blob: 9a706b1cf3bf2f1fae4d8ebba90e44f6d67c2765 [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
Jerry Yub9930e72021-08-06 17:11:51 +08002 * TLS 1.3 server-side functions
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Gilles Peskine449bd832023-01-11 14:50:10 +010018 */
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080019
20#include "common.h"
21
Jerry Yufb4b6472022-01-27 15:03:26 +080022#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080023
Jerry Yu687101b2021-09-14 16:03:56 +080024#include "mbedtls/debug.h"
Xiaofei Baicba64af2022-02-15 10:00:56 +000025#include "mbedtls/error.h"
26#include "mbedtls/platform.h"
Jerry Yu1c105562022-07-10 06:32:38 +000027#include "mbedtls/constant_time.h"
Jerry Yu3bf2c642022-03-30 22:02:12 +080028
Xiaofei Bai9ca09d42022-02-14 12:57:18 +000029#include "ssl_misc.h"
30#include "ssl_tls13_keys.h"
31#include "ssl_debug_helpers.h"
32
Jerry Yuf35ba382022-08-23 17:58:26 +080033
Jerry Yuc5a23a02022-08-25 10:51:44 +080034static const mbedtls_ssl_ciphersuite_t *ssl_tls13_validate_peer_ciphersuite(
Gilles Peskine449bd832023-01-11 14:50:10 +010035 mbedtls_ssl_context *ssl,
36 unsigned int cipher_suite)
Jerry Yuf35ba382022-08-23 17:58:26 +080037{
38 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +010039 if (!mbedtls_ssl_tls13_cipher_suite_is_offered(ssl, cipher_suite)) {
40 return NULL;
Jerry Yuf35ba382022-08-23 17:58:26 +080041 }
Gilles Peskine449bd832023-01-11 14:50:10 +010042
43 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(cipher_suite);
44 if ((mbedtls_ssl_validate_ciphersuite(ssl, ciphersuite_info,
45 ssl->tls_version,
46 ssl->tls_version) != 0)) {
47 return NULL;
48 }
49 return ciphersuite_info;
Jerry Yuf35ba382022-08-23 17:58:26 +080050}
51
Ronald Cron41a443a2022-10-04 16:38:25 +020052#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yue19e3b92022-07-08 12:04:51 +000053/* From RFC 8446:
54 *
55 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
56 * struct {
57 * PskKeyExchangeMode ke_modes<1..255>;
58 * } PskKeyExchangeModes;
59 */
Jerry Yu6e74a7e2022-07-20 20:49:32 +080060MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +010061static int ssl_tls13_parse_key_exchange_modes_ext(mbedtls_ssl_context *ssl,
62 const unsigned char *buf,
63 const unsigned char *end)
Jerry Yue19e3b92022-07-08 12:04:51 +000064{
Jerry Yu299e31f2022-07-13 23:06:36 +080065 const unsigned char *p = buf;
Jerry Yue19e3b92022-07-08 12:04:51 +000066 size_t ke_modes_len;
67 int ke_modes = 0;
68
Jerry Yu854dd9e2022-07-15 14:28:27 +080069 /* Read ke_modes length (1 Byte) */
Gilles Peskine449bd832023-01-11 14:50:10 +010070 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
Jerry Yu299e31f2022-07-13 23:06:36 +080071 ke_modes_len = *p++;
Jerry Yue19e3b92022-07-08 12:04:51 +000072 /* Currently, there are only two PSK modes, so even without looking
73 * at the content, something's wrong if the list has more than 2 items. */
Gilles Peskine449bd832023-01-11 14:50:10 +010074 if (ke_modes_len > 2) {
75 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
76 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
77 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu299e31f2022-07-13 23:06:36 +080078 }
Jerry Yue19e3b92022-07-08 12:04:51 +000079
Gilles Peskine449bd832023-01-11 14:50:10 +010080 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, ke_modes_len);
Jerry Yue19e3b92022-07-08 12:04:51 +000081
Gilles Peskine449bd832023-01-11 14:50:10 +010082 while (ke_modes_len-- != 0) {
83 switch (*p++) {
84 case MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE:
85 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
86 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK KEX MODE"));
87 break;
88 case MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE:
89 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
90 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK_EPHEMERAL KEX MODE"));
91 break;
92 default:
93 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
94 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
95 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yue19e3b92022-07-08 12:04:51 +000096 }
97 }
98
99 ssl->handshake->tls13_kex_modes = ke_modes;
Gilles Peskine449bd832023-01-11 14:50:10 +0100100 return 0;
Jerry Yue19e3b92022-07-08 12:04:51 +0000101}
Jerry Yu1c105562022-07-10 06:32:38 +0000102
Jerry Yue9d4fc02022-08-20 19:21:15 +0800103#define SSL_TLS1_3_OFFERED_PSK_NOT_MATCH 1
104#define SSL_TLS1_3_OFFERED_PSK_MATCH 0
Jerry Yu95699e72022-08-21 19:22:23 +0800105
106#if defined(MBEDTLS_SSL_SESSION_TICKETS)
107
108MBEDTLS_CHECK_RETURN_CRITICAL
109static int ssl_tls13_offered_psks_check_identity_match_ticket(
Gilles Peskine449bd832023-01-11 14:50:10 +0100110 mbedtls_ssl_context *ssl,
111 const unsigned char *identity,
112 size_t identity_len,
113 uint32_t obfuscated_ticket_age,
114 mbedtls_ssl_session *session)
Jerry Yu95699e72022-08-21 19:22:23 +0800115{
Jerry Yufd310eb2022-09-06 09:16:35 +0800116 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu95699e72022-08-21 19:22:23 +0800117 unsigned char *ticket_buffer;
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800118#if defined(MBEDTLS_HAVE_TIME)
119 mbedtls_time_t now;
Jerry Yuacff8232022-09-14 14:35:11 +0800120 uint64_t age_in_s;
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800121 int64_t age_diff_in_ms;
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800122#endif
Jerry Yu95699e72022-08-21 19:22:23 +0800123
124 ((void) obfuscated_ticket_age);
125
Gilles Peskine449bd832023-01-11 14:50:10 +0100126 MBEDTLS_SSL_DEBUG_MSG(2, ("=> check_identity_match_ticket"));
Jerry Yu95699e72022-08-21 19:22:23 +0800127
Jerry Yufd310eb2022-09-06 09:16:35 +0800128 /* Ticket parser is not configured, Skip */
Gilles Peskine449bd832023-01-11 14:50:10 +0100129 if (ssl->conf->f_ticket_parse == NULL || identity_len == 0) {
130 return 0;
131 }
Jerry Yu95699e72022-08-21 19:22:23 +0800132
Jerry Yu4746b102022-09-13 11:11:48 +0800133 /* We create a copy of the encrypted ticket since the ticket parsing
134 * function is allowed to use its input buffer as an output buffer
135 * (in-place decryption). We do, however, need the original buffer for
136 * computing the PSK binder value.
Jerry Yu95699e72022-08-21 19:22:23 +0800137 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100138 ticket_buffer = mbedtls_calloc(1, identity_len);
139 if (ticket_buffer == NULL) {
140 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
141 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Jerry Yu95699e72022-08-21 19:22:23 +0800142 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100143 memcpy(ticket_buffer, identity, identity_len);
Jerry Yu95699e72022-08-21 19:22:23 +0800144
Gilles Peskine449bd832023-01-11 14:50:10 +0100145 if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket,
146 session,
147 ticket_buffer, identity_len)) != 0) {
148 if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) {
149 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic"));
150 } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) {
151 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired"));
152 } else {
153 MBEDTLS_SSL_DEBUG_RET(1, "ticket_parse", ret);
154 }
Jerry Yu95699e72022-08-21 19:22:23 +0800155 }
156
157 /* We delete the temporary buffer */
Gilles Peskine449bd832023-01-11 14:50:10 +0100158 mbedtls_free(ticket_buffer);
Jerry Yu95699e72022-08-21 19:22:23 +0800159
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 if (ret != 0) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800161 goto exit;
162 }
Jerry Yu95699e72022-08-21 19:22:23 +0800163
Pengyu Lv3eb49be2022-12-05 16:35:12 +0800164 /* RFC 8446 section 4.2.9
165 *
166 * Servers SHOULD NOT send NewSessionTicket with tickets that are not
167 * compatible with the advertised modes; however, if a server does so,
168 * the impact will just be that the client's attempts at resumption fail.
169 *
170 * We regard the ticket with incompatible key exchange modes as not match.
171 */
Pengyu Lv18946532023-01-12 12:28:09 +0800172 ret = MBEDTLS_ERR_ERROR_GENERIC_ERROR;
Pengyu Lv4938a562023-01-16 11:28:49 +0800173 MBEDTLS_SSL_PRINT_TICKET_FLAGS(4,
Pengyu Lv80270b22023-01-12 11:54:04 +0800174 session->ticket_flags);
Pengyu Lve2f1dbf2023-01-16 12:28:27 +0800175 if (mbedtls_ssl_tls13_check_kex_modes(
176 ssl,
177 mbedtls_ssl_session_get_ticket_flags(
178 session,
179 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL))) {
Pengyu Lv3eb49be2022-12-05 16:35:12 +0800180 MBEDTLS_SSL_DEBUG_MSG(3, ("No suitable key exchange mode"));
181 goto exit;
182 }
183
Gilles Peskine449bd832023-01-11 14:50:10 +0100184 ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED;
185#if defined(MBEDTLS_HAVE_TIME)
186 now = mbedtls_time(NULL);
187
188 if (now < session->start) {
189 MBEDTLS_SSL_DEBUG_MSG(
190 3, ("Invalid ticket start time ( now=%" MBEDTLS_PRINTF_LONGLONG
191 ", start=%" MBEDTLS_PRINTF_LONGLONG " )",
192 (long long) now, (long long) session->start));
193 goto exit;
194 }
195
196 age_in_s = (uint64_t) (now - session->start);
Jerry Yu95699e72022-08-21 19:22:23 +0800197
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800198 /* RFC 8446 section 4.6.1
199 *
200 * Servers MUST NOT use any value greater than 604800 seconds (7 days).
201 *
202 * RFC 8446 section 4.2.11.1
203 *
204 * Clients MUST NOT attempt to use tickets which have ages greater than
205 * the "ticket_lifetime" value which was provided with the ticket.
206 *
207 * For time being, the age MUST be less than 604800 seconds (7 days).
208 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100209 if (age_in_s > 604800) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800210 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +0100211 3, ("Ticket age exceeds limitation ticket_age=%lu",
212 (long unsigned int) age_in_s));
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800213 goto exit;
214 }
Jerry Yu95699e72022-08-21 19:22:23 +0800215
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800216 /* RFC 8446 section 4.2.10
217 *
218 * For PSKs provisioned via NewSessionTicket, a server MUST validate that
219 * the ticket age for the selected PSK identity (computed by subtracting
220 * ticket_age_add from PskIdentity.obfuscated_ticket_age modulo 2^32) is
221 * within a small tolerance of the time since the ticket was issued.
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800222 *
Jerry Yu0a55cc62022-09-15 16:15:06 +0800223 * NOTE: When `now == session->start`, `age_diff_in_ms` may be negative
224 * as the age units are different on the server (s) and in the
225 * client (ms) side. Add a -1000 ms tolerance window to take this
226 * into account.
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800227 */
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800228 age_diff_in_ms = age_in_s * 1000;
Gilles Peskine449bd832023-01-11 14:50:10 +0100229 age_diff_in_ms -= (obfuscated_ticket_age - session->ticket_age_add);
230 if (age_diff_in_ms <= -1000 ||
231 age_diff_in_ms > MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800232 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +0100233 3, ("Ticket age outside tolerance window ( diff=%d )",
234 (int) age_diff_in_ms));
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800235 goto exit;
236 }
237
238 ret = 0;
Jerry Yu95699e72022-08-21 19:22:23 +0800239
240#endif /* MBEDTLS_HAVE_TIME */
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800241
242exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100243 if (ret != 0) {
244 mbedtls_ssl_session_free(session);
245 }
Jerry Yu95699e72022-08-21 19:22:23 +0800246
Gilles Peskine449bd832023-01-11 14:50:10 +0100247 MBEDTLS_SSL_DEBUG_MSG(2, ("<= check_identity_match_ticket"));
248 return ret;
Jerry Yu95699e72022-08-21 19:22:23 +0800249}
250#endif /* MBEDTLS_SSL_SESSION_TICKETS */
251
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800252MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu1c105562022-07-10 06:32:38 +0000253static int ssl_tls13_offered_psks_check_identity_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100254 mbedtls_ssl_context *ssl,
255 const unsigned char *identity,
256 size_t identity_len,
257 uint32_t obfuscated_ticket_age,
258 int *psk_type,
259 mbedtls_ssl_session *session)
Jerry Yu1c105562022-07-10 06:32:38 +0000260{
Ronald Cron606671e2023-02-17 11:36:33 +0100261 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
262
Jerry Yu95699e72022-08-21 19:22:23 +0800263 ((void) session);
264 ((void) obfuscated_ticket_age);
Jerry Yu5725f1c2022-08-21 17:27:16 +0800265 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
Jerry Yu95699e72022-08-21 19:22:23 +0800266
Gilles Peskine449bd832023-01-11 14:50:10 +0100267 MBEDTLS_SSL_DEBUG_BUF(4, "identity", identity, identity_len);
Jerry Yu95699e72022-08-21 19:22:23 +0800268 ssl->handshake->resume = 0;
269
Jerry Yu95699e72022-08-21 19:22:23 +0800270#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100271 if (ssl_tls13_offered_psks_check_identity_match_ticket(
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800272 ssl, identity, identity_len, obfuscated_ticket_age,
Gilles Peskine449bd832023-01-11 14:50:10 +0100273 session) == SSL_TLS1_3_OFFERED_PSK_MATCH) {
Jerry Yu95699e72022-08-21 19:22:23 +0800274 ssl->handshake->resume = 1;
275 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION;
Ronald Cron606671e2023-02-17 11:36:33 +0100276 ret = mbedtls_ssl_set_hs_psk(ssl,
277 session->resumption_key,
278 session->resumption_key_len);
279 if (ret != 0) {
280 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
281 return ret;
282 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100283
284 MBEDTLS_SSL_DEBUG_BUF(4, "Ticket-resumed PSK:",
285 session->resumption_key,
286 session->resumption_key_len);
287 MBEDTLS_SSL_DEBUG_MSG(4, ("ticket: obfuscated_ticket_age: %u",
288 (unsigned) obfuscated_ticket_age));
289 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu95699e72022-08-21 19:22:23 +0800290 }
291#endif /* MBEDTLS_SSL_SESSION_TICKETS */
292
Jerry Yu1c105562022-07-10 06:32:38 +0000293 /* Check identity with external configured function */
Gilles Peskine449bd832023-01-11 14:50:10 +0100294 if (ssl->conf->f_psk != NULL) {
295 if (ssl->conf->f_psk(
296 ssl->conf->p_psk, ssl, identity, identity_len) == 0) {
297 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000298 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100299 return SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000300 }
301
Gilles Peskine449bd832023-01-11 14:50:10 +0100302 MBEDTLS_SSL_DEBUG_BUF(5, "identity", identity, identity_len);
Jerry Yu1c105562022-07-10 06:32:38 +0000303 /* Check identity with pre-configured psk */
Gilles Peskine449bd832023-01-11 14:50:10 +0100304 if (ssl->conf->psk_identity != NULL &&
Jerry Yu2f0abc92022-07-22 19:34:48 +0800305 identity_len == ssl->conf->psk_identity_len &&
Gilles Peskine449bd832023-01-11 14:50:10 +0100306 mbedtls_ct_memcmp(ssl->conf->psk_identity,
307 identity, identity_len) == 0) {
Ronald Cron606671e2023-02-17 11:36:33 +0100308 ret = mbedtls_ssl_set_hs_psk(ssl, ssl->conf->psk, ssl->conf->psk_len);
309 if (ret != 0) {
310 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
311 return ret;
312 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000314 }
315
Gilles Peskine449bd832023-01-11 14:50:10 +0100316 return SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000317}
318
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800319MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100320static int ssl_tls13_offered_psks_check_binder_match(mbedtls_ssl_context *ssl,
321 const unsigned char *binder,
322 size_t binder_len,
323 int psk_type,
324 psa_algorithm_t psk_hash_alg)
Jerry Yu1c105562022-07-10 06:32:38 +0000325{
326 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu96a2e362022-07-21 15:11:34 +0800327
Jerry Yudaf375a2022-07-20 21:31:43 +0800328 unsigned char transcript[PSA_HASH_MAX_SIZE];
Jerry Yu1c105562022-07-10 06:32:38 +0000329 size_t transcript_len;
Jerry Yu2f0abc92022-07-22 19:34:48 +0800330 unsigned char *psk;
Jerry Yu96a2e362022-07-21 15:11:34 +0800331 size_t psk_len;
Jerry Yudaf375a2022-07-20 21:31:43 +0800332 unsigned char server_computed_binder[PSA_HASH_MAX_SIZE];
Jerry Yu1c105562022-07-10 06:32:38 +0000333
Jerry Yu1c105562022-07-10 06:32:38 +0000334 /* Get current state of handshake transcript. */
Jerry Yu29d9faa2022-08-23 17:52:45 +0800335 ret = mbedtls_ssl_get_handshake_transcript(
Gilles Peskine449bd832023-01-11 14:50:10 +0100336 ssl, mbedtls_hash_info_md_from_psa(psk_hash_alg),
337 transcript, sizeof(transcript), &transcript_len);
338 if (ret != 0) {
339 return ret;
340 }
Jerry Yu1c105562022-07-10 06:32:38 +0000341
Gilles Peskine449bd832023-01-11 14:50:10 +0100342 ret = mbedtls_ssl_tls13_export_handshake_psk(ssl, &psk, &psk_len);
343 if (ret != 0) {
344 return ret;
345 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800346
Gilles Peskine449bd832023-01-11 14:50:10 +0100347 ret = mbedtls_ssl_tls13_create_psk_binder(ssl, psk_hash_alg,
348 psk, psk_len, psk_type,
349 transcript,
350 server_computed_binder);
Jerry Yu96a2e362022-07-21 15:11:34 +0800351#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100352 mbedtls_free((void *) psk);
Jerry Yu96a2e362022-07-21 15:11:34 +0800353#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100354 if (ret != 0) {
355 MBEDTLS_SSL_DEBUG_MSG(1, ("PSK binder calculation failed."));
356 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu1c105562022-07-10 06:32:38 +0000357 }
358
Gilles Peskine449bd832023-01-11 14:50:10 +0100359 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( computed ): ",
360 server_computed_binder, transcript_len);
361 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( received ): ", binder, binder_len);
Jerry Yu1c105562022-07-10 06:32:38 +0000362
Gilles Peskine449bd832023-01-11 14:50:10 +0100363 if (mbedtls_ct_memcmp(server_computed_binder, binder, binder_len) == 0) {
364 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000365 }
366
Gilles Peskine449bd832023-01-11 14:50:10 +0100367 mbedtls_platform_zeroize(server_computed_binder,
368 sizeof(server_computed_binder));
369 return SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000370}
Jerry Yu96a2e362022-07-21 15:11:34 +0800371
Jerry Yu5725f1c2022-08-21 17:27:16 +0800372MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf35ba382022-08-23 17:58:26 +0800373static int ssl_tls13_select_ciphersuite_for_psk(
Gilles Peskine449bd832023-01-11 14:50:10 +0100374 mbedtls_ssl_context *ssl,
375 const unsigned char *cipher_suites,
376 const unsigned char *cipher_suites_end,
377 uint16_t *selected_ciphersuite,
378 const mbedtls_ssl_ciphersuite_t **selected_ciphersuite_info)
Jerry Yu5725f1c2022-08-21 17:27:16 +0800379{
Jerry Yuf35ba382022-08-23 17:58:26 +0800380 psa_algorithm_t psk_hash_alg = PSA_ALG_SHA_256;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800381
Jerry Yu0baf9072022-08-25 11:21:04 +0800382 *selected_ciphersuite = 0;
383 *selected_ciphersuite_info = NULL;
384
Jerry Yuf35ba382022-08-23 17:58:26 +0800385 /* RFC 8446, page 55.
386 *
387 * For externally established PSKs, the Hash algorithm MUST be set when the
388 * PSK is established or default to SHA-256 if no such algorithm is defined.
389 *
390 */
Jerry Yu5725f1c2022-08-21 17:27:16 +0800391
Jerry Yu5725f1c2022-08-21 17:27:16 +0800392 /*
393 * Search for a matching ciphersuite
394 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100395 for (const unsigned char *p = cipher_suites;
396 p < cipher_suites_end; p += 2) {
Jerry Yu5725f1c2022-08-21 17:27:16 +0800397 uint16_t cipher_suite;
Jerry Yuf35ba382022-08-23 17:58:26 +0800398 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800399
Gilles Peskine449bd832023-01-11 14:50:10 +0100400 cipher_suite = MBEDTLS_GET_UINT16_BE(p, 0);
401 ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(ssl,
402 cipher_suite);
403 if (ciphersuite_info == NULL) {
Jerry Yu5725f1c2022-08-21 17:27:16 +0800404 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100405 }
Jerry Yu5725f1c2022-08-21 17:27:16 +0800406
Jerry Yu5725f1c2022-08-21 17:27:16 +0800407 /* MAC of selected ciphersuite MUST be same with PSK binder if exist.
408 * Otherwise, client should reject.
409 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100410 if (psk_hash_alg == mbedtls_psa_translate_md(ciphersuite_info->mac)) {
Jerry Yuf35ba382022-08-23 17:58:26 +0800411 *selected_ciphersuite = cipher_suite;
412 *selected_ciphersuite_info = ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +0100413 return 0;
Jerry Yuf35ba382022-08-23 17:58:26 +0800414 }
415 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100416 MBEDTLS_SSL_DEBUG_MSG(2, ("No matched ciphersuite"));
417 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yuf35ba382022-08-23 17:58:26 +0800418}
Jerry Yu5725f1c2022-08-21 17:27:16 +0800419
Jerry Yu82534862022-08-30 10:42:33 +0800420#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yuf35ba382022-08-23 17:58:26 +0800421MBEDTLS_CHECK_RETURN_CRITICAL
422static int ssl_tls13_select_ciphersuite_for_resumption(
Gilles Peskine449bd832023-01-11 14:50:10 +0100423 mbedtls_ssl_context *ssl,
424 const unsigned char *cipher_suites,
425 const unsigned char *cipher_suites_end,
426 mbedtls_ssl_session *session,
427 uint16_t *selected_ciphersuite,
428 const mbedtls_ssl_ciphersuite_t **selected_ciphersuite_info)
Jerry Yuf35ba382022-08-23 17:58:26 +0800429{
Jerry Yu82534862022-08-30 10:42:33 +0800430
Jerry Yuf35ba382022-08-23 17:58:26 +0800431 *selected_ciphersuite = 0;
432 *selected_ciphersuite_info = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100433 for (const unsigned char *p = cipher_suites; p < cipher_suites_end; p += 2) {
434 uint16_t cipher_suite = MBEDTLS_GET_UINT16_BE(p, 0);
Jerry Yu82534862022-08-30 10:42:33 +0800435 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
436
Gilles Peskine449bd832023-01-11 14:50:10 +0100437 if (cipher_suite != session->ciphersuite) {
Jerry Yu82534862022-08-30 10:42:33 +0800438 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100439 }
Jerry Yu82534862022-08-30 10:42:33 +0800440
Gilles Peskine449bd832023-01-11 14:50:10 +0100441 ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(ssl,
442 cipher_suite);
443 if (ciphersuite_info == NULL) {
Jerry Yu82534862022-08-30 10:42:33 +0800444 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 }
Jerry Yu82534862022-08-30 10:42:33 +0800446
Jerry Yu4746b102022-09-13 11:11:48 +0800447 *selected_ciphersuite = cipher_suite;
Jerry Yu82534862022-08-30 10:42:33 +0800448 *selected_ciphersuite_info = ciphersuite_info;
449
Gilles Peskine449bd832023-01-11 14:50:10 +0100450 return 0;
Jerry Yu82534862022-08-30 10:42:33 +0800451 }
452
Gilles Peskine449bd832023-01-11 14:50:10 +0100453 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800454}
Jerry Yuf35ba382022-08-23 17:58:26 +0800455
Jerry Yu82534862022-08-30 10:42:33 +0800456MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100457static int ssl_tls13_session_copy_ticket(mbedtls_ssl_session *dst,
458 const mbedtls_ssl_session *src)
Jerry Yu82534862022-08-30 10:42:33 +0800459{
Jerry Yu82534862022-08-30 10:42:33 +0800460 dst->ticket_age_add = src->ticket_age_add;
461 dst->ticket_flags = src->ticket_flags;
462 dst->resumption_key_len = src->resumption_key_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100463 if (src->resumption_key_len == 0) {
464 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
465 }
466 memcpy(dst->resumption_key, src->resumption_key, src->resumption_key_len);
Jerry Yu4746b102022-09-13 11:11:48 +0800467
Gilles Peskine449bd832023-01-11 14:50:10 +0100468 return 0;
Jerry Yu82534862022-08-30 10:42:33 +0800469}
470#endif /* MBEDTLS_SSL_SESSION_TICKETS */
471
Jerry Yu1c105562022-07-10 06:32:38 +0000472/* Parser for pre_shared_key extension in client hello
473 * struct {
474 * opaque identity<1..2^16-1>;
475 * uint32 obfuscated_ticket_age;
476 * } PskIdentity;
477 *
478 * opaque PskBinderEntry<32..255>;
479 *
480 * struct {
481 * PskIdentity identities<7..2^16-1>;
482 * PskBinderEntry binders<33..2^16-1>;
483 * } OfferedPsks;
484 *
485 * struct {
486 * select (Handshake.msg_type) {
487 * case client_hello: OfferedPsks;
488 * ....
489 * };
490 * } PreSharedKeyExtension;
491 */
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800492MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100493static int ssl_tls13_parse_pre_shared_key_ext(mbedtls_ssl_context *ssl,
494 const unsigned char *pre_shared_key_ext,
495 const unsigned char *pre_shared_key_ext_end,
496 const unsigned char *ciphersuites,
497 const unsigned char *ciphersuites_end)
Jerry Yu1c105562022-07-10 06:32:38 +0000498{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100499 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu29d9faa2022-08-23 17:52:45 +0800500 const unsigned char *identities = pre_shared_key_ext;
Jerry Yu568ec252022-07-22 21:27:34 +0800501 const unsigned char *p_identity_len;
502 size_t identities_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000503 const unsigned char *identities_end;
Jerry Yu568ec252022-07-22 21:27:34 +0800504 const unsigned char *binders;
505 const unsigned char *p_binder_len;
506 size_t binders_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000507 const unsigned char *binders_end;
Jerry Yu96a2e362022-07-21 15:11:34 +0800508 int matched_identity = -1;
509 int identity_id = -1;
Jerry Yu1c105562022-07-10 06:32:38 +0000510
Gilles Peskine449bd832023-01-11 14:50:10 +0100511 MBEDTLS_SSL_DEBUG_BUF(3, "pre_shared_key extension",
512 pre_shared_key_ext,
513 pre_shared_key_ext_end - pre_shared_key_ext);
Jerry Yu1c105562022-07-10 06:32:38 +0000514
Jerry Yu96a2e362022-07-21 15:11:34 +0800515 /* identities_len 2 bytes
516 * identities_data >= 7 bytes
517 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 MBEDTLS_SSL_CHK_BUF_READ_PTR(identities, pre_shared_key_ext_end, 7 + 2);
519 identities_len = MBEDTLS_GET_UINT16_BE(identities, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800520 p_identity_len = identities + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100521 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, pre_shared_key_ext_end,
522 identities_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800523 identities_end = p_identity_len + identities_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000524
Jerry Yu96a2e362022-07-21 15:11:34 +0800525 /* binders_len 2 bytes
526 * binders >= 33 bytes
527 */
Jerry Yu568ec252022-07-22 21:27:34 +0800528 binders = identities_end;
Gilles Peskine449bd832023-01-11 14:50:10 +0100529 MBEDTLS_SSL_CHK_BUF_READ_PTR(binders, pre_shared_key_ext_end, 33 + 2);
530 binders_len = MBEDTLS_GET_UINT16_BE(binders, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800531 p_binder_len = binders + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100532 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, pre_shared_key_ext_end, binders_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800533 binders_end = p_binder_len + binders_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000534
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100535 ret = ssl->handshake->update_checksum(ssl, pre_shared_key_ext,
536 identities_end - pre_shared_key_ext);
537 if (0 != ret) {
538 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
539 return ret;
540 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800541
Gilles Peskine449bd832023-01-11 14:50:10 +0100542 while (p_identity_len < identities_end && p_binder_len < binders_end) {
Jerry Yu1c105562022-07-10 06:32:38 +0000543 const unsigned char *identity;
Jerry Yu568ec252022-07-22 21:27:34 +0800544 size_t identity_len;
Jerry Yu82534862022-08-30 10:42:33 +0800545 uint32_t obfuscated_ticket_age;
Jerry Yu96a2e362022-07-21 15:11:34 +0800546 const unsigned char *binder;
Jerry Yu568ec252022-07-22 21:27:34 +0800547 size_t binder_len;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800548 int psk_type;
549 uint16_t cipher_suite;
Jerry Yu29d9faa2022-08-23 17:52:45 +0800550 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu82534862022-08-30 10:42:33 +0800551#if defined(MBEDTLS_SSL_SESSION_TICKETS)
552 mbedtls_ssl_session session;
Gilles Peskine449bd832023-01-11 14:50:10 +0100553 mbedtls_ssl_session_init(&session);
Jerry Yu82534862022-08-30 10:42:33 +0800554#endif
Jerry Yubb852022022-07-20 21:10:44 +0800555
Gilles Peskine449bd832023-01-11 14:50:10 +0100556 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, identities_end, 2 + 1 + 4);
557 identity_len = MBEDTLS_GET_UINT16_BE(p_identity_len, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800558 identity = p_identity_len + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100559 MBEDTLS_SSL_CHK_BUF_READ_PTR(identity, identities_end, identity_len + 4);
560 obfuscated_ticket_age = MBEDTLS_GET_UINT32_BE(identity, identity_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800561 p_identity_len += identity_len + 6;
Jerry Yu1c105562022-07-10 06:32:38 +0000562
Gilles Peskine449bd832023-01-11 14:50:10 +0100563 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, binders_end, 1 + 32);
Jerry Yu568ec252022-07-22 21:27:34 +0800564 binder_len = *p_binder_len;
565 binder = p_binder_len + 1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 MBEDTLS_SSL_CHK_BUF_READ_PTR(binder, binders_end, binder_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800567 p_binder_len += binder_len + 1;
Jerry Yu96a2e362022-07-21 15:11:34 +0800568
Jerry Yu96a2e362022-07-21 15:11:34 +0800569 identity_id++;
Gilles Peskine449bd832023-01-11 14:50:10 +0100570 if (matched_identity != -1) {
Jerry Yu1c105562022-07-10 06:32:38 +0000571 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100572 }
Jerry Yu1c105562022-07-10 06:32:38 +0000573
Jerry Yu96a2e362022-07-21 15:11:34 +0800574 ret = ssl_tls13_offered_psks_check_identity_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100575 ssl, identity, identity_len, obfuscated_ticket_age,
576 &psk_type, &session);
577 if (ret != SSL_TLS1_3_OFFERED_PSK_MATCH) {
Jerry Yu96a2e362022-07-21 15:11:34 +0800578 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100579 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800580
Gilles Peskine449bd832023-01-11 14:50:10 +0100581 MBEDTLS_SSL_DEBUG_MSG(4, ("found matched identity"));
582 switch (psk_type) {
Jerry Yu0baf9072022-08-25 11:21:04 +0800583 case MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL:
584 ret = ssl_tls13_select_ciphersuite_for_psk(
Gilles Peskine449bd832023-01-11 14:50:10 +0100585 ssl, ciphersuites, ciphersuites_end,
586 &cipher_suite, &ciphersuite_info);
Jerry Yu0baf9072022-08-25 11:21:04 +0800587 break;
588 case MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:
Jerry Yu82534862022-08-30 10:42:33 +0800589#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu0baf9072022-08-25 11:21:04 +0800590 ret = ssl_tls13_select_ciphersuite_for_resumption(
Gilles Peskine449bd832023-01-11 14:50:10 +0100591 ssl, ciphersuites, ciphersuites_end, &session,
592 &cipher_suite, &ciphersuite_info);
593 if (ret != 0) {
594 mbedtls_ssl_session_free(&session);
595 }
Jerry Yu82534862022-08-30 10:42:33 +0800596#else
597 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
598#endif
Jerry Yu0baf9072022-08-25 11:21:04 +0800599 break;
600 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100601 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu0baf9072022-08-25 11:21:04 +0800602 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100603 if (ret != 0) {
Jerry Yuf35ba382022-08-23 17:58:26 +0800604 /* See below, no cipher_suite available, abort handshake */
605 MBEDTLS_SSL_PEND_FATAL_ALERT(
606 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
Gilles Peskine449bd832023-01-11 14:50:10 +0100607 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
Jerry Yuf35ba382022-08-23 17:58:26 +0800608 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +0100609 2, "ssl_tls13_select_ciphersuite", ret);
610 return ret;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800611 }
612
Jerry Yu96a2e362022-07-21 15:11:34 +0800613 ret = ssl_tls13_offered_psks_check_binder_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100614 ssl, binder, binder_len, psk_type,
615 mbedtls_psa_translate_md(ciphersuite_info->mac));
616 if (ret != SSL_TLS1_3_OFFERED_PSK_MATCH) {
Jerry Yuc5a23a02022-08-25 10:51:44 +0800617 /* For security reasons, the handshake should be aborted when we
618 * fail to validate a binder value. See RFC 8446 section 4.2.11.2
619 * and appendix E.6. */
Jerry Yu82534862022-08-30 10:42:33 +0800620#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100621 mbedtls_ssl_session_free(&session);
Jerry Yu82534862022-08-30 10:42:33 +0800622#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100623 MBEDTLS_SSL_DEBUG_MSG(3, ("Invalid binder."));
624 MBEDTLS_SSL_DEBUG_RET(1,
625 "ssl_tls13_offered_psks_check_binder_match", ret);
Jerry Yu96a2e362022-07-21 15:11:34 +0800626 MBEDTLS_SSL_PEND_FATAL_ALERT(
627 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
Gilles Peskine449bd832023-01-11 14:50:10 +0100628 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
629 return ret;
Jerry Yu96a2e362022-07-21 15:11:34 +0800630 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800631
632 matched_identity = identity_id;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800633
634 /* Update handshake parameters */
Jerry Yue5834fd2022-08-29 20:16:09 +0800635 ssl->handshake->ciphersuite_info = ciphersuite_info;
Jerry Yu4746b102022-09-13 11:11:48 +0800636 ssl->session_negotiate->ciphersuite = cipher_suite;
Gilles Peskine449bd832023-01-11 14:50:10 +0100637 MBEDTLS_SSL_DEBUG_MSG(2, ("overwrite ciphersuite: %04x - %s",
638 cipher_suite, ciphersuite_info->name));
Jerry Yu82534862022-08-30 10:42:33 +0800639#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100640 if (psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
641 ret = ssl_tls13_session_copy_ticket(ssl->session_negotiate,
642 &session);
643 mbedtls_ssl_session_free(&session);
644 if (ret != 0) {
645 return ret;
646 }
Jerry Yu82534862022-08-30 10:42:33 +0800647 }
648#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu1c105562022-07-10 06:32:38 +0000649 }
650
Gilles Peskine449bd832023-01-11 14:50:10 +0100651 if (p_identity_len != identities_end || p_binder_len != binders_end) {
652 MBEDTLS_SSL_DEBUG_MSG(3, ("pre_shared_key extension decode error"));
653 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
654 MBEDTLS_ERR_SSL_DECODE_ERROR);
655 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yu1c105562022-07-10 06:32:38 +0000656 }
657
Jerry Yu6f1db3f2022-07-22 23:05:59 +0800658 /* Update the handshake transcript with the binder list. */
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100659 ret = ssl->handshake->update_checksum(ssl,
660 identities_end,
661 (size_t) (binders_end - identities_end));
662 if (0 != ret) {
663 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
664 return ret;
665 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100666 if (matched_identity == -1) {
667 MBEDTLS_SSL_DEBUG_MSG(3, ("No matched PSK or ticket."));
668 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Jerry Yu1c105562022-07-10 06:32:38 +0000669 }
670
Gilles Peskine449bd832023-01-11 14:50:10 +0100671 ssl->handshake->selected_identity = (uint16_t) matched_identity;
672 MBEDTLS_SSL_DEBUG_MSG(3, ("Pre shared key found"));
Jerry Yu1c105562022-07-10 06:32:38 +0000673
Gilles Peskine449bd832023-01-11 14:50:10 +0100674 return 0;
Jerry Yu1c105562022-07-10 06:32:38 +0000675}
Jerry Yu032b15ce2022-07-11 06:10:03 +0000676
677/*
678 * struct {
679 * select ( Handshake.msg_type ) {
680 * ....
681 * case server_hello:
682 * uint16 selected_identity;
683 * }
684 * } PreSharedKeyExtension;
685 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100686static int ssl_tls13_write_server_pre_shared_key_ext(mbedtls_ssl_context *ssl,
687 unsigned char *buf,
688 unsigned char *end,
689 size_t *olen)
Jerry Yu032b15ce2022-07-11 06:10:03 +0000690{
Gilles Peskine449bd832023-01-11 14:50:10 +0100691 unsigned char *p = (unsigned char *) buf;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000692
693 *olen = 0;
694
David Horstmann21b89762022-10-06 18:34:28 +0100695 int not_using_psk = 0;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000696#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100697 not_using_psk = (mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque));
Jerry Yu032b15ce2022-07-11 06:10:03 +0000698#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100699 not_using_psk = (ssl->handshake->psk == NULL);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000700#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100701 if (not_using_psk) {
Jerry Yu032b15ce2022-07-11 06:10:03 +0000702 /* We shouldn't have called this extension writer unless we've
703 * chosen to use a PSK. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100704 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000705 }
706
Gilles Peskine449bd832023-01-11 14:50:10 +0100707 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding pre_shared_key extension"));
708 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000709
Gilles Peskine449bd832023-01-11 14:50:10 +0100710 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_PRE_SHARED_KEY, p, 0);
711 MBEDTLS_PUT_UINT16_BE(2, p, 2);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000712
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 MBEDTLS_PUT_UINT16_BE(ssl->handshake->selected_identity, p, 4);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000714
715 *olen = 6;
716
Gilles Peskine449bd832023-01-11 14:50:10 +0100717 MBEDTLS_SSL_DEBUG_MSG(4, ("sent selected_identity: %u",
718 ssl->handshake->selected_identity));
Jerry Yu032b15ce2022-07-11 06:10:03 +0000719
Gilles Peskine449bd832023-01-11 14:50:10 +0100720 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_PRE_SHARED_KEY);
Jerry Yub95dd362022-11-08 21:19:34 +0800721
Gilles Peskine449bd832023-01-11 14:50:10 +0100722 return 0;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000723}
724
Ronald Cron41a443a2022-10-04 16:38:25 +0200725#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yue19e3b92022-07-08 12:04:51 +0000726
XiaokangQian7807f9f2022-02-15 10:04:37 +0000727/* From RFC 8446:
728 * struct {
XiaokangQiancfd925f2022-04-14 07:10:37 +0000729 * ProtocolVersion versions<2..254>;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000730 * } SupportedVersions;
731 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200732MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100733static int ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context *ssl,
734 const unsigned char *buf,
735 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000736{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000737 const unsigned char *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000738 size_t versions_len;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000739 const unsigned char *versions_end;
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000740 uint16_t tls_version;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000741 int tls13_supported = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000742
Gilles Peskine449bd832023-01-11 14:50:10 +0100743 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
XiaokangQian4080a7f2022-04-11 09:55:18 +0000744 versions_len = p[0];
XiaokangQian7807f9f2022-02-15 10:04:37 +0000745 p += 1;
746
Gilles Peskine449bd832023-01-11 14:50:10 +0100747 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, versions_len);
XiaokangQian4080a7f2022-04-11 09:55:18 +0000748 versions_end = p + versions_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100749 while (p < versions_end) {
750 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, versions_end, 2);
751 tls_version = mbedtls_ssl_read_version(p, ssl->conf->transport);
XiaokangQianb67384d2022-04-19 00:02:38 +0000752 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000753
754 /* In this implementation we only support TLS 1.3 and DTLS 1.3. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100755 if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
XiaokangQian7807f9f2022-02-15 10:04:37 +0000756 tls13_supported = 1;
757 break;
758 }
XiaokangQian7807f9f2022-02-15 10:04:37 +0000759 }
760
Gilles Peskine449bd832023-01-11 14:50:10 +0100761 if (!tls13_supported) {
762 MBEDTLS_SSL_DEBUG_MSG(1, ("TLS 1.3 is not supported by the client"));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000763
Gilles Peskine449bd832023-01-11 14:50:10 +0100764 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
765 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
766 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000767 }
768
Gilles Peskine449bd832023-01-11 14:50:10 +0100769 MBEDTLS_SSL_DEBUG_MSG(1, ("Negotiated version. Supported is [%04x]",
770 (unsigned int) tls_version));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000771
Gilles Peskine449bd832023-01-11 14:50:10 +0100772 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000773}
774
Valerio Setti080a22b2023-03-20 15:22:47 +0100775#if defined(PSA_WANT_ALG_ECDH)
XiaokangQiane8ff3502022-04-22 02:34:40 +0000776/*
XiaokangQian7807f9f2022-02-15 10:04:37 +0000777 *
778 * From RFC 8446:
779 * enum {
780 * ... (0xFFFF)
781 * } NamedGroup;
782 * struct {
783 * NamedGroup named_group_list<2..2^16-1>;
784 * } NamedGroupList;
785 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200786MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100787static int ssl_tls13_parse_supported_groups_ext(mbedtls_ssl_context *ssl,
788 const unsigned char *buf,
789 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000790{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000791 const unsigned char *p = buf;
XiaokangQian84823772022-04-19 07:57:30 +0000792 size_t named_group_list_len;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000793 const unsigned char *named_group_list_end;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000794
Gilles Peskine449bd832023-01-11 14:50:10 +0100795 MBEDTLS_SSL_DEBUG_BUF(3, "supported_groups extension", p, end - buf);
796 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
797 named_group_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000798 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100799 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, named_group_list_len);
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000800 named_group_list_end = p + named_group_list_len;
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000801 ssl->handshake->hrr_selected_group = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000802
Gilles Peskine449bd832023-01-11 14:50:10 +0100803 while (p < named_group_list_end) {
XiaokangQian08037552022-04-20 07:16:41 +0000804 uint16_t named_group;
Gilles Peskine449bd832023-01-11 14:50:10 +0100805 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, named_group_list_end, 2);
806 named_group = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian08037552022-04-20 07:16:41 +0000807 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000808
Gilles Peskine449bd832023-01-11 14:50:10 +0100809 MBEDTLS_SSL_DEBUG_MSG(2,
810 ("got named group: %s(%04x)",
811 mbedtls_ssl_named_group_to_str(named_group),
812 named_group));
XiaokangQian08037552022-04-20 07:16:41 +0000813
Gilles Peskine449bd832023-01-11 14:50:10 +0100814 if (!mbedtls_ssl_named_group_is_offered(ssl, named_group) ||
815 !mbedtls_ssl_named_group_is_supported(named_group) ||
816 ssl->handshake->hrr_selected_group != 0) {
XiaokangQian08037552022-04-20 07:16:41 +0000817 continue;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000818 }
819
Gilles Peskine449bd832023-01-11 14:50:10 +0100820 MBEDTLS_SSL_DEBUG_MSG(2,
821 ("add named group %s(%04x) into received list.",
822 mbedtls_ssl_named_group_to_str(named_group),
823 named_group));
Jerry Yuc1be19f2022-04-23 16:11:39 +0800824
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000825 ssl->handshake->hrr_selected_group = named_group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000826 }
827
Gilles Peskine449bd832023-01-11 14:50:10 +0100828 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000829
830}
Valerio Setti080a22b2023-03-20 15:22:47 +0100831#endif /* PSA_WANT_ALG_ECDH */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000832
XiaokangQian08037552022-04-20 07:16:41 +0000833#define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1
834
Valerio Setti080a22b2023-03-20 15:22:47 +0100835#if defined(PSA_WANT_ALG_ECDH)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000836/*
837 * ssl_tls13_parse_key_shares_ext() verifies whether the information in the
XiaokangQiane8ff3502022-04-22 02:34:40 +0000838 * extension is correct and stores the first acceptable key share and its associated group.
XiaokangQian7807f9f2022-02-15 10:04:37 +0000839 *
840 * Possible return values are:
841 * - 0: Successful processing of the client provided key share extension.
XiaokangQian08037552022-04-20 07:16:41 +0000842 * - SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH: The key shares provided by the client
XiaokangQian7807f9f2022-02-15 10:04:37 +0000843 * does not match a group supported by the server. A HelloRetryRequest will
844 * be needed.
XiaokangQiane8ff3502022-04-22 02:34:40 +0000845 * - A negative value for fatal errors.
Jerry Yuc1be19f2022-04-23 16:11:39 +0800846 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200847MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100848static int ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context *ssl,
849 const unsigned char *buf,
850 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000851{
XiaokangQianb67384d2022-04-19 00:02:38 +0000852 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000853 unsigned char const *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000854 unsigned char const *client_shares_end;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800855 size_t client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000856
857 /* From RFC 8446:
858 *
859 * struct {
860 * KeyShareEntry client_shares<0..2^16-1>;
861 * } KeyShareClientHello;
862 *
863 */
864
Gilles Peskine449bd832023-01-11 14:50:10 +0100865 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
866 client_shares_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000867 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100868 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, client_shares_len);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000869
870 ssl->handshake->offered_group_id = 0;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000871 client_shares_end = p + client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000872
873 /* We try to find a suitable key share entry and copy it to the
874 * handshake context. Later, we have to find out whether we can do
875 * something with the provided key share or whether we have to
XiaokangQianc5763b52022-04-02 03:34:37 +0000876 * dismiss it and send a HelloRetryRequest message.
877 */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000878
Gilles Peskine449bd832023-01-11 14:50:10 +0100879 while (p < client_shares_end) {
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000880 uint16_t group;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800881 size_t key_exchange_len;
Jerry Yu086edc22022-05-05 10:50:38 +0800882 const unsigned char *key_exchange;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000883
884 /*
885 * struct {
886 * NamedGroup group;
887 * opaque key_exchange<1..2^16-1>;
888 * } KeyShareEntry;
889 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100890 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, 4);
891 group = MBEDTLS_GET_UINT16_BE(p, 0);
892 key_exchange_len = MBEDTLS_GET_UINT16_BE(p, 2);
Jerry Yuc1be19f2022-04-23 16:11:39 +0800893 p += 4;
Jerry Yu086edc22022-05-05 10:50:38 +0800894 key_exchange = p;
Gilles Peskine449bd832023-01-11 14:50:10 +0100895 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, key_exchange_len);
Jerry Yu086edc22022-05-05 10:50:38 +0800896 p += key_exchange_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000897
898 /* Continue parsing even if we have already found a match,
XiaokangQianc5763b52022-04-02 03:34:37 +0000899 * for input validation purposes.
900 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100901 if (!mbedtls_ssl_named_group_is_offered(ssl, group) ||
902 !mbedtls_ssl_named_group_is_supported(group) ||
903 ssl->handshake->offered_group_id != 0) {
XiaokangQian060d8672022-04-21 09:24:56 +0000904 continue;
905 }
XiaokangQian060d8672022-04-21 09:24:56 +0000906
XiaokangQian7807f9f2022-02-15 10:04:37 +0000907 /*
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000908 * For now, we only support ECDHE groups.
XiaokangQian7807f9f2022-02-15 10:04:37 +0000909 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100910 if (mbedtls_ssl_tls13_named_group_is_ecdhe(group)) {
911 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDH group: %s (%04x)",
912 mbedtls_ssl_named_group_to_str(group),
913 group));
XiaokangQian318dc762022-04-20 09:43:51 +0000914 ret = mbedtls_ssl_tls13_read_public_ecdhe_share(
Gilles Peskine449bd832023-01-11 14:50:10 +0100915 ssl, key_exchange - 2, key_exchange_len + 2);
916 if (ret != 0) {
917 return ret;
918 }
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000919
Gilles Peskine449bd832023-01-11 14:50:10 +0100920 } else {
921 MBEDTLS_SSL_DEBUG_MSG(4, ("Unrecognized NamedGroup %u",
922 (unsigned) group));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000923 continue;
924 }
925
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000926 ssl->handshake->offered_group_id = group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000927 }
928
Jerry Yuc1be19f2022-04-23 16:11:39 +0800929
Gilles Peskine449bd832023-01-11 14:50:10 +0100930 if (ssl->handshake->offered_group_id == 0) {
931 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching key share"));
932 return SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000933 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100934 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000935}
Valerio Setti080a22b2023-03-20 15:22:47 +0100936#endif /* PSA_WANT_ALG_ECDH */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000937
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200938MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100939static int ssl_tls13_client_hello_has_exts(mbedtls_ssl_context *ssl,
940 int exts_mask)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000941{
Jerry Yu0c354a22022-08-29 15:25:36 +0800942 int masked = ssl->handshake->received_extensions & exts_mask;
Gilles Peskine449bd832023-01-11 14:50:10 +0100943 return masked == exts_mask;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000944}
945
Jerry Yue5991322022-11-07 14:03:44 +0800946#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200947MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianb67384d2022-04-19 00:02:38 +0000948static int ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +0100949 mbedtls_ssl_context *ssl)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000950{
Gilles Peskine449bd832023-01-11 14:50:10 +0100951 return ssl_tls13_client_hello_has_exts(
952 ssl,
953 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
954 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
955 MBEDTLS_SSL_EXT_MASK(SIG_ALG));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000956}
Jerry Yue5991322022-11-07 14:03:44 +0800957#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000958
Jerry Yue5991322022-11-07 14:03:44 +0800959#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
Jerry Yu77f01482022-07-11 07:03:24 +0000960MBEDTLS_CHECK_RETURN_CRITICAL
961static int ssl_tls13_client_hello_has_exts_for_psk_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +0100962 mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +0000963{
Gilles Peskine449bd832023-01-11 14:50:10 +0100964 return ssl_tls13_client_hello_has_exts(
965 ssl,
966 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
967 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
Jerry Yu77f01482022-07-11 07:03:24 +0000968}
Jerry Yue5991322022-11-07 14:03:44 +0800969#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED */
Jerry Yu77f01482022-07-11 07:03:24 +0000970
Jerry Yue5991322022-11-07 14:03:44 +0800971#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Jerry Yu77f01482022-07-11 07:03:24 +0000972MBEDTLS_CHECK_RETURN_CRITICAL
973static int ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +0100974 mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +0000975{
Gilles Peskine449bd832023-01-11 14:50:10 +0100976 return ssl_tls13_client_hello_has_exts(
977 ssl,
978 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
979 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
980 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
981 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
Jerry Yu77f01482022-07-11 07:03:24 +0000982}
Jerry Yue5991322022-11-07 14:03:44 +0800983#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED */
Jerry Yu77f01482022-07-11 07:03:24 +0000984
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200985MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100986static int ssl_tls13_check_ephemeral_key_exchange(mbedtls_ssl_context *ssl)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000987{
Jerry Yue5991322022-11-07 14:03:44 +0800988#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +0100989 return mbedtls_ssl_conf_tls13_ephemeral_enabled(ssl) &&
990 ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(ssl);
Jerry Yue5991322022-11-07 14:03:44 +0800991#else
992 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +0100993 return 0;
Jerry Yue5991322022-11-07 14:03:44 +0800994#endif
Jerry Yu77f01482022-07-11 07:03:24 +0000995}
XiaokangQian7807f9f2022-02-15 10:04:37 +0000996
Jerry Yu77f01482022-07-11 07:03:24 +0000997MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100998static int ssl_tls13_check_psk_key_exchange(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +0000999{
Jerry Yue5991322022-11-07 14:03:44 +08001000#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001001 return mbedtls_ssl_conf_tls13_psk_enabled(ssl) &&
1002 mbedtls_ssl_tls13_psk_enabled(ssl) &&
1003 ssl_tls13_client_hello_has_exts_for_psk_key_exchange(ssl);
Jerry Yu77f01482022-07-11 07:03:24 +00001004#else
1005 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001006 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001007#endif
1008}
XiaokangQian7807f9f2022-02-15 10:04:37 +00001009
Jerry Yu77f01482022-07-11 07:03:24 +00001010MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001011static int ssl_tls13_check_psk_ephemeral_key_exchange(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001012{
Jerry Yue5991322022-11-07 14:03:44 +08001013#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001014 return mbedtls_ssl_conf_tls13_psk_ephemeral_enabled(ssl) &&
1015 mbedtls_ssl_tls13_psk_ephemeral_enabled(ssl) &&
1016 ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(ssl);
Jerry Yu77f01482022-07-11 07:03:24 +00001017#else
1018 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001019 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001020#endif
1021}
1022
Gilles Peskine449bd832023-01-11 14:50:10 +01001023static int ssl_tls13_determine_key_exchange_mode(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001024{
1025 /*
1026 * Determine the key exchange algorithm to use.
1027 * There are three types of key exchanges supported in TLS 1.3:
1028 * - (EC)DH with ECDSA,
1029 * - (EC)DH with PSK,
1030 * - plain PSK.
1031 *
1032 * The PSK-based key exchanges may additionally be used with 0-RTT.
1033 *
1034 * Our built-in order of preference is
Jerry Yuce6ed702022-07-22 21:49:53 +08001035 * 1 ) (EC)DHE-PSK Mode ( psk_ephemeral )
1036 * 2 ) Certificate Mode ( ephemeral )
1037 * 3 ) Plain PSK Mode ( psk )
Jerry Yu77f01482022-07-11 07:03:24 +00001038 */
1039
1040 ssl->handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE;
1041
Gilles Peskine449bd832023-01-11 14:50:10 +01001042 if (ssl_tls13_check_psk_ephemeral_key_exchange(ssl)) {
Jerry Yu77f01482022-07-11 07:03:24 +00001043 ssl->handshake->key_exchange_mode =
1044 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001045 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk_ephemeral"));
1046 } else
1047 if (ssl_tls13_check_ephemeral_key_exchange(ssl)) {
Jerry Yu77f01482022-07-11 07:03:24 +00001048 ssl->handshake->key_exchange_mode =
1049 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001050 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: ephemeral"));
1051 } else
1052 if (ssl_tls13_check_psk_key_exchange(ssl)) {
Jerry Yuce6ed702022-07-22 21:49:53 +08001053 ssl->handshake->key_exchange_mode =
1054 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
Gilles Peskine449bd832023-01-11 14:50:10 +01001055 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk"));
1056 } else {
Jerry Yu77f01482022-07-11 07:03:24 +00001057 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001058 1,
1059 ("ClientHello message misses mandatory extensions."));
1060 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION,
1061 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1062 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu77f01482022-07-11 07:03:24 +00001063 }
1064
Gilles Peskine449bd832023-01-11 14:50:10 +01001065 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001066
XiaokangQian7807f9f2022-02-15 10:04:37 +00001067}
1068
XiaokangQian81802f42022-06-10 13:25:22 +00001069#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
Ronald Cron928cbd32022-10-04 16:14:26 +02001070 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Ronald Cron67ea2542022-09-15 17:34:42 +02001071
1072#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001073static psa_algorithm_t ssl_tls13_iana_sig_alg_to_psa_alg(uint16_t sig_alg)
Ronald Cron67ea2542022-09-15 17:34:42 +02001074{
Gilles Peskine449bd832023-01-11 14:50:10 +01001075 switch (sig_alg) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001076 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001077 return PSA_ALG_ECDSA(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001078 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001079 return PSA_ALG_ECDSA(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001080 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001081 return PSA_ALG_ECDSA(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001082 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001083 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001084 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001085 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001086 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001087 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001088 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001089 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001090 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001091 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001092 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001093 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001094 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01001095 return PSA_ALG_NONE;
Ronald Cron67ea2542022-09-15 17:34:42 +02001096 }
1097}
1098#endif /* MBEDTLS_USE_PSA_CRYPTO */
1099
XiaokangQian23c5be62022-06-07 02:04:34 +00001100/*
XiaokangQianfb665a82022-06-15 03:57:21 +00001101 * Pick best ( private key, certificate chain ) pair based on the signature
1102 * algorithms supported by the client.
XiaokangQian23c5be62022-06-07 02:04:34 +00001103 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02001104MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001105static int ssl_tls13_pick_key_cert(mbedtls_ssl_context *ssl)
XiaokangQian23c5be62022-06-07 02:04:34 +00001106{
XiaokangQianfb665a82022-06-15 03:57:21 +00001107 mbedtls_ssl_key_cert *key_cert, *key_cert_list;
XiaokangQian81802f42022-06-10 13:25:22 +00001108 const uint16_t *sig_alg = ssl->handshake->received_sig_algs;
XiaokangQian23c5be62022-06-07 02:04:34 +00001109
1110#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01001111 if (ssl->handshake->sni_key_cert != NULL) {
XiaokangQianfb665a82022-06-15 03:57:21 +00001112 key_cert_list = ssl->handshake->sni_key_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001113 } else
XiaokangQian23c5be62022-06-07 02:04:34 +00001114#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Gilles Peskine449bd832023-01-11 14:50:10 +01001115 key_cert_list = ssl->conf->key_cert;
XiaokangQian23c5be62022-06-07 02:04:34 +00001116
Gilles Peskine449bd832023-01-11 14:50:10 +01001117 if (key_cert_list == NULL) {
1118 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate"));
1119 return -1;
XiaokangQian23c5be62022-06-07 02:04:34 +00001120 }
1121
Gilles Peskine449bd832023-01-11 14:50:10 +01001122 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
1123 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001124 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001125 }
Ronald Cron67ea2542022-09-15 17:34:42 +02001126
Gilles Peskine449bd832023-01-11 14:50:10 +01001127 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001128 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001129 }
Ronald Cron67ea2542022-09-15 17:34:42 +02001130
Gilles Peskine449bd832023-01-11 14:50:10 +01001131 for (key_cert = key_cert_list; key_cert != NULL;
1132 key_cert = key_cert->next) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001133#if defined(MBEDTLS_USE_PSA_CRYPTO)
1134 psa_algorithm_t psa_alg = PSA_ALG_NONE;
1135#endif /* MBEDTLS_USE_PSA_CRYPTO */
1136
Gilles Peskine449bd832023-01-11 14:50:10 +01001137 MBEDTLS_SSL_DEBUG_CRT(3, "certificate (chain) candidate",
1138 key_cert->cert);
XiaokangQian81802f42022-06-10 13:25:22 +00001139
1140 /*
Gilles Peskine449bd832023-01-11 14:50:10 +01001141 * This avoids sending the client a cert it'll reject based on
1142 * keyUsage or other extensions.
1143 */
1144 if (mbedtls_x509_crt_check_key_usage(
1145 key_cert->cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0 ||
XiaokangQian81802f42022-06-10 13:25:22 +00001146 mbedtls_x509_crt_check_extended_key_usage(
XiaokangQianfb665a82022-06-15 03:57:21 +00001147 key_cert->cert, MBEDTLS_OID_SERVER_AUTH,
Gilles Peskine449bd832023-01-11 14:50:10 +01001148 MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH)) != 0) {
1149 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
1150 "(extended) key usage extension"));
XiaokangQian81802f42022-06-10 13:25:22 +00001151 continue;
1152 }
XiaokangQian23c5be62022-06-07 02:04:34 +00001153
Gilles Peskine449bd832023-01-11 14:50:10 +01001154 MBEDTLS_SSL_DEBUG_MSG(3,
1155 ("ssl_tls13_pick_key_cert:"
1156 "check signature algorithm %s [%04x]",
1157 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1158 *sig_alg));
Ronald Cron67ea2542022-09-15 17:34:42 +02001159#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001160 psa_alg = ssl_tls13_iana_sig_alg_to_psa_alg(*sig_alg);
Ronald Cron67ea2542022-09-15 17:34:42 +02001161#endif /* MBEDTLS_USE_PSA_CRYPTO */
1162
Gilles Peskine449bd832023-01-11 14:50:10 +01001163 if (mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
1164 *sig_alg, &key_cert->cert->pk)
Ronald Cron67ea2542022-09-15 17:34:42 +02001165#if defined(MBEDTLS_USE_PSA_CRYPTO)
1166 && psa_alg != PSA_ALG_NONE &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001167 mbedtls_pk_can_do_ext(&key_cert->cert->pk, psa_alg,
1168 PSA_KEY_USAGE_SIGN_HASH) == 1
Ronald Cron67ea2542022-09-15 17:34:42 +02001169#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001170 ) {
XiaokangQianfb665a82022-06-15 03:57:21 +00001171 ssl->handshake->key_cert = key_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001172 MBEDTLS_SSL_DEBUG_MSG(3,
1173 ("ssl_tls13_pick_key_cert:"
1174 "selected signature algorithm"
1175 " %s [%04x]",
1176 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1177 *sig_alg));
XiaokangQianfb665a82022-06-15 03:57:21 +00001178 MBEDTLS_SSL_DEBUG_CRT(
Gilles Peskine449bd832023-01-11 14:50:10 +01001179 3, "selected certificate (chain)",
1180 ssl->handshake->key_cert->cert);
1181 return 0;
XiaokangQian81802f42022-06-10 13:25:22 +00001182 }
XiaokangQian81802f42022-06-10 13:25:22 +00001183 }
XiaokangQian23c5be62022-06-07 02:04:34 +00001184 }
1185
Gilles Peskine449bd832023-01-11 14:50:10 +01001186 MBEDTLS_SSL_DEBUG_MSG(2, ("ssl_tls13_pick_key_cert:"
1187 "no suitable certificate found"));
1188 return -1;
XiaokangQian23c5be62022-06-07 02:04:34 +00001189}
XiaokangQian81802f42022-06-10 13:25:22 +00001190#endif /* MBEDTLS_X509_CRT_PARSE_C &&
Ronald Cron928cbd32022-10-04 16:14:26 +02001191 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian23c5be62022-06-07 02:04:34 +00001192
XiaokangQian4080a7f2022-04-11 09:55:18 +00001193/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001194 *
1195 * STATE HANDLING: ClientHello
1196 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001197 * There are three possible classes of outcomes when parsing the ClientHello:
XiaokangQianed582dd2022-04-13 08:21:05 +00001198 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001199 * 1) The ClientHello was well-formed and matched the server's configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +00001200 *
1201 * In this case, the server progresses to sending its ServerHello.
1202 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001203 * 2) The ClientHello was well-formed but didn't match the server's
1204 * configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +00001205 *
1206 * For example, the client might not have offered a key share which
1207 * the server supports, or the server might require a cookie.
1208 *
1209 * In this case, the server sends a HelloRetryRequest.
1210 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001211 * 3) The ClientHello was ill-formed
XiaokangQianed582dd2022-04-13 08:21:05 +00001212 *
1213 * In this case, we abort the handshake.
1214 *
1215 */
1216
1217/*
XiaokangQian4080a7f2022-04-11 09:55:18 +00001218 * Structure of this message:
1219 *
XiaokangQiane8ff3502022-04-22 02:34:40 +00001220 * uint16 ProtocolVersion;
1221 * opaque Random[32];
1222 * uint8 CipherSuite[2]; // Cryptographic suite selector
XiaokangQian4080a7f2022-04-11 09:55:18 +00001223 *
XiaokangQiane8ff3502022-04-22 02:34:40 +00001224 * struct {
1225 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
1226 * Random random;
1227 * opaque legacy_session_id<0..32>;
1228 * CipherSuite cipher_suites<2..2^16-2>;
1229 * opaque legacy_compression_methods<1..2^8-1>;
1230 * Extension extensions<8..2^16-1>;
1231 * } ClientHello;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001232 */
XiaokangQianed582dd2022-04-13 08:21:05 +00001233
1234#define SSL_CLIENT_HELLO_OK 0
1235#define SSL_CLIENT_HELLO_HRR_REQUIRED 1
1236
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001237MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001238static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl,
1239 const unsigned char *buf,
1240 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001241{
XiaokangQianb67384d2022-04-19 00:02:38 +00001242 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1243 const unsigned char *p = buf;
Ronald Crond540d992023-03-07 09:41:48 +01001244 const unsigned char *random;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001245 size_t legacy_session_id_len;
Ronald Croncada4102023-03-07 09:51:39 +01001246 const unsigned char *legacy_session_id;
XiaokangQian318dc762022-04-20 09:43:51 +00001247 size_t cipher_suites_len;
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001248 const unsigned char *cipher_suites;
XiaokangQian060d8672022-04-21 09:24:56 +00001249 const unsigned char *cipher_suites_end;
XiaokangQianb67384d2022-04-19 00:02:38 +00001250 size_t extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001251 const unsigned char *extensions_end;
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001252 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu49ca9282022-05-05 11:05:22 +08001253 int hrr_required = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001254
Ronald Cron41a443a2022-10-04 16:38:25 +02001255#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yu29d9faa2022-08-23 17:52:45 +08001256 const unsigned char *pre_shared_key_ext = NULL;
Jerry Yu1c105562022-07-10 06:32:38 +00001257 const unsigned char *pre_shared_key_ext_end = NULL;
Ronald Cron41a443a2022-10-04 16:38:25 +02001258#endif
XiaokangQian7807f9f2022-02-15 10:04:37 +00001259
XiaokangQian7807f9f2022-02-15 10:04:37 +00001260 /*
XiaokangQianb67384d2022-04-19 00:02:38 +00001261 * ClientHello layout:
XiaokangQian7807f9f2022-02-15 10:04:37 +00001262 * 0 . 1 protocol version
XiaokangQiane8ff3502022-04-22 02:34:40 +00001263 * 2 . 33 random bytes
XiaokangQianc5763b52022-04-02 03:34:37 +00001264 * 34 . 34 session id length ( 1 byte )
XiaokangQian7807f9f2022-02-15 10:04:37 +00001265 * 35 . 34+x session id
XiaokangQian7807f9f2022-02-15 10:04:37 +00001266 * .. . .. ciphersuite list length ( 2 bytes )
1267 * .. . .. ciphersuite list
1268 * .. . .. compression alg. list length ( 1 byte )
1269 * .. . .. compression alg. list
1270 * .. . .. extensions length ( 2 bytes, optional )
1271 * .. . .. extensions ( optional )
1272 */
1273
XiaokangQianb67384d2022-04-19 00:02:38 +00001274 /*
bootstrap-prime6dbbf442022-05-17 19:30:44 -04001275 * Minimal length ( with everything empty and extensions omitted ) is
XiaokangQian7807f9f2022-02-15 10:04:37 +00001276 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1277 * read at least up to session id length without worrying.
1278 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001279 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 38);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001280
1281 /* ...
1282 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1283 * ...
1284 * with ProtocolVersion defined as:
1285 * uint16 ProtocolVersion;
1286 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001287 if (mbedtls_ssl_read_version(p, ssl->conf->transport) !=
1288 MBEDTLS_SSL_VERSION_TLS1_2) {
1289 MBEDTLS_SSL_DEBUG_MSG(1, ("Unsupported version of TLS."));
1290 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1291 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
1292 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001293 }
1294 p += 2;
1295
Jerry Yuc1be19f2022-04-23 16:11:39 +08001296 /* ...
1297 * Random random;
1298 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001299 * with Random defined as:
1300 * opaque Random[32];
XiaokangQian7807f9f2022-02-15 10:04:37 +00001301 */
Ronald Crond540d992023-03-07 09:41:48 +01001302 random = p;
XiaokangQian08037552022-04-20 07:16:41 +00001303 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001304
Jerry Yuc1be19f2022-04-23 16:11:39 +08001305 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001306 * opaque legacy_session_id<0..32>;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001307 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +00001308 */
Ronald Croncada4102023-03-07 09:51:39 +01001309 legacy_session_id_len = *(p++);
1310 legacy_session_id = p;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001311
XiaokangQianb67384d2022-04-19 00:02:38 +00001312 /*
1313 * Check we have enough data for the legacy session identifier
Jerry Yue95c8af2022-07-26 15:48:20 +08001314 * and the ciphersuite list length.
XiaokangQianb67384d2022-04-19 00:02:38 +00001315 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001316 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, legacy_session_id_len + 2);
XiaokangQian4080a7f2022-04-11 09:55:18 +00001317 p += legacy_session_id_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001318
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001319 /* ...
1320 * CipherSuite cipher_suites<2..2^16-2>;
1321 * ...
1322 * with CipherSuite defined as:
1323 * uint8 CipherSuite[2];
1324 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001325 cipher_suites_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001326 p += 2;
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001327 cipher_suites = p;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001328
Ronald Cronfc7ae872023-02-16 15:32:19 +01001329 /*
1330 * The length of the ciphersuite list has to be even.
1331 */
1332 if (cipher_suites_len & 1) {
1333 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1334 MBEDTLS_ERR_SSL_DECODE_ERROR);
1335 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1336 }
1337
XiaokangQianb67384d2022-04-19 00:02:38 +00001338 /* Check we have enough data for the ciphersuite list, the legacy
1339 * compression methods and the length of the extensions.
Jerry Yue95c8af2022-07-26 15:48:20 +08001340 *
1341 * cipher_suites cipher_suites_len bytes
1342 * legacy_compression_methods 2 bytes
1343 * extensions_len 2 bytes
XiaokangQianb67384d2022-04-19 00:02:38 +00001344 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001345 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, cipher_suites_len + 2 + 2);
XiaokangQian060d8672022-04-21 09:24:56 +00001346 cipher_suites_end = p + cipher_suites_len;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001347
1348 /*
Ronald Cron64582392023-03-07 09:21:40 +01001349 * Only support TLS 1.3 currently, temporarily set the version.
1350 */
1351 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1352
1353#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1354 /* Store minor version for later use with ticket serialization. */
1355 ssl->session_negotiate->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1356 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
1357#endif
1358
1359 /*
Ronald Crond540d992023-03-07 09:41:48 +01001360 * We are negotiation the version 1.3 of the protocol. Do what we have
Ronald Croncada4102023-03-07 09:51:39 +01001361 * postponed: copy of the client random bytes, copy of the legacy session
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001362 * identifier and selection of the TLS 1.3 cipher suite.
Ronald Crond540d992023-03-07 09:41:48 +01001363 */
1364 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes",
1365 random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1366 memcpy(&handshake->randbytes[0], random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1367
Ronald Croncada4102023-03-07 09:51:39 +01001368 if (legacy_session_id_len > sizeof(ssl->session_negotiate->id)) {
1369 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1370 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1371 }
1372 ssl->session_negotiate->id_len = legacy_session_id_len;
1373 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id",
1374 legacy_session_id, legacy_session_id_len);
1375 memcpy(&ssl->session_negotiate->id[0],
1376 legacy_session_id, legacy_session_id_len);
1377
Ronald Crond540d992023-03-07 09:41:48 +01001378 /*
Jerry Yu5725f1c2022-08-21 17:27:16 +08001379 * Search for a matching ciphersuite
1380 */
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001381 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, list of cipher suites",
1382 cipher_suites, cipher_suites_len);
1383 for (p = cipher_suites; p < cipher_suites_end; p += 2) {
XiaokangQiane8ff3502022-04-22 02:34:40 +00001384 uint16_t cipher_suite;
Gilles Peskine449bd832023-01-11 14:50:10 +01001385 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001386
Ronald Crond89360b2023-02-21 08:53:33 +01001387 /*
1388 * "cipher_suite_end - p is even" is an invariant of the loop. As
1389 * cipher_suites_end - p > 0, we have cipher_suites_end - p >= 2 and
1390 * it is thus safe to read two bytes.
1391 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001392 cipher_suite = MBEDTLS_GET_UINT16_BE(p, 0);
Jerry Yuc5a23a02022-08-25 10:51:44 +08001393 ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(
Gilles Peskine449bd832023-01-11 14:50:10 +01001394 ssl, cipher_suite);
1395 if (ciphersuite_info == NULL) {
Jerry Yu5725f1c2022-08-21 17:27:16 +08001396 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 }
Jerry Yu5725f1c2022-08-21 17:27:16 +08001398
Jerry Yu5725f1c2022-08-21 17:27:16 +08001399 ssl->session_negotiate->ciphersuite = cipher_suite;
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001400 handshake->ciphersuite_info = ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +01001401 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %04x - %s",
1402 cipher_suite,
1403 ciphersuite_info->name));
Ronald Cron25e9ec62023-02-16 15:35:16 +01001404 break;
XiaokangQian17f974c2022-04-19 09:57:41 +00001405 }
Jerry Yu5725f1c2022-08-21 17:27:16 +08001406
Gilles Peskine449bd832023-01-11 14:50:10 +01001407 if (handshake->ciphersuite_info == NULL) {
1408 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1409 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1410 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001411 }
Ronald Cron25e9ec62023-02-16 15:35:16 +01001412 p = cipher_suites_end;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001413
XiaokangQian4080a7f2022-04-11 09:55:18 +00001414 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001415 * opaque legacy_compression_methods<1..2^8-1>;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001416 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +00001417 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001418 if (p[0] != 1 || p[1] != MBEDTLS_SSL_COMPRESS_NULL) {
1419 MBEDTLS_SSL_DEBUG_MSG(1, ("bad legacy compression method"));
1420 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1421 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1422 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001423 }
XiaokangQianb67384d2022-04-19 00:02:38 +00001424 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001425
Jerry Yuc1be19f2022-04-23 16:11:39 +08001426 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001427 * Extension extensions<8..2^16-1>;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001428 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001429 * with Extension defined as:
1430 * struct {
1431 * ExtensionType extension_type;
1432 * opaque extension_data<0..2^16-1>;
1433 * } Extension;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001434 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001435 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001436 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01001437 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len);
XiaokangQiane8ff3502022-04-22 02:34:40 +00001438 extensions_end = p + extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001439
Gilles Peskine449bd832023-01-11 14:50:10 +01001440 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", p, extensions_len);
Jerry Yu63a459c2022-10-31 13:38:40 +08001441 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
Jerry Yu0c354a22022-08-29 15:25:36 +08001442
Gilles Peskine449bd832023-01-11 14:50:10 +01001443 while (p < extensions_end) {
XiaokangQian7807f9f2022-02-15 10:04:37 +00001444 unsigned int extension_type;
1445 size_t extension_data_len;
1446 const unsigned char *extension_data_end;
1447
Jerry Yu0c354a22022-08-29 15:25:36 +08001448 /* RFC 8446, section 4.2.11
Jerry Yu1c9247c2022-07-21 12:37:39 +08001449 *
1450 * The "pre_shared_key" extension MUST be the last extension in the
1451 * ClientHello (this facilitates implementation as described below).
1452 * Servers MUST check that it is the last extension and otherwise fail
1453 * the handshake with an "illegal_parameter" alert.
1454 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001455 if (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY)) {
Jerry Yu1c9247c2022-07-21 12:37:39 +08001456 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001457 3, ("pre_shared_key is not last extension."));
Jerry Yu1c9247c2022-07-21 12:37:39 +08001458 MBEDTLS_SSL_PEND_FATAL_ALERT(
1459 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01001460 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1461 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu1c9247c2022-07-21 12:37:39 +08001462 }
1463
Gilles Peskine449bd832023-01-11 14:50:10 +01001464 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
1465 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
1466 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001467 p += 4;
1468
Gilles Peskine449bd832023-01-11 14:50:10 +01001469 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001470 extension_data_end = p + extension_data_len;
1471
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001472 ret = mbedtls_ssl_tls13_check_received_extension(
Gilles Peskine449bd832023-01-11 14:50:10 +01001473 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, extension_type,
1474 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CH);
1475 if (ret != 0) {
1476 return ret;
1477 }
Jerry Yue18dc7e2022-08-04 16:29:22 +08001478
Gilles Peskine449bd832023-01-11 14:50:10 +01001479 switch (extension_type) {
XiaokangQian40a35232022-05-07 09:02:40 +00001480#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1481 case MBEDTLS_TLS_EXT_SERVERNAME:
Gilles Peskine449bd832023-01-11 14:50:10 +01001482 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension"));
1483 ret = mbedtls_ssl_parse_server_name_ext(ssl, p,
1484 extension_data_end);
1485 if (ret != 0) {
XiaokangQian40a35232022-05-07 09:02:40 +00001486 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001487 1, "mbedtls_ssl_parse_servername_ext", ret);
1488 return ret;
XiaokangQian40a35232022-05-07 09:02:40 +00001489 }
XiaokangQian40a35232022-05-07 09:02:40 +00001490 break;
1491#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1492
Valerio Setti080a22b2023-03-20 15:22:47 +01001493#if defined(PSA_WANT_ALG_ECDH)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001494 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
Gilles Peskine449bd832023-01-11 14:50:10 +01001495 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported group extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001496
1497 /* Supported Groups Extension
1498 *
1499 * When sent by the client, the "supported_groups" extension
1500 * indicates the named groups which the client supports,
1501 * ordered from most preferred to least preferred.
1502 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001503 ret = ssl_tls13_parse_supported_groups_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001504 ssl, p, extension_data_end);
1505 if (ret != 0) {
1506 MBEDTLS_SSL_DEBUG_RET(1,
1507 "mbedtls_ssl_parse_supported_groups_ext", ret);
1508 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001509 }
1510
XiaokangQian7807f9f2022-02-15 10:04:37 +00001511 break;
Valerio Setti080a22b2023-03-20 15:22:47 +01001512#endif /* PSA_WANT_ALG_ECDH */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001513
Valerio Setti080a22b2023-03-20 15:22:47 +01001514#if defined(PSA_WANT_ALG_ECDH)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001515 case MBEDTLS_TLS_EXT_KEY_SHARE:
Gilles Peskine449bd832023-01-11 14:50:10 +01001516 MBEDTLS_SSL_DEBUG_MSG(3, ("found key share extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001517
1518 /*
1519 * Key Share Extension
1520 *
1521 * When sent by the client, the "key_share" extension
1522 * contains the endpoint's cryptographic parameters for
1523 * ECDHE/DHE key establishment methods.
1524 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001525 ret = ssl_tls13_parse_key_shares_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001526 ssl, p, extension_data_end);
1527 if (ret == SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH) {
1528 MBEDTLS_SSL_DEBUG_MSG(2, ("HRR needed "));
Jerry Yu49ca9282022-05-05 11:05:22 +08001529 hrr_required = 1;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001530 }
1531
Gilles Peskine449bd832023-01-11 14:50:10 +01001532 if (ret < 0) {
Jerry Yu582dd062022-04-22 21:59:01 +08001533 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001534 1, "ssl_tls13_parse_key_shares_ext", ret);
1535 return ret;
Jerry Yu582dd062022-04-22 21:59:01 +08001536 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001537
XiaokangQian7807f9f2022-02-15 10:04:37 +00001538 break;
Valerio Setti080a22b2023-03-20 15:22:47 +01001539#endif /* PSA_WANT_ALG_ECDH */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001540
1541 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +01001542 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported versions extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001543
1544 ret = ssl_tls13_parse_supported_versions_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001545 ssl, p, extension_data_end);
1546 if (ret != 0) {
1547 MBEDTLS_SSL_DEBUG_RET(1,
1548 ("ssl_tls13_parse_supported_versions_ext"), ret);
1549 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001550 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001551 break;
1552
Ronald Cron41a443a2022-10-04 16:38:25 +02001553#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yue19e3b92022-07-08 12:04:51 +00001554 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
Gilles Peskine449bd832023-01-11 14:50:10 +01001555 MBEDTLS_SSL_DEBUG_MSG(3, ("found psk key exchange modes extension"));
Jerry Yue19e3b92022-07-08 12:04:51 +00001556
1557 ret = ssl_tls13_parse_key_exchange_modes_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001558 ssl, p, extension_data_end);
1559 if (ret != 0) {
Jerry Yue19e3b92022-07-08 12:04:51 +00001560 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001561 1, "ssl_tls13_parse_key_exchange_modes_ext", ret);
1562 return ret;
Jerry Yue19e3b92022-07-08 12:04:51 +00001563 }
1564
Jerry Yue19e3b92022-07-08 12:04:51 +00001565 break;
Ronald Cron41a443a2022-10-04 16:38:25 +02001566#endif
Jerry Yue19e3b92022-07-08 12:04:51 +00001567
Jerry Yu1c105562022-07-10 06:32:38 +00001568 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01001569 MBEDTLS_SSL_DEBUG_MSG(3, ("found pre_shared_key extension"));
1570 if ((handshake->received_extensions &
1571 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES)) == 0) {
Jerry Yu13ab81d2022-07-22 23:17:11 +08001572 MBEDTLS_SSL_PEND_FATAL_ALERT(
1573 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01001574 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1575 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu13ab81d2022-07-22 23:17:11 +08001576 }
Ronald Cron41a443a2022-10-04 16:38:25 +02001577#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yu1c105562022-07-10 06:32:38 +00001578 /* Delay processing of the PSK identity once we have
1579 * found out which algorithms to use. We keep a pointer
1580 * to the buffer and the size for later processing.
1581 */
Jerry Yu29d9faa2022-08-23 17:52:45 +08001582 pre_shared_key_ext = p;
Jerry Yu1c105562022-07-10 06:32:38 +00001583 pre_shared_key_ext_end = extension_data_end;
Jerry Yue18dc7e2022-08-04 16:29:22 +08001584#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yu1c105562022-07-10 06:32:38 +00001585 break;
Jerry Yu1c105562022-07-10 06:32:38 +00001586
XiaokangQianacb39922022-06-17 10:18:48 +00001587#if defined(MBEDTLS_SSL_ALPN)
1588 case MBEDTLS_TLS_EXT_ALPN:
Gilles Peskine449bd832023-01-11 14:50:10 +01001589 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension"));
XiaokangQianacb39922022-06-17 10:18:48 +00001590
Gilles Peskine449bd832023-01-11 14:50:10 +01001591 ret = mbedtls_ssl_parse_alpn_ext(ssl, p, extension_data_end);
1592 if (ret != 0) {
XiaokangQianacb39922022-06-17 10:18:48 +00001593 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001594 1, ("mbedtls_ssl_parse_alpn_ext"), ret);
1595 return ret;
XiaokangQianacb39922022-06-17 10:18:48 +00001596 }
XiaokangQianacb39922022-06-17 10:18:48 +00001597 break;
1598#endif /* MBEDTLS_SSL_ALPN */
1599
Ronald Cron928cbd32022-10-04 16:14:26 +02001600#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001601 case MBEDTLS_TLS_EXT_SIG_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +01001602 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001603
Gabor Mezei078e8032022-04-27 21:17:56 +02001604 ret = mbedtls_ssl_parse_sig_alg_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001605 ssl, p, extension_data_end);
1606 if (ret != 0) {
1607 MBEDTLS_SSL_DEBUG_MSG(1,
1608 (
1609 "ssl_parse_supported_signature_algorithms_server_ext ( %d )",
1610 ret));
1611 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001612 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001613 break;
Ronald Cron928cbd32022-10-04 16:14:26 +02001614#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001615
Jan Bruckner151f6422023-02-10 12:45:19 +01001616#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
1617 case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
1618 MBEDTLS_SSL_DEBUG_MSG(3, ("found record_size_limit extension"));
1619
1620 ret = mbedtls_ssl_tls13_parse_record_size_limit_ext(ssl, p, extension_data_end);
1621
Jan Bruckner1a38e542023-03-15 14:15:11 +01001622 /* TODO: Return unconditionally here until we handle the record size limit correctly.
1623 * Once handled correctly, only return in case of errors. */
Jan Bruckner151f6422023-02-10 12:45:19 +01001624 return ret;
1625
1626 break;
1627#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
1628
XiaokangQian7807f9f2022-02-15 10:04:37 +00001629 default:
Jerry Yu79aa7212022-11-08 21:30:21 +08001630 MBEDTLS_SSL_PRINT_EXT(
Jerry Yu63a459c2022-10-31 13:38:40 +08001631 3, MBEDTLS_SSL_HS_CLIENT_HELLO,
Gilles Peskine449bd832023-01-11 14:50:10 +01001632 extension_type, "( ignored )");
Jerry Yu0c354a22022-08-29 15:25:36 +08001633 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001634 }
1635
1636 p += extension_data_len;
1637 }
1638
Gilles Peskine449bd832023-01-11 14:50:10 +01001639 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CLIENT_HELLO,
1640 handshake->received_extensions);
Jerry Yue18dc7e2022-08-04 16:29:22 +08001641
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001642 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl,
1643 MBEDTLS_SSL_HS_CLIENT_HELLO,
1644 p - buf);
1645 if (0 != ret) {
1646 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_add_hs_hdr_to_checksum"), ret);
1647 return ret;
1648 }
Jerry Yu032b15ce2022-07-11 06:10:03 +00001649
Ronald Cron41a443a2022-10-04 16:38:25 +02001650#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001651 /* Update checksum with either
1652 * - The entire content of the CH message, if no PSK extension is present
1653 * - The content up to but excluding the PSK extension, if present.
1654 */
Jerry Yu1c105562022-07-10 06:32:38 +00001655 /* If we've settled on a PSK-based exchange, parse PSK identity ext */
Gilles Peskine449bd832023-01-11 14:50:10 +01001656 if (mbedtls_ssl_tls13_some_psk_enabled(ssl) &&
1657 mbedtls_ssl_conf_tls13_some_psk_enabled(ssl) &&
1658 (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY))) {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001659 ret = handshake->update_checksum(ssl, buf,
1660 pre_shared_key_ext - buf);
1661 if (0 != ret) {
1662 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1663 return ret;
1664 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001665 ret = ssl_tls13_parse_pre_shared_key_ext(ssl,
1666 pre_shared_key_ext,
1667 pre_shared_key_ext_end,
1668 cipher_suites,
1669 cipher_suites_end);
1670 if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) {
1671 handshake->received_extensions &= ~MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY);
1672 } else if (ret != 0) {
Jerry Yu63a459c2022-10-31 13:38:40 +08001673 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001674 1, "ssl_tls13_parse_pre_shared_key_ext", ret);
1675 return ret;
Jerry Yu1c105562022-07-10 06:32:38 +00001676 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001677 } else
Ronald Cron41a443a2022-10-04 16:38:25 +02001678#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yu1c105562022-07-10 06:32:38 +00001679 {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001680 ret = handshake->update_checksum(ssl, buf, p - buf);
1681 if (0 != ret) {
1682 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1683 return ret;
1684 }
Jerry Yu1c105562022-07-10 06:32:38 +00001685 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001686
Gilles Peskine449bd832023-01-11 14:50:10 +01001687 ret = ssl_tls13_determine_key_exchange_mode(ssl);
1688 if (ret < 0) {
1689 return ret;
1690 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001691
Gilles Peskine449bd832023-01-11 14:50:10 +01001692 mbedtls_ssl_optimize_checksum(ssl, handshake->ciphersuite_info);
Jerry Yue5834fd2022-08-29 20:16:09 +08001693
Gilles Peskine449bd832023-01-11 14:50:10 +01001694 return hrr_required ? SSL_CLIENT_HELLO_HRR_REQUIRED : SSL_CLIENT_HELLO_OK;
XiaokangQian75fe8c72022-06-15 09:42:45 +00001695}
1696
1697/* Update the handshake state machine */
1698
Ronald Cronce7d76e2022-07-08 18:56:49 +02001699MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001700static int ssl_tls13_postprocess_client_hello(mbedtls_ssl_context *ssl)
XiaokangQian75fe8c72022-06-15 09:42:45 +00001701{
1702 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1703
XiaokangQian7807f9f2022-02-15 10:04:37 +00001704 /*
XiaokangQianfb665a82022-06-15 03:57:21 +00001705 * Server certificate selection
1706 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001707 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) {
1708 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret);
1709 return ret;
XiaokangQianfb665a82022-06-15 03:57:21 +00001710 }
1711#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1712 ssl->handshake->sni_name = NULL;
1713 ssl->handshake->sni_name_len = 0;
1714#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001715
Gilles Peskine449bd832023-01-11 14:50:10 +01001716 ret = mbedtls_ssl_tls13_key_schedule_stage_early(ssl);
1717 if (ret != 0) {
1718 MBEDTLS_SSL_DEBUG_RET(1,
1719 "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret);
1720 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001721 }
1722
Gilles Peskine449bd832023-01-11 14:50:10 +01001723 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001724
1725}
1726
1727/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001728 * Main entry point from the state machine; orchestrates the otherfunctions.
1729 */
1730
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001731MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001732static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
XiaokangQianed582dd2022-04-13 08:21:05 +00001733{
1734
XiaokangQian08037552022-04-20 07:16:41 +00001735 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01001736 unsigned char *buf = NULL;
XiaokangQianed582dd2022-04-13 08:21:05 +00001737 size_t buflen = 0;
Jerry Yu4ca91402022-05-09 15:50:57 +08001738 int parse_client_hello_ret;
1739
Gilles Peskine449bd832023-01-11 14:50:10 +01001740 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
XiaokangQianed582dd2022-04-13 08:21:05 +00001741
Gilles Peskine449bd832023-01-11 14:50:10 +01001742 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
1743 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
1744 &buf, &buflen));
XiaokangQianed582dd2022-04-13 08:21:05 +00001745
Gilles Peskine449bd832023-01-11 14:50:10 +01001746 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf,
1747 buf + buflen));
Jerry Yuf41553b2022-05-09 22:20:30 +08001748 parse_client_hello_ret = ret; /* Store return value of parse_client_hello,
1749 * only SSL_CLIENT_HELLO_OK or
1750 * SSL_CLIENT_HELLO_HRR_REQUIRED at this
1751 * stage as negative error codes are handled
1752 * by MBEDTLS_SSL_PROC_CHK_NEG. */
Jerry Yu4ca91402022-05-09 15:50:57 +08001753
Gilles Peskine449bd832023-01-11 14:50:10 +01001754 MBEDTLS_SSL_PROC_CHK(ssl_tls13_postprocess_client_hello(ssl));
Jerry Yu582dd062022-04-22 21:59:01 +08001755
Gilles Peskine449bd832023-01-11 14:50:10 +01001756 if (parse_client_hello_ret == SSL_CLIENT_HELLO_OK) {
1757 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO);
1758 } else {
1759 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST);
1760 }
XiaokangQianed582dd2022-04-13 08:21:05 +00001761
1762cleanup:
1763
Gilles Peskine449bd832023-01-11 14:50:10 +01001764 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello"));
1765 return ret;
XiaokangQianed582dd2022-04-13 08:21:05 +00001766}
1767
1768/*
Jerry Yu1c3e6882022-04-20 21:23:40 +08001769 * Handler for MBEDTLS_SSL_SERVER_HELLO
Jerry Yu5b64ae92022-03-30 17:15:02 +08001770 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001771MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001772static int ssl_tls13_prepare_server_hello(mbedtls_ssl_context *ssl)
Jerry Yuf4b27e42022-03-30 17:32:21 +08001773{
Jerry Yu637a3f12022-04-20 21:37:58 +08001774 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1775 unsigned char *server_randbytes =
Gilles Peskine449bd832023-01-11 14:50:10 +01001776 ssl->handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
1777 if (ssl->conf->f_rng == NULL) {
1778 MBEDTLS_SSL_DEBUG_MSG(1, ("no RNG provided"));
1779 return MBEDTLS_ERR_SSL_NO_RNG;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001780 }
1781
Gilles Peskine449bd832023-01-11 14:50:10 +01001782 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, server_randbytes,
1783 MBEDTLS_SERVER_HELLO_RANDOM_LEN)) != 0) {
1784 MBEDTLS_SSL_DEBUG_RET(1, "f_rng", ret);
1785 return ret;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001786 }
1787
Gilles Peskine449bd832023-01-11 14:50:10 +01001788 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", server_randbytes,
1789 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yuf4b27e42022-03-30 17:32:21 +08001790
1791#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01001792 ssl->session_negotiate->start = time(NULL);
Jerry Yuf4b27e42022-03-30 17:32:21 +08001793#endif /* MBEDTLS_HAVE_TIME */
1794
Gilles Peskine449bd832023-01-11 14:50:10 +01001795 return ret;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001796}
1797
Jerry Yu3bf2c642022-03-30 22:02:12 +08001798/*
Jerry Yue74e04a2022-04-21 09:23:16 +08001799 * ssl_tls13_write_server_hello_supported_versions_ext ():
Jerry Yu3bf2c642022-03-30 22:02:12 +08001800 *
1801 * struct {
Jerry Yufb9f54d2022-04-06 10:08:34 +08001802 * ProtocolVersion selected_version;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001803 * } SupportedVersions;
1804 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001805MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yue74e04a2022-04-21 09:23:16 +08001806static int ssl_tls13_write_server_hello_supported_versions_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001807 mbedtls_ssl_context *ssl,
1808 unsigned char *buf,
1809 unsigned char *end,
1810 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001811{
Jerry Yu3bf2c642022-03-30 22:02:12 +08001812 *out_len = 0;
1813
Gilles Peskine449bd832023-01-11 14:50:10 +01001814 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, write selected version"));
Jerry Yu3bf2c642022-03-30 22:02:12 +08001815
1816 /* Check if we have space to write the extension:
1817 * - extension_type (2 bytes)
1818 * - extension_data_length (2 bytes)
Jerry Yu349a6132022-04-14 20:52:56 +08001819 * - selected_version (2 bytes)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001820 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001821 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001822
Gilles Peskine449bd832023-01-11 14:50:10 +01001823 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, buf, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001824
Gilles Peskine449bd832023-01-11 14:50:10 +01001825 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001826
Gilles Peskine449bd832023-01-11 14:50:10 +01001827 mbedtls_ssl_write_version(buf + 4,
1828 ssl->conf->transport,
1829 ssl->tls_version);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001830
Gilles Peskine449bd832023-01-11 14:50:10 +01001831 MBEDTLS_SSL_DEBUG_MSG(3, ("supported version: [%04x]",
1832 ssl->tls_version));
Jerry Yu3bf2c642022-03-30 22:02:12 +08001833
Jerry Yu349a6132022-04-14 20:52:56 +08001834 *out_len = 6;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001835
Jerry Yub95dd362022-11-08 21:19:34 +08001836 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
Gilles Peskine449bd832023-01-11 14:50:10 +01001837 ssl, MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS);
Jerry Yub95dd362022-11-08 21:19:34 +08001838
Gilles Peskine449bd832023-01-11 14:50:10 +01001839 return 0;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001840}
1841
Jerry Yud9436a12022-04-20 22:28:09 +08001842
Jerry Yu3bf2c642022-03-30 22:02:12 +08001843
1844/* Generate and export a single key share. For hybrid KEMs, this can
1845 * be called multiple times with the different components of the hybrid. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001846MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001847static int ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context *ssl,
1848 uint16_t named_group,
1849 unsigned char *buf,
1850 unsigned char *end,
1851 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001852{
1853 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu955ddd72022-04-22 22:27:33 +08001854
1855 *out_len = 0;
1856
Valerio Setti080a22b2023-03-20 15:22:47 +01001857#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01001858 if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) {
Jerry Yu89e103c2022-03-30 22:43:29 +08001859 ret = mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +01001860 ssl, named_group, buf, end, out_len);
1861 if (ret != 0) {
Jerry Yu89e103c2022-03-30 22:43:29 +08001862 MBEDTLS_SSL_DEBUG_RET(
1863 1, "mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange",
Gilles Peskine449bd832023-01-11 14:50:10 +01001864 ret);
1865 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001866 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001867 } else
Valerio Setti080a22b2023-03-20 15:22:47 +01001868#endif /* PSA_WANT_ALG_ECDH */
Gilles Peskine449bd832023-01-11 14:50:10 +01001869 if (0 /* Other kinds of KEMs */) {
1870 } else {
Jerry Yu955ddd72022-04-22 22:27:33 +08001871 ((void) ssl);
1872 ((void) named_group);
1873 ((void) buf);
1874 ((void) end);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001875 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1876 }
1877
Gilles Peskine449bd832023-01-11 14:50:10 +01001878 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001879}
1880
1881/*
1882 * ssl_tls13_write_key_share_ext
1883 *
1884 * Structure of key_share extension in ServerHello:
1885 *
Jerry Yu1c3e6882022-04-20 21:23:40 +08001886 * struct {
1887 * NamedGroup group;
1888 * opaque key_exchange<1..2^16-1>;
1889 * } KeyShareEntry;
1890 * struct {
1891 * KeyShareEntry server_share;
1892 * } KeyShareServerHello;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001893 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001894MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001895static int ssl_tls13_write_key_share_ext(mbedtls_ssl_context *ssl,
1896 unsigned char *buf,
1897 unsigned char *end,
1898 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001899{
Jerry Yu955ddd72022-04-22 22:27:33 +08001900 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001901 unsigned char *p = buf;
Jerry Yu57d48412022-04-20 21:50:42 +08001902 uint16_t group = ssl->handshake->offered_group_id;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001903 unsigned char *server_share = buf + 4;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001904 size_t key_exchange_length;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001905
1906 *out_len = 0;
1907
Gilles Peskine449bd832023-01-11 14:50:10 +01001908 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding key share extension"));
Jerry Yu3bf2c642022-03-30 22:02:12 +08001909
Gilles Peskine449bd832023-01-11 14:50:10 +01001910 MBEDTLS_SSL_DEBUG_MSG(2, ("server hello, write selected_group: %s (%04x)",
1911 mbedtls_ssl_named_group_to_str(group),
1912 group));
Jerry Yu58af2332022-09-06 11:19:31 +08001913
Jerry Yu3bf2c642022-03-30 22:02:12 +08001914 /* Check if we have space for header and length fields:
1915 * - extension_type (2 bytes)
1916 * - extension_data_length (2 bytes)
1917 * - group (2 bytes)
1918 * - key_exchange_length (2 bytes)
1919 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001920 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 8);
1921 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, p, 0);
1922 MBEDTLS_PUT_UINT16_BE(group, server_share, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001923 p += 8;
Jerry Yu57d48412022-04-20 21:50:42 +08001924
Jerry Yu3bf2c642022-03-30 22:02:12 +08001925 /* When we introduce PQC-ECDHE hybrids, we'll want to call this
1926 * function multiple times. */
Jerry Yu955ddd72022-04-22 22:27:33 +08001927 ret = ssl_tls13_generate_and_write_key_share(
Gilles Peskine449bd832023-01-11 14:50:10 +01001928 ssl, group, server_share + 4, end, &key_exchange_length);
1929 if (ret != 0) {
1930 return ret;
1931 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08001932 p += key_exchange_length;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001933
Gilles Peskine449bd832023-01-11 14:50:10 +01001934 MBEDTLS_PUT_UINT16_BE(key_exchange_length, server_share + 2, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001935
Gilles Peskine449bd832023-01-11 14:50:10 +01001936 MBEDTLS_PUT_UINT16_BE(p - server_share, buf, 2);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001937
Jerry Yu57d48412022-04-20 21:50:42 +08001938 *out_len = p - buf;
Jerry Yu955ddd72022-04-22 22:27:33 +08001939
Gilles Peskine449bd832023-01-11 14:50:10 +01001940 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
Jerry Yub95dd362022-11-08 21:19:34 +08001941
Gilles Peskine449bd832023-01-11 14:50:10 +01001942 return 0;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001943}
Jerry Yud9436a12022-04-20 22:28:09 +08001944
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001945MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001946static int ssl_tls13_write_hrr_key_share_ext(mbedtls_ssl_context *ssl,
1947 unsigned char *buf,
1948 unsigned char *end,
1949 size_t *out_len)
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001950{
1951 uint16_t selected_group = ssl->handshake->hrr_selected_group;
1952 /* key_share Extension
1953 *
1954 * struct {
1955 * select (Handshake.msg_type) {
1956 * ...
1957 * case hello_retry_request:
1958 * NamedGroup selected_group;
1959 * ...
1960 * };
1961 * } KeyShare;
1962 */
1963
1964 *out_len = 0;
1965
Jerry Yub0ac10b2022-05-05 11:10:08 +08001966 /*
1967 * For a pure PSK key exchange, there is no group to agree upon. The purpose
1968 * of the HRR is then to transmit a cookie to force the client to demonstrate
1969 * reachability at their apparent network address (primarily useful for DTLS).
1970 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001971 if (!mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
1972 return 0;
1973 }
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001974
1975 /* We should only send the key_share extension if the client's initial
1976 * key share was not acceptable. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001977 if (ssl->handshake->offered_group_id != 0) {
1978 MBEDTLS_SSL_DEBUG_MSG(4, ("Skip key_share extension in HRR"));
1979 return 0;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001980 }
1981
Gilles Peskine449bd832023-01-11 14:50:10 +01001982 if (selected_group == 0) {
1983 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching named group found"));
1984 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001985 }
1986
Jerry Yub0ac10b2022-05-05 11:10:08 +08001987 /* Check if we have enough space:
1988 * - extension_type (2 bytes)
1989 * - extension_data_length (2 bytes)
1990 * - selected_group (2 bytes)
1991 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001992 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001993
Gilles Peskine449bd832023-01-11 14:50:10 +01001994 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0);
1995 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
1996 MBEDTLS_PUT_UINT16_BE(selected_group, buf, 4);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08001997
Gilles Peskine449bd832023-01-11 14:50:10 +01001998 MBEDTLS_SSL_DEBUG_MSG(3,
1999 ("HRR selected_group: %s (%x)",
2000 mbedtls_ssl_named_group_to_str(selected_group),
2001 selected_group));
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002002
2003 *out_len = 6;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002004
Gilles Peskine449bd832023-01-11 14:50:10 +01002005 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
Jerry Yub95dd362022-11-08 21:19:34 +08002006
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 return 0;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002008}
Jerry Yu3bf2c642022-03-30 22:02:12 +08002009
2010/*
2011 * Structure of ServerHello message:
2012 *
2013 * struct {
2014 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
2015 * Random random;
2016 * opaque legacy_session_id_echo<0..32>;
2017 * CipherSuite cipher_suite;
2018 * uint8 legacy_compression_method = 0;
2019 * Extension extensions<6..2^16-1>;
2020 * } ServerHello;
2021 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002022MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002023static int ssl_tls13_write_server_hello_body(mbedtls_ssl_context *ssl,
2024 unsigned char *buf,
2025 unsigned char *end,
2026 size_t *out_len,
2027 int is_hrr)
Jerry Yu56404d72022-03-30 17:36:13 +08002028{
Jerry Yu955ddd72022-04-22 22:27:33 +08002029 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002030 unsigned char *p = buf;
Jerry Yud9436a12022-04-20 22:28:09 +08002031 unsigned char *p_extensions_len;
Jerry Yufbe3e642022-04-25 19:31:51 +08002032 size_t output_len;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002033
2034 *out_len = 0;
Jerry Yu50e00e32022-10-31 14:45:01 +08002035 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002036
Jerry Yucfc04b32022-04-21 09:31:58 +08002037 /* ...
2038 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
2039 * ...
2040 * with ProtocolVersion defined as:
2041 * uint16 ProtocolVersion;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002042 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002043 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2044 MBEDTLS_PUT_UINT16_BE(0x0303, p, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002045 p += 2;
2046
Jerry Yu1c3e6882022-04-20 21:23:40 +08002047 /* ...
2048 * Random random;
2049 * ...
Jerry Yucfc04b32022-04-21 09:31:58 +08002050 * with Random defined as:
2051 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu1c3e6882022-04-20 21:23:40 +08002052 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002053 MBEDTLS_SSL_CHK_BUF_PTR(p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2054 if (is_hrr) {
2055 memcpy(p, mbedtls_ssl_tls13_hello_retry_request_magic,
2056 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2057 } else {
2058 memcpy(p, &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN],
2059 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002060 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002061 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes",
2062 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002063 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
2064
Jerry Yucfc04b32022-04-21 09:31:58 +08002065 /* ...
2066 * opaque legacy_session_id_echo<0..32>;
2067 * ...
Jerry Yu3bf2c642022-03-30 22:02:12 +08002068 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002069 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1 + ssl->session_negotiate->id_len);
2070 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2071 if (ssl->session_negotiate->id_len > 0) {
2072 memcpy(p, &ssl->session_negotiate->id[0],
2073 ssl->session_negotiate->id_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002074 p += ssl->session_negotiate->id_len;
Jerry Yu955ddd72022-04-22 22:27:33 +08002075
Gilles Peskine449bd832023-01-11 14:50:10 +01002076 MBEDTLS_SSL_DEBUG_BUF(3, "session id", ssl->session_negotiate->id,
2077 ssl->session_negotiate->id_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002078 }
2079
Jerry Yucfc04b32022-04-21 09:31:58 +08002080 /* ...
2081 * CipherSuite cipher_suite;
2082 * ...
2083 * with CipherSuite defined as:
2084 * uint8 CipherSuite[2];
Jerry Yu3bf2c642022-03-30 22:02:12 +08002085 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002086 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2087 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002088 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002089 MBEDTLS_SSL_DEBUG_MSG(3,
2090 ("server hello, chosen ciphersuite: %s ( id=%d )",
2091 mbedtls_ssl_get_ciphersuite_name(
2092 ssl->session_negotiate->ciphersuite),
2093 ssl->session_negotiate->ciphersuite));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002094
Jerry Yucfc04b32022-04-21 09:31:58 +08002095 /* ...
2096 * uint8 legacy_compression_method = 0;
2097 * ...
2098 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002099 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1);
Thomas Daubney31e03a82022-07-25 15:59:25 +01002100 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002101
Jerry Yucfc04b32022-04-21 09:31:58 +08002102 /* ...
2103 * Extension extensions<6..2^16-1>;
2104 * ...
2105 * struct {
2106 * ExtensionType extension_type; (2 bytes)
2107 * opaque extension_data<0..2^16-1>;
2108 * } Extension;
2109 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002110 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yud9436a12022-04-20 22:28:09 +08002111 p_extensions_len = p;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002112 p += 2;
2113
Gilles Peskine449bd832023-01-11 14:50:10 +01002114 if ((ret = ssl_tls13_write_server_hello_supported_versions_ext(
2115 ssl, p, end, &output_len)) != 0) {
Jerry Yu955ddd72022-04-22 22:27:33 +08002116 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01002117 1, "ssl_tls13_write_server_hello_supported_versions_ext", ret);
2118 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002119 }
2120 p += output_len;
2121
Gilles Peskine449bd832023-01-11 14:50:10 +01002122 if (mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2123 if (is_hrr) {
2124 ret = ssl_tls13_write_hrr_key_share_ext(ssl, p, end, &output_len);
2125 } else {
2126 ret = ssl_tls13_write_key_share_ext(ssl, p, end, &output_len);
2127 }
2128 if (ret != 0) {
2129 return ret;
2130 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002131 p += output_len;
2132 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002133
Ronald Cron41a443a2022-10-04 16:38:25 +02002134#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002135 if (!is_hrr && mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2136 ret = ssl_tls13_write_server_pre_shared_key_ext(ssl, p, end, &output_len);
2137 if (ret != 0) {
2138 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_server_pre_shared_key_ext",
2139 ret);
2140 return ret;
Jerry Yu032b15ce2022-07-11 06:10:03 +00002141 }
2142 p += output_len;
2143 }
Ronald Cron41a443a2022-10-04 16:38:25 +02002144#endif
Jerry Yu032b15ce2022-07-11 06:10:03 +00002145
Gilles Peskine449bd832023-01-11 14:50:10 +01002146 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002147
Gilles Peskine449bd832023-01-11 14:50:10 +01002148 MBEDTLS_SSL_DEBUG_BUF(4, "server hello extensions",
2149 p_extensions_len, p - p_extensions_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002150
Jerry Yud9436a12022-04-20 22:28:09 +08002151 *out_len = p - buf;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002152
Gilles Peskine449bd832023-01-11 14:50:10 +01002153 MBEDTLS_SSL_DEBUG_BUF(3, "server hello", buf, *out_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002154
Jerry Yu7de2ff02022-11-08 21:43:46 +08002155 MBEDTLS_SSL_PRINT_EXTS(
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002156 3, is_hrr ? MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST :
Gilles Peskine449bd832023-01-11 14:50:10 +01002157 MBEDTLS_SSL_HS_SERVER_HELLO,
2158 ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002159
Gilles Peskine449bd832023-01-11 14:50:10 +01002160 return ret;
Jerry Yu56404d72022-03-30 17:36:13 +08002161}
2162
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002163MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian934ce6f2023-02-06 10:23:04 +00002164static int ssl_tls13_finalize_server_hello(mbedtls_ssl_context *ssl)
Jerry Yue110d252022-05-05 10:19:22 +08002165{
2166 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002167 ret = mbedtls_ssl_tls13_compute_handshake_transform(ssl);
2168 if (ret != 0) {
2169 MBEDTLS_SSL_DEBUG_RET(1,
2170 "mbedtls_ssl_tls13_compute_handshake_transform",
2171 ret);
2172 return ret;
Jerry Yue110d252022-05-05 10:19:22 +08002173 }
2174
Gilles Peskine449bd832023-01-11 14:50:10 +01002175 return ret;
Jerry Yue110d252022-05-05 10:19:22 +08002176}
2177
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002178MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002179static int ssl_tls13_write_server_hello(mbedtls_ssl_context *ssl)
Jerry Yu5b64ae92022-03-30 17:15:02 +08002180{
Jerry Yu637a3f12022-04-20 21:37:58 +08002181 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yuf4b27e42022-03-30 17:32:21 +08002182 unsigned char *buf;
2183 size_t buf_len, msg_len;
2184
Gilles Peskine449bd832023-01-11 14:50:10 +01002185 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello"));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002186
Gilles Peskine449bd832023-01-11 14:50:10 +01002187 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_server_hello(ssl));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002188
Gilles Peskine449bd832023-01-11 14:50:10 +01002189 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
2190 MBEDTLS_SSL_HS_SERVER_HELLO, &buf,
2191 &buf_len));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002192
Gilles Peskine449bd832023-01-11 14:50:10 +01002193 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2194 buf + buf_len,
2195 &msg_len,
2196 0));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002197
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002198 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002199 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002200
Gilles Peskine449bd832023-01-11 14:50:10 +01002201 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2202 ssl, buf_len, msg_len));
Jerry Yu637a3f12022-04-20 21:37:58 +08002203
Xiaokang Qian934ce6f2023-02-06 10:23:04 +00002204 MBEDTLS_SSL_PROC_CHK(ssl_tls13_finalize_server_hello(ssl));
Jerry Yue110d252022-05-05 10:19:22 +08002205
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002206#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2207 /* The server sends a dummy change_cipher_spec record immediately
2208 * after its first handshake message. This may either be after
2209 * a ServerHello or a HelloRetryRequest.
2210 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02002211 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002212 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002213#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002214 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002215#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yue110d252022-05-05 10:19:22 +08002216
Jerry Yuf4b27e42022-03-30 17:32:21 +08002217cleanup:
2218
Gilles Peskine449bd832023-01-11 14:50:10 +01002219 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2220 return ret;
Jerry Yu5b64ae92022-03-30 17:15:02 +08002221}
2222
Jerry Yu23d1a252022-05-12 18:08:59 +08002223
2224/*
2225 * Handler for MBEDTLS_SSL_HELLO_RETRY_REQUEST
2226 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002227MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002228static int ssl_tls13_prepare_hello_retry_request(mbedtls_ssl_context *ssl)
Jerry Yu23d1a252022-05-12 18:08:59 +08002229{
2230 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002231 if (ssl->handshake->hello_retry_request_count > 0) {
2232 MBEDTLS_SSL_DEBUG_MSG(1, ("Too many HRRs"));
2233 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2234 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2235 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu23d1a252022-05-12 18:08:59 +08002236 }
2237
2238 /*
2239 * Create stateless transcript hash for HRR
2240 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002241 MBEDTLS_SSL_DEBUG_MSG(4, ("Reset transcript for HRR"));
2242 ret = mbedtls_ssl_reset_transcript_for_hrr(ssl);
2243 if (ret != 0) {
2244 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_transcript_for_hrr", ret);
2245 return ret;
Jerry Yu23d1a252022-05-12 18:08:59 +08002246 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002247 mbedtls_ssl_session_reset_msg_layer(ssl, 0);
Jerry Yu23d1a252022-05-12 18:08:59 +08002248
Gilles Peskine449bd832023-01-11 14:50:10 +01002249 return 0;
Jerry Yu23d1a252022-05-12 18:08:59 +08002250}
2251
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002252MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002253static int ssl_tls13_write_hello_retry_request(mbedtls_ssl_context *ssl)
Jerry Yu23d1a252022-05-12 18:08:59 +08002254{
2255 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2256 unsigned char *buf;
2257 size_t buf_len, msg_len;
2258
Gilles Peskine449bd832023-01-11 14:50:10 +01002259 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello retry request"));
Jerry Yu23d1a252022-05-12 18:08:59 +08002260
Gilles Peskine449bd832023-01-11 14:50:10 +01002261 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_hello_retry_request(ssl));
Jerry Yu23d1a252022-05-12 18:08:59 +08002262
Gilles Peskine449bd832023-01-11 14:50:10 +01002263 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2264 ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
2265 &buf, &buf_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002266
Gilles Peskine449bd832023-01-11 14:50:10 +01002267 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2268 buf + buf_len,
2269 &msg_len,
2270 1));
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002271 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002272 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002273
2274
Gilles Peskine449bd832023-01-11 14:50:10 +01002275 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(ssl, buf_len,
2276 msg_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002277
2278 ssl->handshake->hello_retry_request_count++;
2279
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002280#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2281 /* The server sends a dummy change_cipher_spec record immediately
2282 * after its first handshake message. This may either be after
2283 * a ServerHello or a HelloRetryRequest.
