• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  *  TLS 1.3 client-side functions
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  *
19  *  This file is part of mbed TLS ( https://tls.mbed.org )
20  */
21 
22 #include "common.h"
23 
24 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
25 
26 #if defined(MBEDTLS_SSL_CLI_C)
27 
28 #include <string.h>
29 
30 #include "mbedtls/debug.h"
31 #include "mbedtls/error.h"
32 #include "mbedtls/platform.h"
33 
34 #include "ssl_misc.h"
35 #include "ecdh_misc.h"
36 #include "ssl_tls13_keys.h"
37 #include "ssl_debug_helpers_generated.h"
38 
39 /* Write extensions */
40 
41 /*
42  * ssl_tls13_write_supported_versions_ext():
43  *
44  * struct {
45  *      ProtocolVersion versions<2..254>;
46  * } SupportedVersions;
47  */
ssl_tls13_write_supported_versions_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)48 static int ssl_tls13_write_supported_versions_ext( mbedtls_ssl_context *ssl,
49                                                    unsigned char *buf,
50                                                    unsigned char *end,
51                                                    size_t *out_len )
52 {
53     unsigned char *p = buf;
54 
55     *out_len = 0;
56 
57     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported versions extension" ) );
58 
59     /* Check if we have space to write the extension:
60      * - extension_type         (2 bytes)
61      * - extension_data_length  (2 bytes)
62      * - versions_length        (1 byte )
63      * - versions               (2 bytes)
64      */
65     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
66 
67     /* Write extension_type */
68     MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
69 
70     /* Write extension_data_length */
71     MBEDTLS_PUT_UINT16_BE( 3, p, 2 );
72     p += 4;
73 
74     /* Length of versions */
75     *p++ = 0x2;
76 
77     /* Write values of supported versions.
78      *
79      * They are defined by the configuration.
80      *
81      * Currently, only one version is advertised.
82      */
83     mbedtls_ssl_write_version( ssl->conf->max_major_ver,
84                                ssl->conf->max_minor_ver,
85                                ssl->conf->transport, p );
86 
87     MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]",
88                                 ssl->conf->max_major_ver,
89                                 ssl->conf->max_minor_ver ) );
90 
91     *out_len = 7;
92 
93     return( 0 );
94 }
95 
ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)96 static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl,
97                                                    const unsigned char *buf,
98                                                    const unsigned char *end )
99 {
100     ((void) ssl);
101 
102     MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2);
103     if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 ||
104         buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 )
105     {
106         MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected version" ) );
107 
108         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
109                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
110         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
111     }
112 
113     return( 0 );
114 }
115 
116 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
117 
118 /*
119  * Functions for writing supported_groups extension.
120  *
121  * Stucture of supported_groups:
122  *      enum {
123  *          secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
124  *          x25519(0x001D), x448(0x001E),
125  *          ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
126  *          ffdhe6144(0x0103), ffdhe8192(0x0104),
127  *          ffdhe_private_use(0x01FC..0x01FF),
128  *          ecdhe_private_use(0xFE00..0xFEFF),
129  *          (0xFFFF)
130  *      } NamedGroup;
131  *      struct {
132  *          NamedGroup named_group_list<2..2^16-1>;
133  *      } NamedGroupList;
134  */
135 #if defined(MBEDTLS_ECDH_C)
136 /*
137  * In versions of TLS prior to TLS 1.3, this extension was named
138  * 'elliptic_curves' and only contained elliptic curve groups.
139  */
ssl_tls13_write_named_group_list_ecdhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)140 static int ssl_tls13_write_named_group_list_ecdhe( mbedtls_ssl_context *ssl,
141                                                    unsigned char *buf,
142                                                    unsigned char *end,
143                                                    size_t *out_len )
144 {
145     unsigned char *p = buf;
146 
147     *out_len = 0;
148 
149     const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
150 
151     if( group_list == NULL )
152         return( MBEDTLS_ERR_SSL_BAD_CONFIG );
153 
154     for ( ; *group_list != 0; group_list++ )
155     {
156         const mbedtls_ecp_curve_info *curve_info;
157         curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
158         if( curve_info == NULL )
159             continue;
160 
161         if( !mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
162             continue;
163 
164         MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2);
165         MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
166         p += 2;
167 
168         MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
169                                     curve_info->name, *group_list ) );
170     }
171 
172     *out_len = p - buf;
173 
174     return( 0 );
175 }
176 #else
ssl_tls13_write_named_group_list_ecdhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)177 static int ssl_tls13_write_named_group_list_ecdhe( mbedtls_ssl_context *ssl,
178                                             unsigned char *buf,
179                                             unsigned char *end,
180                                             size_t *out_len )
181 {
182     ((void) ssl);
183     ((void) buf);
184     ((void) end);
185     *out_len = 0;
186     return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
187 }
188 #endif /* MBEDTLS_ECDH_C */
189 
ssl_tls13_write_named_group_list_dhe(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)190 static int ssl_tls13_write_named_group_list_dhe( mbedtls_ssl_context *ssl,
191                                         unsigned char *buf,
192                                         unsigned char *end,
193                                         size_t *out_len )
194 {
195     ((void) ssl);
196     ((void) buf);
197     ((void) end);
198     *out_len = 0;
199     MBEDTLS_SSL_DEBUG_MSG( 3, ( "write_named_group_dhe is not implemented" ) );
200     return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
201 }
202 
ssl_tls13_write_supported_groups_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)203 static int ssl_tls13_write_supported_groups_ext( mbedtls_ssl_context *ssl,
204                                                  unsigned char *buf,
205                                                  unsigned char *end,
206                                                  size_t *out_len )
207 {
208     unsigned char *p = buf ;
209     unsigned char *named_group_list; /* Start of named_group_list */
210     size_t named_group_list_len;     /* Length of named_group_list */
211     size_t output_len = 0;
212     int ret_ecdhe, ret_dhe;
213 
214     *out_len = 0;
215 
216     if( !mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
217         return( 0 );
218 
219     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) );
220 
221     /* Check if we have space for header and length fields:
222      * - extension_type            (2 bytes)
223      * - extension_data_length     (2 bytes)
224      * - named_group_list_length   (2 bytes)
225      */
226     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
227     p += 6;
228 
229     named_group_list = p;
230     ret_ecdhe = ssl_tls13_write_named_group_list_ecdhe( ssl, p, end, &output_len );
231     if( ret_ecdhe != 0 )
232     {
233         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_named_group_list_ecdhe", ret_ecdhe );
234     }
235     p += output_len;
236 
237     ret_dhe = ssl_tls13_write_named_group_list_dhe( ssl, p, end, &output_len );
238     if( ret_dhe != 0 )
239     {
240         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_write_named_group_list_dhe", ret_dhe );
241     }
242     p += output_len;
243 
244     /* Both ECDHE and DHE failed. */
245     if( ret_ecdhe != 0 && ret_dhe != 0 )
246     {
247         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Both ECDHE and DHE groups are fail. " ) );
248         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
249     }
250 
251     /* Length of named_group_list*/
252     named_group_list_len = p - named_group_list;
253     if( named_group_list_len == 0 )
254     {
255         MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) );
256         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
257     }
258 
259     /* Write extension_type */
260     MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 );
261     /* Write extension_data_length */
262     MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 );
263     /* Write length of named_group_list */
264     MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 );
265 
266     MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension", buf + 4, named_group_list_len + 2 );
267 
268     *out_len = p - buf;
269 
270     ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
271 
272     return( 0 );
273 }
274 
275 /*
276  * Functions for writing key_share extension.
277  */
278 #if defined(MBEDTLS_ECDH_C)
ssl_tls13_generate_and_write_ecdh_key_exchange(mbedtls_ssl_context * ssl,uint16_t named_group,unsigned char * buf,unsigned char * end,size_t * out_len)279 static int ssl_tls13_generate_and_write_ecdh_key_exchange(
280                 mbedtls_ssl_context *ssl,
281                 uint16_t named_group,
282                 unsigned char *buf,
283                 unsigned char *end,
284                 size_t *out_len )
285 {
286     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
287     const mbedtls_ecp_curve_info *curve_info =
288         mbedtls_ecp_curve_info_from_tls_id( named_group );
289 
290     if( curve_info == NULL )
291         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
292 
293     MBEDTLS_SSL_DEBUG_MSG( 3, ( "offer curve %s", curve_info->name ) );
294 
295     if( ( ret = mbedtls_ecdh_setup_no_everest( &ssl->handshake->ecdh_ctx,
296                                                curve_info->grp_id ) ) != 0 )
297     {
298         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_setup_no_everest", ret );
299         return( ret );
300     }
301 
302     ret = mbedtls_ecdh_tls13_make_params( &ssl->handshake->ecdh_ctx, out_len,
303                                           buf, end - buf,
304                                           ssl->conf->f_rng, ssl->conf->p_rng );
305     if( ret != 0 )
306     {
307         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_tls13_make_params", ret );
308         return( ret );
309     }
310 
311     MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
312                             MBEDTLS_DEBUG_ECDH_Q );
313     return( 0 );
314 }
315 #endif /* MBEDTLS_ECDH_C */
316 
ssl_tls13_get_default_group_id(mbedtls_ssl_context * ssl,uint16_t * group_id)317 static int ssl_tls13_get_default_group_id( mbedtls_ssl_context *ssl,
318                                            uint16_t *group_id )
319 {
320     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
321 
322 
323 #if defined(MBEDTLS_ECDH_C)
324     const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
325     /* Pick first available ECDHE group compatible with TLS 1.3 */
326     if( group_list == NULL )
327         return( MBEDTLS_ERR_SSL_BAD_CONFIG );
328 
329     for ( ; *group_list != 0; group_list++ )
330     {
331         const mbedtls_ecp_curve_info *curve_info;
332         curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
333         if( curve_info != NULL &&
334             mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) )
335         {
336             *group_id = *group_list;
337             return( 0 );
338         }
339     }
340 #else
341     ((void) ssl);
342     ((void) group_id);
343 #endif /* MBEDTLS_ECDH_C */
344 
345     /*
346      * Add DHE named groups here.
347      * Pick first available DHE group compatible with TLS 1.3
348      */
349 
350     return( ret );
351 }
352 
353 /*
354  * ssl_tls13_write_key_share_ext
355  *
356  * Structure of key_share extension in ClientHello:
357  *
358  *  struct {
359  *          NamedGroup group;
360  *          opaque key_exchange<1..2^16-1>;
361  *      } KeyShareEntry;
362  *  struct {
363  *          KeyShareEntry client_shares<0..2^16-1>;
364  *      } KeyShareClientHello;
365  */
ssl_tls13_write_key_share_ext(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)366 static int ssl_tls13_write_key_share_ext( mbedtls_ssl_context *ssl,
367                                           unsigned char *buf,
368                                           unsigned char *end,
369                                           size_t *out_len )
370 {
371     unsigned char *p = buf;
372     unsigned char *client_shares; /* Start of client_shares */
373     size_t client_shares_len;     /* Length of client_shares */
374     uint16_t group_id;
375     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
376 
377     *out_len = 0;
378 
379     if( !mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) )
380         return( 0 );
381 
382     /* Check if we have space for header and length fields:
383      * - extension_type         (2 bytes)
384      * - extension_data_length  (2 bytes)
385      * - client_shares_length   (2 bytes)
386      */
387     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
388     p += 6;
389 
390     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello: adding key share extension" ) );
391 
392     /* HRR could already have requested something else. */
393     group_id = ssl->handshake->offered_group_id;
394     if( !mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) &&
395         !mbedtls_ssl_tls13_named_group_is_dhe( group_id ) )
396     {
397         MBEDTLS_SSL_PROC_CHK( ssl_tls13_get_default_group_id( ssl,
398                                                               &group_id ) );
399     }
400 
401     /*
402      * Dispatch to type-specific key generation function.
403      *
404      * So far, we're only supporting ECDHE. With the introduction
405      * of PQC KEMs, we'll want to have multiple branches, one per
406      * type of KEM, and dispatch to the corresponding crypto. And
407      * only one key share entry is allowed.
408      */
409     client_shares = p;
410 #if defined(MBEDTLS_ECDH_C)
411     if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
412     {
413         /* Pointer to group */
414         unsigned char *group = p;
415         /* Length of key_exchange */
416         size_t key_exchange_len;
417 
418         /* Check there is space for header of KeyShareEntry
419          * - group                  (2 bytes)
420          * - key_exchange_length    (2 bytes)
421          */
422         MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
423         p += 4;
424         ret = ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, group_id,
425                                                               p, end,
426                                                               &key_exchange_len );
427         p += key_exchange_len;
428         if( ret != 0 )
429             return( ret );
430 
431         /* Write group */
432         MBEDTLS_PUT_UINT16_BE( group_id, group, 0 );
433         /* Write key_exchange_length */
434         MBEDTLS_PUT_UINT16_BE( key_exchange_len, group, 2 );
435     }
436     else
437 #endif /* MBEDTLS_ECDH_C */
438     if( 0 /* other KEMs? */ )
439     {
440         /* Do something */
441     }
442     else
443         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
444 
445     /* Length of client_shares */
446     client_shares_len = p - client_shares;
447     if( client_shares_len == 0)
448     {
449         MBEDTLS_SSL_DEBUG_MSG( 1, ( "No key share defined." ) );
450         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
451     }
452     /* Write extension_type */
453     MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0 );
454     /* Write extension_data_length */
455     MBEDTLS_PUT_UINT16_BE( client_shares_len + 2, buf, 2 );
456     /* Write client_shares_length */
457     MBEDTLS_PUT_UINT16_BE( client_shares_len, buf, 4 );
458 
459     /* Update offered_group_id field */
460     ssl->handshake->offered_group_id = group_id;
461 
462     /* Output the total length of key_share extension. */
463     *out_len = p - buf;
464 
465     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, key_share extension", buf, *out_len );
466 
467     ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
468 
469 cleanup:
470 
471     return( ret );
472 }
473 
474 #if defined(MBEDTLS_ECDH_C)
475 
ssl_tls13_check_ecdh_params(const mbedtls_ssl_context * ssl)476 static int ssl_tls13_check_ecdh_params( const mbedtls_ssl_context *ssl )
477 {
478     const mbedtls_ecp_curve_info *curve_info;
479     mbedtls_ecp_group_id grp_id;
480 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
481     grp_id = ssl->handshake->ecdh_ctx.grp.id;
482 #else
483     grp_id = ssl->handshake->ecdh_ctx.grp_id;
484 #endif
485 
486     curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
487     if( curve_info == NULL )
488     {
489         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
490         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
491     }
492 
493     MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
494 
495     if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
496         return( -1 );
497 
498     MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
499                             MBEDTLS_DEBUG_ECDH_QP );
500 
501     return( 0 );
502 }
503 
ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t buf_len)504 static int ssl_tls13_read_public_ecdhe_share( mbedtls_ssl_context *ssl,
505                                               const unsigned char *buf,
506                                               size_t buf_len )
507 {
508     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
509 
510     ret = mbedtls_ecdh_tls13_read_public( &ssl->handshake->ecdh_ctx,
511                                           buf, buf_len );
512     if( ret != 0 )
513     {
514         MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_tls13_read_public" ), ret );
515 
516         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
517                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
518         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
519     }
520 
521     if( ssl_tls13_check_ecdh_params( ssl ) != 0 )
522     {
523         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ssl_tls13_check_ecdh_params() failed!" ) );
524 
525         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
526                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
527         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
528     }
529 
530     return( 0 );
531 }
532 #endif /* MBEDTLS_ECDH_C */
533 
534 /*
535  * ssl_tls13_parse_key_share_ext()
536  *      Parse key_share extension in Server Hello
537  *
538  * struct {
539  *        KeyShareEntry server_share;
540  * } KeyShareServerHello;
541  * struct {
542  *        NamedGroup group;
543  *        opaque key_exchange<1..2^16-1>;
544  * } KeyShareEntry;
545  */
ssl_tls13_parse_key_share_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)546 static int ssl_tls13_parse_key_share_ext( mbedtls_ssl_context *ssl,
547                                           const unsigned char *buf,
548                                           const unsigned char *end )
549 {
550     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
551     const unsigned char *p = buf;
552     uint16_t group, offered_group;
553 
554     /* ...
555      * NamedGroup group; (2 bytes)
556      * ...
557      */
558     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
559     group = MBEDTLS_GET_UINT16_BE( p, 0 );
560     p += 2;
561 
562     /* Check that the chosen group matches the one we offered. */
563     offered_group = ssl->handshake->offered_group_id;
564     if( offered_group != group )
565     {
566         MBEDTLS_SSL_DEBUG_MSG( 1,
567             ( "Invalid server key share, our group %u, their group %u",
568               (unsigned) offered_group, (unsigned) group ) );
569         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
570                                       MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
571         return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
572     }
573 
574 #if defined(MBEDTLS_ECDH_C)
575     if( mbedtls_ssl_tls13_named_group_is_ecdhe( group ) )
576     {
577         /* Complete ECDHE key agreement */
578         ret = ssl_tls13_read_public_ecdhe_share( ssl, p, end - p );
579         if( ret != 0 )
580             return( ret );
581     }
582     else
583 #endif /* MBEDTLS_ECDH_C */
584     if( 0 /* other KEMs? */ )
585     {
586         /* Do something */
587     }
588     else
589         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
590 
591     ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE;
592     return( ret );
593 }
594 
595 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
596 
597 /* Write cipher_suites
598  * CipherSuite cipher_suites<2..2^16-2>;
599  */
ssl_tls13_write_client_hello_cipher_suites(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)600 static int ssl_tls13_write_client_hello_cipher_suites(
601             mbedtls_ssl_context *ssl,
602             unsigned char *buf,
603             unsigned char *end,
604             size_t *out_len )
605 {
606     unsigned char *p = buf;
607     const int *ciphersuite_list;
608     unsigned char *cipher_suites; /* Start of the cipher_suites list */
609     size_t cipher_suites_len;
610 
611     *out_len = 0 ;
612 
613     /*
614      * Ciphersuite list
615      *
616      * This is a list of the symmetric cipher options supported by
617      * the client, specifically the record protection algorithm
618      * ( including secret key length ) and a hash to be used with
619      * HKDF, in descending order of client preference.
620      */
621     ciphersuite_list = ssl->conf->ciphersuite_list;
622 
623     /* Check there is space for the cipher suite list length (2 bytes). */
624     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
625     p += 2;
626 
627     /* Write cipher_suites */
628     cipher_suites = p;
629     for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
630     {
631         int cipher_suite = ciphersuite_list[i];
632         const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
633 
634         ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
635         if( ciphersuite_info == NULL )
636             continue;
637         if( !( MBEDTLS_SSL_MINOR_VERSION_4 >= ciphersuite_info->min_minor_ver &&
638                MBEDTLS_SSL_MINOR_VERSION_4 <= ciphersuite_info->max_minor_ver ) )
639             continue;
640 
641         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
642                                     (unsigned int) cipher_suite,
643                                     ciphersuite_info->name ) );
644 
645         /* Check there is space for the cipher suite identifier (2 bytes). */
646         MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
647         MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
648         p += 2;
649     }
650 
651     /* Write the cipher_suites length in number of bytes */
652     cipher_suites_len = p - cipher_suites;
653     MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
654     MBEDTLS_SSL_DEBUG_MSG( 3,
655                            ( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
656                              cipher_suites_len/2 ) );
657 
658     /* Output the total length of cipher_suites field. */
659     *out_len = p - buf;
660 
661     return( 0 );
662 }
663 
664 /*
665  * Structure of ClientHello message:
666  *
667  *    struct {
668  *        ProtocolVersion legacy_version = 0x0303;    // TLS v1.2
669  *        Random random;
670  *        opaque legacy_session_id<0..32>;
671  *        CipherSuite cipher_suites<2..2^16-2>;
672  *        opaque legacy_compression_methods<1..2^8-1>;
673  *        Extension extensions<8..2^16-1>;
674  *    } ClientHello;
675  */
ssl_tls13_write_client_hello_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)676 static int ssl_tls13_write_client_hello_body( mbedtls_ssl_context *ssl,
677                                               unsigned char *buf,
678                                               unsigned char *end,
679                                               size_t *out_len )
680 {
681 
682     int ret;
683     unsigned char *p_extensions_len; /* Pointer to extensions length */
684     size_t output_len;               /* Length of buffer used by function */
685     size_t extensions_len;           /* Length of the list of extensions*/
686 
687     /* Buffer management */
688     unsigned char *p = buf;
689 
690     *out_len = 0;
691 
692     /* No validation needed here. It has been done by ssl_conf_check() */
693     ssl->major_ver = ssl->conf->min_major_ver;
694     ssl->minor_ver = ssl->conf->min_minor_ver;
695 
696     /*
697      * Write legacy_version
698      *    ProtocolVersion legacy_version = 0x0303;    // TLS v1.2
699      *
700      *  For TLS 1.3 we use the legacy version number {0x03, 0x03}
701      *  instead of the true version number.
702      */
703     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
704     MBEDTLS_PUT_UINT16_BE( 0x0303, p, 0 );
705     p += 2;
706 
707     /* Write the random bytes ( random ).*/
708     MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
709     memcpy( p, ssl->handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
710     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
711                            p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
712     p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
713 
714     /*
715      * Write legacy_session_id
716      *
717      * Versions of TLS before TLS 1.3 supported a "session resumption" feature
718      * which has been merged with pre-shared keys in this version. A client
719      * which has a cached session ID set by a pre-TLS 1.3 server SHOULD set
720      * this field to that value. In compatibility mode, this field MUST be
721      * non-empty, so a client not offering a pre-TLS 1.3 session MUST generate
722      * a new 32-byte value. This value need not be random but SHOULD be
723      * unpredictable to avoid implementations fixating on a specific value
724      * ( also known as ossification ). Otherwise, it MUST be set as a zero-length
725      * vector ( i.e., a zero-valued single byte length field ).
726      */
727 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
728     MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
729     *p++ = (unsigned char)ssl->session_negotiate->id_len;
730     memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
731     p += ssl->session_negotiate->id_len;
732 
733     MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
734                               ssl->session_negotiate->id_len );
735 #else
736     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
737     *p++ = 0; /* session id length set to zero */
738 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
739 
740     /* Write cipher_suites */
741     ret = ssl_tls13_write_client_hello_cipher_suites( ssl, p, end, &output_len );
742     if( ret != 0 )
743         return( ret );
744     p += output_len;
745 
746     /* Write legacy_compression_methods
747      *
748      * For every TLS 1.3 ClientHello, this vector MUST contain exactly
749      * one byte set to zero, which corresponds to the 'null' compression
750      * method in prior versions of TLS.
751      */
752     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
753     *p++ = 1;
754     *p++ = MBEDTLS_SSL_COMPRESS_NULL;
755 
756     /* Write extensions */
757 
758     /* Keeping track of the included extensions */
759     ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
760 
761     /* First write extensions, then the total length */
762     MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
763     p_extensions_len = p;
764     p += 2;
765 
766     /* Write supported_versions extension
767      *
768      * Supported Versions Extension is mandatory with TLS 1.3.
769      */
770     ret = ssl_tls13_write_supported_versions_ext( ssl, p, end, &output_len );
771     if( ret != 0 )
772         return( ret );
773     p += output_len;
774 
775 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
776     /* Write supported_groups extension
777      *
778      * It is REQUIRED for ECDHE cipher_suites.
779      */
780     ret = ssl_tls13_write_supported_groups_ext( ssl, p, end, &output_len );
781     if( ret != 0 )
782         return( ret );
783     p += output_len;
784 
785     /* Write key_share extension
786      *
787      * We need to send the key shares under three conditions:
788      * 1) A certificate-based ciphersuite is being offered. In this case
789      *    supported_groups and supported_signature extensions have been
790      *    successfully added.
791      * 2) A PSK-based ciphersuite with ECDHE is offered. In this case the
792      *    psk_key_exchange_modes has been added as the last extension.
793      * 3) Or, in case all ciphers are supported ( which includes #1 and #2
794      *    from above )
795      */
796     ret = ssl_tls13_write_key_share_ext( ssl, p, end, &output_len );
797     if( ret != 0 )
798         return( ret );
799     p += output_len;
800 
801     /* Write signature_algorithms extension
802      *
803      * It is REQUIRED for certificate authenticated cipher_suites.
804      */
805     ret = mbedtls_ssl_tls13_write_sig_alg_ext( ssl, p, end, &output_len );
806     if( ret != 0 )
807         return( ret );
808     p += output_len;
809 
810 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
811 
812 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
813     /* Write server name extension */
814     ret = mbedtls_ssl_write_hostname_ext( ssl, p, end, &output_len );
815     if( ret != 0 )
816         return( ret );
817     p += output_len;
818 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
819 
820     /* Add more extensions here */
821 
822     /* Write the length of the list of extensions. */
823     extensions_len = p - p_extensions_len - 2;
824     MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
825     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" MBEDTLS_PRINTF_SIZET ,
826                                 extensions_len ) );
827     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p_extensions_len, extensions_len );
828 
829     *out_len = p - buf;
830     return( 0 );
831 }
832 
ssl_tls13_finalize_client_hello(mbedtls_ssl_context * ssl)833 static int ssl_tls13_finalize_client_hello( mbedtls_ssl_context *ssl )
834 {
835     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
836     return( 0 );
837 }
838 
ssl_tls13_prepare_client_hello(mbedtls_ssl_context * ssl)839 static int ssl_tls13_prepare_client_hello( mbedtls_ssl_context *ssl )
840 {
841     int ret;
842 
843     if( ssl->conf->f_rng == NULL )
844     {
845         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
846         return( MBEDTLS_ERR_SSL_NO_RNG );
847     }
848 
849     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
850                                   ssl->handshake->randbytes,
851                                   MBEDTLS_CLIENT_HELLO_RANDOM_LEN ) ) != 0 )
852     {
853         MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
854         return( ret );
855     }
856 
857 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
858     /*
859      * Create a session identifier for the purpose of middlebox compatibility
860      * only if one has not been created already.
861      */
862     if( ssl->session_negotiate->id_len == 0 )
863     {
864         /* Creating a session id with 32 byte length */
865         if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
866                                       ssl->session_negotiate->id, 32 ) ) != 0 )
867         {
868             MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
869             return( ret );
870         }
871         ssl->session_negotiate->id_len = 32;
872     }
873 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
874 
875     return( 0 );
876 }
877 
878 /*
879  * Write ClientHello handshake message.
880  * Handler for MBEDTLS_SSL_CLIENT_HELLO
881  */
ssl_tls13_write_client_hello(mbedtls_ssl_context * ssl)882 static int ssl_tls13_write_client_hello( mbedtls_ssl_context *ssl )
883 {
884     int ret = 0;
885     unsigned char *buf;
886     size_t buf_len, msg_len;
887 
888     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
889 
890     MBEDTLS_SSL_PROC_CHK( ssl_tls13_prepare_client_hello( ssl ) );
891 
892     MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_start_handshake_msg(
893                                 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
894                                 &buf, &buf_len ) );
895 
896     MBEDTLS_SSL_PROC_CHK( ssl_tls13_write_client_hello_body( ssl, buf,
897                                                              buf + buf_len,
898                                                              &msg_len ) );
899 
900     mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl,
901                                               MBEDTLS_SSL_HS_CLIENT_HELLO,
902                                               msg_len );
903     ssl->handshake->update_checksum( ssl, buf, msg_len );
904 
905     MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_client_hello( ssl ) );
906     MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_finish_handshake_msg( ssl,
907                                                                   buf_len,
908                                                                   msg_len ) );
909 
910 cleanup:
911 
912     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
913     return ret;
914 }
915 
916 /*
917  * Functions for parsing and processing Server Hello
918  */
919 /* Returns a negative value on failure, and otherwise
920  * - SSL_SERVER_HELLO_COORDINATE_HELLO or
921  * - SSL_SERVER_HELLO_COORDINATE_HRR
922  * to indicate which message is expected and to be parsed next. */
923 #define SSL_SERVER_HELLO_COORDINATE_HELLO 0
924 #define SSL_SERVER_HELLO_COORDINATE_HRR 1
ssl_server_hello_is_hrr(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)925 static int ssl_server_hello_is_hrr( mbedtls_ssl_context *ssl,
926                                     const unsigned char *buf,
927                                     const unsigned char *end )
928 {
929     static const unsigned char magic_hrr_string[MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
930         { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
931           0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
932           0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
933           0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33 ,0x9C };
934 
935     /* Check whether this message is a HelloRetryRequest ( HRR ) message.
936      *
937      * Server Hello and HRR are only distinguished by Random set to the
938      * special value of the SHA-256 of "HelloRetryRequest".
939      *
940      * struct {
941      *    ProtocolVersion legacy_version = 0x0303;
942      *    Random random;
943      *    opaque legacy_session_id_echo<0..32>;
944      *    CipherSuite cipher_suite;
945      *    uint8 legacy_compression_method = 0;
946      *    Extension extensions<6..2^16-1>;
947      * } ServerHello;
948      *
949      */
950     MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 + sizeof( magic_hrr_string ) );
951 
952     if( memcmp( buf + 2, magic_hrr_string, sizeof( magic_hrr_string ) ) == 0 )
953     {
954         return( SSL_SERVER_HELLO_COORDINATE_HRR );
955     }
956 
957     return( SSL_SERVER_HELLO_COORDINATE_HELLO );
958 }
959 
960 /* Fetch and preprocess
961  * Returns a negative value on failure, and otherwise
962  * - SSL_SERVER_HELLO_COORDINATE_HELLO or
963  * - SSL_SERVER_HELLO_COORDINATE_HRR
964  */
ssl_tls13_server_hello_coordinate(mbedtls_ssl_context * ssl,unsigned char ** buf,size_t * buf_len)965 static int ssl_tls13_server_hello_coordinate( mbedtls_ssl_context *ssl,
966                                               unsigned char **buf,
967                                               size_t *buf_len )
968 {
969     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
970 
971     MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_read_record( ssl, 0 ) );
972 
973     if( ( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) ||
974         ( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO ) )
975     {
976         MBEDTLS_SSL_DEBUG_MSG( 1, ( "unexpected message" ) );
977 
978         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
979                                       MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
980         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
981     }
982 
983     *buf = ssl->in_msg + 4;
984     *buf_len = ssl->in_hslen - 4;
985 
986     ret = ssl_server_hello_is_hrr( ssl, *buf, *buf + *buf_len );
987     switch( ret )
988     {
989         case SSL_SERVER_HELLO_COORDINATE_HELLO:
990             MBEDTLS_SSL_DEBUG_MSG( 2, ( "received ServerHello message" ) );
991             break;
992         case SSL_SERVER_HELLO_COORDINATE_HRR:
993             MBEDTLS_SSL_DEBUG_MSG( 2, ( "received HelloRetryRequest message" ) );
994             break;
995     }
996 
997 cleanup:
998 
999     return( ret );
1000 }
1001 
ssl_tls13_check_server_hello_session_id_echo(mbedtls_ssl_context * ssl,const unsigned char ** buf,const unsigned char * end)1002 static int ssl_tls13_check_server_hello_session_id_echo( mbedtls_ssl_context *ssl,
1003                                                          const unsigned char **buf,
1004                                                          const unsigned char *end )
1005 {
1006     const unsigned char *p = *buf;
1007     size_t legacy_session_id_echo_len;
1008 
1009     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1010     legacy_session_id_echo_len = *p++ ;
1011 
1012     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, legacy_session_id_echo_len );
1013 
1014     /* legacy_session_id_echo */
1015     if( ssl->session_negotiate->id_len != legacy_session_id_echo_len ||
1016         memcmp( ssl->session_negotiate->id, p , legacy_session_id_echo_len ) != 0 )
1017     {
1018         MBEDTLS_SSL_DEBUG_BUF( 3, "Expected Session ID",
1019                                ssl->session_negotiate->id,
1020                                ssl->session_negotiate->id_len );
1021         MBEDTLS_SSL_DEBUG_BUF( 3, "Received Session ID", p,
1022                                legacy_session_id_echo_len );
1023 
1024         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1025                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1026 
1027         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1028     }
1029 
1030     p += legacy_session_id_echo_len;
1031     *buf = p;
1032 
1033     MBEDTLS_SSL_DEBUG_BUF( 3, "Session ID", ssl->session_negotiate->id,
1034                             ssl->session_negotiate->id_len );
1035     return( 0 );
1036 }
1037 
ssl_tls13_cipher_suite_is_offered(mbedtls_ssl_context * ssl,int cipher_suite)1038 static int ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl,
1039                                               int cipher_suite )
1040 {
1041     const int *ciphersuite_list = ssl->conf->ciphersuite_list;
1042 
1043     /* Check whether we have offered this ciphersuite */
1044     for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
1045     {
1046         if( ciphersuite_list[i] == cipher_suite )
1047         {
1048             return( 1 );
1049         }
1050     }
1051     return( 0 );
1052 }
1053 
1054 /* Parse ServerHello message and configure context
1055  *
1056  * struct {
1057  *    ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1058  *    Random random;
1059  *    opaque legacy_session_id_echo<0..32>;
1060  *    CipherSuite cipher_suite;
1061  *    uint8 legacy_compression_method = 0;
1062  *    Extension extensions<6..2^16-1>;
1063  * } ServerHello;
1064  */
ssl_tls13_parse_server_hello(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1065 static int ssl_tls13_parse_server_hello( mbedtls_ssl_context *ssl,
1066                                          const unsigned char *buf,
1067                                          const unsigned char *end )
1068 {
1069     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1070     const unsigned char *p = buf;
1071     size_t extensions_len;
1072     const unsigned char *extensions_end;
1073     uint16_t cipher_suite;
1074     const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
1075 
1076     /*
1077      * Check there is space for minimal fields
1078      *
1079      * - legacy_version             ( 2 bytes)
1080      * - random                     (MBEDTLS_SERVER_HELLO_RANDOM_LEN bytes)
1081      * - legacy_session_id_echo     ( 1 byte ), minimum size
1082      * - cipher_suite               ( 2 bytes)
1083      * - legacy_compression_method  ( 1 byte )
1084      */
1085     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN + 6 );
1086 
1087     MBEDTLS_SSL_DEBUG_BUF( 4, "server hello", p, end - p );
1088     MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", p, 2 );
1089 
1090     /* ...
1091      * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1092      * ...
1093      * with ProtocolVersion defined as:
1094      * uint16 ProtocolVersion;
1095      */
1096     if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 &&
1097            p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) )
1098     {
1099         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) );
1100         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1101                                       MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
1102         return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
1103     }
1104     p += 2;
1105 
1106     /* ...
1107      * Random random;
1108      * ...
1109      * with Random defined as:
1110      * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
1111      */
1112     memcpy( &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN], p,
1113             MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1114     MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes",
1115                            p, MBEDTLS_SERVER_HELLO_RANDOM_LEN );
1116     p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
1117 
1118     /* ...
1119      * opaque legacy_session_id_echo<0..32>;
1120      * ...
1121      */
1122     if( ssl_tls13_check_server_hello_session_id_echo( ssl, &p, end ) != 0 )
1123     {
1124         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1125                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1126         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1127     }
1128 
1129     /* ...
1130      * CipherSuite cipher_suite;
1131      * ...
1132      * with CipherSuite defined as:
1133      * uint8 CipherSuite[2];
1134      */
1135     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1136     cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
1137     p += 2;
1138 
1139 
1140     /*
1141      * Check whether this ciphersuite is supported and offered.
1142      * Via the force_ciphersuite version we may have instructed the client
1143      * to use a different ciphersuite.
1144      */
1145     ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
1146     if( ciphersuite_info == NULL ||
1147         ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) == 0 )
1148     {
1149         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite(%04x) not found or not offered",
1150                                     cipher_suite ) );
1151 
1152         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1153                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1154         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1155     }
1156 
1157 
1158     /* Configure ciphersuites */
1159     mbedtls_ssl_optimize_checksum( ssl, ciphersuite_info );
1160 
1161     ssl->handshake->ciphersuite_info = ciphersuite_info;
1162     ssl->session_negotiate->ciphersuite = cipher_suite;
1163 
1164     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: ( %04x ) - %s",
1165                                  cipher_suite, ciphersuite_info->name ) );
1166 
1167 #if defined(MBEDTLS_HAVE_TIME)
1168     ssl->session_negotiate->start = time( NULL );
1169 #endif /* MBEDTLS_HAVE_TIME */
1170 
1171     /* ...
1172      * uint8 legacy_compression_method = 0;
1173      * ...
1174      */
1175     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 );
1176     if( p[0] != 0 )
1177     {
1178         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad legacy compression method" ) );
1179         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1180                                       MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1181         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
1182     }
1183     p++;
1184 
1185     /* ...
1186      * Extension extensions<6..2^16-1>;
1187      * ...
1188      * struct {
1189      *      ExtensionType extension_type; (2 bytes)
1190      *      opaque extension_data<0..2^16-1>;
1191      * } Extension;
1192      */
1193     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1194     extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1195     p += 2;
1196 
1197     /* Check extensions do not go beyond the buffer of data. */
1198     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1199     extensions_end = p + extensions_len;
1200 
1201     MBEDTLS_SSL_DEBUG_BUF( 3, "server hello extensions", p, extensions_len );
1202 
1203     while( p < extensions_end )
1204     {
1205         unsigned int extension_type;
1206         size_t extension_data_len;
1207 
1208         MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1209         extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1210         extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1211         p += 4;
1212 
1213         MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1214 
1215         switch( extension_type )
1216         {
1217             case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
1218                 MBEDTLS_SSL_DEBUG_MSG( 3,
1219                             ( "found supported_versions extension" ) );
1220 
1221                 ret = ssl_tls13_parse_supported_versions_ext( ssl,
1222                                                               p,
1223                                                               p + extension_data_len );
1224                 if( ret != 0 )
1225                     return( ret );
1226                 break;
1227 
1228             case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
1229                 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found pre_shared_key extension." ) );
1230                 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pre_shared_key:Not supported yet" ) );
1231 
1232                 MBEDTLS_SSL_PEND_FATAL_ALERT(
1233                     MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1234                     MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1235                 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1236 
1237 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1238             case MBEDTLS_TLS_EXT_KEY_SHARE:
1239                 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key_shares extension" ) );
1240                 if( ( ret = ssl_tls13_parse_key_share_ext( ssl,
1241                                             p, p + extension_data_len ) ) != 0 )
1242                 {
1243                     MBEDTLS_SSL_DEBUG_RET( 1,
1244                                            "ssl_tls13_parse_key_share_ext",
1245                                            ret );
1246                     return( ret );
1247                 }
1248                 break;
1249 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1250 
1251             default:
1252                 MBEDTLS_SSL_DEBUG_MSG(
1253                     3,
1254                     ( "unknown extension found: %u ( ignoring )",
1255                       extension_type ) );
1256 
1257                 MBEDTLS_SSL_PEND_FATAL_ALERT(
1258                     MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1259                     MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1260                 return( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1261         }
1262 
1263         p += extension_data_len;
1264     }
1265 
1266     return( 0 );
1267 }
1268 
ssl_tls13_finalize_server_hello(mbedtls_ssl_context * ssl)1269 static int ssl_tls13_finalize_server_hello( mbedtls_ssl_context *ssl )
1270 {
1271     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1272     mbedtls_ssl_key_set traffic_keys;
1273     mbedtls_ssl_transform *transform_handshake = NULL;
1274     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1275 
1276     /* Determine the key exchange mode:
1277      * 1) If both the pre_shared_key and key_share extensions were received
1278      *    then the key exchange mode is PSK with EPHEMERAL.
1279      * 2) If only the pre_shared_key extension was received then the key
1280      *    exchange mode is PSK-only.
1281      * 3) If only the key_share extension was received then the key
1282      *    exchange mode is EPHEMERAL-only.
1283      */
1284     switch( handshake->extensions_present &
1285             ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ) )
1286     {
1287         /* Only the pre_shared_key extension was received */
1288         case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
1289             handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
1290             break;
1291 
1292         /* Only the key_share extension was received */
1293         case MBEDTLS_SSL_EXT_KEY_SHARE:
1294             handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
1295             break;
1296 
1297         /* Both the pre_shared_key and key_share extensions were received */
1298         case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
1299             handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
1300             break;
1301 
1302         /* Neither pre_shared_key nor key_share extension was received */
1303         default:
1304             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unknown key exchange." ) );
1305             ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1306             goto cleanup;
1307     }
1308 
1309     /* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
1310      *
1311      * TODO: We don't have to do this in case we offered 0-RTT and the
1312      *       server accepted it. In this case, we could skip generating
1313      *       the early secret. */
1314     ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl );
1315     if( ret != 0 )
1316     {
1317         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_key_schedule_stage_early_data",
1318                                ret );
1319         goto cleanup;
1320     }
1321 
1322     /* Compute handshake secret */
1323     ret = mbedtls_ssl_tls13_key_schedule_stage_handshake( ssl );
1324     if( ret != 0 )
1325     {
1326         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_derive_master_secret", ret );
1327         goto cleanup;
1328     }
1329 
1330     /* Next evolution in key schedule: Establish handshake secret and
1331      * key material. */
1332     ret = mbedtls_ssl_tls13_generate_handshake_keys( ssl, &traffic_keys );
1333     if( ret != 0 )
1334     {
1335         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_generate_handshake_keys",
1336                                ret );
1337         goto cleanup;
1338     }
1339 
1340     transform_handshake = mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) );
1341     if( transform_handshake == NULL )
1342     {
1343         ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
1344         goto cleanup;
1345     }
1346 
1347     ret = mbedtls_ssl_tls13_populate_transform( transform_handshake,
1348                               ssl->conf->endpoint,
1349                               ssl->session_negotiate->ciphersuite,
1350                               &traffic_keys,
1351                               ssl );
1352     if( ret != 0 )
1353     {
1354         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret );
1355         goto cleanup;
1356     }
1357 
1358     handshake->transform_handshake = transform_handshake;
1359     mbedtls_ssl_set_inbound_transform( ssl, transform_handshake );
1360 
1361     MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to handshake keys for inbound traffic" ) );
1362     ssl->session_in = ssl->session_negotiate;
1363 
1364     /*
1365      * State machine update
1366      */
1367     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS );
1368 
1369 cleanup:
1370 
1371     mbedtls_platform_zeroize( &traffic_keys, sizeof( traffic_keys ) );
1372     if( ret != 0 )
1373     {
1374         mbedtls_free( transform_handshake );
1375 
1376         MBEDTLS_SSL_PEND_FATAL_ALERT(
1377             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1378             MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1379     }
1380     return( ret );
1381 }
1382 
1383 /*
1384  * Wait and parse ServerHello handshake message.
1385  * Handler for MBEDTLS_SSL_SERVER_HELLO
1386  */
ssl_tls13_process_server_hello(mbedtls_ssl_context * ssl)1387 static int ssl_tls13_process_server_hello( mbedtls_ssl_context *ssl )
1388 {
1389     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1390     unsigned char *buf;
1391     size_t buf_len;
1392 
1393     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> %s", __func__ ) );
1394 
1395     /* Coordination step
1396      * - Fetch record
1397      * - Make sure it's either a ServerHello or a HRR.
1398      * - Switch processing routine in case of HRR
1399      */
1400     ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
1401     ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
1402 
1403     ret = ssl_tls13_server_hello_coordinate( ssl, &buf, &buf_len );
1404     /* Parsing step
1405      * We know what message to expect by now and call
1406      * the respective parsing function.
1407      */
1408     if( ret == SSL_SERVER_HELLO_COORDINATE_HELLO )
1409     {
1410         MBEDTLS_SSL_PROC_CHK( ssl_tls13_parse_server_hello( ssl, buf,
1411                                                             buf + buf_len ) );
1412 
1413         mbedtls_ssl_tls13_add_hs_msg_to_checksum( ssl,
1414                                                   MBEDTLS_SSL_HS_SERVER_HELLO,
1415                                                   buf, buf_len );
1416 
1417         MBEDTLS_SSL_PROC_CHK( ssl_tls13_finalize_server_hello( ssl ) );
1418     }
1419     else if( ret == SSL_SERVER_HELLO_COORDINATE_HRR )
1420     {
1421         MBEDTLS_SSL_DEBUG_MSG( 1, ( "HRR not supported" ) );
1422         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ,
1423                                       MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1424         ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1425     }
1426 
1427 cleanup:
1428     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= %s", __func__ ) );
1429     return( ret );
1430 }
1431 
1432 /*
1433  *
1434  * EncryptedExtensions message
1435  *
1436  * The EncryptedExtensions message contains any extensions which
1437  * should be protected, i.e., any which are not needed to establish
1438  * the cryptographic context.
1439  */
1440 
1441 /*
1442  * Overview
1443  */
1444 
1445 /* Main entry point; orchestrates the other functions */
1446 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl );
1447 
1448 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1449                                                  const unsigned char *buf,
1450                                                  const unsigned char *end );
1451 static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl );
1452 
1453 /*
1454  * Handler for  MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
1455  */
ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context * ssl)1456 static int ssl_tls13_process_encrypted_extensions( mbedtls_ssl_context *ssl )
1457 {
1458     int ret;
1459     unsigned char *buf;
1460     size_t buf_len;
1461 
1462     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse encrypted extensions" ) );
1463 
1464     MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( ssl,
1465                                              MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
1466                                              &buf, &buf_len ) );
1467 
1468     /* Process the message contents */
1469     MBEDTLS_SSL_PROC_CHK(
1470         ssl_tls13_parse_encrypted_extensions( ssl, buf, buf + buf_len ) );
1471 
1472     mbedtls_ssl_tls13_add_hs_msg_to_checksum(
1473         ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, buf_len );
1474 
1475     MBEDTLS_SSL_PROC_CHK( ssl_tls13_postprocess_encrypted_extensions( ssl ) );
1476 
1477 cleanup:
1478 
1479     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse encrypted extensions" ) );
1480     return( ret );
1481 
1482 }
1483 
1484 /* Parse EncryptedExtensions message
1485  * struct {
1486  *     Extension extensions<0..2^16-1>;
1487  * } EncryptedExtensions;
1488  */
ssl_tls13_parse_encrypted_extensions(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1489 static int ssl_tls13_parse_encrypted_extensions( mbedtls_ssl_context *ssl,
1490                                                  const unsigned char *buf,
1491                                                  const unsigned char *end )
1492 {
1493     int ret = 0;
1494     size_t extensions_len;
1495     const unsigned char *p = buf;
1496     const unsigned char *extensions_end;
1497 
1498     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
1499     extensions_len = MBEDTLS_GET_UINT16_BE( p, 0 );
1500     p += 2;
1501 
1502     MBEDTLS_SSL_DEBUG_BUF( 3, "encrypted extensions", p, extensions_len );
1503     extensions_end = p + extensions_len;
1504     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, extensions_len );
1505 
1506     while( p < extensions_end )
1507     {
1508         unsigned int extension_type;
1509         size_t extension_data_len;
1510 
1511         /*
1512          * struct {
1513          *     ExtensionType extension_type; (2 bytes)
1514          *     opaque extension_data<0..2^16-1>;
1515          * } Extension;
1516          */
1517         MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, 4 );
1518         extension_type = MBEDTLS_GET_UINT16_BE( p, 0 );
1519         extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 );
1520         p += 4;
1521 
1522         MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len );
1523 
1524         /* The client MUST check EncryptedExtensions for the
1525          * presence of any forbidden extensions and if any are found MUST abort
1526          * the handshake with an "unsupported_extension" alert.
1527          */
1528         switch( extension_type )
1529         {
1530 
1531             case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1532                 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extensions supported groups" ) );
1533                 break;
1534 
1535             default:
1536                 MBEDTLS_SSL_DEBUG_MSG(
1537                     3, ( "unsupported extension found: %u ", extension_type) );
1538                 MBEDTLS_SSL_PEND_FATAL_ALERT(
1539                     MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1540                     MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1541                 return ( MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION );
1542         }
1543 
1544         p += extension_data_len;
1545     }
1546 
1547     /* Check that we consumed all the message. */
1548     if( p != end )
1549     {
1550         MBEDTLS_SSL_DEBUG_MSG( 1, ( "EncryptedExtension lengths misaligned" ) );
1551         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1552                                       MBEDTLS_ERR_SSL_DECODE_ERROR );
1553         return( MBEDTLS_ERR_SSL_DECODE_ERROR );
1554     }
1555 
1556     return( ret );
1557 }
1558 
ssl_tls13_postprocess_encrypted_extensions(mbedtls_ssl_context * ssl)1559 static int ssl_tls13_postprocess_encrypted_extensions( mbedtls_ssl_context *ssl )
1560 {
1561 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1562     if( mbedtls_ssl_tls13_some_psk_enabled( ssl ) )
1563         mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1564     else
1565         mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST );
1566 #else
1567     ((void) ssl);
1568     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1569 #endif
1570     return( 0 );
1571 }
1572 
1573 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1574 /*
1575  * Handler for  MBEDTLS_SSL_CERTIFICATE_REQUEST
1576  */
ssl_tls13_process_certificate_request(mbedtls_ssl_context * ssl)1577 static int ssl_tls13_process_certificate_request( mbedtls_ssl_context *ssl )
1578 {
1579     int ret = mbedtls_ssl_read_record( ssl, 0 );
1580 
1581     if( ret != 0 )
1582     {
1583         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1584         return( ret );
1585     }
1586 
1587     if( ( ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE ) &&
1588         ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ) )
1589     {
1590         MBEDTLS_SSL_DEBUG_MSG( 1, ( "CertificateRequest not supported" ) );
1591         MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1592                                       MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1593         return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
1594     }
1595 
1596     ssl->keep_current_message = 1;
1597     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_CERTIFICATE );
1598 
1599     return( 0 );
1600 }
1601 
1602 /*
1603  * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
1604  */
ssl_tls13_process_server_certificate(mbedtls_ssl_context * ssl)1605 static int ssl_tls13_process_server_certificate( mbedtls_ssl_context *ssl )
1606 {
1607     int ret;
1608 
1609     ret = mbedtls_ssl_tls13_process_certificate( ssl );
1610     if( ret != 0 )
1611         return( ret );
1612 
1613     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY );
1614     return( 0 );
1615 }
1616 
1617 /*
1618  * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
1619  */
ssl_tls13_process_certificate_verify(mbedtls_ssl_context * ssl)1620 static int ssl_tls13_process_certificate_verify( mbedtls_ssl_context *ssl )
1621 {
1622     int ret;
1623 
1624     ret = mbedtls_ssl_tls13_process_certificate_verify( ssl );
1625     if( ret != 0 )
1626         return( ret );
1627 
1628     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_FINISHED );
1629     return( 0 );
1630 }
1631 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1632 
1633 /*
1634  * Handler for MBEDTLS_SSL_SERVER_FINISHED
1635  */
ssl_tls13_process_server_finished(mbedtls_ssl_context * ssl)1636 static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
1637 {
1638     int ret;
1639 
1640     ret = mbedtls_ssl_tls13_process_finished_message( ssl );
1641     if( ret != 0 )
1642         return( ret );
1643 
1644 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1645     mbedtls_ssl_handshake_set_state(
1646         ssl,
1647         MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
1648 #else
1649     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1650 #endif
1651 
1652     return( 0 );
1653 }
1654 
1655 /*
1656  * Handler for MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED
1657  */
1658 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context * ssl)1659 static int ssl_tls13_write_change_cipher_spec( mbedtls_ssl_context *ssl )
1660 {
1661     int ret;
1662 
1663     ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
1664     if( ret != 0 )
1665         return( ret );
1666 
1667     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
1668 
1669     return( 0 );
1670 }
1671 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1672 
1673 /*
1674  * Handler for MBEDTLS_SSL_CLIENT_FINISHED
1675  */
ssl_tls13_write_client_finished(mbedtls_ssl_context * ssl)1676 static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
1677 {
1678     int ret;
1679 
1680     mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
1681 
1682     ret = mbedtls_ssl_tls13_write_finished_message( ssl );
1683     if( ret != 0 )
1684         return( ret );
1685 
1686     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_FLUSH_BUFFERS );
1687     return( 0 );
1688 }
1689 
1690 /*
1691  * Handler for MBEDTLS_SSL_FLUSH_BUFFERS
1692  */
ssl_tls13_flush_buffers(mbedtls_ssl_context * ssl)1693 static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
1694 {
1695     MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
1696     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP );
1697     return( 0 );
1698 }
1699 
1700 /*
1701  * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
1702  */
ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)1703 static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
1704 {
1705     MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for inbound traffic" ) );
1706     mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application );
1707 
1708     MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for outbound traffic" ) );
1709     mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application );
1710 
1711     mbedtls_ssl_tls13_handshake_wrapup( ssl );
1712 
1713     mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HANDSHAKE_OVER );
1714     return( 0 );
1715 }
1716 
mbedtls_ssl_tls13_handshake_client_step(mbedtls_ssl_context * ssl)1717 int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
1718 {
1719     int ret = 0;
1720 
1721     MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 client state: %s(%d)",
1722                                 mbedtls_ssl_states_str( ssl->state ),
1723                                 ssl->state ) );
1724 
1725     switch( ssl->state )
1726     {
1727         /*
1728          * ssl->state is initialized as HELLO_REQUEST. It is the same
1729          * as CLIENT_HELLO state.
1730          */
1731         case MBEDTLS_SSL_HELLO_REQUEST:
1732         case MBEDTLS_SSL_CLIENT_HELLO:
1733             ret = ssl_tls13_write_client_hello( ssl );
1734             break;
1735 
1736         case MBEDTLS_SSL_SERVER_HELLO:
1737             ret = ssl_tls13_process_server_hello( ssl );
1738             break;
1739 
1740         case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
1741             ret = ssl_tls13_process_encrypted_extensions( ssl );
1742             break;
1743 
1744 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1745         case MBEDTLS_SSL_CERTIFICATE_REQUEST:
1746             ret = ssl_tls13_process_certificate_request( ssl );
1747             break;
1748 
1749         case MBEDTLS_SSL_SERVER_CERTIFICATE:
1750             ret = ssl_tls13_process_server_certificate( ssl );
1751             break;
1752 
1753         case MBEDTLS_SSL_CERTIFICATE_VERIFY:
1754             ret = ssl_tls13_process_certificate_verify( ssl );
1755             break;
1756 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1757 
1758         case MBEDTLS_SSL_SERVER_FINISHED:
1759             ret = ssl_tls13_process_server_finished( ssl );
1760             break;
1761 
1762         case MBEDTLS_SSL_CLIENT_FINISHED:
1763             ret = ssl_tls13_write_client_finished( ssl );
1764             break;
1765 
1766         case MBEDTLS_SSL_FLUSH_BUFFERS:
1767             ret = ssl_tls13_flush_buffers( ssl );
1768             break;
1769 
1770         case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
1771             ret = ssl_tls13_handshake_wrapup( ssl );
1772             break;
1773 
1774         /*
1775          * Injection of dummy-CCS's for middlebox compatibility
1776          */
1777 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1778         case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
1779             ret = ssl_tls13_write_change_cipher_spec( ssl );
1780             break;
1781 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1782 
1783         default:
1784             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
1785             return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1786     }
1787 
1788     return( ret );
1789 }
1790 
1791 #endif /* MBEDTLS_SSL_CLI_C */
1792 
1793 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
1794