1 /*
2 * TLS 1.3 server-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
11
12 #include "debug_internal.h"
13 #include "mbedtls/error.h"
14 #include "mbedtls/platform.h"
15 #include "mbedtls/constant_time.h"
16 #include "mbedtls/oid.h"
17 #include "mbedtls/psa_util.h"
18
19 #include "ssl_misc.h"
20 #include "ssl_tls13_keys.h"
21 #include "ssl_debug_helpers.h"
22
23
ssl_tls13_validate_peer_ciphersuite(mbedtls_ssl_context * ssl,unsigned int cipher_suite)24 static const mbedtls_ssl_ciphersuite_t *ssl_tls13_validate_peer_ciphersuite(
25 mbedtls_ssl_context *ssl,
26 unsigned int cipher_suite)
27 {
28 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
29 if (!mbedtls_ssl_tls13_cipher_suite_is_offered(ssl, cipher_suite)) {
30 return NULL;
31 }
32
33 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(cipher_suite);
34 if ((mbedtls_ssl_validate_ciphersuite(ssl, ciphersuite_info,
35 ssl->tls_version,
36 ssl->tls_version) != 0)) {
37 return NULL;
38 }
39 return ciphersuite_info;
40 }
41
ssl_tls13_select_ciphersuite(mbedtls_ssl_context * ssl,const unsigned char * cipher_suites,const unsigned char * cipher_suites_end,int psk_ciphersuite_id,psa_algorithm_t psk_hash_alg,const mbedtls_ssl_ciphersuite_t ** selected_ciphersuite_info)42 static void ssl_tls13_select_ciphersuite(
43 mbedtls_ssl_context *ssl,
44 const unsigned char *cipher_suites,
45 const unsigned char *cipher_suites_end,
46 int psk_ciphersuite_id,
47 psa_algorithm_t psk_hash_alg,
48 const mbedtls_ssl_ciphersuite_t **selected_ciphersuite_info)
49 {
50 *selected_ciphersuite_info = NULL;
51
52 /*
53 * In a compliant ClientHello the byte-length of the list of ciphersuites
54 * is even and this function relies on this fact. This should have been
55 * checked in the main ClientHello parsing function. Double check here.
56 */
57 if ((cipher_suites_end - cipher_suites) & 1) {
58 return;
59 }
60
61 for (const unsigned char *p = cipher_suites;
62 p < cipher_suites_end; p += 2) {
63 /*
64 * "cipher_suites_end - p is even" is an invariant of the loop. As
65 * cipher_suites_end - p > 0, we have cipher_suites_end - p >= 2 and it
66 * is thus safe to read two bytes.
67 */
68 uint16_t id = MBEDTLS_GET_UINT16_BE(p, 0);
69
70 const mbedtls_ssl_ciphersuite_t *info =
71 ssl_tls13_validate_peer_ciphersuite(ssl, id);
72 if (info == NULL) {
73 continue;
74 }
75
76 /*
77 * If a valid PSK ciphersuite identifier has been passed in, we want
78 * an exact match.
79 */
80 if (psk_ciphersuite_id != 0) {
81 if (id != psk_ciphersuite_id) {
82 continue;
83 }
84 } else if (psk_hash_alg != PSA_ALG_NONE) {
85 if (mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) info->mac) !=
86 psk_hash_alg) {
87 continue;
88 }
89 }
90
91 *selected_ciphersuite_info = info;
92 return;
93 }
94
95 MBEDTLS_SSL_DEBUG_MSG(2, ("No matched ciphersuite, psk_ciphersuite_id=%x, psk_hash_alg=%x",
96 (unsigned) psk_ciphersuite_id, psk_hash_alg));
97 }
98
99 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
100 /* From RFC 8446:
101 *
102 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
103 * struct {
104 * PskKeyExchangeMode ke_modes<1..255>;
105 * } PskKeyExchangeModes;
106 */
107 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_key_exchange_modes_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)108 static int ssl_tls13_parse_key_exchange_modes_ext(mbedtls_ssl_context *ssl,
109 const unsigned char *buf,
110 const unsigned char *end)
111 {
112 const unsigned char *p = buf;
113 size_t ke_modes_len;
114 int ke_modes = 0;
115
116 /* Read ke_modes length (1 Byte) */
117 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
118 ke_modes_len = *p++;
119 /* Currently, there are only two PSK modes, so even without looking
120 * at the content, something's wrong if the list has more than 2 items. */
121 if (ke_modes_len > 2) {
122 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
123 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
124 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
125 }
126
127 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, ke_modes_len);
128
129 while (ke_modes_len-- != 0) {
130 switch (*p++) {
131 case MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE:
132 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
133 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK KEX MODE"));
134 break;
135 case MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE:
136 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
137 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK_EPHEMERAL KEX MODE"));
138 break;
139 default:
140 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
141 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
142 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
143 }
144 }
145
146 ssl->handshake->tls13_kex_modes = ke_modes;
147 return 0;
148 }
149
150 /*
151 * Non-error return values of
152 * ssl_tls13_offered_psks_check_identity_match_ticket() and
153 * ssl_tls13_offered_psks_check_identity_match(). They are positive to
154 * not collide with error codes that are negative. Zero
155 * (SSL_TLS1_3_PSK_IDENTITY_MATCH) in case of success as it may be propagated
156 * up by the callers of this function as a generic success condition.
157 *
158 * The return value SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE means
159 * that the pre-shared-key identity matches that of a ticket or an externally-
160 * provisioned pre-shared-key. We have thus been able to retrieve the
161 * attributes of the pre-shared-key but at least one of them does not meet
162 * some criteria and the pre-shared-key cannot be used. For example, a ticket
163 * is expired or its version is not TLS 1.3. Note eventually that the return
164 * value SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE does not have
165 * anything to do with binder check. A binder check is done only when a
166 * suitable pre-shared-key has been selected and only for that selected
167 * pre-shared-key: if the binder check fails, we fail the handshake and we do
168 * not try to find another pre-shared-key for which the binder check would
169 * succeed as recommended by the specification.
170 */
171 #define SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH 2
172 #define SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE 1
173 #define SSL_TLS1_3_PSK_IDENTITY_MATCH 0
174
175 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
176 MBEDTLS_CHECK_RETURN_CRITICAL
177 static int ssl_tls13_key_exchange_is_psk_available(mbedtls_ssl_context *ssl);
178 MBEDTLS_CHECK_RETURN_CRITICAL
179 static int ssl_tls13_key_exchange_is_psk_ephemeral_available(mbedtls_ssl_context *ssl);
180
181 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_offered_psks_check_identity_match_ticket(mbedtls_ssl_context * ssl,const unsigned char * identity,size_t identity_len,uint32_t obfuscated_ticket_age,mbedtls_ssl_session * session)182 static int ssl_tls13_offered_psks_check_identity_match_ticket(
183 mbedtls_ssl_context *ssl,
184 const unsigned char *identity,
185 size_t identity_len,
186 uint32_t obfuscated_ticket_age,
187 mbedtls_ssl_session *session)
188 {
189 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
190 unsigned char *ticket_buffer;
191 #if defined(MBEDTLS_HAVE_TIME)
192 mbedtls_ms_time_t now;
193 mbedtls_ms_time_t server_age;
194 uint32_t client_age;
195 mbedtls_ms_time_t age_diff;
196 #endif
197
198 ((void) obfuscated_ticket_age);
199
200 MBEDTLS_SSL_DEBUG_MSG(2, ("=> check_identity_match_ticket"));
201
202 /* Ticket parser is not configured, Skip */
203 if (ssl->conf->f_ticket_parse == NULL || identity_len == 0) {
204 return SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
205 }
206
207 /* We create a copy of the encrypted ticket since the ticket parsing
208 * function is allowed to use its input buffer as an output buffer
209 * (in-place decryption). We do, however, need the original buffer for
210 * computing the PSK binder value.
211 */
212 ticket_buffer = mbedtls_calloc(1, identity_len);
213 if (ticket_buffer == NULL) {
214 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
215 }
216 memcpy(ticket_buffer, identity, identity_len);
217
218 ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket,
219 session,
220 ticket_buffer, identity_len);
221 switch (ret) {
222 case 0:
223 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH;
224 break;
225
226 case MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED:
227 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired"));
228 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE;
229 break;
230
231 case MBEDTLS_ERR_SSL_INVALID_MAC:
232 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic"));
233 ret = SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
234 break;
235
236 default:
237 MBEDTLS_SSL_DEBUG_RET(1, "ticket_parse", ret);
238 ret = SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
239 }
240
241 /* We delete the temporary buffer */
242 mbedtls_free(ticket_buffer);
243
244 if (ret != SSL_TLS1_3_PSK_IDENTITY_MATCH) {
245 goto exit;
246 }
247
248 /*
249 * The identity matches that of a ticket. Now check that it has suitable
250 * attributes and bet it will not be the case.
251 */
252 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE;
253
254 if (session->tls_version != MBEDTLS_SSL_VERSION_TLS1_3) {
255 MBEDTLS_SSL_DEBUG_MSG(3, ("Ticket TLS version is not 1.3."));
256 goto exit;
257 }
258
259 #if defined(MBEDTLS_HAVE_TIME)
260 now = mbedtls_ms_time();
261
262 if (now < session->ticket_creation_time) {
263 MBEDTLS_SSL_DEBUG_MSG(
264 3, ("Invalid ticket creation time ( now = %" MBEDTLS_PRINTF_MS_TIME
265 ", creation_time = %" MBEDTLS_PRINTF_MS_TIME " )",
266 now, session->ticket_creation_time));
267 goto exit;
268 }
269
270 server_age = now - session->ticket_creation_time;
271
272 /* RFC 8446 section 4.6.1
273 *
274 * Servers MUST NOT use any value greater than 604800 seconds (7 days).
275 *
276 * RFC 8446 section 4.2.11.1
277 *
278 * Clients MUST NOT attempt to use tickets which have ages greater than
279 * the "ticket_lifetime" value which was provided with the ticket.
280 *
281 */
282 if (server_age > MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME * 1000) {
283 MBEDTLS_SSL_DEBUG_MSG(
284 3, ("Ticket age exceeds limitation ticket_age = %" MBEDTLS_PRINTF_MS_TIME,
285 server_age));
286 goto exit;
287 }
288
289 /* RFC 8446 section 4.2.10
290 *
291 * For PSKs provisioned via NewSessionTicket, a server MUST validate that
292 * the ticket age for the selected PSK identity (computed by subtracting
293 * ticket_age_add from PskIdentity.obfuscated_ticket_age modulo 2^32) is
294 * within a small tolerance of the time since the ticket was issued.
295 *
296 * NOTE: The typical accuracy of an RTC crystal is ±100 to ±20 parts per
297 * million (360 to 72 milliseconds per hour). Default tolerance
298 * window is 6s, thus in the worst case clients and servers must
299 * sync up their system time every 6000/360/2~=8 hours.
300 */
301 client_age = obfuscated_ticket_age - session->ticket_age_add;
302 age_diff = server_age - (mbedtls_ms_time_t) client_age;
303 if (age_diff < -MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE ||
304 age_diff > MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE) {
305 MBEDTLS_SSL_DEBUG_MSG(
306 3, ("Ticket age outside tolerance window ( diff = %"
307 MBEDTLS_PRINTF_MS_TIME ")",
308 age_diff));
309 goto exit;
310 }
311 #endif /* MBEDTLS_HAVE_TIME */
312
313 /*
314 * All good, we have found a suitable ticket.
315 */
316 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH;
317
318 exit:
319 if (ret != SSL_TLS1_3_PSK_IDENTITY_MATCH) {
320 mbedtls_ssl_session_free(session);
321 }
322
323 MBEDTLS_SSL_DEBUG_MSG(2, ("<= check_identity_match_ticket"));
324 return ret;
325 }
326 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
327
328 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_offered_psks_check_identity_match(mbedtls_ssl_context * ssl,const unsigned char * identity,size_t identity_len,uint32_t obfuscated_ticket_age,int * psk_type,mbedtls_ssl_session * session)329 static int ssl_tls13_offered_psks_check_identity_match(
330 mbedtls_ssl_context *ssl,
331 const unsigned char *identity,
332 size_t identity_len,
333 uint32_t obfuscated_ticket_age,
334 int *psk_type,
335 mbedtls_ssl_session *session)
336 {
337 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
338
339 ((void) session);
340 ((void) obfuscated_ticket_age);
341 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
342
343 MBEDTLS_SSL_DEBUG_BUF(4, "identity", identity, identity_len);
344
345 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
346 ret = ssl_tls13_offered_psks_check_identity_match_ticket(
347 ssl, identity, identity_len, obfuscated_ticket_age, session);
348 if (ret == SSL_TLS1_3_PSK_IDENTITY_MATCH) {
349 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION;
350 ret = mbedtls_ssl_set_hs_psk(ssl,
351 session->resumption_key,
352 session->resumption_key_len);
353 if (ret != 0) {
354 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
355 return ret;
356 }
357
358 MBEDTLS_SSL_DEBUG_BUF(4, "Ticket-resumed PSK:",
359 session->resumption_key,
360 session->resumption_key_len);
361 MBEDTLS_SSL_DEBUG_MSG(4, ("ticket: obfuscated_ticket_age: %u",
362 (unsigned) obfuscated_ticket_age));
363 return SSL_TLS1_3_PSK_IDENTITY_MATCH;
364 } else if (ret == SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE) {
365 return SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE;
366 }
367 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
368
369 /* Check identity with external configured function */
370 if (ssl->conf->f_psk != NULL) {
371 if (ssl->conf->f_psk(
372 ssl->conf->p_psk, ssl, identity, identity_len) == 0) {
373 return SSL_TLS1_3_PSK_IDENTITY_MATCH;
374 }
375 return SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
376 }
377
378 MBEDTLS_SSL_DEBUG_BUF(5, "identity", identity, identity_len);
379 /* Check identity with pre-configured psk */
380 if (ssl->conf->psk_identity != NULL &&
381 identity_len == ssl->conf->psk_identity_len &&
382 mbedtls_ct_memcmp(ssl->conf->psk_identity,
383 identity, identity_len) == 0) {
384 ret = mbedtls_ssl_set_hs_psk(ssl, ssl->conf->psk, ssl->conf->psk_len);
385 if (ret != 0) {
386 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
387 return ret;
388 }
389 return SSL_TLS1_3_PSK_IDENTITY_MATCH;
390 }
391
392 return SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
393 }
394
395 /*
396 * Non-error return values of ssl_tls13_offered_psks_check_binder_match().
397 * They are positive to not collide with error codes that are negative. Zero
398 * (SSL_TLS1_3_BINDER_MATCH) in case of success as it may be propagated up
399 * by the callers of this function as a generic success condition.
400 */
401 #define SSL_TLS1_3_BINDER_DOES_NOT_MATCH 1
402 #define SSL_TLS1_3_BINDER_MATCH 0
403 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_offered_psks_check_binder_match(mbedtls_ssl_context * ssl,const unsigned char * binder,size_t binder_len,int psk_type,psa_algorithm_t psk_hash_alg)404 static int ssl_tls13_offered_psks_check_binder_match(
405 mbedtls_ssl_context *ssl,
406 const unsigned char *binder, size_t binder_len,
407 int psk_type, psa_algorithm_t psk_hash_alg)
408 {
409 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
410
411 unsigned char transcript[PSA_HASH_MAX_SIZE];
412 size_t transcript_len;
413 unsigned char *psk;
414 size_t psk_len;
415 unsigned char server_computed_binder[PSA_HASH_MAX_SIZE];
416
417 if (binder_len != PSA_HASH_LENGTH(psk_hash_alg)) {
418 return SSL_TLS1_3_BINDER_DOES_NOT_MATCH;
419 }
420
421 /* Get current state of handshake transcript. */
422 ret = mbedtls_ssl_get_handshake_transcript(
423 ssl, mbedtls_md_type_from_psa_alg(psk_hash_alg),
424 transcript, sizeof(transcript), &transcript_len);
425 if (ret != 0) {
426 return ret;
427 }
428
429 ret = mbedtls_ssl_tls13_export_handshake_psk(ssl, &psk, &psk_len);
430 if (ret != 0) {
431 return ret;
432 }
433
434 ret = mbedtls_ssl_tls13_create_psk_binder(ssl, psk_hash_alg,
435 psk, psk_len, psk_type,
436 transcript,
437 server_computed_binder);
438 #if defined(MBEDTLS_USE_PSA_CRYPTO)
439 mbedtls_free((void *) psk);
440 #endif
441 if (ret != 0) {
442 MBEDTLS_SSL_DEBUG_MSG(1, ("PSK binder calculation failed."));
443 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
444 }
445
446 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( computed ): ",
447 server_computed_binder, transcript_len);
448 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( received ): ", binder, binder_len);
449
450 if (mbedtls_ct_memcmp(server_computed_binder,
451 binder,
452 PSA_HASH_LENGTH(psk_hash_alg)) == 0) {
453 return SSL_TLS1_3_BINDER_MATCH;
454 }
455
456 mbedtls_platform_zeroize(server_computed_binder,
457 sizeof(server_computed_binder));
458 return SSL_TLS1_3_BINDER_DOES_NOT_MATCH;
459 }
460
461 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
462 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_session_copy_ticket(mbedtls_ssl_session * dst,const mbedtls_ssl_session * src)463 static int ssl_tls13_session_copy_ticket(mbedtls_ssl_session *dst,
464 const mbedtls_ssl_session *src)
465 {
466 dst->ticket_age_add = src->ticket_age_add;
467 dst->ticket_flags = src->ticket_flags;
468 dst->resumption_key_len = src->resumption_key_len;
469 if (src->resumption_key_len == 0) {
470 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
471 }
472 memcpy(dst->resumption_key, src->resumption_key, src->resumption_key_len);
473
474 #if defined(MBEDTLS_SSL_EARLY_DATA)
475 dst->max_early_data_size = src->max_early_data_size;
476
477 #if defined(MBEDTLS_SSL_ALPN)
478 int ret = mbedtls_ssl_session_set_ticket_alpn(dst, src->ticket_alpn);
479 if (ret != 0) {
480 return ret;
481 }
482 #endif /* MBEDTLS_SSL_ALPN */
483 #endif /* MBEDTLS_SSL_EARLY_DATA*/
484
485 return 0;
486 }
487 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
488
489 struct psk_attributes {
490 int type;
491 int key_exchange_mode;
492 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
493 };
494 #define PSK_ATTRIBUTES_INIT { 0, 0, NULL }
495
496 /* Parser for pre_shared_key extension in client hello
497 * struct {
498 * opaque identity<1..2^16-1>;
499 * uint32 obfuscated_ticket_age;
500 * } PskIdentity;
501 *
502 * opaque PskBinderEntry<32..255>;
503 *
504 * struct {
505 * PskIdentity identities<7..2^16-1>;
506 * PskBinderEntry binders<33..2^16-1>;
507 * } OfferedPsks;
508 *
509 * struct {
510 * select (Handshake.msg_type) {
511 * case client_hello: OfferedPsks;
512 * ....
513 * };
514 * } PreSharedKeyExtension;
515 */
516 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_pre_shared_key_ext(mbedtls_ssl_context * ssl,const unsigned char * pre_shared_key_ext,const unsigned char * pre_shared_key_ext_end,const unsigned char * ciphersuites,const unsigned char * ciphersuites_end,struct psk_attributes * psk)517 static int ssl_tls13_parse_pre_shared_key_ext(
518 mbedtls_ssl_context *ssl,
519 const unsigned char *pre_shared_key_ext,
520 const unsigned char *pre_shared_key_ext_end,
521 const unsigned char *ciphersuites,
522 const unsigned char *ciphersuites_end,
523 struct psk_attributes *psk)
524 {
525 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
526 const unsigned char *identities = pre_shared_key_ext;
527 const unsigned char *p_identity_len;
528 size_t identities_len;
529 const unsigned char *identities_end;
530 const unsigned char *binders;
531 const unsigned char *p_binder_len;
532 size_t binders_len;
533 const unsigned char *binders_end;
534 int matched_identity = -1;
535 int identity_id = -1;
536
537 MBEDTLS_SSL_DEBUG_BUF(3, "pre_shared_key extension",
538 pre_shared_key_ext,
539 pre_shared_key_ext_end - pre_shared_key_ext);
540
541 /* identities_len 2 bytes
542 * identities_data >= 7 bytes
543 */
544 MBEDTLS_SSL_CHK_BUF_READ_PTR(identities, pre_shared_key_ext_end, 7 + 2);
545 identities_len = MBEDTLS_GET_UINT16_BE(identities, 0);
546 p_identity_len = identities + 2;
547 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, pre_shared_key_ext_end,
548 identities_len);
549 identities_end = p_identity_len + identities_len;
550
551 /* binders_len 2 bytes
552 * binders >= 33 bytes
553 */
554 binders = identities_end;
555 MBEDTLS_SSL_CHK_BUF_READ_PTR(binders, pre_shared_key_ext_end, 33 + 2);
556 binders_len = MBEDTLS_GET_UINT16_BE(binders, 0);
557 p_binder_len = binders + 2;
558 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, pre_shared_key_ext_end, binders_len);
559 binders_end = p_binder_len + binders_len;
560
561 ret = ssl->handshake->update_checksum(ssl, pre_shared_key_ext,
562 identities_end - pre_shared_key_ext);
563 if (0 != ret) {
564 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
565 return ret;
566 }
567
568 while (p_identity_len < identities_end && p_binder_len < binders_end) {
569 const unsigned char *identity;
570 size_t identity_len;
571 uint32_t obfuscated_ticket_age;
572 const unsigned char *binder;
573 size_t binder_len;
574 int psk_ciphersuite_id;
575 psa_algorithm_t psk_hash_alg;
576 int allowed_key_exchange_modes;
577
578 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
579 mbedtls_ssl_session session;
580 mbedtls_ssl_session_init(&session);
581 #endif
582
583 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, identities_end, 2 + 1 + 4);
584 identity_len = MBEDTLS_GET_UINT16_BE(p_identity_len, 0);
585 identity = p_identity_len + 2;
586 MBEDTLS_SSL_CHK_BUF_READ_PTR(identity, identities_end, identity_len + 4);
587 obfuscated_ticket_age = MBEDTLS_GET_UINT32_BE(identity, identity_len);
588 p_identity_len += identity_len + 6;
589
590 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, binders_end, 1 + 32);
591 binder_len = *p_binder_len;
592 binder = p_binder_len + 1;
593 MBEDTLS_SSL_CHK_BUF_READ_PTR(binder, binders_end, binder_len);
594 p_binder_len += binder_len + 1;
595
596 identity_id++;
597 if (matched_identity != -1) {
598 continue;
599 }
600
601 ret = ssl_tls13_offered_psks_check_identity_match(
602 ssl, identity, identity_len, obfuscated_ticket_age,
603 &psk->type, &session);
604 if (ret != SSL_TLS1_3_PSK_IDENTITY_MATCH) {
605 continue;
606 }
607
608 MBEDTLS_SSL_DEBUG_MSG(4, ("found matched identity"));
609
610 switch (psk->type) {
611 case MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL:
612 psk_ciphersuite_id = 0;
613 psk_hash_alg = PSA_ALG_SHA_256;
614 allowed_key_exchange_modes =
615 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL;
616 break;
617 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
618 case MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:
619 psk_ciphersuite_id = session.ciphersuite;
620 psk_hash_alg = PSA_ALG_NONE;
621 ssl->session_negotiate->ticket_flags = session.ticket_flags;
622 allowed_key_exchange_modes =
623 session.ticket_flags &
624 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL;
625 break;
626 #endif
627 default:
628 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
629 }
630
631 psk->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE;
632
633 if ((allowed_key_exchange_modes &
634 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL) &&
635 ssl_tls13_key_exchange_is_psk_ephemeral_available(ssl)) {
636 psk->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
637 } else if ((allowed_key_exchange_modes &
638 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK) &&
639 ssl_tls13_key_exchange_is_psk_available(ssl)) {
640 psk->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
641 }
642
643 if (psk->key_exchange_mode == MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE) {
644 MBEDTLS_SSL_DEBUG_MSG(3, ("No suitable PSK key exchange mode"));
645 continue;
646 }
647
648 ssl_tls13_select_ciphersuite(ssl, ciphersuites, ciphersuites_end,
649 psk_ciphersuite_id, psk_hash_alg,
650 &psk->ciphersuite_info);
651
652 if (psk->ciphersuite_info == NULL) {
653 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
654 mbedtls_ssl_session_free(&session);
655 #endif
656 /*
657 * We consider finding a ciphersuite suitable for the PSK as part
658 * of the validation of its binder. Thus if we do not find one, we
659 * abort the handshake with a decrypt_error alert.
660 */
661 MBEDTLS_SSL_PEND_FATAL_ALERT(
662 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
663 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
664 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
665 }
666
667 ret = ssl_tls13_offered_psks_check_binder_match(
668 ssl, binder, binder_len, psk->type,
669 mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) psk->ciphersuite_info->mac));
670 if (ret != SSL_TLS1_3_BINDER_MATCH) {
671 /* For security reasons, the handshake should be aborted when we
672 * fail to validate a binder value. See RFC 8446 section 4.2.11.2
673 * and appendix E.6. */
674 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
675 mbedtls_ssl_session_free(&session);
676 #endif
677 MBEDTLS_SSL_DEBUG_MSG(3, ("Invalid binder."));
678 MBEDTLS_SSL_DEBUG_RET(
679 1, "ssl_tls13_offered_psks_check_binder_match", ret);
680 MBEDTLS_SSL_PEND_FATAL_ALERT(
681 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
682 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
683 return ret;
684 }
685
686 matched_identity = identity_id;
687
688 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
689 if (psk->type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
690 ret = ssl_tls13_session_copy_ticket(ssl->session_negotiate,
691 &session);
692 mbedtls_ssl_session_free(&session);
693 if (ret != 0) {
694 return ret;
695 }
696 }
697 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
698 }
699
700 if (p_identity_len != identities_end || p_binder_len != binders_end) {
701 MBEDTLS_SSL_DEBUG_MSG(3, ("pre_shared_key extension decode error"));
702 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
703 MBEDTLS_ERR_SSL_DECODE_ERROR);
704 return MBEDTLS_ERR_SSL_DECODE_ERROR;
705 }
706
707 /* Update the handshake transcript with the binder list. */
708 ret = ssl->handshake->update_checksum(
709 ssl, identities_end, (size_t) (binders_end - identities_end));
710 if (0 != ret) {
711 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
712 return ret;
713 }
714 if (matched_identity == -1) {
715 MBEDTLS_SSL_DEBUG_MSG(3, ("No usable PSK or ticket."));
716 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
717 }
718
719 ssl->handshake->selected_identity = (uint16_t) matched_identity;
720 MBEDTLS_SSL_DEBUG_MSG(3, ("Pre shared key found"));
721
722 return 0;
723 }
724
725 /*
726 * struct {
727 * select ( Handshake.msg_type ) {
728 * ....
729 * case server_hello:
730 * uint16 selected_identity;
731 * }
732 * } PreSharedKeyExtension;
733 */
ssl_tls13_write_server_pre_shared_key_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * olen)734 static int ssl_tls13_write_server_pre_shared_key_ext(mbedtls_ssl_context *ssl,
735 unsigned char *buf,
736 unsigned char *end,
737 size_t *olen)
738 {
739 unsigned char *p = (unsigned char *) buf;
740
741 *olen = 0;
742
743 int not_using_psk = 0;
744 #if defined(MBEDTLS_USE_PSA_CRYPTO)
745 not_using_psk = (mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque));
746 #else
747 not_using_psk = (ssl->handshake->psk == NULL);
748 #endif
749 if (not_using_psk) {
750 /* We shouldn't have called this extension writer unless we've
751 * chosen to use a PSK. */
752 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
753 }
754
755 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding pre_shared_key extension"));
756 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
757
758 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_PRE_SHARED_KEY, p, 0);
759 MBEDTLS_PUT_UINT16_BE(2, p, 2);
760
761 MBEDTLS_PUT_UINT16_BE(ssl->handshake->selected_identity, p, 4);
762
763 *olen = 6;
764
765 MBEDTLS_SSL_DEBUG_MSG(4, ("sent selected_identity: %u",
766 ssl->handshake->selected_identity));
767
768 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_PRE_SHARED_KEY);
769
770 return 0;
771 }
772
773 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
774
775 /* From RFC 8446:
776 * struct {
777 * ProtocolVersion versions<2..254>;
778 * } SupportedVersions;
779 */
780 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)781 static int ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context *ssl,
782 const unsigned char *buf,
783 const unsigned char *end)
784 {
785 const unsigned char *p = buf;
786 size_t versions_len;
787 const unsigned char *versions_end;
788 uint16_t tls_version;
789 int found_supported_version = 0;
790
791 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
792 versions_len = p[0];
793 p += 1;
794
795 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, versions_len);
796 versions_end = p + versions_len;
797 while (p < versions_end) {
798 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, versions_end, 2);
799 tls_version = mbedtls_ssl_read_version(p, ssl->conf->transport);
800 p += 2;
801
802 if (MBEDTLS_SSL_VERSION_TLS1_3 == tls_version) {
803 found_supported_version = 1;
804 break;
805 }
806
807 if ((MBEDTLS_SSL_VERSION_TLS1_2 == tls_version) &&
808 mbedtls_ssl_conf_is_tls12_enabled(ssl->conf)) {
809 found_supported_version = 1;
810 break;
811 }
812 }
813
814 if (!found_supported_version) {
815 MBEDTLS_SSL_DEBUG_MSG(1, ("No supported version found."));
816
817 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
818 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
819 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
820 }
821
822 MBEDTLS_SSL_DEBUG_MSG(1, ("Negotiated version: [%04x]",
823 (unsigned int) tls_version));
824
825 return (int) tls_version;
826 }
827
828 #if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
829 /*
830 *
831 * From RFC 8446:
832 * enum {
833 * ... (0xFFFF)
834 * } NamedGroup;
835 * struct {
836 * NamedGroup named_group_list<2..2^16-1>;
837 * } NamedGroupList;
838 */
839 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_supported_groups_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)840 static int ssl_tls13_parse_supported_groups_ext(mbedtls_ssl_context *ssl,
841 const unsigned char *buf,
842 const unsigned char *end)
843 {
844 const unsigned char *p = buf;
845 size_t named_group_list_len;
846 const unsigned char *named_group_list_end;
847
848 MBEDTLS_SSL_DEBUG_BUF(3, "supported_groups extension", p, end - buf);
849 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
850 named_group_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
851 p += 2;
852 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, named_group_list_len);
853 named_group_list_end = p + named_group_list_len;
854 ssl->handshake->hrr_selected_group = 0;
855
856 while (p < named_group_list_end) {
857 uint16_t named_group;
858 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, named_group_list_end, 2);
859 named_group = MBEDTLS_GET_UINT16_BE(p, 0);
860 p += 2;
861
862 MBEDTLS_SSL_DEBUG_MSG(2,
863 ("got named group: %s(%04x)",
864 mbedtls_ssl_named_group_to_str(named_group),
865 named_group));
866
867 if (!mbedtls_ssl_named_group_is_offered(ssl, named_group) ||
868 !mbedtls_ssl_named_group_is_supported(named_group) ||
869 ssl->handshake->hrr_selected_group != 0) {
870 continue;
871 }
872
873 MBEDTLS_SSL_DEBUG_MSG(2,
874 ("add named group %s(%04x) into received list.",
875 mbedtls_ssl_named_group_to_str(named_group),
876 named_group));
877
878 ssl->handshake->hrr_selected_group = named_group;
879 }
880
881 return 0;
882
883 }
884 #endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
885
886 #define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1
887
888 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
889 /*
890 * ssl_tls13_parse_key_shares_ext() verifies whether the information in the
891 * extension is correct and stores the first acceptable key share and its
892 * associated group.
893 *
894 * Possible return values are:
895 * - 0: Successful processing of the client provided key share extension.
896 * - SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH: The key shares provided by
897 * the client does not match a group supported by the server. A
898 * HelloRetryRequest will be needed.
899 * - A negative value for fatal errors.
900 */
901 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)902 static int ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context *ssl,
903 const unsigned char *buf,
904 const unsigned char *end)
905 {
906 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
907 unsigned char const *p = buf;
908 unsigned char const *client_shares_end;
909 size_t client_shares_len;
910
911 /* From RFC 8446:
912 *
913 * struct {
914 * KeyShareEntry client_shares<0..2^16-1>;
915 * } KeyShareClientHello;
916 *
917 */
918
919 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
920 client_shares_len = MBEDTLS_GET_UINT16_BE(p, 0);
921 p += 2;
922 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, client_shares_len);
923
924 ssl->handshake->offered_group_id = 0;
925 client_shares_end = p + client_shares_len;
926
927 /* We try to find a suitable key share entry and copy it to the
928 * handshake context. Later, we have to find out whether we can do
929 * something with the provided key share or whether we have to
930 * dismiss it and send a HelloRetryRequest message.
931 */
932
933 while (p < client_shares_end) {
934 uint16_t group;
935 size_t key_exchange_len;
936 const unsigned char *key_exchange;
937
938 /*
939 * struct {
940 * NamedGroup group;
941 * opaque key_exchange<1..2^16-1>;
942 * } KeyShareEntry;
943 */
944 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, 4);
945 group = MBEDTLS_GET_UINT16_BE(p, 0);
946 key_exchange_len = MBEDTLS_GET_UINT16_BE(p, 2);
947 p += 4;
948 key_exchange = p;
949 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, key_exchange_len);
950 p += key_exchange_len;
951
952 /* Continue parsing even if we have already found a match,
953 * for input validation purposes.
954 */
955 if (!mbedtls_ssl_named_group_is_offered(ssl, group) ||
956 !mbedtls_ssl_named_group_is_supported(group) ||
957 ssl->handshake->offered_group_id != 0) {
958 continue;
959 }
960
961 /*
962 * ECDHE and FFDHE groups are supported
963 */
964 if (mbedtls_ssl_tls13_named_group_is_ecdhe(group) ||
965 mbedtls_ssl_tls13_named_group_is_ffdh(group)) {
966 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDH/FFDH group: %s (%04x)",
967 mbedtls_ssl_named_group_to_str(group),
968 group));
969 ret = mbedtls_ssl_tls13_read_public_xxdhe_share(
970 ssl, key_exchange - 2, key_exchange_len + 2);
971 if (ret != 0) {
972 return ret;
973 }
974
975 } else {
976 MBEDTLS_SSL_DEBUG_MSG(4, ("Unrecognized NamedGroup %u",
977 (unsigned) group));
978 continue;
979 }
980
981 ssl->handshake->offered_group_id = group;
982 }
983
984
985 if (ssl->handshake->offered_group_id == 0) {
986 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching key share"));
987 return SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH;
988 }
989 return 0;
990 }
991 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
992
993 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_client_hello_has_exts(mbedtls_ssl_context * ssl,int exts_mask)994 static int ssl_tls13_client_hello_has_exts(mbedtls_ssl_context *ssl,
995 int exts_mask)
996 {
997 int masked = ssl->handshake->received_extensions & exts_mask;
998 return masked == exts_mask;
999 }
1000
1001 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
1002 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(mbedtls_ssl_context * ssl)1003 static int ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(
1004 mbedtls_ssl_context *ssl)
1005 {
1006 return ssl_tls13_client_hello_has_exts(
1007 ssl,
1008 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
1009 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
1010 MBEDTLS_SSL_EXT_MASK(SIG_ALG));
1011 }
1012 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
1013
1014 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
1015 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_client_hello_has_exts_for_psk_key_exchange(mbedtls_ssl_context * ssl)1016 static int ssl_tls13_client_hello_has_exts_for_psk_key_exchange(
1017 mbedtls_ssl_context *ssl)
1018 {
1019 return ssl_tls13_client_hello_has_exts(
1020 ssl,
1021 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
1022 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
1023 }
1024 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED */
1025
1026 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
1027 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(mbedtls_ssl_context * ssl)1028 static int ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(
1029 mbedtls_ssl_context *ssl)
1030 {
1031 return ssl_tls13_client_hello_has_exts(
1032 ssl,
1033 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
1034 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
1035 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
1036 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
1037 }
1038 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED */
1039
1040 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1041 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_key_exchange_is_psk_available(mbedtls_ssl_context * ssl)1042 static int ssl_tls13_key_exchange_is_psk_available(mbedtls_ssl_context *ssl)
1043 {
1044 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
1045 return mbedtls_ssl_conf_tls13_is_psk_enabled(ssl) &&
1046 mbedtls_ssl_tls13_is_psk_supported(ssl) &&
1047 ssl_tls13_client_hello_has_exts_for_psk_key_exchange(ssl);
1048 #else
1049 ((void) ssl);
1050 return 0;
1051 #endif
1052 }
1053
1054 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_key_exchange_is_psk_ephemeral_available(mbedtls_ssl_context * ssl)1055 static int ssl_tls13_key_exchange_is_psk_ephemeral_available(mbedtls_ssl_context *ssl)
1056 {
1057 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
1058 return mbedtls_ssl_conf_tls13_is_psk_ephemeral_enabled(ssl) &&
1059 mbedtls_ssl_tls13_is_psk_ephemeral_supported(ssl) &&
1060 ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(ssl);
1061 #else
1062 ((void) ssl);
1063 return 0;
1064 #endif
1065 }
1066 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
1067
1068 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_key_exchange_is_ephemeral_available(mbedtls_ssl_context * ssl)1069 static int ssl_tls13_key_exchange_is_ephemeral_available(mbedtls_ssl_context *ssl)
1070 {
1071 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
1072 return mbedtls_ssl_conf_tls13_is_ephemeral_enabled(ssl) &&
1073 ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(ssl);
1074 #else
1075 ((void) ssl);
1076 return 0;
1077 #endif
1078 }
1079
1080 #if defined(MBEDTLS_X509_CRT_PARSE_C) && \
1081 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
1082
1083 #if defined(MBEDTLS_USE_PSA_CRYPTO)
ssl_tls13_iana_sig_alg_to_psa_alg(uint16_t sig_alg)1084 static psa_algorithm_t ssl_tls13_iana_sig_alg_to_psa_alg(uint16_t sig_alg)
1085 {
1086 switch (sig_alg) {
1087 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256:
1088 return PSA_ALG_ECDSA(PSA_ALG_SHA_256);
1089 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384:
1090 return PSA_ALG_ECDSA(PSA_ALG_SHA_384);
1091 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512:
1092 return PSA_ALG_ECDSA(PSA_ALG_SHA_512);
1093 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
1094 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_256);
1095 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
1096 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_384);
1097 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
1098 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_512);
1099 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
1100 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256);
1101 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384:
1102 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_384);
1103 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512:
1104 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_512);
1105 default:
1106 return PSA_ALG_NONE;
1107 }
1108 }
1109 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1110
1111 /*
1112 * Pick best ( private key, certificate chain ) pair based on the signature
1113 * algorithms supported by the client.
1114 */
1115 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_pick_key_cert(mbedtls_ssl_context * ssl)1116 static int ssl_tls13_pick_key_cert(mbedtls_ssl_context *ssl)
1117 {
1118 mbedtls_ssl_key_cert *key_cert, *key_cert_list;
1119 const uint16_t *sig_alg = ssl->handshake->received_sig_algs;
1120
1121 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1122 if (ssl->handshake->sni_key_cert != NULL) {
1123 key_cert_list = ssl->handshake->sni_key_cert;
1124 } else
1125 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1126 key_cert_list = ssl->conf->key_cert;
1127
1128 if (key_cert_list == NULL) {
1129 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate"));
1130 return -1;
1131 }
1132
1133 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
1134 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) {
1135 continue;
1136 }
1137
1138 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) {
1139 continue;
1140 }
1141
1142 for (key_cert = key_cert_list; key_cert != NULL;
1143 key_cert = key_cert->next) {
1144 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1145 psa_algorithm_t psa_alg = PSA_ALG_NONE;
1146 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1147
1148 MBEDTLS_SSL_DEBUG_CRT(3, "certificate (chain) candidate",
1149 key_cert->cert);
1150
1151 /*
1152 * This avoids sending the client a cert it'll reject based on
1153 * keyUsage or other extensions.
1154 */
1155 if (mbedtls_x509_crt_check_key_usage(
1156 key_cert->cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0 ||
1157 mbedtls_x509_crt_check_extended_key_usage(
1158 key_cert->cert, MBEDTLS_OID_SERVER_AUTH,
1159 MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH)) != 0) {
1160 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
1161 "(extended) key usage extension"));
1162 continue;
1163 }
1164
1165 MBEDTLS_SSL_DEBUG_MSG(3,
1166 ("ssl_tls13_pick_key_cert:"
1167 "check signature algorithm %s [%04x]",
1168 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1169 *sig_alg));
1170 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1171 psa_alg = ssl_tls13_iana_sig_alg_to_psa_alg(*sig_alg);
1172 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1173
1174 if (mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
1175 *sig_alg, &key_cert->cert->pk)
1176 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1177 && psa_alg != PSA_ALG_NONE &&
1178 mbedtls_pk_can_do_ext(&key_cert->cert->pk, psa_alg,
1179 PSA_KEY_USAGE_SIGN_HASH) == 1
1180 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1181 ) {
1182 ssl->handshake->key_cert = key_cert;
1183 MBEDTLS_SSL_DEBUG_MSG(3,
1184 ("ssl_tls13_pick_key_cert:"
1185 "selected signature algorithm"
1186 " %s [%04x]",
1187 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1188 *sig_alg));
1189 MBEDTLS_SSL_DEBUG_CRT(
1190 3, "selected certificate (chain)",
1191 ssl->handshake->key_cert->cert);
1192 return 0;
1193 }
1194 }
1195 }
1196
1197 MBEDTLS_SSL_DEBUG_MSG(2, ("ssl_tls13_pick_key_cert:"
1198 "no suitable certificate found"));
1199 return -1;
1200 }
1201 #endif /* MBEDTLS_X509_CRT_PARSE_C &&
1202 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
1203
1204 /*
1205 *
1206 * STATE HANDLING: ClientHello
1207 *
1208 * There are three possible classes of outcomes when parsing the ClientHello:
1209 *
1210 * 1) The ClientHello was well-formed and matched the server's configuration.
1211 *
1212 * In this case, the server progresses to sending its ServerHello.
1213 *
1214 * 2) The ClientHello was well-formed but didn't match the server's
1215 * configuration.
1216 *
1217 * For example, the client might not have offered a key share which
1218 * the server supports, or the server might require a cookie.
1219 *
1220 * In this case, the server sends a HelloRetryRequest.
1221 *
1222 * 3) The ClientHello was ill-formed
1223 *
1224 * In this case, we abort the handshake.
1225 *
1226 */
1227
1228 /*
1229 * Structure of this message:
1230 *
1231 * uint16 ProtocolVersion;
1232 * opaque Random[32];
1233 * uint8 CipherSuite[2]; // Cryptographic suite selector
1234 *
1235 * struct {
1236 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
1237 * Random random;
1238 * opaque legacy_session_id<0..32>;
1239 * CipherSuite cipher_suites<2..2^16-2>;
1240 * opaque legacy_compression_methods<1..2^8-1>;
1241 * Extension extensions<8..2^16-1>;
1242 * } ClientHello;
1243 */
1244
1245 #define SSL_CLIENT_HELLO_OK 0
1246 #define SSL_CLIENT_HELLO_HRR_REQUIRED 1
1247 #define SSL_CLIENT_HELLO_TLS1_2 2
1248
1249 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_client_hello(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1250 static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl,
1251 const unsigned char *buf,
1252 const unsigned char *end)
1253 {
1254 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1255 const unsigned char *p = buf;
1256 const unsigned char *random;
1257 size_t legacy_session_id_len;
1258 const unsigned char *legacy_session_id;
1259 size_t cipher_suites_len;
1260 const unsigned char *cipher_suites;
1261 const unsigned char *cipher_suites_end;
1262 size_t extensions_len;
1263 const unsigned char *extensions_end;
1264 const unsigned char *supported_versions_data;
1265 const unsigned char *supported_versions_data_end;
1266 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1267 int hrr_required = 0;
1268 int no_usable_share_for_key_agreement = 0;
1269
1270 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1271 int got_psk = 0;
1272 struct psk_attributes psk = PSK_ATTRIBUTES_INIT;
1273 const unsigned char *pre_shared_key_ext = NULL;
1274 const unsigned char *pre_shared_key_ext_end = NULL;
1275 #endif
1276
1277 /*
1278 * ClientHello layout:
1279 * 0 . 1 protocol version
1280 * 2 . 33 random bytes
1281 * 34 . 34 session id length ( 1 byte )
1282 * 35 . 34+x session id
1283 * .. . .. ciphersuite list length ( 2 bytes )
1284 * .. . .. ciphersuite list
1285 * .. . .. compression alg. list length ( 1 byte )
1286 * .. . .. compression alg. list
1287 * .. . .. extensions length ( 2 bytes, optional )
1288 * .. . .. extensions ( optional )
1289 */
1290
1291 /*
1292 * Minimal length ( with everything empty and extensions omitted ) is
1293 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1294 * read at least up to session id length without worrying.
1295 */
1296 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 38);
1297
1298 /* ...
1299 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1300 * ...
1301 * with ProtocolVersion defined as:
1302 * uint16 ProtocolVersion;
1303 */
1304 if (mbedtls_ssl_read_version(p, ssl->conf->transport) !=
1305 MBEDTLS_SSL_VERSION_TLS1_2) {
1306 MBEDTLS_SSL_DEBUG_MSG(1, ("Unsupported version of TLS."));
1307 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1308 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
1309 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1310 }
1311 p += 2;
1312
1313 /* ...
1314 * Random random;
1315 * ...
1316 * with Random defined as:
1317 * opaque Random[32];
1318 */
1319 random = p;
1320 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
1321
1322 /* ...
1323 * opaque legacy_session_id<0..32>;
1324 * ...
1325 */
1326 legacy_session_id_len = *(p++);
1327 legacy_session_id = p;
1328
1329 /*
1330 * Check we have enough data for the legacy session identifier
1331 * and the ciphersuite list length.
1332 */
1333 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, legacy_session_id_len + 2);
1334 p += legacy_session_id_len;
1335
1336 /* ...
1337 * CipherSuite cipher_suites<2..2^16-2>;
1338 * ...
1339 * with CipherSuite defined as:
1340 * uint8 CipherSuite[2];
1341 */
1342 cipher_suites_len = MBEDTLS_GET_UINT16_BE(p, 0);
1343 p += 2;
1344 cipher_suites = p;
1345
1346 /*
1347 * The length of the ciphersuite list has to be even.
1348 */
1349 if (cipher_suites_len & 1) {
1350 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1351 MBEDTLS_ERR_SSL_DECODE_ERROR);
1352 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1353 }
1354
1355 /* Check we have enough data for the ciphersuite list, the legacy
1356 * compression methods and the length of the extensions.
1357 *
1358 * cipher_suites cipher_suites_len bytes
1359 * legacy_compression_methods 2 bytes
1360 * extensions_len 2 bytes
1361 */
1362 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, cipher_suites_len + 2 + 2);
1363 p += cipher_suites_len;
1364 cipher_suites_end = p;
1365
1366 /*
1367 * Search for the supported versions extension and parse it to determine
1368 * if the client supports TLS 1.3.
1369 */
1370 ret = mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts(
1371 ssl, p + 2, end,
1372 &supported_versions_data, &supported_versions_data_end);
1373 if (ret < 0) {
1374 MBEDTLS_SSL_DEBUG_RET(1,
1375 ("mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts"), ret);
1376 return ret;
1377 }
1378
1379 if (ret == 0) {
1380 return SSL_CLIENT_HELLO_TLS1_2;
1381 }
1382
1383 if (ret == 1) {
1384 ret = ssl_tls13_parse_supported_versions_ext(ssl,
1385 supported_versions_data,
1386 supported_versions_data_end);
1387 if (ret < 0) {
1388 MBEDTLS_SSL_DEBUG_RET(1,
1389 ("ssl_tls13_parse_supported_versions_ext"), ret);
1390 return ret;
1391 }
1392
1393 /*
1394 * The supported versions extension was parsed successfully as the
1395 * value returned by ssl_tls13_parse_supported_versions_ext() is
1396 * positive. The return value is then equal to
1397 * MBEDTLS_SSL_VERSION_TLS1_2 or MBEDTLS_SSL_VERSION_TLS1_3, defining
1398 * the TLS version to negotiate.
1399 */
1400 if (MBEDTLS_SSL_VERSION_TLS1_2 == ret) {
1401 return SSL_CLIENT_HELLO_TLS1_2;
1402 }
1403 }
1404
1405 /*
1406 * We negotiate TLS 1.3.
1407 */
1408 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1409 ssl->session_negotiate->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1410 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
1411
1412 /*
1413 * We are negotiating the version 1.3 of the protocol. Do what we have
1414 * postponed: copy of the client random bytes, copy of the legacy session
1415 * identifier and selection of the TLS 1.3 cipher suite.
1416 */
1417 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes",
1418 random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1419 memcpy(&handshake->randbytes[0], random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1420
1421 if (legacy_session_id_len > sizeof(ssl->session_negotiate->id)) {
1422 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1423 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1424 }
1425 ssl->session_negotiate->id_len = legacy_session_id_len;
1426 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id",
1427 legacy_session_id, legacy_session_id_len);
1428 memcpy(&ssl->session_negotiate->id[0],
1429 legacy_session_id, legacy_session_id_len);
1430
1431 /*
1432 * Search for a matching ciphersuite
1433 */
1434 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, list of cipher suites",
1435 cipher_suites, cipher_suites_len);
1436
1437 ssl_tls13_select_ciphersuite(ssl, cipher_suites, cipher_suites_end,
1438 0, PSA_ALG_NONE, &handshake->ciphersuite_info);
1439
1440 if (handshake->ciphersuite_info == NULL) {
1441 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1442 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1443 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1444 }
1445 ssl->session_negotiate->ciphersuite = handshake->ciphersuite_info->id;
1446
1447 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %04x - %s",
1448 ((unsigned) handshake->ciphersuite_info->id),
1449 handshake->ciphersuite_info->name));
1450
1451 /* ...
1452 * opaque legacy_compression_methods<1..2^8-1>;
1453 * ...
1454 */
1455 if (p[0] != 1 || p[1] != MBEDTLS_SSL_COMPRESS_NULL) {
1456 MBEDTLS_SSL_DEBUG_MSG(1, ("bad legacy compression method"));
1457 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1458 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1459 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1460 }
1461 p += 2;
1462
1463 /* ...
1464 * Extension extensions<8..2^16-1>;
1465 * ...
1466 * with Extension defined as:
1467 * struct {
1468 * ExtensionType extension_type;
1469 * opaque extension_data<0..2^16-1>;
1470 * } Extension;
1471 */
1472 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
1473 p += 2;
1474 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len);
1475 extensions_end = p + extensions_len;
1476
1477 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", p, extensions_len);
1478 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
1479
1480 while (p < extensions_end) {
1481 unsigned int extension_type;
1482 size_t extension_data_len;
1483 const unsigned char *extension_data_end;
1484 uint32_t allowed_exts = MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CH;
1485
1486 if (ssl->handshake->hello_retry_request_flag) {
1487 /* Do not accept early data extension in 2nd ClientHello */
1488 allowed_exts &= ~MBEDTLS_SSL_EXT_MASK(EARLY_DATA);
1489 }
1490
1491 /* RFC 8446, section 4.2.11
1492 *
1493 * The "pre_shared_key" extension MUST be the last extension in the
1494 * ClientHello (this facilitates implementation as described below).
1495 * Servers MUST check that it is the last extension and otherwise fail
1496 * the handshake with an "illegal_parameter" alert.
1497 */
1498 if (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY)) {
1499 MBEDTLS_SSL_DEBUG_MSG(
1500 3, ("pre_shared_key is not last extension."));
1501 MBEDTLS_SSL_PEND_FATAL_ALERT(
1502 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1503 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1504 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1505 }
1506
1507 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
1508 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
1509 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
1510 p += 4;
1511
1512 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
1513 extension_data_end = p + extension_data_len;
1514
1515 ret = mbedtls_ssl_tls13_check_received_extension(
1516 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, extension_type,
1517 allowed_exts);
1518 if (ret != 0) {
1519 return ret;
1520 }
1521
1522 switch (extension_type) {
1523 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1524 case MBEDTLS_TLS_EXT_SERVERNAME:
1525 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension"));
1526 ret = mbedtls_ssl_parse_server_name_ext(ssl, p,
1527 extension_data_end);
1528 if (ret != 0) {
1529 MBEDTLS_SSL_DEBUG_RET(
1530 1, "mbedtls_ssl_parse_servername_ext", ret);
1531 return ret;
1532 }
1533 break;
1534 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1535
1536 #if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
1537 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1538 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported group extension"));
1539
1540 /* Supported Groups Extension
1541 *
1542 * When sent by the client, the "supported_groups" extension
1543 * indicates the named groups which the client supports,
1544 * ordered from most preferred to least preferred.
1545 */
1546 ret = ssl_tls13_parse_supported_groups_ext(
1547 ssl, p, extension_data_end);
1548 if (ret != 0) {
1549 MBEDTLS_SSL_DEBUG_RET(
1550 1, "ssl_tls13_parse_supported_groups_ext", ret);
1551 return ret;
1552 }
1553
1554 break;
1555 #endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH*/
1556
1557 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
1558 case MBEDTLS_TLS_EXT_KEY_SHARE:
1559 MBEDTLS_SSL_DEBUG_MSG(3, ("found key share extension"));
1560
1561 /*
1562 * Key Share Extension
1563 *
1564 * When sent by the client, the "key_share" extension
1565 * contains the endpoint's cryptographic parameters for
1566 * ECDHE/DHE key establishment methods.
1567 */
1568 ret = ssl_tls13_parse_key_shares_ext(
1569 ssl, p, extension_data_end);
1570 if (ret == SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH) {
1571 MBEDTLS_SSL_DEBUG_MSG(2, ("No usable share for key agreement."));
1572 no_usable_share_for_key_agreement = 1;
1573 }
1574
1575 if (ret < 0) {
1576 MBEDTLS_SSL_DEBUG_RET(
1577 1, "ssl_tls13_parse_key_shares_ext", ret);
1578 return ret;
1579 }
1580
1581 break;
1582 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
1583
1584 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
1585 /* Already parsed */
1586 break;
1587
1588 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1589 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
1590 MBEDTLS_SSL_DEBUG_MSG(
1591 3, ("found psk key exchange modes extension"));
1592
1593 ret = ssl_tls13_parse_key_exchange_modes_ext(
1594 ssl, p, extension_data_end);
1595 if (ret != 0) {
1596 MBEDTLS_SSL_DEBUG_RET(
1597 1, "ssl_tls13_parse_key_exchange_modes_ext", ret);
1598 return ret;
1599 }
1600
1601 break;
1602 #endif
1603
1604 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1605 MBEDTLS_SSL_DEBUG_MSG(3, ("found pre_shared_key extension"));
1606 if ((handshake->received_extensions &
1607 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES)) == 0) {
1608 MBEDTLS_SSL_PEND_FATAL_ALERT(
1609 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1610 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1611 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1612 }
1613 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1614 /* Delay processing of the PSK identity once we have
1615 * found out which algorithms to use. We keep a pointer
1616 * to the buffer and the size for later processing.
1617 */
1618 pre_shared_key_ext = p;
1619 pre_shared_key_ext_end = extension_data_end;
1620 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
1621 break;
1622
1623 #if defined(MBEDTLS_SSL_ALPN)
1624 case MBEDTLS_TLS_EXT_ALPN:
1625 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension"));
1626
1627 ret = mbedtls_ssl_parse_alpn_ext(ssl, p, extension_data_end);
1628 if (ret != 0) {
1629 MBEDTLS_SSL_DEBUG_RET(
1630 1, ("mbedtls_ssl_parse_alpn_ext"), ret);
1631 return ret;
1632 }
1633 break;
1634 #endif /* MBEDTLS_SSL_ALPN */
1635
1636 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
1637 case MBEDTLS_TLS_EXT_SIG_ALG:
1638 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension"));
1639
1640 ret = mbedtls_ssl_parse_sig_alg_ext(
1641 ssl, p, extension_data_end);
1642 if (ret != 0) {
1643 MBEDTLS_SSL_DEBUG_RET(
1644 1, "mbedtls_ssl_parse_sig_alg_ext", ret);
1645 return ret;
1646 }
1647 break;
1648 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
1649
1650 #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
1651 case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
1652 MBEDTLS_SSL_DEBUG_MSG(3, ("found record_size_limit extension"));
1653
1654 ret = mbedtls_ssl_tls13_parse_record_size_limit_ext(
1655 ssl, p, extension_data_end);
1656 if (ret != 0) {
1657 MBEDTLS_SSL_DEBUG_RET(
1658 1, ("mbedtls_ssl_tls13_parse_record_size_limit_ext"), ret);
1659 return ret;
1660 }
1661 break;
1662 #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
1663
1664 default:
1665 MBEDTLS_SSL_PRINT_EXT(
1666 3, MBEDTLS_SSL_HS_CLIENT_HELLO,
1667 extension_type, "( ignored )");
1668 break;
1669 }
1670
1671 p += extension_data_len;
1672 }
1673
1674 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CLIENT_HELLO,
1675 handshake->received_extensions);
1676
1677 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl,
1678 MBEDTLS_SSL_HS_CLIENT_HELLO,
1679 p - buf);
1680 if (0 != ret) {
1681 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_add_hs_hdr_to_checksum"), ret);
1682 return ret;
1683 }
1684
1685 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1686 /* Update checksum with either
1687 * - The entire content of the CH message, if no PSK extension is present
1688 * - The content up to but excluding the PSK extension, if present.
1689 * Always parse the pre-shared-key extension when present in the
1690 * ClientHello even if some pre-requisites for PSK key exchange modes are
1691 * not met. That way we always validate the syntax of the extension.
1692 */
1693 if (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY)) {
1694 ret = handshake->update_checksum(ssl, buf,
1695 pre_shared_key_ext - buf);
1696 if (0 != ret) {
1697 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1698 return ret;
1699 }
1700 ret = ssl_tls13_parse_pre_shared_key_ext(ssl,
1701 pre_shared_key_ext,
1702 pre_shared_key_ext_end,
1703 cipher_suites,
1704 cipher_suites_end,
1705 &psk);
1706 if (ret == 0) {
1707 got_psk = 1;
1708 } else if (ret != MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) {
1709 MBEDTLS_SSL_DEBUG_RET(
1710 1, "ssl_tls13_parse_pre_shared_key_ext", ret);
1711 return ret;
1712 }
1713 } else
1714 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
1715 {
1716 ret = handshake->update_checksum(ssl, buf, p - buf);
1717 if (0 != ret) {
1718 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1719 return ret;
1720 }
1721 }
1722
1723 /*
1724 * Determine the key exchange algorithm to use.
1725 * There are three types of key exchanges supported in TLS 1.3:
1726 * - (EC)DH with ECDSA,
1727 * - (EC)DH with PSK,
1728 * - plain PSK.
1729 *
1730 * The PSK-based key exchanges may additionally be used with 0-RTT.
1731 *
1732 * Our built-in order of preference is
1733 * 1 ) (EC)DHE-PSK Mode ( psk_ephemeral )
1734 * 2 ) Certificate Mode ( ephemeral )
1735 * 3 ) Plain PSK Mode ( psk )
1736 */
1737 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1738 if (got_psk && (psk.key_exchange_mode ==
1739 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)) {
1740 handshake->key_exchange_mode =
1741 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
1742 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk_ephemeral"));
1743
1744 } else
1745 #endif
1746 if (ssl_tls13_key_exchange_is_ephemeral_available(ssl)) {
1747 handshake->key_exchange_mode =
1748 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
1749 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: ephemeral"));
1750
1751 }
1752 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1753 else if (got_psk && (psk.key_exchange_mode ==
1754 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK)) {
1755 handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
1756 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk"));
1757 }
1758 #endif
1759 else {
1760 MBEDTLS_SSL_DEBUG_MSG(
1761 1,
1762 ("ClientHello message misses mandatory extensions."));
1763 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION,
1764 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1765 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1766 }
1767
1768 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1769 if (handshake->key_exchange_mode &
1770 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL) {
1771 handshake->ciphersuite_info = psk.ciphersuite_info;
1772 ssl->session_negotiate->ciphersuite = psk.ciphersuite_info->id;
1773
1774 MBEDTLS_SSL_DEBUG_MSG(2, ("Select PSK ciphersuite: %04x - %s",
1775 ((unsigned) psk.ciphersuite_info->id),
1776 psk.ciphersuite_info->name));
1777
1778 if (psk.type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
1779 handshake->resume = 1;
1780 }
1781 }
1782 #endif
1783
1784 if (handshake->key_exchange_mode !=
1785 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK) {
1786 hrr_required = (no_usable_share_for_key_agreement != 0);
1787 }
1788
1789 mbedtls_ssl_optimize_checksum(ssl, handshake->ciphersuite_info);
1790
1791 return hrr_required ? SSL_CLIENT_HELLO_HRR_REQUIRED : SSL_CLIENT_HELLO_OK;
1792 }
1793
1794 #if defined(MBEDTLS_SSL_EARLY_DATA)
ssl_tls13_check_early_data_requirements(mbedtls_ssl_context * ssl)1795 static int ssl_tls13_check_early_data_requirements(mbedtls_ssl_context *ssl)
1796 {
1797 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1798
1799 if (ssl->conf->early_data_enabled == MBEDTLS_SSL_EARLY_DATA_DISABLED) {
1800 MBEDTLS_SSL_DEBUG_MSG(
1801 1,
1802 ("EarlyData: rejected, feature disabled in server configuration."));
1803 return -1;
1804 }
1805
1806 if (!handshake->resume) {
1807 /* We currently support early data only in the case of PSKs established
1808 via a NewSessionTicket message thus in the case of a session
1809 resumption. */
1810 MBEDTLS_SSL_DEBUG_MSG(
1811 1, ("EarlyData: rejected, not a session resumption."));
1812 return -1;
1813 }
1814
1815 /* RFC 8446 4.2.10
1816 *
1817 * In order to accept early data, the server MUST have accepted a PSK cipher
1818 * suite and selected the first key offered in the client's "pre_shared_key"
1819 * extension. In addition, it MUST verify that the following values are the
1820 * same as those associated with the selected PSK:
1821 * - The TLS version number
1822 * - The selected cipher suite
1823 * - The selected ALPN [RFC7301] protocol, if any
1824 *
1825 * NOTE:
1826 * - The TLS version number is checked in
1827 * ssl_tls13_offered_psks_check_identity_match_ticket().
1828 */
1829
1830 if (handshake->selected_identity != 0) {
1831 MBEDTLS_SSL_DEBUG_MSG(
1832 1, ("EarlyData: rejected, the selected key in "
1833 "`pre_shared_key` is not the first one."));
1834 return -1;
1835 }
1836
1837 if (handshake->ciphersuite_info->id !=
1838 ssl->session_negotiate->ciphersuite) {
1839 MBEDTLS_SSL_DEBUG_MSG(
1840 1, ("EarlyData: rejected, the selected ciphersuite is not the one "
1841 "of the selected pre-shared key."));
1842 return -1;
1843
1844 }
1845
1846 if (!mbedtls_ssl_tls13_session_ticket_allow_early_data(ssl->session_negotiate)) {
1847 MBEDTLS_SSL_DEBUG_MSG(
1848 1,
1849 ("EarlyData: rejected, early_data not allowed in ticket "
1850 "permission bits."));
1851 return -1;
1852 }
1853
1854 #if defined(MBEDTLS_SSL_ALPN)
1855 const char *alpn = mbedtls_ssl_get_alpn_protocol(ssl);
1856 size_t alpn_len;
1857
1858 if (alpn == NULL && ssl->session_negotiate->ticket_alpn == NULL) {
1859 return 0;
1860 }
1861
1862 if (alpn != NULL) {
1863 alpn_len = strlen(alpn);
1864 }
1865
1866 if (alpn == NULL ||
1867 ssl->session_negotiate->ticket_alpn == NULL ||
1868 alpn_len != strlen(ssl->session_negotiate->ticket_alpn) ||
1869 (memcmp(alpn, ssl->session_negotiate->ticket_alpn, alpn_len) != 0)) {
1870 MBEDTLS_SSL_DEBUG_MSG(1, ("EarlyData: rejected, the selected ALPN is different "
1871 "from the one associated with the pre-shared key."));
1872 return -1;
1873 }
1874 #endif
1875
1876 return 0;
1877 }
1878 #endif /* MBEDTLS_SSL_EARLY_DATA */
1879
1880 /* Update the handshake state machine */
1881
1882 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_postprocess_client_hello(mbedtls_ssl_context * ssl,int hrr_required)1883 static int ssl_tls13_postprocess_client_hello(mbedtls_ssl_context *ssl,
1884 int hrr_required)
1885 {
1886 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1887
1888 /*
1889 * Server certificate selection
1890 */
1891 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) {
1892 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret);
1893 return ret;
1894 }
1895 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1896 ssl->handshake->sni_name = NULL;
1897 ssl->handshake->sni_name_len = 0;
1898 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1899
1900 ret = mbedtls_ssl_tls13_key_schedule_stage_early(ssl);
1901 if (ret != 0) {
1902 MBEDTLS_SSL_DEBUG_RET(1,
1903 "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret);
1904 return ret;
1905 }
1906
1907 #if defined(MBEDTLS_SSL_EARLY_DATA)
1908 if (ssl->handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(EARLY_DATA)) {
1909 ssl->handshake->early_data_accepted =
1910 (!hrr_required) && (ssl_tls13_check_early_data_requirements(ssl) == 0);
1911
1912 if (ssl->handshake->early_data_accepted) {
1913 ret = mbedtls_ssl_tls13_compute_early_transform(ssl);
1914 if (ret != 0) {
1915 MBEDTLS_SSL_DEBUG_RET(
1916 1, "mbedtls_ssl_tls13_compute_early_transform", ret);
1917 return ret;
1918 }
1919 } else {
1920 ssl->discard_early_data_record =
1921 hrr_required ?
1922 MBEDTLS_SSL_EARLY_DATA_DISCARD :
1923 MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD;
1924 }
1925 }
1926 #else
1927 ((void) hrr_required);
1928 #endif /* MBEDTLS_SSL_EARLY_DATA */
1929
1930 return 0;
1931 }
1932
1933 /*
1934 * Main entry point from the state machine; orchestrates the otherfunctions.
1935 */
1936
1937 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_client_hello(mbedtls_ssl_context * ssl)1938 static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
1939 {
1940
1941 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1942 unsigned char *buf = NULL;
1943 size_t buflen = 0;
1944 int parse_client_hello_ret;
1945
1946 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
1947
1948 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
1949 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
1950 &buf, &buflen));
1951
1952 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf,
1953 buf + buflen));
1954 parse_client_hello_ret = ret; /* Store positive return value of
1955 * parse_client_hello,
1956 * as negative error codes are handled
1957 * by MBEDTLS_SSL_PROC_CHK_NEG. */
1958
1959 /*
1960 * Version 1.2 of the protocol has to be used for the handshake.
1961 * If TLS 1.2 is not supported, abort the handshake. Otherwise, set the
1962 * ssl->keep_current_message flag for the ClientHello to be kept and parsed
1963 * as a TLS 1.2 ClientHello. We also change ssl->tls_version to
1964 * MBEDTLS_SSL_VERSION_TLS1_2 thus from now on mbedtls_ssl_handshake_step()
1965 * will dispatch to the TLS 1.2 state machine.
1966 */
1967 if (SSL_CLIENT_HELLO_TLS1_2 == parse_client_hello_ret) {
1968 /* Check if server supports TLS 1.2 */
1969 if (!mbedtls_ssl_conf_is_tls12_enabled(ssl->conf)) {
1970 MBEDTLS_SSL_DEBUG_MSG(
1971 1, ("TLS 1.2 not supported."));
1972 MBEDTLS_SSL_PEND_FATAL_ALERT(
1973 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1974 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
1975 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1976 }
1977 ssl->keep_current_message = 1;
1978 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
1979 return 0;
1980 }
1981
1982 MBEDTLS_SSL_PROC_CHK(
1983 ssl_tls13_postprocess_client_hello(ssl, parse_client_hello_ret ==
1984 SSL_CLIENT_HELLO_HRR_REQUIRED));
1985
1986 if (SSL_CLIENT_HELLO_OK == parse_client_hello_ret) {
1987 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO);
1988 } else {
1989 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST);
1990 }
1991
1992 cleanup:
1993
1994 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello"));
1995 return ret;
1996 }
1997
1998 /*
1999 * Handler for MBEDTLS_SSL_SERVER_HELLO
2000 */
2001 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_prepare_server_hello(mbedtls_ssl_context * ssl)2002 static int ssl_tls13_prepare_server_hello(mbedtls_ssl_context *ssl)
2003 {
2004 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2005 unsigned char *server_randbytes =
2006 ssl->handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
2007
2008 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, server_randbytes,
2009 MBEDTLS_SERVER_HELLO_RANDOM_LEN)) != 0) {
2010 MBEDTLS_SSL_DEBUG_RET(1, "f_rng", ret);
2011 return ret;
2012 }
2013
2014 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", server_randbytes,
2015 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2016
2017 #if defined(MBEDTLS_HAVE_TIME)
2018 ssl->session_negotiate->start = mbedtls_time(NULL);
2019 #endif /* MBEDTLS_HAVE_TIME */
2020
2021 return ret;
2022 }
2023
2024 /*
2025 * ssl_tls13_write_server_hello_supported_versions_ext ():
2026 *
2027 * struct {
2028 * ProtocolVersion selected_version;
2029 * } SupportedVersions;
2030 */
2031 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_server_hello_supported_versions_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)2032 static int ssl_tls13_write_server_hello_supported_versions_ext(
2033 mbedtls_ssl_context *ssl,
2034 unsigned char *buf,
2035 unsigned char *end,
2036 size_t *out_len)
2037 {
2038 *out_len = 0;
2039
2040 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, write selected version"));
2041
2042 /* Check if we have space to write the extension:
2043 * - extension_type (2 bytes)
2044 * - extension_data_length (2 bytes)
2045 * - selected_version (2 bytes)
2046 */
2047 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
2048
2049 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, buf, 0);
2050
2051 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
2052
2053 mbedtls_ssl_write_version(buf + 4,
2054 ssl->conf->transport,
2055 ssl->tls_version);
2056
2057 MBEDTLS_SSL_DEBUG_MSG(3, ("supported version: [%04x]",
2058 ssl->tls_version));
2059
2060 *out_len = 6;
2061
2062 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
2063 ssl, MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS);
2064
2065 return 0;
2066 }
2067
2068
2069
2070 /* Generate and export a single key share. For hybrid KEMs, this can
2071 * be called multiple times with the different components of the hybrid. */
2072 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context * ssl,uint16_t named_group,unsigned char * buf,unsigned char * end,size_t * out_len)2073 static int ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context *ssl,
2074 uint16_t named_group,
2075 unsigned char *buf,
2076 unsigned char *end,
2077 size_t *out_len)
2078 {
2079 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2080
2081 *out_len = 0;
2082
2083 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
2084 if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group) ||
2085 mbedtls_ssl_tls13_named_group_is_ffdh(named_group)) {
2086 ret = mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(
2087 ssl, named_group, buf, end, out_len);
2088 if (ret != 0) {
2089 MBEDTLS_SSL_DEBUG_RET(
2090 1, "mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange",
2091 ret);
2092 return ret;
2093 }
2094 } else
2095 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
2096 if (0 /* Other kinds of KEMs */) {
2097 } else {
2098 ((void) ssl);
2099 ((void) named_group);
2100 ((void) buf);
2101 ((void) end);
2102 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2103 }
2104
2105 return ret;
2106 }
2107
2108 /*
2109 * ssl_tls13_write_key_share_ext
2110 *
2111 * Structure of key_share extension in ServerHello:
2112 *
2113 * struct {
2114 * NamedGroup group;
2115 * opaque key_exchange<1..2^16-1>;
2116 * } KeyShareEntry;
2117 * struct {
2118 * KeyShareEntry server_share;
2119 * } KeyShareServerHello;
2120 */
2121 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_key_share_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)2122 static int ssl_tls13_write_key_share_ext(mbedtls_ssl_context *ssl,
2123 unsigned char *buf,
2124 unsigned char *end,
2125 size_t *out_len)
2126 {
2127 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2128 unsigned char *p = buf;
2129 uint16_t group = ssl->handshake->offered_group_id;
2130 unsigned char *server_share = buf + 4;
2131 size_t key_exchange_length;
2132
2133 *out_len = 0;
2134
2135 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding key share extension"));
2136
2137 MBEDTLS_SSL_DEBUG_MSG(2, ("server hello, write selected_group: %s (%04x)",
2138 mbedtls_ssl_named_group_to_str(group),
2139 group));
2140
2141 /* Check if we have space for header and length fields:
2142 * - extension_type (2 bytes)
2143 * - extension_data_length (2 bytes)
2144 * - group (2 bytes)
2145 * - key_exchange_length (2 bytes)
2146 */
2147 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 8);
2148 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, p, 0);
2149 MBEDTLS_PUT_UINT16_BE(group, server_share, 0);
2150 p += 8;
2151
2152 /* When we introduce PQC-ECDHE hybrids, we'll want to call this
2153 * function multiple times. */
2154 ret = ssl_tls13_generate_and_write_key_share(
2155 ssl, group, server_share + 4, end, &key_exchange_length);
2156 if (ret != 0) {
2157 return ret;
2158 }
2159 p += key_exchange_length;
2160
2161 MBEDTLS_PUT_UINT16_BE(key_exchange_length, server_share + 2, 0);
2162
2163 MBEDTLS_PUT_UINT16_BE(p - server_share, buf, 2);
2164
2165 *out_len = p - buf;
2166
2167 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
2168
2169 return 0;
2170 }
2171
2172 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_hrr_key_share_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)2173 static int ssl_tls13_write_hrr_key_share_ext(mbedtls_ssl_context *ssl,
2174 unsigned char *buf,
2175 unsigned char *end,
2176 size_t *out_len)
2177 {
2178 uint16_t selected_group = ssl->handshake->hrr_selected_group;
2179 /* key_share Extension
2180 *
2181 * struct {
2182 * select (Handshake.msg_type) {
2183 * ...
2184 * case hello_retry_request:
2185 * NamedGroup selected_group;
2186 * ...
2187 * };
2188 * } KeyShare;
2189 */
2190
2191 *out_len = 0;
2192
2193 /*
2194 * For a pure PSK key exchange, there is no group to agree upon. The purpose
2195 * of the HRR is then to transmit a cookie to force the client to demonstrate
2196 * reachability at their apparent network address (primarily useful for DTLS).
2197 */
2198 if (!mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2199 return 0;
2200 }
2201
2202 /* We should only send the key_share extension if the client's initial
2203 * key share was not acceptable. */
2204 if (ssl->handshake->offered_group_id != 0) {
2205 MBEDTLS_SSL_DEBUG_MSG(4, ("Skip key_share extension in HRR"));
2206 return 0;
2207 }
2208
2209 if (selected_group == 0) {
2210 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching named group found"));
2211 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2212 }
2213
2214 /* Check if we have enough space:
2215 * - extension_type (2 bytes)
2216 * - extension_data_length (2 bytes)
2217 * - selected_group (2 bytes)
2218 */
2219 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
2220
2221 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0);
2222 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
2223 MBEDTLS_PUT_UINT16_BE(selected_group, buf, 4);
2224
2225 MBEDTLS_SSL_DEBUG_MSG(3,
2226 ("HRR selected_group: %s (%x)",
2227 mbedtls_ssl_named_group_to_str(selected_group),
2228 selected_group));
2229
2230 *out_len = 6;
2231
2232 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
2233
2234 return 0;
2235 }
2236
2237 /*
2238 * Structure of ServerHello message:
2239 *
2240 * struct {
2241 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
2242 * Random random;
2243 * opaque legacy_session_id_echo<0..32>;
2244 * CipherSuite cipher_suite;
2245 * uint8 legacy_compression_method = 0;
2246 * Extension extensions<6..2^16-1>;
2247 * } ServerHello;
2248 */
2249 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_server_hello_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len,int is_hrr)2250 static int ssl_tls13_write_server_hello_body(mbedtls_ssl_context *ssl,
2251 unsigned char *buf,
2252 unsigned char *end,
2253 size_t *out_len,
2254 int is_hrr)
2255 {
2256 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2257 unsigned char *p = buf;
2258 unsigned char *p_extensions_len;
2259 size_t output_len;
2260
2261 *out_len = 0;
2262 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
2263
2264 /* ...
2265 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
2266 * ...
2267 * with ProtocolVersion defined as:
2268 * uint16 ProtocolVersion;
2269 */
2270 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2271 MBEDTLS_PUT_UINT16_BE(0x0303, p, 0);
2272 p += 2;
2273
2274 /* ...
2275 * Random random;
2276 * ...
2277 * with Random defined as:
2278 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
2279 */
2280 MBEDTLS_SSL_CHK_BUF_PTR(p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2281 if (is_hrr) {
2282 memcpy(p, mbedtls_ssl_tls13_hello_retry_request_magic,
2283 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2284 } else {
2285 memcpy(p, &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN],
2286 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2287 }
2288 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes",
2289 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2290 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
2291
2292 /* ...
2293 * opaque legacy_session_id_echo<0..32>;
2294 * ...
2295 */
2296 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1 + ssl->session_negotiate->id_len);
2297 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2298 if (ssl->session_negotiate->id_len > 0) {
2299 memcpy(p, &ssl->session_negotiate->id[0],
2300 ssl->session_negotiate->id_len);
2301 p += ssl->session_negotiate->id_len;
2302
2303 MBEDTLS_SSL_DEBUG_BUF(3, "session id", ssl->session_negotiate->id,
2304 ssl->session_negotiate->id_len);
2305 }
2306
2307 /* ...
2308 * CipherSuite cipher_suite;
2309 * ...
2310 * with CipherSuite defined as:
2311 * uint8 CipherSuite[2];
2312 */
2313 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2314 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0);
2315 p += 2;
2316 MBEDTLS_SSL_DEBUG_MSG(3,
2317 ("server hello, chosen ciphersuite: %s ( id=%d )",
2318 mbedtls_ssl_get_ciphersuite_name(
2319 ssl->session_negotiate->ciphersuite),
2320 ssl->session_negotiate->ciphersuite));
2321
2322 /* ...
2323 * uint8 legacy_compression_method = 0;
2324 * ...
2325 */
2326 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1);
2327 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
2328
2329 /* ...
2330 * Extension extensions<6..2^16-1>;
2331 * ...
2332 * struct {
2333 * ExtensionType extension_type; (2 bytes)
2334 * opaque extension_data<0..2^16-1>;
2335 * } Extension;
2336 */
2337 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2338 p_extensions_len = p;
2339 p += 2;
2340
2341 if ((ret = ssl_tls13_write_server_hello_supported_versions_ext(
2342 ssl, p, end, &output_len)) != 0) {
2343 MBEDTLS_SSL_DEBUG_RET(
2344 1, "ssl_tls13_write_server_hello_supported_versions_ext", ret);
2345 return ret;
2346 }
2347 p += output_len;
2348
2349 if (mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2350 if (is_hrr) {
2351 ret = ssl_tls13_write_hrr_key_share_ext(ssl, p, end, &output_len);
2352 } else {
2353 ret = ssl_tls13_write_key_share_ext(ssl, p, end, &output_len);
2354 }
2355 if (ret != 0) {
2356 return ret;
2357 }
2358 p += output_len;
2359 }
2360
2361 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
2362 if (!is_hrr && mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2363 ret = ssl_tls13_write_server_pre_shared_key_ext(ssl, p, end, &output_len);
2364 if (ret != 0) {
2365 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_server_pre_shared_key_ext",
2366 ret);
2367 return ret;
2368 }
2369 p += output_len;
2370 }
2371 #endif
2372
2373 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
2374
2375 MBEDTLS_SSL_DEBUG_BUF(4, "server hello extensions",
2376 p_extensions_len, p - p_extensions_len);
2377
2378 *out_len = p - buf;
2379
2380 MBEDTLS_SSL_DEBUG_BUF(3, "server hello", buf, *out_len);
2381
2382 MBEDTLS_SSL_PRINT_EXTS(
2383 3, is_hrr ? MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST :
2384 MBEDTLS_SSL_HS_SERVER_HELLO,
2385 ssl->handshake->sent_extensions);
2386
2387 return ret;
2388 }
2389
2390 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_finalize_server_hello(mbedtls_ssl_context * ssl)2391 static int ssl_tls13_finalize_server_hello(mbedtls_ssl_context *ssl)
2392 {
2393 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2394 ret = mbedtls_ssl_tls13_compute_handshake_transform(ssl);
2395 if (ret != 0) {
2396 MBEDTLS_SSL_DEBUG_RET(1,
2397 "mbedtls_ssl_tls13_compute_handshake_transform",
2398 ret);
2399 return ret;
2400 }
2401
2402 return ret;
2403 }
2404
2405 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_server_hello(mbedtls_ssl_context * ssl)2406 static int ssl_tls13_write_server_hello(mbedtls_ssl_context *ssl)
2407 {
2408 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2409 unsigned char *buf;
2410 size_t buf_len, msg_len;
2411
2412 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello"));
2413
2414 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_server_hello(ssl));
2415
2416 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2417 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, &buf, &buf_len));
2418
2419 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2420 buf + buf_len,
2421 &msg_len,
2422 0));
2423
2424 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
2425 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
2426
2427 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2428 ssl, buf_len, msg_len));
2429
2430 MBEDTLS_SSL_PROC_CHK(ssl_tls13_finalize_server_hello(ssl));
2431
2432 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2433 /* The server sends a dummy change_cipher_spec record immediately
2434 * after its first handshake message. This may either be after
2435 * a ServerHello or a HelloRetryRequest.
2436 */
2437 mbedtls_ssl_handshake_set_state(
2438 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO);
2439 #else
2440 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
2441 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
2442
2443 cleanup:
2444
2445 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2446 return ret;
2447 }
2448
2449
2450 /*
2451 * Handler for MBEDTLS_SSL_HELLO_RETRY_REQUEST
2452 */
2453 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_prepare_hello_retry_request(mbedtls_ssl_context * ssl)2454 static int ssl_tls13_prepare_hello_retry_request(mbedtls_ssl_context *ssl)
2455 {
2456 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2457 if (ssl->handshake->hello_retry_request_flag) {
2458 MBEDTLS_SSL_DEBUG_MSG(1, ("Too many HRRs"));
2459 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2460 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2461 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2462 }
2463
2464 /*
2465 * Create stateless transcript hash for HRR
2466 */
2467 MBEDTLS_SSL_DEBUG_MSG(4, ("Reset transcript for HRR"));
2468 ret = mbedtls_ssl_reset_transcript_for_hrr(ssl);
2469 if (ret != 0) {
2470 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_transcript_for_hrr", ret);
2471 return ret;
2472 }
2473 mbedtls_ssl_session_reset_msg_layer(ssl, 0);
2474
2475 return 0;
2476 }
2477
2478 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_hello_retry_request(mbedtls_ssl_context * ssl)2479 static int ssl_tls13_write_hello_retry_request(mbedtls_ssl_context *ssl)
2480 {
2481 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2482 unsigned char *buf;
2483 size_t buf_len, msg_len;
2484
2485 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello retry request"));
2486
2487 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_hello_retry_request(ssl));
2488
2489 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2490 ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
2491 &buf, &buf_len));
2492
2493 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2494 buf + buf_len,
2495 &msg_len,
2496 1));
2497 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
2498 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
2499
2500
2501 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(ssl, buf_len,
2502 msg_len));
2503
2504 ssl->handshake->hello_retry_request_flag = 1;
2505
2506 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2507 /* The server sends a dummy change_cipher_spec record immediately
2508 * after its first handshake message. This may either be after
2509 * a ServerHello or a HelloRetryRequest.
2510 */
2511 mbedtls_ssl_handshake_set_state(
2512 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST);
2513 #else
2514 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
2515 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
2516
2517 cleanup:
2518 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello retry request"));
2519 return ret;
2520 }
2521
2522 /*
2523 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
2524 */
2525
2526 /*
2527 * struct {
2528 * Extension extensions<0..2 ^ 16 - 1>;
2529 * } EncryptedExtensions;
2530 *
2531 */
2532 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_encrypted_extensions_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)2533 static int ssl_tls13_write_encrypted_extensions_body(mbedtls_ssl_context *ssl,
2534 unsigned char *buf,
2535 unsigned char *end,
2536 size_t *out_len)
2537 {
2538 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2539 unsigned char *p = buf;
2540 size_t extensions_len = 0;
2541 unsigned char *p_extensions_len;
2542 size_t output_len;
2543
2544 *out_len = 0;
2545
2546 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2547 p_extensions_len = p;
2548 p += 2;
2549
2550 ((void) ssl);
2551 ((void) ret);
2552 ((void) output_len);
2553
2554 #if defined(MBEDTLS_SSL_ALPN)
2555 ret = mbedtls_ssl_write_alpn_ext(ssl, p, end, &output_len);
2556 if (ret != 0) {
2557 return ret;
2558 }
2559 p += output_len;
2560 #endif /* MBEDTLS_SSL_ALPN */
2561
2562 #if defined(MBEDTLS_SSL_EARLY_DATA)
2563 if (ssl->handshake->early_data_accepted) {
2564 ret = mbedtls_ssl_tls13_write_early_data_ext(
2565 ssl, 0, p, end, &output_len);
2566 if (ret != 0) {
2567 return ret;
2568 }
2569 p += output_len;
2570 }
2571 #endif /* MBEDTLS_SSL_EARLY_DATA */
2572
2573 #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
2574 if (ssl->handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT)) {
2575 ret = mbedtls_ssl_tls13_write_record_size_limit_ext(
2576 ssl, p, end, &output_len);
2577 if (ret != 0) {
2578 return ret;
2579 }
2580 p += output_len;
2581 }
2582 #endif
2583
2584 extensions_len = (p - p_extensions_len) - 2;
2585 MBEDTLS_PUT_UINT16_BE(extensions_len, p_extensions_len, 0);
2586
2587 *out_len = p - buf;
2588
2589 MBEDTLS_SSL_DEBUG_BUF(4, "encrypted extensions", buf, *out_len);
2590
2591 MBEDTLS_SSL_PRINT_EXTS(
2592 3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, ssl->handshake->sent_extensions);
2593
2594 return 0;
2595 }
2596
2597 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context * ssl)2598 static int ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context *ssl)
2599 {
2600 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2601 unsigned char *buf;
2602 size_t buf_len, msg_len;
2603
2604 mbedtls_ssl_set_outbound_transform(ssl,
2605 ssl->handshake->transform_handshake);
2606 MBEDTLS_SSL_DEBUG_MSG(
2607 3, ("switching to handshake transform for outbound data"));
2608
2609 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write encrypted extensions"));
2610
2611 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2612 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2613 &buf, &buf_len));
2614
2615 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_encrypted_extensions_body(
2616 ssl, buf, buf + buf_len, &msg_len));
2617
2618 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
2619 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2620 buf, msg_len));
2621
2622 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2623 ssl, buf_len, msg_len));
2624
2625 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2626 if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2627 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2628 } else {
2629 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
2630 }
2631 #else
2632 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2633 #endif
2634
2635 cleanup:
2636
2637 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write encrypted extensions"));
2638 return ret;
2639 }
2640
2641 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
2642 #define SSL_CERTIFICATE_REQUEST_SEND_REQUEST 0
2643 #define SSL_CERTIFICATE_REQUEST_SKIP 1
2644 /* Coordination:
2645 * Check whether a CertificateRequest message should be written.
2646 * Returns a negative code on failure, or
2647 * - SSL_CERTIFICATE_REQUEST_SEND_REQUEST
2648 * - SSL_CERTIFICATE_REQUEST_SKIP
2649 * indicating if the writing of the CertificateRequest
2650 * should be skipped or not.
2651 */
2652 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_certificate_request_coordinate(mbedtls_ssl_context * ssl)2653 static int ssl_tls13_certificate_request_coordinate(mbedtls_ssl_context *ssl)
2654 {
2655 int authmode;
2656
2657 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2658 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
2659 authmode = ssl->handshake->sni_authmode;
2660 } else
2661 #endif
2662 authmode = ssl->conf->authmode;
2663
2664 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
2665 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
2666 return SSL_CERTIFICATE_REQUEST_SKIP;
2667 }
2668
2669 ssl->handshake->certificate_request_sent = 1;
2670
2671 return SSL_CERTIFICATE_REQUEST_SEND_REQUEST;
2672 }
2673
2674 /*
2675 * struct {
2676 * opaque certificate_request_context<0..2^8-1>;
2677 * Extension extensions<2..2^16-1>;
2678 * } CertificateRequest;
2679 *
2680 */
2681 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_request_body(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * out_len)2682 static int ssl_tls13_write_certificate_request_body(mbedtls_ssl_context *ssl,
2683 unsigned char *buf,
2684 const unsigned char *end,
2685 size_t *out_len)
2686 {
2687 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2688 unsigned char *p = buf;
2689 size_t output_len = 0;
2690 unsigned char *p_extensions_len;
2691
2692 *out_len = 0;
2693
2694 /* Check if we have enough space:
2695 * - certificate_request_context (1 byte)
2696 * - extensions length (2 bytes)
2697 */
2698 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3);
2699
2700 /*
2701 * Write certificate_request_context
2702 */
2703 /*
2704 * We use a zero length context for the normal handshake
2705 * messages. For post-authentication handshake messages
2706 * this request context would be set to a non-zero value.
2707 */
2708 *p++ = 0x0;
2709
2710 /*
2711 * Write extensions
2712 */
2713 /* The extensions must contain the signature_algorithms. */
2714 p_extensions_len = p;
2715 p += 2;
2716 ret = mbedtls_ssl_write_sig_alg_ext(ssl, p, end, &output_len);
2717 if (ret != 0) {
2718 return ret;
2719 }
2720
2721 p += output_len;
2722 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
2723
2724 *out_len = p - buf;
2725
2726 MBEDTLS_SSL_PRINT_EXTS(
2727 3, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, ssl->handshake->sent_extensions);
2728
2729 return 0;
2730 }
2731
2732 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_request(mbedtls_ssl_context * ssl)2733 static int ssl_tls13_write_certificate_request(mbedtls_ssl_context *ssl)
2734 {
2735 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2736
2737 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
2738
2739 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_certificate_request_coordinate(ssl));
2740
2741 if (ret == SSL_CERTIFICATE_REQUEST_SEND_REQUEST) {
2742 unsigned char *buf;
2743 size_t buf_len, msg_len;
2744
2745 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2746 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2747 &buf, &buf_len));
2748
2749 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_request_body(
2750 ssl, buf, buf + buf_len, &msg_len));
2751
2752 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
2753 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2754 buf, msg_len));
2755
2756 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2757 ssl, buf_len, msg_len));
2758 } else if (ret == SSL_CERTIFICATE_REQUEST_SKIP) {
2759 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
2760 ret = 0;
2761 } else {
2762 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
2763 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2764 goto cleanup;
2765 }
2766
2767 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_CERTIFICATE);
2768 cleanup:
2769
2770 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request"));
2771 return ret;
2772 }
2773
2774 /*
2775 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
2776 */
2777 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_server_certificate(mbedtls_ssl_context * ssl)2778 static int ssl_tls13_write_server_certificate(mbedtls_ssl_context *ssl)
2779 {
2780 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2781
2782 #if defined(MBEDTLS_X509_CRT_PARSE_C)
2783 if ((ssl_tls13_pick_key_cert(ssl) != 0) ||
2784 mbedtls_ssl_own_cert(ssl) == NULL) {
2785 MBEDTLS_SSL_DEBUG_MSG(2, ("No certificate available."));
2786 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2787 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2788 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2789 }
2790 #endif /* MBEDTLS_X509_CRT_PARSE_C */
2791
2792 ret = mbedtls_ssl_tls13_write_certificate(ssl);
2793 if (ret != 0) {
2794 return ret;
2795 }
2796 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY);
2797 return 0;
2798 }
2799
2800 /*
2801 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
2802 */
2803 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_verify(mbedtls_ssl_context * ssl)2804 static int ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl)
2805 {
2806 int ret = mbedtls_ssl_tls13_write_certificate_verify(ssl);
2807 if (ret != 0) {
2808 return ret;
2809 }
2810 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2811 return 0;
2812 }
2813 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
2814
2815 /*
2816 * RFC 8446 section A.2
2817 *
2818 * | Send ServerHello
2819 * | K_send = handshake
2820 * | Send EncryptedExtensions
2821 * | [Send CertificateRequest]
2822 * Can send | [Send Certificate + CertificateVerify]
2823 * app data | Send Finished
2824 * after --> | K_send = application
2825 * here +--------+--------+
2826 * No 0-RTT | | 0-RTT
2827 * | |
2828 * K_recv = handshake | | K_recv = early data
2829 * [Skip decrypt errors] | +------> WAIT_EOED -+
2830 * | | Recv | | Recv EndOfEarlyData
2831 * | | early data | | K_recv = handshake
2832 * | +------------+ |
2833 * | |
2834 * +> WAIT_FLIGHT2 <--------+
2835 * |
2836 * +--------+--------+
2837 * No auth | | Client auth
2838 * | |
2839 * | v
2840 * | WAIT_CERT
2841 * | Recv | | Recv Certificate
2842 * | empty | v
2843 * | Certificate | WAIT_CV
2844 * | | | Recv
2845 * | v | CertificateVerify
2846 * +-> WAIT_FINISHED <---+
2847 * | Recv Finished
2848 *
2849 *
2850 * The following function handles the state changes after WAIT_FLIGHT2 in the
2851 * above diagram. We are not going to receive early data related messages
2852 * anymore, prepare to receive the first handshake message of the client
2853 * second flight.
2854 */
ssl_tls13_prepare_for_handshake_second_flight(mbedtls_ssl_context * ssl)2855 static void ssl_tls13_prepare_for_handshake_second_flight(
2856 mbedtls_ssl_context *ssl)
2857 {
2858 if (ssl->handshake->certificate_request_sent) {
2859 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE);
2860 } else {
2861 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate"));
2862 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
2863
2864 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_FINISHED);
2865 }
2866 }
2867
2868 /*
2869 * Handler for MBEDTLS_SSL_SERVER_FINISHED
2870 */
2871 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_server_finished(mbedtls_ssl_context * ssl)2872 static int ssl_tls13_write_server_finished(mbedtls_ssl_context *ssl)
2873 {
2874 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2875
2876 ret = mbedtls_ssl_tls13_write_finished_message(ssl);
2877 if (ret != 0) {
2878 return ret;
2879 }
2880
2881 ret = mbedtls_ssl_tls13_compute_application_transform(ssl);
2882 if (ret != 0) {
2883 MBEDTLS_SSL_PEND_FATAL_ALERT(
2884 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2885 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2886 return ret;
2887 }
2888
2889 #if defined(MBEDTLS_SSL_EARLY_DATA)
2890 if (ssl->handshake->early_data_accepted) {
2891 /* See RFC 8446 section A.2 for more information */
2892 MBEDTLS_SSL_DEBUG_MSG(
2893 1, ("Switch to early keys for inbound traffic. "
2894 "( K_recv = early data )"));
2895 mbedtls_ssl_set_inbound_transform(
2896 ssl, ssl->handshake->transform_earlydata);
2897 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_END_OF_EARLY_DATA);
2898 return 0;
2899 }
2900 #endif /* MBEDTLS_SSL_EARLY_DATA */
2901 MBEDTLS_SSL_DEBUG_MSG(
2902 1, ("Switch to handshake keys for inbound traffic "
2903 "( K_recv = handshake )"));
2904 mbedtls_ssl_set_inbound_transform(ssl, ssl->handshake->transform_handshake);
2905
2906 ssl_tls13_prepare_for_handshake_second_flight(ssl);
2907
2908 return 0;
2909 }
2910
2911 #if defined(MBEDTLS_SSL_EARLY_DATA)
2912 /*
2913 * Handler for MBEDTLS_SSL_END_OF_EARLY_DATA
2914 */
2915 #define SSL_GOT_END_OF_EARLY_DATA 0
2916 #define SSL_GOT_EARLY_DATA 1
2917 /* Coordination:
2918 * Deals with the ambiguity of not knowing if the next message is an
2919 * EndOfEarlyData message or an application message containing early data.
2920 * Returns a negative code on failure, or
2921 * - SSL_GOT_END_OF_EARLY_DATA
2922 * - SSL_GOT_EARLY_DATA
2923 * indicating which message is received.
2924 */
2925 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_end_of_early_data_coordinate(mbedtls_ssl_context * ssl)2926 static int ssl_tls13_end_of_early_data_coordinate(mbedtls_ssl_context *ssl)
2927 {
2928 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2929
2930 if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) {
2931 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
2932 return ret;
2933 }
2934 ssl->keep_current_message = 1;
2935
2936 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2937 ssl->in_msg[0] == MBEDTLS_SSL_HS_END_OF_EARLY_DATA) {
2938 MBEDTLS_SSL_DEBUG_MSG(3, ("Received an end_of_early_data message."));
2939 return SSL_GOT_END_OF_EARLY_DATA;
2940 }
2941
2942 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA) {
2943 if (ssl->in_offt == NULL) {
2944 MBEDTLS_SSL_DEBUG_MSG(3, ("Received early data"));
2945 /* Set the reading pointer */
2946 ssl->in_offt = ssl->in_msg;
2947 ret = mbedtls_ssl_tls13_check_early_data_len(ssl, ssl->in_msglen);
2948 if (ret != 0) {
2949 return ret;
2950 }
2951 }
2952 return SSL_GOT_EARLY_DATA;
2953 }
2954
2955 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
2956 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
2957 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
2958 }
2959
2960 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_end_of_early_data(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)2961 static int ssl_tls13_parse_end_of_early_data(mbedtls_ssl_context *ssl,
2962 const unsigned char *buf,
2963 const unsigned char *end)
2964 {
2965 /* RFC 8446 section 4.5
2966 *
2967 * struct {} EndOfEarlyData;
2968 */
2969 if (buf != end) {
2970 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
2971 MBEDTLS_ERR_SSL_DECODE_ERROR);
2972 return MBEDTLS_ERR_SSL_DECODE_ERROR;
2973 }
2974 return 0;
2975 }
2976
2977 /*
2978 * RFC 8446 section A.2
2979 *
2980 * | Send ServerHello
2981 * | K_send = handshake
2982 * | Send EncryptedExtensions
2983 * | [Send CertificateRequest]
2984 * Can send | [Send Certificate + CertificateVerify]
2985 * app data | Send Finished
2986 * after --> | K_send = application
2987 * here +--------+--------+
2988 * No 0-RTT | | 0-RTT
2989 * | |
2990 * K_recv = handshake | | K_recv = early data
2991 * [Skip decrypt errors] | +------> WAIT_EOED -+
2992 * | | Recv | | Recv EndOfEarlyData
2993 * | | early data | | K_recv = handshake
2994 * | +------------+ |
2995 * | |
2996 * +> WAIT_FLIGHT2 <--------+
2997 * |
2998 * +--------+--------+
2999 * No auth | | Client auth
3000 * | |
3001 * | v
3002 * | WAIT_CERT
3003 * | Recv | | Recv Certificate
3004 * | empty | v
3005 * | Certificate | WAIT_CV
3006 * | | | Recv
3007 * | v | CertificateVerify
3008 * +-> WAIT_FINISHED <---+
3009 * | Recv Finished
3010 *
3011 * The function handles actions and state changes from 0-RTT to WAIT_FLIGHT2 in
3012 * the above diagram.
3013 */
3014 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_end_of_early_data(mbedtls_ssl_context * ssl)3015 static int ssl_tls13_process_end_of_early_data(mbedtls_ssl_context *ssl)
3016 {
3017 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3018
3019 MBEDTLS_SSL_DEBUG_MSG(2, ("=> ssl_tls13_process_end_of_early_data"));
3020
3021 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_end_of_early_data_coordinate(ssl));
3022
3023 if (ret == SSL_GOT_END_OF_EARLY_DATA) {
3024 unsigned char *buf;
3025 size_t buf_len;
3026
3027 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
3028 ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA,
3029 &buf, &buf_len));
3030
3031 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_end_of_early_data(
3032 ssl, buf, buf + buf_len));
3033
3034 MBEDTLS_SSL_DEBUG_MSG(
3035 1, ("Switch to handshake keys for inbound traffic"
3036 "( K_recv = handshake )"));
3037 mbedtls_ssl_set_inbound_transform(
3038 ssl, ssl->handshake->transform_handshake);
3039
3040 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
3041 ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA,
3042 buf, buf_len));
3043
3044 ssl_tls13_prepare_for_handshake_second_flight(ssl);
3045
3046 } else if (ret == SSL_GOT_EARLY_DATA) {
3047 ret = MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA;
3048 goto cleanup;
3049 } else {
3050 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3051 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3052 goto cleanup;
3053 }
3054
3055 cleanup:
3056 MBEDTLS_SSL_DEBUG_MSG(2, ("<= ssl_tls13_process_end_of_early_data"));
3057 return ret;
3058 }
3059 #endif /* MBEDTLS_SSL_EARLY_DATA */
3060
3061 /*
3062 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
3063 */
3064 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_process_client_finished(mbedtls_ssl_context * ssl)3065 static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl)
3066 {
3067 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3068
3069 ret = mbedtls_ssl_tls13_process_finished_message(ssl);
3070 if (ret != 0) {
3071 return ret;
3072 }
3073
3074 ret = mbedtls_ssl_tls13_compute_resumption_master_secret(ssl);
3075 if (ret != 0) {
3076 MBEDTLS_SSL_DEBUG_RET(
3077 1, "mbedtls_ssl_tls13_compute_resumption_master_secret", ret);
3078 }
3079
3080 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);
3081 return 0;
3082 }
3083
3084 /*
3085 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
3086 */
3087 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)3088 static int ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl)
3089 {
3090 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done"));
3091
3092 mbedtls_ssl_tls13_handshake_wrapup(ssl);
3093
3094 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
3095 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
3096 /* TODO: Remove the check of SOME_PSK_ENABLED since SESSION_TICKETS requires
3097 * SOME_PSK_ENABLED to be enabled. Here is just to make CI happy. It is
3098 * expected to be resolved with issue#6395.
3099 */
3100 /* Sent NewSessionTicket message only when client supports PSK */
3101 if (mbedtls_ssl_tls13_is_some_psk_supported(ssl)) {
3102 mbedtls_ssl_handshake_set_state(
3103 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
3104 } else
3105 #endif
3106 {
3107 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3108 }
3109 return 0;
3110 }
3111
3112 /*
3113 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
3114 */
3115 #define SSL_NEW_SESSION_TICKET_SKIP 0
3116 #define SSL_NEW_SESSION_TICKET_WRITE 1
3117 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_new_session_ticket_coordinate(mbedtls_ssl_context * ssl)3118 static int ssl_tls13_write_new_session_ticket_coordinate(mbedtls_ssl_context *ssl)
3119 {
3120 /* Check whether the use of session tickets is enabled */
3121 if (ssl->conf->f_ticket_write == NULL) {
3122 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
3123 " callback is not set"));
3124 return SSL_NEW_SESSION_TICKET_SKIP;
3125 }
3126 if (ssl->conf->new_session_tickets_count == 0) {
3127 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
3128 " configured count is zero"));
3129 return SSL_NEW_SESSION_TICKET_SKIP;
3130 }
3131
3132 if (ssl->handshake->new_session_tickets_count == 0) {
3133 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: all tickets have "
3134 "been sent."));
3135 return SSL_NEW_SESSION_TICKET_SKIP;
3136 }
3137
3138 return SSL_NEW_SESSION_TICKET_WRITE;
3139 }
3140
3141 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
3142 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context * ssl,unsigned char * ticket_nonce,size_t ticket_nonce_size)3143 static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
3144 unsigned char *ticket_nonce,
3145 size_t ticket_nonce_size)
3146 {
3147 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3148 mbedtls_ssl_session *session = ssl->session;
3149 mbedtls_ssl_ciphersuite_t *ciphersuite_info;
3150 psa_algorithm_t psa_hash_alg;
3151 int hash_length;
3152
3153 MBEDTLS_SSL_DEBUG_MSG(2, ("=> prepare NewSessionTicket msg"));
3154
3155 /* Set ticket_flags depends on the advertised psk key exchange mode */
3156 mbedtls_ssl_tls13_session_clear_ticket_flags(
3157 session, MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
3158 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
3159 mbedtls_ssl_tls13_session_set_ticket_flags(
3160 session, ssl->handshake->tls13_kex_modes);
3161 #endif
3162
3163 #if defined(MBEDTLS_SSL_EARLY_DATA)
3164 if (ssl->conf->early_data_enabled == MBEDTLS_SSL_EARLY_DATA_ENABLED &&
3165 ssl->conf->max_early_data_size > 0) {
3166 mbedtls_ssl_tls13_session_set_ticket_flags(
3167 session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA);
3168 session->max_early_data_size = ssl->conf->max_early_data_size;
3169 }
3170 #endif /* MBEDTLS_SSL_EARLY_DATA */
3171
3172 MBEDTLS_SSL_PRINT_TICKET_FLAGS(4, session->ticket_flags);
3173
3174 #if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
3175 if (session->ticket_alpn == NULL) {
3176 ret = mbedtls_ssl_session_set_ticket_alpn(session, ssl->alpn_chosen);
3177 if (ret != 0) {
3178 return ret;
3179 }
3180 }
3181 #endif
3182
3183 /* Generate ticket_age_add */
3184 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
3185 (unsigned char *) &session->ticket_age_add,
3186 sizeof(session->ticket_age_add)) != 0)) {
3187 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
3188 return ret;
3189 }
3190 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
3191 (unsigned int) session->ticket_age_add));
3192
3193 /* Generate ticket_nonce */
3194 ret = ssl->conf->f_rng(ssl->conf->p_rng, ticket_nonce, ticket_nonce_size);
3195 if (ret != 0) {
3196 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_nonce", ret);
3197 return ret;
3198 }
3199 MBEDTLS_SSL_DEBUG_BUF(3, "ticket_nonce:",
3200 ticket_nonce, ticket_nonce_size);
3201
3202 ciphersuite_info =
3203 (mbedtls_ssl_ciphersuite_t *) ssl->handshake->ciphersuite_info;
3204 psa_hash_alg = mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
3205 hash_length = PSA_HASH_LENGTH(psa_hash_alg);
3206 if (hash_length == -1 ||
3207 (size_t) hash_length > sizeof(session->resumption_key)) {
3208 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3209 }
3210
3211 /* In this code the psk key length equals the length of the hash */
3212 session->resumption_key_len = hash_length;
3213 session->ciphersuite = ciphersuite_info->id;
3214
3215 /* Compute resumption key
3216 *
3217 * HKDF-Expand-Label( resumption_master_secret,
3218 * "resumption", ticket_nonce, Hash.length )
3219 */
3220 ret = mbedtls_ssl_tls13_hkdf_expand_label(
3221 psa_hash_alg,
3222 session->app_secrets.resumption_master_secret,
3223 hash_length,
3224 MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(resumption),
3225 ticket_nonce,
3226 ticket_nonce_size,
3227 session->resumption_key,
3228 hash_length);
3229
3230 if (ret != 0) {
3231 MBEDTLS_SSL_DEBUG_RET(2,
3232 "Creating the ticket-resumed PSK failed",
3233 ret);
3234 return ret;
3235 }
3236 MBEDTLS_SSL_DEBUG_BUF(3, "Ticket-resumed PSK",
3237 session->resumption_key,
3238 session->resumption_key_len);
3239
3240 MBEDTLS_SSL_DEBUG_BUF(3, "resumption_master_secret",
3241 session->app_secrets.resumption_master_secret,
3242 hash_length);
3243
3244 return 0;
3245 }
3246
3247 /* This function creates a NewSessionTicket message in the following format:
3248 *
3249 * struct {
3250 * uint32 ticket_lifetime;
3251 * uint32 ticket_age_add;
3252 * opaque ticket_nonce<0..255>;
3253 * opaque ticket<1..2^16-1>;
3254 * Extension extensions<0..2^16-2>;
3255 * } NewSessionTicket;
3256 *
3257 * The ticket inside the NewSessionTicket message is an encrypted container
3258 * carrying the necessary information so that the server is later able to
3259 * re-start the communication.
3260 *
3261 * The following fields are placed inside the ticket by the
3262 * f_ticket_write() function:
3263 *
3264 * - creation time (ticket_creation_time)
3265 * - flags (ticket_flags)
3266 * - age add (ticket_age_add)
3267 * - key (resumption_key)
3268 * - key length (resumption_key_len)
3269 * - ciphersuite (ciphersuite)
3270 * - max_early_data_size (max_early_data_size)
3271 */
3272 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_new_session_ticket_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len,unsigned char * ticket_nonce,size_t ticket_nonce_size)3273 static int ssl_tls13_write_new_session_ticket_body(mbedtls_ssl_context *ssl,
3274 unsigned char *buf,
3275 unsigned char *end,
3276 size_t *out_len,
3277 unsigned char *ticket_nonce,
3278 size_t ticket_nonce_size)
3279 {
3280 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3281 unsigned char *p = buf;
3282 mbedtls_ssl_session *session = ssl->session;
3283 size_t ticket_len;
3284 uint32_t ticket_lifetime;
3285 unsigned char *p_extensions_len;
3286
3287 *out_len = 0;
3288 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write NewSessionTicket msg"));
3289
3290 /*
3291 * ticket_lifetime 4 bytes
3292 * ticket_age_add 4 bytes
3293 * ticket_nonce 1 + ticket_nonce_size bytes
3294 * ticket >=2 bytes
3295 */
3296 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4 + 4 + 1 + ticket_nonce_size + 2);
3297
3298 /* Generate ticket and ticket_lifetime */
3299 #if defined(MBEDTLS_HAVE_TIME)
3300 session->ticket_creation_time = mbedtls_ms_time();
3301 #endif
3302 ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket,
3303 session,
3304 p + 9 + ticket_nonce_size + 2,
3305 end,
3306 &ticket_len,
3307 &ticket_lifetime);
3308 if (ret != 0) {
3309 MBEDTLS_SSL_DEBUG_RET(1, "write_ticket", ret);
3310 return ret;
3311 }
3312
3313 /* RFC 8446 section 4.6.1
3314 *
3315 * ticket_lifetime: Indicates the lifetime in seconds as a 32-bit
3316 * unsigned integer in network byte order from the time of ticket
3317 * issuance. Servers MUST NOT use any value greater than
3318 * 604800 seconds (7 days) ...
3319 */
3320 if (ticket_lifetime > MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME) {
3321 MBEDTLS_SSL_DEBUG_MSG(
3322 1, ("Ticket lifetime (%u) is greater than 7 days.",
3323 (unsigned int) ticket_lifetime));
3324 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3325 }
3326
3327 MBEDTLS_PUT_UINT32_BE(ticket_lifetime, p, 0);
3328 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_lifetime: %u",
3329 (unsigned int) ticket_lifetime));
3330
3331 /* Write ticket_age_add */
3332 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 4);
3333 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
3334 (unsigned int) session->ticket_age_add));
3335
3336 /* Write ticket_nonce */
3337 p[8] = (unsigned char) ticket_nonce_size;
3338 if (ticket_nonce_size > 0) {
3339 memcpy(p + 9, ticket_nonce, ticket_nonce_size);
3340 }
3341 p += 9 + ticket_nonce_size;
3342
3343 /* Write ticket */
3344 MBEDTLS_PUT_UINT16_BE(ticket_len, p, 0);
3345 p += 2;
3346 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", p, ticket_len);
3347 p += ticket_len;
3348
3349 /* Ticket Extensions
3350 *
3351 * Extension extensions<0..2^16-2>;
3352 */
3353 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
3354
3355 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
3356 p_extensions_len = p;
3357 p += 2;
3358
3359 #if defined(MBEDTLS_SSL_EARLY_DATA)
3360 if (mbedtls_ssl_tls13_session_ticket_allow_early_data(session)) {
3361 size_t output_len;
3362
3363 if ((ret = mbedtls_ssl_tls13_write_early_data_ext(
3364 ssl, 1, p, end, &output_len)) != 0) {
3365 MBEDTLS_SSL_DEBUG_RET(
3366 1, "mbedtls_ssl_tls13_write_early_data_ext", ret);
3367 return ret;
3368 }
3369 p += output_len;
3370 } else {
3371 MBEDTLS_SSL_DEBUG_MSG(
3372 4, ("early_data not allowed, "
3373 "skip early_data extension in NewSessionTicket"));
3374 }
3375
3376 #endif /* MBEDTLS_SSL_EARLY_DATA */
3377
3378 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
3379
3380 *out_len = p - buf;
3381 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", buf, *out_len);
3382 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket"));
3383
3384 MBEDTLS_SSL_PRINT_EXTS(
3385 3, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, ssl->handshake->sent_extensions);
3386
3387 return 0;
3388 }
3389
3390 /*
3391 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
3392 */
ssl_tls13_write_new_session_ticket(mbedtls_ssl_context * ssl)3393 static int ssl_tls13_write_new_session_ticket(mbedtls_ssl_context *ssl)
3394 {
3395 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3396
3397 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_write_new_session_ticket_coordinate(ssl));
3398
3399 if (ret == SSL_NEW_SESSION_TICKET_WRITE) {
3400 unsigned char ticket_nonce[MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH];
3401 unsigned char *buf;
3402 size_t buf_len, msg_len;
3403
3404 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_new_session_ticket(
3405 ssl, ticket_nonce, sizeof(ticket_nonce)));
3406
3407 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
3408 ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
3409 &buf, &buf_len));
3410
3411 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_new_session_ticket_body(
3412 ssl, buf, buf + buf_len, &msg_len,
3413 ticket_nonce, sizeof(ticket_nonce)));
3414
3415 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
3416 ssl, buf_len, msg_len));
3417
3418 /* Limit session tickets count to one when resumption connection.
3419 *
3420 * See document of mbedtls_ssl_conf_new_session_tickets.
3421 */
3422 if (ssl->handshake->resume == 1) {
3423 ssl->handshake->new_session_tickets_count = 0;
3424 } else {
3425 ssl->handshake->new_session_tickets_count--;
3426 }
3427
3428 mbedtls_ssl_handshake_set_state(
3429 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH);
3430 } else {
3431 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3432 }
3433
3434 cleanup:
3435
3436 return ret;
3437 }
3438 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
3439
3440 /*
3441 * TLS 1.3 State Machine -- server side
3442 */
mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context * ssl)3443 int mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context *ssl)
3444 {
3445 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3446
3447 if (ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL) {
3448 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3449 }
3450
3451 MBEDTLS_SSL_DEBUG_MSG(2, ("tls13 server state: %s(%d)",
3452 mbedtls_ssl_states_str((mbedtls_ssl_states) ssl->state),
3453 ssl->state));
3454
3455 switch (ssl->state) {
3456 /* start state */
3457 case MBEDTLS_SSL_HELLO_REQUEST:
3458 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
3459 ret = 0;
3460 break;
3461
3462 case MBEDTLS_SSL_CLIENT_HELLO:
3463 ret = ssl_tls13_process_client_hello(ssl);
3464 if (ret != 0) {
3465 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_process_client_hello", ret);
3466 }
3467 break;
3468
3469 case MBEDTLS_SSL_HELLO_RETRY_REQUEST:
3470 ret = ssl_tls13_write_hello_retry_request(ssl);
3471 if (ret != 0) {
3472 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_hello_retry_request", ret);
3473 return ret;
3474 }
3475 break;
3476
3477 case MBEDTLS_SSL_SERVER_HELLO:
3478 ret = ssl_tls13_write_server_hello(ssl);
3479 break;
3480
3481 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
3482 ret = ssl_tls13_write_encrypted_extensions(ssl);
3483 if (ret != 0) {
3484 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_encrypted_extensions", ret);
3485 return ret;
3486 }
3487 break;
3488
3489 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
3490 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
3491 ret = ssl_tls13_write_certificate_request(ssl);
3492 break;
3493
3494 case MBEDTLS_SSL_SERVER_CERTIFICATE:
3495 ret = ssl_tls13_write_server_certificate(ssl);
3496 break;
3497
3498 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
3499 ret = ssl_tls13_write_certificate_verify(ssl);
3500 break;
3501 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
3502
3503 /*
3504 * Injection of dummy-CCS's for middlebox compatibility
3505 */
3506 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
3507 case MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST:
3508 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3509 if (ret == 0) {
3510 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
3511 }
3512 break;
3513
3514 case MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO:
3515 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3516 if (ret != 0) {
3517 break;
3518 }
3519 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
3520 break;
3521 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
3522
3523 case MBEDTLS_SSL_SERVER_FINISHED:
3524 ret = ssl_tls13_write_server_finished(ssl);
3525 break;
3526
3527 #if defined(MBEDTLS_SSL_EARLY_DATA)
3528 case MBEDTLS_SSL_END_OF_EARLY_DATA:
3529 ret = ssl_tls13_process_end_of_early_data(ssl);
3530 break;
3531 #endif /* MBEDTLS_SSL_EARLY_DATA */
3532
3533 case MBEDTLS_SSL_CLIENT_FINISHED:
3534 ret = ssl_tls13_process_client_finished(ssl);
3535 break;
3536
3537 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
3538 ret = ssl_tls13_handshake_wrapup(ssl);
3539 break;
3540
3541 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
3542 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
3543 ret = mbedtls_ssl_tls13_process_certificate(ssl);
3544 if (ret == 0) {
3545 if (ssl->session_negotiate->peer_cert != NULL) {
3546 mbedtls_ssl_handshake_set_state(
3547 ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY);
3548 } else {
3549 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
3550 mbedtls_ssl_handshake_set_state(
3551 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
3552 }
3553 }
3554 break;
3555
3556 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
3557 ret = mbedtls_ssl_tls13_process_certificate_verify(ssl);
3558 if (ret == 0) {
3559 mbedtls_ssl_handshake_set_state(
3560 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
3561 }
3562 break;
3563 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
3564
3565 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
3566 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET:
3567 ret = ssl_tls13_write_new_session_ticket(ssl);
3568 if (ret != 0) {
3569 MBEDTLS_SSL_DEBUG_RET(1,
3570 "ssl_tls13_write_new_session_ticket ",
3571 ret);
3572 }
3573 break;
3574 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH:
3575 /* This state is necessary to do the flush of the New Session
3576 * Ticket message written in MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
3577 * as part of ssl_prepare_handshake_step.
3578 */
3579 ret = 0;
3580
3581 if (ssl->handshake->new_session_tickets_count == 0) {
3582 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3583 } else {
3584 mbedtls_ssl_handshake_set_state(
3585 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
3586 }
3587 break;
3588
3589 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
3590
3591 default:
3592 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state));
3593 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3594 }
3595
3596 return ret;
3597 }
3598
3599 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */
3600
