blob: 0b37947567009a1da86d1bf2c664e2ec6e1da6e5 [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
Jerry Yub9930e72021-08-06 17:11:51 +08002 * TLS 1.3 server-side functions
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18*/
19
20#include "common.h"
21
Jerry Yufb4b6472022-01-27 15:03:26 +080022#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080023
Jerry Yu687101b2021-09-14 16:03:56 +080024#include "mbedtls/debug.h"
25
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080026#include "ssl_misc.h"
XiaokangQian7807f9f2022-02-15 10:04:37 +000027#include "ssl_tls13_keys.h"
Gilles Peskine923d5c92021-12-15 12:56:54 +010028#include "ssl_debug_helpers.h"
XiaokangQian7807f9f2022-02-15 10:04:37 +000029#include <string.h>
30#if defined(MBEDTLS_ECP_C)
31#include "mbedtls/ecp.h"
32#include "ecp_internal.h"
33#endif /* MBEDTLS_ECP_C */
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080034
XiaokangQiana9c58412022-02-17 09:41:26 +000035#if defined(MBEDTLS_PLATFORM_C)
36#include "mbedtls/platform.h"
37#else
38#include <stdlib.h>
39#define mbedtls_calloc calloc
40#define mbedtls_free free
41#endif /* MBEDTLS_PLATFORM_C */
XiaokangQian7807f9f2022-02-15 10:04:37 +000042
43/* From RFC 8446:
44 * struct {
45 * select (Handshake.msg_type) {
46 * case client_hello:
47 * ProtocolVersion versions<2..254>;
48 * case server_hello: // and HelloRetryRequest
49 * ProtocolVersion selected_version;
50 * };
51 * } SupportedVersions;
52 */
53static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
54 const unsigned char *buf,
55 const unsigned char *end )
56{
57 size_t list_len;
58 int tls13_supported = 0;
59 int major_ver, minor_ver;
60 const unsigned char *p = buf;
61 const unsigned char *version_end;
62
63 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
64
65 list_len = p[0];
66 p += 1;
67
68 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, list_len );
69 if( list_len % 2 != 0 )
70 {
71 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid supported version list length %" MBEDTLS_PRINTF_SIZET,
72 list_len ) );
73 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
74 }
75
76 version_end = p + list_len;
77 while( p < version_end )
78 {
79 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
80
81 /* In this implementation we only support TLS 1.3 and DTLS 1.3. */
82 if( major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
83 minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
84 {
85 tls13_supported = 1;
86 break;
87 }
88
89 p += 2;
90 }
91
92 if( tls13_supported == 0 )
93 {
94 /* When we support runtime negotiation of TLS 1.2 and TLS 1.3, we need
95 * a graceful fallback to TLS 1.2 in this case. */
96
97 MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 is not supported by the client" ) );
98
99 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
100 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
101 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
102 }
103
104 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Negotiated version. Supported is [%d:%d]",
105 major_ver, minor_ver ) );
106
107 ssl->major_ver = major_ver;
108 ssl->minor_ver = minor_ver;
109 ssl->handshake->max_major_ver = ssl->major_ver;
110 ssl->handshake->max_minor_ver = ssl->minor_ver;
111 return( 0 );
112}
113
114#if ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) )
115/* This function parses the TLS 1.3 supported_groups extension and
116 * stores the received groups in ssl->handshake->curves.
117 *
118 * From RFC 8446:
119 * enum {
120 * ... (0xFFFF)
121 * } NamedGroup;
122 * struct {
123 * NamedGroup named_group_list<2..2^16-1>;
124 * } NamedGroupList;
125 */
126static int mbedtls_ssl_tls13_parse_supported_groups_ext(
127 mbedtls_ssl_context *ssl,
128 const unsigned char *buf, const unsigned char *end )
129{
130
131 size_t list_size, our_size;
132 const unsigned char *p = buf;
133 const mbedtls_ecp_curve_info *curve_info, **curves;
134 const unsigned char *extentions_end;
135
136 MBEDTLS_SSL_DEBUG_BUF( 3, "supported_groups extension", p, end - buf );
137 list_size = MBEDTLS_GET_UINT16_BE( p, 0 );
138 p += 2;
139 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, list_size );
140 if( list_size % 2 != 0 )
141 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
142
143 /* TODO: At the moment, this can happen when receiving a second
144 * ClientHello after an HRR. We should properly reset the
145 * state upon receiving an HRR, in which case we should
146 * not observe handshake->curves already being allocated. */
147 if( ssl->handshake->curves != NULL )
148 {
149 mbedtls_free( ssl->handshake->curves );
150 ssl->handshake->curves = NULL;
151 }
152
153 /* Don't allow our peer to make us allocate too much memory,
154 * and leave room for a final 0 */
155 our_size = list_size / 2 + 1;
156 if( our_size > MBEDTLS_ECP_DP_MAX )
157 our_size = MBEDTLS_ECP_DP_MAX;
158
159 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
160 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
161
162 extentions_end = p + list_size;
163 ssl->handshake->curves = curves;
164
165 while ( p < extentions_end && our_size > 1 )
166 {
167 uint16_t tls_grp_id = MBEDTLS_GET_UINT16_BE( p, 0 );
168 curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_grp_id );
169
170 /* mbedtls_ecp_curve_info_from_tls_id() uses the mbedtls_ecp_curve_info
171 * data structure (defined in ecp.c), which only includes the list of
172 * curves implemented. Hence, we only add curves that are also supported
173 * and implemented by the server. */
174 if( curve_info != NULL )
175 {
176 *curves++ = curve_info;
177 MBEDTLS_SSL_DEBUG_MSG( 4, ( "supported curve: %s", curve_info->name ) );
178 our_size--;
179 }
180
181 p += 2;
182 }
183
184 return( 0 );
185
186}
187#endif /* MBEDTLS_ECDH_C || ( MBEDTLS_ECDSA_C */
188
XiaokangQiana9c58412022-02-17 09:41:26 +0000189#if ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000190/* TODO: Code for MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED missing */
191/*
192 * ssl_tls13_parse_key_shares_ext() verifies whether the information in the
193 * extension is correct and stores the provided key shares. Whether this is an
194 * acceptable key share depends on the selected ciphersuite.
195 *
196 * Possible return values are:
197 * - 0: Successful processing of the client provided key share extension.
198 * - MBEDTLS_ERR_SSL_HRR_REQUIRED: The key share provided by the client
199 * does not match a group supported by the server. A HelloRetryRequest will
200 * be needed.
201 * - Another negative return value for fatal errors.
202*/
203
204static int ssl_tls13_parse_key_shares_ext( mbedtls_ssl_context *ssl,
205 const unsigned char *buf,
206 const unsigned char *end )
207{
208 int ret = 0;
209 unsigned char const *p = buf;
210 unsigned char const *extentions_end;
211
212 size_t total_ext_len, cur_share_len;
213 int match_found = 0;
214
215 /* From RFC 8446:
216 *
217 * struct {
218 * KeyShareEntry client_shares<0..2^16-1>;
219 * } KeyShareClientHello;
220 *
221 */
222
223 /* Read total legnth of KeyShareClientHello */
224 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
225
226 total_ext_len = MBEDTLS_GET_UINT16_BE( p, 0 );
227 p += 2;
228 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, total_ext_len );
229
230 ssl->handshake->offered_group_id = 0;
231 extentions_end = p + total_ext_len;
232
233 /* We try to find a suitable key share entry and copy it to the
234 * handshake context. Later, we have to find out whether we can do
235 * something with the provided key share or whether we have to
236 * dismiss it and send a HelloRetryRequest message. */
237
238 for( ; p < extentions_end; p += cur_share_len )
239 {
240 uint16_t their_group;
241 mbedtls_ecp_group_id their_curve;
242 mbedtls_ecp_curve_info const *their_curve_info;
243 unsigned char const *end_of_share;
244
245 /*
246 * struct {
247 * NamedGroup group;
248 * opaque key_exchange<1..2^16-1>;
249 * } KeyShareEntry;
250 */
251 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extentions_end, 4 );
252
253 their_group = MBEDTLS_GET_UINT16_BE( p, 0 );
254 p += 2;
255
256 cur_share_len = MBEDTLS_GET_UINT16_BE( p, 0 );
257 p += 2;
258
259 end_of_share = p + cur_share_len;
260
261 /* Continue parsing even if we have already found a match,
262 * for input validation purposes. */
263 if( match_found == 1 )
264 continue;
265
266 /*
267 * NamedGroup matching
268 *
269 * For now, we only support ECDHE groups, but e.g.
270 * PQC KEMs will need to be added at a later stage.
