1 /*
2 * This file is part of the openHiTLS project.
3 *
4 * openHiTLS is licensed under the Mulan PSL v2.
5 * You can use this software according to the terms and conditions of the Mulan PSL v2.
6 * You may obtain a copy of Mulan PSL v2 at:
7 *
8 * http://license.coscl.org.cn/MulanPSL2
9 *
10 * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
11 * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
12 * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
13 * See the Mulan PSL v2 for more details.
14 */
15
16 #include <stdint.h>
17 #include <stdbool.h>
18 #include "hitls_build.h"
19 #include "securec.h"
20 #include "cipher_suite.h"
21 #include "bsl_err_internal.h"
22 #include "tls_binlog_id.h"
23 #include "bsl_log_internal.h"
24 #include "bsl_log.h"
25 #include "bsl_bytes.h"
26 #include "bsl_list.h"
27 #include "hitls_error.h"
28 #include "hitls_sni.h"
29 #include "hitls_cert_type.h"
30 #include "hitls_crypt_type.h"
31 #include "hitls_session.h"
32 #include "tls.h"
33 #include "hs_ctx.h"
34 #include "hs_extensions.h"
35 #include "hs.h"
36 #include "hs_msg.h"
37 #include "hs_common.h"
38 #include "session.h"
39 #include "hs_verify.h"
40 #include "pack_common.h"
41 #include "custom_extensions.h"
42 #include "pack_extensions.h"
43 #include "config_type.h"
44
45
46 #define EXTENSION_MSG(exMsgT, needP, packF) \
47 .exMsgType = (exMsgT), \
48 .needPack = (needP), \
49 .packFunc = (packF), \
50
51 // Pack the extension header.
PackExtensionHeader(uint16_t exMsgType,uint16_t exMsgLen,uint8_t * buf,uint32_t bufLen)52 int32_t PackExtensionHeader(uint16_t exMsgType, uint16_t exMsgLen, uint8_t *buf, uint32_t bufLen)
53 {
54 if (bufLen < (HS_EX_HEADER_LEN + exMsgLen)) {
55 return PackBufLenError(BINLOG_ID15409, BINGLOG_STR("extension"));
56 }
57
58 BSL_Uint16ToByte(exMsgType, buf);
59 BSL_Uint16ToByte(exMsgLen, buf + sizeof(uint16_t));
60
61 return HITLS_SUCCESS;
62 }
63 #ifdef HITLS_TLS_PROTO_TLS13
64
IsNeedPreSharedKey(const TLS_Ctx * ctx)65 static bool IsNeedPreSharedKey(const TLS_Ctx *ctx)
66 {
67 if (ctx->config.tlsConfig.maxVersion != HITLS_VERSION_TLS13) {
68 return false;
69 }
70
71 if (ctx->hsCtx->state == TRY_SEND_HELLO_RETRY_REQUEST) {
72 /* hello retry request does not contain the psk */
73 return false;
74 }
75
76 return true;
77 }
78
Tls13NeedPack(const TLS_Ctx * ctx,uint32_t version)79 bool Tls13NeedPack(const TLS_Ctx *ctx, uint32_t version)
80 {
81 bool tls13NeedPack = false;
82 if (IS_SUPPORT_DATAGRAM(ctx->config.tlsConfig.originVersionMask)) {
83 tls13NeedPack = false;
84 } else {
85 tls13NeedPack = (version >= HITLS_VERSION_TLS13) ? true : false;
86 }
87 return tls13NeedPack;
88 }
PackCookie(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)89 static int32_t PackCookie(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
90 {
91 int32_t ret = HITLS_SUCCESS;
92 uint32_t exMsgDataLen = 0u;
93 uint32_t offset = 0u;
94
95 if (ctx->negotiatedInfo.cookie == NULL) {
96 return HITLS_SUCCESS;
97 }
98
99 /* Calculate the extension length */
100 exMsgDataLen = sizeof(uint16_t) + (ctx->negotiatedInfo.cookieSize);
101 uint32_t cookieLen = ctx->negotiatedInfo.cookieSize;
102
103 ret = PackExtensionHeader(HS_EX_TYPE_COOKIE, exMsgDataLen, buf, bufLen);
104 if (ret != HITLS_SUCCESS) {
105 return ret;
106 }
107 offset += HS_EX_HEADER_LEN;
108 BSL_Uint16ToByte(cookieLen, &buf[offset]);
109 offset += sizeof(uint16_t);
110 /* Pack the cookie */
111 (void)memcpy_s(&buf[offset], bufLen - offset, ctx->negotiatedInfo.cookie, cookieLen);
112 offset += cookieLen;
113
114 ctx->hsCtx->extFlag.haveCookie = true;
115
116 *usedLen = offset;
117 return HITLS_SUCCESS;
118 }
119 #endif /* HITLS_TLS_PROTO_TLS13 */
PackPointFormats(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)120 static int32_t PackPointFormats(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
121 {
122 int32_t ret = HITLS_SUCCESS;
123 uint16_t exMsgHeaderLen = 0u;
124 uint8_t exMsgDataLen = 0u;
125 uint32_t offset = 0u;
126 const TLS_Config *config = &(ctx->config.tlsConfig);
127
128 if (config->pointFormatsSize == 0) {
129 *usedLen = 0;
130 return HITLS_SUCCESS;
131 }
132
133 if (config->pointFormats == NULL) {
134 BSL_ERR_PUSH_ERROR(HITLS_INTERNAL_EXCEPTION);
135 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15415, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
136 "pack point formats extension error, invalid input parameter.", 0, 0, 0, 0);
137 return HITLS_INTERNAL_EXCEPTION;
138 }
139
140 /* Calculate the extension length */
141 exMsgHeaderLen = sizeof(uint8_t);
142 exMsgDataLen = (uint8_t)config->pointFormatsSize;
143
144 ret = PackExtensionHeader(HS_EX_TYPE_POINT_FORMATS, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
145 if (ret != HITLS_SUCCESS) {
146 return ret;
147 }
148 offset += HS_EX_HEADER_LEN;
149
150 /* Pack the extension point format */
151 buf[offset] = exMsgDataLen;
152 offset += sizeof(uint8_t);
153 for (uint32_t index = 0; index < config->pointFormatsSize; index++) {
154 buf[offset] = config->pointFormats[index];
155 offset += sizeof(uint8_t);
156 }
157
158 /* Set the extension flag */
159 ctx->hsCtx->extFlag.havePointFormats = true;
160
161 *usedLen = offset;
162 return HITLS_SUCCESS;
163 }
164
PackEmptyExtension(uint16_t exMsgType,bool needPack,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)165 int32_t PackEmptyExtension(uint16_t exMsgType, bool needPack, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
166 {
167 uint32_t offset = 0u;
168 int32_t ret = 0;
169 if (needPack) {
170 ret = PackExtensionHeader(exMsgType, 0u, &buf[offset], bufLen - offset);
171 if (ret != HITLS_SUCCESS) {
172 return ret;
173 }
174 offset += HS_EX_HEADER_LEN;
175 }
176 /* Update the packet length */
177 *usedLen = offset;
178 return HITLS_SUCCESS;
179 }
180
181 #ifdef HITLS_TLS_HOST_CLIENT
182 #ifdef HITLS_TLS_FEATURE_SNI
PackServerName(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)183 static int32_t PackServerName(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
184 {
185 int32_t ret = HITLS_SUCCESS;
186 uint16_t exMsgDataLen = 0u;
187 uint32_t offset = 0u;
188 uint8_t *hostName = NULL;
189 uint8_t *serverName = NULL;
190 uint32_t hostNameSize, serverNameSize = 0u;
191 const TLS_Config *config = &(ctx->config.tlsConfig);
192 bool isNotTls13 = (config->maxVersion < HITLS_VERSION_TLS13 || config->maxVersion == HITLS_VERSION_DTLS12);
193 (void)isNotTls13;
194 (void)hostNameSize;
195 (void)hostName;
196 #ifdef HITLS_TLS_FEATURE_SESSION
197 /* When a session whose protocol version is earlier than HITLS_VERSION_TLS13 is resumed, the servername extension
198 * field is the hostname in the session */
199 if (isNotTls13 && ctx->session != NULL) {
200 /* Obtain the hostname in the session */
201 SESS_GetHostName(ctx->session, &hostNameSize, &hostName);
202 serverName = hostName;
203 } else
204 #endif
205 {
206 /* Obtain the servername in the config */
207 serverName = config->serverName;
208 }
209
210 if (serverName == NULL) {
211 *usedLen = 0;
212 return HITLS_SUCCESS;
213 }
214
215 serverNameSize = (uint32_t)strlen((char *)serverName);
216 /* Calculate the extension length */
217 /* server Name list Length + server Name Type + Server Name Length + Server Name */
218 exMsgDataLen = sizeof(uint16_t) + sizeof(uint8_t) + sizeof(uint16_t) + sizeof(uint8_t) * serverNameSize;
219
220 ret = PackExtensionHeader(HS_EX_TYPE_SERVER_NAME, exMsgDataLen, buf, bufLen);
221 if (ret != HITLS_SUCCESS) {
222 return ret;
223 }
224 offset += HS_EX_HEADER_LEN;
225
226 /* Pack the extension Server Name Indication extension */
227 /* server Name list Length */
228 BSL_Uint16ToByte(exMsgDataLen - sizeof(uint16_t), &buf[offset]);
229 offset += sizeof(uint16_t);
230
231 /* server Name Type */
232 buf[offset] = HITLS_SNI_HOSTNAME_TYPE;
233 offset += sizeof(uint8_t);
234
235 /* Server Name Length */
236 BSL_Uint16ToByte((uint16_t)serverNameSize, &buf[offset]);
237 offset += sizeof(uint16_t);
238
239 /* Server Name */
240 (void)memcpy_s(&buf[offset], bufLen - offset, serverName, serverNameSize);
241
242 offset += serverNameSize;
243
244 /* Set the extension flag */
245 ctx->hsCtx->extFlag.haveServerName = true;
246
247 *usedLen = offset;
248 return HITLS_SUCCESS;
249 }
250
IsNeedClientPackServerName(const TLS_Ctx * ctx)251 static bool IsNeedClientPackServerName(const TLS_Ctx *ctx)
252 {
253 const TLS_Config *config = &(ctx->config.tlsConfig);
254
255 /* not in session resumption */
256 if (ctx->session == NULL) {
257 if (config->serverName == NULL) {
258 return false;
259 }
260 }
261
262 /* The session is being resumed */
263 if (ctx->session != NULL) {
264 if (config->maxVersion == HITLS_VERSION_TLS13 && config->serverName == NULL) {
265 return false;
266 }
267 }
268
269 return true;
270 }
271 #endif /* HITLS_TLS_FEATURE_SNI */
PackClientSignatureAlgorithms(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)272 static int32_t PackClientSignatureAlgorithms(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
273 {
274 int32_t ret = HITLS_SUCCESS;
275 uint16_t exMsgHeaderLen = 0u;
276 uint16_t exMsgDataLen = 0u;
277 uint32_t offset = 0u;
278 const TLS_Config *config = &(ctx->config.tlsConfig);
279
280 if (config->signAlgorithmsSize == 0) {
281 *usedLen = 0;
282 return HITLS_SUCCESS;
283 }
284
285 if (config->signAlgorithms == NULL) {
286 BSL_ERR_PUSH_ERROR(HITLS_INTERNAL_EXCEPTION);
287 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15413, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
288 "pack signature algirithms extension error, invalid input parameter.", 0, 0, 0, 0);
289 return HITLS_INTERNAL_EXCEPTION;
290 }
291
292 uint32_t signAlgorithmsSize = 0;
293 uint16_t *signAlgorithms = CheckSupportSignAlgorithms(ctx, config->signAlgorithms,
294 config->signAlgorithmsSize, &signAlgorithmsSize);
295 if (signAlgorithms == NULL || signAlgorithmsSize == 0) {
296 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID17309, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
297 "no available signAlgorithms", 0, 0, 0, 0);
298 BSL_SAL_FREE(signAlgorithms);
299 ctx->method.sendAlert(ctx, ALERT_LEVEL_FATAL, ALERT_INTERNAL_ERROR);
300 return HITLS_CERT_ERR_NO_SIGN_SCHEME_MATCH;
301 }
302
303 /* Calculate the extension length */
304 exMsgHeaderLen = sizeof(uint16_t);
305 exMsgDataLen = sizeof(uint16_t) * (uint16_t)signAlgorithmsSize;
306
307 /* Pack the extension header */
308 ret = PackExtensionHeader(HS_EX_TYPE_SIGNATURE_ALGORITHMS, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
309 if (ret != HITLS_SUCCESS) {
310 BSL_SAL_FREE(signAlgorithms);
311 return ret;
312 }
313 offset += HS_EX_HEADER_LEN;
314
315 /* Pack the extended signature algorithm. */
316 BSL_Uint16ToByte(exMsgDataLen, &buf[offset]);
317 offset += sizeof(uint16_t);
318 for (uint32_t index = 0; index < signAlgorithmsSize; index++) {
319 BSL_Uint16ToByte(signAlgorithms[index], &buf[offset]);
320 offset += sizeof(uint16_t);
321 }
322 BSL_SAL_FREE(signAlgorithms);
323
324 /* Set the extension flag */
325 ctx->hsCtx->extFlag.haveSignatureAlgorithms = true;
326
327 *usedLen = offset;
328 return HITLS_SUCCESS;
329 }
330
PackClientSupportedGroups(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)331 static int32_t PackClientSupportedGroups(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
332 {
333 int32_t ret = HITLS_SUCCESS;
334 uint16_t exMsgHeaderLen = 0u;
335 uint16_t exMsgDataLen = 0u;
336 uint32_t offset = 0u;
337 const TLS_Config *config = &(ctx->config.tlsConfig);
338
339 if (config->groupsSize == 0) {
340 *usedLen = 0;
341 return HITLS_SUCCESS;
342 }
343
344 if (config->groups == NULL) {
345 BSL_ERR_PUSH_ERROR(HITLS_INTERNAL_EXCEPTION);
346 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15414, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
347 "pack supported groups extension error, invalid input parameter.", 0, 0, 0, 0);
348 return HITLS_INTERNAL_EXCEPTION;
349 }
350
351 /* Calculate the extension length */
352 exMsgHeaderLen = sizeof(uint16_t);
353 exMsgDataLen = sizeof(uint16_t) * (uint16_t)config->groupsSize;
354
355 ret = PackExtensionHeader(HS_EX_TYPE_SUPPORTED_GROUPS, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
356 if (ret != HITLS_SUCCESS) {
357 return ret;
358 }
359 offset += HS_EX_HEADER_LEN;
360
361 /* Pack extended supported groups */
362 BSL_Uint16ToByte(exMsgDataLen, &buf[offset]);
363 offset += sizeof(uint16_t);
364 for (uint32_t index = 0; index < config->groupsSize; index++) {
365 BSL_Uint16ToByte(config->groups[index], &buf[offset]);
366 offset += sizeof(uint16_t);
367 }
368
369 /* Set the extension flag */
370 ctx->hsCtx->extFlag.haveSupportedGroups = true;
371
372 *usedLen = offset;
373 return HITLS_SUCCESS;
374 }
375 #ifdef HITLS_TLS_FEATURE_ALPN
PackClientAlpnList(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)376 static int32_t PackClientAlpnList(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
377 {
378 int32_t ret = HITLS_SUCCESS;
379 uint16_t exMsgHeaderLen = 0u;
380 uint8_t exMsgDataLen = 0u;
381 uint32_t offset = 0u;
382 const TLS_Config *config = &(ctx->config.tlsConfig);
383
384 if (config->alpnListSize == 0) {
385 *usedLen = 0;
386 return HITLS_SUCCESS;
387 }
388
389 if (config->alpnList == NULL) {
390 BSL_ERR_PUSH_ERROR(HITLS_INTERNAL_EXCEPTION);
391 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15416, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
392 "pack alpn list extension error, invalid input parameter.", 0, 0, 0, 0);
393 return HITLS_INTERNAL_EXCEPTION;
394 }
395
396 /* Calculate the extension length */
397 exMsgHeaderLen = sizeof(uint16_t);
398 exMsgDataLen = (uint8_t)config->alpnListSize;
399
400 ret = PackExtensionHeader(HS_EX_TYPE_APP_LAYER_PROTOCOLS, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
401 if (ret != HITLS_SUCCESS) {
402 return ret;
403 }
404 offset += HS_EX_HEADER_LEN;
405
406 BSL_Uint16ToByte(exMsgDataLen, &buf[offset]);
407 offset += sizeof(uint16_t);
408
409 (void)memcpy_s(&buf[offset], bufLen - offset, config->alpnList, config->alpnListSize);
410
411 offset += (config->alpnListSize);
412
413 /* Set the extension flag */
414 ctx->hsCtx->extFlag.haveAlpn = true;
415
416 *usedLen = offset;
417 return HITLS_SUCCESS;
418 }
419 #endif /* HITLS_TLS_FEATURE_ALPN */
420 #ifdef HITLS_TLS_FEATURE_SESSION_TICKET
PackClientTicket(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)421 static int32_t PackClientTicket(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
422 {
423 int32_t ret = HITLS_SUCCESS;
424 uint32_t offset = 0u;
425 uint8_t *ticket = NULL;
426 uint32_t ticketSize = 0;
427 uint16_t sessVersion = HITLS_VERSION_TLS13;
428 if (ctx->session != NULL) {
429 HITLS_SESS_GetProtocolVersion(ctx->session, &sessVersion);
430 }
431
432 /* Whether the ticket belongs to tls1.3 needs to be determined */
433 if (sessVersion != HITLS_VERSION_TLS13) {
434 SESS_GetTicket(ctx->session, &ticket, &ticketSize);
435 }
436
437 ret = PackExtensionHeader(HS_EX_TYPE_SESSION_TICKET, (uint16_t)ticketSize, buf, bufLen);
438 if (ret != HITLS_SUCCESS) {
439 return ret;
440 }
441 offset += HS_EX_HEADER_LEN;
442
443 (void)memcpy_s(&buf[offset], bufLen - offset, ticket, ticketSize);
444 offset += ticketSize;
445
446 /* Set the extension flag. */
447 ctx->hsCtx->extFlag.haveTicket = true;
448
449 *usedLen = offset;
450 return HITLS_SUCCESS;
451 }
452 #endif /* HITLS_TLS_FEATURE_SESSION_TICKET */
453 #ifdef HITLS_TLS_FEATURE_RENEGOTIATION
PackClientSecRenegoInfo(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)454 static int32_t PackClientSecRenegoInfo(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
455 {
456 if (!ctx->negotiatedInfo.isRenegotiation) {
457 *usedLen = 0;
458 return HITLS_SUCCESS;
459 }
460
461 /* Calculate the extension length */
462 const uint8_t *clientData = ctx->negotiatedInfo.clientVerifyData;
463 uint32_t clientDataSize = ctx->negotiatedInfo.clientVerifyDataSize;
464 uint16_t exMsgHeaderLen = sizeof(uint8_t);
465 uint16_t exMsgDataLen = (uint16_t)clientDataSize;
466
467 /* Pack the extension header */
468 int32_t ret;
469 uint32_t offset = 0;
470 ret = PackExtensionHeader(HS_EX_TYPE_RENEGOTIATION_INFO, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
471 if (ret != HITLS_SUCCESS) {
472 return ret;
473 }
474 offset += HS_EX_HEADER_LEN;
475
476 /* Pack the length of secRenegoInfo */
477 buf[offset] = (uint8_t)clientDataSize;
478 offset++;
479
480 /* Pack the secRenegoInfo content */
481 (void)memcpy_s(&buf[offset], bufLen - offset, clientData, clientDataSize);
482 offset += clientDataSize;
483
484 *usedLen = offset;
485 return HITLS_SUCCESS;
486 }
487 #endif /* HITLS_TLS_FEATURE_RENEGOTIATION */
IsNeedPackEcExtension(const TLS_Ctx * ctx)488 static bool IsNeedPackEcExtension(const TLS_Ctx *ctx)
489 {
490 const TLS_Config *config = &(ctx->config.tlsConfig);
491 #ifdef HITLS_TLS_PROTO_TLS13
492 if ((config->maxVersion == HITLS_VERSION_TLS13)) {
493 uint32_t needKeyShareMode = TLS13_KE_MODE_PSK_WITH_DHE | TLS13_CERT_AUTH_WITH_DHE;
494 if ((ctx->negotiatedInfo.tls13BasicKeyExMode & needKeyShareMode) != 0) {
495 return true;
496 }
497 }
498 #endif /* HITLS_TLS_PROTO_TLS13 */
499 for (uint32_t index = 0; index < config->cipherSuitesSize; index++) {
500 CipherSuiteInfo cipherInfo = {0};
501 /* The returned value does not need to be checked. The validity of the cipher suite is checked when the cipher
502 * suite is configured */
503 (void)CFG_GetCipherSuiteInfo(config->cipherSuites[index], &cipherInfo);
504
505 /* The ECC algorithm suite exists */
506 if ((cipherInfo.authAlg == HITLS_AUTH_ECDSA) ||
507 (cipherInfo.kxAlg == HITLS_KEY_EXCH_ECDHE) ||
508 (cipherInfo.kxAlg == HITLS_KEY_EXCH_ECDH) ||
509 (cipherInfo.kxAlg == HITLS_KEY_EXCH_ECDHE_PSK)) {
510 return true;
511 }
512 }
513
514 return false;
515 }
516 #ifdef HITLS_TLS_PROTO_TLS13
PackClientSupportedVersions(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)517 static int32_t PackClientSupportedVersions(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
518 {
519 int32_t ret = HITLS_SUCCESS;
520 uint16_t exMsgHeaderLen = 0u;
521 uint8_t exMsgDataLen = 0u;
522 uint32_t offset = 0u;
523 const TLS_Config *config = &(ctx->config.tlsConfig);
524 uint16_t minVersion = config->minVersion;
525 uint16_t maxVersion = config->maxVersion;
526
527 if (config->minVersion < HITLS_VERSION_SSL30 || config->maxVersion > HITLS_VERSION_TLS13) {
528 BSL_ERR_PUSH_ERROR(HITLS_INTERNAL_EXCEPTION);
529 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15418, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
530 "pack supported version extension error, invalid input parameter.", 0, 0, 0, 0);
531 return HITLS_INTERNAL_EXCEPTION;
532 }
533
534 /* Calculate the extension length */
535 exMsgHeaderLen = sizeof(uint8_t);
536 exMsgDataLen = sizeof(uint16_t) * (maxVersion - minVersion + 1);
537
538 ret = PackExtensionHeader(HS_EX_TYPE_SUPPORTED_VERSIONS, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
539 if (ret != HITLS_SUCCESS) {
540 return ret;
541 }
542 offset += HS_EX_HEADER_LEN;
543
544 /* Pack the TLS version supported by the extension */
545 buf[offset] = exMsgDataLen;
546 offset += sizeof(exMsgDataLen);
547
548 for (uint16_t version = maxVersion; version >= minVersion; version--) {
549 BSL_Uint16ToByte(version, &buf[offset]);
550 offset += sizeof(uint16_t);
551 }
552
553 /* Set the extension flag */
554 ctx->hsCtx->extFlag.haveSupportedVers = true;
555
556 *usedLen = offset;
557 return HITLS_SUCCESS;
558 }
559
PackClientPskKeyExModes(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)560 static int32_t PackClientPskKeyExModes(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
561 {
562 bool allowOnly = false;
563 bool allowDhe = false;
564 const uint32_t configKxMode = ctx->config.tlsConfig.keyExchMode;
565 uint16_t exMsgHeaderLen = sizeof(uint8_t);
566 uint16_t exMsgDataLen = 0;
567
568 if ((bool)(configKxMode & TLS13_KE_MODE_PSK_WITH_DHE)) {
569 exMsgDataLen++;
570 allowDhe = true;
571 }
572 if ((bool)(configKxMode & TLS13_KE_MODE_PSK_ONLY)) {
573 exMsgDataLen++;
574 allowOnly = true;
575 }
576
577 int32_t ret = PackExtensionHeader(HS_EX_TYPE_PSK_KEY_EXCHANGE_MODES, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
578 if (ret != HITLS_SUCCESS) {
579 return ret;
580 }
581 uint32_t offset = HS_EX_HEADER_LEN;
582
583 /* Pack the length of the key exchange pattern extension */
584 buf[offset] = (uint8_t)exMsgDataLen;
585 offset += sizeof(uint8_t);
586 if (allowDhe) {
587 buf[offset] = PSK_DHE_KE;
588 offset += sizeof(uint8_t);
589 }
590 if (allowOnly) {
591 buf[offset] = PSK_KE;
592 offset += sizeof(uint8_t);
593 }
594
595 ctx->hsCtx->extFlag.havePskExMode = true;
596
597 *usedLen = offset;
598 return HITLS_SUCCESS;
599 }
600
PackClientKeyShare(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)601 static int32_t PackClientKeyShare(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
602 {
603 uint32_t needKeyShareMode = TLS13_KE_MODE_PSK_WITH_DHE | TLS13_CERT_AUTH_WITH_DHE;
604 if ((ctx->negotiatedInfo.tls13BasicKeyExMode & needKeyShareMode) == 0) {
605 return HITLS_SUCCESS;
606 }
607
608 uint32_t offset = 0u;
609 KeyExchCtx *kxCtx = ctx->hsCtx->kxCtx;
610 if (kxCtx == NULL) {
611 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID16939, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN, "kxCtx is null", 0, 0, 0, 0);
612 BSL_ERR_PUSH_ERROR(HITLS_NULL_INPUT);
613 return HITLS_NULL_INPUT;
614 }
615
616 uint16_t keyShareLen = 0;
617
618 KeyShareParam *keyShare = &(kxCtx->keyExchParam.share);
619 uint32_t secondPubKeyLen = 0u;
620 uint32_t pubKeyLen = SAL_CRYPT_GetCryptLength(ctx, HITLS_CRYPT_INFO_CMD_GET_PUBLIC_KEY_LEN, keyShare->group);
621 if (pubKeyLen == 0u) {
622 BSL_ERR_PUSH_ERROR(HITLS_PACK_INVALID_KX_PUBKEY_LENGTH);
623 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15422, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
624 "invalid keyShare length.", 0, 0, 0, 0);
625 return HITLS_PACK_INVALID_KX_PUBKEY_LENGTH;
626 }
627
628 keyShareLen += sizeof(uint16_t) + sizeof(uint16_t) + pubKeyLen;
629 if (keyShare->secondGroup != HITLS_NAMED_GROUP_BUTT) {
630 secondPubKeyLen = SAL_CRYPT_GetCryptLength(ctx, HITLS_CRYPT_INFO_CMD_GET_PUBLIC_KEY_LEN, keyShare->secondGroup);
631 if (secondPubKeyLen == 0u) {
632 BSL_ERR_PUSH_ERROR(HITLS_PACK_INVALID_KX_PUBKEY_LENGTH);
633 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15422, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
634 "invalid keyShare length.", 0, 0, 0, 0);
635 return HITLS_PACK_INVALID_KX_PUBKEY_LENGTH;
636 }
637 keyShareLen += sizeof(uint16_t) + sizeof(uint16_t) + secondPubKeyLen;
638 }
639
640 int32_t ret = PackExtensionHeader(HS_EX_TYPE_KEY_SHARE, sizeof(uint16_t) + keyShareLen, buf, bufLen);
641 if (ret != HITLS_SUCCESS) {
642 return ret;
643 }
644 offset += HS_EX_HEADER_LEN;
645 /* Pack the total length of client_keyShare */
646 BSL_Uint16ToByte(keyShareLen, &buf[offset]);
647 offset += sizeof(uint16_t);
648 /* Pack a group */
649 BSL_Uint16ToByte((uint16_t)keyShare->group, &buf[offset]);
650 offset += sizeof(uint16_t);
651
652 /* Length of the Pack KeyExChange */
653 BSL_Uint16ToByte((uint16_t)pubKeyLen, &buf[offset]);
654 offset += sizeof(uint16_t);
655
656 uint32_t pubKeyUsedLen = 0;
657 /* Pack KeyExChange */
658 ret = SAL_CRYPT_EncodeEcdhPubKey(kxCtx->key, &buf[offset], pubKeyLen, &pubKeyUsedLen);
659 if (ret != HITLS_SUCCESS || pubKeyUsedLen != pubKeyLen) {
660 BSL_ERR_PUSH_ERROR(HITLS_CRYPT_ERR_ENCODE_ECDH_KEY);
661 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15423, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
662 "encode client keyShare key fail.", 0, 0, 0, 0);
663 return HITLS_CRYPT_ERR_ENCODE_ECDH_KEY;
664 }
665 offset += pubKeyLen;
666
667 if (keyShare->secondGroup != HITLS_NAMED_GROUP_BUTT) {
668 BSL_Uint16ToByte((uint16_t)keyShare->secondGroup, &buf[offset]);
669 offset += sizeof(uint16_t);
670 BSL_Uint16ToByte((uint16_t)secondPubKeyLen, &buf[offset]);
671 offset += sizeof(uint16_t);
672 ret = SAL_CRYPT_EncodeEcdhPubKey(kxCtx->secondKey, &buf[offset], secondPubKeyLen, &pubKeyUsedLen);
673 if (ret != HITLS_SUCCESS || pubKeyUsedLen != secondPubKeyLen) {
674 BSL_ERR_PUSH_ERROR(HITLS_CRYPT_ERR_ENCODE_ECDH_KEY);
675 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15423, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
676 "encode client keyShare key fail.", 0, 0, 0, 0);
677 return HITLS_CRYPT_ERR_ENCODE_ECDH_KEY;
678 }
679 offset += secondPubKeyLen;
680 }
681 *usedLen = offset;
682 ctx->hsCtx->extFlag.haveKeyShare = true;
683 return HITLS_SUCCESS;
684 }
685
GetPreSharedKeyExtLen(const PskInfo13 * pskInfo)686 static uint32_t GetPreSharedKeyExtLen(const PskInfo13 *pskInfo)
687 {
688 uint32_t extLen = HS_EX_HEADER_LEN;
689 uint32_t binderLen = 0;
690 if (pskInfo->resumeSession != NULL) {
691 HITLS_HashAlgo hashAlg = HITLS_HASH_BUTT;
692 binderLen = HS_GetBinderLen(pskInfo->resumeSession, &hashAlg);
693 if (binderLen == 0) {
694 return 0;
695 }
696 uint8_t *ticket = NULL;
697 uint32_t ticketSize = 0;
698 SESS_GetTicket(pskInfo->resumeSession, &ticket, &ticketSize);
699 extLen += sizeof(uint16_t) + ticketSize + sizeof(uint32_t) + sizeof(uint8_t) + binderLen;
700 }
701
702 if (pskInfo->userPskSess != NULL) {
703 HITLS_HashAlgo hashAlg = HITLS_HASH_BUTT;
704 binderLen = HS_GetBinderLen(pskInfo->userPskSess->pskSession, &hashAlg);
705 if (binderLen == 0) {
706 return 0;
707 }
708 extLen += sizeof(uint16_t) + pskInfo->userPskSess->identityLen + sizeof(uint32_t) + sizeof(uint8_t) + binderLen;
709 }
710 extLen += sizeof(uint16_t) + sizeof(uint16_t);
711 return extLen;
712 }
713
PackClientPreSharedKeyIdentity(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * outOffset)714 static void PackClientPreSharedKeyIdentity(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *outOffset)
715 {
716 PskInfo13 *pskInfo = &ctx->hsCtx->kxCtx->pskInfo13;
717 uint32_t offset = *outOffset;
718 uint32_t offsetStamp = offset;
719 offset += sizeof(uint16_t); // skip identities len
720 if (pskInfo->resumeSession != NULL) {
721 uint8_t *ticket = NULL;
722 uint32_t ticketSize = 0;
723 SESS_GetTicket(pskInfo->resumeSession, &ticket, &ticketSize);
724 BSL_Uint16ToByte((uint16_t)ticketSize, &buf[offset]);
725 offset += sizeof(uint16_t);
726 // has passed the verification above, and it must be successful here.
