1 /* 2 * TLS 1.3 client-side functions 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 * 19 * This file is part of mbed TLS ( https://tls.mbed.org ) 20 */ 21 22 #include "common.h" 23 24 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 25 26 #if defined(MBEDTLS_SSL_CLI_C) 27 28 #include <string.h> 29 30 #include "mbedtls/debug.h" 31 #include "mbedtls/error.h" 32 #include "mbedtls/platform.h" 33 34 #include "ssl_misc.h" 35 #include "ecdh_misc.h" 36 #include "ssl_tls13_keys.h" 37 #include "ssl_debug_helpers_generated.h" 38 39 /* Write extensions */ 40 41 /* 42 * ssl_tls13_write_supported_versions_ext(): 43 * 44 * struct { 45 * ProtocolVersion versions<2..254>; 46 * } SupportedVersions; 47 */ ssl_tls13_write_supported_versions_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)48 static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl, 49 unsigned char *buf, 50 unsigned char *end, 51 size_t *out_len ) 52 { 53 unsigned char *p = buf; 54 55 *out_len = 0; 56 57 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) ); 58 59 /* Check if we have space to write the extension: 60 * - extension_type (2 bytes) 61 * - extension_data_length (2 bytes) 62 * - versions_length (1 byte ) 63 * - versions (2 bytes) 64 */ 65 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 ); 66 67 /* Write extension_type */ 68 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 ); 69 70 /* Write extension_data_length */ 71 MBEDTLS_PUT_UINT16_BE( 3, p, 2 ); 72 p += 4; 73 74 /* Length of versions */ 75 *p++ = 0x2; 76 77 /* Write values of supported versions. 78 * 79 * They are defined by the configuration. 80 * 81 * Currently, only one version is advertised. 82 */ 83 mbedtls_ssl_write_version( ssl->conf->max_major_ver, 84 ssl->conf->max_minor_ver, 85 ssl->conf->transport, p ); 86 87 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]", 88 ssl->conf->max_major_ver, 89 ssl->conf->max_minor_ver ) ); 90 91 *out_len = 7; 92 93 return( 0 ); 94 } 95 ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)96 static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl, 97 const unsigned char *buf, 98 const unsigned char *end ) 99 { 100 ((void) ssl); 101 102 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2); 103 if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 || 104 buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 ) 105 { 106 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) ); 107 108 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 109 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); 110 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 111 } 112 113 return( 0 ); 114 } 115 116 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 117 118 /* 119 * Functions for writing supported_groups extension. 120 * 121 * Stucture of supported_groups: 122 * enum { 123 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019), 124 * x25519(0x001D), x448(0x001E), 125 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102), 126 * ffdhe6144(0x0103), ffdhe8192(0x0104), 127 * ffdhe_private_use(0x01FC..0x01FF), 128 * ecdhe_private_use(0xFE00..0xFEFF), 129 * (0xFFFF) 130 * } NamedGroup; 131 * struct { 132 * NamedGroup named_group_list<2..2^16-1>; 133 * } NamedGroupList; 134 */ 135 #if defined(MBEDTLS_ECDH_C) 136 /* 137 * In versions of TLS prior to TLS 1.3, this extension was named 138 * 'elliptic_curves' and only contained elliptic curve groups. 139 */ ssl_tls13_write_named_group_list_ecdhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)140 static int ssl_tls13_write_named_group_list_ecdhe( mbedtls_ssl_context *ssl, 141 unsigned char *buf, 142 unsigned char *end, 143 size_t *out_len ) 144 { 145 unsigned char *p = buf; 146 147 *out_len = 0; 148 149 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl ); 150 151 if( group_list == NULL ) 152 return( MBEDTLS_ERR_SSL_BAD_CONFIG ); 153 154 for ( ; *group_list != 0; group_list++ ) 155 { 156 const mbedtls_ecp_curve_info *curve_info; 157 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list ); 158 if( curve_info == NULL ) 159 continue; 160 161 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) 162 continue; 163 164 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2); 165 MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 ); 166 p += 2; 167 168 MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )", 169 curve_info->name, *group_list ) ); 170 } 171 172 *out_len = p - buf; 173 174 return( 0 ); 175 } 176 #else ssl_tls13_write_named_group_list_ecdhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)177 static int ssl_tls13_write_named_group_list_ecdhe( mbedtls_ssl_context *ssl, 178 unsigned char *buf, 179 unsigned char *end, 180 size_t *out_len ) 181 { 182 ((void) ssl); 183 ((void) buf); 184 ((void) end); 185 *out_len = 0; 186 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 187 } 188 #endif /* MBEDTLS_ECDH_C */ 189 ssl_tls13_write_named_group_list_dhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)190 static int ssl_tls13_write_named_group_list_dhe( mbedtls_ssl_context *ssl, 191 unsigned char *buf, 192 unsigned char *end, 193 size_t *out_len ) 194 { 195 ((void) ssl); 196 ((void) buf); 197 ((void) end); 198 *out_len = 0; 199 MBEDTLS_SSL_DEBUG_MSG( 3, ( "write_named_group_dhe is not implemented" ) ); 200 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 201 } 202 ssl_tls13_write_supported_groups_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)203 static int ssl_tls13_write_supported_groups_ext( mbedtls_ssl_context *ssl, 204 unsigned char *buf, 205 unsigned char *end, 206 size_t *out_len ) 207 { 208 unsigned char *p = buf ; 209 unsigned char *named_group_list; /* Start of named_group_list */ 210 size_t named_group_list_len; /* Length of named_group_list */ 211 size_t output_len = 0; 212 int ret_ecdhe, ret_dhe; 213 214 *out_len = 0; 215 216 if( !mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) ) 217 return( 0 ); 218 219 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) ); 220 221 /* Check if we have space for header and length fields: 222 * - extension_type (2 bytes) 223 * - extension_data_length (2 bytes) 224 * - named_group_list_length (2 bytes) 225 */ 226 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 ); 227 p += 6; 228 229 named_group_list = p; 230 ret_ecdhe = ssl_tls13_write_named_group_list_ecdhe( ssl, p, end, &output_len ); 231 if( ret_ecdhe != 0 ) 232 { 233 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_named_group_list_ecdhe", ret_ecdhe ); 234 } 235 p += output_len; 236 237 ret_dhe = ssl_tls13_write_named_group_list_dhe( ssl, p, end, &output_len ); 238 if( ret_dhe != 0 ) 239 { 240 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_named_group_list_dhe", ret_dhe ); 241 } 242 p += output_len; 243 244 /* Both ECDHE and DHE failed. */ 245 if( ret_ecdhe != 0 && ret_dhe != 0 ) 246 { 247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Both ECDHE and DHE groups are fail. " ) ); 248 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 249 } 250 251 /* Length of named_group_list*/ 252 named_group_list_len = p - named_group_list; 253 if( named_group_list_len == 0 ) 254 { 255 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) ); 256 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 257 } 258 259 /* Write extension_type */ 260 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 ); 261 /* Write extension_data_length */ 262 MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 ); 263 /* Write length of named_group_list */ 264 MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 ); 265 266 MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension", buf + 4, named_group_list_len + 2 ); 267 268 *out_len = p - buf; 269 270 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS; 271 272 return( 0 ); 273 } 274 275 /* 276 * Functions for writing key_share extension. 277 */ 278 #if defined(MBEDTLS_ECDH_C) ssl_tls13_generate_and_write_ecdh_key_exchange(mbedtls_ssl_context * ssl,uint16_t named_group,unsigned char * buf,unsigned char * end,size_t * out_len)279 static int ssl_tls13_generate_and_write_ecdh_key_exchange( 280 mbedtls_ssl_context *ssl, 281 uint16_t named_group, 282 unsigned char *buf, 283 unsigned char *end, 284 size_t *out_len ) 285 { 286 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 287 const mbedtls_ecp_curve_info *curve_info = 288 mbedtls_ecp_curve_info_from_tls_id( named_group ); 289 290 if( curve_info == NULL ) 291 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 292 293 MBEDTLS_SSL_DEBUG_MSG( 3, ( "offer curve %s", curve_info->name ) ); 294 295 if( ( ret = mbedtls_ecdh_setup_no_everest( &ssl->handshake->ecdh_ctx, 296 curve_info->grp_id ) ) != 0 ) 297 { 298 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_setup_no_everest", ret ); 299 return( ret ); 300 } 301 302 ret = mbedtls_ecdh_tls13_make_params( &ssl->handshake->ecdh_ctx, out_len, 303 buf, end - buf, 304 ssl->conf->f_rng, ssl->conf->p_rng ); 305 if( ret != 0 ) 306 { 307 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_tls13_make_params", ret ); 308 return( ret ); 309 } 310 311 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, 312 MBEDTLS_DEBUG_ECDH_Q ); 313 return( 0 ); 314 } 315 #endif /* MBEDTLS_ECDH_C */ 316 ssl_tls13_get_default_group_id(mbedtls_ssl_context * ssl,uint16_t * group_id)317 static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl, 318 uint16_t *group_id ) 319 { 320 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 321 322 323 #if defined(MBEDTLS_ECDH_C) 324 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl ); 325 /* Pick first available ECDHE group compatible with TLS 1.3 */ 326 if( group_list == NULL ) 327 return( MBEDTLS_ERR_SSL_BAD_CONFIG ); 328 329 for ( ; *group_list != 0; group_list++ ) 330 { 331 const mbedtls_ecp_curve_info *curve_info; 332 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list ); 333 if( curve_info != NULL && 334 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) 335 { 336 *group_id = *group_list; 337 return( 0 ); 338 } 339 } 340 #else 341 ((void) ssl); 342 ((void) group_id); 343 #endif /* MBEDTLS_ECDH_C */ 344 345 /* 346 * Add DHE named groups here. 347 * Pick first available DHE group compatible with TLS 1.3 348 */ 349 350 return( ret ); 351 } 352 353 /* 354 * ssl_tls13_write_key_share_ext 355 * 356 * Structure of key_share extension in ClientHello: 357 * 358 * struct { 359 * NamedGroup group; 360 * opaque key_exchange<1..2^16-1>; 361 * } KeyShareEntry; 362 * struct { 363 * KeyShareEntry client_shares<0..2^16-1>; 364 * } KeyShareClientHello; 365 */ ssl_tls13_write_key_share_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)366 static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl, 367 unsigned char *buf, 368 unsigned char *end, 369 size_t *out_len ) 370 { 371 unsigned char *p = buf; 372 unsigned char *client_shares; /* Start of client_shares */ 373 size_t client_shares_len; /* Length of client_shares */ 374 uint16_t group_id; 375 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 376 377 *out_len = 0; 378 379 if( !mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) ) 380 return( 0 ); 381 382 /* Check if we have space for header and length fields: 383 * - extension_type (2 bytes) 384 * - extension_data_length (2 bytes) 385 * - client_shares_length (2 bytes) 386 */ 387 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 ); 388 p += 6; 389 390 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) ); 391 392 /* HRR could already have requested something else. */ 393 group_id = ssl->handshake->offered_group_id; 394 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) && 395 !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) ) 396 { 397 MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl, 398 &group_id ) ); 399 } 400 401 /* 402 * Dispatch to type-specific key generation function. 403 * 404 * So far, we're only supporting ECDHE. With the introduction 405 * of PQC KEMs, we'll want to have multiple branches, one per 406 * type of KEM, and dispatch to the corresponding crypto. And 407 * only one key share entry is allowed. 408 */ 409 client_shares = p; 410 #if defined(MBEDTLS_ECDH_C) 411 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) ) 412 { 413 /* Pointer to group */ 414 unsigned char *group = p; 415 /* Length of key_exchange */ 416 size_t key_exchange_len; 417 418 /* Check there is space for header of KeyShareEntry 419 * - group (2 bytes) 420 * - key_exchange_length (2 bytes) 421 */ 422 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 ); 423 p += 4; 424 ret = ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, group_id, 425 p, end, 426 &key_exchange_len ); 427 p += key_exchange_len; 428 if( ret != 0 ) 429 return( ret ); 430 431 /* Write group */ 432 MBEDTLS_PUT_UINT16_BE( group_id, group, 0 ); 433 /* Write key_exchange_length */ 434 MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 ); 435 } 436 else 437 #endif /* MBEDTLS_ECDH_C */ 438 if( 0 /* other KEMs? */ ) 439 { 440 /* Do something */ 441 } 442 else 443 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 444 445 /* Length of client_shares */ 446 client_shares_len = p - client_shares; 447 if( client_shares_len == 0) 448 { 449 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) ); 450 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 451 } 452 /* Write extension_type */ 453 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 ); 454 /* Write extension_data_length */ 455 MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 ); 456 /* Write client_shares_length */ 457 MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 ); 458 459 /* Update offered_group_id field */ 460 ssl->handshake->offered_group_id = group_id; 461 462 /* Output the total length of key_share extension. */ 463 *out_len = p - buf; 464 465 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len ); 466 467 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE; 468 469 cleanup: 470 471 return( ret ); 472 } 473 474 #if defined(MBEDTLS_ECDH_C) 475 ssl_tls13_check_ecdh_params(const mbedtls_ssl_context * ssl)476 static int ssl_tls13_check_ecdh_params( const mbedtls_ssl_context *ssl ) 477 { 478 const mbedtls_ecp_curve_info *curve_info; 479 mbedtls_ecp_group_id grp_id; 480 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT) 481 grp_id = ssl->handshake->ecdh_ctx.grp.id; 482 #else 483 grp_id = ssl->handshake->ecdh_ctx.grp_id; 484 #endif 485 486 curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id ); 487 if( curve_info == NULL ) 488 { 489 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 490 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 491 } 492 493 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) ); 494 495 if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 ) 496 return( -1 ); 497 498 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx, 499 MBEDTLS_DEBUG_ECDH_QP ); 500 501 return( 0 ); 502 } 503 ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t buf_len)504 static int ssl_tls13_read_public_ecdhe_share( mbedtls_ssl_context *ssl, 505 const unsigned char *buf, 506 size_t buf_len ) 507 { 508 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 509 510 ret = mbedtls_ecdh_tls13_read_public( &ssl->handshake->ecdh_ctx, 511 buf, buf_len ); 512 if( ret != 0 ) 513 { 514 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_tls13_read_public" ), ret ); 515 516 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 517 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 518 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 519 } 520 521 if( ssl_tls13_check_ecdh_params( ssl ) != 0 ) 522 { 523 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ssl_tls13_check_ecdh_params() failed!" ) ); 524 525 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 526 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 527 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 528 } 529 530 return( 0 ); 531 } 532 #endif /* MBEDTLS_ECDH_C */ 533 534 /* 535 * ssl_tls13_parse_key_share_ext() 536 * Parse key_share extension in Server Hello 537 * 538 * struct { 539 * KeyShareEntry server_share; 540 * } KeyShareServerHello; 541 * struct { 542 * NamedGroup group; 543 * opaque key_exchange<1..2^16-1>; 544 * } KeyShareEntry; 545 */ ssl_tls13_parse_key_share_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)546 static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl, 547 const unsigned char *buf, 548 const unsigned char *end ) 549 { 550 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 551 const unsigned char *p = buf; 552 uint16_t group, offered_group; 553 554 /* ... 555 * NamedGroup group; (2 bytes) 556 * ... 557 */ 558 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); 559 group = MBEDTLS_GET_UINT16_BE( p, 0 ); 560 p += 2; 561 562 /* Check that the chosen group matches the one we offered. */ 563 offered_group = ssl->handshake->offered_group_id; 564 if( offered_group != group ) 565 { 566 MBEDTLS_SSL_DEBUG_MSG( 1, 567 ( "Invalid server key share, our group %u, their group %u", 568 (unsigned) offered_group, (unsigned) group ) ); 569 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE, 570 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); 571 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); 572 } 573 574 #if defined(MBEDTLS_ECDH_C) 575 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) ) 576 { 577 /* Complete ECDHE key agreement */ 578 ret = ssl_tls13_read_public_ecdhe_share( ssl, p, end - p ); 579 if( ret != 0 ) 580 return( ret ); 581 } 582 else 583 #endif /* MBEDTLS_ECDH_C */ 584 if( 0 /* other KEMs? */ ) 585 { 586 /* Do something */ 587 } 588 else 589 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 590 591 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE; 592 return( ret ); 593 } 594 595 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 596 597 /* Write cipher_suites 598 * CipherSuite cipher_suites<2..2^16-2>; 599 */ ssl_tls13_write_client_hello_cipher_suites(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)600 static int ssl_tls13_write_client_hello_cipher_suites( 601 mbedtls_ssl_context *ssl, 602 unsigned char *buf, 603 unsigned char *end, 604 size_t *out_len ) 605 { 606 unsigned char *p = buf; 607 const int *ciphersuite_list; 608 unsigned char *cipher_suites; /* Start of the cipher_suites list */ 609 size_t cipher_suites_len; 610 611 *out_len = 0 ; 612 613 /* 614 * Ciphersuite list 615 * 616 * This is a list of the symmetric cipher options supported by 617 * the client, specifically the record protection algorithm 618 * ( including secret key length ) and a hash to be used with 619 * HKDF, in descending order of client preference. 620 */ 621 ciphersuite_list = ssl->conf->ciphersuite_list; 622 623 /* Check there is space for the cipher suite list length (2 bytes). */ 624 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 ); 625 p += 2; 626 627 /* Write cipher_suites */ 628 cipher_suites = p; 629 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ ) 630 { 631 int cipher_suite = ciphersuite_list[i]; 632 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 633 634 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite ); 635 if( ciphersuite_info == NULL ) 636 continue; 637 if( !( MBEDTLS_SSL_MINOR_VERSION_4 >= ciphersuite_info->min_minor_ver && 638 MBEDTLS_SSL_MINOR_VERSION_4 <= ciphersuite_info->max_minor_ver ) ) 639 continue; 640 641 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s", 642 (unsigned int) cipher_suite, 643 ciphersuite_info->name ) ); 644 645 /* Check there is space for the cipher suite identifier (2 bytes). */ 646 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 ); 647 MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 ); 648 p += 2; 649 } 650 651 /* Write the cipher_suites length in number of bytes */ 652 cipher_suites_len = p - cipher_suites; 653 MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 ); 654 MBEDTLS_SSL_DEBUG_MSG( 3, 655 ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites", 656 cipher_suites_len/2 ) ); 657 658 /* Output the total length of cipher_suites field. */ 659 *out_len = p - buf; 660 661 return( 0 ); 662 } 663 664 /* 665 * Structure of ClientHello message: 666 * 667 * struct { 668 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2 669 * Random random; 670 * opaque legacy_session_id<0..32>; 671 * CipherSuite cipher_suites<2..2^16-2>; 672 * opaque legacy_compression_methods<1..2^8-1>; 673 * Extension extensions<8..2^16-1>; 674 * } ClientHello; 675 */ ssl_tls13_write_client_hello_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)676 static int ssl_tls13_write_client_hello_body( mbedtls_ssl_context *ssl, 677 unsigned char *buf, 678 unsigned char *end, 679 size_t *out_len ) 680 { 681 682 int ret; 683 unsigned char *p_extensions_len; /* Pointer to extensions length */ 684 size_t output_len; /* Length of buffer used by function */ 685 size_t extensions_len; /* Length of the list of extensions*/ 686 687 /* Buffer management */ 688 unsigned char *p = buf; 689 690 *out_len = 0; 691 692 /* No validation needed here. It has been done by ssl_conf_check() */ 693 ssl->major_ver = ssl->conf->min_major_ver; 694 ssl->minor_ver = ssl->conf->min_minor_ver; 695 696 /* 697 * Write legacy_version 698 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2 699 * 700 * For TLS 1.3 we use the legacy version number {0x03, 0x03} 701 * instead of the true version number. 702 */ 703 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 ); 704 MBEDTLS_PUT_UINT16_BE( 0x0303, p, 0 ); 705 p += 2; 706 707 /* Write the random bytes ( random ).*/ 708 MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN ); 709 memcpy( p, ssl->handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN ); 710 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", 711 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN ); 712 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN; 713 714 /* 715 * Write legacy_session_id 716 * 717 * Versions of TLS before TLS 1.3 supported a "session resumption" feature 718 * which has been merged with pre-shared keys in this version. A client 719 * which has a cached session ID set by a pre-TLS 1.3 server SHOULD set 720 * this field to that value. In compatibility mode, this field MUST be 721 * non-empty, so a client not offering a pre-TLS 1.3 session MUST generate 722 * a new 32-byte value. This value need not be random but SHOULD be 723 * unpredictable to avoid implementations fixating on a specific value 724 * ( also known as ossification ). Otherwise, it MUST be set as a zero-length 725 * vector ( i.e., a zero-valued single byte length field ). 726 */ 727 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) 728 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 ); 729 *p++ = (unsigned char)ssl->session_negotiate->id_len; 730 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len ); 731 p += ssl->session_negotiate->id_len; 732 733 MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id, 734 ssl->session_negotiate->id_len ); 735 #else 736 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 ); 737 *p++ = 0; /* session id length set to zero */ 738 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ 739 740 /* Write cipher_suites */ 741 ret = ssl_tls13_write_client_hello_cipher_suites( ssl, p, end, &output_len ); 742 if( ret != 0 ) 743 return( ret ); 744 p += output_len; 745 746 /* Write legacy_compression_methods 747 * 748 * For every TLS 1.3 ClientHello, this vector MUST contain exactly 749 * one byte set to zero, which corresponds to the 'null' compression 750 * method in prior versions of TLS. 751 */ 752 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 ); 753 *p++ = 1; 754 *p++ = MBEDTLS_SSL_COMPRESS_NULL; 755 756 /* Write extensions */ 757 758 /* Keeping track of the included extensions */ 759 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE; 760 761 /* First write extensions, then the total length */ 762 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 ); 763 p_extensions_len = p; 764 p += 2; 765 766 /* Write supported_versions extension 767 * 768 * Supported Versions Extension is mandatory with TLS 1.3. 769 */ 770 ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &output_len ); 771 if( ret != 0 ) 772 return( ret ); 773 p += output_len; 774 775 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 776 /* Write supported_groups extension 777 * 778 * It is REQUIRED for ECDHE cipher_suites. 779 */ 780 ret = ssl_tls13_write_supported_groups_ext( ssl, p, end, &output_len ); 781 if( ret != 0 ) 782 return( ret ); 783 p += output_len; 784 785 /* Write key_share extension 786 * 787 * We need to send the key shares under three conditions: 788 * 1) A certificate-based ciphersuite is being offered. In this case 789 * supported_groups and supported_signature extensions have been 790 * successfully added. 791 * 2) A PSK-based ciphersuite with ECDHE is offered. In this case the 792 * psk_key_exchange_modes has been added as the last extension. 793 * 3) Or, in case all ciphers are supported ( which includes #1 and #2 794 * from above ) 795 */ 796 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &output_len ); 797 if( ret != 0 ) 798 return( ret ); 799 p += output_len; 800 801 /* Write signature_algorithms extension 802 * 803 * It is REQUIRED for certificate authenticated cipher_suites. 804 */ 805 ret = mbedtls_ssl_tls13_write_sig_alg_ext( ssl, p, end, &output_len ); 806 if( ret != 0 ) 807 return( ret ); 808 p += output_len; 809 810 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 811 812 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 813 /* Write server name extension */ 814 ret = mbedtls_ssl_write_hostname_ext( ssl, p, end, &output_len ); 815 if( ret != 0 ) 816 return( ret ); 817 p += output_len; 818 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 819 820 /* Add more extensions here */ 821 822 /* Write the length of the list of extensions. */ 823 extensions_len = p - p_extensions_len - 2; 824 MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 ); 825 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" MBEDTLS_PRINTF_SIZET , 826 extensions_len ) ); 827 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p_extensions_len, extensions_len ); 828 829 *out_len = p - buf; 830 return( 0 ); 831 } 832 ssl_tls13_finalize_client_hello(mbedtls_ssl_context * ssl)833 static int ssl_tls13_finalize_client_hello( mbedtls_ssl_context *ssl ) 834 { 835 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO ); 836 return( 0 ); 837 } 838 ssl_tls13_prepare_client_hello(mbedtls_ssl_context * ssl)839 static int ssl_tls13_prepare_client_hello( mbedtls_ssl_context *ssl ) 840 { 841 int ret; 842 843 if( ssl->conf->f_rng == NULL ) 844 { 845 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) ); 846 return( MBEDTLS_ERR_SSL_NO_RNG ); 847 } 848 849 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, 850 ssl->handshake->randbytes, 851 MBEDTLS_CLIENT_HELLO_RANDOM_LEN ) ) != 0 ) 852 { 853 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret ); 854 return( ret ); 855 } 856 857 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) 858 /* 859 * Create a session identifier for the purpose of middlebox compatibility 860 * only if one has not been created already. 861 */ 862 if( ssl->session_negotiate->id_len == 0 ) 863 { 864 /* Creating a session id with 32 byte length */ 865 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, 866 ssl->session_negotiate->id, 32 ) ) != 0 ) 867 { 868 MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret ); 869 return( ret ); 870 } 871 ssl->session_negotiate->id_len = 32; 872 } 873 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ 874 875 return( 0 ); 876 } 877 878 /* 879 * Write ClientHello handshake message. 880 * Handler for MBEDTLS_SSL_CLIENT_HELLO 881 */ ssl_tls13_write_client_hello(mbedtls_ssl_context * ssl)882 static int ssl_tls13_write_client_hello( mbedtls_ssl_context *ssl ) 883 { 884 int ret = 0; 885 unsigned char *buf; 886 size_t buf_len, msg_len; 887 888 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) ); 889 890 MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_client_hello( ssl ) ); 891 892 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_start_handshake_msg( 893 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, 894 &buf, &buf_len ) ); 895 896 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_client_hello_body( ssl, buf, 897 buf + buf_len, 898 &msg_len ) ); 899 900 mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl, 901 MBEDTLS_SSL_HS_CLIENT_HELLO, 902 msg_len ); 903 ssl->handshake->update_checksum( ssl, buf, msg_len ); 904 905 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_client_hello( ssl ) ); 906 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_finish_handshake_msg( ssl, 907 buf_len, 908 msg_len ) ); 909 910 cleanup: 911 912 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) ); 913 return ret; 914 } 915 916 /* 917 * Functions for parsing and processing Server Hello 918 */ 919 /* Returns a negative value on failure, and otherwise 920 * - SSL_SERVER_HELLO_COORDINATE_HELLO or 921 * - SSL_SERVER_HELLO_COORDINATE_HRR 922 * to indicate which message is expected and to be parsed next. */ 923 #define SSL_SERVER_HELLO_COORDINATE_HELLO 0 924 #define SSL_SERVER_HELLO_COORDINATE_HRR 1 ssl_server_hello_is_hrr(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)925 static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl, 926 const unsigned char *buf, 927 const unsigned char *end ) 928 { 929 static const unsigned char magic_hrr_string[MBEDTLS_SERVER_HELLO_RANDOM_LEN] = 930 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11, 931 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91, 932 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E, 933 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33 ,0x9C }; 934 935 /* Check whether this message is a HelloRetryRequest ( HRR ) message. 936 * 937 * Server Hello and HRR are only distinguished by Random set to the 938 * special value of the SHA-256 of "HelloRetryRequest". 939 * 940 * struct { 941 * ProtocolVersion legacy_version = 0x0303; 942 * Random random; 943 * opaque legacy_session_id_echo<0..32>; 944 * CipherSuite cipher_suite; 945 * uint8 legacy_compression_method = 0; 946 * Extension extensions<6..2^16-1>; 947 * } ServerHello; 948 * 949 */ 950 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 + sizeof( magic_hrr_string ) ); 951 952 if( memcmp( buf + 2, magic_hrr_string, sizeof( magic_hrr_string ) ) == 0 ) 953 { 954 return( SSL_SERVER_HELLO_COORDINATE_HRR ); 955 } 956 957 return( SSL_SERVER_HELLO_COORDINATE_HELLO ); 958 } 959 960 /* Fetch and preprocess 961 * Returns a negative value on failure, and otherwise 962 * - SSL_SERVER_HELLO_COORDINATE_HELLO or 963 * - SSL_SERVER_HELLO_COORDINATE_HRR 964 */ ssl_tls13_server_hello_coordinate(mbedtls_ssl_context * ssl,unsigned char ** buf,size_t * buf_len)965 static int ssl_tls13_server_hello_coordinate( mbedtls_ssl_context *ssl, 966 unsigned char **buf, 967 size_t *buf_len ) 968 { 969 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 970 971 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_read_record( ssl, 0 ) ); 972 973 if( ( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) || 974 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO ) ) 975 { 976 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected message" ) ); 977 978 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE, 979 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 980 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 981 } 982 983 *buf = ssl->in_msg + 4; 984 *buf_len = ssl->in_hslen - 4; 985 986 ret = ssl_server_hello_is_hrr( ssl, *buf, *buf + *buf_len ); 987 switch( ret ) 988 { 989 case SSL_SERVER_HELLO_COORDINATE_HELLO: 990 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) ); 991 break; 992 case SSL_SERVER_HELLO_COORDINATE_HRR: 993 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) ); 994 break; 995 } 996 997 cleanup: 998 999 return( ret ); 1000 } 1001 ssl_tls13_check_server_hello_session_id_echo(mbedtls_ssl_context * ssl,const unsigned char ** buf,const unsigned char * end)1002 static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl, 1003 const unsigned char **buf, 1004 const unsigned char *end ) 1005 { 1006 const unsigned char *p = *buf; 1007 size_t legacy_session_id_echo_len; 1008 1009 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 ); 1010 legacy_session_id_echo_len = *p++ ; 1011 1012 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len ); 1013 1014 /* legacy_session_id_echo */ 1015 if( ssl->session_negotiate->id_len != legacy_session_id_echo_len || 1016 memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 ) 1017 { 1018 MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID", 1019 ssl->session_negotiate->id, 1020 ssl->session_negotiate->id_len ); 1021 MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p, 1022 legacy_session_id_echo_len ); 1023 1024 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1025 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); 1026 1027 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1028 } 1029 1030 p += legacy_session_id_echo_len; 1031 *buf = p; 1032 1033 MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id, 1034 ssl->session_negotiate->id_len ); 1035 return( 0 ); 1036 } 1037 ssl_tls13_cipher_suite_is_offered(mbedtls_ssl_context * ssl,int cipher_suite)1038 static int ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl, 1039 int cipher_suite ) 1040 { 1041 const int *ciphersuite_list = ssl->conf->ciphersuite_list; 1042 1043 /* Check whether we have offered this ciphersuite */ 1044 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ ) 1045 { 1046 if( ciphersuite_list[i] == cipher_suite ) 1047 { 1048 return( 1 ); 1049 } 1050 } 1051 return( 0 ); 1052 } 1053 1054 /* Parse ServerHello message and configure context 1055 * 1056 * struct { 1057 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2 1058 * Random random; 1059 * opaque legacy_session_id_echo<0..32>; 1060 * CipherSuite cipher_suite; 1061 * uint8 legacy_compression_method = 0; 1062 * Extension extensions<6..2^16-1>; 1063 * } ServerHello; 1064 */ ssl_tls13_parse_server_hello(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1065 static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl, 1066 const unsigned char *buf, 1067 const unsigned char *end ) 1068 { 1069 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1070 const unsigned char *p = buf; 1071 size_t extensions_len; 1072 const unsigned char *extensions_end; 1073 uint16_t cipher_suite; 1074 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 1075 1076 /* 1077 * Check there is space for minimal fields 1078 * 1079 * - legacy_version ( 2 bytes) 1080 * - random (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes) 1081 * - legacy_session_id_echo ( 1 byte ), minimum size 1082 * - cipher_suite ( 2 bytes) 1083 * - legacy_compression_method ( 1 byte ) 1084 */ 1085 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 ); 1086 1087 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p ); 1088 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 ); 1089 1090 /* ... 1091 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2 1092 * ... 1093 * with ProtocolVersion defined as: 1094 * uint16 ProtocolVersion; 1095 */ 1096 if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 && 1097 p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) ) 1098 { 1099 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) ); 1100 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION, 1101 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ); 1102 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ); 1103 } 1104 p += 2; 1105 1106 /* ... 1107 * Random random; 1108 * ... 1109 * with Random defined as: 1110 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN]; 1111 */ 1112 memcpy( &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p, 1113 MBEDTLS_SERVER_HELLO_RANDOM_LEN ); 1114 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", 1115 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN ); 1116 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN; 1117 1118 /* ... 1119 * opaque legacy_session_id_echo<0..32>; 1120 * ... 1121 */ 1122 if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 ) 1123 { 1124 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1125 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1126 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1127 } 1128 1129 /* ... 1130 * CipherSuite cipher_suite; 1131 * ... 1132 * with CipherSuite defined as: 1133 * uint8 CipherSuite[2]; 1134 */ 1135 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); 1136 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 ); 1137 p += 2; 1138 1139 1140 /* 1141 * Check whether this ciphersuite is supported and offered. 1142 * Via the force_ciphersuite version we may have instructed the client 1143 * to use a different ciphersuite. 1144 */ 1145 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite ); 1146 if( ciphersuite_info == NULL || 1147 ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) == 0 ) 1148 { 1149 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite(%04x) not found or not offered", 1150 cipher_suite ) ); 1151 1152 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1153 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1154 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1155 } 1156 1157 1158 /* Configure ciphersuites */ 1159 mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info ); 1160 1161 ssl->handshake->ciphersuite_info = ciphersuite_info; 1162 ssl->session_negotiate->ciphersuite = cipher_suite; 1163 1164 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s", 1165 cipher_suite, ciphersuite_info->name ) ); 1166 1167 #if defined(MBEDTLS_HAVE_TIME) 1168 ssl->session_negotiate->start = time( NULL ); 1169 #endif /* MBEDTLS_HAVE_TIME */ 1170 1171 /* ... 1172 * uint8 legacy_compression_method = 0; 1173 * ... 1174 */ 1175 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 ); 1176 if( p[0] != 0 ) 1177 { 1178 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) ); 1179 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1180 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1181 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); 1182 } 1183 p++; 1184 1185 /* ... 1186 * Extension extensions<6..2^16-1>; 1187 * ... 1188 * struct { 1189 * ExtensionType extension_type; (2 bytes) 1190 * opaque extension_data<0..2^16-1>; 1191 * } Extension; 1192 */ 1193 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); 1194 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 ); 1195 p += 2; 1196 1197 /* Check extensions do not go beyond the buffer of data. */ 1198 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len ); 1199 extensions_end = p + extensions_len; 1200 1201 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len ); 1202 1203 while( p < extensions_end ) 1204 { 1205 unsigned int extension_type; 1206 size_t extension_data_len; 1207 1208 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 ); 1209 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 ); 1210 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 ); 1211 p += 4; 1212 1213 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len ); 1214 1215 switch( extension_type ) 1216 { 1217 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS: 1218 MBEDTLS_SSL_DEBUG_MSG( 3, 1219 ( "found supported_versions extension" ) ); 1220 1221 ret = ssl_tls13_parse_supported_versions_ext( ssl, 1222 p, 1223 p + extension_data_len ); 1224 if( ret != 0 ) 1225 return( ret ); 1226 break; 1227 1228 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY: 1229 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) ); 1230 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) ); 1231 1232 MBEDTLS_SSL_PEND_FATAL_ALERT( 1233 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, 1234 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); 1235 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); 1236 1237 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1238 case MBEDTLS_TLS_EXT_KEY_SHARE: 1239 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) ); 1240 if( ( ret = ssl_tls13_parse_key_share_ext( ssl, 1241 p, p + extension_data_len ) ) != 0 ) 1242 { 1243 MBEDTLS_SSL_DEBUG_RET( 1, 1244 "ssl_tls13_parse_key_share_ext", 1245 ret ); 1246 return( ret ); 1247 } 1248 break; 1249 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1250 1251 default: 1252 MBEDTLS_SSL_DEBUG_MSG( 1253 3, 1254 ( "unknown extension found: %u ( ignoring )", 1255 extension_type ) ); 1256 1257 MBEDTLS_SSL_PEND_FATAL_ALERT( 1258 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, 1259 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); 1260 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); 1261 } 1262 1263 p += extension_data_len; 1264 } 1265 1266 return( 0 ); 1267 } 1268 ssl_tls13_finalize_server_hello(mbedtls_ssl_context * ssl)1269 static int ssl_tls13_finalize_server_hello( mbedtls_ssl_context *ssl ) 1270 { 1271 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1272 mbedtls_ssl_key_set traffic_keys; 1273 mbedtls_ssl_transform *transform_handshake = NULL; 1274 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 1275 1276 /* Determine the key exchange mode: 1277 * 1) If both the pre_shared_key and key_share extensions were received 1278 * then the key exchange mode is PSK with EPHEMERAL. 1279 * 2) If only the pre_shared_key extension was received then the key 1280 * exchange mode is PSK-only. 1281 * 3) If only the key_share extension was received then the key 1282 * exchange mode is EPHEMERAL-only. 1283 */ 1284 switch( handshake->extensions_present & 1285 ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ) ) 1286 { 1287 /* Only the pre_shared_key extension was received */ 1288 case MBEDTLS_SSL_EXT_PRE_SHARED_KEY: 1289 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK; 1290 break; 1291 1292 /* Only the key_share extension was received */ 1293 case MBEDTLS_SSL_EXT_KEY_SHARE: 1294 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL; 1295 break; 1296 1297 /* Both the pre_shared_key and key_share extensions were received */ 1298 case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ): 1299 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL; 1300 break; 1301 1302 /* Neither pre_shared_key nor key_share extension was received */ 1303 default: 1304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) ); 1305 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1306 goto cleanup; 1307 } 1308 1309 /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret. 1310 * 1311 * TODO: We don't have to do this in case we offered 0-RTT and the 1312 * server accepted it. In this case, we could skip generating 1313 * the early secret. */ 1314 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl ); 1315 if( ret != 0 ) 1316 { 1317 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early_data", 1318 ret ); 1319 goto cleanup; 1320 } 1321 1322 /* Compute handshake secret */ 1323 ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl ); 1324 if( ret != 0 ) 1325 { 1326 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret ); 1327 goto cleanup; 1328 } 1329 1330 /* Next evolution in key schedule: Establish handshake secret and 1331 * key material. */ 1332 ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys ); 1333 if( ret != 0 ) 1334 { 1335 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys", 1336 ret ); 1337 goto cleanup; 1338 } 1339 1340 transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) ); 1341 if( transform_handshake == NULL ) 1342 { 1343 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; 1344 goto cleanup; 1345 } 1346 1347 ret = mbedtls_ssl_tls13_populate_transform( transform_handshake, 1348 ssl->conf->endpoint, 1349 ssl->session_negotiate->ciphersuite, 1350 &traffic_keys, 1351 ssl ); 1352 if( ret != 0 ) 1353 { 1354 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret ); 1355 goto cleanup; 1356 } 1357 1358 handshake->transform_handshake = transform_handshake; 1359 mbedtls_ssl_set_inbound_transform( ssl, transform_handshake ); 1360 1361 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) ); 1362 ssl->session_in = ssl->session_negotiate; 1363 1364 /* 1365 * State machine update 1366 */ 1367 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS ); 1368 1369 cleanup: 1370 1371 mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) ); 1372 if( ret != 0 ) 1373 { 1374 mbedtls_free( transform_handshake ); 1375 1376 MBEDTLS_SSL_PEND_FATAL_ALERT( 1377 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE, 1378 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); 1379 } 1380 return( ret ); 1381 } 1382 1383 /* 1384 * Wait and parse ServerHello handshake message. 1385 * Handler for MBEDTLS_SSL_SERVER_HELLO 1386 */ ssl_tls13_process_server_hello(mbedtls_ssl_context * ssl)1387 static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl ) 1388 { 1389 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1390 unsigned char *buf; 1391 size_t buf_len; 1392 1393 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) ); 1394 1395 /* Coordination step 1396 * - Fetch record 1397 * - Make sure it's either a ServerHello or a HRR. 1398 * - Switch processing routine in case of HRR 1399 */ 1400 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; 1401 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE; 1402 1403 ret = ssl_tls13_server_hello_coordinate( ssl, &buf, &buf_len ); 1404 /* Parsing step 1405 * We know what message to expect by now and call 1406 * the respective parsing function. 1407 */ 1408 if( ret == SSL_SERVER_HELLO_COORDINATE_HELLO ) 1409 { 1410 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf, 1411 buf + buf_len ) ); 1412 1413 mbedtls_ssl_tls13_add_hs_msg_to_checksum( ssl, 1414 MBEDTLS_SSL_HS_SERVER_HELLO, 1415 buf, buf_len ); 1416 1417 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_server_hello( ssl ) ); 1418 } 1419 else if( ret == SSL_SERVER_HELLO_COORDINATE_HRR ) 1420 { 1421 MBEDTLS_SSL_DEBUG_MSG( 1, ( "HRR not supported" ) ); 1422 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE , 1423 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); 1424 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1425 } 1426 1427 cleanup: 1428 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s", __func__ ) ); 1429 return( ret ); 1430 } 1431 1432 /* 1433 * 1434 * EncryptedExtensions message 1435 * 1436 * The EncryptedExtensions message contains any extensions which 1437 * should be protected, i.e., any which are not needed to establish 1438 * the cryptographic context. 1439 */ 1440 1441 /* 1442 * Overview 1443 */ 1444 1445 /* Main entry point; orchestrates the other functions */ 1446 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl ); 1447 1448 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl, 1449 const unsigned char *buf, 1450 const unsigned char *end ); 1451 static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl ); 1452 1453 /* 1454 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS 1455 */ ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context * ssl)1456 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl ) 1457 { 1458 int ret; 1459 unsigned char *buf; 1460 size_t buf_len; 1461 1462 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) ); 1463 1464 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl, 1465 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, 1466 &buf, &buf_len ) ); 1467 1468 /* Process the message contents */ 1469 MBEDTLS_SSL_PROC_CHK( 1470 ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) ); 1471 1472 mbedtls_ssl_tls13_add_hs_msg_to_checksum( 1473 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, buf_len ); 1474 1475 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_encrypted_extensions( ssl ) ); 1476 1477 cleanup: 1478 1479 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) ); 1480 return( ret ); 1481 1482 } 1483 1484 /* Parse EncryptedExtensions message 1485 * struct { 1486 * Extension extensions<0..2^16-1>; 1487 * } EncryptedExtensions; 1488 */ ssl_tls13_parse_encrypted_extensions(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1489 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl, 1490 const unsigned char *buf, 1491 const unsigned char *end ) 1492 { 1493 int ret = 0; 1494 size_t extensions_len; 1495 const unsigned char *p = buf; 1496 const unsigned char *extensions_end; 1497 1498 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); 1499 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 ); 1500 p += 2; 1501 1502 MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len ); 1503 extensions_end = p + extensions_len; 1504 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len ); 1505 1506 while( p < extensions_end ) 1507 { 1508 unsigned int extension_type; 1509 size_t extension_data_len; 1510 1511 /* 1512 * struct { 1513 * ExtensionType extension_type; (2 bytes) 1514 * opaque extension_data<0..2^16-1>; 1515 * } Extension; 1516 */ 1517 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 ); 1518 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 ); 1519 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 ); 1520 p += 4; 1521 1522 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len ); 1523 1524 /* The client MUST check EncryptedExtensions for the 1525 * presence of any forbidden extensions and if any are found MUST abort 1526 * the handshake with an "unsupported_extension" alert. 1527 */ 1528 switch( extension_type ) 1529 { 1530 1531 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS: 1532 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extensions supported groups" ) ); 1533 break; 1534 1535 default: 1536 MBEDTLS_SSL_DEBUG_MSG( 1537 3, ( "unsupported extension found: %u ", extension_type) ); 1538 MBEDTLS_SSL_PEND_FATAL_ALERT( 1539 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, 1540 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); 1541 return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION ); 1542 } 1543 1544 p += extension_data_len; 1545 } 1546 1547 /* Check that we consumed all the message. */ 1548 if( p != end ) 1549 { 1550 MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) ); 1551 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, 1552 MBEDTLS_ERR_SSL_DECODE_ERROR ); 1553 return( MBEDTLS_ERR_SSL_DECODE_ERROR ); 1554 } 1555 1556 return( ret ); 1557 } 1558 ssl_tls13_postprocess_encrypted_extensions(mbedtls_ssl_context * ssl)1559 static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl ) 1560 { 1561 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1562 if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) ) 1563 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED ); 1564 else 1565 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST ); 1566 #else 1567 ((void) ssl); 1568 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED ); 1569 #endif 1570 return( 0 ); 1571 } 1572 1573 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1574 /* 1575 * Handler for MBEDTLS_SSL_CERTIFICATE_REQUEST 1576 */ ssl_tls13_process_certificate_request(mbedtls_ssl_context * ssl)1577 static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl ) 1578 { 1579 int ret = mbedtls_ssl_read_record( ssl, 0 ); 1580 1581 if( ret != 0 ) 1582 { 1583 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 1584 return( ret ); 1585 } 1586 1587 if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) && 1588 ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) ) 1589 { 1590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CertificateRequest not supported" ) ); 1591 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE, 1592 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); 1593 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); 1594 } 1595 1596 ssl->keep_current_message = 1; 1597 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE ); 1598 1599 return( 0 ); 1600 } 1601 1602 /* 1603 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE 1604 */ ssl_tls13_process_server_certificate(mbedtls_ssl_context * ssl)1605 static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl ) 1606 { 1607 int ret; 1608 1609 ret = mbedtls_ssl_tls13_process_certificate( ssl ); 1610 if( ret != 0 ) 1611 return( ret ); 1612 1613 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY ); 1614 return( 0 ); 1615 } 1616 1617 /* 1618 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY 1619 */ ssl_tls13_process_certificate_verify(mbedtls_ssl_context * ssl)1620 static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl ) 1621 { 1622 int ret; 1623 1624 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl ); 1625 if( ret != 0 ) 1626 return( ret ); 1627 1628 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED ); 1629 return( 0 ); 1630 } 1631 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1632 1633 /* 1634 * Handler for MBEDTLS_SSL_SERVER_FINISHED 1635 */ ssl_tls13_process_server_finished(mbedtls_ssl_context * ssl)1636 static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl ) 1637 { 1638 int ret; 1639 1640 ret = mbedtls_ssl_tls13_process_finished_message( ssl ); 1641 if( ret != 0 ) 1642 return( ret ); 1643 1644 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) 1645 mbedtls_ssl_handshake_set_state( 1646 ssl, 1647 MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED ); 1648 #else 1649 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED ); 1650 #endif 1651 1652 return( 0 ); 1653 } 1654 1655 /* 1656 * Handler for MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED 1657 */ 1658 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context * ssl)1659 static int ssl_tls13_write_change_cipher_spec( mbedtls_ssl_context *ssl ) 1660 { 1661 int ret; 1662 1663 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl ); 1664 if( ret != 0 ) 1665 return( ret ); 1666 1667 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED ); 1668 1669 return( 0 ); 1670 } 1671 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ 1672 1673 /* 1674 * Handler for MBEDTLS_SSL_CLIENT_FINISHED 1675 */ ssl_tls13_write_client_finished(mbedtls_ssl_context * ssl)1676 static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl ) 1677 { 1678 int ret; 1679 1680 mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake ); 1681 1682 ret = mbedtls_ssl_tls13_write_finished_message( ssl ); 1683 if( ret != 0 ) 1684 return( ret ); 1685 1686 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS ); 1687 return( 0 ); 1688 } 1689 1690 /* 1691 * Handler for MBEDTLS_SSL_FLUSH_BUFFERS 1692 */ ssl_tls13_flush_buffers(mbedtls_ssl_context * ssl)1693 static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl ) 1694 { 1695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) ); 1696 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP ); 1697 return( 0 ); 1698 } 1699 1700 /* 1701 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP 1702 */ ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)1703 static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl ) 1704 { 1705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) ); 1706 mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application ); 1707 1708 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for outbound traffic" ) ); 1709 mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application ); 1710 1711 mbedtls_ssl_tls13_handshake_wrapup( ssl ); 1712 1713 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER ); 1714 return( 0 ); 1715 } 1716 mbedtls_ssl_tls13_handshake_client_step(mbedtls_ssl_context * ssl)1717 int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl ) 1718 { 1719 int ret = 0; 1720 1721 MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 client state: %s(%d)", 1722 mbedtls_ssl_states_str( ssl->state ), 1723 ssl->state ) ); 1724 1725 switch( ssl->state ) 1726 { 1727 /* 1728 * ssl->state is initialized as HELLO_REQUEST. It is the same 1729 * as CLIENT_HELLO state. 1730 */ 1731 case MBEDTLS_SSL_HELLO_REQUEST: 1732 case MBEDTLS_SSL_CLIENT_HELLO: 1733 ret = ssl_tls13_write_client_hello( ssl ); 1734 break; 1735 1736 case MBEDTLS_SSL_SERVER_HELLO: 1737 ret = ssl_tls13_process_server_hello( ssl ); 1738 break; 1739 1740 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS: 1741 ret = ssl_tls13_process_encrypted_extensions( ssl ); 1742 break; 1743 1744 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1745 case MBEDTLS_SSL_CERTIFICATE_REQUEST: 1746 ret = ssl_tls13_process_certificate_request( ssl ); 1747 break; 1748 1749 case MBEDTLS_SSL_SERVER_CERTIFICATE: 1750 ret = ssl_tls13_process_server_certificate( ssl ); 1751 break; 1752 1753 case MBEDTLS_SSL_CERTIFICATE_VERIFY: 1754 ret = ssl_tls13_process_certificate_verify( ssl ); 1755 break; 1756 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1757 1758 case MBEDTLS_SSL_SERVER_FINISHED: 1759 ret = ssl_tls13_process_server_finished( ssl ); 1760 break; 1761 1762 case MBEDTLS_SSL_CLIENT_FINISHED: 1763 ret = ssl_tls13_write_client_finished( ssl ); 1764 break; 1765 1766 case MBEDTLS_SSL_FLUSH_BUFFERS: 1767 ret = ssl_tls13_flush_buffers( ssl ); 1768 break; 1769 1770 case MBEDTLS_SSL_HANDSHAKE_WRAPUP: 1771 ret = ssl_tls13_handshake_wrapup( ssl ); 1772 break; 1773 1774 /* 1775 * Injection of dummy-CCS's for middlebox compatibility 1776 */ 1777 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) 1778 case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED: 1779 ret = ssl_tls13_write_change_cipher_spec( ssl ); 1780 break; 1781 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ 1782 1783 default: 1784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) ); 1785 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 1786 } 1787 1788 return( ret ); 1789 } 1790 1791 #endif /* MBEDTLS_SSL_CLI_C */ 1792 1793 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ 1794