blob: 83ee98fbde324238ece30639f6b184221c70f311 [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
2 * TLS 1.3 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS ( https://tls.mbed.org )
20 */
21
22#include "common.h"
23
Ronald Cron6f135e12021-12-08 16:57:54 +010024#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080025
26#if defined(MBEDTLS_SSL_CLI_C)
27
Jerry Yubc20bdd2021-08-24 15:59:48 +080028#include <string.h>
29
Jerry Yu56fc07f2021-09-01 17:48:49 +080030#include "mbedtls/debug.h"
31#include "mbedtls/error.h"
Jerry Yue1b9c292021-09-10 10:08:31 +080032#include "mbedtls/platform.h"
Jerry Yua13c7e72021-08-17 10:44:40 +080033
Jerry Yubdc71882021-09-14 19:30:36 +080034#include "ssl_misc.h"
35#include "ecdh_misc.h"
Jerry Yue1b9c292021-09-10 10:08:31 +080036#include "ssl_tls13_keys.h"
Gilles Peskine923d5c92021-12-15 12:56:54 +010037#include "ssl_debug_helpers.h"
Jerry Yubdc71882021-09-14 19:30:36 +080038
Jerry Yubc20bdd2021-08-24 15:59:48 +080039/* Write extensions */
40
Jerry Yu92c6b402021-08-27 16:59:09 +080041/*
42 * ssl_tls13_write_supported_versions_ext():
43 *
44 * struct {
45 * ProtocolVersion versions<2..254>;
46 * } SupportedVersions;
47 */
Jerry Yuf4436812021-08-26 22:59:56 +080048static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl,
Jerry Yueecfbf02021-08-30 18:32:07 +080049 unsigned char *buf,
50 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +000051 size_t *out_len )
Jerry Yu92c6b402021-08-27 16:59:09 +080052{
53 unsigned char *p = buf;
54
Xiaofei Baid25fab62021-12-02 06:36:27 +000055 *out_len = 0;
Jerry Yu92c6b402021-08-27 16:59:09 +080056
Jerry Yu159c5a02021-08-31 12:51:25 +080057 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) );
Jerry Yu92c6b402021-08-27 16:59:09 +080058
Jerry Yu388bd0d2021-09-15 18:41:02 +080059 /* Check if we have space to write the extension:
Jerry Yub60e3cf2021-09-08 16:41:02 +080060 * - extension_type (2 bytes)
61 * - extension_data_length (2 bytes)
62 * - versions_length (1 byte )
63 * - versions (2 bytes)
Jerry Yu159c5a02021-08-31 12:51:25 +080064 */
Jerry Yu92c6b402021-08-27 16:59:09 +080065 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
66
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080067 /* Write extension_type */
Jerry Yueecfbf02021-08-30 18:32:07 +080068 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
Jerry Yu92c6b402021-08-27 16:59:09 +080069
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080070 /* Write extension_data_length */
Jerry Yub7ab3362021-08-31 16:16:19 +080071 MBEDTLS_PUT_UINT16_BE( 3, p, 2 );
Jerry Yueecfbf02021-08-30 18:32:07 +080072 p += 4;
Jerry Yu92c6b402021-08-27 16:59:09 +080073
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080074 /* Length of versions */
Jerry Yu92c6b402021-08-27 16:59:09 +080075 *p++ = 0x2;
76
Jerry Yu0c63af62021-09-02 12:59:12 +080077 /* Write values of supported versions.
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080078 *
Jerry Yu0c63af62021-09-02 12:59:12 +080079 * They are defined by the configuration.
Jerry Yu1bc2c1f2021-09-01 12:57:29 +080080 *
Jerry Yu0c63af62021-09-02 12:59:12 +080081 * Currently, only one version is advertised.
Jerry Yu92c6b402021-08-27 16:59:09 +080082 */
Jerry Yueecfbf02021-08-30 18:32:07 +080083 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
84 ssl->conf->max_minor_ver,
85 ssl->conf->transport, p );
Jerry Yu92c6b402021-08-27 16:59:09 +080086
87 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]",
Jerry Yueecfbf02021-08-30 18:32:07 +080088 ssl->conf->max_major_ver,
89 ssl->conf->max_minor_ver ) );
Jerry Yu92c6b402021-08-27 16:59:09 +080090
Xiaofei Baid25fab62021-12-02 06:36:27 +000091 *out_len = 7;
Jerry Yu92c6b402021-08-27 16:59:09 +080092
93 return( 0 );
94}
Jerry Yubc20bdd2021-08-24 15:59:48 +080095
Jerry Yuc068b662021-10-11 22:30:19 +080096static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
97 const unsigned char *buf,
Jerry Yub85277e2021-10-13 13:36:05 +080098 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +080099{
Jerry Yue1b9c292021-09-10 10:08:31 +0800100 ((void) ssl);
101
Jerry Yub85277e2021-10-13 13:36:05 +0800102 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2);
103 if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 ||
Jerry Yue1b9c292021-09-10 10:08:31 +0800104 buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 )
105 {
106 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) );
Jerry Yu4a173382021-10-11 21:45:31 +0800107
108 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
109 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
110 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue1b9c292021-09-10 10:08:31 +0800111 }
112
113 return( 0 );
114}
115
Jerry Yubc20bdd2021-08-24 15:59:48 +0800116#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
117
Jerry Yu6b64fe32021-09-01 17:05:13 +0800118/*
Jerry Yu56fc07f2021-09-01 17:48:49 +0800119 * Functions for writing key_share extension.
120 */
121#if defined(MBEDTLS_ECDH_C)
Jerry Yu7c522d42021-09-08 17:55:09 +0800122static int ssl_tls13_generate_and_write_ecdh_key_exchange(
Jerry Yub60e3cf2021-09-08 16:41:02 +0800123 mbedtls_ssl_context *ssl,
124 uint16_t named_group,
125 unsigned char *buf,
126 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000127 size_t *out_len )
Jerry Yu92c6b402021-08-27 16:59:09 +0800128{
Jerry Yu56fc07f2021-09-01 17:48:49 +0800129 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800130 const mbedtls_ecp_curve_info *curve_info =
131 mbedtls_ecp_curve_info_from_tls_id( named_group );
132
133 if( curve_info == NULL )
134 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
135
136 MBEDTLS_SSL_DEBUG_MSG( 3, ( "offer curve %s", curve_info->name ) );
137
Jerry Yudd1fb9e2021-09-15 11:10:15 +0800138 if( ( ret = mbedtls_ecdh_setup_no_everest( &ssl->handshake->ecdh_ctx,
139 curve_info->grp_id ) ) != 0 )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800140 {
Jerry Yu388bd0d2021-09-15 18:41:02 +0800141 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_setup_no_everest", ret );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800142 return( ret );
143 }
144
Xiaofei Baid25fab62021-12-02 06:36:27 +0000145 ret = mbedtls_ecdh_tls13_make_params( &ssl->handshake->ecdh_ctx, out_len,
146 buf, end - buf,
147 ssl->conf->f_rng, ssl->conf->p_rng );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800148 if( ret != 0 )
149 {
150 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_tls13_make_params", ret );
151 return( ret );
152 }
153
154 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
155 MBEDTLS_DEBUG_ECDH_Q );
Jerry Yu75336352021-09-01 15:59:36 +0800156 return( 0 );
Jerry Yu92c6b402021-08-27 16:59:09 +0800157}
Jerry Yu56fc07f2021-09-01 17:48:49 +0800158#endif /* MBEDTLS_ECDH_C */
159
Jerry Yub60e3cf2021-09-08 16:41:02 +0800160static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl,
161 uint16_t *group_id )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800162{
163 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
164
Jerry Yu56fc07f2021-09-01 17:48:49 +0800165
Jerry Yu56fc07f2021-09-01 17:48:49 +0800166#if defined(MBEDTLS_ECDH_C)
Brett Warren14efd332021-10-06 09:32:11 +0100167 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
Jerry Yu388bd0d2021-09-15 18:41:02 +0800168 /* Pick first available ECDHE group compatible with TLS 1.3 */
Brett Warren14efd332021-10-06 09:32:11 +0100169 if( group_list == NULL )
Jerry Yu388bd0d2021-09-15 18:41:02 +0800170 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
171
Brett Warren14efd332021-10-06 09:32:11 +0100172 for ( ; *group_list != 0; group_list++ )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800173 {
Xiaofei Baieef15042021-11-18 07:29:56 +0000174 const mbedtls_ecp_curve_info *curve_info;
175 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
176 if( curve_info != NULL &&
Brett Warren14efd332021-10-06 09:32:11 +0100177 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800178 {
Brett Warren14efd332021-10-06 09:32:11 +0100179 *group_id = *group_list;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800180 return( 0 );
181 }
182 }
183#else
184 ((void) ssl);
Jerry Yub60e3cf2021-09-08 16:41:02 +0800185 ((void) group_id);
Jerry Yu56fc07f2021-09-01 17:48:49 +0800186#endif /* MBEDTLS_ECDH_C */
187
188 /*
189 * Add DHE named groups here.
Jerry Yu388bd0d2021-09-15 18:41:02 +0800190 * Pick first available DHE group compatible with TLS 1.3
Jerry Yu56fc07f2021-09-01 17:48:49 +0800191 */
192
193 return( ret );
194}
195
196/*
197 * ssl_tls13_write_key_share_ext
198 *
Jerry Yu388bd0d2021-09-15 18:41:02 +0800199 * Structure of key_share extension in ClientHello:
Jerry Yu56fc07f2021-09-01 17:48:49 +0800200 *
201 * struct {
202 * NamedGroup group;
203 * opaque key_exchange<1..2^16-1>;
204 * } KeyShareEntry;
205 * struct {
206 * KeyShareEntry client_shares<0..2^16-1>;
207 * } KeyShareClientHello;
208 */
209static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
210 unsigned char *buf,
211 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000212 size_t *out_len )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800213{
214 unsigned char *p = buf;
Xiaofei Baieef15042021-11-18 07:29:56 +0000215 unsigned char *client_shares; /* Start of client_shares */
216 size_t client_shares_len; /* Length of client_shares */
Jerry Yu56fc07f2021-09-01 17:48:49 +0800217 uint16_t group_id;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800218 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
219
Xiaofei Baid25fab62021-12-02 06:36:27 +0000220 *out_len = 0;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800221
Jerry Yub60e3cf2021-09-08 16:41:02 +0800222 /* Check if we have space for header and length fields:
Jerry Yu56fc07f2021-09-01 17:48:49 +0800223 * - extension_type (2 bytes)
224 * - extension_data_length (2 bytes)
225 * - client_shares_length (2 bytes)
226 */
227 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
228 p += 6;
229
230 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) );
231
232 /* HRR could already have requested something else. */
233 group_id = ssl->handshake->offered_group_id;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800234 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) &&
235 !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800236 {
Jerry Yub60e3cf2021-09-08 16:41:02 +0800237 MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl,
Jerry Yu56fc07f2021-09-01 17:48:49 +0800238 &group_id ) );
239 }
240
241 /*
242 * Dispatch to type-specific key generation function.
243 *
244 * So far, we're only supporting ECDHE. With the introduction
245 * of PQC KEMs, we'll want to have multiple branches, one per
246 * type of KEM, and dispatch to the corresponding crypto. And
247 * only one key share entry is allowed.
248 */
Xiaofei Baieef15042021-11-18 07:29:56 +0000249 client_shares = p;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800250#if defined(MBEDTLS_ECDH_C)
Jerry Yub60e3cf2021-09-08 16:41:02 +0800251 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
Jerry Yu56fc07f2021-09-01 17:48:49 +0800252 {
Jerry Yu388bd0d2021-09-15 18:41:02 +0800253 /* Pointer to group */
Xiaofei Baieef15042021-11-18 07:29:56 +0000254 unsigned char *group = p;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800255 /* Length of key_exchange */
256 size_t key_exchange_len;
257
258 /* Check there is space for header of KeyShareEntry
259 * - group (2 bytes)
260 * - key_exchange_length (2 bytes)
261 */
262 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
263 p += 4;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800264 ret = ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, group_id,
265 p, end,
266 &key_exchange_len );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800267 p += key_exchange_len;
268 if( ret != 0 )
269 return( ret );
270
271 /* Write group */
Xiaofei Baieef15042021-11-18 07:29:56 +0000272 MBEDTLS_PUT_UINT16_BE( group_id, group, 0 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800273 /* Write key_exchange_length */
Xiaofei Baieef15042021-11-18 07:29:56 +0000274 MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800275 }
276 else
277#endif /* MBEDTLS_ECDH_C */
278 if( 0 /* other KEMs? */ )
279 {
280 /* Do something */
281 }
282 else
283 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
284
Jerry Yub60e3cf2021-09-08 16:41:02 +0800285 /* Length of client_shares */
Xiaofei Baieef15042021-11-18 07:29:56 +0000286 client_shares_len = p - client_shares;
Jerry Yub60e3cf2021-09-08 16:41:02 +0800287 if( client_shares_len == 0)
288 {
289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) );
290 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Jerry Yu7c522d42021-09-08 17:55:09 +0800291 }
Jerry Yu56fc07f2021-09-01 17:48:49 +0800292 /* Write extension_type */
293 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
294 /* Write extension_data_length */
Jerry Yub60e3cf2021-09-08 16:41:02 +0800295 MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800296 /* Write client_shares_length */
Jerry Yub60e3cf2021-09-08 16:41:02 +0800297 MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800298
299 /* Update offered_group_id field */
300 ssl->handshake->offered_group_id = group_id;
301
302 /* Output the total length of key_share extension. */
Xiaofei Baid25fab62021-12-02 06:36:27 +0000303 *out_len = p - buf;
Jerry Yu56fc07f2021-09-01 17:48:49 +0800304
Xiaofei Baid25fab62021-12-02 06:36:27 +0000305 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len );
Jerry Yu56fc07f2021-09-01 17:48:49 +0800306
307 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
308
309cleanup:
310
311 return( ret );
312}
Jerry Yubc20bdd2021-08-24 15:59:48 +0800313
Jerry Yue1b9c292021-09-10 10:08:31 +0800314#if defined(MBEDTLS_ECDH_C)
315
Jerry Yuc068b662021-10-11 22:30:19 +0800316static int ssl_tls13_check_ecdh_params( const mbedtls_ssl_context *ssl )
Jerry Yue1b9c292021-09-10 10:08:31 +0800317{
318 const mbedtls_ecp_curve_info *curve_info;
319 mbedtls_ecp_group_id grp_id;
320#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
321 grp_id = ssl->handshake->ecdh_ctx.grp.id;
322#else
323 grp_id = ssl->handshake->ecdh_ctx.grp_id;
324#endif
325
326 curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
327 if( curve_info == NULL )
328 {
329 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
330 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
331 }
332
333 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
334
Jerry Yue1b9c292021-09-10 10:08:31 +0800335 if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
Jerry Yub85277e2021-10-13 13:36:05 +0800336 return( -1 );
Jerry Yue1b9c292021-09-10 10:08:31 +0800337
338 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
339 MBEDTLS_DEBUG_ECDH_QP );
340
341 return( 0 );
342}
343
Jerry Yuc068b662021-10-11 22:30:19 +0800344static int ssl_tls13_read_public_ecdhe_share( mbedtls_ssl_context *ssl,
345 const unsigned char *buf,
346 size_t buf_len )
Jerry Yue1b9c292021-09-10 10:08:31 +0800347{
348 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
349
Jerry Yuc068b662021-10-11 22:30:19 +0800350 ret = mbedtls_ecdh_tls13_read_public( &ssl->handshake->ecdh_ctx,
Jerry Yu4a173382021-10-11 21:45:31 +0800351 buf, buf_len );
Jerry Yue1b9c292021-09-10 10:08:31 +0800352 if( ret != 0 )
353 {
354 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_tls13_read_public" ), ret );
Jerry Yub85277e2021-10-13 13:36:05 +0800355
356 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
357 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
358 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue1b9c292021-09-10 10:08:31 +0800359 }
360
Jerry Yuc068b662021-10-11 22:30:19 +0800361 if( ssl_tls13_check_ecdh_params( ssl ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800362 {
Jerry Yuc068b662021-10-11 22:30:19 +0800363 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ssl_tls13_check_ecdh_params() failed!" ) );
Jerry Yub85277e2021-10-13 13:36:05 +0800364
Jerry Yu4a173382021-10-11 21:45:31 +0800365 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
366 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
367 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue1b9c292021-09-10 10:08:31 +0800368 }
369
370 return( 0 );
371}
Jerry Yu4a173382021-10-11 21:45:31 +0800372#endif /* MBEDTLS_ECDH_C */
Jerry Yue1b9c292021-09-10 10:08:31 +0800373
374/*
Jerry Yub85277e2021-10-13 13:36:05 +0800375 * ssl_tls13_parse_key_share_ext()
376 * Parse key_share extension in Server Hello
377 *
Jerry Yue1b9c292021-09-10 10:08:31 +0800378 * struct {
379 * KeyShareEntry server_share;
380 * } KeyShareServerHello;
381 * struct {
382 * NamedGroup group;
383 * opaque key_exchange<1..2^16-1>;
384 * } KeyShareEntry;
385 */
Jerry Yu4a173382021-10-11 21:45:31 +0800386static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl,
Jerry Yue1b9c292021-09-10 10:08:31 +0800387 const unsigned char *buf,
388 const unsigned char *end )
389{
Jerry Yub85277e2021-10-13 13:36:05 +0800390 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800391 const unsigned char *p = buf;
Jerry Yu4a173382021-10-11 21:45:31 +0800392 uint16_t group, offered_group;
Jerry Yue1b9c292021-09-10 10:08:31 +0800393
Jerry Yu4a173382021-10-11 21:45:31 +0800394 /* ...
395 * NamedGroup group; (2 bytes)
396 * ...
397 */
398 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
399 group = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yue1b9c292021-09-10 10:08:31 +0800400 p += 2;
401
Jerry Yu4a173382021-10-11 21:45:31 +0800402 /* Check that the chosen group matches the one we offered. */
Jerry Yue1b9c292021-09-10 10:08:31 +0800403 offered_group = ssl->handshake->offered_group_id;
Jerry Yu4a173382021-10-11 21:45:31 +0800404 if( offered_group != group )
Jerry Yue1b9c292021-09-10 10:08:31 +0800405 {
406 MBEDTLS_SSL_DEBUG_MSG( 1,
407 ( "Invalid server key share, our group %u, their group %u",
Jerry Yu4a173382021-10-11 21:45:31 +0800408 (unsigned) offered_group, (unsigned) group ) );
409 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
410 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
411 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Jerry Yue1b9c292021-09-10 10:08:31 +0800412 }
413
414#if defined(MBEDTLS_ECDH_C)
Jerry Yu4a173382021-10-11 21:45:31 +0800415 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
Jerry Yue1b9c292021-09-10 10:08:31 +0800416 {
417 /* Complete ECDHE key agreement */
Jerry Yuc068b662021-10-11 22:30:19 +0800418 ret = ssl_tls13_read_public_ecdhe_share( ssl, p, end - p );
Jerry Yue1b9c292021-09-10 10:08:31 +0800419 if( ret != 0 )
420 return( ret );
421 }
Jerry Yub85277e2021-10-13 13:36:05 +0800422 else
Jerry Yue1b9c292021-09-10 10:08:31 +0800423#endif /* MBEDTLS_ECDH_C */
Jerry Yub85277e2021-10-13 13:36:05 +0800424 if( 0 /* other KEMs? */ )
Jerry Yue1b9c292021-09-10 10:08:31 +0800425 {
426 /* Do something */
427 }
428 else
429 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
430
431 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
432 return( ret );
433}
434
Jerry Yubc20bdd2021-08-24 15:59:48 +0800435#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
436
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800437/* Write cipher_suites
Jerry Yu6a643102021-08-31 14:40:36 +0800438 * CipherSuite cipher_suites<2..2^16-2>;
439 */
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800440static int ssl_tls13_write_client_hello_cipher_suites(
Jerry Yu6a643102021-08-31 14:40:36 +0800441 mbedtls_ssl_context *ssl,
442 unsigned char *buf,
443 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000444 size_t *out_len )
Jerry Yu6a643102021-08-31 14:40:36 +0800445{
Jerry Yufec982e2021-09-07 17:26:06 +0800446 unsigned char *p = buf;
Jerry Yu0c63af62021-09-02 12:59:12 +0800447 const int *ciphersuite_list;
Xiaofei Baieef15042021-11-18 07:29:56 +0000448 unsigned char *cipher_suites; /* Start of the cipher_suites list */
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800449 size_t cipher_suites_len;
Jerry Yu92c6b402021-08-27 16:59:09 +0800450
Xiaofei Baid25fab62021-12-02 06:36:27 +0000451 *out_len = 0 ;
Jerry Yu6a643102021-08-31 14:40:36 +0800452
453 /*
454 * Ciphersuite list
455 *
456 * This is a list of the symmetric cipher options supported by
457 * the client, specifically the record protection algorithm
458 * ( including secret key length ) and a hash to be used with
459 * HKDF, in descending order of client preference.
460 */
Jerry Yu0c63af62021-09-02 12:59:12 +0800461 ciphersuite_list = ssl->conf->ciphersuite_list;
Jerry Yu6a643102021-08-31 14:40:36 +0800462
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800463 /* Check there is space for the cipher suite list length (2 bytes). */
Jerry Yu4e388282021-09-06 21:28:08 +0800464 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
465 p += 2;
Jerry Yu6a643102021-08-31 14:40:36 +0800466
Jerry Yu0c63af62021-09-02 12:59:12 +0800467 /* Write cipher_suites */
Xiaofei Baieef15042021-11-18 07:29:56 +0000468 cipher_suites = p;
Jerry Yu0c63af62021-09-02 12:59:12 +0800469 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
Jerry Yu6a643102021-08-31 14:40:36 +0800470 {
Jerry Yu0c63af62021-09-02 12:59:12 +0800471 int cipher_suite = ciphersuite_list[i];
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800472 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu6a643102021-08-31 14:40:36 +0800473
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800474 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
Jerry Yu6a643102021-08-31 14:40:36 +0800475 if( ciphersuite_info == NULL )
476 continue;
Jerry Yudbfb7bd2021-09-04 09:58:58 +0800477 if( !( MBEDTLS_SSL_MINOR_VERSION_4 >= ciphersuite_info->min_minor_ver &&
478 MBEDTLS_SSL_MINOR_VERSION_4 <= ciphersuite_info->max_minor_ver ) )
Jerry Yu6a643102021-08-31 14:40:36 +0800479 continue;
480
481 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800482 (unsigned int) cipher_suite,
Jerry Yu6a643102021-08-31 14:40:36 +0800483 ciphersuite_info->name ) );
484
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800485 /* Check there is space for the cipher suite identifier (2 bytes). */
Jerry Yubbe09522021-09-06 21:17:54 +0800486 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
487 MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
488 p += 2;
Jerry Yu6a643102021-08-31 14:40:36 +0800489 }
490
Jerry Yu0c63af62021-09-02 12:59:12 +0800491 /* Write the cipher_suites length in number of bytes */
Xiaofei Baieef15042021-11-18 07:29:56 +0000492 cipher_suites_len = p - cipher_suites;
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800493 MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
Jerry Yu6a643102021-08-31 14:40:36 +0800494 MBEDTLS_SSL_DEBUG_MSG( 3,
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800495 ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
496 cipher_suites_len/2 ) );
Jerry Yu6a643102021-08-31 14:40:36 +0800497
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800498 /* Output the total length of cipher_suites field. */
Xiaofei Baid25fab62021-12-02 06:36:27 +0000499 *out_len = p - buf;
Jerry Yuf171e832021-08-31 18:31:09 +0800500
Jerry Yu6a643102021-08-31 14:40:36 +0800501 return( 0 );
502}
503
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800504/*
505 * Structure of ClientHello message:
506 *
507 * struct {
508 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
509 * Random random;
510 * opaque legacy_session_id<0..32>;
511 * CipherSuite cipher_suites<2..2^16-2>;
512 * opaque legacy_compression_methods<1..2^8-1>;
513 * Extension extensions<8..2^16-1>;
514 * } ClientHello;
515 */
Jerry Yu08906d02021-08-31 11:05:27 +0800516static int ssl_tls13_write_client_hello_body( mbedtls_ssl_context *ssl,
Jerry Yueecfbf02021-08-30 18:32:07 +0800517 unsigned char *buf,
Jerry Yuef387d72021-09-02 13:59:41 +0800518 unsigned char *end,
Xiaofei Baid25fab62021-12-02 06:36:27 +0000519 size_t *out_len )
Jerry Yu65dd2cc2021-08-18 16:38:40 +0800520{
Jerry Yubc20bdd2021-08-24 15:59:48 +0800521
Jerry Yubc20bdd2021-08-24 15:59:48 +0800522 int ret;
Xiaofei Baieef15042021-11-18 07:29:56 +0000523 unsigned char *p_extensions_len; /* Pointer to extensions length */
524 size_t output_len; /* Length of buffer used by function */
525 size_t extensions_len; /* Length of the list of extensions*/
Jerry Yubc20bdd2021-08-24 15:59:48 +0800526
Jerry Yubc20bdd2021-08-24 15:59:48 +0800527 /* Buffer management */
Jerry Yubbe09522021-09-06 21:17:54 +0800528 unsigned char *p = buf;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800529
Xiaofei Baid25fab62021-12-02 06:36:27 +0000530 *out_len = 0;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800531
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800532 /* No validation needed here. It has been done by ssl_conf_check() */
Jerry Yubc20bdd2021-08-24 15:59:48 +0800533 ssl->major_ver = ssl->conf->min_major_ver;
534 ssl->minor_ver = ssl->conf->min_minor_ver;
535
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800536 /*
537 * Write legacy_version
Jerry Yu6a643102021-08-31 14:40:36 +0800538 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800539 *
540 * For TLS 1.3 we use the legacy version number {0x03, 0x03}
Jerry Yubc20bdd2021-08-24 15:59:48 +0800541 * instead of the true version number.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800542 */
Jerry Yufec982e2021-09-07 17:26:06 +0800543 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Jerry Yubbe09522021-09-06 21:17:54 +0800544 MBEDTLS_PUT_UINT16_BE( 0x0303, p, 0 );
Jerry Yufec982e2021-09-07 17:26:06 +0800545 p += 2;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800546
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800547 /* Write the random bytes ( random ).*/
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800548 MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
549 memcpy( p, ssl->handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
Jerry Yue885b762021-08-26 17:32:34 +0800550 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800551 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
552 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800553
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800554 /*
555 * Write legacy_session_id
556 *
557 * Versions of TLS before TLS 1.3 supported a "session resumption" feature
558 * which has been merged with pre-shared keys in this version. A client
559 * which has a cached session ID set by a pre-TLS 1.3 server SHOULD set
560 * this field to that value. In compatibility mode, this field MUST be
561 * non-empty, so a client not offering a pre-TLS 1.3 session MUST generate
562 * a new 32-byte value. This value need not be random but SHOULD be
563 * unpredictable to avoid implementations fixating on a specific value
564 * ( also known as ossification ). Otherwise, it MUST be set as a zero-length
565 * vector ( i.e., a zero-valued single byte length field ).
Jerry Yubc20bdd2021-08-24 15:59:48 +0800566 */
Ronald Cron49ad6192021-11-24 16:25:31 +0100567#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
568 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
569 *p++ = (unsigned char)ssl->session_negotiate->id_len;
570 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
571 p += ssl->session_negotiate->id_len;
572
573 MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
574 ssl->session_negotiate->id_len );
575#else
Jerry Yubbe09522021-09-06 21:17:54 +0800576 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
577 *p++ = 0; /* session id length set to zero */
Ronald Cron49ad6192021-11-24 16:25:31 +0100578#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yubc20bdd2021-08-24 15:59:48 +0800579
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800580 /* Write cipher_suites */
Jerry Yubbe09522021-09-06 21:17:54 +0800581 ret = ssl_tls13_write_client_hello_cipher_suites( ssl, p, end, &output_len );
Jerry Yudbfb7bd2021-09-04 09:58:58 +0800582 if( ret != 0 )
Jerry Yu6a643102021-08-31 14:40:36 +0800583 return( ret );
Jerry Yubbe09522021-09-06 21:17:54 +0800584 p += output_len;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800585
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800586 /* Write legacy_compression_methods
587 *
588 * For every TLS 1.3 ClientHello, this vector MUST contain exactly
Jerry Yubc20bdd2021-08-24 15:59:48 +0800589 * one byte set to zero, which corresponds to the 'null' compression
590 * method in prior versions of TLS.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800591 */
Jerry Yubbe09522021-09-06 21:17:54 +0800592 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
593 *p++ = 1;
594 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800595
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800596 /* Write extensions */
597
598 /* Keeping track of the included extensions */
599 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800600
601 /* First write extensions, then the total length */
Jerry Yubbe09522021-09-06 21:17:54 +0800602 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Xiaofei Baieef15042021-11-18 07:29:56 +0000603 p_extensions_len = p;
Jerry Yubbe09522021-09-06 21:17:54 +0800604 p += 2;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800605
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800606 /* Write supported_versions extension
Jerry Yubc20bdd2021-08-24 15:59:48 +0800607 *
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800608 * Supported Versions Extension is mandatory with TLS 1.3.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800609 */
Jerry Yubbe09522021-09-06 21:17:54 +0800610 ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &output_len );
Jerry Yu92c6b402021-08-27 16:59:09 +0800611 if( ret != 0 )
612 return( ret );
Jerry Yubbe09522021-09-06 21:17:54 +0800613 p += output_len;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800614
615#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yubc20bdd2021-08-24 15:59:48 +0800616
Jerry Yub925f212022-01-12 11:17:02 +0800617 /*
618 * Add the extensions related to (EC)DHE ephemeral key establishment only if
619 * enabled as per the configuration.
Jerry Yubc20bdd2021-08-24 15:59:48 +0800620 */
Jerry Yuf46b0162022-01-11 16:28:00 +0800621 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
622 {
623 ret = mbedtls_ssl_write_supported_groups_ext( ssl, p, end, &output_len );
624 if( ret != 0 )
625 return( ret );
626 p += output_len;
Jerry Yu6a643102021-08-31 14:40:36 +0800627
Jerry Yuf46b0162022-01-11 16:28:00 +0800628 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &output_len );
629 if( ret != 0 )
630 return( ret );
631 p += output_len;
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800632
Jerry Yuf017ee42022-01-12 15:49:48 +0800633 ret = mbedtls_ssl_write_sig_alg_ext( ssl, p, end, &output_len );
Jerry Yuf46b0162022-01-11 16:28:00 +0800634 if( ret != 0 )
635 return( ret );
636 p += output_len;
637 }
Jerry Yubc20bdd2021-08-24 15:59:48 +0800638#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
639
Xiaofei Bai15a56812021-11-05 10:52:12 +0000640#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Xiaofei Bai58afdba2021-11-09 03:10:05 +0000641 /* Write server name extension */
Xiaofei Bai15a56812021-11-05 10:52:12 +0000642 ret = mbedtls_ssl_write_hostname_ext( ssl, p, end, &output_len );
643 if( ret != 0 )
644 return( ret );
645 p += output_len;
646#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
647
Jerry Yubc20bdd2021-08-24 15:59:48 +0800648 /* Add more extensions here */
649
Jerry Yu1bc2c1f2021-09-01 12:57:29 +0800650 /* Write the length of the list of extensions. */
Xiaofei Baieef15042021-11-18 07:29:56 +0000651 extensions_len = p - p_extensions_len - 2;
652 MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
Jerry Yubc20bdd2021-08-24 15:59:48 +0800653 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" MBEDTLS_PRINTF_SIZET ,
Jerry Yu790656a2021-09-01 15:51:48 +0800654 extensions_len ) );
Xiaofei Baieef15042021-11-18 07:29:56 +0000655 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p_extensions_len, extensions_len );
Jerry Yubc20bdd2021-08-24 15:59:48 +0800656
Xiaofei Baid25fab62021-12-02 06:36:27 +0000657 *out_len = p - buf;
Jerry Yubc20bdd2021-08-24 15:59:48 +0800658 return( 0 );
659}
660
Jerry Yu335aca92021-09-12 20:18:56 +0800661static int ssl_tls13_finalize_client_hello( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +0800662{
Jerry Yu92c6b402021-08-27 16:59:09 +0800663 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
664 return( 0 );
665}
Jerry Yuef6b36b2021-08-24 16:29:02 +0800666
Jerry Yu92c6b402021-08-27 16:59:09 +0800667static int ssl_tls13_prepare_client_hello( mbedtls_ssl_context *ssl )
668{
669 int ret;
Jerry Yuef6b36b2021-08-24 16:29:02 +0800670
Jerry Yu92c6b402021-08-27 16:59:09 +0800671 if( ssl->conf->f_rng == NULL )
672 {
673 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
674 return( MBEDTLS_ERR_SSL_NO_RNG );
675 }
Jerry Yuef6b36b2021-08-24 16:29:02 +0800676
Jerry Yu92c6b402021-08-27 16:59:09 +0800677 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
678 ssl->handshake->randbytes,
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800679 MBEDTLS_CLIENT_HELLO_RANDOM_LEN ) ) != 0 )
Jerry Yu92c6b402021-08-27 16:59:09 +0800680 {
Jerry Yu8c02bb42021-09-03 21:09:22 +0800681 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
Jerry Yu92c6b402021-08-27 16:59:09 +0800682 return( ret );
683 }
Jerry Yu6f13f642021-08-26 17:18:15 +0800684
Ronald Cron49ad6192021-11-24 16:25:31 +0100685#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
686 /*
687 * Create a session identifier for the purpose of middlebox compatibility
688 * only if one has not been created already.
689 */
690 if( ssl->session_negotiate->id_len == 0 )
691 {
692 /* Creating a session id with 32 byte length */
693 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
694 ssl->session_negotiate->id, 32 ) ) != 0 )
695 {
696 MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
697 return( ret );
698 }
699 ssl->session_negotiate->id_len = 32;
700 }
701#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
702
Jerry Yu6f13f642021-08-26 17:18:15 +0800703 return( 0 );
Jerry Yubc20bdd2021-08-24 15:59:48 +0800704}
705
Jerry Yu92c6b402021-08-27 16:59:09 +0800706/*
Jerry Yu159c5a02021-08-31 12:51:25 +0800707 * Write ClientHello handshake message.
Jerry Yu687101b2021-09-14 16:03:56 +0800708 * Handler for MBEDTLS_SSL_CLIENT_HELLO
Jerry Yu92c6b402021-08-27 16:59:09 +0800709 */
710static int ssl_tls13_write_client_hello( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +0800711{
Jerry Yu92c6b402021-08-27 16:59:09 +0800712 int ret = 0;
713 unsigned char *buf;
714 size_t buf_len, msg_len;
715
716 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
717
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800718 MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_client_hello( ssl ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800719
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800720 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_start_handshake_msg(
721 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
722 &buf, &buf_len ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800723
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800724 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_client_hello_body( ssl, buf,
Jerry Yuef387d72021-09-02 13:59:41 +0800725 buf + buf_len,
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800726 &msg_len ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800727
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800728 mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl,
729 MBEDTLS_SSL_HS_CLIENT_HELLO,
Jerry Yu0c63af62021-09-02 12:59:12 +0800730 msg_len );
731 ssl->handshake->update_checksum( ssl, buf, msg_len );
Jerry Yu92c6b402021-08-27 16:59:09 +0800732
Jerry Yu2c0fbf32021-09-02 13:53:46 +0800733 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_client_hello( ssl ) );
734 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_finish_handshake_msg( ssl,
735 buf_len,
736 msg_len ) );
Jerry Yu92c6b402021-08-27 16:59:09 +0800737
738cleanup:
739
740 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
741 return ret;
Jerry Yu65dd2cc2021-08-18 16:38:40 +0800742}
743
Jerry Yu687101b2021-09-14 16:03:56 +0800744/*
Jerry Yu4a173382021-10-11 21:45:31 +0800745 * Functions for parsing and processing Server Hello
Jerry Yue1b9c292021-09-10 10:08:31 +0800746 */
Jerry Yu7a186a02021-10-15 18:46:14 +0800747/* Returns a negative value on failure, and otherwise
Jerry Yub85277e2021-10-13 13:36:05 +0800748 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
749 * - SSL_SERVER_HELLO_COORDINATE_HRR
750 * to indicate which message is expected and to be parsed next. */
751#define SSL_SERVER_HELLO_COORDINATE_HELLO 0
752#define SSL_SERVER_HELLO_COORDINATE_HRR 1
753static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl,
754 const unsigned char *buf,
755 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800756{
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800757 static const unsigned char magic_hrr_string[MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
Jerry Yue1b9c292021-09-10 10:08:31 +0800758 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
759 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
760 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
761 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33 ,0x9C };
762
763 /* Check whether this message is a HelloRetryRequest ( HRR ) message.
764 *
Jerry Yu4a173382021-10-11 21:45:31 +0800765 * Server Hello and HRR are only distinguished by Random set to the
Jerry Yue1b9c292021-09-10 10:08:31 +0800766 * special value of the SHA-256 of "HelloRetryRequest".
