1 /*
2 * TLS 1.3 functionality shared between client and server
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
11
12 #include <string.h>
13
14 #include "mbedtls/error.h"
15 #include "debug_internal.h"
16 #include "mbedtls/oid.h"
17 #include "mbedtls/platform.h"
18 #include "mbedtls/constant_time.h"
19 #include "psa/crypto.h"
20 #include "mbedtls/psa_util.h"
21
22 #include "ssl_misc.h"
23 #include "ssl_tls13_invasive.h"
24 #include "ssl_tls13_keys.h"
25 #include "ssl_debug_helpers.h"
26
27 #include "psa/crypto.h"
28 #include "psa_util_internal.h"
29
30 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
31 /* Define a local translating function to save code size by not using too many
32 * arguments in each translating place. */
local_err_translation(psa_status_t status)33 static int local_err_translation(psa_status_t status)
34 {
35 return psa_status_to_mbedtls(status, psa_to_ssl_errors,
36 ARRAY_LENGTH(psa_to_ssl_errors),
37 psa_generic_status_to_mbedtls);
38 }
39 #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
40 #endif
41
42 const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[
43 MBEDTLS_SERVER_HELLO_RANDOM_LEN] =
44 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
45 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
46 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
47 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C };
48
mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context * ssl,unsigned hs_type,unsigned char ** buf,size_t * buf_len)49 int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
50 unsigned hs_type,
51 unsigned char **buf,
52 size_t *buf_len)
53 {
54 int ret;
55
56 if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) {
57 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
58 goto cleanup;
59 }
60
61 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
62 ssl->in_msg[0] != hs_type) {
63 MBEDTLS_SSL_DEBUG_MSG(1, ("Receive unexpected handshake message."));
64 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
65 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
66 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
67 goto cleanup;
68 }
69
70 /*
71 * Jump handshake header (4 bytes, see Section 4 of RFC 8446).
72 * ...
73 * HandshakeType msg_type;
74 * uint24 length;
75 * ...
76 */
77 *buf = ssl->in_msg + 4;
78 *buf_len = ssl->in_hslen - 4;
79
80 cleanup:
81
82 return ret;
83 }
84
mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end,const unsigned char ** supported_versions_data,const unsigned char ** supported_versions_data_end)85 int mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts(
86 mbedtls_ssl_context *ssl,
87 const unsigned char *buf, const unsigned char *end,
88 const unsigned char **supported_versions_data,
89 const unsigned char **supported_versions_data_end)
90 {
91 const unsigned char *p = buf;
92 size_t extensions_len;
93 const unsigned char *extensions_end;
94
95 *supported_versions_data = NULL;
96 *supported_versions_data_end = NULL;
97
98 /* Case of no extension */
99 if (p == end) {
100 return 0;
101 }
102
103 /* ...
104 * Extension extensions<x..2^16-1>;
105 * ...
106 * struct {
107 * ExtensionType extension_type; (2 bytes)
108 * opaque extension_data<0..2^16-1>;
109 * } Extension;
110 */
111 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
112 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
113 p += 2;
114
115 /* Check extensions do not go beyond the buffer of data. */
116 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len);
117 extensions_end = p + extensions_len;
118
119 while (p < extensions_end) {
120 unsigned int extension_type;
121 size_t extension_data_len;
122
123 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
124 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
125 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
126 p += 4;
127 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
128
129 if (extension_type == MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS) {
130 *supported_versions_data = p;
131 *supported_versions_data_end = p + extension_data_len;
132 return 1;
133 }
134 p += extension_data_len;
135 }
136
137 return 0;
138 }
139
140 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
141 /*
142 * STATE HANDLING: Read CertificateVerify
143 */
144 /* Macro to express the maximum length of the verify structure.
145 *
146 * The structure is computed per TLS 1.3 specification as:
147 * - 64 bytes of octet 32,
148 * - 33 bytes for the context string
149 * (which is either "TLS 1.3, client CertificateVerify"
150 * or "TLS 1.3, server CertificateVerify"),
151 * - 1 byte for the octet 0x0, which serves as a separator,
152 * - 32 or 48 bytes for the Transcript-Hash(Handshake Context, Certificate)
153 * (depending on the size of the transcript_hash)
154 *
155 * This results in a total size of
156 * - 130 bytes for a SHA256-based transcript hash, or
157 * (64 + 33 + 1 + 32 bytes)
158 * - 146 bytes for a SHA384-based transcript hash.
159 * (64 + 33 + 1 + 48 bytes)
160 *
161 */
162 #define SSL_VERIFY_STRUCT_MAX_SIZE (64 + \
163 33 + \
164 1 + \
165 MBEDTLS_TLS1_3_MD_MAX_SIZE \
166 )
167
168 /*
169 * The ssl_tls13_create_verify_structure() creates the verify structure.
170 * As input, it requires the transcript hash.
171 *
172 * The caller has to ensure that the buffer has size at least
173 * SSL_VERIFY_STRUCT_MAX_SIZE bytes.
174 */
ssl_tls13_create_verify_structure(const unsigned char * transcript_hash,size_t transcript_hash_len,unsigned char * verify_buffer,size_t * verify_buffer_len,int from)175 static void ssl_tls13_create_verify_structure(const unsigned char *transcript_hash,
176 size_t transcript_hash_len,
177 unsigned char *verify_buffer,
178 size_t *verify_buffer_len,
179 int from)
180 {
181 size_t idx;
182
183 /* RFC 8446, Section 4.4.3:
184 *
185 * The digital signature [in the CertificateVerify message] is then
186 * computed over the concatenation of:
187 * - A string that consists of octet 32 (0x20) repeated 64 times
188 * - The context string
189 * - A single 0 byte which serves as the separator
190 * - The content to be signed
191 */
192 memset(verify_buffer, 0x20, 64);
193 idx = 64;
194
195 if (from == MBEDTLS_SSL_IS_CLIENT) {
196 memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(client_cv));
197 idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(client_cv);
198 } else { /* from == MBEDTLS_SSL_IS_SERVER */
199 memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(server_cv));
200 idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(server_cv);
201 }
202
203 verify_buffer[idx++] = 0x0;
204
205 memcpy(verify_buffer + idx, transcript_hash, transcript_hash_len);
206 idx += transcript_hash_len;
207
208 *verify_buffer_len = idx;
209 }
210
211 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_certificate_verify(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end,const unsigned char * verify_buffer,size_t verify_buffer_len)212 static int ssl_tls13_parse_certificate_verify(mbedtls_ssl_context *ssl,
213 const unsigned char *buf,
214 const unsigned char *end,
215 const unsigned char *verify_buffer,
216 size_t verify_buffer_len)
217 {
218 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
219 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
220 const unsigned char *p = buf;
221 uint16_t algorithm;
222 size_t signature_len;
223 mbedtls_pk_type_t sig_alg;
224 mbedtls_md_type_t md_alg;
225 psa_algorithm_t hash_alg = PSA_ALG_NONE;
226 unsigned char verify_hash[PSA_HASH_MAX_SIZE];
227 size_t verify_hash_len;
228
229 void const *options = NULL;
230 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
231 mbedtls_pk_rsassa_pss_options rsassa_pss_options;
232 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
233
234 /*
235 * struct {
236 * SignatureScheme algorithm;
237 * opaque signature<0..2^16-1>;
238 * } CertificateVerify;
239 */
240 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
241 algorithm = MBEDTLS_GET_UINT16_BE(p, 0);
242 p += 2;
243
244 /* RFC 8446 section 4.4.3
245 *
246 * If the CertificateVerify message is sent by a server, the signature
247 * algorithm MUST be one offered in the client's "signature_algorithms"
248 * extension unless no valid certificate chain can be produced without
249 * unsupported algorithms
250 *
251 * RFC 8446 section 4.4.2.2
252 *
253 * If the client cannot construct an acceptable chain using the provided
254 * certificates and decides to abort the handshake, then it MUST abort the
255 * handshake with an appropriate certificate-related alert
256 * (by default, "unsupported_certificate").
257 *
258 * Check if algorithm is an offered signature algorithm.
259 */
260 if (!mbedtls_ssl_sig_alg_is_offered(ssl, algorithm)) {
261 /* algorithm not in offered signature algorithms list */
262 MBEDTLS_SSL_DEBUG_MSG(1, ("Received signature algorithm(%04x) is not "
263 "offered.",
264 (unsigned int) algorithm));
265 goto error;
266 }
267
268 if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(
269 algorithm, &sig_alg, &md_alg) != 0) {
270 goto error;
271 }
272
273 hash_alg = mbedtls_md_psa_alg_from_type(md_alg);
274 if (hash_alg == 0) {
275 goto error;
276 }
277
278 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate Verify: Signature algorithm ( %04x )",
279 (unsigned int) algorithm));
280
281 /*
282 * Check the certificate's key type matches the signature alg
283 */
284 if (!mbedtls_pk_can_do(&ssl->session_negotiate->peer_cert->pk, sig_alg)) {
285 MBEDTLS_SSL_DEBUG_MSG(1, ("signature algorithm doesn't match cert key"));
286 goto error;
287 }
288
289 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
290 signature_len = MBEDTLS_GET_UINT16_BE(p, 0);
291 p += 2;
292 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, signature_len);
293
294 status = psa_hash_compute(hash_alg,
295 verify_buffer,
296 verify_buffer_len,
297 verify_hash,
298 sizeof(verify_hash),
299 &verify_hash_len);
300 if (status != PSA_SUCCESS) {
301 MBEDTLS_SSL_DEBUG_RET(1, "hash computation PSA error", status);
302 goto error;
303 }
304
305 MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len);
306 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
307 if (sig_alg == MBEDTLS_PK_RSASSA_PSS) {
308 rsassa_pss_options.mgf1_hash_id = md_alg;
309
310 rsassa_pss_options.expected_salt_len = PSA_HASH_LENGTH(hash_alg);
311 options = (const void *) &rsassa_pss_options;
312 }
313 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
314
315 if ((ret = mbedtls_pk_verify_ext(sig_alg, options,
316 &ssl->session_negotiate->peer_cert->pk,
317 md_alg, verify_hash, verify_hash_len,
318 p, signature_len)) == 0) {
319 return 0;
320 }
321 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify_ext", ret);
322
323 error:
324 /* RFC 8446 section 4.4.3
325 *
326 * If the verification fails, the receiver MUST terminate the handshake
327 * with a "decrypt_error" alert.
328 */
329 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
330 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
331 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
332
333 }
334 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
335
mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context * ssl)336 int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl)
337 {
338
339 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
340 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
341 unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE];
342 size_t verify_buffer_len;
343 unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE];
344 size_t transcript_len;
345 unsigned char *buf;
346 size_t buf_len;
347
348 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify"));
349
350 MBEDTLS_SSL_PROC_CHK(
351 mbedtls_ssl_tls13_fetch_handshake_msg(
352 ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, &buf_len));
353
354 /* Need to calculate the hash of the transcript first
355 * before reading the message since otherwise it gets
356 * included in the transcript
357 */
358 ret = mbedtls_ssl_get_handshake_transcript(
359 ssl,
360 (mbedtls_md_type_t) ssl->handshake->ciphersuite_info->mac,
361 transcript, sizeof(transcript),
362 &transcript_len);
363 if (ret != 0) {
364 MBEDTLS_SSL_PEND_FATAL_ALERT(
365 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR,
366 MBEDTLS_ERR_SSL_INTERNAL_ERROR);
367 return ret;
368 }
369
370 MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash", transcript, transcript_len);
371
372 /* Create verify structure */
373 ssl_tls13_create_verify_structure(transcript,
374 transcript_len,
375 verify_buffer,
376 &verify_buffer_len,
377 (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) ?
378 MBEDTLS_SSL_IS_SERVER :
379 MBEDTLS_SSL_IS_CLIENT);
380
381 /* Process the message contents */
382 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_verify(
383 ssl, buf, buf + buf_len,
384 verify_buffer, verify_buffer_len));
385
386 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
387 ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY,
388 buf, buf_len));
389
390 cleanup:
391
392 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify"));
393 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_process_certificate_verify", ret);
394 return ret;
395 #else
396 ((void) ssl);
397 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
398 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
399 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
400 }
401
402 /*
403 *
404 * STATE HANDLING: Incoming Certificate.
405 *
406 */
407
408 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
409 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
410 /*
411 * Structure of Certificate message:
412 *
413 * enum {
414 * X509(0),
415 * RawPublicKey(2),
416 * (255)
417 * } CertificateType;
418 *
419 * struct {
420 * select (certificate_type) {
421 * case RawPublicKey:
422 * * From RFC 7250 ASN.1_subjectPublicKeyInfo *
423 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
424 * case X509:
425 * opaque cert_data<1..2^24-1>;
426 * };
427 * Extension extensions<0..2^16-1>;
428 * } CertificateEntry;
429 *
430 * struct {
431 * opaque certificate_request_context<0..2^8-1>;
432 * CertificateEntry certificate_list<0..2^24-1>;
433 * } Certificate;
434 *
435 */
436
437 /* Parse certificate chain send by the server. */
438 MBEDTLS_CHECK_RETURN_CRITICAL
439 MBEDTLS_STATIC_TESTABLE
mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)440 int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl,
441 const unsigned char *buf,
442 const unsigned char *end)
443 {
444 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
445 size_t certificate_request_context_len = 0;
446 size_t certificate_list_len = 0;
447 const unsigned char *p = buf;
448 const unsigned char *certificate_list_end;
449 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
450
451 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4);
452 certificate_request_context_len = p[0];
453 certificate_list_len = MBEDTLS_GET_UINT24_BE(p, 1);
454 p += 4;
455
456 /* In theory, the certificate list can be up to 2^24 Bytes, but we don't
457 * support anything beyond 2^16 = 64K.
458 */
459 if ((certificate_request_context_len != 0) ||
460 (certificate_list_len >= 0x10000)) {
461 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message"));
462 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
463 MBEDTLS_ERR_SSL_DECODE_ERROR);
464 return MBEDTLS_ERR_SSL_DECODE_ERROR;
465 }
466
467 /* In case we tried to reuse a session but it failed */
468 if (ssl->session_negotiate->peer_cert != NULL) {
469 mbedtls_x509_crt_free(ssl->session_negotiate->peer_cert);
470 mbedtls_free(ssl->session_negotiate->peer_cert);
471 }
472
473 /* This is used by ssl_tls13_validate_certificate() */
474 if (certificate_list_len == 0) {
475 ssl->session_negotiate->peer_cert = NULL;
476 ret = 0;
477 goto exit;
478 }
479
480 if ((ssl->session_negotiate->peer_cert =
481 mbedtls_calloc(1, sizeof(mbedtls_x509_crt))) == NULL) {
482 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc( %" MBEDTLS_PRINTF_SIZET " bytes ) failed",
483 sizeof(mbedtls_x509_crt)));
484 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR,
485 MBEDTLS_ERR_SSL_ALLOC_FAILED);
486 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
487 }
488
489 mbedtls_x509_crt_init(ssl->session_negotiate->peer_cert);
490
491 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, certificate_list_len);
492 certificate_list_end = p + certificate_list_len;
493 while (p < certificate_list_end) {
494 size_t cert_data_len, extensions_len;
495 const unsigned char *extensions_end;
496
497 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 3);
498 cert_data_len = MBEDTLS_GET_UINT24_BE(p, 0);
499 p += 3;
500
501 /* In theory, the CRT can be up to 2^24 Bytes, but we don't support
502 * anything beyond 2^16 = 64K. Otherwise as in the TLS 1.2 code,
503 * check that we have a minimum of 128 bytes of data, this is not
504 * clear why we need that though.
505 */
506 if ((cert_data_len < 128) || (cert_data_len >= 0x10000)) {
507 MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message"));
508 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
509 MBEDTLS_ERR_SSL_DECODE_ERROR);
510 return MBEDTLS_ERR_SSL_DECODE_ERROR;
511 }
512
513 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, cert_data_len);
514 ret = mbedtls_x509_crt_parse_der(ssl->session_negotiate->peer_cert,
515 p, cert_data_len);
516
517 switch (ret) {
518 case 0: /*ok*/
519 break;
520 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND:
521 /* Ignore certificate with an unknown algorithm: maybe a
522 prior certificate was already trusted. */
523 break;
524
525 case MBEDTLS_ERR_X509_ALLOC_FAILED:
526 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR,
527 MBEDTLS_ERR_X509_ALLOC_FAILED);
528 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
529 return ret;
530
531 case MBEDTLS_ERR_X509_UNKNOWN_VERSION:
532 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT,
533 MBEDTLS_ERR_X509_UNKNOWN_VERSION);
534 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
535 return ret;
536
537 default:
538 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT,
539 ret);
540 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret);
541 return ret;
542 }
543
544 p += cert_data_len;
545
546 /* Certificate extensions length */
547 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 2);
548 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
549 p += 2;
550 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, extensions_len);
551
552 extensions_end = p + extensions_len;
553 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
554
555 while (p < extensions_end) {
556 unsigned int extension_type;
557 size_t extension_data_len;
558
559 /*
560 * struct {
561 * ExtensionType extension_type; (2 bytes)
562 * opaque extension_data<0..2^16-1>;
563 * } Extension;
564 */
565 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
566 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
567 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
568 p += 4;
569
570 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
571
572 ret = mbedtls_ssl_tls13_check_received_extension(
573 ssl, MBEDTLS_SSL_HS_CERTIFICATE, extension_type,
574 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CT);
575 if (ret != 0) {
576 return ret;
577 }
578
579 switch (extension_type) {
580 default:
581 MBEDTLS_SSL_PRINT_EXT(
582 3, MBEDTLS_SSL_HS_CERTIFICATE,
583 extension_type, "( ignored )");
584 break;
585 }
586
587 p += extension_data_len;
588 }
589
590 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CERTIFICATE,
591 handshake->received_extensions);
592 }
593
594 exit:
595 /* Check that all the message is consumed. */
596 if (p != end) {
597 MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message"));
598 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
599 MBEDTLS_ERR_SSL_DECODE_ERROR);
600 return MBEDTLS_ERR_SSL_DECODE_ERROR;
601 }
602
603 MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate",
604 ssl->session_negotiate->peer_cert);
605
606 return ret;
607 }
608 #else
609 MBEDTLS_CHECK_RETURN_CRITICAL
610 MBEDTLS_STATIC_TESTABLE
mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)611 int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl,
612 const unsigned char *buf,
613 const unsigned char *end)
614 {
615 ((void) ssl);
616 ((void) buf);
617 ((void) end);
618 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
619 }
620 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
621 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
622
623 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
624 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
625 /* Validate certificate chain sent by the server. */
626 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_validate_certificate(mbedtls_ssl_context * ssl)627 static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl)
628 {
629 /* Authmode: precedence order is SNI if used else configuration */
630 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
631 const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
632 ? ssl->handshake->sni_authmode
633 : ssl->conf->authmode;
634 #else
635 const int authmode = ssl->conf->authmode;
636 #endif
637
638 /*
639 * If the peer hasn't sent a certificate ( i.e. it sent
640 * an empty certificate chain ), this is reflected in the peer CRT
641 * structure being unset.
642 * Check for that and handle it depending on the
643 * authentication mode.
644 */
645 if (ssl->session_negotiate->peer_cert == NULL) {
646 MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate"));
647
648 #if defined(MBEDTLS_SSL_SRV_C)
649 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
650 /* The client was asked for a certificate but didn't send
651 * one. The client should know what's going on, so we
652 * don't send an alert.
653 */
654 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
655 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) {
656 return 0;
657 } else {
658 MBEDTLS_SSL_PEND_FATAL_ALERT(
659 MBEDTLS_SSL_ALERT_MSG_NO_CERT,
660 MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE);
661 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
662 }
663 }
664 #endif /* MBEDTLS_SSL_SRV_C */
665
666 #if defined(MBEDTLS_SSL_CLI_C)
667 /* Regardless of authmode, the server is not allowed to send an empty
668 * certificate chain. (Last paragraph before 4.4.2.1 in RFC 8446: "The
669 * server's certificate_list MUST always be non-empty.") With authmode
670 * optional/none, we continue the handshake if we can't validate the
671 * server's cert, but we still break it if no certificate was sent. */
672 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
673 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_NO_CERT,
674 MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE);
675 return MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE;
676 }
677 #endif /* MBEDTLS_SSL_CLI_C */
678 }
679
680 return mbedtls_ssl_verify_certificate(ssl, authmode,
681 ssl->session_negotiate->peer_cert,
682 NULL, NULL);
683 }
684 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
685 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_validate_certificate(mbedtls_ssl_context * ssl)686 static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl)
687 {
688 ((void) ssl);
689 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
690 }
691 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
692 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
693
mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context * ssl)694 int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl)
695 {
696 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
697 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate"));
698
699 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
700 unsigned char *buf;
701 size_t buf_len;
702
703 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
704 ssl, MBEDTLS_SSL_HS_CERTIFICATE,
705 &buf, &buf_len));
706
707 /* Parse the certificate chain sent by the peer. */
708 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_parse_certificate(ssl, buf,
709 buf + buf_len));
710 /* Validate the certificate chain and set the verification results. */
711 MBEDTLS_SSL_PROC_CHK(ssl_tls13_validate_certificate(ssl));
712
713 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
714 ssl, MBEDTLS_SSL_HS_CERTIFICATE, buf, buf_len));
715
716 cleanup:
717 #else /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
718 (void) ssl;
719 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
720
721 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate"));
722 return ret;
723 }
724 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
725 /*
726 * enum {
727 * X509(0),
728 * RawPublicKey(2),
729 * (255)
730 * } CertificateType;
731 *
732 * struct {
733 * select (certificate_type) {
734 * case RawPublicKey:
735 * // From RFC 7250 ASN.1_subjectPublicKeyInfo
736 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>;
737 *
738 * case X509:
739 * opaque cert_data<1..2^24-1>;
740 * };
741 * Extension extensions<0..2^16-1>;
742 * } CertificateEntry;
743 *
744 * struct {
745 * opaque certificate_request_context<0..2^8-1>;
746 * CertificateEntry certificate_list<0..2^24-1>;
747 * } Certificate;
748 */
749 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)750 static int ssl_tls13_write_certificate_body(mbedtls_ssl_context *ssl,
751 unsigned char *buf,
752 unsigned char *end,
753 size_t *out_len)
754 {
755 const mbedtls_x509_crt *crt = mbedtls_ssl_own_cert(ssl);
756 unsigned char *p = buf;
757 unsigned char *certificate_request_context =
758 ssl->handshake->certificate_request_context;
759 unsigned char certificate_request_context_len =
760 ssl->handshake->certificate_request_context_len;
761 unsigned char *p_certificate_list_len;
762
763
764 /* ...
765 * opaque certificate_request_context<0..2^8-1>;
766 * ...
767 */
768 MBEDTLS_SSL_CHK_BUF_PTR(p, end, certificate_request_context_len + 1);
769 *p++ = certificate_request_context_len;
770 if (certificate_request_context_len > 0) {
771 memcpy(p, certificate_request_context, certificate_request_context_len);
772 p += certificate_request_context_len;
773 }
774
775 /* ...
776 * CertificateEntry certificate_list<0..2^24-1>;
777 * ...
778 */
779 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3);
780 p_certificate_list_len = p;
781 p += 3;
782
783 MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", crt);
784
785 while (crt != NULL) {
786 size_t cert_data_len = crt->raw.len;
787
788 MBEDTLS_SSL_CHK_BUF_PTR(p, end, cert_data_len + 3 + 2);
789 MBEDTLS_PUT_UINT24_BE(cert_data_len, p, 0);
790 p += 3;
791
792 memcpy(p, crt->raw.p, cert_data_len);
793 p += cert_data_len;
794 crt = crt->next;
795
796 /* Currently, we don't have any certificate extensions defined.
797 * Hence, we are sending an empty extension with length zero.
798 */
799 MBEDTLS_PUT_UINT16_BE(0, p, 0);
800 p += 2;
801 }
802
803 MBEDTLS_PUT_UINT24_BE(p - p_certificate_list_len - 3,
804 p_certificate_list_len, 0);
805
806 *out_len = p - buf;
807
808 MBEDTLS_SSL_PRINT_EXTS(
809 3, MBEDTLS_SSL_HS_CERTIFICATE, ssl->handshake->sent_extensions);
810
811 return 0;
812 }
813
mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context * ssl)814 int mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context *ssl)
815 {
816 int ret;
817 unsigned char *buf;
818 size_t buf_len, msg_len;
819
820 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate"));
821
822 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
823 ssl, MBEDTLS_SSL_HS_CERTIFICATE, &buf, &buf_len));
824
825 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_body(ssl,
826 buf,
827 buf + buf_len,
828 &msg_len));
829
830 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
831 ssl, MBEDTLS_SSL_HS_CERTIFICATE, buf, msg_len));
832
833 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
834 ssl, buf_len, msg_len));
835 cleanup:
836
837 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate"));
838 return ret;
839 }
840
841 /*
842 * STATE HANDLING: Output Certificate Verify
843 */
mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg,mbedtls_pk_context * key)844 int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg,
845 mbedtls_pk_context *key)
846 {
847 mbedtls_pk_type_t pk_type = (mbedtls_pk_type_t) mbedtls_ssl_sig_from_pk(key);
848 size_t key_size = mbedtls_pk_get_bitlen(key);
849
850 switch (pk_type) {
851 case MBEDTLS_SSL_SIG_ECDSA:
852 switch (key_size) {
853 case 256:
854 return
855 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
856
857 case 384:
858 return
859 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384;
860
861 case 521:
862 return
863 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512;
864 default:
865 break;
866 }
867 break;
868
869 case MBEDTLS_SSL_SIG_RSA:
870 switch (sig_alg) {
871 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: /* Intentional fallthrough */
872 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: /* Intentional fallthrough */
873 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
874 return 1;
875
876 default:
877 break;
878 }
879 break;
880
881 default:
882 break;
883 }
884
885 return 0;
886 }
887
888 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)889 static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl,
890 unsigned char *buf,
891 unsigned char *end,
892 size_t *out_len)
893 {
894 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
895 unsigned char *p = buf;
896 mbedtls_pk_context *own_key;
897
898 unsigned char handshake_hash[MBEDTLS_TLS1_3_MD_MAX_SIZE];
899 size_t handshake_hash_len;
900 unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE];
901 size_t verify_buffer_len;
902
903 uint16_t *sig_alg = ssl->handshake->received_sig_algs;
904 size_t signature_len = 0;
905
906 *out_len = 0;
907
908 own_key = mbedtls_ssl_own_key(ssl);
909 if (own_key == NULL) {
910 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
911 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
912 }
913
914 ret = mbedtls_ssl_get_handshake_transcript(
915 ssl, (mbedtls_md_type_t) ssl->handshake->ciphersuite_info->mac,
916 handshake_hash, sizeof(handshake_hash), &handshake_hash_len);
917 if (ret != 0) {
918 return ret;
919 }
920
921 MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash",
922 handshake_hash,
923 handshake_hash_len);
924
925 ssl_tls13_create_verify_structure(handshake_hash, handshake_hash_len,
926 verify_buffer, &verify_buffer_len,
927 ssl->conf->endpoint);
928
929 /*
930 * struct {
931 * SignatureScheme algorithm;
932 * opaque signature<0..2^16-1>;
933 * } CertificateVerify;
934 */
935 /* Check there is space for the algorithm identifier (2 bytes) and the
936 * signature length (2 bytes).
937 */
938 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4);
939
940 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
941 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
942 mbedtls_pk_type_t pk_type = MBEDTLS_PK_NONE;
943 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
944 psa_algorithm_t psa_algorithm = PSA_ALG_NONE;
945 unsigned char verify_hash[PSA_HASH_MAX_SIZE];
946 size_t verify_hash_len;
947
948 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) {
949 continue;
950 }
951
952 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) {
953 continue;
954 }
955
956 if (!mbedtls_ssl_tls13_check_sig_alg_cert_key_match(*sig_alg, own_key)) {
957 continue;
958 }
959
960 if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(
961 *sig_alg, &pk_type, &md_alg) != 0) {
962 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
963 }
964
965 /* Hash verify buffer with indicated hash function */
966 psa_algorithm = mbedtls_md_psa_alg_from_type(md_alg);
967 status = psa_hash_compute(psa_algorithm,
968 verify_buffer,
969 verify_buffer_len,
970 verify_hash, sizeof(verify_hash),
971 &verify_hash_len);
972 if (status != PSA_SUCCESS) {
973 return PSA_TO_MBEDTLS_ERR(status);
974 }
975
976 MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len);
977
978 if ((ret = mbedtls_pk_sign_ext(pk_type, own_key,
979 md_alg, verify_hash, verify_hash_len,
980 p + 4, (size_t) (end - (p + 4)), &signature_len,
981 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
982 MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s",
983 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
984 MBEDTLS_SSL_DEBUG_RET(2, "mbedtls_pk_sign_ext", ret);
985
986 /* The signature failed. This is possible if the private key
987 * was not suitable for the signature operation as purposely we
988 * did not check its suitability completely. Let's try with
989 * another signature algorithm.
990 */
991 continue;
992 }
993
994 MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature with %s",
995 mbedtls_ssl_sig_alg_to_str(*sig_alg)));
996
997 break;
998 }
999
1000 if (*sig_alg == MBEDTLS_TLS1_3_SIG_NONE) {
1001 MBEDTLS_SSL_DEBUG_MSG(1, ("no suitable signature algorithm"));
1002 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1003 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1004 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1005 }
1006
1007 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0);
1008 MBEDTLS_PUT_UINT16_BE(signature_len, p, 2);
1009
1010 *out_len = 4 + signature_len;
1011
1012 return 0;
1013 }
1014
mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context * ssl)1015 int mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl)
1016 {
1017 int ret = 0;
1018 unsigned char *buf;
1019 size_t buf_len, msg_len;
1020
1021 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate verify"));
1022
1023 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
1024 ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY,
1025 &buf, &buf_len));
1026
1027 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_verify_body(
1028 ssl, buf, buf + buf_len, &msg_len));
1029
1030 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
1031 ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY,
1032 buf, msg_len));
1033
1034 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
1035 ssl, buf_len, msg_len));
1036
1037 cleanup:
1038
1039 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate verify"));
1040 return ret;
1041 }
1042
1043 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
1044
1045 /*
1046 *
1047 * STATE HANDLING: Incoming Finished message.
1048 */
1049 /*
1050 * Implementation
1051 */
1052
1053 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_preprocess_finished_message(mbedtls_ssl_context * ssl)1054 static int ssl_tls13_preprocess_finished_message(mbedtls_ssl_context *ssl)
1055 {
1056 int ret;
1057
1058 ret = mbedtls_ssl_tls13_calculate_verify_data(
1059 ssl,
1060 ssl->handshake->state_local.finished_in.digest,
1061 sizeof(ssl->handshake->state_local.finished_in.digest),
1062 &ssl->handshake->state_local.finished_in.digest_len,
1063 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ?
1064 MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT);
1065 if (ret != 0) {
1066 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_calculate_verify_data", ret);
1067 return ret;
1068 }
1069
1070 return 0;
1071 }
1072
1073 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_parse_finished_message(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1074 static int ssl_tls13_parse_finished_message(mbedtls_ssl_context *ssl,
1075 const unsigned char *buf,
1076 const unsigned char *end)
1077 {
1078 /*
1079 * struct {
1080 * opaque verify_data[Hash.length];
1081 * } Finished;
1082 */
1083 const unsigned char *expected_verify_data =
1084 ssl->handshake->state_local.finished_in.digest;
1085 size_t expected_verify_data_len =
1086 ssl->handshake->state_local.finished_in.digest_len;
1087 /* Structural validation */
1088 if ((size_t) (end - buf) != expected_verify_data_len) {
1089 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
1090
1091 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1092 MBEDTLS_ERR_SSL_DECODE_ERROR);
1093 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1094 }
1095
1096 MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (self-computed):",
1097 expected_verify_data,
1098 expected_verify_data_len);
1099 MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (received message):", buf,
1100 expected_verify_data_len);
1101
1102 /* Semantic validation */
1103 if (mbedtls_ct_memcmp(buf,
1104 expected_verify_data,
1105 expected_verify_data_len) != 0) {
1106 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message"));
1107
1108 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
1109 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1110 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1111 }
1112 return 0;
1113 }
1114
mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context * ssl)1115 int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl)
1116 {
1117 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1118 unsigned char *buf;
1119 size_t buf_len;
1120
1121 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message"));
1122
1123 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
1124 ssl, MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len));
1125
1126 /* Preprocessing step: Compute handshake digest */
1127 MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl));
1128
1129 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_finished_message(
1130 ssl, buf, buf + buf_len));
1131
1132 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
1133 ssl, MBEDTLS_SSL_HS_FINISHED, buf, buf_len));
1134
1135 cleanup:
1136
1137 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished message"));
1138 return ret;
1139 }
1140
1141 /*
1142 *
1143 * STATE HANDLING: Write and send Finished message.
1144 *
1145 */
1146 /*
1147 * Implement
1148 */
1149
1150 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_prepare_finished_message(mbedtls_ssl_context * ssl)1151 static int ssl_tls13_prepare_finished_message(mbedtls_ssl_context *ssl)
1152 {
1153 int ret;
1154
1155 /* Compute transcript of handshake up to now. */
1156 ret = mbedtls_ssl_tls13_calculate_verify_data(ssl,
1157 ssl->handshake->state_local.finished_out.digest,
1158 sizeof(ssl->handshake->state_local.finished_out.
1159 digest),
1160 &ssl->handshake->state_local.finished_out.digest_len,
1161 ssl->conf->endpoint);
1162
1163 if (ret != 0) {
1164 MBEDTLS_SSL_DEBUG_RET(1, "calculate_verify_data failed", ret);
1165 return ret;
1166 }
1167
1168 return 0;
1169 }
1170
1171 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_finished_message_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * out_len)1172 static int ssl_tls13_write_finished_message_body(mbedtls_ssl_context *ssl,
1173 unsigned char *buf,
1174 unsigned char *end,
1175 size_t *out_len)
1176 {
1177 size_t verify_data_len = ssl->handshake->state_local.finished_out.digest_len;
1178 /*
1179 * struct {
1180 * opaque verify_data[Hash.length];
1181 * } Finished;
1182 */
1183 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, verify_data_len);
1184
1185 memcpy(buf, ssl->handshake->state_local.finished_out.digest,
1186 verify_data_len);
1187
1188 *out_len = verify_data_len;
1189 return 0;
1190 }
1191
1192 /* Main entry point: orchestrates the other functions */
mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context * ssl)1193 int mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context *ssl)
1194 {
1195 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1196 unsigned char *buf;
1197 size_t buf_len, msg_len;
1198
1199 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished message"));
1200
1201 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_finished_message(ssl));
1202
1203 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
1204 MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len));
1205
1206 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_finished_message_body(
1207 ssl, buf, buf + buf_len, &msg_len));
1208
1209 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl,
1210 MBEDTLS_SSL_HS_FINISHED, buf, msg_len));
1211
1212 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
1213 ssl, buf_len, msg_len));
1214 cleanup:
1215
1216 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished message"));
1217 return ret;
1218 }
1219
mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context * ssl)1220 void mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl)
1221 {
1222
1223 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup"));
1224
1225 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for inbound traffic"));
1226 mbedtls_ssl_set_inbound_transform(ssl, ssl->transform_application);
1227
1228 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for outbound traffic"));
1229 mbedtls_ssl_set_outbound_transform(ssl, ssl->transform_application);
1230
1231 /*
1232 * Free the previous session and switch to the current one.
1233 */
1234 if (ssl->session) {
1235 mbedtls_ssl_session_free(ssl->session);
1236 mbedtls_free(ssl->session);
1237 }
1238 ssl->session = ssl->session_negotiate;
1239 ssl->session_negotiate = NULL;
1240
1241 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup"));
1242 }
1243
1244 /*
1245 *
1246 * STATE HANDLING: Write ChangeCipherSpec
1247 *
1248 */
1249 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
1250 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_tls13_write_change_cipher_spec_body(mbedtls_ssl_context * ssl,unsigned char * buf,unsigned char * end,size_t * olen)1251 static int ssl_tls13_write_change_cipher_spec_body(mbedtls_ssl_context *ssl,
1252 unsigned char *buf,
1253 unsigned char *end,
1254 size_t *olen)
1255 {
1256 ((void) ssl);
1257
1258 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 1);
1259 buf[0] = 1;
1260 *olen = 1;
1261
1262 return 0;
1263 }
1264
mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context * ssl)1265 int mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context *ssl)
1266 {
1267 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1268
1269 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write change cipher spec"));
1270
1271 /* Only one CCS to send. */
1272 if (ssl->handshake->ccs_sent) {
1273 ret = 0;
1274 goto cleanup;
1275 }
1276
1277 /* Write CCS message */
1278 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_change_cipher_spec_body(
1279 ssl, ssl->out_msg,
1280 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
1281 &ssl->out_msglen));
1282
1283 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC;
1284
1285 /* Dispatch message */
1286 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_write_record(ssl, 0));
1287
1288 ssl->handshake->ccs_sent = 1;
1289
1290 cleanup:
1291
1292 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write change cipher spec"));
1293 return ret;
1294 }
1295
1296 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
1297
1298 /* Early Data Indication Extension
1299 *
1300 * struct {
1301 * select ( Handshake.msg_type ) {
1302 * case new_session_ticket: uint32 max_early_data_size;
1303 * case client_hello: Empty;
1304 * case encrypted_extensions: Empty;
1305 * };
1306 * } EarlyDataIndication;
1307 */
1308 #if defined(MBEDTLS_SSL_EARLY_DATA)
mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context * ssl,int in_new_session_ticket,unsigned char * buf,const unsigned char * end,size_t * out_len)1309 int mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context *ssl,
1310 int in_new_session_ticket,
1311 unsigned char *buf,
1312 const unsigned char *end,
1313 size_t *out_len)
1314 {
1315 unsigned char *p = buf;
1316
1317 #if defined(MBEDTLS_SSL_SRV_C)
1318 const size_t needed = in_new_session_ticket ? 8 : 4;
1319 #else
1320 const size_t needed = 4;
1321 ((void) in_new_session_ticket);
1322 #endif
1323
1324 *out_len = 0;
1325
1326 MBEDTLS_SSL_CHK_BUF_PTR(p, end, needed);
1327
1328 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EARLY_DATA, p, 0);
1329 MBEDTLS_PUT_UINT16_BE(needed - 4, p, 2);
1330
1331 #if defined(MBEDTLS_SSL_SRV_C)
1332 if (in_new_session_ticket) {
1333 MBEDTLS_PUT_UINT32_BE(ssl->conf->max_early_data_size, p, 4);
1334 MBEDTLS_SSL_DEBUG_MSG(
1335 4, ("Sent max_early_data_size=%u",
1336 (unsigned int) ssl->conf->max_early_data_size));
1337 }
1338 #endif
1339
1340 *out_len = needed;
1341
1342 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_EARLY_DATA);
1343
1344 return 0;
1345 }
1346
1347 #if defined(MBEDTLS_SSL_SRV_C)
mbedtls_ssl_tls13_check_early_data_len(mbedtls_ssl_context * ssl,size_t early_data_len)1348 int mbedtls_ssl_tls13_check_early_data_len(mbedtls_ssl_context *ssl,
1349 size_t early_data_len)
1350 {
1351 /*
1352 * This function should be called only while an handshake is in progress
1353 * and thus a session under negotiation. Add a sanity check to detect a
1354 * misuse.
1355 */
1356 if (ssl->session_negotiate == NULL) {
1357 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1358 }
1359
1360 /* RFC 8446 section 4.6.1
1361 *
1362 * A server receiving more than max_early_data_size bytes of 0-RTT data
1363 * SHOULD terminate the connection with an "unexpected_message" alert.
1364 * Note that if it is still possible to send early_data_len bytes of early
1365 * data, it means that early_data_len is smaller than max_early_data_size
1366 * (type uint32_t) and can fit in an uint32_t. We use this further
1367 * down.
1368 */
1369 if (early_data_len >
1370 (ssl->session_negotiate->max_early_data_size -
1371 ssl->total_early_data_size)) {
1372
1373 MBEDTLS_SSL_DEBUG_MSG(
1374 2, ("EarlyData: Too much early data received, %u + %" MBEDTLS_PRINTF_SIZET " > %u",
1375 ssl->total_early_data_size, early_data_len,
1376 ssl->session_negotiate->max_early_data_size));
1377
1378 MBEDTLS_SSL_PEND_FATAL_ALERT(
1379 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
1380 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
1381 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
1382 }
1383
1384 /*
1385 * early_data_len has been checked to be less than max_early_data_size
1386 * that is uint32_t. Its cast to an uint32_t below is thus safe. We need
1387 * the cast to appease some compilers.
1388 */
1389 ssl->total_early_data_size += (uint32_t) early_data_len;
1390
1391 return 0;
1392 }
1393 #endif /* MBEDTLS_SSL_SRV_C */
1394 #endif /* MBEDTLS_SSL_EARLY_DATA */
1395
1396 /* Reset SSL context and update hash for handling HRR.
1397 *
1398 * Replace Transcript-Hash(X) by
1399 * Transcript-Hash( message_hash ||
1400 * 00 00 Hash.length ||
1401 * X )
1402 * A few states of the handshake are preserved, including:
1403 * - session ID
1404 * - session ticket
1405 * - negotiated ciphersuite
1406 */
mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context * ssl)1407 int mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context *ssl)
1408 {
1409 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1410 unsigned char hash_transcript[PSA_HASH_MAX_SIZE + 4];
1411 size_t hash_len;
1412 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
1413 ssl->handshake->ciphersuite_info;
1414
1415 MBEDTLS_SSL_DEBUG_MSG(3, ("Reset SSL session for HRR"));
1416
1417 ret = mbedtls_ssl_get_handshake_transcript(ssl, (mbedtls_md_type_t) ciphersuite_info->mac,
1418 hash_transcript + 4,
1419 PSA_HASH_MAX_SIZE,
1420 &hash_len);
1421 if (ret != 0) {
1422 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_get_handshake_transcript", ret);
1423 return ret;
1424 }
1425
1426 hash_transcript[0] = MBEDTLS_SSL_HS_MESSAGE_HASH;
1427 hash_transcript[1] = 0;
1428 hash_transcript[2] = 0;
1429 hash_transcript[3] = (unsigned char) hash_len;
1430
1431 hash_len += 4;
1432
1433 MBEDTLS_SSL_DEBUG_BUF(4, "Truncated handshake transcript",
1434 hash_transcript, hash_len);
1435
1436 /* Reset running hash and replace it with a hash of the transcript */
1437 ret = mbedtls_ssl_reset_checksum(ssl);
1438 if (ret != 0) {
1439 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_checksum", ret);
1440 return ret;
1441 }
1442 ret = ssl->handshake->update_checksum(ssl, hash_transcript, hash_len);
1443 if (ret != 0) {
1444 MBEDTLS_SSL_DEBUG_RET(1, "update_checksum", ret);
1445 return ret;
1446 }
1447
1448 return ret;
1449 }
1450
1451 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
1452
mbedtls_ssl_tls13_read_public_xxdhe_share(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t buf_len)1453 int mbedtls_ssl_tls13_read_public_xxdhe_share(mbedtls_ssl_context *ssl,
1454 const unsigned char *buf,
1455 size_t buf_len)
1456 {
1457 uint8_t *p = (uint8_t *) buf;
1458 const uint8_t *end = buf + buf_len;
1459 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1460
1461 /* Get size of the TLS opaque key_exchange field of the KeyShareEntry struct. */
1462 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
1463 uint16_t peerkey_len = MBEDTLS_GET_UINT16_BE(p, 0);
1464 p += 2;
1465
1466 /* Check if key size is consistent with given buffer length. */
1467 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, peerkey_len);
1468
1469 /* Store peer's ECDH/FFDH public key. */
1470 if (peerkey_len > sizeof(handshake->xxdh_psa_peerkey)) {
1471 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %u > %" MBEDTLS_PRINTF_SIZET,
1472 (unsigned) peerkey_len,
1473 sizeof(handshake->xxdh_psa_peerkey)));
1474 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1475 }
1476 memcpy(handshake->xxdh_psa_peerkey, p, peerkey_len);
1477 handshake->xxdh_psa_peerkey_len = peerkey_len;
1478
1479 return 0;
1480 }
1481
1482 #if defined(PSA_WANT_ALG_FFDH)
mbedtls_ssl_get_psa_ffdh_info_from_tls_id(uint16_t tls_id,size_t * bits,psa_key_type_t * key_type)1483 static psa_status_t mbedtls_ssl_get_psa_ffdh_info_from_tls_id(
1484 uint16_t tls_id, size_t *bits, psa_key_type_t *key_type)
1485 {
1486 switch (tls_id) {
1487 #if defined(PSA_WANT_DH_RFC7919_2048)
1488 case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048:
1489 *bits = 2048;
1490 *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919);
1491 return PSA_SUCCESS;
1492 #endif /* PSA_WANT_DH_RFC7919_2048 */
1493 #if defined(PSA_WANT_DH_RFC7919_3072)
1494 case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072:
1495 *bits = 3072;
1496 *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919);
1497 return PSA_SUCCESS;
1498 #endif /* PSA_WANT_DH_RFC7919_3072 */
1499 #if defined(PSA_WANT_DH_RFC7919_4096)
1500 case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096:
1501 *bits = 4096;
1502 *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919);
1503 return PSA_SUCCESS;
1504 #endif /* PSA_WANT_DH_RFC7919_4096 */
1505 #if defined(PSA_WANT_DH_RFC7919_6144)
1506 case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144:
1507 *bits = 6144;
1508 *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919);
1509 return PSA_SUCCESS;
1510 #endif /* PSA_WANT_DH_RFC7919_6144 */
1511 #if defined(PSA_WANT_DH_RFC7919_8192)
1512 case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192:
1513 *bits = 8192;
1514 *key_type = PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919);
1515 return PSA_SUCCESS;
1516 #endif /* PSA_WANT_DH_RFC7919_8192 */
1517 default:
1518 return PSA_ERROR_NOT_SUPPORTED;
1519 }
1520 }
1521 #endif /* PSA_WANT_ALG_FFDH */
1522
mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(mbedtls_ssl_context * ssl,uint16_t named_group,unsigned char * buf,unsigned char * end,size_t * out_len)1523 int mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(
1524 mbedtls_ssl_context *ssl,
1525 uint16_t named_group,
1526 unsigned char *buf,
1527 unsigned char *end,
1528 size_t *out_len)
1529 {
1530 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
1531 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1532 psa_key_attributes_t key_attributes;
1533 size_t own_pubkey_len;
1534 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1535 size_t bits = 0;
1536 psa_key_type_t key_type = PSA_KEY_TYPE_NONE;
1537 psa_algorithm_t alg = PSA_ALG_NONE;
1538 size_t buf_size = (size_t) (end - buf);
1539
1540 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH/FFDH computation."));
1541
1542 /* Convert EC's TLS ID to PSA key type. */
1543 #if defined(PSA_WANT_ALG_ECDH)
1544 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(
1545 named_group, &key_type, &bits) == PSA_SUCCESS) {
1546 alg = PSA_ALG_ECDH;
1547 }
1548 #endif
1549 #if defined(PSA_WANT_ALG_FFDH)
1550 if (mbedtls_ssl_get_psa_ffdh_info_from_tls_id(named_group, &bits,
1551 &key_type) == PSA_SUCCESS) {
1552 alg = PSA_ALG_FFDH;
1553 }
1554 #endif
1555
1556 if (key_type == PSA_KEY_TYPE_NONE) {
1557 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1558 }
1559
1560 if (buf_size < PSA_BITS_TO_BYTES(bits)) {
1561 return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
1562 }
1563
1564 handshake->xxdh_psa_type = key_type;
1565 ssl->handshake->xxdh_psa_bits = bits;
1566
1567 key_attributes = psa_key_attributes_init();
1568 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
1569 psa_set_key_algorithm(&key_attributes, alg);
1570 psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
1571 psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
1572
1573 /* Generate ECDH/FFDH private key. */
1574 status = psa_generate_key(&key_attributes,
1575 &handshake->xxdh_psa_privkey);
1576 if (status != PSA_SUCCESS) {
1577 ret = PSA_TO_MBEDTLS_ERR(status);
1578 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret);
1579 return ret;
1580
1581 }
1582
1583 /* Export the public part of the ECDH/FFDH private key from PSA. */
1584 status = psa_export_public_key(handshake->xxdh_psa_privkey,
1585 buf, buf_size,
1586 &own_pubkey_len);
1587
1588 if (status != PSA_SUCCESS) {
1589 ret = PSA_TO_MBEDTLS_ERR(status);
1590 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret);
1591 return ret;
1592 }
1593
1594 *out_len = own_pubkey_len;
1595
1596 return 0;
1597 }
1598 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
1599
1600 /* RFC 8446 section 4.2
1601 *
1602 * If an implementation receives an extension which it recognizes and which is
1603 * not specified for the message in which it appears, it MUST abort the handshake
1604 * with an "illegal_parameter" alert.
1605 *
1606 */
mbedtls_ssl_tls13_check_received_extension(mbedtls_ssl_context * ssl,int hs_msg_type,unsigned int received_extension_type,uint32_t hs_msg_allowed_extensions_mask)1607 int mbedtls_ssl_tls13_check_received_extension(
1608 mbedtls_ssl_context *ssl,
1609 int hs_msg_type,
1610 unsigned int received_extension_type,
1611 uint32_t hs_msg_allowed_extensions_mask)
1612 {
1613 uint32_t extension_mask = mbedtls_ssl_get_extension_mask(
1614 received_extension_type);
1615
1616 MBEDTLS_SSL_PRINT_EXT(
1617 3, hs_msg_type, received_extension_type, "received");
1618
1619 if ((extension_mask & hs_msg_allowed_extensions_mask) == 0) {
1620 MBEDTLS_SSL_PRINT_EXT(
1621 3, hs_msg_type, received_extension_type, "is illegal");
1622 MBEDTLS_SSL_PEND_FATAL_ALERT(
1623 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1624 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1625 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1626 }
1627
1628 ssl->handshake->received_extensions |= extension_mask;
1629 /*
1630 * If it is a message containing extension responses, check that we
1631 * previously sent the extension.
1632 */
1633 switch (hs_msg_type) {
1634 case MBEDTLS_SSL_HS_SERVER_HELLO:
1635 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST:
1636 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
1637 case MBEDTLS_SSL_HS_CERTIFICATE:
1638 /* Check if the received extension is sent by peer message.*/
1639 if ((ssl->handshake->sent_extensions & extension_mask) != 0) {
1640 return 0;
1641 }
1642 break;
1643 default:
1644 return 0;
1645 }
1646
1647 MBEDTLS_SSL_PRINT_EXT(
1648 3, hs_msg_type, received_extension_type, "is unsupported");
1649 MBEDTLS_SSL_PEND_FATAL_ALERT(
1650 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT,
1651 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION);
1652 return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION;
1653 }
1654
1655 #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
1656
1657 /* RFC 8449, section 4:
1658 *
1659 * The ExtensionData of the "record_size_limit" extension is
1660 * RecordSizeLimit:
1661 * uint16 RecordSizeLimit;
1662 */
1663 MBEDTLS_CHECK_RETURN_CRITICAL
mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,const unsigned char * end)1664 int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl,
1665 const unsigned char *buf,
1666 const unsigned char *end)
1667 {
1668 const unsigned char *p = buf;
1669 uint16_t record_size_limit;
1670 const size_t extension_data_len = end - buf;
1671
1672 if (extension_data_len !=
1673 MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH) {
1674 MBEDTLS_SSL_DEBUG_MSG(2,
1675 ("record_size_limit extension has invalid length: %"
1676 MBEDTLS_PRINTF_SIZET " Bytes",
1677 extension_data_len));
1678
1679 MBEDTLS_SSL_PEND_FATAL_ALERT(
1680 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1681 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1682 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1683 }
1684
1685 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
1686 record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0);
1687
1688 MBEDTLS_SSL_DEBUG_MSG(2, ("RecordSizeLimit: %u Bytes", record_size_limit));
1689
1690 /* RFC 8449, section 4:
1691 *
1692 * Endpoints MUST NOT send a "record_size_limit" extension with a value
1693 * smaller than 64. An endpoint MUST treat receipt of a smaller value
1694 * as a fatal error and generate an "illegal_parameter" alert.
1695 */
1696 if (record_size_limit < MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN) {
1697 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid record size limit : %u Bytes",
1698 record_size_limit));
1699 MBEDTLS_SSL_PEND_FATAL_ALERT(
1700 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1701 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1702 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1703 }
1704
1705 ssl->session_negotiate->record_size_limit = record_size_limit;
1706
1707 return 0;
1708 }
1709
1710 MBEDTLS_CHECK_RETURN_CRITICAL
mbedtls_ssl_tls13_write_record_size_limit_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * out_len)1711 int mbedtls_ssl_tls13_write_record_size_limit_ext(mbedtls_ssl_context *ssl,
1712 unsigned char *buf,
1713 const unsigned char *end,
1714 size_t *out_len)
1715 {
1716 unsigned char *p = buf;
1717 *out_len = 0;
1718
1719 MBEDTLS_STATIC_ASSERT(MBEDTLS_SSL_IN_CONTENT_LEN >= MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN,
1720 "MBEDTLS_SSL_IN_CONTENT_LEN is less than the "
1721 "minimum record size limit");
1722
1723 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
1724
1725 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT, p, 0);
1726 MBEDTLS_PUT_UINT16_BE(MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH,
1727 p, 2);
1728 MBEDTLS_PUT_UINT16_BE(MBEDTLS_SSL_IN_CONTENT_LEN, p, 4);
1729
1730 *out_len = 6;
1731
1732 MBEDTLS_SSL_DEBUG_MSG(2, ("Sent RecordSizeLimit: %d Bytes",
1733 MBEDTLS_SSL_IN_CONTENT_LEN));
1734
1735 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT);
1736
1737 return 0;
1738 }
1739
1740 #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
1741
1742 #endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */
1743