271 */
272
273 /* Type 1: ECDHE shares
274 *
275 * - Check if we recognize the group
276 * - Check if it's supported
277 */
278
279 const mbedtls_ecp_curve_info *curve_info;
280 curve_info = mbedtls_ecp_curve_info_from_tls_id( their_group );
281 if( curve_info == NULL )
282 return( MBEDTLS_ECP_DP_NONE );
283 their_curve = curve_info->grp_id;
284 if( mbedtls_ssl_check_curve( ssl, their_curve ) != 0 )
285 continue;
286
287 /* Type 2..X: Other kinds of shares */
288 /* TO BE ADDED */
289
290 /* Skip if we no match succeeded. */
291 if( their_curve == MBEDTLS_ECP_DP_NONE )
292 {
293 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Unrecognized NamedGroup %u",
294 (unsigned) their_group ) );
295 continue;
296 }
297
298 match_found = 1;
299
300 /* KeyShare parsing
301 *
302 * Once we add more key share types, this needs to be a switch
303 * over the (type of) the named curve */
304
305 /* Type 1: ECDHE shares
306 *
307 * - Setup ECDHE context
308 * - Import client's public key
309 * - Apply further curve checks
310 */
311
312 their_curve_info = mbedtls_ecp_curve_info_from_grp_id( their_curve );
313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", their_curve_info->name ) );
314
315 ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx, their_curve );
316 if( ret != 0 )
317 {
318 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_setup()", ret );
319 return( ret );
320 }
321
322 ret = mbedtls_ecdh_import_public_raw( &ssl->handshake->ecdh_ctx,
323 p, end_of_share );
324 if( ret != 0 )
325 {
326 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_import_public_raw()", ret );
327 return( ret );
328 }
329
330 ssl->handshake->offered_group_id = their_group;
331 }
332
333 if( match_found == 0 )
334 {
335 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching key share" ) );
336 return( MBEDTLS_ERR_SSL_HRR_REQUIRED );
337 }
338 return( 0 );
339}
340#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
341
342#if defined(MBEDTLS_SSL_COOKIE_C)
343static int ssl_tls13_parse_cookie_ext( mbedtls_ssl_context *ssl,
344 const unsigned char *buf,
345 const unsigned char *end )
346{
347 int ret = 0;
348 size_t cookie_len;
349 unsigned char const *p = buf;
350 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
351
352 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse cookie extension" ) );
353
354 if( ssl->conf->f_cookie_check != NULL )
355 {
356 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
357 cookie_len = MBEDTLS_GET_UINT16_BE( p, 0 );
358 p += 2;
359
360 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cookie_len );
361
362 MBEDTLS_SSL_DEBUG_BUF( 3, "Received cookie", p, cookie_len );
363
364 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
365 p, cookie_len, ssl->cli_id,
366 ssl->cli_id_len ) != 0 )
367 {
368 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
369 handshake->verify_cookie_len = 1;
370 ret = MBEDTLS_ERR_SSL_HRR_REQUIRED;
371 }
372 else
373 {
374 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
375 handshake->verify_cookie_len = 0;
376 }
377 }
378 else {
379 /* TBD: Check under what cases this is appropriate */
380 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
381 }
382
383 return( ret );
384}
385#endif /* MBEDTLS_SSL_COOKIE_C */
386
387/*
388 *
389 * STATE HANDLING: ClientHello
390 *
391 * There are three possible classes of outcomes when parsing the CH:
392 *
393 * 1) The CH was well-formed and matched the server's configuration.
394 *
395 * In this case, the server progresses to sending its ServerHello.
396 *
397 * 2) The CH was well-formed but didn't match the server's configuration.
398 *
399 * For example, the client might not have offered a key share which
400 * the server supports, or the server might require a cookie.
401 *
402 * In this case, the server sends a HelloRetryRequest.
403 *
404 * 3) The CH was ill-formed
405 *
406 * In this case, we abort the handshake.
407 *
408 */
409
410/*
411 * Overview
412 */
413
414/* Main entry point from the state machine; orchestrates the otherfunctions. */
415static int ssl_client_hello_process( mbedtls_ssl_context *ssl );
416
417static int ssl_client_hello_parse( mbedtls_ssl_context *ssl,
418 const unsigned char *buf,
419 const unsigned char *end );
420
421/* Update the handshake state machine */
422/* TODO: At the moment, this doesn't update the state machine - why? */
423static int ssl_client_hello_postprocess( mbedtls_ssl_context *ssl,
424 int hrr_required );
425
426/*
427 * Implementation
428 */
429
430#define SSL_CLIENT_HELLO_OK 0
431#define SSL_CLIENT_HELLO_HRR_REQUIRED 1
432
433static int ssl_client_hello_process( mbedtls_ssl_context *ssl )
434{
435
436 int ret = 0;
437 int hrr_required = SSL_CLIENT_HELLO_OK;
438 unsigned char* buf = NULL;
439 size_t buflen = 0;
440 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
441
442 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
443 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg(
444 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
445 &buf, &buflen ) );
446
447 mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl,
448 MBEDTLS_SSL_HS_CLIENT_HELLO,
449 buflen );
450
451 MBEDTLS_SSL_PROC_CHK_NEG( ssl_client_hello_parse( ssl, buf, buf + buflen ) );
452 hrr_required = ret;
453
454 MBEDTLS_SSL_DEBUG_MSG( 1, ( "postprocess" ) );
455 MBEDTLS_SSL_PROC_CHK( ssl_client_hello_postprocess( ssl, hrr_required ) );
456
457cleanup:
458
459 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
460 return( ret );
461}
462
463static void ssl_debug_print_client_hello_exts( mbedtls_ssl_context *ssl )
464{
465 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Extensions:" ) );
466 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- KEY_SHARE_EXTENSION ( %s )",
467 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_KEY_SHARE ) > 0 ) ?
468 "TRUE" : "FALSE" ) );
469 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- PSK_KEY_EXCHANGE_MODES_EXTENSION ( %s )",
470 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES ) > 0 ) ?
471 "TRUE" : "FALSE" ) );
472 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- PRE_SHARED_KEY_EXTENSION ( %s )",
473 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PRE_SHARED_KEY ) > 0 ) ?
474 "TRUE" : "FALSE" ) );
475 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SIGNATURE_ALGORITHM_EXTENSION ( %s )",
476 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SIG_ALG ) > 0 ) ?
477 "TRUE" : "FALSE" ) );
478 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SUPPORTED_GROUPS_EXTENSION ( %s )",
479 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SUPPORTED_GROUPS ) >0 ) ?
480 "TRUE" : "FALSE" ) );
481 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SUPPORTED_VERSION_EXTENSION ( %s )",
482 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS ) > 0 ) ?
483 "TRUE" : "FALSE" ) );
484#if defined ( MBEDTLS_SSL_SERVER_NAME_INDICATION )
485 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SERVERNAME_EXTENSION ( %s )",
486 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SERVERNAME ) > 0 ) ?
487 "TRUE" : "FALSE" ) );
488#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
489#if defined ( MBEDTLS_SSL_COOKIE_C )
490 MBEDTLS_SSL_DEBUG_MSG( 3, ( "- COOKIE_EXTENSION ( %s )",
491 ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_COOKIE ) >0 ) ?
492 "TRUE" : "FALSE" ) );
493#endif /* MBEDTLS_SSL_COOKIE_C */
494}
495
496static int ssl_client_hello_has_exts( mbedtls_ssl_context *ssl,
497 int ext_id_mask )
498{
499 int masked = ssl->handshake->extensions_present & ext_id_mask;
500 return( masked == ext_id_mask );
501}
502
503static int ssl_client_hello_has_cert_extensions( mbedtls_ssl_context *ssl )
504{
505 return( ssl_client_hello_has_exts( ssl,
506 MBEDTLS_SSL_EXT_SUPPORTED_GROUPS |
507 MBEDTLS_SSL_EXT_KEY_SHARE |
508 MBEDTLS_SSL_EXT_SIG_ALG ) );
509}
510
511static int ssl_check_certificate_key_exchange( mbedtls_ssl_context *ssl )
512{
513 if( !mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) )
514 return( 0 );
515
516 if( !ssl_client_hello_has_cert_extensions( ssl ) )
517 return( 0 );
518
519 ssl->handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
520 return( 1 );
521}
522
523static int ssl_client_hello_parse( mbedtls_ssl_context *ssl,
524 const unsigned char *buf,
525 const unsigned char *end )
526{
527 int ret;
528 size_t i, j;
529 size_t comp_len, sess_len;
530 size_t cipher_suites_len;
531 size_t ext_len;
532 const unsigned char *ciph_offset;
533 const unsigned char *p = buf;
534 const unsigned char *extensions_end;
535
536 const int* ciphersuites;
537 const mbedtls_ssl_ciphersuite_t* ciphersuite_info;
538
539 int hrr_required = 0;
540
541 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
542
543 /*
544 * ClientHello layer:
545 * 0 . 1 protocol version
546 * 2 . 33 random bytes ( starting with 4 bytes of Unix time )
547 * 34 . 35 session id length ( 1 byte )
548 * 35 . 34+x session id
549 * 35+x . 35+x DTLS only: cookie length ( 1 byte )
550 * 36+x . .. DTLS only: cookie
551 * .. . .. ciphersuite list length ( 2 bytes )
552 * .. . .. ciphersuite list
553 * .. . .. compression alg. list length ( 1 byte )
554 * .. . .. compression alg. list
555 * .. . .. extensions length ( 2 bytes, optional )
556 * .. . .. extensions ( optional )
557 */
558
559 /* TBD: Needs to be updated due to mandatory extensions
560 * Minimal length ( with everything empty and extensions ommitted ) is
561 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
562 * read at least up to session id length without worrying.
563 */
564 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 38 );
565
566 /* ...
567 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
568 * ...
569 * with ProtocolVersion defined as:
570 * uint16 ProtocolVersion;
571 */
572 if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 &&
573 p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) )
574 {
575 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
576 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
577 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
578 ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
579 return ret;
580 }
581 p += 2;
582
583 /*
584 * Save client random
585 */
586 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
587
588 memcpy( &ssl->handshake->randbytes[0], p, 32 );
589 p += 32; /* skip random bytes */
590
591 /*
592 * Parse session ID
593 */
594 sess_len = p[0];
595 p++; /* skip session id length */
596
597 if( sess_len > 32 )
598 {
599 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
600 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
601 }
602
603 ssl->session_negotiate->id_len = sess_len;
604
605 /* Note that this field is echoed even if
606 * the client's value corresponded to a cached pre-TLS 1.3 session
607 * which the server has chosen not to resume. A client which
608 * receives a legacy_session_id_echo field that does not match what
609 * it sent in the ClientHello MUST abort the handshake with an
610 * "illegal_parameter" alert.
611 */
612 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id length ( %" MBEDTLS_PRINTF_SIZET " )", sess_len ) );
613 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf, sess_len );
614
615 memcpy( &ssl->session_negotiate->id[0], p, sess_len ); /* write session id */
616 p += sess_len;
617
618 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
619 cipher_suites_len = MBEDTLS_GET_UINT16_BE( p, 0 );
620 p += 2;
621
622 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cipher_suites_len );
623
624 /* store pointer to ciphersuite list */
625 ciph_offset = p;
626
627 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
628 p, cipher_suites_len );
629
630 /* skip ciphersuites for now */
631 p += cipher_suites_len;
632
633 /*
634 * For TLS 1.3 we are not using compression.
635 */
XiaokangQiana9c58412022-02-17 09:41:26 +0000636 comp_len = p[0];
XiaokangQian7807f9f2022-02-15 10:04:37 +0000637 p++;
638 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, comp_len );
639
640 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
641 p, comp_len );
642
643 /* Determine whether we are indeed using null compression */
XiaokangQiana9c58412022-02-17 09:41:26 +0000644 if( ( comp_len != 1 ) && ( p[0] == 0 ) )
XiaokangQian7807f9f2022-02-15 10:04:37 +0000645 {
646 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
647 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
648 }
649
650 /* skip compression */
651 p++;
652
653 /*
654 * Check the extension length
655 */
656 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
657
658 ext_len = MBEDTLS_GET_UINT16_BE( p, 0 );
659 p += 2;
660 extensions_end = p + ext_len;
661 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, ext_len );
662
663 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p, ext_len );
664
665 while( p < extensions_end )
666 {
667 unsigned int extension_type;
668 size_t extension_data_len;
669 const unsigned char *extension_data_end;
670
671 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
672 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
673 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
674 p += 4;
675
676 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
677 extension_data_end = p + extension_data_len;
678
679 switch( extension_type )
680 {
681#if defined(MBEDTLS_SSL_COOKIE_C)
682 case MBEDTLS_TLS_EXT_COOKIE:
683 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found cookie extension" ) );
684
685 ret = ssl_tls13_parse_cookie_ext( ssl, p,
686 extension_data_end );
687
688 /* if cookie verification failed then we return a hello retry
689 * message, or return success and set cookie extension present
690 */
691 if( ret == MBEDTLS_ERR_SSL_HRR_REQUIRED )
692 {
693 hrr_required = 1;
694 }
695 else if( ret == 0 )
696 {
697 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_COOKIE;
698 }
699 break;
700#endif /* MBEDTLS_SSL_COOKIE_C */
701
702#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
703 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
704 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported group extension" ) );
705
706 /* Supported Groups Extension
707 *
708 * When sent by the client, the "supported_groups" extension
709 * indicates the named groups which the client supports,
710 * ordered from most preferred to least preferred.
711 */
712 ret = mbedtls_ssl_tls13_parse_supported_groups_ext( ssl, p,
713 extension_data_end );
714 if( ret != 0 )
715 {
716 MBEDTLS_SSL_DEBUG_RET( 1,
717 "mbedtls_ssl_parse_supported_groups_ext", ret );
718 return( ret );
719 }
720
721 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
722 break;
723#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
724
725#if ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) )
726 case MBEDTLS_TLS_EXT_KEY_SHARE:
727 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key share extension" ) );
728
729 /*
730 * Key Share Extension
731 *
732 * When sent by the client, the "key_share" extension
733 * contains the endpoint's cryptographic parameters for
734 * ECDHE/DHE key establishment methods.
735 */
736 ret = ssl_tls13_parse_key_shares_ext( ssl, p, extension_data_end );
737 if( ret == MBEDTLS_ERR_SSL_HRR_REQUIRED )
738 {
739 hrr_required = 1;
740 ret = 0;
741 }
742
743 if( ret != 0 )
744 return( ret );
745
746 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
747 break;
748#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
749
750 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
751 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported versions extension" ) );
752
753 ret = ssl_tls13_parse_supported_versions_ext(
754 ssl, p, extension_data_end );
755 if( ret != 0 )
756 {
757 MBEDTLS_SSL_DEBUG_RET( 1,
758 ( "ssl_tls13_parse_supported_versions_ext" ), ret );
759 return( ret );
760 }
761 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS;
762 break;
763
764#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
765 case MBEDTLS_TLS_EXT_SIG_ALG:
766 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
767
768 ret = mbedtls_ssl_tls13_parse_sig_alg_ext( ssl, p,
769 extension_data_end );
770 if( ret != 0 )
771 {
772 MBEDTLS_SSL_DEBUG_MSG( 1,
773 ( "ssl_parse_supported_signature_algorithms_server_ext ( %d )",
774 ret ) );
775 return( ret );
776 }
777 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG;
778 break;
779#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
780
781 default:
782 MBEDTLS_SSL_DEBUG_MSG( 3,
783 ( "unknown extension found: %ud ( ignoring )",
784 extension_type ) );
785 }
786
787 p += extension_data_len;
788 }
789
790 /* Update checksum with either
791 * - The entire content of the CH message, if no PSK extension is present
792 * - The content up to but excluding the PSK extension, if present.
793 */
794 ssl->handshake->update_checksum( ssl, buf, p - buf );
795 /*
796 * Search for a matching ciphersuite
797 */
798 ciphersuites = ssl->conf->ciphersuite_list;
799 ciphersuite_info = NULL;
800 for ( j = 0, p = ciph_offset; j < cipher_suites_len; j += 2, p += 2 )
801 {
802 for ( i = 0; ciphersuites[i] != 0; i++ )
803 {
804 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
805 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
806 continue;
807
808 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(
809 ciphersuites[i] );
810
811 if( ciphersuite_info == NULL )
812 {
813 MBEDTLS_SSL_DEBUG_MSG(
814 1,
815 ( "mbedtls_ssl_ciphersuite_from_id: should never happen" ) );
816 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
817 }
818
819 goto have_ciphersuite;
820
821 }
822 }
823
824 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
825
826have_ciphersuite:
827
828 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s",
829 ciphersuite_info->name ) );
830
831 ssl->session_negotiate->ciphersuite = ciphersuites[i];
832 ssl->handshake->ciphersuite_info = ciphersuite_info;
833
834 /* List all the extensions we have received */
835 ssl_debug_print_client_hello_exts( ssl );
836
837 /*
838 * Determine the key exchange algorithm to use.
839 * There are three types of key exchanges supported in TLS 1.3:
840 * - (EC)DH with ECDSA,
841 * - (EC)DH with PSK,
842 * - plain PSK.
843 *
844 * The PSK-based key exchanges may additionally be used with 0-RTT.
845 *
846 * Our built-in order of preference is
847 * 1 ) Plain PSK Mode
848 * 2 ) (EC)DHE-PSK Mode
849 * 3 ) Certificate Mode
850 */
851
852 if( !ssl_check_certificate_key_exchange( ssl ) )
853 {
854 MBEDTLS_SSL_DEBUG_MSG(
855 1,
856 ( "ClientHello message misses mandatory extensions." ) );
857 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION ,
858 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
859 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
860 }
861
862#if defined(MBEDTLS_SSL_COOKIE_C)
863 /* If we failed to see a cookie extension, and we required it through the
864 * configuration settings ( rr_config ), then we need to send a HRR msg.
865 * Conceptually, this is similiar to having received a cookie that failed
866 * the verification check.
867 */
868 if( ( ssl->conf->rr_config == MBEDTLS_SSL_FORCE_RR_CHECK_ON ) &&
869 !( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_COOKIE ) )
870 {
871 MBEDTLS_SSL_DEBUG_MSG(
872 2,
873 ( "Cookie extension missing. Need to send a HRR." ) );
874 hrr_required = 1;
875 }
876#endif /* MBEDTLS_SSL_COOKIE_C */
877
878 if( hrr_required == 1 )
879 return( SSL_CLIENT_HELLO_HRR_REQUIRED );
880
881 return( 0 );
882}
883
884static int ssl_client_hello_postprocess( mbedtls_ssl_context* ssl,
885 int hrr_required )
886{
887 int ret = 0;
888
889 if( ssl->handshake->hello_retry_request_count == 0 &&
890 ssl->conf->rr_config == MBEDTLS_SSL_FORCE_RR_CHECK_ON )
891 {
892 hrr_required = SSL_CLIENT_HELLO_HRR_REQUIRED;
893 }
894
895 if( hrr_required == SSL_CLIENT_HELLO_HRR_REQUIRED )
896 {
897 /*
898 * Create stateless transcript hash for HRR
899 */
900 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Reset transcript for HRR" ) );
901 ret = mbedtls_ssl_reset_transcript_for_hrr( ssl );
902 if( ret != 0 )
903 {
904 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_reset_transcript_for_hrr",
905 ret );
906 return( ret );
907 }
908 mbedtls_ssl_session_reset_msg_layer( ssl, 0 );
909
910 /* Transmit Hello Retry Request */
911 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST );
912 return( 0 );
913 }
914
915 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
916 if( ret != 0 )
917 {
918 MBEDTLS_SSL_DEBUG_RET( 1,
919 "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret );
920 return( ret );
921 }
922
923 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
924 return( 0 );
925
926}
927
928/*
929 * TLS and DTLS 1.3 State Maschine -- server side
930 */
Jerry Yu27561932021-08-27 17:07:38 +0800931int mbedtls_ssl_tls13_handshake_server_step( mbedtls_ssl_context *ssl )
Jerry Yub9930e72021-08-06 17:11:51 +0800932{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000933 int ret = 0;
934
935 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
936 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
937
Jerry Yue3b34122021-09-28 17:53:35 +0800938 MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 server state: %s(%d)",
939 mbedtls_ssl_states_str( ssl->state ),
940 ssl->state ) );
Jerry Yu6e81b272021-09-27 11:16:17 +0800941
XiaokangQian7807f9f2022-02-15 10:04:37 +0000942 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
943 return( ret );
944
945 switch( ssl->state )
946 {
947 /* start state */
948 case MBEDTLS_SSL_HELLO_REQUEST:
949 ssl->handshake->hello_retry_request_count = 0;
950 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
951
952 break;
953
954 /* ----- READ CLIENT HELLO ----*/
955
956 case MBEDTLS_SSL_CLIENT_HELLO:
957
958 ret = ssl_client_hello_process( ssl );
959 if( ret != 0 )
960 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_client_hello_process", ret );
961
962 break;
963
964 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
965 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
966
967 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for all traffic" ) );
968
969 mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
970 mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application );
971
972 mbedtls_ssl_tls13_handshake_wrapup( ssl );
973 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET );
974
975 break;
976
977 default:
978 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
979 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
980 }
981
982 return( ret );
Jerry Yub9930e72021-08-06 17:11:51 +0800983}
Jerry Yu3cc4c2a2021-08-06 16:29:08 +0800984
Jerry Yufb4b6472022-01-27 15:03:26 +0800985#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */