blob: 291d64500d30333de943c8b5a75e8c1e623a2a06 [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
Jerry Yub9930e72021-08-06 17:11:51 +08002 * TLS 1.3 server-side functions
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003 *
4 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00005 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Gilles Peskine449bd832023-01-11 14:50:10 +01006 */
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08007
8#include "common.h"
9
Jerry Yufb4b6472022-01-27 15:03:26 +080010#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080011
Valerio Settib4f50762024-01-17 10:24:52 +010012#include "debug_internal.h"
Xiaofei Baicba64af2022-02-15 10:00:56 +000013#include "mbedtls/error.h"
14#include "mbedtls/platform.h"
Jerry Yu1c105562022-07-10 06:32:38 +000015#include "mbedtls/constant_time.h"
Manuel Pégourié-Gonnardd55d66f2023-06-20 10:14:58 +020016#include "mbedtls/oid.h"
Valerio Setti384fbde2024-01-02 13:26:40 +010017#include "mbedtls/psa_util.h"
Jerry Yu3bf2c642022-03-30 22:02:12 +080018
Xiaofei Bai9ca09d42022-02-14 12:57:18 +000019#include "ssl_misc.h"
20#include "ssl_tls13_keys.h"
21#include "ssl_debug_helpers.h"
22
Jerry Yuf35ba382022-08-23 17:58:26 +080023
Jerry Yuc5a23a02022-08-25 10:51:44 +080024static const mbedtls_ssl_ciphersuite_t *ssl_tls13_validate_peer_ciphersuite(
Gilles Peskine449bd832023-01-11 14:50:10 +010025 mbedtls_ssl_context *ssl,
26 unsigned int cipher_suite)
Jerry Yuf35ba382022-08-23 17:58:26 +080027{
28 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +010029 if (!mbedtls_ssl_tls13_cipher_suite_is_offered(ssl, cipher_suite)) {
30 return NULL;
Jerry Yuf35ba382022-08-23 17:58:26 +080031 }
Gilles Peskine449bd832023-01-11 14:50:10 +010032
33 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(cipher_suite);
34 if ((mbedtls_ssl_validate_ciphersuite(ssl, ciphersuite_info,
35 ssl->tls_version,
36 ssl->tls_version) != 0)) {
37 return NULL;
38 }
39 return ciphersuite_info;
Jerry Yuf35ba382022-08-23 17:58:26 +080040}
41
Ronald Cron89089cc2024-02-14 18:18:08 +010042static void ssl_tls13_select_ciphersuite(
43 mbedtls_ssl_context *ssl,
44 const unsigned char *cipher_suites,
45 const unsigned char *cipher_suites_end,
46 int psk_ciphersuite_id,
47 psa_algorithm_t psk_hash_alg,
48 const mbedtls_ssl_ciphersuite_t **selected_ciphersuite_info)
49{
50 *selected_ciphersuite_info = NULL;
51
52 /*
Ronald Cron38117652024-03-05 09:05:46 +010053 * In a compliant ClientHello the byte-length of the list of ciphersuites
54 * is even and this function relies on this fact. This should have been
55 * checked in the main ClientHello parsing function. Double check here.
Ronald Cron89089cc2024-02-14 18:18:08 +010056 */
57 if ((cipher_suites_end - cipher_suites) & 1) {
58 return;
59 }
60
61 for (const unsigned char *p = cipher_suites;
62 p < cipher_suites_end; p += 2) {
63 /*
64 * "cipher_suites_end - p is even" is an invariant of the loop. As
65 * cipher_suites_end - p > 0, we have cipher_suites_end - p >= 2 and it
66 * is thus safe to read two bytes.
67 */
68 uint16_t id = MBEDTLS_GET_UINT16_BE(p, 0);
69
70 const mbedtls_ssl_ciphersuite_t *info =
71 ssl_tls13_validate_peer_ciphersuite(ssl, id);
72 if (info == NULL) {
73 continue;
74 }
75
76 /*
Ronald Cron7cab4f82024-03-07 15:09:09 +010077 * If a valid PSK ciphersuite identifier has been passed in, we want
78 * an exact match.
Ronald Cron89089cc2024-02-14 18:18:08 +010079 */
80 if (psk_ciphersuite_id != 0) {
81 if (id != psk_ciphersuite_id) {
82 continue;
83 }
84 } else if (psk_hash_alg != PSA_ALG_NONE) {
85 if (mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) info->mac) !=
86 psk_hash_alg) {
87 continue;
88 }
89 }
90
91 *selected_ciphersuite_info = info;
92 return;
93 }
94
Ronald Cron19521dd2024-03-07 15:09:41 +010095 MBEDTLS_SSL_DEBUG_MSG(2, ("No matched ciphersuite, psk_ciphersuite_id=%x, psk_hash_alg=%x",
96 (unsigned) psk_ciphersuite_id, psk_hash_alg));
Ronald Cron89089cc2024-02-14 18:18:08 +010097}
98
Ronald Cron41a443a2022-10-04 16:38:25 +020099#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yue19e3b92022-07-08 12:04:51 +0000100/* From RFC 8446:
101 *
102 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
103 * struct {
104 * PskKeyExchangeMode ke_modes<1..255>;
105 * } PskKeyExchangeModes;
106 */
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800107MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100108static int ssl_tls13_parse_key_exchange_modes_ext(mbedtls_ssl_context *ssl,
109 const unsigned char *buf,
110 const unsigned char *end)
Jerry Yue19e3b92022-07-08 12:04:51 +0000111{
Jerry Yu299e31f2022-07-13 23:06:36 +0800112 const unsigned char *p = buf;
Jerry Yue19e3b92022-07-08 12:04:51 +0000113 size_t ke_modes_len;
114 int ke_modes = 0;
115
Jerry Yu854dd9e2022-07-15 14:28:27 +0800116 /* Read ke_modes length (1 Byte) */
Gilles Peskine449bd832023-01-11 14:50:10 +0100117 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
Jerry Yu299e31f2022-07-13 23:06:36 +0800118 ke_modes_len = *p++;
Jerry Yue19e3b92022-07-08 12:04:51 +0000119 /* Currently, there are only two PSK modes, so even without looking
120 * at the content, something's wrong if the list has more than 2 items. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100121 if (ke_modes_len > 2) {
122 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
123 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
124 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu299e31f2022-07-13 23:06:36 +0800125 }
Jerry Yue19e3b92022-07-08 12:04:51 +0000126
Gilles Peskine449bd832023-01-11 14:50:10 +0100127 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, ke_modes_len);
Jerry Yue19e3b92022-07-08 12:04:51 +0000128
Gilles Peskine449bd832023-01-11 14:50:10 +0100129 while (ke_modes_len-- != 0) {
130 switch (*p++) {
131 case MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE:
132 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
133 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK KEX MODE"));
134 break;
135 case MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE:
136 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
137 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK_EPHEMERAL KEX MODE"));
138 break;
139 default:
140 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
141 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
142 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yue19e3b92022-07-08 12:04:51 +0000143 }
144 }
145
146 ssl->handshake->tls13_kex_modes = ke_modes;
Gilles Peskine449bd832023-01-11 14:50:10 +0100147 return 0;
Jerry Yue19e3b92022-07-08 12:04:51 +0000148}
Jerry Yu1c105562022-07-10 06:32:38 +0000149
Ronald Cron38117652024-03-05 09:05:46 +0100150/*
151 * Non-error return values of
152 * ssl_tls13_offered_psks_check_identity_match_ticket() and
153 * ssl_tls13_offered_psks_check_identity_match(). They are positive to
154 * not collide with error codes that are negative. Zero
155 * (SSL_TLS1_3_PSK_IDENTITY_MATCH) in case of success as it may be propagated
156 * up by the callers of this function as a generic success condition.
157 *
158 * The return value SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE means
Ronald Cron7cab4f82024-03-07 15:09:09 +0100159 * that the pre-shared-key identity matches that of a ticket or an externally-
Ronald Cron38117652024-03-05 09:05:46 +0100160 * provisioned pre-shared-key. We have thus been able to retrieve the
161 * attributes of the pre-shared-key but at least one of them does not meet
162 * some criteria and the pre-shared-key cannot be used. For example, a ticket
163 * is expired or its version is not TLS 1.3. Note eventually that the return
164 * value SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE does not have
165 * anything to do with binder check. A binder check is done only when a
166 * suitable pre-shared-key has been selected and only for that selected
167 * pre-shared-key: if the binder check fails, we fail the handshake and we do
168 * not try to find another pre-shared-key for which the binder check would
169 * succeed as recommended by the specification.
170 */
Ronald Cronfbae94a2023-12-05 18:15:14 +0100171#define SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH 2
172#define SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE 1
173#define SSL_TLS1_3_PSK_IDENTITY_MATCH 0
Jerry Yu95699e72022-08-21 19:22:23 +0800174
175#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Pengyu Lv29daf4a2023-10-30 17:13:30 +0800176MBEDTLS_CHECK_RETURN_CRITICAL
Pengyu Lvbc4aab72023-12-01 15:37:24 +0800177static int ssl_tls13_key_exchange_is_psk_available(mbedtls_ssl_context *ssl);
Pengyu Lv29daf4a2023-10-30 17:13:30 +0800178MBEDTLS_CHECK_RETURN_CRITICAL
Pengyu Lvbc4aab72023-12-01 15:37:24 +0800179static int ssl_tls13_key_exchange_is_psk_ephemeral_available(mbedtls_ssl_context *ssl);
Jerry Yu95699e72022-08-21 19:22:23 +0800180
181MBEDTLS_CHECK_RETURN_CRITICAL
182static int ssl_tls13_offered_psks_check_identity_match_ticket(
Gilles Peskine449bd832023-01-11 14:50:10 +0100183 mbedtls_ssl_context *ssl,
184 const unsigned char *identity,
185 size_t identity_len,
186 uint32_t obfuscated_ticket_age,
187 mbedtls_ssl_session *session)
Jerry Yu95699e72022-08-21 19:22:23 +0800188{
Jerry Yufd310eb2022-09-06 09:16:35 +0800189 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu95699e72022-08-21 19:22:23 +0800190 unsigned char *ticket_buffer;
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800191#if defined(MBEDTLS_HAVE_TIME)
Jerry Yucebffc32022-12-15 18:00:05 +0800192 mbedtls_ms_time_t now;
193 mbedtls_ms_time_t server_age;
Jerry Yu713ce1f2023-11-17 15:32:12 +0800194 uint32_t client_age;
Jerry Yucebffc32022-12-15 18:00:05 +0800195 mbedtls_ms_time_t age_diff;
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800196#endif
Jerry Yu95699e72022-08-21 19:22:23 +0800197
198 ((void) obfuscated_ticket_age);
199
Gilles Peskine449bd832023-01-11 14:50:10 +0100200 MBEDTLS_SSL_DEBUG_MSG(2, ("=> check_identity_match_ticket"));
Jerry Yu95699e72022-08-21 19:22:23 +0800201
Jerry Yufd310eb2022-09-06 09:16:35 +0800202 /* Ticket parser is not configured, Skip */
Gilles Peskine449bd832023-01-11 14:50:10 +0100203 if (ssl->conf->f_ticket_parse == NULL || identity_len == 0) {
Ronald Cronfbae94a2023-12-05 18:15:14 +0100204 return SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
Gilles Peskine449bd832023-01-11 14:50:10 +0100205 }
Jerry Yu95699e72022-08-21 19:22:23 +0800206
Jerry Yu4746b102022-09-13 11:11:48 +0800207 /* We create a copy of the encrypted ticket since the ticket parsing
208 * function is allowed to use its input buffer as an output buffer
209 * (in-place decryption). We do, however, need the original buffer for
210 * computing the PSK binder value.
Jerry Yu95699e72022-08-21 19:22:23 +0800211 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100212 ticket_buffer = mbedtls_calloc(1, identity_len);
213 if (ticket_buffer == NULL) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100214 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Jerry Yu95699e72022-08-21 19:22:23 +0800215 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100216 memcpy(ticket_buffer, identity, identity_len);
Jerry Yu95699e72022-08-21 19:22:23 +0800217
Ronald Cronfbae94a2023-12-05 18:15:14 +0100218 ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket,
219 session,
220 ticket_buffer, identity_len);
Ronald Cronf602f7b2024-03-05 09:11:55 +0100221 switch (ret) {
222 case 0:
223 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH;
224 break;
225
226 case MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100227 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired"));
Ronald Cronfbae94a2023-12-05 18:15:14 +0100228 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE;
Ronald Cronf602f7b2024-03-05 09:11:55 +0100229 break;
230
231 case MBEDTLS_ERR_SSL_INVALID_MAC:
232 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic"));
Ronald Cronfbae94a2023-12-05 18:15:14 +0100233 ret = SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
Ronald Cronf602f7b2024-03-05 09:11:55 +0100234 break;
235
236 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100237 MBEDTLS_SSL_DEBUG_RET(1, "ticket_parse", ret);
Ronald Cronf602f7b2024-03-05 09:11:55 +0100238 ret = SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
Jerry Yu95699e72022-08-21 19:22:23 +0800239 }
240
241 /* We delete the temporary buffer */
Gilles Peskine449bd832023-01-11 14:50:10 +0100242 mbedtls_free(ticket_buffer);
Jerry Yu95699e72022-08-21 19:22:23 +0800243
Ronald Cronfbae94a2023-12-05 18:15:14 +0100244 if (ret != SSL_TLS1_3_PSK_IDENTITY_MATCH) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800245 goto exit;
246 }
Jerry Yu95699e72022-08-21 19:22:23 +0800247
Ronald Cron38117652024-03-05 09:05:46 +0100248 /*
249 * The identity matches that of a ticket. Now check that it has suitable
250 * attributes and bet it will not be the case.
Pengyu Lv3eb49be2022-12-05 16:35:12 +0800251 */
Ronald Cronfbae94a2023-12-05 18:15:14 +0100252 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE;
Pengyu Lv29daf4a2023-10-30 17:13:30 +0800253
Ronald Cronfbae94a2023-12-05 18:15:14 +0100254 if (session->tls_version != MBEDTLS_SSL_VERSION_TLS1_3) {
255 MBEDTLS_SSL_DEBUG_MSG(3, ("Ticket TLS version is not 1.3."));
Pengyu Lv3eb49be2022-12-05 16:35:12 +0800256 goto exit;
257 }
258
Gilles Peskine449bd832023-01-11 14:50:10 +0100259#if defined(MBEDTLS_HAVE_TIME)
Jerry Yucebffc32022-12-15 18:00:05 +0800260 now = mbedtls_ms_time();
Gilles Peskine449bd832023-01-11 14:50:10 +0100261
Jerry Yu25ba4d42023-11-10 14:12:20 +0800262 if (now < session->ticket_creation_time) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100263 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu713ce1f2023-11-17 15:32:12 +0800264 3, ("Invalid ticket creation time ( now = %" MBEDTLS_PRINTF_MS_TIME
265 ", creation_time = %" MBEDTLS_PRINTF_MS_TIME " )",
Jerry Yu25ba4d42023-11-10 14:12:20 +0800266 now, session->ticket_creation_time));
Gilles Peskine449bd832023-01-11 14:50:10 +0100267 goto exit;
268 }
269
Jerry Yu25ba4d42023-11-10 14:12:20 +0800270 server_age = now - session->ticket_creation_time;
Jerry Yu95699e72022-08-21 19:22:23 +0800271
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800272 /* RFC 8446 section 4.6.1
273 *
274 * Servers MUST NOT use any value greater than 604800 seconds (7 days).
275 *
276 * RFC 8446 section 4.2.11.1
277 *
278 * Clients MUST NOT attempt to use tickets which have ages greater than
279 * the "ticket_lifetime" value which was provided with the ticket.
280 *
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800281 */
Jerry Yu8e0174a2023-11-10 13:58:16 +0800282 if (server_age > MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME * 1000) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800283 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yud84c14f2023-11-16 13:33:57 +0800284 3, ("Ticket age exceeds limitation ticket_age = %" MBEDTLS_PRINTF_MS_TIME,
Jerry Yucebffc32022-12-15 18:00:05 +0800285 server_age));
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800286 goto exit;
287 }
Jerry Yu95699e72022-08-21 19:22:23 +0800288
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800289 /* RFC 8446 section 4.2.10
290 *
291 * For PSKs provisioned via NewSessionTicket, a server MUST validate that
292 * the ticket age for the selected PSK identity (computed by subtracting
293 * ticket_age_add from PskIdentity.obfuscated_ticket_age modulo 2^32) is
294 * within a small tolerance of the time since the ticket was issued.
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800295 *
Jerry Yu31b601a2023-11-10 11:27:21 +0800296 * NOTE: The typical accuracy of an RTC crystal is ±100 to ±20 parts per
297 * million (360 to 72 milliseconds per hour). Default tolerance
Jerry Yu9cb953a2023-11-15 09:54:11 +0800298 * window is 6s, thus in the worst case clients and servers must
Jerry Yu31b601a2023-11-10 11:27:21 +0800299 * sync up their system time every 6000/360/2~=8 hours.
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800300 */
Jerry Yucebffc32022-12-15 18:00:05 +0800301 client_age = obfuscated_ticket_age - session->ticket_age_add;
Jerry Yu60e99722023-11-20 09:55:24 +0800302 age_diff = server_age - (mbedtls_ms_time_t) client_age;
Jerry Yu28e7c552023-11-10 12:05:56 +0800303 if (age_diff < -MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE ||
Jerry Yucebffc32022-12-15 18:00:05 +0800304 age_diff > MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800305 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yuf16efbc2023-10-30 11:06:24 +0800306 3, ("Ticket age outside tolerance window ( diff = %"
307 MBEDTLS_PRINTF_MS_TIME ")",
Jerry Yucebffc32022-12-15 18:00:05 +0800308 age_diff));
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800309 goto exit;
310 }
Jerry Yu95699e72022-08-21 19:22:23 +0800311#endif /* MBEDTLS_HAVE_TIME */
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800312
Ronald Cron38117652024-03-05 09:05:46 +0100313 /*
314 * All good, we have found a suitable ticket.
315 */
Ronald Cronfbae94a2023-12-05 18:15:14 +0100316 ret = SSL_TLS1_3_PSK_IDENTITY_MATCH;
317
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800318exit:
Ronald Cronfbae94a2023-12-05 18:15:14 +0100319 if (ret != SSL_TLS1_3_PSK_IDENTITY_MATCH) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100320 mbedtls_ssl_session_free(session);
321 }
Jerry Yu95699e72022-08-21 19:22:23 +0800322
Gilles Peskine449bd832023-01-11 14:50:10 +0100323 MBEDTLS_SSL_DEBUG_MSG(2, ("<= check_identity_match_ticket"));
324 return ret;
Jerry Yu95699e72022-08-21 19:22:23 +0800325}
326#endif /* MBEDTLS_SSL_SESSION_TICKETS */
327
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800328MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu1c105562022-07-10 06:32:38 +0000329static int ssl_tls13_offered_psks_check_identity_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100330 mbedtls_ssl_context *ssl,
331 const unsigned char *identity,
332 size_t identity_len,
333 uint32_t obfuscated_ticket_age,
334 int *psk_type,
335 mbedtls_ssl_session *session)
Jerry Yu1c105562022-07-10 06:32:38 +0000336{
Ronald Cron606671e2023-02-17 11:36:33 +0100337 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
338
Jerry Yu95699e72022-08-21 19:22:23 +0800339 ((void) session);
340 ((void) obfuscated_ticket_age);
Jerry Yu5725f1c2022-08-21 17:27:16 +0800341 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
Jerry Yu95699e72022-08-21 19:22:23 +0800342
Gilles Peskine449bd832023-01-11 14:50:10 +0100343 MBEDTLS_SSL_DEBUG_BUF(4, "identity", identity, identity_len);
Jerry Yu95699e72022-08-21 19:22:23 +0800344
Jerry Yu95699e72022-08-21 19:22:23 +0800345#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Ronald Cron7a30cf52024-02-23 14:38:59 +0100346 ret = ssl_tls13_offered_psks_check_identity_match_ticket(
347 ssl, identity, identity_len, obfuscated_ticket_age, session);
348 if (ret == SSL_TLS1_3_PSK_IDENTITY_MATCH) {
Jerry Yu95699e72022-08-21 19:22:23 +0800349 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION;
Ronald Cron606671e2023-02-17 11:36:33 +0100350 ret = mbedtls_ssl_set_hs_psk(ssl,
351 session->resumption_key,
352 session->resumption_key_len);
353 if (ret != 0) {
354 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
355 return ret;
356 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100357
358 MBEDTLS_SSL_DEBUG_BUF(4, "Ticket-resumed PSK:",
359 session->resumption_key,
360 session->resumption_key_len);
361 MBEDTLS_SSL_DEBUG_MSG(4, ("ticket: obfuscated_ticket_age: %u",
362 (unsigned) obfuscated_ticket_age));
Ronald Cronfbae94a2023-12-05 18:15:14 +0100363 return SSL_TLS1_3_PSK_IDENTITY_MATCH;
Ronald Cron7a30cf52024-02-23 14:38:59 +0100364 } else if (ret == SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE) {
365 return SSL_TLS1_3_PSK_IDENTITY_MATCH_BUT_PSK_NOT_USABLE;
Jerry Yu95699e72022-08-21 19:22:23 +0800366 }
367#endif /* MBEDTLS_SSL_SESSION_TICKETS */
368
Jerry Yu1c105562022-07-10 06:32:38 +0000369 /* Check identity with external configured function */
Gilles Peskine449bd832023-01-11 14:50:10 +0100370 if (ssl->conf->f_psk != NULL) {
371 if (ssl->conf->f_psk(
372 ssl->conf->p_psk, ssl, identity, identity_len) == 0) {
Ronald Cronfbae94a2023-12-05 18:15:14 +0100373 return SSL_TLS1_3_PSK_IDENTITY_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000374 }
Ronald Cronfbae94a2023-12-05 18:15:14 +0100375 return SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000376 }
377
Gilles Peskine449bd832023-01-11 14:50:10 +0100378 MBEDTLS_SSL_DEBUG_BUF(5, "identity", identity, identity_len);
Jerry Yu1c105562022-07-10 06:32:38 +0000379 /* Check identity with pre-configured psk */
Gilles Peskine449bd832023-01-11 14:50:10 +0100380 if (ssl->conf->psk_identity != NULL &&
Jerry Yu2f0abc92022-07-22 19:34:48 +0800381 identity_len == ssl->conf->psk_identity_len &&
Gilles Peskine449bd832023-01-11 14:50:10 +0100382 mbedtls_ct_memcmp(ssl->conf->psk_identity,
383 identity, identity_len) == 0) {
Ronald Cron606671e2023-02-17 11:36:33 +0100384 ret = mbedtls_ssl_set_hs_psk(ssl, ssl->conf->psk, ssl->conf->psk_len);
385 if (ret != 0) {
386 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
387 return ret;
388 }
Ronald Cronfbae94a2023-12-05 18:15:14 +0100389 return SSL_TLS1_3_PSK_IDENTITY_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000390 }
391
Ronald Cronfbae94a2023-12-05 18:15:14 +0100392 return SSL_TLS1_3_PSK_IDENTITY_DOES_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000393}
394
Ronald Cron38117652024-03-05 09:05:46 +0100395/*
396 * Non-error return values of ssl_tls13_offered_psks_check_binder_match().
397 * They are positive to not collide with error codes that are negative. Zero
398 * (SSL_TLS1_3_BINDER_MATCH) in case of success as it may be propagated up
399 * by the callers of this function as a generic success condition.
400 */
Ronald Cron6e311272023-12-05 17:57:01 +0100401#define SSL_TLS1_3_BINDER_DOES_NOT_MATCH 1
402#define SSL_TLS1_3_BINDER_MATCH 0
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800403MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000404static int ssl_tls13_offered_psks_check_binder_match(
405 mbedtls_ssl_context *ssl,
406 const unsigned char *binder, size_t binder_len,
407 int psk_type, psa_algorithm_t psk_hash_alg)
Jerry Yu1c105562022-07-10 06:32:38 +0000408{
409 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu96a2e362022-07-21 15:11:34 +0800410
Jerry Yudaf375a2022-07-20 21:31:43 +0800411 unsigned char transcript[PSA_HASH_MAX_SIZE];
Jerry Yu1c105562022-07-10 06:32:38 +0000412 size_t transcript_len;
Jerry Yu2f0abc92022-07-22 19:34:48 +0800413 unsigned char *psk;
Jerry Yu96a2e362022-07-21 15:11:34 +0800414 size_t psk_len;
Jerry Yudaf375a2022-07-20 21:31:43 +0800415 unsigned char server_computed_binder[PSA_HASH_MAX_SIZE];
Jerry Yu1c105562022-07-10 06:32:38 +0000416
Jerry Yu1c105562022-07-10 06:32:38 +0000417 /* Get current state of handshake transcript. */
Jerry Yu29d9faa2022-08-23 17:52:45 +0800418 ret = mbedtls_ssl_get_handshake_transcript(
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +0200419 ssl, mbedtls_md_type_from_psa_alg(psk_hash_alg),
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 transcript, sizeof(transcript), &transcript_len);
421 if (ret != 0) {
422 return ret;
423 }
Jerry Yu1c105562022-07-10 06:32:38 +0000424
Gilles Peskine449bd832023-01-11 14:50:10 +0100425 ret = mbedtls_ssl_tls13_export_handshake_psk(ssl, &psk, &psk_len);
426 if (ret != 0) {
427 return ret;
428 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800429
Gilles Peskine449bd832023-01-11 14:50:10 +0100430 ret = mbedtls_ssl_tls13_create_psk_binder(ssl, psk_hash_alg,
431 psk, psk_len, psk_type,
432 transcript,
433 server_computed_binder);
Jerry Yu96a2e362022-07-21 15:11:34 +0800434#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100435 mbedtls_free((void *) psk);
Jerry Yu96a2e362022-07-21 15:11:34 +0800436#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100437 if (ret != 0) {
438 MBEDTLS_SSL_DEBUG_MSG(1, ("PSK binder calculation failed."));
439 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu1c105562022-07-10 06:32:38 +0000440 }
441
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( computed ): ",
443 server_computed_binder, transcript_len);
444 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( received ): ", binder, binder_len);
Jerry Yu1c105562022-07-10 06:32:38 +0000445
Gilles Peskine449bd832023-01-11 14:50:10 +0100446 if (mbedtls_ct_memcmp(server_computed_binder, binder, binder_len) == 0) {
Ronald Cron6e311272023-12-05 17:57:01 +0100447 return SSL_TLS1_3_BINDER_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000448 }
449
Gilles Peskine449bd832023-01-11 14:50:10 +0100450 mbedtls_platform_zeroize(server_computed_binder,
451 sizeof(server_computed_binder));
Ronald Cron6e311272023-12-05 17:57:01 +0100452 return SSL_TLS1_3_BINDER_DOES_NOT_MATCH;
Jerry Yuf35ba382022-08-23 17:58:26 +0800453}
Jerry Yu5725f1c2022-08-21 17:27:16 +0800454
Jerry Yu82534862022-08-30 10:42:33 +0800455#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yuf35ba382022-08-23 17:58:26 +0800456MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100457static int ssl_tls13_session_copy_ticket(mbedtls_ssl_session *dst,
458 const mbedtls_ssl_session *src)
Jerry Yu82534862022-08-30 10:42:33 +0800459{
Jerry Yu82534862022-08-30 10:42:33 +0800460 dst->ticket_age_add = src->ticket_age_add;
461 dst->ticket_flags = src->ticket_flags;
462 dst->resumption_key_len = src->resumption_key_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 if (src->resumption_key_len == 0) {
464 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
465 }
466 memcpy(dst->resumption_key, src->resumption_key, src->resumption_key_len);
Jerry Yu4746b102022-09-13 11:11:48 +0800467
Jerry Yu33bf2402022-12-12 16:01:43 +0800468#if defined(MBEDTLS_SSL_EARLY_DATA)
469 dst->max_early_data_size = src->max_early_data_size;
Waleed Elmelegy2824a202024-02-23 17:51:47 +0000470
471#if defined(MBEDTLS_SSL_ALPN)
472 if (src->alpn != NULL) {
473 dst->alpn = mbedtls_calloc(strlen(src->alpn) + 1, sizeof(char));
474 if (dst->alpn == NULL) {
475 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
476 }
477 memcpy(dst->alpn, src->alpn, strlen(src->alpn) + 1);
478 }
479#endif /* MBEDTLS_SSL_ALPN */
480#endif /* MBEDTLS_SSL_EARLY_DATA*/
Jerry Yu33bf2402022-12-12 16:01:43 +0800481
Gilles Peskine449bd832023-01-11 14:50:10 +0100482 return 0;
Jerry Yu82534862022-08-30 10:42:33 +0800483}
484#endif /* MBEDTLS_SSL_SESSION_TICKETS */
485
Ronald Cron79cdd412024-02-20 17:19:28 +0100486struct psk_attributes {
487 int type;
488 int key_exchange_mode;
Ronald Cron74a16292024-02-23 17:07:41 +0100489 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Ronald Cron79cdd412024-02-20 17:19:28 +0100490};
Ronald Cron16cc3702024-03-07 15:04:56 +0100491#define PSK_ATTRIBUTES_INIT { 0, 0, NULL }
Ronald Cron79cdd412024-02-20 17:19:28 +0100492
Jerry Yu1c105562022-07-10 06:32:38 +0000493/* Parser for pre_shared_key extension in client hello
494 * struct {
495 * opaque identity<1..2^16-1>;
496 * uint32 obfuscated_ticket_age;
497 * } PskIdentity;
498 *
499 * opaque PskBinderEntry<32..255>;
500 *
501 * struct {
502 * PskIdentity identities<7..2^16-1>;
503 * PskBinderEntry binders<33..2^16-1>;
504 * } OfferedPsks;
505 *
506 * struct {
507 * select (Handshake.msg_type) {
508 * case client_hello: OfferedPsks;
509 * ....
510 * };
511 * } PreSharedKeyExtension;
512 */
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800513MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000514static int ssl_tls13_parse_pre_shared_key_ext(
515 mbedtls_ssl_context *ssl,
516 const unsigned char *pre_shared_key_ext,
517 const unsigned char *pre_shared_key_ext_end,
518 const unsigned char *ciphersuites,
Ronald Cron79cdd412024-02-20 17:19:28 +0100519 const unsigned char *ciphersuites_end,
520 struct psk_attributes *psk)
Jerry Yu1c105562022-07-10 06:32:38 +0000521{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100522 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu29d9faa2022-08-23 17:52:45 +0800523 const unsigned char *identities = pre_shared_key_ext;
Jerry Yu568ec252022-07-22 21:27:34 +0800524 const unsigned char *p_identity_len;
525 size_t identities_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000526 const unsigned char *identities_end;
Jerry Yu568ec252022-07-22 21:27:34 +0800527 const unsigned char *binders;
528 const unsigned char *p_binder_len;
529 size_t binders_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000530 const unsigned char *binders_end;
Jerry Yu96a2e362022-07-21 15:11:34 +0800531 int matched_identity = -1;
532 int identity_id = -1;
Jerry Yu1c105562022-07-10 06:32:38 +0000533
Gilles Peskine449bd832023-01-11 14:50:10 +0100534 MBEDTLS_SSL_DEBUG_BUF(3, "pre_shared_key extension",
535 pre_shared_key_ext,
536 pre_shared_key_ext_end - pre_shared_key_ext);
Jerry Yu1c105562022-07-10 06:32:38 +0000537
Jerry Yu96a2e362022-07-21 15:11:34 +0800538 /* identities_len 2 bytes
539 * identities_data >= 7 bytes
540 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100541 MBEDTLS_SSL_CHK_BUF_READ_PTR(identities, pre_shared_key_ext_end, 7 + 2);
542 identities_len = MBEDTLS_GET_UINT16_BE(identities, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800543 p_identity_len = identities + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100544 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, pre_shared_key_ext_end,
545 identities_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800546 identities_end = p_identity_len + identities_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000547
Jerry Yu96a2e362022-07-21 15:11:34 +0800548 /* binders_len 2 bytes
549 * binders >= 33 bytes
550 */
Jerry Yu568ec252022-07-22 21:27:34 +0800551 binders = identities_end;
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 MBEDTLS_SSL_CHK_BUF_READ_PTR(binders, pre_shared_key_ext_end, 33 + 2);
553 binders_len = MBEDTLS_GET_UINT16_BE(binders, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800554 p_binder_len = binders + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100555 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, pre_shared_key_ext_end, binders_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800556 binders_end = p_binder_len + binders_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000557
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100558 ret = ssl->handshake->update_checksum(ssl, pre_shared_key_ext,
559 identities_end - pre_shared_key_ext);
560 if (0 != ret) {
561 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
562 return ret;
563 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800564
Gilles Peskine449bd832023-01-11 14:50:10 +0100565 while (p_identity_len < identities_end && p_binder_len < binders_end) {
Jerry Yu1c105562022-07-10 06:32:38 +0000566 const unsigned char *identity;
Jerry Yu568ec252022-07-22 21:27:34 +0800567 size_t identity_len;
Jerry Yu82534862022-08-30 10:42:33 +0800568 uint32_t obfuscated_ticket_age;
Jerry Yu96a2e362022-07-21 15:11:34 +0800569 const unsigned char *binder;
Jerry Yu568ec252022-07-22 21:27:34 +0800570 size_t binder_len;
Ronald Cron89089cc2024-02-14 18:18:08 +0100571 int psk_ciphersuite_id;
572 psa_algorithm_t psk_hash_alg;
Ronald Croncf284562024-02-16 18:54:10 +0100573 int allowed_key_exchange_modes;
Ronald Cron74a16292024-02-23 17:07:41 +0100574
Jerry Yu82534862022-08-30 10:42:33 +0800575#if defined(MBEDTLS_SSL_SESSION_TICKETS)
576 mbedtls_ssl_session session;
Gilles Peskine449bd832023-01-11 14:50:10 +0100577 mbedtls_ssl_session_init(&session);
Jerry Yu82534862022-08-30 10:42:33 +0800578#endif
Jerry Yubb852022022-07-20 21:10:44 +0800579
Gilles Peskine449bd832023-01-11 14:50:10 +0100580 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, identities_end, 2 + 1 + 4);
581 identity_len = MBEDTLS_GET_UINT16_BE(p_identity_len, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800582 identity = p_identity_len + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100583 MBEDTLS_SSL_CHK_BUF_READ_PTR(identity, identities_end, identity_len + 4);
584 obfuscated_ticket_age = MBEDTLS_GET_UINT32_BE(identity, identity_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800585 p_identity_len += identity_len + 6;
Jerry Yu1c105562022-07-10 06:32:38 +0000586
Gilles Peskine449bd832023-01-11 14:50:10 +0100587 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, binders_end, 1 + 32);
Jerry Yu568ec252022-07-22 21:27:34 +0800588 binder_len = *p_binder_len;
589 binder = p_binder_len + 1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100590 MBEDTLS_SSL_CHK_BUF_READ_PTR(binder, binders_end, binder_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800591 p_binder_len += binder_len + 1;
Jerry Yu96a2e362022-07-21 15:11:34 +0800592
Jerry Yu96a2e362022-07-21 15:11:34 +0800593 identity_id++;
Gilles Peskine449bd832023-01-11 14:50:10 +0100594 if (matched_identity != -1) {
Jerry Yu1c105562022-07-10 06:32:38 +0000595 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100596 }
Jerry Yu1c105562022-07-10 06:32:38 +0000597
Jerry Yu96a2e362022-07-21 15:11:34 +0800598 ret = ssl_tls13_offered_psks_check_identity_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100599 ssl, identity, identity_len, obfuscated_ticket_age,
Ronald Cron79cdd412024-02-20 17:19:28 +0100600 &psk->type, &session);
Ronald Cronfbae94a2023-12-05 18:15:14 +0100601 if (ret != SSL_TLS1_3_PSK_IDENTITY_MATCH) {
Jerry Yu96a2e362022-07-21 15:11:34 +0800602 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100603 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800604
Gilles Peskine449bd832023-01-11 14:50:10 +0100605 MBEDTLS_SSL_DEBUG_MSG(4, ("found matched identity"));
Ronald Cron89089cc2024-02-14 18:18:08 +0100606
Ronald Cron79cdd412024-02-20 17:19:28 +0100607 switch (psk->type) {
Jerry Yu0baf9072022-08-25 11:21:04 +0800608 case MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL:
Ronald Cron89089cc2024-02-14 18:18:08 +0100609 psk_ciphersuite_id = 0;
610 psk_hash_alg = PSA_ALG_SHA_256;
Ronald Croncf284562024-02-16 18:54:10 +0100611 allowed_key_exchange_modes =
612 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL;
Jerry Yu0baf9072022-08-25 11:21:04 +0800613 break;
Jerry Yu82534862022-08-30 10:42:33 +0800614#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Ronald Cronf7e99162024-02-14 16:04:02 +0100615 case MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:
Ronald Cron89089cc2024-02-14 18:18:08 +0100616 psk_ciphersuite_id = session.ciphersuite;
617 psk_hash_alg = PSA_ALG_NONE;
Ronald Croncf284562024-02-16 18:54:10 +0100618 ssl->session_negotiate->ticket_flags = session.ticket_flags;
619 allowed_key_exchange_modes =
620 session.ticket_flags &
621 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL;
Jerry Yu0baf9072022-08-25 11:21:04 +0800622 break;
Ronald Cronf7e99162024-02-14 16:04:02 +0100623#endif
Jerry Yu0baf9072022-08-25 11:21:04 +0800624 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100625 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu0baf9072022-08-25 11:21:04 +0800626 }
Ronald Cron89089cc2024-02-14 18:18:08 +0100627
Ronald Cron79cdd412024-02-20 17:19:28 +0100628 psk->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE;
629
Ronald Croncf284562024-02-16 18:54:10 +0100630 if ((allowed_key_exchange_modes &
631 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL) &&
632 ssl_tls13_key_exchange_is_psk_ephemeral_available(ssl)) {
Ronald Cron79cdd412024-02-20 17:19:28 +0100633 psk->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
Ronald Croncf284562024-02-16 18:54:10 +0100634 } else if ((allowed_key_exchange_modes &
635 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK) &&
636 ssl_tls13_key_exchange_is_psk_available(ssl)) {
Ronald Cron79cdd412024-02-20 17:19:28 +0100637 psk->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
Ronald Croncf284562024-02-16 18:54:10 +0100638 }
639
Ronald Cron79cdd412024-02-20 17:19:28 +0100640 if (psk->key_exchange_mode == MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE) {
Ronald Croncf284562024-02-16 18:54:10 +0100641 MBEDTLS_SSL_DEBUG_MSG(3, ("No suitable PSK key exchange mode"));
642 continue;
643 }
644
Ronald Cron89089cc2024-02-14 18:18:08 +0100645 ssl_tls13_select_ciphersuite(ssl, ciphersuites, ciphersuites_end,
646 psk_ciphersuite_id, psk_hash_alg,
Ronald Cron74a16292024-02-23 17:07:41 +0100647 &psk->ciphersuite_info);
Ronald Cron89089cc2024-02-14 18:18:08 +0100648
Ronald Cron74a16292024-02-23 17:07:41 +0100649 if (psk->ciphersuite_info == NULL) {
Ronald Cron89089cc2024-02-14 18:18:08 +0100650#if defined(MBEDTLS_SSL_SESSION_TICKETS)
651 mbedtls_ssl_session_free(&session);
652#endif
653 /*
654 * We consider finding a ciphersuite suitable for the PSK as part
655 * of the validation of its binder. Thus if we do not find one, we
656 * abort the handshake with a decrypt_error alert.
657 */
Jerry Yuf35ba382022-08-23 17:58:26 +0800658 MBEDTLS_SSL_PEND_FATAL_ALERT(
659 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
Gilles Peskine449bd832023-01-11 14:50:10 +0100660 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
Ronald Cron89089cc2024-02-14 18:18:08 +0100661 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800662 }
663
Jerry Yu96a2e362022-07-21 15:11:34 +0800664 ret = ssl_tls13_offered_psks_check_binder_match(
Ronald Cron79cdd412024-02-20 17:19:28 +0100665 ssl, binder, binder_len, psk->type,
Ronald Cron74a16292024-02-23 17:07:41 +0100666 mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) psk->ciphersuite_info->mac));
Ronald Cron6e311272023-12-05 17:57:01 +0100667 if (ret != SSL_TLS1_3_BINDER_MATCH) {
Jerry Yuc5a23a02022-08-25 10:51:44 +0800668 /* For security reasons, the handshake should be aborted when we
669 * fail to validate a binder value. See RFC 8446 section 4.2.11.2
670 * and appendix E.6. */
Jerry Yu82534862022-08-30 10:42:33 +0800671#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100672 mbedtls_ssl_session_free(&session);
Jerry Yu82534862022-08-30 10:42:33 +0800673#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100674 MBEDTLS_SSL_DEBUG_MSG(3, ("Invalid binder."));
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000675 MBEDTLS_SSL_DEBUG_RET(
676 1, "ssl_tls13_offered_psks_check_binder_match", ret);
Jerry Yu96a2e362022-07-21 15:11:34 +0800677 MBEDTLS_SSL_PEND_FATAL_ALERT(
678 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
Gilles Peskine449bd832023-01-11 14:50:10 +0100679 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
680 return ret;
Jerry Yu96a2e362022-07-21 15:11:34 +0800681 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800682
683 matched_identity = identity_id;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800684
Jerry Yu82534862022-08-30 10:42:33 +0800685#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Ronald Cron79cdd412024-02-20 17:19:28 +0100686 if (psk->type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
Gilles Peskine449bd832023-01-11 14:50:10 +0100687 ret = ssl_tls13_session_copy_ticket(ssl->session_negotiate,
688 &session);
689 mbedtls_ssl_session_free(&session);
690 if (ret != 0) {
691 return ret;
692 }
Jerry Yu82534862022-08-30 10:42:33 +0800693 }
694#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu1c105562022-07-10 06:32:38 +0000695 }
696
Gilles Peskine449bd832023-01-11 14:50:10 +0100697 if (p_identity_len != identities_end || p_binder_len != binders_end) {
698 MBEDTLS_SSL_DEBUG_MSG(3, ("pre_shared_key extension decode error"));
699 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
700 MBEDTLS_ERR_SSL_DECODE_ERROR);
701 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yu1c105562022-07-10 06:32:38 +0000702 }
703
Jerry Yu6f1db3f2022-07-22 23:05:59 +0800704 /* Update the handshake transcript with the binder list. */
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000705 ret = ssl->handshake->update_checksum(
706 ssl, identities_end, (size_t) (binders_end - identities_end));
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100707 if (0 != ret) {
708 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
709 return ret;
710 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100711 if (matched_identity == -1) {
Ronald Croncf284562024-02-16 18:54:10 +0100712 MBEDTLS_SSL_DEBUG_MSG(3, ("No usable PSK or ticket."));
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Jerry Yu1c105562022-07-10 06:32:38 +0000714 }
715
Gilles Peskine449bd832023-01-11 14:50:10 +0100716 ssl->handshake->selected_identity = (uint16_t) matched_identity;
717 MBEDTLS_SSL_DEBUG_MSG(3, ("Pre shared key found"));
Jerry Yu1c105562022-07-10 06:32:38 +0000718
Gilles Peskine449bd832023-01-11 14:50:10 +0100719 return 0;
Jerry Yu1c105562022-07-10 06:32:38 +0000720}
Jerry Yu032b15ce2022-07-11 06:10:03 +0000721
722/*
723 * struct {
724 * select ( Handshake.msg_type ) {
725 * ....
726 * case server_hello:
727 * uint16 selected_identity;
728 * }
729 * } PreSharedKeyExtension;
730 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100731static int ssl_tls13_write_server_pre_shared_key_ext(mbedtls_ssl_context *ssl,
732 unsigned char *buf,
733 unsigned char *end,
734 size_t *olen)
Jerry Yu032b15ce2022-07-11 06:10:03 +0000735{
Gilles Peskine449bd832023-01-11 14:50:10 +0100736 unsigned char *p = (unsigned char *) buf;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000737
738 *olen = 0;
739
David Horstmann21b89762022-10-06 18:34:28 +0100740 int not_using_psk = 0;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000741#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100742 not_using_psk = (mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque));
Jerry Yu032b15ce2022-07-11 06:10:03 +0000743#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100744 not_using_psk = (ssl->handshake->psk == NULL);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000745#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100746 if (not_using_psk) {
Jerry Yu032b15ce2022-07-11 06:10:03 +0000747 /* We shouldn't have called this extension writer unless we've
748 * chosen to use a PSK. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100749 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000750 }
751
Gilles Peskine449bd832023-01-11 14:50:10 +0100752 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding pre_shared_key extension"));
753 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000754
Gilles Peskine449bd832023-01-11 14:50:10 +0100755 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_PRE_SHARED_KEY, p, 0);
756 MBEDTLS_PUT_UINT16_BE(2, p, 2);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000757
Gilles Peskine449bd832023-01-11 14:50:10 +0100758 MBEDTLS_PUT_UINT16_BE(ssl->handshake->selected_identity, p, 4);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000759
760 *olen = 6;
761
Gilles Peskine449bd832023-01-11 14:50:10 +0100762 MBEDTLS_SSL_DEBUG_MSG(4, ("sent selected_identity: %u",
763 ssl->handshake->selected_identity));
Jerry Yu032b15ce2022-07-11 06:10:03 +0000764
Gilles Peskine449bd832023-01-11 14:50:10 +0100765 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_PRE_SHARED_KEY);
Jerry Yub95dd362022-11-08 21:19:34 +0800766
Gilles Peskine449bd832023-01-11 14:50:10 +0100767 return 0;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000768}
769
Ronald Cron41a443a2022-10-04 16:38:25 +0200770#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yue19e3b92022-07-08 12:04:51 +0000771
XiaokangQian7807f9f2022-02-15 10:04:37 +0000772/* From RFC 8446:
773 * struct {
XiaokangQiancfd925f2022-04-14 07:10:37 +0000774 * ProtocolVersion versions<2..254>;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000775 * } SupportedVersions;
776 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200777MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100778static int ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context *ssl,
779 const unsigned char *buf,
780 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000781{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000782 const unsigned char *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000783 size_t versions_len;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000784 const unsigned char *versions_end;
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000785 uint16_t tls_version;
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100786 int found_supported_version = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000787
Gilles Peskine449bd832023-01-11 14:50:10 +0100788 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
XiaokangQian4080a7f2022-04-11 09:55:18 +0000789 versions_len = p[0];
XiaokangQian7807f9f2022-02-15 10:04:37 +0000790 p += 1;
791
Gilles Peskine449bd832023-01-11 14:50:10 +0100792 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, versions_len);
XiaokangQian4080a7f2022-04-11 09:55:18 +0000793 versions_end = p + versions_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100794 while (p < versions_end) {
795 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, versions_end, 2);
796 tls_version = mbedtls_ssl_read_version(p, ssl->conf->transport);
XiaokangQianb67384d2022-04-19 00:02:38 +0000797 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000798
Ronald Cron3bd2b022023-04-03 16:45:39 +0200799 if (MBEDTLS_SSL_VERSION_TLS1_3 == tls_version) {
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100800 found_supported_version = 1;
801 break;
802 }
803
Ronald Cron3bd2b022023-04-03 16:45:39 +0200804 if ((MBEDTLS_SSL_VERSION_TLS1_2 == tls_version) &&
805 mbedtls_ssl_conf_is_tls12_enabled(ssl->conf)) {
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100806 found_supported_version = 1;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000807 break;
808 }
XiaokangQian7807f9f2022-02-15 10:04:37 +0000809 }
810
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100811 if (!found_supported_version) {
812 MBEDTLS_SSL_DEBUG_MSG(1, ("No supported version found."));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000813
Gilles Peskine449bd832023-01-11 14:50:10 +0100814 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
815 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
816 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000817 }
818
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100819 MBEDTLS_SSL_DEBUG_MSG(1, ("Negotiated version: [%04x]",
Gilles Peskine449bd832023-01-11 14:50:10 +0100820 (unsigned int) tls_version));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000821
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100822 return (int) tls_version;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000823}
824
Przemek Stekiel8c0a9532023-06-15 16:48:19 +0200825#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
XiaokangQiane8ff3502022-04-22 02:34:40 +0000826/*
XiaokangQian7807f9f2022-02-15 10:04:37 +0000827 *
828 * From RFC 8446:
829 * enum {
830 * ... (0xFFFF)
831 * } NamedGroup;
832 * struct {
833 * NamedGroup named_group_list<2..2^16-1>;
834 * } NamedGroupList;
835 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200836MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100837static int ssl_tls13_parse_supported_groups_ext(mbedtls_ssl_context *ssl,
838 const unsigned char *buf,
839 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000840{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000841 const unsigned char *p = buf;
XiaokangQian84823772022-04-19 07:57:30 +0000842 size_t named_group_list_len;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000843 const unsigned char *named_group_list_end;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000844
Gilles Peskine449bd832023-01-11 14:50:10 +0100845 MBEDTLS_SSL_DEBUG_BUF(3, "supported_groups extension", p, end - buf);
846 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
847 named_group_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000848 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100849 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, named_group_list_len);
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000850 named_group_list_end = p + named_group_list_len;
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000851 ssl->handshake->hrr_selected_group = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000852
Gilles Peskine449bd832023-01-11 14:50:10 +0100853 while (p < named_group_list_end) {
XiaokangQian08037552022-04-20 07:16:41 +0000854 uint16_t named_group;
Gilles Peskine449bd832023-01-11 14:50:10 +0100855 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, named_group_list_end, 2);
856 named_group = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian08037552022-04-20 07:16:41 +0000857 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000858
Gilles Peskine449bd832023-01-11 14:50:10 +0100859 MBEDTLS_SSL_DEBUG_MSG(2,
860 ("got named group: %s(%04x)",
861 mbedtls_ssl_named_group_to_str(named_group),
862 named_group));
XiaokangQian08037552022-04-20 07:16:41 +0000863
Gilles Peskine449bd832023-01-11 14:50:10 +0100864 if (!mbedtls_ssl_named_group_is_offered(ssl, named_group) ||
865 !mbedtls_ssl_named_group_is_supported(named_group) ||
866 ssl->handshake->hrr_selected_group != 0) {
XiaokangQian08037552022-04-20 07:16:41 +0000867 continue;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000868 }
869
Gilles Peskine449bd832023-01-11 14:50:10 +0100870 MBEDTLS_SSL_DEBUG_MSG(2,
871 ("add named group %s(%04x) into received list.",
872 mbedtls_ssl_named_group_to_str(named_group),
873 named_group));
Jerry Yuc1be19f2022-04-23 16:11:39 +0800874
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000875 ssl->handshake->hrr_selected_group = named_group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000876 }
877
Gilles Peskine449bd832023-01-11 14:50:10 +0100878 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000879
880}
Przemek Stekiel8c0a9532023-06-15 16:48:19 +0200881#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000882
XiaokangQian08037552022-04-20 07:16:41 +0000883#define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1
884
Valerio Settic9ae8622023-07-25 11:23:50 +0200885#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000886/*
887 * ssl_tls13_parse_key_shares_ext() verifies whether the information in the
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000888 * extension is correct and stores the first acceptable key share and its
889 * associated group.
XiaokangQian7807f9f2022-02-15 10:04:37 +0000890 *
891 * Possible return values are:
892 * - 0: Successful processing of the client provided key share extension.
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000893 * - SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH: The key shares provided by
894 * the client does not match a group supported by the server. A
895 * HelloRetryRequest will be needed.
XiaokangQiane8ff3502022-04-22 02:34:40 +0000896 * - A negative value for fatal errors.
Jerry Yuc1be19f2022-04-23 16:11:39 +0800897 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200898MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100899static int ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context *ssl,
900 const unsigned char *buf,
901 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000902{
XiaokangQianb67384d2022-04-19 00:02:38 +0000903 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000904 unsigned char const *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000905 unsigned char const *client_shares_end;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800906 size_t client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000907
908 /* From RFC 8446:
909 *
910 * struct {
911 * KeyShareEntry client_shares<0..2^16-1>;
912 * } KeyShareClientHello;
913 *
914 */
915
Gilles Peskine449bd832023-01-11 14:50:10 +0100916 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
917 client_shares_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000918 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100919 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, client_shares_len);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000920
921 ssl->handshake->offered_group_id = 0;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000922 client_shares_end = p + client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000923
924 /* We try to find a suitable key share entry and copy it to the
925 * handshake context. Later, we have to find out whether we can do
926 * something with the provided key share or whether we have to
XiaokangQianc5763b52022-04-02 03:34:37 +0000927 * dismiss it and send a HelloRetryRequest message.
928 */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000929
Gilles Peskine449bd832023-01-11 14:50:10 +0100930 while (p < client_shares_end) {
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000931 uint16_t group;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800932 size_t key_exchange_len;
Jerry Yu086edc22022-05-05 10:50:38 +0800933 const unsigned char *key_exchange;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000934
935 /*
936 * struct {
937 * NamedGroup group;
938 * opaque key_exchange<1..2^16-1>;
939 * } KeyShareEntry;
940 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100941 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, 4);
942 group = MBEDTLS_GET_UINT16_BE(p, 0);
943 key_exchange_len = MBEDTLS_GET_UINT16_BE(p, 2);
Jerry Yuc1be19f2022-04-23 16:11:39 +0800944 p += 4;
Jerry Yu086edc22022-05-05 10:50:38 +0800945 key_exchange = p;
Gilles Peskine449bd832023-01-11 14:50:10 +0100946 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, key_exchange_len);
Jerry Yu086edc22022-05-05 10:50:38 +0800947 p += key_exchange_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000948
949 /* Continue parsing even if we have already found a match,
XiaokangQianc5763b52022-04-02 03:34:37 +0000950 * for input validation purposes.
951 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100952 if (!mbedtls_ssl_named_group_is_offered(ssl, group) ||
953 !mbedtls_ssl_named_group_is_supported(group) ||
954 ssl->handshake->offered_group_id != 0) {
XiaokangQian060d8672022-04-21 09:24:56 +0000955 continue;
956 }
XiaokangQian060d8672022-04-21 09:24:56 +0000957
XiaokangQian7807f9f2022-02-15 10:04:37 +0000958 /*
Przemek Stekielc89f3ea2023-05-18 15:45:53 +0200959 * ECDHE and FFDHE groups are supported
XiaokangQian7807f9f2022-02-15 10:04:37 +0000960 */
Przemek Stekielc89f3ea2023-05-18 15:45:53 +0200961 if (mbedtls_ssl_tls13_named_group_is_ecdhe(group) ||
Przemek Stekield5f79e72023-06-29 09:08:43 +0200962 mbedtls_ssl_tls13_named_group_is_ffdh(group)) {
Przemek Stekielc89f3ea2023-05-18 15:45:53 +0200963 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDH/FFDH group: %s (%04x)",
Gilles Peskine449bd832023-01-11 14:50:10 +0100964 mbedtls_ssl_named_group_to_str(group),
965 group));
Przemek Stekiel7ac93be2023-07-04 10:02:38 +0200966 ret = mbedtls_ssl_tls13_read_public_xxdhe_share(
Gilles Peskine449bd832023-01-11 14:50:10 +0100967 ssl, key_exchange - 2, key_exchange_len + 2);
968 if (ret != 0) {
969 return ret;
970 }
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000971
Gilles Peskine449bd832023-01-11 14:50:10 +0100972 } else {
973 MBEDTLS_SSL_DEBUG_MSG(4, ("Unrecognized NamedGroup %u",
974 (unsigned) group));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000975 continue;
976 }
977
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000978 ssl->handshake->offered_group_id = group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000979 }
980
Jerry Yuc1be19f2022-04-23 16:11:39 +0800981
Gilles Peskine449bd832023-01-11 14:50:10 +0100982 if (ssl->handshake->offered_group_id == 0) {
983 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching key share"));
984 return SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000985 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100986 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000987}
Valerio Settic9ae8622023-07-25 11:23:50 +0200988#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000989
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200990MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100991static int ssl_tls13_client_hello_has_exts(mbedtls_ssl_context *ssl,
992 int exts_mask)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000993{
Jerry Yu0c354a22022-08-29 15:25:36 +0800994 int masked = ssl->handshake->received_extensions & exts_mask;
Gilles Peskine449bd832023-01-11 14:50:10 +0100995 return masked == exts_mask;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000996}
997
Jerry Yue5991322022-11-07 14:03:44 +0800998#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200999MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianb67384d2022-04-19 00:02:38 +00001000static int ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +01001001 mbedtls_ssl_context *ssl)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001002{
Gilles Peskine449bd832023-01-11 14:50:10 +01001003 return ssl_tls13_client_hello_has_exts(
1004 ssl,
1005 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
1006 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
1007 MBEDTLS_SSL_EXT_MASK(SIG_ALG));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001008}
Jerry Yue5991322022-11-07 14:03:44 +08001009#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001010
Jerry Yue5991322022-11-07 14:03:44 +08001011#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
Jerry Yu77f01482022-07-11 07:03:24 +00001012MBEDTLS_CHECK_RETURN_CRITICAL
1013static int ssl_tls13_client_hello_has_exts_for_psk_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +01001014 mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001015{
Gilles Peskine449bd832023-01-11 14:50:10 +01001016 return ssl_tls13_client_hello_has_exts(
1017 ssl,
1018 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
1019 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
Jerry Yu77f01482022-07-11 07:03:24 +00001020}
Jerry Yue5991322022-11-07 14:03:44 +08001021#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED */
Jerry Yu77f01482022-07-11 07:03:24 +00001022
Jerry Yue5991322022-11-07 14:03:44 +08001023#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Jerry Yu77f01482022-07-11 07:03:24 +00001024MBEDTLS_CHECK_RETURN_CRITICAL
1025static int ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +01001026 mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001027{
Gilles Peskine449bd832023-01-11 14:50:10 +01001028 return ssl_tls13_client_hello_has_exts(
1029 ssl,
1030 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
1031 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
1032 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
1033 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
Jerry Yu77f01482022-07-11 07:03:24 +00001034}
Jerry Yue5991322022-11-07 14:03:44 +08001035#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED */
Jerry Yu77f01482022-07-11 07:03:24 +00001036
Pengyu Lv306a01d2023-02-02 16:35:47 +08001037#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1038MBEDTLS_CHECK_RETURN_CRITICAL
Pengyu Lvbc4aab72023-12-01 15:37:24 +08001039static int ssl_tls13_key_exchange_is_psk_available(mbedtls_ssl_context *ssl)
Pengyu Lv306a01d2023-02-02 16:35:47 +08001040{
Jerry Yue5991322022-11-07 14:03:44 +08001041#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
Ronald Crone8c162d2024-02-21 10:15:44 +01001042 return mbedtls_ssl_conf_tls13_is_psk_enabled(ssl) &&
Pengyu Lvb2cfafb2023-11-14 13:56:13 +08001043 mbedtls_ssl_tls13_is_psk_supported(ssl) &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001044 ssl_tls13_client_hello_has_exts_for_psk_key_exchange(ssl);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001045#else
1046 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001047 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001048#endif
Jerry Yu77f01482022-07-11 07:03:24 +00001049}
XiaokangQian7807f9f2022-02-15 10:04:37 +00001050
Jerry Yu77f01482022-07-11 07:03:24 +00001051MBEDTLS_CHECK_RETURN_CRITICAL
Pengyu Lvbc4aab72023-12-01 15:37:24 +08001052static int ssl_tls13_key_exchange_is_psk_ephemeral_available(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001053{
Jerry Yue5991322022-11-07 14:03:44 +08001054#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Ronald Crone8c162d2024-02-21 10:15:44 +01001055 return mbedtls_ssl_conf_tls13_is_psk_ephemeral_enabled(ssl) &&
Pengyu Lvb2cfafb2023-11-14 13:56:13 +08001056 mbedtls_ssl_tls13_is_psk_ephemeral_supported(ssl) &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001057 ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(ssl);
Jerry Yu77f01482022-07-11 07:03:24 +00001058#else
1059 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001060 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001061#endif
XiaokangQian7807f9f2022-02-15 10:04:37 +00001062}
1063#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
1064
1065MBEDTLS_CHECK_RETURN_CRITICAL
1066static int ssl_tls13_key_exchange_is_ephemeral_available(mbedtls_ssl_context *ssl)
1067{
1068#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
1069 return mbedtls_ssl_conf_tls13_is_ephemeral_enabled(ssl) &&
1070 ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(ssl);
1071#else
1072 ((void) ssl);
1073 return 0;
1074#endif
1075}
1076
XiaokangQian81802f42022-06-10 13:25:22 +00001077#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
Ronald Cron928cbd32022-10-04 16:14:26 +02001078 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Ronald Cron67ea2542022-09-15 17:34:42 +02001079
1080#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001081static psa_algorithm_t ssl_tls13_iana_sig_alg_to_psa_alg(uint16_t sig_alg)
Ronald Cron67ea2542022-09-15 17:34:42 +02001082{
Gilles Peskine449bd832023-01-11 14:50:10 +01001083 switch (sig_alg) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001084 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001085 return PSA_ALG_ECDSA(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001086 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001087 return PSA_ALG_ECDSA(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001088 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001089 return PSA_ALG_ECDSA(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001090 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001091 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001092 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001093 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001094 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001095 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001096 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001097 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001098 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001099 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001100 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001101 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001102 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01001103 return PSA_ALG_NONE;
Ronald Cron67ea2542022-09-15 17:34:42 +02001104 }
1105}
1106#endif /* MBEDTLS_USE_PSA_CRYPTO */
1107
XiaokangQian23c5be62022-06-07 02:04:34 +00001108/*
XiaokangQianfb665a82022-06-15 03:57:21 +00001109 * Pick best ( private key, certificate chain ) pair based on the signature
1110 * algorithms supported by the client.
XiaokangQian23c5be62022-06-07 02:04:34 +00001111 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02001112MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001113static int ssl_tls13_pick_key_cert(mbedtls_ssl_context *ssl)
XiaokangQian23c5be62022-06-07 02:04:34 +00001114{
XiaokangQianfb665a82022-06-15 03:57:21 +00001115 mbedtls_ssl_key_cert *key_cert, *key_cert_list;
XiaokangQian81802f42022-06-10 13:25:22 +00001116 const uint16_t *sig_alg = ssl->handshake->received_sig_algs;
XiaokangQian23c5be62022-06-07 02:04:34 +00001117
1118#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01001119 if (ssl->handshake->sni_key_cert != NULL) {
XiaokangQianfb665a82022-06-15 03:57:21 +00001120 key_cert_list = ssl->handshake->sni_key_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001121 } else
XiaokangQian23c5be62022-06-07 02:04:34 +00001122#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Gilles Peskine449bd832023-01-11 14:50:10 +01001123 key_cert_list = ssl->conf->key_cert;
XiaokangQian23c5be62022-06-07 02:04:34 +00001124
Gilles Peskine449bd832023-01-11 14:50:10 +01001125 if (key_cert_list == NULL) {
1126 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate"));
1127 return -1;
XiaokangQian23c5be62022-06-07 02:04:34 +00001128 }
1129
Gilles Peskine449bd832023-01-11 14:50:10 +01001130 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
1131 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001132 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001133 }
Ronald Cron67ea2542022-09-15 17:34:42 +02001134
Gilles Peskine449bd832023-01-11 14:50:10 +01001135 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001136 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001137 }
Ronald Cron67ea2542022-09-15 17:34:42 +02001138
Gilles Peskine449bd832023-01-11 14:50:10 +01001139 for (key_cert = key_cert_list; key_cert != NULL;
1140 key_cert = key_cert->next) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001141#if defined(MBEDTLS_USE_PSA_CRYPTO)
1142 psa_algorithm_t psa_alg = PSA_ALG_NONE;
1143#endif /* MBEDTLS_USE_PSA_CRYPTO */
1144
Gilles Peskine449bd832023-01-11 14:50:10 +01001145 MBEDTLS_SSL_DEBUG_CRT(3, "certificate (chain) candidate",
1146 key_cert->cert);
XiaokangQian81802f42022-06-10 13:25:22 +00001147
1148 /*
Gilles Peskine449bd832023-01-11 14:50:10 +01001149 * This avoids sending the client a cert it'll reject based on
1150 * keyUsage or other extensions.
1151 */
1152 if (mbedtls_x509_crt_check_key_usage(
1153 key_cert->cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0 ||
XiaokangQian81802f42022-06-10 13:25:22 +00001154 mbedtls_x509_crt_check_extended_key_usage(
XiaokangQianfb665a82022-06-15 03:57:21 +00001155 key_cert->cert, MBEDTLS_OID_SERVER_AUTH,
Gilles Peskine449bd832023-01-11 14:50:10 +01001156 MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH)) != 0) {
1157 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
1158 "(extended) key usage extension"));
XiaokangQian81802f42022-06-10 13:25:22 +00001159 continue;
1160 }
XiaokangQian23c5be62022-06-07 02:04:34 +00001161
Gilles Peskine449bd832023-01-11 14:50:10 +01001162 MBEDTLS_SSL_DEBUG_MSG(3,
1163 ("ssl_tls13_pick_key_cert:"
1164 "check signature algorithm %s [%04x]",
1165 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1166 *sig_alg));
Ronald Cron67ea2542022-09-15 17:34:42 +02001167#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001168 psa_alg = ssl_tls13_iana_sig_alg_to_psa_alg(*sig_alg);
Ronald Cron67ea2542022-09-15 17:34:42 +02001169#endif /* MBEDTLS_USE_PSA_CRYPTO */
1170
Gilles Peskine449bd832023-01-11 14:50:10 +01001171 if (mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
1172 *sig_alg, &key_cert->cert->pk)
Ronald Cron67ea2542022-09-15 17:34:42 +02001173#if defined(MBEDTLS_USE_PSA_CRYPTO)
1174 && psa_alg != PSA_ALG_NONE &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001175 mbedtls_pk_can_do_ext(&key_cert->cert->pk, psa_alg,
1176 PSA_KEY_USAGE_SIGN_HASH) == 1
Ronald Cron67ea2542022-09-15 17:34:42 +02001177#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001178 ) {
XiaokangQianfb665a82022-06-15 03:57:21 +00001179 ssl->handshake->key_cert = key_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001180 MBEDTLS_SSL_DEBUG_MSG(3,
1181 ("ssl_tls13_pick_key_cert:"
1182 "selected signature algorithm"
1183 " %s [%04x]",
1184 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1185 *sig_alg));
XiaokangQianfb665a82022-06-15 03:57:21 +00001186 MBEDTLS_SSL_DEBUG_CRT(
Gilles Peskine449bd832023-01-11 14:50:10 +01001187 3, "selected certificate (chain)",
1188 ssl->handshake->key_cert->cert);
1189 return 0;
XiaokangQian81802f42022-06-10 13:25:22 +00001190 }
XiaokangQian81802f42022-06-10 13:25:22 +00001191 }
XiaokangQian23c5be62022-06-07 02:04:34 +00001192 }
1193
Gilles Peskine449bd832023-01-11 14:50:10 +01001194 MBEDTLS_SSL_DEBUG_MSG(2, ("ssl_tls13_pick_key_cert:"
1195 "no suitable certificate found"));
1196 return -1;
XiaokangQian23c5be62022-06-07 02:04:34 +00001197}
XiaokangQian81802f42022-06-10 13:25:22 +00001198#endif /* MBEDTLS_X509_CRT_PARSE_C &&
Ronald Cron928cbd32022-10-04 16:14:26 +02001199 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian23c5be62022-06-07 02:04:34 +00001200
XiaokangQian4080a7f2022-04-11 09:55:18 +00001201/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001202 *
1203 * STATE HANDLING: ClientHello
1204 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001205 * There are three possible classes of outcomes when parsing the ClientHello:
XiaokangQianed582dd2022-04-13 08:21:05 +00001206 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001207 * 1) The ClientHello was well-formed and matched the server's configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +00001208 *
1209 * In this case, the server progresses to sending its ServerHello.
1210 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001211 * 2) The ClientHello was well-formed but didn't match the server's
1212 * configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +00001213 *
1214 * For example, the client might not have offered a key share which
1215 * the server supports, or the server might require a cookie.
1216 *
1217 * In this case, the server sends a HelloRetryRequest.
1218 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001219 * 3) The ClientHello was ill-formed
XiaokangQianed582dd2022-04-13 08:21:05 +00001220 *
1221 * In this case, we abort the handshake.
1222 *
1223 */
1224
1225/*
XiaokangQian4080a7f2022-04-11 09:55:18 +00001226 * Structure of this message:
1227 *
XiaokangQiane8ff3502022-04-22 02:34:40 +00001228 * uint16 ProtocolVersion;
1229 * opaque Random[32];
1230 * uint8 CipherSuite[2]; // Cryptographic suite selector
XiaokangQian4080a7f2022-04-11 09:55:18 +00001231 *
XiaokangQiane8ff3502022-04-22 02:34:40 +00001232 * struct {
1233 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
1234 * Random random;
1235 * opaque legacy_session_id<0..32>;
1236 * CipherSuite cipher_suites<2..2^16-2>;
1237 * opaque legacy_compression_methods<1..2^8-1>;
1238 * Extension extensions<8..2^16-1>;
1239 * } ClientHello;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001240 */
XiaokangQianed582dd2022-04-13 08:21:05 +00001241
1242#define SSL_CLIENT_HELLO_OK 0
1243#define SSL_CLIENT_HELLO_HRR_REQUIRED 1
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001244#define SSL_CLIENT_HELLO_TLS1_2 2
XiaokangQianed582dd2022-04-13 08:21:05 +00001245
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001246MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001247static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl,
1248 const unsigned char *buf,
1249 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001250{
XiaokangQianb67384d2022-04-19 00:02:38 +00001251 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1252 const unsigned char *p = buf;
Ronald Crond540d992023-03-07 09:41:48 +01001253 const unsigned char *random;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001254 size_t legacy_session_id_len;
Ronald Croncada4102023-03-07 09:51:39 +01001255 const unsigned char *legacy_session_id;
XiaokangQian318dc762022-04-20 09:43:51 +00001256 size_t cipher_suites_len;
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001257 const unsigned char *cipher_suites;
XiaokangQian060d8672022-04-21 09:24:56 +00001258 const unsigned char *cipher_suites_end;
XiaokangQianb67384d2022-04-19 00:02:38 +00001259 size_t extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001260 const unsigned char *extensions_end;
Ronald Croneff56732023-04-03 17:36:31 +02001261 const unsigned char *supported_versions_data;
1262 const unsigned char *supported_versions_data_end;
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001263 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu49ca9282022-05-05 11:05:22 +08001264 int hrr_required = 0;
Ronald Cron8a74f072023-06-14 17:59:29 +02001265 int no_usable_share_for_key_agreement = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001266
Ronald Cron41a443a2022-10-04 16:38:25 +02001267#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Ronald Cron79cdd412024-02-20 17:19:28 +01001268 int got_psk = 0;
1269 struct psk_attributes psk = PSK_ATTRIBUTES_INIT;
Jerry Yu29d9faa2022-08-23 17:52:45 +08001270 const unsigned char *pre_shared_key_ext = NULL;
Jerry Yu1c105562022-07-10 06:32:38 +00001271 const unsigned char *pre_shared_key_ext_end = NULL;
Ronald Cron41a443a2022-10-04 16:38:25 +02001272#endif
XiaokangQian7807f9f2022-02-15 10:04:37 +00001273
XiaokangQian7807f9f2022-02-15 10:04:37 +00001274 /*
XiaokangQianb67384d2022-04-19 00:02:38 +00001275 * ClientHello layout:
XiaokangQian7807f9f2022-02-15 10:04:37 +00001276 * 0 . 1 protocol version
XiaokangQiane8ff3502022-04-22 02:34:40 +00001277 * 2 . 33 random bytes
XiaokangQianc5763b52022-04-02 03:34:37 +00001278 * 34 . 34 session id length ( 1 byte )
XiaokangQian7807f9f2022-02-15 10:04:37 +00001279 * 35 . 34+x session id
XiaokangQian7807f9f2022-02-15 10:04:37 +00001280 * .. . .. ciphersuite list length ( 2 bytes )
1281 * .. . .. ciphersuite list
1282 * .. . .. compression alg. list length ( 1 byte )
1283 * .. . .. compression alg. list
1284 * .. . .. extensions length ( 2 bytes, optional )
1285 * .. . .. extensions ( optional )
1286 */
1287
XiaokangQianb67384d2022-04-19 00:02:38 +00001288 /*
bootstrap-prime6dbbf442022-05-17 19:30:44 -04001289 * Minimal length ( with everything empty and extensions omitted ) is
XiaokangQian7807f9f2022-02-15 10:04:37 +00001290 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1291 * read at least up to session id length without worrying.
1292 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001293 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 38);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001294
1295 /* ...
1296 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1297 * ...
1298 * with ProtocolVersion defined as:
1299 * uint16 ProtocolVersion;
1300 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001301 if (mbedtls_ssl_read_version(p, ssl->conf->transport) !=
1302 MBEDTLS_SSL_VERSION_TLS1_2) {
1303 MBEDTLS_SSL_DEBUG_MSG(1, ("Unsupported version of TLS."));
1304 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1305 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
1306 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001307 }
1308 p += 2;
1309
Jerry Yuc1be19f2022-04-23 16:11:39 +08001310 /* ...
1311 * Random random;
1312 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001313 * with Random defined as:
1314 * opaque Random[32];
XiaokangQian7807f9f2022-02-15 10:04:37 +00001315 */
Ronald Crond540d992023-03-07 09:41:48 +01001316 random = p;
XiaokangQian08037552022-04-20 07:16:41 +00001317 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001318
Jerry Yuc1be19f2022-04-23 16:11:39 +08001319 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001320 * opaque legacy_session_id<0..32>;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001321 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +00001322 */
Ronald Croncada4102023-03-07 09:51:39 +01001323 legacy_session_id_len = *(p++);
1324 legacy_session_id = p;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001325
XiaokangQianb67384d2022-04-19 00:02:38 +00001326 /*
1327 * Check we have enough data for the legacy session identifier
Jerry Yue95c8af2022-07-26 15:48:20 +08001328 * and the ciphersuite list length.
XiaokangQianb67384d2022-04-19 00:02:38 +00001329 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001330 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, legacy_session_id_len + 2);
XiaokangQian4080a7f2022-04-11 09:55:18 +00001331 p += legacy_session_id_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001332
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001333 /* ...
1334 * CipherSuite cipher_suites<2..2^16-2>;
1335 * ...
1336 * with CipherSuite defined as:
1337 * uint8 CipherSuite[2];
1338 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001339 cipher_suites_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001340 p += 2;
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001341 cipher_suites = p;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001342
Ronald Cronfc7ae872023-02-16 15:32:19 +01001343 /*
1344 * The length of the ciphersuite list has to be even.
1345 */
1346 if (cipher_suites_len & 1) {
1347 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1348 MBEDTLS_ERR_SSL_DECODE_ERROR);
1349 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1350 }
1351
XiaokangQianb67384d2022-04-19 00:02:38 +00001352 /* Check we have enough data for the ciphersuite list, the legacy
1353 * compression methods and the length of the extensions.
Jerry Yue95c8af2022-07-26 15:48:20 +08001354 *
1355 * cipher_suites cipher_suites_len bytes
1356 * legacy_compression_methods 2 bytes
1357 * extensions_len 2 bytes
XiaokangQianb67384d2022-04-19 00:02:38 +00001358 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001359 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, cipher_suites_len + 2 + 2);
Ronald Cron8c527d02023-03-07 15:47:47 +01001360 p += cipher_suites_len;
1361 cipher_suites_end = p;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001362
1363 /*
Ronald Cron8c527d02023-03-07 15:47:47 +01001364 * Search for the supported versions extension and parse it to determine
1365 * if the client supports TLS 1.3.
1366 */
1367 ret = mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts(
1368 ssl, p + 2, end,
Ronald Croneff56732023-04-03 17:36:31 +02001369 &supported_versions_data, &supported_versions_data_end);
Ronald Cron8c527d02023-03-07 15:47:47 +01001370 if (ret < 0) {
1371 MBEDTLS_SSL_DEBUG_RET(1,
1372 ("mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts"), ret);
1373 return ret;
1374 }
1375
1376 if (ret == 0) {
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001377 return SSL_CLIENT_HELLO_TLS1_2;
Ronald Cron8c527d02023-03-07 15:47:47 +01001378 }
1379
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001380 if (ret == 1) {
1381 ret = ssl_tls13_parse_supported_versions_ext(ssl,
Ronald Croneff56732023-04-03 17:36:31 +02001382 supported_versions_data,
1383 supported_versions_data_end);
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001384 if (ret < 0) {
1385 MBEDTLS_SSL_DEBUG_RET(1,
1386 ("ssl_tls13_parse_supported_versions_ext"), ret);
1387 return ret;
1388 }
1389
Ronald Cronb828c7d2023-04-03 16:37:22 +02001390 /*
1391 * The supported versions extension was parsed successfully as the
1392 * value returned by ssl_tls13_parse_supported_versions_ext() is
1393 * positive. The return value is then equal to
1394 * MBEDTLS_SSL_VERSION_TLS1_2 or MBEDTLS_SSL_VERSION_TLS1_3, defining
1395 * the TLS version to negotiate.
1396 */
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001397 if (MBEDTLS_SSL_VERSION_TLS1_2 == ret) {
1398 return SSL_CLIENT_HELLO_TLS1_2;
1399 }
Ronald Cron8c527d02023-03-07 15:47:47 +01001400 }
1401
1402 /*
1403 * We negotiate TLS 1.3.
Ronald Cron64582392023-03-07 09:21:40 +01001404 */
1405 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
Ronald Cron64582392023-03-07 09:21:40 +01001406 ssl->session_negotiate->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1407 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
Ronald Cron64582392023-03-07 09:21:40 +01001408
1409 /*
Ronald Crondad02b22023-04-06 09:57:52 +02001410 * We are negotiating the version 1.3 of the protocol. Do what we have
Ronald Croncada4102023-03-07 09:51:39 +01001411 * postponed: copy of the client random bytes, copy of the legacy session
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001412 * identifier and selection of the TLS 1.3 cipher suite.
Ronald Crond540d992023-03-07 09:41:48 +01001413 */
1414 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes",
1415 random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1416 memcpy(&handshake->randbytes[0], random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1417
Ronald Croncada4102023-03-07 09:51:39 +01001418 if (legacy_session_id_len > sizeof(ssl->session_negotiate->id)) {
1419 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1420 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1421 }
1422 ssl->session_negotiate->id_len = legacy_session_id_len;
1423 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id",
1424 legacy_session_id, legacy_session_id_len);
1425 memcpy(&ssl->session_negotiate->id[0],
1426 legacy_session_id, legacy_session_id_len);
1427
Ronald Crond540d992023-03-07 09:41:48 +01001428 /*
Jerry Yu5725f1c2022-08-21 17:27:16 +08001429 * Search for a matching ciphersuite
1430 */
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001431 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, list of cipher suites",
1432 cipher_suites, cipher_suites_len);
Jerry Yu5725f1c2022-08-21 17:27:16 +08001433
Ronald Cron89089cc2024-02-14 18:18:08 +01001434 ssl_tls13_select_ciphersuite(ssl, cipher_suites, cipher_suites_end,
1435 0, PSA_ALG_NONE, &handshake->ciphersuite_info);
Jerry Yu5725f1c2022-08-21 17:27:16 +08001436
Gilles Peskine449bd832023-01-11 14:50:10 +01001437 if (handshake->ciphersuite_info == NULL) {
1438 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1439 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1440 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001441 }
Ronald Cron89089cc2024-02-14 18:18:08 +01001442 ssl->session_negotiate->ciphersuite = handshake->ciphersuite_info->id;
1443
1444 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %04x - %s",
1445 ((unsigned) handshake->ciphersuite_info->id),
1446 handshake->ciphersuite_info->name));
Jerry Yuc1be19f2022-04-23 16:11:39 +08001447
XiaokangQian4080a7f2022-04-11 09:55:18 +00001448 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001449 * opaque legacy_compression_methods<1..2^8-1>;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001450 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +00001451 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001452 if (p[0] != 1 || p[1] != MBEDTLS_SSL_COMPRESS_NULL) {
1453 MBEDTLS_SSL_DEBUG_MSG(1, ("bad legacy compression method"));
1454 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1455 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1456 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001457 }
XiaokangQianb67384d2022-04-19 00:02:38 +00001458 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001459
Jerry Yuc1be19f2022-04-23 16:11:39 +08001460 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001461 * Extension extensions<8..2^16-1>;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001462 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001463 * with Extension defined as:
1464 * struct {
1465 * ExtensionType extension_type;
1466 * opaque extension_data<0..2^16-1>;
1467 * } Extension;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001468 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001469 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001470 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01001471 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len);
XiaokangQiane8ff3502022-04-22 02:34:40 +00001472 extensions_end = p + extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001473
Gilles Peskine449bd832023-01-11 14:50:10 +01001474 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", p, extensions_len);
Jerry Yu63a459c2022-10-31 13:38:40 +08001475 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
Jerry Yu0c354a22022-08-29 15:25:36 +08001476
Gilles Peskine449bd832023-01-11 14:50:10 +01001477 while (p < extensions_end) {
XiaokangQian7807f9f2022-02-15 10:04:37 +00001478 unsigned int extension_type;
1479 size_t extension_data_len;
1480 const unsigned char *extension_data_end;
Jerry Yu263dbf72022-10-26 10:51:27 +08001481 uint32_t allowed_exts = MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CH;
1482
Ronald Cron5fbd2702024-02-14 10:03:36 +01001483 if (ssl->handshake->hello_retry_request_flag) {
Jerry Yu263dbf72022-10-26 10:51:27 +08001484 /* Do not accept early data extension in 2nd ClientHello */
1485 allowed_exts &= ~MBEDTLS_SSL_EXT_MASK(EARLY_DATA);
1486 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001487
Jerry Yu0c354a22022-08-29 15:25:36 +08001488 /* RFC 8446, section 4.2.11
Jerry Yu1c9247c2022-07-21 12:37:39 +08001489 *
1490 * The "pre_shared_key" extension MUST be the last extension in the
1491 * ClientHello (this facilitates implementation as described below).
1492 * Servers MUST check that it is the last extension and otherwise fail
1493 * the handshake with an "illegal_parameter" alert.
1494 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001495 if (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY)) {
Jerry Yu1c9247c2022-07-21 12:37:39 +08001496 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001497 3, ("pre_shared_key is not last extension."));
Jerry Yu1c9247c2022-07-21 12:37:39 +08001498 MBEDTLS_SSL_PEND_FATAL_ALERT(
1499 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01001500 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1501 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu1c9247c2022-07-21 12:37:39 +08001502 }
1503
Gilles Peskine449bd832023-01-11 14:50:10 +01001504 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
1505 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
1506 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001507 p += 4;
1508
Gilles Peskine449bd832023-01-11 14:50:10 +01001509 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001510 extension_data_end = p + extension_data_len;
1511
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001512 ret = mbedtls_ssl_tls13_check_received_extension(
Gilles Peskine449bd832023-01-11 14:50:10 +01001513 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, extension_type,
Jerry Yu263dbf72022-10-26 10:51:27 +08001514 allowed_exts);
Gilles Peskine449bd832023-01-11 14:50:10 +01001515 if (ret != 0) {
1516 return ret;
1517 }
Jerry Yue18dc7e2022-08-04 16:29:22 +08001518
Gilles Peskine449bd832023-01-11 14:50:10 +01001519 switch (extension_type) {
XiaokangQian40a35232022-05-07 09:02:40 +00001520#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1521 case MBEDTLS_TLS_EXT_SERVERNAME:
Gilles Peskine449bd832023-01-11 14:50:10 +01001522 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension"));
1523 ret = mbedtls_ssl_parse_server_name_ext(ssl, p,
1524 extension_data_end);
1525 if (ret != 0) {
XiaokangQian40a35232022-05-07 09:02:40 +00001526 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001527 1, "mbedtls_ssl_parse_servername_ext", ret);
1528 return ret;
XiaokangQian40a35232022-05-07 09:02:40 +00001529 }
XiaokangQian40a35232022-05-07 09:02:40 +00001530 break;
1531#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1532
Przemek Stekiel8c0a9532023-06-15 16:48:19 +02001533#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001534 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
Gilles Peskine449bd832023-01-11 14:50:10 +01001535 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported group extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001536
1537 /* Supported Groups Extension
1538 *
1539 * When sent by the client, the "supported_groups" extension
1540 * indicates the named groups which the client supports,
1541 * ordered from most preferred to least preferred.
1542 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001543 ret = ssl_tls13_parse_supported_groups_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001544 ssl, p, extension_data_end);
1545 if (ret != 0) {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001546 MBEDTLS_SSL_DEBUG_RET(
Xiaokang Qian8bce0e62023-04-04 10:15:48 +00001547 1, "ssl_tls13_parse_supported_groups_ext", ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01001548 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001549 }
1550
XiaokangQian7807f9f2022-02-15 10:04:37 +00001551 break;
Przemek Stekiel8c0a9532023-06-15 16:48:19 +02001552#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH*/
XiaokangQian7807f9f2022-02-15 10:04:37 +00001553
Valerio Settic9ae8622023-07-25 11:23:50 +02001554#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001555 case MBEDTLS_TLS_EXT_KEY_SHARE:
Gilles Peskine449bd832023-01-11 14:50:10 +01001556 MBEDTLS_SSL_DEBUG_MSG(3, ("found key share extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001557
1558 /*
1559 * Key Share Extension
1560 *
1561 * When sent by the client, the "key_share" extension
1562 * contains the endpoint's cryptographic parameters for
1563 * ECDHE/DHE key establishment methods.
1564 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001565 ret = ssl_tls13_parse_key_shares_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001566 ssl, p, extension_data_end);
1567 if (ret == SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH) {
Ronald Cron8a74f072023-06-14 17:59:29 +02001568 MBEDTLS_SSL_DEBUG_MSG(2, ("No usable share for key agreement."));
1569 no_usable_share_for_key_agreement = 1;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001570 }
1571
Gilles Peskine449bd832023-01-11 14:50:10 +01001572 if (ret < 0) {
Jerry Yu582dd062022-04-22 21:59:01 +08001573 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001574 1, "ssl_tls13_parse_key_shares_ext", ret);
1575 return ret;
Jerry Yu582dd062022-04-22 21:59:01 +08001576 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001577
XiaokangQian7807f9f2022-02-15 10:04:37 +00001578 break;
Valerio Settic9ae8622023-07-25 11:23:50 +02001579#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001580
1581 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Ronald Cron8c527d02023-03-07 15:47:47 +01001582 /* Already parsed */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001583 break;
1584
Ronald Cron41a443a2022-10-04 16:38:25 +02001585#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yue19e3b92022-07-08 12:04:51 +00001586 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001587 MBEDTLS_SSL_DEBUG_MSG(
1588 3, ("found psk key exchange modes extension"));
Jerry Yue19e3b92022-07-08 12:04:51 +00001589
1590 ret = ssl_tls13_parse_key_exchange_modes_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001591 ssl, p, extension_data_end);
1592 if (ret != 0) {
Jerry Yue19e3b92022-07-08 12:04:51 +00001593 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001594 1, "ssl_tls13_parse_key_exchange_modes_ext", ret);
1595 return ret;
Jerry Yue19e3b92022-07-08 12:04:51 +00001596 }
1597
Jerry Yue19e3b92022-07-08 12:04:51 +00001598 break;
Ronald Cron41a443a2022-10-04 16:38:25 +02001599#endif
Jerry Yue19e3b92022-07-08 12:04:51 +00001600
Jerry Yu1c105562022-07-10 06:32:38 +00001601 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01001602 MBEDTLS_SSL_DEBUG_MSG(3, ("found pre_shared_key extension"));
1603 if ((handshake->received_extensions &
1604 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES)) == 0) {
Jerry Yu13ab81d2022-07-22 23:17:11 +08001605 MBEDTLS_SSL_PEND_FATAL_ALERT(
1606 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01001607 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1608 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu13ab81d2022-07-22 23:17:11 +08001609 }
Ronald Cron41a443a2022-10-04 16:38:25 +02001610#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yu1c105562022-07-10 06:32:38 +00001611 /* Delay processing of the PSK identity once we have
1612 * found out which algorithms to use. We keep a pointer
1613 * to the buffer and the size for later processing.
1614 */
Jerry Yu29d9faa2022-08-23 17:52:45 +08001615 pre_shared_key_ext = p;
Jerry Yu1c105562022-07-10 06:32:38 +00001616 pre_shared_key_ext_end = extension_data_end;
Jerry Yue18dc7e2022-08-04 16:29:22 +08001617#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yu1c105562022-07-10 06:32:38 +00001618 break;
Jerry Yu1c105562022-07-10 06:32:38 +00001619
XiaokangQianacb39922022-06-17 10:18:48 +00001620#if defined(MBEDTLS_SSL_ALPN)
1621 case MBEDTLS_TLS_EXT_ALPN:
Gilles Peskine449bd832023-01-11 14:50:10 +01001622 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension"));
XiaokangQianacb39922022-06-17 10:18:48 +00001623
Gilles Peskine449bd832023-01-11 14:50:10 +01001624 ret = mbedtls_ssl_parse_alpn_ext(ssl, p, extension_data_end);
1625 if (ret != 0) {
XiaokangQianacb39922022-06-17 10:18:48 +00001626 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001627 1, ("mbedtls_ssl_parse_alpn_ext"), ret);
1628 return ret;
XiaokangQianacb39922022-06-17 10:18:48 +00001629 }
XiaokangQianacb39922022-06-17 10:18:48 +00001630 break;
1631#endif /* MBEDTLS_SSL_ALPN */
1632
Ronald Cron928cbd32022-10-04 16:14:26 +02001633#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001634 case MBEDTLS_TLS_EXT_SIG_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +01001635 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001636
Gabor Mezei078e8032022-04-27 21:17:56 +02001637 ret = mbedtls_ssl_parse_sig_alg_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001638 ssl, p, extension_data_end);
1639 if (ret != 0) {
Xiaokang Qian49f39c12023-04-06 02:31:02 +00001640 MBEDTLS_SSL_DEBUG_RET(
1641 1, "mbedtls_ssl_parse_sig_alg_ext", ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01001642 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001643 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001644 break;
Ronald Cron928cbd32022-10-04 16:14:26 +02001645#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001646
Jan Bruckner151f6422023-02-10 12:45:19 +01001647#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
1648 case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
1649 MBEDTLS_SSL_DEBUG_MSG(3, ("found record_size_limit extension"));
1650
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001651 ret = mbedtls_ssl_tls13_parse_record_size_limit_ext(
1652 ssl, p, extension_data_end);
Jan Brucknerf482dcc2023-03-15 09:09:06 +01001653 if (ret != 0) {
1654 MBEDTLS_SSL_DEBUG_RET(
1655 1, ("mbedtls_ssl_tls13_parse_record_size_limit_ext"), ret);
1656 return ret;
1657 }
Jan Bruckner151f6422023-02-10 12:45:19 +01001658 break;
1659#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
1660
XiaokangQian7807f9f2022-02-15 10:04:37 +00001661 default:
Jerry Yu79aa7212022-11-08 21:30:21 +08001662 MBEDTLS_SSL_PRINT_EXT(
Jerry Yu63a459c2022-10-31 13:38:40 +08001663 3, MBEDTLS_SSL_HS_CLIENT_HELLO,
Gilles Peskine449bd832023-01-11 14:50:10 +01001664 extension_type, "( ignored )");
Jerry Yu0c354a22022-08-29 15:25:36 +08001665 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001666 }
1667
1668 p += extension_data_len;
1669 }
1670
Gilles Peskine449bd832023-01-11 14:50:10 +01001671 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CLIENT_HELLO,
1672 handshake->received_extensions);
Jerry Yue18dc7e2022-08-04 16:29:22 +08001673
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001674 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl,
1675 MBEDTLS_SSL_HS_CLIENT_HELLO,
1676 p - buf);
1677 if (0 != ret) {
1678 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_add_hs_hdr_to_checksum"), ret);
1679 return ret;
1680 }
Jerry Yu032b15ce2022-07-11 06:10:03 +00001681
Ronald Cron41a443a2022-10-04 16:38:25 +02001682#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001683 /* Update checksum with either
1684 * - The entire content of the CH message, if no PSK extension is present
1685 * - The content up to but excluding the PSK extension, if present.
Ronald Cron7cab4f82024-03-07 15:09:09 +01001686 * Always parse the pre-shared-key extension when present in the
Ronald Cron12e72f12024-02-14 15:49:38 +01001687 * ClientHello even if some pre-requisites for PSK key exchange modes are
1688 * not met. That way we always validate the syntax of the extension.
XiaokangQian7807f9f2022-02-15 10:04:37 +00001689 */
Ronald Cron12e72f12024-02-14 15:49:38 +01001690 if (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY)) {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001691 ret = handshake->update_checksum(ssl, buf,
1692 pre_shared_key_ext - buf);
1693 if (0 != ret) {
1694 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1695 return ret;
1696 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001697 ret = ssl_tls13_parse_pre_shared_key_ext(ssl,
1698 pre_shared_key_ext,
1699 pre_shared_key_ext_end,
1700 cipher_suites,
Ronald Cron79cdd412024-02-20 17:19:28 +01001701 cipher_suites_end,
1702 &psk);
1703 if (ret == 0) {
1704 got_psk = 1;
1705 } else if (ret != MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) {
Jerry Yu63a459c2022-10-31 13:38:40 +08001706 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001707 1, "ssl_tls13_parse_pre_shared_key_ext", ret);
1708 return ret;
Jerry Yu1c105562022-07-10 06:32:38 +00001709 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001710 } else
Ronald Cron41a443a2022-10-04 16:38:25 +02001711#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yu1c105562022-07-10 06:32:38 +00001712 {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001713 ret = handshake->update_checksum(ssl, buf, p - buf);
1714 if (0 != ret) {
1715 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1716 return ret;
1717 }
Jerry Yu1c105562022-07-10 06:32:38 +00001718 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001719
Ronald Cron79cdd412024-02-20 17:19:28 +01001720 /*
1721 * Determine the key exchange algorithm to use.
1722 * There are three types of key exchanges supported in TLS 1.3:
1723 * - (EC)DH with ECDSA,
1724 * - (EC)DH with PSK,
1725 * - plain PSK.
1726 *
1727 * The PSK-based key exchanges may additionally be used with 0-RTT.
1728 *
1729 * Our built-in order of preference is
1730 * 1 ) (EC)DHE-PSK Mode ( psk_ephemeral )
1731 * 2 ) Certificate Mode ( ephemeral )
1732 * 3 ) Plain PSK Mode ( psk )
1733 */
1734#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1735 if (got_psk && (psk.key_exchange_mode ==
1736 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)) {
1737 handshake->key_exchange_mode =
1738 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
1739 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk_ephemeral"));
1740
1741 } else
1742#endif
1743 if (ssl_tls13_key_exchange_is_ephemeral_available(ssl)) {
1744 handshake->key_exchange_mode =
1745 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
1746 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: ephemeral"));
1747
1748 }
1749#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
1750 else if (got_psk && (psk.key_exchange_mode ==
1751 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK)) {
1752 handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
1753 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk"));
1754 }
1755#endif
1756 else {
1757 MBEDTLS_SSL_DEBUG_MSG(
1758 1,
1759 ("ClientHello message misses mandatory extensions."));
1760 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION,
1761 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1762 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Gilles Peskine449bd832023-01-11 14:50:10 +01001763 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001764
Ronald Cron3e47eec2024-02-21 10:29:24 +01001765#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Ronald Cron74a16292024-02-23 17:07:41 +01001766 if (handshake->key_exchange_mode &
1767 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL) {
1768 handshake->ciphersuite_info = psk.ciphersuite_info;
1769 ssl->session_negotiate->ciphersuite = psk.ciphersuite_info->id;
1770
1771 MBEDTLS_SSL_DEBUG_MSG(2, ("Select PSK ciphersuite: %04x - %s",
1772 ((unsigned) psk.ciphersuite_info->id),
1773 psk.ciphersuite_info->name));
1774
1775 if (psk.type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
1776 handshake->resume = 1;
1777 }
Ronald Cron79cdd412024-02-20 17:19:28 +01001778 }
Ronald Cron3e47eec2024-02-21 10:29:24 +01001779#endif
Ronald Cron79cdd412024-02-20 17:19:28 +01001780
1781 if (handshake->key_exchange_mode !=
Ronald Cron8a74f072023-06-14 17:59:29 +02001782 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK) {
1783 hrr_required = (no_usable_share_for_key_agreement != 0);
1784 }
1785
Gilles Peskine449bd832023-01-11 14:50:10 +01001786 mbedtls_ssl_optimize_checksum(ssl, handshake->ciphersuite_info);
Jerry Yue5834fd2022-08-29 20:16:09 +08001787
Gilles Peskine449bd832023-01-11 14:50:10 +01001788 return hrr_required ? SSL_CLIENT_HELLO_HRR_REQUIRED : SSL_CLIENT_HELLO_OK;
XiaokangQian75fe8c72022-06-15 09:42:45 +00001789}
1790
Jerry Yuab0da372023-02-08 13:55:24 +08001791#if defined(MBEDTLS_SSL_EARLY_DATA)
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001792static int ssl_tls13_check_early_data_requirements(mbedtls_ssl_context *ssl)
Jerry Yuab0da372023-02-08 13:55:24 +08001793{
1794 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1795
Jerry Yu985c9672022-12-04 14:06:30 +08001796 if (ssl->conf->early_data_enabled == MBEDTLS_SSL_EARLY_DATA_DISABLED) {
1797 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu985c9672022-12-04 14:06:30 +08001798 1,
Jerry Yu454dda32023-10-31 15:13:54 +08001799 ("EarlyData: rejected, feature disabled in server configuration."));
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001800 return -1;
Ronald Cron7b6ee942024-01-12 10:29:55 +01001801 }
1802
Jerry Yu454dda32023-10-31 15:13:54 +08001803 if (!handshake->resume) {
1804 /* We currently support early data only in the case of PSKs established
1805 via a NewSessionTicket message thus in the case of a session
1806 resumption. */
Jerry Yu985c9672022-12-04 14:06:30 +08001807 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu7ef9fd82023-11-07 14:30:38 +08001808 1, ("EarlyData: rejected, not a session resumption."));
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001809 return -1;
Jerry Yu985c9672022-12-04 14:06:30 +08001810 }
1811
Jerry Yu82fd6c12023-10-31 16:32:19 +08001812 /* RFC 8446 4.2.10
1813 *
1814 * In order to accept early data, the server MUST have accepted a PSK cipher
1815 * suite and selected the first key offered in the client's "pre_shared_key"
1816 * extension. In addition, it MUST verify that the following values are the
1817 * same as those associated with the selected PSK:
1818 * - The TLS version number
1819 * - The selected cipher suite
1820 * - The selected ALPN [RFC7301] protocol, if any
1821 *
1822 * NOTE:
Jerry Yu7ef9fd82023-11-07 14:30:38 +08001823 * - The TLS version number is checked in
1824 * ssl_tls13_offered_psks_check_identity_match_ticket().
1825 * - ALPN is not checked for the time being (TODO).
Jerry Yu82fd6c12023-10-31 16:32:19 +08001826 */
1827
1828 if (handshake->selected_identity != 0) {
1829 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu7ef9fd82023-11-07 14:30:38 +08001830 1, ("EarlyData: rejected, the selected key in "
1831 "`pre_shared_key` is not the first one."));
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001832 return -1;
Jerry Yu82fd6c12023-10-31 16:32:19 +08001833 }
1834
1835 if (handshake->ciphersuite_info->id !=
1836 ssl->session_negotiate->ciphersuite) {
1837 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu7ef9fd82023-11-07 14:30:38 +08001838 1, ("EarlyData: rejected, the selected ciphersuite is not the one "
1839 "of the selected pre-shared key."));
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001840 return -1;
Jerry Yu82fd6c12023-10-31 16:32:19 +08001841
1842 }
Jerry Yu985c9672022-12-04 14:06:30 +08001843
Pengyu Lv94a42cc2023-12-06 10:04:17 +08001844 if (!mbedtls_ssl_tls13_session_ticket_allow_early_data(ssl->session_negotiate)) {
Jerry Yufceddb32022-12-12 15:30:34 +08001845 MBEDTLS_SSL_DEBUG_MSG(
1846 1,
Jerry Yuea96ac32023-11-21 17:06:36 +08001847 ("EarlyData: rejected, early_data not allowed in ticket "
1848 "permission bits."));
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001849 return -1;
Jerry Yufceddb32022-12-12 15:30:34 +08001850 }
Jerry Yu985c9672022-12-04 14:06:30 +08001851
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001852 return 0;
Jerry Yuab0da372023-02-08 13:55:24 +08001853}
1854#endif /* MBEDTLS_SSL_EARLY_DATA */
1855
XiaokangQian75fe8c72022-06-15 09:42:45 +00001856/* Update the handshake state machine */
1857
Ronald Cronce7d76e2022-07-08 18:56:49 +02001858MBEDTLS_CHECK_RETURN_CRITICAL
Ronald Cron7b6ee942024-01-12 10:29:55 +01001859static int ssl_tls13_postprocess_client_hello(mbedtls_ssl_context *ssl,
1860 int hrr_required)
XiaokangQian75fe8c72022-06-15 09:42:45 +00001861{
1862 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1863
XiaokangQian7807f9f2022-02-15 10:04:37 +00001864 /*
XiaokangQianfb665a82022-06-15 03:57:21 +00001865 * Server certificate selection
1866 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001867 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) {
1868 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret);
1869 return ret;
XiaokangQianfb665a82022-06-15 03:57:21 +00001870 }
1871#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1872 ssl->handshake->sni_name = NULL;
1873 ssl->handshake->sni_name_len = 0;
1874#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001875
Gilles Peskine449bd832023-01-11 14:50:10 +01001876 ret = mbedtls_ssl_tls13_key_schedule_stage_early(ssl);
1877 if (ret != 0) {
1878 MBEDTLS_SSL_DEBUG_RET(1,
1879 "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret);
1880 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001881 }
1882
Jerry Yuab0da372023-02-08 13:55:24 +08001883#if defined(MBEDTLS_SSL_EARLY_DATA)
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001884 if (ssl->handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(EARLY_DATA)) {
Ronald Cron31e2d832024-02-05 16:45:57 +01001885 ssl->handshake->early_data_accepted =
1886 (!hrr_required) && (ssl_tls13_check_early_data_requirements(ssl) == 0);
Jerry Yu4e9b70e2022-12-04 14:08:02 +08001887
Jerry Yu4caf3ca2023-11-15 16:13:47 +08001888 if (ssl->handshake->early_data_accepted) {
1889 ret = mbedtls_ssl_tls13_compute_early_transform(ssl);
1890 if (ret != 0) {
1891 MBEDTLS_SSL_DEBUG_RET(
1892 1, "mbedtls_ssl_tls13_compute_early_transform", ret);
1893 return ret;
1894 }
1895 } else {
1896 ssl->discard_early_data_record =
1897 hrr_required ?
1898 MBEDTLS_SSL_EARLY_DATA_DISCARD :
1899 MBEDTLS_SSL_EARLY_DATA_TRY_TO_DEPROTECT_AND_DISCARD;
Jerry Yu4e9b70e2022-12-04 14:08:02 +08001900 }
1901 }
Ronald Cron7b6ee942024-01-12 10:29:55 +01001902#else
1903 ((void) hrr_required);
Jerry Yuab0da372023-02-08 13:55:24 +08001904#endif /* MBEDTLS_SSL_EARLY_DATA */
1905
Gilles Peskine449bd832023-01-11 14:50:10 +01001906 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001907}
1908
1909/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001910 * Main entry point from the state machine; orchestrates the otherfunctions.
1911 */
1912
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001913MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001914static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
XiaokangQianed582dd2022-04-13 08:21:05 +00001915{
1916
XiaokangQian08037552022-04-20 07:16:41 +00001917 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01001918 unsigned char *buf = NULL;
XiaokangQianed582dd2022-04-13 08:21:05 +00001919 size_t buflen = 0;
Jerry Yu4ca91402022-05-09 15:50:57 +08001920 int parse_client_hello_ret;
1921
Gilles Peskine449bd832023-01-11 14:50:10 +01001922 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
XiaokangQianed582dd2022-04-13 08:21:05 +00001923
Gilles Peskine449bd832023-01-11 14:50:10 +01001924 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
1925 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
1926 &buf, &buflen));
XiaokangQianed582dd2022-04-13 08:21:05 +00001927
Gilles Peskine449bd832023-01-11 14:50:10 +01001928 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf,
1929 buf + buflen));
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001930 parse_client_hello_ret = ret; /* Store positive return value of
1931 * parse_client_hello,
1932 * as negative error codes are handled
Jerry Yuf41553b2022-05-09 22:20:30 +08001933 * by MBEDTLS_SSL_PROC_CHK_NEG. */
Jerry Yu4ca91402022-05-09 15:50:57 +08001934
Ronald Cronb828c7d2023-04-03 16:37:22 +02001935 /*
Yanray Wang90acdc62023-12-08 10:29:42 +08001936 * Version 1.2 of the protocol has to be used for the handshake.
1937 * If TLS 1.2 is not supported, abort the handshake. Otherwise, set the
Ronald Cronb828c7d2023-04-03 16:37:22 +02001938 * ssl->keep_current_message flag for the ClientHello to be kept and parsed
1939 * as a TLS 1.2 ClientHello. We also change ssl->tls_version to
1940 * MBEDTLS_SSL_VERSION_TLS1_2 thus from now on mbedtls_ssl_handshake_step()
1941 * will dispatch to the TLS 1.2 state machine.
1942 */
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001943 if (SSL_CLIENT_HELLO_TLS1_2 == parse_client_hello_ret) {
Yanray Wangfb0f47b2023-12-04 15:27:28 +08001944 /* Check if server supports TLS 1.2 */
Yanray Wang408ba6f2023-12-08 10:18:03 +08001945 if (!mbedtls_ssl_conf_is_tls12_enabled(ssl->conf)) {
Yanray Wangfb0f47b2023-12-04 15:27:28 +08001946 MBEDTLS_SSL_DEBUG_MSG(
Yanray Wang177e49a2023-12-08 10:51:04 +08001947 1, ("TLS 1.2 not supported."));
Yanray Wangfb0f47b2023-12-04 15:27:28 +08001948 MBEDTLS_SSL_PEND_FATAL_ALERT(
Yanray Wang2bef9172023-12-08 10:21:53 +08001949 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1950 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
1951 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
Yanray Wangfb0f47b2023-12-04 15:27:28 +08001952 }
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001953 ssl->keep_current_message = 1;
1954 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
1955 return 0;
1956 }
1957
Ronald Cron7b6ee942024-01-12 10:29:55 +01001958 MBEDTLS_SSL_PROC_CHK(
1959 ssl_tls13_postprocess_client_hello(ssl, parse_client_hello_ret ==
1960 SSL_CLIENT_HELLO_HRR_REQUIRED));
Jerry Yu582dd062022-04-22 21:59:01 +08001961
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001962 if (SSL_CLIENT_HELLO_OK == parse_client_hello_ret) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001963 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO);
1964 } else {
1965 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST);
1966 }
XiaokangQianed582dd2022-04-13 08:21:05 +00001967
1968cleanup:
1969
Gilles Peskine449bd832023-01-11 14:50:10 +01001970 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello"));
1971 return ret;
XiaokangQianed582dd2022-04-13 08:21:05 +00001972}
1973
1974/*
Jerry Yu1c3e6882022-04-20 21:23:40 +08001975 * Handler for MBEDTLS_SSL_SERVER_HELLO
Jerry Yu5b64ae92022-03-30 17:15:02 +08001976 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001977MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001978static int ssl_tls13_prepare_server_hello(mbedtls_ssl_context *ssl)
Jerry Yuf4b27e42022-03-30 17:32:21 +08001979{
Jerry Yu637a3f12022-04-20 21:37:58 +08001980 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1981 unsigned char *server_randbytes =
Gilles Peskine449bd832023-01-11 14:50:10 +01001982 ssl->handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001983
Gilles Peskine449bd832023-01-11 14:50:10 +01001984 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, server_randbytes,
1985 MBEDTLS_SERVER_HELLO_RANDOM_LEN)) != 0) {
1986 MBEDTLS_SSL_DEBUG_RET(1, "f_rng", ret);
1987 return ret;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001988 }
1989
Gilles Peskine449bd832023-01-11 14:50:10 +01001990 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", server_randbytes,
1991 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yuf4b27e42022-03-30 17:32:21 +08001992
1993#if defined(MBEDTLS_HAVE_TIME)
YxCda609132023-05-22 12:08:12 -07001994 ssl->session_negotiate->start = mbedtls_time(NULL);
Jerry Yuf4b27e42022-03-30 17:32:21 +08001995#endif /* MBEDTLS_HAVE_TIME */
1996
Gilles Peskine449bd832023-01-11 14:50:10 +01001997 return ret;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001998}
1999
Jerry Yu3bf2c642022-03-30 22:02:12 +08002000/*
Jerry Yue74e04a2022-04-21 09:23:16 +08002001 * ssl_tls13_write_server_hello_supported_versions_ext ():
Jerry Yu3bf2c642022-03-30 22:02:12 +08002002 *
2003 * struct {
Jerry Yufb9f54d2022-04-06 10:08:34 +08002004 * ProtocolVersion selected_version;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002005 * } SupportedVersions;
2006 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002007MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yue74e04a2022-04-21 09:23:16 +08002008static int ssl_tls13_write_server_hello_supported_versions_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01002009 mbedtls_ssl_context *ssl,
2010 unsigned char *buf,
2011 unsigned char *end,
2012 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08002013{
Jerry Yu3bf2c642022-03-30 22:02:12 +08002014 *out_len = 0;
2015
Gilles Peskine449bd832023-01-11 14:50:10 +01002016 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, write selected version"));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002017
2018 /* Check if we have space to write the extension:
2019 * - extension_type (2 bytes)
2020 * - extension_data_length (2 bytes)
Jerry Yu349a6132022-04-14 20:52:56 +08002021 * - selected_version (2 bytes)
Jerry Yu3bf2c642022-03-30 22:02:12 +08002022 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002023 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002024
Gilles Peskine449bd832023-01-11 14:50:10 +01002025 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, buf, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002026
Gilles Peskine449bd832023-01-11 14:50:10 +01002027 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002028
Gilles Peskine449bd832023-01-11 14:50:10 +01002029 mbedtls_ssl_write_version(buf + 4,
2030 ssl->conf->transport,
2031 ssl->tls_version);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002032
Gilles Peskine449bd832023-01-11 14:50:10 +01002033 MBEDTLS_SSL_DEBUG_MSG(3, ("supported version: [%04x]",
2034 ssl->tls_version));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002035
Jerry Yu349a6132022-04-14 20:52:56 +08002036 *out_len = 6;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002037
Jerry Yub95dd362022-11-08 21:19:34 +08002038 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
Gilles Peskine449bd832023-01-11 14:50:10 +01002039 ssl, MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS);
Jerry Yub95dd362022-11-08 21:19:34 +08002040
Gilles Peskine449bd832023-01-11 14:50:10 +01002041 return 0;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002042}
2043
Jerry Yud9436a12022-04-20 22:28:09 +08002044
Jerry Yu3bf2c642022-03-30 22:02:12 +08002045
2046/* Generate and export a single key share. For hybrid KEMs, this can
2047 * be called multiple times with the different components of the hybrid. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002048MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002049static int ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context *ssl,
2050 uint16_t named_group,
2051 unsigned char *buf,
2052 unsigned char *end,
2053 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08002054{
2055 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu955ddd72022-04-22 22:27:33 +08002056
2057 *out_len = 0;
2058
Valerio Settic9ae8622023-07-25 11:23:50 +02002059#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
Przemek Stekiel29c219c2023-05-31 15:21:04 +02002060 if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group) ||
Przemek Stekield5f79e72023-06-29 09:08:43 +02002061 mbedtls_ssl_tls13_named_group_is_ffdh(named_group)) {
Przemek Stekiel408569f2023-07-06 11:26:44 +02002062 ret = mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +01002063 ssl, named_group, buf, end, out_len);
2064 if (ret != 0) {
Jerry Yu89e103c2022-03-30 22:43:29 +08002065 MBEDTLS_SSL_DEBUG_RET(
Przemek Stekiel408569f2023-07-06 11:26:44 +02002066 1, "mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange",
Gilles Peskine449bd832023-01-11 14:50:10 +01002067 ret);
2068 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002069 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002070 } else
Valerio Settic9ae8622023-07-25 11:23:50 +02002071#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
Gilles Peskine449bd832023-01-11 14:50:10 +01002072 if (0 /* Other kinds of KEMs */) {
2073 } else {
Jerry Yu955ddd72022-04-22 22:27:33 +08002074 ((void) ssl);
2075 ((void) named_group);
2076 ((void) buf);
2077 ((void) end);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002078 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2079 }
2080
Gilles Peskine449bd832023-01-11 14:50:10 +01002081 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002082}
2083
2084/*
2085 * ssl_tls13_write_key_share_ext
2086 *
2087 * Structure of key_share extension in ServerHello:
2088 *
Jerry Yu1c3e6882022-04-20 21:23:40 +08002089 * struct {
2090 * NamedGroup group;
2091 * opaque key_exchange<1..2^16-1>;
2092 * } KeyShareEntry;
2093 * struct {
2094 * KeyShareEntry server_share;
2095 * } KeyShareServerHello;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002096 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002097MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002098static int ssl_tls13_write_key_share_ext(mbedtls_ssl_context *ssl,
2099 unsigned char *buf,
2100 unsigned char *end,
2101 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08002102{
Jerry Yu955ddd72022-04-22 22:27:33 +08002103 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002104 unsigned char *p = buf;
Jerry Yu57d48412022-04-20 21:50:42 +08002105 uint16_t group = ssl->handshake->offered_group_id;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002106 unsigned char *server_share = buf + 4;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002107 size_t key_exchange_length;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002108
2109 *out_len = 0;
2110
Gilles Peskine449bd832023-01-11 14:50:10 +01002111 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding key share extension"));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002112
Gilles Peskine449bd832023-01-11 14:50:10 +01002113 MBEDTLS_SSL_DEBUG_MSG(2, ("server hello, write selected_group: %s (%04x)",
2114 mbedtls_ssl_named_group_to_str(group),
2115 group));
Jerry Yu58af2332022-09-06 11:19:31 +08002116
Jerry Yu3bf2c642022-03-30 22:02:12 +08002117 /* Check if we have space for header and length fields:
2118 * - extension_type (2 bytes)
2119 * - extension_data_length (2 bytes)
2120 * - group (2 bytes)
2121 * - key_exchange_length (2 bytes)
2122 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002123 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 8);
2124 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, p, 0);
2125 MBEDTLS_PUT_UINT16_BE(group, server_share, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002126 p += 8;
Jerry Yu57d48412022-04-20 21:50:42 +08002127
Jerry Yu3bf2c642022-03-30 22:02:12 +08002128 /* When we introduce PQC-ECDHE hybrids, we'll want to call this
2129 * function multiple times. */
Jerry Yu955ddd72022-04-22 22:27:33 +08002130 ret = ssl_tls13_generate_and_write_key_share(
Gilles Peskine449bd832023-01-11 14:50:10 +01002131 ssl, group, server_share + 4, end, &key_exchange_length);
2132 if (ret != 0) {
2133 return ret;
2134 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002135 p += key_exchange_length;
Jerry Yuc1be19f2022-04-23 16:11:39 +08002136
Gilles Peskine449bd832023-01-11 14:50:10 +01002137 MBEDTLS_PUT_UINT16_BE(key_exchange_length, server_share + 2, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002138
Gilles Peskine449bd832023-01-11 14:50:10 +01002139 MBEDTLS_PUT_UINT16_BE(p - server_share, buf, 2);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002140
Jerry Yu57d48412022-04-20 21:50:42 +08002141 *out_len = p - buf;
Jerry Yu955ddd72022-04-22 22:27:33 +08002142
Gilles Peskine449bd832023-01-11 14:50:10 +01002143 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
Jerry Yub95dd362022-11-08 21:19:34 +08002144
Gilles Peskine449bd832023-01-11 14:50:10 +01002145 return 0;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002146}
Jerry Yud9436a12022-04-20 22:28:09 +08002147
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002148MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002149static int ssl_tls13_write_hrr_key_share_ext(mbedtls_ssl_context *ssl,
2150 unsigned char *buf,
2151 unsigned char *end,
2152 size_t *out_len)
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002153{
2154 uint16_t selected_group = ssl->handshake->hrr_selected_group;
2155 /* key_share Extension
2156 *
2157 * struct {
2158 * select (Handshake.msg_type) {
2159 * ...
2160 * case hello_retry_request:
2161 * NamedGroup selected_group;
2162 * ...
2163 * };
2164 * } KeyShare;
2165 */
2166
2167 *out_len = 0;
2168
Jerry Yub0ac10b2022-05-05 11:10:08 +08002169 /*
2170 * For a pure PSK key exchange, there is no group to agree upon. The purpose
2171 * of the HRR is then to transmit a cookie to force the client to demonstrate
2172 * reachability at their apparent network address (primarily useful for DTLS).
2173 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002174 if (!mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2175 return 0;
2176 }
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002177
2178 /* We should only send the key_share extension if the client's initial
2179 * key share was not acceptable. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002180 if (ssl->handshake->offered_group_id != 0) {
2181 MBEDTLS_SSL_DEBUG_MSG(4, ("Skip key_share extension in HRR"));
2182 return 0;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002183 }
2184
Gilles Peskine449bd832023-01-11 14:50:10 +01002185 if (selected_group == 0) {
2186 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching named group found"));
2187 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002188 }
2189
Jerry Yub0ac10b2022-05-05 11:10:08 +08002190 /* Check if we have enough space:
2191 * - extension_type (2 bytes)
2192 * - extension_data_length (2 bytes)
2193 * - selected_group (2 bytes)
2194 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002195 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002196
Gilles Peskine449bd832023-01-11 14:50:10 +01002197 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0);
2198 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
2199 MBEDTLS_PUT_UINT16_BE(selected_group, buf, 4);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002200
Gilles Peskine449bd832023-01-11 14:50:10 +01002201 MBEDTLS_SSL_DEBUG_MSG(3,
2202 ("HRR selected_group: %s (%x)",
2203 mbedtls_ssl_named_group_to_str(selected_group),
2204 selected_group));
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002205
2206 *out_len = 6;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002207
Gilles Peskine449bd832023-01-11 14:50:10 +01002208 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
Jerry Yub95dd362022-11-08 21:19:34 +08002209
Gilles Peskine449bd832023-01-11 14:50:10 +01002210 return 0;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002211}
Jerry Yu3bf2c642022-03-30 22:02:12 +08002212
2213/*
2214 * Structure of ServerHello message:
2215 *
2216 * struct {
2217 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
2218 * Random random;
2219 * opaque legacy_session_id_echo<0..32>;
2220 * CipherSuite cipher_suite;
2221 * uint8 legacy_compression_method = 0;
2222 * Extension extensions<6..2^16-1>;
2223 * } ServerHello;
2224 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002225MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002226static int ssl_tls13_write_server_hello_body(mbedtls_ssl_context *ssl,
2227 unsigned char *buf,
2228 unsigned char *end,
2229 size_t *out_len,
2230 int is_hrr)
Jerry Yu56404d72022-03-30 17:36:13 +08002231{
Jerry Yu955ddd72022-04-22 22:27:33 +08002232 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002233 unsigned char *p = buf;
Jerry Yud9436a12022-04-20 22:28:09 +08002234 unsigned char *p_extensions_len;
Jerry Yufbe3e642022-04-25 19:31:51 +08002235 size_t output_len;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002236
2237 *out_len = 0;
Jerry Yu50e00e32022-10-31 14:45:01 +08002238 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002239
Jerry Yucfc04b32022-04-21 09:31:58 +08002240 /* ...
2241 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
2242 * ...
2243 * with ProtocolVersion defined as:
2244 * uint16 ProtocolVersion;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002245 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002246 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2247 MBEDTLS_PUT_UINT16_BE(0x0303, p, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002248 p += 2;
2249
Jerry Yu1c3e6882022-04-20 21:23:40 +08002250 /* ...
2251 * Random random;
2252 * ...
Jerry Yucfc04b32022-04-21 09:31:58 +08002253 * with Random defined as:
2254 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu1c3e6882022-04-20 21:23:40 +08002255 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002256 MBEDTLS_SSL_CHK_BUF_PTR(p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2257 if (is_hrr) {
2258 memcpy(p, mbedtls_ssl_tls13_hello_retry_request_magic,
2259 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2260 } else {
2261 memcpy(p, &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN],
2262 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002263 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002264 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes",
2265 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002266 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
2267
Jerry Yucfc04b32022-04-21 09:31:58 +08002268 /* ...
2269 * opaque legacy_session_id_echo<0..32>;
2270 * ...
Jerry Yu3bf2c642022-03-30 22:02:12 +08002271 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002272 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1 + ssl->session_negotiate->id_len);
2273 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2274 if (ssl->session_negotiate->id_len > 0) {
2275 memcpy(p, &ssl->session_negotiate->id[0],
2276 ssl->session_negotiate->id_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002277 p += ssl->session_negotiate->id_len;
Jerry Yu955ddd72022-04-22 22:27:33 +08002278
Gilles Peskine449bd832023-01-11 14:50:10 +01002279 MBEDTLS_SSL_DEBUG_BUF(3, "session id", ssl->session_negotiate->id,
2280 ssl->session_negotiate->id_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002281 }
2282
Jerry Yucfc04b32022-04-21 09:31:58 +08002283 /* ...
2284 * CipherSuite cipher_suite;
2285 * ...
2286 * with CipherSuite defined as:
2287 * uint8 CipherSuite[2];
Jerry Yu3bf2c642022-03-30 22:02:12 +08002288 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002289 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2290 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002291 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002292 MBEDTLS_SSL_DEBUG_MSG(3,
2293 ("server hello, chosen ciphersuite: %s ( id=%d )",
2294 mbedtls_ssl_get_ciphersuite_name(
2295 ssl->session_negotiate->ciphersuite),
2296 ssl->session_negotiate->ciphersuite));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002297
Jerry Yucfc04b32022-04-21 09:31:58 +08002298 /* ...
2299 * uint8 legacy_compression_method = 0;
2300 * ...
2301 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002302 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1);
Thomas Daubney31e03a82022-07-25 15:59:25 +01002303 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002304
Jerry Yucfc04b32022-04-21 09:31:58 +08002305 /* ...
2306 * Extension extensions<6..2^16-1>;
2307 * ...
2308 * struct {
2309 * ExtensionType extension_type; (2 bytes)
2310 * opaque extension_data<0..2^16-1>;
2311 * } Extension;
2312 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002313 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yud9436a12022-04-20 22:28:09 +08002314 p_extensions_len = p;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002315 p += 2;
2316
Gilles Peskine449bd832023-01-11 14:50:10 +01002317 if ((ret = ssl_tls13_write_server_hello_supported_versions_ext(
2318 ssl, p, end, &output_len)) != 0) {
Jerry Yu955ddd72022-04-22 22:27:33 +08002319 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01002320 1, "ssl_tls13_write_server_hello_supported_versions_ext", ret);
2321 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002322 }
2323 p += output_len;
2324
Gilles Peskine449bd832023-01-11 14:50:10 +01002325 if (mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2326 if (is_hrr) {
2327 ret = ssl_tls13_write_hrr_key_share_ext(ssl, p, end, &output_len);
2328 } else {
2329 ret = ssl_tls13_write_key_share_ext(ssl, p, end, &output_len);
2330 }
2331 if (ret != 0) {
2332 return ret;
2333 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002334 p += output_len;
2335 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002336
Ronald Cron41a443a2022-10-04 16:38:25 +02002337#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002338 if (!is_hrr && mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2339 ret = ssl_tls13_write_server_pre_shared_key_ext(ssl, p, end, &output_len);
2340 if (ret != 0) {
2341 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_server_pre_shared_key_ext",
2342 ret);
2343 return ret;
Jerry Yu032b15ce2022-07-11 06:10:03 +00002344 }
2345 p += output_len;
2346 }
Ronald Cron41a443a2022-10-04 16:38:25 +02002347#endif
Jerry Yu032b15ce2022-07-11 06:10:03 +00002348
Gilles Peskine449bd832023-01-11 14:50:10 +01002349 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002350
Gilles Peskine449bd832023-01-11 14:50:10 +01002351 MBEDTLS_SSL_DEBUG_BUF(4, "server hello extensions",
2352 p_extensions_len, p - p_extensions_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002353
Jerry Yud9436a12022-04-20 22:28:09 +08002354 *out_len = p - buf;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002355
Gilles Peskine449bd832023-01-11 14:50:10 +01002356 MBEDTLS_SSL_DEBUG_BUF(3, "server hello", buf, *out_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002357
Jerry Yu7de2ff02022-11-08 21:43:46 +08002358 MBEDTLS_SSL_PRINT_EXTS(
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002359 3, is_hrr ? MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST :
Gilles Peskine449bd832023-01-11 14:50:10 +01002360 MBEDTLS_SSL_HS_SERVER_HELLO,
2361 ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002362
Gilles Peskine449bd832023-01-11 14:50:10 +01002363 return ret;
Jerry Yu56404d72022-03-30 17:36:13 +08002364}
2365
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002366MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian934ce6f2023-02-06 10:23:04 +00002367static int ssl_tls13_finalize_server_hello(mbedtls_ssl_context *ssl)
Jerry Yue110d252022-05-05 10:19:22 +08002368{
2369 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002370 ret = mbedtls_ssl_tls13_compute_handshake_transform(ssl);
2371 if (ret != 0) {
2372 MBEDTLS_SSL_DEBUG_RET(1,
2373 "mbedtls_ssl_tls13_compute_handshake_transform",
2374 ret);
2375 return ret;
Jerry Yue110d252022-05-05 10:19:22 +08002376 }
2377
Gilles Peskine449bd832023-01-11 14:50:10 +01002378 return ret;
Jerry Yue110d252022-05-05 10:19:22 +08002379}
2380
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002381MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002382static int ssl_tls13_write_server_hello(mbedtls_ssl_context *ssl)
Jerry Yu5b64ae92022-03-30 17:15:02 +08002383{
Jerry Yu637a3f12022-04-20 21:37:58 +08002384 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yuf4b27e42022-03-30 17:32:21 +08002385 unsigned char *buf;
2386 size_t buf_len, msg_len;
2387
Gilles Peskine449bd832023-01-11 14:50:10 +01002388 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello"));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002389
Gilles Peskine449bd832023-01-11 14:50:10 +01002390 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_server_hello(ssl));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002391
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002392 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2393 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, &buf, &buf_len));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002394
Gilles Peskine449bd832023-01-11 14:50:10 +01002395 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2396 buf + buf_len,
2397 &msg_len,
2398 0));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002399
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002400 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002401 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002402
Gilles Peskine449bd832023-01-11 14:50:10 +01002403 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2404 ssl, buf_len, msg_len));
Jerry Yu637a3f12022-04-20 21:37:58 +08002405
Xiaokang Qian934ce6f2023-02-06 10:23:04 +00002406 MBEDTLS_SSL_PROC_CHK(ssl_tls13_finalize_server_hello(ssl));
Jerry Yue110d252022-05-05 10:19:22 +08002407
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002408#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2409 /* The server sends a dummy change_cipher_spec record immediately
2410 * after its first handshake message. This may either be after
2411 * a ServerHello or a HelloRetryRequest.
2412 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02002413 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002414 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002415#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002416 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002417#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yue110d252022-05-05 10:19:22 +08002418
Jerry Yuf4b27e42022-03-30 17:32:21 +08002419cleanup:
2420
Gilles Peskine449bd832023-01-11 14:50:10 +01002421 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2422 return ret;
Jerry Yu5b64ae92022-03-30 17:15:02 +08002423}
2424
Jerry Yu23d1a252022-05-12 18:08:59 +08002425
2426/*
2427 * Handler for MBEDTLS_SSL_HELLO_RETRY_REQUEST
2428 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002429MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002430static int ssl_tls13_prepare_hello_retry_request(mbedtls_ssl_context *ssl)
Jerry Yu23d1a252022-05-12 18:08:59 +08002431{
2432 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Ronald Cron5fbd2702024-02-14 10:03:36 +01002433 if (ssl->handshake->hello_retry_request_flag) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002434 MBEDTLS_SSL_DEBUG_MSG(1, ("Too many HRRs"));
2435 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2436 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2437 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu23d1a252022-05-12 18:08:59 +08002438 }
2439
2440 /*
2441 * Create stateless transcript hash for HRR
2442 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002443 MBEDTLS_SSL_DEBUG_MSG(4, ("Reset transcript for HRR"));
2444 ret = mbedtls_ssl_reset_transcript_for_hrr(ssl);
2445 if (ret != 0) {
2446 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_transcript_for_hrr", ret);
2447 return ret;
Jerry Yu23d1a252022-05-12 18:08:59 +08002448 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002449 mbedtls_ssl_session_reset_msg_layer(ssl, 0);
Jerry Yu23d1a252022-05-12 18:08:59 +08002450
Gilles Peskine449bd832023-01-11 14:50:10 +01002451 return 0;
Jerry Yu23d1a252022-05-12 18:08:59 +08002452}
2453
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002454MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002455static int ssl_tls13_write_hello_retry_request(mbedtls_ssl_context *ssl)
Jerry Yu23d1a252022-05-12 18:08:59 +08002456{
2457 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2458 unsigned char *buf;
2459 size_t buf_len, msg_len;
2460
Gilles Peskine449bd832023-01-11 14:50:10 +01002461 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello retry request"));
Jerry Yu23d1a252022-05-12 18:08:59 +08002462
Gilles Peskine449bd832023-01-11 14:50:10 +01002463 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_hello_retry_request(ssl));
Jerry Yu23d1a252022-05-12 18:08:59 +08002464
Gilles Peskine449bd832023-01-11 14:50:10 +01002465 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2466 ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
2467 &buf, &buf_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002468
Gilles Peskine449bd832023-01-11 14:50:10 +01002469 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2470 buf + buf_len,
2471 &msg_len,
2472 1));
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002473 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002474 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002475
2476
Gilles Peskine449bd832023-01-11 14:50:10 +01002477 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(ssl, buf_len,
2478 msg_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002479
Ronald Cron5fbd2702024-02-14 10:03:36 +01002480 ssl->handshake->hello_retry_request_flag = 1;
Jerry Yu23d1a252022-05-12 18:08:59 +08002481
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002482#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2483 /* The server sends a dummy change_cipher_spec record immediately
2484 * after its first handshake message. This may either be after
2485 * a ServerHello or a HelloRetryRequest.
2486 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02002487 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002488 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002489#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002490 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002491#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yu23d1a252022-05-12 18:08:59 +08002492
2493cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01002494 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello retry request"));
2495 return ret;
Jerry Yu23d1a252022-05-12 18:08:59 +08002496}
2497
Jerry Yu5b64ae92022-03-30 17:15:02 +08002498/*
Jerry Yu4d3841a2022-04-16 12:37:19 +08002499 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
2500 */
Jerry Yu4d3841a2022-04-16 12:37:19 +08002501
2502/*
2503 * struct {
2504 * Extension extensions<0..2 ^ 16 - 1>;
2505 * } EncryptedExtensions;
2506 *
2507 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002508MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002509static int ssl_tls13_write_encrypted_extensions_body(mbedtls_ssl_context *ssl,
2510 unsigned char *buf,
2511 unsigned char *end,
2512 size_t *out_len)
Jerry Yu4d3841a2022-04-16 12:37:19 +08002513{
XiaokangQianacb39922022-06-17 10:18:48 +00002514 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002515 unsigned char *p = buf;
2516 size_t extensions_len = 0;
Jerry Yu8937eb42022-05-03 12:12:14 +08002517 unsigned char *p_extensions_len;
XiaokangQianacb39922022-06-17 10:18:48 +00002518 size_t output_len;
Jerry Yu9da5e5a2022-05-03 15:46:09 +08002519
Jerry Yu4d3841a2022-04-16 12:37:19 +08002520 *out_len = 0;
2521
Gilles Peskine449bd832023-01-11 14:50:10 +01002522 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yu8937eb42022-05-03 12:12:14 +08002523 p_extensions_len = p;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002524 p += 2;
2525
Jerry Yu8937eb42022-05-03 12:12:14 +08002526 ((void) ssl);
XiaokangQianacb39922022-06-17 10:18:48 +00002527 ((void) ret);
2528 ((void) output_len);
2529
2530#if defined(MBEDTLS_SSL_ALPN)
Gilles Peskine449bd832023-01-11 14:50:10 +01002531 ret = mbedtls_ssl_write_alpn_ext(ssl, p, end, &output_len);
2532 if (ret != 0) {
2533 return ret;
2534 }
XiaokangQian95d5f542022-06-24 02:29:26 +00002535 p += output_len;
XiaokangQianacb39922022-06-17 10:18:48 +00002536#endif /* MBEDTLS_SSL_ALPN */
Jerry Yu4d3841a2022-04-16 12:37:19 +08002537
Jerry Yu71c14f12022-12-12 11:10:35 +08002538#if defined(MBEDTLS_SSL_EARLY_DATA)
Ronald Cron78a38f62024-02-01 18:30:31 +01002539 if (ssl->handshake->early_data_accepted) {
Jerry Yu52335392023-11-23 18:06:06 +08002540 ret = mbedtls_ssl_tls13_write_early_data_ext(
Jerry Yuc59c5862023-12-05 10:40:49 +08002541 ssl, 0, p, end, &output_len);
Jerry Yu71c14f12022-12-12 11:10:35 +08002542 if (ret != 0) {
2543 return ret;
2544 }
2545 p += output_len;
2546 }
2547#endif /* MBEDTLS_SSL_EARLY_DATA */
2548
Waleed Elmelegy47d29462024-01-03 17:31:52 +00002549#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
Waleed Elmelegyfbe42742024-01-05 18:11:10 +00002550 if (ssl->handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(RECORD_SIZE_LIMIT)) {
Waleed Elmelegyd2fc90e2024-01-04 18:04:53 +00002551 ret = mbedtls_ssl_tls13_write_record_size_limit_ext(
2552 ssl, p, end, &output_len);
2553 if (ret != 0) {
2554 return ret;
2555 }
2556 p += output_len;
Waleed Elmelegy47d29462024-01-03 17:31:52 +00002557 }
Waleed Elmelegy47d29462024-01-03 17:31:52 +00002558#endif
2559
Gilles Peskine449bd832023-01-11 14:50:10 +01002560 extensions_len = (p - p_extensions_len) - 2;
2561 MBEDTLS_PUT_UINT16_BE(extensions_len, p_extensions_len, 0);
Jerry Yu8937eb42022-05-03 12:12:14 +08002562
2563 *out_len = p - buf;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002564
Gilles Peskine449bd832023-01-11 14:50:10 +01002565 MBEDTLS_SSL_DEBUG_BUF(4, "encrypted extensions", buf, *out_len);
Jerry Yu4d3841a2022-04-16 12:37:19 +08002566
Jerry Yu7de2ff02022-11-08 21:43:46 +08002567 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002568 3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002569
Gilles Peskine449bd832023-01-11 14:50:10 +01002570 return 0;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002571}
2572
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002573MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002574static int ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context *ssl)
Jerry Yu4d3841a2022-04-16 12:37:19 +08002575{
2576 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2577 unsigned char *buf;
Jerry Yu39730a72022-05-03 12:14:04 +08002578 size_t buf_len, msg_len;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002579
Gilles Peskine449bd832023-01-11 14:50:10 +01002580 mbedtls_ssl_set_outbound_transform(ssl,
2581 ssl->handshake->transform_handshake);
Gabor Mezei54719122022-06-28 11:34:56 +02002582 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01002583 3, ("switching to handshake transform for outbound data"));
Gabor Mezei54719122022-06-28 11:34:56 +02002584
Gilles Peskine449bd832023-01-11 14:50:10 +01002585 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write encrypted extensions"));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002586
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002587 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2588 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2589 &buf, &buf_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002590
Gilles Peskine449bd832023-01-11 14:50:10 +01002591 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_encrypted_extensions_body(
2592 ssl, buf, buf + buf_len, &msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002593
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002594 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002595 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2596 buf, msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002597
Gilles Peskine449bd832023-01-11 14:50:10 +01002598 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2599 ssl, buf_len, msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002600
Ronald Cron928cbd32022-10-04 16:14:26 +02002601#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002602 if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2603 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2604 } else {
2605 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
2606 }
Jerry Yu8937eb42022-05-03 12:12:14 +08002607#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002608 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
Jerry Yu8937eb42022-05-03 12:12:14 +08002609#endif
2610
Jerry Yu4d3841a2022-04-16 12:37:19 +08002611cleanup:
2612
Gilles Peskine449bd832023-01-11 14:50:10 +01002613 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write encrypted extensions"));
2614 return ret;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002615}
2616
Ronald Cron928cbd32022-10-04 16:14:26 +02002617#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQiana987e1d2022-05-07 01:25:58 +00002618#define SSL_CERTIFICATE_REQUEST_SEND_REQUEST 0
2619#define SSL_CERTIFICATE_REQUEST_SKIP 1
2620/* Coordination:
2621 * Check whether a CertificateRequest message should be written.
2622 * Returns a negative code on failure, or
2623 * - SSL_CERTIFICATE_REQUEST_SEND_REQUEST
2624 * - SSL_CERTIFICATE_REQUEST_SKIP
2625 * indicating if the writing of the CertificateRequest
2626 * should be skipped or not.
2627 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002628MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002629static int ssl_tls13_certificate_request_coordinate(mbedtls_ssl_context *ssl)
XiaokangQiana987e1d2022-05-07 01:25:58 +00002630{
2631 int authmode;
2632
XiaokangQian40a35232022-05-07 09:02:40 +00002633#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002634 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
XiaokangQian40a35232022-05-07 09:02:40 +00002635 authmode = ssl->handshake->sni_authmode;
Gilles Peskine449bd832023-01-11 14:50:10 +01002636 } else
XiaokangQian40a35232022-05-07 09:02:40 +00002637#endif
XiaokangQiana987e1d2022-05-07 01:25:58 +00002638 authmode = ssl->conf->authmode;
2639
Gilles Peskine449bd832023-01-11 14:50:10 +01002640 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
Ronald Croneac00ad2022-09-13 10:16:31 +02002641 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Gilles Peskine449bd832023-01-11 14:50:10 +01002642 return SSL_CERTIFICATE_REQUEST_SKIP;
Ronald Croneac00ad2022-09-13 10:16:31 +02002643 }
XiaokangQiana987e1d2022-05-07 01:25:58 +00002644
XiaokangQianc3017f62022-05-13 05:55:41 +00002645 ssl->handshake->certificate_request_sent = 1;
XiaokangQian189ded22022-05-10 08:12:17 +00002646
Gilles Peskine449bd832023-01-11 14:50:10 +01002647 return SSL_CERTIFICATE_REQUEST_SEND_REQUEST;
XiaokangQiana987e1d2022-05-07 01:25:58 +00002648}
2649
XiaokangQiancec9ae62022-05-06 07:28:50 +00002650/*
2651 * struct {
2652 * opaque certificate_request_context<0..2^8-1>;
2653 * Extension extensions<2..2^16-1>;
2654 * } CertificateRequest;
2655 *
2656 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002657MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002658static int ssl_tls13_write_certificate_request_body(mbedtls_ssl_context *ssl,
2659 unsigned char *buf,
2660 const unsigned char *end,
2661 size_t *out_len)
XiaokangQiancec9ae62022-05-06 07:28:50 +00002662{
2663 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2664 unsigned char *p = buf;
XiaokangQianec6efb92022-05-06 09:53:10 +00002665 size_t output_len = 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002666 unsigned char *p_extensions_len;
2667
2668 *out_len = 0;
2669
2670 /* Check if we have enough space:
2671 * - certificate_request_context (1 byte)
2672 * - extensions length (2 bytes)
2673 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002674 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002675
2676 /*
2677 * Write certificate_request_context
2678 */
2679 /*
2680 * We use a zero length context for the normal handshake
2681 * messages. For post-authentication handshake messages
2682 * this request context would be set to a non-zero value.
2683 */
2684 *p++ = 0x0;
2685
2686 /*
2687 * Write extensions
2688 */
2689 /* The extensions must contain the signature_algorithms. */
2690 p_extensions_len = p;
2691 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002692 ret = mbedtls_ssl_write_sig_alg_ext(ssl, p, end, &output_len);
2693 if (ret != 0) {
2694 return ret;
2695 }
XiaokangQiancec9ae62022-05-06 07:28:50 +00002696
XiaokangQianec6efb92022-05-06 09:53:10 +00002697 p += output_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002698 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002699
2700 *out_len = p - buf;
2701
Jerry Yu7de2ff02022-11-08 21:43:46 +08002702 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002703 3, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002704
Gilles Peskine449bd832023-01-11 14:50:10 +01002705 return 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002706}
2707
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002708MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002709static int ssl_tls13_write_certificate_request(mbedtls_ssl_context *ssl)
XiaokangQiancec9ae62022-05-06 07:28:50 +00002710{
2711 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2712
Gilles Peskine449bd832023-01-11 14:50:10 +01002713 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002714
Gilles Peskine449bd832023-01-11 14:50:10 +01002715 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_certificate_request_coordinate(ssl));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002716
Gilles Peskine449bd832023-01-11 14:50:10 +01002717 if (ret == SSL_CERTIFICATE_REQUEST_SEND_REQUEST) {
XiaokangQiancec9ae62022-05-06 07:28:50 +00002718 unsigned char *buf;
2719 size_t buf_len, msg_len;
2720
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002721 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2722 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2723 &buf, &buf_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002724
Gilles Peskine449bd832023-01-11 14:50:10 +01002725 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_request_body(
2726 ssl, buf, buf + buf_len, &msg_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002727
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002728 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002729 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2730 buf, msg_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002731
Gilles Peskine449bd832023-01-11 14:50:10 +01002732 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2733 ssl, buf_len, msg_len));
2734 } else if (ret == SSL_CERTIFICATE_REQUEST_SKIP) {
2735 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002736 ret = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002737 } else {
2738 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002739 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2740 goto cleanup;
2741 }
2742
Gilles Peskine449bd832023-01-11 14:50:10 +01002743 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_CERTIFICATE);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002744cleanup:
2745
Gilles Peskine449bd832023-01-11 14:50:10 +01002746 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request"));
2747 return ret;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002748}
XiaokangQiancec9ae62022-05-06 07:28:50 +00002749
Jerry Yu4d3841a2022-04-16 12:37:19 +08002750/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002751 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
Jerry Yu83da34e2022-04-16 13:59:52 +08002752 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002753MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002754static int ssl_tls13_write_server_certificate(mbedtls_ssl_context *ssl)
Jerry Yu83da34e2022-04-16 13:59:52 +08002755{
Jerry Yu5a26f302022-05-10 20:46:40 +08002756 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQianfb665a82022-06-15 03:57:21 +00002757
2758#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002759 if ((ssl_tls13_pick_key_cert(ssl) != 0) ||
2760 mbedtls_ssl_own_cert(ssl) == NULL) {
2761 MBEDTLS_SSL_DEBUG_MSG(2, ("No certificate available."));
2762 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2763 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2764 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5a26f302022-05-10 20:46:40 +08002765 }
XiaokangQianfb665a82022-06-15 03:57:21 +00002766#endif /* MBEDTLS_X509_CRT_PARSE_C */
Jerry Yu5a26f302022-05-10 20:46:40 +08002767
Gilles Peskine449bd832023-01-11 14:50:10 +01002768 ret = mbedtls_ssl_tls13_write_certificate(ssl);
2769 if (ret != 0) {
2770 return ret;
2771 }
2772 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY);
2773 return 0;
Jerry Yu83da34e2022-04-16 13:59:52 +08002774}
2775
2776/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002777 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
Jerry Yu83da34e2022-04-16 13:59:52 +08002778 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002779MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002780static int ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl)
Jerry Yu83da34e2022-04-16 13:59:52 +08002781{
Gilles Peskine449bd832023-01-11 14:50:10 +01002782 int ret = mbedtls_ssl_tls13_write_certificate_verify(ssl);
2783 if (ret != 0) {
2784 return ret;
2785 }
2786 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2787 return 0;
Jerry Yu83da34e2022-04-16 13:59:52 +08002788}
Ronald Cron928cbd32022-10-04 16:14:26 +02002789#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08002790
Jerry Yu9b72e392023-12-01 16:27:08 +08002791/*
2792 * RFC 8446 section A.2
2793 *
2794 * | Send ServerHello
2795 * | K_send = handshake
2796 * | Send EncryptedExtensions
2797 * | [Send CertificateRequest]
2798 * Can send | [Send Certificate + CertificateVerify]
2799 * app data | Send Finished
2800 * after --> | K_send = application
2801 * here +--------+--------+
2802 * No 0-RTT | | 0-RTT
2803 * | |
2804 * K_recv = handshake | | K_recv = early data
2805 * [Skip decrypt errors] | +------> WAIT_EOED -+
2806 * | | Recv | | Recv EndOfEarlyData
2807 * | | early data | | K_recv = handshake
2808 * | +------------+ |
2809 * | |
2810 * +> WAIT_FLIGHT2 <--------+
2811 * |
2812 * +--------+--------+
2813 * No auth | | Client auth
2814 * | |
2815 * | v
2816 * | WAIT_CERT
2817 * | Recv | | Recv Certificate
2818 * | empty | v
2819 * | Certificate | WAIT_CV
2820 * | | | Recv
2821 * | v | CertificateVerify
2822 * +-> WAIT_FINISHED <---+
2823 * | Recv Finished
2824 *
2825 *
2826 * The following function handles the state changes after WAIT_FLIGHT2 in the
Jerry Yu3be85072023-12-04 09:58:54 +08002827 * above diagram. We are not going to receive early data related messages
2828 * anymore, prepare to receive the first handshake message of the client
2829 * second flight.
Jerry Yu9b72e392023-12-01 16:27:08 +08002830 */
Jerry Yu3be85072023-12-04 09:58:54 +08002831static void ssl_tls13_prepare_for_handshake_second_flight(
2832 mbedtls_ssl_context *ssl)
Jerry Yu9b72e392023-12-01 16:27:08 +08002833{
Jerry Yu9b72e392023-12-01 16:27:08 +08002834 if (ssl->handshake->certificate_request_sent) {
2835 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE);
2836 } else {
Jerry Yu42020fb2023-12-05 17:35:53 +08002837 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate"));
Jerry Yuebb1b1d2023-12-05 11:02:15 +08002838 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
Jerry Yuebb1b1d2023-12-05 11:02:15 +08002839
Jerry Yu9b72e392023-12-01 16:27:08 +08002840 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_FINISHED);
2841 }
Jerry Yu9b72e392023-12-01 16:27:08 +08002842}
2843
Jerry Yu83da34e2022-04-16 13:59:52 +08002844/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002845 * Handler for MBEDTLS_SSL_SERVER_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002846 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002847MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002848static int ssl_tls13_write_server_finished(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002849{
Jerry Yud6e253d2022-05-18 13:59:24 +08002850 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002851
Gilles Peskine449bd832023-01-11 14:50:10 +01002852 ret = mbedtls_ssl_tls13_write_finished_message(ssl);
2853 if (ret != 0) {
2854 return ret;
2855 }
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002856
Gilles Peskine449bd832023-01-11 14:50:10 +01002857 ret = mbedtls_ssl_tls13_compute_application_transform(ssl);
2858 if (ret != 0) {
Jerry Yue3d67cb2022-05-19 15:33:10 +08002859 MBEDTLS_SSL_PEND_FATAL_ALERT(
Gilles Peskine449bd832023-01-11 14:50:10 +01002860 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2861 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2862 return ret;
Jerry Yue3d67cb2022-05-19 15:33:10 +08002863 }
XiaokangQianc3017f62022-05-13 05:55:41 +00002864
Jerry Yu87b5ed42022-12-12 13:07:07 +08002865#if defined(MBEDTLS_SSL_EARLY_DATA)
Ronald Cron78a38f62024-02-01 18:30:31 +01002866 if (ssl->handshake->early_data_accepted) {
Jerry Yu0af63dc2023-12-01 17:14:51 +08002867 /* See RFC 8446 section A.2 for more information */
Jerry Yu87b5ed42022-12-12 13:07:07 +08002868 MBEDTLS_SSL_DEBUG_MSG(
2869 1, ("Switch to early keys for inbound traffic. "
2870 "( K_recv = early data )"));
2871 mbedtls_ssl_set_inbound_transform(
2872 ssl, ssl->handshake->transform_earlydata);
2873 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_END_OF_EARLY_DATA);
2874 return 0;
2875 }
2876#endif /* MBEDTLS_SSL_EARLY_DATA */
Jerry Yu0af63dc2023-12-01 17:14:51 +08002877 MBEDTLS_SSL_DEBUG_MSG(
2878 1, ("Switch to handshake keys for inbound traffic "
2879 "( K_recv = handshake )"));
Gilles Peskine449bd832023-01-11 14:50:10 +01002880 mbedtls_ssl_set_inbound_transform(ssl, ssl->handshake->transform_handshake);
XiaokangQian189ded22022-05-10 08:12:17 +00002881
Jerry Yu3be85072023-12-04 09:58:54 +08002882 ssl_tls13_prepare_for_handshake_second_flight(ssl);
Jerry Yu7d8c3fe2022-12-12 12:59:44 +08002883
2884 return 0;
2885}
2886
Jerry Yu87b5ed42022-12-12 13:07:07 +08002887#if defined(MBEDTLS_SSL_EARLY_DATA)
2888/*
Jerry Yu59d420f2023-12-01 16:30:34 +08002889 * Handler for MBEDTLS_SSL_END_OF_EARLY_DATA
Jerry Yu87b5ed42022-12-12 13:07:07 +08002890 */
Jerry Yu3be85072023-12-04 09:58:54 +08002891#define SSL_GOT_END_OF_EARLY_DATA 0
Jerry Yub55f9eb2023-12-05 10:27:17 +08002892#define SSL_GOT_EARLY_DATA 1
Jerry Yud5c34962023-12-01 16:32:31 +08002893/* Coordination:
Jerry Yu3be85072023-12-04 09:58:54 +08002894 * Deals with the ambiguity of not knowing if the next message is an
2895 * EndOfEarlyData message or an application message containing early data.
Jerry Yud5c34962023-12-01 16:32:31 +08002896 * Returns a negative code on failure, or
Jerry Yu3be85072023-12-04 09:58:54 +08002897 * - SSL_GOT_END_OF_EARLY_DATA
Jerry Yub55f9eb2023-12-05 10:27:17 +08002898 * - SSL_GOT_EARLY_DATA
Jerry Yud5c34962023-12-01 16:32:31 +08002899 * indicating which message is received.
2900 */
2901MBEDTLS_CHECK_RETURN_CRITICAL
2902static int ssl_tls13_end_of_early_data_coordinate(mbedtls_ssl_context *ssl)
2903{
2904 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yub4ed4602023-12-01 16:34:00 +08002905
2906 if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) {
2907 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
2908 return ret;
2909 }
2910 ssl->keep_current_message = 1;
2911
2912 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_HANDSHAKE &&
2913 ssl->in_msg[0] == MBEDTLS_SSL_HS_END_OF_EARLY_DATA) {
Jerry Yub55f9eb2023-12-05 10:27:17 +08002914 MBEDTLS_SSL_DEBUG_MSG(3, ("Received an end_of_early_data message."));
Jerry Yu3be85072023-12-04 09:58:54 +08002915 return SSL_GOT_END_OF_EARLY_DATA;
Jerry Yub4ed4602023-12-01 16:34:00 +08002916 }
2917
2918 if (ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA) {
Ronald Croned7d4bf2024-01-31 07:55:19 +01002919 if (ssl->in_offt == NULL) {
Ronald Cron85718042024-02-22 10:22:09 +01002920 MBEDTLS_SSL_DEBUG_MSG(3, ("Received early data"));
Ronald Croned7d4bf2024-01-31 07:55:19 +01002921 /* Set the reading pointer */
2922 ssl->in_offt = ssl->in_msg;
Ronald Cron85718042024-02-22 10:22:09 +01002923 ret = mbedtls_ssl_tls13_check_early_data_len(ssl, ssl->in_msglen);
2924 if (ret != 0) {
2925 return ret;
2926 }
Ronald Croned7d4bf2024-01-31 07:55:19 +01002927 }
Jerry Yub55f9eb2023-12-05 10:27:17 +08002928 return SSL_GOT_EARLY_DATA;
Jerry Yub4ed4602023-12-01 16:34:00 +08002929 }
2930
Jerry Yu7bb40a32023-12-04 10:04:15 +08002931 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
2932 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
Jerry Yub4ed4602023-12-01 16:34:00 +08002933 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
Jerry Yud5c34962023-12-01 16:32:31 +08002934}
2935
2936MBEDTLS_CHECK_RETURN_CRITICAL
2937static int ssl_tls13_parse_end_of_early_data(mbedtls_ssl_context *ssl,
2938 const unsigned char *buf,
2939 const unsigned char *end)
2940{
Jerry Yu75c9ab72023-12-01 16:41:40 +08002941 /* RFC 8446 section 4.5
2942 *
2943 * struct {} EndOfEarlyData;
2944 */
Jerry Yufbf03992023-12-04 10:00:37 +08002945 if (buf != end) {
2946 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
2947 MBEDTLS_ERR_SSL_DECODE_ERROR);
2948 return MBEDTLS_ERR_SSL_DECODE_ERROR;
2949 }
2950 return 0;
Jerry Yud5c34962023-12-01 16:32:31 +08002951}
2952
Jerry Yud5c34962023-12-01 16:32:31 +08002953/*
2954 * RFC 8446 section A.2
2955 *
2956 * | Send ServerHello
2957 * | K_send = handshake
2958 * | Send EncryptedExtensions
2959 * | [Send CertificateRequest]
2960 * Can send | [Send Certificate + CertificateVerify]
2961 * app data | Send Finished
2962 * after --> | K_send = application
2963 * here +--------+--------+
2964 * No 0-RTT | | 0-RTT
2965 * | |
2966 * K_recv = handshake | | K_recv = early data
2967 * [Skip decrypt errors] | +------> WAIT_EOED -+
2968 * | | Recv | | Recv EndOfEarlyData
2969 * | | early data | | K_recv = handshake
2970 * | +------------+ |
2971 * | |
2972 * +> WAIT_FLIGHT2 <--------+
2973 * |
2974 * +--------+--------+
2975 * No auth | | Client auth
2976 * | |
2977 * | v
2978 * | WAIT_CERT
2979 * | Recv | | Recv Certificate
2980 * | empty | v
2981 * | Certificate | WAIT_CV
2982 * | | | Recv
2983 * | v | CertificateVerify
2984 * +-> WAIT_FINISHED <---+
2985 * | Recv Finished
2986 *
2987 * The function handles actions and state changes from 0-RTT to WAIT_FLIGHT2 in
2988 * the above diagram.
2989 */
Jerry Yu87b5ed42022-12-12 13:07:07 +08002990MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu59d420f2023-12-01 16:30:34 +08002991static int ssl_tls13_process_end_of_early_data(mbedtls_ssl_context *ssl)
Jerry Yu87b5ed42022-12-12 13:07:07 +08002992{
2993 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yud5c34962023-12-01 16:32:31 +08002994
2995 MBEDTLS_SSL_DEBUG_MSG(2, ("=> ssl_tls13_process_end_of_early_data"));
2996
2997 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_end_of_early_data_coordinate(ssl));
2998
Jerry Yu3be85072023-12-04 09:58:54 +08002999 if (ret == SSL_GOT_END_OF_EARLY_DATA) {
Jerry Yud5c34962023-12-01 16:32:31 +08003000 unsigned char *buf;
3001 size_t buf_len;
3002
3003 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
3004 ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA,
3005 &buf, &buf_len));
3006
3007 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_end_of_early_data(
3008 ssl, buf, buf + buf_len));
3009
Jerry Yue9655122023-12-01 16:44:40 +08003010 MBEDTLS_SSL_DEBUG_MSG(
3011 1, ("Switch to handshake keys for inbound traffic"
3012 "( K_recv = handshake )"));
3013 mbedtls_ssl_set_inbound_transform(
3014 ssl, ssl->handshake->transform_handshake);
3015
Jerry Yud5c34962023-12-01 16:32:31 +08003016 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
3017 ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA,
3018 buf, buf_len));
Jerry Yue9655122023-12-01 16:44:40 +08003019
Jerry Yu3be85072023-12-04 09:58:54 +08003020 ssl_tls13_prepare_for_handshake_second_flight(ssl);
Jerry Yud5c34962023-12-01 16:32:31 +08003021
Jerry Yub55f9eb2023-12-05 10:27:17 +08003022 } else if (ret == SSL_GOT_EARLY_DATA) {
Jerry Yud9ca3542023-12-06 17:23:52 +08003023 ret = MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA;
3024 goto cleanup;
Jerry Yud5c34962023-12-01 16:32:31 +08003025 } else {
3026 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3027 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3028 goto cleanup;
3029 }
3030
Jerry Yud5c34962023-12-01 16:32:31 +08003031cleanup:
3032 MBEDTLS_SSL_DEBUG_MSG(2, ("<= ssl_tls13_process_end_of_early_data"));
Jerry Yu87b5ed42022-12-12 13:07:07 +08003033 return ret;
3034}
3035#endif /* MBEDTLS_SSL_EARLY_DATA */
3036
Jerry Yu69dd8d42022-04-16 12:51:26 +08003037/*
Jerry Yud6e253d2022-05-18 13:59:24 +08003038 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08003039 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003040MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003041static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08003042{
Jerry Yud6e253d2022-05-18 13:59:24 +08003043 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3044
Gilles Peskine449bd832023-01-11 14:50:10 +01003045 ret = mbedtls_ssl_tls13_process_finished_message(ssl);
3046 if (ret != 0) {
3047 return ret;
Jerry Yue3d67cb2022-05-19 15:33:10 +08003048 }
3049
Gilles Peskine449bd832023-01-11 14:50:10 +01003050 ret = mbedtls_ssl_tls13_compute_resumption_master_secret(ssl);
3051 if (ret != 0) {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00003052 MBEDTLS_SSL_DEBUG_RET(
3053 1, "mbedtls_ssl_tls13_compute_resumption_master_secret", ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01003054 }
3055
3056 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);
3057 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08003058}
3059
3060/*
Jerry Yud6e253d2022-05-18 13:59:24 +08003061 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
Jerry Yu69dd8d42022-04-16 12:51:26 +08003062 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02003063MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003064static int ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08003065{
Gilles Peskine449bd832023-01-11 14:50:10 +01003066 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done"));
Jerry Yu03ed50b2022-04-16 17:13:30 +08003067
Gilles Peskine449bd832023-01-11 14:50:10 +01003068 mbedtls_ssl_tls13_handshake_wrapup(ssl);
Jerry Yue67bef42022-07-07 07:29:42 +00003069
Pengyu Lv3643fdb2023-01-12 16:46:28 +08003070#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
3071 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Pengyu Lva1aa31b2022-12-13 13:49:59 +08003072/* TODO: Remove the check of SOME_PSK_ENABLED since SESSION_TICKETS requires
3073 * SOME_PSK_ENABLED to be enabled. Here is just to make CI happy. It is
3074 * expected to be resolved with issue#6395.
3075 */
Pengyu Lvc7af2c42022-12-01 16:33:00 +08003076 /* Sent NewSessionTicket message only when client supports PSK */
Pengyu Lvb2cfafb2023-11-14 13:56:13 +08003077 if (mbedtls_ssl_tls13_is_some_psk_supported(ssl)) {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00003078 mbedtls_ssl_handshake_set_state(
3079 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
Pengyu Lvc7af2c42022-12-01 16:33:00 +08003080 } else
Jerry Yufca4d572022-07-21 10:37:48 +08003081#endif
Pengyu Lv3643fdb2023-01-12 16:46:28 +08003082 {
3083 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3084 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003085 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08003086}
3087
3088/*
Jerry Yua8d3c502022-10-30 14:51:23 +08003089 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00003090 */
3091#define SSL_NEW_SESSION_TICKET_SKIP 0
3092#define SSL_NEW_SESSION_TICKET_WRITE 1
3093MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003094static int ssl_tls13_write_new_session_ticket_coordinate(mbedtls_ssl_context *ssl)
Jerry Yue67bef42022-07-07 07:29:42 +00003095{
3096 /* Check whether the use of session tickets is enabled */
Gilles Peskine449bd832023-01-11 14:50:10 +01003097 if (ssl->conf->f_ticket_write == NULL) {
3098 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
3099 " callback is not set"));
3100 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yud0766ec2022-09-22 10:46:57 +08003101 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003102 if (ssl->conf->new_session_tickets_count == 0) {
3103 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
3104 " configured count is zero"));
3105 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yud0766ec2022-09-22 10:46:57 +08003106 }
3107
Gilles Peskine449bd832023-01-11 14:50:10 +01003108 if (ssl->handshake->new_session_tickets_count == 0) {
3109 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: all tickets have "
3110 "been sent."));
3111 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yue67bef42022-07-07 07:29:42 +00003112 }
3113
Gilles Peskine449bd832023-01-11 14:50:10 +01003114 return SSL_NEW_SESSION_TICKET_WRITE;
Jerry Yue67bef42022-07-07 07:29:42 +00003115}
3116
3117#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3118MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003119static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
3120 unsigned char *ticket_nonce,
3121 size_t ticket_nonce_size)
Jerry Yue67bef42022-07-07 07:29:42 +00003122{
3123 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3124 mbedtls_ssl_session *session = ssl->session;
3125 mbedtls_ssl_ciphersuite_t *ciphersuite_info;
3126 psa_algorithm_t psa_hash_alg;
3127 int hash_length;
3128
Gilles Peskine449bd832023-01-11 14:50:10 +01003129 MBEDTLS_SSL_DEBUG_MSG(2, ("=> prepare NewSessionTicket msg"));
Jerry Yue67bef42022-07-07 07:29:42 +00003130
Pengyu Lv9f926952022-11-17 15:22:33 +08003131 /* Set ticket_flags depends on the advertised psk key exchange mode */
Pengyu Lv94a42cc2023-12-06 10:04:17 +08003132 mbedtls_ssl_tls13_session_clear_ticket_flags(
Pengyu Lv9eacb442022-12-09 14:39:19 +08003133 session, MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
Pengyu Lve6487fe2022-12-06 09:30:29 +08003134#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Pengyu Lv94a42cc2023-12-06 10:04:17 +08003135 mbedtls_ssl_tls13_session_set_ticket_flags(
Pengyu Lv9eacb442022-12-09 14:39:19 +08003136 session, ssl->handshake->tls13_kex_modes);
Pengyu Lve6487fe2022-12-06 09:30:29 +08003137#endif
Jerry Yu95648b02023-12-06 15:03:34 +08003138
3139#if defined(MBEDTLS_SSL_EARLY_DATA)
3140 if (ssl->conf->early_data_enabled == MBEDTLS_SSL_EARLY_DATA_ENABLED &&
3141 ssl->conf->max_early_data_size > 0) {
Pengyu Lv94a42cc2023-12-06 10:04:17 +08003142 mbedtls_ssl_tls13_session_set_ticket_flags(
Jerry Yu95648b02023-12-06 15:03:34 +08003143 session, MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA);
Ronald Cronc2865192024-02-07 14:01:03 +01003144 session->max_early_data_size = ssl->conf->max_early_data_size;
Jerry Yu95648b02023-12-06 15:03:34 +08003145 }
3146#endif /* MBEDTLS_SSL_EARLY_DATA */
3147
Pengyu Lv4938a562023-01-16 11:28:49 +08003148 MBEDTLS_SSL_PRINT_TICKET_FLAGS(4, session->ticket_flags);
Pengyu Lv9f926952022-11-17 15:22:33 +08003149
Waleed Elmelegy2824a202024-02-23 17:51:47 +00003150#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_ALPN)
3151 if (ssl->alpn_chosen != NULL) {
3152 session->alpn = mbedtls_calloc(strlen(ssl->alpn_chosen) + 1, sizeof(char));
3153 if (session->alpn == NULL) {
3154 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
3155 }
3156 memcpy(session->alpn, ssl->alpn_chosen, strlen(ssl->alpn_chosen) + 1);
3157 }
3158#endif
3159
Jerry Yue67bef42022-07-07 07:29:42 +00003160 /* Generate ticket_age_add */
Gilles Peskine449bd832023-01-11 14:50:10 +01003161 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
3162 (unsigned char *) &session->ticket_age_add,
3163 sizeof(session->ticket_age_add)) != 0)) {
3164 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
3165 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00003166 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003167 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
3168 (unsigned int) session->ticket_age_add));
Jerry Yue67bef42022-07-07 07:29:42 +00003169
3170 /* Generate ticket_nonce */
Gilles Peskine449bd832023-01-11 14:50:10 +01003171 ret = ssl->conf->f_rng(ssl->conf->p_rng, ticket_nonce, ticket_nonce_size);
3172 if (ret != 0) {
3173 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_nonce", ret);
3174 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00003175 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003176 MBEDTLS_SSL_DEBUG_BUF(3, "ticket_nonce:",
3177 ticket_nonce, ticket_nonce_size);
Jerry Yue67bef42022-07-07 07:29:42 +00003178
3179 ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01003180 (mbedtls_ssl_ciphersuite_t *) ssl->handshake->ciphersuite_info;
Dave Rodgman2eab4622023-10-05 13:30:37 +01003181 psa_hash_alg = mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01003182 hash_length = PSA_HASH_LENGTH(psa_hash_alg);
3183 if (hash_length == -1 ||
3184 (size_t) hash_length > sizeof(session->resumption_key)) {
3185 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yufca4d572022-07-21 10:37:48 +08003186 }
3187
Jerry Yue67bef42022-07-07 07:29:42 +00003188 /* In this code the psk key length equals the length of the hash */
3189 session->resumption_key_len = hash_length;
3190 session->ciphersuite = ciphersuite_info->id;
3191
3192 /* Compute resumption key
3193 *
3194 * HKDF-Expand-Label( resumption_master_secret,
3195 * "resumption", ticket_nonce, Hash.length )
3196 */
3197 ret = mbedtls_ssl_tls13_hkdf_expand_label(
Gilles Peskine449bd832023-01-11 14:50:10 +01003198 psa_hash_alg,
3199 session->app_secrets.resumption_master_secret,
3200 hash_length,
3201 MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(resumption),
3202 ticket_nonce,
3203 ticket_nonce_size,
3204 session->resumption_key,
3205 hash_length);
Jerry Yue67bef42022-07-07 07:29:42 +00003206
Gilles Peskine449bd832023-01-11 14:50:10 +01003207 if (ret != 0) {
3208 MBEDTLS_SSL_DEBUG_RET(2,
3209 "Creating the ticket-resumed PSK failed",
3210 ret);
3211 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00003212 }
Gilles Peskine449bd832023-01-11 14:50:10 +01003213 MBEDTLS_SSL_DEBUG_BUF(3, "Ticket-resumed PSK",
3214 session->resumption_key,
3215 session->resumption_key_len);
Jerry Yue67bef42022-07-07 07:29:42 +00003216
Gilles Peskine449bd832023-01-11 14:50:10 +01003217 MBEDTLS_SSL_DEBUG_BUF(3, "resumption_master_secret",
3218 session->app_secrets.resumption_master_secret,
3219 hash_length);
Jerry Yue67bef42022-07-07 07:29:42 +00003220
Gilles Peskine449bd832023-01-11 14:50:10 +01003221 return 0;
Jerry Yue67bef42022-07-07 07:29:42 +00003222}
3223
3224/* This function creates a NewSessionTicket message in the following format:
3225 *
3226 * struct {
3227 * uint32 ticket_lifetime;
3228 * uint32 ticket_age_add;
3229 * opaque ticket_nonce<0..255>;
3230 * opaque ticket<1..2^16-1>;
3231 * Extension extensions<0..2^16-2>;
3232 * } NewSessionTicket;
3233 *
3234 * The ticket inside the NewSessionTicket message is an encrypted container
3235 * carrying the necessary information so that the server is later able to
3236 * re-start the communication.
3237 *
3238 * The following fields are placed inside the ticket by the
3239 * f_ticket_write() function:
3240 *
Jerry Yu0069abc2023-11-23 21:07:28 +08003241 * - creation time (ticket_creation_time)
3242 * - flags (ticket_flags)
Jerry Yue67bef42022-07-07 07:29:42 +00003243 * - age add (ticket_age_add)
Jerry Yu0069abc2023-11-23 21:07:28 +08003244 * - key (resumption_key)
3245 * - key length (resumption_key_len)
Jerry Yue67bef42022-07-07 07:29:42 +00003246 * - ciphersuite (ciphersuite)
Jerry Yu0069abc2023-11-23 21:07:28 +08003247 * - max_early_data_size (max_early_data_size)
Jerry Yue67bef42022-07-07 07:29:42 +00003248 */
3249MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01003250static int ssl_tls13_write_new_session_ticket_body(mbedtls_ssl_context *ssl,
3251 unsigned char *buf,
3252 unsigned char *end,
3253 size_t *out_len,
3254 unsigned char *ticket_nonce,
3255 size_t ticket_nonce_size)
Jerry Yue67bef42022-07-07 07:29:42 +00003256{
3257 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3258 unsigned char *p = buf;
3259 mbedtls_ssl_session *session = ssl->session;
3260 size_t ticket_len;
3261 uint32_t ticket_lifetime;
Jerry Yu01da35e2022-12-12 15:09:22 +08003262 unsigned char *p_extensions_len;
Jerry Yue67bef42022-07-07 07:29:42 +00003263
3264 *out_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003265 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write NewSessionTicket msg"));
Jerry Yue67bef42022-07-07 07:29:42 +00003266
3267 /*
3268 * ticket_lifetime 4 bytes
3269 * ticket_age_add 4 bytes
3270 * ticket_nonce 1 + ticket_nonce_size bytes
3271 * ticket >=2 bytes
3272 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003273 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4 + 4 + 1 + ticket_nonce_size + 2);
Jerry Yue67bef42022-07-07 07:29:42 +00003274
3275 /* Generate ticket and ticket_lifetime */
Ronald Cron3c0072b2023-11-22 10:00:14 +01003276#if defined(MBEDTLS_HAVE_TIME)
3277 session->ticket_creation_time = mbedtls_ms_time();
3278#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01003279 ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket,
3280 session,
3281 p + 9 + ticket_nonce_size + 2,
3282 end,
3283 &ticket_len,
3284 &ticket_lifetime);
3285 if (ret != 0) {
3286 MBEDTLS_SSL_DEBUG_RET(1, "write_ticket", ret);
3287 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00003288 }
3289 /* RFC 8446 4.6.1
3290 * ticket_lifetime: Indicates the lifetime in seconds as a 32-bit
3291 * unsigned integer in network byte order from the time of ticket
3292 * issuance. Servers MUST NOT use any value greater than
3293 * 604800 seconds (7 days). The value of zero indicates that the
3294 * ticket should be discarded immediately. Clients MUST NOT cache
3295 * tickets for longer than 7 days, regardless of the ticket_lifetime,
3296 * and MAY delete tickets earlier based on local policy. A server
3297 * MAY treat a ticket as valid for a shorter period of time than what
3298 * is stated in the ticket_lifetime.
3299 */
Jerry Yu8e0174a2023-11-10 13:58:16 +08003300 if (ticket_lifetime > MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME) {
3301 ticket_lifetime = MBEDTLS_SSL_TLS1_3_MAX_ALLOWED_TICKET_LIFETIME;
Gilles Peskine449bd832023-01-11 14:50:10 +01003302 }
3303 MBEDTLS_PUT_UINT32_BE(ticket_lifetime, p, 0);
3304 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_lifetime: %u",
3305 (unsigned int) ticket_lifetime));
Jerry Yue67bef42022-07-07 07:29:42 +00003306
3307 /* Write ticket_age_add */
Gilles Peskine449bd832023-01-11 14:50:10 +01003308 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 4);
3309 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
3310 (unsigned int) session->ticket_age_add));
Jerry Yue67bef42022-07-07 07:29:42 +00003311
3312 /* Write ticket_nonce */
Gilles Peskine449bd832023-01-11 14:50:10 +01003313 p[8] = (unsigned char) ticket_nonce_size;
3314 if (ticket_nonce_size > 0) {
3315 memcpy(p + 9, ticket_nonce, ticket_nonce_size);
Jerry Yue67bef42022-07-07 07:29:42 +00003316 }
3317 p += 9 + ticket_nonce_size;
3318
3319 /* Write ticket */
Gilles Peskine449bd832023-01-11 14:50:10 +01003320 MBEDTLS_PUT_UINT16_BE(ticket_len, p, 0);
Jerry Yue67bef42022-07-07 07:29:42 +00003321 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01003322 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", p, ticket_len);
Jerry Yue67bef42022-07-07 07:29:42 +00003323 p += ticket_len;
3324
3325 /* Ticket Extensions
3326 *
Jerry Yu01da35e2022-12-12 15:09:22 +08003327 * Extension extensions<0..2^16-2>;
Jerry Yue67bef42022-07-07 07:29:42 +00003328 */
Jerry Yuedab6372022-10-31 14:37:31 +08003329 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
3330
Gilles Peskine449bd832023-01-11 14:50:10 +01003331 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yu01da35e2022-12-12 15:09:22 +08003332 p_extensions_len = p;
Jerry Yue67bef42022-07-07 07:29:42 +00003333 p += 2;
3334
Jerry Yu01da35e2022-12-12 15:09:22 +08003335#if defined(MBEDTLS_SSL_EARLY_DATA)
Pengyu Lv94a42cc2023-12-06 10:04:17 +08003336 if (mbedtls_ssl_tls13_session_ticket_allow_early_data(session)) {
Jerry Yu95648b02023-12-06 15:03:34 +08003337 size_t output_len;
3338
Jerry Yuf135bac2023-11-23 18:10:51 +08003339 if ((ret = mbedtls_ssl_tls13_write_early_data_ext(
Jerry Yuc59c5862023-12-05 10:40:49 +08003340 ssl, 1, p, end, &output_len)) != 0) {
Jerry Yuf135bac2023-11-23 18:10:51 +08003341 MBEDTLS_SSL_DEBUG_RET(
3342 1, "mbedtls_ssl_tls13_write_early_data_ext", ret);
3343 return ret;
3344 }
3345 p += output_len;
Jerry Yu9e7f9bc2023-11-27 16:52:07 +08003346 } else {
3347 MBEDTLS_SSL_DEBUG_MSG(
3348 4, ("early_data not allowed, "
3349 "skip early_data extension in NewSessionTicket"));
Jerry Yu01da35e2022-12-12 15:09:22 +08003350 }
Jerry Yuf135bac2023-11-23 18:10:51 +08003351
Jerry Yu01da35e2022-12-12 15:09:22 +08003352#endif /* MBEDTLS_SSL_EARLY_DATA */
3353
3354 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
3355
Jerry Yue67bef42022-07-07 07:29:42 +00003356 *out_len = p - buf;
Gilles Peskine449bd832023-01-11 14:50:10 +01003357 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", buf, *out_len);
3358 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket"));
Jerry Yue67bef42022-07-07 07:29:42 +00003359
Jerry Yu7de2ff02022-11-08 21:43:46 +08003360 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01003361 3, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08003362
Gilles Peskine449bd832023-01-11 14:50:10 +01003363 return 0;
Jerry Yue67bef42022-07-07 07:29:42 +00003364}
3365
3366/*
Jerry Yua8d3c502022-10-30 14:51:23 +08003367 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00003368 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003369static int ssl_tls13_write_new_session_ticket(mbedtls_ssl_context *ssl)
Jerry Yue67bef42022-07-07 07:29:42 +00003370{
3371 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3372
Gilles Peskine449bd832023-01-11 14:50:10 +01003373 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_write_new_session_ticket_coordinate(ssl));
Jerry Yue67bef42022-07-07 07:29:42 +00003374
Gilles Peskine449bd832023-01-11 14:50:10 +01003375 if (ret == SSL_NEW_SESSION_TICKET_WRITE) {
Jerry Yue67bef42022-07-07 07:29:42 +00003376 unsigned char ticket_nonce[MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH];
3377 unsigned char *buf;
3378 size_t buf_len, msg_len;
3379
Gilles Peskine449bd832023-01-11 14:50:10 +01003380 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_new_session_ticket(
3381 ssl, ticket_nonce, sizeof(ticket_nonce)));
Jerry Yue67bef42022-07-07 07:29:42 +00003382
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00003383 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
3384 ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
3385 &buf, &buf_len));
Jerry Yue67bef42022-07-07 07:29:42 +00003386
Gilles Peskine449bd832023-01-11 14:50:10 +01003387 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_new_session_ticket_body(
3388 ssl, buf, buf + buf_len, &msg_len,
3389 ticket_nonce, sizeof(ticket_nonce)));
Jerry Yue67bef42022-07-07 07:29:42 +00003390
Gilles Peskine449bd832023-01-11 14:50:10 +01003391 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
3392 ssl, buf_len, msg_len));
Jerry Yufca4d572022-07-21 10:37:48 +08003393
Jerry Yu359e65f2022-09-22 23:47:43 +08003394 /* Limit session tickets count to one when resumption connection.
3395 *
3396 * See document of mbedtls_ssl_conf_new_session_tickets.
3397 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003398 if (ssl->handshake->resume == 1) {
Jerry Yu359e65f2022-09-22 23:47:43 +08003399 ssl->handshake->new_session_tickets_count = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003400 } else {
Jerry Yu359e65f2022-09-22 23:47:43 +08003401 ssl->handshake->new_session_tickets_count--;
Gilles Peskine449bd832023-01-11 14:50:10 +01003402 }
Jerry Yub7e3fa72022-09-22 11:07:18 +08003403
Jerry Yua8d3c502022-10-30 14:51:23 +08003404 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003405 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH);
3406 } else {
3407 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
Jerry Yue67bef42022-07-07 07:29:42 +00003408 }
3409
Jerry Yue67bef42022-07-07 07:29:42 +00003410cleanup:
3411
Gilles Peskine449bd832023-01-11 14:50:10 +01003412 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00003413}
3414#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3415
3416/*
XiaokangQiane8ff3502022-04-22 02:34:40 +00003417 * TLS 1.3 State Machine -- server side
XiaokangQian7807f9f2022-02-15 10:04:37 +00003418 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003419int mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context *ssl)
Jerry Yub9930e72021-08-06 17:11:51 +08003420{
XiaokangQian08037552022-04-20 07:16:41 +00003421 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003422
Gilles Peskine449bd832023-01-11 14:50:10 +01003423 if (ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL) {
3424 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3425 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00003426
Gilles Peskine449bd832023-01-11 14:50:10 +01003427 MBEDTLS_SSL_DEBUG_MSG(2, ("tls13 server state: %s(%d)",
Dave Rodgman2eab4622023-10-05 13:30:37 +01003428 mbedtls_ssl_states_str((mbedtls_ssl_states) ssl->state),
Gilles Peskine449bd832023-01-11 14:50:10 +01003429 ssl->state));
Jerry Yu6e81b272021-09-27 11:16:17 +08003430
Gilles Peskine449bd832023-01-11 14:50:10 +01003431 switch (ssl->state) {
XiaokangQian7807f9f2022-02-15 10:04:37 +00003432 /* start state */
3433 case MBEDTLS_SSL_HELLO_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003434 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
XiaokangQian08037552022-04-20 07:16:41 +00003435 ret = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003436 break;
3437
XiaokangQian7807f9f2022-02-15 10:04:37 +00003438 case MBEDTLS_SSL_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003439 ret = ssl_tls13_process_client_hello(ssl);
3440 if (ret != 0) {
3441 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_process_client_hello", ret);
3442 }
Jerry Yuf41553b2022-05-09 22:20:30 +08003443 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003444
Jerry Yuf41553b2022-05-09 22:20:30 +08003445 case MBEDTLS_SSL_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003446 ret = ssl_tls13_write_hello_retry_request(ssl);
3447 if (ret != 0) {
3448 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_hello_retry_request", ret);
3449 return ret;
Jerry Yuf41553b2022-05-09 22:20:30 +08003450 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00003451 break;
3452
Jerry Yu5b64ae92022-03-30 17:15:02 +08003453 case MBEDTLS_SSL_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003454 ret = ssl_tls13_write_server_hello(ssl);
Jerry Yu5b64ae92022-03-30 17:15:02 +08003455 break;
3456
Xiaofei Baicba64af2022-02-15 10:00:56 +00003457 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +01003458 ret = ssl_tls13_write_encrypted_extensions(ssl);
3459 if (ret != 0) {
3460 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_encrypted_extensions", ret);
3461 return ret;
Xiaofei Baicba64af2022-02-15 10:00:56 +00003462 }
Jerry Yu48330562022-05-06 21:35:44 +08003463 break;
Jerry Yu6a2cd9e2022-05-05 11:14:19 +08003464
Ronald Cron928cbd32022-10-04 16:14:26 +02003465#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00003466 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003467 ret = ssl_tls13_write_certificate_request(ssl);
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00003468 break;
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00003469
Jerry Yu83da34e2022-04-16 13:59:52 +08003470 case MBEDTLS_SSL_SERVER_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +01003471 ret = ssl_tls13_write_server_certificate(ssl);
Jerry Yu83da34e2022-04-16 13:59:52 +08003472 break;
3473
3474 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Gilles Peskine449bd832023-01-11 14:50:10 +01003475 ret = ssl_tls13_write_certificate_verify(ssl);
Jerry Yu83da34e2022-04-16 13:59:52 +08003476 break;
Ronald Cron928cbd32022-10-04 16:14:26 +02003477#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08003478
Gilles Peskine449bd832023-01-11 14:50:10 +01003479 /*
3480 * Injection of dummy-CCS's for middlebox compatibility
3481 */
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003482#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
Gabor Mezeif7044ea2022-06-28 16:01:49 +02003483 case MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003484 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3485 if (ret == 0) {
3486 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
3487 }
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003488 break;
3489
3490 case MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO:
Ronald Crone273f722024-02-13 18:22:26 +01003491 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3492 if (ret != 0) {
3493 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01003494 }
Ronald Cronfe59ff72024-01-24 14:31:50 +01003495 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003496 break;
3497#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
3498
Jerry Yu69dd8d42022-04-16 12:51:26 +08003499 case MBEDTLS_SSL_SERVER_FINISHED:
Gilles Peskine449bd832023-01-11 14:50:10 +01003500 ret = ssl_tls13_write_server_finished(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003501 break;
3502
Jerry Yu87b5ed42022-12-12 13:07:07 +08003503#if defined(MBEDTLS_SSL_EARLY_DATA)
3504 case MBEDTLS_SSL_END_OF_EARLY_DATA:
Jerry Yu59d420f2023-12-01 16:30:34 +08003505 ret = ssl_tls13_process_end_of_early_data(ssl);
Jerry Yu87b5ed42022-12-12 13:07:07 +08003506 break;
3507#endif /* MBEDTLS_SSL_EARLY_DATA */
3508
Jerry Yu69dd8d42022-04-16 12:51:26 +08003509 case MBEDTLS_SSL_CLIENT_FINISHED:
Gilles Peskine449bd832023-01-11 14:50:10 +01003510 ret = ssl_tls13_process_client_finished(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003511 break;
3512
Jerry Yu69dd8d42022-04-16 12:51:26 +08003513 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Gilles Peskine449bd832023-01-11 14:50:10 +01003514 ret = ssl_tls13_handshake_wrapup(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003515 break;
3516
Ronald Cron766c0cd2022-10-18 12:17:11 +02003517#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQian6b916b12022-04-25 07:29:34 +00003518 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +01003519 ret = mbedtls_ssl_tls13_process_certificate(ssl);
3520 if (ret == 0) {
3521 if (ssl->session_negotiate->peer_cert != NULL) {
Ronald Cron209cae92022-06-07 10:30:19 +02003522 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003523 ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY);
3524 } else {
3525 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
Ronald Cron209cae92022-06-07 10:30:19 +02003526 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003527 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
Ronald Cron19385882022-06-15 16:26:13 +02003528 }
XiaokangQian6b916b12022-04-25 07:29:34 +00003529 }
3530 break;
3531
3532 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
Gilles Peskine449bd832023-01-11 14:50:10 +01003533 ret = mbedtls_ssl_tls13_process_certificate_verify(ssl);
3534 if (ret == 0) {
XiaokangQian6b916b12022-04-25 07:29:34 +00003535 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003536 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
XiaokangQian6b916b12022-04-25 07:29:34 +00003537 }
3538 break;
Ronald Cron766c0cd2022-10-18 12:17:11 +02003539#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian6b916b12022-04-25 07:29:34 +00003540
Jerry Yue67bef42022-07-07 07:29:42 +00003541#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yua8d3c502022-10-30 14:51:23 +08003542 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +01003543 ret = ssl_tls13_write_new_session_ticket(ssl);
3544 if (ret != 0) {
3545 MBEDTLS_SSL_DEBUG_RET(1,
3546 "ssl_tls13_write_new_session_ticket ",
3547 ret);
Jerry Yue67bef42022-07-07 07:29:42 +00003548 }
3549 break;
Jerry Yua8d3c502022-10-30 14:51:23 +08003550 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH:
Jerry Yue67bef42022-07-07 07:29:42 +00003551 /* This state is necessary to do the flush of the New Session
Jerry Yua8d3c502022-10-30 14:51:23 +08003552 * Ticket message written in MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00003553 * as part of ssl_prepare_handshake_step.
3554 */
3555 ret = 0;
Jerry Yud4e75002022-08-09 13:33:50 +08003556
Gilles Peskine449bd832023-01-11 14:50:10 +01003557 if (ssl->handshake->new_session_tickets_count == 0) {
3558 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3559 } else {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00003560 mbedtls_ssl_handshake_set_state(
3561 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
Gilles Peskine449bd832023-01-11 14:50:10 +01003562 }
Jerry Yue67bef42022-07-07 07:29:42 +00003563 break;
3564
3565#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3566
XiaokangQian7807f9f2022-02-15 10:04:37 +00003567 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003568 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state));
3569 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003570 }
3571
Gilles Peskine449bd832023-01-11 14:50:10 +01003572 return ret;
Jerry Yub9930e72021-08-06 17:11:51 +08003573}
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003574
Jerry Yufb4b6472022-01-27 15:03:26 +08003575#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */