1 /*
2 * TLS 1.3 functionality shared between client and server
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19
20 #include "common.h"
21
22 #if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
23
24 #include <string.h>
25
26 #include "mbedtls/error.h"
27 #include "mbedtls/debug.h"
28 #include "mbedtls/oid.h"
29 #include "mbedtls/platform.h"
30 #include "mbedtls/constant_time.h"
31 #include "psa/crypto.h"
32 #include "mbedtls/psa_util.h"
33
34 #include "ssl_misc.h"
35 #include "ssl_tls13_invasive.h"
36 #include "ssl_tls13_keys.h"
37 #include "ssl_debug_helpers.h"
38
39 #include "psa/crypto.h"
40 #include "mbedtls/psa_util.h"
41
42 #define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
43 psa_to_ssl_errors, \
44 psa_generic_status_to_mbedtls)
45
46 const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[
47 MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
48 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
49 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
50 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
51 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C };
52
mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context * ssl,unsigned hs_type,unsigned char ** buf,size_t * buf_len)53 int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
54 unsigned hs_type,
55 unsigned char **buf,
56 size_t *buf_len)
57 {
58 int ret;
59
60 if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) {
61 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
62 goto cleanup;
63 }
64
65 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
66 ssl->in_msg[0] != hs_type) {
67 MBEDTLS_SSL_DEBUG_MSG(1, ("Receive unexpected handshake message."));
68 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
69 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
70 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
71 goto cleanup;
72 }
73
74 /*
75 * Jump handshake header (4 bytes, see Section 4 of RFC 8446).
76 * ...
77 * HandshakeType msg_type;
78 * uint24 length;
79 * ...
80 */
81 *buf = ssl->in_msg + 4;
82 *buf_len = ssl->in_hslen - 4;
83
84 cleanup:
85
86 return ret;
87 }
88
89 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
90 /*
91 * STATE HANDLING: Read CertificateVerify
92 */
93 /* Macro to express the maximum length of the verify structure.
94 *
95 * The structure is computed per TLS 1.3 specification as:
96 * - 64 bytes of octet 32,
97 * - 33 bytes for the context string
98 * (which is either "TLS 1.3, client CertificateVerify"
99 * or "TLS 1.3, server CertificateVerify"),
100 * - 1 byte for the octet 0x0, which serves as a separator,
101 * - 32 or 48 bytes for the Transcript-Hash(Handshake Context, Certificate)
102 * (depending on the size of the transcript_hash)
103 *
104 * This results in a total size of
105 * - 130 bytes for a SHA256-based transcript hash, or
106 * (64 + 33 + 1 + 32 bytes)
107 * - 146 bytes for a SHA384-based transcript hash.
108 * (64 + 33 + 1 + 48 bytes)
109 *
110 */
111 #define SSL_VERIFY_STRUCT_MAX_SIZE (64 + \
112 33 + \
113 1 + \
114 MBEDTLS_TLS1_3_MD_MAX_SIZE \
115 )
116
117 /*
118 * The ssl_tls13_create_verify_structure() creates the verify structure.
119 * As input, it requires the transcript hash.
120 *
121 * The caller has to ensure that the buffer has size at least
122 * SSL_VERIFY_STRUCT_MAX_SIZE bytes.
123 */
ssl_tls13_create_verify_structure(const unsigned char * transcript_hash,size_t transcript_hash_len,unsigned char * verify_buffer,size_t * verify_buffer_len,int from)124 static void ssl_tls13_create_verify_structure(const unsigned char *transcript_hash,
125 size_t transcript_hash_len,
126 unsigned char *verify_buffer,
127 size_t *verify_buffer_len,
128 int from)
129 {
130 size_t idx;
131
132 /* RFC 8446, Section 4.4.3:
133 *
134 * The digital signature [in the CertificateVerify message] is then
135 * computed over the concatenation of:
136 * - A string that consists of octet 32 (0x20) repeated 64 times
137 * - The context string
138 * - A single 0 byte which serves as the separator
139 * - The content to be signed
140 */
141 memset(verify_buffer, 0x20, 64);
142 idx = 64;
143
144 if (from == MBEDTLS_SSL_IS_CLIENT) {
145 memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(client_cv));
146 idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(client_cv);
147 } else { /* from == MBEDTLS_SSL_IS_SERVER */
148 memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(server_cv));
149 idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(server_cv);
150 }
151
152 verify_buffer[idx++] = 0x0;
153
154 memcpy(verify_buffer + idx, transcript_hash, transcript_hash_len);
155 idx += transcript_hash_len;
156
157 *verify_buffer_len = idx;
158 }
159
160 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_certificate_verify(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end,const unsigned char * verify_buffer,size_t verify_buffer_len)161 static int ssl_tls13_parse_certificate_verify(mbedtls_ssl_context *ssl,
162 const unsigned char *buf,
163 const unsigned char *end,
164 const unsigned char *verify_buffer,
165 size_t verify_buffer_len)
166 {
167 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
168 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
169 const unsigned char *p = buf;
170 uint16_t algorithm;
171 size_t signature_len;
172 mbedtls_pk_type_t sig_alg;
173 mbedtls_md_type_t md_alg;
174 psa_algorithm_t hash_alg = PSA_ALG_NONE;
175 unsigned char verify_hash[PSA_HASH_MAX_SIZE];
176 size_t verify_hash_len;
177
178 void const *options = NULL;
179 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
180 mbedtls_pk_rsassa_pss_options rsassa_pss_options;
181 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
182
183 /*
184 * struct {
185 * SignatureScheme algorithm;
186 * opaque signature<0..2^16-1>;
187 * } CertificateVerify;
188 */
189 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
190 algorithm = MBEDTLS_GET_UINT16_BE(p, 0);
191 p += 2;
192
193 /* RFC 8446 section 4.4.3
194 *
195 * If the CertificateVerify message is sent by a server, the signature algorithm
196 * MUST be one offered in the client's "signature_algorithms" extension unless
197 * no valid certificate chain can be produced without unsupported algorithms
198 *
199 * RFC 8446 section 4.4.2.2
200 *
201 * If the client cannot construct an acceptable chain using the provided
202 * certificates and decides to abort the handshake, then it MUST abort the handshake
203 * with an appropriate certificate-related alert (by default, "unsupported_certificate").
