client_shares */
Xiaofei Baieef15042021-11-18 07:29:56 +0000327 client_shares_len = p - client_shares;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800328 if( client_shares_len == 0)
329 {
330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) );
331 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu7c522d42021-09-08 17:55:09 +0800332 }
Jerry Yu56fc07f2021-09-01 17:48:49 +0800333 /* Write extension_type */
334 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
335 /* Write extension_data_length */
Jerry Yub60e3cf2021-09-08 16:41:02 +0800336 MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800337 /* Write client_shares_length */
Jerry Yub60e3cf2021-09-08 16:41:02 +0800338 MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800339
340 /* Update offered_group_id field */
341 ssl->handshake->offered_group_id = group_id;
342
343 /* Output the total length of key_share extension. */
Xiaofei Baid25fab62021-12-02 06:36:27 +0000344 *out_len = p - buf;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800345
Xiaofei Baid25fab62021-12-02 06:36:27 +0000346 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800347
348 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
349
350cleanup:
351
352 return( ret );
353}
Jerry Yubc20bdd2021-08-24 15:59:48 +0800354
Jerry Yue1b9c292021-09-10 10:08:31 +0800355#if defined(MBEDTLS_ECDH_C)
356
Jerry Yuc068b662021-10-11 22:30:19 +0800357static int ssl_tls13_read_public_ecdhe_share( mbedtls_ssl_context *ssl,
358 const unsigned char *buf,
359 size_t buf_len )
Jerry Yue1b9c292021-09-10 10:08:31 +0800360{
361 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielf008ae72022-02-10 10:32:02 +0100362 uint8_t ecpoint_len;
363 uint8_t *p = (uint8_t*)buf;
364 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yue1b9c292021-09-10 10:08:31 +0800365
Przemyslaw Stekielf008ae72022-02-10 10:32:02 +0100366 /*
367 * Put peer's ECDH public key in the format understood by PSA.
368 */
369
370 ecpoint_len = *p++;
371 if( ( buf_len - 1 ) < ecpoint_len )
372 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
373
374 if ( ( ret = mbedtls_psa_tls_ecpoint_to_psa_ec( p,
375 ecpoint_len, handshake->ecdh_psa_peerkey,
376 sizeof( handshake->ecdh_psa_peerkey ),
377 &handshake->ecdh_psa_peerkey_len ) ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800378 {
Przemyslaw Stekielf008ae72022-02-10 10:32:02 +0100379 return( ret );
Jerry Yue1b9c292021-09-10 10:08:31 +0800380 }
381
382 return( 0 );
383}
Jerry Yu4a173382021-10-11 21:45:31 +0800384#endif /* MBEDTLS_ECDH_C */
Jerry Yue1b9c292021-09-10 10:08:31 +0800385
XiaokangQiand59be772022-01-24 10:12:51 +0000386/*
387 * ssl_tls13_parse_hrr_key_share_ext()
388 * Parse key_share extension in Hello Retry Request
389 *
390 * struct {
391 * NamedGroup selected_group;
392 * } KeyShareHelloRetryRequest;
393 */
XiaokangQiand9e068e2022-01-18 06:23:32 +0000394static int ssl_tls13_parse_hrr_key_share_ext( mbedtls_ssl_context *ssl,
XiaokangQianb851da82022-01-14 04:03:11 +0000395 const unsigned char *buf,
396 const unsigned char *end )
397{
XiaokangQianb851da82022-01-14 04:03:11 +0000398 const mbedtls_ecp_curve_info *curve_info = NULL;
399 const unsigned char *p = buf;
XiaokangQiand59be772022-01-24 10:12:51 +0000400 int selected_group;
XiaokangQianb851da82022-01-14 04:03:11 +0000401 int found = 0;
402
403 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
404 if( group_list == NULL )
405 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
406
407 MBEDTLS_SSL_DEBUG_BUF( 3, "key_share extension", p, end - buf );
408
409 /* Read selected_group */
XiaokangQianb48894e2022-01-17 02:05:52 +0000410 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQiand59be772022-01-24 10:12:51 +0000411 selected_group = MBEDTLS_GET_UINT16_BE( p, 0 );
412 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected_group ( %d )", selected_group ) );
XiaokangQianb851da82022-01-14 04:03:11 +0000413
414 /* Upon receipt of this extension in a HelloRetryRequest, the client
415 * MUST first verify that the selected_group field corresponds to a
416 * group which was provided in the "supported_groups" extension in the
417 * original ClientHello.
418 * The supported_group was based on the info in ssl->conf->group_list.
419 *
420 * If the server provided a key share that was not sent in the ClientHello
421 * then the client MUST abort the handshake with an "illegal_parameter" alert.
422 */
XiaokangQiand9e068e2022-01-18 06:23:32 +0000423 for( ; *group_list != 0; group_list++ )
XiaokangQianb851da82022-01-14 04:03:11 +0000424 {
425 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
XiaokangQiand59be772022-01-24 10:12:51 +0000426 if( curve_info == NULL || curve_info->tls_id != selected_group )
XiaokangQianb851da82022-01-14 04:03:11 +0000427 continue;
428
429 /* We found a match */
430 found = 1;
431 break;
432 }
433
434 /* Client MUST verify that the selected_group field does not
435 * correspond to a group which was provided in the "key_share"
436 * extension in the original ClientHello. If the server sent an
437 * HRR message with a key share already provided in the
438 * ClientHello then the client MUST abort the handshake with
439 * an "illegal_parameter" alert.
440 */
XiaokangQiand59be772022-01-24 10:12:51 +0000441 if( found == 0 || selected_group == ssl->handshake->offered_group_id )
XiaokangQianb851da82022-01-14 04:03:11 +0000442 {
443 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid key share in HRR" ) );
444 MBEDTLS_SSL_PEND_FATAL_ALERT(
445 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
446 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
447 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
448 }
449
450 /* Remember server's preference for next ClientHello */
XiaokangQiand59be772022-01-24 10:12:51 +0000451 ssl->handshake->offered_group_id = selected_group;
XiaokangQianb851da82022-01-14 04:03:11 +0000452
453 return( 0 );
454}
455
Jerry Yue1b9c292021-09-10 10:08:31 +0800456/*
Jerry Yub85277e2021-10-13 13:36:05 +0800457 * ssl_tls13_parse_key_share_ext()
458 * Parse key_share extension in Server Hello
459 *
Jerry Yue1b9c292021-09-10 10:08:31 +0800460 * struct {
461 * KeyShareEntry server_share;
462 * } KeyShareServerHello;
463 * struct {
464 * NamedGroup group;
465 * opaque key_exchange<1..2^16-1>;
466 * } KeyShareEntry;
467 */
Jerry Yu4a173382021-10-11 21:45:31 +0800468static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl,
Jerry Yue1b9c292021-09-10 10:08:31 +0800469 const unsigned char *buf,
470 const unsigned char *end )
471{
Jerry Yub85277e2021-10-13 13:36:05 +0800472 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800473 const unsigned char *p = buf;
Jerry Yu4a173382021-10-11 21:45:31 +0800474 uint16_t group, offered_group;
Jerry Yue1b9c292021-09-10 10:08:31 +0800475
Jerry Yu4a173382021-10-11 21:45:31 +0800476 /* ...
477 * NamedGroup group; (2 bytes)
478 * ...
479 */
480 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
481 group = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yue1b9c292021-09-10 10:08:31 +0800482 p += 2;
483
Jerry Yu4a173382021-10-11 21:45:31 +0800484 /* Check that the chosen group matches the one we offered. */
Jerry Yue1b9c292021-09-10 10:08:31 +0800485 offered_group = ssl->handshake->offered_group_id;
Jerry Yu4a173382021-10-11 21:45:31 +0800486 if( offered_group != group )
Jerry Yue1b9c292021-09-10 10:08:31 +0800487 {
488 MBEDTLS_SSL_DEBUG_MSG( 1,
489 ( "Invalid server key share, our group %u, their group %u",
Jerry Yu4a173382021-10-11 21:45:31 +0800490 (unsigned) offered_group, (unsigned) group ) );
491 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
492 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
493 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Jerry Yue1b9c292021-09-10 10:08:31 +0800494 }
495
496#if defined(MBEDTLS_ECDH_C)
Jerry Yu4a173382021-10-11 21:45:31 +0800497 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
Jerry Yue1b9c292021-09-10 10:08:31 +0800498 {
499 /* Complete ECDHE key agreement */
Jerry Yuc068b662021-10-11 22:30:19 +0800500 ret = ssl_tls13_read_public_ecdhe_share( ssl, p, end - p );
Jerry Yue1b9c292021-09-10 10:08:31 +0800501 if( ret != 0 )
502 return( ret );
503 }
Jerry Yub85277e2021-10-13 13:36:05 +0800504 else
Jerry Yue1b9c292021-09-10 10:08:31 +0800505#endif /* MBEDTLS_ECDH_C */
Jerry Yub85277e2021-10-13 13:36:05 +0800506 if( 0 /* other KEMs? */ )
Jerry Yue1b9c292021-09-10 10:08:31 +0800507 {
508 /* Do something */
509 }
510 else
511 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
512
513 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
514 return( ret );
515}
516
Jerry Yubc20bdd2021-08-24 15:59:48 +0800517#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
518
XiaokangQiand59be772022-01-24 10:12:51 +0000519/*
520 * ssl_tls13_parse_cookie_ext()
521 * Parse cookie extension in Hello Retry Request
522 *
523 * struct {
524 * opaque cookie<1..2^16-1>;
525 * } Cookie;
526 *
527 * When sending a HelloRetryRequest, the server MAY provide a "cookie"
528 * extension to the client (this is an exception to the usual rule that
529 * the only extensions that may be sent are those that appear in the
530 * ClientHello). When sending the new ClientHello, the client MUST copy
531 * the contents of the extension received in the HelloRetryRequest into
532 * a "cookie" extension in the new ClientHello. Clients MUST NOT use
533 * cookies in their initial ClientHello in subsequent connections.