767 *
768 * struct {
769 * ProtocolVersion legacy_version = 0x0303;
770 * Random random;
771 * opaque legacy_session_id_echo<0..32>;
772 * CipherSuite cipher_suite;
773 * uint8 legacy_compression_method = 0;
Jerry Yub85277e2021-10-13 13:36:05 +0800774 * Extension extensions<6..2^16-1>;
Jerry Yue1b9c292021-09-10 10:08:31 +0800775 * } ServerHello;
776 *
777 */
Jerry Yub85277e2021-10-13 13:36:05 +0800778 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 + sizeof( magic_hrr_string ) );
Jerry Yu4a173382021-10-11 21:45:31 +0800779
780 if( memcmp( buf + 2, magic_hrr_string, sizeof( magic_hrr_string ) ) == 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800781 {
Jerry Yub85277e2021-10-13 13:36:05 +0800782 return( SSL_SERVER_HELLO_COORDINATE_HRR );
Jerry Yue1b9c292021-09-10 10:08:31 +0800783 }
784
Jerry Yub85277e2021-10-13 13:36:05 +0800785 return( SSL_SERVER_HELLO_COORDINATE_HELLO );
Jerry Yue1b9c292021-09-10 10:08:31 +0800786}
787
Jerry Yu745bb612021-10-13 22:01:04 +0800788/* Fetch and preprocess
789 * Returns a negative value on failure, and otherwise
790 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
791 * - SSL_SERVER_HELLO_COORDINATE_HRR
792 */
Jerry Yub85277e2021-10-13 13:36:05 +0800793static int ssl_tls13_server_hello_coordinate( mbedtls_ssl_context *ssl,
794 unsigned char **buf,
795 size_t *buf_len )
Jerry Yue1b9c292021-09-10 10:08:31 +0800796{
Jerry Yu4a173382021-10-11 21:45:31 +0800797 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800798
799 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_read_record( ssl, 0 ) );
800
Jerry Yue1b9c292021-09-10 10:08:31 +0800801 if( ( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) ||
802 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO ) )
803 {
804 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected message" ) );
805
806 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
807 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
808 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
809 }
810
811 *buf = ssl->in_msg + 4;
812 *buf_len = ssl->in_hslen - 4;
813
Jerry Yub85277e2021-10-13 13:36:05 +0800814 ret = ssl_server_hello_is_hrr( ssl, *buf, *buf + *buf_len );
815 switch( ret )
Jerry Yue1b9c292021-09-10 10:08:31 +0800816 {
Jerry Yu745bb612021-10-13 22:01:04 +0800817 case SSL_SERVER_HELLO_COORDINATE_HELLO:
818 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) );
819 break;
820 case SSL_SERVER_HELLO_COORDINATE_HRR:
821 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) );
822 break;
Jerry Yue1b9c292021-09-10 10:08:31 +0800823 }
824
825cleanup:
826
827 return( ret );
828}
829
Jerry Yu4a173382021-10-11 21:45:31 +0800830static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl,
831 const unsigned char **buf,
832 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800833{
834 const unsigned char *p = *buf;
Jerry Yu4a173382021-10-11 21:45:31 +0800835 size_t legacy_session_id_echo_len;
Jerry Yue1b9c292021-09-10 10:08:31 +0800836
Jerry Yude4fb2c2021-09-19 18:05:08 +0800837 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
Jerry Yu4a173382021-10-11 21:45:31 +0800838 legacy_session_id_echo_len = *p++ ;
Jerry Yue1b9c292021-09-10 10:08:31 +0800839
Jerry Yu4a173382021-10-11 21:45:31 +0800840 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len );
Jerry Yue1b9c292021-09-10 10:08:31 +0800841
842 /* legacy_session_id_echo */
Jerry Yu4a173382021-10-11 21:45:31 +0800843 if( ssl->session_negotiate->id_len != legacy_session_id_echo_len ||
844 memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800845 {
Jerry Yue1b9c292021-09-10 10:08:31 +0800846 MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID",
847 ssl->session_negotiate->id,
848 ssl->session_negotiate->id_len );
849 MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p,
Jerry Yu4a173382021-10-11 21:45:31 +0800850 legacy_session_id_echo_len );
851
852 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
853 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
854
Jerry Yue1b9c292021-09-10 10:08:31 +0800855 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
856 }
857
Jerry Yu4a173382021-10-11 21:45:31 +0800858 p += legacy_session_id_echo_len;
Jerry Yue1b9c292021-09-10 10:08:31 +0800859 *buf = p;
860
861 MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id,
Jerry Yu4a173382021-10-11 21:45:31 +0800862 ssl->session_negotiate->id_len );
Jerry Yue1b9c292021-09-10 10:08:31 +0800863 return( 0 );
864}
865
Jerry Yu4a173382021-10-11 21:45:31 +0800866static int ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl,
867 int cipher_suite )
Jerry Yue1b9c292021-09-10 10:08:31 +0800868{
Jerry Yu4a173382021-10-11 21:45:31 +0800869 const int *ciphersuite_list = ssl->conf->ciphersuite_list;
870
Jerry Yue1b9c292021-09-10 10:08:31 +0800871 /* Check whether we have offered this ciphersuite */
Jerry Yu4a173382021-10-11 21:45:31 +0800872 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
Jerry Yue1b9c292021-09-10 10:08:31 +0800873 {
Jerry Yu4a173382021-10-11 21:45:31 +0800874 if( ciphersuite_list[i] == cipher_suite )
Jerry Yue1b9c292021-09-10 10:08:31 +0800875 {
876 return( 1 );
877 }
878 }
879 return( 0 );
880}
881
882/* Parse ServerHello message and configure context
883 *
884 * struct {
885 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
886 * Random random;
887 * opaque legacy_session_id_echo<0..32>;
888 * CipherSuite cipher_suite;
889 * uint8 legacy_compression_method = 0;
Jerry Yub85277e2021-10-13 13:36:05 +0800890 * Extension extensions<6..2^16-1>;
Jerry Yue1b9c292021-09-10 10:08:31 +0800891 * } ServerHello;
892 */
Jerry Yuc068b662021-10-11 22:30:19 +0800893static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl,
894 const unsigned char *buf,
895 const unsigned char *end )
Jerry Yue1b9c292021-09-10 10:08:31 +0800896{
Jerry Yub85277e2021-10-13 13:36:05 +0800897 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +0800898 const unsigned char *p = buf;
Jerry Yub85277e2021-10-13 13:36:05 +0800899 size_t extensions_len;
900 const unsigned char *extensions_end;
Jerry Yue1b9c292021-09-10 10:08:31 +0800901 uint16_t cipher_suite;
Jerry Yude4fb2c2021-09-19 18:05:08 +0800902 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yue1b9c292021-09-10 10:08:31 +0800903
904 /*
905 * Check there is space for minimal fields
906 *
907 * - legacy_version ( 2 bytes)
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800908 * - random (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes)
Jerry Yue1b9c292021-09-10 10:08:31 +0800909 * - legacy_session_id_echo ( 1 byte ), minimum size
910 * - cipher_suite ( 2 bytes)
911 * - legacy_compression_method ( 1 byte )
912 */
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800913 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 );
Jerry Yue1b9c292021-09-10 10:08:31 +0800914
915 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p );
Jerry Yue1b9c292021-09-10 10:08:31 +0800916 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 );
917
Jerry Yu4a173382021-10-11 21:45:31 +0800918 /* ...
Jerry Yub85277e2021-10-13 13:36:05 +0800919 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
Jerry Yu4a173382021-10-11 21:45:31 +0800920 * ...
921 * with ProtocolVersion defined as:
922 * uint16 ProtocolVersion;
923 */
Jerry Yue1b9c292021-09-10 10:08:31 +0800924 if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 &&
925 p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) )
926 {
927 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
928 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
929 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
930 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
931 }
932 p += 2;
Jerry Yue1b9c292021-09-10 10:08:31 +0800933
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800934 /* ...
Jerry Yu4a173382021-10-11 21:45:31 +0800935 * Random random;
936 * ...
937 * with Random defined as:
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800938 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu4a173382021-10-11 21:45:31 +0800939 */
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800940 memcpy( &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p,
941 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
Jerry Yue1b9c292021-09-10 10:08:31 +0800942 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
Jerry Yue6d7e5c2021-10-26 10:44:32 +0800943 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
944 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
Jerry Yue1b9c292021-09-10 10:08:31 +0800945
Jerry Yu4a173382021-10-11 21:45:31 +0800946 /* ...
947 * opaque legacy_session_id_echo<0..32>;
948 * ...
949 */
950 if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800951 {
952 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
953 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
954 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
955 }
956
Jerry Yu4a173382021-10-11 21:45:31 +0800957 /* ...
958 * CipherSuite cipher_suite;
959 * ...
960 * with CipherSuite defined as:
961 * uint8 CipherSuite[2];
962 */
963 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
Jerry Yue1b9c292021-09-10 10:08:31 +0800964 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
965 p += 2;
966
Jerry Yu4a173382021-10-11 21:45:31 +0800967
968 /*
969 * Check whether this ciphersuite is supported and offered.
970 * Via the force_ciphersuite version we may have instructed the client
971 * to use a different ciphersuite.
972 */
Jerry Yue1b9c292021-09-10 10:08:31 +0800973 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
Jerry Yu4a173382021-10-11 21:45:31 +0800974 if( ciphersuite_info == NULL ||
975 ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) == 0 )
Jerry Yue1b9c292021-09-10 10:08:31 +0800976 {
Jerry Yub85277e2021-10-13 13:36:05 +0800977 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite(%04x) not found or not offered",
Jerry Yue1b9c292021-09-10 10:08:31 +0800978 cipher_suite ) );
Jerry Yue1b9c292021-09-10 10:08:31 +0800979
Jerry Yu4a173382021-10-11 21:45:31 +0800980 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
981 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
982 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Jerry Yue1b9c292021-09-10 10:08:31 +0800983 }
984
Jerry Yue1b9c292021-09-10 10:08:31 +0800985
Jerry Yu4a173382021-10-11 21:45:31 +0800986 /* Configure ciphersuites */
987 mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info );
988
989 ssl->handshake->ciphersuite_info = ciphersuite_info;
Jerry Yue1b9c292021-09-10 10:08:31 +0800990 ssl->session_negotiate->ciphersuite = cipher_suite;
991
Jerry Yue1b9c292021-09-10 10:08:31 +0800992 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s",
993 cipher_suite, ciphersuite_info->name ) );
994
995#if defined(MBEDTLS_HAVE_TIME)
996 ssl->session_negotiate->start = time( NULL );
997#endif /* MBEDTLS_HAVE_TIME */
998
Jerry Yu4a173382021-10-11 21:45:31 +0800999 /* ...
1000 * uint8 legacy_compression_method = 0;
1001 * ...
Jerry Yue1b9c292021-09-10 10:08:31 +08001002 */
Jerry Yude4fb2c2021-09-19 18:05:08 +08001003 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001004 if( p[0] != 0 )
1005 {
Jerry Yub85277e2021-10-13 13:36:05 +08001006 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001007 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1008 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1009 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1010 }
1011 p++;
1012
Jerry Yub85277e2021-10-13 13:36:05 +08001013 /* ...
1014 * Extension extensions<6..2^16-1>;
1015 * ...
Jerry Yu4a173382021-10-11 21:45:31 +08001016 * struct {
1017 * ExtensionType extension_type; (2 bytes)
1018 * opaque extension_data<0..2^16-1>;
1019 * } Extension;
1020 */
Jerry Yude4fb2c2021-09-19 18:05:08 +08001021 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
Jerry Yu4a173382021-10-11 21:45:31 +08001022 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001023 p += 2;
Jerry Yude4fb2c2021-09-19 18:05:08 +08001024
Jerry Yu4a173382021-10-11 21:45:31 +08001025 /* Check extensions do not go beyond the buffer of data. */
1026 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1027 extensions_end = p + extensions_len;
Jerry Yue1b9c292021-09-10 10:08:31 +08001028
Jerry Yu4a173382021-10-11 21:45:31 +08001029 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001030
Jerry Yu4a173382021-10-11 21:45:31 +08001031 while( p < extensions_end )
Jerry Yue1b9c292021-09-10 10:08:31 +08001032 {
1033 unsigned int extension_type;
1034 size_t extension_data_len;
1035
Jerry Yu4a173382021-10-11 21:45:31 +08001036 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
Jerry Yue1b9c292021-09-10 10:08:31 +08001037 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1038 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1039 p += 4;
1040
Jerry Yu4a173382021-10-11 21:45:31 +08001041 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001042
1043 switch( extension_type )
1044 {
1045 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
1046 MBEDTLS_SSL_DEBUG_MSG( 3,
1047 ( "found supported_versions extension" ) );
1048
Jerry Yuc068b662021-10-11 22:30:19 +08001049 ret = ssl_tls13_parse_supported_versions_ext( ssl,
Jerry Yub85277e2021-10-13 13:36:05 +08001050 p,
1051 p + extension_data_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001052 if( ret != 0 )
1053 return( ret );
1054 break;
1055
1056 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1057 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) );
1058 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001059
1060 MBEDTLS_SSL_PEND_FATAL_ALERT(
1061 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1062 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1063 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
Jerry Yue1b9c292021-09-10 10:08:31 +08001064
1065#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1066 case MBEDTLS_TLS_EXT_KEY_SHARE:
1067 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001068 if( ( ret = ssl_tls13_parse_key_share_ext( ssl,
Jerry Yue1b9c292021-09-10 10:08:31 +08001069 p, p + extension_data_len ) ) != 0 )
1070 {
1071 MBEDTLS_SSL_DEBUG_RET( 1,
Jerry Yu4a173382021-10-11 21:45:31 +08001072 "ssl_tls13_parse_key_share_ext",
Jerry Yue1b9c292021-09-10 10:08:31 +08001073 ret );
1074 return( ret );
1075 }
1076 break;
1077#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1078
1079 default:
Jerry Yu4a173382021-10-11 21:45:31 +08001080 MBEDTLS_SSL_DEBUG_MSG(
1081 3,
1082 ( "unknown extension found: %u ( ignoring )",
1083 extension_type ) );
1084
1085 MBEDTLS_SSL_PEND_FATAL_ALERT(
1086 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1087 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1088 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
Jerry Yue1b9c292021-09-10 10:08:31 +08001089 }
1090
1091 p += extension_data_len;
1092 }
1093
1094 return( 0 );
1095}
1096
Jerry Yuc068b662021-10-11 22:30:19 +08001097static int ssl_tls13_finalize_server_hello( mbedtls_ssl_context *ssl )
Jerry Yue1b9c292021-09-10 10:08:31 +08001098{
Jerry Yub85277e2021-10-13 13:36:05 +08001099 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu0b177842021-09-05 19:41:30 +08001100 mbedtls_ssl_key_set traffic_keys;
Jerry Yu4a173382021-10-11 21:45:31 +08001101 mbedtls_ssl_transform *transform_handshake = NULL;
Jerry Yub85277e2021-10-13 13:36:05 +08001102 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu0b177842021-09-05 19:41:30 +08001103
Jerry Yub85277e2021-10-13 13:36:05 +08001104 /* Determine the key exchange mode:
1105 * 1) If both the pre_shared_key and key_share extensions were received
1106 * then the key exchange mode is PSK with EPHEMERAL.
1107 * 2) If only the pre_shared_key extension was received then the key
1108 * exchange mode is PSK-only.
1109 * 3) If only the key_share extension was received then the key
1110 * exchange mode is EPHEMERAL-only.
Jerry Yu0b177842021-09-05 19:41:30 +08001111 */
Jerry Yub85277e2021-10-13 13:36:05 +08001112 switch( handshake->extensions_present &
1113 ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ) )
Jerry Yu0b177842021-09-05 19:41:30 +08001114 {
Jerry Yu745bb612021-10-13 22:01:04 +08001115 /* Only the pre_shared_key extension was received */
1116 case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
Xiaofei Baid25fab62021-12-02 06:36:27 +00001117 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
Jerry Yu745bb612021-10-13 22:01:04 +08001118 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001119
Jerry Yu745bb612021-10-13 22:01:04 +08001120 /* Only the key_share extension was received */
1121 case MBEDTLS_SSL_EXT_KEY_SHARE:
Xiaofei Baid25fab62021-12-02 06:36:27 +00001122 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
Jerry Yu745bb612021-10-13 22:01:04 +08001123 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001124
Jerry Yu745bb612021-10-13 22:01:04 +08001125 /* Both the pre_shared_key and key_share extensions were received */
1126 case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
Xiaofei Baid25fab62021-12-02 06:36:27 +00001127 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
Jerry Yu745bb612021-10-13 22:01:04 +08001128 break;
Jerry Yub85277e2021-10-13 13:36:05 +08001129
Jerry Yu745bb612021-10-13 22:01:04 +08001130 /* Neither pre_shared_key nor key_share extension was received */
1131 default:
1132 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) );
1133 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1134 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001135 }
1136
1137 /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
1138 *
1139 * TODO: We don't have to do this in case we offered 0-RTT and the
1140 * server accepted it. In this case, we could skip generating
1141 * the early secret. */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001142 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
Jerry Yu0b177842021-09-05 19:41:30 +08001143 if( ret != 0 )
1144 {
Xiaofei Bai746f9482021-11-12 08:53:56 +00001145 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early_data",
Jerry Yu0b177842021-09-05 19:41:30 +08001146 ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001147 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001148 }
1149
1150 /* Compute handshake secret */
Jerry Yuf0ac2352021-10-11 17:47:07 +08001151 ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl );
Jerry Yu0b177842021-09-05 19:41:30 +08001152 if( ret != 0 )
1153 {
Xiaofei Bai746f9482021-11-12 08:53:56 +00001154 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001155 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001156 }
1157
1158 /* Next evolution in key schedule: Establish handshake secret and
1159 * key material. */
Jerry Yuc068b662021-10-11 22:30:19 +08001160 ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys );
Jerry Yu0b177842021-09-05 19:41:30 +08001161 if( ret != 0 )
1162 {
Jerry Yuc068b662021-10-11 22:30:19 +08001163 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys",
1164 ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001165 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001166 }
1167
Jerry Yub85277e2021-10-13 13:36:05 +08001168 transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) );
Jerry Yu0b177842021-09-05 19:41:30 +08001169 if( transform_handshake == NULL )
Jerry Yu4a173382021-10-11 21:45:31 +08001170 {
1171 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
1172 goto cleanup;
1173 }
Jerry Yu0b177842021-09-05 19:41:30 +08001174
1175 ret = mbedtls_ssl_tls13_populate_transform( transform_handshake,
1176 ssl->conf->endpoint,
1177 ssl->session_negotiate->ciphersuite,
1178 &traffic_keys,
1179 ssl );
1180 if( ret != 0 )
1181 {
1182 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret );
Jerry Yu4a173382021-10-11 21:45:31 +08001183 goto cleanup;
Jerry Yu0b177842021-09-05 19:41:30 +08001184 }
1185
Jerry Yub85277e2021-10-13 13:36:05 +08001186 handshake->transform_handshake = transform_handshake;
1187 mbedtls_ssl_set_inbound_transform( ssl, transform_handshake );
Jerry Yu0b177842021-09-05 19:41:30 +08001188
1189 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
1190 ssl->session_in = ssl->session_negotiate;
1191
1192 /*
1193 * State machine update
1194 */
1195 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
1196
Jerry Yu4a173382021-10-11 21:45:31 +08001197cleanup:
1198
Jerry Yu0b177842021-09-05 19:41:30 +08001199 mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) );
Jerry Yu4a173382021-10-11 21:45:31 +08001200 if( ret != 0 )
1201 {
Jerry Yub85277e2021-10-13 13:36:05 +08001202 mbedtls_free( transform_handshake );
Jerry Yuc068b662021-10-11 22:30:19 +08001203
Jerry Yu4a173382021-10-11 21:45:31 +08001204 MBEDTLS_SSL_PEND_FATAL_ALERT(
1205 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1206 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1207 }
1208 return( ret );
Jerry Yue1b9c292021-09-10 10:08:31 +08001209}
1210
1211/*
Jerry Yu4a173382021-10-11 21:45:31 +08001212 * Wait and parse ServerHello handshake message.
Jerry Yu687101b2021-09-14 16:03:56 +08001213 * Handler for MBEDTLS_SSL_SERVER_HELLO
1214 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001215static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001216{
Jerry Yu4a173382021-10-11 21:45:31 +08001217 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yue1b9c292021-09-10 10:08:31 +08001218 unsigned char *buf;
1219 size_t buf_len;
1220
1221 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) );
1222
1223 /* Coordination step
1224 * - Fetch record
1225 * - Make sure it's either a ServerHello or a HRR.
1226 * - Switch processing routine in case of HRR
1227 */
Jerry Yue1b9c292021-09-10 10:08:31 +08001228 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
1229 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
1230
Jerry Yub85277e2021-10-13 13:36:05 +08001231 ret = ssl_tls13_server_hello_coordinate( ssl, &buf, &buf_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001232 /* Parsing step
1233 * We know what message to expect by now and call
1234 * the respective parsing function.
1235 */
1236 if( ret == SSL_SERVER_HELLO_COORDINATE_HELLO )
1237 {
Jerry Yuc068b662021-10-11 22:30:19 +08001238 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf,
1239 buf + buf_len ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001240
Xiaofei Bai746f9482021-11-12 08:53:56 +00001241 mbedtls_ssl_tls13_add_hs_msg_to_checksum( ssl,
1242 MBEDTLS_SSL_HS_SERVER_HELLO,
1243 buf, buf_len );
Jerry Yue1b9c292021-09-10 10:08:31 +08001244
Jerry Yuc068b662021-10-11 22:30:19 +08001245 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_server_hello( ssl ) );
Jerry Yue1b9c292021-09-10 10:08:31 +08001246 }
1247 else if( ret == SSL_SERVER_HELLO_COORDINATE_HRR )
1248 {
Jerry Yu4a173382021-10-11 21:45:31 +08001249 MBEDTLS_SSL_DEBUG_MSG( 1, ( "HRR not supported" ) );
1250 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ,
1251 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1252 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yue1b9c292021-09-10 10:08:31 +08001253 }
1254
1255cleanup:
1256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s", __func__ ) );
1257 return( ret );
Jerry Yu687101b2021-09-14 16:03:56 +08001258}
1259
1260/*
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001261 *
1262 * EncryptedExtensions message
1263 *
1264 * The EncryptedExtensions message contains any extensions which
1265 * should be protected, i.e., any which are not needed to establish
1266 * the cryptographic context.
Jerry Yu687101b2021-09-14 16:03:56 +08001267 */
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001268
1269/*
1270 * Overview
1271 */
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001272
1273/* Main entry point; orchestrates the other functions */
XiaokangQian97799ac2021-10-11 10:05:54 +00001274static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001275
XiaokangQian97799ac2021-10-11 10:05:54 +00001276static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1277 const unsigned char *buf,
1278 const unsigned char *end );
1279static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001280
1281/*
XiaokangQianc1fe0002021-09-16 03:02:14 +00001282 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001283 */
XiaokangQian97799ac2021-10-11 10:05:54 +00001284static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001285{
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001286 int ret;
1287 unsigned char *buf;
1288 size_t buf_len;
1289
1290 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) );
1291
Xiaofei Bai746f9482021-11-12 08:53:56 +00001292 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
XiaokangQianab7f50d2021-10-21 06:23:29 +00001293 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001294 &buf, &buf_len ) );
1295
1296 /* Process the message contents */
XiaokangQian97799ac2021-10-11 10:05:54 +00001297 MBEDTLS_SSL_PROC_CHK(
XiaokangQian8db25ff2021-10-13 05:56:18 +00001298 ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001299
Xiaofei Bai746f9482021-11-12 08:53:56 +00001300 mbedtls_ssl_tls13_add_hs_msg_to_checksum(
XiaokangQianab7f50d2021-10-21 06:23:29 +00001301 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, buf_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001302
XiaokangQian97799ac2021-10-11 10:05:54 +00001303 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_encrypted_extensions( ssl ) );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001304
1305cleanup:
1306
1307 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) );
1308 return( ret );
1309
1310}
1311
XiaokangQian08da26c2021-10-09 10:12:11 +00001312/* Parse EncryptedExtensions message
1313 * struct {
XiaokangQian97799ac2021-10-11 10:05:54 +00001314 * Extension extensions<0..2^16-1>;
XiaokangQian08da26c2021-10-09 10:12:11 +00001315 * } EncryptedExtensions;
1316 */
XiaokangQian97799ac2021-10-11 10:05:54 +00001317static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1318 const unsigned char *buf,
1319 const unsigned char *end )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001320{
1321 int ret = 0;
XiaokangQian08da26c2021-10-09 10:12:11 +00001322 size_t extensions_len;
XiaokangQian140f0452021-10-08 08:05:53 +00001323 const unsigned char *p = buf;
XiaokangQian8db25ff2021-10-13 05:56:18 +00001324 const unsigned char *extensions_end;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001325
XiaokangQian08da26c2021-10-09 10:12:11 +00001326 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
XiaokangQian97799ac2021-10-11 10:05:54 +00001327 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
XiaokangQian08da26c2021-10-09 10:12:11 +00001328 p += 2;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001329
XiaokangQian97799ac2021-10-11 10:05:54 +00001330 MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len );
XiaokangQian8db25ff2021-10-13 05:56:18 +00001331 extensions_end = p + extensions_len;
1332 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001333
XiaokangQian8db25ff2021-10-13 05:56:18 +00001334 while( p < extensions_end )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001335 {
XiaokangQian08da26c2021-10-09 10:12:11 +00001336 unsigned int extension_type;
1337 size_t extension_data_len;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001338
XiaokangQian08da26c2021-10-09 10:12:11 +00001339 /*
1340 * struct {
XiaokangQian97799ac2021-10-11 10:05:54 +00001341 * ExtensionType extension_type; (2 bytes)
1342 * opaque extension_data<0..2^16-1>;
XiaokangQian08da26c2021-10-09 10:12:11 +00001343 * } Extension;
1344 */
XiaokangQian8db25ff2021-10-13 05:56:18 +00001345 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
XiaokangQian08da26c2021-10-09 10:12:11 +00001346 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1347 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1348 p += 4;
1349
XiaokangQian8db25ff2021-10-13 05:56:18 +00001350 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001351
XiaokangQian97799ac2021-10-11 10:05:54 +00001352 /* The client MUST check EncryptedExtensions for the
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001353 * presence of any forbidden extensions and if any are found MUST abort
XiaokangQian08da26c2021-10-09 10:12:11 +00001354 * the handshake with an "unsupported_extension" alert.
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001355 */
XiaokangQian08da26c2021-10-09 10:12:11 +00001356 switch( extension_type )
1357 {
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001358
XiaokangQian08da26c2021-10-09 10:12:11 +00001359 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1360 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extensions supported groups" ) );
1361 break;
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001362
XiaokangQian08da26c2021-10-09 10:12:11 +00001363 default:
XiaokangQian97799ac2021-10-11 10:05:54 +00001364 MBEDTLS_SSL_DEBUG_MSG(
1365 3, ( "unsupported extension found: %u ", extension_type) );
1366 MBEDTLS_SSL_PEND_FATAL_ALERT(
Jerry Yu7aa71862021-10-28 21:41:30 +08001367 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
XiaokangQian97799ac2021-10-11 10:05:54 +00001368 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1369 return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
XiaokangQian08da26c2021-10-09 10:12:11 +00001370 }
1371
XiaokangQian08da26c2021-10-09 10:12:11 +00001372 p += extension_data_len;
XiaokangQian97799ac2021-10-11 10:05:54 +00001373 }
XiaokangQian08da26c2021-10-09 10:12:11 +00001374
XiaokangQian97799ac2021-10-11 10:05:54 +00001375 /* Check that we consumed all the message. */
XiaokangQian7b2d4ef2021-10-13 10:19:02 +00001376 if( p != end )
XiaokangQian97799ac2021-10-11 10:05:54 +00001377 {
1378 MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) );
Jerry Yu7aa71862021-10-28 21:41:30 +08001379 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
XiaokangQian7b2d4ef2021-10-13 10:19:02 +00001380 MBEDTLS_ERR_SSL_DECODE_ERROR );
XiaokangQian97799ac2021-10-11 10:05:54 +00001381 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001382 }
1383
1384 return( ret );
1385}
1386
XiaokangQian97799ac2021-10-11 10:05:54 +00001387static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl )
XiaokangQian2d5c72b2021-09-13 07:30:09 +00001388{
Jerry Yua93ac112021-10-27 16:31:48 +08001389#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Xiaofei Bai746f9482021-11-12 08:53:56 +00001390 if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
Jerry Yua93ac112021-10-27 16:31:48 +08001391 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1392 else
Jerry Yud2674312021-10-29 10:08:19 +08001393 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
Jerry Yua93ac112021-10-27 16:31:48 +08001394#else
1395 ((void) ssl);
1396 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1397#endif
Jerry Yu687101b2021-09-14 16:03:56 +08001398 return( 0 );
1399}
1400
Jerry Yua93ac112021-10-27 16:31:48 +08001401#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yu687101b2021-09-14 16:03:56 +08001402/*
Jerry Yud2674312021-10-29 10:08:19 +08001403 * Handler for MBEDTLS_SSL_CERTIFICATE_REQUEST
1404 */
1405static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl )
1406{
1407 int ret = mbedtls_ssl_read_record( ssl, 0 );
1408
1409 if( ret != 0 )
1410 {
1411 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1412 return( ret );
1413 }
1414
1415 if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) &&
1416 ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) )
1417 {
Xiaofei Baie1e34422021-12-23 12:09:05 +00001418 ret = mbedtls_ssl_tls13_process_certificate_request( ssl );
1419 if( ret != 0 )
1420 return( ret );
Jerry Yud2674312021-10-29 10:08:19 +08001421 }
1422
1423 ssl->keep_current_message = 1;
1424 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
1425
1426 return( 0 );
1427}
1428
1429/*
Jerry Yu687101b2021-09-14 16:03:56 +08001430 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
1431 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001432static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001433{
Xiaofei Bai947571e2021-09-29 09:12:03 +00001434 int ret;
1435
1436 ret = mbedtls_ssl_tls13_process_certificate( ssl );
Xiaofei Baif93cbd22021-10-29 02:39:30 +00001437 if( ret != 0 )
Xiaofei Bai947571e2021-09-29 09:12:03 +00001438 return( ret );
1439
Jerry Yu687101b2021-09-14 16:03:56 +08001440 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
1441 return( 0 );
1442}
1443
1444/*
1445 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
1446 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001447static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001448{
Jerry Yu30b071c2021-09-12 20:16:03 +08001449 int ret;
1450
1451 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
1452 if( ret != 0 )
1453 return( ret );
1454
Jerry Yu687101b2021-09-14 16:03:56 +08001455 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1456 return( 0 );
1457}
Jerry Yua93ac112021-10-27 16:31:48 +08001458#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Ronald Crond4c64022021-12-06 09:06:46 +01001459
Jerry Yu687101b2021-09-14 16:03:56 +08001460/*
1461 * Handler for MBEDTLS_SSL_SERVER_FINISHED
1462 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001463static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001464{
XiaokangQianac0385c2021-11-03 06:40:11 +00001465 int ret;
1466
XiaokangQianc5c39d52021-11-09 11:55:10 +00001467 ret = mbedtls_ssl_tls13_process_finished_message( ssl );
XiaokangQianac0385c2021-11-03 06:40:11 +00001468 if( ret != 0 )
1469 return( ret );
1470
Ronald Cron49ad6192021-11-24 16:25:31 +01001471#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1472 mbedtls_ssl_handshake_set_state(
1473 ssl,
1474 MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
1475#else
XiaokangQianac0385c2021-11-03 06:40:11 +00001476 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
Ronald Cron49ad6192021-11-24 16:25:31 +01001477#endif
1478
XiaokangQianac0385c2021-11-03 06:40:11 +00001479 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001480}
1481
1482/*
Ronald Crond4c64022021-12-06 09:06:46 +01001483 * Handler for MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED
1484 */
1485#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1486static int ssl_tls13_write_change_cipher_spec( mbedtls_ssl_context *ssl )
1487{
1488 int ret;
1489
1490 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
1491 if( ret != 0 )
1492 return( ret );
1493
1494 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1495
1496 return( 0 );
1497}
1498#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1499
1500/*
Jerry Yu687101b2021-09-14 16:03:56 +08001501 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
1502 */
XiaokangQian74af2a82021-09-22 07:40:30 +00001503static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001504{
XiaokangQian0fa66432021-11-15 03:33:57 +00001505 int ret;
1506
Ronald Cron49ad6192021-11-24 16:25:31 +01001507 mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
1508
XiaokangQian0fa66432021-11-15 03:33:57 +00001509 ret = mbedtls_ssl_tls13_write_finished_message( ssl );
1510 if( ret != 0 )
1511 return( ret );
1512
1513 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS );
1514 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001515}
1516
1517/*
1518 * Handler for MBEDTLS_SSL_FLUSH_BUFFERS
1519 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001520static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001521{
Jerry Yu378254d2021-10-30 21:44:47 +08001522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
Jerry Yuad8d0ba2021-09-28 17:58:26 +08001523 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
Jerry Yu687101b2021-09-14 16:03:56 +08001524 return( 0 );
1525}
1526
1527/*
1528 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
1529 */
Xiaofei Bai746f9482021-11-12 08:53:56 +00001530static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
Jerry Yu687101b2021-09-14 16:03:56 +08001531{
Jerry Yu378254d2021-10-30 21:44:47 +08001532 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) );
1533 mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
1534
1535 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for outbound traffic" ) );
1536 mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application );
1537
1538 mbedtls_ssl_tls13_handshake_wrapup( ssl );
1539
1540 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
1541 return( 0 );
Jerry Yu687101b2021-09-14 16:03:56 +08001542}
1543
Jerry Yu92c6b402021-08-27 16:59:09 +08001544int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
Jerry Yubc20bdd2021-08-24 15:59:48 +08001545{
Jerry Yu92c6b402021-08-27 16:59:09 +08001546 int ret = 0;
Jerry Yuc8a392c2021-08-18 16:46:28 +08001547
Jerry Yue3b34122021-09-28 17:53:35 +08001548 MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 client state: %s(%d)",
1549 mbedtls_ssl_states_str( ssl->state ),
1550 ssl->state ) );
Jerry Yu92c6b402021-08-27 16:59:09 +08001551
1552 switch( ssl->state )
1553 {
1554 /*
Jerry Yu0c63af62021-09-02 12:59:12 +08001555 * ssl->state is initialized as HELLO_REQUEST. It is the same
1556 * as CLIENT_HELLO state.
Jerry Yu92c6b402021-08-27 16:59:09 +08001557 */
1558 case MBEDTLS_SSL_HELLO_REQUEST:
1559 case MBEDTLS_SSL_CLIENT_HELLO:
1560 ret = ssl_tls13_write_client_hello( ssl );
1561 break;
1562
1563 case MBEDTLS_SSL_SERVER_HELLO:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001564 ret = ssl_tls13_process_server_hello( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001565 break;
1566
1567 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
XiaokangQian97799ac2021-10-11 10:05:54 +00001568 ret = ssl_tls13_process_encrypted_extensions( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001569 break;
1570
Jerry Yua93ac112021-10-27 16:31:48 +08001571#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Jerry Yud2674312021-10-29 10:08:19 +08001572 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
1573 ret = ssl_tls13_process_certificate_request( ssl );
1574 break;
1575
Jerry Yu687101b2021-09-14 16:03:56 +08001576 case MBEDTLS_SSL_SERVER_CERTIFICATE:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001577 ret = ssl_tls13_process_server_certificate( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001578 break;
1579
1580 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001581 ret = ssl_tls13_process_certificate_verify( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001582 break;
Jerry Yua93ac112021-10-27 16:31:48 +08001583#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Jerry Yu687101b2021-09-14 16:03:56 +08001584
1585 case MBEDTLS_SSL_SERVER_FINISHED:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001586 ret = ssl_tls13_process_server_finished( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001587 break;
1588
Jerry Yu687101b2021-09-14 16:03:56 +08001589 case MBEDTLS_SSL_CLIENT_FINISHED:
XiaokangQian74af2a82021-09-22 07:40:30 +00001590 ret = ssl_tls13_write_client_finished( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001591 break;
1592
1593 case MBEDTLS_SSL_FLUSH_BUFFERS:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001594 ret = ssl_tls13_flush_buffers( ssl );
Jerry Yu687101b2021-09-14 16:03:56 +08001595 break;
1596
1597 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Xiaofei Bai746f9482021-11-12 08:53:56 +00001598 ret = ssl_tls13_handshake_wrapup( ssl );
Jerry Yu92c6b402021-08-27 16:59:09 +08001599 break;
1600
Ronald Cron49ad6192021-11-24 16:25:31 +01001601 /*
1602 * Injection of dummy-CCS's for middlebox compatibility
1603 */
1604#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1605 case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
Ronald Crond4c64022021-12-06 09:06:46 +01001606 ret = ssl_tls13_write_change_cipher_spec( ssl );
Ronald Cron49ad6192021-11-24 16:25:31 +01001607 break;
1608#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1609
Jerry Yu92c6b402021-08-27 16:59:09 +08001610 default:
1611 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
1612 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1613 }
1614
1615 return( ret );
1616}
Jerry Yu65dd2cc2021-08-18 16:38:40 +08001617
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001618#endif /* MBEDTLS_SSL_CLI_C */
1619
Ronald Cron6f135e12021-12-08 16:57:54 +01001620#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */