blob: 0f7448fc9c88892f73505f4cf1149521ed7e4ced [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
2 * TLS 1.3 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS ( https://tls.mbed.org )
20 */
21
22#include "common.h"
23
Jerry Yucc43c6b2022-01-28 10:24:45 +080024#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080025
Jerry Yubc20bdd2021-08-24 15:59:48 +080026#include <string.h>
27
Jerry Yu56fc07f2021-09-01 17:48:49 +080028#include "mbedtls/debug.h"
29#include "mbedtls/error.h"
Jerry Yue1b9c292021-09-10 10:08:31 +080030#include "mbedtls/platform.h"
Jerry Yua13c7e72021-08-17 10:44:40 +080031
Jerry Yubdc71882021-09-14 19:30:36 +080032#include "ssl_misc.h"
33#include "ecdh_misc.h"
Ronald Cron3d580bf2022-02-18 17:24:56 +010034#include "ssl_client.h"
Jerry Yue1b9c292021-09-10 10:08:31 +080035#include "ssl_tls13_keys.h"
Jerry Yubdc71882021-09-14 19:30:36 +080036
Jerry Yubc20bdd2021-08-24 15:59:48 +080037/* Write extensions */
38
Jerry Yu92c6b402021-08-27 16:59:09 +080039/*
40 * ssl_tls13_write_supported_versions_ext():
41 *
42 * struct {
43 * ProtocolVersion versions<2..254>;
44 * } SupportedVersions;
45 */
Jerry Yuf4436812021-08-26 22:59:56 +080046static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl,
Jerry Yueecfbf02021-08-30 18:32:07 +080047 unsigned char *buf,
48 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +000049 size_t *out_len )
Jerry Yu92c6b402021-08-27 16:59:09 +080050{
51 unsigned char *p = buf;
52
Xiaofei Baid25fab62021-12-02 06:36:27 +000053 *out_len = 0;
Jerry Yu92c6b402021-08-27 16:59:09 +080054
Jerry Yu159c5a02021-08-31 12:51:25 +080055 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) );
Jerry Yu92c6b402021-08-27 16:59:09 +080056
Jerry Yu388bd0d2021-09-15 18:41:02 +080057 /* Check if we have space to write the extension:
Jerry Yub60e3cf2021-09-08 16:41:02 +080058 * - extension_type (2 bytes)
59 * - extension_data_length (2 bytes)
60 * - versions_length (1 byte )
61 * - versions (2 bytes)
Jerry Yu159c5a02021-08-31 12:51:25 +080062 */
Jerry Yu92c6b402021-08-27 16:59:09 +080063 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
64
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080065 /* Write extension_type */
Jerry Yueecfbf02021-08-30 18:32:07 +080066 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
Jerry Yu92c6b402021-08-27 16:59:09 +080067
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080068 /* Write extension_data_length */
Jerry Yub7ab3362021-08-31 16:16:19 +080069 MBEDTLS_PUT_UINT16_BE( 3, p, 2 );
Jerry Yueecfbf02021-08-30 18:32:07 +080070 p += 4;
Jerry Yu92c6b402021-08-27 16:59:09 +080071
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080072 /* Length of versions */
Jerry Yu92c6b402021-08-27 16:59:09 +080073 *p++ = 0x2;
74
Jerry Yu0c63af62021-09-02 12:59:12 +080075 /* Write values of supported versions.
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080076 *
Jerry Yu0c63af62021-09-02 12:59:12 +080077 * They are defined by the configuration.
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080078 *
Jerry Yu0c63af62021-09-02 12:59:12 +080079 * Currently, only one version is advertised.
Jerry Yu92c6b402021-08-27 16:59:09 +080080 */
Jerry Yueecfbf02021-08-30 18:32:07 +080081 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
82 ssl->conf->max_minor_ver,
83 ssl->conf->transport, p );
Jerry Yu92c6b402021-08-27 16:59:09 +080084
85 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]",
Jerry Yueecfbf02021-08-30 18:32:07 +080086 ssl->conf->max_major_ver,
87 ssl->conf->max_minor_ver ) );
Jerry Yu92c6b402021-08-27 16:59:09 +080088
Xiaofei Baid25fab62021-12-02 06:36:27 +000089 *out_len = 7;
Jerry Yu92c6b402021-08-27 16:59:09 +080090
91 return( 0 );
92}
Jerry Yubc20bdd2021-08-24 15:59:48 +080093
Jerry Yuc068b662021-10-11 22:30:19 +080094static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
95 const unsigned char *buf,
Jerry Yub85277e2021-10-13 13:36:05 +080096 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +080097{
Jerry Yue1b9c292021-09-10 10:08:31 +080098 ((void) ssl);
99
Jerry Yub85277e2021-10-13 13:36:05 +0800100 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2);
101 if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 ||
Jerry Yue1b9c292021-09-10 10:08:31 +0800102 buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 )
103 {
104 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) );
Jerry Yu4a173382021-10-11 21:45:31 +0800105
106 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
107 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
108 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue1b9c292021-09-10 10:08:31 +0800109 }
110
111 return( 0 );
112}
113
lhuang0486cacac2022-01-21 07:34:27 -0800114#if defined(MBEDTLS_SSL_ALPN)
lhuang0486cacac2022-01-21 07:34:27 -0800115static int ssl_tls13_parse_alpn_ext( mbedtls_ssl_context *ssl,
116 const unsigned char *buf, size_t len )
117{
118 size_t list_len, name_len;
119 const unsigned char *p = buf;
120 const unsigned char *end = buf + len;
121
122 /* If we didn't send it, the server shouldn't send it */
123 if( ssl->conf->alpn_list == NULL )
124 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
125
126 /*
127 * opaque ProtocolName<1..2^8-1>;
128 *
129 * struct {
130 * ProtocolName protocol_name_list<2..2^16-1>
131 * } ProtocolNameList;
132 *
133 * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
134 */
135
136 /* Min length is 2 ( list_len ) + 1 ( name_len ) + 1 ( name ) */
137 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
138
139 list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
140 p += 2;
141 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, list_len );
142
143 name_len = *p++;
144 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, list_len - 1 );
145
146 /* Check that the server chosen protocol was in our list and save it */
147 for ( const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++ )
148 {
149 if( name_len == strlen( *alpn ) &&
150 memcmp( buf + 3, *alpn, name_len ) == 0 )
151 {
152 ssl->alpn_chosen = *alpn;
153 return( 0 );
154 }
155 }
156
157 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
158}
159#endif /* MBEDTLS_SSL_ALPN */
160
XiaokangQian16acd4b2022-01-14 07:35:47 +0000161static int ssl_tls13_reset_key_share( mbedtls_ssl_context *ssl )
XiaokangQian647719a2021-12-07 09:16:29 +0000162{
163 uint16_t group_id = ssl->handshake->offered_group_id;
Ronald Cron5b98ac92022-03-15 10:19:18 +0100164
XiaokangQian647719a2021-12-07 09:16:29 +0000165 if( group_id == 0 )
166 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
167
XiaokangQian355e09a2022-01-20 11:14:50 +0000168#if defined(MBEDTLS_ECDH_C)
XiaokangQian647719a2021-12-07 09:16:29 +0000169 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
XiaokangQian78b1fa72022-01-19 06:56:30 +0000170 {
Ronald Cron5b98ac92022-03-15 10:19:18 +0100171 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
172 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
173
174 /* Destroy generated private key. */
175 status = psa_destroy_key( ssl->handshake->ecdh_psa_privkey );
176 if( status != PSA_SUCCESS )
177 {
178 ret = psa_ssl_status_to_mbedtls( status );
179 MBEDTLS_SSL_DEBUG_RET( 1, "psa_destroy_key", ret );
180 return( ret );
181 }
182
183 ssl->handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
XiaokangQian78b1fa72022-01-19 06:56:30 +0000184 return( 0 );
185 }
XiaokangQian355e09a2022-01-20 11:14:50 +0000186 else
187#endif /* MBEDTLS_ECDH_C */
188 if( 0 /* other KEMs? */ )
XiaokangQian647719a2021-12-07 09:16:29 +0000189 {
190 /* Do something */
191 }
192
193 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
194}
195
196/*
Jerry Yu56fc07f2021-09-01 17:48:49 +0800197 * Functions for writing key_share extension.
198 */
199#if defined(MBEDTLS_ECDH_C)
Jerry Yu7c522d42021-09-08 17:55:09 +0800200static int ssl_tls13_generate_and_write_ecdh_key_exchange(
Jerry Yub60e3cf2021-09-08 16:41:02 +0800201 mbedtls_ssl_context *ssl,
202 uint16_t named_group,
203 unsigned char *buf,
204 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000205 size_t *out_len )
Jerry Yu92c6b402021-08-27 16:59:09 +0800206{
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100207 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
208 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
209 psa_key_attributes_t key_attributes;
210 size_t own_pubkey_len;
211 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
212 size_t ecdh_bits = 0;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800213
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100214 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Perform PSA-based ECDH computation." ) );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800215
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100216 /* Convert EC group to PSA key type. */
217 if( ( handshake->ecdh_psa_type =
218 mbedtls_psa_parse_tls_ecc_group( named_group, &ecdh_bits ) ) == 0 )
219 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800220
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100221 if( ecdh_bits > 0xffff )
222 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
223 ssl->handshake->ecdh_bits = (uint16_t) ecdh_bits;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800224
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100225 key_attributes = psa_key_attributes_init();
226 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
227 psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH );
228 psa_set_key_type( &key_attributes, handshake->ecdh_psa_type );
229 psa_set_key_bits( &key_attributes, handshake->ecdh_bits );
Przemyslaw Stekielea859c22022-02-10 10:19:46 +0100230
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100231 /* Generate ECDH private key. */
232 status = psa_generate_key( &key_attributes,
233 &handshake->ecdh_psa_privkey );
234 if( status != PSA_SUCCESS )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800235 {
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100236 ret = psa_ssl_status_to_mbedtls( status );
237 MBEDTLS_SSL_DEBUG_RET( 1, "psa_generate_key", ret );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800238 return( ret );
Przemyslaw Stekielea859c22022-02-10 10:19:46 +0100239
Jerry Yu56fc07f2021-09-01 17:48:49 +0800240 }
241
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100242 /* Export the public part of the ECDH private key from PSA. */
243 status = psa_export_public_key( handshake->ecdh_psa_privkey,
244 buf, (size_t)( end - buf ),
245 &own_pubkey_len );
246 if( status != PSA_SUCCESS )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800247 {
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100248 ret = psa_ssl_status_to_mbedtls( status );
249 MBEDTLS_SSL_DEBUG_RET( 1, "psa_export_public_key", ret );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800250 return( ret );
Przemyslaw Stekielea859c22022-02-10 10:19:46 +0100251
Jerry Yu56fc07f2021-09-01 17:48:49 +0800252 }
253
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100254 if( own_pubkey_len > (size_t)( end - buf ) )
255 {
256 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No space in the buffer for ECDH public key." ) );
257 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
258 }
Przemyslaw Stekielea859c22022-02-10 10:19:46 +0100259
Przemek Stekiele894c5c2022-03-02 08:45:56 +0100260 *out_len = own_pubkey_len;
Przemyslaw Stekielea859c22022-02-10 10:19:46 +0100261
Jerry Yu75336352021-09-01 15:59:36 +0800262 return( 0 );
Jerry Yu92c6b402021-08-27 16:59:09 +0800263}
Jerry Yu56fc07f2021-09-01 17:48:49 +0800264#endif /* MBEDTLS_ECDH_C */
265
Jerry Yub60e3cf2021-09-08 16:41:02 +0800266static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl,
267 uint16_t *group_id )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800268{
269 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
270
Jerry Yu56fc07f2021-09-01 17:48:49 +0800271
Jerry Yu56fc07f2021-09-01 17:48:49 +0800272#if defined(MBEDTLS_ECDH_C)
Brett Warren14efd332021-10-06 09:32:11 +0100273 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Jerry Yu388bd0d2021-09-15 18:41:02 +0800274 /* Pick first available ECDHE group compatible with TLS 1.3 */
Brett Warren14efd332021-10-06 09:32:11 +0100275 if( group_list == NULL )
Jerry Yu388bd0d2021-09-15 18:41:02 +0800276 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
277
Brett Warren14efd332021-10-06 09:32:11 +0100278 for ( ; *group_list != 0; group_list++ )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800279 {
Xiaofei Baieef15042021-11-18 07:29:56 +0000280 const mbedtls_ecp_curve_info *curve_info;
281 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
282 if( curve_info != NULL &&
Brett Warren14efd332021-10-06 09:32:11 +0100283 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800284 {
Brett Warren14efd332021-10-06 09:32:11 +0100285 *group_id = *group_list;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800286 return( 0 );
287 }
288 }
289#else
290 ((void) ssl);
Jerry Yub60e3cf2021-09-08 16:41:02 +0800291 ((void) group_id);
Jerry Yu56fc07f2021-09-01 17:48:49 +0800292#endif /* MBEDTLS_ECDH_C */
293
294 /*
295 * Add DHE named groups here.
Jerry Yu388bd0d2021-09-15 18:41:02 +0800296 * Pick first available DHE group compatible with TLS 1.3
Jerry Yu56fc07f2021-09-01 17:48:49 +0800297 */
298
299 return( ret );
300}
301
302/*
303 * ssl_tls13_write_key_share_ext
304 *
Jerry Yu388bd0d2021-09-15 18:41:02 +0800305 * Structure of key_share extension in ClientHello:
Jerry Yu56fc07f2021-09-01 17:48:49 +0800306 *
307 * struct {
308 * NamedGroup group;
309 * opaque key_exchange<1..2^16-1>;
310 * } KeyShareEntry;
311 * struct {
312 * KeyShareEntry client_shares<0..2^16-1>;
313 * } KeyShareClientHello;
314 */
315static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
316 unsigned char *buf,
317 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000318 size_t *out_len )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800319{
320 unsigned char *p = buf;
Xiaofei Baieef15042021-11-18 07:29:56 +0000321 unsigned char *client_shares; /* Start of client_shares */
322 size_t client_shares_len; /* Length of client_shares */
Jerry Yu56fc07f2021-09-01 17:48:49 +0800323 uint16_t group_id;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800324 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
325
Xiaofei Baid25fab62021-12-02 06:36:27 +0000326 *out_len = 0;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800327
Jerry Yub60e3cf2021-09-08 16:41:02 +0800328 /* Check if we have space for header and length fields:
Jerry Yu56fc07f2021-09-01 17:48:49 +0800329 * - extension_type (2 bytes)
330 * - extension_data_length (2 bytes)
331 * - client_shares_length (2 bytes)
332 */
333 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
334 p += 6;
335
336 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) );
337
338 /* HRR could already have requested something else. */
339 group_id = ssl->handshake->offered_group_id;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800340 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) &&
341 !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800342 {
Jerry Yub60e3cf2021-09-08 16:41:02 +0800343 MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl,
Jerry Yu56fc07f2021-09-01 17:48:49 +0800344 &group_id ) );
345 }
346
347 /*
348 * Dispatch to type-specific key generation function.
349 *
350 * So far, we're only supporting ECDHE. With the introduction
351 * of PQC KEMs, we'll want to have multiple branches, one per
352 * type of KEM, and dispatch to the corresponding crypto. And
353 * only one key share entry is allowed.
354 */
Xiaofei Baieef15042021-11-18 07:29:56 +0000355 client_shares = p;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800356#if defined(MBEDTLS_ECDH_C)
Jerry Yub60e3cf2021-09-08 16:41:02 +0800357 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800358 {
Jerry Yu388bd0d2021-09-15 18:41:02 +0800359 /* Pointer to group */
Xiaofei Baieef15042021-11-18 07:29:56 +0000360 unsigned char *group = p;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800361 /* Length of key_exchange */
Przemyslaw Stekiel4f419e52022-02-10 15:56:26 +0100362 size_t key_exchange_len = 0;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800363
364 /* Check there is space for header of KeyShareEntry
365 * - group (2 bytes)
366 * - key_exchange_length (2 bytes)
367 */
368 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
369 p += 4;
Przemyslaw Stekielea859c22022-02-10 10:19:46 +0100370 ret = ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, group_id, p, end,
Jerry Yub60e3cf2021-09-08 16:41:02 +0800371 &key_exchange_len );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800372 p += key_exchange_len;
373 if( ret != 0 )
374 return( ret );
375
376 /* Write group */
Xiaofei Baieef15042021-11-18 07:29:56 +0000377 MBEDTLS_PUT_UINT16_BE( group_id, group, 0 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800378 /* Write key_exchange_length */
Xiaofei Baieef15042021-11-18 07:29:56 +0000379 MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800380 }
381 else
382#endif /* MBEDTLS_ECDH_C */
383 if( 0 /* other KEMs? */ )
384 {
385 /* Do something */
386 }
387 else
388 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
389
Jerry Yub60e3cf2021-09-08 16:41:02 +0800390 /* Length of client_shares */
Xiaofei Baieef15042021-11-18 07:29:56 +0000391 client_shares_len = p - client_shares;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800392 if( client_shares_len == 0)
393 {
394 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) );
395 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu7c522d42021-09-08 17:55:09 +0800396 }
Jerry Yu56fc07f2021-09-01 17:48:49 +0800397 /* Write extension_type */
398 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
399 /* Write extension_data_length */
Jerry Yub60e3cf2021-09-08 16:41:02 +0800400 MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800401 /* Write client_shares_length */
Jerry Yub60e3cf2021-09-08 16:41:02 +0800402 MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800403
404 /* Update offered_group_id field */
405 ssl->handshake->offered_group_id = group_id;
406
407 /* Output the total length of key_share extension. */
Xiaofei Baid25fab62021-12-02 06:36:27 +0000408 *out_len = p - buf;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800409
Xiaofei Baid25fab62021-12-02 06:36:27 +0000410 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800411
412 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
413
414cleanup:
415
416 return( ret );
417}
Jerry Yubc20bdd2021-08-24 15:59:48 +0800418
Jerry Yue1b9c292021-09-10 10:08:31 +0800419#if defined(MBEDTLS_ECDH_C)
420
Jerry Yuc068b662021-10-11 22:30:19 +0800421static int ssl_tls13_read_public_ecdhe_share( mbedtls_ssl_context *ssl,
422 const unsigned char *buf,
423 size_t buf_len )
Jerry Yue1b9c292021-09-10 10:08:31 +0800424{
Przemyslaw Stekiel9e23ddb2022-02-10 10:32:02 +0100425 uint8_t *p = (uint8_t*)buf;
426 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yue1b9c292021-09-10 10:08:31 +0800427
Przemyslaw Stekiel9e23ddb2022-02-10 10:32:02 +0100428 /* Get size of the TLS opaque key_exchange field of the KeyShareEntry struct. */
429 uint16_t peerkey_len = MBEDTLS_GET_UINT16_BE( p, 0 );
430 p += 2;
Jerry Yub85277e2021-10-13 13:36:05 +0800431
Przemyslaw Stekiel9e23ddb2022-02-10 10:32:02 +0100432 /* Check if key size is consistent with given buffer length. */
433 if ( peerkey_len > ( buf_len - 2 ) )
434 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Jerry Yue1b9c292021-09-10 10:08:31 +0800435
Przemyslaw Stekiel9e23ddb2022-02-10 10:32:02 +0100436 /* Store peer's ECDH public key. */
Przemyslaw Stekiel0f5ecef2022-02-14 17:10:05 +0100437 memcpy( handshake->ecdh_psa_peerkey, p, peerkey_len );
Przemyslaw Stekiel9e23ddb2022-02-10 10:32:02 +0100438 handshake->ecdh_psa_peerkey_len = peerkey_len;
Jerry Yue1b9c292021-09-10 10:08:31 +0800439
440 return( 0 );
441}
Jerry Yu4a173382021-10-11 21:45:31 +0800442#endif /* MBEDTLS_ECDH_C */
Jerry Yue1b9c292021-09-10 10:08:31 +0800443
XiaokangQiand59be772022-01-24 10:12:51 +0000444/*
445 * ssl_tls13_parse_hrr_key_share_ext()
446 * Parse key_share extension in Hello Retry Request
447 *
448 * struct {
449 * NamedGroup selected_group;
450 * } KeyShareHelloRetryRequest;
451 */
XiaokangQiand9e068e2022-01-18 06:23:32 +0000452static int ssl_tls13_parse_hrr_key_share_ext( mbedtls_ssl_context *ssl,
XiaokangQianb851da82022-01-14 04:03:11 +0000453 const unsigned char *buf,
454 const unsigned char *end )
455{
XiaokangQianb851da82022-01-14 04:03:11 +0000456 const mbedtls_ecp_curve_info *curve_info = NULL;
457 const unsigned char *p = buf;
XiaokangQiand59be772022-01-24 10:12:51 +0000458 int selected_group;
XiaokangQianb851da82022-01-14 04:03:11 +0000459 int found = 0;
460
461 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
462 if( group_list == NULL )
463 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
464
465 MBEDTLS_SSL_DEBUG_BUF( 3, "key_share extension", p, end - buf );
466
467 /* Read selected_group */
XiaokangQianb48894e2022-01-17 02:05:52 +0000468 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQiand59be772022-01-24 10:12:51 +0000469 selected_group = MBEDTLS_GET_UINT16_BE( p, 0 );
470 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected_group ( %d )", selected_group ) );
XiaokangQianb851da82022-01-14 04:03:11 +0000471
472 /* Upon receipt of this extension in a HelloRetryRequest, the client
473 * MUST first verify that the selected_group field corresponds to a
474 * group which was provided in the "supported_groups" extension in the
475 * original ClientHello.
476 * The supported_group was based on the info in ssl->conf->group_list.
477 *
478 * If the server provided a key share that was not sent in the ClientHello
479 * then the client MUST abort the handshake with an "illegal_parameter" alert.
480 */
XiaokangQiand9e068e2022-01-18 06:23:32 +0000481 for( ; *group_list != 0; group_list++ )
XiaokangQianb851da82022-01-14 04:03:11 +0000482 {
483 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
XiaokangQiand59be772022-01-24 10:12:51 +0000484 if( curve_info == NULL || curve_info->tls_id != selected_group )
XiaokangQianb851da82022-01-14 04:03:11 +0000485 continue;
486
487 /* We found a match */
488 found = 1;
489 break;
490 }
491
492 /* Client MUST verify that the selected_group field does not
493 * correspond to a group which was provided in the "key_share"
494 * extension in the original ClientHello. If the server sent an
495 * HRR message with a key share already provided in the
496 * ClientHello then the client MUST abort the handshake with
497 * an "illegal_parameter" alert.
498 */
XiaokangQiand59be772022-01-24 10:12:51 +0000499 if( found == 0 || selected_group == ssl->handshake->offered_group_id )
XiaokangQianb851da82022-01-14 04:03:11 +0000500 {
501 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid key share in HRR" ) );
502 MBEDTLS_SSL_PEND_FATAL_ALERT(
503 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
504 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
505 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
506 }
507
508 /* Remember server's preference for next ClientHello */
XiaokangQiand59be772022-01-24 10:12:51 +0000509 ssl->handshake->offered_group_id = selected_group;
XiaokangQianb851da82022-01-14 04:03:11 +0000510
511 return( 0 );
512}
513
Jerry Yue1b9c292021-09-10 10:08:31 +0800514/*
Jerry Yub85277e2021-10-13 13:36:05 +0800515 * ssl_tls13_parse_key_share_ext()
516 * Parse key_share extension in Server Hello
517 *
Jerry Yue1b9c292021-09-10 10:08:31 +0800518 * struct {
519 * KeyShareEntry server_share;
520 * } KeyShareServerHello;
521 * struct {
522 * NamedGroup group;
523 * opaque key_exchange<1..2^16-1>;
524 * } KeyShareEntry;
525 */
Jerry Yu4a173382021-10-11 21:45:31 +0800526static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl,
Jerry Yue1b9c292021-09-10 10:08:31 +0800527 const unsigned char *buf,
528 const unsigned char *end )
529{
Jerry Yub85277e2021-10-13 13:36:05 +0800530 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800531 const unsigned char *p = buf;
Jerry Yu4a173382021-10-11 21:45:31 +0800532 uint16_t group, offered_group;
Jerry Yue1b9c292021-09-10 10:08:31 +0800533
Jerry Yu4a173382021-10-11 21:45:31 +0800534 /* ...
535 * NamedGroup group; (2 bytes)
536 * ...
537 */
538 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
539 group = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yue1b9c292021-09-10 10:08:31 +0800540 p += 2;
541
Jerry Yu4a173382021-10-11 21:45:31 +0800542 /* Check that the chosen group matches the one we offered. */
Jerry Yue1b9c292021-09-10 10:08:31 +0800543 offered_group = ssl->handshake->offered_group_id;
Jerry Yu4a173382021-10-11 21:45:31 +0800544 if( offered_group != group )
Jerry Yue1b9c292021-09-10 10:08:31 +0800545 {
546 MBEDTLS_SSL_DEBUG_MSG( 1,
547 ( "Invalid server key share, our group %u, their group %u",
Jerry Yu4a173382021-10-11 21:45:31 +0800548 (unsigned) offered_group, (unsigned) group ) );
549 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
550 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
551 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Jerry Yue1b9c292021-09-10 10:08:31 +0800552 }
553
554#if defined(MBEDTLS_ECDH_C)
Jerry Yu4a173382021-10-11 21:45:31 +0800555 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
Jerry Yue1b9c292021-09-10 10:08:31 +0800556 {
Przemyslaw Stekiel9e23ddb2022-02-10 10:32:02 +0100557 const mbedtls_ecp_curve_info *curve_info =
558 mbedtls_ecp_curve_info_from_tls_id( group );
559 if( curve_info == NULL )
560 {
561 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid TLS curve group id" ) );
562 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
563 }
564
565 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
566
Jerry Yuc068b662021-10-11 22:30:19 +0800567 ret = ssl_tls13_read_public_ecdhe_share( ssl, p, end - p );
Jerry Yue1b9c292021-09-10 10:08:31 +0800568 if( ret != 0 )
569 return( ret );
570 }
Jerry Yub85277e2021-10-13 13:36:05 +0800571 else
Jerry Yue1b9c292021-09-10 10:08:31 +0800572#endif /* MBEDTLS_ECDH_C */
Jerry Yub85277e2021-10-13 13:36:05 +0800573 if( 0 /* other KEMs? */ )
Jerry Yue1b9c292021-09-10 10:08:31 +0800574 {
575 /* Do something */
576 }
577 else
578 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
579
580 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
581 return( ret );
582}
583
XiaokangQiand59be772022-01-24 10:12:51 +0000584/*
585 * ssl_tls13_parse_cookie_ext()
586 * Parse cookie extension in Hello Retry Request
587 *
588 * struct {
589 * opaque cookie<1..2^16-1>;
590 * } Cookie;
591 *
592 * When sending a HelloRetryRequest, the server MAY provide a "cookie"
593 * extension to the client (this is an exception to the usual rule that
594 * the only extensions that may be sent are those that appear in the
595 * ClientHello). When sending the new ClientHello, the client MUST copy
596 * the contents of the extension received in the HelloRetryRequest into
597 * a "cookie" extension in the new ClientHello. Clients MUST NOT use
598 * cookies in their initial ClientHello in subsequent connections.
599 */
XiaokangQian43550bd2022-01-21 04:32:58 +0000600static int ssl_tls13_parse_cookie_ext( mbedtls_ssl_context *ssl,
601 const unsigned char *buf,
602 const unsigned char *end )
603{
XiaokangQian25c9c902022-02-08 10:49:53 +0000604 uint16_t cookie_len;
XiaokangQian43550bd2022-01-21 04:32:58 +0000605 const unsigned char *p = buf;
606 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
607
608 /* Retrieve length field of cookie */
609 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
610 cookie_len = MBEDTLS_GET_UINT16_BE( p, 0 );
611 p += 2;
612
613 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cookie_len );
614 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie extension", p, cookie_len );
615
XiaokangQian9b93c0d2022-02-09 06:02:25 +0000616 mbedtls_free( handshake->cookie );
XiaokangQian25c9c902022-02-08 10:49:53 +0000617 handshake->hrr_cookie_len = 0;
XiaokangQian9b93c0d2022-02-09 06:02:25 +0000618 handshake->cookie = mbedtls_calloc( 1, cookie_len );
619 if( handshake->cookie == NULL )
XiaokangQian43550bd2022-01-21 04:32:58 +0000620 {
621 MBEDTLS_SSL_DEBUG_MSG( 1,
XiaokangQian25c9c902022-02-08 10:49:53 +0000622 ( "alloc failed ( %ud bytes )",
XiaokangQian43550bd2022-01-21 04:32:58 +0000623 cookie_len ) );
624 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
625 }
626
XiaokangQian9b93c0d2022-02-09 06:02:25 +0000627 memcpy( handshake->cookie, p, cookie_len );
XiaokangQian25c9c902022-02-08 10:49:53 +0000628 handshake->hrr_cookie_len = cookie_len;
XiaokangQian43550bd2022-01-21 04:32:58 +0000629
630 return( 0 );
631}
XiaokangQian43550bd2022-01-21 04:32:58 +0000632
XiaokangQian0b64eed2022-01-27 10:36:51 +0000633static int ssl_tls13_write_cookie_ext( mbedtls_ssl_context *ssl,
XiaokangQian233397e2022-02-07 08:32:16 +0000634 unsigned char *buf,
635 unsigned char *end,
XiaokangQian9deb90f2022-02-08 10:31:07 +0000636 size_t *out_len )
XiaokangQian0b64eed2022-01-27 10:36:51 +0000637{
638 unsigned char *p = buf;
XiaokangQian9deb90f2022-02-08 10:31:07 +0000639 *out_len = 0;
XiaokangQianc02768a2022-02-10 07:31:25 +0000640 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
XiaokangQian0b64eed2022-01-27 10:36:51 +0000641
XiaokangQianc02768a2022-02-10 07:31:25 +0000642 if( handshake->cookie == NULL )
XiaokangQian0b64eed2022-01-27 10:36:51 +0000643 {
644 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no cookie to send; skip extension" ) );
645 return( 0 );
646 }
647
648 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
XiaokangQianc02768a2022-02-10 07:31:25 +0000649 handshake->cookie,
650 handshake->hrr_cookie_len );
XiaokangQian0b64eed2022-01-27 10:36:51 +0000651
XiaokangQianc02768a2022-02-10 07:31:25 +0000652 MBEDTLS_SSL_CHK_BUF_PTR( p, end, handshake->hrr_cookie_len + 6 );
XiaokangQian0b64eed2022-01-27 10:36:51 +0000653
654 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding cookie extension" ) );
655
XiaokangQian0b64eed2022-01-27 10:36:51 +0000656 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_COOKIE, p, 0 );
XiaokangQianc02768a2022-02-10 07:31:25 +0000657 MBEDTLS_PUT_UINT16_BE( handshake->hrr_cookie_len + 2, p, 2 );
658 MBEDTLS_PUT_UINT16_BE( handshake->hrr_cookie_len, p, 4 );
XiaokangQian233397e2022-02-07 08:32:16 +0000659 p += 6;
XiaokangQian0b64eed2022-01-27 10:36:51 +0000660
661 /* Cookie */
XiaokangQianc02768a2022-02-10 07:31:25 +0000662 memcpy( p, handshake->cookie, handshake->hrr_cookie_len );
XiaokangQian0b64eed2022-01-27 10:36:51 +0000663
XiaokangQianc02768a2022-02-10 07:31:25 +0000664 *out_len = handshake->hrr_cookie_len + 6;
XiaokangQian0b64eed2022-01-27 10:36:51 +0000665
666 return( 0 );
667}
668
Ronald Cron3d580bf2022-02-18 17:24:56 +0100669int mbedtls_ssl_tls13_write_client_hello_exts( mbedtls_ssl_context *ssl,
670 unsigned char *buf,
671 unsigned char *end,
672 size_t *out_len )
Ronald Cron04fbd2b2022-02-18 12:06:07 +0100673{
674 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
675 unsigned char *p = buf;
676 size_t ext_len;
677
678 *out_len = 0;
679
680 /* Write supported_versions extension
681 *
682 * Supported Versions Extension is mandatory with TLS 1.3.
683 */
684 ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &ext_len );
685 if( ret != 0 )
686 return( ret );
687 p += ext_len;
688
689 /* Echo the cookie if the server provided one in its preceding
690 * HelloRetryRequest message.
691 */
692 ret = ssl_tls13_write_cookie_ext( ssl, p, end, &ext_len );
693 if( ret != 0 )
694 return( ret );
695 p += ext_len;
696
Ronald Cron04fbd2b2022-02-18 12:06:07 +0100697 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
698 {
699 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &ext_len );
700 if( ret != 0 )
701 return( ret );
702 p += ext_len;
703 }
Ronald Cron04fbd2b2022-02-18 12:06:07 +0100704
705 *out_len = p - buf;
706
707 return( 0 );
708}
709
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800710/*
Jerry Yu4a173382021-10-11 21:45:31 +0800711 * Functions for parsing and processing Server Hello
Jerry Yue1b9c292021-09-10 10:08:31 +0800712 */
Ronald Cron9f0fba32022-02-10 16:45:15 +0100713static int ssl_tls13_is_supported_versions_ext_present(
714 mbedtls_ssl_context *ssl,
715 const unsigned char *buf,
716 const unsigned char *end )
717{
718 const unsigned char *p = buf;
719 size_t legacy_session_id_echo_len;
720 size_t extensions_len;
721 const unsigned char *extensions_end;
722
723 /*
724 * Check there is enough data to access the legacy_session_id_echo vector
725 * length.
726 * - legacy_version, 2 bytes
727 * - random MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes
728 * - legacy_session_id_echo 1 byte
729 */
730 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 3 );
731 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN + 2;
732 legacy_session_id_echo_len = *p;
733
734 /*
735 * Jump to the extensions, jumping over:
736 * - legacy_session_id_echo (legacy_session_id_echo_len + 1) bytes
737 * - cipher_suite 2 bytes
738 * - legacy_compression_method 1 byte
739 */
740 p += legacy_session_id_echo_len + 4;
741
742 /* Case of no extension */
743 if( p == end )
744 return( 0 );
745
746 /* ...
747 * Extension extensions<6..2^16-1>;
748 * ...
749 * struct {
750 * ExtensionType extension_type; (2 bytes)
751 * opaque extension_data<0..2^16-1>;
752 * } Extension;
753 */
754 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
755 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
756 p += 2;
757
758 /* Check extensions do not go beyond the buffer of data. */
759 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
760 extensions_end = p + extensions_len;
761
762 while( p < extensions_end )
763 {
764 unsigned int extension_type;
765 size_t extension_data_len;
766
767 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
768 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
769 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
770 p += 4;
771
772 if( extension_type == MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS )
773 return( 1 );
774
775 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
776 p += extension_data_len;
777 }
778
779 return( 0 );
780}
781
Jerry Yu7a186a02021-10-15 18:46:14 +0800782/* Returns a negative value on failure, and otherwise
Jerry Yub85277e2021-10-13 13:36:05 +0800783 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
784 * - SSL_SERVER_HELLO_COORDINATE_HRR
XiaokangQian51eff222021-12-10 10:33:56 +0000785 * to indicate which message is expected and to be parsed next.
786 */
Jerry Yub85277e2021-10-13 13:36:05 +0800787#define SSL_SERVER_HELLO_COORDINATE_HELLO 0
788#define SSL_SERVER_HELLO_COORDINATE_HRR 1
789static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl,
790 const unsigned char *buf,
791 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800792{
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800793 static const unsigned char magic_hrr_string[MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
Jerry Yue1b9c292021-09-10 10:08:31 +0800794 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
795 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
796 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
797 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33 ,0x9C };
798
799 /* Check whether this message is a HelloRetryRequest ( HRR ) message.
800 *
Jerry Yu4a173382021-10-11 21:45:31 +0800801 * Server Hello and HRR are only distinguished by Random set to the
Jerry Yue1b9c292021-09-10 10:08:31 +0800802 * special value of the SHA-256 of "HelloRetryRequest".
803 *
804 * struct {
805 * ProtocolVersion legacy_version = 0x0303;
806 * Random random;
807 * opaque legacy_session_id_echo<0..32>;
808 * CipherSuite cipher_suite;
809 * uint8 legacy_compression_method = 0;
Jerry Yub85277e2021-10-13 13:36:05 +0800810 * Extension extensions<6..2^16-1>;
Jerry Yue1b9c292021-09-10 10:08:31 +0800811 * } ServerHello;
812 *
813 */
Jerry Yub85277e2021-10-13 13:36:05 +0800814 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 + sizeof( magic_hrr_string ) );
Jerry Yu4a173382021-10-11 21:45:31 +0800815
816 if( memcmp( buf + 2, magic_hrr_string, sizeof( magic_hrr_string ) ) == 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800817 {
Jerry Yub85277e2021-10-13 13:36:05 +0800818 return( SSL_SERVER_HELLO_COORDINATE_HRR );
Jerry Yue1b9c292021-09-10 10:08:31 +0800819 }
820
Jerry Yub85277e2021-10-13 13:36:05 +0800821 return( SSL_SERVER_HELLO_COORDINATE_HELLO );
Jerry Yue1b9c292021-09-10 10:08:31 +0800822}
823
Jerry Yu745bb612021-10-13 22:01:04 +0800824/* Fetch and preprocess
825 * Returns a negative value on failure, and otherwise
826 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
Ronald Cron9f0fba32022-02-10 16:45:15 +0100827 * - SSL_SERVER_HELLO_COORDINATE_HRR or
828 * - SSL_SERVER_HELLO_COORDINATE_TLS1_2
Jerry Yu745bb612021-10-13 22:01:04 +0800829 */
Ronald Cron9f0fba32022-02-10 16:45:15 +0100830#define SSL_SERVER_HELLO_COORDINATE_TLS1_2 2
Jerry Yub85277e2021-10-13 13:36:05 +0800831static int ssl_tls13_server_hello_coordinate( mbedtls_ssl_context *ssl,
832 unsigned char **buf,
833 size_t *buf_len )
Jerry Yue1b9c292021-09-10 10:08:31 +0800834{
Jerry Yu4a173382021-10-11 21:45:31 +0800835 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800836
XiaokangQian355e09a2022-01-20 11:14:50 +0000837 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
838 MBEDTLS_SSL_HS_SERVER_HELLO,
839 buf, buf_len ) );
Jerry Yue1b9c292021-09-10 10:08:31 +0800840
Ronald Cron9f0fba32022-02-10 16:45:15 +0100841 MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_is_supported_versions_ext_present(
842 ssl, *buf, *buf + *buf_len ) );
843 if( ret == 0 )
844 {
845 /* If the supported versions extension is not present but we were
846 * expecting it, abort the handshake. Otherwise, switch to TLS 1.2
847 * handshake.
848 */
849 if( ssl->handshake->min_minor_ver > MBEDTLS_SSL_MINOR_VERSION_3 )
850 {
851 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
852 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
853 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
854 }
855
856 ssl->keep_current_message = 1;
857 ssl->minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
858 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
859 *buf, *buf_len );
860
861 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
862 {
863 ret = ssl_tls13_reset_key_share( ssl );
864 if( ret != 0 )
865 return( ret );
866 }
867
868 return( SSL_SERVER_HELLO_COORDINATE_TLS1_2 );
869 }
870
Jerry Yub85277e2021-10-13 13:36:05 +0800871 ret = ssl_server_hello_is_hrr( ssl, *buf, *buf + *buf_len );
872 switch( ret )
Jerry Yue1b9c292021-09-10 10:08:31 +0800873 {
Jerry Yu745bb612021-10-13 22:01:04 +0800874 case SSL_SERVER_HELLO_COORDINATE_HELLO:
875 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) );
876 break;
877 case SSL_SERVER_HELLO_COORDINATE_HRR:
878 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) );
XiaokangQian16acd4b2022-01-14 07:35:47 +0000879 /* If a client receives a second
880 * HelloRetryRequest in the same connection (i.e., where the ClientHello
881 * was itself in response to a HelloRetryRequest), it MUST abort the
882 * handshake with an "unexpected_message" alert.
883 */
XiaokangQiand9e068e2022-01-18 06:23:32 +0000884 if( ssl->handshake->hello_retry_request_count > 0 )
XiaokangQian16acd4b2022-01-14 07:35:47 +0000885 {
886 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Multiple HRRs received" ) );
887 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
888 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
889 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
890 }
XiaokangQian2b01dc32022-01-21 02:53:13 +0000891 /*
892 * Clients must abort the handshake with an "illegal_parameter"
893 * alert if the HelloRetryRequest would not result in any change
894 * in the ClientHello.
895 * In a PSK only key exchange that what we expect.
896 */
897 if( ! mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
898 {
899 MBEDTLS_SSL_DEBUG_MSG( 1,
900 ( "Unexpected HRR in pure PSK key exchange." ) );
901 MBEDTLS_SSL_PEND_FATAL_ALERT(
902 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
903 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
904 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
905 }
XiaokangQian16acd4b2022-01-14 07:35:47 +0000906
XiaokangQiand9e068e2022-01-18 06:23:32 +0000907 ssl->handshake->hello_retry_request_count++;
XiaokangQian16acd4b2022-01-14 07:35:47 +0000908
Jerry Yu745bb612021-10-13 22:01:04 +0800909 break;
Jerry Yue1b9c292021-09-10 10:08:31 +0800910 }
911
912cleanup:
913
914 return( ret );
915}
916
Jerry Yu4a173382021-10-11 21:45:31 +0800917static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl,
918 const unsigned char **buf,
919 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800920{
921 const unsigned char *p = *buf;
Jerry Yu4a173382021-10-11 21:45:31 +0800922 size_t legacy_session_id_echo_len;
Jerry Yue1b9c292021-09-10 10:08:31 +0800923
Jerry Yude4fb2c2021-09-19 18:05:08 +0800924 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
Jerry Yu4a173382021-10-11 21:45:31 +0800925 legacy_session_id_echo_len = *p++ ;
Jerry Yue1b9c292021-09-10 10:08:31 +0800926
Jerry Yu4a173382021-10-11 21:45:31 +0800927 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len );
Jerry Yue1b9c292021-09-10 10:08:31 +0800928
929 /* legacy_session_id_echo */
Jerry Yu4a173382021-10-11 21:45:31 +0800930 if( ssl->session_negotiate->id_len != legacy_session_id_echo_len ||
931 memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800932 {
Jerry Yue1b9c292021-09-10 10:08:31 +0800933 MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID",
934 ssl->session_negotiate->id,
935 ssl->session_negotiate->id_len );
936 MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p,
Jerry Yu4a173382021-10-11 21:45:31 +0800937 legacy_session_id_echo_len );
938
939 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
940 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
941
Jerry Yue1b9c292021-09-10 10:08:31 +0800942 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
943 }
944
Jerry Yu4a173382021-10-11 21:45:31 +0800945 p += legacy_session_id_echo_len;
Jerry Yue1b9c292021-09-10 10:08:31 +0800946 *buf = p;
947
948 MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id,
Jerry Yu4a173382021-10-11 21:45:31 +0800949 ssl->session_negotiate->id_len );
Jerry Yue1b9c292021-09-10 10:08:31 +0800950 return( 0 );
951}
952
Jerry Yu4a173382021-10-11 21:45:31 +0800953static int ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl,
954 int cipher_suite )
Jerry Yue1b9c292021-09-10 10:08:31 +0800955{
Jerry Yu4a173382021-10-11 21:45:31 +0800956 const int *ciphersuite_list = ssl->conf->ciphersuite_list;
957
Jerry Yue1b9c292021-09-10 10:08:31 +0800958 /* Check whether we have offered this ciphersuite */
Jerry Yu4a173382021-10-11 21:45:31 +0800959 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
Jerry Yue1b9c292021-09-10 10:08:31 +0800960 {
Jerry Yu4a173382021-10-11 21:45:31 +0800961 if( ciphersuite_list[i] == cipher_suite )
Jerry Yue1b9c292021-09-10 10:08:31 +0800962 {
963 return( 1 );
964 }
965 }
966 return( 0 );
967}
968
969/* Parse ServerHello message and configure context
970 *
971 * struct {
972 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
973 * Random random;
974 * opaque legacy_session_id_echo<0..32>;
975 * CipherSuite cipher_suite;
976 * uint8 legacy_compression_method = 0;
Jerry Yub85277e2021-10-13 13:36:05 +0800977 * Extension extensions<6..2^16-1>;
Jerry Yue1b9c292021-09-10 10:08:31 +0800978 * } ServerHello;
979 */
Jerry Yuc068b662021-10-11 22:30:19 +0800980static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl,
981 const unsigned char *buf,
XiaokangQiand9e068e2022-01-18 06:23:32 +0000982 const unsigned char *end,
983 int is_hrr )
Jerry Yue1b9c292021-09-10 10:08:31 +0800984{
Jerry Yub85277e2021-10-13 13:36:05 +0800985 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800986 const unsigned char *p = buf;
XiaokangQian355e09a2022-01-20 11:14:50 +0000987 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yub85277e2021-10-13 13:36:05 +0800988 size_t extensions_len;
989 const unsigned char *extensions_end;
Jerry Yue1b9c292021-09-10 10:08:31 +0800990 uint16_t cipher_suite;
Jerry Yude4fb2c2021-09-19 18:05:08 +0800991 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
XiaokangQianb119a352022-01-26 03:29:10 +0000992 int fatal_alert = 0;
Jerry Yue1b9c292021-09-10 10:08:31 +0800993
994 /*
995 * Check there is space for minimal fields
996 *
997 * - legacy_version ( 2 bytes)
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800998 * - random (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes)
Jerry Yue1b9c292021-09-10 10:08:31 +0800999 * - legacy_session_id_echo ( 1 byte ), minimum size
1000 * - cipher_suite ( 2 bytes)
1001 * - legacy_compression_method ( 1 byte )
1002 */
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001003 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001004
1005 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p );
Jerry Yue1b9c292021-09-10 10:08:31 +08001006 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 );
1007
Jerry Yu4a173382021-10-11 21:45:31 +08001008 /* ...
Jerry Yub85277e2021-10-13 13:36:05 +08001009 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
Jerry Yu4a173382021-10-11 21:45:31 +08001010 * ...
1011 * with ProtocolVersion defined as:
1012 * uint16 ProtocolVersion;
1013 */
Jerry Yue1b9c292021-09-10 10:08:31 +08001014 if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 &&
1015 p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) )
1016 {
1017 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
1018 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1019 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
XiaokangQiand59be772022-01-24 10:12:51 +00001020 ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1021 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001022 }
1023 p += 2;
Jerry Yue1b9c292021-09-10 10:08:31 +08001024
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001025 /* ...
Jerry Yu4a173382021-10-11 21:45:31 +08001026 * Random random;
1027 * ...
1028 * with Random defined as:
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001029 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu4a173382021-10-11 21:45:31 +08001030 */
XiaokangQian53f20b72022-01-18 10:47:33 +00001031 if( !is_hrr )
1032 {
XiaokangQian355e09a2022-01-20 11:14:50 +00001033 memcpy( &handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p,
XiaokangQian53f20b72022-01-18 10:47:33 +00001034 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1035 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
1036 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1037 }
Jerry Yue6d7e5c2021-10-26 10:44:32 +08001038 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
Jerry Yue1b9c292021-09-10 10:08:31 +08001039
Jerry Yu4a173382021-10-11 21:45:31 +08001040 /* ...
1041 * opaque legacy_session_id_echo<0..32>;
1042 * ...
1043 */
1044 if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +08001045 {
XiaokangQian52da5582022-01-26 09:49:29 +00001046 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQiand59be772022-01-24 10:12:51 +00001047 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001048 }
1049
Jerry Yu4a173382021-10-11 21:45:31 +08001050 /* ...
1051 * CipherSuite cipher_suite;
1052 * ...
1053 * with CipherSuite defined as:
1054 * uint8 CipherSuite[2];
1055 */
1056 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001057 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
1058 p += 2;
1059
Jerry Yu4a173382021-10-11 21:45:31 +08001060
XiaokangQian355e09a2022-01-20 11:14:50 +00001061 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
Jerry Yu4a173382021-10-11 21:45:31 +08001062 /*
1063 * Check whether this ciphersuite is supported and offered.
1064 * Via the force_ciphersuite version we may have instructed the client
1065 * to use a different ciphersuite.
1066 */
Jerry Yu4a173382021-10-11 21:45:31 +08001067 if( ciphersuite_info == NULL ||
1068 ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) == 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +08001069 {
XiaokangQian52da5582022-01-26 09:49:29 +00001070 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
Jerry Yue1b9c292021-09-10 10:08:31 +08001071 }
XiaokangQian53f20b72022-01-18 10:47:33 +00001072 /*
XiaokangQian355e09a2022-01-20 11:14:50 +00001073 * If we received an HRR before and that the proposed selected
1074 * ciphersuite in this server hello is not the same as the one
1075 * proposed in the HRR, we abort the handshake and send an
1076 * "illegal_parameter" alert.
XiaokangQian53f20b72022-01-18 10:47:33 +00001077 */
XiaokangQian355e09a2022-01-20 11:14:50 +00001078 else if( ( !is_hrr ) && ( handshake->hello_retry_request_count > 0 ) &&
1079 ( cipher_suite != ssl->session_negotiate->ciphersuite ) )
XiaokangQian53f20b72022-01-18 10:47:33 +00001080 {
XiaokangQian52da5582022-01-26 09:49:29 +00001081 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQian355e09a2022-01-20 11:14:50 +00001082 }
XiaokangQian53f20b72022-01-18 10:47:33 +00001083
XiaokangQian52da5582022-01-26 09:49:29 +00001084 if( fatal_alert == MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER )
XiaokangQian355e09a2022-01-20 11:14:50 +00001085 {
1086 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid ciphersuite(%04x) parameter",
1087 cipher_suite ) );
XiaokangQiand59be772022-01-24 10:12:51 +00001088 goto cleanup;
XiaokangQian53f20b72022-01-18 10:47:33 +00001089 }
Jerry Yue1b9c292021-09-10 10:08:31 +08001090
Jerry Yu4a173382021-10-11 21:45:31 +08001091 /* Configure ciphersuites */
1092 mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info );
1093
XiaokangQian355e09a2022-01-20 11:14:50 +00001094 handshake->ciphersuite_info = ciphersuite_info;
Jerry Yue1b9c292021-09-10 10:08:31 +08001095 ssl->session_negotiate->ciphersuite = cipher_suite;
1096
Jerry Yue1b9c292021-09-10 10:08:31 +08001097 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s",
1098 cipher_suite, ciphersuite_info->name ) );
1099
1100#if defined(MBEDTLS_HAVE_TIME)
1101 ssl->session_negotiate->start = time( NULL );
1102#endif /* MBEDTLS_HAVE_TIME */
1103
Jerry Yu4a173382021-10-11 21:45:31 +08001104 /* ...
1105 * uint8 legacy_compression_method = 0;
1106 * ...
Jerry Yue1b9c292021-09-10 10:08:31 +08001107 */
Jerry Yude4fb2c2021-09-19 18:05:08 +08001108 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001109 if( p[0] != 0 )
1110 {
Jerry Yub85277e2021-10-13 13:36:05 +08001111 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
XiaokangQian52da5582022-01-26 09:49:29 +00001112 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
XiaokangQiand59be772022-01-24 10:12:51 +00001113 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001114 }
1115 p++;
1116
Jerry Yub85277e2021-10-13 13:36:05 +08001117 /* ...
1118 * Extension extensions<6..2^16-1>;
1119 * ...
Jerry Yu4a173382021-10-11 21:45:31 +08001120 * struct {
1121 * ExtensionType extension_type; (2 bytes)
1122 * opaque extension_data<0..2^16-1>;
1123 * } Extension;
1124 */
Jerry Yude4fb2c2021-09-19 18:05:08 +08001125 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
Jerry Yu4a173382021-10-11 21:45:31 +08001126 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001127 p += 2;
Jerry Yude4fb2c2021-09-19 18:05:08 +08001128
Jerry Yu4a173382021-10-11 21:45:31 +08001129 /* Check extensions do not go beyond the buffer of data. */
1130 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1131 extensions_end = p + extensions_len;
Jerry Yue1b9c292021-09-10 10:08:31 +08001132
Jerry Yu4a173382021-10-11 21:45:31 +08001133 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001134
Jerry Yu4a173382021-10-11 21:45:31 +08001135 while( p < extensions_end )
Jerry Yue1b9c292021-09-10 10:08:31 +08001136 {
1137 unsigned int extension_type;
1138 size_t extension_data_len;
XiaokangQian43550bd2022-01-21 04:32:58 +00001139 const unsigned char *extension_data_end;
Jerry Yue1b9c292021-09-10 10:08:31 +08001140
Jerry Yu4a173382021-10-11 21:45:31 +08001141 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001142 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1143 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1144 p += 4;
1145
Jerry Yu4a173382021-10-11 21:45:31 +08001146 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
XiaokangQian43550bd2022-01-21 04:32:58 +00001147 extension_data_end = p + extension_data_len;
Jerry Yue1b9c292021-09-10 10:08:31 +08001148
1149 switch( extension_type )
1150 {
XiaokangQianb851da82022-01-14 04:03:11 +00001151 case MBEDTLS_TLS_EXT_COOKIE:
1152
XiaokangQiand9e068e2022-01-18 06:23:32 +00001153 if( !is_hrr )
1154 {
XiaokangQian52da5582022-01-26 09:49:29 +00001155 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001156 goto cleanup;
XiaokangQiand9e068e2022-01-18 06:23:32 +00001157 }
1158
XiaokangQian43550bd2022-01-21 04:32:58 +00001159 ret = ssl_tls13_parse_cookie_ext( ssl,
1160 p, extension_data_end );
1161 if( ret != 0 )
XiaokangQianb851da82022-01-14 04:03:11 +00001162 {
XiaokangQian43550bd2022-01-21 04:32:58 +00001163 MBEDTLS_SSL_DEBUG_RET( 1,
1164 "ssl_tls13_parse_cookie_ext",
1165 ret );
XiaokangQiand59be772022-01-24 10:12:51 +00001166 goto cleanup;
XiaokangQianb851da82022-01-14 04:03:11 +00001167 }
XiaokangQianb851da82022-01-14 04:03:11 +00001168 break;
XiaokangQianb851da82022-01-14 04:03:11 +00001169
Jerry Yue1b9c292021-09-10 10:08:31 +08001170 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Jerry Yuc068b662021-10-11 22:30:19 +08001171 ret = ssl_tls13_parse_supported_versions_ext( ssl,
Jerry Yub85277e2021-10-13 13:36:05 +08001172 p,
XiaokangQian43550bd2022-01-21 04:32:58 +00001173 extension_data_end );
Jerry Yue1b9c292021-09-10 10:08:31 +08001174 if( ret != 0 )
XiaokangQiand59be772022-01-24 10:12:51 +00001175 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001176 break;
1177
1178 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1179 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) );
1180 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001181
XiaokangQian52da5582022-01-26 09:49:29 +00001182 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001183 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001184
Jerry Yue1b9c292021-09-10 10:08:31 +08001185 case MBEDTLS_TLS_EXT_KEY_SHARE:
1186 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
XiaokangQiand59be772022-01-24 10:12:51 +00001187 if( ! mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1188 {
XiaokangQian52da5582022-01-26 09:49:29 +00001189 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001190 goto cleanup;
1191 }
1192
XiaokangQian53f20b72022-01-18 10:47:33 +00001193 if( is_hrr )
XiaokangQiand9e068e2022-01-18 06:23:32 +00001194 ret = ssl_tls13_parse_hrr_key_share_ext( ssl,
XiaokangQian43550bd2022-01-21 04:32:58 +00001195 p, extension_data_end );
XiaokangQian53f20b72022-01-18 10:47:33 +00001196 else
XiaokangQianb851da82022-01-14 04:03:11 +00001197 ret = ssl_tls13_parse_key_share_ext( ssl,
XiaokangQian43550bd2022-01-21 04:32:58 +00001198 p, extension_data_end );
XiaokangQianb851da82022-01-14 04:03:11 +00001199 if( ret != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +08001200 {
1201 MBEDTLS_SSL_DEBUG_RET( 1,
Jerry Yu4a173382021-10-11 21:45:31 +08001202 "ssl_tls13_parse_key_share_ext",
Jerry Yue1b9c292021-09-10 10:08:31 +08001203 ret );
XiaokangQiand59be772022-01-24 10:12:51 +00001204 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001205 }
1206 break;
Jerry Yue1b9c292021-09-10 10:08:31 +08001207
1208 default:
Jerry Yu4a173382021-10-11 21:45:31 +08001209 MBEDTLS_SSL_DEBUG_MSG(
1210 3,
1211 ( "unknown extension found: %u ( ignoring )",
1212 extension_type ) );
1213
XiaokangQian52da5582022-01-26 09:49:29 +00001214 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
XiaokangQiand59be772022-01-24 10:12:51 +00001215 goto cleanup;
Jerry Yue1b9c292021-09-10 10:08:31 +08001216 }
1217
1218 p += extension_data_len;
1219 }
1220
XiaokangQiand59be772022-01-24 10:12:51 +00001221cleanup:
1222
XiaokangQian52da5582022-01-26 09:49:29 +00001223 if( fatal_alert == MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT )
XiaokangQiand59be772022-01-24 10:12:51 +00001224 {
1225 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1226 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1227 ret = MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
1228 }
XiaokangQian52da5582022-01-26 09:49:29 +00001229 else if ( fatal_alert == MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER )
XiaokangQiand59be772022-01-24 10:12:51 +00001230 {
1231 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1232 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1233 ret = MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1234 }
1235 return( ret );
Jerry Yue1b9c292021-09-10 10:08:31 +08001236}
1237
XiaokangQian355e09a2022-01-20 11:14:50 +00001238static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
Jerry Yue1b9c292021-09-10 10:08:31 +08001239{
Jerry Yub85277e2021-10-13 13:36:05 +08001240 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu0b177842021-09-05 19:41:30 +08001241 mbedtls_ssl_key_set traffic_keys;
Jerry Yu4a173382021-10-11 21:45:31 +08001242 mbedtls_ssl_transform *transform_handshake = NULL;
Jerry Yub85277e2021-10-13 13:36:05 +08001243 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu0b177842021-09-05 19:41:30 +08001244
Jerry Yub85277e2021-10-13 13:36:05 +08001245 /* Determine the key exchange mode:
1246 * 1) If both the pre_shared_key and key_share extensions were received
1247 * then the key exchange mode is PSK with EPHEMERAL.
1248 * 2) If only the pre_shared_key extension was received then the key
1249 * exchange mode is PSK-only.
1250 * 3) If only the key_share extension was received then the key
1251 * exchange mode is EPHEMERAL-only.
Jerry Yu0b177842021-09-05 19:41:30 +08001252 */
Jerry Yub85277e2021-10-13 13:36:05 +08001253 switch( handshake->extensions_present &
1254 ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ) )
Jerry Yu0b177842021-09-05 19:41:30 +08001255 {
Jerry Yu745bb612021-10-13 22:01:04 +08001256 /* Only the pre_shared_key extension was received */
1257 case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
Xiaofei Baid25fab62021-12-02 06:36:27 +00001258 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
Jerry Yu745bb612021-10-13 22:01:04 +08001259 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001260
Jerry Yu745bb612021-10-13 22:01:04 +08001261 /* Only the key_share extension was received */
1262 case MBEDTLS_SSL_EXT_KEY_SHARE:
Xiaofei Baid25fab62021-12-02 06:36:27 +00001263 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
Jerry Yu745bb612021-10-13 22:01:04 +08001264 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001265
Jerry Yu745bb612021-10-13 22:01:04 +08001266 /* Both the pre_shared_key and key_share extensions were received */
1267 case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
Xiaofei Baid25fab62021-12-02 06:36:27 +00001268 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
Jerry Yu745bb612021-10-13 22:01:04 +08001269 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001270
Jerry Yu745bb612021-10-13 22:01:04 +08001271 /* Neither pre_shared_key nor key_share extension was received */
1272 default:
1273 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) );
1274 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1275 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001276 }
1277
1278 /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
1279 *
1280 * TODO: We don't have to do this in case we offered 0-RTT and the
1281 * server accepted it. In this case, we could skip generating
1282 * the early secret. */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001283 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
Jerry Yu0b177842021-09-05 19:41:30 +08001284 if( ret != 0 )
1285 {
Xiaofei Bai746f9482021-11-12 08:53:56 +00001286 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early_data",
Jerry Yu0b177842021-09-05 19:41:30 +08001287 ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001288 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001289 }
1290
1291 /* Compute handshake secret */
Jerry Yuf0ac2352021-10-11 17:47:07 +08001292 ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl );
Jerry Yu0b177842021-09-05 19:41:30 +08001293 if( ret != 0 )
1294 {
Xiaofei Bai746f9482021-11-12 08:53:56 +00001295 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001296 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001297 }
1298
1299 /* Next evolution in key schedule: Establish handshake secret and
1300 * key material. */
Jerry Yuc068b662021-10-11 22:30:19 +08001301 ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys );
Jerry Yu0b177842021-09-05 19:41:30 +08001302 if( ret != 0 )
1303 {
Jerry Yuc068b662021-10-11 22:30:19 +08001304 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys",
1305 ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001306 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001307 }
1308
Jerry Yub85277e2021-10-13 13:36:05 +08001309 transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) );
Jerry Yu0b177842021-09-05 19:41:30 +08001310 if( transform_handshake == NULL )
Jerry Yu4a173382021-10-11 21:45:31 +08001311 {
1312 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
1313 goto cleanup;
1314 }
Jerry Yu0b177842021-09-05 19:41:30 +08001315
1316 ret = mbedtls_ssl_tls13_populate_transform( transform_handshake,
1317 ssl->conf->endpoint,
1318 ssl->session_negotiate->ciphersuite,
1319 &traffic_keys,
1320 ssl );
1321 if( ret != 0 )
1322 {
1323 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001324 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001325 }
1326
Jerry Yub85277e2021-10-13 13:36:05 +08001327 handshake->transform_handshake = transform_handshake;
1328 mbedtls_ssl_set_inbound_transform( ssl, transform_handshake );
Jerry Yu0b177842021-09-05 19:41:30 +08001329
1330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
1331 ssl->session_in = ssl->session_negotiate;
1332
1333 /*
1334 * State machine update
1335 */
1336 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
1337
Jerry Yu4a173382021-10-11 21:45:31 +08001338cleanup:
1339
Jerry Yu0b177842021-09-05 19:41:30 +08001340 mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001341 if( ret != 0 )
1342 {
Jerry Yub85277e2021-10-13 13:36:05 +08001343 mbedtls_free( transform_handshake );
Jerry Yuc068b662021-10-11 22:30:19 +08001344
Jerry Yu4a173382021-10-11 21:45:31 +08001345 MBEDTLS_SSL_PEND_FATAL_ALERT(
1346 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1347 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1348 }
1349 return( ret );
Jerry Yue1b9c292021-09-10 10:08:31 +08001350}
1351
XiaokangQian355e09a2022-01-20 11:14:50 +00001352static int ssl_tls13_postprocess_hrr( mbedtls_ssl_context *ssl )
XiaokangQian647719a2021-12-07 09:16:29 +00001353{
1354 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1355
XiaokangQian647719a2021-12-07 09:16:29 +00001356#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1357 /* If not offering early data, the client sends a dummy CCS record
1358 * immediately before its second flight. This may either be before
XiaokangQian51eff222021-12-10 10:33:56 +00001359 * its second ClientHello or before its encrypted handshake flight.
1360 */
XiaokangQian647719a2021-12-07 09:16:29 +00001361 mbedtls_ssl_handshake_set_state( ssl,
1362 MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO );
1363#else
1364 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
1365#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1366
XiaokangQian78b1fa72022-01-19 06:56:30 +00001367 mbedtls_ssl_session_reset_msg_layer( ssl, 0 );
XiaokangQian647719a2021-12-07 09:16:29 +00001368
XiaokangQian78b1fa72022-01-19 06:56:30 +00001369 /*
XiaokangQian355e09a2022-01-20 11:14:50 +00001370 * We are going to re-generate a shared secret corresponding to the group
1371 * selected by the server, which is different from the group for which we
1372 * generated a shared secret in the first client hello.
1373 * Thus, reset the shared secret.
XiaokangQian51eff222021-12-10 10:33:56 +00001374 */
XiaokangQian16acd4b2022-01-14 07:35:47 +00001375 ret = ssl_tls13_reset_key_share( ssl );
XiaokangQian647719a2021-12-07 09:16:29 +00001376 if( ret != 0 )
1377 return( ret );
1378
1379 return( 0 );
1380}
1381
Jerry Yue1b9c292021-09-10 10:08:31 +08001382/*
Jerry Yu4a173382021-10-11 21:45:31 +08001383 * Wait and parse ServerHello handshake message.
Jerry Yu687101b2021-09-14 16:03:56 +08001384 * Handler for MBEDTLS_SSL_SERVER_HELLO
1385 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001386static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001387{
Jerry Yu4a173382021-10-11 21:45:31 +08001388 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian647719a2021-12-07 09:16:29 +00001389 unsigned char *buf = NULL;
1390 size_t buf_len = 0;
XiaokangQian78b1fa72022-01-19 06:56:30 +00001391 int is_hrr = 0;
Jerry Yue1b9c292021-09-10 10:08:31 +08001392
1393 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) );
1394
1395 /* Coordination step
1396 * - Fetch record
1397 * - Make sure it's either a ServerHello or a HRR.
1398 * - Switch processing routine in case of HRR
1399 */
Jerry Yue1b9c292021-09-10 10:08:31 +08001400 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
1401 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
1402
XiaokangQian16acd4b2022-01-14 07:35:47 +00001403 ret = ssl_tls13_server_hello_coordinate( ssl, &buf, &buf_len );
XiaokangQiand9e068e2022-01-18 06:23:32 +00001404 if( ret < 0 )
XiaokangQian16acd4b2022-01-14 07:35:47 +00001405 goto cleanup;
1406 else
XiaokangQiand9e068e2022-01-18 06:23:32 +00001407 is_hrr = ( ret == SSL_SERVER_HELLO_COORDINATE_HRR );
XiaokangQiand59be772022-01-24 10:12:51 +00001408
Ronald Cron9f0fba32022-02-10 16:45:15 +01001409 if( ret == SSL_SERVER_HELLO_COORDINATE_TLS1_2 )
1410 {
1411 ret = 0;
1412 goto cleanup;
1413 }
1414
XiaokangQianb851da82022-01-14 04:03:11 +00001415 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf,
XiaokangQiand9e068e2022-01-18 06:23:32 +00001416 buf + buf_len,
1417 is_hrr ) );
1418 if( is_hrr )
XiaokangQian647719a2021-12-07 09:16:29 +00001419 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_reset_transcript_for_hrr( ssl ) );
1420
Ronald Cron8f6d39a2022-03-10 18:56:50 +01001421 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
1422 buf, buf_len );
XiaokangQian647719a2021-12-07 09:16:29 +00001423
XiaokangQiand9e068e2022-01-18 06:23:32 +00001424 if( is_hrr )
XiaokangQian355e09a2022-01-20 11:14:50 +00001425 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_hrr( ssl ) );
XiaokangQiand9e068e2022-01-18 06:23:32 +00001426 else
XiaokangQian355e09a2022-01-20 11:14:50 +00001427 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_server_hello( ssl ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001428
1429cleanup:
XiaokangQiana9090612022-01-27 03:48:27 +00001430 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s ( %s )", __func__,
1431 is_hrr?"HelloRetryRequest":"ServerHello" ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001432 return( ret );
Jerry Yu687101b2021-09-14 16:03:56 +08001433}
1434
1435/*
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001436 *
1437 * EncryptedExtensions message
1438 *
1439 * The EncryptedExtensions message contains any extensions which
1440 * should be protected, i.e., any which are not needed to establish
1441 * the cryptographic context.
Jerry Yu687101b2021-09-14 16:03:56 +08001442 */
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001443
1444/*
1445 * Overview
1446 */
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001447
1448/* Main entry point; orchestrates the other functions */
XiaokangQian97799ac2021-10-11 10:05:54 +00001449static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001450
XiaokangQian97799ac2021-10-11 10:05:54 +00001451static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1452 const unsigned char *buf,
1453 const unsigned char *end );
1454static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001455
1456/*
XiaokangQianc1fe0002021-09-16 03:02:14 +00001457 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001458 */
XiaokangQian97799ac2021-10-11 10:05:54 +00001459static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001460{
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001461 int ret;
1462 unsigned char *buf;
1463 size_t buf_len;
1464
1465 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) );
1466
Xiaofei Bai746f9482021-11-12 08:53:56 +00001467 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
XiaokangQianab7f50d2021-10-21 06:23:29 +00001468 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001469 &buf, &buf_len ) );
1470
1471 /* Process the message contents */
XiaokangQian97799ac2021-10-11 10:05:54 +00001472 MBEDTLS_SSL_PROC_CHK(
XiaokangQian8db25ff2021-10-13 05:56:18 +00001473 ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001474
Ronald Cron8f6d39a2022-03-10 18:56:50 +01001475 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
1476 buf, buf_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001477
XiaokangQian97799ac2021-10-11 10:05:54 +00001478 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_encrypted_extensions( ssl ) );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001479
1480cleanup:
1481
1482 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) );
1483 return( ret );
1484
1485}
1486
XiaokangQian08da26c2021-10-09 10:12:11 +00001487/* Parse EncryptedExtensions message
1488 * struct {
XiaokangQian97799ac2021-10-11 10:05:54 +00001489 * Extension extensions<0..2^16-1>;
XiaokangQian08da26c2021-10-09 10:12:11 +00001490 * } EncryptedExtensions;
1491 */
XiaokangQian97799ac2021-10-11 10:05:54 +00001492static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1493 const unsigned char *buf,
1494 const unsigned char *end )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001495{
1496 int ret = 0;
XiaokangQian08da26c2021-10-09 10:12:11 +00001497 size_t extensions_len;
XiaokangQian140f0452021-10-08 08:05:53 +00001498 const unsigned char *p = buf;
XiaokangQian8db25ff2021-10-13 05:56:18 +00001499 const unsigned char *extensions_end;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001500
XiaokangQian08da26c2021-10-09 10:12:11 +00001501 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian97799ac2021-10-11 10:05:54 +00001502 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian08da26c2021-10-09 10:12:11 +00001503 p += 2;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001504
XiaokangQian97799ac2021-10-11 10:05:54 +00001505 MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len );
XiaokangQian8db25ff2021-10-13 05:56:18 +00001506 extensions_end = p + extensions_len;
1507 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001508
XiaokangQian8db25ff2021-10-13 05:56:18 +00001509 while( p < extensions_end )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001510 {
XiaokangQian08da26c2021-10-09 10:12:11 +00001511 unsigned int extension_type;
1512 size_t extension_data_len;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001513
XiaokangQian08da26c2021-10-09 10:12:11 +00001514 /*
1515 * struct {
XiaokangQian97799ac2021-10-11 10:05:54 +00001516 * ExtensionType extension_type; (2 bytes)
1517 * opaque extension_data<0..2^16-1>;
XiaokangQian08da26c2021-10-09 10:12:11 +00001518 * } Extension;
1519 */
XiaokangQian8db25ff2021-10-13 05:56:18 +00001520 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
XiaokangQian08da26c2021-10-09 10:12:11 +00001521 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1522 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1523 p += 4;
1524
XiaokangQian8db25ff2021-10-13 05:56:18 +00001525 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001526
XiaokangQian97799ac2021-10-11 10:05:54 +00001527 /* The client MUST check EncryptedExtensions for the
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001528 * presence of any forbidden extensions and if any are found MUST abort
XiaokangQian08da26c2021-10-09 10:12:11 +00001529 * the handshake with an "unsupported_extension" alert.
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001530 */
XiaokangQian08da26c2021-10-09 10:12:11 +00001531 switch( extension_type )
1532 {
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001533
XiaokangQian08da26c2021-10-09 10:12:11 +00001534 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1535 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extensions supported groups" ) );
1536 break;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001537
lhuang0486cacac2022-01-21 07:34:27 -08001538#if defined(MBEDTLS_SSL_ALPN)
1539 case MBEDTLS_TLS_EXT_ALPN:
1540 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
1541
1542 if( ( ret = ssl_tls13_parse_alpn_ext( ssl, p, (size_t)extension_data_len ) ) != 0 )
1543 {
1544 return( ret );
1545 }
1546
1547 break;
1548#endif /* MBEDTLS_SSL_ALPN */
XiaokangQian08da26c2021-10-09 10:12:11 +00001549 default:
XiaokangQian97799ac2021-10-11 10:05:54 +00001550 MBEDTLS_SSL_DEBUG_MSG(
1551 3, ( "unsupported extension found: %u ", extension_type) );
1552 MBEDTLS_SSL_PEND_FATAL_ALERT(
Jerry Yu7aa71862021-10-28 21:41:30 +08001553 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
XiaokangQian97799ac2021-10-11 10:05:54 +00001554 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1555 return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
XiaokangQian08da26c2021-10-09 10:12:11 +00001556 }
1557
XiaokangQian08da26c2021-10-09 10:12:11 +00001558 p += extension_data_len;
XiaokangQian97799ac2021-10-11 10:05:54 +00001559 }
XiaokangQian08da26c2021-10-09 10:12:11 +00001560
XiaokangQian97799ac2021-10-11 10:05:54 +00001561 /* Check that we consumed all the message. */
XiaokangQian7b2d4ef2021-10-13 10:19:02 +00001562 if( p != end )
XiaokangQian97799ac2021-10-11 10:05:54 +00001563 {
1564 MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) );
Jerry Yu7aa71862021-10-28 21:41:30 +08001565 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
XiaokangQian7b2d4ef2021-10-13 10:19:02 +00001566 MBEDTLS_ERR_SSL_DECODE_ERROR );
XiaokangQian97799ac2021-10-11 10:05:54 +00001567 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001568 }
1569
1570 return( ret );
1571}
1572
XiaokangQian97799ac2021-10-11 10:05:54 +00001573static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001574{
Jerry Yua93ac112021-10-27 16:31:48 +08001575#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00001576 if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
Jerry Yua93ac112021-10-27 16:31:48 +08001577 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1578 else
Jerry Yud2674312021-10-29 10:08:19 +08001579 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
Jerry Yua93ac112021-10-27 16:31:48 +08001580#else
1581 ((void) ssl);
1582 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1583#endif
Jerry Yu687101b2021-09-14 16:03:56 +08001584 return( 0 );
1585}
1586
Jerry Yua93ac112021-10-27 16:31:48 +08001587#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu687101b2021-09-14 16:03:56 +08001588/*
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001589 *
1590 * STATE HANDLING: CertificateRequest
1591 *
Jerry Yud2674312021-10-29 10:08:19 +08001592 */
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001593#define SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST 0
1594#define SSL_CERTIFICATE_REQUEST_SKIP 1
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001595/* Coordination:
1596 * Deals with the ambiguity of not knowing if a CertificateRequest
1597 * will be sent. Returns a negative code on failure, or
1598 * - SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST
1599 * - SSL_CERTIFICATE_REQUEST_SKIP
1600 * indicating if a Certificate Request is expected or not.
1601 */
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001602static int ssl_tls13_certificate_request_coordinate( mbedtls_ssl_context *ssl )
Jerry Yud2674312021-10-29 10:08:19 +08001603{
Xiaofei Baide3f13e2022-01-18 05:47:05 +00001604 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yud2674312021-10-29 10:08:19 +08001605
Xiaofei Bai7c8b6a92022-02-08 15:21:13 +00001606 if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001607 {
1608 MBEDTLS_SSL_DEBUG_MSG( 3, ( "<= skip parse certificate request" ) );
1609 return( SSL_CERTIFICATE_REQUEST_SKIP );
1610 }
1611
1612 if( ( ret = mbedtls_ssl_read_record( ssl, 0 ) ) != 0 )
Jerry Yud2674312021-10-29 10:08:19 +08001613 {
1614 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1615 return( ret );
1616 }
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001617 ssl->keep_current_message = 1;
Jerry Yud2674312021-10-29 10:08:19 +08001618
1619 if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) &&
1620 ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) )
1621 {
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001622 return( SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST );
Jerry Yud2674312021-10-29 10:08:19 +08001623 }
1624
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001625 return( SSL_CERTIFICATE_REQUEST_SKIP );
1626}
1627
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001628/*
1629 * ssl_tls13_parse_certificate_request()
1630 * Parse certificate request
1631 * struct {
1632 * opaque certificate_request_context<0..2^8-1>;
1633 * Extension extensions<2..2^16-1>;
1634 * } CertificateRequest;
1635 */
1636static int ssl_tls13_parse_certificate_request( mbedtls_ssl_context *ssl,
1637 const unsigned char *buf,
1638 const unsigned char *end )
1639{
1640 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1641 const unsigned char *p = buf;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001642 size_t certificate_request_context_len = 0;
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001643 size_t extensions_len = 0;
1644 const unsigned char *extensions_end;
1645 unsigned char sig_alg_ext_found = 0;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001646
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001647 /* ...
1648 * opaque certificate_request_context<0..2^8-1>
1649 * ...
1650 */
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001651 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1652 certificate_request_context_len = (size_t) p[0];
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001653 p += 1;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001654
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001655 if( certificate_request_context_len > 0 )
1656 {
Xiaofei Baic234ecf2022-02-08 09:59:23 +00001657 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, certificate_request_context_len );
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001658 MBEDTLS_SSL_DEBUG_BUF( 3, "Certificate Request Context",
1659 p, certificate_request_context_len );
1660
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001661 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001662 handshake->certificate_request_context =
Xiaofei Bai6d42bb42022-01-28 08:52:13 +00001663 mbedtls_calloc( 1, certificate_request_context_len );
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001664 if( handshake->certificate_request_context == NULL )
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001665 {
1666 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
1667 return ( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1668 }
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001669 memcpy( handshake->certificate_request_context, p,
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001670 certificate_request_context_len );
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001671 p += certificate_request_context_len;
1672 }
1673
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001674 /* ...
1675 * Extension extensions<2..2^16-1>;
1676 * ...
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001677 */
1678 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1679 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1680 p += 2;
1681
1682 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1683 extensions_end = p + extensions_len;
1684
1685 while( p < extensions_end )
1686 {
1687 unsigned int extension_type;
1688 size_t extension_data_len;
1689
1690 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1691 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1692 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1693 p += 4;
1694
1695 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1696
1697 switch( extension_type )
1698 {
1699 case MBEDTLS_TLS_EXT_SIG_ALG:
1700 MBEDTLS_SSL_DEBUG_MSG( 3,
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001701 ( "found signature algorithms extension" ) );
1702 ret = mbedtls_ssl_tls13_parse_sig_alg_ext( ssl, p,
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001703 p + extension_data_len );
1704 if( ret != 0 )
1705 return( ret );
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001706 if( ! sig_alg_ext_found )
1707 sig_alg_ext_found = 1;
1708 else
1709 {
1710 MBEDTLS_SSL_DEBUG_MSG( 3,
1711 ( "Duplicate signature algorithms extensions found" ) );
Xiaofei Baic234ecf2022-02-08 09:59:23 +00001712 goto decode_error;
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001713 }
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001714 break;
1715
1716 default:
1717 MBEDTLS_SSL_DEBUG_MSG(
1718 3,
1719 ( "unknown extension found: %u ( ignoring )",
1720 extension_type ) );
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001721 break;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001722 }
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001723 p += extension_data_len;
1724 }
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001725 /* Check that we consumed all the message. */
1726 if( p != end )
1727 {
1728 MBEDTLS_SSL_DEBUG_MSG( 1,
Xiaofei Baic234ecf2022-02-08 09:59:23 +00001729 ( "CertificateRequest misaligned" ) );
1730 goto decode_error;
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001731 }
1732 /* Check that we found signature algorithms extension */
Xiaofei Bai82f0a9a2022-01-26 09:21:54 +00001733 if( ! sig_alg_ext_found )
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001734 {
Xiaofei Bai6d42bb42022-01-28 08:52:13 +00001735 MBEDTLS_SSL_DEBUG_MSG( 3,
1736 ( "no signature algorithms extension found" ) );
Xiaofei Baic234ecf2022-02-08 09:59:23 +00001737 goto decode_error;
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001738 }
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001739
Jerry Yu7840f812022-01-29 10:26:51 +08001740 ssl->handshake->client_auth = 1;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001741 return( 0 );
Xiaofei Bai51f515a2022-02-08 07:28:04 +00001742
Xiaofei Baic234ecf2022-02-08 09:59:23 +00001743decode_error:
Xiaofei Bai51f515a2022-02-08 07:28:04 +00001744 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1745 MBEDTLS_ERR_SSL_DECODE_ERROR );
1746 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001747}
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001748
Xiaofei Baide3f13e2022-01-18 05:47:05 +00001749/*
1750 * Handler for MBEDTLS_SSL_CERTIFICATE_REQUEST
1751 */
1752static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl )
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001753{
Xiaofei Baide3f13e2022-01-18 05:47:05 +00001754 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001755
1756 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
1757
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001758 MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_certificate_request_coordinate( ssl ) );
1759
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001760 if( ret == SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST )
1761 {
1762 unsigned char *buf;
1763 size_t buf_len;
1764
1765 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
1766 MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
1767 &buf, &buf_len ) );
1768
1769 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_certificate_request( ssl,
1770 buf, buf + buf_len ) );
1771
Ronald Cron8f6d39a2022-03-10 18:56:50 +01001772 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
1773 buf, buf_len );
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001774 }
Xiaofei Bai69fcd392022-01-20 08:25:00 +00001775 else if( ret == SSL_CERTIFICATE_REQUEST_SKIP )
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001776 {
1777 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
Xiaofei Baif6d36962022-01-16 14:54:35 +00001778 ret = 0;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001779 }
1780 else
1781 {
1782 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Xiaofei Bai51f515a2022-02-08 07:28:04 +00001783 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1784 goto cleanup;
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001785 }
1786
1787 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
Jerry Yu7840f812022-01-29 10:26:51 +08001788 ssl->handshake->client_auth ? "a" : "no" ) );
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001789
Jerry Yud2674312021-10-29 10:08:19 +08001790 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
1791
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001792cleanup:
1793
Xiaofei Baia0ab7772022-01-16 12:14:45 +00001794 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
1795 return( ret );
Jerry Yud2674312021-10-29 10:08:19 +08001796}
1797
1798/*
Jerry Yu687101b2021-09-14 16:03:56 +08001799 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
1800 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001801static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001802{
Xiaofei Bai947571e2021-09-29 09:12:03 +00001803 int ret;
1804
1805 ret = mbedtls_ssl_tls13_process_certificate( ssl );
Xiaofei Baif93cbd22021-10-29 02:39:30 +00001806 if( ret != 0 )
Xiaofei Bai947571e2021-09-29 09:12:03 +00001807 return( ret );
1808
Jerry Yu687101b2021-09-14 16:03:56 +08001809 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
1810 return( 0 );
1811}
1812
1813/*
1814 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
1815 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001816static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001817{
Jerry Yu30b071c2021-09-12 20:16:03 +08001818 int ret;
1819
1820 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
1821 if( ret != 0 )
1822 return( ret );
1823
Jerry Yu687101b2021-09-14 16:03:56 +08001824 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1825 return( 0 );
1826}
Jerry Yua93ac112021-10-27 16:31:48 +08001827#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Ronald Crond4c64022021-12-06 09:06:46 +01001828
Jerry Yu687101b2021-09-14 16:03:56 +08001829/*
1830 * Handler for MBEDTLS_SSL_SERVER_FINISHED
1831 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001832static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001833{
XiaokangQianac0385c2021-11-03 06:40:11 +00001834 int ret;
1835
XiaokangQianc5c39d52021-11-09 11:55:10 +00001836 ret = mbedtls_ssl_tls13_process_finished_message( ssl );
XiaokangQianac0385c2021-11-03 06:40:11 +00001837 if( ret != 0 )
1838 return( ret );
1839
Ronald Cron49ad6192021-11-24 16:25:31 +01001840#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1841 mbedtls_ssl_handshake_set_state(
1842 ssl,
1843 MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
1844#else
Jerry Yuca133a32022-02-15 14:22:05 +08001845 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE );
Jerry Yu566c7812022-01-26 15:41:22 +08001846#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Ronald Cron49ad6192021-11-24 16:25:31 +01001847
XiaokangQianac0385c2021-11-03 06:40:11 +00001848 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001849}
1850
1851/*
Jerry Yu566c7812022-01-26 15:41:22 +08001852 * Handler for MBEDTLS_SSL_CLIENT_CERTIFICATE
1853 */
1854static int ssl_tls13_write_client_certificate( mbedtls_ssl_context *ssl )
1855{
Ronald Cron7a94aca2022-03-09 07:44:27 +01001856 int non_empty_certificate_msg = 0;
1857
Jerry Yu5cc35062022-01-28 16:16:08 +08001858 MBEDTLS_SSL_DEBUG_MSG( 1,
1859 ( "Switch to handshake traffic keys for outbound traffic" ) );
Jerry Yu566c7812022-01-26 15:41:22 +08001860 mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
Jerry Yu5cc35062022-01-28 16:16:08 +08001861
Ronald Cron9df7c802022-03-08 18:38:54 +01001862#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Ronald Cron5bb8fc82022-03-09 07:00:13 +01001863 if( ssl->handshake->client_auth )
Ronald Cron7a94aca2022-03-09 07:44:27 +01001864 {
1865 int ret = mbedtls_ssl_tls13_write_certificate( ssl );
1866 if( ret != 0 )
1867 return( ret );
Ronald Cron5bb8fc82022-03-09 07:00:13 +01001868
Ronald Cron7a94aca2022-03-09 07:44:27 +01001869 if( mbedtls_ssl_own_cert( ssl ) != NULL )
1870 non_empty_certificate_msg = 1;
1871 }
1872 else
1873 {
1874 MBEDTLS_SSL_DEBUG_MSG( 2, ( "No certificate message to send." ) );
1875 }
Ronald Cron9df7c802022-03-08 18:38:54 +01001876#endif
Ronald Cron5bb8fc82022-03-09 07:00:13 +01001877
Ronald Cron7a94aca2022-03-09 07:44:27 +01001878 if( non_empty_certificate_msg )
1879 {
1880 mbedtls_ssl_handshake_set_state( ssl,
1881 MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY );
1882 }
1883 else
1884 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1885
Ronald Cron5bb8fc82022-03-09 07:00:13 +01001886 return( 0 );
Jerry Yu566c7812022-01-26 15:41:22 +08001887}
1888
Ronald Cron9df7c802022-03-08 18:38:54 +01001889#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu566c7812022-01-26 15:41:22 +08001890/*
1891 * Handler for MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY
1892 */
1893static int ssl_tls13_write_client_certificate_verify( mbedtls_ssl_context *ssl )
1894{
Ronald Crona8b38872022-03-09 07:59:25 +01001895 int ret = mbedtls_ssl_tls13_write_certificate_verify( ssl );
1896
1897 if( ret == 0 )
1898 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1899
1900 return( ret );
Jerry Yu566c7812022-01-26 15:41:22 +08001901}
Jerry Yu90f152d2022-01-29 22:12:42 +08001902#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu566c7812022-01-26 15:41:22 +08001903
1904/*
Jerry Yu687101b2021-09-14 16:03:56 +08001905 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
1906 */
XiaokangQian74af2a82021-09-22 07:40:30 +00001907static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001908{
XiaokangQian0fa66432021-11-15 03:33:57 +00001909 int ret;
1910
1911 ret = mbedtls_ssl_tls13_write_finished_message( ssl );
1912 if( ret != 0 )
1913 return( ret );
1914
1915 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS );
1916 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001917}
1918
1919/*
1920 * Handler for MBEDTLS_SSL_FLUSH_BUFFERS
1921 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001922static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001923{
Jerry Yu378254d2021-10-30 21:44:47 +08001924 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
Jerry Yuad8d0ba2021-09-28 17:58:26 +08001925 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
Jerry Yu687101b2021-09-14 16:03:56 +08001926 return( 0 );
1927}
1928
1929/*
1930 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
1931 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001932static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001933{
Jerry Yu378254d2021-10-30 21:44:47 +08001934 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) );
1935 mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
1936
1937 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for outbound traffic" ) );
1938 mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application );
1939
1940 mbedtls_ssl_tls13_handshake_wrapup( ssl );
1941
1942 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
1943 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001944}
1945
Jerry Yu92c6b402021-08-27 16:59:09 +08001946int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +08001947{
Jerry Yu92c6b402021-08-27 16:59:09 +08001948 int ret = 0;
Jerry Yuc8a392c2021-08-18 16:46:28 +08001949
Jerry Yu92c6b402021-08-27 16:59:09 +08001950 switch( ssl->state )
1951 {
1952 /*
Jerry Yu0c63af62021-09-02 12:59:12 +08001953 * ssl->state is initialized as HELLO_REQUEST. It is the same
1954 * as CLIENT_HELLO state.
Jerry Yu92c6b402021-08-27 16:59:09 +08001955 */
1956 case MBEDTLS_SSL_HELLO_REQUEST:
1957 case MBEDTLS_SSL_CLIENT_HELLO:
Ronald Cron3d580bf2022-02-18 17:24:56 +01001958 ret = mbedtls_ssl_write_client_hello( ssl );
Jerry Yu92c6b402021-08-27 16:59:09 +08001959 break;
1960
1961 case MBEDTLS_SSL_SERVER_HELLO:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001962 ret = ssl_tls13_process_server_hello( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001963 break;
1964
1965 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
XiaokangQian97799ac2021-10-11 10:05:54 +00001966 ret = ssl_tls13_process_encrypted_extensions( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001967 break;
1968
Jerry Yua93ac112021-10-27 16:31:48 +08001969#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yud2674312021-10-29 10:08:19 +08001970 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
1971 ret = ssl_tls13_process_certificate_request( ssl );
1972 break;
1973
Jerry Yu687101b2021-09-14 16:03:56 +08001974 case MBEDTLS_SSL_SERVER_CERTIFICATE:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001975 ret = ssl_tls13_process_server_certificate( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001976 break;
1977
1978 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001979 ret = ssl_tls13_process_certificate_verify( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001980 break;
Jerry Yua93ac112021-10-27 16:31:48 +08001981#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu687101b2021-09-14 16:03:56 +08001982
1983 case MBEDTLS_SSL_SERVER_FINISHED:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001984 ret = ssl_tls13_process_server_finished( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001985 break;
1986
Jerry Yu566c7812022-01-26 15:41:22 +08001987 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
1988 ret = ssl_tls13_write_client_certificate( ssl );
1989 break;
1990
Ronald Cron9df7c802022-03-08 18:38:54 +01001991#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu566c7812022-01-26 15:41:22 +08001992 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
1993 ret = ssl_tls13_write_client_certificate_verify( ssl );
1994 break;
Jerry Yu90f152d2022-01-29 22:12:42 +08001995#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu566c7812022-01-26 15:41:22 +08001996
Jerry Yu687101b2021-09-14 16:03:56 +08001997 case MBEDTLS_SSL_CLIENT_FINISHED:
XiaokangQian74af2a82021-09-22 07:40:30 +00001998 ret = ssl_tls13_write_client_finished( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001999 break;
2000
2001 case MBEDTLS_SSL_FLUSH_BUFFERS:
Xiaofei Bai746f9482021-11-12 08:53:56 +00002002 ret = ssl_tls13_flush_buffers( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08002003 break;
2004
2005 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Xiaofei Bai746f9482021-11-12 08:53:56 +00002006 ret = ssl_tls13_handshake_wrapup( ssl );
Jerry Yu92c6b402021-08-27 16:59:09 +08002007 break;
2008
Ronald Cron49ad6192021-11-24 16:25:31 +01002009 /*
2010 * Injection of dummy-CCS's for middlebox compatibility
2011 */
2012#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
XiaokangQian0b56a8f2021-12-22 02:39:32 +00002013 case MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO:
Ronald Cron9f55f632022-02-02 16:02:47 +01002014 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
2015 if( ret == 0 )
2016 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
2017 break;
2018
2019 case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
2020 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
2021 if( ret == 0 )
2022 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE );
Ronald Cron49ad6192021-11-24 16:25:31 +01002023 break;
2024#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
2025
Jerry Yu92c6b402021-08-27 16:59:09 +08002026 default:
2027 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
2028 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2029 }
2030
2031 return( ret );
2032}
Jerry Yu65dd2cc2021-08-18 16:38:40 +08002033
Jerry Yufb4b6472022-01-27 15:03:26 +08002034#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_PROTO_TLS1_3 */
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08002035
Jerry Yufb4b6472022-01-27 15:03:26 +08002036