727 (void)memcpy_s(&buf[offset], bufLen - offset, ticket, ticketSize);
728 offset += ticketSize;
729 uint32_t ageSec = (uint32_t)((uint64_t)BSL_SAL_CurrentSysTimeGet() - SESS_GetStartTime(pskInfo->resumeSession));
730
731 uint32_t agemSec = ageSec * 1000 + (uint32_t)SESS_GetTicketAgeAdd(pskInfo->resumeSession); /* unit: ms */
732 BSL_Uint32ToByte(agemSec, &buf[offset]);
733 offset += sizeof(uint32_t);
734 }
735
736 if (pskInfo->userPskSess != NULL) {
737 BSL_Uint16ToByte((uint16_t)pskInfo->userPskSess->identityLen, &buf[offset]);
738 offset += sizeof(uint16_t);
739 (void)memcpy_s(&buf[offset], bufLen - offset,
740 // has passed the verification above, and it must be successful here
741 pskInfo->userPskSess->identity, pskInfo->userPskSess->identityLen);
742 offset += pskInfo->userPskSess->identityLen;
743 BSL_Uint32ToByte(0, &buf[offset]);
744 offset += sizeof(uint32_t);
745 }
746 BSL_Uint16ToByte((uint16_t)(offset - offsetStamp - sizeof(uint16_t)), &buf[offsetStamp]);
747 *outOffset = offset;
748 }
749
750 // ClientPreSharedKey: pskid, binder, see rfc 8446 section 4.2.11, currently support one pskid and one binder
PackClientPreSharedKey(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)751 static int32_t PackClientPreSharedKey(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
752 {
753 PskInfo13 *pskInfo = &ctx->hsCtx->kxCtx->pskInfo13;
754 if (pskInfo->resumeSession == NULL && pskInfo->userPskSess == NULL) {
755 return HITLS_SUCCESS;
756 }
757 uint32_t minLen = GetPreSharedKeyExtLen(pskInfo);
758 if (minLen == 0) {
759 BSL_ERR_PUSH_ERROR(HITLS_PACK_PRE_SHARED_KEY_ERR);
760 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15939, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
761 "Binder size is zero when PackClientPreSharedKey", 0, 0, 0, 0);
762 return HITLS_PACK_PRE_SHARED_KEY_ERR;
763 }
764 if (minLen > bufLen) {
765 return PackBufLenError(BINLOG_ID16159, BINGLOG_STR("extension"));
766 }
767 (void)PackExtensionHeader(HS_EX_TYPE_PRE_SHARED_KEY, (uint16_t)(minLen - HS_EX_HEADER_LEN), buf, bufLen);
768 uint32_t offset = HS_EX_HEADER_LEN;
769 (void)PackClientPreSharedKeyIdentity(ctx, buf, bufLen, &offset);
770 // pack binder after fills in the packet header and extension length. call PackClientPreSharedKeyBinders
771 ctx->hsCtx->extFlag.havePreShareKey = true;
772 *usedLen = minLen;
773 return HITLS_SUCCESS;
774 }
775
776 #ifdef HITLS_TLS_FEATURE_PHA
IsNeedPackPha(const TLS_Ctx * ctx)777 static bool IsNeedPackPha(const TLS_Ctx *ctx)
778 {
779 const TLS_Config *tlsConfig = &ctx->config.tlsConfig;
780 if (tlsConfig->maxVersion != HITLS_VERSION_TLS13) {
781 return false;
782 }
783 return tlsConfig->isSupportPostHandshakeAuth;
784 }
785 #endif /* HITLS_TLS_FEATURE_PHA */
786 #endif /* HITLS_TLS_PROTO_TLS13 */
PackExtensions(const TLS_Ctx * ctx,uint8_t * buf,uint32_t * bufLen,PackExtInfo * extMsgList,uint32_t listSize)787 static int32_t PackExtensions(const TLS_Ctx *ctx, uint8_t *buf, uint32_t *bufLen,
788 PackExtInfo *extMsgList, uint32_t listSize)
789 {
790 int32_t ret = HITLS_SUCCESS;
791 uint32_t inBufLen = *bufLen;
792 uint32_t exLen, offset = 0u;
793 for (uint32_t index = 0; index < listSize; index++) {
794 if (extMsgList[index].needPack == false) {
795 continue;
796 }
797
798 exLen = 0u;
799 /* Empty expansion */
800 if (extMsgList[index].packFunc == NULL) {
801 ret = PackEmptyExtension(extMsgList[index].exMsgType, extMsgList[index].needPack,
802 &buf[offset], inBufLen - offset, &exLen);
803 } else { /* Non-empty expansion */
804 exLen = 0u;
805 ret = extMsgList[index].packFunc(ctx, &buf[offset], inBufLen - offset, &exLen);
806 }
807
808 if (ret != HITLS_SUCCESS) {
809 return ret;
810 }
811 offset += exLen;
812 }
813 *bufLen = offset;
814 return HITLS_SUCCESS;
815 }
816
IsNeedEms(const TLS_Ctx * ctx)817 static bool IsNeedEms(const TLS_Ctx *ctx)
818 {
819 if (ctx->config.tlsConfig.maxVersion == HITLS_VERSION_TLCP_DTLCP11) {
820 return false;
821 }
822 return true;
823 }
824
825 // Pack the non-null extension of client hello.
PackClientExtensions(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)826 static int32_t PackClientExtensions(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
827 {
828 int32_t ret = HITLS_SUCCESS;
829 const TLS_Config *tlsConfig = &ctx->config.tlsConfig;
830 (void)tlsConfig;
831 #ifdef HITLS_TLS_FEATURE_RENEGOTIATION
832 const TLS_NegotiatedInfo *negoInfo = &ctx->negotiatedInfo;
833 #endif /* HITLS_TLS_FEATURE_RENEGOTIATION */
834 #ifdef HITLS_TLS_PROTO_TLS13
835 bool isTls13 = (tlsConfig->maxVersion == HITLS_VERSION_TLS13);
836 #endif /* HITLS_TLS_PROTO_TLS13 */
837 /* Check whether EC extensions need to be filled */
838 bool isEcNeed = IsNeedPackEcExtension(ctx);
839
840 /* If the version is earlier than tls1.2, the signature extension cannot be sent */
841 bool isSignAlgNeed = (ctx->config.tlsConfig.maxVersion >= HITLS_VERSION_TLS12);
842 #ifdef HITLS_TLS_FEATURE_SESSION_TICKET
843 /* Do not send the sessionticket in the PTO scenario */
844 bool isSessionTicketNeed = IsTicketSupport(ctx);
845 #endif /* HITLS_TLS_FEATURE_SESSION_TICKET */
846 #ifdef HITLS_TLS_FEATURE_PHA
847 bool isNeedPha = IsNeedPackPha(ctx);
848 #endif /* HITLS_TLS_FEATURE_PHA */
849 PackExtInfo extMsgList[] = {
850 #ifdef HITLS_TLS_FEATURE_SNI
851 { EXTENSION_MSG(HS_EX_TYPE_SERVER_NAME, IsNeedClientPackServerName(ctx), PackServerName) },
852 #endif /* HITLS_TLS_FEATURE_SNI */
853 { EXTENSION_MSG(HS_EX_TYPE_SIGNATURE_ALGORITHMS, isSignAlgNeed, PackClientSignatureAlgorithms) },
854 { EXTENSION_MSG(HS_EX_TYPE_SUPPORTED_GROUPS, isEcNeed, PackClientSupportedGroups) },
855 { EXTENSION_MSG(HS_EX_TYPE_POINT_FORMATS, isEcNeed, PackPointFormats) },
856 #ifdef HITLS_TLS_PROTO_TLS13
857 { EXTENSION_MSG(HS_EX_TYPE_SUPPORTED_VERSIONS, isTls13, PackClientSupportedVersions) },
858 #endif /* HITLS_TLS_PROTO_TLS13 */
859 { EXTENSION_MSG(HS_EX_TYPE_EARLY_DATA, false, NULL) },
860 #ifdef HITLS_TLS_PROTO_TLS13
861 { EXTENSION_MSG(HS_EX_TYPE_COOKIE, isTls13, PackCookie) },
862 #ifdef HITLS_TLS_FEATURE_PHA
863 { EXTENSION_MSG(HS_EX_TYPE_POST_HS_AUTH, isNeedPha, NULL) },
864 #endif /* HITLS_TLS_FEATURE_PHA */
865 #endif /* HITLS_TLS_PROTO_TLS13 */
866 { EXTENSION_MSG(HS_EX_TYPE_EXTENDED_MASTER_SECRET, IsNeedEms(ctx), NULL) },
867 #ifdef HITLS_TLS_FEATURE_ALPN
868 { EXTENSION_MSG(HS_EX_TYPE_APP_LAYER_PROTOCOLS, (tlsConfig->alpnList != NULL &&
869 ctx->state == CM_STATE_HANDSHAKING), PackClientAlpnList) },
870 #endif /* HITLS_TLS_FEATURE_ALPN */
871 #ifdef HITLS_TLS_PROTO_TLS13
872 { EXTENSION_MSG(HS_EX_TYPE_PSK_KEY_EXCHANGE_MODES, isTls13, PackClientPskKeyExModes) },
873 { EXTENSION_MSG(HS_EX_TYPE_KEY_SHARE, isTls13, PackClientKeyShare) },
874 #endif /* HITLS_TLS_PROTO_TLS13 */
875 #ifdef HITLS_TLS_FEATURE_RENEGOTIATION
876 { EXTENSION_MSG(HS_EX_TYPE_RENEGOTIATION_INFO, negoInfo->isSecureRenegotiation, PackClientSecRenegoInfo) },
877 #endif /* HITLS_TLS_FEATURE_RENEGOTIATION */
878 #ifdef HITLS_TLS_FEATURE_SESSION_TICKET
879 { EXTENSION_MSG(HS_EX_TYPE_SESSION_TICKET, isSessionTicketNeed, PackClientTicket) },
880 #endif /* HITLS_TLS_FEATURE_SESSION_TICKET */
881 #ifdef HITLS_TLS_FEATURE_ETM
882 { EXTENSION_MSG(HS_EX_TYPE_ENCRYPT_THEN_MAC, tlsConfig->isEncryptThenMac, NULL) },
883 #endif /* HITLS_TLS_FEATURE_ETM */
884 #ifdef HITLS_TLS_PROTO_TLS13
885 { EXTENSION_MSG(HS_EX_TYPE_PRE_SHARED_KEY, IsNeedPreSharedKey(ctx), PackClientPreSharedKey) },
886 #endif /* HITLS_TLS_PROTO_TLS13 */
887 };
888
889 uint32_t exLen = 0;
890 uint32_t offset = 0;
891 #ifdef HITLS_TLS_FEATURE_CUSTOM_EXTENSION
892 if (IsPackNeedCustomExtensions(CUSTOM_EXT_FROM_CTX(ctx), HITLS_EX_TYPE_CLIENT_HELLO)) {
893 ret = PackCustomExtensions(ctx, &buf[offset], bufLen - offset, &exLen, HITLS_EX_TYPE_CLIENT_HELLO, NULL, 0);
894 if (ret != HITLS_SUCCESS) {
895 return ret;
896 }
897 offset += exLen;
898 }
899 #endif /* HITLS_TLS_FEATURE_CUSTOM_EXTENSION */
900
901 uint32_t tmpBufLen = bufLen - offset;
902 ret = PackExtensions(ctx, &buf[offset], &tmpBufLen, extMsgList, sizeof(extMsgList) / sizeof(extMsgList[0]));
903 if (ret != HITLS_SUCCESS) {
904 return ret;
905 }
906 *usedLen = tmpBufLen + exLen;
907 #ifdef HITLS_TLS_FEATURE_PHA
908 ctx->hsCtx->extFlag.havePostHsAuth = isNeedPha;
909 #endif /* HITLS_TLS_FEATURE_PHA */
910 ctx->hsCtx->extFlag.haveExtendedMasterSecret = IsNeedEms(ctx);
911 #ifdef HITLS_TLS_FEATURE_ETM
912 ctx->hsCtx->extFlag.haveEncryptThenMac = ctx->config.tlsConfig.isEncryptThenMac;
913 #endif /* HITLS_TLS_FEATURE_ETM */
914 return HITLS_SUCCESS;
915 }
916
917 // Pack the Client Hello extension
PackClientExtension(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * len)918 int32_t PackClientExtension(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *len)
919 {
920 int32_t ret = HITLS_SUCCESS;
921 uint32_t headerLen = 0u;
922 uint32_t exLen = 0u;
923
924 /* Obtain the packet header length */
925 headerLen = sizeof(uint16_t);
926 if (bufLen < headerLen) {
927 return PackBufLenError(BINLOG_ID15426, BINGLOG_STR("client extension"));
928 }
929
930 /* Pack the client hello extension content */
931 ret = PackClientExtensions(ctx, &buf[headerLen], bufLen - headerLen, &exLen);
932 if (ret != HITLS_SUCCESS) {
933 return ret;
934 }
935
936 if (exLen > 0u) {
937 BSL_Uint16ToByte((uint16_t)exLen, buf);
938 *len = exLen + headerLen;
939 } else {
940 *len = 0u;
941 }
942
943 return ret;
944 }
945 #endif /* HITLS_TLS_HOST_CLIENT */
946 #ifdef HITLS_TLS_HOST_SERVER
IsServerNeedPackEcExtension(const TLS_Ctx * ctx)947 static bool IsServerNeedPackEcExtension(const TLS_Ctx *ctx)
948 {
949 const TLS_NegotiatedInfo *negotiatedInfo = &(ctx->negotiatedInfo);
950 CipherSuiteInfo cipherInfo = negotiatedInfo->cipherSuiteInfo;
951
952 /* The negotiated algorithm suite is the ECC cipher suite */
953 if (((cipherInfo.authAlg == HITLS_AUTH_ECDSA) || (cipherInfo.kxAlg == HITLS_KEY_EXCH_ECDHE) ||
954 (cipherInfo.kxAlg == HITLS_KEY_EXCH_ECDH) || (cipherInfo.kxAlg == HITLS_KEY_EXCH_ECDHE_PSK)) &&
955 ctx->haveClientPointFormats == true) {
956 return true;
957 }
958
959 return false;
960 }
961 #ifdef HITLS_TLS_FEATURE_ALPN
PackServerSelectAlpnProto(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)962 int32_t PackServerSelectAlpnProto(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
963 {
964 int32_t ret = HITLS_SUCCESS;
965 uint16_t exMsgHeaderLen = 0u;
966 uint8_t exMsgDataLen = 0u;
967 uint32_t offset = 0u;
968
969 if (ctx->negotiatedInfo.alpnSelectedSize == 0) {
970 *usedLen = 0;
971 return HITLS_SUCCESS;
972 }
973
974 /* Calculate the extension length */
975 exMsgHeaderLen = sizeof(uint16_t);
976 exMsgDataLen = (uint8_t)ctx->negotiatedInfo.alpnSelectedSize + sizeof(uint8_t);
977
978 /* Pack the extension header */
979 ret = PackExtensionHeader(HS_EX_TYPE_APP_LAYER_PROTOCOLS, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
980 if (ret != HITLS_SUCCESS) {
981 return ret;
982 }
983 offset += HS_EX_HEADER_LEN;
984
985 BSL_Uint16ToByte((uint16_t)exMsgDataLen, &buf[offset]);
986 offset += sizeof(uint16_t);
987 buf[offset] = exMsgDataLen - sizeof(uint8_t);
988 offset += sizeof(uint8_t);
989 (void)memcpy_s(&buf[offset], bufLen - offset, ctx->negotiatedInfo.alpnSelected,
990 ctx->negotiatedInfo.alpnSelectedSize);
991 offset += ctx->negotiatedInfo.alpnSelectedSize;
992
993 /* Set the extension flag */
994 ctx->hsCtx->extFlag.haveAlpn = true;
995
996 *usedLen = offset;
997 return HITLS_SUCCESS;
998 }
999 #endif /* HITLS_TLS_FEATURE_ALPN */
1000 #ifdef HITLS_TLS_PROTO_TLS13
PackHrrKeyShare(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)1001 static int32_t PackHrrKeyShare(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
1002 {
1003 int32_t ret = HITLS_SUCCESS;
1004 uint16_t exMsgDataLen = 0u;
1005 uint32_t offset = 0u;
1006 KeyShareParam *keyShare = &(ctx->hsCtx->kxCtx->keyExchParam.share);
1007
1008 /* Message length = group length */
1009 exMsgDataLen = sizeof(uint16_t);
1010
1011 ret = PackExtensionHeader(HS_EX_TYPE_KEY_SHARE, exMsgDataLen, buf, bufLen);
1012 if (ret != HITLS_SUCCESS) {
1013 return ret;
1014 }
1015 offset += HS_EX_HEADER_LEN;
1016
1017 /* Pack a group */
1018 BSL_Uint16ToByte((uint16_t)keyShare->group, &buf[offset]);
1019 offset += sizeof(uint16_t);
1020
1021 ctx->hsCtx->extFlag.haveKeyShare = true;
1022 *usedLen = offset;
1023 return HITLS_SUCCESS;
1024 }
1025
PackServerKeyShare(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)1026 static int32_t PackServerKeyShare(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
1027 {
1028 uint32_t pubKeyLen = 0u;
1029 uint32_t offset = 0u;
1030 KeyShareParam *keyShare = &(ctx->hsCtx->kxCtx->keyExchParam.share);
1031 KeyExchCtx *kxCtx = ctx->hsCtx->kxCtx;
1032
1033 /* If the peer public key does not exist, the psk_only mode is used. In this case, the key share does not need to be
1034 * sent */
1035 if (kxCtx->peerPubkey == NULL) {
1036 return HITLS_SUCCESS;
1037 }
1038 const TLS_GroupInfo *groupInfo = ConfigGetGroupInfo(&ctx->config.tlsConfig, ctx->negotiatedInfo.negotiatedGroup);
1039 if (groupInfo == NULL) {
1040 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID16246, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
1041 "group info not found", 0, 0, 0, 0);
1042 return HITLS_INVALID_INPUT;
1043 }
1044 pubKeyLen = groupInfo->isKem ? groupInfo->ciphertextLen : groupInfo->pubkeyLen;
1045 if (pubKeyLen == 0u || (groupInfo->isKem && pubKeyLen != kxCtx->ciphertextLen)) {
1046 BSL_ERR_PUSH_ERROR(HITLS_PACK_INVALID_KX_PUBKEY_LENGTH);
1047 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15428, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
1048 "invalid keyShare length.", 0, 0, 0, 0);
1049 return HITLS_PACK_INVALID_KX_PUBKEY_LENGTH;
1050 }
1051
1052 /* Length of group + Length of KeyExChange + KeyExChange */
1053 uint16_t exMsgDataLen = sizeof(uint16_t) + sizeof(uint16_t) + (uint16_t)pubKeyLen;
1054
1055 int32_t ret = PackExtensionHeader(HS_EX_TYPE_KEY_SHARE, exMsgDataLen, buf, bufLen);
1056 if (ret != HITLS_SUCCESS) {
1057 return ret;
1058 }
1059 offset += HS_EX_HEADER_LEN;
1060
1061 /* Pack a group */
1062 BSL_Uint16ToByte((uint16_t)keyShare->group, &buf[offset]);
1063 offset += sizeof(uint16_t);
1064
1065 /* Length of the paced KeyExChange */
1066 BSL_Uint16ToByte((uint16_t)pubKeyLen, &buf[offset]);
1067 offset += sizeof(uint16_t);
1068
1069 uint32_t pubKeyUsedLen = 0;
1070 if (groupInfo->isKem) {
1071 (void)memcpy_s(&buf[offset], pubKeyLen, kxCtx->ciphertext, kxCtx->ciphertextLen);
1072 } else {
1073 ret = SAL_CRYPT_EncodeEcdhPubKey(kxCtx->key, &buf[offset], pubKeyLen, &pubKeyUsedLen);
1074 if (ret != HITLS_SUCCESS || pubKeyLen != pubKeyUsedLen) {
1075 BSL_ERR_PUSH_ERROR(HITLS_CRYPT_ERR_ENCODE_ECDH_KEY);
1076 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15429, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
1077 "encode server keyShare key fail.", 0, 0, 0, 0);
1078 return HITLS_CRYPT_ERR_ENCODE_ECDH_KEY;
1079 }
1080 }
1081 /* Pack KeyExChange */
1082
1083 ctx->hsCtx->extFlag.haveKeyShare = true;
1084 *usedLen = offset + pubKeyLen;
1085 return HITLS_SUCCESS;
1086 }
1087
PackServerSupportedVersion(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)1088 static int32_t PackServerSupportedVersion(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
1089 {
1090 int32_t ret = HITLS_SUCCESS;
1091 uint16_t exMsgDataLen = 0u;
1092 uint32_t offset = 0u;
1093 const uint16_t supportedVersion = ctx->negotiatedInfo.version;
1094
1095 if (supportedVersion <= 0) {
1096 BSL_ERR_PUSH_ERROR(HITLS_INTERNAL_EXCEPTION);
1097 BSL_LOG_BINLOG_FIXLEN(BINLOG_ID15430, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,
1098 "pack supported version extension error, invalid input parameter.", 0, 0, 0, 0);
1099 return HITLS_INTERNAL_EXCEPTION;
1100 }
1101
1102 /* Calculate the extension length */
1103 exMsgDataLen = sizeof(uint16_t);
1104
1105 ret = PackExtensionHeader(HS_EX_TYPE_SUPPORTED_VERSIONS, exMsgDataLen, buf, bufLen);
1106 if (ret != HITLS_SUCCESS) {
1107 return ret;
1108 }
1109 offset += HS_EX_HEADER_LEN;
1110
1111 BSL_Uint16ToByte(supportedVersion, &buf[offset]);
1112 offset += sizeof(uint16_t);
1113
1114 ctx->hsCtx->extFlag.haveSupportedVers = true;
1115
1116 *usedLen = offset;
1117 return HITLS_SUCCESS;
1118 }
1119
IsHrrKeyShare(const TLS_Ctx * ctx)1120 static int32_t IsHrrKeyShare(const TLS_Ctx *ctx)
1121 {
1122 bool haveHrr = ctx->hsCtx->haveHrr; /* Sent or in the process of sending hrr */
1123 bool haveKeyShare = ctx->hsCtx->extFlag.haveKeyShare; /* has packed the keyshare */
1124
1125 if (haveHrr && !haveKeyShare) {
1126 return true;
1127 }
1128 return false;
1129 }
1130
PackServerPreSharedKey(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)1131 static int32_t PackServerPreSharedKey(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
1132 {
1133 const PskInfo13 *pskInfo = &ctx->hsCtx->kxCtx->pskInfo13;
1134 if (pskInfo->psk == NULL) {
1135 return HITLS_SUCCESS;
1136 }
1137 int32_t ret = PackExtensionHeader(HS_EX_TYPE_PRE_SHARED_KEY, sizeof(uint16_t), buf, bufLen);
1138 if (ret != HITLS_SUCCESS) {
1139 return ret;
1140 }
1141
1142 BSL_Uint16ToByte((uint16_t)pskInfo->selectIndex, &buf[HS_EX_HEADER_LEN]);
1143 *usedLen = HS_EX_HEADER_LEN + sizeof(uint16_t);
1144
1145 return HITLS_SUCCESS;
1146 }
1147 #endif /* HITLS_TLS_PROTO_TLS13 */
1148 #if defined(HITLS_TLS_PROTO_TLS_BASIC) || defined(HITLS_TLS_PROTO_DTLS12)
PackServerSecRenegoInfo(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)1149 static int32_t PackServerSecRenegoInfo(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
1150 {
1151 bool isRenegotiation = ctx->negotiatedInfo.isRenegotiation;
1152 const uint8_t *clientData = ctx->negotiatedInfo.clientVerifyData;
1153 uint32_t clientDataSize = ctx->negotiatedInfo.clientVerifyDataSize;
1154 const uint8_t *serverData = ctx->negotiatedInfo.serverVerifyData;
1155 uint32_t serverDataSize = ctx->negotiatedInfo.serverVerifyDataSize;
1156 /* Calculate the extension length */
1157 uint16_t exMsgHeaderLen = sizeof(uint8_t);
1158 /* For renegotiation, the verify data (client data + server data) must be assembled */
1159 uint16_t exMsgDataLen = (uint16_t)(isRenegotiation ? (clientDataSize + serverDataSize) : 0);
1160
1161 uint32_t offset = 0;
1162 int32_t ret = PackExtensionHeader(HS_EX_TYPE_RENEGOTIATION_INFO, exMsgHeaderLen + exMsgDataLen, buf, bufLen);
1163 if (ret != HITLS_SUCCESS) {
1164 return ret;
1165 }
1166 offset += HS_EX_HEADER_LEN;
1167
1168 if (!isRenegotiation) {
1169 buf[offset++] = 0;
1170 *usedLen = offset;
1171 return HITLS_SUCCESS;
1172 }
1173
1174 /* Pack the length of secRenegoInfo */
1175 buf[offset++] = (uint8_t)(clientDataSize + serverDataSize);
1176
1177 /* Pack the secRenegoInfo content */
1178 (void)memcpy_s(&buf[offset], bufLen - offset, clientData, clientDataSize);
1179
1180 offset += clientDataSize;
1181
1182 (void)memcpy_s(&buf[offset], bufLen - offset, serverData, serverDataSize);
1183 offset += serverDataSize;
1184
1185 *usedLen = offset;
1186 return HITLS_SUCCESS;
1187 }
1188 #endif /* defined(HITLS_TLS_PROTO_TLS_BASIC) || defined(HITLS_TLS_PROTO_DTLS12) */
1189 #ifdef HITLS_TLS_FEATURE_SNI
IsNeedServerPackServerName(const TLS_Ctx * ctx)1190 static bool IsNeedServerPackServerName(const TLS_Ctx *ctx)
1191 {
1192 const TLS_Config *config = &(ctx->config.tlsConfig);
1193 const TLS_NegotiatedInfo *negoInfo = &ctx->negotiatedInfo;
1194
1195 /* The protocol version is earlier than tls1.3 and the server accepts the server name. The server hello message sent
1196 * by the server contains an empty server name extension */
1197 if (negoInfo->isSniStateOK &&
1198 (config->maxVersion < HITLS_VERSION_TLS13 || config->maxVersion == HITLS_VERSION_DTLS12)) {
1199 return true;
1200 }
1201 return false;
1202 }
1203 #endif /* HITLS_TLS_FEATURE_SNI */
1204 #ifdef HITLS_TLS_FEATURE_ETM
IsNeedServerPackEncryptThenMac(const TLS_Ctx * ctx)1205 static bool IsNeedServerPackEncryptThenMac(const TLS_Ctx *ctx)
1206 {
1207 const TLS_Config *config = &(ctx->config.tlsConfig);
1208 const TLS_NegotiatedInfo *negoInfo = &ctx->negotiatedInfo;
1209 if (config->isEncryptThenMac && negoInfo->isEncryptThenMac) {
1210 return true;
1211 }
1212 return false;
1213 }
1214 #endif /* HITLS_TLS_FEATURE_ETM */
1215 // Pack the empty extension of Server Hello
PackServerExtensions(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * usedLen)1216 static int32_t PackServerExtensions(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *usedLen)
1217 {
1218 int32_t ret = HITLS_SUCCESS;
1219 uint32_t listSize = 0u;
1220 uint32_t exLen = 0u;
1221 uint32_t offset = 0u;
1222 #ifdef HITLS_TLS_FEATURE_CUSTOM_EXTENSION
1223 uint32_t context = 0;
1224 #endif /* HITLS_TLS_FEATURE_CUSTOM_EXTENSION */
1225 #ifdef HITLS_TLS_PROTO_TLS13
1226 uint32_t version = HS_GetVersion(ctx);
1227 bool isHrrKeyshare = IsHrrKeyShare(ctx);
1228 bool isTls13 = Tls13NeedPack(ctx, version);
1229 #endif /* HITLS_TLS_PROTO_TLS13 */
1230 const TLS_NegotiatedInfo *negoInfo = &ctx->negotiatedInfo;
1231 (void)negoInfo;
1232 PackExtInfo extMsgList[] = {
1233 #ifdef HITLS_TLS_FEATURE_SNI
1234 { EXTENSION_MSG(HS_EX_TYPE_SERVER_NAME, IsNeedServerPackServerName(ctx), NULL) },
1235 #endif /* HITLS_TLS_FEATURE_SNI */
1236 #ifdef HITLS_TLS_PROTO_TLS13
1237 { EXTENSION_MSG(HS_EX_TYPE_COOKIE, isTls13, PackCookie) },
1238 #endif /* HITLS_TLS_PROTO_TLS13 */
1239 #ifdef HITLS_TLS_FEATURE_SESSION_TICKET
1240 { EXTENSION_MSG(HS_EX_TYPE_SESSION_TICKET, negoInfo->isTicket, NULL) },
1241 #endif /* HITLS_TLS_FEATURE_SESSION_TICKET */
1242 { EXTENSION_MSG(HS_EX_TYPE_POINT_FORMATS, IsServerNeedPackEcExtension(ctx), PackPointFormats) },
1243 #ifdef HITLS_TLS_PROTO_TLS13
1244 { EXTENSION_MSG(HS_EX_TYPE_SUPPORTED_VERSIONS, isTls13, PackServerSupportedVersion) },
1245 #endif /* HITLS_TLS_PROTO_TLS13 */
1246 { EXTENSION_MSG(HS_EX_TYPE_EXTENDED_MASTER_SECRET, negoInfo->isExtendedMasterSecret, NULL) },
1247 #ifdef HITLS_TLS_FEATURE_ALPN
1248 { .exMsgType = HS_EX_TYPE_APP_LAYER_PROTOCOLS,
1249 .needPack = (negoInfo->alpnSelected != NULL
1250 #ifdef HITLS_TLS_PROTO_TLS13
1251 && !isTls13
1252 #endif
1253 ),
1254 .packFunc = PackServerSelectAlpnProto },
1255 #endif /* HITLS_TLS_FEATURE_ALPN */
1256 #ifdef HITLS_TLS_PROTO_TLS13
1257 { EXTENSION_MSG(HS_EX_TYPE_KEY_SHARE, (isTls13 && !isHrrKeyshare), PackServerKeyShare) },
1258 { EXTENSION_MSG(HS_EX_TYPE_KEY_SHARE, (isTls13 && isHrrKeyshare), PackHrrKeyShare) },
1259 #endif /* HITLS_TLS_PROTO_TLS13 */
1260 #if defined(HITLS_TLS_PROTO_TLS_BASIC) || defined(HITLS_TLS_PROTO_DTLS12)
1261 { EXTENSION_MSG(HS_EX_TYPE_RENEGOTIATION_INFO, negoInfo->isSecureRenegotiation, PackServerSecRenegoInfo) },
1262 #endif /* defined(HITLS_TLS_PROTO_TLS_BASIC) || defined(HITLS_TLS_PROTO_DTLS12) */
1263 #ifdef HITLS_TLS_FEATURE_ETM
1264 { EXTENSION_MSG(HS_EX_TYPE_ENCRYPT_THEN_MAC, IsNeedServerPackEncryptThenMac(ctx), NULL) },
1265 #endif /* HITLS_TLS_FEATURE_ETM */
1266 #ifdef HITLS_TLS_PROTO_TLS13
1267 /* The preshare key must be the last extension */
1268 { EXTENSION_MSG(HS_EX_TYPE_PRE_SHARED_KEY, IsNeedPreSharedKey(ctx), PackServerPreSharedKey) },
1269 #endif /* HITLS_TLS_PROTO_TLS13 */
1270 };
1271 #ifdef HITLS_TLS_FEATURE_CUSTOM_EXTENSION
1272 #ifdef HITLS_TLS_PROTO_TLS13
1273 if (isTls13) {
1274 if (isHrrKeyshare) {
1275 context = HITLS_EX_TYPE_HELLO_RETRY_REQUEST;
1276 } else {
1277 context = HITLS_EX_TYPE_TLS1_3_SERVER_HELLO;
1278 }
1279 } else
1280 #endif
1281 {
1282 context = HITLS_EX_TYPE_TLS1_2_SERVER_HELLO;
1283 }
1284
1285 exLen = 0u;
1286 if (IsPackNeedCustomExtensions(CUSTOM_EXT_FROM_CTX(ctx), context)) {
1287 ret = PackCustomExtensions(ctx, &buf[offset], bufLen - offset, &exLen, context, NULL, 0);
1288 if (ret != HITLS_SUCCESS) {
1289 return ret;
1290 }
1291 offset += exLen;
1292 }
1293 #endif /* HITLS_TLS_FEATURE_CUSTOM_EXTENSION */
1294
1295 /* Calculate the number of extended types */
1296 listSize = sizeof(extMsgList) / sizeof(extMsgList[0]);
1297
1298 /* Pack the Server Hello extension */
1299 for (uint32_t index = 0; index < listSize; index++) {
1300 if (extMsgList[index].needPack == false) {
1301 continue;
1302 }
1303 /* Empty extension */
1304 if (extMsgList[index].packFunc == NULL) {
1305 exLen = 0u;
1306 ret = PackEmptyExtension(extMsgList[index].exMsgType, extMsgList[index].needPack,
1307 &buf[offset], bufLen - offset, &exLen);
1308 if (ret != HITLS_SUCCESS) {
1309 return ret;
1310 }
1311 offset += exLen;
1312 }
1313 /* No empty extension */
1314 if (extMsgList[index].packFunc != NULL) {
1315 exLen = 0u;
1316 ret = extMsgList[index].packFunc(ctx, &buf[offset], bufLen - offset, &exLen);
1317 if (ret != HITLS_SUCCESS) {
1318 return ret;
1319 }
1320 offset += exLen;
1321 }
1322 }
1323
1324 *usedLen = offset;
1325 return HITLS_SUCCESS;
1326 }
1327
PackServerExBody(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * exLen)1328 static int32_t PackServerExBody(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *exLen)
1329 {
1330 int32_t ret = HITLS_SUCCESS;
1331 uint32_t offset = 0u;
1332 uint32_t usedLen = 0u;
1333
1334 ret = PackServerExtensions(ctx, &buf[offset], bufLen - offset, &usedLen);
1335 if (ret != HITLS_SUCCESS) {
1336 return ret;
1337 }
1338 offset += usedLen;
1339
1340 /* Pack the nonempty extension of server hello. No nonempty extension of server hello is supported. */
1341
1342 /* Update the packet length */
1343 *exLen = offset;
1344 return HITLS_SUCCESS;
1345 }
1346
1347 // Pack the Server Hello extension
PackServerExtension(const TLS_Ctx * ctx,uint8_t * buf,uint32_t bufLen,uint32_t * len)1348 int32_t PackServerExtension(const TLS_Ctx *ctx, uint8_t *buf, uint32_t bufLen, uint32_t *len)
1349 {
1350 int32_t ret = HITLS_SUCCESS;
1351 uint32_t headerLen = 0u;
1352 uint32_t exLen = 0u;
1353
1354 /* Obtain the packet header length */
1355 headerLen = sizeof(uint16_t);
1356 if (bufLen < headerLen) {
1357 return PackBufLenError(BINLOG_ID15434, BINGLOG_STR("server hello extension"));
1358 }
1359
1360 /* Pack the server hello extension content */
1361 ret = PackServerExBody(ctx, &buf[headerLen], bufLen - headerLen, &exLen);
1362 if (ret != HITLS_SUCCESS) {
1363 return ret;
1364 }
1365
1366 /* Update the packet length */
1367 if (exLen > 0u) {
1368 BSL_Uint16ToByte((uint16_t)exLen, buf);
1369 *len = exLen + headerLen;
1370 } else {
1371 *len = 0u;
1372 }
1373
1374 return HITLS_SUCCESS;
1375 }
1376 #endif /* HITLS_TLS_HOST_SERVER */
1377