1 /*
2 * TLS server-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
11
12 #include "mbedtls/platform.h"
13
14 #include "mbedtls/ssl.h"
15 #include "ssl_misc.h"
16 #include "debug_internal.h"
17 #include "mbedtls/error.h"
18 #include "mbedtls/platform_util.h"
19 #include "constant_time_internal.h"
20 #include "mbedtls/constant_time.h"
21
22 #include <string.h>
23
24 #if defined(MBEDTLS_USE_PSA_CRYPTO)
25 /* Define a local translating function to save code size by not using too many
26 * arguments in each translating place. */
27 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) || \
28 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
local_err_translation(psa_status_t status)29 static int local_err_translation(psa_status_t status)
30 {
31 return psa_status_to_mbedtls(status, psa_to_ssl_errors,
32 ARRAY_LENGTH(psa_to_ssl_errors),
33 psa_generic_status_to_mbedtls);
34 }
35 #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
36 #endif
37 #endif
38
39 #if defined(MBEDTLS_ECP_C)
40 #include "mbedtls/ecp.h"
41 #endif
42
43 #if defined(MBEDTLS_HAVE_TIME)
44 #include "mbedtls/platform_time.h"
45 #endif
46
47 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context * ssl,const unsigned char * info,size_t ilen)48 int mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context *ssl,
49 const unsigned char *info,
50 size_t ilen)
51 {
52 if (ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER) {
53 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
54 }
55
56 mbedtls_free(ssl->cli_id);
57
58 if ((ssl->cli_id = mbedtls_calloc(1, ilen)) == NULL) {
59 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
60 }
61
62 memcpy(ssl->cli_id, info, ilen);
63 ssl->cli_id_len = ilen;
64
65 return 0;
66 }
67
mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config * conf,mbedtls_ssl_cookie_write_t * f_cookie_write,mbedtls_ssl_cookie_check_t * f_cookie_check,void * p_cookie)68 void mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config *conf,
69 mbedtls_ssl_cookie_write_t *f_cookie_write,
70 mbedtls_ssl_cookie_check_t *f_cookie_check,
71 void *p_cookie)
72 {
73 conf->f_cookie_write = f_cookie_write;
74 conf->f_cookie_check = f_cookie_check;
75 conf->p_cookie = p_cookie;
76 }
77 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
78
79 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
80 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_conf_has_psk_or_cb(mbedtls_ssl_config const * conf)81 static int ssl_conf_has_psk_or_cb(mbedtls_ssl_config const *conf)
82 {
83 if (conf->f_psk != NULL) {
84 return 1;
85 }
86
87 if (conf->psk_identity_len == 0 || conf->psk_identity == NULL) {
88 return 0;
89 }
90
91
92 #if defined(MBEDTLS_USE_PSA_CRYPTO)
93 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
94 return 1;
95 }
96 #endif /* MBEDTLS_USE_PSA_CRYPTO */
97
98 if (conf->psk != NULL && conf->psk_len != 0) {
99 return 1;
100 }
101
102 return 0;
103 }
104 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
105
106 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_renegotiation_info(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)107 static int ssl_parse_renegotiation_info(mbedtls_ssl_context *ssl,
108 const unsigned char *buf,
109 size_t len)
110 {
111 #if defined(MBEDTLS_SSL_RENEGOTIATION)
112 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
113 /* Check verify-data in constant-time. The length OTOH is no secret */
114 if (len != 1 + ssl->verify_data_len ||
115 buf[0] != ssl->verify_data_len ||
116 mbedtls_ct_memcmp(buf + 1, ssl->peer_verify_data,
117 ssl->verify_data_len) != 0) {
118 MBEDTLS_SSL_DEBUG_MSG(1, ("non-matching renegotiation info"));
119 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
120 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
121 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
122 }
123 } else
124 #endif /* MBEDTLS_SSL_RENEGOTIATION */
125 {
126 if (len != 1 || buf[0] != 0x0) {
127 MBEDTLS_SSL_DEBUG_MSG(1, ("non-zero length renegotiation info"));
128 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
129 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
130 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
131 }
132
133 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
134 }
135
136 return 0;
137 }
138
139 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
140 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
141 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
142 /*
143 * Function for parsing a supported groups (TLS 1.3) or supported elliptic
144 * curves (TLS 1.2) extension.
145 *
146 * The "extension_data" field of a supported groups extension contains a
147 * "NamedGroupList" value (TLS 1.3 RFC8446):
148 * enum {
149 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
150 * x25519(0x001D), x448(0x001E),
151 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
152 * ffdhe6144(0x0103), ffdhe8192(0x0104),
153 * ffdhe_private_use(0x01FC..0x01FF),
154 * ecdhe_private_use(0xFE00..0xFEFF),
155 * (0xFFFF)
156 * } NamedGroup;
157 * struct {
158 * NamedGroup named_group_list<2..2^16-1>;
159 * } NamedGroupList;
160 *
161 * The "extension_data" field of a supported elliptic curves extension contains
162 * a "NamedCurveList" value (TLS 1.2 RFC 8422):
163 * enum {
164 * deprecated(1..22),
165 * secp256r1 (23), secp384r1 (24), secp521r1 (25),
166 * x25519(29), x448(30),
167 * reserved (0xFE00..0xFEFF),
168 * deprecated(0xFF01..0xFF02),
169 * (0xFFFF)
170 * } NamedCurve;
171 * struct {
172 * NamedCurve named_curve_list<2..2^16-1>
173 * } NamedCurveList;
174 *
175 * The TLS 1.3 supported groups extension was defined to be a compatible
176 * generalization of the TLS 1.2 supported elliptic curves extension. They both
177 * share the same extension identifier.
178 *
179 */
180 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_supported_groups_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)181 static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl,
182 const unsigned char *buf,
183 size_t len)
184 {
185 size_t list_size, our_size;
186 const unsigned char *p;
187 uint16_t *curves_tls_id;
188
189 if (len < 2) {
190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
192 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
193 return MBEDTLS_ERR_SSL_DECODE_ERROR;
194 }
195 list_size = MBEDTLS_GET_UINT16_BE(buf, 0);
196 if (list_size + 2 != len ||
197 list_size % 2 != 0) {
198 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
199 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
200 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
201 return MBEDTLS_ERR_SSL_DECODE_ERROR;
202 }
203
204 /* Should never happen unless client duplicates the extension */
205 if (ssl->handshake->curves_tls_id != NULL) {
206 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
207 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
208 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
209 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
210 }
211
212 /* Don't allow our peer to make us allocate too much memory,
213 * and leave room for a final 0 */
214 our_size = list_size / 2 + 1;
215 if (our_size > MBEDTLS_ECP_DP_MAX) {
216 our_size = MBEDTLS_ECP_DP_MAX;
217 }
218
219 if ((curves_tls_id = mbedtls_calloc(our_size,
220 sizeof(*curves_tls_id))) == NULL) {
221 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
222 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
223 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
224 }
225
226 ssl->handshake->curves_tls_id = curves_tls_id;
227
228 p = buf + 2;
229 while (list_size > 0 && our_size > 1) {
230 uint16_t curr_tls_id = MBEDTLS_GET_UINT16_BE(p, 0);
231
232 if (mbedtls_ssl_get_ecp_group_id_from_tls_id(curr_tls_id) !=
233 MBEDTLS_ECP_DP_NONE) {
234 *curves_tls_id++ = curr_tls_id;
235 our_size--;
236 }
237
238 list_size -= 2;
239 p += 2;
240 }
241
242 return 0;
243 }
244
245 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_supported_point_formats(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)246 static int ssl_parse_supported_point_formats(mbedtls_ssl_context *ssl,
247 const unsigned char *buf,
248 size_t len)
249 {
250 size_t list_size;
251 const unsigned char *p;
252
253 if (len == 0 || (size_t) (buf[0] + 1) != len) {
254 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
255 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
256 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
257 return MBEDTLS_ERR_SSL_DECODE_ERROR;
258 }
259 list_size = buf[0];
260
261 p = buf + 1;
262 while (list_size > 0) {
263 if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
264 p[0] == MBEDTLS_ECP_PF_COMPRESSED) {
265 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
266 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
267 ssl->handshake->ecdh_ctx.point_format = p[0];
268 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */
269 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
270 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
271 mbedtls_ecjpake_set_point_format(&ssl->handshake->ecjpake_ctx,
272 p[0]);
273 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
274 MBEDTLS_SSL_DEBUG_MSG(4, ("point format selected: %d", p[0]));
275 return 0;
276 }
277
278 list_size--;
279 p++;
280 }
281
282 return 0;
283 }
284 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
285 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED ||
286 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
287
288 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
289 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_ecjpake_kkpp(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)290 static int ssl_parse_ecjpake_kkpp(mbedtls_ssl_context *ssl,
291 const unsigned char *buf,
292 size_t len)
293 {
294 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
295
296 #if defined(MBEDTLS_USE_PSA_CRYPTO)
297 if (ssl->handshake->psa_pake_ctx_is_ok != 1)
298 #else
299 if (mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0)
300 #endif /* MBEDTLS_USE_PSA_CRYPTO */
301 {
302 MBEDTLS_SSL_DEBUG_MSG(3, ("skip ecjpake kkpp extension"));
303 return 0;
304 }
305
306 #if defined(MBEDTLS_USE_PSA_CRYPTO)
307 if ((ret = mbedtls_psa_ecjpake_read_round(
308 &ssl->handshake->psa_pake_ctx, buf, len,
309 MBEDTLS_ECJPAKE_ROUND_ONE)) != 0) {
310 psa_destroy_key(ssl->handshake->psa_pake_password);
311 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
312
313 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round one", ret);
314 mbedtls_ssl_send_alert_message(
315 ssl,
316 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
317 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
318
319 return ret;
320 }
321 #else
322 if ((ret = mbedtls_ecjpake_read_round_one(&ssl->handshake->ecjpake_ctx,
323 buf, len)) != 0) {
324 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_one", ret);
325 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
326 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
327 return ret;
328 }
329 #endif /* MBEDTLS_USE_PSA_CRYPTO */
330
331 /* Only mark the extension as OK when we're sure it is */
332 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
333
334 return 0;
335 }
336 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
337
338 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
339 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_max_fragment_length_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)340 static int ssl_parse_max_fragment_length_ext(mbedtls_ssl_context *ssl,
341 const unsigned char *buf,
342 size_t len)
343 {
344 if (len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID) {
345 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
346 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
347 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
348 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
349 }
350
351 ssl->session_negotiate->mfl_code = buf[0];
352
353 return 0;
354 }
355 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
356
357 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
358 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_cid_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)359 static int ssl_parse_cid_ext(mbedtls_ssl_context *ssl,
360 const unsigned char *buf,
361 size_t len)
362 {
363 size_t peer_cid_len;
364
365 /* CID extension only makes sense in DTLS */
366 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
367 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
368 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
369 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
370 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
371 }
372
373 /*
374 * struct {
375 * opaque cid<0..2^8-1>;
376 * } ConnectionId;
377 */
378
379 if (len < 1) {
380 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
381 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
382 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
383 return MBEDTLS_ERR_SSL_DECODE_ERROR;
384 }
385
386 peer_cid_len = *buf++;
387 len--;
388
389 if (len != peer_cid_len) {
390 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
391 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
392 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
393 return MBEDTLS_ERR_SSL_DECODE_ERROR;
394 }
395
396 /* Ignore CID if the user has disabled its use. */
397 if (ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) {
398 /* Leave ssl->handshake->cid_in_use in its default
399 * value of MBEDTLS_SSL_CID_DISABLED. */
400 MBEDTLS_SSL_DEBUG_MSG(3, ("Client sent CID extension, but CID disabled"));
401 return 0;
402 }
403
404 if (peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX) {
405 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
406 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
407 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
408 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
409 }
410
411 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
412 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
413 memcpy(ssl->handshake->peer_cid, buf, peer_cid_len);
414
415 MBEDTLS_SSL_DEBUG_MSG(3, ("Use of CID extension negotiated"));
416 MBEDTLS_SSL_DEBUG_BUF(3, "Client CID", buf, peer_cid_len);
417
418 return 0;
419 }
420 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
421
422 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
423 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)424 static int ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context *ssl,
425 const unsigned char *buf,
426 size_t len)
427 {
428 if (len != 0) {
429 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
430 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
431 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
432 return MBEDTLS_ERR_SSL_DECODE_ERROR;
433 }
434
435 ((void) buf);
436
437 if (ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED) {
438 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
439 }
440
441 return 0;
442 }
443 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
444
445 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
446 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_extended_ms_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)447 static int ssl_parse_extended_ms_ext(mbedtls_ssl_context *ssl,
448 const unsigned char *buf,
449 size_t len)
450 {
451 if (len != 0) {
452 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
453 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
454 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
455 return MBEDTLS_ERR_SSL_DECODE_ERROR;
456 }
457
458 ((void) buf);
459
460 if (ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) {
461 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
462 }
463
464 return 0;
465 }
466 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
467
468 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
469 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_session_ticket_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t len)470 static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl,
471 unsigned char *buf,
472 size_t len)
473 {
474 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
475 mbedtls_ssl_session session;
476
477 mbedtls_ssl_session_init(&session);
478
479 if (ssl->conf->f_ticket_parse == NULL ||
480 ssl->conf->f_ticket_write == NULL) {
481 return 0;
482 }
483
484 /* Remember the client asked us to send a new ticket */
485 ssl->handshake->new_session_ticket = 1;
486
487 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket length: %" MBEDTLS_PRINTF_SIZET, len));
488
489 if (len == 0) {
490 return 0;
491 }
492
493 #if defined(MBEDTLS_SSL_RENEGOTIATION)
494 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
495 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket rejected: renegotiating"));
496 return 0;
497 }
498 #endif /* MBEDTLS_SSL_RENEGOTIATION */
499
500 /*
501 * Failures are ok: just ignore the ticket and proceed.
502 */
503 if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket, &session,
504 buf, len)) != 0) {
505 mbedtls_ssl_session_free(&session);
506
507 if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) {
508 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic"));
509 } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) {
510 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired"));
511 } else {
512 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_parse", ret);
513 }
514
515 return 0;
516 }
517
518 /*
519 * Keep the session ID sent by the client, since we MUST send it back to
520 * inform them we're accepting the ticket (RFC 5077 section 3.4)
521 */
522 session.id_len = ssl->session_negotiate->id_len;
523 memcpy(&session.id, ssl->session_negotiate->id, session.id_len);
524
525 mbedtls_ssl_session_free(ssl->session_negotiate);
526 memcpy(ssl->session_negotiate, &session, sizeof(mbedtls_ssl_session));
527
528 /* Zeroize instead of free as we copied the content */
529 mbedtls_platform_zeroize(&session, sizeof(mbedtls_ssl_session));
530
531 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from ticket"));
532
533 ssl->handshake->resume = 1;
534
535 /* Don't send a new ticket after all, this one is OK */
536 ssl->handshake->new_session_ticket = 0;
537
538 return 0;
539 }
540 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
541
542 #if defined(MBEDTLS_SSL_DTLS_SRTP)
543 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_use_srtp_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)544 static int ssl_parse_use_srtp_ext(mbedtls_ssl_context *ssl,
545 const unsigned char *buf,
546 size_t len)
547 {
548 mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET;
549 size_t i, j;
550 size_t profile_length;
551 uint16_t mki_length;
552 /*! 2 bytes for profile length and 1 byte for mki len */
553 const size_t size_of_lengths = 3;
554
555 /* If use_srtp is not configured, just ignore the extension */
556 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) ||
557 (ssl->conf->dtls_srtp_profile_list == NULL) ||
558 (ssl->conf->dtls_srtp_profile_list_len == 0)) {
559 return 0;
560 }
561
562 /* RFC5764 section 4.1.1
563 * uint8 SRTPProtectionProfile[2];
564 *
565 * struct {
566 * SRTPProtectionProfiles SRTPProtectionProfiles;
567 * opaque srtp_mki<0..255>;
568 * } UseSRTPData;
569
570 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
571 */
572
573 /*
574 * Min length is 5: at least one protection profile(2 bytes)
575 * and length(2 bytes) + srtp_mki length(1 byte)
576 * Check here that we have at least 2 bytes of protection profiles length
577 * and one of srtp_mki length
578 */
579 if (len < size_of_lengths) {
580 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
581 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
582 return MBEDTLS_ERR_SSL_DECODE_ERROR;
583 }
584
585 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET;
586
587 /* first 2 bytes are protection profile length(in bytes) */
588 profile_length = (buf[0] << 8) | buf[1];
589 buf += 2;
590
591 /* The profile length cannot be bigger than input buffer size - lengths fields */
592 if (profile_length > len - size_of_lengths ||
593 profile_length % 2 != 0) { /* profiles are 2 bytes long, so the length must be even */
594 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
595 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
596 return MBEDTLS_ERR_SSL_DECODE_ERROR;
597 }
598 /*
599 * parse the extension list values are defined in
600 * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml
601 */
602 for (j = 0; j < profile_length; j += 2) {
603 uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1];
604 client_protection = mbedtls_ssl_check_srtp_profile_value(protection_profile_value);
605
606 if (client_protection != MBEDTLS_TLS_SRTP_UNSET) {
607 MBEDTLS_SSL_DEBUG_MSG(3, ("found srtp profile: %s",
608 mbedtls_ssl_get_srtp_profile_as_string(
609 client_protection)));
610 } else {
611 continue;
612 }
613 /* check if suggested profile is in our list */
614 for (i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++) {
615 if (client_protection == ssl->conf->dtls_srtp_profile_list[i]) {
616 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i];
617 MBEDTLS_SSL_DEBUG_MSG(3, ("selected srtp profile: %s",
618 mbedtls_ssl_get_srtp_profile_as_string(
619 client_protection)));
620 break;
621 }
622 }
623 if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET) {
624 break;
625 }
626 }
627 buf += profile_length; /* buf points to the mki length */
628 mki_length = *buf;
629 buf++;
630
631 if (mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH ||
632 mki_length + profile_length + size_of_lengths != len) {
633 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
634 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
635 return MBEDTLS_ERR_SSL_DECODE_ERROR;
636 }
637
638 /* Parse the mki only if present and mki is supported locally */
639 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED &&
640 mki_length > 0) {
641 ssl->dtls_srtp_info.mki_len = mki_length;
642
643 memcpy(ssl->dtls_srtp_info.mki_value, buf, mki_length);
644
645 MBEDTLS_SSL_DEBUG_BUF(3, "using mki", ssl->dtls_srtp_info.mki_value,
646 ssl->dtls_srtp_info.mki_len);
647 }
648
649 return 0;
650 }
651 #endif /* MBEDTLS_SSL_DTLS_SRTP */
652
653 /*
654 * Auxiliary functions for ServerHello parsing and related actions
655 */
656
657 #if defined(MBEDTLS_X509_CRT_PARSE_C)
658 /*
659 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
660 */
661 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
662 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_check_key_curve(mbedtls_pk_context * pk,uint16_t * curves_tls_id)663 static int ssl_check_key_curve(mbedtls_pk_context *pk,
664 uint16_t *curves_tls_id)
665 {
666 uint16_t *curr_tls_id = curves_tls_id;
667 mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk);
668 mbedtls_ecp_group_id curr_grp_id;
669
670 while (*curr_tls_id != 0) {
671 curr_grp_id = mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id);
672 if (curr_grp_id == grp_id) {
673 return 0;
674 }
675 curr_tls_id++;
676 }
677
678 return -1;
679 }
680 #endif /* MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED */
681
682 /*
683 * Try picking a certificate for this ciphersuite,
684 * return 0 on success and -1 on failure.
685 */
686 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_pick_cert(mbedtls_ssl_context * ssl,const mbedtls_ssl_ciphersuite_t * ciphersuite_info)687 static int ssl_pick_cert(mbedtls_ssl_context *ssl,
688 const mbedtls_ssl_ciphersuite_t *ciphersuite_info)
689 {
690 mbedtls_ssl_key_cert *cur, *list;
691 #if defined(MBEDTLS_USE_PSA_CRYPTO)
692 psa_algorithm_t pk_alg =
693 mbedtls_ssl_get_ciphersuite_sig_pk_psa_alg(ciphersuite_info);
694 psa_key_usage_t pk_usage =
695 mbedtls_ssl_get_ciphersuite_sig_pk_psa_usage(ciphersuite_info);
696 #else
697 mbedtls_pk_type_t pk_alg =
698 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info);
699 #endif /* MBEDTLS_USE_PSA_CRYPTO */
700 uint32_t flags;
701
702 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
703 if (ssl->handshake->sni_key_cert != NULL) {
704 list = ssl->handshake->sni_key_cert;
705 } else
706 #endif
707 list = ssl->conf->key_cert;
708
709 int pk_alg_is_none = 0;
710 #if defined(MBEDTLS_USE_PSA_CRYPTO)
711 pk_alg_is_none = (pk_alg == PSA_ALG_NONE);
712 #else
713 pk_alg_is_none = (pk_alg == MBEDTLS_PK_NONE);
714 #endif /* MBEDTLS_USE_PSA_CRYPTO */
715 if (pk_alg_is_none) {
716 return 0;
717 }
718
719 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite requires certificate"));
720
721 if (list == NULL) {
722 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate"));
723 return -1;
724 }
725
726 for (cur = list; cur != NULL; cur = cur->next) {
727 flags = 0;
728 MBEDTLS_SSL_DEBUG_CRT(3, "candidate certificate chain, certificate",
729 cur->cert);
730
731 int key_type_matches = 0;
732 #if defined(MBEDTLS_USE_PSA_CRYPTO)
733 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
734 key_type_matches = ((ssl->conf->f_async_sign_start != NULL ||
735 ssl->conf->f_async_decrypt_start != NULL ||
736 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)) &&
737 mbedtls_pk_can_do_ext(&cur->cert->pk, pk_alg, pk_usage));
738 #else
739 key_type_matches = (
740 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage));
741 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
742 #else
743 key_type_matches = mbedtls_pk_can_do(&cur->cert->pk, pk_alg);
744 #endif /* MBEDTLS_USE_PSA_CRYPTO */
745 if (!key_type_matches) {
746 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: key type"));
747 continue;
748 }
749
750 /*
751 * This avoids sending the client a cert it'll reject based on
752 * keyUsage or other extensions.
753 *
754 * It also allows the user to provision different certificates for
755 * different uses based on keyUsage, eg if they want to avoid signing
756 * and decrypting with the same RSA key.
757 */
758 if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info,
759 MBEDTLS_SSL_IS_CLIENT,
760 MBEDTLS_SSL_VERSION_TLS1_2,
761 &flags) != 0) {
762 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
763 "(extended) key usage extension"));
764 continue;
765 }
766
767 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
768 if (pk_alg == MBEDTLS_PK_ECDSA &&
769 ssl_check_key_curve(&cur->cert->pk,
770 ssl->handshake->curves_tls_id) != 0) {
771 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: elliptic curve"));
772 continue;
773 }
774 #endif
775
776 /* If we get there, we got a winner */
777 break;
778 }
779
780 /* Do not update ssl->handshake->key_cert unless there is a match */
781 if (cur != NULL) {
782 ssl->handshake->key_cert = cur;
783 MBEDTLS_SSL_DEBUG_CRT(3, "selected certificate chain, certificate",
784 ssl->handshake->key_cert->cert);
785 return 0;
786 }
787
788 return -1;
789 }
790 #endif /* MBEDTLS_X509_CRT_PARSE_C */
791
792 /*
793 * Check if a given ciphersuite is suitable for use with our config/keys/etc
794 * Sets ciphersuite_info only if the suite matches.
795 */
796 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_ciphersuite_match(mbedtls_ssl_context * ssl,int suite_id,const mbedtls_ssl_ciphersuite_t ** ciphersuite_info)797 static int ssl_ciphersuite_match(mbedtls_ssl_context *ssl, int suite_id,
798 const mbedtls_ssl_ciphersuite_t **ciphersuite_info)
799 {
800 const mbedtls_ssl_ciphersuite_t *suite_info;
801
802 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
803 mbedtls_pk_type_t sig_type;
804 #endif
805
806 suite_info = mbedtls_ssl_ciphersuite_from_id(suite_id);
807 if (suite_info == NULL) {
808 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
809 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
810 }
811
812 MBEDTLS_SSL_DEBUG_MSG(3, ("trying ciphersuite: %#04x (%s)",
813 (unsigned int) suite_id, suite_info->name));
814
815 if (suite_info->min_tls_version > ssl->tls_version ||
816 suite_info->max_tls_version < ssl->tls_version) {
817 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: version"));
818 return 0;
819 }
820
821 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
822 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
823 (ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK) == 0) {
824 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: ecjpake "
825 "not configured or ext missing"));
826 return 0;
827 }
828 #endif
829
830
831 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
832 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
833 if (mbedtls_ssl_ciphersuite_uses_ec(suite_info) &&
834 (ssl->handshake->curves_tls_id == NULL ||
835 ssl->handshake->curves_tls_id[0] == 0)) {
836 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: "
837 "no common elliptic curve"));
838 return 0;
839 }
840 #endif
841
842 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
843 /* If the ciphersuite requires a pre-shared key and we don't
844 * have one, skip it now rather than failing later */
845 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) &&
846 ssl_conf_has_psk_or_cb(ssl->conf) == 0) {
847 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no pre-shared key"));
848 return 0;
849 }
850 #endif
851
852 #if defined(MBEDTLS_X509_CRT_PARSE_C)
853 /*
854 * Final check: if ciphersuite requires us to have a
855 * certificate/key of a particular type:
856 * - select the appropriate certificate if we have one, or
857 * - try the next ciphersuite if we don't
858 * This must be done last since we modify the key_cert list.
859 */
860 if (ssl_pick_cert(ssl, suite_info) != 0) {
861 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: "
862 "no suitable certificate"));
863 return 0;
864 }
865 #endif
866
867 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
868 /* If the ciphersuite requires signing, check whether
869 * a suitable hash algorithm is present. */
870 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg(suite_info);
871 if (sig_type != MBEDTLS_PK_NONE &&
872 mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
873 ssl, mbedtls_ssl_sig_from_pk_alg(sig_type)) == MBEDTLS_SSL_HASH_NONE) {
874 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no suitable hash algorithm "
875 "for signature algorithm %u", (unsigned) sig_type));
876 return 0;
877 }
878
879 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
880
881 *ciphersuite_info = suite_info;
882 return 0;
883 }
884
885 /* This function doesn't alert on errors that happen early during
886 ClientHello parsing because they might indicate that the client is
887 not talking SSL/TLS at all and would not understand our alert. */
888 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_hello(mbedtls_ssl_context * ssl)889 static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
890 {
891 int ret, got_common_suite;
892 size_t i, j;
893 size_t ciph_offset, comp_offset, ext_offset;
894 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
895 #if defined(MBEDTLS_SSL_PROTO_DTLS)
896 size_t cookie_offset, cookie_len;
897 #endif
898 unsigned char *buf, *p, *ext;
899 #if defined(MBEDTLS_SSL_RENEGOTIATION)
900 int renegotiation_info_seen = 0;
901 #endif
902 int handshake_failure = 0;
903 const int *ciphersuites;
904 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
905
906 /* If there is no signature-algorithm extension present,
907 * we need to fall back to the default values for allowed
908 * signature-hash pairs. */
909 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
910 int sig_hash_alg_ext_present = 0;
911 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
912
913 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
914
915 int renegotiating;
916
917 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
918 read_record_header:
919 #endif
920 /*
921 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
922 * otherwise read it ourselves manually in order to support SSLv2
923 * ClientHello, which doesn't use the same record layer format.
924 * Otherwise in a scenario of TLS 1.3/TLS 1.2 version negotiation, the
925 * ClientHello has been already fully fetched by the TLS 1.3 code and the
926 * flag ssl->keep_current_message is raised.
927 */
928 renegotiating = 0;
929 #if defined(MBEDTLS_SSL_RENEGOTIATION)
930 renegotiating = (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE);
931 #endif
932 if (!renegotiating && !ssl->keep_current_message) {
933 if ((ret = mbedtls_ssl_fetch_input(ssl, 5)) != 0) {
934 /* No alert on a read error. */
935 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret);
936 return ret;
937 }
938 }
939
940 buf = ssl->in_hdr;
941
942 MBEDTLS_SSL_DEBUG_BUF(4, "record header", buf, mbedtls_ssl_in_hdr_len(ssl));
943
944 /*
945 * TLS Client Hello
946 *
947 * Record layer:
948 * 0 . 0 message type
949 * 1 . 2 protocol version
950 * 3 . 11 DTLS: epoch + record sequence number
951 * 3 . 4 message length
952 */
953 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message type: %d",
954 buf[0]));
955
956 if (buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE) {
957 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
958 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
959 }
960
961 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message len.: %d",
962 MBEDTLS_GET_UINT16_BE(ssl->in_len, 0)));
963
964 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, protocol version: [%d:%d]",
965 buf[1], buf[2]));
966
967 /* For DTLS if this is the initial handshake, remember the client sequence
968 * number to use it in our next message (RFC 6347 4.2.1) */
969 #if defined(MBEDTLS_SSL_PROTO_DTLS)
970 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
971 #if defined(MBEDTLS_SSL_RENEGOTIATION)
972 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
973 #endif
974 ) {
975 /* Epoch should be 0 for initial handshakes */
976 if (ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0) {
977 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
978 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
979 }
980
981 memcpy(&ssl->cur_out_ctr[2], ssl->in_ctr + 2,
982 sizeof(ssl->cur_out_ctr) - 2);
983
984 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
985 if (mbedtls_ssl_dtls_replay_check(ssl) != 0) {
986 MBEDTLS_SSL_DEBUG_MSG(1, ("replayed record, discarding"));
987 ssl->next_record_offset = 0;
988 ssl->in_left = 0;
989 goto read_record_header;
990 }
991
992 /* No MAC to check yet, so we can update right now */
993 mbedtls_ssl_dtls_replay_update(ssl);
994 #endif
995 }
996 #endif /* MBEDTLS_SSL_PROTO_DTLS */
997
998 msg_len = MBEDTLS_GET_UINT16_BE(ssl->in_len, 0);
999
1000 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1001 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
1002 /* Set by mbedtls_ssl_read_record() */
1003 msg_len = ssl->in_hslen;
1004 } else
1005 #endif
1006 {
1007 if (ssl->keep_current_message) {
1008 ssl->keep_current_message = 0;
1009 } else {
1010 if (msg_len > MBEDTLS_SSL_IN_CONTENT_LEN) {
1011 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1012 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1013 }
1014
1015 if ((ret = mbedtls_ssl_fetch_input(ssl,
1016 mbedtls_ssl_in_hdr_len(ssl) + msg_len)) != 0) {
1017 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret);
1018 return ret;
1019 }
1020
1021 /* Done reading this record, get ready for the next one */
1022 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1023 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1024 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len(ssl);
1025 } else
1026 #endif
1027 ssl->in_left = 0;
1028 }
1029 }
1030
1031 buf = ssl->in_msg;
1032
1033 MBEDTLS_SSL_DEBUG_BUF(4, "record contents", buf, msg_len);
1034
1035 ret = ssl->handshake->update_checksum(ssl, buf, msg_len);
1036 if (0 != ret) {
1037 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1038 return ret;
1039 }
1040
1041 /*
1042 * Handshake layer:
1043 * 0 . 0 handshake type
1044 * 1 . 3 handshake length
1045 * 4 . 5 DTLS only: message sequence number
1046 * 6 . 8 DTLS only: fragment offset
1047 * 9 . 11 DTLS only: fragment length
1048 */
1049 if (msg_len < mbedtls_ssl_hs_hdr_len(ssl)) {
1050 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1051 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1052 }
1053
1054 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake type: %d", buf[0]));
1055
1056 if (buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO) {
1057 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1058 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
1059 }
1060 {
1061 size_t handshake_len = MBEDTLS_GET_UINT24_BE(buf, 1);
1062 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake len.: %u",
1063 (unsigned) handshake_len));
1064
1065 /* The record layer has a record size limit of 2^14 - 1 and
1066 * fragmentation is not supported, so buf[1] should be zero. */
1067 if (buf[1] != 0) {
1068 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message: %u != 0",
1069 (unsigned) buf[1]));
1070 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1071 }
1072
1073 /* We don't support fragmentation of ClientHello (yet?) */
1074 if (msg_len != mbedtls_ssl_hs_hdr_len(ssl) + handshake_len) {
1075 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message: %u != %u + %u",
1076 (unsigned) msg_len,
1077 (unsigned) mbedtls_ssl_hs_hdr_len(ssl),
1078 (unsigned) handshake_len));
1079 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1080 }
1081 }
1082
1083 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1084 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1085 /*
1086 * Copy the client's handshake message_seq on initial handshakes,
1087 * check sequence number on renego.
1088 */
1089 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1090 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
1091 /* This couldn't be done in ssl_prepare_handshake_record() */
1092 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4);
1093 if (cli_msg_seq != ssl->handshake->in_msg_seq) {
1094 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message_seq: "
1095 "%u (expected %u)", cli_msg_seq,
1096 ssl->handshake->in_msg_seq));
1097 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1098 }
1099
1100 ssl->handshake->in_msg_seq++;
1101 } else
1102 #endif
1103 {
1104 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4);
1105 ssl->handshake->out_msg_seq = cli_msg_seq;
1106 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1107 }
1108 {
1109 /*
1110 * For now we don't support fragmentation, so make sure
1111 * fragment_offset == 0 and fragment_length == length
1112 */
1113 size_t fragment_offset, fragment_length, length;
1114 fragment_offset = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 6);
1115 fragment_length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 9);
1116 length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 1);
1117 MBEDTLS_SSL_DEBUG_MSG(
1118 4, ("fragment_offset=%u fragment_length=%u length=%u",
1119 (unsigned) fragment_offset, (unsigned) fragment_length,
1120 (unsigned) length));
1121 if (fragment_offset != 0 || length != fragment_length) {
1122 MBEDTLS_SSL_DEBUG_MSG(1, ("ClientHello fragmentation not supported"));
1123 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1124 }
1125 }
1126 }
1127 #endif /* MBEDTLS_SSL_PROTO_DTLS */
1128
1129 buf += mbedtls_ssl_hs_hdr_len(ssl);
1130 msg_len -= mbedtls_ssl_hs_hdr_len(ssl);
1131
1132 /*
1133 * ClientHello layout:
1134 * 0 . 1 protocol version
1135 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1136 * 34 . 34 session id length (1 byte)
1137 * 35 . 34+x session id, where x = session id length from byte 34
1138 * 35+x . 35+x DTLS only: cookie length (1 byte)
1139 * 36+x . .. DTLS only: cookie
1140 * .. . .. ciphersuite list length (2 bytes)
1141 * .. . .. ciphersuite list
1142 * .. . .. compression alg. list length (1 byte)
1143 * .. . .. compression alg. list
1144 * .. . .. extensions length (2 bytes, optional)
1145 * .. . .. extensions (optional)
1146 */
1147
1148 /*
1149 * Minimal length (with everything empty and extensions omitted) is
1150 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1151 * read at least up to session id length without worrying.
1152 */
1153 if (msg_len < 38) {
1154 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1155 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1156 }
1157
1158 /*
1159 * Check and save the protocol version
1160 */
1161 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, version", buf, 2);
1162
1163 ssl->tls_version = (mbedtls_ssl_protocol_version) mbedtls_ssl_read_version(buf,
1164 ssl->conf->transport);
1165 ssl->session_negotiate->tls_version = ssl->tls_version;
1166 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
1167
1168 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
1169 MBEDTLS_SSL_DEBUG_MSG(1, ("server only supports TLS 1.2"));
1170 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1171 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION);
1172 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1173 }
1174
1175 /*
1176 * Save client random (inc. Unix time)
1177 */
1178 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes", buf + 2, 32);
1179
1180 memcpy(ssl->handshake->randbytes, buf + 2, 32);
1181
1182 /*
1183 * Check the session ID length and save session ID
1184 */
1185 sess_len = buf[34];
1186
1187 if (sess_len > sizeof(ssl->session_negotiate->id) ||
1188 sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */
1189 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1190 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1191 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1192 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1193 }
1194
1195 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id", buf + 35, sess_len);
1196
1197 ssl->session_negotiate->id_len = sess_len;
1198 memset(ssl->session_negotiate->id, 0,
1199 sizeof(ssl->session_negotiate->id));
1200 memcpy(ssl->session_negotiate->id, buf + 35,
1201 ssl->session_negotiate->id_len);
1202
1203 /*
1204 * Check the cookie length and content
1205 */
1206 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1207 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1208 cookie_offset = 35 + sess_len;
1209 cookie_len = buf[cookie_offset];
1210
1211 if (cookie_offset + 1 + cookie_len + 2 > msg_len) {
1212 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1213 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1214 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1215 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1216 }
1217
1218 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie",
1219 buf + cookie_offset + 1, cookie_len);
1220
1221 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
1222 if (ssl->conf->f_cookie_check != NULL
1223 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1224 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
1225 #endif
1226 ) {
1227 if (ssl->conf->f_cookie_check(ssl->conf->p_cookie,
1228 buf + cookie_offset + 1, cookie_len,
1229 ssl->cli_id, ssl->cli_id_len) != 0) {
1230 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification failed"));
1231 ssl->handshake->cookie_verify_result = 1;
1232 } else {
1233 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification passed"));
1234 ssl->handshake->cookie_verify_result = 0;
1235 }
1236 } else
1237 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
1238 {
1239 /* We know we didn't send a cookie, so it should be empty */
1240 if (cookie_len != 0) {
1241 /* This may be an attacker's probe, so don't send an alert */
1242 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1243 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1244 }
1245
1246 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification skipped"));
1247 }
1248
1249 /*
1250 * Check the ciphersuitelist length (will be parsed later)
1251 */
1252 ciph_offset = cookie_offset + 1 + cookie_len;
1253 } else
1254 #endif /* MBEDTLS_SSL_PROTO_DTLS */
1255 ciph_offset = 35 + sess_len;
1256
1257 ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset);
1258
1259 if (ciph_len < 2 ||
1260 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1261 (ciph_len % 2) != 0) {
1262 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1263 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1264 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1265 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1266 }
1267
1268 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, ciphersuitelist",
1269 buf + ciph_offset + 2, ciph_len);
1270
1271 /*
1272 * Check the compression algorithm's length.
1273 * The list contents are ignored because implementing
1274 * MBEDTLS_SSL_COMPRESS_NULL is mandatory and is the only
1275 * option supported by Mbed TLS.
1276 */
1277 comp_offset = ciph_offset + 2 + ciph_len;
1278
1279 comp_len = buf[comp_offset];
1280
1281 if (comp_len < 1 ||
1282 comp_len > 16 ||
1283 comp_len + comp_offset + 1 > msg_len) {
1284 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1285 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1286 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1287 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1288 }
1289
1290 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, compression",
1291 buf + comp_offset + 1, comp_len);
1292
1293 /*
1294 * Check the extension length
1295 */
1296 ext_offset = comp_offset + 1 + comp_len;
1297 if (msg_len > ext_offset) {
1298 if (msg_len < ext_offset + 2) {
1299 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1300 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1301 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1302 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1303 }
1304
1305 ext_len = MBEDTLS_GET_UINT16_BE(buf, ext_offset);
1306
1307 if (msg_len != ext_offset + 2 + ext_len) {
1308 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1309 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1310 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1311 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1312 }
1313 } else {
1314 ext_len = 0;
1315 }
1316
1317 ext = buf + ext_offset + 2;
1318 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", ext, ext_len);
1319
1320 while (ext_len != 0) {
1321 unsigned int ext_id;
1322 unsigned int ext_size;
1323 if (ext_len < 4) {
1324 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1325 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1326 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1327 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1328 }
1329 ext_id = MBEDTLS_GET_UINT16_BE(ext, 0);
1330 ext_size = MBEDTLS_GET_UINT16_BE(ext, 2);
1331
1332 if (ext_size + 4 > ext_len) {
1333 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1334 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1335 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1336 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1337 }
1338 switch (ext_id) {
1339 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1340 case MBEDTLS_TLS_EXT_SERVERNAME:
1341 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension"));
1342 ret = mbedtls_ssl_parse_server_name_ext(ssl, ext + 4,
1343 ext + 4 + ext_size);
1344 if (ret != 0) {
1345 return ret;
1346 }
1347 break;
1348 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1349
1350 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1351 MBEDTLS_SSL_DEBUG_MSG(3, ("found renegotiation extension"));
1352 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1353 renegotiation_info_seen = 1;
1354 #endif
1355
1356 ret = ssl_parse_renegotiation_info(ssl, ext + 4, ext_size);
1357 if (ret != 0) {
1358 return ret;
1359 }
1360 break;
1361
1362 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1363 case MBEDTLS_TLS_EXT_SIG_ALG:
1364 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension"));
1365
1366 ret = mbedtls_ssl_parse_sig_alg_ext(ssl, ext + 4, ext + 4 + ext_size);
1367 if (ret != 0) {
1368 return ret;
1369 }
1370
1371 sig_hash_alg_ext_present = 1;
1372 break;
1373 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1374
1375 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
1376 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
1377 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1378 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1379 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported elliptic curves extension"));
1380
1381 ret = ssl_parse_supported_groups_ext(ssl, ext + 4, ext_size);
1382 if (ret != 0) {
1383 return ret;
1384 }
1385 break;
1386
1387 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1388 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported point formats extension"));
1389 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
1390
1391 ret = ssl_parse_supported_point_formats(ssl, ext + 4, ext_size);
1392 if (ret != 0) {
1393 return ret;
1394 }
1395 break;
1396 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || \
1397 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED ||
1398 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1399
1400 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1401 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1402 MBEDTLS_SSL_DEBUG_MSG(3, ("found ecjpake kkpp extension"));
1403
1404 ret = ssl_parse_ecjpake_kkpp(ssl, ext + 4, ext_size);
1405 if (ret != 0) {
1406 return ret;
1407 }
1408 break;
1409 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1410
1411 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1412 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1413 MBEDTLS_SSL_DEBUG_MSG(3, ("found max fragment length extension"));
1414
1415 ret = ssl_parse_max_fragment_length_ext(ssl, ext + 4, ext_size);
1416 if (ret != 0) {
1417 return ret;
1418 }
1419 break;
1420 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1421
1422 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
1423 case MBEDTLS_TLS_EXT_CID:
1424 MBEDTLS_SSL_DEBUG_MSG(3, ("found CID extension"));
1425
1426 ret = ssl_parse_cid_ext(ssl, ext + 4, ext_size);
1427 if (ret != 0) {
1428 return ret;
1429 }
1430 break;
1431 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1432
1433 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1434 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1435 MBEDTLS_SSL_DEBUG_MSG(3, ("found encrypt then mac extension"));
1436
1437 ret = ssl_parse_encrypt_then_mac_ext(ssl, ext + 4, ext_size);
1438 if (ret != 0) {
1439 return ret;
1440 }
1441 break;
1442 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1443
1444 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1445 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1446 MBEDTLS_SSL_DEBUG_MSG(3, ("found extended master secret extension"));
1447
1448 ret = ssl_parse_extended_ms_ext(ssl, ext + 4, ext_size);
1449 if (ret != 0) {
1450 return ret;
1451 }
1452 break;
1453 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1454
1455 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1456 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1457 MBEDTLS_SSL_DEBUG_MSG(3, ("found session ticket extension"));
1458
1459 ret = ssl_parse_session_ticket_ext(ssl, ext + 4, ext_size);
1460 if (ret != 0) {
1461 return ret;
1462 }
1463 break;
1464 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1465
1466 #if defined(MBEDTLS_SSL_ALPN)
1467 case MBEDTLS_TLS_EXT_ALPN:
1468 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension"));
1469
1470 ret = mbedtls_ssl_parse_alpn_ext(ssl, ext + 4,
1471 ext + 4 + ext_size);
1472 if (ret != 0) {
1473 return ret;
1474 }
1475 break;
1476 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1477
1478 #if defined(MBEDTLS_SSL_DTLS_SRTP)
1479 case MBEDTLS_TLS_EXT_USE_SRTP:
1480 MBEDTLS_SSL_DEBUG_MSG(3, ("found use_srtp extension"));
1481
1482 ret = ssl_parse_use_srtp_ext(ssl, ext + 4, ext_size);
1483 if (ret != 0) {
1484 return ret;
1485 }
1486 break;
1487 #endif /* MBEDTLS_SSL_DTLS_SRTP */
1488
1489 default:
1490 MBEDTLS_SSL_DEBUG_MSG(3, ("unknown extension found: %u (ignoring)",
1491 ext_id));
1492 }
1493
1494 ext_len -= 4 + ext_size;
1495 ext += 4 + ext_size;
1496 }
1497
1498 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1499
1500 /*
1501 * Try to fall back to default hash SHA1 if the client
1502 * hasn't provided any preferred signature-hash combinations.
1503 */
1504 if (!sig_hash_alg_ext_present) {
1505 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
1506 const uint16_t default_sig_algs[] = {
1507 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
1508 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA,
1509 MBEDTLS_SSL_HASH_SHA1),
1510 #endif
1511 #if defined(MBEDTLS_RSA_C)
1512 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA,
1513 MBEDTLS_SSL_HASH_SHA1),
1514 #endif
1515 MBEDTLS_TLS_SIG_NONE
1516 };
1517
1518 MBEDTLS_STATIC_ASSERT(sizeof(default_sig_algs) / sizeof(default_sig_algs[0])
1519 <= MBEDTLS_RECEIVED_SIG_ALGS_SIZE,
1520 "default_sig_algs is too big");
1521
1522 memcpy(received_sig_algs, default_sig_algs, sizeof(default_sig_algs));
1523 }
1524
1525 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1526
1527 /*
1528 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1529 */
1530 for (i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2) {
1531 if (p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO) {
1532 MBEDTLS_SSL_DEBUG_MSG(3, ("received TLS_EMPTY_RENEGOTIATION_INFO "));
1533 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1534 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
1535 MBEDTLS_SSL_DEBUG_MSG(1, ("received RENEGOTIATION SCSV "
1536 "during renegotiation"));
1537 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1538 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1539 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1540 }
1541 #endif
1542 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
1543 break;
1544 }
1545 }
1546
1547 /*
1548 * Renegotiation security checks
1549 */
1550 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
1551 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) {
1552 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation, breaking off handshake"));
1553 handshake_failure = 1;
1554 }
1555 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1556 else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1557 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
1558 renegotiation_info_seen == 0) {
1559 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension missing (secure)"));
1560 handshake_failure = 1;
1561 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1562 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1563 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) {
1564 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation not allowed"));
1565 handshake_failure = 1;
1566 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1567 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1568 renegotiation_info_seen == 1) {
1569 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension present (legacy)"));
1570 handshake_failure = 1;
1571 }
1572 #endif /* MBEDTLS_SSL_RENEGOTIATION */
1573
1574 if (handshake_failure == 1) {
1575 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1576 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1577 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1578 }
1579
1580 /*
1581 * Server certification selection (after processing TLS extensions)
1582 */
1583 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) {
1584 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret);
1585 return ret;
1586 }
1587 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1588 ssl->handshake->sni_name = NULL;
1589 ssl->handshake->sni_name_len = 0;
1590 #endif
1591
1592 /*
1593 * Search for a matching ciphersuite
1594 * (At the end because we need information from the EC-based extensions
1595 * and certificate from the SNI callback triggered by the SNI extension
1596 * or certificate from server certificate selection callback.)
1597 */
1598 got_common_suite = 0;
1599 ciphersuites = ssl->conf->ciphersuite_list;
1600 ciphersuite_info = NULL;
1601
1602 if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT) {
1603 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) {
1604 for (i = 0; ciphersuites[i] != 0; i++) {
1605 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) {
1606 continue;
1607 }
1608
1609 got_common_suite = 1;
1610
1611 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i],
1612 &ciphersuite_info)) != 0) {
1613 return ret;
1614 }
1615
1616 if (ciphersuite_info != NULL) {
1617 goto have_ciphersuite;
1618 }
1619 }
1620 }
1621 } else {
1622 for (i = 0; ciphersuites[i] != 0; i++) {
1623 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) {
1624 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) {
1625 continue;
1626 }
1627
1628 got_common_suite = 1;
1629
1630 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i],
1631 &ciphersuite_info)) != 0) {
1632 return ret;
1633 }
1634
1635 if (ciphersuite_info != NULL) {
1636 goto have_ciphersuite;
1637 }
1638 }
1639 }
1640 }
1641
1642 if (got_common_suite) {
1643 MBEDTLS_SSL_DEBUG_MSG(1, ("got ciphersuites in common, "
1644 "but none of them usable"));
1645 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1646 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1647 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1648 } else {
1649 MBEDTLS_SSL_DEBUG_MSG(1, ("got no ciphersuites in common"));
1650 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1651 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1652 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1653 }
1654
1655 have_ciphersuite:
1656 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %s", ciphersuite_info->name));
1657
1658 ssl->session_negotiate->ciphersuite = ciphersuites[i];
1659 ssl->handshake->ciphersuite_info = ciphersuite_info;
1660
1661 ssl->state++;
1662
1663 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1664 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1665 mbedtls_ssl_recv_flight_completed(ssl);
1666 }
1667 #endif
1668
1669 /* Debugging-only output for testsuite */
1670 #if defined(MBEDTLS_DEBUG_C) && \
1671 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1672 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg(ciphersuite_info);
1673 if (sig_alg != MBEDTLS_PK_NONE) {
1674 unsigned int sig_hash = mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
1675 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg));
1676 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext: %u",
1677 sig_hash));
1678 } else {
1679 MBEDTLS_SSL_DEBUG_MSG(3, ("no hash algorithm for signature algorithm "
1680 "%u - should not happen", (unsigned) sig_alg));
1681 }
1682 #endif
1683
1684 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello"));
1685
1686 return 0;
1687 }
1688
1689 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
ssl_write_cid_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1690 static void ssl_write_cid_ext(mbedtls_ssl_context *ssl,
1691 unsigned char *buf,
1692 size_t *olen)
1693 {
1694 unsigned char *p = buf;
1695 size_t ext_len;
1696 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1697
1698 *olen = 0;
1699
1700 /* Skip writing the extension if we don't want to use it or if
1701 * the client hasn't offered it. */
1702 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED) {
1703 return;
1704 }
1705
1706 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
1707 * which is at most 255, so the increment cannot overflow. */
1708 if (end < p || (size_t) (end - p) < (unsigned) (ssl->own_cid_len + 5)) {
1709 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
1710 return;
1711 }
1712
1713 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding CID extension"));
1714
1715 /*
1716 * struct {
1717 * opaque cid<0..2^8-1>;
1718 * } ConnectionId;
1719 */
1720 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_CID, p, 0);
1721 p += 2;
1722 ext_len = (size_t) ssl->own_cid_len + 1;
1723 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0);
1724 p += 2;
1725
1726 *p++ = (uint8_t) ssl->own_cid_len;
1727 memcpy(p, ssl->own_cid, ssl->own_cid_len);
1728
1729 *olen = ssl->own_cid_len + 5;
1730 }
1731 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1732
1733 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1734 static void ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context *ssl,
1735 unsigned char *buf,
1736 size_t *olen)
1737 {
1738 unsigned char *p = buf;
1739 const mbedtls_ssl_ciphersuite_t *suite = NULL;
1740
1741 /*
1742 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
1743 * from a client and then selects a stream or Authenticated Encryption
1744 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
1745 * encrypt-then-MAC response extension back to the client."
1746 */
1747 suite = mbedtls_ssl_ciphersuite_from_id(
1748 ssl->session_negotiate->ciphersuite);
1749 if (suite == NULL) {
1750 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
1751 } else {
1752 mbedtls_ssl_mode_t ssl_mode =
1753 mbedtls_ssl_get_mode_from_ciphersuite(
1754 ssl->session_negotiate->encrypt_then_mac,
1755 suite);
1756
1757 if (ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM) {
1758 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
1759 }
1760 }
1761
1762 if (ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED) {
1763 *olen = 0;
1764 return;
1765 }
1766
1767 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding encrypt then mac extension"));
1768
1769 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC, p, 0);
1770 p += 2;
1771
1772 *p++ = 0x00;
1773 *p++ = 0x00;
1774
1775 *olen = 4;
1776 }
1777 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
1778
1779 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
ssl_write_extended_ms_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1780 static void ssl_write_extended_ms_ext(mbedtls_ssl_context *ssl,
1781 unsigned char *buf,
1782 size_t *olen)
1783 {
1784 unsigned char *p = buf;
1785
1786 if (ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED) {
1787 *olen = 0;
1788 return;
1789 }
1790
1791 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding extended master secret "
1792 "extension"));
1793
1794 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET, p, 0);
1795 p += 2;
1796
1797 *p++ = 0x00;
1798 *p++ = 0x00;
1799
1800 *olen = 4;
1801 }
1802 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1803
1804 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
ssl_write_session_ticket_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1805 static void ssl_write_session_ticket_ext(mbedtls_ssl_context *ssl,
1806 unsigned char *buf,
1807 size_t *olen)
1808 {
1809 unsigned char *p = buf;
1810
1811 if (ssl->handshake->new_session_ticket == 0) {
1812 *olen = 0;
1813 return;
1814 }
1815
1816 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding session ticket extension"));
1817
1818 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SESSION_TICKET, p, 0);
1819 p += 2;
1820
1821 *p++ = 0x00;
1822 *p++ = 0x00;
1823
1824 *olen = 4;
1825 }
1826 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1827
ssl_write_renegotiation_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1828 static void ssl_write_renegotiation_ext(mbedtls_ssl_context *ssl,
1829 unsigned char *buf,
1830 size_t *olen)
1831 {
1832 unsigned char *p = buf;
1833
1834 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION) {
1835 *olen = 0;
1836 return;
1837 }
1838
1839 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, secure renegotiation extension"));
1840
1841 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_RENEGOTIATION_INFO, p, 0);
1842 p += 2;
1843
1844 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1845 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
1846 *p++ = 0x00;
1847 *p++ = (ssl->verify_data_len * 2 + 1) & 0xFF;
1848 *p++ = ssl->verify_data_len * 2 & 0xFF;
1849
1850 memcpy(p, ssl->peer_verify_data, ssl->verify_data_len);
1851 p += ssl->verify_data_len;
1852 memcpy(p, ssl->own_verify_data, ssl->verify_data_len);
1853 p += ssl->verify_data_len;
1854 } else
1855 #endif /* MBEDTLS_SSL_RENEGOTIATION */
1856 {
1857 *p++ = 0x00;
1858 *p++ = 0x01;
1859 *p++ = 0x00;
1860 }
1861
1862 *olen = (size_t) (p - buf);
1863 }
1864
1865 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
ssl_write_max_fragment_length_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1866 static void ssl_write_max_fragment_length_ext(mbedtls_ssl_context *ssl,
1867 unsigned char *buf,
1868 size_t *olen)
1869 {
1870 unsigned char *p = buf;
1871
1872 if (ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE) {
1873 *olen = 0;
1874 return;
1875 }
1876
1877 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, max_fragment_length extension"));
1878
1879 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH, p, 0);
1880 p += 2;
1881
1882 *p++ = 0x00;
1883 *p++ = 1;
1884
1885 *p++ = ssl->session_negotiate->mfl_code;
1886
1887 *olen = 5;
1888 }
1889 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1890
1891 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
1892 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
1893 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_supported_point_formats_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1894 static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl,
1895 unsigned char *buf,
1896 size_t *olen)
1897 {
1898 unsigned char *p = buf;
1899 ((void) ssl);
1900
1901 if ((ssl->handshake->cli_exts &
1902 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT) == 0) {
1903 *olen = 0;
1904 return;
1905 }
1906
1907 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, supported_point_formats extension"));
1908
1909 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS, p, 0);
1910 p += 2;
1911
1912 *p++ = 0x00;
1913 *p++ = 2;
1914
1915 *p++ = 1;
1916 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
1917
1918 *olen = 6;
1919 }
1920 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
1921 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED ||
1922 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1923
1924 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1925 static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
1926 unsigned char *buf,
1927 size_t *olen)
1928 {
1929 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1930 unsigned char *p = buf;
1931 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1932 size_t kkpp_len;
1933
1934 *olen = 0;
1935
1936 /* Skip costly computation if not needed */
1937 if (ssl->handshake->ciphersuite_info->key_exchange !=
1938 MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
1939 return;
1940 }
1941
1942 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension"));
1943
1944 if (end - p < 4) {
1945 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
1946 return;
1947 }
1948
1949 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0);
1950 p += 2;
1951
1952 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1953 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx,
1954 p + 2, (size_t) (end - p - 2), &kkpp_len,
1955 MBEDTLS_ECJPAKE_ROUND_ONE);
1956 if (ret != 0) {
1957 psa_destroy_key(ssl->handshake->psa_pake_password);
1958 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
1959 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret);
1960 return;
1961 }
1962 #else
1963 ret = mbedtls_ecjpake_write_round_one(&ssl->handshake->ecjpake_ctx,
1964 p + 2, (size_t) (end - p - 2), &kkpp_len,
1965 ssl->conf->f_rng, ssl->conf->p_rng);
1966 if (ret != 0) {
1967 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_one", ret);
1968 return;
1969 }
1970 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1971
1972 MBEDTLS_PUT_UINT16_BE(kkpp_len, p, 0);
1973 p += 2;
1974
1975 *olen = kkpp_len + 4;
1976 }
1977 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1978
1979 #if defined(MBEDTLS_SSL_DTLS_SRTP) && defined(MBEDTLS_SSL_PROTO_DTLS)
ssl_write_use_srtp_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1980 static void ssl_write_use_srtp_ext(mbedtls_ssl_context *ssl,
1981 unsigned char *buf,
1982 size_t *olen)
1983 {
1984 size_t mki_len = 0, ext_len = 0;
1985 uint16_t profile_value = 0;
1986 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1987
1988 *olen = 0;
1989
1990 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) ||
1991 (ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET)) {
1992 return;
1993 }
1994
1995 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding use_srtp extension"));
1996
1997 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED) {
1998 mki_len = ssl->dtls_srtp_info.mki_len;
1999 }
2000
2001 /* The extension total size is 9 bytes :
2002 * - 2 bytes for the extension tag
2003 * - 2 bytes for the total size
2004 * - 2 bytes for the protection profile length
2005 * - 2 bytes for the protection profile
2006 * - 1 byte for the mki length
2007 * + the actual mki length
2008 * Check we have enough room in the output buffer */
2009 if ((size_t) (end - buf) < mki_len + 9) {
2010 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
2011 return;
2012 }
2013
2014 /* extension */
2015 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_USE_SRTP, buf, 0);
2016 /*
2017 * total length 5 and mki value: only one profile(2 bytes)
2018 * and length(2 bytes) and srtp_mki )
2019 */
2020 ext_len = 5 + mki_len;
2021 MBEDTLS_PUT_UINT16_BE(ext_len, buf, 2);
2022
2023 /* protection profile length: 2 */
2024 buf[4] = 0x00;
2025 buf[5] = 0x02;
2026 profile_value = mbedtls_ssl_check_srtp_profile_value(
2027 ssl->dtls_srtp_info.chosen_dtls_srtp_profile);
2028 if (profile_value != MBEDTLS_TLS_SRTP_UNSET) {
2029 MBEDTLS_PUT_UINT16_BE(profile_value, buf, 6);
2030 } else {
2031 MBEDTLS_SSL_DEBUG_MSG(1, ("use_srtp extension invalid profile"));
2032 return;
2033 }
2034
2035 buf[8] = mki_len & 0xFF;
2036 memcpy(&buf[9], ssl->dtls_srtp_info.mki_value, mki_len);
2037
2038 *olen = 9 + mki_len;
2039 }
2040 #endif /* MBEDTLS_SSL_DTLS_SRTP */
2041
2042 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2043 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_hello_verify_request(mbedtls_ssl_context * ssl)2044 static int ssl_write_hello_verify_request(mbedtls_ssl_context *ssl)
2045 {
2046 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2047 unsigned char *p = ssl->out_msg + 4;
2048 unsigned char *cookie_len_byte;
2049
2050 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello verify request"));
2051
2052 /*
2053 * struct {
2054 * ProtocolVersion server_version;
2055 * opaque cookie<0..2^8-1>;
2056 * } HelloVerifyRequest;
2057 */
2058
2059 /* The RFC is not clear on this point, but sending the actual negotiated
2060 * version looks like the most interoperable thing to do. */
2061 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version);
2062 MBEDTLS_SSL_DEBUG_BUF(3, "server version", p, 2);
2063 p += 2;
2064
2065 /* If we get here, f_cookie_check is not null */
2066 if (ssl->conf->f_cookie_write == NULL) {
2067 MBEDTLS_SSL_DEBUG_MSG(1, ("inconsistent cookie callbacks"));
2068 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2069 }
2070
2071 /* Skip length byte until we know the length */
2072 cookie_len_byte = p++;
2073
2074 if ((ret = ssl->conf->f_cookie_write(ssl->conf->p_cookie,
2075 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN,
2076 ssl->cli_id, ssl->cli_id_len)) != 0) {
2077 MBEDTLS_SSL_DEBUG_RET(1, "f_cookie_write", ret);
2078 return ret;
2079 }
2080
2081 *cookie_len_byte = (unsigned char) (p - (cookie_len_byte + 1));
2082
2083 MBEDTLS_SSL_DEBUG_BUF(3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte);
2084
2085 ssl->out_msglen = (size_t) (p - ssl->out_msg);
2086 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2087 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
2088
2089 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
2090
2091 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
2092 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
2093 return ret;
2094 }
2095
2096 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2097 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2098 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
2099 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
2100 return ret;
2101 }
2102 #endif /* MBEDTLS_SSL_PROTO_DTLS */
2103
2104 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello verify request"));
2105
2106 return 0;
2107 }
2108 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
2109
ssl_handle_id_based_session_resumption(mbedtls_ssl_context * ssl)2110 static void ssl_handle_id_based_session_resumption(mbedtls_ssl_context *ssl)
2111 {
2112 int ret;
2113 mbedtls_ssl_session session_tmp;
2114 mbedtls_ssl_session * const session = ssl->session_negotiate;
2115
2116 /* Resume is 0 by default, see ssl_handshake_init().
2117 * It may be already set to 1 by ssl_parse_session_ticket_ext(). */
2118 if (ssl->handshake->resume == 1) {
2119 return;
2120 }
2121 if (session->id_len == 0) {
2122 return;
2123 }
2124 if (ssl->conf->f_get_cache == NULL) {
2125 return;
2126 }
2127 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2128 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
2129 return;
2130 }
2131 #endif
2132
2133 mbedtls_ssl_session_init(&session_tmp);
2134
2135 ret = ssl->conf->f_get_cache(ssl->conf->p_cache,
2136 session->id,
2137 session->id_len,
2138 &session_tmp);
2139 if (ret != 0) {
2140 goto exit;
2141 }
2142
2143 if (session->ciphersuite != session_tmp.ciphersuite) {
2144 /* Mismatch between cached and negotiated session */
2145 goto exit;
2146 }
2147
2148 /* Move semantics */
2149 mbedtls_ssl_session_free(session);
2150 *session = session_tmp;
2151 memset(&session_tmp, 0, sizeof(session_tmp));
2152
2153 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from cache"));
2154 ssl->handshake->resume = 1;
2155
2156 exit:
2157
2158 mbedtls_ssl_session_free(&session_tmp);
2159 }
2160
2161 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_server_hello(mbedtls_ssl_context * ssl)2162 static int ssl_write_server_hello(mbedtls_ssl_context *ssl)
2163 {
2164 #if defined(MBEDTLS_HAVE_TIME)
2165 mbedtls_time_t t;
2166 #endif
2167 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2168 size_t olen, ext_len = 0, n;
2169 unsigned char *buf, *p;
2170
2171 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello"));
2172
2173 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2174 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2175 ssl->handshake->cookie_verify_result != 0) {
2176 MBEDTLS_SSL_DEBUG_MSG(2, ("client hello was not authenticated"));
2177 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2178
2179 return ssl_write_hello_verify_request(ssl);
2180 }
2181 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
2182
2183 /*
2184 * 0 . 0 handshake type
2185 * 1 . 3 handshake length
2186 * 4 . 5 protocol version
2187 * 6 . 9 UNIX time()
2188 * 10 . 37 random bytes
2189 */
2190 buf = ssl->out_msg;
2191 p = buf + 4;
2192
2193 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version);
2194 p += 2;
2195
2196 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen version: [%d:%d]",
2197 buf[4], buf[5]));
2198
2199 #if defined(MBEDTLS_HAVE_TIME)
2200 t = mbedtls_time(NULL);
2201 MBEDTLS_PUT_UINT32_BE(t, p, 0);
2202 p += 4;
2203
2204 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
2205 (long long) t));
2206 #else
2207 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 4)) != 0) {
2208 return ret;
2209 }
2210
2211 p += 4;
2212 #endif /* MBEDTLS_HAVE_TIME */
2213
2214 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 20)) != 0) {
2215 return ret;
2216 }
2217 p += 20;
2218
2219 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
2220 /*
2221 * RFC 8446
2222 * TLS 1.3 has a downgrade protection mechanism embedded in the server's
2223 * random value. TLS 1.3 servers which negotiate TLS 1.2 or below in
2224 * response to a ClientHello MUST set the last 8 bytes of their Random
2225 * value specially in their ServerHello.
2226 */
2227 if (mbedtls_ssl_conf_is_tls13_enabled(ssl->conf)) {
2228 static const unsigned char magic_tls12_downgrade_string[] =
2229 { 'D', 'O', 'W', 'N', 'G', 'R', 'D', 1 };
2230
2231 MBEDTLS_STATIC_ASSERT(
2232 sizeof(magic_tls12_downgrade_string) == 8,
2233 "magic_tls12_downgrade_string does not have the expected size");
2234
2235 memcpy(p, magic_tls12_downgrade_string,
2236 sizeof(magic_tls12_downgrade_string));
2237 } else
2238 #endif
2239 {
2240 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 8)) != 0) {
2241 return ret;
2242 }
2243 }
2244 p += 8;
2245
2246 memcpy(ssl->handshake->randbytes + 32, buf + 6, 32);
2247
2248 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", buf + 6, 32);
2249
2250 ssl_handle_id_based_session_resumption(ssl);
2251
2252 if (ssl->handshake->resume == 0) {
2253 /*
2254 * New session, create a new session id,
2255 * unless we're about to issue a session ticket
2256 */
2257 ssl->state++;
2258
2259 #if defined(MBEDTLS_HAVE_TIME)
2260 ssl->session_negotiate->start = mbedtls_time(NULL);
2261 #endif
2262
2263 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2264 if (ssl->handshake->new_session_ticket != 0) {
2265 ssl->session_negotiate->id_len = n = 0;
2266 memset(ssl->session_negotiate->id, 0, 32);
2267 } else
2268 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
2269 {
2270 ssl->session_negotiate->id_len = n = 32;
2271 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, ssl->session_negotiate->id,
2272 n)) != 0) {
2273 return ret;
2274 }
2275 }
2276 } else {
2277 /*
2278 * Resuming a session
2279 */
2280 n = ssl->session_negotiate->id_len;
2281 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
2282
2283 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) {
2284 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret);
2285 return ret;
2286 }
2287 }
2288
2289 /*
2290 * 38 . 38 session id length
2291 * 39 . 38+n session id
2292 * 39+n . 40+n chosen ciphersuite
2293 * 41+n . 41+n chosen compression alg.
2294 * 42+n . 43+n extensions length
2295 * 44+n . 43+n+m extensions
2296 */
2297 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2298 memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len);
2299 p += ssl->session_negotiate->id_len;
2300
2301 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n));
2302 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, session id", buf + 39, n);
2303 MBEDTLS_SSL_DEBUG_MSG(3, ("%s session has been resumed",
2304 ssl->handshake->resume ? "a" : "no"));
2305
2306 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0);
2307 p += 2;
2308 *p++ = MBEDTLS_BYTE_0(MBEDTLS_SSL_COMPRESS_NULL);
2309
2310 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen ciphersuite: %s",
2311 mbedtls_ssl_get_ciphersuite_name(ssl->session_negotiate->ciphersuite)));
2312 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, compress alg.: 0x%02X",
2313 (unsigned int) MBEDTLS_SSL_COMPRESS_NULL));
2314
2315 /*
2316 * First write extensions, then the total length
2317 */
2318 ssl_write_renegotiation_ext(ssl, p + 2 + ext_len, &olen);
2319 ext_len += olen;
2320
2321 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2322 ssl_write_max_fragment_length_ext(ssl, p + 2 + ext_len, &olen);
2323 ext_len += olen;
2324 #endif
2325
2326 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
2327 ssl_write_cid_ext(ssl, p + 2 + ext_len, &olen);
2328 ext_len += olen;
2329 #endif
2330
2331 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2332 ssl_write_encrypt_then_mac_ext(ssl, p + 2 + ext_len, &olen);
2333 ext_len += olen;
2334 #endif
2335
2336 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2337 ssl_write_extended_ms_ext(ssl, p + 2 + ext_len, &olen);
2338 ext_len += olen;
2339 #endif
2340
2341 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2342 ssl_write_session_ticket_ext(ssl, p + 2 + ext_len, &olen);
2343 ext_len += olen;
2344 #endif
2345
2346 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
2347 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
2348 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2349 const mbedtls_ssl_ciphersuite_t *suite =
2350 mbedtls_ssl_ciphersuite_from_id(ssl->session_negotiate->ciphersuite);
2351 if (suite != NULL && mbedtls_ssl_ciphersuite_uses_ec(suite)) {
2352 ssl_write_supported_point_formats_ext(ssl, p + 2 + ext_len, &olen);
2353 ext_len += olen;
2354 }
2355 #endif
2356
2357 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2358 ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen);
2359 ext_len += olen;
2360 #endif
2361
2362 #if defined(MBEDTLS_SSL_ALPN)
2363 unsigned char *end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN - 4;
2364 if ((ret = mbedtls_ssl_write_alpn_ext(ssl, p + 2 + ext_len, end, &olen))
2365 != 0) {
2366 return ret;
2367 }
2368
2369 ext_len += olen;
2370 #endif
2371
2372 #if defined(MBEDTLS_SSL_DTLS_SRTP)
2373 ssl_write_use_srtp_ext(ssl, p + 2 + ext_len, &olen);
2374 ext_len += olen;
2375 #endif
2376
2377 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, total extension length: %" MBEDTLS_PRINTF_SIZET,
2378 ext_len));
2379
2380 if (ext_len > 0) {
2381 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0);
2382 p += 2 + ext_len;
2383 }
2384
2385 ssl->out_msglen = (size_t) (p - buf);
2386 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2387 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
2388
2389 ret = mbedtls_ssl_write_handshake_msg(ssl);
2390
2391 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2392
2393 return ret;
2394 }
2395
2396 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
2397 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_certificate_request(mbedtls_ssl_context * ssl)2398 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl)
2399 {
2400 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2401 ssl->handshake->ciphersuite_info;
2402
2403 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
2404
2405 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) {
2406 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
2407 ssl->state++;
2408 return 0;
2409 }
2410
2411 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
2412 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2413 }
2414 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
2415 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_certificate_request(mbedtls_ssl_context * ssl)2416 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl)
2417 {
2418 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2419 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2420 ssl->handshake->ciphersuite_info;
2421 uint16_t dn_size, total_dn_size; /* excluding length bytes */
2422 size_t ct_len, sa_len; /* including length bytes */
2423 unsigned char *buf, *p;
2424 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
2425 const mbedtls_x509_crt *crt;
2426 int authmode;
2427
2428 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
2429
2430 ssl->state++;
2431
2432 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2433 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
2434 authmode = ssl->handshake->sni_authmode;
2435 } else
2436 #endif
2437 authmode = ssl->conf->authmode;
2438
2439 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info) ||
2440 authmode == MBEDTLS_SSL_VERIFY_NONE) {
2441 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
2442 return 0;
2443 }
2444
2445 /*
2446 * 0 . 0 handshake type
2447 * 1 . 3 handshake length
2448 * 4 . 4 cert type count
2449 * 5 .. m-1 cert types
2450 * m .. m+1 sig alg length (TLS 1.2 only)
2451 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
2452 * n .. n+1 length of all DNs
2453 * n+2 .. n+3 length of DN 1
2454 * n+4 .. ... Distinguished Name #1
2455 * ... .. ... length of DN 2, etc.
2456 */
2457 buf = ssl->out_msg;
2458 p = buf + 4;
2459
2460 /*
2461 * Supported certificate types
2462 *
2463 * ClientCertificateType certificate_types<1..2^8-1>;
2464 * enum { (255) } ClientCertificateType;
2465 */
2466 ct_len = 0;
2467
2468 #if defined(MBEDTLS_RSA_C)
2469 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
2470 #endif
2471 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
2472 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
2473 #endif
2474
2475 p[0] = (unsigned char) ct_len++;
2476 p += ct_len;
2477
2478 sa_len = 0;
2479
2480 /*
2481 * Add signature_algorithms for verify (TLS 1.2)
2482 *
2483 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2484 *
2485 * struct {
2486 * HashAlgorithm hash;
2487 * SignatureAlgorithm signature;
2488 * } SignatureAndHashAlgorithm;
2489 *
2490 * enum { (255) } HashAlgorithm;
2491 * enum { (255) } SignatureAlgorithm;
2492 */
2493 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl);
2494 if (sig_alg == NULL) {
2495 return MBEDTLS_ERR_SSL_BAD_CONFIG;
2496 }
2497
2498 for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) {
2499 unsigned char hash = MBEDTLS_BYTE_1(*sig_alg);
2500
2501 if (mbedtls_ssl_set_calc_verify_md(ssl, hash)) {
2502 continue;
2503 }
2504 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) {
2505 continue;
2506 }
2507
2508 /* Write elements at offsets starting from 1 (offset 0 is for the
2509 * length). Thus the offset of each element is the length of the
2510 * partial list including that element. */
2511 sa_len += 2;
2512 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, sa_len);
2513
2514 }
2515
2516 /* Fill in list length. */
2517 MBEDTLS_PUT_UINT16_BE(sa_len, p, 0);
2518 sa_len += 2;
2519 p += sa_len;
2520
2521 /*
2522 * DistinguishedName certificate_authorities<0..2^16-1>;
2523 * opaque DistinguishedName<1..2^16-1>;
2524 */
2525 p += 2;
2526
2527 total_dn_size = 0;
2528
2529 if (ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED) {
2530 /* NOTE: If trusted certificates are provisioned
2531 * via a CA callback (configured through
2532 * `mbedtls_ssl_conf_ca_cb()`, then the
2533 * CertificateRequest is currently left empty. */
2534
2535 #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
2536 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2537 if (ssl->handshake->dn_hints != NULL) {
2538 crt = ssl->handshake->dn_hints;
2539 } else
2540 #endif
2541 if (ssl->conf->dn_hints != NULL) {
2542 crt = ssl->conf->dn_hints;
2543 } else
2544 #endif
2545 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2546 if (ssl->handshake->sni_ca_chain != NULL) {
2547 crt = ssl->handshake->sni_ca_chain;
2548 } else
2549 #endif
2550 crt = ssl->conf->ca_chain;
2551
2552 while (crt != NULL && crt->version != 0) {
2553 /* It follows from RFC 5280 A.1 that this length
2554 * can be represented in at most 11 bits. */
2555 dn_size = (uint16_t) crt->subject_raw.len;
2556
2557 if (end < p || (size_t) (end - p) < 2 + (size_t) dn_size) {
2558 MBEDTLS_SSL_DEBUG_MSG(1, ("skipping CAs: buffer too short"));
2559 break;
2560 }
2561
2562 MBEDTLS_PUT_UINT16_BE(dn_size, p, 0);
2563 p += 2;
2564 memcpy(p, crt->subject_raw.p, dn_size);
2565 p += dn_size;
2566
2567 MBEDTLS_SSL_DEBUG_BUF(3, "requested DN", p - dn_size, dn_size);
2568
2569 total_dn_size += (unsigned short) (2 + dn_size);
2570 crt = crt->next;
2571 }
2572 }
2573
2574 ssl->out_msglen = (size_t) (p - buf);
2575 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2576 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
2577 MBEDTLS_PUT_UINT16_BE(total_dn_size, ssl->out_msg, 4 + ct_len + sa_len);
2578
2579 ret = mbedtls_ssl_write_handshake_msg(ssl);
2580
2581 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request"));
2582
2583 return ret;
2584 }
2585 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
2586
2587 #if (defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2588 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED))
2589 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2590 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_get_ecdh_params_from_cert(mbedtls_ssl_context * ssl)2591 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
2592 {
2593 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2594 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2595 mbedtls_pk_context *pk;
2596 mbedtls_pk_type_t pk_type;
2597 psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
2598 unsigned char buf[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
2599 size_t key_len;
2600 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2601 uint16_t tls_id = 0;
2602 psa_key_type_t key_type = PSA_KEY_TYPE_NONE;
2603 mbedtls_ecp_group_id grp_id;
2604 mbedtls_ecp_keypair *key;
2605 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
2606
2607 pk = mbedtls_ssl_own_key(ssl);
2608
2609 if (pk == NULL) {
2610 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
2611 }
2612
2613 pk_type = mbedtls_pk_get_type(pk);
2614
2615 switch (pk_type) {
2616 case MBEDTLS_PK_OPAQUE:
2617 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2618 case MBEDTLS_PK_ECKEY:
2619 case MBEDTLS_PK_ECKEY_DH:
2620 case MBEDTLS_PK_ECDSA:
2621 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
2622 if (!mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) {
2623 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
2624 }
2625
2626 /* Get the attributes of the key previously parsed by PK module in
2627 * order to extract its type and length (in bits). */
2628 status = psa_get_key_attributes(pk->priv_id, &key_attributes);
2629 if (status != PSA_SUCCESS) {
2630 ret = PSA_TO_MBEDTLS_ERR(status);
2631 goto exit;
2632 }
2633 ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes);
2634 ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes);
2635
2636 if (pk_type == MBEDTLS_PK_OPAQUE) {
2637 /* Opaque key is created by the user (externally from Mbed TLS)
2638 * so we assume it already has the right algorithm and flags
2639 * set. Just copy its ID as reference. */
2640 ssl->handshake->xxdh_psa_privkey = pk->priv_id;
2641 ssl->handshake->xxdh_psa_privkey_is_external = 1;
2642 } else {
2643 /* PK_ECKEY[_DH] and PK_ECDSA instead as parsed from the PK
2644 * module and only have ECDSA capabilities. Since we need
2645 * them for ECDH later, we export and then re-import them with
2646 * proper flags and algorithm. Of course We also set key's type
2647 * and bits that we just got above. */
2648 key_attributes = psa_key_attributes_init();
2649 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
2650 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
2651 psa_set_key_type(&key_attributes,
2652 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type));
2653 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits);
2654
2655 status = psa_export_key(pk->priv_id, buf, sizeof(buf), &key_len);
2656 if (status != PSA_SUCCESS) {
2657 ret = PSA_TO_MBEDTLS_ERR(status);
2658 goto exit;
2659 }
2660 status = psa_import_key(&key_attributes, buf, key_len,
2661 &ssl->handshake->xxdh_psa_privkey);
2662 if (status != PSA_SUCCESS) {
2663 ret = PSA_TO_MBEDTLS_ERR(status);
2664 goto exit;
2665 }
2666
2667 /* Set this key as owned by the TLS library: it will be its duty
2668 * to clear it exit. */
2669 ssl->handshake->xxdh_psa_privkey_is_external = 0;
2670 }
2671
2672 ret = 0;
2673 break;
2674 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2675 case MBEDTLS_PK_ECKEY:
2676 case MBEDTLS_PK_ECKEY_DH:
2677 case MBEDTLS_PK_ECDSA:
2678 key = mbedtls_pk_ec_rw(*pk);
2679 grp_id = mbedtls_pk_get_ec_group_id(pk);
2680 if (grp_id == MBEDTLS_ECP_DP_NONE) {
2681 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
2682 }
2683 tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
2684 if (tls_id == 0) {
2685 /* This elliptic curve is not supported */
2686 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2687 }
2688
2689 /* If the above conversion to TLS ID was fine, then also this one will
2690 be, so there is no need to check the return value here */
2691 mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id, &key_type,
2692 &ssl->handshake->xxdh_psa_bits);
2693
2694 ssl->handshake->xxdh_psa_type = key_type;
2695
2696 key_attributes = psa_key_attributes_init();
2697 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
2698 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
2699 psa_set_key_type(&key_attributes,
2700 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type));
2701 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits);
2702
2703 ret = mbedtls_ecp_write_key_ext(key, &key_len, buf, sizeof(buf));
2704 if (ret != 0) {
2705 mbedtls_platform_zeroize(buf, sizeof(buf));
2706 break;
2707 }
2708
2709 status = psa_import_key(&key_attributes, buf, key_len,
2710 &ssl->handshake->xxdh_psa_privkey);
2711 if (status != PSA_SUCCESS) {
2712 ret = PSA_TO_MBEDTLS_ERR(status);
2713 mbedtls_platform_zeroize(buf, sizeof(buf));
2714 break;
2715 }
2716
2717 mbedtls_platform_zeroize(buf, sizeof(buf));
2718 ret = 0;
2719 break;
2720 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
2721 default:
2722 ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
2723 }
2724
2725 exit:
2726 psa_reset_key_attributes(&key_attributes);
2727 mbedtls_platform_zeroize(buf, sizeof(buf));
2728
2729 return ret;
2730 }
2731 #else /* MBEDTLS_USE_PSA_CRYPTO */
2732 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_get_ecdh_params_from_cert(mbedtls_ssl_context * ssl)2733 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
2734 {
2735 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2736
2737 const mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl);
2738 if (private_key == NULL) {
2739 MBEDTLS_SSL_DEBUG_MSG(1, ("got no server private key"));
2740 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
2741 }
2742
2743 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_ECKEY)) {
2744 MBEDTLS_SSL_DEBUG_MSG(1, ("server key not ECDH capable"));
2745 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
2746 }
2747
2748 if ((ret = mbedtls_ecdh_get_params(&ssl->handshake->ecdh_ctx,
2749 mbedtls_pk_ec_ro(*mbedtls_ssl_own_key(ssl)),
2750 MBEDTLS_ECDH_OURS)) != 0) {
2751 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecdh_get_params"), ret);
2752 return ret;
2753 }
2754
2755 return 0;
2756 }
2757 #endif /* MBEDTLS_USE_PSA_CRYPTO */
2758 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2759 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2760
2761 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \
2762 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
2763 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_resume_server_key_exchange(mbedtls_ssl_context * ssl,size_t * signature_len)2764 static int ssl_resume_server_key_exchange(mbedtls_ssl_context *ssl,
2765 size_t *signature_len)
2766 {
2767 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
2768 * signature length which will be added in ssl_write_server_key_exchange
2769 * after the call to ssl_prepare_server_key_exchange.
2770 * ssl_write_server_key_exchange also takes care of incrementing
2771 * ssl->out_msglen. */
2772 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2;
2773 size_t sig_max_len = (ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN
2774 - sig_start);
2775 int ret = ssl->conf->f_async_resume(ssl,
2776 sig_start, signature_len, sig_max_len);
2777 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
2778 ssl->handshake->async_in_progress = 0;
2779 mbedtls_ssl_set_async_operation_data(ssl, NULL);
2780 }
2781 MBEDTLS_SSL_DEBUG_RET(2, "ssl_resume_server_key_exchange", ret);
2782 return ret;
2783 }
2784 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
2785 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
2786
2787 /* Prepare the ServerKeyExchange message, up to and including
2788 * calculating the signature if any, but excluding formatting the
2789 * signature and sending the message. */
2790 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_prepare_server_key_exchange(mbedtls_ssl_context * ssl,size_t * signature_len)2791 static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl,
2792 size_t *signature_len)
2793 {
2794 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2795 ssl->handshake->ciphersuite_info;
2796
2797 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED)
2798 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2799 unsigned char *dig_signed = NULL;
2800 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
2801 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */
2802
2803 (void) ciphersuite_info; /* unused in some configurations */
2804 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2805 (void) signature_len;
2806 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
2807
2808 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2809 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
2810 size_t out_buf_len = ssl->out_buf_len - (size_t) (ssl->out_msg - ssl->out_buf);
2811 #else
2812 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN - (size_t) (ssl->out_msg - ssl->out_buf);
2813 #endif
2814 #endif
2815
2816 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */
2817
2818 /*
2819 *
2820 * Part 1: Provide key exchange parameters for chosen ciphersuite.
2821 *
2822 */
2823
2824 /*
2825 * - ECJPAKE key exchanges
2826 */
2827 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2828 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
2829 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2830 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2831 unsigned char *out_p = ssl->out_msg + ssl->out_msglen;
2832 unsigned char *end_p = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN -
2833 ssl->out_msglen;
2834 size_t output_offset = 0;
2835 size_t output_len = 0;
2836
2837 /*
2838 * The first 3 bytes are:
2839 * [0] MBEDTLS_ECP_TLS_NAMED_CURVE
2840 * [1, 2] elliptic curve's TLS ID
2841 *
2842 * However since we only support secp256r1 for now, we hardcode its
2843 * TLS ID here
2844 */
2845 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
2846 MBEDTLS_ECP_DP_SECP256R1);
2847 if (tls_id == 0) {
2848 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2849 }
2850 *out_p = MBEDTLS_ECP_TLS_NAMED_CURVE;
2851 MBEDTLS_PUT_UINT16_BE(tls_id, out_p, 1);
2852 output_offset += 3;
2853
2854 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx,
2855 out_p + output_offset,
2856 end_p - out_p - output_offset, &output_len,
2857 MBEDTLS_ECJPAKE_ROUND_TWO);
2858 if (ret != 0) {
2859 psa_destroy_key(ssl->handshake->psa_pake_password);
2860 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
2861 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret);
2862 return ret;
2863 }
2864
2865 output_offset += output_len;
2866 ssl->out_msglen += output_offset;
2867 #else
2868 size_t len = 0;
2869
2870 ret = mbedtls_ecjpake_write_round_two(
2871 &ssl->handshake->ecjpake_ctx,
2872 ssl->out_msg + ssl->out_msglen,
2873 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len,
2874 ssl->conf->f_rng, ssl->conf->p_rng);
2875 if (ret != 0) {
2876 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_two", ret);
2877 return ret;
2878 }
2879
2880 ssl->out_msglen += len;
2881 #endif /* MBEDTLS_USE_PSA_CRYPTO */
2882 }
2883 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2884
2885 /*
2886 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
2887 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
2888 * we use empty support identity hints here.
2889 **/
2890 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2891 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2892 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2893 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
2894 ssl->out_msg[ssl->out_msglen++] = 0x00;
2895 ssl->out_msg[ssl->out_msglen++] = 0x00;
2896 }
2897 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2898 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2899
2900 /*
2901 * - DHE key exchanges
2902 */
2903 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED)
2904 if (mbedtls_ssl_ciphersuite_uses_dhe(ciphersuite_info)) {
2905 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2906 size_t len = 0;
2907
2908 if (ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL) {
2909 MBEDTLS_SSL_DEBUG_MSG(1, ("no DH parameters set"));
2910 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2911 }
2912
2913 /*
2914 * Ephemeral DH parameters:
2915 *
2916 * struct {
2917 * opaque dh_p<1..2^16-1>;
2918 * opaque dh_g<1..2^16-1>;
2919 * opaque dh_Ys<1..2^16-1>;
2920 * } ServerDHParams;
2921 */
2922 if ((ret = mbedtls_dhm_set_group(&ssl->handshake->dhm_ctx,
2923 &ssl->conf->dhm_P,
2924 &ssl->conf->dhm_G)) != 0) {
2925 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_set_group", ret);
2926 return ret;
2927 }
2928
2929 if ((ret = mbedtls_dhm_make_params(
2930 &ssl->handshake->dhm_ctx,
2931 (int) mbedtls_dhm_get_len(&ssl->handshake->dhm_ctx),
2932 ssl->out_msg + ssl->out_msglen, &len,
2933 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
2934 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_make_params", ret);
2935 return ret;
2936 }
2937
2938 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2939 dig_signed = ssl->out_msg + ssl->out_msglen;
2940 #endif
2941
2942 ssl->out_msglen += len;
2943
2944 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: X ", &ssl->handshake->dhm_ctx.X);
2945 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: P ", &ssl->handshake->dhm_ctx.P);
2946 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: G ", &ssl->handshake->dhm_ctx.G);
2947 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GX", &ssl->handshake->dhm_ctx.GX);
2948 }
2949 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */
2950
2951 /*
2952 * - ECDHE key exchanges
2953 */
2954 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
2955 if (mbedtls_ssl_ciphersuite_uses_ecdhe(ciphersuite_info)) {
2956 /*
2957 * Ephemeral ECDH parameters:
2958 *
2959 * struct {
2960 * ECParameters curve_params;
2961 * ECPoint public;
2962 * } ServerECDHParams;
2963 */
2964 uint16_t *curr_tls_id = ssl->handshake->curves_tls_id;
2965 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
2966 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2967 size_t len = 0;
2968
2969 /* Match our preference list against the offered curves */
2970 if ((group_list == NULL) || (curr_tls_id == NULL)) {
2971 return MBEDTLS_ERR_SSL_BAD_CONFIG;
2972 }
2973 for (; *group_list != 0; group_list++) {
2974 for (curr_tls_id = ssl->handshake->curves_tls_id;
2975 *curr_tls_id != 0; curr_tls_id++) {
2976 if (*curr_tls_id == *group_list) {
2977 goto curve_matching_done;
2978 }
2979 }
2980 }
2981
2982 curve_matching_done:
2983 if (*curr_tls_id == 0) {
2984 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching curve for ECDHE"));
2985 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2986 }
2987
2988 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDHE curve: %s",
2989 mbedtls_ssl_get_curve_name_from_tls_id(*curr_tls_id)));
2990
2991 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2992 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
2993 psa_key_attributes_t key_attributes;
2994 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2995 uint8_t *p = ssl->out_msg + ssl->out_msglen;
2996 const size_t header_size = 4; // curve_type(1), namedcurve(2),
2997 // data length(1)
2998 const size_t data_length_size = 1;
2999 psa_key_type_t key_type = PSA_KEY_TYPE_NONE;
3000 size_t ec_bits = 0;
3001
3002 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH computation."));
3003
3004 /* Convert EC's TLS ID to PSA key type. */
3005 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(*curr_tls_id,
3006 &key_type,
3007 &ec_bits) == PSA_ERROR_NOT_SUPPORTED) {
3008 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid ecc group parse."));
3009 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
3010 }
3011 handshake->xxdh_psa_type = key_type;
3012 handshake->xxdh_psa_bits = ec_bits;
3013
3014 key_attributes = psa_key_attributes_init();
3015 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
3016 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
3017 psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
3018 psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
3019
3020 /*
3021 * ECParameters curve_params
3022 *
3023 * First byte is curve_type, always named_curve
3024 */
3025 *p++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
3026
3027 /*
3028 * Next two bytes are the namedcurve value
3029 */
3030 MBEDTLS_PUT_UINT16_BE(*curr_tls_id, p, 0);
3031 p += 2;
3032
3033 /* Generate ECDH private key. */
3034 status = psa_generate_key(&key_attributes,
3035 &handshake->xxdh_psa_privkey);
3036 if (status != PSA_SUCCESS) {
3037 ret = PSA_TO_MBEDTLS_ERR(status);
3038 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret);
3039 return ret;
3040 }
3041
3042 /*
3043 * ECPoint public
3044 *
3045 * First byte is data length.
3046 * It will be filled later. p holds now the data length location.
3047 */
3048
3049 /* Export the public part of the ECDH private key from PSA.
3050 * Make one byte space for the length.
3051 */
3052 unsigned char *own_pubkey = p + data_length_size;
3053
3054 size_t own_pubkey_max_len = (size_t) (MBEDTLS_SSL_OUT_CONTENT_LEN
3055 - (own_pubkey - ssl->out_msg));
3056
3057 status = psa_export_public_key(handshake->xxdh_psa_privkey,
3058 own_pubkey, own_pubkey_max_len,
3059 &len);
3060 if (status != PSA_SUCCESS) {
3061 ret = PSA_TO_MBEDTLS_ERR(status);
3062 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret);
3063 (void) psa_destroy_key(handshake->xxdh_psa_privkey);
3064 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3065 return ret;
3066 }
3067
3068 /* Store the length of the exported public key. */
3069 *p = (uint8_t) len;
3070
3071 /* Determine full message length. */
3072 len += header_size;
3073 #else
3074 mbedtls_ecp_group_id curr_grp_id =
3075 mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id);
3076
3077 if ((ret = mbedtls_ecdh_setup(&ssl->handshake->ecdh_ctx,
3078 curr_grp_id)) != 0) {
3079 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecp_group_load", ret);
3080 return ret;
3081 }
3082
3083 if ((ret = mbedtls_ecdh_make_params(
3084 &ssl->handshake->ecdh_ctx, &len,
3085 ssl->out_msg + ssl->out_msglen,
3086 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen,
3087 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3088 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_make_params", ret);
3089 return ret;
3090 }
3091
3092 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3093 MBEDTLS_DEBUG_ECDH_Q);
3094 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3095
3096 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3097 dig_signed = ssl->out_msg + ssl->out_msglen;
3098 #endif
3099
3100 ssl->out_msglen += len;
3101 }
3102 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */
3103
3104 /*
3105 *
3106 * Part 2: For key exchanges involving the server signing the
3107 * exchange parameters, compute and add the signature here.
3108 *
3109 */
3110 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3111 if (mbedtls_ssl_ciphersuite_uses_server_signature(ciphersuite_info)) {
3112 if (dig_signed == NULL) {
3113 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3114 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3115 }
3116
3117 size_t dig_signed_len = (size_t) (ssl->out_msg + ssl->out_msglen - dig_signed);
3118 size_t hashlen = 0;
3119 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
3120
3121 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3122
3123 /*
3124 * 2.1: Choose hash algorithm:
3125 * For TLS 1.2, obey signature-hash-algorithm extension
3126 * to choose appropriate hash.
3127 */
3128
3129 mbedtls_pk_type_t sig_alg =
3130 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info);
3131
3132 unsigned char sig_hash =
3133 (unsigned char) mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
3134 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg));
3135
3136 mbedtls_md_type_t md_alg = mbedtls_ssl_md_alg_from_hash(sig_hash);
3137
3138 /* For TLS 1.2, obey signature-hash-algorithm extension
3139 * (RFC 5246, Sec. 7.4.1.4.1). */
3140 if (sig_alg == MBEDTLS_PK_NONE || md_alg == MBEDTLS_MD_NONE) {
3141 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3142 /* (... because we choose a cipher suite
3143 * only if there is a matching hash.) */
3144 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3145 }
3146
3147 MBEDTLS_SSL_DEBUG_MSG(3, ("pick hash algorithm %u for signing", (unsigned) md_alg));
3148
3149 /*
3150 * 2.2: Compute the hash to be signed
3151 */
3152 if (md_alg != MBEDTLS_MD_NONE) {
3153 ret = mbedtls_ssl_get_key_exchange_md_tls1_2(ssl, hash, &hashlen,
3154 dig_signed,
3155 dig_signed_len,
3156 md_alg);
3157 if (ret != 0) {
3158 return ret;
3159 }
3160 } else {
3161 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3162 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3163 }
3164
3165 MBEDTLS_SSL_DEBUG_BUF(3, "parameters hash", hash, hashlen);
3166
3167 /*
3168 * 2.3: Compute and add the signature
3169 */
3170 /*
3171 * We need to specify signature and hash algorithm explicitly through
3172 * a prefix to the signature.
3173 *
3174 * struct {
3175 * HashAlgorithm hash;
3176 * SignatureAlgorithm signature;
3177 * } SignatureAndHashAlgorithm;
3178 *
3179 * struct {
3180 * SignatureAndHashAlgorithm algorithm;
3181 * opaque signature<0..2^16-1>;
3182 * } DigitallySigned;
3183 *
3184 */
3185
3186 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_hash_from_md_alg(md_alg);
3187 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_sig_from_pk_alg(sig_alg);
3188
3189 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3190 if (ssl->conf->f_async_sign_start != NULL) {
3191 ret = ssl->conf->f_async_sign_start(ssl,
3192 mbedtls_ssl_own_cert(ssl),
3193 md_alg, hash, hashlen);
3194 switch (ret) {
3195 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3196 /* act as if f_async_sign was null */
3197 break;
3198 case 0:
3199 ssl->handshake->async_in_progress = 1;
3200 return ssl_resume_server_key_exchange(ssl, signature_len);
3201 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
3202 ssl->handshake->async_in_progress = 1;
3203 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS;
3204 default:
3205 MBEDTLS_SSL_DEBUG_RET(1, "f_async_sign_start", ret);
3206 return ret;
3207 }
3208 }
3209 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3210
3211 if (mbedtls_ssl_own_key(ssl) == NULL) {
3212 MBEDTLS_SSL_DEBUG_MSG(1, ("got no private key"));
3213 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
3214 }
3215
3216 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3217 * signature length which will be added in ssl_write_server_key_exchange
3218 * after the call to ssl_prepare_server_key_exchange.
3219 * ssl_write_server_key_exchange also takes care of incrementing
3220 * ssl->out_msglen. */
3221 if ((ret = mbedtls_pk_sign(mbedtls_ssl_own_key(ssl),
3222 md_alg, hash, hashlen,
3223 ssl->out_msg + ssl->out_msglen + 2,
3224 out_buf_len - ssl->out_msglen - 2,
3225 signature_len,
3226 ssl->conf->f_rng,
3227 ssl->conf->p_rng)) != 0) {
3228 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_sign", ret);
3229 return ret;
3230 }
3231 }
3232 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
3233
3234 return 0;
3235 }
3236
3237 /* Prepare the ServerKeyExchange message and send it. For ciphersuites
3238 * that do not include a ServerKeyExchange message, do nothing. Either
3239 * way, if successful, move on to the next step in the SSL state
3240 * machine. */
3241 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_server_key_exchange(mbedtls_ssl_context * ssl)3242 static int ssl_write_server_key_exchange(mbedtls_ssl_context *ssl)
3243 {
3244 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3245 size_t signature_len = 0;
3246 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
3247 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3248 ssl->handshake->ciphersuite_info;
3249 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
3250
3251 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server key exchange"));
3252
3253 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
3254 /* Extract static ECDH parameters and abort if ServerKeyExchange
3255 * is not needed. */
3256 if (mbedtls_ssl_ciphersuite_no_pfs(ciphersuite_info)) {
3257 /* For suites involving ECDH, extract DH parameters
3258 * from certificate at this point. */
3259 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED)
3260 if (mbedtls_ssl_ciphersuite_uses_ecdh(ciphersuite_info)) {
3261 ret = ssl_get_ecdh_params_from_cert(ssl);
3262 if (ret != 0) {
3263 MBEDTLS_SSL_DEBUG_RET(1, "ssl_get_ecdh_params_from_cert", ret);
3264 return ret;
3265 }
3266 }
3267 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */
3268
3269 /* Key exchanges not involving ephemeral keys don't use
3270 * ServerKeyExchange, so end here. */
3271 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write server key exchange"));
3272 ssl->state++;
3273 return 0;
3274 }
3275 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
3276
3277 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \
3278 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3279 /* If we have already prepared the message and there is an ongoing
3280 * signature operation, resume signing. */
3281 if (ssl->handshake->async_in_progress != 0) {
3282 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming signature operation"));
3283 ret = ssl_resume_server_key_exchange(ssl, &signature_len);
3284 } else
3285 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
3286 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
3287 {
3288 /* ServerKeyExchange is needed. Prepare the message. */
3289 ret = ssl_prepare_server_key_exchange(ssl, &signature_len);
3290 }
3291
3292 if (ret != 0) {
3293 /* If we're starting to write a new message, set ssl->out_msglen
3294 * to 0. But if we're resuming after an asynchronous message,
3295 * out_msglen is the amount of data written so far and mst be
3296 * preserved. */
3297 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
3298 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange (pending)"));
3299 } else {
3300 ssl->out_msglen = 0;
3301 }
3302 return ret;
3303 }
3304
3305 /* If there is a signature, write its length.
3306 * ssl_prepare_server_key_exchange already wrote the signature
3307 * itself at its proper place in the output buffer. */
3308 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3309 if (signature_len != 0) {
3310 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_1(signature_len);
3311 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_0(signature_len);
3312
3313 MBEDTLS_SSL_DEBUG_BUF(3, "my signature",
3314 ssl->out_msg + ssl->out_msglen,
3315 signature_len);
3316
3317 /* Skip over the already-written signature */
3318 ssl->out_msglen += signature_len;
3319 }
3320 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
3321
3322 /* Add header and send. */
3323 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3324 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
3325
3326 ssl->state++;
3327
3328 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
3329 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
3330 return ret;
3331 }
3332
3333 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange"));
3334 return 0;
3335 }
3336
3337 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_server_hello_done(mbedtls_ssl_context * ssl)3338 static int ssl_write_server_hello_done(mbedtls_ssl_context *ssl)
3339 {
3340 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3341
3342 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello done"));
3343
3344 ssl->out_msglen = 4;
3345 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3346 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
3347
3348 ssl->state++;
3349
3350 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3351 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
3352 mbedtls_ssl_send_flight_completed(ssl);
3353 }
3354 #endif
3355
3356 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
3357 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
3358 return ret;
3359 }
3360
3361 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3362 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3363 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
3364 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
3365 return ret;
3366 }
3367 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3368
3369 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello done"));
3370
3371 return 0;
3372 }
3373
3374 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3375 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3376 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_dh_public(mbedtls_ssl_context * ssl,unsigned char ** p,const unsigned char * end)3377 static int ssl_parse_client_dh_public(mbedtls_ssl_context *ssl, unsigned char **p,
3378 const unsigned char *end)
3379 {
3380 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3381 size_t n;
3382
3383 /*
3384 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3385 */
3386 if (*p + 2 > end) {
3387 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3388 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3389 }
3390
3391 n = MBEDTLS_GET_UINT16_BE(*p, 0);
3392 *p += 2;
3393
3394 if (*p + n > end) {
3395 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3396 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3397 }
3398
3399 if ((ret = mbedtls_dhm_read_public(&ssl->handshake->dhm_ctx, *p, n)) != 0) {
3400 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_read_public", ret);
3401 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3402 }
3403
3404 *p += n;
3405
3406 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GY", &ssl->handshake->dhm_ctx.GY);
3407
3408 return ret;
3409 }
3410 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3411 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3412
3413 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3414 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3415
3416 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3417 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_resume_decrypt_pms(mbedtls_ssl_context * ssl,unsigned char * peer_pms,size_t * peer_pmslen,size_t peer_pmssize)3418 static int ssl_resume_decrypt_pms(mbedtls_ssl_context *ssl,
3419 unsigned char *peer_pms,
3420 size_t *peer_pmslen,
3421 size_t peer_pmssize)
3422 {
3423 int ret = ssl->conf->f_async_resume(ssl,
3424 peer_pms, peer_pmslen, peer_pmssize);
3425 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
3426 ssl->handshake->async_in_progress = 0;
3427 mbedtls_ssl_set_async_operation_data(ssl, NULL);
3428 }
3429 MBEDTLS_SSL_DEBUG_RET(2, "ssl_decrypt_encrypted_pms", ret);
3430 return ret;
3431 }
3432 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3433
3434 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_decrypt_encrypted_pms(mbedtls_ssl_context * ssl,const unsigned char * p,const unsigned char * end,unsigned char * peer_pms,size_t * peer_pmslen,size_t peer_pmssize)3435 static int ssl_decrypt_encrypted_pms(mbedtls_ssl_context *ssl,
3436 const unsigned char *p,
3437 const unsigned char *end,
3438 unsigned char *peer_pms,
3439 size_t *peer_pmslen,
3440 size_t peer_pmssize)
3441 {
3442 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3443
3444 mbedtls_x509_crt *own_cert = mbedtls_ssl_own_cert(ssl);
3445 if (own_cert == NULL) {
3446 MBEDTLS_SSL_DEBUG_MSG(1, ("got no local certificate"));
3447 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
3448 }
3449 mbedtls_pk_context *public_key = &own_cert->pk;
3450 mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl);
3451 size_t len = mbedtls_pk_get_len(public_key);
3452
3453 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3454 /* If we have already started decoding the message and there is an ongoing
3455 * decryption operation, resume signing. */
3456 if (ssl->handshake->async_in_progress != 0) {
3457 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming decryption operation"));
3458 return ssl_resume_decrypt_pms(ssl,
3459 peer_pms, peer_pmslen, peer_pmssize);
3460 }
3461 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3462
3463 /*
3464 * Prepare to decrypt the premaster using own private RSA key
3465 */
3466 if (p + 2 > end) {
3467 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3468 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3469 }
3470 if (*p++ != MBEDTLS_BYTE_1(len) ||
3471 *p++ != MBEDTLS_BYTE_0(len)) {
3472 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3473 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3474 }
3475
3476 if (p + len != end) {
3477 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3478 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3479 }
3480
3481 /*
3482 * Decrypt the premaster secret
3483 */
3484 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3485 if (ssl->conf->f_async_decrypt_start != NULL) {
3486 ret = ssl->conf->f_async_decrypt_start(ssl,
3487 mbedtls_ssl_own_cert(ssl),
3488 p, len);
3489 switch (ret) {
3490 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3491 /* act as if f_async_decrypt_start was null */
3492 break;
3493 case 0:
3494 ssl->handshake->async_in_progress = 1;
3495 return ssl_resume_decrypt_pms(ssl,
3496 peer_pms,
3497 peer_pmslen,
3498 peer_pmssize);
3499 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
3500 ssl->handshake->async_in_progress = 1;
3501 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS;
3502 default:
3503 MBEDTLS_SSL_DEBUG_RET(1, "f_async_decrypt_start", ret);
3504 return ret;
3505 }
3506 }
3507 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3508
3509 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_RSA)) {
3510 MBEDTLS_SSL_DEBUG_MSG(1, ("got no RSA private key"));
3511 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
3512 }
3513
3514 ret = mbedtls_pk_decrypt(private_key, p, len,
3515 peer_pms, peer_pmslen, peer_pmssize,
3516 ssl->conf->f_rng, ssl->conf->p_rng);
3517 return ret;
3518 }
3519
3520 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_encrypted_pms(mbedtls_ssl_context * ssl,const unsigned char * p,const unsigned char * end,size_t pms_offset)3521 static int ssl_parse_encrypted_pms(mbedtls_ssl_context *ssl,
3522 const unsigned char *p,
3523 const unsigned char *end,
3524 size_t pms_offset)
3525 {
3526 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3527 unsigned char *pms = ssl->handshake->premaster + pms_offset;
3528 unsigned char ver[2];
3529 unsigned char fake_pms[48], peer_pms[48];
3530 size_t peer_pmslen;
3531 mbedtls_ct_condition_t diff;
3532
3533 /* In case of a failure in decryption, the decryption may write less than
3534 * 2 bytes of output, but we always read the first two bytes. It doesn't
3535 * matter in the end because diff will be nonzero in that case due to
3536 * ret being nonzero, and we only care whether diff is 0.
3537 * But do initialize peer_pms and peer_pmslen for robustness anyway. This
3538 * also makes memory analyzers happy (don't access uninitialized memory,
3539 * even if it's an unsigned char). */
3540 peer_pms[0] = peer_pms[1] = ~0;
3541 peer_pmslen = 0;
3542
3543 ret = ssl_decrypt_encrypted_pms(ssl, p, end,
3544 peer_pms,
3545 &peer_pmslen,
3546 sizeof(peer_pms));
3547
3548 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3549 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
3550 return ret;
3551 }
3552 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3553
3554 mbedtls_ssl_write_version(ver, ssl->conf->transport,
3555 ssl->session_negotiate->tls_version);
3556
3557 /* Avoid data-dependent branches while checking for invalid
3558 * padding, to protect against timing-based Bleichenbacher-type
3559 * attacks. */
3560 diff = mbedtls_ct_bool(ret);
3561 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pmslen, 48));
3562 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[0], ver[0]));
3563 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[1], ver[1]));
3564
3565 /*
3566 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3567 * must not cause the connection to end immediately; instead, send a
3568 * bad_record_mac later in the handshake.
3569 * To protect against timing-based variants of the attack, we must
3570 * not have any branch that depends on whether the decryption was
3571 * successful. In particular, always generate the fake premaster secret,
3572 * regardless of whether it will ultimately influence the output or not.
3573 */
3574 ret = ssl->conf->f_rng(ssl->conf->p_rng, fake_pms, sizeof(fake_pms));
3575 if (ret != 0) {
3576 /* It's ok to abort on an RNG failure, since this does not reveal
3577 * anything about the RSA decryption. */
3578 return ret;
3579 }
3580
3581 #if defined(MBEDTLS_SSL_DEBUG_ALL)
3582 if (diff != MBEDTLS_CT_FALSE) {
3583 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3584 }
3585 #endif
3586
3587 if (sizeof(ssl->handshake->premaster) < pms_offset ||
3588 sizeof(ssl->handshake->premaster) - pms_offset < 48) {
3589 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3590 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3591 }
3592 ssl->handshake->pmslen = 48;
3593
3594 /* Set pms to either the true or the fake PMS, without
3595 * data-dependent branches. */
3596 mbedtls_ct_memcpy_if(diff, pms, fake_pms, peer_pms, ssl->handshake->pmslen);
3597
3598 return 0;
3599 }
3600 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3601 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3602
3603 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
3604 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_psk_identity(mbedtls_ssl_context * ssl,unsigned char ** p,const unsigned char * end)3605 static int ssl_parse_client_psk_identity(mbedtls_ssl_context *ssl, unsigned char **p,
3606 const unsigned char *end)
3607 {
3608 int ret = 0;
3609 uint16_t n;
3610
3611 if (ssl_conf_has_psk_or_cb(ssl->conf) == 0) {
3612 MBEDTLS_SSL_DEBUG_MSG(1, ("got no pre-shared key"));
3613 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
3614 }
3615
3616 /*
3617 * Receive client pre-shared key identity name
3618 */
3619 if (end - *p < 2) {
3620 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3621 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3622 }
3623
3624 n = MBEDTLS_GET_UINT16_BE(*p, 0);
3625 *p += 2;
3626
3627 if (n == 0 || n > end - *p) {
3628 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3629 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3630 }
3631
3632 if (ssl->conf->f_psk != NULL) {
3633 if (ssl->conf->f_psk(ssl->conf->p_psk, ssl, *p, n) != 0) {
3634 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
3635 }
3636 } else {
3637 /* Identity is not a big secret since clients send it in the clear,
3638 * but treat it carefully anyway, just in case */
3639 if (n != ssl->conf->psk_identity_len ||
3640 mbedtls_ct_memcmp(ssl->conf->psk_identity, *p, n) != 0) {
3641 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
3642 }
3643 }
3644
3645 if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) {
3646 MBEDTLS_SSL_DEBUG_BUF(3, "Unknown PSK identity", *p, n);
3647 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3648 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY);
3649 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
3650 }
3651
3652 *p += n;
3653
3654 return 0;
3655 }
3656 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
3657
3658 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_key_exchange(mbedtls_ssl_context * ssl)3659 static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl)
3660 {
3661 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3662 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
3663 unsigned char *p, *end;
3664
3665 ciphersuite_info = ssl->handshake->ciphersuite_info;
3666
3667 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client key exchange"));
3668
3669 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \
3670 (defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3671 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED))
3672 if ((ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3673 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) &&
3674 (ssl->handshake->async_in_progress != 0)) {
3675 /* We've already read a record and there is an asynchronous
3676 * operation in progress to decrypt it. So skip reading the
3677 * record. */
3678 MBEDTLS_SSL_DEBUG_MSG(3, ("will resume decryption of previously-read record"));
3679 } else
3680 #endif
3681 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
3682 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
3683 return ret;
3684 }
3685
3686 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl);
3687 end = ssl->in_msg + ssl->in_hslen;
3688
3689 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
3690 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3691 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
3692 }
3693
3694 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE) {
3695 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3696 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
3697 }
3698
3699 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3700 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA) {
3701 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) {
3702 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret);
3703 return ret;
3704 }
3705
3706 if (p != end) {
3707 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange"));
3708 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3709 }
3710
3711 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
3712 ssl->handshake->premaster,
3713 MBEDTLS_PREMASTER_SIZE,
3714 &ssl->handshake->pmslen,
3715 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3716 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
3717 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3718 }
3719
3720 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
3721 } else
3722 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3723 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3724 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3725 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3726 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3727 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3728 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3729 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3730 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA) {
3731 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3732 size_t data_len = (size_t) (*p++);
3733 size_t buf_len = (size_t) (end - p);
3734 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
3735 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3736
3737 MBEDTLS_SSL_DEBUG_MSG(3, ("Read the peer's public key."));
3738
3739 /*
3740 * We must have at least two bytes (1 for length, at least 1 for data)
3741 */
3742 if (buf_len < 2) {
3743 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length: %" MBEDTLS_PRINTF_SIZET,
3744 buf_len));
3745 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3746 }
3747
3748 if (data_len < 1 || data_len > buf_len) {
3749 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length: %" MBEDTLS_PRINTF_SIZET
3750 " > %" MBEDTLS_PRINTF_SIZET,
3751 data_len, buf_len));
3752 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3753 }
3754
3755 /* Store peer's ECDH public key. */
3756 if (data_len > sizeof(handshake->xxdh_psa_peerkey)) {
3757 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %" MBEDTLS_PRINTF_SIZET
3758 " > %" MBEDTLS_PRINTF_SIZET,
3759 data_len,
3760 sizeof(handshake->xxdh_psa_peerkey)));
3761 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3762 }
3763 memcpy(handshake->xxdh_psa_peerkey, p, data_len);
3764 handshake->xxdh_psa_peerkey_len = data_len;
3765
3766 /* Compute ECDH shared secret. */
3767 status = psa_raw_key_agreement(
3768 PSA_ALG_ECDH, handshake->xxdh_psa_privkey,
3769 handshake->xxdh_psa_peerkey, handshake->xxdh_psa_peerkey_len,
3770 handshake->premaster, sizeof(handshake->premaster),
3771 &handshake->pmslen);
3772 if (status != PSA_SUCCESS) {
3773 ret = PSA_TO_MBEDTLS_ERR(status);
3774 MBEDTLS_SSL_DEBUG_RET(1, "psa_raw_key_agreement", ret);
3775 if (handshake->xxdh_psa_privkey_is_external == 0) {
3776 (void) psa_destroy_key(handshake->xxdh_psa_privkey);
3777 }
3778 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3779 return ret;
3780 }
3781
3782 if (handshake->xxdh_psa_privkey_is_external == 0) {
3783 status = psa_destroy_key(handshake->xxdh_psa_privkey);
3784
3785 if (status != PSA_SUCCESS) {
3786 ret = PSA_TO_MBEDTLS_ERR(status);
3787 MBEDTLS_SSL_DEBUG_RET(1, "psa_destroy_key", ret);
3788 return ret;
3789 }
3790 }
3791 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3792 #else
3793 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx,
3794 p, (size_t) (end - p))) != 0) {
3795 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret);
3796 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3797 }
3798
3799 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3800 MBEDTLS_DEBUG_ECDH_QP);
3801
3802 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx,
3803 &ssl->handshake->pmslen,
3804 ssl->handshake->premaster,
3805 MBEDTLS_MPI_MAX_SIZE,
3806 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3807 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
3808 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3809 }
3810
3811 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3812 MBEDTLS_DEBUG_ECDH_Z);
3813 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3814 } else
3815 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3816 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3817 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3818 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3819 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3820 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK) {
3821 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3822 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3823 return ret;
3824 }
3825
3826 if (p != end) {
3827 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange"));
3828 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3829 }
3830
3831 #if !defined(MBEDTLS_USE_PSA_CRYPTO)
3832 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3833 (mbedtls_key_exchange_type_t) ciphersuite_info->
3834 key_exchange)) != 0) {
3835 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
3836 return ret;
3837 }
3838 #endif /* !MBEDTLS_USE_PSA_CRYPTO */
3839 } else
3840 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
3841 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3842 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
3843 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3844 if (ssl->handshake->async_in_progress != 0) {
3845 /* There is an asynchronous operation in progress to
3846 * decrypt the encrypted premaster secret, so skip
3847 * directly to resuming this operation. */
3848 MBEDTLS_SSL_DEBUG_MSG(3, ("PSK identity already parsed"));
3849 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms
3850 * won't actually use it, but maintain p anyway for robustness. */
3851 p += ssl->conf->psk_identity_len + 2;
3852 } else
3853 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3854 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3855 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3856 return ret;
3857 }
3858
3859 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 2)) != 0) {
3860 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_encrypted_pms"), ret);
3861 return ret;
3862 }
3863
3864 #if !defined(MBEDTLS_USE_PSA_CRYPTO)
3865 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3866 (mbedtls_key_exchange_type_t) ciphersuite_info->
3867 key_exchange)) != 0) {
3868 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
3869 return ret;
3870 }
3871 #endif /* !MBEDTLS_USE_PSA_CRYPTO */
3872 } else
3873 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3874 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3875 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
3876 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3877 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3878 return ret;
3879 }
3880 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) {
3881 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret);
3882 return ret;
3883 }
3884
3885 if (p != end) {
3886 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange"));
3887 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3888 }
3889
3890 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3891 unsigned char *pms = ssl->handshake->premaster;
3892 unsigned char *pms_end = pms + sizeof(ssl->handshake->premaster);
3893 size_t pms_len;
3894
3895 /* Write length only when we know the actual value */
3896 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
3897 pms + 2, pms_end - (pms + 2), &pms_len,
3898 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3899 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
3900 return ret;
3901 }
3902 MBEDTLS_PUT_UINT16_BE(pms_len, pms, 0);
3903 pms += 2 + pms_len;
3904
3905 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
3906 #else
3907 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3908 (mbedtls_key_exchange_type_t) ciphersuite_info->
3909 key_exchange)) != 0) {
3910 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
3911 return ret;
3912 }
3913 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3914 } else
3915 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3916 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3917 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
3918 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3919 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3920 psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED;
3921 uint8_t ecpoint_len;
3922
3923 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3924
3925 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3926 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3927 psa_destroy_key(handshake->xxdh_psa_privkey);
3928 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3929 return ret;
3930 }
3931
3932 /* Keep a copy of the peer's public key */
3933 if (p >= end) {
3934 psa_destroy_key(handshake->xxdh_psa_privkey);
3935 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3936 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3937 }
3938
3939 ecpoint_len = *(p++);
3940 if ((size_t) (end - p) < ecpoint_len) {
3941 psa_destroy_key(handshake->xxdh_psa_privkey);
3942 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3943 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3944 }
3945
3946 /* When FFDH is enabled, the array handshake->xxdh_psa_peer_key size takes into account
3947 the sizes of the FFDH keys which are at least 2048 bits.
3948 The size of the array is thus greater than 256 bytes which is greater than any
3949 possible value of ecpoint_len (type uint8_t) and the check below can be skipped.*/
3950 #if !defined(PSA_WANT_ALG_FFDH)
3951 if (ecpoint_len > sizeof(handshake->xxdh_psa_peerkey)) {
3952 psa_destroy_key(handshake->xxdh_psa_privkey);
3953 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3954 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3955 }
3956 #else
3957 MBEDTLS_STATIC_ASSERT(sizeof(handshake->xxdh_psa_peerkey) >= UINT8_MAX,
3958 "peer key buffer too small");
3959 #endif
3960
3961 memcpy(handshake->xxdh_psa_peerkey, p, ecpoint_len);
3962 handshake->xxdh_psa_peerkey_len = ecpoint_len;
3963 p += ecpoint_len;
3964
3965 /* As RFC 5489 section 2, the premaster secret is formed as follows:
3966 * - a uint16 containing the length (in octets) of the ECDH computation
3967 * - the octet string produced by the ECDH computation
3968 * - a uint16 containing the length (in octets) of the PSK
3969 * - the PSK itself
3970 */
3971 unsigned char *psm = ssl->handshake->premaster;
3972 const unsigned char * const psm_end =
3973 psm + sizeof(ssl->handshake->premaster);
3974 /* uint16 to store length (in octets) of the ECDH computation */
3975 const size_t zlen_size = 2;
3976 size_t zlen = 0;
3977
3978 /* Compute ECDH shared secret. */
3979 status = psa_raw_key_agreement(PSA_ALG_ECDH,
3980 handshake->xxdh_psa_privkey,
3981 handshake->xxdh_psa_peerkey,
3982 handshake->xxdh_psa_peerkey_len,
3983 psm + zlen_size,
3984 psm_end - (psm + zlen_size),
3985 &zlen);
3986
3987 destruction_status = psa_destroy_key(handshake->xxdh_psa_privkey);
3988 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3989
3990 if (status != PSA_SUCCESS) {
3991 return PSA_TO_MBEDTLS_ERR(status);
3992 } else if (destruction_status != PSA_SUCCESS) {
3993 return PSA_TO_MBEDTLS_ERR(destruction_status);
3994 }
3995
3996 /* Write the ECDH computation length before the ECDH computation */
3997 MBEDTLS_PUT_UINT16_BE(zlen, psm, 0);
3998 psm += zlen_size + zlen;
3999
4000 #else /* MBEDTLS_USE_PSA_CRYPTO */
4001 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
4002 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
4003 return ret;
4004 }
4005
4006 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx,
4007 p, (size_t) (end - p))) != 0) {
4008 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret);
4009 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4010 }
4011
4012 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
4013 MBEDTLS_DEBUG_ECDH_QP);
4014
4015 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
4016 (mbedtls_key_exchange_type_t) ciphersuite_info->
4017 key_exchange)) != 0) {
4018 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
4019 return ret;
4020 }
4021 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4022 } else
4023 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
4024 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
4025 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) {
4026 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 0)) != 0) {
4027 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_parse_encrypted_pms_secret"), ret);
4028 return ret;
4029 }
4030 } else
4031 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
4032 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4033 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
4034 #if defined(MBEDTLS_USE_PSA_CRYPTO)
4035 if ((ret = mbedtls_psa_ecjpake_read_round(
4036 &ssl->handshake->psa_pake_ctx, p, (size_t) (end - p),
4037 MBEDTLS_ECJPAKE_ROUND_TWO)) != 0) {
4038 psa_destroy_key(ssl->handshake->psa_pake_password);
4039 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
4040
4041 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round two", ret);
4042 return ret;
4043 }
4044 #else
4045 ret = mbedtls_ecjpake_read_round_two(&ssl->handshake->ecjpake_ctx,
4046 p, (size_t) (end - p));
4047 if (ret != 0) {
4048 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_two", ret);
4049 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4050 }
4051
4052 ret = mbedtls_ecjpake_derive_secret(&ssl->handshake->ecjpake_ctx,
4053 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
4054 ssl->conf->f_rng, ssl->conf->p_rng);
4055 if (ret != 0) {
4056 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_derive_secret", ret);
4057 return ret;
4058 }
4059 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4060 } else
4061 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
4062 {
4063 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
4064 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4065 }
4066
4067 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) {
4068 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret);
4069 return ret;
4070 }
4071
4072 ssl->state++;
4073
4074 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client key exchange"));
4075
4076 return 0;
4077 }
4078
4079 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
4080 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl)4081 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl)
4082 {
4083 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
4084 ssl->handshake->ciphersuite_info;
4085
4086 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify"));
4087
4088 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) {
4089 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4090 ssl->state++;
4091 return 0;
4092 }
4093
4094 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
4095 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4096 }
4097 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
4098 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl)4099 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl)
4100 {
4101 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
4102 size_t i, sig_len;
4103 unsigned char hash[48];
4104 unsigned char *hash_start = hash;
4105 size_t hashlen;
4106 mbedtls_pk_type_t pk_alg;
4107 mbedtls_md_type_t md_alg;
4108 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
4109 ssl->handshake->ciphersuite_info;
4110 mbedtls_pk_context *peer_pk;
4111
4112 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify"));
4113
4114 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) {
4115 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4116 ssl->state++;
4117 return 0;
4118 }
4119
4120 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4121 if (ssl->session_negotiate->peer_cert == NULL) {
4122 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4123 ssl->state++;
4124 return 0;
4125 }
4126 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4127 if (ssl->session_negotiate->peer_cert_digest == NULL) {
4128 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4129 ssl->state++;
4130 return 0;
4131 }
4132 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4133
4134 /* Read the message without adding it to the checksum */
4135 ret = mbedtls_ssl_read_record(ssl, 0 /* no checksum update */);
4136 if (0 != ret) {
4137 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_read_record"), ret);
4138 return ret;
4139 }
4140
4141 ssl->state++;
4142
4143 /* Process the message contents */
4144 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
4145 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY) {
4146 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4147 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
4148 }
4149
4150 i = mbedtls_ssl_hs_hdr_len(ssl);
4151
4152 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4153 peer_pk = &ssl->handshake->peer_pubkey;
4154 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4155 if (ssl->session_negotiate->peer_cert == NULL) {
4156 /* Should never happen */
4157 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4158 }
4159 peer_pk = &ssl->session_negotiate->peer_cert->pk;
4160 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4161
4162 /*
4163 * struct {
4164 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
4165 * opaque signature<0..2^16-1>;
4166 * } DigitallySigned;
4167 */
4168 if (i + 2 > ssl->in_hslen) {
4169 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4170 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4171 }
4172
4173 /*
4174 * Hash
4175 */
4176 md_alg = mbedtls_ssl_md_alg_from_hash(ssl->in_msg[i]);
4177
4178 if (md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md(ssl, ssl->in_msg[i])) {
4179 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg"
4180 " for verify message"));
4181 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
4182 }
4183
4184 #if !defined(MBEDTLS_MD_SHA1)
4185 if (MBEDTLS_MD_SHA1 == md_alg) {
4186 hash_start += 16;
4187 }
4188 #endif
4189
4190 /* Info from md_alg will be used instead */
4191 hashlen = 0;
4192
4193 i++;
4194
4195 /*
4196 * Signature
4197 */
4198 if ((pk_alg = mbedtls_ssl_pk_alg_from_sig(ssl->in_msg[i]))
4199 == MBEDTLS_PK_NONE) {
4200 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg"
4201 " for verify message"));
4202 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
4203 }
4204
4205 /*
4206 * Check the certificate's key type matches the signature alg
4207 */
4208 if (!mbedtls_pk_can_do(peer_pk, pk_alg)) {
4209 MBEDTLS_SSL_DEBUG_MSG(1, ("sig_alg doesn't match cert key"));
4210 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
4211 }
4212
4213 i++;
4214
4215 if (i + 2 > ssl->in_hslen) {
4216 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4217 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4218 }
4219
4220 sig_len = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i);
4221 i += 2;
4222
4223 if (i + sig_len != ssl->in_hslen) {
4224 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4225 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4226 }
4227
4228 /* Calculate hash and verify signature */
4229 {
4230 size_t dummy_hlen;
4231 ret = ssl->handshake->calc_verify(ssl, hash, &dummy_hlen);
4232 if (0 != ret) {
4233 MBEDTLS_SSL_DEBUG_RET(1, ("calc_verify"), ret);
4234 return ret;
4235 }
4236 }
4237
4238 if ((ret = mbedtls_pk_verify(peer_pk,
4239 md_alg, hash_start, hashlen,
4240 ssl->in_msg + i, sig_len)) != 0) {
4241 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify", ret);
4242 return ret;
4243 }
4244
4245 ret = mbedtls_ssl_update_handshake_status(ssl);
4246 if (0 != ret) {
4247 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_update_handshake_status"), ret);
4248 return ret;
4249 }
4250
4251 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify"));
4252
4253 return ret;
4254 }
4255 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
4256
4257 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4258 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_new_session_ticket(mbedtls_ssl_context * ssl)4259 static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl)
4260 {
4261 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4262 size_t tlen;
4263 uint32_t lifetime;
4264
4265 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write new session ticket"));
4266
4267 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4268 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
4269
4270 /*
4271 * struct {
4272 * uint32 ticket_lifetime_hint;
4273 * opaque ticket<0..2^16-1>;
4274 * } NewSessionTicket;
4275 *
4276 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
4277 * 8 . 9 ticket_len (n)
4278 * 10 . 9+n ticket content
4279 */
4280
4281 #if defined(MBEDTLS_HAVE_TIME)
4282 ssl->session_negotiate->ticket_creation_time = mbedtls_ms_time();
4283 #endif
4284 if ((ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket,
4285 ssl->session_negotiate,
4286 ssl->out_msg + 10,
4287 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
4288 &tlen, &lifetime)) != 0) {
4289 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_write", ret);
4290 tlen = 0;
4291 }
4292
4293 MBEDTLS_PUT_UINT32_BE(lifetime, ssl->out_msg, 4);
4294 MBEDTLS_PUT_UINT16_BE(tlen, ssl->out_msg, 8);
4295 ssl->out_msglen = 10 + tlen;
4296
4297 /*
4298 * Morally equivalent to updating ssl->state, but NewSessionTicket and
4299 * ChangeCipherSpec share the same state.
4300 */
4301 ssl->handshake->new_session_ticket = 0;
4302
4303 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
4304 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
4305 return ret;
4306 }
4307
4308 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket"));
4309
4310 return 0;
4311 }
4312 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4313
4314 /*
4315 * SSL handshake -- server side -- single step
4316 */
mbedtls_ssl_handshake_server_step(mbedtls_ssl_context * ssl)4317 int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl)
4318 {
4319 int ret = 0;
4320
4321 MBEDTLS_SSL_DEBUG_MSG(2, ("server state: %d", ssl->state));
4322
4323 switch (ssl->state) {
4324 case MBEDTLS_SSL_HELLO_REQUEST:
4325 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
4326 break;
4327
4328 /*
4329 * <== ClientHello
4330 */
4331 case MBEDTLS_SSL_CLIENT_HELLO:
4332 ret = ssl_parse_client_hello(ssl);
4333 break;
4334
4335 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4336 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
4337 return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED;
4338 #endif
4339
4340 /*
4341 * ==> ServerHello
4342 * Certificate
4343 * ( ServerKeyExchange )
4344 * ( CertificateRequest )
4345 * ServerHelloDone
4346 */
4347 case MBEDTLS_SSL_SERVER_HELLO:
4348 ret = ssl_write_server_hello(ssl);
4349 break;
4350
4351 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4352 ret = mbedtls_ssl_write_certificate(ssl);
4353 break;
4354
4355 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
4356 ret = ssl_write_server_key_exchange(ssl);
4357 break;
4358
4359 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
4360 ret = ssl_write_certificate_request(ssl);
4361 break;
4362
4363 case MBEDTLS_SSL_SERVER_HELLO_DONE:
4364 ret = ssl_write_server_hello_done(ssl);
4365 break;
4366
4367 /*
4368 * <== ( Certificate/Alert )
4369 * ClientKeyExchange
4370 * ( CertificateVerify )
4371 * ChangeCipherSpec
4372 * Finished
4373 */
4374 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4375 ret = mbedtls_ssl_parse_certificate(ssl);
4376 break;
4377
4378 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
4379 ret = ssl_parse_client_key_exchange(ssl);
4380 break;
4381
4382 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
4383 ret = ssl_parse_certificate_verify(ssl);
4384 break;
4385
4386 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4387 ret = mbedtls_ssl_parse_change_cipher_spec(ssl);
4388 break;
4389
4390 case MBEDTLS_SSL_CLIENT_FINISHED:
4391 ret = mbedtls_ssl_parse_finished(ssl);
4392 break;
4393
4394 /*
4395 * ==> ( NewSessionTicket )
4396 * ChangeCipherSpec
4397 * Finished
4398 */
4399 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4400 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4401 if (ssl->handshake->new_session_ticket != 0) {
4402 ret = ssl_write_new_session_ticket(ssl);
4403 } else
4404 #endif
4405 ret = mbedtls_ssl_write_change_cipher_spec(ssl);
4406 break;
4407
4408 case MBEDTLS_SSL_SERVER_FINISHED:
4409 ret = mbedtls_ssl_write_finished(ssl);
4410 break;
4411
4412 case MBEDTLS_SSL_FLUSH_BUFFERS:
4413 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done"));
4414 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
4415 break;
4416
4417 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4418 mbedtls_ssl_handshake_wrapup(ssl);
4419 break;
4420
4421 default:
4422 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state));
4423 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4424 }
4425
4426 return ret;
4427 }
4428
mbedtls_ssl_conf_preference_order(mbedtls_ssl_config * conf,int order)4429 void mbedtls_ssl_conf_preference_order(mbedtls_ssl_config *conf, int order)
4430 {
4431 conf->respect_cli_pref = order;
4432 }
4433
4434 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_2 */
4435