2284 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02002285 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002286 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002287#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002288 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002289#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yu23d1a252022-05-12 18:08:59 +08002290
2291cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01002292 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello retry request"));
2293 return ret;
Jerry Yu23d1a252022-05-12 18:08:59 +08002294}
2295
Jerry Yu5b64ae92022-03-30 17:15:02 +08002296/*
Jerry Yu4d3841a2022-04-16 12:37:19 +08002297 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
2298 */
Jerry Yu4d3841a2022-04-16 12:37:19 +08002299
2300/*
2301 * struct {
2302 * Extension extensions<0..2 ^ 16 - 1>;
2303 * } EncryptedExtensions;
2304 *
2305 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002306MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002307static int ssl_tls13_write_encrypted_extensions_body(mbedtls_ssl_context *ssl,
2308 unsigned char *buf,
2309 unsigned char *end,
2310 size_t *out_len)
Jerry Yu4d3841a2022-04-16 12:37:19 +08002311{
XiaokangQianacb39922022-06-17 10:18:48 +00002312 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002313 unsigned char *p = buf;
2314 size_t extensions_len = 0;
Jerry Yu8937eb42022-05-03 12:12:14 +08002315 unsigned char *p_extensions_len;
XiaokangQianacb39922022-06-17 10:18:48 +00002316 size_t output_len;
Jerry Yu9da5e5a2022-05-03 15:46:09 +08002317
Jerry Yu4d3841a2022-04-16 12:37:19 +08002318 *out_len = 0;
2319
Gilles Peskine449bd832023-01-11 14:50:10 +01002320 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yu8937eb42022-05-03 12:12:14 +08002321 p_extensions_len = p;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002322 p += 2;
2323
Jerry Yu8937eb42022-05-03 12:12:14 +08002324 ((void) ssl);
XiaokangQianacb39922022-06-17 10:18:48 +00002325 ((void) ret);
2326 ((void) output_len);
2327
2328#if defined(MBEDTLS_SSL_ALPN)
Gilles Peskine449bd832023-01-11 14:50:10 +01002329 ret = mbedtls_ssl_write_alpn_ext(ssl, p, end, &output_len);
2330 if (ret != 0) {
2331 return ret;
2332 }
XiaokangQian95d5f542022-06-24 02:29:26 +00002333 p += output_len;
XiaokangQianacb39922022-06-17 10:18:48 +00002334#endif /* MBEDTLS_SSL_ALPN */
Jerry Yu4d3841a2022-04-16 12:37:19 +08002335
Gilles Peskine449bd832023-01-11 14:50:10 +01002336 extensions_len = (p - p_extensions_len) - 2;
2337 MBEDTLS_PUT_UINT16_BE(extensions_len, p_extensions_len, 0);
Jerry Yu8937eb42022-05-03 12:12:14 +08002338
2339 *out_len = p - buf;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002340
Gilles Peskine449bd832023-01-11 14:50:10 +01002341 MBEDTLS_SSL_DEBUG_BUF(4, "encrypted extensions", buf, *out_len);
Jerry Yu4d3841a2022-04-16 12:37:19 +08002342
Jerry Yu7de2ff02022-11-08 21:43:46 +08002343 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002344 3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002345
Gilles Peskine449bd832023-01-11 14:50:10 +01002346 return 0;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002347}
2348
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002349MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002350static int ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context *ssl)
Jerry Yu4d3841a2022-04-16 12:37:19 +08002351{
2352 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2353 unsigned char *buf;
Jerry Yu39730a72022-05-03 12:14:04 +08002354 size_t buf_len, msg_len;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002355
Gilles Peskine449bd832023-01-11 14:50:10 +01002356 mbedtls_ssl_set_outbound_transform(ssl,
2357 ssl->handshake->transform_handshake);
Gabor Mezei54719122022-06-28 11:34:56 +02002358 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01002359 3, ("switching to handshake transform for outbound data"));
Gabor Mezei54719122022-06-28 11:34:56 +02002360
Gilles Peskine449bd832023-01-11 14:50:10 +01002361 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write encrypted extensions"));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002362
Gilles Peskine449bd832023-01-11 14:50:10 +01002363 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
2364 MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, &buf,
2365 &buf_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002366
Gilles Peskine449bd832023-01-11 14:50:10 +01002367 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_encrypted_extensions_body(
2368 ssl, buf, buf + buf_len, &msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002369
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002370 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002371 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, buf, msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002372
Gilles Peskine449bd832023-01-11 14:50:10 +01002373 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2374 ssl, buf_len, msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002375
Ronald Cron928cbd32022-10-04 16:14:26 +02002376#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002377 if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2378 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2379 } else {
2380 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
2381 }
Jerry Yu8937eb42022-05-03 12:12:14 +08002382#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002383 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
Jerry Yu8937eb42022-05-03 12:12:14 +08002384#endif
2385
Jerry Yu4d3841a2022-04-16 12:37:19 +08002386cleanup:
2387
Gilles Peskine449bd832023-01-11 14:50:10 +01002388 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write encrypted extensions"));
2389 return ret;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002390}
2391
Ronald Cron928cbd32022-10-04 16:14:26 +02002392#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQiana987e1d2022-05-07 01:25:58 +00002393#define SSL_CERTIFICATE_REQUEST_SEND_REQUEST 0
2394#define SSL_CERTIFICATE_REQUEST_SKIP 1
2395/* Coordination:
2396 * Check whether a CertificateRequest message should be written.
2397 * Returns a negative code on failure, or
2398 * - SSL_CERTIFICATE_REQUEST_SEND_REQUEST
2399 * - SSL_CERTIFICATE_REQUEST_SKIP
2400 * indicating if the writing of the CertificateRequest
2401 * should be skipped or not.
2402 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002403MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002404static int ssl_tls13_certificate_request_coordinate(mbedtls_ssl_context *ssl)
XiaokangQiana987e1d2022-05-07 01:25:58 +00002405{
2406 int authmode;
2407
XiaokangQian40a35232022-05-07 09:02:40 +00002408#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002409 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
XiaokangQian40a35232022-05-07 09:02:40 +00002410 authmode = ssl->handshake->sni_authmode;
Gilles Peskine449bd832023-01-11 14:50:10 +01002411 } else
XiaokangQian40a35232022-05-07 09:02:40 +00002412#endif
XiaokangQiana987e1d2022-05-07 01:25:58 +00002413 authmode = ssl->conf->authmode;
2414
Gilles Peskine449bd832023-01-11 14:50:10 +01002415 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
Ronald Croneac00ad2022-09-13 10:16:31 +02002416 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Gilles Peskine449bd832023-01-11 14:50:10 +01002417 return SSL_CERTIFICATE_REQUEST_SKIP;
Ronald Croneac00ad2022-09-13 10:16:31 +02002418 }
XiaokangQiana987e1d2022-05-07 01:25:58 +00002419
XiaokangQianc3017f62022-05-13 05:55:41 +00002420 ssl->handshake->certificate_request_sent = 1;
XiaokangQian189ded22022-05-10 08:12:17 +00002421
Gilles Peskine449bd832023-01-11 14:50:10 +01002422 return SSL_CERTIFICATE_REQUEST_SEND_REQUEST;
XiaokangQiana987e1d2022-05-07 01:25:58 +00002423}
2424
XiaokangQiancec9ae62022-05-06 07:28:50 +00002425/*
2426 * struct {
2427 * opaque certificate_request_context<0..2^8-1>;
2428 * Extension extensions<2..2^16-1>;
2429 * } CertificateRequest;
2430 *
2431 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002432MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002433static int ssl_tls13_write_certificate_request_body(mbedtls_ssl_context *ssl,
2434 unsigned char *buf,
2435 const unsigned char *end,
2436 size_t *out_len)
XiaokangQiancec9ae62022-05-06 07:28:50 +00002437{
2438 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2439 unsigned char *p = buf;
XiaokangQianec6efb92022-05-06 09:53:10 +00002440 size_t output_len = 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002441 unsigned char *p_extensions_len;
2442
2443 *out_len = 0;
2444
2445 /* Check if we have enough space:
2446 * - certificate_request_context (1 byte)
2447 * - extensions length (2 bytes)
2448 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002449 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002450
2451 /*
2452 * Write certificate_request_context
2453 */
2454 /*
2455 * We use a zero length context for the normal handshake
2456 * messages. For post-authentication handshake messages
2457 * this request context would be set to a non-zero value.
2458 */
2459 *p++ = 0x0;
2460
2461 /*
2462 * Write extensions
2463 */
2464 /* The extensions must contain the signature_algorithms. */
2465 p_extensions_len = p;
2466 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002467 ret = mbedtls_ssl_write_sig_alg_ext(ssl, p, end, &output_len);
2468 if (ret != 0) {
2469 return ret;
2470 }
XiaokangQiancec9ae62022-05-06 07:28:50 +00002471
XiaokangQianec6efb92022-05-06 09:53:10 +00002472 p += output_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002473 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002474
2475 *out_len = p - buf;
2476
Jerry Yu7de2ff02022-11-08 21:43:46 +08002477 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002478 3, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002479
Gilles Peskine449bd832023-01-11 14:50:10 +01002480 return 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002481}
2482
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002483MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002484static int ssl_tls13_write_certificate_request(mbedtls_ssl_context *ssl)
XiaokangQiancec9ae62022-05-06 07:28:50 +00002485{
2486 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2487
Gilles Peskine449bd832023-01-11 14:50:10 +01002488 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002489
Gilles Peskine449bd832023-01-11 14:50:10 +01002490 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_certificate_request_coordinate(ssl));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002491
Gilles Peskine449bd832023-01-11 14:50:10 +01002492 if (ret == SSL_CERTIFICATE_REQUEST_SEND_REQUEST) {
XiaokangQiancec9ae62022-05-06 07:28:50 +00002493 unsigned char *buf;
2494 size_t buf_len, msg_len;
2495
Gilles Peskine449bd832023-01-11 14:50:10 +01002496 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
2497 MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2498 &buf, &buf_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002499
Gilles Peskine449bd832023-01-11 14:50:10 +01002500 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_request_body(
2501 ssl, buf, buf + buf_len, &msg_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002502
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002503 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002504 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, buf, msg_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002505
Gilles Peskine449bd832023-01-11 14:50:10 +01002506 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2507 ssl, buf_len, msg_len));
2508 } else if (ret == SSL_CERTIFICATE_REQUEST_SKIP) {
2509 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002510 ret = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002511 } else {
2512 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002513 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2514 goto cleanup;
2515 }
2516
Gilles Peskine449bd832023-01-11 14:50:10 +01002517 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_CERTIFICATE);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002518cleanup:
2519
Gilles Peskine449bd832023-01-11 14:50:10 +01002520 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request"));
2521 return ret;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002522}
XiaokangQiancec9ae62022-05-06 07:28:50 +00002523
Jerry Yu4d3841a2022-04-16 12:37:19 +08002524/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002525 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
Jerry Yu83da34e2022-04-16 13:59:52 +08002526 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002527MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002528static int ssl_tls13_write_server_certificate(mbedtls_ssl_context *ssl)
Jerry Yu83da34e2022-04-16 13:59:52 +08002529{
Jerry Yu5a26f302022-05-10 20:46:40 +08002530 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQianfb665a82022-06-15 03:57:21 +00002531
2532#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002533 if ((ssl_tls13_pick_key_cert(ssl) != 0) ||
2534 mbedtls_ssl_own_cert(ssl) == NULL) {
2535 MBEDTLS_SSL_DEBUG_MSG(2, ("No certificate available."));
2536 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2537 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2538 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5a26f302022-05-10 20:46:40 +08002539 }
XiaokangQianfb665a82022-06-15 03:57:21 +00002540#endif /* MBEDTLS_X509_CRT_PARSE_C */
Jerry Yu5a26f302022-05-10 20:46:40 +08002541
Gilles Peskine449bd832023-01-11 14:50:10 +01002542 ret = mbedtls_ssl_tls13_write_certificate(ssl);
2543 if (ret != 0) {
2544 return ret;
2545 }
2546 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY);
2547 return 0;
Jerry Yu83da34e2022-04-16 13:59:52 +08002548}
2549
2550/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002551 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
Jerry Yu83da34e2022-04-16 13:59:52 +08002552 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002553MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002554static int ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl)
Jerry Yu83da34e2022-04-16 13:59:52 +08002555{
Gilles Peskine449bd832023-01-11 14:50:10 +01002556 int ret = mbedtls_ssl_tls13_write_certificate_verify(ssl);
2557 if (ret != 0) {
2558 return ret;
2559 }
2560 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2561 return 0;
Jerry Yu83da34e2022-04-16 13:59:52 +08002562}
Ronald Cron928cbd32022-10-04 16:14:26 +02002563#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08002564
2565/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002566 * Handler for MBEDTLS_SSL_SERVER_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002567 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002568MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002569static int ssl_tls13_write_server_finished(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002570{
Jerry Yud6e253d2022-05-18 13:59:24 +08002571 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002572
Gilles Peskine449bd832023-01-11 14:50:10 +01002573 ret = mbedtls_ssl_tls13_write_finished_message(ssl);
2574 if (ret != 0) {
2575 return ret;
2576 }
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002577
Gilles Peskine449bd832023-01-11 14:50:10 +01002578 ret = mbedtls_ssl_tls13_compute_application_transform(ssl);
2579 if (ret != 0) {
Jerry Yue3d67cb2022-05-19 15:33:10 +08002580 MBEDTLS_SSL_PEND_FATAL_ALERT(
Gilles Peskine449bd832023-01-11 14:50:10 +01002581 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2582 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2583 return ret;
Jerry Yue3d67cb2022-05-19 15:33:10 +08002584 }
XiaokangQianc3017f62022-05-13 05:55:41 +00002585
Gilles Peskine449bd832023-01-11 14:50:10 +01002586 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to handshake keys for inbound traffic"));
2587 mbedtls_ssl_set_inbound_transform(ssl, ssl->handshake->transform_handshake);
XiaokangQian189ded22022-05-10 08:12:17 +00002588
Gilles Peskine449bd832023-01-11 14:50:10 +01002589 if (ssl->handshake->certificate_request_sent) {
2590 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE);
2591 } else {
2592 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate"));
2593 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
2594 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_FINISHED);
Ronald Cron19385882022-06-15 16:26:13 +02002595 }
Ronald Cron63dc4632022-05-31 14:41:53 +02002596
Gilles Peskine449bd832023-01-11 14:50:10 +01002597 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08002598}
2599
2600/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002601 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002602 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002603MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002604static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002605{
Jerry Yud6e253d2022-05-18 13:59:24 +08002606 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2607
Gilles Peskine449bd832023-01-11 14:50:10 +01002608 ret = mbedtls_ssl_tls13_process_finished_message(ssl);
2609 if (ret != 0) {
2610 return ret;
Jerry Yue3d67cb2022-05-19 15:33:10 +08002611 }
2612
Gilles Peskine449bd832023-01-11 14:50:10 +01002613 ret = mbedtls_ssl_tls13_compute_resumption_master_secret(ssl);
2614 if (ret != 0) {
2615 MBEDTLS_SSL_DEBUG_RET(1,
2616 "mbedtls_ssl_tls13_compute_resumption_master_secret", ret);
2617 }
2618
2619 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);
2620 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08002621}
2622
2623/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002624 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
Jerry Yu69dd8d42022-04-16 12:51:26 +08002625 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002626MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002627static int ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002628{
Gilles Peskine449bd832023-01-11 14:50:10 +01002629 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done"));
Jerry Yu03ed50b2022-04-16 17:13:30 +08002630
Gilles Peskine449bd832023-01-11 14:50:10 +01002631 mbedtls_ssl_tls13_handshake_wrapup(ssl);
Jerry Yue67bef42022-07-07 07:29:42 +00002632
Pengyu Lv3643fdb2023-01-12 16:46:28 +08002633#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
2634 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Pengyu Lva1aa31b2022-12-13 13:49:59 +08002635/* TODO: Remove the check of SOME_PSK_ENABLED since SESSION_TICKETS requires
2636 * SOME_PSK_ENABLED to be enabled. Here is just to make CI happy. It is
2637 * expected to be resolved with issue#6395.
2638 */
Pengyu Lvc7af2c42022-12-01 16:33:00 +08002639 /* Sent NewSessionTicket message only when client supports PSK */
Pengyu Lv3643fdb2023-01-12 16:46:28 +08002640 if (mbedtls_ssl_tls13_some_psk_enabled(ssl)) {
2641 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
Pengyu Lvc7af2c42022-12-01 16:33:00 +08002642 } else
Jerry Yufca4d572022-07-21 10:37:48 +08002643#endif
Pengyu Lv3643fdb2023-01-12 16:46:28 +08002644 {
2645 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
2646 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002647 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08002648}
2649
2650/*
Jerry Yua8d3c502022-10-30 14:51:23 +08002651 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00002652 */
2653#define SSL_NEW_SESSION_TICKET_SKIP 0
2654#define SSL_NEW_SESSION_TICKET_WRITE 1
2655MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002656static int ssl_tls13_write_new_session_ticket_coordinate(mbedtls_ssl_context *ssl)
Jerry Yue67bef42022-07-07 07:29:42 +00002657{
2658 /* Check whether the use of session tickets is enabled */
Gilles Peskine449bd832023-01-11 14:50:10 +01002659 if (ssl->conf->f_ticket_write == NULL) {
2660 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
2661 " callback is not set"));
2662 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yud0766ec2022-09-22 10:46:57 +08002663 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002664 if (ssl->conf->new_session_tickets_count == 0) {
2665 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
2666 " configured count is zero"));
2667 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yud0766ec2022-09-22 10:46:57 +08002668 }
2669
Gilles Peskine449bd832023-01-11 14:50:10 +01002670 if (ssl->handshake->new_session_tickets_count == 0) {
2671 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: all tickets have "
2672 "been sent."));
2673 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yue67bef42022-07-07 07:29:42 +00002674 }
2675
Gilles Peskine449bd832023-01-11 14:50:10 +01002676 return SSL_NEW_SESSION_TICKET_WRITE;
Jerry Yue67bef42022-07-07 07:29:42 +00002677}
2678
2679#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2680MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002681static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
2682 unsigned char *ticket_nonce,
2683 size_t ticket_nonce_size)
Jerry Yue67bef42022-07-07 07:29:42 +00002684{
2685 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2686 mbedtls_ssl_session *session = ssl->session;
2687 mbedtls_ssl_ciphersuite_t *ciphersuite_info;
2688 psa_algorithm_t psa_hash_alg;
2689 int hash_length;
2690
Gilles Peskine449bd832023-01-11 14:50:10 +01002691 MBEDTLS_SSL_DEBUG_MSG(2, ("=> prepare NewSessionTicket msg"));
Jerry Yue67bef42022-07-07 07:29:42 +00002692
2693#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01002694 session->start = mbedtls_time(NULL);
Jerry Yue67bef42022-07-07 07:29:42 +00002695#endif
2696
Pengyu Lv9f926952022-11-17 15:22:33 +08002697 /* Set ticket_flags depends on the advertised psk key exchange mode */
Pengyu Lv80270b22023-01-12 11:54:04 +08002698 mbedtls_ssl_session_clear_ticket_flags(
Pengyu Lv9eacb442022-12-09 14:39:19 +08002699 session, MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
Pengyu Lve6487fe2022-12-06 09:30:29 +08002700#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Pengyu Lv80270b22023-01-12 11:54:04 +08002701 mbedtls_ssl_session_set_ticket_flags(
Pengyu Lv9eacb442022-12-09 14:39:19 +08002702 session, ssl->handshake->tls13_kex_modes);
Pengyu Lve6487fe2022-12-06 09:30:29 +08002703#endif
Pengyu Lv4938a562023-01-16 11:28:49 +08002704 MBEDTLS_SSL_PRINT_TICKET_FLAGS(4, session->ticket_flags);
Pengyu Lv9f926952022-11-17 15:22:33 +08002705
Jerry Yue67bef42022-07-07 07:29:42 +00002706 /* Generate ticket_age_add */
Gilles Peskine449bd832023-01-11 14:50:10 +01002707 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
2708 (unsigned char *) &session->ticket_age_add,
2709 sizeof(session->ticket_age_add)) != 0)) {
2710 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
2711 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002712 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002713 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
2714 (unsigned int) session->ticket_age_add));
Jerry Yue67bef42022-07-07 07:29:42 +00002715
2716 /* Generate ticket_nonce */
Gilles Peskine449bd832023-01-11 14:50:10 +01002717 ret = ssl->conf->f_rng(ssl->conf->p_rng, ticket_nonce, ticket_nonce_size);
2718 if (ret != 0) {
2719 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_nonce", ret);
2720 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002721 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002722 MBEDTLS_SSL_DEBUG_BUF(3, "ticket_nonce:",
2723 ticket_nonce, ticket_nonce_size);
Jerry Yue67bef42022-07-07 07:29:42 +00002724
2725 ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01002726 (mbedtls_ssl_ciphersuite_t *) ssl->handshake->ciphersuite_info;
2727 psa_hash_alg = mbedtls_psa_translate_md(ciphersuite_info->mac);
2728 hash_length = PSA_HASH_LENGTH(psa_hash_alg);
2729 if (hash_length == -1 ||
2730 (size_t) hash_length > sizeof(session->resumption_key)) {
2731 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yufca4d572022-07-21 10:37:48 +08002732 }
2733
Jerry Yue67bef42022-07-07 07:29:42 +00002734 /* In this code the psk key length equals the length of the hash */
2735 session->resumption_key_len = hash_length;
2736 session->ciphersuite = ciphersuite_info->id;
2737
2738 /* Compute resumption key
2739 *
2740 * HKDF-Expand-Label( resumption_master_secret,
2741 * "resumption", ticket_nonce, Hash.length )
2742 */
2743 ret = mbedtls_ssl_tls13_hkdf_expand_label(
Gilles Peskine449bd832023-01-11 14:50:10 +01002744 psa_hash_alg,
2745 session->app_secrets.resumption_master_secret,
2746 hash_length,
2747 MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(resumption),
2748 ticket_nonce,
2749 ticket_nonce_size,
2750 session->resumption_key,
2751 hash_length);
Jerry Yue67bef42022-07-07 07:29:42 +00002752
Gilles Peskine449bd832023-01-11 14:50:10 +01002753 if (ret != 0) {
2754 MBEDTLS_SSL_DEBUG_RET(2,
2755 "Creating the ticket-resumed PSK failed",
2756 ret);
2757 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002758 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002759 MBEDTLS_SSL_DEBUG_BUF(3, "Ticket-resumed PSK",
2760 session->resumption_key,
2761 session->resumption_key_len);
Jerry Yue67bef42022-07-07 07:29:42 +00002762
Gilles Peskine449bd832023-01-11 14:50:10 +01002763 MBEDTLS_SSL_DEBUG_BUF(3, "resumption_master_secret",
2764 session->app_secrets.resumption_master_secret,
2765 hash_length);
Jerry Yue67bef42022-07-07 07:29:42 +00002766
Gilles Peskine449bd832023-01-11 14:50:10 +01002767 return 0;
Jerry Yue67bef42022-07-07 07:29:42 +00002768}
2769
2770/* This function creates a NewSessionTicket message in the following format:
2771 *
2772 * struct {
2773 * uint32 ticket_lifetime;
2774 * uint32 ticket_age_add;
2775 * opaque ticket_nonce<0..255>;
2776 * opaque ticket<1..2^16-1>;
2777 * Extension extensions<0..2^16-2>;
2778 * } NewSessionTicket;
2779 *
2780 * The ticket inside the NewSessionTicket message is an encrypted container
2781 * carrying the necessary information so that the server is later able to
2782 * re-start the communication.
2783 *
2784 * The following fields are placed inside the ticket by the
2785 * f_ticket_write() function:
2786 *
2787 * - creation time (start)
2788 * - flags (flags)
2789 * - age add (ticket_age_add)
2790 * - key (key)
2791 * - key length (key_len)
2792 * - ciphersuite (ciphersuite)
2793 */
2794MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002795static int ssl_tls13_write_new_session_ticket_body(mbedtls_ssl_context *ssl,
2796 unsigned char *buf,
2797 unsigned char *end,
2798 size_t *out_len,
2799 unsigned char *ticket_nonce,
2800 size_t ticket_nonce_size)
Jerry Yue67bef42022-07-07 07:29:42 +00002801{
2802 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2803 unsigned char *p = buf;
2804 mbedtls_ssl_session *session = ssl->session;
2805 size_t ticket_len;
2806 uint32_t ticket_lifetime;
2807
2808 *out_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002809 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write NewSessionTicket msg"));
Jerry Yue67bef42022-07-07 07:29:42 +00002810
2811 /*
2812 * ticket_lifetime 4 bytes
2813 * ticket_age_add 4 bytes
2814 * ticket_nonce 1 + ticket_nonce_size bytes
2815 * ticket >=2 bytes
2816 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002817 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4 + 4 + 1 + ticket_nonce_size + 2);
Jerry Yue67bef42022-07-07 07:29:42 +00002818
2819 /* Generate ticket and ticket_lifetime */
Gilles Peskine449bd832023-01-11 14:50:10 +01002820 ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket,
2821 session,
2822 p + 9 + ticket_nonce_size + 2,
2823 end,
2824 &ticket_len,
2825 &ticket_lifetime);
2826 if (ret != 0) {
2827 MBEDTLS_SSL_DEBUG_RET(1, "write_ticket", ret);
2828 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002829 }
2830 /* RFC 8446 4.6.1
2831 * ticket_lifetime: Indicates the lifetime in seconds as a 32-bit
2832 * unsigned integer in network byte order from the time of ticket
2833 * issuance. Servers MUST NOT use any value greater than
2834 * 604800 seconds (7 days). The value of zero indicates that the
2835 * ticket should be discarded immediately. Clients MUST NOT cache
2836 * tickets for longer than 7 days, regardless of the ticket_lifetime,
2837 * and MAY delete tickets earlier based on local policy. A server
2838 * MAY treat a ticket as valid for a shorter period of time than what
2839 * is stated in the ticket_lifetime.
2840 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002841 if (ticket_lifetime > 604800) {
Xiaokang Qian28af5012022-10-13 08:18:19 +00002842 ticket_lifetime = 604800;
Gilles Peskine449bd832023-01-11 14:50:10 +01002843 }
2844 MBEDTLS_PUT_UINT32_BE(ticket_lifetime, p, 0);
2845 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_lifetime: %u",
2846 (unsigned int) ticket_lifetime));
Jerry Yue67bef42022-07-07 07:29:42 +00002847
2848 /* Write ticket_age_add */
Gilles Peskine449bd832023-01-11 14:50:10 +01002849 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 4);
2850 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
2851 (unsigned int) session->ticket_age_add));
Jerry Yue67bef42022-07-07 07:29:42 +00002852
2853 /* Write ticket_nonce */
Gilles Peskine449bd832023-01-11 14:50:10 +01002854 p[8] = (unsigned char) ticket_nonce_size;
2855 if (ticket_nonce_size > 0) {
2856 memcpy(p + 9, ticket_nonce, ticket_nonce_size);
Jerry Yue67bef42022-07-07 07:29:42 +00002857 }
2858 p += 9 + ticket_nonce_size;
2859
2860 /* Write ticket */
Gilles Peskine449bd832023-01-11 14:50:10 +01002861 MBEDTLS_PUT_UINT16_BE(ticket_len, p, 0);
Jerry Yue67bef42022-07-07 07:29:42 +00002862 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002863 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", p, ticket_len);
Jerry Yue67bef42022-07-07 07:29:42 +00002864 p += ticket_len;
2865
2866 /* Ticket Extensions
2867 *
2868 * Note: We currently don't have any extensions.
2869 * Set length to zero.
2870 */
Jerry Yuedab6372022-10-31 14:37:31 +08002871 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
2872
Gilles Peskine449bd832023-01-11 14:50:10 +01002873 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2874 MBEDTLS_PUT_UINT16_BE(0, p, 0);
Jerry Yue67bef42022-07-07 07:29:42 +00002875 p += 2;
2876
2877 *out_len = p - buf;
Gilles Peskine449bd832023-01-11 14:50:10 +01002878 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", buf, *out_len);
2879 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket"));
Jerry Yue67bef42022-07-07 07:29:42 +00002880
Jerry Yu7de2ff02022-11-08 21:43:46 +08002881 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002882 3, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002883
Gilles Peskine449bd832023-01-11 14:50:10 +01002884 return 0;
Jerry Yue67bef42022-07-07 07:29:42 +00002885}
2886
2887/*
Jerry Yua8d3c502022-10-30 14:51:23 +08002888 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00002889 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002890static int ssl_tls13_write_new_session_ticket(mbedtls_ssl_context *ssl)
Jerry Yue67bef42022-07-07 07:29:42 +00002891{
2892 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2893
Gilles Peskine449bd832023-01-11 14:50:10 +01002894 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_write_new_session_ticket_coordinate(ssl));
Jerry Yue67bef42022-07-07 07:29:42 +00002895
Gilles Peskine449bd832023-01-11 14:50:10 +01002896 if (ret == SSL_NEW_SESSION_TICKET_WRITE) {
Jerry Yue67bef42022-07-07 07:29:42 +00002897 unsigned char ticket_nonce[MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH];
2898 unsigned char *buf;
2899 size_t buf_len, msg_len;
2900
Gilles Peskine449bd832023-01-11 14:50:10 +01002901 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_new_session_ticket(
2902 ssl, ticket_nonce, sizeof(ticket_nonce)));
Jerry Yue67bef42022-07-07 07:29:42 +00002903
Gilles Peskine449bd832023-01-11 14:50:10 +01002904 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl,
2905 MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
2906 &buf, &buf_len));
Jerry Yue67bef42022-07-07 07:29:42 +00002907
Gilles Peskine449bd832023-01-11 14:50:10 +01002908 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_new_session_ticket_body(
2909 ssl, buf, buf + buf_len, &msg_len,
2910 ticket_nonce, sizeof(ticket_nonce)));
Jerry Yue67bef42022-07-07 07:29:42 +00002911
Gilles Peskine449bd832023-01-11 14:50:10 +01002912 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2913 ssl, buf_len, msg_len));
Jerry Yufca4d572022-07-21 10:37:48 +08002914
Jerry Yu359e65f2022-09-22 23:47:43 +08002915 /* Limit session tickets count to one when resumption connection.
2916 *
2917 * See document of mbedtls_ssl_conf_new_session_tickets.
2918 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002919 if (ssl->handshake->resume == 1) {
Jerry Yu359e65f2022-09-22 23:47:43 +08002920 ssl->handshake->new_session_tickets_count = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002921 } else {
Jerry Yu359e65f2022-09-22 23:47:43 +08002922 ssl->handshake->new_session_tickets_count--;
Gilles Peskine449bd832023-01-11 14:50:10 +01002923 }
Jerry Yub7e3fa72022-09-22 11:07:18 +08002924
Jerry Yua8d3c502022-10-30 14:51:23 +08002925 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002926 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH);
2927 } else {
2928 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
Jerry Yue67bef42022-07-07 07:29:42 +00002929 }
2930
Jerry Yue67bef42022-07-07 07:29:42 +00002931cleanup:
2932
Gilles Peskine449bd832023-01-11 14:50:10 +01002933 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002934}
2935#endif /* MBEDTLS_SSL_SESSION_TICKETS */
2936
2937/*
XiaokangQiane8ff3502022-04-22 02:34:40 +00002938 * TLS 1.3 State Machine -- server side
XiaokangQian7807f9f2022-02-15 10:04:37 +00002939 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002940int mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context *ssl)
Jerry Yub9930e72021-08-06 17:11:51 +08002941{
XiaokangQian08037552022-04-20 07:16:41 +00002942 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +00002943
Gilles Peskine449bd832023-01-11 14:50:10 +01002944 if (ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL) {
2945 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2946 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00002947
Gilles Peskine449bd832023-01-11 14:50:10 +01002948 MBEDTLS_SSL_DEBUG_MSG(2, ("tls13 server state: %s(%d)",
2949 mbedtls_ssl_states_str(ssl->state),
2950 ssl->state));
Jerry Yu6e81b272021-09-27 11:16:17 +08002951
Gilles Peskine449bd832023-01-11 14:50:10 +01002952 switch (ssl->state) {
XiaokangQian7807f9f2022-02-15 10:04:37 +00002953 /* start state */
2954 case MBEDTLS_SSL_HELLO_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01002955 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
XiaokangQian08037552022-04-20 07:16:41 +00002956 ret = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00002957 break;
2958
XiaokangQian7807f9f2022-02-15 10:04:37 +00002959 case MBEDTLS_SSL_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01002960 ret = ssl_tls13_process_client_hello(ssl);
2961 if (ret != 0) {
2962 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_process_client_hello", ret);
2963 }
Jerry Yuf41553b2022-05-09 22:20:30 +08002964 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00002965
Jerry Yuf41553b2022-05-09 22:20:30 +08002966 case MBEDTLS_SSL_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01002967 ret = ssl_tls13_write_hello_retry_request(ssl);
2968 if (ret != 0) {
2969 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_hello_retry_request", ret);
2970 return ret;
Jerry Yuf41553b2022-05-09 22:20:30 +08002971 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00002972 break;
2973
Jerry Yu5b64ae92022-03-30 17:15:02 +08002974 case MBEDTLS_SSL_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01002975 ret = ssl_tls13_write_server_hello(ssl);
Jerry Yu5b64ae92022-03-30 17:15:02 +08002976 break;
2977
Xiaofei Baicba64af2022-02-15 10:00:56 +00002978 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +01002979 ret = ssl_tls13_write_encrypted_extensions(ssl);
2980 if (ret != 0) {
2981 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_encrypted_extensions", ret);
2982 return ret;
Xiaofei Baicba64af2022-02-15 10:00:56 +00002983 }
Jerry Yu48330562022-05-06 21:35:44 +08002984 break;
Jerry Yu6a2cd9e2022-05-05 11:14:19 +08002985
Ronald Cron928cbd32022-10-04 16:14:26 +02002986#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00002987 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01002988 ret = ssl_tls13_write_certificate_request(ssl);
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00002989 break;
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00002990
Jerry Yu83da34e2022-04-16 13:59:52 +08002991 case MBEDTLS_SSL_SERVER_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +01002992 ret = ssl_tls13_write_server_certificate(ssl);
Jerry Yu83da34e2022-04-16 13:59:52 +08002993 break;
2994
2995 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Gilles Peskine449bd832023-01-11 14:50:10 +01002996 ret = ssl_tls13_write_certificate_verify(ssl);
Jerry Yu83da34e2022-04-16 13:59:52 +08002997 break;
Ronald Cron928cbd32022-10-04 16:14:26 +02002998#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08002999
Gilles Peskine449bd832023-01-11 14:50:10 +01003000 /*
3001 * Injection of dummy-CCS's for middlebox compatibility
3002 */
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003003#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
Gabor Mezeif7044ea2022-06-28 16:01:49 +02003004 case MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003005 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3006 if (ret == 0) {
3007 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
3008 }
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003009 break;
3010
3011 case MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003012 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3013 if (ret == 0) {
3014 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
3015 }
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003016 break;
3017#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
3018
Jerry Yu69dd8d42022-04-16 12:51:26 +08003019 case MBEDTLS_SSL_SERVER_FINISHED:
Gilles Peskine449bd832023-01-11 14:50:10 +01003020 ret = ssl_tls13_write_server_finished(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003021 break;
3022
3023 case MBEDTLS_SSL_CLIENT_FINISHED:
Gilles Peskine449bd832023-01-11 14:50:10 +01003024 ret = ssl_tls13_process_client_finished(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003025 break;
3026
Jerry Yu69dd8d42022-04-16 12:51:26 +08003027 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Gilles Peskine449bd832023-01-11 14:50:10 +01003028 ret = ssl_tls13_handshake_wrapup(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003029 break;
3030
Ronald Cron766c0cd2022-10-18 12:17:11 +02003031#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQian6b916b12022-04-25 07:29:34 +00003032 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +01003033 ret = mbedtls_ssl_tls13_process_certificate(ssl);
3034 if (ret == 0) {
3035 if (ssl->session_negotiate->peer_cert != NULL) {
Ronald Cron209cae92022-06-07 10:30:19 +02003036 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003037 ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY);
3038 } else {
3039 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
Ronald Cron209cae92022-06-07 10:30:19 +02003040 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003041 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
Ronald Cron19385882022-06-15 16:26:13 +02003042 }
XiaokangQian6b916b12022-04-25 07:29:34 +00003043 }
3044 break;
3045
3046 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
Gilles Peskine449bd832023-01-11 14:50:10 +01003047 ret = mbedtls_ssl_tls13_process_certificate_verify(ssl);
3048 if (ret == 0) {
XiaokangQian6b916b12022-04-25 07:29:34 +00003049 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003050 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
XiaokangQian6b916b12022-04-25 07:29:34 +00003051 }
3052 break;
Ronald Cron766c0cd2022-10-18 12:17:11 +02003053#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian6b916b12022-04-25 07:29:34 +00003054
Jerry Yue67bef42022-07-07 07:29:42 +00003055#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yua8d3c502022-10-30 14:51:23 +08003056 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +01003057 ret = ssl_tls13_write_new_session_ticket(ssl);
3058 if (ret != 0) {
3059 MBEDTLS_SSL_DEBUG_RET(1,
3060 "ssl_tls13_write_new_session_ticket ",
3061 ret);
Jerry Yue67bef42022-07-07 07:29:42 +00003062 }
3063 break;
Jerry Yua8d3c502022-10-30 14:51:23 +08003064 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH:
Jerry Yue67bef42022-07-07 07:29:42 +00003065 /* This state is necessary to do the flush of the New Session
Jerry Yua8d3c502022-10-30 14:51:23 +08003066 * Ticket message written in MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00003067 * as part of ssl_prepare_handshake_step.
3068 */
3069 ret = 0;
Jerry Yud4e75002022-08-09 13:33:50 +08003070
Gilles Peskine449bd832023-01-11 14:50:10 +01003071 if (ssl->handshake->new_session_tickets_count == 0) {
3072 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3073 } else {
3074 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
3075 }
Jerry Yue67bef42022-07-07 07:29:42 +00003076 break;
3077
3078#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3079
XiaokangQian7807f9f2022-02-15 10:04:37 +00003080 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003081 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state));
3082 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003083 }
3084
Gilles Peskine449bd832023-01-11 14:50:10 +01003085 return ret;
Jerry Yub9930e72021-08-06 17:11:51 +08003086}
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003087
Jerry Yufb4b6472022-01-27 15:03:26 +08003088#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */