1 /*
2 * TLS 1.3 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS ( https://tls.mbed.org )
20 */
21
22 #include "common.h"
23
24 #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
25
26 #include <string.h>
27
28 #include "mbedtls/debug.h"
29 #include "mbedtls/error.h"
30 #include "mbedtls/platform.h"
31
32 #include "ssl_misc.h"
33 #include "ssl_client.h"
34 #include "ssl_tls13_keys.h"
35 #include "ssl_debug_helpers.h"
36
37 /* Write extensions */
38
39 /*
40 * ssl_tls13_write_supported_versions_ext():
41 *
42 * struct {
43 * ProtocolVersion versions<2..254>;
44 * } SupportedVersions;
45 */
46 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_supported_versions_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)47 static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl,
48 unsigned char *buf,
49 unsigned char *end,
50 size_t *out_len )
51 {
52 unsigned char *p = buf;
53 unsigned char versions_len = ( ssl->handshake->min_tls_version <=
54 MBEDTLS_SSL_VERSION_TLS1_2 ) ? 4 : 2;
55
56 *out_len = 0;
57
58 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) );
59
60 /* Check if we have space to write the extension:
61 * - extension_type (2 bytes)
62 * - extension_data_length (2 bytes)
63 * - versions_length (1 byte )
64 * - versions (2 or 4 bytes)
65 */
66 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 5 + versions_len );
67
68 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
69 MBEDTLS_PUT_UINT16_BE( versions_len + 1, p, 2 );
70 p += 4;
71
72 /* Length of versions */
73 *p++ = versions_len;
74
75 /* Write values of supported versions.
76 * They are defined by the configuration.
77 * Currently, we advertise only TLS 1.3 or both TLS 1.3 and TLS 1.2.
78 */
79 mbedtls_ssl_write_version( p, MBEDTLS_SSL_TRANSPORT_STREAM,
80 MBEDTLS_SSL_VERSION_TLS1_3 );
81 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [3:4]" ) );
82
83
84 if( ssl->handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 )
85 {
86 mbedtls_ssl_write_version( p + 2, MBEDTLS_SSL_TRANSPORT_STREAM,
87 MBEDTLS_SSL_VERSION_TLS1_2 );
88 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [3:3]" ) );
89 }
90
91 *out_len = 5 + versions_len;
92
93 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
94 ssl, MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS );
95
96 return( 0 );
97 }
98
99 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)100 static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
101 const unsigned char *buf,
102 const unsigned char *end )
103 {
104 ((void) ssl);
105
106 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 );
107 if( mbedtls_ssl_read_version( buf, ssl->conf->transport ) !=
108 MBEDTLS_SSL_VERSION_TLS1_3 )
109 {
110 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) );
111
112 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
113 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
114 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
115 }
116
117 if( &buf[2] != end )
118 {
119 MBEDTLS_SSL_DEBUG_MSG( 1, ( "supported_versions ext data length incorrect" ) );
120 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
121 MBEDTLS_ERR_SSL_DECODE_ERROR );
122 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
123 }
124
125 return( 0 );
126 }
127
128 #if defined(MBEDTLS_SSL_ALPN)
129 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_alpn_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)130 static int ssl_tls13_parse_alpn_ext( mbedtls_ssl_context *ssl,
131 const unsigned char *buf, size_t len )
132 {
133 const unsigned char *p = buf;
134 const unsigned char *end = buf + len;
135 size_t protocol_name_list_len, protocol_name_len;
136 const unsigned char *protocol_name_list_end;
137
138 /* If we didn't send it, the server shouldn't send it */
139 if( ssl->conf->alpn_list == NULL )
140 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
141
142 /*
143 * opaque ProtocolName<1..2^8-1>;
144 *
145 * struct {
146 * ProtocolName protocol_name_list<2..2^16-1>
147 * } ProtocolNameList;
148 *
149 * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
150 */
151
152 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
153 protocol_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
154 p += 2;
155
156 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, protocol_name_list_len );
157 protocol_name_list_end = p + protocol_name_list_len;
158
159 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, protocol_name_list_end, 1 );
160 protocol_name_len = *p++;
161
162 /* Check that the server chosen protocol was in our list and save it */
163 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, protocol_name_list_end, protocol_name_len );
164 for( const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++ )
165 {
166 if( protocol_name_len == strlen( *alpn ) &&
167 memcmp( p, *alpn, protocol_name_len ) == 0 )
168 {
169 ssl->alpn_chosen = *alpn;
170 return( 0 );
171 }
172 }
173
174 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
175 }
176 #endif /* MBEDTLS_SSL_ALPN */
177
178 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_reset_key_share(mbedtls_ssl_context * ssl)179 static int ssl_tls13_reset_key_share( mbedtls_ssl_context *ssl )
180 {
181 uint16_t group_id = ssl->handshake->offered_group_id;
182
183 if( group_id == 0 )
184 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
185
186 #if defined(MBEDTLS_ECDH_C)
187 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
188 {
189 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
190 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
191
192 /* Destroy generated private key. */
193 status = psa_destroy_key( ssl->handshake->ecdh_psa_privkey );
194 if( status != PSA_SUCCESS )
195 {
196 ret = psa_ssl_status_to_mbedtls( status );
197 MBEDTLS_SSL_DEBUG_RET( 1, "psa_destroy_key", ret );
198 return( ret );
199 }
200
201 ssl->handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
202 return( 0 );
203 }
204 else
205 #endif /* MBEDTLS_ECDH_C */
206 if( 0 /* other KEMs? */ )
207 {
208 /* Do something */
209 }
210
211 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
212 }
213
214 /*
215 * Functions for writing key_share extension.
216 */
217 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
218 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_get_default_group_id(mbedtls_ssl_context * ssl,uint16_t * group_id)219 static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl,
220 uint16_t *group_id )
221 {
222 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
223
224
225 #if defined(MBEDTLS_ECDH_C)
226 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
227 /* Pick first available ECDHE group compatible with TLS 1.3 */
228 if( group_list == NULL )
229 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
230
231 for ( ; *group_list != 0; group_list++ )
232 {
233 const mbedtls_ecp_curve_info *curve_info;
234 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
235 if( curve_info != NULL &&
236 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
237 {
238 *group_id = *group_list;
239 return( 0 );
240 }
241 }
242 #else
243 ((void) ssl);
244 ((void) group_id);
245 #endif /* MBEDTLS_ECDH_C */
246
247 /*
248 * Add DHE named groups here.
249 * Pick first available DHE group compatible with TLS 1.3
250 */
251
252 return( ret );
253 }
254
255 /*
256 * ssl_tls13_write_key_share_ext
257 *
258 * Structure of key_share extension in ClientHello:
259 *
260 * struct {
261 * NamedGroup group;
262 * opaque key_exchange<1..2^16-1>;
263 * } KeyShareEntry;
264 * struct {
265 * KeyShareEntry client_shares<0..2^16-1>;
266 * } KeyShareClientHello;
267 */
268 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_key_share_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)269 static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
270 unsigned char *buf,
271 unsigned char *end,
272 size_t *out_len )
273 {
274 unsigned char *p = buf;
275 unsigned char *client_shares; /* Start of client_shares */
276 size_t client_shares_len; /* Length of client_shares */
277 uint16_t group_id;
278 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
279
280 *out_len = 0;
281
282 /* Check if we have space for header and length fields:
283 * - extension_type (2 bytes)
284 * - extension_data_length (2 bytes)
285 * - client_shares_length (2 bytes)
286 */
287 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
288 p += 6;
289
290 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) );
291
292 /* HRR could already have requested something else. */
293 group_id = ssl->handshake->offered_group_id;
294 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) &&
295 !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) )
296 {
297 MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl,
298 &group_id ) );
299 }
300
301 /*
302 * Dispatch to type-specific key generation function.
303 *
304 * So far, we're only supporting ECDHE. With the introduction
305 * of PQC KEMs, we'll want to have multiple branches, one per
306 * type of KEM, and dispatch to the corresponding crypto. And
307 * only one key share entry is allowed.
308 */
309 client_shares = p;
310 #if defined(MBEDTLS_ECDH_C)
311 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
312 {
313 /* Pointer to group */
314 unsigned char *group = p;
315 /* Length of key_exchange */
316 size_t key_exchange_len = 0;
317
318 /* Check there is space for header of KeyShareEntry
319 * - group (2 bytes)
320 * - key_exchange_length (2 bytes)
321 */
322 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
323 p += 4;
324 ret = mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange(
325 ssl, group_id, p, end, &key_exchange_len );
326 p += key_exchange_len;
327 if( ret != 0 )
328 return( ret );
329
330 /* Write group */
331 MBEDTLS_PUT_UINT16_BE( group_id, group, 0 );
332 /* Write key_exchange_length */
333 MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 );
334 }
335 else
336 #endif /* MBEDTLS_ECDH_C */
337 if( 0 /* other KEMs? */ )
338 {
339 /* Do something */
340 }
341 else
342 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
343
344 /* Length of client_shares */
345 client_shares_len = p - client_shares;
346 if( client_shares_len == 0)
347 {
348 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) );
349 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
350 }
351 /* Write extension_type */
352 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
353 /* Write extension_data_length */
354 MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 );
355 /* Write client_shares_length */
356 MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 );
357
358 /* Update offered_group_id field */
359 ssl->handshake->offered_group_id = group_id;
360
361 /* Output the total length of key_share extension. */
362 *out_len = p - buf;
363
364 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len );
365
366 mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_KEY_SHARE );
367
368 cleanup:
369
370 return( ret );
371 }
372 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
373
374 /*
375 * ssl_tls13_parse_hrr_key_share_ext()
376 * Parse key_share extension in Hello Retry Request
377 *
378 * struct {
379 * NamedGroup selected_group;
380 * } KeyShareHelloRetryRequest;
381 */
382 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_hrr_key_share_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)383 static int ssl_tls13_parse_hrr_key_share_ext( mbedtls_ssl_context *ssl,
384 const unsigned char *buf,
385 const unsigned char *end )
386 {
387 #if defined(MBEDTLS_ECDH_C)
388 const mbedtls_ecp_curve_info *curve_info = NULL;
389 const unsigned char *p = buf;
390 int selected_group;
391 int found = 0;
392
393 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
394 if( group_list == NULL )
395 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
396
397 MBEDTLS_SSL_DEBUG_BUF( 3, "key_share extension", p, end - buf );
398
399 /* Read selected_group */
400 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
401 selected_group = MBEDTLS_GET_UINT16_BE( p, 0 );
402 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected_group ( %d )", selected_group ) );
403
404 /* Upon receipt of this extension in a HelloRetryRequest, the client
405 * MUST first verify that the selected_group field corresponds to a
406 * group which was provided in the "supported_groups" extension in the
407 * original ClientHello.
408 * The supported_group was based on the info in ssl->conf->group_list.
409 *
410 * If the server provided a key share that was not sent in the ClientHello
411 * then the client MUST abort the handshake with an "illegal_parameter" alert.
412 */
413 for( ; *group_list != 0; group_list++ )
414 {
415 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
416 if( curve_info == NULL || curve_info->tls_id != selected_group )
417 continue;
418
419 /* We found a match */
420 found = 1;
421 break;
422 }
423
424 /* Client MUST verify that the selected_group field does not
425 * correspond to a group which was provided in the "key_share"
426 * extension in the original ClientHello. If the server sent an
427 * HRR message with a key share already provided in the
428 * ClientHello then the client MUST abort the handshake with
429 * an "illegal_parameter" alert.
430 */
431 if( found == 0 || selected_group == ssl->handshake->offered_group_id )
432 {
433 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid key share in HRR" ) );
434 MBEDTLS_SSL_PEND_FATAL_ALERT(
435 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
436 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
437 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
438 }
439
440 /* Remember server's preference for next ClientHello */
441 ssl->handshake->offered_group_id = selected_group;
442
443 return( 0 );
444 #else
445 (void) ssl;
446 (void) buf;
447 (void) end;
448 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
449 #endif
450 }
451
452 /*
453 * ssl_tls13_parse_key_share_ext()
454 * Parse key_share extension in Server Hello
455 *
456 * struct {
457 * KeyShareEntry server_share;
458 * } KeyShareServerHello;
459 * struct {
460 * NamedGroup group;
461 * opaque key_exchange<1..2^16-1>;
462 * } KeyShareEntry;
463 */
464 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_key_share_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)465 static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl,
466 const unsigned char *buf,
467 const unsigned char *end )
468 {
469 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
470 const unsigned char *p = buf;
471 uint16_t group, offered_group;
472
473 /* ...
474 * NamedGroup group; (2 bytes)
475 * ...
476 */
477 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
478 group = MBEDTLS_GET_UINT16_BE( p, 0 );
479 p += 2;
480
481 /* Check that the chosen group matches the one we offered. */
482 offered_group = ssl->handshake->offered_group_id;
483 if( offered_group != group )
484 {
485 MBEDTLS_SSL_DEBUG_MSG( 1,
486 ( "Invalid server key share, our group %u, their group %u",
487 (unsigned) offered_group, (unsigned) group ) );
488 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
489 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
490 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
491 }
492
493 #if defined(MBEDTLS_ECDH_C)
494 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
495 {
496 const mbedtls_ecp_curve_info *curve_info =
497 mbedtls_ecp_curve_info_from_tls_id( group );
498 if( curve_info == NULL )
499 {
500 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid TLS curve group id" ) );
501 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
502 }
503
504 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
505
506 ret = mbedtls_ssl_tls13_read_public_ecdhe_share( ssl, p, end - p );
507 if( ret != 0 )
508 return( ret );
509 }
510 else
511 #endif /* MBEDTLS_ECDH_C */
512 if( 0 /* other KEMs? */ )
513 {
514 /* Do something */
515 }
516 else
517 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
518
519 return( ret );
520 }
521
522 /*
523 * ssl_tls13_parse_cookie_ext()
524 * Parse cookie extension in Hello Retry Request
525 *
526 * struct {
527 * opaque cookie<1..2^16-1>;
528 * } Cookie;
529 *
530 * When sending a HelloRetryRequest, the server MAY provide a "cookie"
531 * extension to the client (this is an exception to the usual rule that
532 * the only extensions that may be sent are those that appear in the
533 * ClientHello). When sending the new ClientHello, the client MUST copy
534 * the contents of the extension received in the HelloRetryRequest into
535 * a "cookie" extension in the new ClientHello. Clients MUST NOT use
536 * cookies in their initial ClientHello in subsequent connections.
537 */
538 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_cookie_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)539 static int ssl_tls13_parse_cookie_ext( mbedtls_ssl_context *ssl,
540 const unsigned char *buf,
541 const unsigned char *end )
542 {
543 uint16_t cookie_len;
544 const unsigned char *p = buf;
545 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
546
547 /* Retrieve length field of cookie */
548 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
549 cookie_len = MBEDTLS_GET_UINT16_BE( p, 0 );
550 p += 2;
551
552 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cookie_len );
553 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie extension", p, cookie_len );
554
555 mbedtls_free( handshake->cookie );
556 handshake->hrr_cookie_len = 0;
557 handshake->cookie = mbedtls_calloc( 1, cookie_len );
558 if( handshake->cookie == NULL )
559 {
560 MBEDTLS_SSL_DEBUG_MSG( 1,
561 ( "alloc failed ( %ud bytes )",
562 cookie_len ) );
563 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
564 }
565
566 memcpy( handshake->cookie, p, cookie_len );
567 handshake->hrr_cookie_len = cookie_len;
568
569 return( 0 );
570 }
571
572 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_cookie_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)573 static int ssl_tls13_write_cookie_ext( mbedtls_ssl_context *ssl,
574 unsigned char *buf,
575 unsigned char *end,
576 size_t *out_len )
577 {
578 unsigned char *p = buf;
579 *out_len = 0;
580 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
581
582 if( handshake->cookie == NULL )
583 {
584 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no cookie to send; skip extension" ) );
585 return( 0 );
586 }
587
588 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
589 handshake->cookie,
590 handshake->hrr_cookie_len );
591
592 MBEDTLS_SSL_CHK_BUF_PTR( p, end, handshake->hrr_cookie_len + 6 );
593
594 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding cookie extension" ) );
595
596 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_COOKIE, p, 0 );
597 MBEDTLS_PUT_UINT16_BE( handshake->hrr_cookie_len + 2, p, 2 );
598 MBEDTLS_PUT_UINT16_BE( handshake->hrr_cookie_len, p, 4 );
599 p += 6;
600
601 /* Cookie */
602 memcpy( p, handshake->cookie, handshake->hrr_cookie_len );
603
604 *out_len = handshake->hrr_cookie_len + 6;
605
606 mbedtls_ssl_tls13_set_hs_sent_ext_mask( ssl, MBEDTLS_TLS_EXT_COOKIE );
607
608 return( 0 );
609 }
610
611 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
612 /*
613 * ssl_tls13_write_psk_key_exchange_modes_ext() structure:
614 *
615 * enum { psk_ke( 0 ), psk_dhe_ke( 1 ), ( 255 ) } PskKeyExchangeMode;
616 *
617 * struct {
618 * PskKeyExchangeMode ke_modes<1..255>;
619 * } PskKeyExchangeModes;
620 */
621 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_psk_key_exchange_modes_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)622 static int ssl_tls13_write_psk_key_exchange_modes_ext( mbedtls_ssl_context *ssl,
623 unsigned char *buf,
624 unsigned char *end,
625 size_t *out_len )
626 {
627 unsigned char *p = buf;
628 int ke_modes_len = 0;
629
630 ((void) ke_modes_len );
631 *out_len = 0;
632
633 /* Skip writing extension if no PSK key exchange mode
634 * is enabled in the config.
635 */
636 if( !mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
637 {
638 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip psk_key_exchange_modes extension" ) );
639 return( 0 );
640 }
641
642 /* Require 7 bytes of data, otherwise fail,
643 * even if extension might be shorter.
644 */
645 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
646 MBEDTLS_SSL_DEBUG_MSG(
647 3, ( "client hello, adding psk_key_exchange_modes extension" ) );
648
649 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES, p, 0 );
650
651 /* Skip extension length (2 bytes) and
652 * ke_modes length (1 byte) for now.
653 */
654 p += 5;
655
656 if( mbedtls_ssl_conf_tls13_psk_ephemeral_enabled( ssl ) )
657 {
658 *p++ = MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE;
659 ke_modes_len++;
660
661 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Adding PSK-ECDHE key exchange mode" ) );
662 }
663
664 if( mbedtls_ssl_conf_tls13_psk_enabled( ssl ) )
665 {
666 *p++ = MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE;
667 ke_modes_len++;
668
669 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Adding pure PSK key exchange mode" ) );
670 }
671
672 /* Now write the extension and ke_modes length */
673 MBEDTLS_PUT_UINT16_BE( ke_modes_len + 1, buf, 2 );
674 buf[4] = ke_modes_len;
675
676 *out_len = p - buf;
677
678 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
679 ssl, MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES );
680
681 return ( 0 );
682 }
683
ssl_tls13_get_ciphersuite_hash_alg(int ciphersuite)684 static psa_algorithm_t ssl_tls13_get_ciphersuite_hash_alg( int ciphersuite )
685 {
686 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = NULL;
687 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuite );
688
689 if( ciphersuite_info != NULL )
690 return( mbedtls_psa_translate_md( ciphersuite_info->mac ) );
691
692 return( PSA_ALG_NONE );
693 }
694
695 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
ssl_tls13_has_configured_ticket(mbedtls_ssl_context * ssl)696 static int ssl_tls13_has_configured_ticket( mbedtls_ssl_context *ssl )
697 {
698 mbedtls_ssl_session *session = ssl->session_negotiate;
699 return( ssl->handshake->resume &&
700 session != NULL && session->ticket != NULL );
701 }
702
703 #if defined(MBEDTLS_SSL_EARLY_DATA)
ssl_tls13_early_data_has_valid_ticket(mbedtls_ssl_context * ssl)704 static int ssl_tls13_early_data_has_valid_ticket( mbedtls_ssl_context *ssl )
705 {
706 mbedtls_ssl_session *session = ssl->session_negotiate;
707 return( ssl->handshake->resume &&
708 session->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
709 ( session->ticket_flags &
710 MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA ) &&
711 mbedtls_ssl_tls13_cipher_suite_is_offered(
712 ssl, session->ciphersuite ) );
713 }
714 #endif
715
716 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_ticket_get_identity(mbedtls_ssl_context * ssl,psa_algorithm_t * hash_alg,const unsigned char ** identity,size_t * identity_len)717 static int ssl_tls13_ticket_get_identity( mbedtls_ssl_context *ssl,
718 psa_algorithm_t *hash_alg,
719 const unsigned char **identity,
720 size_t *identity_len )
721 {
722 mbedtls_ssl_session *session = ssl->session_negotiate;
723
724 if( !ssl_tls13_has_configured_ticket( ssl ) )
725 return( -1 );
726
727 *hash_alg = ssl_tls13_get_ciphersuite_hash_alg( session->ciphersuite );
728 *identity = session->ticket;
729 *identity_len = session->ticket_len;
730 return( 0 );
731 }
732
733 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_ticket_get_psk(mbedtls_ssl_context * ssl,psa_algorithm_t * hash_alg,const unsigned char ** psk,size_t * psk_len)734 static int ssl_tls13_ticket_get_psk( mbedtls_ssl_context *ssl,
735 psa_algorithm_t *hash_alg,
736 const unsigned char **psk,
737 size_t *psk_len )
738 {
739
740 mbedtls_ssl_session *session = ssl->session_negotiate;
741
742 if( !ssl_tls13_has_configured_ticket( ssl ) )
743 return( -1 );
744
745 *hash_alg = ssl_tls13_get_ciphersuite_hash_alg( session->ciphersuite );
746 *psk = session->resumption_key;
747 *psk_len = session->resumption_key_len;
748
749 return( 0 );
750 }
751 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
752
753 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_psk_get_identity(mbedtls_ssl_context * ssl,psa_algorithm_t * hash_alg,const unsigned char ** identity,size_t * identity_len)754 static int ssl_tls13_psk_get_identity( mbedtls_ssl_context *ssl,
755 psa_algorithm_t *hash_alg,
756 const unsigned char **identity,
757 size_t *identity_len )
758 {
759
760 if( ! mbedtls_ssl_conf_has_static_psk( ssl->conf ) )
761 return( -1 );
762
763 *hash_alg = PSA_ALG_SHA_256;
764 *identity = ssl->conf->psk_identity;
765 *identity_len = ssl->conf->psk_identity_len;
766 return( 0 );
767 }
768
769 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_psk_get_psk(mbedtls_ssl_context * ssl,psa_algorithm_t * hash_alg,const unsigned char ** psk,size_t * psk_len)770 static int ssl_tls13_psk_get_psk( mbedtls_ssl_context *ssl,
771 psa_algorithm_t *hash_alg,
772 const unsigned char **psk,
773 size_t *psk_len )
774 {
775
776 if( ! mbedtls_ssl_conf_has_static_psk( ssl->conf ) )
777 return( -1 );
778
779 *hash_alg = PSA_ALG_SHA_256;
780 *psk = ssl->conf->psk;
781 *psk_len = ssl->conf->psk_len;
782 return( 0 );
783 }
784
ssl_tls13_get_configured_psk_count(mbedtls_ssl_context * ssl)785 static int ssl_tls13_get_configured_psk_count( mbedtls_ssl_context *ssl )
786 {
787 int configured_psk_count = 0;
788 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
789 if( ssl_tls13_has_configured_ticket( ssl ) )
790 {
791 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Ticket is configured" ) );
792 configured_psk_count++;
793 }
794 #endif
795 if( mbedtls_ssl_conf_has_static_psk( ssl->conf ) )
796 {
797 MBEDTLS_SSL_DEBUG_MSG( 3, ( "PSK is configured" ) );
798 configured_psk_count++;
799 }
800 return( configured_psk_count );
801 }
802
803 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_identity(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,const unsigned char * identity,size_t identity_len,uint32_t obfuscated_ticket_age,size_t * out_len)804 static int ssl_tls13_write_identity( mbedtls_ssl_context *ssl,
805 unsigned char *buf,
806 unsigned char *end,
807 const unsigned char *identity,
808 size_t identity_len,
809 uint32_t obfuscated_ticket_age,
810 size_t *out_len )
811 {
812 ((void) ssl);
813 *out_len = 0;
814
815 /*
816 * - identity_len (2 bytes)
817 * - identity (psk_identity_len bytes)
818 * - obfuscated_ticket_age (4 bytes)
819 */
820 MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 6 + identity_len );
821
822 MBEDTLS_PUT_UINT16_BE( identity_len, buf, 0 );
823 memcpy( buf + 2, identity, identity_len );
824 MBEDTLS_PUT_UINT32_BE( obfuscated_ticket_age, buf, 2 + identity_len );
825
826 MBEDTLS_SSL_DEBUG_BUF( 4, "write identity", buf, 6 + identity_len );
827
828 *out_len = 6 + identity_len;
829
830 return( 0 );
831 }
832
833 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_binder(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,int psk_type,psa_algorithm_t hash_alg,const unsigned char * psk,size_t psk_len,size_t * out_len)834 static int ssl_tls13_write_binder( mbedtls_ssl_context *ssl,
835 unsigned char *buf,
836 unsigned char *end,
837 int psk_type,
838 psa_algorithm_t hash_alg,
839 const unsigned char *psk,
840 size_t psk_len,
841 size_t *out_len )
842 {
843 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
844 unsigned char binder_len;
845 unsigned char transcript[ MBEDTLS_TLS1_3_MD_MAX_SIZE ];
846 size_t transcript_len = 0;
847
848 *out_len = 0;
849
850 binder_len = PSA_HASH_LENGTH( hash_alg );
851
852 /*
853 * - binder_len (1 bytes)
854 * - binder (binder_len bytes)
855 */
856 MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 1 + binder_len );
857
858 buf[0] = binder_len;
859
860 /* Get current state of handshake transcript. */
861 ret = mbedtls_ssl_get_handshake_transcript(
862 ssl, mbedtls_hash_info_md_from_psa( hash_alg ),
863 transcript, sizeof( transcript ), &transcript_len );
864 if( ret != 0 )
865 return( ret );
866
867 ret = mbedtls_ssl_tls13_create_psk_binder( ssl, hash_alg,
868 psk, psk_len, psk_type,
869 transcript, buf + 1 );
870 if( ret != 0 )
871 {
872 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_create_psk_binder", ret );
873 return( ret );
874 }
875 MBEDTLS_SSL_DEBUG_BUF( 4, "write binder", buf, 1 + binder_len );
876
877 *out_len = 1 + binder_len;
878
879 return( 0 );
880 }
881
882 /*
883 * mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext() structure:
884 *
885 * struct {
886 * opaque identity<1..2^16-1>;
887 * uint32 obfuscated_ticket_age;
888 * } PskIdentity;
889 *
890 * opaque PskBinderEntry<32..255>;
891 *
892 * struct {
893 * PskIdentity identities<7..2^16-1>;
894 * PskBinderEntry binders<33..2^16-1>;
895 * } OfferedPsks;
896 *
897 * struct {
898 * select (Handshake.msg_type) {
899 * case client_hello: OfferedPsks;
900 * ...
901 * };
902 * } PreSharedKeyExtension;
903 *
904 */
mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len,size_t * binders_len)905 int mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext(
906 mbedtls_ssl_context *ssl, unsigned char *buf, unsigned char *end,
907 size_t *out_len, size_t *binders_len )
908 {
909 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
910 int configured_psk_count = 0;
911 unsigned char *p = buf;
912 psa_algorithm_t hash_alg;
913 const unsigned char *identity;
914 size_t identity_len;
915 size_t l_binders_len = 0;
916 size_t output_len;
917
918 *out_len = 0;
919 *binders_len = 0;
920
921 /* Check if we have any PSKs to offer. If no, skip pre_shared_key */
922 configured_psk_count = ssl_tls13_get_configured_psk_count( ssl );
923 if( configured_psk_count == 0 )
924 {
925 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip pre_shared_key extensions" ) );
926 return( 0 );
927 }
928
929 MBEDTLS_SSL_DEBUG_MSG( 4, ( "Pre-configured PSK number = %d",
930 configured_psk_count ) );
931
932 /* Check if we have space to write the extension, binders included.
933 * - extension_type (2 bytes)
934 * - extension_data_len (2 bytes)
935 * - identities_len (2 bytes)
936 */
937 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
938 p += 6;
939
940 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
941 if( ssl_tls13_ticket_get_identity(
942 ssl, &hash_alg, &identity, &identity_len ) == 0 )
943 {
944 #if defined(MBEDTLS_HAVE_TIME)
945 mbedtls_time_t now = mbedtls_time( NULL );
946 mbedtls_ssl_session *session = ssl->session_negotiate;
947 uint32_t obfuscated_ticket_age =
948 (uint32_t)( now - session->ticket_received );
949
950 obfuscated_ticket_age *= 1000;
951 obfuscated_ticket_age += session->ticket_age_add;
952
953 ret = ssl_tls13_write_identity( ssl, p, end,
954 identity, identity_len,
955 obfuscated_ticket_age,
956 &output_len );
957 #else
958 ret = ssl_tls13_write_identity( ssl, p, end, identity, identity_len,
959 0, &output_len );
960 #endif /* MBEDTLS_HAVE_TIME */
961 if( ret != 0 )
962 return( ret );
963
964 p += output_len;
965 l_binders_len += 1 + PSA_HASH_LENGTH( hash_alg );
966 }
967 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
968
969 if( ssl_tls13_psk_get_identity(
970 ssl, &hash_alg, &identity, &identity_len ) == 0 )
971 {
972
973 ret = ssl_tls13_write_identity( ssl, p, end, identity, identity_len, 0,
974 &output_len );
975 if( ret != 0 )
976 return( ret );
977
978 p += output_len;
979 l_binders_len += 1 + PSA_HASH_LENGTH( hash_alg );
980 }
981
982 MBEDTLS_SSL_DEBUG_MSG( 3,
983 ( "client hello, adding pre_shared_key extension, "
984 "omitting PSK binder list" ) );
985
986 /* Take into account the two bytes for the length of the binders. */
987 l_binders_len += 2;
988 /* Check if there is enough space for binders */
989 MBEDTLS_SSL_CHK_BUF_PTR( p, end, l_binders_len );
990
991 /*
992 * - extension_type (2 bytes)
993 * - extension_data_len (2 bytes)
994 * - identities_len (2 bytes)
995 */
996 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_PRE_SHARED_KEY, buf, 0 );
997 MBEDTLS_PUT_UINT16_BE( p - buf - 4 + l_binders_len , buf, 2 );
998 MBEDTLS_PUT_UINT16_BE( p - buf - 6 , buf, 4 );
999
1000 *out_len = ( p - buf ) + l_binders_len;
1001 *binders_len = l_binders_len;
1002
1003 MBEDTLS_SSL_DEBUG_BUF( 3, "pre_shared_key identities", buf, p - buf );
1004
1005 return( 0 );
1006 }
1007
mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end)1008 int mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
1009 mbedtls_ssl_context *ssl, unsigned char *buf, unsigned char *end )
1010 {
1011 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1012 unsigned char *p = buf;
1013 psa_algorithm_t hash_alg = PSA_ALG_NONE;
1014 const unsigned char *psk;
1015 size_t psk_len;
1016 size_t output_len;
1017
1018 /* Check if we have space to write binders_len.
1019 * - binders_len (2 bytes)
1020 */
1021 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1022 p += 2;
1023
1024 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1025 if( ssl_tls13_ticket_get_psk( ssl, &hash_alg, &psk, &psk_len ) == 0 )
1026 {
1027
1028 ret = ssl_tls13_write_binder( ssl, p, end,
1029 MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION,
1030 hash_alg, psk, psk_len,
1031 &output_len );
1032 if( ret != 0 )
1033 return( ret );
1034 p += output_len;
1035 }
1036 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1037
1038 if( ssl_tls13_psk_get_psk( ssl, &hash_alg, &psk, &psk_len ) == 0 )
1039 {
1040
1041 ret = ssl_tls13_write_binder( ssl, p, end,
1042 MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL,
1043 hash_alg, psk, psk_len,
1044 &output_len );
1045 if( ret != 0 )
1046 return( ret );
1047 p += output_len;
1048 }
1049
1050 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding PSK binder list." ) );
1051
1052 /*
1053 * - binders_len (2 bytes)
1054 */
1055 MBEDTLS_PUT_UINT16_BE( p - buf - 2, buf, 0 );
1056
1057 MBEDTLS_SSL_DEBUG_BUF( 3, "pre_shared_key binders", buf, p - buf );
1058
1059 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
1060 ssl, MBEDTLS_TLS_EXT_PRE_SHARED_KEY );
1061
1062 return( 0 );
1063 }
1064
1065 /*
1066 * struct {
1067 * opaque identity<1..2^16-1>;
1068 * uint32 obfuscated_ticket_age;
1069 * } PskIdentity;
1070 *
1071 * opaque PskBinderEntry<32..255>;
1072 *
1073 * struct {
1074 *
1075 * select (Handshake.msg_type) {
1076 * ...
1077 * case server_hello: uint16 selected_identity;
1078 * };
1079 *
1080 * } PreSharedKeyExtension;
1081 *
1082 */
1083 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_server_pre_shared_key_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1084 static int ssl_tls13_parse_server_pre_shared_key_ext( mbedtls_ssl_context *ssl,
1085 const unsigned char *buf,
1086 const unsigned char *end )
1087 {
1088 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1089 int selected_identity;
1090 const unsigned char *psk;
1091 size_t psk_len;
1092 psa_algorithm_t hash_alg;
1093
1094 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 );
1095 selected_identity = MBEDTLS_GET_UINT16_BE( buf, 0 );
1096
1097 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected_identity = %d", selected_identity ) );
1098
1099 if( selected_identity >= ssl_tls13_get_configured_psk_count( ssl ) )
1100 {
1101 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid PSK identity." ) );
1102
1103 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1104 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1105 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1106 }
1107
1108 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1109 if( selected_identity == 0 && ssl_tls13_has_configured_ticket( ssl ) )
1110 {
1111 ret = ssl_tls13_ticket_get_psk( ssl, &hash_alg, &psk, &psk_len );
1112 }
1113 else
1114 #endif
1115 if( mbedtls_ssl_conf_has_static_psk( ssl->conf ) )
1116 {
1117 ret = ssl_tls13_psk_get_psk( ssl, &hash_alg, &psk, &psk_len );
1118 }
1119 else
1120 {
1121 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1122 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1123 }
1124 if( ret != 0 )
1125 return( ret );
1126
1127 ret = mbedtls_ssl_set_hs_psk( ssl, psk, psk_len );
1128 if( ret != 0 )
1129 {
1130 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_set_hs_psk", ret );
1131 return( ret );
1132 }
1133
1134 return( 0 );
1135 }
1136 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
1137
mbedtls_ssl_tls13_write_client_hello_exts(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)1138 int mbedtls_ssl_tls13_write_client_hello_exts( mbedtls_ssl_context *ssl,
1139 unsigned char *buf,
1140 unsigned char *end,
1141 size_t *out_len )
1142 {
1143 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1144 unsigned char *p = buf;
1145 size_t ext_len;
1146
1147 *out_len = 0;
1148
1149 /* Write supported_versions extension
1150 *
1151 * Supported Versions Extension is mandatory with TLS 1.3.
1152 */
1153 ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &ext_len );
1154 if( ret != 0 )
1155 return( ret );
1156 p += ext_len;
1157
1158 /* Echo the cookie if the server provided one in its preceding
1159 * HelloRetryRequest message.
1160 */
1161 ret = ssl_tls13_write_cookie_ext( ssl, p, end, &ext_len );
1162 if( ret != 0 )
1163 return( ret );
1164 p += ext_len;
1165
1166 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
1167 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1168 {
1169 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &ext_len );
1170 if( ret != 0 )
1171 return( ret );
1172 p += ext_len;
1173 }
1174 #endif
1175
1176 #if defined(MBEDTLS_SSL_EARLY_DATA)
1177 if( mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) &&
1178 ssl_tls13_early_data_has_valid_ticket( ssl ) &&
1179 ssl->conf->early_data_enabled == MBEDTLS_SSL_EARLY_DATA_ENABLED )
1180 {
1181 ret = mbedtls_ssl_tls13_write_early_data_ext( ssl, p, end, &ext_len );
1182 if( ret != 0 )
1183 return( ret );
1184 p += ext_len;
1185
1186 /* Initializes the status to `rejected`. It will be updated to
1187 * `accepted` if the EncryptedExtension message contain an early data
1188 * indication extension.
1189 */
1190 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED;
1191 }
1192 else
1193 {
1194 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write early_data extension" ) );
1195 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_SENT;
1196 }
1197 #endif /* MBEDTLS_SSL_EARLY_DATA */
1198
1199 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1200 /* For PSK-based key exchange we need the pre_shared_key extension
1201 * and the psk_key_exchange_modes extension.
1202 *
1203 * The pre_shared_key extension MUST be the last extension in the
1204 * ClientHello. Servers MUST check that it is the last extension and
1205 * otherwise fail the handshake with an "illegal_parameter" alert.
1206 *
1207 * Add the psk_key_exchange_modes extension.
1208 */
1209 ret = ssl_tls13_write_psk_key_exchange_modes_ext( ssl, p, end, &ext_len );
1210 if( ret != 0 )
1211 return( ret );
1212 p += ext_len;
1213 #endif
1214
1215 *out_len = p - buf;
1216
1217 return( 0 );
1218 }
1219
1220 /*
1221 * Functions for parsing and processing Server Hello
1222 */
1223
1224 /**
1225 * \brief Detect if the ServerHello contains a supported_versions extension
1226 * or not.
1227 *
1228 * \param[in] ssl SSL context
1229 * \param[in] buf Buffer containing the ServerHello message
1230 * \param[in] end End of the buffer containing the ServerHello message
1231 *
1232 * \return 0 if the ServerHello does not contain a supported_versions extension
1233 * \return 1 if the ServerHello contains a supported_versions extension
1234 * \return A negative value if an error occurred while parsing the ServerHello.
1235 */
1236 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_is_supported_versions_ext_present(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1237 static int ssl_tls13_is_supported_versions_ext_present(
1238 mbedtls_ssl_context *ssl,
1239 const unsigned char *buf,
1240 const unsigned char *end )
1241 {
1242 const unsigned char *p = buf;
1243 size_t legacy_session_id_echo_len;
1244 size_t extensions_len;
1245 const unsigned char *extensions_end;
1246
1247 /*
1248 * Check there is enough data to access the legacy_session_id_echo vector
1249 * length:
1250 * - legacy_version 2 bytes
1251 * - random MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes
1252 * - legacy_session_id_echo length 1 byte
1253 */
1254 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 3 );
1255 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN + 2;
1256 legacy_session_id_echo_len = *p;
1257
1258 /*
1259 * Jump to the extensions, jumping over:
1260 * - legacy_session_id_echo (legacy_session_id_echo_len + 1) bytes
1261 * - cipher_suite 2 bytes
1262 * - legacy_compression_method 1 byte
1263 */
1264 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len + 4 );
1265 p += legacy_session_id_echo_len + 4;
1266
1267 /* Case of no extension */
1268 if( p == end )
1269 return( 0 );
1270
1271 /* ...
1272 * Extension extensions<6..2^16-1>;
1273 * ...
1274 * struct {
1275 * ExtensionType extension_type; (2 bytes)
1276 * opaque extension_data<0..2^16-1>;
1277 * } Extension;
1278 */
1279 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1280 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1281 p += 2;
1282
1283 /* Check extensions do not go beyond the buffer of data. */
1284 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1285 extensions_end = p + extensions_len;
1286
1287 while( p < extensions_end )
1288 {
1289 unsigned int extension_type;
1290 size_t extension_data_len;
1291
1292 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1293 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1294 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1295 p += 4;
1296
1297 if( extension_type == MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS )
1298 return( 1 );
1299
1300 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1301 p += extension_data_len;
1302 }
1303
1304 return( 0 );
1305 }
1306
1307 /* Returns a negative value on failure, and otherwise
1308 * - 1 if the last eight bytes of the ServerHello random bytes indicate that
1309 * the server is TLS 1.3 capable but negotiating TLS 1.2 or below.
1310 * - 0 otherwise
1311 */
1312 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_is_downgrade_negotiation(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1313 static int ssl_tls13_is_downgrade_negotiation( mbedtls_ssl_context *ssl,
1314 const unsigned char *buf,
1315 const unsigned char *end )
1316 {
1317 /* First seven bytes of the magic downgrade strings, see RFC 8446 4.1.3 */
1318 static const unsigned char magic_downgrade_string[] =
1319 { 0x44, 0x4F, 0x57, 0x4E, 0x47, 0x52, 0x44 };
1320 const unsigned char *last_eight_bytes_of_random;
1321 unsigned char last_byte_of_random;
1322
1323 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 2 );
1324 last_eight_bytes_of_random = buf + 2 + MBEDTLS_SERVER_HELLO_RANDOM_LEN - 8;
1325
1326 if( memcmp( last_eight_bytes_of_random,
1327 magic_downgrade_string,
1328 sizeof( magic_downgrade_string ) ) == 0 )
1329 {
1330 last_byte_of_random = last_eight_bytes_of_random[7];
1331 return( last_byte_of_random == 0 ||
1332 last_byte_of_random == 1 );
1333 }
1334
1335 return( 0 );
1336 }
1337
1338 /* Returns a negative value on failure, and otherwise
1339 * - SSL_SERVER_HELLO or
1340 * - SSL_SERVER_HELLO_HRR
1341 * to indicate which message is expected and to be parsed next.
1342 */
1343 #define SSL_SERVER_HELLO 0
1344 #define SSL_SERVER_HELLO_HRR 1
1345 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_server_hello_is_hrr(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1346 static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl,
1347 const unsigned char *buf,
1348 const unsigned char *end )
1349 {
1350
1351 /* Check whether this message is a HelloRetryRequest ( HRR ) message.
1352 *
1353 * Server Hello and HRR are only distinguished by Random set to the
1354 * special value of the SHA-256 of "HelloRetryRequest".
1355 *
1356 * struct {
1357 * ProtocolVersion legacy_version = 0x0303;
1358 * Random random;
1359 * opaque legacy_session_id_echo<0..32>;
1360 * CipherSuite cipher_suite;
1361 * uint8 legacy_compression_method = 0;
1362 * Extension extensions<6..2^16-1>;
1363 * } ServerHello;
1364 *
1365 */
1366 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end,
1367 2 + sizeof( mbedtls_ssl_tls13_hello_retry_request_magic ) );
1368
1369 if( memcmp( buf + 2, mbedtls_ssl_tls13_hello_retry_request_magic,
1370 sizeof( mbedtls_ssl_tls13_hello_retry_request_magic ) ) == 0 )
1371 {
1372 return( SSL_SERVER_HELLO_HRR );
1373 }
1374
1375 return( SSL_SERVER_HELLO );
1376 }
1377
1378 /*
1379 * Returns a negative value on failure, and otherwise
1380 * - SSL_SERVER_HELLO or
1381 * - SSL_SERVER_HELLO_HRR or
1382 * - SSL_SERVER_HELLO_TLS1_2
1383 */
1384 #define SSL_SERVER_HELLO_TLS1_2 2
1385 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_preprocess_server_hello(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1386 static int ssl_tls13_preprocess_server_hello( mbedtls_ssl_context *ssl,
1387 const unsigned char *buf,
1388 const unsigned char *end )
1389 {
1390 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1391 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1392
1393 MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_is_supported_versions_ext_present(
1394 ssl, buf, end ) );
1395
1396 if( ret == 0 )
1397 {
1398 MBEDTLS_SSL_PROC_CHK_NEG(
1399 ssl_tls13_is_downgrade_negotiation( ssl, buf, end ) );
1400
1401 /* If the server is negotiating TLS 1.2 or below and:
1402 * . we did not propose TLS 1.2 or
1403 * . the server responded it is TLS 1.3 capable but negotiating a lower
1404 * version of the protocol and thus we are under downgrade attack
1405 * abort the handshake with an "illegal parameter" alert.
1406 */
1407 if( handshake->min_tls_version > MBEDTLS_SSL_VERSION_TLS1_2 || ret )
1408 {
1409 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1410 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1411 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1412 }
1413
1414 ssl->keep_current_message = 1;
1415 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
1416 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
1417 buf, (size_t)(end - buf) );
1418
1419 if( mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1420 {
1421 ret = ssl_tls13_reset_key_share( ssl );
1422 if( ret != 0 )
1423 return( ret );
1424 }
1425
1426 return( SSL_SERVER_HELLO_TLS1_2 );
1427 }
1428
1429 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1430 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
1431 ssl->session_negotiate->tls_version = ssl->tls_version;
1432 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1433
1434 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
1435
1436 ret = ssl_server_hello_is_hrr( ssl, buf, end );
1437 switch( ret )
1438 {
1439 case SSL_SERVER_HELLO:
1440 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) );
1441 break;
1442 case SSL_SERVER_HELLO_HRR:
1443 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) );
1444 /* If a client receives a second
1445 * HelloRetryRequest in the same connection (i.e., where the ClientHello
1446 * was itself in response to a HelloRetryRequest), it MUST abort the
1447 * handshake with an "unexpected_message" alert.
1448 */
1449 if( handshake->hello_retry_request_count > 0 )
1450 {
1451 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Multiple HRRs received" ) );
1452 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
1453 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1454 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1455 }
1456 /*
1457 * Clients must abort the handshake with an "illegal_parameter"
1458 * alert if the HelloRetryRequest would not result in any change
1459 * in the ClientHello.
1460 * In a PSK only key exchange that what we expect.
1461 */
1462 if( ! mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1463 {
1464 MBEDTLS_SSL_DEBUG_MSG( 1,
1465 ( "Unexpected HRR in pure PSK key exchange." ) );
1466 MBEDTLS_SSL_PEND_FATAL_ALERT(
1467 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1468 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1469 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1470 }
1471
1472 handshake->hello_retry_request_count++;
1473
1474 break;
1475 }
1476
1477 cleanup:
1478
1479 return( ret );
1480 }
1481
1482 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_check_server_hello_session_id_echo(mbedtls_ssl_context * ssl,const unsigned char ** buf,const unsigned char * end)1483 static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl,
1484 const unsigned char **buf,
1485 const unsigned char *end )
1486 {
1487 const unsigned char *p = *buf;
1488 size_t legacy_session_id_echo_len;
1489
1490 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1491 legacy_session_id_echo_len = *p++ ;
1492
1493 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len );
1494
1495 /* legacy_session_id_echo */
1496 if( ssl->session_negotiate->id_len != legacy_session_id_echo_len ||
1497 memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 )
1498 {
1499 MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID",
1500 ssl->session_negotiate->id,
1501 ssl->session_negotiate->id_len );
1502 MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p,
1503 legacy_session_id_echo_len );
1504
1505 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1506 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1507
1508 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1509 }
1510
1511 p += legacy_session_id_echo_len;
1512 *buf = p;
1513
1514 MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id,
1515 ssl->session_negotiate->id_len );
1516 return( 0 );
1517 }
1518
1519 /* Parse ServerHello message and configure context
1520 *
1521 * struct {
1522 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1523 * Random random;
1524 * opaque legacy_session_id_echo<0..32>;
1525 * CipherSuite cipher_suite;
1526 * uint8 legacy_compression_method = 0;
1527 * Extension extensions<6..2^16-1>;
1528 * } ServerHello;
1529 */
1530 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_server_hello(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end,int is_hrr)1531 static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl,
1532 const unsigned char *buf,
1533 const unsigned char *end,
1534 int is_hrr )
1535 {
1536 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1537 const unsigned char *p = buf;
1538 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1539 size_t extensions_len;
1540 const unsigned char *extensions_end;
1541 uint16_t cipher_suite;
1542 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
1543 int fatal_alert = 0;
1544 uint32_t allowed_extensions_mask;
1545 int hs_msg_type = is_hrr ? MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST :
1546 MBEDTLS_SSL_HS_SERVER_HELLO;
1547
1548 /*
1549 * Check there is space for minimal fields
1550 *
1551 * - legacy_version ( 2 bytes)
1552 * - random (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes)
1553 * - legacy_session_id_echo ( 1 byte ), minimum size
1554 * - cipher_suite ( 2 bytes)
1555 * - legacy_compression_method ( 1 byte )
1556 */
1557 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 );
1558
1559 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p );
1560 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 );
1561
1562 /* ...
1563 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1564 * ...
1565 * with ProtocolVersion defined as:
1566 * uint16 ProtocolVersion;
1567 */
1568 if( mbedtls_ssl_read_version( p, ssl->conf->transport ) !=
1569 MBEDTLS_SSL_VERSION_TLS1_2 )
1570 {
1571 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
1572 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1573 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
1574 ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1575 goto cleanup;
1576 }
1577 p += 2;
1578
1579 /* ...
1580 * Random random;
1581 * ...
1582 * with Random defined as:
1583 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
1584 */
1585 if( !is_hrr )
1586 {
1587 memcpy( &handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p,
1588 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1589 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
1590 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1591 }
1592 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
1593
1594 /* ...
1595 * opaque legacy_session_id_echo<0..32>;
1596 * ...
1597 */
1598 if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 )
1599 {
1600 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
1601 goto cleanup;
1602 }
1603
1604 /* ...
1605 * CipherSuite cipher_suite;
1606 * ...
1607 * with CipherSuite defined as:
1608 * uint8 CipherSuite[2];
1609 */
1610 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1611 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
1612 p += 2;
1613
1614
1615 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
1616 /*
1617 * Check whether this ciphersuite is valid and offered.
1618 */
1619 if( ( mbedtls_ssl_validate_ciphersuite( ssl, ciphersuite_info,
1620 ssl->tls_version,
1621 ssl->tls_version ) != 0 ) ||
1622 !mbedtls_ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) )
1623 {
1624 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
1625 }
1626 /*
1627 * If we received an HRR before and that the proposed selected
1628 * ciphersuite in this server hello is not the same as the one
1629 * proposed in the HRR, we abort the handshake and send an
1630 * "illegal_parameter" alert.
1631 */
1632 else if( ( !is_hrr ) && ( handshake->hello_retry_request_count > 0 ) &&
1633 ( cipher_suite != ssl->session_negotiate->ciphersuite ) )
1634 {
1635 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
1636 }
1637
1638 if( fatal_alert == MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER )
1639 {
1640 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid ciphersuite(%04x) parameter",
1641 cipher_suite ) );
1642 goto cleanup;
1643 }
1644
1645 /* Configure ciphersuites */
1646 mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info );
1647
1648 handshake->ciphersuite_info = ciphersuite_info;
1649 ssl->session_negotiate->ciphersuite = cipher_suite;
1650
1651 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s",
1652 cipher_suite, ciphersuite_info->name ) );
1653
1654 #if defined(MBEDTLS_HAVE_TIME)
1655 ssl->session_negotiate->start = time( NULL );
1656 #endif /* MBEDTLS_HAVE_TIME */
1657
1658 /* ...
1659 * uint8 legacy_compression_method = 0;
1660 * ...
1661 */
1662 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1663 if( p[0] != MBEDTLS_SSL_COMPRESS_NULL )
1664 {
1665 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
1666 fatal_alert = MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
1667 goto cleanup;
1668 }
1669 p++;
1670
1671 /* ...
1672 * Extension extensions<6..2^16-1>;
1673 * ...
1674 * struct {
1675 * ExtensionType extension_type; (2 bytes)
1676 * opaque extension_data<0..2^16-1>;
1677 * } Extension;
1678 */
1679 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1680 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1681 p += 2;
1682
1683 /* Check extensions do not go beyond the buffer of data. */
1684 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1685 extensions_end = p + extensions_len;
1686
1687 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len );
1688
1689 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
1690 allowed_extensions_mask = is_hrr ?
1691 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_HRR :
1692 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_SH;
1693
1694 while( p < extensions_end )
1695 {
1696 unsigned int extension_type;
1697 size_t extension_data_len;
1698 const unsigned char *extension_data_end;
1699
1700 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1701 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1702 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1703 p += 4;
1704
1705 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1706 extension_data_end = p + extension_data_len;
1707
1708 ret = mbedtls_ssl_tls13_check_received_extension(
1709 ssl, hs_msg_type, extension_type, allowed_extensions_mask );
1710 if( ret != 0 )
1711 return( ret );
1712
1713 switch( extension_type )
1714 {
1715 case MBEDTLS_TLS_EXT_COOKIE:
1716
1717 ret = ssl_tls13_parse_cookie_ext( ssl,
1718 p, extension_data_end );
1719 if( ret != 0 )
1720 {
1721 MBEDTLS_SSL_DEBUG_RET( 1,
1722 "ssl_tls13_parse_cookie_ext",
1723 ret );
1724 goto cleanup;
1725 }
1726 break;
1727
1728 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
1729 ret = ssl_tls13_parse_supported_versions_ext( ssl,
1730 p,
1731 extension_data_end );
1732 if( ret != 0 )
1733 goto cleanup;
1734 break;
1735
1736 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1737 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1738 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension" ) );
1739
1740 if( ( ret = ssl_tls13_parse_server_pre_shared_key_ext(
1741 ssl, p, extension_data_end ) ) != 0 )
1742 {
1743 MBEDTLS_SSL_DEBUG_RET(
1744 1, ( "ssl_tls13_parse_server_pre_shared_key_ext" ), ret );
1745 return( ret );
1746 }
1747 break;
1748 #endif
1749
1750 case MBEDTLS_TLS_EXT_KEY_SHARE:
1751 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
1752 if( ! mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
1753 {
1754 fatal_alert = MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT;
1755 goto cleanup;
1756 }
1757
1758 if( is_hrr )
1759 ret = ssl_tls13_parse_hrr_key_share_ext( ssl,
1760 p, extension_data_end );
1761 else
1762 ret = ssl_tls13_parse_key_share_ext( ssl,
1763 p, extension_data_end );
1764 if( ret != 0 )
1765 {
1766 MBEDTLS_SSL_DEBUG_RET( 1,
1767 "ssl_tls13_parse_key_share_ext",
1768 ret );
1769 goto cleanup;
1770 }
1771 break;
1772
1773 default:
1774 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1775 goto cleanup;
1776 }
1777
1778 p += extension_data_len;
1779 }
1780
1781 MBEDTLS_SSL_PRINT_EXTS( 3, hs_msg_type, handshake->received_extensions );
1782
1783 cleanup:
1784
1785 if( fatal_alert == MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT )
1786 {
1787 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1788 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1789 ret = MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
1790 }
1791 else if ( fatal_alert == MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER )
1792 {
1793 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1794 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1795 ret = MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1796 }
1797 return( ret );
1798 }
1799
1800 #if defined(MBEDTLS_DEBUG_C)
ssl_tls13_get_kex_mode_str(int mode)1801 static const char *ssl_tls13_get_kex_mode_str(int mode)
1802 {
1803 switch( mode )
1804 {
1805 case MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK:
1806 return "psk";
1807 case MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL:
1808 return "ephemeral";
1809 case MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL:
1810 return "psk_ephemeral";
1811 default:
1812 return "unknown mode";
1813 }
1814 }
1815 #endif /* MBEDTLS_DEBUG_C */
1816
1817 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_postprocess_server_hello(mbedtls_ssl_context * ssl)1818 static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
1819 {
1820 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1821 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1822
1823 /* Determine the key exchange mode:
1824 * 1) If both the pre_shared_key and key_share extensions were received
1825 * then the key exchange mode is PSK with EPHEMERAL.
1826 * 2) If only the pre_shared_key extension was received then the key
1827 * exchange mode is PSK-only.
1828 * 3) If only the key_share extension was received then the key
1829 * exchange mode is EPHEMERAL-only.
1830 */
1831 switch( handshake->received_extensions &
1832 ( MBEDTLS_SSL_EXT_MASK( PRE_SHARED_KEY ) | MBEDTLS_SSL_EXT_MASK( KEY_SHARE ) ) )
1833 {
1834 /* Only the pre_shared_key extension was received */
1835 case MBEDTLS_SSL_EXT_MASK( PRE_SHARED_KEY ):
1836 handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
1837 break;
1838
1839 /* Only the key_share extension was received */
1840 case MBEDTLS_SSL_EXT_MASK( KEY_SHARE ):
1841 handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
1842 break;
1843
1844 /* Both the pre_shared_key and key_share extensions were received */
1845 case ( MBEDTLS_SSL_EXT_MASK( PRE_SHARED_KEY ) | MBEDTLS_SSL_EXT_MASK( KEY_SHARE ) ):
1846 handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
1847 break;
1848
1849 /* Neither pre_shared_key nor key_share extension was received */
1850 default:
1851 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) );
1852 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1853 goto cleanup;
1854 }
1855
1856 if( !mbedtls_ssl_conf_tls13_check_kex_modes( ssl, handshake->key_exchange_mode ) )
1857 {
1858 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1859 MBEDTLS_SSL_DEBUG_MSG( 2,
1860 ( "Key exchange mode(%s) is not supported.",
1861 ssl_tls13_get_kex_mode_str( handshake->key_exchange_mode ) ) );
1862 goto cleanup;
1863 }
1864
1865 MBEDTLS_SSL_DEBUG_MSG( 3,
1866 ( "Selected key exchange mode: %s",
1867 ssl_tls13_get_kex_mode_str( handshake->key_exchange_mode ) ) );
1868
1869 /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
1870 *
1871 * TODO: We don't have to do this in case we offered 0-RTT and the
1872 * server accepted it. In this case, we could skip generating
1873 * the early secret. */
1874 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
1875 if( ret != 0 )
1876 {
1877 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early",
1878 ret );
1879 goto cleanup;
1880 }
1881
1882 ret = mbedtls_ssl_tls13_compute_handshake_transform( ssl );
1883 if( ret != 0 )
1884 {
1885 MBEDTLS_SSL_DEBUG_RET( 1,
1886 "mbedtls_ssl_tls13_compute_handshake_transform",
1887 ret );
1888 goto cleanup;
1889 }
1890
1891 mbedtls_ssl_set_inbound_transform( ssl, handshake->transform_handshake );
1892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
1893 ssl->session_in = ssl->session_negotiate;
1894
1895 cleanup:
1896 if( ret != 0 )
1897 {
1898 MBEDTLS_SSL_PEND_FATAL_ALERT(
1899 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1900 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1901 }
1902
1903 return( ret );
1904 }
1905
1906 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_postprocess_hrr(mbedtls_ssl_context * ssl)1907 static int ssl_tls13_postprocess_hrr( mbedtls_ssl_context *ssl )
1908 {
1909 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1910
1911 mbedtls_ssl_session_reset_msg_layer( ssl, 0 );
1912
1913 /*
1914 * We are going to re-generate a shared secret corresponding to the group
1915 * selected by the server, which is different from the group for which we
1916 * generated a shared secret in the first client hello.
1917 * Thus, reset the shared secret.
1918 */
1919 ret = ssl_tls13_reset_key_share( ssl );
1920 if( ret != 0 )
1921 return( ret );
1922
1923 return( 0 );
1924 }
1925
1926 /*
1927 * Wait and parse ServerHello handshake message.
1928 * Handler for MBEDTLS_SSL_SERVER_HELLO
1929 */
1930 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_server_hello(mbedtls_ssl_context * ssl)1931 static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl )
1932 {
1933 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1934 unsigned char *buf = NULL;
1935 size_t buf_len = 0;
1936 int is_hrr = 0;
1937
1938 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) );
1939
1940 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
1941 MBEDTLS_SSL_HS_SERVER_HELLO,
1942 &buf, &buf_len ) );
1943
1944 ret = ssl_tls13_preprocess_server_hello( ssl, buf, buf + buf_len );
1945 if( ret < 0 )
1946 goto cleanup;
1947 else
1948 is_hrr = ( ret == SSL_SERVER_HELLO_HRR );
1949
1950 if( ret == SSL_SERVER_HELLO_TLS1_2 )
1951 {
1952 ret = 0;
1953 goto cleanup;
1954 }
1955
1956 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf,
1957 buf + buf_len,
1958 is_hrr ) );
1959 if( is_hrr )
1960 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_reset_transcript_for_hrr( ssl ) );
1961
1962 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
1963 buf, buf_len );
1964
1965 if( is_hrr )
1966 {
1967 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_hrr( ssl ) );
1968 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1969 /* If not offering early data, the client sends a dummy CCS record
1970 * immediately before its second flight. This may either be before
1971 * its second ClientHello or before its encrypted handshake flight.
1972 */
1973 mbedtls_ssl_handshake_set_state( ssl,
1974 MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO );
1975 #else
1976 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
1977 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1978 }
1979 else
1980 {
1981 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_server_hello( ssl ) );
1982 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
1983 }
1984
1985 cleanup:
1986 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s ( %s )", __func__,
1987 is_hrr?"HelloRetryRequest":"ServerHello" ) );
1988 return( ret );
1989 }
1990
1991 /*
1992 *
1993 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
1994 *
1995 * The EncryptedExtensions message contains any extensions which
1996 * should be protected, i.e., any which are not needed to establish
1997 * the cryptographic context.
1998 */
1999
2000 /* Parse EncryptedExtensions message
2001 * struct {
2002 * Extension extensions<0..2^16-1>;
2003 * } EncryptedExtensions;
2004 */
2005 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_encrypted_extensions(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)2006 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
2007 const unsigned char *buf,
2008 const unsigned char *end )
2009 {
2010 int ret = 0;
2011 size_t extensions_len;
2012 const unsigned char *p = buf;
2013 const unsigned char *extensions_end;
2014 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2015
2016 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
2017 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2018 p += 2;
2019
2020 MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len );
2021 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
2022 extensions_end = p + extensions_len;
2023
2024 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
2025
2026 while( p < extensions_end )
2027 {
2028 unsigned int extension_type;
2029 size_t extension_data_len;
2030
2031 /*
2032 * struct {
2033 * ExtensionType extension_type; (2 bytes)
2034 * opaque extension_data<0..2^16-1>;
2035 * } Extension;
2036 */
2037 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
2038 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
2039 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
2040 p += 4;
2041
2042 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
2043
2044 ret = mbedtls_ssl_tls13_check_received_extension(
2045 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, extension_type,
2046 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_EE );
2047 if( ret != 0 )
2048 return( ret );
2049
2050 switch( extension_type )
2051 {
2052 #if defined(MBEDTLS_SSL_ALPN)
2053 case MBEDTLS_TLS_EXT_ALPN:
2054 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
2055
2056 if( ( ret = ssl_tls13_parse_alpn_ext( ssl, p, (size_t)extension_data_len ) ) != 0 )
2057 {
2058 return( ret );
2059 }
2060
2061 break;
2062 #endif /* MBEDTLS_SSL_ALPN */
2063
2064 #if defined(MBEDTLS_SSL_EARLY_DATA)
2065 case MBEDTLS_TLS_EXT_EARLY_DATA:
2066
2067 if( extension_data_len != 0 )
2068 {
2069 /* The message must be empty. */
2070 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
2071 MBEDTLS_ERR_SSL_DECODE_ERROR );
2072 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
2073 }
2074
2075 break;
2076 #endif /* MBEDTLS_SSL_EARLY_DATA */
2077
2078 default:
2079 MBEDTLS_SSL_PRINT_EXT(
2080 3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2081 extension_type, "( ignored )" );
2082 break;
2083 }
2084
2085 p += extension_data_len;
2086 }
2087
2088 MBEDTLS_SSL_PRINT_EXTS( 3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2089 handshake->received_extensions );
2090
2091 /* Check that we consumed all the message. */
2092 if( p != end )
2093 {
2094 MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) );
2095 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
2096 MBEDTLS_ERR_SSL_DECODE_ERROR );
2097 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
2098 }
2099
2100 return( ret );
2101 }
2102
2103 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context * ssl)2104 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl )
2105 {
2106 int ret;
2107 unsigned char *buf;
2108 size_t buf_len;
2109
2110 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) );
2111
2112 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
2113 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2114 &buf, &buf_len ) );
2115
2116 /* Process the message contents */
2117 MBEDTLS_SSL_PROC_CHK(
2118 ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) );
2119
2120 #if defined(MBEDTLS_SSL_EARLY_DATA)
2121 if( ssl->handshake->received_extensions &
2122 MBEDTLS_SSL_EXT_MASK( EARLY_DATA ) )
2123 {
2124 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED;
2125 }
2126 #endif
2127
2128 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2129 buf, buf_len );
2130
2131 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2132 if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) )
2133 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
2134 else
2135 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
2136 #else
2137 ((void) ssl);
2138 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
2139 #endif
2140
2141 cleanup:
2142
2143 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) );
2144 return( ret );
2145
2146 }
2147
2148 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2149 /*
2150 * STATE HANDLING: CertificateRequest
2151 *
2152 */
2153 #define SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST 0
2154 #define SSL_CERTIFICATE_REQUEST_SKIP 1
2155 /* Coordination:
2156 * Deals with the ambiguity of not knowing if a CertificateRequest
2157 * will be sent. Returns a negative code on failure, or
2158 * - SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST
2159 * - SSL_CERTIFICATE_REQUEST_SKIP
2160 * indicating if a Certificate Request is expected or not.
2161 */
2162 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_certificate_request_coordinate(mbedtls_ssl_context * ssl)2163 static int ssl_tls13_certificate_request_coordinate( mbedtls_ssl_context *ssl )
2164 {
2165 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2166
2167 if( ( ret = mbedtls_ssl_read_record( ssl, 0 ) ) != 0 )
2168 {
2169 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2170 return( ret );
2171 }
2172 ssl->keep_current_message = 1;
2173
2174 if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) &&
2175 ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) )
2176 {
2177 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got a certificate request" ) );
2178 return( SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST );
2179 }
2180
2181 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got no certificate request" ) );
2182
2183 return( SSL_CERTIFICATE_REQUEST_SKIP );
2184 }
2185
2186 /*
2187 * ssl_tls13_parse_certificate_request()
2188 * Parse certificate request
2189 * struct {
2190 * opaque certificate_request_context<0..2^8-1>;
2191 * Extension extensions<2..2^16-1>;
2192 * } CertificateRequest;
2193 */
2194 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_certificate_request(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)2195 static int ssl_tls13_parse_certificate_request( mbedtls_ssl_context *ssl,
2196 const unsigned char *buf,
2197 const unsigned char *end )
2198 {
2199 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2200 const unsigned char *p = buf;
2201 size_t certificate_request_context_len = 0;
2202 size_t extensions_len = 0;
2203 const unsigned char *extensions_end;
2204 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2205
2206 /* ...
2207 * opaque certificate_request_context<0..2^8-1>
2208 * ...
2209 */
2210 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
2211 certificate_request_context_len = (size_t) p[0];
2212 p += 1;
2213
2214 if( certificate_request_context_len > 0 )
2215 {
2216 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, certificate_request_context_len );
2217 MBEDTLS_SSL_DEBUG_BUF( 3, "Certificate Request Context",
2218 p, certificate_request_context_len );
2219
2220 handshake->certificate_request_context =
2221 mbedtls_calloc( 1, certificate_request_context_len );
2222 if( handshake->certificate_request_context == NULL )
2223 {
2224 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2225 return ( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2226 }
2227 memcpy( handshake->certificate_request_context, p,
2228 certificate_request_context_len );
2229 p += certificate_request_context_len;
2230 }
2231
2232 /* ...
2233 * Extension extensions<2..2^16-1>;
2234 * ...
2235 */
2236 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
2237 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2238 p += 2;
2239
2240 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
2241 extensions_end = p + extensions_len;
2242
2243 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
2244
2245 while( p < extensions_end )
2246 {
2247 unsigned int extension_type;
2248 size_t extension_data_len;
2249
2250 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
2251 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
2252 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
2253 p += 4;
2254
2255 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
2256
2257 ret = mbedtls_ssl_tls13_check_received_extension(
2258 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, extension_type,
2259 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CR );
2260 if( ret != 0 )
2261 return( ret );
2262
2263 switch( extension_type )
2264 {
2265 case MBEDTLS_TLS_EXT_SIG_ALG:
2266 MBEDTLS_SSL_DEBUG_MSG( 3,
2267 ( "found signature algorithms extension" ) );
2268 ret = mbedtls_ssl_parse_sig_alg_ext( ssl, p,
2269 p + extension_data_len );
2270 if( ret != 0 )
2271 return( ret );
2272
2273 break;
2274
2275 default:
2276 MBEDTLS_SSL_PRINT_EXT(
2277 3, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2278 extension_type, "( ignored )" );
2279 break;
2280 }
2281
2282 p += extension_data_len;
2283 }
2284
2285 MBEDTLS_SSL_PRINT_EXTS( 3, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2286 handshake->received_extensions );
2287
2288 /* Check that we consumed all the message. */
2289 if( p != end )
2290 {
2291 MBEDTLS_SSL_DEBUG_MSG( 1,
2292 ( "CertificateRequest misaligned" ) );
2293 goto decode_error;
2294 }
2295
2296 /* RFC 8446 section 4.3.2
2297 *
2298 * The "signature_algorithms" extension MUST be specified
2299 */
2300 if( ( handshake->received_extensions & MBEDTLS_SSL_EXT_MASK( SIG_ALG ) ) == 0 )
2301 {
2302 MBEDTLS_SSL_DEBUG_MSG( 3,
2303 ( "no signature algorithms extension found" ) );
2304 goto decode_error;
2305 }
2306
2307 ssl->handshake->client_auth = 1;
2308 return( 0 );
2309
2310 decode_error:
2311 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
2312 MBEDTLS_ERR_SSL_DECODE_ERROR );
2313 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
2314 }
2315
2316 /*
2317 * Handler for MBEDTLS_SSL_CERTIFICATE_REQUEST
2318 */
2319 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_certificate_request(mbedtls_ssl_context * ssl)2320 static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl )
2321 {
2322 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2323
2324 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
2325
2326 MBEDTLS_SSL_PROC_CHK_NEG( ssl_tls13_certificate_request_coordinate( ssl ) );
2327
2328 if( ret == SSL_CERTIFICATE_REQUEST_EXPECT_REQUEST )
2329 {
2330 unsigned char *buf;
2331 size_t buf_len;
2332
2333 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
2334 MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2335 &buf, &buf_len ) );
2336
2337 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_certificate_request( ssl,
2338 buf, buf + buf_len ) );
2339
2340 mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2341 buf, buf_len );
2342 }
2343 else if( ret == SSL_CERTIFICATE_REQUEST_SKIP )
2344 {
2345 ret = 0;
2346 }
2347 else
2348 {
2349 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2350 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2351 goto cleanup;
2352 }
2353
2354 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
2355
2356 cleanup:
2357
2358 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
2359 return( ret );
2360 }
2361
2362 /*
2363 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
2364 */
2365 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_server_certificate(mbedtls_ssl_context * ssl)2366 static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl )
2367 {
2368 int ret;
2369
2370 ret = mbedtls_ssl_tls13_process_certificate( ssl );
2371 if( ret != 0 )
2372 return( ret );
2373
2374 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
2375 return( 0 );
2376 }
2377
2378 /*
2379 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
2380 */
2381 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_certificate_verify(mbedtls_ssl_context * ssl)2382 static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl )
2383 {
2384 int ret;
2385
2386 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
2387 if( ret != 0 )
2388 return( ret );
2389
2390 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
2391 return( 0 );
2392 }
2393 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2394
2395 /*
2396 * Handler for MBEDTLS_SSL_SERVER_FINISHED
2397 */
2398 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_server_finished(mbedtls_ssl_context * ssl)2399 static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
2400 {
2401 int ret;
2402
2403 ret = mbedtls_ssl_tls13_process_finished_message( ssl );
2404 if( ret != 0 )
2405 return( ret );
2406
2407 ret = mbedtls_ssl_tls13_compute_application_transform( ssl );
2408 if( ret != 0 )
2409 {
2410 MBEDTLS_SSL_PEND_FATAL_ALERT(
2411 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2412 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
2413 return( ret );
2414 }
2415
2416 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2417 mbedtls_ssl_handshake_set_state(
2418 ssl,
2419 MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
2420 #else
2421 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE );
2422 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
2423
2424 return( 0 );
2425 }
2426
2427 /*
2428 * Handler for MBEDTLS_SSL_CLIENT_CERTIFICATE
2429 */
2430 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_client_certificate(mbedtls_ssl_context * ssl)2431 static int ssl_tls13_write_client_certificate( mbedtls_ssl_context *ssl )
2432 {
2433 int non_empty_certificate_msg = 0;
2434
2435 MBEDTLS_SSL_DEBUG_MSG( 1,
2436 ( "Switch to handshake traffic keys for outbound traffic" ) );
2437 mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
2438
2439 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2440 if( ssl->handshake->client_auth )
2441 {
2442 int ret = mbedtls_ssl_tls13_write_certificate( ssl );
2443 if( ret != 0 )
2444 return( ret );
2445
2446 if( mbedtls_ssl_own_cert( ssl ) != NULL )
2447 non_empty_certificate_msg = 1;
2448 }
2449 else
2450 {
2451 MBEDTLS_SSL_DEBUG_MSG( 2, ( "skip write certificate" ) );
2452 }
2453 #endif
2454
2455 if( non_empty_certificate_msg )
2456 {
2457 mbedtls_ssl_handshake_set_state( ssl,
2458 MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY );
2459 }
2460 else
2461 {
2462 MBEDTLS_SSL_DEBUG_MSG( 2, ( "skip write certificate verify" ) );
2463 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
2464 }
2465
2466 return( 0 );
2467 }
2468
2469 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2470 /*
2471 * Handler for MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY
2472 */
2473 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_client_certificate_verify(mbedtls_ssl_context * ssl)2474 static int ssl_tls13_write_client_certificate_verify( mbedtls_ssl_context *ssl )
2475 {
2476 int ret = mbedtls_ssl_tls13_write_certificate_verify( ssl );
2477
2478 if( ret == 0 )
2479 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
2480
2481 return( ret );
2482 }
2483 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2484
2485 /*
2486 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
2487 */
2488 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_client_finished(mbedtls_ssl_context * ssl)2489 static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
2490 {
2491 int ret;
2492
2493 ret = mbedtls_ssl_tls13_write_finished_message( ssl );
2494 if( ret != 0 )
2495 return( ret );
2496
2497 ret = mbedtls_ssl_tls13_compute_resumption_master_secret( ssl );
2498 if( ret != 0 )
2499 {
2500 MBEDTLS_SSL_DEBUG_RET( 1,
2501 "mbedtls_ssl_tls13_compute_resumption_master_secret ", ret );
2502 return ( ret );
2503 }
2504
2505 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS );
2506 return( 0 );
2507 }
2508
2509 /*
2510 * Handler for MBEDTLS_SSL_FLUSH_BUFFERS
2511 */
2512 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_flush_buffers(mbedtls_ssl_context * ssl)2513 static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
2514 {
2515 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
2516 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
2517 return( 0 );
2518 }
2519
2520 /*
2521 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
2522 */
2523 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)2524 static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
2525 {
2526
2527 mbedtls_ssl_tls13_handshake_wrapup( ssl );
2528
2529 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
2530 return( 0 );
2531 }
2532
2533 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2534
2535 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_new_session_ticket_exts(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)2536 static int ssl_tls13_parse_new_session_ticket_exts( mbedtls_ssl_context *ssl,
2537 const unsigned char *buf,
2538 const unsigned char *end )
2539 {
2540 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2541 const unsigned char *p = buf;
2542
2543
2544 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
2545
2546 while( p < end )
2547 {
2548 unsigned int extension_type;
2549 size_t extension_data_len;
2550 int ret;
2551
2552 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 );
2553 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
2554 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
2555 p += 4;
2556
2557 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extension_data_len );
2558
2559 ret = mbedtls_ssl_tls13_check_received_extension(
2560 ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, extension_type,
2561 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_NST );
2562 if( ret != 0 )
2563 return( ret );
2564
2565 switch( extension_type )
2566 {
2567 #if defined(MBEDTLS_SSL_EARLY_DATA)
2568 case MBEDTLS_TLS_EXT_EARLY_DATA:
2569 if( extension_data_len != 4 )
2570 {
2571 MBEDTLS_SSL_PEND_FATAL_ALERT(
2572 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
2573 MBEDTLS_ERR_SSL_DECODE_ERROR );
2574 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
2575 }
2576 if( ssl->session != NULL )
2577 {
2578 ssl->session->ticket_flags |=
2579 MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA;
2580 }
2581 break;
2582 #endif /* MBEDTLS_SSL_EARLY_DATA */
2583
2584 default:
2585 MBEDTLS_SSL_PRINT_EXT(
2586 3, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
2587 extension_type, "( ignored )" );
2588 break;
2589 }
2590
2591 p += extension_data_len;
2592 }
2593
2594 MBEDTLS_SSL_PRINT_EXTS( 3, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
2595 handshake->received_extensions );
2596
2597 return( 0 );
2598 }
2599
2600 /*
2601 * From RFC8446, page 74
2602 *
2603 * struct {
2604 * uint32 ticket_lifetime;
2605 * uint32 ticket_age_add;
2606 * opaque ticket_nonce<0..255>;
2607 * opaque ticket<1..2^16-1>;
2608 * Extension extensions<0..2^16-2>;
2609 * } NewSessionTicket;
2610 *
2611 */
2612 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_new_session_ticket(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,unsigned char ** ticket_nonce,size_t * ticket_nonce_len)2613 static int ssl_tls13_parse_new_session_ticket( mbedtls_ssl_context *ssl,
2614 unsigned char *buf,
2615 unsigned char *end,
2616 unsigned char **ticket_nonce,
2617 size_t *ticket_nonce_len )
2618 {
2619 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2620 unsigned char *p = buf;
2621 mbedtls_ssl_session *session = ssl->session;
2622 size_t ticket_len;
2623 unsigned char *ticket;
2624 size_t extensions_len;
2625
2626 *ticket_nonce = NULL;
2627 *ticket_nonce_len = 0;
2628 /*
2629 * ticket_lifetime 4 bytes
2630 * ticket_age_add 4 bytes
2631 * ticket_nonce_len 1 byte
2632 */
2633 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 9 );
2634
2635 session->ticket_lifetime = MBEDTLS_GET_UINT32_BE( p, 0 );
2636 MBEDTLS_SSL_DEBUG_MSG( 3,
2637 ( "ticket_lifetime: %u",
2638 ( unsigned int )session->ticket_lifetime ) );
2639
2640 session->ticket_age_add = MBEDTLS_GET_UINT32_BE( p, 4 );
2641 MBEDTLS_SSL_DEBUG_MSG( 3,
2642 ( "ticket_age_add: %u",
2643 ( unsigned int )session->ticket_age_add ) );
2644
2645 *ticket_nonce_len = p[8];
2646 p += 9;
2647
2648 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, *ticket_nonce_len );
2649 *ticket_nonce = p;
2650 MBEDTLS_SSL_DEBUG_BUF( 3, "ticket_nonce:", *ticket_nonce, *ticket_nonce_len );
2651 p += *ticket_nonce_len;
2652
2653 /* Ticket */
2654 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
2655 ticket_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2656 p += 2;
2657 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, ticket_len );
2658 MBEDTLS_SSL_DEBUG_BUF( 3, "received ticket", p, ticket_len ) ;
2659
2660 /* Check if we previously received a ticket already. */
2661 if( session->ticket != NULL || session->ticket_len > 0 )
2662 {
2663 mbedtls_free( session->ticket );
2664 session->ticket = NULL;
2665 session->ticket_len = 0;
2666 }
2667
2668 if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
2669 {
2670 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
2671 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2672 }
2673 memcpy( ticket, p, ticket_len );
2674 p += ticket_len;
2675 session->ticket = ticket;
2676 session->ticket_len = ticket_len;
2677
2678 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
2679 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
2680 p += 2;
2681 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
2682
2683 MBEDTLS_SSL_DEBUG_BUF( 3, "ticket extension", p, extensions_len );
2684
2685 ret = ssl_tls13_parse_new_session_ticket_exts( ssl, p, p + extensions_len );
2686 if( ret != 0 )
2687 {
2688 MBEDTLS_SSL_DEBUG_RET( 1,
2689 "ssl_tls13_parse_new_session_ticket_exts",
2690 ret );
2691 return( ret );
2692 }
2693
2694 /* session has been updated, allow export */
2695 session->exported = 0;
2696
2697 return( 0 );
2698 }
2699
2700 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_postprocess_new_session_ticket(mbedtls_ssl_context * ssl,unsigned char * ticket_nonce,size_t ticket_nonce_len)2701 static int ssl_tls13_postprocess_new_session_ticket( mbedtls_ssl_context *ssl,
2702 unsigned char *ticket_nonce,
2703 size_t ticket_nonce_len )
2704 {
2705 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2706 mbedtls_ssl_session *session = ssl->session;
2707 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
2708 psa_algorithm_t psa_hash_alg;
2709 int hash_length;
2710
2711 #if defined(MBEDTLS_HAVE_TIME)
2712 /* Store ticket creation time */
2713 session->ticket_received = mbedtls_time( NULL );
2714 #endif
2715
2716 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( session->ciphersuite );
2717 if( ciphersuite_info == NULL )
2718 {
2719 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2720 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2721 }
2722
2723 psa_hash_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
2724 hash_length = PSA_HASH_LENGTH( psa_hash_alg );
2725 if( hash_length == -1 ||
2726 ( size_t )hash_length > sizeof( session->resumption_key ) )
2727 {
2728 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2729 }
2730
2731
2732 MBEDTLS_SSL_DEBUG_BUF( 3, "resumption_master_secret",
2733 session->app_secrets.resumption_master_secret,
2734 hash_length );
2735
2736 /* Compute resumption key
2737 *
2738 * HKDF-Expand-Label( resumption_master_secret,
2739 * "resumption", ticket_nonce, Hash.length )
2740 */
2741 ret = mbedtls_ssl_tls13_hkdf_expand_label(
2742 psa_hash_alg,
2743 session->app_secrets.resumption_master_secret,
2744 hash_length,
2745 MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN( resumption ),
2746 ticket_nonce,
2747 ticket_nonce_len,
2748 session->resumption_key,
2749 hash_length );
2750
2751 if( ret != 0 )
2752 {
2753 MBEDTLS_SSL_DEBUG_RET( 2,
2754 "Creating the ticket-resumed PSK failed",
2755 ret );
2756 return( ret );
2757 }
2758
2759 session->resumption_key_len = hash_length;
2760
2761 MBEDTLS_SSL_DEBUG_BUF( 3, "Ticket-resumed PSK",
2762 session->resumption_key,
2763 session->resumption_key_len );
2764
2765 return( 0 );
2766 }
2767
2768 /*
2769 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
2770 */
2771 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_new_session_ticket(mbedtls_ssl_context * ssl)2772 static int ssl_tls13_process_new_session_ticket( mbedtls_ssl_context *ssl )
2773 {
2774 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2775 unsigned char *buf;
2776 size_t buf_len;
2777 unsigned char *ticket_nonce;
2778 size_t ticket_nonce_len;
2779
2780 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
2781
2782 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg(
2783 ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
2784 &buf, &buf_len ) );
2785
2786 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_new_session_ticket(
2787 ssl, buf, buf + buf_len,
2788 &ticket_nonce, &ticket_nonce_len ) );
2789
2790 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_new_session_ticket(
2791 ssl, ticket_nonce, ticket_nonce_len ) );
2792
2793 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
2794
2795 cleanup:
2796
2797 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
2798 return( ret );
2799 }
2800 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
2801
mbedtls_ssl_tls13_handshake_client_step(mbedtls_ssl_context * ssl)2802 int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
2803 {
2804 int ret = 0;
2805
2806 switch( ssl->state )
2807 {
2808 /*
2809 * ssl->state is initialized as HELLO_REQUEST. It is the same
2810 * as CLIENT_HELLO state.
2811 */
2812 case MBEDTLS_SSL_HELLO_REQUEST:
2813 case MBEDTLS_SSL_CLIENT_HELLO:
2814 ret = mbedtls_ssl_write_client_hello( ssl );
2815 break;
2816
2817 case MBEDTLS_SSL_SERVER_HELLO:
2818 ret = ssl_tls13_process_server_hello( ssl );
2819 break;
2820
2821 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
2822 ret = ssl_tls13_process_encrypted_extensions( ssl );
2823 break;
2824
2825 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2826 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
2827 ret = ssl_tls13_process_certificate_request( ssl );
2828 break;
2829
2830 case MBEDTLS_SSL_SERVER_CERTIFICATE:
2831 ret = ssl_tls13_process_server_certificate( ssl );
2832 break;
2833
2834 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
2835 ret = ssl_tls13_process_certificate_verify( ssl );
2836 break;
2837 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2838
2839 case MBEDTLS_SSL_SERVER_FINISHED:
2840 ret = ssl_tls13_process_server_finished( ssl );
2841 break;
2842
2843 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
2844 ret = ssl_tls13_write_client_certificate( ssl );
2845 break;
2846
2847 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2848 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
2849 ret = ssl_tls13_write_client_certificate_verify( ssl );
2850 break;
2851 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2852
2853 case MBEDTLS_SSL_CLIENT_FINISHED:
2854 ret = ssl_tls13_write_client_finished( ssl );
2855 break;
2856
2857 case MBEDTLS_SSL_FLUSH_BUFFERS:
2858 ret = ssl_tls13_flush_buffers( ssl );
2859 break;
2860
2861 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
2862 ret = ssl_tls13_handshake_wrapup( ssl );
2863 break;
2864
2865 /*
2866 * Injection of dummy-CCS's for middlebox compatibility
2867 */
2868 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2869 case MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO:
2870 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
2871 if( ret == 0 )
2872 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO );
2873 break;
2874
2875 case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
2876 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
2877 if( ret == 0 )
2878 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE );
2879 break;
2880 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
2881
2882 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2883 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET:
2884 ret = ssl_tls13_process_new_session_ticket( ssl );
2885 if( ret != 0 )
2886 break;
2887 ret = MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET;
2888 break;
2889 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
2890
2891 default:
2892 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
2893 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2894 }
2895
2896 return( ret );
2897 }
2898
2899 #endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_PROTO_TLS1_3 */
2900
2901
2902