534 */
XiaokangQian43550bd2022-01-21 04:32:58 +0000535static int ssl_tls13_parse_cookie_ext( mbedtls_ssl_context *ssl,
536 const unsigned char *buf,
537 const unsigned char *end )
538{
539 size_t cookie_len;
540 const unsigned char *p = buf;
541 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
542
543 /* Retrieve length field of cookie */
544 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
545 cookie_len = MBEDTLS_GET_UINT16_BE( p, 0 );
546 p += 2;
547
548 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cookie_len );
549 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie extension", p, cookie_len );
550
551 mbedtls_free( handshake->verify_cookie );
XiaokangQian34909742022-01-27 02:25:04 +0000552 handshake->verify_cookie_len = 0;
XiaokangQian43550bd2022-01-21 04:32:58 +0000553 handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
554 if( handshake->verify_cookie == NULL )
555 {
556 MBEDTLS_SSL_DEBUG_MSG( 1,
557 ( "alloc failed ( %" MBEDTLS_PRINTF_SIZET " bytes )",
558 cookie_len ) );
559 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
560 }
561
562 memcpy( handshake->verify_cookie, p, cookie_len );
563 handshake->verify_cookie_len = (unsigned char) cookie_len;
564
565 return( 0 );
566}
XiaokangQian43550bd2022-01-21 04:32:58 +0000567
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800568/* Write cipher_suites
Jerry Yu6a643102021-08-31 14:40:36 +0800569 * CipherSuite cipher_suites<2..2^16-2>;
570 */
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800571static int ssl_tls13_write_client_hello_cipher_suites(
Jerry Yu6a643102021-08-31 14:40:36 +0800572 mbedtls_ssl_context *ssl,
573 unsigned char *buf,
574 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000575 size_t *out_len )
Jerry Yu6a643102021-08-31 14:40:36 +0800576{
Jerry Yufec982e2021-09-07 17:26:06 +0800577 unsigned char *p = buf;
Jerry Yu0c63af62021-09-02 12:59:12 +0800578 const int *ciphersuite_list;
Xiaofei Baieef15042021-11-18 07:29:56 +0000579 unsigned char *cipher_suites; /* Start of the cipher_suites list */
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800580 size_t cipher_suites_len;
Jerry Yu92c6b402021-08-27 16:59:09 +0800581
Xiaofei Baid25fab62021-12-02 06:36:27 +0000582 *out_len = 0 ;
Jerry Yu6a643102021-08-31 14:40:36 +0800583
584 /*
585 * Ciphersuite list
586 *
587 * This is a list of the symmetric cipher options supported by
588 * the client, specifically the record protection algorithm
589 * ( including secret key length ) and a hash to be used with
590 * HKDF, in descending order of client preference.
591 */
Jerry Yu0c63af62021-09-02 12:59:12 +0800592 ciphersuite_list = ssl->conf->ciphersuite_list;
Jerry Yu6a643102021-08-31 14:40:36 +0800593
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800594 /* Check there is space for the cipher suite list length (2 bytes). */
Jerry Yu4e388282021-09-06 21:28:08 +0800595 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
596 p += 2;
Jerry Yu6a643102021-08-31 14:40:36 +0800597
Jerry Yu0c63af62021-09-02 12:59:12 +0800598 /* Write cipher_suites */
Xiaofei Baieef15042021-11-18 07:29:56 +0000599 cipher_suites = p;
Jerry Yu0c63af62021-09-02 12:59:12 +0800600 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
Jerry Yu6a643102021-08-31 14:40:36 +0800601 {
Jerry Yu0c63af62021-09-02 12:59:12 +0800602 int cipher_suite = ciphersuite_list[i];
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800603 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu6a643102021-08-31 14:40:36 +0800604
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800605 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
Jerry Yu6a643102021-08-31 14:40:36 +0800606 if( ciphersuite_info == NULL )
607 continue;
Jerry Yudbfb7bd2021-09-04 09:58:58 +0800608 if( !( MBEDTLS_SSL_MINOR_VERSION_4 >= ciphersuite_info->min_minor_ver &&
609 MBEDTLS_SSL_MINOR_VERSION_4 <= ciphersuite_info->max_minor_ver ) )
Jerry Yu6a643102021-08-31 14:40:36 +0800610 continue;
611
612 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800613 (unsigned int) cipher_suite,
Jerry Yu6a643102021-08-31 14:40:36 +0800614 ciphersuite_info->name ) );
615
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800616 /* Check there is space for the cipher suite identifier (2 bytes). */
Jerry Yubbe09522021-09-06 21:17:54 +0800617 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
618 MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
619 p += 2;
Jerry Yu6a643102021-08-31 14:40:36 +0800620 }
621
Jerry Yu0c63af62021-09-02 12:59:12 +0800622 /* Write the cipher_suites length in number of bytes */
Xiaofei Baieef15042021-11-18 07:29:56 +0000623 cipher_suites_len = p - cipher_suites;
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800624 MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
Jerry Yu6a643102021-08-31 14:40:36 +0800625 MBEDTLS_SSL_DEBUG_MSG( 3,
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800626 ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
627 cipher_suites_len/2 ) );
Jerry Yu6a643102021-08-31 14:40:36 +0800628
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800629 /* Output the total length of cipher_suites field. */
Xiaofei Baid25fab62021-12-02 06:36:27 +0000630 *out_len = p - buf;
Jerry Yuf171e832021-08-31 18:31:09 +0800631
Jerry Yu6a643102021-08-31 14:40:36 +0800632 return( 0 );
633}
634
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800635/*
636 * Structure of ClientHello message:
637 *
638 * struct {
639 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
640 * Random random;
641 * opaque legacy_session_id<0..32>;
642 * CipherSuite cipher_suites<2..2^16-2>;
643 * opaque legacy_compression_methods<1..2^8-1>;
644 * Extension extensions<8..2^16-1>;
645 * } ClientHello;
646 */
Jerry Yu08906d02021-08-31 11:05:27 +0800647static int ssl_tls13_write_client_hello_body( mbedtls_ssl_context *ssl,
Jerry Yueecfbf02021-08-30 18:32:07 +0800648 unsigned char *buf,
Jerry Yuef387d72021-09-02 13:59:41 +0800649 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000650 size_t *out_len )
Jerry Yu65dd2cc2021-08-18 16:38:40 +0800651{
Jerry Yubc20bdd2021-08-24 15:59:48 +0800652
Jerry Yubc20bdd2021-08-24 15:59:48 +0800653 int ret;
Xiaofei Baieef15042021-11-18 07:29:56 +0000654 unsigned char *p_extensions_len; /* Pointer to extensions length */
655 size_t output_len; /* Length of buffer used by function */
656 size_t extensions_len; /* Length of the list of extensions*/
Jerry Yubc20bdd2021-08-24 15:59:48 +0800657
Jerry Yubc20bdd2021-08-24 15:59:48 +0800658 /* Buffer management */
Jerry Yubbe09522021-09-06 21:17:54 +0800659 unsigned char *p = buf;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800660
Xiaofei Baid25fab62021-12-02 06:36:27 +0000661 *out_len = 0;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800662
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800663 /* No validation needed here. It has been done by ssl_conf_check() */
Jerry Yubc20bdd2021-08-24 15:59:48 +0800664 ssl->major_ver = ssl->conf->min_major_ver;
665 ssl->minor_ver = ssl->conf->min_minor_ver;
666
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800667 /*
668 * Write legacy_version
Jerry Yu6a643102021-08-31 14:40:36 +0800669 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800670 *
671 * For TLS 1.3 we use the legacy version number {0x03, 0x03}
Jerry Yubc20bdd2021-08-24 15:59:48 +0800672 * instead of the true version number.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800673 */
Jerry Yufec982e2021-09-07 17:26:06 +0800674 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Jerry Yubbe09522021-09-06 21:17:54 +0800675 MBEDTLS_PUT_UINT16_BE( 0x0303, p, 0 );
Jerry Yufec982e2021-09-07 17:26:06 +0800676 p += 2;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800677
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800678 /* Write the random bytes ( random ).*/
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800679 MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
680 memcpy( p, ssl->handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
Jerry Yue885b762021-08-26 17:32:34 +0800681 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800682 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
683 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800684
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800685 /*
686 * Write legacy_session_id
687 *
688 * Versions of TLS before TLS 1.3 supported a "session resumption" feature
689 * which has been merged with pre-shared keys in this version. A client
690 * which has a cached session ID set by a pre-TLS 1.3 server SHOULD set
691 * this field to that value. In compatibility mode, this field MUST be
692 * non-empty, so a client not offering a pre-TLS 1.3 session MUST generate
693 * a new 32-byte value. This value need not be random but SHOULD be
694 * unpredictable to avoid implementations fixating on a specific value
695 * ( also known as ossification ). Otherwise, it MUST be set as a zero-length
696 * vector ( i.e., a zero-valued single byte length field ).
Jerry Yubc20bdd2021-08-24 15:59:48 +0800697 */
Ronald Cron49ad6192021-11-24 16:25:31 +0100698#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
699 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
700 *p++ = (unsigned char)ssl->session_negotiate->id_len;
701 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
702 p += ssl->session_negotiate->id_len;
703
704 MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
705 ssl->session_negotiate->id_len );
706#else
Jerry Yubbe09522021-09-06 21:17:54 +0800707 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
708 *p++ = 0; /* session id length set to zero */
Ronald Cron49ad6192021-11-24 16:25:31 +0100709#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yubc20bdd2021-08-24 15:59:48 +0800710
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800711 /* Write cipher_suites */
Jerry Yubbe09522021-09-06 21:17:54 +0800712 ret = ssl_tls13_write_client_hello_cipher_suites( ssl, p, end, &output_len );
Jerry Yudbfb7bd2021-09-04 09:58:58 +0800713 if( ret != 0 )
Jerry Yu6a643102021-08-31 14:40:36 +0800714 return( ret );
Jerry Yubbe09522021-09-06 21:17:54 +0800715 p += output_len;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800716
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800717 /* Write legacy_compression_methods
718 *
719 * For every TLS 1.3 ClientHello, this vector MUST contain exactly
Jerry Yubc20bdd2021-08-24 15:59:48 +0800720 * one byte set to zero, which corresponds to the 'null' compression
721 * method in prior versions of TLS.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800722 */
Jerry Yubbe09522021-09-06 21:17:54 +0800723 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
724 *p++ = 1;
725 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800726
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800727 /* Write extensions */
728
729 /* Keeping track of the included extensions */
730 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800731
732 /* First write extensions, then the total length */
Jerry Yubbe09522021-09-06 21:17:54 +0800733 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Xiaofei Baieef15042021-11-18 07:29:56 +0000734 p_extensions_len = p;
Jerry Yubbe09522021-09-06 21:17:54 +0800735 p += 2;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800736
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800737 /* Write supported_versions extension
Jerry Yubc20bdd2021-08-24 15:59:48 +0800738 *
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800739 * Supported Versions Extension is mandatory with TLS 1.3.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800740 */
Jerry Yubbe09522021-09-06 21:17:54 +0800741 ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &output_len );
Jerry Yu92c6b402021-08-27 16:59:09 +0800742 if( ret != 0 )
743 return( ret );
Jerry Yubbe09522021-09-06 21:17:54 +0800744 p += output_len;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800745
746#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yubc20bdd2021-08-24 15:59:48 +0800747
Jerry Yub925f212022-01-12 11:17:02 +0800748 /*
749 * Add the extensions related to (EC)DHE ephemeral key establishment only if
750 * enabled as per the configuration.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800751 */
Jerry Yuf46b0162022-01-11 16:28:00 +0800752 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
753 {
754 ret = mbedtls_ssl_write_supported_groups_ext( ssl, p, end, &output_len );
755 if( ret != 0 )
756 return( ret );
757 p += output_len;
Jerry Yu6a643102021-08-31 14:40:36 +0800758
Jerry Yuf46b0162022-01-11 16:28:00 +0800759 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &output_len );
760 if( ret != 0 )
761 return( ret );
762 p += output_len;
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800763
Jerry Yuf017ee42022-01-12 15:49:48 +0800764 ret = mbedtls_ssl_write_sig_alg_ext( ssl, p, end, &output_len );
Jerry Yuf46b0162022-01-11 16:28:00 +0800765 if( ret != 0 )
766 return( ret );
767 p += output_len;
768 }
Jerry Yubc20bdd2021-08-24 15:59:48 +0800769#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
770
Xiaofei Bai15a56812021-11-05 10:52:12 +0000771#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaofei Bai58afdba2021-11-09 03:10:05 +0000772 /* Write server name extension */
Xiaofei Bai15a56812021-11-05 10:52:12 +0000773 ret = mbedtls_ssl_write_hostname_ext( ssl, p, end, &output_len );
774 if( ret != 0 )
775 return( ret );
776 p += output_len;
777#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
778
Jerry Yubc20bdd2021-08-24 15:59:48 +0800779 /* Add more extensions here */
780
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800781 /* Write the length of the list of extensions. */
Xiaofei Baieef15042021-11-18 07:29:56 +0000782 extensions_len = p - p_extensions_len - 2;
783 MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
Jerry Yubc20bdd2021-08-24 15:59:48 +0800784 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" MBEDTLS_PRINTF_SIZET ,
Jerry Yu790656a2021-09-01 15:51:48 +0800785 extensions_len ) );
Xiaofei Baieef15042021-11-18 07:29:56 +0000786 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p_extensions_len, extensions_len );
Jerry Yubc20bdd2021-08-24 15:59:48 +0800787
Xiaofei Baid25fab62021-12-02 06:36:27 +0000788 *out_len = p - buf;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800789 return( 0 );
790}
791
Jerry Yu335aca92021-09-12 20:18:56 +0800792static int ssl_tls13_finalize_client_hello( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +0800793{
Jerry Yu92c6b402021-08-27 16:59:09 +0800794 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
795 return( 0 );
796}
Jerry Yuef6b36b2021-08-24 16:29:02 +0800797
Jerry Yu92c6b402021-08-27 16:59:09 +0800798static int ssl_tls13_prepare_client_hello( mbedtls_ssl_context *ssl )
799{
800 int ret;
Jerry Yuef6b36b2021-08-24 16:29:02 +0800801
Jerry Yu92c6b402021-08-27 16:59:09 +0800802 if( ssl->conf->f_rng == NULL )
803 {
804 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
805 return( MBEDTLS_ERR_SSL_NO_RNG );
806 }
Jerry Yuef6b36b2021-08-24 16:29:02 +0800807
Jerry Yu92c6b402021-08-27 16:59:09 +0800808 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
809 ssl->handshake->randbytes,
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800810 MBEDTLS_CLIENT_HELLO_RANDOM_LEN ) ) != 0 )
Jerry Yu92c6b402021-08-27 16:59:09 +0800811 {
Jerry Yu8c02bb42021-09-03 21:09:22 +0800812 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
Jerry Yu92c6b402021-08-27 16:59:09 +0800813 return( ret );
814 }
Jerry Yu6f13f642021-08-26 17:18:15 +0800815
Ronald Cron49ad6192021-11-24 16:25:31 +0100816#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
817 /*
818 * Create a session identifier for the purpose of middlebox compatibility
819 * only if one has not been created already.
820 */
821 if( ssl->session_negotiate->id_len == 0 )
822 {
823 /* Creating a session id with 32 byte length */
824 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
825 ssl->session_negotiate->id, 32 ) ) != 0 )
826 {
827 MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
828 return( ret );
829 }
830 ssl->session_negotiate->id_len = 32;
831 }
832#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
833
Jerry Yu6f13f642021-08-26 17:18:15 +0800834 return( 0 );
Jerry Yubc20bdd2021-08-24 15:59:48 +0800835}
836
Jerry Yu92c6b402021-08-27 16:59:09 +0800837/*
Jerry Yu159c5a02021-08-31 12:51:25 +0800838 * Write ClientHello handshake message.
Jerry Yu687101b2021-09-14 16:03:56 +0800839 * Handler for MBEDTLS_SSL_CLIENT_HELLO
Jerry Yu92c6b402021-08-27 16:59:09 +0800840 */
841static int ssl_tls13_write_client_hello( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +0800842{
Jerry Yu92c6b402021-08-27 16:59:09 +0800843 int ret = 0;
844 unsigned char *buf;
845 size_t buf_len, msg_len;
846
847 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
848
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800849 MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_client_hello( ssl ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800850
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800851 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_start_handshake_msg(
852 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
853 &buf, &buf_len ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800854
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800855 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_client_hello_body( ssl, buf,
Jerry Yuef387d72021-09-02 13:59:41 +0800856 buf + buf_len,
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800857 &msg_len ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800858
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800859 mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl,
860 MBEDTLS_SSL_HS_CLIENT_HELLO,
Jerry Yu0c63af62021-09-02 12:59:12 +0800861 msg_len );
862 ssl->handshake->update_checksum( ssl, buf, msg_len );
Jerry Yu92c6b402021-08-27 16:59:09 +0800863
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800864 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_client_hello( ssl ) );
865 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_finish_handshake_msg( ssl,
866 buf_len,
867 msg_len ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800868
869cleanup:
870
871 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
872 return ret;
Jerry Yu65dd2cc2021-08-18 16:38:40 +0800873}
874
Jerry Yu687101b2021-09-14 16:03:56 +0800875/*
Jerry Yu4a173382021-10-11 21:45:31 +0800876 * Functions for parsing and processing Server Hello
Jerry Yue1b9c292021-09-10 10:08:31 +0800877 */
Jerry Yu7a186a02021-10-15 18:46:14 +0800878/* Returns a negative value on failure, and otherwise
Jerry Yub85277e2021-10-13 13:36:05 +0800879 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
880 * - SSL_SERVER_HELLO_COORDINATE_HRR
XiaokangQian51eff222021-12-10 10:33:56 +0000881 * to indicate which message is expected and to be parsed next.
882 */
Jerry Yub85277e2021-10-13 13:36:05 +0800883#define SSL_SERVER_HELLO_COORDINATE_HELLO 0
884#define SSL_SERVER_HELLO_COORDINATE_HRR 1
885static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl,
886 const unsigned char *buf,
887 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800888{
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800889 static const unsigned char magic_hrr_string[MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
Jerry Yue1b9c292021-09-10 10:08:31 +0800890 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
891 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
892 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
893 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33 ,0x9C };
894
895 /* Check whether this message is a HelloRetryRequest ( HRR ) message.
896 *
Jerry Yu4a173382021-10-11 21:45:31 +0800897 * Server Hello and HRR are only distinguished by Random set to the
Jerry Yue1b9c292021-09-10 10:08:31 +0800898 * special value of the SHA-256 of "HelloRetryRequest".
899 *
900 * struct {
901 * ProtocolVersion legacy_version = 0x0303;
902 * Random random;
903 * opaque legacy_session_id_echo<0..32>;
904 * CipherSuite cipher_suite;
905 * uint8 legacy_compression_method = 0;
Jerry Yub85277e2021-10-13 13:36:05 +0800906 * Extension extensions<6..2^16-1>;
Jerry Yue1b9c292021-09-10 10:08:31 +0800907 * } ServerHello;
908 *
909 */
Jerry Yub85277e2021-10-13 13:36:05 +0800910 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 + sizeof( magic_hrr_string ) );
Jerry Yu4a173382021-10-11 21:45:31 +0800911
912 if( memcmp( buf + 2, magic_hrr_string, sizeof( magic_hrr_string ) ) == 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800913 {
Jerry Yub85277e2021-10-13 13:36:05 +0800914 return( SSL_SERVER_HELLO_COORDINATE_HRR );
Jerry Yue1b9c292021-09-10 10:08:31 +0800915 }
916
Jerry Yub85277e2021-10-13 13:36:05 +0800917 return( SSL_SERVER_HELLO_COORDINATE_HELLO );
Jerry Yue1b9c292021-09-10 10:08:31 +0800918}
919
Jerry Yu745bb612021-10-13 22:01:04 +0800920/* Fetch and preprocess
921 * Returns a negative value on failure, and otherwise
922 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
923 * - SSL_SERVER_HELLO_COORDINATE_HRR
924 */
Jerry Yub85277e2021-10-13 13:36:05 +0800925static int ssl_tls13_server_hello_coordinate( mbedtls_ssl_context *ssl,
926 unsigned char **buf,
927 size_t *buf_len )
Jerry Yue1b9c292021-09-10 10:08:31 +0800928{
Jerry Yu4a173382021-10-11 21:45:31 +0800929 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800930
XiaokangQian355e09a2022-01-20 11:14:50 +0000931 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
932 MBEDTLS_SSL_HS_SERVER_HELLO,
933 buf, buf_len ) );
Jerry Yue1b9c292021-09-10 10:08:31 +0800934
Jerry Yub85277e2021-10-13 13:36:05 +0800935 ret = ssl_server_hello_is_hrr( ssl, *buf, *buf + *buf_len );
936 switch( ret )
Jerry Yue1b9c292021-09-10 10:08:31 +0800937 {
Jerry Yu745bb612021-10-13 22:01:04 +0800938 case SSL_SERVER_HELLO_COORDINATE_HELLO:
939 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) );
940 break;
941 case SSL_SERVER_HELLO_COORDINATE_HRR:
942 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) );
XiaokangQian16acd4b2022-01-14 07:35:47 +0000943 /* If a client receives a second
944 * HelloRetryRequest in the same connection (i.e., where the ClientHello
945 * was itself in response to a HelloRetryRequest), it MUST abort the
946 * handshake with an "unexpected_message" alert.
947 */
XiaokangQiand9e068e2022-01-18 06:23:32 +0000948 if( ssl->handshake->hello_retry_request_count > 0 )
XiaokangQian16acd4b2022-01-14 07:35:47 +0000949 {
950 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Multiple HRRs received" ) );
951 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
952 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
953 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
954 }
XiaokangQian2b01dc32022-01-21 02:53:13 +0000955 /*
956 * Clients must abort the handshake with an "illegal_parameter"
957 * alert if the HelloRetryRequest would not result in any change
958 * in the ClientHello.
959 * In a PSK only key exchange that what we expect.
960 */
961 if( ! mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
962 {
963 MBEDTLS_SSL_DEBUG_MSG( 1,
964 ( "Unexpected HRR in pure PSK key exchange." ) );
965 MBEDTLS_SSL_PEND_FATAL_ALERT(
966 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
967 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
968 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
969 }
XiaokangQian16acd4b2022-01-14 07:35:47 +0000970
XiaokangQiand9e068e2022-01-18 06:23:32 +0000971 ssl->handshake->hello_retry_request_count++;
XiaokangQian16acd4b2022-01-14 07:35:47 +0000972
Jerry Yu745bb612021-10-13 22:01:04 +0800973 break;
Jerry Yue1b9c292021-09-10 10:08:31 +0800974 }
975
976cleanup:
977
978 return( ret );
979}
980
Jerry Yu4a173382021-10-11 21:45:31 +0800981static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl,
982 const unsigned char **buf,
983 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800984{
985 const unsigned char *p = *buf;
Jerry Yu4a173382021-10-11 21:45:31 +0800986 size_t legacy_session_id_echo_len;
Jerry Yue1b9c292021-09-10 10:08:31 +0800987
Jerry Yude4fb2c2021-09-19 18:05:08 +0800988 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
Jerry Yu4a173382021-10-11 21:45:31 +0800989 legacy_session_id_echo_len = *p++ ;
Jerry Yue1b9c292021-09-10 10:08:31 +0800990
Jerry Yu4a173382021-10-11 21:45:31 +0800991 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len );
Jerry Yue1b9c292021-09-10 10:08:31 +0800992
993 /* legacy_session_id_echo */
Jerry Yu4a173382021-10-11 21:45:31 +0800994 if( ssl->session_negotiate->id_len != legacy_session_id_echo_len ||
995 memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800996 {
Jerry Yue1b9c292021-09-10 10:08:31 +0800997 MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID",
998 ssl->session_negotiate->id,
999 ssl->session_negotiate->id_len );
1000 MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p,
Jerry Yu4a173382021-10-11 21:45:31 +08001001 legacy_session_id_echo_len );
1002
1003 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1004 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1005
Jerry Yue1b9c292021-09-10 10:08:31 +08001006 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1007 }
1008
Jerry Yu4a173382021-10-11 21:45:31 +08001009 p += legacy_session_id_echo_len;
Jerry Yue1b9c292021-09-10 10:08:31 +08001010 *buf = p;
1011
1012 MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id,
Jerry Yu4a173382021-10-11 21:45:31 +08001013 ssl->session_negotiate->id_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001014 return( 0 );
1015}
1016
Jerry Yu4a173382021-10-11 21:45:31 +08001017static int ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl,
1018 int cipher_suite )
Jerry Yue1b9c292021-09-10 10:08:31 +08001019{
Jerry Yu4a173382021-10-11 21:45:31 +08001020 const int *ciphersuite_list = ssl->conf->ciphersuite_list;
1021
Jerry Yue1b9c292021-09-10 10:08:31 +08001022 /* Check whether we have offered this ciphersuite */
Jerry Yu4a173382021-10-11 21:45:31 +08001023 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
Jerry Yue1b9c292021-09-10 10:08:31 +08001024 {
Jerry Yu4a173382021-10-11 21:45:31 +08001025 if( ciphersuite_list[i] == cipher_suite )
Jerry Yue1b9c292021-09-10 10:08:31 +08001026 {
1027 return( 1 );
1028 }
1029 }
1030 return( 0 );
1031}
1032
1033/* Parse ServerHello message and configure context
1034 *
1035 * struct {
1036 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1037 * Random random;
1038 * opaque legacy_session_id_echo<0..32>;
1039 * CipherSuite cipher_suite;
1040 * uint8 legacy_compression_method = 0;
Jerry Yub85277e2021-10-13 13:36:05 +08001041 * Extension extensions<6..2^16-1>;
Jerry Yue1b9c292021-09-10 10:08:31 +08001042 * } ServerHello;
1043 */
Jerry Yuc068b662021-10-11 22:30:19 +08001044static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl,
1045 const unsigned char *buf,
XiaokangQiand9e068e2022-01-18 06:23:32 +00001046 const unsigned char *end,
1047 int is_hrr )
Jerry Yue1b9c292021-09-10 10:08:31 +08001048{
Jerry Yub85277e2021-10-13 13:36:05 +08001049 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +08001050 const unsigned char *p = buf;
XiaokangQian355e09a2022-01-20 11:14:50 +00001051 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yub85277e2021-10-13 13:36:05 +08001052 size_t extensions_len;
1053 const unsigned char *extensions_end;
Jerry Yue1b9c292021-09-10 10:08:31 +08001054 uint16_t cipher_suite;
Jerry Yude4fb2c2021-09-19 18:05:08 +08001055 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
XiaokangQian78b1fa72022-01-19 06:56:30 +00001056 int supported_versions_ext_found = 0;
XiaokangQianb119a352022-01-26 03:29:10 +00001057 int fatal_alert = 0;
Jerry Yue1b9c292021-09-10 10:08:31 +08001058
1059 /*
1060 * Check there is space for minimal fields
1061 *
1062 * - legacy_version ( 2 bytes)
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001063 * - random (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes)
Jerry Yue1b9c292021-09-10 10:08:31 +08001064 * - legacy_session_id_echo ( 1 byte ), minimum size
1065 * - cipher_suite ( 2 bytes)
1066 * - legacy_compression_method ( 1 byte )
1067 */
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001068 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001069
1070 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p );
Jerry Yue1b9c292021-09-10 10:08:31 +08001071 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 );
1072
Jerry Yu4a173382021-10-11 21:45:31 +08001073 /* ...
Jerry Yub85277e2021-10-13 13:36:05 +08001074 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
Jerry Yu4a173382021-10-11 21:45:31 +08001075 * ...
1076 * with ProtocolVersion defined as:
1077 * uint16 ProtocolVersion;
1078 */
Jerry Yue1b9c292021-09-10 10:08:31 +08001079 if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 &&
1080 p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) )
1081 {
1082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
1083 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1084 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
XiaokangQiand59be772022-01-24 10:12:51 +00001085 ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1086 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001087 }
1088 p += 2;
Jerry Yue1b9c292021-09-10 10:08:31 +08001089
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001090 /* ...
Jerry Yu4a173382021-10-11 21:45:31 +08001091 * Random random;
1092 * ...
1093 * with Random defined as:
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001094 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu4a173382021-10-11 21:45:31 +08001095 */
XiaokangQian53f20b72022-01-18 10:47:33 +00001096 if( !is_hrr )
1097 {
XiaokangQian355e09a2022-01-20 11:14:50 +00001098 memcpy( &handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p,
XiaokangQian53f20b72022-01-18 10:47:33 +00001099 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1100 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
1101 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1102 }
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001103 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
Jerry Yue1b9c292021-09-10 10:08:31 +08001104
Jerry Yu4a173382021-10-11 21:45:31 +08001105 /* ...
1106 * opaque legacy_session_id_echo<0..32>;
1107 * ...
1108 */
1109 if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +08001110 {
XiaokangQian52da5582022-01-26 09:49:29 +00001111 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQiand59be772022-01-24 10:12:51 +00001112 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001113 }
1114
Jerry Yu4a173382021-10-11 21:45:31 +08001115 /* ...
1116 * CipherSuite cipher_suite;
1117 * ...
1118 * with CipherSuite defined as:
1119 * uint8 CipherSuite[2];
1120 */
1121 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001122 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
1123 p += 2;
1124
Jerry Yu4a173382021-10-11 21:45:31 +08001125
XiaokangQian355e09a2022-01-20 11:14:50 +00001126 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
Jerry Yu4a173382021-10-11 21:45:31 +08001127 /*
1128 * Check whether this ciphersuite is supported and offered.
1129 * Via the force_ciphersuite version we may have instructed the client
1130 * to use a different ciphersuite.
1131 */
Jerry Yu4a173382021-10-11 21:45:31 +08001132 if( ciphersuite_info == NULL ||
1133 ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) == 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +08001134 {
XiaokangQian52da5582022-01-26 09:49:29 +00001135 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
Jerry Yue1b9c292021-09-10 10:08:31 +08001136 }
XiaokangQian53f20b72022-01-18 10:47:33 +00001137 /*
XiaokangQian355e09a2022-01-20 11:14:50 +00001138 * If we received an HRR before and that the proposed selected
1139 * ciphersuite in this server hello is not the same as the one
1140 * proposed in the HRR, we abort the handshake and send an
1141 * "illegal_parameter" alert.
XiaokangQian53f20b72022-01-18 10:47:33 +00001142 */
XiaokangQian355e09a2022-01-20 11:14:50 +00001143 else if( ( !is_hrr ) && ( handshake->hello_retry_request_count > 0 ) &&
1144 ( cipher_suite != ssl->session_negotiate->ciphersuite ) )
XiaokangQian53f20b72022-01-18 10:47:33 +00001145 {
XiaokangQian52da5582022-01-26 09:49:29 +00001146 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQian355e09a2022-01-20 11:14:50 +00001147 }
XiaokangQian53f20b72022-01-18 10:47:33 +00001148
XiaokangQian52da5582022-01-26 09:49:29 +00001149 if( fatal_alert == MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER )
XiaokangQian355e09a2022-01-20 11:14:50 +00001150 {
1151 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid ciphersuite(%04x) parameter",
1152 cipher_suite ) );
XiaokangQiand59be772022-01-24 10:12:51 +00001153 goto cleanup;
XiaokangQian53f20b72022-01-18 10:47:33 +00001154 }
Jerry Yue1b9c292021-09-10 10:08:31 +08001155
Jerry Yu4a173382021-10-11 21:45:31 +08001156 /* Configure ciphersuites */
1157 mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info );
1158
XiaokangQian355e09a2022-01-20 11:14:50 +00001159 handshake->ciphersuite_info = ciphersuite_info;
Jerry Yue1b9c292021-09-10 10:08:31 +08001160 ssl->session_negotiate->ciphersuite = cipher_suite;
1161
Jerry Yue1b9c292021-09-10 10:08:31 +08001162 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s",
1163 cipher_suite, ciphersuite_info->name ) );
1164
1165#if defined(MBEDTLS_HAVE_TIME)
1166 ssl->session_negotiate->start = time( NULL );
1167#endif /* MBEDTLS_HAVE_TIME */
1168
Jerry Yu4a173382021-10-11 21:45:31 +08001169 /* ...
1170 * uint8 legacy_compression_method = 0;
1171 * ...
Jerry Yue1b9c292021-09-10 10:08:31 +08001172 */
Jerry Yude4fb2c2021-09-19 18:05:08 +08001173 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001174 if( p[0] != 0 )
1175 {
Jerry Yub85277e2021-10-13 13:36:05 +08001176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
XiaokangQian52da5582022-01-26 09:49:29 +00001177 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQiand59be772022-01-24 10:12:51 +00001178 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001179 }
1180 p++;
1181
Jerry Yub85277e2021-10-13 13:36:05 +08001182 /* ...
1183 * Extension extensions<6..2^16-1>;
1184 * ...
Jerry Yu4a173382021-10-11 21:45:31 +08001185 * struct {
1186 * ExtensionType extension_type; (2 bytes)
1187 * opaque extension_data<0..2^16-1>;
1188 * } Extension;
1189 */
Jerry Yude4fb2c2021-09-19 18:05:08 +08001190 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
Jerry Yu4a173382021-10-11 21:45:31 +08001191 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001192 p += 2;
Jerry Yude4fb2c2021-09-19 18:05:08 +08001193
Jerry Yu4a173382021-10-11 21:45:31 +08001194 /* Check extensions do not go beyond the buffer of data. */
1195 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1196 extensions_end = p + extensions_len;
Jerry Yue1b9c292021-09-10 10:08:31 +08001197
Jerry Yu4a173382021-10-11 21:45:31 +08001198 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001199
Jerry Yu4a173382021-10-11 21:45:31 +08001200 while( p < extensions_end )
Jerry Yue1b9c292021-09-10 10:08:31 +08001201 {
1202 unsigned int extension_type;
1203 size_t extension_data_len;
XiaokangQian43550bd2022-01-21 04:32:58 +00001204 const unsigned char *extension_data_end;
Jerry Yue1b9c292021-09-10 10:08:31 +08001205
Jerry Yu4a173382021-10-11 21:45:31 +08001206 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001207 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1208 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1209 p += 4;
1210
Jerry Yu4a173382021-10-11 21:45:31 +08001211 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
XiaokangQian43550bd2022-01-21 04:32:58 +00001212 extension_data_end = p + extension_data_len;
Jerry Yue1b9c292021-09-10 10:08:31 +08001213
1214 switch( extension_type )
1215 {
XiaokangQianb851da82022-01-14 04:03:11 +00001216 case MBEDTLS_TLS_EXT_COOKIE:
1217
XiaokangQiand9e068e2022-01-18 06:23:32 +00001218 if( !is_hrr )
1219 {
XiaokangQian52da5582022-01-26 09:49:29 +00001220 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001221 goto cleanup;
XiaokangQiand9e068e2022-01-18 06:23:32 +00001222 }
1223
XiaokangQian43550bd2022-01-21 04:32:58 +00001224 ret = ssl_tls13_parse_cookie_ext( ssl,
1225 p, extension_data_end );
1226 if( ret != 0 )
XiaokangQianb851da82022-01-14 04:03:11 +00001227 {
XiaokangQian43550bd2022-01-21 04:32:58 +00001228 MBEDTLS_SSL_DEBUG_RET( 1,
1229 "ssl_tls13_parse_cookie_ext",
1230 ret );
XiaokangQiand59be772022-01-24 10:12:51 +00001231 goto cleanup;
XiaokangQianb851da82022-01-14 04:03:11 +00001232 }
XiaokangQianb851da82022-01-14 04:03:11 +00001233 break;
XiaokangQianb851da82022-01-14 04:03:11 +00001234
Jerry Yue1b9c292021-09-10 10:08:31 +08001235 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
XiaokangQian78b1fa72022-01-19 06:56:30 +00001236 supported_versions_ext_found = 1;
Jerry Yue1b9c292021-09-10 10:08:31 +08001237 MBEDTLS_SSL_DEBUG_MSG( 3,
1238 ( "found supported_versions extension" ) );
1239
Jerry Yuc068b662021-10-11 22:30:19 +08001240 ret = ssl_tls13_parse_supported_versions_ext( ssl,
Jerry Yub85277e2021-10-13 13:36:05 +08001241 p,
XiaokangQian43550bd2022-01-21 04:32:58 +00001242 extension_data_end );
Jerry Yue1b9c292021-09-10 10:08:31 +08001243 if( ret != 0 )
XiaokangQiand59be772022-01-24 10:12:51 +00001244 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001245 break;
1246
1247 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1248 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) );
1249 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001250
XiaokangQian52da5582022-01-26 09:49:29 +00001251 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001252 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001253
1254#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1255 case MBEDTLS_TLS_EXT_KEY_SHARE:
1256 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
XiaokangQiand59be772022-01-24 10:12:51 +00001257 if( ! mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1258 {
XiaokangQian52da5582022-01-26 09:49:29 +00001259 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001260 goto cleanup;
1261 }
1262
XiaokangQian53f20b72022-01-18 10:47:33 +00001263 if( is_hrr )
XiaokangQiand9e068e2022-01-18 06:23:32 +00001264 ret = ssl_tls13_parse_hrr_key_share_ext( ssl,
XiaokangQian43550bd2022-01-21 04:32:58 +00001265 p, extension_data_end );
XiaokangQian53f20b72022-01-18 10:47:33 +00001266 else
XiaokangQianb851da82022-01-14 04:03:11 +00001267 ret = ssl_tls13_parse_key_share_ext( ssl,
XiaokangQian43550bd2022-01-21 04:32:58 +00001268 p, extension_data_end );
XiaokangQianb851da82022-01-14 04:03:11 +00001269 if( ret != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +08001270 {
1271 MBEDTLS_SSL_DEBUG_RET( 1,
Jerry Yu4a173382021-10-11 21:45:31 +08001272 "ssl_tls13_parse_key_share_ext",
Jerry Yue1b9c292021-09-10 10:08:31 +08001273 ret );
XiaokangQiand59be772022-01-24 10:12:51 +00001274 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001275 }
1276 break;
1277#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1278
1279 default:
Jerry Yu4a173382021-10-11 21:45:31 +08001280 MBEDTLS_SSL_DEBUG_MSG(
1281 3,
1282 ( "unknown extension found: %u ( ignoring )",
1283 extension_type ) );
1284
XiaokangQian52da5582022-01-26 09:49:29 +00001285 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001286 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001287 }
1288
1289 p += extension_data_len;
1290 }
1291
XiaokangQian78b1fa72022-01-19 06:56:30 +00001292 if( !supported_versions_ext_found )
XiaokangQian53f20b72022-01-18 10:47:33 +00001293 {
XiaokangQian78b1fa72022-01-19 06:56:30 +00001294 MBEDTLS_SSL_DEBUG_MSG( 1, ( "supported_versions not found" ) );
XiaokangQian52da5582022-01-26 09:49:29 +00001295 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQiand59be772022-01-24 10:12:51 +00001296 goto cleanup;
XiaokangQian53f20b72022-01-18 10:47:33 +00001297 }
1298
XiaokangQiand59be772022-01-24 10:12:51 +00001299cleanup:
1300
XiaokangQian52da5582022-01-26 09:49:29 +00001301 if( fatal_alert == MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT )
XiaokangQiand59be772022-01-24 10:12:51 +00001302 {
1303 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1304 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1305 ret = MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
1306 }
XiaokangQian52da5582022-01-26 09:49:29 +00001307 else if ( fatal_alert == MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER )
XiaokangQiand59be772022-01-24 10:12:51 +00001308 {
1309 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1310 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1311 ret = MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1312 }
1313 return( ret );
Jerry Yue1b9c292021-09-10 10:08:31 +08001314}
1315
XiaokangQian355e09a2022-01-20 11:14:50 +00001316static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
Jerry Yue1b9c292021-09-10 10:08:31 +08001317{
Jerry Yub85277e2021-10-13 13:36:05 +08001318 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu0b177842021-09-05 19:41:30 +08001319 mbedtls_ssl_key_set traffic_keys;
Jerry Yu4a173382021-10-11 21:45:31 +08001320 mbedtls_ssl_transform *transform_handshake = NULL;
Jerry Yub85277e2021-10-13 13:36:05 +08001321 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu0b177842021-09-05 19:41:30 +08001322
Jerry Yub85277e2021-10-13 13:36:05 +08001323 /* Determine the key exchange mode:
1324 * 1) If both the pre_shared_key and key_share extensions were received
1325 * then the key exchange mode is PSK with EPHEMERAL.
1326 * 2) If only the pre_shared_key extension was received then the key
1327 * exchange mode is PSK-only.
1328 * 3) If only the key_share extension was received then the key
1329 * exchange mode is EPHEMERAL-only.
Jerry Yu0b177842021-09-05 19:41:30 +08001330 */
Jerry Yub85277e2021-10-13 13:36:05 +08001331 switch( handshake->extensions_present &
1332 ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ) )
Jerry Yu0b177842021-09-05 19:41:30 +08001333 {
Jerry Yu745bb612021-10-13 22:01:04 +08001334 /* Only the pre_shared_key extension was received */
1335 case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
Xiaofei Baid25fab62021-12-02 06:36:27 +00001336 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
Jerry Yu745bb612021-10-13 22:01:04 +08001337 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001338
Jerry Yu745bb612021-10-13 22:01:04 +08001339 /* Only the key_share extension was received */
1340 case MBEDTLS_SSL_EXT_KEY_SHARE:
Xiaofei Baid25fab62021-12-02 06:36:27 +00001341 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
Jerry Yu745bb612021-10-13 22:01:04 +08001342 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001343
Jerry Yu745bb612021-10-13 22:01:04 +08001344 /* Both the pre_shared_key and key_share extensions were received */
1345 case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
Xiaofei Baid25fab62021-12-02 06:36:27 +00001346 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
Jerry Yu745bb612021-10-13 22:01:04 +08001347 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001348
Jerry Yu745bb612021-10-13 22:01:04 +08001349 /* Neither pre_shared_key nor key_share extension was received */
1350 default:
1351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) );
1352 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1353 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001354 }
1355
1356 /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
1357 *
1358 * TODO: We don't have to do this in case we offered 0-RTT and the
1359 * server accepted it. In this case, we could skip generating
1360 * the early secret. */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001361 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
Jerry Yu0b177842021-09-05 19:41:30 +08001362 if( ret != 0 )
1363 {
Xiaofei Bai746f9482021-11-12 08:53:56 +00001364 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early_data",
Jerry Yu0b177842021-09-05 19:41:30 +08001365 ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001366 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001367 }
1368
1369 /* Compute handshake secret */
Jerry Yuf0ac2352021-10-11 17:47:07 +08001370 ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl );
Jerry Yu0b177842021-09-05 19:41:30 +08001371 if( ret != 0 )
1372 {
Xiaofei Bai746f9482021-11-12 08:53:56 +00001373 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001374 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001375 }
1376
1377 /* Next evolution in key schedule: Establish handshake secret and
1378 * key material. */
Jerry Yuc068b662021-10-11 22:30:19 +08001379 ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys );
Jerry Yu0b177842021-09-05 19:41:30 +08001380 if( ret != 0 )
1381 {
Jerry Yuc068b662021-10-11 22:30:19 +08001382 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys",
1383 ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001384 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001385 }
1386
Jerry Yub85277e2021-10-13 13:36:05 +08001387 transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) );
Jerry Yu0b177842021-09-05 19:41:30 +08001388 if( transform_handshake == NULL )
Jerry Yu4a173382021-10-11 21:45:31 +08001389 {
1390 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
1391 goto cleanup;
1392 }
Jerry Yu0b177842021-09-05 19:41:30 +08001393
1394 ret = mbedtls_ssl_tls13_populate_transform( transform_handshake,
1395 ssl->conf->endpoint,
1396 ssl->session_negotiate->ciphersuite,
1397 &traffic_keys,
1398 ssl );
1399 if( ret != 0 )
1400 {
1401 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001402 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001403 }
1404
Jerry Yub85277e2021-10-13 13:36:05 +08001405 handshake->transform_handshake = transform_handshake;
1406 mbedtls_ssl_set_inbound_transform( ssl, transform_handshake );
Jerry Yu0b177842021-09-05 19:41:30 +08001407
1408 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
1409 ssl->session_in = ssl->session_negotiate;
1410
1411 /*
1412 * State machine update
1413 */
1414 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
1415
Jerry Yu4a173382021-10-11 21:45:31 +08001416cleanup:
1417
Jerry Yu0b177842021-09-05 19:41:30 +08001418 mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001419 if( ret != 0 )
1420 {
Jerry Yub85277e2021-10-13 13:36:05 +08001421 mbedtls_free( transform_handshake );
Jerry Yuc068b662021-10-11 22:30:19 +08001422
Jerry Yu4a173382021-10-11 21:45:31 +08001423 MBEDTLS_SSL_PEND_FATAL_ALERT(
1424 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1425 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1426 }
1427 return( ret );
Jerry Yue1b9c292021-09-10 10:08:31 +08001428}
1429
XiaokangQian355e09a2022-01-20 11:14:50 +00001430static int ssl_tls13_postprocess_hrr( mbedtls_ssl_context *ssl )
XiaokangQian647719a2021-12-07 09:16:29 +00001431{
XiaokangQian0b56a8f2021-12-22 02:39:32 +00001432#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
XiaokangQian647719a2021-12-07 09:16:29 +00001433 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1434
XiaokangQian647719a2021-12-07 09:16:29 +00001435#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1436 /* If not offering early data, the client sends a dummy CCS record
1437 * immediately before its second flight. This may either be before
XiaokangQian51eff222021-12-10 10:33:56 +00001438 * its second ClientHello or before its encrypted handshake flight.
1439 */
XiaokangQian647719a2021-12-07 09:16:29 +00001440 mbedtls_ssl_handshake_set_state( ssl,
1441 MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO );
1442#else
1443 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
1444#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1445
XiaokangQian78b1fa72022-01-19 06:56:30 +00001446 mbedtls_ssl_session_reset_msg_layer( ssl, 0 );
XiaokangQian647719a2021-12-07 09:16:29 +00001447
XiaokangQian78b1fa72022-01-19 06:56:30 +00001448 /*
XiaokangQian355e09a2022-01-20 11:14:50 +00001449 * We are going to re-generate a shared secret corresponding to the group
1450 * selected by the server, which is different from the group for which we
1451 * generated a shared secret in the first client hello.
1452 * Thus, reset the shared secret.
XiaokangQian51eff222021-12-10 10:33:56 +00001453 */
XiaokangQian16acd4b2022-01-14 07:35:47 +00001454 ret = ssl_tls13_reset_key_share( ssl );
XiaokangQian647719a2021-12-07 09:16:29 +00001455 if( ret != 0 )
1456 return( ret );
XiaokangQian43550bd2022-01-21 04:32:58 +00001457#else
1458 ((void) ssl);
XiaokangQian0b56a8f2021-12-22 02:39:32 +00001459#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
XiaokangQian647719a2021-12-07 09:16:29 +00001460
1461 return( 0 );
1462}
1463
Jerry Yue1b9c292021-09-10 10:08:31 +08001464/*
Jerry Yu4a173382021-10-11 21:45:31 +08001465 * Wait and parse ServerHello handshake message.
Jerry Yu687101b2021-09-14 16:03:56 +08001466 * Handler for MBEDTLS_SSL_SERVER_HELLO
1467 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001468static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001469{
Jerry Yu4a173382021-10-11 21:45:31 +08001470 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian647719a2021-12-07 09:16:29 +00001471 unsigned char *buf = NULL;
1472 size_t buf_len = 0;
XiaokangQian78b1fa72022-01-19 06:56:30 +00001473 int is_hrr = 0;
Jerry Yue1b9c292021-09-10 10:08:31 +08001474
1475 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) );
1476
1477 /* Coordination step
1478 * - Fetch record
1479 * - Make sure it's either a ServerHello or a HRR.
1480 * - Switch processing routine in case of HRR
1481 */
Jerry Yue1b9c292021-09-10 10:08:31 +08001482 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
1483 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
1484
XiaokangQian16acd4b2022-01-14 07:35:47 +00001485 ret = ssl_tls13_server_hello_coordinate( ssl, &buf, &buf_len );
XiaokangQiand9e068e2022-01-18 06:23:32 +00001486 if( ret < 0 )
XiaokangQian16acd4b2022-01-14 07:35:47 +00001487 goto cleanup;
1488 else
XiaokangQiand9e068e2022-01-18 06:23:32 +00001489 is_hrr = ( ret == SSL_SERVER_HELLO_COORDINATE_HRR );
XiaokangQiand59be772022-01-24 10:12:51 +00001490
XiaokangQianb851da82022-01-14 04:03:11 +00001491 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf,
XiaokangQiand9e068e2022-01-18 06:23:32 +00001492 buf + buf_len,
1493 is_hrr ) );
1494 if( is_hrr )
XiaokangQian647719a2021-12-07 09:16:29 +00001495 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_reset_transcript_for_hrr( ssl ) );
1496
XiaokangQianb851da82022-01-14 04:03:11 +00001497 mbedtls_ssl_tls13_add_hs_msg_to_checksum( ssl,
1498 MBEDTLS_SSL_HS_SERVER_HELLO,
1499 buf, buf_len );
XiaokangQian647719a2021-12-07 09:16:29 +00001500
XiaokangQiand9e068e2022-01-18 06:23:32 +00001501 if( is_hrr )
XiaokangQian355e09a2022-01-20 11:14:50 +00001502 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_hrr( ssl ) );
XiaokangQiand9e068e2022-01-18 06:23:32 +00001503 else
XiaokangQian355e09a2022-01-20 11:14:50 +00001504 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_server_hello( ssl ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001505
1506cleanup:
XiaokangQiana9090612022-01-27 03:48:27 +00001507 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s ( %s )", __func__,
1508 is_hrr?"HelloRetryRequest":"ServerHello" ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001509 return( ret );
Jerry Yu687101b2021-09-14 16:03:56 +08001510}
1511
1512/*
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001513 *
1514 * EncryptedExtensions message
1515 *
1516 * The EncryptedExtensions message contains any extensions which
1517 * should be protected, i.e., any which are not needed to establish
1518 * the cryptographic context.
Jerry Yu687101b2021-09-14 16:03:56 +08001519 */
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001520
1521/*
1522 * Overview
1523 */
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001524
1525/* Main entry point; orchestrates the other functions */
XiaokangQian97799ac2021-10-11 10:05:54 +00001526static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001527
XiaokangQian97799ac2021-10-11 10:05:54 +00001528static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1529 const unsigned char *buf,
1530 const unsigned char *end );
1531static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001532
1533/*
XiaokangQianc1fe0002021-09-16 03:02:14 +00001534 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001535 */
XiaokangQian97799ac2021-10-11 10:05:54 +00001536static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001537{
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001538 int ret;
1539 unsigned char *buf;
1540 size_t buf_len;
1541
1542 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) );
1543
Xiaofei Bai746f9482021-11-12 08:53:56 +00001544 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
XiaokangQianab7f50d2021-10-21 06:23:29 +00001545 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001546 &buf, &buf_len ) );
1547
1548 /* Process the message contents */
XiaokangQian97799ac2021-10-11 10:05:54 +00001549 MBEDTLS_SSL_PROC_CHK(
XiaokangQian8db25ff2021-10-13 05:56:18 +00001550 ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001551
Xiaofei Bai746f9482021-11-12 08:53:56 +00001552 mbedtls_ssl_tls13_add_hs_msg_to_checksum(
XiaokangQianab7f50d2021-10-21 06:23:29 +00001553 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, buf_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001554
XiaokangQian97799ac2021-10-11 10:05:54 +00001555 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_encrypted_extensions( ssl ) );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001556
1557cleanup:
1558
1559 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) );
1560 return( ret );
1561
1562}
1563
XiaokangQian08da26c2021-10-09 10:12:11 +00001564/* Parse EncryptedExtensions message
1565 * struct {
XiaokangQian97799ac2021-10-11 10:05:54 +00001566 * Extension extensions<0..2^16-1>;
XiaokangQian08da26c2021-10-09 10:12:11 +00001567 * } EncryptedExtensions;
1568 */
XiaokangQian97799ac2021-10-11 10:05:54 +00001569static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1570 const unsigned char *buf,
1571 const unsigned char *end )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001572{
1573 int ret = 0;
XiaokangQian08da26c2021-10-09 10:12:11 +00001574 size_t extensions_len;
XiaokangQian140f0452021-10-08 08:05:53 +00001575 const unsigned char *p = buf;
XiaokangQian8db25ff2021-10-13 05:56:18 +00001576 const unsigned char *extensions_end;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001577
XiaokangQian08da26c2021-10-09 10:12:11 +00001578 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian97799ac2021-10-11 10:05:54 +00001579 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian08da26c2021-10-09 10:12:11 +00001580 p += 2;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001581
XiaokangQian97799ac2021-10-11 10:05:54 +00001582 MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len );
XiaokangQian8db25ff2021-10-13 05:56:18 +00001583 extensions_end = p + extensions_len;
1584 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001585
XiaokangQian8db25ff2021-10-13 05:56:18 +00001586 while( p < extensions_end )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001587 {
XiaokangQian08da26c2021-10-09 10:12:11 +00001588 unsigned int extension_type;
1589 size_t extension_data_len;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001590
XiaokangQian08da26c2021-10-09 10:12:11 +00001591 /*
1592 * struct {
XiaokangQian97799ac2021-10-11 10:05:54 +00001593 * ExtensionType extension_type; (2 bytes)
1594 * opaque extension_data<0..2^16-1>;
XiaokangQian08da26c2021-10-09 10:12:11 +00001595 * } Extension;
1596 */
XiaokangQian8db25ff2021-10-13 05:56:18 +00001597 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
XiaokangQian08da26c2021-10-09 10:12:11 +00001598 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1599 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1600 p += 4;
1601
XiaokangQian8db25ff2021-10-13 05:56:18 +00001602 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001603
XiaokangQian97799ac2021-10-11 10:05:54 +00001604 /* The client MUST check EncryptedExtensions for the
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001605 * presence of any forbidden extensions and if any are found MUST abort
XiaokangQian08da26c2021-10-09 10:12:11 +00001606 * the handshake with an "unsupported_extension" alert.
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001607 */
XiaokangQian08da26c2021-10-09 10:12:11 +00001608 switch( extension_type )
1609 {
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001610
XiaokangQian08da26c2021-10-09 10:12:11 +00001611 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1612 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extensions supported groups" ) );
1613 break;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001614
XiaokangQian08da26c2021-10-09 10:12:11 +00001615 default:
XiaokangQian97799ac2021-10-11 10:05:54 +00001616 MBEDTLS_SSL_DEBUG_MSG(
1617 3, ( "unsupported extension found: %u ", extension_type) );
1618 MBEDTLS_SSL_PEND_FATAL_ALERT(
Jerry Yu7aa71862021-10-28 21:41:30 +08001619 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
XiaokangQian97799ac2021-10-11 10:05:54 +00001620 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1621 return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
XiaokangQian08da26c2021-10-09 10:12:11 +00001622 }
1623
XiaokangQian08da26c2021-10-09 10:12:11 +00001624 p += extension_data_len;
XiaokangQian97799ac2021-10-11 10:05:54 +00001625 }
XiaokangQian08da26c2021-10-09 10:12:11 +00001626
XiaokangQian97799ac2021-10-11 10:05:54 +00001627 /* Check that we consumed all the message. */
XiaokangQian7b2d4ef2021-10-13 10:19:02 +00001628 if( p != end )
XiaokangQian97799ac2021-10-11 10:05:54 +00001629 {
1630 MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) );
Jerry Yu7aa71862021-10-28 21:41:30 +08001631 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
XiaokangQian7b2d4ef2021-10-13 10:19:02 +00001632 MBEDTLS_ERR_SSL_DECODE_ERROR );
XiaokangQian97799ac2021-10-11 10:05:54 +00001633 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001634 }
1635
1636 return( ret );
1637}
1638
XiaokangQian97799ac2021-10-11 10:05:54 +00001639static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001640{
Jerry Yua93ac112021-10-27 16:31:48 +08001641#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00001642 if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
Jerry Yua93ac112021-10-27 16:31:48 +08001643 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1644 else
Jerry Yud2674312021-10-29 10:08:19 +08001645 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
Jerry Yua93ac112021-10-27 16:31:48 +08001646#else
1647 ((void) ssl);
1648 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1649#endif
Jerry Yu687101b2021-09-14 16:03:56 +08001650 return( 0 );
1651}
1652
Jerry Yua93ac112021-10-27 16:31:48 +08001653#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu687101b2021-09-14 16:03:56 +08001654/*
Jerry Yud2674312021-10-29 10:08:19 +08001655 * Handler for MBEDTLS_SSL_CERTIFICATE_REQUEST
1656 */
1657static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl )
1658{
1659 int ret = mbedtls_ssl_read_record( ssl, 0 );
1660
1661 if( ret != 0 )
1662 {
1663 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1664 return( ret );
1665 }
1666
1667 if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) &&
1668 ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) )
1669 {
1670 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CertificateRequest not supported" ) );
1671 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1672 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1673 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1674 }
1675
1676 ssl->keep_current_message = 1;
1677 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
1678
1679 return( 0 );
1680}
1681
1682/*
Jerry Yu687101b2021-09-14 16:03:56 +08001683 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
1684 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001685static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001686{
Xiaofei Bai947571e2021-09-29 09:12:03 +00001687 int ret;
1688
1689 ret = mbedtls_ssl_tls13_process_certificate( ssl );
Xiaofei Baif93cbd22021-10-29 02:39:30 +00001690 if( ret != 0 )
Xiaofei Bai947571e2021-09-29 09:12:03 +00001691 return( ret );
1692
Jerry Yu687101b2021-09-14 16:03:56 +08001693 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
1694 return( 0 );
1695}
1696
1697/*
1698 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
1699 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001700static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001701{
Jerry Yu30b071c2021-09-12 20:16:03 +08001702 int ret;
1703
1704 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
1705 if( ret != 0 )
1706 return( ret );
1707
Jerry Yu687101b2021-09-14 16:03:56 +08001708 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1709 return( 0 );
1710}
Jerry Yua93ac112021-10-27 16:31:48 +08001711#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Ronald Crond4c64022021-12-06 09:06:46 +01001712
Jerry Yu687101b2021-09-14 16:03:56 +08001713/*
1714 * Handler for MBEDTLS_SSL_SERVER_FINISHED
1715 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001716static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001717{
XiaokangQianac0385c2021-11-03 06:40:11 +00001718 int ret;
1719
XiaokangQianc5c39d52021-11-09 11:55:10 +00001720 ret = mbedtls_ssl_tls13_process_finished_message( ssl );
XiaokangQianac0385c2021-11-03 06:40:11 +00001721 if( ret != 0 )
1722 return( ret );
1723
Ronald Cron49ad6192021-11-24 16:25:31 +01001724#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1725 mbedtls_ssl_handshake_set_state(
1726 ssl,
1727 MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
1728#else
XiaokangQianac0385c2021-11-03 06:40:11 +00001729 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
Ronald Cron49ad6192021-11-24 16:25:31 +01001730#endif
1731
XiaokangQianac0385c2021-11-03 06:40:11 +00001732 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001733}
1734
1735/*
Ronald Crond4c64022021-12-06 09:06:46 +01001736 * Handler for MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED
1737 */
1738#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1739static int ssl_tls13_write_change_cipher_spec( mbedtls_ssl_context *ssl )
1740{
1741 int ret;
1742
1743 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
1744 if( ret != 0 )
1745 return( ret );
1746
Ronald Crond4c64022021-12-06 09:06:46 +01001747 return( 0 );
1748}
1749#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1750
1751/*
Jerry Yu687101b2021-09-14 16:03:56 +08001752 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
1753 */
XiaokangQian74af2a82021-09-22 07:40:30 +00001754static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001755{
XiaokangQian0fa66432021-11-15 03:33:57 +00001756 int ret;
1757
Ronald Cron49ad6192021-11-24 16:25:31 +01001758 mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
1759
XiaokangQian0fa66432021-11-15 03:33:57 +00001760 ret = mbedtls_ssl_tls13_write_finished_message( ssl );
1761 if( ret != 0 )
1762 return( ret );
1763
1764 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS );
1765 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001766}
1767
1768/*
1769 * Handler for MBEDTLS_SSL_FLUSH_BUFFERS
1770 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001771static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001772{
Jerry Yu378254d2021-10-30 21:44:47 +08001773 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
Jerry Yuad8d0ba2021-09-28 17:58:26 +08001774 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
Jerry Yu687101b2021-09-14 16:03:56 +08001775 return( 0 );
1776}
1777
1778/*
1779 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
1780 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001781static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001782{
Jerry Yu378254d2021-10-30 21:44:47 +08001783 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) );
1784 mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
1785
1786 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for outbound traffic" ) );
1787 mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application );
1788
1789 mbedtls_ssl_tls13_handshake_wrapup( ssl );
1790
1791 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
1792 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001793}
1794
Jerry Yu92c6b402021-08-27 16:59:09 +08001795int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +08001796{
Jerry Yu92c6b402021-08-27 16:59:09 +08001797 int ret = 0;
Jerry Yuc8a392c2021-08-18 16:46:28 +08001798
Jerry Yue3b34122021-09-28 17:53:35 +08001799 MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 client state: %s(%d)",
1800 mbedtls_ssl_states_str( ssl->state ),
1801 ssl->state ) );
Jerry Yu92c6b402021-08-27 16:59:09 +08001802
1803 switch( ssl->state )
1804 {
1805 /*
Jerry Yu0c63af62021-09-02 12:59:12 +08001806 * ssl->state is initialized as HELLO_REQUEST. It is the same
1807 * as CLIENT_HELLO state.
Jerry Yu92c6b402021-08-27 16:59:09 +08001808 */
1809 case MBEDTLS_SSL_HELLO_REQUEST:
1810 case MBEDTLS_SSL_CLIENT_HELLO:
1811 ret = ssl_tls13_write_client_hello( ssl );
1812 break;
1813
1814 case MBEDTLS_SSL_SERVER_HELLO:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001815 ret = ssl_tls13_process_server_hello( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001816 break;
1817
1818 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
XiaokangQian97799ac2021-10-11 10:05:54 +00001819 ret = ssl_tls13_process_encrypted_extensions( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001820 break;
1821
Jerry Yua93ac112021-10-27 16:31:48 +08001822#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yud2674312021-10-29 10:08:19 +08001823 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
1824 ret = ssl_tls13_process_certificate_request( ssl );
1825 break;
1826
Jerry Yu687101b2021-09-14 16:03:56 +08001827 case MBEDTLS_SSL_SERVER_CERTIFICATE:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001828 ret = ssl_tls13_process_server_certificate( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001829 break;
1830
1831 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001832 ret = ssl_tls13_process_certificate_verify( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001833 break;
Jerry Yua93ac112021-10-27 16:31:48 +08001834#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu687101b2021-09-14 16:03:56 +08001835
1836 case MBEDTLS_SSL_SERVER_FINISHED:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001837 ret = ssl_tls13_process_server_finished( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001838 break;
1839
Jerry Yu687101b2021-09-14 16:03:56 +08001840 case MBEDTLS_SSL_CLIENT_FINISHED:
XiaokangQian74af2a82021-09-22 07:40:30 +00001841 ret = ssl_tls13_write_client_finished( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001842 break;
1843
1844 case MBEDTLS_SSL_FLUSH_BUFFERS:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001845 ret = ssl_tls13_flush_buffers( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001846 break;
1847
1848 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001849 ret = ssl_tls13_handshake_wrapup( ssl );
Jerry Yu92c6b402021-08-27 16:59:09 +08001850 break;
1851
Ronald Cron49ad6192021-11-24 16:25:31 +01001852 /*
1853 * Injection of dummy-CCS's for middlebox compatibility
1854 */
1855#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1856 case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
XiaokangQian0b56a8f2021-12-22 02:39:32 +00001857 case MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO:
Ronald Crond4c64022021-12-06 09:06:46 +01001858 ret = ssl_tls13_write_change_cipher_spec( ssl );
Ronald Cron49ad6192021-11-24 16:25:31 +01001859 break;
1860#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1861
Jerry Yu92c6b402021-08-27 16:59:09 +08001862 default:
1863 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
1864 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1865 }
1866
1867 return( ret );
1868}
Jerry Yu65dd2cc2021-08-18 16:38:40 +08001869
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001870#endif /* MBEDTLS_SSL_CLI_C */
1871
Ronald Cron6f135e12021-12-08 16:57:54 +01001872#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */