1 /*
2 * TLS 1.3 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS ( https://tls.mbed.org )
20 */
21
22 #include "common.h"
23
24 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
25
26 #if defined(MBEDTLS_SSL_CLI_C)
27
28 #include <string.h>
29
30 #include "mbedtls/debug.h"
31 #include "mbedtls/error.h"
32 #include "mbedtls/platform.h"
33
34 #include "ssl_misc.h"
35 #include "ecdh_misc.h"
36 #include "ssl_tls13_keys.h"
37 #include "ssl_debug_helpers_generated.h"
38
39 /* Write extensions */
40
41 /*
42 * ssl_tls13_write_supported_versions_ext():
43 *
44 * struct {
45 * ProtocolVersion versions<2..254>;
46 * } SupportedVersions;
47 */
ssl_tls13_write_supported_versions_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)48 static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl,
49 unsigned char *buf,
50 unsigned char *end,
51 size_t *out_len )
52 {
53 unsigned char *p = buf;
54
55 *out_len = 0;
56
57 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) );
58
59 /* Check if we have space to write the extension:
60 * - extension_type (2 bytes)
61 * - extension_data_length (2 bytes)
62 * - versions_length (1 byte )
63 * - versions (2 bytes)
64 */
65 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
66
67 /* Write extension_type */
68 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
69
70 /* Write extension_data_length */
71 MBEDTLS_PUT_UINT16_BE( 3, p, 2 );
72 p += 4;
73
74 /* Length of versions */
75 *p++ = 0x2;
76
77 /* Write values of supported versions.
78 *
79 * They are defined by the configuration.
80 *
81 * Currently, only one version is advertised.
82 */
83 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
84 ssl->conf->max_minor_ver,
85 ssl->conf->transport, p );
86
87 MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]",
88 ssl->conf->max_major_ver,
89 ssl->conf->max_minor_ver ) );
90
91 *out_len = 7;
92
93 return( 0 );
94 }
95
ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)96 static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
97 const unsigned char *buf,
98 const unsigned char *end )
99 {
100 ((void) ssl);
101
102 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2);
103 if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 ||
104 buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 )
105 {
106 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) );
107
108 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
109 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
110 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
111 }
112
113 return( 0 );
114 }
115
116 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
117
118 /*
119 * Functions for writing supported_groups extension.
120 *
121 * Stucture of supported_groups:
122 * enum {
123 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
124 * x25519(0x001D), x448(0x001E),
125 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
126 * ffdhe6144(0x0103), ffdhe8192(0x0104),
127 * ffdhe_private_use(0x01FC..0x01FF),
128 * ecdhe_private_use(0xFE00..0xFEFF),
129 * (0xFFFF)
130 * } NamedGroup;
131 * struct {
132 * NamedGroup named_group_list<2..2^16-1>;
133 * } NamedGroupList;
134 */
135 #if defined(MBEDTLS_ECDH_C)
136 /*
137 * In versions of TLS prior to TLS 1.3, this extension was named
138 * 'elliptic_curves' and only contained elliptic curve groups.
139 */
ssl_tls13_write_named_group_list_ecdhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)140 static int ssl_tls13_write_named_group_list_ecdhe( mbedtls_ssl_context *ssl,
141 unsigned char *buf,
142 unsigned char *end,
143 size_t *out_len )
144 {
145 unsigned char *p = buf;
146
147 *out_len = 0;
148
149 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
150
151 if( group_list == NULL )
152 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
153
154 for ( ; *group_list != 0; group_list++ )
155 {
156 const mbedtls_ecp_curve_info *curve_info;
157 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
158 if( curve_info == NULL )
159 continue;
160
161 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
162 continue;
163
164 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2);
165 MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
166 p += 2;
167
168 MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
169 curve_info->name, *group_list ) );
170 }
171
172 *out_len = p - buf;
173
174 return( 0 );
175 }
176 #else
ssl_tls13_write_named_group_list_ecdhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)177 static int ssl_tls13_write_named_group_list_ecdhe( mbedtls_ssl_context *ssl,
178 unsigned char *buf,
179 unsigned char *end,
180 size_t *out_len )
181 {
182 ((void) ssl);
183 ((void) buf);
184 ((void) end);
185 *out_len = 0;
186 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
187 }
188 #endif /* MBEDTLS_ECDH_C */
189
ssl_tls13_write_named_group_list_dhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)190 static int ssl_tls13_write_named_group_list_dhe( mbedtls_ssl_context *ssl,
191 unsigned char *buf,
192 unsigned char *end,
193 size_t *out_len )
194 {
195 ((void) ssl);
196 ((void) buf);
197 ((void) end);
198 *out_len = 0;
199 MBEDTLS_SSL_DEBUG_MSG( 3, ( "write_named_group_dhe is not implemented" ) );
200 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
201 }
202
ssl_tls13_write_supported_groups_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)203 static int ssl_tls13_write_supported_groups_ext( mbedtls_ssl_context *ssl,
204 unsigned char *buf,
205 unsigned char *end,
206 size_t *out_len )
207 {
208 unsigned char *p = buf ;
209 unsigned char *named_group_list; /* Start of named_group_list */
210 size_t named_group_list_len; /* Length of named_group_list */
211 size_t output_len = 0;
212 int ret_ecdhe, ret_dhe;
213
214 *out_len = 0;
215
216 if( !mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
217 return( 0 );
218
219 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) );
220
221 /* Check if we have space for header and length fields:
222 * - extension_type (2 bytes)
223 * - extension_data_length (2 bytes)
224 * - named_group_list_length (2 bytes)
225 */
226 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
227 p += 6;
228
229 named_group_list = p;
230 ret_ecdhe = ssl_tls13_write_named_group_list_ecdhe( ssl, p, end, &output_len );
231 if( ret_ecdhe != 0 )
232 {
233 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_named_group_list_ecdhe", ret_ecdhe );
234 }
235 p += output_len;
236
237 ret_dhe = ssl_tls13_write_named_group_list_dhe( ssl, p, end, &output_len );
238 if( ret_dhe != 0 )
239 {
240 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_named_group_list_dhe", ret_dhe );
241 }
242 p += output_len;
243
244 /* Both ECDHE and DHE failed. */
245 if( ret_ecdhe != 0 && ret_dhe != 0 )
246 {
247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Both ECDHE and DHE groups are fail. " ) );
248 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
249 }
250
251 /* Length of named_group_list*/
252 named_group_list_len = p - named_group_list;
253 if( named_group_list_len == 0 )
254 {
255 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) );
256 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
257 }
258
259 /* Write extension_type */
260 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 );
261 /* Write extension_data_length */
262 MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 );
263 /* Write length of named_group_list */
264 MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 );
265
266 MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension", buf + 4, named_group_list_len + 2 );
267
268 *out_len = p - buf;
269
270 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
271
272 return( 0 );
273 }
274
275 /*
276 * Functions for writing key_share extension.
277 */
278 #if defined(MBEDTLS_ECDH_C)
ssl_tls13_generate_and_write_ecdh_key_exchange(mbedtls_ssl_context * ssl,uint16_t named_group,unsigned char * buf,unsigned char * end,size_t * out_len)279 static int ssl_tls13_generate_and_write_ecdh_key_exchange(
280 mbedtls_ssl_context *ssl,
281 uint16_t named_group,
282 unsigned char *buf,
283 unsigned char *end,
284 size_t *out_len )
285 {
286 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
287 const mbedtls_ecp_curve_info *curve_info =
288 mbedtls_ecp_curve_info_from_tls_id( named_group );
289
290 if( curve_info == NULL )
291 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
292
293 MBEDTLS_SSL_DEBUG_MSG( 3, ( "offer curve %s", curve_info->name ) );
294
295 if( ( ret = mbedtls_ecdh_setup_no_everest( &ssl->handshake->ecdh_ctx,
296 curve_info->grp_id ) ) != 0 )
297 {
298 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_setup_no_everest", ret );
299 return( ret );
300 }
301
302 ret = mbedtls_ecdh_tls13_make_params( &ssl->handshake->ecdh_ctx, out_len,
303 buf, end - buf,
304 ssl->conf->f_rng, ssl->conf->p_rng );
305 if( ret != 0 )
306 {
307 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_tls13_make_params", ret );
308 return( ret );
309 }
310
311 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
312 MBEDTLS_DEBUG_ECDH_Q );
313 return( 0 );
314 }
315 #endif /* MBEDTLS_ECDH_C */
316
ssl_tls13_get_default_group_id(mbedtls_ssl_context * ssl,uint16_t * group_id)317 static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl,
318 uint16_t *group_id )
319 {
320 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
321
322
323 #if defined(MBEDTLS_ECDH_C)
324 const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
325 /* Pick first available ECDHE group compatible with TLS 1.3 */
326 if( group_list == NULL )
327 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
328
329 for ( ; *group_list != 0; group_list++ )
330 {
331 const mbedtls_ecp_curve_info *curve_info;
332 curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
333 if( curve_info != NULL &&
334 mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
335 {
336 *group_id = *group_list;
337 return( 0 );
338 }
339 }
340 #else
341 ((void) ssl);
342 ((void) group_id);
343 #endif /* MBEDTLS_ECDH_C */
344
345 /*
346 * Add DHE named groups here.
347 * Pick first available DHE group compatible with TLS 1.3
348 */
349
350 return( ret );
351 }
352
353 /*
354 * ssl_tls13_write_key_share_ext
355 *
356 * Structure of key_share extension in ClientHello:
357 *
358 * struct {
359 * NamedGroup group;
360 * opaque key_exchange<1..2^16-1>;
361 * } KeyShareEntry;
362 * struct {
363 * KeyShareEntry client_shares<0..2^16-1>;
364 * } KeyShareClientHello;
365 */
ssl_tls13_write_key_share_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)366 static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
367 unsigned char *buf,
368 unsigned char *end,
369 size_t *out_len )
370 {
371 unsigned char *p = buf;
372 unsigned char *client_shares; /* Start of client_shares */
373 size_t client_shares_len; /* Length of client_shares */
374 uint16_t group_id;
375 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
376
377 *out_len = 0;
378
379 if( !mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
380 return( 0 );
381
382 /* Check if we have space for header and length fields:
383 * - extension_type (2 bytes)
384 * - extension_data_length (2 bytes)
385 * - client_shares_length (2 bytes)
386 */
387 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
388 p += 6;
389
390 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) );
391
392 /* HRR could already have requested something else. */
393 group_id = ssl->handshake->offered_group_id;
394 if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) &&
395 !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) )
396 {
397 MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl,
398 &group_id ) );
399 }
400
401 /*
402 * Dispatch to type-specific key generation function.
403 *
404 * So far, we're only supporting ECDHE. With the introduction
405 * of PQC KEMs, we'll want to have multiple branches, one per
406 * type of KEM, and dispatch to the corresponding crypto. And
407 * only one key share entry is allowed.
408 */
409 client_shares = p;
410 #if defined(MBEDTLS_ECDH_C)
411 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
412 {
413 /* Pointer to group */
414 unsigned char *group = p;
415 /* Length of key_exchange */
416 size_t key_exchange_len;
417
418 /* Check there is space for header of KeyShareEntry
419 * - group (2 bytes)
420 * - key_exchange_length (2 bytes)
421 */
422 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
423 p += 4;
424 ret = ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, group_id,
425 p, end,
426 &key_exchange_len );
427 p += key_exchange_len;
428 if( ret != 0 )
429 return( ret );
430
431 /* Write group */
432 MBEDTLS_PUT_UINT16_BE( group_id, group, 0 );
433 /* Write key_exchange_length */
434 MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 );
435 }
436 else
437 #endif /* MBEDTLS_ECDH_C */
438 if( 0 /* other KEMs? */ )
439 {
440 /* Do something */
441 }
442 else
443 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
444
445 /* Length of client_shares */
446 client_shares_len = p - client_shares;
447 if( client_shares_len == 0)
448 {
449 MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) );
450 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
451 }
452 /* Write extension_type */
453 MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
454 /* Write extension_data_length */
455 MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 );
456 /* Write client_shares_length */
457 MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 );
458
459 /* Update offered_group_id field */
460 ssl->handshake->offered_group_id = group_id;
461
462 /* Output the total length of key_share extension. */
463 *out_len = p - buf;
464
465 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len );
466
467 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
468
469 cleanup:
470
471 return( ret );
472 }
473
474 #if defined(MBEDTLS_ECDH_C)
475
ssl_tls13_check_ecdh_params(const mbedtls_ssl_context * ssl)476 static int ssl_tls13_check_ecdh_params( const mbedtls_ssl_context *ssl )
477 {
478 const mbedtls_ecp_curve_info *curve_info;
479 mbedtls_ecp_group_id grp_id;
480 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
481 grp_id = ssl->handshake->ecdh_ctx.grp.id;
482 #else
483 grp_id = ssl->handshake->ecdh_ctx.grp_id;
484 #endif
485
486 curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
487 if( curve_info == NULL )
488 {
489 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
490 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
491 }
492
493 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
494
495 if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
496 return( -1 );
497
498 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
499 MBEDTLS_DEBUG_ECDH_QP );
500
501 return( 0 );
502 }
503
ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t buf_len)504 static int ssl_tls13_read_public_ecdhe_share( mbedtls_ssl_context *ssl,
505 const unsigned char *buf,
506 size_t buf_len )
507 {
508 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
509
510 ret = mbedtls_ecdh_tls13_read_public( &ssl->handshake->ecdh_ctx,
511 buf, buf_len );
512 if( ret != 0 )
513 {
514 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_tls13_read_public" ), ret );
515
516 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
517 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
518 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
519 }
520
521 if( ssl_tls13_check_ecdh_params( ssl ) != 0 )
522 {
523 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ssl_tls13_check_ecdh_params() failed!" ) );
524
525 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
526 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
527 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
528 }
529
530 return( 0 );
531 }
532 #endif /* MBEDTLS_ECDH_C */
533
534 /*
535 * ssl_tls13_parse_key_share_ext()
536 * Parse key_share extension in Server Hello
537 *
538 * struct {
539 * KeyShareEntry server_share;
540 * } KeyShareServerHello;
541 * struct {
542 * NamedGroup group;
543 * opaque key_exchange<1..2^16-1>;
544 * } KeyShareEntry;
545 */
ssl_tls13_parse_key_share_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)546 static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl,
547 const unsigned char *buf,
548 const unsigned char *end )
549 {
550 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
551 const unsigned char *p = buf;
552 uint16_t group, offered_group;
553
554 /* ...
555 * NamedGroup group; (2 bytes)
556 * ...
557 */
558 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
559 group = MBEDTLS_GET_UINT16_BE( p, 0 );
560 p += 2;
561
562 /* Check that the chosen group matches the one we offered. */
563 offered_group = ssl->handshake->offered_group_id;
564 if( offered_group != group )
565 {
566 MBEDTLS_SSL_DEBUG_MSG( 1,
567 ( "Invalid server key share, our group %u, their group %u",
568 (unsigned) offered_group, (unsigned) group ) );
569 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
570 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
571 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
572 }
573
574 #if defined(MBEDTLS_ECDH_C)
575 if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
576 {
577 /* Complete ECDHE key agreement */
578 ret = ssl_tls13_read_public_ecdhe_share( ssl, p, end - p );
579 if( ret != 0 )
580 return( ret );
581 }
582 else
583 #endif /* MBEDTLS_ECDH_C */
584 if( 0 /* other KEMs? */ )
585 {
586 /* Do something */
587 }
588 else
589 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
590
591 ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
592 return( ret );
593 }
594
595 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
596
597 /* Write cipher_suites
598 * CipherSuite cipher_suites<2..2^16-2>;
599 */
ssl_tls13_write_client_hello_cipher_suites(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)600 static int ssl_tls13_write_client_hello_cipher_suites(
601 mbedtls_ssl_context *ssl,
602 unsigned char *buf,
603 unsigned char *end,
604 size_t *out_len )
605 {
606 unsigned char *p = buf;
607 const int *ciphersuite_list;
608 unsigned char *cipher_suites; /* Start of the cipher_suites list */
609 size_t cipher_suites_len;
610
611 *out_len = 0 ;
612
613 /*
614 * Ciphersuite list
615 *
616 * This is a list of the symmetric cipher options supported by
617 * the client, specifically the record protection algorithm
618 * ( including secret key length ) and a hash to be used with
619 * HKDF, in descending order of client preference.
620 */
621 ciphersuite_list = ssl->conf->ciphersuite_list;
622
623 /* Check there is space for the cipher suite list length (2 bytes). */
624 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
625 p += 2;
626
627 /* Write cipher_suites */
628 cipher_suites = p;
629 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
630 {
631 int cipher_suite = ciphersuite_list[i];
632 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
633
634 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
635 if( ciphersuite_info == NULL )
636 continue;
637 if( !( MBEDTLS_SSL_MINOR_VERSION_4 >= ciphersuite_info->min_minor_ver &&
638 MBEDTLS_SSL_MINOR_VERSION_4 <= ciphersuite_info->max_minor_ver ) )
639 continue;
640
641 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
642 (unsigned int) cipher_suite,
643 ciphersuite_info->name ) );
644
645 /* Check there is space for the cipher suite identifier (2 bytes). */
646 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
647 MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
648 p += 2;
649 }
650
651 /* Write the cipher_suites length in number of bytes */
652 cipher_suites_len = p - cipher_suites;
653 MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
654 MBEDTLS_SSL_DEBUG_MSG( 3,
655 ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
656 cipher_suites_len/2 ) );
657
658 /* Output the total length of cipher_suites field. */
659 *out_len = p - buf;
660
661 return( 0 );
662 }
663
664 /*
665 * Structure of ClientHello message:
666 *
667 * struct {
668 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
669 * Random random;
670 * opaque legacy_session_id<0..32>;
671 * CipherSuite cipher_suites<2..2^16-2>;
672 * opaque legacy_compression_methods<1..2^8-1>;
673 * Extension extensions<8..2^16-1>;
674 * } ClientHello;
675 */
ssl_tls13_write_client_hello_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)676 static int ssl_tls13_write_client_hello_body( mbedtls_ssl_context *ssl,
677 unsigned char *buf,
678 unsigned char *end,
679 size_t *out_len )
680 {
681
682 int ret;
683 unsigned char *p_extensions_len; /* Pointer to extensions length */
684 size_t output_len; /* Length of buffer used by function */
685 size_t extensions_len; /* Length of the list of extensions*/
686
687 /* Buffer management */
688 unsigned char *p = buf;
689
690 *out_len = 0;
691
692 /* No validation needed here. It has been done by ssl_conf_check() */
693 ssl->major_ver = ssl->conf->min_major_ver;
694 ssl->minor_ver = ssl->conf->min_minor_ver;
695
696 /*
697 * Write legacy_version
698 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
699 *
700 * For TLS 1.3 we use the legacy version number {0x03, 0x03}
701 * instead of the true version number.
702 */
703 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
704 MBEDTLS_PUT_UINT16_BE( 0x0303, p, 0 );
705 p += 2;
706
707 /* Write the random bytes ( random ).*/
708 MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
709 memcpy( p, ssl->handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
710 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
711 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
712 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
713
714 /*
715 * Write legacy_session_id
716 *
717 * Versions of TLS before TLS 1.3 supported a "session resumption" feature
718 * which has been merged with pre-shared keys in this version. A client
719 * which has a cached session ID set by a pre-TLS 1.3 server SHOULD set
720 * this field to that value. In compatibility mode, this field MUST be
721 * non-empty, so a client not offering a pre-TLS 1.3 session MUST generate
722 * a new 32-byte value. This value need not be random but SHOULD be
723 * unpredictable to avoid implementations fixating on a specific value
724 * ( also known as ossification ). Otherwise, it MUST be set as a zero-length
725 * vector ( i.e., a zero-valued single byte length field ).
726 */
727 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
728 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
729 *p++ = (unsigned char)ssl->session_negotiate->id_len;
730 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
731 p += ssl->session_negotiate->id_len;
732
733 MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
734 ssl->session_negotiate->id_len );
735 #else
736 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
737 *p++ = 0; /* session id length set to zero */
738 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
739
740 /* Write cipher_suites */
741 ret = ssl_tls13_write_client_hello_cipher_suites( ssl, p, end, &output_len );
742 if( ret != 0 )
743 return( ret );
744 p += output_len;
745
746 /* Write legacy_compression_methods
747 *
748 * For every TLS 1.3 ClientHello, this vector MUST contain exactly
749 * one byte set to zero, which corresponds to the 'null' compression
750 * method in prior versions of TLS.
751 */
752 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
753 *p++ = 1;
754 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
755
756 /* Write extensions */
757
758 /* Keeping track of the included extensions */
759 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
760
761 /* First write extensions, then the total length */
762 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
763 p_extensions_len = p;
764 p += 2;
765
766 /* Write supported_versions extension
767 *
768 * Supported Versions Extension is mandatory with TLS 1.3.
769 */
770 ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &output_len );
771 if( ret != 0 )
772 return( ret );
773 p += output_len;
774
775 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
776 /* Write supported_groups extension
777 *
778 * It is REQUIRED for ECDHE cipher_suites.
779 */
780 ret = ssl_tls13_write_supported_groups_ext( ssl, p, end, &output_len );
781 if( ret != 0 )
782 return( ret );
783 p += output_len;
784
785 /* Write key_share extension
786 *
787 * We need to send the key shares under three conditions:
788 * 1) A certificate-based ciphersuite is being offered. In this case
789 * supported_groups and supported_signature extensions have been
790 * successfully added.
791 * 2) A PSK-based ciphersuite with ECDHE is offered. In this case the
792 * psk_key_exchange_modes has been added as the last extension.
793 * 3) Or, in case all ciphers are supported ( which includes #1 and #2
794 * from above )
795 */
796 ret = ssl_tls13_write_key_share_ext( ssl, p, end, &output_len );
797 if( ret != 0 )
798 return( ret );
799 p += output_len;
800
801 /* Write signature_algorithms extension
802 *
803 * It is REQUIRED for certificate authenticated cipher_suites.
804 */
805 ret = mbedtls_ssl_tls13_write_sig_alg_ext( ssl, p, end, &output_len );
806 if( ret != 0 )
807 return( ret );
808 p += output_len;
809
810 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
811
812 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
813 /* Write server name extension */
814 ret = mbedtls_ssl_write_hostname_ext( ssl, p, end, &output_len );
815 if( ret != 0 )
816 return( ret );
817 p += output_len;
818 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
819
820 /* Add more extensions here */
821
822 /* Write the length of the list of extensions. */
823 extensions_len = p - p_extensions_len - 2;
824 MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
825 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" MBEDTLS_PRINTF_SIZET ,
826 extensions_len ) );
827 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p_extensions_len, extensions_len );
828
829 *out_len = p - buf;
830 return( 0 );
831 }
832
ssl_tls13_finalize_client_hello(mbedtls_ssl_context * ssl)833 static int ssl_tls13_finalize_client_hello( mbedtls_ssl_context *ssl )
834 {
835 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
836 return( 0 );
837 }
838
ssl_tls13_prepare_client_hello(mbedtls_ssl_context * ssl)839 static int ssl_tls13_prepare_client_hello( mbedtls_ssl_context *ssl )
840 {
841 int ret;
842
843 if( ssl->conf->f_rng == NULL )
844 {
845 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
846 return( MBEDTLS_ERR_SSL_NO_RNG );
847 }
848
849 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
850 ssl->handshake->randbytes,
851 MBEDTLS_CLIENT_HELLO_RANDOM_LEN ) ) != 0 )
852 {
853 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
854 return( ret );
855 }
856
857 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
858 /*
859 * Create a session identifier for the purpose of middlebox compatibility
860 * only if one has not been created already.
861 */
862 if( ssl->session_negotiate->id_len == 0 )
863 {
864 /* Creating a session id with 32 byte length */
865 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
866 ssl->session_negotiate->id, 32 ) ) != 0 )
867 {
868 MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
869 return( ret );
870 }
871 ssl->session_negotiate->id_len = 32;
872 }
873 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
874
875 return( 0 );
876 }
877
878 /*
879 * Write ClientHello handshake message.
880 * Handler for MBEDTLS_SSL_CLIENT_HELLO
881 */
ssl_tls13_write_client_hello(mbedtls_ssl_context * ssl)882 static int ssl_tls13_write_client_hello( mbedtls_ssl_context *ssl )
883 {
884 int ret = 0;
885 unsigned char *buf;
886 size_t buf_len, msg_len;
887
888 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
889
890 MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_client_hello( ssl ) );
891
892 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_start_handshake_msg(
893 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
894 &buf, &buf_len ) );
895
896 MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_client_hello_body( ssl, buf,
897 buf + buf_len,
898 &msg_len ) );
899
900 mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl,
901 MBEDTLS_SSL_HS_CLIENT_HELLO,
902 msg_len );
903 ssl->handshake->update_checksum( ssl, buf, msg_len );
904
905 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_client_hello( ssl ) );
906 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_finish_handshake_msg( ssl,
907 buf_len,
908 msg_len ) );
909
910 cleanup:
911
912 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
913 return ret;
914 }
915
916 /*
917 * Functions for parsing and processing Server Hello
918 */
919 /* Returns a negative value on failure, and otherwise
920 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
921 * - SSL_SERVER_HELLO_COORDINATE_HRR
922 * to indicate which message is expected and to be parsed next. */
923 #define SSL_SERVER_HELLO_COORDINATE_HELLO 0
924 #define SSL_SERVER_HELLO_COORDINATE_HRR 1
ssl_server_hello_is_hrr(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)925 static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl,
926 const unsigned char *buf,
927 const unsigned char *end )
928 {
929 static const unsigned char magic_hrr_string[MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
930 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
931 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
932 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
933 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33 ,0x9C };
934
935 /* Check whether this message is a HelloRetryRequest ( HRR ) message.
936 *
937 * Server Hello and HRR are only distinguished by Random set to the
938 * special value of the SHA-256 of "HelloRetryRequest".
939 *
940 * struct {
941 * ProtocolVersion legacy_version = 0x0303;
942 * Random random;
943 * opaque legacy_session_id_echo<0..32>;
944 * CipherSuite cipher_suite;
945 * uint8 legacy_compression_method = 0;
946 * Extension extensions<6..2^16-1>;
947 * } ServerHello;
948 *
949 */
950 MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 + sizeof( magic_hrr_string ) );
951
952 if( memcmp( buf + 2, magic_hrr_string, sizeof( magic_hrr_string ) ) == 0 )
953 {
954 return( SSL_SERVER_HELLO_COORDINATE_HRR );
955 }
956
957 return( SSL_SERVER_HELLO_COORDINATE_HELLO );
958 }
959
960 /* Fetch and preprocess
961 * Returns a negative value on failure, and otherwise
962 * - SSL_SERVER_HELLO_COORDINATE_HELLO or
963 * - SSL_SERVER_HELLO_COORDINATE_HRR
964 */
ssl_tls13_server_hello_coordinate(mbedtls_ssl_context * ssl,unsigned char ** buf,size_t * buf_len)965 static int ssl_tls13_server_hello_coordinate( mbedtls_ssl_context *ssl,
966 unsigned char **buf,
967 size_t *buf_len )
968 {
969 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
970
971 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_read_record( ssl, 0 ) );
972
973 if( ( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) ||
974 ( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO ) )
975 {
976 MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected message" ) );
977
978 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
979 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
980 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
981 }
982
983 *buf = ssl->in_msg + 4;
984 *buf_len = ssl->in_hslen - 4;
985
986 ret = ssl_server_hello_is_hrr( ssl, *buf, *buf + *buf_len );
987 switch( ret )
988 {
989 case SSL_SERVER_HELLO_COORDINATE_HELLO:
990 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) );
991 break;
992 case SSL_SERVER_HELLO_COORDINATE_HRR:
993 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) );
994 break;
995 }
996
997 cleanup:
998
999 return( ret );
1000 }
1001
ssl_tls13_check_server_hello_session_id_echo(mbedtls_ssl_context * ssl,const unsigned char ** buf,const unsigned char * end)1002 static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl,
1003 const unsigned char **buf,
1004 const unsigned char *end )
1005 {
1006 const unsigned char *p = *buf;
1007 size_t legacy_session_id_echo_len;
1008
1009 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1010 legacy_session_id_echo_len = *p++ ;
1011
1012 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len );
1013
1014 /* legacy_session_id_echo */
1015 if( ssl->session_negotiate->id_len != legacy_session_id_echo_len ||
1016 memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 )
1017 {
1018 MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID",
1019 ssl->session_negotiate->id,
1020 ssl->session_negotiate->id_len );
1021 MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p,
1022 legacy_session_id_echo_len );
1023
1024 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1025 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1026
1027 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1028 }
1029
1030 p += legacy_session_id_echo_len;
1031 *buf = p;
1032
1033 MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id,
1034 ssl->session_negotiate->id_len );
1035 return( 0 );
1036 }
1037
ssl_tls13_cipher_suite_is_offered(mbedtls_ssl_context * ssl,int cipher_suite)1038 static int ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl,
1039 int cipher_suite )
1040 {
1041 const int *ciphersuite_list = ssl->conf->ciphersuite_list;
1042
1043 /* Check whether we have offered this ciphersuite */
1044 for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
1045 {
1046 if( ciphersuite_list[i] == cipher_suite )
1047 {
1048 return( 1 );
1049 }
1050 }
1051 return( 0 );
1052 }
1053
1054 /* Parse ServerHello message and configure context
1055 *
1056 * struct {
1057 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1058 * Random random;
1059 * opaque legacy_session_id_echo<0..32>;
1060 * CipherSuite cipher_suite;
1061 * uint8 legacy_compression_method = 0;
1062 * Extension extensions<6..2^16-1>;
1063 * } ServerHello;
1064 */
ssl_tls13_parse_server_hello(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1065 static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl,
1066 const unsigned char *buf,
1067 const unsigned char *end )
1068 {
1069 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1070 const unsigned char *p = buf;
1071 size_t extensions_len;
1072 const unsigned char *extensions_end;
1073 uint16_t cipher_suite;
1074 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
1075
1076 /*
1077 * Check there is space for minimal fields
1078 *
1079 * - legacy_version ( 2 bytes)
1080 * - random (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes)
1081 * - legacy_session_id_echo ( 1 byte ), minimum size
1082 * - cipher_suite ( 2 bytes)
1083 * - legacy_compression_method ( 1 byte )
1084 */
1085 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 );
1086
1087 MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p );
1088 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 );
1089
1090 /* ...
1091 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1092 * ...
1093 * with ProtocolVersion defined as:
1094 * uint16 ProtocolVersion;
1095 */
1096 if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 &&
1097 p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) )
1098 {
1099 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
1100 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1101 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
1102 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
1103 }
1104 p += 2;
1105
1106 /* ...
1107 * Random random;
1108 * ...
1109 * with Random defined as:
1110 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
1111 */
1112 memcpy( &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p,
1113 MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1114 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
1115 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1116 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
1117
1118 /* ...
1119 * opaque legacy_session_id_echo<0..32>;
1120 * ...
1121 */
1122 if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 )
1123 {
1124 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1125 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1126 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1127 }
1128
1129 /* ...
1130 * CipherSuite cipher_suite;
1131 * ...
1132 * with CipherSuite defined as:
1133 * uint8 CipherSuite[2];
1134 */
1135 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1136 cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
1137 p += 2;
1138
1139
1140 /*
1141 * Check whether this ciphersuite is supported and offered.
1142 * Via the force_ciphersuite version we may have instructed the client
1143 * to use a different ciphersuite.
1144 */
1145 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
1146 if( ciphersuite_info == NULL ||
1147 ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) == 0 )
1148 {
1149 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite(%04x) not found or not offered",
1150 cipher_suite ) );
1151
1152 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1153 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1154 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1155 }
1156
1157
1158 /* Configure ciphersuites */
1159 mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info );
1160
1161 ssl->handshake->ciphersuite_info = ciphersuite_info;
1162 ssl->session_negotiate->ciphersuite = cipher_suite;
1163
1164 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s",
1165 cipher_suite, ciphersuite_info->name ) );
1166
1167 #if defined(MBEDTLS_HAVE_TIME)
1168 ssl->session_negotiate->start = time( NULL );
1169 #endif /* MBEDTLS_HAVE_TIME */
1170
1171 /* ...
1172 * uint8 legacy_compression_method = 0;
1173 * ...
1174 */
1175 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1176 if( p[0] != 0 )
1177 {
1178 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
1179 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1180 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1181 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1182 }
1183 p++;
1184
1185 /* ...
1186 * Extension extensions<6..2^16-1>;
1187 * ...
1188 * struct {
1189 * ExtensionType extension_type; (2 bytes)
1190 * opaque extension_data<0..2^16-1>;
1191 * } Extension;
1192 */
1193 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1194 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1195 p += 2;
1196
1197 /* Check extensions do not go beyond the buffer of data. */
1198 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1199 extensions_end = p + extensions_len;
1200
1201 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len );
1202
1203 while( p < extensions_end )
1204 {
1205 unsigned int extension_type;
1206 size_t extension_data_len;
1207
1208 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1209 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1210 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1211 p += 4;
1212
1213 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1214
1215 switch( extension_type )
1216 {
1217 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
1218 MBEDTLS_SSL_DEBUG_MSG( 3,
1219 ( "found supported_versions extension" ) );
1220
1221 ret = ssl_tls13_parse_supported_versions_ext( ssl,
1222 p,
1223 p + extension_data_len );
1224 if( ret != 0 )
1225 return( ret );
1226 break;
1227
1228 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1229 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) );
1230 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) );
1231
1232 MBEDTLS_SSL_PEND_FATAL_ALERT(
1233 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1234 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1235 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1236
1237 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1238 case MBEDTLS_TLS_EXT_KEY_SHARE:
1239 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
1240 if( ( ret = ssl_tls13_parse_key_share_ext( ssl,
1241 p, p + extension_data_len ) ) != 0 )
1242 {
1243 MBEDTLS_SSL_DEBUG_RET( 1,
1244 "ssl_tls13_parse_key_share_ext",
1245 ret );
1246 return( ret );
1247 }
1248 break;
1249 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1250
1251 default:
1252 MBEDTLS_SSL_DEBUG_MSG(
1253 3,
1254 ( "unknown extension found: %u ( ignoring )",
1255 extension_type ) );
1256
1257 MBEDTLS_SSL_PEND_FATAL_ALERT(
1258 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1259 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1260 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1261 }
1262
1263 p += extension_data_len;
1264 }
1265
1266 return( 0 );
1267 }
1268
ssl_tls13_finalize_server_hello(mbedtls_ssl_context * ssl)1269 static int ssl_tls13_finalize_server_hello( mbedtls_ssl_context *ssl )
1270 {
1271 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1272 mbedtls_ssl_key_set traffic_keys;
1273 mbedtls_ssl_transform *transform_handshake = NULL;
1274 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1275
1276 /* Determine the key exchange mode:
1277 * 1) If both the pre_shared_key and key_share extensions were received
1278 * then the key exchange mode is PSK with EPHEMERAL.
1279 * 2) If only the pre_shared_key extension was received then the key
1280 * exchange mode is PSK-only.
1281 * 3) If only the key_share extension was received then the key
1282 * exchange mode is EPHEMERAL-only.
1283 */
1284 switch( handshake->extensions_present &
1285 ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ) )
1286 {
1287 /* Only the pre_shared_key extension was received */
1288 case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
1289 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
1290 break;
1291
1292 /* Only the key_share extension was received */
1293 case MBEDTLS_SSL_EXT_KEY_SHARE:
1294 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
1295 break;
1296
1297 /* Both the pre_shared_key and key_share extensions were received */
1298 case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
1299 handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
1300 break;
1301
1302 /* Neither pre_shared_key nor key_share extension was received */
1303 default:
1304 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) );
1305 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1306 goto cleanup;
1307 }
1308
1309 /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
1310 *
1311 * TODO: We don't have to do this in case we offered 0-RTT and the
1312 * server accepted it. In this case, we could skip generating
1313 * the early secret. */
1314 ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
1315 if( ret != 0 )
1316 {
1317 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early_data",
1318 ret );
1319 goto cleanup;
1320 }
1321
1322 /* Compute handshake secret */
1323 ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl );
1324 if( ret != 0 )
1325 {
1326 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret );
1327 goto cleanup;
1328 }
1329
1330 /* Next evolution in key schedule: Establish handshake secret and
1331 * key material. */
1332 ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys );
1333 if( ret != 0 )
1334 {
1335 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys",
1336 ret );
1337 goto cleanup;
1338 }
1339
1340 transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) );
1341 if( transform_handshake == NULL )
1342 {
1343 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
1344 goto cleanup;
1345 }
1346
1347 ret = mbedtls_ssl_tls13_populate_transform( transform_handshake,
1348 ssl->conf->endpoint,
1349 ssl->session_negotiate->ciphersuite,
1350 &traffic_keys,
1351 ssl );
1352 if( ret != 0 )
1353 {
1354 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret );
1355 goto cleanup;
1356 }
1357
1358 handshake->transform_handshake = transform_handshake;
1359 mbedtls_ssl_set_inbound_transform( ssl, transform_handshake );
1360
1361 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
1362 ssl->session_in = ssl->session_negotiate;
1363
1364 /*
1365 * State machine update
1366 */
1367 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
1368
1369 cleanup:
1370
1371 mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) );
1372 if( ret != 0 )
1373 {
1374 mbedtls_free( transform_handshake );
1375
1376 MBEDTLS_SSL_PEND_FATAL_ALERT(
1377 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1378 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1379 }
1380 return( ret );
1381 }
1382
1383 /*
1384 * Wait and parse ServerHello handshake message.
1385 * Handler for MBEDTLS_SSL_SERVER_HELLO
1386 */
ssl_tls13_process_server_hello(mbedtls_ssl_context * ssl)1387 static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl )
1388 {
1389 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1390 unsigned char *buf;
1391 size_t buf_len;
1392
1393 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) );
1394
1395 /* Coordination step
1396 * - Fetch record
1397 * - Make sure it's either a ServerHello or a HRR.
1398 * - Switch processing routine in case of HRR
1399 */
1400 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
1401 ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
1402
1403 ret = ssl_tls13_server_hello_coordinate( ssl, &buf, &buf_len );
1404 /* Parsing step
1405 * We know what message to expect by now and call
1406 * the respective parsing function.
1407 */
1408 if( ret == SSL_SERVER_HELLO_COORDINATE_HELLO )
1409 {
1410 MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf,
1411 buf + buf_len ) );
1412
1413 mbedtls_ssl_tls13_add_hs_msg_to_checksum( ssl,
1414 MBEDTLS_SSL_HS_SERVER_HELLO,
1415 buf, buf_len );
1416
1417 MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_server_hello( ssl ) );
1418 }
1419 else if( ret == SSL_SERVER_HELLO_COORDINATE_HRR )
1420 {
1421 MBEDTLS_SSL_DEBUG_MSG( 1, ( "HRR not supported" ) );
1422 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ,
1423 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1424 ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1425 }
1426
1427 cleanup:
1428 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s", __func__ ) );
1429 return( ret );
1430 }
1431
1432 /*
1433 *
1434 * EncryptedExtensions message
1435 *
1436 * The EncryptedExtensions message contains any extensions which
1437 * should be protected, i.e., any which are not needed to establish
1438 * the cryptographic context.
1439 */
1440
1441 /*
1442 * Overview
1443 */
1444
1445 /* Main entry point; orchestrates the other functions */
1446 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl );
1447
1448 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1449 const unsigned char *buf,
1450 const unsigned char *end );
1451 static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl );
1452
1453 /*
1454 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
1455 */
ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context * ssl)1456 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl )
1457 {
1458 int ret;
1459 unsigned char *buf;
1460 size_t buf_len;
1461
1462 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) );
1463
1464 MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
1465 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
1466 &buf, &buf_len ) );
1467
1468 /* Process the message contents */
1469 MBEDTLS_SSL_PROC_CHK(
1470 ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) );
1471
1472 mbedtls_ssl_tls13_add_hs_msg_to_checksum(
1473 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, buf_len );
1474
1475 MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_encrypted_extensions( ssl ) );
1476
1477 cleanup:
1478
1479 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) );
1480 return( ret );
1481
1482 }
1483
1484 /* Parse EncryptedExtensions message
1485 * struct {
1486 * Extension extensions<0..2^16-1>;
1487 * } EncryptedExtensions;
1488 */
ssl_tls13_parse_encrypted_extensions(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1489 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1490 const unsigned char *buf,
1491 const unsigned char *end )
1492 {
1493 int ret = 0;
1494 size_t extensions_len;
1495 const unsigned char *p = buf;
1496 const unsigned char *extensions_end;
1497
1498 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1499 extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1500 p += 2;
1501
1502 MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len );
1503 extensions_end = p + extensions_len;
1504 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1505
1506 while( p < extensions_end )
1507 {
1508 unsigned int extension_type;
1509 size_t extension_data_len;
1510
1511 /*
1512 * struct {
1513 * ExtensionType extension_type; (2 bytes)
1514 * opaque extension_data<0..2^16-1>;
1515 * } Extension;
1516 */
1517 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1518 extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1519 extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1520 p += 4;
1521
1522 MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1523
1524 /* The client MUST check EncryptedExtensions for the
1525 * presence of any forbidden extensions and if any are found MUST abort
1526 * the handshake with an "unsupported_extension" alert.
1527 */
1528 switch( extension_type )
1529 {
1530
1531 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1532 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extensions supported groups" ) );
1533 break;
1534
1535 default:
1536 MBEDTLS_SSL_DEBUG_MSG(
1537 3, ( "unsupported extension found: %u ", extension_type) );
1538 MBEDTLS_SSL_PEND_FATAL_ALERT(
1539 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1540 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1541 return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1542 }
1543
1544 p += extension_data_len;
1545 }
1546
1547 /* Check that we consumed all the message. */
1548 if( p != end )
1549 {
1550 MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) );
1551 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1552 MBEDTLS_ERR_SSL_DECODE_ERROR );
1553 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1554 }
1555
1556 return( ret );
1557 }
1558
ssl_tls13_postprocess_encrypted_extensions(mbedtls_ssl_context * ssl)1559 static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl )
1560 {
1561 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1562 if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
1563 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1564 else
1565 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
1566 #else
1567 ((void) ssl);
1568 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1569 #endif
1570 return( 0 );
1571 }
1572
1573 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1574 /*
1575 * Handler for MBEDTLS_SSL_CERTIFICATE_REQUEST
1576 */
ssl_tls13_process_certificate_request(mbedtls_ssl_context * ssl)1577 static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl )
1578 {
1579 int ret = mbedtls_ssl_read_record( ssl, 0 );
1580
1581 if( ret != 0 )
1582 {
1583 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1584 return( ret );
1585 }
1586
1587 if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) &&
1588 ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) )
1589 {
1590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CertificateRequest not supported" ) );
1591 MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1592 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1593 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1594 }
1595
1596 ssl->keep_current_message = 1;
1597 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
1598
1599 return( 0 );
1600 }
1601
1602 /*
1603 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
1604 */
ssl_tls13_process_server_certificate(mbedtls_ssl_context * ssl)1605 static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl )
1606 {
1607 int ret;
1608
1609 ret = mbedtls_ssl_tls13_process_certificate( ssl );
1610 if( ret != 0 )
1611 return( ret );
1612
1613 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
1614 return( 0 );
1615 }
1616
1617 /*
1618 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
1619 */
ssl_tls13_process_certificate_verify(mbedtls_ssl_context * ssl)1620 static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl )
1621 {
1622 int ret;
1623
1624 ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
1625 if( ret != 0 )
1626 return( ret );
1627
1628 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1629 return( 0 );
1630 }
1631 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1632
1633 /*
1634 * Handler for MBEDTLS_SSL_SERVER_FINISHED
1635 */
ssl_tls13_process_server_finished(mbedtls_ssl_context * ssl)1636 static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
1637 {
1638 int ret;
1639
1640 ret = mbedtls_ssl_tls13_process_finished_message( ssl );
1641 if( ret != 0 )
1642 return( ret );
1643
1644 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1645 mbedtls_ssl_handshake_set_state(
1646 ssl,
1647 MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
1648 #else
1649 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1650 #endif
1651
1652 return( 0 );
1653 }
1654
1655 /*
1656 * Handler for MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED
1657 */
1658 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context * ssl)1659 static int ssl_tls13_write_change_cipher_spec( mbedtls_ssl_context *ssl )
1660 {
1661 int ret;
1662
1663 ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
1664 if( ret != 0 )
1665 return( ret );
1666
1667 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1668
1669 return( 0 );
1670 }
1671 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1672
1673 /*
1674 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
1675 */
ssl_tls13_write_client_finished(mbedtls_ssl_context * ssl)1676 static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
1677 {
1678 int ret;
1679
1680 mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
1681
1682 ret = mbedtls_ssl_tls13_write_finished_message( ssl );
1683 if( ret != 0 )
1684 return( ret );
1685
1686 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS );
1687 return( 0 );
1688 }
1689
1690 /*
1691 * Handler for MBEDTLS_SSL_FLUSH_BUFFERS
1692 */
ssl_tls13_flush_buffers(mbedtls_ssl_context * ssl)1693 static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
1694 {
1695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
1696 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
1697 return( 0 );
1698 }
1699
1700 /*
1701 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
1702 */
ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)1703 static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
1704 {
1705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) );
1706 mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
1707
1708 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for outbound traffic" ) );
1709 mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application );
1710
1711 mbedtls_ssl_tls13_handshake_wrapup( ssl );
1712
1713 mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
1714 return( 0 );
1715 }
1716
mbedtls_ssl_tls13_handshake_client_step(mbedtls_ssl_context * ssl)1717 int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
1718 {
1719 int ret = 0;
1720
1721 MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 client state: %s(%d)",
1722 mbedtls_ssl_states_str( ssl->state ),
1723 ssl->state ) );
1724
1725 switch( ssl->state )
1726 {
1727 /*
1728 * ssl->state is initialized as HELLO_REQUEST. It is the same
1729 * as CLIENT_HELLO state.
1730 */
1731 case MBEDTLS_SSL_HELLO_REQUEST:
1732 case MBEDTLS_SSL_CLIENT_HELLO:
1733 ret = ssl_tls13_write_client_hello( ssl );
1734 break;
1735
1736 case MBEDTLS_SSL_SERVER_HELLO:
1737 ret = ssl_tls13_process_server_hello( ssl );
1738 break;
1739
1740 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
1741 ret = ssl_tls13_process_encrypted_extensions( ssl );
1742 break;
1743
1744 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1745 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
1746 ret = ssl_tls13_process_certificate_request( ssl );
1747 break;
1748
1749 case MBEDTLS_SSL_SERVER_CERTIFICATE:
1750 ret = ssl_tls13_process_server_certificate( ssl );
1751 break;
1752
1753 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
1754 ret = ssl_tls13_process_certificate_verify( ssl );
1755 break;
1756 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1757
1758 case MBEDTLS_SSL_SERVER_FINISHED:
1759 ret = ssl_tls13_process_server_finished( ssl );
1760 break;
1761
1762 case MBEDTLS_SSL_CLIENT_FINISHED:
1763 ret = ssl_tls13_write_client_finished( ssl );
1764 break;
1765
1766 case MBEDTLS_SSL_FLUSH_BUFFERS:
1767 ret = ssl_tls13_flush_buffers( ssl );
1768 break;
1769
1770 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
1771 ret = ssl_tls13_handshake_wrapup( ssl );
1772 break;
1773
1774 /*
1775 * Injection of dummy-CCS's for middlebox compatibility
1776 */
1777 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1778 case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
1779 ret = ssl_tls13_write_change_cipher_spec( ssl );
1780 break;
1781 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1782
1783 default:
1784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
1785 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1786 }
1787
1788 return( ret );
1789 }
1790
1791 #endif /* MBEDTLS_SSL_CLI_C */
1792
1793 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1794