204 *
205 * Check if algorithm is an offered signature algorithm.
206 */
207 if (!mbedtls_ssl_sig_alg_is_offered(ssl, algorithm)) {
208 /* algorithm not in offered signature algorithms list */
209 MBEDTLS_SSL_DEBUG_MSG(1, ("Received signature algorithm(%04x) is not "
210 "offered.",
211 (unsigned int) algorithm));
212 goto error;
213 }
214
215 if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(
216 algorithm, &sig_alg, &md_alg) != 0) {
217 goto error;
218 }
219
220 hash_alg = mbedtls_hash_info_psa_from_md(md_alg);
221 if (hash_alg == 0) {
222 goto error;
223 }
224
225 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate Verify: Signature algorithm ( %04x )",
226 (unsigned int) algorithm));
227
228 /*
229 * Check the certificate's key type matches the signature alg
230 */
231 if (!mbedtls_pk_can_do(&ssl->session_negotiate->peer_cert->pk, sig_alg)) {
232 MBEDTLS_SSL_DEBUG_MSG(1, ("signature algorithm doesn't match cert key"));
233 goto error;
234 }
235
236 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
237 signature_len = MBEDTLS_GET_UINT16_BE(p, 0);
238 p += 2;
239 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, signature_len);
240
241 status = psa_hash_compute(hash_alg,
242 verify_buffer,
243 verify_buffer_len,
244 verify_hash,
245 sizeof(verify_hash),
246 &verify_hash_len);
247 if (status != PSA_SUCCESS) {
248 MBEDTLS_SSL_DEBUG_RET(1, "hash computation PSA error", status);
249 goto error;
250 }
251
252 MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len);
253 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
254 if (sig_alg == MBEDTLS_PK_RSASSA_PSS) {
255 rsassa_pss_options.mgf1_hash_id = md_alg;
256
257 rsassa_pss_options.expected_salt_len = PSA_HASH_LENGTH(hash_alg);
258 options = (const void *) &rsassa_pss_options;
259 }
260 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
261
262 if ((ret = mbedtls_pk_verify_ext(sig_alg, options,
263 &ssl->session_negotiate->peer_cert->pk,
264 md_alg, verify_hash, verify_hash_len,
265 p, signature_len)) == 0) {
266 return 0;
267 }
268 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify_ext", ret);
269
270 error:
271 /* RFC 8446 section 4.4.3
272 *
273 * If the verification fails, the receiver MUST terminate the handshake
274 * with a "decrypt_error" alert.
275 */
276 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
277 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
278 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
279
280 }
281 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
282
mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context * ssl)283 int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl)
284 {
285
286 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
287 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
288 unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE];
289 size_t verify_buffer_len;
290 unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE];
291 size_t transcript_len;
292 unsigned char *buf;
293 size_t buf_len;
294
295 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify"));
296
297 MBEDTLS_SSL_PROC_CHK(
298 mbedtls_ssl_tls13_fetch_handshake_msg(ssl,
299 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, &buf_len));
300
301 /* Need to calculate the hash of the transcript first
302 * before reading the message since otherwise it gets
303 * included in the transcript
304 */
305 ret = mbedtls_ssl_get_handshake_transcript(ssl,
306 ssl->handshake->ciphersuite_info->mac,
307 transcript, sizeof(transcript),
308 &transcript_len);
309 if (ret != 0) {
310 MBEDTLS_SSL_PEND_FATAL_ALERT(
311 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR,
312 MBEDTLS_ERR_SSL_INTERNAL_ERROR);
313 return ret;
314 }
315
316 MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash", transcript, transcript_len);
317
318 /* Create verify structure */
319 ssl_tls13_create_verify_structure(transcript,
320 transcript_len,
321 verify_buffer,
322 &verify_buffer_len,
323 (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) ?
324 MBEDTLS_SSL_IS_SERVER :
325 MBEDTLS_SSL_IS_CLIENT);
326
327 /* Process the message contents */
328 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_verify(ssl, buf,
329 buf + buf_len, verify_buffer,
330 verify_buffer_len));
331
332 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
333 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY,
334 buf, buf_len));
335
336 cleanup:
337
338 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify"));
339 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_process_certificate_verify", ret);
340 return ret;
341 #else
342 ((void) ssl);
343 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
344 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
345 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
346 }
347
348 /*
349 *
350 * STATE HANDLING: Incoming Certificate.
351 *
352 */
353
354 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
355 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
356 /*
357 * Structure of Certificate message:
358 *
359 * enum {
360 * X509(0),
361 * RawPublicKey(2),
362 * (255)
363 * } CertificateType;
364 *
365 * struct {
366 * select (certificate_type) {
367 * case RawPublicKey:
368 * * From RFC 7250 ASN.1_subjectPublicKeyInfo *
369 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
370 * case X509:
371 * opaque cert_data<1..2^24-1>;
372 * };
373 * Extension extensions<0..2^16-1>;
374 * } CertificateEntry;
375 *
376 * struct {
377 * opaque certificate_request_context<0..2^8-1>;
378 * CertificateEntry certificate_list<0..2^24-1>;
379 * } Certificate;
380 *
381 */
382
383 /* Parse certificate chain send by the server. */
384 MBEDTLS_CHECK_RETURN_CRITICAL
385 MBEDTLS_STATIC_TESTABLE
mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)386 int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl,
387 const unsigned char *buf,
388 const unsigned char *end)
389 {
390 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
391 size_t certificate_request_context_len = 0;
392 size_t certificate_list_len = 0;
393 const unsigned char *p = buf;
394 const unsigned char *certificate_list_end;
395 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
396
397 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4);
398 certificate_request_context_len = p[0];
399 certificate_list_len = MBEDTLS_GET_UINT24_BE(p, 1);
400 p += 4;
401
402 /* In theory, the certificate list can be up to 2^24 Bytes, but we don't
403 * support anything beyond 2^16 = 64K.
404 */
405 if ((certificate_request_context_len != 0) ||
406 (certificate_list_len >= 0x10000)) {
407 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
408 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
409 MBEDTLS_ERR_SSL_DECODE_ERROR);
410 return MBEDTLS_ERR_SSL_DECODE_ERROR;
411 }
412
413 /* In case we tried to reuse a session but it failed */
414 if (ssl->session_negotiate->peer_cert != NULL) {
415 mbedtls_x509_crt_free(ssl->session_negotiate->peer_cert);
416 mbedtls_free(ssl->session_negotiate->peer_cert);
417 }
418
419 if (certificate_list_len == 0) {
420 ssl->session_negotiate->peer_cert = NULL;
421 ret = 0;
422 goto exit;
423 }
424
425 if ((ssl->session_negotiate->peer_cert =
426 mbedtls_calloc(1, sizeof(mbedtls_x509_crt))) == NULL) {
427 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc( %" MBEDTLS_PRINTF_SIZET " bytes ) failed",
428 sizeof(mbedtls_x509_crt)));
429 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR,
430 MBEDTLS_ERR_SSL_ALLOC_FAILED);
431 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
432 }
433
434 mbedtls_x509_crt_init(ssl->session_negotiate->peer_cert);
435
436 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, certificate_list_len);
437 certificate_list_end = p + certificate_list_len;
438 while (p < certificate_list_end) {
439 size_t cert_data_len, extensions_len;
440 const unsigned char *extensions_end;
441
442 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 3);
443 cert_data_len = MBEDTLS_GET_UINT24_BE(p, 0);
444 p += 3;
445
446 /* In theory, the CRT can be up to 2^24 Bytes, but we don't support
447 * anything beyond 2^16 = 64K. Otherwise as in the TLS 1.2 code,
448 * check that we have a minimum of 128 bytes of data, this is not
449 * clear why we need that though.
450 */
451 if ((cert_data_len < 128) || (cert_data_len >= 0x10000)) {
452 MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message"));
453 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
454 MBEDTLS_ERR_SSL_DECODE_ERROR);
455 return MBEDTLS_ERR_SSL_DECODE_ERROR;
456 }
457
458 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, cert_data_len);
459 ret = mbedtls_x509_crt_parse_der(ssl->session_negotiate->peer_cert,
460 p, cert_data_len);
461
462 switch (ret) {
463 case 0: /*ok*/
464 break;
465 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
466 /* Ignore certificate with an unknown algorithm: maybe a
467 prior certificate was already trusted. */
468 break;
469
470 case MBEDTLS_ERR_X509_ALLOC_FAILED:
471 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR,
472 MBEDTLS_ERR_X509_ALLOC_FAILED);
473 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
474 return ret;
475
476 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
477 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT,
478 MBEDTLS_ERR_X509_UNKNOWN_VERSION);
479 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
480 return ret;
481
482 default:
483 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT,
484 ret);
485 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
486 return ret;
487 }
488
489 p += cert_data_len;
490
491 /* Certificate extensions length */
492 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 2);
493 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
494 p += 2;
495 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, extensions_len);
496
497 extensions_end = p + extensions_len;
498 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
499
500 while (p < extensions_end) {
501 unsigned int extension_type;
502 size_t extension_data_len;
503
504 /*
505 * struct {
506 * ExtensionType extension_type; (2 bytes)
507 * opaque extension_data<0..2^16-1>;
508 * } Extension;
509 */
510 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
511 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
512 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
513 p += 4;
514
515 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
516
517 ret = mbedtls_ssl_tls13_check_received_extension(
518 ssl, MBEDTLS_SSL_HS_CERTIFICATE, extension_type,
519 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CT);
520 if (ret != 0) {
521 return ret;
522 }
523
524 switch (extension_type) {
525 default:
526 MBEDTLS_SSL_PRINT_EXT(
527 3, MBEDTLS_SSL_HS_CERTIFICATE,
528 extension_type, "( ignored )");
529 break;
530 }
531
532 p += extension_data_len;
533 }
534
535 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CERTIFICATE,
536 handshake->received_extensions);
537 }
538
539 exit:
540 /* Check that all the message is consumed. */
541 if (p != end) {
542 MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message"));
543 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
544 MBEDTLS_ERR_SSL_DECODE_ERROR);
545 return MBEDTLS_ERR_SSL_DECODE_ERROR;
546 }
547
548 MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate", ssl->session_negotiate->peer_cert);
549
550 return ret;
551 }
552 #else
553 MBEDTLS_CHECK_RETURN_CRITICAL
554 MBEDTLS_STATIC_TESTABLE
mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)555 int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl,
556 const unsigned char *buf,
557 const unsigned char *end)
558 {
559 ((void) ssl);
560 ((void) buf);
561 ((void) end);
562 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
563 }
564 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
565 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
566
567 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
568 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
569 /* Validate certificate chain sent by the server. */
570 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_validate_certificate(mbedtls_ssl_context * ssl)571 static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl)
572 {
573 int ret = 0;
574 int authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
575 mbedtls_x509_crt *ca_chain;
576 mbedtls_x509_crl *ca_crl;
577 const char *ext_oid;
578 size_t ext_len;
579 uint32_t verify_result = 0;
580
581 /* If SNI was used, overwrite authentication mode
582 * from the configuration. */
583 #if defined(MBEDTLS_SSL_SRV_C)
584 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
585 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
586 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
587 authmode = ssl->handshake->sni_authmode;
588 } else
589 #endif
590 authmode = ssl->conf->authmode;
591 }
592 #endif
593
594 /*
595 * If the peer hasn't sent a certificate ( i.e. it sent
596 * an empty certificate chain ), this is reflected in the peer CRT
597 * structure being unset.
598 * Check for that and handle it depending on the
599 * authentication mode.
600 */
601 if (ssl->session_negotiate->peer_cert == NULL) {
602 MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate"));
603
604 #if defined(MBEDTLS_SSL_SRV_C)
605 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
606 /* The client was asked for a certificate but didn't send
607 * one. The client should know what's going on, so we
608 * don't send an alert.
609 */
610 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
611 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) {
612 return 0;
613 } else {
614 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_NO_CERT,
615 MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE);
616 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
617 }
618 }
619 #endif /* MBEDTLS_SSL_SRV_C */
620
621 #if defined(MBEDTLS_SSL_CLI_C)
622 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
623 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_NO_CERT,
624 MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE);
625 return MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE;
626 }
627 #endif /* MBEDTLS_SSL_CLI_C */
628 }
629
630 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
631 if (ssl->handshake->sni_ca_chain != NULL) {
632 ca_chain = ssl->handshake->sni_ca_chain;
633 ca_crl = ssl->handshake->sni_ca_crl;
634 } else
635 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
636 {
637 ca_chain = ssl->conf->ca_chain;
638 ca_crl = ssl->conf->ca_crl;
639 }
640
641 /*
642 * Main check: verify certificate
643 */
644 ret = mbedtls_x509_crt_verify_with_profile(
645 ssl->session_negotiate->peer_cert,
646 ca_chain, ca_crl,
647 ssl->conf->cert_profile,
648 ssl->hostname,
649 &verify_result,
650 ssl->conf->f_vrfy, ssl->conf->p_vrfy);
651
652 if (ret != 0) {
653 MBEDTLS_SSL_DEBUG_RET(1, "x509_verify_cert", ret);
654 }
655
656 /*
657 * Secondary checks: always done, but change 'ret' only if it was 0
658 */
659 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
660 ext_oid = MBEDTLS_OID_SERVER_AUTH;
661 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH);
662 } else {
663 ext_oid = MBEDTLS_OID_CLIENT_AUTH;
664 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_CLIENT_AUTH);
665 }
666
667 if ((mbedtls_x509_crt_check_key_usage(
668 ssl->session_negotiate->peer_cert,
669 MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0) ||
670 (mbedtls_x509_crt_check_extended_key_usage(
671 ssl->session_negotiate->peer_cert,
672 ext_oid, ext_len) != 0)) {
673 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)"));
674 if (ret == 0) {
675 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE;
676 }
677 }
678
679 /* mbedtls_x509_crt_verify_with_profile is supposed to report a
680 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED,
681 * with details encoded in the verification flags. All other kinds
682 * of error codes, including those from the user provided f_vrfy
683 * functions, are treated as fatal and lead to a failure of
684 * mbedtls_ssl_tls13_parse_certificate even if verification was optional.
685 */
686 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL &&
687 (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED ||
688 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE)) {
689 ret = 0;
690 }
691
692 if (ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) {
693 MBEDTLS_SSL_DEBUG_MSG(1, ("got no CA chain"));
694 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED;
695 }
696
697 if (ret != 0) {
698 /* The certificate may have been rejected for several reasons.
699 Pick one and send the corresponding alert. Which alert to send
700 may be a subject of debate in some cases. */
701 if (verify_result & MBEDTLS_X509_BADCERT_OTHER) {
702 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED, ret);
703 } else if (verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) {
704 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT, ret);
705 } else if (verify_result & (MBEDTLS_X509_BADCERT_KEY_USAGE |
706 MBEDTLS_X509_BADCERT_EXT_KEY_USAGE |
707 MBEDTLS_X509_BADCERT_NS_CERT_TYPE |
708 MBEDTLS_X509_BADCERT_BAD_PK |
709 MBEDTLS_X509_BADCERT_BAD_KEY)) {
710 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT, ret);
711 } else if (verify_result & MBEDTLS_X509_BADCERT_EXPIRED) {
712 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED, ret);
713 } else if (verify_result & MBEDTLS_X509_BADCERT_REVOKED) {
714 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED, ret);
715 } else if (verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
716 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA, ret);
717 } else {
718 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN, ret);
719 }
720 }
721
722 #if defined(MBEDTLS_DEBUG_C)
723 if (verify_result != 0) {
724 MBEDTLS_SSL_DEBUG_MSG(3, ("! Certificate verification flags %08x",
725 (unsigned int) verify_result));
726 } else {
727 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate verification flags clear"));
728 }
729 #endif /* MBEDTLS_DEBUG_C */
730
731 ssl->session_negotiate->verify_result = verify_result;
732 return ret;
733 }
734 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
735 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_validate_certificate(mbedtls_ssl_context * ssl)736 static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl)
737 {
738 ((void) ssl);
739 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
740 }
741 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
742 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
743
mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context * ssl)744 int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl)
745 {
746 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
747 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
748
749 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
750 unsigned char *buf;
751 size_t buf_len;
752
753 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
754 ssl, MBEDTLS_SSL_HS_CERTIFICATE,
755 &buf, &buf_len));
756
757 /* Parse the certificate chain sent by the peer. */
758 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_parse_certificate(ssl, buf,
759 buf + buf_len));
760 /* Validate the certificate chain and set the verification results. */
761 MBEDTLS_SSL_PROC_CHK(ssl_tls13_validate_certificate(ssl));
762
763 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
764 MBEDTLS_SSL_HS_CERTIFICATE, buf,
765 buf_len));
766
767 cleanup:
768 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
769
770 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate"));
771 return ret;
772 }
773 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
774 /*
775 * enum {
776 * X509(0),
777 * RawPublicKey(2),
778 * (255)
779 * } CertificateType;
780 *
781 * struct {
782 * select (certificate_type) {
783 * case RawPublicKey:
784 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
785 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
786 *
787 * case X509:
788 * opaque cert_data<1..2^24-1>;
789 * };
790 * Extension extensions<0..2^16-1>;
791 * } CertificateEntry;
792 *
793 * struct {
794 * opaque certificate_request_context<0..2^8-1>;
795 * CertificateEntry certificate_list<0..2^24-1>;
796 * } Certificate;
797 */
798 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)799 static int ssl_tls13_write_certificate_body(mbedtls_ssl_context *ssl,
800 unsigned char *buf,
801 unsigned char *end,
802 size_t *out_len)
803 {
804 const mbedtls_x509_crt *crt = mbedtls_ssl_own_cert(ssl);
805 unsigned char *p = buf;
806 unsigned char *certificate_request_context =
807 ssl->handshake->certificate_request_context;
808 unsigned char certificate_request_context_len =
809 ssl->handshake->certificate_request_context_len;
810 unsigned char *p_certificate_list_len;
811
812
813 /* ...
814 * opaque certificate_request_context<0..2^8-1>;
815 * ...
816 */
817 MBEDTLS_SSL_CHK_BUF_PTR(p, end, certificate_request_context_len + 1);
818 *p++ = certificate_request_context_len;
819 if (certificate_request_context_len > 0) {
820 memcpy(p, certificate_request_context, certificate_request_context_len);
821 p += certificate_request_context_len;
822 }
823
824 /* ...
825 * CertificateEntry certificate_list<0..2^24-1>;
826 * ...
827 */
828 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3);
829 p_certificate_list_len = p;
830 p += 3;
831
832 MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", crt);
833
834 while (crt != NULL) {
835 size_t cert_data_len = crt->raw.len;
836
837 MBEDTLS_SSL_CHK_BUF_PTR(p, end, cert_data_len + 3 + 2);
838 MBEDTLS_PUT_UINT24_BE(cert_data_len, p, 0);
839 p += 3;
840
841 memcpy(p, crt->raw.p, cert_data_len);
842 p += cert_data_len;
843 crt = crt->next;
844
845 /* Currently, we don't have any certificate extensions defined.
846 * Hence, we are sending an empty extension with length zero.
847 */
848 MBEDTLS_PUT_UINT16_BE(0, p, 0);
849 p += 2;
850 }
851
852 MBEDTLS_PUT_UINT24_BE(p - p_certificate_list_len - 3,
853 p_certificate_list_len, 0);
854
855 *out_len = p - buf;
856
857 MBEDTLS_SSL_PRINT_EXTS(
858 3, MBEDTLS_SSL_HS_CERTIFICATE, ssl->handshake->sent_extensions);
859
860 return 0;
861 }
862
mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context * ssl)863 int mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context *ssl)
864 {
865 int ret;
866 unsigned char *buf;
867 size_t buf_len, msg_len;
868
869 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
870
871 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
872 MBEDTLS_SSL_HS_CERTIFICATE, &buf,
873 &buf_len));
874
875 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_body(ssl,
876 buf,
877 buf + buf_len,
878 &msg_len));
879
880 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
881 MBEDTLS_SSL_HS_CERTIFICATE, buf,
882 msg_len));
883
884 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
885 ssl, buf_len, msg_len));
886 cleanup:
887
888 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate"));
889 return ret;
890 }
891
892 /*
893 * STATE HANDLING: Output Certificate Verify
894 */
mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg,mbedtls_pk_context * key)895 int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg,
896 mbedtls_pk_context *key)
897 {
898 mbedtls_pk_type_t pk_type = mbedtls_ssl_sig_from_pk(key);
899 size_t key_size = mbedtls_pk_get_bitlen(key);
900
901 switch (pk_type) {
902 case MBEDTLS_SSL_SIG_ECDSA:
903 switch (key_size) {
904 case 256:
905 return
906 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
907
908 case 384:
909 return
910 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384;
911
912 case 521:
913 return
914 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512;
915 default:
916 break;
917 }
918 break;
919
920 case MBEDTLS_SSL_SIG_RSA:
921 switch (sig_alg) {
922 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: /* Intentional fallthrough */
923 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: /* Intentional fallthrough */
924 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
925 return 1;
926
927 default:
928 break;
929 }
930 break;
931
932 default:
933 break;
934 }
935
936 return 0;
937 }
938
939 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)940 static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl,
941 unsigned char *buf,
942 unsigned char *end,
943 size_t *out_len)
944 {
945 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
946 unsigned char *p = buf;
947 mbedtls_pk_context *own_key;
948
949 unsigned char handshake_hash[MBEDTLS_TLS1_3_MD_MAX_SIZE];
950 size_t handshake_hash_len;
951 unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE];
952 size_t verify_buffer_len;
953
954 uint16_t *sig_alg = ssl->handshake->received_sig_algs;
955 size_t signature_len = 0;
956
957 *out_len = 0;
958
959 own_key = mbedtls_ssl_own_key(ssl);
960 if (own_key == NULL) {
961 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
962 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
963 }
964
965 ret = mbedtls_ssl_get_handshake_transcript(ssl,
966 ssl->handshake->ciphersuite_info->mac,
967 handshake_hash,
968 sizeof(handshake_hash),
969 &handshake_hash_len);
970 if (ret != 0) {
971 return ret;
972 }
973
974 MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash",
975 handshake_hash,
976 handshake_hash_len);
977
978 ssl_tls13_create_verify_structure(handshake_hash, handshake_hash_len,
979 verify_buffer, &verify_buffer_len,
980 ssl->conf->endpoint);
981
982 /*
983 * struct {
984 * SignatureScheme algorithm;
985 * opaque signature<0..2^16-1>;
986 * } CertificateVerify;
987 */
988 /* Check there is space for the algorithm identifier (2 bytes) and the
989 * signature length (2 bytes).
990 */
991 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4);
992
993 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
994 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
995 mbedtls_pk_type_t pk_type = MBEDTLS_PK_NONE;
996 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
997 psa_algorithm_t psa_algorithm = PSA_ALG_NONE;
998 unsigned char verify_hash[PSA_HASH_MAX_SIZE];
999 size_t verify_hash_len;
1000
1001 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) {
1002 continue;
1003 }
1004
1005 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) {
1006 continue;
1007 }
1008
1009 if (!mbedtls_ssl_tls13_check_sig_alg_cert_key_match(*sig_alg, own_key)) {
1010 continue;
1011 }
1012
1013 if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(
1014 *sig_alg, &pk_type, &md_alg) != 0) {
1015 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1016 }
1017
1018 /* Hash verify buffer with indicated hash function */
1019 psa_algorithm = mbedtls_hash_info_psa_from_md(md_alg);
1020 status = psa_hash_compute(psa_algorithm,
1021 verify_buffer,
1022 verify_buffer_len,
1023 verify_hash, sizeof(verify_hash),
1024 &verify_hash_len);
1025 if (status != PSA_SUCCESS) {
1026 return PSA_TO_MBEDTLS_ERR(status);
1027 }
1028
1029 MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len);
1030
1031 if ((ret = mbedtls_pk_sign_ext(pk_type, own_key,
1032 md_alg, verify_hash, verify_hash_len,
1033 p + 4, (size_t) (end - (p + 4)), &signature_len,
1034 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
1035 MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s",
1036 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
1037 MBEDTLS_SSL_DEBUG_RET(2, "mbedtls_pk_sign_ext", ret);
1038
1039 /* The signature failed. This is possible if the private key
1040 * was not suitable for the signature operation as purposely we
1041 * did not check its suitability completely. Let's try with
1042 * another signature algorithm.
1043 */
1044 continue;
1045 }
1046
1047 MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature with %s",
1048 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
1049
1050 break;
1051 }
1052
1053 if (*sig_alg == MBEDTLS_TLS1_3_SIG_NONE) {
1054 MBEDTLS_SSL_DEBUG_MSG(1, ("no suitable signature algorithm"));
1055 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1056 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1057 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1058 }
1059
1060 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0);
1061 MBEDTLS_PUT_UINT16_BE(signature_len, p, 2);
1062
1063 *out_len = 4 + signature_len;
1064
1065 return 0;
1066 }
1067
mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context * ssl)1068 int mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl)
1069 {
1070 int ret = 0;
1071 unsigned char *buf;
1072 size_t buf_len, msg_len;
1073
1074 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate verify"));
1075
1076 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
1077 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf,
1078 &buf_len));
1079
1080 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_verify_body(
1081 ssl, buf, buf + buf_len, &msg_len));
1082
1083 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
1084 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, buf,
1085 msg_len));
1086
1087 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
1088 ssl, buf_len, msg_len));
1089
1090 cleanup:
1091
1092 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate verify"));
1093 return ret;
1094 }
1095
1096 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
1097
1098 /*
1099 *
1100 * STATE HANDLING: Incoming Finished message.
1101 */
1102 /*
1103 * Implementation
1104 */
1105
1106 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_preprocess_finished_message(mbedtls_ssl_context * ssl)1107 static int ssl_tls13_preprocess_finished_message(mbedtls_ssl_context *ssl)
1108 {
1109 int ret;
1110
1111 ret = mbedtls_ssl_tls13_calculate_verify_data(ssl,
1112 ssl->handshake->state_local.finished_in.digest,
1113 sizeof(ssl->handshake->state_local.finished_in.
1114 digest),
1115 &ssl->handshake->state_local.finished_in.digest_len,
1116 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ?
1117 MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT);
1118 if (ret != 0) {
1119 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_calculate_verify_data", ret);
1120 return ret;
1121 }
1122
1123 return 0;
1124 }
1125
1126 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_finished_message(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1127 static int ssl_tls13_parse_finished_message(mbedtls_ssl_context *ssl,
1128 const unsigned char *buf,
1129 const unsigned char *end)
1130 {
1131 /*
1132 * struct {
1133 * opaque verify_data[Hash.length];
1134 * } Finished;
1135 */
1136 const unsigned char *expected_verify_data =
1137 ssl->handshake->state_local.finished_in.digest;
1138 size_t expected_verify_data_len =
1139 ssl->handshake->state_local.finished_in.digest_len;
1140 /* Structural validation */
1141 if ((size_t) (end - buf) != expected_verify_data_len) {
1142 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
1143
1144 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1145 MBEDTLS_ERR_SSL_DECODE_ERROR);
1146 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1147 }
1148
1149 MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (self-computed):",
1150 expected_verify_data,
1151 expected_verify_data_len);
1152 MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (received message):", buf,
1153 expected_verify_data_len);
1154
1155 /* Semantic validation */
1156 if (mbedtls_ct_memcmp(buf,
1157 expected_verify_data,
1158 expected_verify_data_len) != 0) {
1159 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
1160
1161 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
1162 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1163 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1164 }
1165 return 0;
1166 }
1167
mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context * ssl)1168 int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl)
1169 {
1170 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1171 unsigned char *buf;
1172 size_t buf_len;
1173
1174 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message"));
1175
1176 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(ssl,
1177 MBEDTLS_SSL_HS_FINISHED,
1178 &buf, &buf_len));
1179
1180 /* Preprocessing step: Compute handshake digest */
1181 MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl));
1182
1183 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_finished_message(ssl, buf, buf + buf_len));
1184
1185 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
1186 MBEDTLS_SSL_HS_FINISHED, buf, buf_len));
1187
1188 cleanup:
1189
1190 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished message"));
1191 return ret;
1192 }
1193
1194 /*
1195 *
1196 * STATE HANDLING: Write and send Finished message.
1197 *
1198 */
1199 /*
1200 * Implement
1201 */
1202
1203 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_prepare_finished_message(mbedtls_ssl_context * ssl)1204 static int ssl_tls13_prepare_finished_message(mbedtls_ssl_context *ssl)
1205 {
1206 int ret;
1207
1208 /* Compute transcript of handshake up to now. */
1209 ret = mbedtls_ssl_tls13_calculate_verify_data(ssl,
1210 ssl->handshake->state_local.finished_out.digest,
1211 sizeof(ssl->handshake->state_local.finished_out.
1212 digest),
1213 &ssl->handshake->state_local.finished_out.digest_len,
1214 ssl->conf->endpoint);
1215
1216 if (ret != 0) {
1217 MBEDTLS_SSL_DEBUG_RET(1, "calculate_verify_data failed", ret);
1218 return ret;
1219 }
1220
1221 return 0;
1222 }
1223
1224 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_finished_message_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)1225 static int ssl_tls13_write_finished_message_body(mbedtls_ssl_context *ssl,
1226 unsigned char *buf,
1227 unsigned char *end,
1228 size_t *out_len)
1229 {
1230 size_t verify_data_len = ssl->handshake->state_local.finished_out.digest_len;
1231 /*
1232 * struct {
1233 * opaque verify_data[Hash.length];
1234 * } Finished;
1235 */
1236 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, verify_data_len);
1237
1238 memcpy(buf, ssl->handshake->state_local.finished_out.digest,
1239 verify_data_len);
1240
1241 *out_len = verify_data_len;
1242 return 0;
1243 }
1244
1245 /* Main entry point: orchestrates the other functions */
mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context * ssl)1246 int mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context *ssl)
1247 {
1248 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1249 unsigned char *buf;
1250 size_t buf_len, msg_len;
1251
1252 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished message"));
1253
1254 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_finished_message(ssl));
1255
1256 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
1257 MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len));
1258
1259 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_finished_message_body(
1260 ssl, buf, buf + buf_len, &msg_len));
1261
1262 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
1263 MBEDTLS_SSL_HS_FINISHED, buf, msg_len));
1264
1265 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
1266 ssl, buf_len, msg_len));
1267 cleanup:
1268
1269 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished message"));
1270 return ret;
1271 }
1272
mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)1273 void mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl)
1274 {
1275
1276 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup"));
1277
1278 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for inbound traffic"));
1279 mbedtls_ssl_set_inbound_transform(ssl, ssl->transform_application);
1280
1281 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for outbound traffic"));
1282 mbedtls_ssl_set_outbound_transform(ssl, ssl->transform_application);
1283
1284 /*
1285 * Free the previous session and switch to the current one.
1286 */
1287 if (ssl->session) {
1288 mbedtls_ssl_session_free(ssl->session);
1289 mbedtls_free(ssl->session);
1290 }
1291 ssl->session = ssl->session_negotiate;
1292 ssl->session_negotiate = NULL;
1293
1294 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup"));
1295 }
1296
1297 /*
1298 *
1299 * STATE HANDLING: Write ChangeCipherSpec
1300 *
1301 */
1302 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1303 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_change_cipher_spec_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * olen)1304 static int ssl_tls13_write_change_cipher_spec_body(mbedtls_ssl_context *ssl,
1305 unsigned char *buf,
1306 unsigned char *end,
1307 size_t *olen)
1308 {
1309 ((void) ssl);
1310
1311 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 1);
1312 buf[0] = 1;
1313 *olen = 1;
1314
1315 return 0;
1316 }
1317
mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context * ssl)1318 int mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context *ssl)
1319 {
1320 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1321
1322 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write change cipher spec"));
1323
1324 /* Write CCS message */
1325 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_change_cipher_spec_body(
1326 ssl, ssl->out_msg,
1327 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
1328 &ssl->out_msglen));
1329
1330 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
1331
1332 /* Dispatch message */
1333 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_write_record(ssl, 0));
1334
1335 cleanup:
1336
1337 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write change cipher spec"));
1338 return ret;
1339 }
1340
1341 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1342
1343 /* Early Data Indication Extension
1344 *
1345 * struct {
1346 * select ( Handshake.msg_type ) {
1347 * ...
1348 * case client_hello: Empty;
1349 * case encrypted_extensions: Empty;
1350 * };
1351 * } EarlyDataIndication;
1352 */
1353 #if defined(MBEDTLS_SSL_EARLY_DATA)
mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * out_len)1354 int mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context *ssl,
1355 unsigned char *buf,
1356 const unsigned char *end,
1357 size_t *out_len)
1358 {
1359 unsigned char *p = buf;
1360 *out_len = 0;
1361 ((void) ssl);
1362
1363 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4);
1364
1365 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EARLY_DATA, p, 0);
1366 MBEDTLS_PUT_UINT16_BE(0, p, 2);
1367
1368 *out_len = 4;
1369
1370 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_EARLY_DATA);
1371
1372 return 0;
1373 }
1374 #endif /* MBEDTLS_SSL_EARLY_DATA */
1375
1376 /* Reset SSL context and update hash for handling HRR.
1377 *
1378 * Replace Transcript-Hash(X) by
1379 * Transcript-Hash( message_hash ||
1380 * 00 00 Hash.length ||
1381 * X )
1382 * A few states of the handshake are preserved, including:
1383 * - session ID
1384 * - session ticket
1385 * - negotiated ciphersuite
1386 */
mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context * ssl)1387 int mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context *ssl)
1388 {
1389 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1390 unsigned char hash_transcript[PSA_HASH_MAX_SIZE + 4];
1391 size_t hash_len;
1392 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1393 ssl->handshake->ciphersuite_info;
1394
1395 MBEDTLS_SSL_DEBUG_MSG(3, ("Reset SSL session for HRR"));
1396
1397 ret = mbedtls_ssl_get_handshake_transcript(ssl, ciphersuite_info->mac,
1398 hash_transcript + 4,
1399 PSA_HASH_MAX_SIZE,
1400 &hash_len);
1401 if (ret != 0) {
1402 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_get_handshake_transcript", ret);
1403 return ret;
1404 }
1405
1406 hash_transcript[0] = MBEDTLS_SSL_HS_MESSAGE_HASH;
1407 hash_transcript[1] = 0;
1408 hash_transcript[2] = 0;
1409 hash_transcript[3] = (unsigned char) hash_len;
1410
1411 hash_len += 4;
1412
1413 MBEDTLS_SSL_DEBUG_BUF(4, "Truncated handshake transcript",
1414 hash_transcript, hash_len);
1415
1416 /* Reset running hash and replace it with a hash of the transcript */
1417 ret = mbedtls_ssl_reset_checksum(ssl);
1418 if (ret != 0) {
1419 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_checksum", ret);
1420 return ret;
1421 }
1422 ret = ssl->handshake->update_checksum(ssl, hash_transcript, hash_len);
1423 if (ret != 0) {
1424 MBEDTLS_SSL_DEBUG_RET(1, "update_checksum", ret);
1425 return ret;
1426 }
1427
1428 return ret;
1429 }
1430
1431 #if defined(MBEDTLS_ECDH_C)
1432
mbedtls_ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t buf_len)1433 int mbedtls_ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context *ssl,
1434 const unsigned char *buf,
1435 size_t buf_len)
1436 {
1437 uint8_t *p = (uint8_t *) buf;
1438 const uint8_t *end = buf + buf_len;
1439 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1440
1441 /* Get size of the TLS opaque key_exchange field of the KeyShareEntry struct. */
1442 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
1443 uint16_t peerkey_len = MBEDTLS_GET_UINT16_BE(p, 0);
1444 p += 2;
1445
1446 /* Check if key size is consistent with given buffer length. */
1447 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, peerkey_len);
1448
1449 /* Store peer's ECDH public key. */
1450 memcpy(handshake->ecdh_psa_peerkey, p, peerkey_len);
1451 handshake->ecdh_psa_peerkey_len = peerkey_len;
1452
1453 return 0;
1454 }
1455
mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange(mbedtls_ssl_context * ssl,uint16_t named_group,unsigned char * buf,unsigned char * end,size_t * out_len)1456 int mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange(
1457 mbedtls_ssl_context *ssl,
1458 uint16_t named_group,
1459 unsigned char *buf,
1460 unsigned char *end,
1461 size_t *out_len)
1462 {
1463 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
1464 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1465 psa_key_attributes_t key_attributes;
1466 size_t own_pubkey_len;
1467 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1468 psa_ecc_family_t ec_psa_family = 0;
1469 size_t ec_bits = 0;
1470
1471 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH computation."));
1472
1473 /* Convert EC's TLS ID to PSA key type. */
1474 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(named_group,
1475 &ec_psa_family,
1476 &ec_bits) == PSA_ERROR_NOT_SUPPORTED) {
1477 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1478 }
1479 handshake->ecdh_psa_type = PSA_KEY_TYPE_ECC_KEY_PAIR(ec_psa_family);
1480 ssl->handshake->ecdh_bits = ec_bits;
1481
1482 key_attributes = psa_key_attributes_init();
1483 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
1484 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
1485 psa_set_key_type(&key_attributes, handshake->ecdh_psa_type);
1486 psa_set_key_bits(&key_attributes, handshake->ecdh_bits);
1487
1488 /* Generate ECDH private key. */
1489 status = psa_generate_key(&key_attributes,
1490 &handshake->ecdh_psa_privkey);
1491 if (status != PSA_SUCCESS) {
1492 ret = PSA_TO_MBEDTLS_ERR(status);
1493 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret);
1494 return ret;
1495
1496 }
1497
1498 /* Export the public part of the ECDH private key from PSA. */
1499 status = psa_export_public_key(handshake->ecdh_psa_privkey,
1500 buf, (size_t) (end - buf),
1501 &own_pubkey_len);
1502 if (status != PSA_SUCCESS) {
1503 ret = PSA_TO_MBEDTLS_ERR(status);
1504 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret);
1505 return ret;
1506
1507 }
1508
1509 *out_len = own_pubkey_len;
1510
1511 return 0;
1512 }
1513 #endif /* MBEDTLS_ECDH_C */
1514
1515 /* RFC 8446 section 4.2
1516 *
1517 * If an implementation receives an extension which it recognizes and which is
1518 * not specified for the message in which it appears, it MUST abort the handshake
1519 * with an "illegal_parameter" alert.
1520 *
1521 */
mbedtls_ssl_tls13_check_received_extension(mbedtls_ssl_context * ssl,int hs_msg_type,unsigned int received_extension_type,uint32_t hs_msg_allowed_extensions_mask)1522 int mbedtls_ssl_tls13_check_received_extension(
1523 mbedtls_ssl_context *ssl,
1524 int hs_msg_type,
1525 unsigned int received_extension_type,
1526 uint32_t hs_msg_allowed_extensions_mask)
1527 {
1528 uint32_t extension_mask = mbedtls_ssl_get_extension_mask(
1529 received_extension_type);
1530
1531 MBEDTLS_SSL_PRINT_EXT(
1532 3, hs_msg_type, received_extension_type, "received");
1533
1534 if ((extension_mask & hs_msg_allowed_extensions_mask) == 0) {
1535 MBEDTLS_SSL_PRINT_EXT(
1536 3, hs_msg_type, received_extension_type, "is illegal");
1537 MBEDTLS_SSL_PEND_FATAL_ALERT(
1538 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1539 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1540 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1541 }
1542
1543 ssl->handshake->received_extensions |= extension_mask;
1544 /*
1545 * If it is a message containing extension responses, check that we
1546 * previously sent the extension.
1547 */
1548 switch (hs_msg_type) {
1549 case MBEDTLS_SSL_HS_SERVER_HELLO:
1550 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST:
1551 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
1552 case MBEDTLS_SSL_HS_CERTIFICATE:
1553 /* Check if the received extension is sent by peer message.*/
1554 if ((ssl->handshake->sent_extensions & extension_mask) != 0) {
1555 return 0;
1556 }
1557 break;
1558 default:
1559 return 0;
1560 }
1561
1562 MBEDTLS_SSL_PRINT_EXT(
1563 3, hs_msg_type, received_extension_type, "is unsupported");
1564 MBEDTLS_SSL_PEND_FATAL_ALERT(
1565 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1566 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION);
1567 return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
1568 }
1569
1570 #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
1571 /* RFC 8449, section 4:
1572 *
1573 * The ExtensionData of the "record_size_limit" extension is
1574 * RecordSizeLimit:
1575 * uint16 RecordSizeLimit;
1576 */
1577 MBEDTLS_CHECK_RETURN_CRITICAL
mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1578 int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl,
1579 const unsigned char *buf,
1580 const unsigned char *end)
1581 {
1582 const unsigned char *p = buf;
1583 uint16_t record_size_limit;
1584 const size_t extension_data_len = end - buf;
1585
1586 if (extension_data_len != MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH) {
1587 MBEDTLS_SSL_DEBUG_MSG(2,
1588 ("record_size_limit extension has invalid length: %"
1589 MBEDTLS_PRINTF_SIZET " Bytes",
1590 extension_data_len));
1591
1592 MBEDTLS_SSL_PEND_FATAL_ALERT(
1593 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1594 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1595 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1596 }
1597
1598 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
1599 record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0);
1600
1601 MBEDTLS_SSL_DEBUG_MSG(2, ("RecordSizeLimit: %u Bytes", record_size_limit));
1602
1603 /* RFC 8449, section 4
1604 *
1605 * Endpoints MUST NOT send a "record_size_limit" extension with a value
1606 * smaller than 64. An endpoint MUST treat receipt of a smaller value
1607 * as a fatal error and generate an "illegal_parameter" alert.
1608 */
1609 if (record_size_limit < MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN) {
1610 MBEDTLS_SSL_PEND_FATAL_ALERT(
1611 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1612 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1613 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1614 }
1615
1616 MBEDTLS_SSL_DEBUG_MSG(2,
1617 (
1618 "record_size_limit extension is still in development. Aborting handshake."));
1619
1620 MBEDTLS_SSL_PEND_FATAL_ALERT(
1621 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1622 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION);
1623 return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
1624 }
1625 #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
1626
1627 #endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */
1628
