1 /*
2 * TLS 1.2 and 1.3 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS ( https://tls.mbed.org )
20 */
21
22 #include "common.h"
23
24 #if defined(MBEDTLS_SSL_CLI_C)
25 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
26
27 #include "mbedtls/platform.h"
28
29 #include <string.h>
30
31 #include "mbedtls/debug.h"
32 #include "mbedtls/error.h"
33 #if defined(MBEDTLS_HAVE_TIME)
34 #include "mbedtls/platform_time.h"
35 #endif
36
37 #include "ssl_client.h"
38 #include "ssl_misc.h"
39 #include "ssl_tls13_keys.h"
40 #include "ssl_debug_helpers.h"
41
42 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
43 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_hostname_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)44 static int ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
45 unsigned char *buf,
46 const unsigned char *end,
47 size_t *olen )
48 {
49 unsigned char *p = buf;
50 size_t hostname_len;
51
52 *olen = 0;
53
54 if( ssl->hostname == NULL )
55 return( 0 );
56
57 MBEDTLS_SSL_DEBUG_MSG( 3,
58 ( "client hello, adding server name extension: %s",
59 ssl->hostname ) );
60
61 hostname_len = strlen( ssl->hostname );
62
63 MBEDTLS_SSL_CHK_BUF_PTR( p, end, hostname_len + 9 );
64
65 /*
66 * Sect. 3, RFC 6066 (TLS Extensions Definitions)
67 *
68 * In order to provide any of the server names, clients MAY include an
69 * extension of type "server_name" in the (extended) client hello. The
70 * "extension_data" field of this extension SHALL contain
71 * "ServerNameList" where:
72 *
73 * struct {
74 * NameType name_type;
75 * select (name_type) {
76 * case host_name: HostName;
77 * } name;
78 * } ServerName;
79 *
80 * enum {
81 * host_name(0), (255)
82 * } NameType;
83 *
84 * opaque HostName<1..2^16-1>;
85 *
86 * struct {
87 * ServerName server_name_list<1..2^16-1>
88 * } ServerNameList;
89 *
90 */
91 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SERVERNAME, p, 0 );
92 p += 2;
93
94 MBEDTLS_PUT_UINT16_BE( hostname_len + 5, p, 0 );
95 p += 2;
96
97 MBEDTLS_PUT_UINT16_BE( hostname_len + 3, p, 0 );
98 p += 2;
99
100 *p++ = MBEDTLS_BYTE_0( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME );
101
102 MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
103 p += 2;
104
105 memcpy( p, ssl->hostname, hostname_len );
106
107 *olen = hostname_len + 9;
108
109 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
110 mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_SERVERNAME );
111 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
112 return( 0 );
113 }
114 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
115
116 #if defined(MBEDTLS_SSL_ALPN)
117 /*
118 * ssl_write_alpn_ext()
119 *
120 * Structure of the application_layer_protocol_negotiation extension in
121 * ClientHello:
122 *
123 * opaque ProtocolName<1..2^8-1>;
124 *
125 * struct {
126 * ProtocolName protocol_name_list<2..2^16-1>
127 * } ProtocolNameList;
128 *
129 */
130 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_alpn_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * out_len)131 static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
132 unsigned char *buf,
133 const unsigned char *end,
134 size_t *out_len )
135 {
136 unsigned char *p = buf;
137
138 *out_len = 0;
139
140 if( ssl->conf->alpn_list == NULL )
141 return( 0 );
142
143 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
144
145
146 /* Check we have enough space for the extension type (2 bytes), the
147 * extension length (2 bytes) and the protocol_name_list length (2 bytes).
148 */
149 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
150 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
151 /* Skip writing extension and list length for now */
152 p += 6;
153
154 /*
155 * opaque ProtocolName<1..2^8-1>;
156 *
157 * struct {
158 * ProtocolName protocol_name_list<2..2^16-1>
159 * } ProtocolNameList;
160 */
161 for( const char **cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
162 {
163 /*
164 * mbedtls_ssl_conf_set_alpn_protocols() checked that the length of
165 * protocol names is less than 255.
166 */
167 size_t protocol_name_len = strlen( *cur );
168
169 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 + protocol_name_len );
170 *p++ = (unsigned char)protocol_name_len;
171 memcpy( p, *cur, protocol_name_len );
172 p += protocol_name_len;
173 }
174
175 *out_len = p - buf;
176
177 /* List length = *out_len - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
178 MBEDTLS_PUT_UINT16_BE( *out_len - 6, buf, 4 );
179
180 /* Extension length = *out_len - 2 (ext_type) - 2 (ext_len) */
181 MBEDTLS_PUT_UINT16_BE( *out_len - 4, buf, 2 );
182
183 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
184 mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_ALPN );
185 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
186 return( 0 );
187 }
188 #endif /* MBEDTLS_SSL_ALPN */
189
190 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
191 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
192 /*
193 * Function for writing a supported groups (TLS 1.3) or supported elliptic
194 * curves (TLS 1.2) extension.
195 *
196 * The "extension_data" field of a supported groups extension contains a
197 * "NamedGroupList" value (TLS 1.3 RFC8446):
198 * enum {
199 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
200 * x25519(0x001D), x448(0x001E),
201 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
202 * ffdhe6144(0x0103), ffdhe8192(0x0104),
203 * ffdhe_private_use(0x01FC..0x01FF),
204 * ecdhe_private_use(0xFE00..0xFEFF),
205 * (0xFFFF)
206 * } NamedGroup;
207 * struct {
208 * NamedGroup named_group_list<2..2^16-1>;
209 * } NamedGroupList;
210 *
211 * The "extension_data" field of a supported elliptic curves extension contains
212 * a "NamedCurveList" value (TLS 1.2 RFC 8422):
213 * enum {
214 * deprecated(1..22),
215 * secp256r1 (23), secp384r1 (24), secp521r1 (25),
216 * x25519(29), x448(30),
217 * reserved (0xFE00..0xFEFF),
218 * deprecated(0xFF01..0xFF02),
219 * (0xFFFF)
220 * } NamedCurve;
221 * struct {
222 * NamedCurve named_curve_list<2..2^16-1>
223 * } NamedCurveList;
224 *
225 * The TLS 1.3 supported groups extension was defined to be a compatible
226 * generalization of the TLS 1.2 supported elliptic curves extension. They both
227 * share the same extension identifier.
228 *
229 * DHE groups are not supported yet.
230 */
231 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_supported_groups_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * out_len)232 static int ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
233 unsigned char *buf,
234 const unsigned char *end,
235 size_t *out_len )
236 {
237 unsigned char *p = buf ;
238 unsigned char *named_group_list; /* Start of named_group_list */
239 size_t named_group_list_len; /* Length of named_group_list */
240 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
241
242 *out_len = 0;
243
244 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) );
245
246 /* Check if we have space for header and length fields:
247 * - extension_type (2 bytes)
248 * - extension_data_length (2 bytes)
249 * - named_group_list_length (2 bytes)
250 */
251 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
252 p += 6;
253
254 named_group_list = p;
255
256 if( group_list == NULL )
257 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
258
259 for( ; *group_list != 0; group_list++ )
260 {
261 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got supported group(%04x)", *group_list ) );
262
263 #if defined(MBEDTLS_ECP_C)
264 if( ( mbedtls_ssl_conf_is_tls13_enabled( ssl->conf ) &&
265 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) ||
266 ( mbedtls_ssl_conf_is_tls12_enabled( ssl->conf ) &&
267 mbedtls_ssl_tls12_named_group_is_ecdhe( *group_list ) ) )
268 {
269 const mbedtls_ecp_curve_info *curve_info;
270 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
271 if( curve_info == NULL )
272 continue;
273 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
274 MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
275 p += 2;
276 MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
277 curve_info->name, *group_list ) );
278 }
279 #endif /* MBEDTLS_ECP_C */
280 /* Add DHE groups here */
281
282 }
283
284 /* Length of named_group_list */
285 named_group_list_len = p - named_group_list;
286 if( named_group_list_len == 0 )
287 {
288 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) );
289 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
290 }
291
292 /* Write extension_type */
293 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 );
294 /* Write extension_data_length */
295 MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 );
296 /* Write length of named_group_list */
297 MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 );
298
299 MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension",
300 buf + 4, named_group_list_len + 2 );
301
302 *out_len = p - buf;
303
304 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
305 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
306 ssl, MBEDTLS_TLS_EXT_SUPPORTED_GROUPS );
307 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
308
309 return( 0 );
310 }
311
312 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
313 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
314
315 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_client_hello_cipher_suites(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,int * tls12_uses_ec,size_t * out_len)316 static int ssl_write_client_hello_cipher_suites(
317 mbedtls_ssl_context *ssl,
318 unsigned char *buf,
319 unsigned char *end,
320 int *tls12_uses_ec,
321 size_t *out_len )
322 {
323 unsigned char *p = buf;
324 const int *ciphersuite_list;
325 unsigned char *cipher_suites; /* Start of the cipher_suites list */
326 size_t cipher_suites_len;
327
328 *tls12_uses_ec = 0;
329 *out_len = 0;
330
331 /*
332 * Ciphersuite list
333 *
334 * This is a list of the symmetric cipher options supported by
335 * the client, specifically the record protection algorithm
336 * ( including secret key length ) and a hash to be used with
337 * HKDF, in descending order of client preference.
338 */
339 ciphersuite_list = ssl->conf->ciphersuite_list;
340
341 /* Check there is space for the cipher suite list length (2 bytes). */
342 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
343 p += 2;
344
345 /* Write cipher_suites
346 * CipherSuite cipher_suites<2..2^16-2>;
347 */
348 cipher_suites = p;
349 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
350 {
351 int cipher_suite = ciphersuite_list[i];
352 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
353
354 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
355
356 if( mbedtls_ssl_validate_ciphersuite( ssl, ciphersuite_info,
357 ssl->handshake->min_tls_version,
358 ssl->tls_version ) != 0 )
359 continue;
360
361 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
362 ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
363 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) )
364 *tls12_uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
365 #endif
366
367 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
368 (unsigned int) cipher_suite,
369 ciphersuite_info->name ) );
370
371 /* Check there is space for the cipher suite identifier (2 bytes). */
372 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
373 MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
374 p += 2;
375 }
376
377 /*
378 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
379 */
380 int renegotiating = 0;
381 #if defined(MBEDTLS_SSL_RENEGOTIATION)
382 renegotiating = ( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE );
383 #endif
384 if( !renegotiating )
385 {
386 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
387 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
388 MBEDTLS_PUT_UINT16_BE( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO, p, 0 );
389 p += 2;
390 }
391
392 /* Write the cipher_suites length in number of bytes */
393 cipher_suites_len = p - cipher_suites;
394 MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
395 MBEDTLS_SSL_DEBUG_MSG( 3,
396 ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
397 cipher_suites_len/2 ) );
398
399 /* Output the total length of cipher_suites field. */
400 *out_len = p - buf;
401
402 return( 0 );
403 }
404
405 /*
406 * Structure of the TLS 1.3 ClientHello message:
407 *
408 * struct {
409 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
410 * Random random;
411 * opaque legacy_session_id<0..32>;
412 * CipherSuite cipher_suites<2..2^16-2>;
413 * opaque legacy_compression_methods<1..2^8-1>;
414 * Extension extensions<8..2^16-1>;
415 * } ClientHello;
416 *
417 * Structure of the (D)TLS 1.2 ClientHello message:
418 *
419 * struct {
420 * ProtocolVersion client_version;
421 * Random random;
422 * SessionID session_id;
423 * opaque cookie<0..2^8-1>; // DTLS 1.2 ONLY
424 * CipherSuite cipher_suites<2..2^16-2>;
425 * CompressionMethod compression_methods<1..2^8-1>;
426 * select (extensions_present) {
427 * case false:
428 * struct {};
429 * case true:
430 * Extension extensions<0..2^16-1>;
431 * };
432 * } ClientHello;
433 */
434 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_client_hello_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len,size_t * binders_len)435 static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
436 unsigned char *buf,
437 unsigned char *end,
438 size_t *out_len,
439 size_t *binders_len )
440 {
441 int ret;
442 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
443 unsigned char *p = buf;
444 unsigned char *p_extensions_len; /* Pointer to extensions length */
445 size_t output_len; /* Length of buffer used by function */
446 size_t extensions_len; /* Length of the list of extensions*/
447 int tls12_uses_ec = 0;
448
449 *out_len = 0;
450 *binders_len = 0;
451
452 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
453 unsigned char propose_tls12 =
454 ( handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 )
455 &&
456 ( MBEDTLS_SSL_VERSION_TLS1_2 <= ssl->tls_version );
457 #endif
458 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
459 unsigned char propose_tls13 =
460 ( handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3 )
461 &&
462 ( MBEDTLS_SSL_VERSION_TLS1_3 <= ssl->tls_version );
463 #endif
464
465 /*
466 * Write client_version (TLS 1.2) or legacy_version (TLS 1.3)
467 *
468 * In all cases this is the TLS 1.2 version.
469 */
470 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
471 mbedtls_ssl_write_version( p, ssl->conf->transport,
472 MBEDTLS_SSL_VERSION_TLS1_2 );
473 p += 2;
474
475 /* ...
476 * Random random;
477 * ...
478 *
479 * The random bytes have been prepared by ssl_prepare_client_hello() into
480 * the handshake->randbytes buffer and are copied here into the output
481 * buffer.
482 */
483 MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
484 memcpy( p, handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
485 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
486 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
487 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
488
489 /* TLS 1.2:
490 * ...
491 * SessionID session_id;
492 * ...
493 * with
494 * opaque SessionID<0..32>;
495 *
496 * TLS 1.3:
497 * ...
498 * opaque legacy_session_id<0..32>;
499 * ...
500 *
501 * The (legacy) session identifier bytes have been prepared by
502 * ssl_prepare_client_hello() into the ssl->session_negotiate->id buffer
503 * and are copied here into the output buffer.
504 */
505 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
506 *p++ = (unsigned char)ssl->session_negotiate->id_len;
507 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
508 p += ssl->session_negotiate->id_len;
509
510 MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
511 ssl->session_negotiate->id_len );
512
513 /* DTLS 1.2 ONLY
514 * ...
515 * opaque cookie<0..2^8-1>;
516 * ...
517 */
518 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
519 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
520 {
521 unsigned char cookie_len = 0;
522
523 if( handshake->cookie != NULL )
524 {
525 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
526 handshake->cookie,
527 handshake->verify_cookie_len );
528 cookie_len = handshake->verify_cookie_len;
529 }
530
531 MBEDTLS_SSL_CHK_BUF_PTR( p, end, cookie_len + 1 );
532 *p++ = cookie_len;
533 if( cookie_len > 0 )
534 {
535 memcpy( p, handshake->cookie, cookie_len );
536 p += cookie_len;
537 }
538 }
539 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
540
541 /* Write cipher_suites */
542 ret = ssl_write_client_hello_cipher_suites( ssl, p, end,
543 &tls12_uses_ec,
544 &output_len );
545 if( ret != 0 )
546 return( ret );
547 p += output_len;
548
549 /* Write legacy_compression_methods (TLS 1.3) or
550 * compression_methods (TLS 1.2)
551 *
552 * For every TLS 1.3 ClientHello, this vector MUST contain exactly
553 * one byte set to zero, which corresponds to the 'null' compression
554 * method in prior versions of TLS.
555 *
556 * For TLS 1.2 ClientHello, for security reasons we do not support
557 * compression anymore, thus also just the 'null' compression method.
558 */
559 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
560 *p++ = 1;
561 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
562
563 /* Write extensions */
564
565 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
566 /* Keeping track of the included extensions */
567 handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
568 #endif
569
570 /* First write extensions, then the total length */
571 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
572 p_extensions_len = p;
573 p += 2;
574
575 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
576 /* Write server name extension */
577 ret = ssl_write_hostname_ext( ssl, p, end, &output_len );
578 if( ret != 0 )
579 return( ret );
580 p += output_len;
581 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
582
583 #if defined(MBEDTLS_SSL_ALPN)
584 ret = ssl_write_alpn_ext( ssl, p, end, &output_len );
585 if( ret != 0 )
586 return( ret );
587 p += output_len;
588 #endif /* MBEDTLS_SSL_ALPN */
589
590 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
591 if( propose_tls13 )
592 {
593 ret = mbedtls_ssl_tls13_write_client_hello_exts( ssl, p, end,
594 &output_len );
595 if( ret != 0 )
596 return( ret );
597 p += output_len;
598 }
599 #endif
600
601 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
602 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
603 if(
604 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
605 ( propose_tls13 &&
606 mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) ) ||
607 #endif
608 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
609 ( propose_tls12 && tls12_uses_ec ) ||
610 #endif
611 0 )
612 {
613 ret = ssl_write_supported_groups_ext( ssl, p, end, &output_len );
614 if( ret != 0 )
615 return( ret );
616 p += output_len;
617 }
618 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
619
620 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
621 if(
622 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
623 ( propose_tls13 && mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) ) ||
624 #endif
625 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
626 propose_tls12 ||
627 #endif
628 0 )
629 {
630 ret = mbedtls_ssl_write_sig_alg_ext( ssl, p, end, &output_len );
631 if( ret != 0 )
632 return( ret );
633 p += output_len;
634 }
635 #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
636
637 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
638 if( propose_tls12 )
639 {
640 ret = mbedtls_ssl_tls12_write_client_hello_exts( ssl, p, end,
641 tls12_uses_ec,
642 &output_len );
643 if( ret != 0 )
644 return( ret );
645 p += output_len;
646 }
647 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
648
649 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
650 /* The "pre_shared_key" extension (RFC 8446 Section 4.2.11)
651 * MUST be the last extension in the ClientHello.
652 */
653 if( propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
654 {
655 ret = mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
656 ssl, p, end, &output_len, binders_len );
657 if( ret != 0 )
658 return( ret );
659 p += output_len;
660 }
661 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
662
663 /* Write the length of the list of extensions. */
664 extensions_len = p - p_extensions_len - 2;
665
666 if( extensions_len == 0 )
667 p = p_extensions_len;
668 else
669 {
670 MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
671 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" \
672 MBEDTLS_PRINTF_SIZET, extensions_len ) );
673 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions",
674 p_extensions_len, extensions_len );
675 }
676
677 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
678 MBEDTLS_SSL_PRINT_EXTS(
679 3, MBEDTLS_SSL_HS_CLIENT_HELLO, handshake->sent_extensions );
680 #endif
681
682 *out_len = p - buf;
683 return( 0 );
684 }
685
686 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_generate_random(mbedtls_ssl_context * ssl)687 static int ssl_generate_random( mbedtls_ssl_context *ssl )
688 {
689 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
690 unsigned char *randbytes = ssl->handshake->randbytes;
691 size_t gmt_unix_time_len = 0;
692
693 /*
694 * Generate the random bytes
695 *
696 * TLS 1.2 case:
697 * struct {
698 * uint32 gmt_unix_time;
699 * opaque random_bytes[28];
700 * } Random;
701 *
702 * TLS 1.3 case:
703 * opaque Random[32];
704 */
705 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
706 {
707 #if defined(MBEDTLS_HAVE_TIME)
708 mbedtls_time_t gmt_unix_time = mbedtls_time( NULL );
709 MBEDTLS_PUT_UINT32_BE( gmt_unix_time, randbytes, 0 );
710 gmt_unix_time_len = 4;
711
712 MBEDTLS_SSL_DEBUG_MSG( 3,
713 ( "client hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
714 (long long) gmt_unix_time ) );
715 #endif /* MBEDTLS_HAVE_TIME */
716 }
717
718 ret = ssl->conf->f_rng( ssl->conf->p_rng,
719 randbytes + gmt_unix_time_len,
720 MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len );
721 return( ret );
722 }
723
724 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_prepare_client_hello(mbedtls_ssl_context * ssl)725 static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
726 {
727 int ret;
728 size_t session_id_len;
729 mbedtls_ssl_session *session_negotiate = ssl->session_negotiate;
730
731 if( session_negotiate == NULL )
732 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
733
734 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
735 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
736 defined(MBEDTLS_HAVE_TIME)
737
738 /* Check if a tls13 ticket has been configured. */
739 if( ssl->handshake->resume != 0 &&
740 session_negotiate->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
741 session_negotiate->ticket != NULL )
742 {
743 mbedtls_time_t now = mbedtls_time( NULL );
744 uint64_t age = (uint64_t)( now - session_negotiate->ticket_received );
745 if( session_negotiate->ticket_received > now ||
746 age > session_negotiate->ticket_lifetime )
747 {
748 /* Without valid ticket, disable session resumption.*/
749 MBEDTLS_SSL_DEBUG_MSG(
750 3, ( "Ticket expired, disable session resumption" ) );
751 ssl->handshake->resume = 0;
752 }
753 }
754 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
755 MBEDTLS_SSL_SESSION_TICKETS &&
756 MBEDTLS_HAVE_TIME */
757
758 if( ssl->conf->f_rng == NULL )
759 {
760 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
761 return( MBEDTLS_ERR_SSL_NO_RNG );
762 }
763
764 /* Bet on the highest configured version if we are not in a TLS 1.2
765 * renegotiation or session resumption.
766 */
767 #if defined(MBEDTLS_SSL_RENEGOTIATION)
768 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
769 ssl->handshake->min_tls_version = ssl->tls_version;
770 else
771 #endif
772 {
773 if( ssl->handshake->resume )
774 {
775 ssl->tls_version = session_negotiate->tls_version;
776 ssl->handshake->min_tls_version = ssl->tls_version;
777 }
778 else
779 {
780 ssl->tls_version = ssl->conf->max_tls_version;
781 ssl->handshake->min_tls_version = ssl->conf->min_tls_version;
782 }
783 }
784
785 /*
786 * Generate the random bytes, except when responding to a verify request
787 * where we MUST reuse the previously generated random bytes
788 * (RFC 6347 4.2.1).
789 */
790 #if defined(MBEDTLS_SSL_PROTO_DTLS)
791 if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
792 ( ssl->handshake->cookie == NULL ) )
793 #endif
794 {
795 ret = ssl_generate_random( ssl );
796 if( ret != 0 )
797 {
798 MBEDTLS_SSL_DEBUG_RET( 1, "Random bytes generation failed", ret );
799 return( ret );
800 }
801 }
802
803 /*
804 * Prepare session identifier. At that point, the length of the session
805 * identifier in the SSL context `ssl->session_negotiate->id_len` is equal
806 * to zero, except in the case of a TLS 1.2 session renegotiation or
807 * session resumption.
808 */
809 session_id_len = session_negotiate->id_len;
810
811 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
812 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
813 {
814 if( session_id_len < 16 || session_id_len > 32 ||
815 #if defined(MBEDTLS_SSL_RENEGOTIATION)
816 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
817 #endif
818 ssl->handshake->resume == 0 )
819 {
820 session_id_len = 0;
821 }
822
823 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
824 /*
825 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
826 * generate and include a Session ID in the TLS ClientHello."
827 */
828 int renegotiating = 0;
829 #if defined(MBEDTLS_SSL_RENEGOTIATION)
830 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
831 renegotiating = 1;
832 #endif
833 if( !renegotiating )
834 {
835 if( ( session_negotiate->ticket != NULL ) &&
836 ( session_negotiate->ticket_len != 0 ) )
837 {
838 session_id_len = 32;
839 }
840 }
841 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
842 }
843 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
844
845 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
846 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
847 {
848 /*
849 * Create a legacy session identifier for the purpose of middlebox
850 * compatibility only if one has not been created already, which is
851 * the case if we are here for the TLS 1.3 second ClientHello.
852 *
853 * Versions of TLS before TLS 1.3 supported a "session resumption"
854 * feature which has been merged with pre-shared keys in TLS 1.3
855 * version. A client which has a cached session ID set by a pre-TLS 1.3
856 * server SHOULD set this field to that value. In compatibility mode,
857 * this field MUST be non-empty, so a client not offering a pre-TLS 1.3
858 * session MUST generate a new 32-byte value. This value need not be
859 * random but SHOULD be unpredictable to avoid implementations fixating
860 * on a specific value (also known as ossification). Otherwise, it MUST
861 * be set as a zero-length vector ( i.e., a zero-valued single byte
862 * length field ).
863 */
864 session_id_len = 32;
865 }
866 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
867
868 if( session_id_len != session_negotiate->id_len )
869 {
870 session_negotiate->id_len = session_id_len;
871 if( session_id_len > 0 )
872 {
873 ret = ssl->conf->f_rng( ssl->conf->p_rng,
874 session_negotiate->id,
875 session_id_len );
876 if( ret != 0 )
877 {
878 MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
879 return( ret );
880 }
881 }
882 }
883
884 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
885 defined(MBEDTLS_SSL_SESSION_TICKETS) && \
886 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
887 if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
888 ssl->handshake->resume )
889 {
890 int hostname_mismatch = ssl->hostname != NULL ||
891 session_negotiate->hostname != NULL;
892 if( ssl->hostname != NULL && session_negotiate->hostname != NULL )
893 {
894 hostname_mismatch = strcmp(
895 ssl->hostname, session_negotiate->hostname ) != 0;
896 }
897
898 if( hostname_mismatch )
899 {
900 MBEDTLS_SSL_DEBUG_MSG(
901 1, ( "Hostname mismatch the session ticket, "
902 "disable session resumption." ) );
903 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
904 }
905 }
906 else
907 {
908 return mbedtls_ssl_session_set_hostname( session_negotiate,
909 ssl->hostname );
910 }
911 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
912 MBEDTLS_SSL_SESSION_TICKETS &&
913 MBEDTLS_SSL_SERVER_NAME_INDICATION */
914
915 return( 0 );
916 }
917 /*
918 * Write ClientHello handshake message.
919 * Handler for MBEDTLS_SSL_CLIENT_HELLO
920 */
mbedtls_ssl_write_client_hello(mbedtls_ssl_context * ssl)921 int mbedtls_ssl_write_client_hello( mbedtls_ssl_context *ssl )
922 {
923 int ret = 0;
924 unsigned char *buf;
925 size_t buf_len, msg_len, binders_len;
926
927 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
928
929 MBEDTLS_SSL_PROC_CHK( ssl_prepare_client_hello( ssl ) );
930
931 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg(
932 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
933 &buf, &buf_len ) );
934
935 MBEDTLS_SSL_PROC_CHK( ssl_write_client_hello_body( ssl, buf,
936 buf + buf_len,
937 &msg_len,
938 &binders_len ) );
939
940 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
941 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
942 {
943 ssl->out_msglen = msg_len + 4;
944 mbedtls_ssl_send_flight_completed( ssl );
945
946 /*
947 * The two functions below may try to send data on the network and
948 * can return with the MBEDTLS_ERR_SSL_WANT_READ error code when they
949 * fail to do so and the transmission has to be retried later. In that
950 * case as in fatal error cases, we return immediately. But we must have
951 * set the handshake state to the next state at that point to ensure
952 * that we will not write and send again a ClientHello when we
953 * eventually succeed in sending the pending data.
954 */
955 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
956
957 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
958 {
959 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
960 return( ret );
961 }
962
963 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
964 {
965 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
966 return( ret );
967 }
968 }
969 else
970 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
971 {
972
973 mbedtls_ssl_add_hs_hdr_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
974 msg_len );
975 ssl->handshake->update_checksum( ssl, buf, msg_len - binders_len );
976 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
977 if( binders_len > 0 )
978 {
979 MBEDTLS_SSL_PROC_CHK(
980 mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
981 ssl, buf + msg_len - binders_len, buf + msg_len ) );
982 ssl->handshake->update_checksum( ssl, buf + msg_len - binders_len,
983 binders_len );
984 }
985 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
986
987 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg( ssl,
988 buf_len,
989 msg_len ) );
990 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
991 }
992
993
994 cleanup:
995
996 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
997 return ret;
998 }
999
1000 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 || MBEDTLS_SSL_PROTO_TLS1_2 */
1001 #endif /* MBEDTLS_SSL_CLI_C */
1002
