blob: 0066744530972c1abdcd43b44110365b0e80c9a8 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002 * TLS server-side functions
Paul Bakker5121ce52009-01-03 21:22:43 +00003 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000023
SimonBd5800b72016-04-26 07:43:27 +010024#if defined(MBEDTLS_PLATFORM_C)
25#include "mbedtls/platform.h"
26#else
27#include <stdlib.h>
28#define mbedtls_calloc calloc
29#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010030#endif
31
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000032#include "mbedtls/ssl.h"
Chris Jones84a773f2021-03-05 18:38:47 +000033#include "ssl_misc.h"
Janos Follath73c616b2019-12-18 15:07:04 +000034#include "mbedtls/debug.h"
35#include "mbedtls/error.h"
Andres Amaya Garcia84914062018-04-24 08:40:46 -050036#include "mbedtls/platform_util.h"
gabor-mezei-armdb9a38c2021-09-27 11:28:54 +020037#include "constant_time.h"
Gabor Mezei765862c2021-10-19 12:22:25 +020038#include "mbedtls/constant_time.h"
Rich Evans00ab4702015-02-06 13:43:58 +000039
40#include <string.h>
41
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020042#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000043#include "mbedtls/ecp.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010044#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020046#if defined(MBEDTLS_HAVE_TIME)
Simon Butcherb5b6af22016-07-13 14:46:18 +010047#include "mbedtls/platform_time.h"
Paul Bakkerfa9b1002013-07-03 15:31:03 +020048#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000049
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020050#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
51int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020052 const unsigned char *info,
53 size_t ilen )
54{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020055 if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020056 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020058 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020059
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020060 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020061 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020062
63 memcpy( ssl->cli_id, info, ilen );
64 ssl->cli_id_len = ilen;
65
66 return( 0 );
67}
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020068
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020069void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020070 mbedtls_ssl_cookie_write_t *f_cookie_write,
71 mbedtls_ssl_cookie_check_t *f_cookie_check,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020072 void *p_cookie )
73{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020074 conf->f_cookie_write = f_cookie_write;
75 conf->f_cookie_check = f_cookie_check;
76 conf->p_cookie = p_cookie;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020077}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020078#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020079
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020080#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020081static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +000082 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +000083 size_t len )
84{
Janos Follath865b3eb2019-12-16 11:46:15 +000085 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5701cdc2012-09-27 21:49:42 +000086 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +000087 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +000088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020089 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +010090
Philippe Antoine747fd532018-05-30 09:13:21 +020091 if( len < 2 )
92 {
93 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
94 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
95 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +010096 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +020097 }
Paul Bakker5701cdc2012-09-27 21:49:42 +000098 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
99 if( servername_list_size + 2 != len )
100 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200101 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200102 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
103 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100104 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000105 }
106
107 p = buf + 2;
Philippe Antoine747fd532018-05-30 09:13:21 +0200108 while( servername_list_size > 2 )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000109 {
110 hostname_len = ( ( p[1] << 8 ) | p[2] );
111 if( hostname_len + 3 > servername_list_size )
112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200113 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200114 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
115 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100116 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000117 }
118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000120 {
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +0200121 ret = ssl->conf->f_sni( ssl->conf->p_sni,
122 ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000123 if( ret != 0 )
124 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200125 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
126 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
127 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100128 return( MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000129 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000130 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000131 }
132
133 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000134 p += hostname_len + 3;
135 }
136
137 if( servername_list_size != 0 )
138 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200139 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200140 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100141 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
142 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000143 }
144
145 return( 0 );
146}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200147#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000148
Gilles Peskineeccd8882020-03-10 12:19:08 +0100149#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Becker845b9462018-10-26 12:07:29 +0100150static int ssl_conf_has_psk_or_cb( mbedtls_ssl_config const *conf )
151{
152 if( conf->f_psk != NULL )
153 return( 1 );
154
155 if( conf->psk_identity_len == 0 || conf->psk_identity == NULL )
156 return( 0 );
157
158 if( conf->psk != NULL && conf->psk_len != 0 )
159 return( 1 );
160
161#if defined(MBEDTLS_USE_PSA_CRYPTO)
Ronald Croncf56a0a2020-08-04 09:51:30 +0200162 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
Hanno Becker845b9462018-10-26 12:07:29 +0100163 return( 1 );
164#endif /* MBEDTLS_USE_PSA_CRYPTO */
165
166 return( 0 );
167}
168
169#if defined(MBEDTLS_USE_PSA_CRYPTO)
170static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
171{
172 if( ssl->conf->f_psk != NULL )
173 {
174 /* If we've used a callback to select the PSK,
175 * the static configuration is irrelevant. */
176
Ronald Croncf56a0a2020-08-04 09:51:30 +0200177 if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
Hanno Becker845b9462018-10-26 12:07:29 +0100178 return( 1 );
179
180 return( 0 );
181 }
182
Ronald Croncf56a0a2020-08-04 09:51:30 +0200183 if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
Hanno Becker845b9462018-10-26 12:07:29 +0100184 return( 1 );
185
186 return( 0 );
187}
188#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskineeccd8882020-03-10 12:19:08 +0100189#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Hanno Becker845b9462018-10-26 12:07:29 +0100190
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200191static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000192 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000193 size_t len )
194{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200195#if defined(MBEDTLS_SSL_RENEGOTIATION)
196 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100197 {
198 /* Check verify-data in constant-time. The length OTOH is no secret */
199 if( len != 1 + ssl->verify_data_len ||
200 buf[0] != ssl->verify_data_len ||
gabor-mezei-arm46025642021-07-19 15:19:19 +0200201 mbedtls_cf_memcmp( buf + 1, ssl->peer_verify_data,
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100202 ssl->verify_data_len ) != 0 )
203 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200205 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
206 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Dave Rodgman43fcb8d2021-06-28 21:49:15 +0100207 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100208 }
209 }
210 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200211#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +0000212 {
213 if( len != 1 || buf[0] != 0x0 )
214 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200216 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
217 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Dave Rodgman43fcb8d2021-06-28 21:49:15 +0100218 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Paul Bakker48916f92012-09-16 19:57:18 +0000219 }
220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200221 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +0000222 }
Paul Bakker48916f92012-09-16 19:57:18 +0000223
224 return( 0 );
225}
226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +0100228 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100229
230/*
231 * Status of the implementation of signature-algorithms extension:
232 *
233 * Currently, we are only considering the signature-algorithm extension
234 * to pick a ciphersuite which allows us to send the ServerKeyExchange
235 * message with a signature-hash combination that the user allows.
236 *
237 * We do *not* check whether all certificates in our certificate
238 * chain are signed with an allowed signature-hash pair.
239 * This needs to be done at a later stage.
240 *
241 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200242static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000243 const unsigned char *buf,
244 size_t len )
245{
246 size_t sig_alg_list_size;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100247
Paul Bakker23f36802012-09-28 14:15:14 +0000248 const unsigned char *p;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200249 const unsigned char *end = buf + len;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200250
Hanno Becker7e5437a2017-04-28 17:15:26 +0100251 mbedtls_md_type_t md_cur;
252 mbedtls_pk_type_t sig_cur;
Paul Bakker23f36802012-09-28 14:15:14 +0000253
Philippe Antoine747fd532018-05-30 09:13:21 +0200254 if ( len < 2 ) {
255 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
256 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
257 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100258 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +0200259 }
Paul Bakker23f36802012-09-28 14:15:14 +0000260 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
261 if( sig_alg_list_size + 2 != len ||
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200262 sig_alg_list_size % 2 != 0 )
Paul Bakker23f36802012-09-28 14:15:14 +0000263 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200264 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200265 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
266 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100267 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker23f36802012-09-28 14:15:14 +0000268 }
269
Hanno Becker7e5437a2017-04-28 17:15:26 +0100270 /* Currently we only guarantee signing the ServerKeyExchange message according
271 * to the constraints specified in this extension (see above), so it suffices
272 * to remember only one suitable hash for each possible signature algorithm.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200273 *
Hanno Becker7e5437a2017-04-28 17:15:26 +0100274 * This will change when we also consider certificate signatures,
275 * in which case we will need to remember the whole signature-hash
276 * pair list from the extension.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200277 */
Hanno Becker7e5437a2017-04-28 17:15:26 +0100278
279 for( p = buf + 2; p < end; p += 2 )
280 {
281 /* Silently ignore unknown signature or hash algorithms. */
282
283 if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
284 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100285 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext"
286 " unknown sig alg encoding %d", p[1] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100287 continue;
288 }
289
290 /* Check if we support the hash the user proposes */
291 md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
292 if( md_cur == MBEDTLS_MD_NONE )
293 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100294 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
295 " unknown hash alg encoding %d", p[0] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100296 continue;
297 }
298
299 if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
300 {
301 mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100302 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
Paul Elliott9f352112020-12-09 14:55:45 +0000303 " match sig %u and hash %u",
Paul Elliott3891caf2020-12-17 18:42:40 +0000304 (unsigned) sig_cur, (unsigned) md_cur ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100305 }
306 else
307 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100308 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: "
Paul Elliott3891caf2020-12-17 18:42:40 +0000309 "hash alg %u not supported", (unsigned) md_cur ) );
Paul Bakker23f36802012-09-28 14:15:14 +0000310 }
Paul Bakker23f36802012-09-28 14:15:14 +0000311 }
312
Paul Bakker23f36802012-09-28 14:15:14 +0000313 return( 0 );
314}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Gilles Peskineeccd8882020-03-10 12:19:08 +0100316 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker23f36802012-09-28 14:15:14 +0000317
Robert Cragie136884c2015-10-02 13:34:31 +0100318#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +0100319 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200320static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200321 const unsigned char *buf,
322 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100323{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200324 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100325 const unsigned char *p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200326 const mbedtls_ecp_curve_info *curve_info, **curves;
Paul Bakker41c83d32013-03-20 14:39:14 +0100327
Philippe Antoine747fd532018-05-30 09:13:21 +0200328 if ( len < 2 ) {
329 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
330 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
331 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100332 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +0200333 }
Paul Bakker41c83d32013-03-20 14:39:14 +0100334 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
335 if( list_size + 2 != len ||
336 list_size % 2 != 0 )
337 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200338 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200339 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
340 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100341 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker41c83d32013-03-20 14:39:14 +0100342 }
343
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200344 /* Should never happen unless client duplicates the extension */
345 if( ssl->handshake->curves != NULL )
346 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200348 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100349 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
350 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200351 }
352
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +0100353 /* Don't allow our peer to make us allocate too much memory,
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200354 * and leave room for a final 0 */
355 our_size = list_size / 2 + 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200356 if( our_size > MBEDTLS_ECP_DP_MAX )
357 our_size = MBEDTLS_ECP_DP_MAX;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200358
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200359 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200360 {
361 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
362 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200363 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200364 }
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200365
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200366 ssl->handshake->curves = curves;
367
Paul Bakker41c83d32013-03-20 14:39:14 +0100368 p = buf + 2;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200369 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100370 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200371 curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200372
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200373 if( curve_info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100374 {
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200375 *curves++ = curve_info;
376 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100377 }
378
379 list_size -= 2;
380 p += 2;
381 }
382
383 return( 0 );
384}
385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200386static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200387 const unsigned char *buf,
388 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100389{
390 size_t list_size;
391 const unsigned char *p;
392
Philippe Antoine747fd532018-05-30 09:13:21 +0200393 if( len == 0 || (size_t)( buf[0] + 1 ) != len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100394 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200396 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
397 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100398 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker41c83d32013-03-20 14:39:14 +0100399 }
Philippe Antoine747fd532018-05-30 09:13:21 +0200400 list_size = buf[0];
Paul Bakker41c83d32013-03-20 14:39:14 +0100401
Manuel Pégourié-Gonnardc1b46d02015-09-16 11:18:32 +0200402 p = buf + 1;
Paul Bakker41c83d32013-03-20 14:39:14 +0100403 while( list_size > 0 )
404 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200405 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
406 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Paul Bakker41c83d32013-03-20 14:39:14 +0100407 {
Robert Cragie136884c2015-10-02 13:34:31 +0100408#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200409 ssl->handshake->ecdh_ctx.point_format = p[0];
Robert Cragie136884c2015-10-02 13:34:31 +0100410#endif
Robert Cragieae8535d2015-10-06 17:11:18 +0100411#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Gilles Peskinecd07e222021-05-27 23:17:34 +0200412 mbedtls_ecjpake_set_point_format( &ssl->handshake->ecjpake_ctx,
413 p[0] );
Robert Cragie136884c2015-10-02 13:34:31 +0100414#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100416 return( 0 );
417 }
418
419 list_size--;
420 p++;
421 }
422
423 return( 0 );
424}
Robert Cragieae8535d2015-10-06 17:11:18 +0100425#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
426 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +0100427
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200428#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
429static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
430 const unsigned char *buf,
431 size_t len )
432{
Janos Follath865b3eb2019-12-16 11:46:15 +0000433 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200434
435 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
436 {
437 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
438 return( 0 );
439 }
440
441 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
442 buf, len ) ) != 0 )
443 {
444 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200445 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
446 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200447 return( ret );
448 }
449
450 /* Only mark the extension as OK when we're sure it is */
451 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
452
453 return( 0 );
454}
455#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200457#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
458static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200459 const unsigned char *buf,
460 size_t len )
461{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200462 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200463 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200464 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200465 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
466 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100467 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200468 }
469
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200470 ssl->session_negotiate->mfl_code = buf[0];
471
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200472 return( 0 );
473}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200474#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200475
Hanno Beckera0e20d02019-05-15 14:03:01 +0100476#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89dcc882019-04-26 13:56:39 +0100477static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl,
478 const unsigned char *buf,
479 size_t len )
480{
481 size_t peer_cid_len;
482
483 /* CID extension only makes sense in DTLS */
484 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
485 {
486 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
487 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
488 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100489 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Hanno Becker89dcc882019-04-26 13:56:39 +0100490 }
491
492 /*
Hanno Beckerebcc9132019-05-15 10:26:32 +0100493 * Quoting draft-ietf-tls-dtls-connection-id-05
494 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Becker89dcc882019-04-26 13:56:39 +0100495 *
496 * struct {
497 * opaque cid<0..2^8-1>;
498 * } ConnectionId;
499 */
500
501 if( len < 1 )
502 {
503 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
504 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100505 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
506 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Hanno Becker89dcc882019-04-26 13:56:39 +0100507 }
508
509 peer_cid_len = *buf++;
510 len--;
511
512 if( len != peer_cid_len )
513 {
514 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
515 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100516 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
517 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Hanno Becker89dcc882019-04-26 13:56:39 +0100518 }
519
520 /* Ignore CID if the user has disabled its use. */
521 if( ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
522 {
523 /* Leave ssl->handshake->cid_in_use in its default
524 * value of MBEDTLS_SSL_CID_DISABLED. */
525 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Client sent CID extension, but CID disabled" ) );
526 return( 0 );
527 }
528
529 if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
530 {
531 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
532 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
533 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100534 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Hanno Becker89dcc882019-04-26 13:56:39 +0100535 }
536
Hanno Becker08556bf2019-05-03 12:43:44 +0100537 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
Hanno Becker89dcc882019-04-26 13:56:39 +0100538 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
539 memcpy( ssl->handshake->peer_cid, buf, peer_cid_len );
540
541 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
542 MBEDTLS_SSL_DEBUG_BUF( 3, "Client CID", buf, peer_cid_len );
543
Hanno Becker89dcc882019-04-26 13:56:39 +0100544 return( 0 );
545}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100546#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker89dcc882019-04-26 13:56:39 +0100547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
549static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100550 const unsigned char *buf,
551 size_t len )
552{
553 if( len != 0 )
554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200556 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
557 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100558 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100559 }
560
561 ((void) buf);
562
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +0100563 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100564 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100566 }
567
568 return( 0 );
569}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200570#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200572#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
573static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200574 const unsigned char *buf,
575 size_t len )
576{
577 if( len != 0 )
578 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200580 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
581 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100582 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200583 }
584
585 ((void) buf);
586
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +0100587 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200588 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200590 }
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200591
592 return( 0 );
593}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200594#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200595
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200596#if defined(MBEDTLS_SSL_SESSION_TICKETS)
597static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200598 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200599 size_t len )
600{
Janos Follath865b3eb2019-12-16 11:46:15 +0000601 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200602 mbedtls_ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200603
Manuel Pégourié-Gonnardbae389b2015-06-24 10:45:58 +0200604 mbedtls_ssl_session_init( &session );
605
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200606 if( ssl->conf->f_ticket_parse == NULL ||
607 ssl->conf->f_ticket_write == NULL )
608 {
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200609 return( 0 );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200610 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200611
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200612 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200613 ssl->handshake->new_session_ticket = 1;
614
Paul Elliottd48d5c62021-01-07 14:47:05 +0000615 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %" MBEDTLS_PRINTF_SIZET, len ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200616
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200617 if( len == 0 )
618 return( 0 );
619
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200620#if defined(MBEDTLS_SSL_RENEGOTIATION)
621 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200622 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200624 return( 0 );
625 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200626#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200627
628 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200629 * Failures are ok: just ignore the ticket and proceed.
630 */
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200631 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
632 buf, len ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200633 {
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200634 mbedtls_ssl_session_free( &session );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200635
636 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
637 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
638 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
639 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
640 else
641 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
642
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200643 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200644 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200645
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200646 /*
647 * Keep the session ID sent by the client, since we MUST send it back to
648 * inform them we're accepting the ticket (RFC 5077 section 3.4)
649 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200650 session.id_len = ssl->session_negotiate->id_len;
651 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200652
653 mbedtls_ssl_session_free( ssl->session_negotiate );
654 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
655
656 /* Zeroize instead of free as we copied the content */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500657 mbedtls_platform_zeroize( &session, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200658
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200659 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200660
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200661 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200662
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200663 /* Don't send a new ticket after all, this one is OK */
664 ssl->handshake->new_session_ticket = 0;
665
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200666 return( 0 );
667}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200668#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200670#if defined(MBEDTLS_SSL_ALPN)
671static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard14beb082014-07-08 13:50:35 +0200672 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200673{
Paul Bakker14b16c62014-05-28 11:33:54 +0200674 size_t list_len, cur_len, ours_len;
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200675 const unsigned char *theirs, *start, *end;
676 const char **ours;
677
678 /* If ALPN not configured, just ignore the extension */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200679 if( ssl->conf->alpn_list == NULL )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200680 return( 0 );
681
682 /*
683 * opaque ProtocolName<1..2^8-1>;
684 *
685 * struct {
686 * ProtocolName protocol_name_list<2..2^16-1>
687 * } ProtocolNameList;
688 */
689
690 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
691 if( len < 4 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200692 {
693 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
694 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100695 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200696 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200697
698 list_len = ( buf[0] << 8 ) | buf[1];
699 if( list_len != len - 2 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200700 {
701 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
702 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100703 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200704 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200705
706 /*
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100707 * Validate peer's list (lengths)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200708 */
709 start = buf + 2;
710 end = buf + len;
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100711 for( theirs = start; theirs != end; theirs += cur_len )
712 {
713 cur_len = *theirs++;
714
715 /* Current identifier must fit in list */
716 if( cur_len > (size_t)( end - theirs ) )
717 {
718 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
719 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100720 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100721 }
722
723 /* Empty strings MUST NOT be included */
724 if( cur_len == 0 )
725 {
726 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
727 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Hanno Becker90d59dd2021-06-24 11:17:13 +0100728 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100729 }
730 }
731
732 /*
733 * Use our order of preference
734 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200735 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200736 {
Paul Bakker14b16c62014-05-28 11:33:54 +0200737 ours_len = strlen( *ours );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200738 for( theirs = start; theirs != end; theirs += cur_len )
739 {
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200740 cur_len = *theirs++;
741
Paul Bakker14b16c62014-05-28 11:33:54 +0200742 if( cur_len == ours_len &&
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200743 memcmp( theirs, *ours, cur_len ) == 0 )
744 {
745 ssl->alpn_chosen = *ours;
746 return( 0 );
747 }
748 }
749 }
750
751 /* If we get there, no match was found */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200752 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
753 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
Dave Rodgman53c86892021-06-29 10:02:06 +0100754 return( MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200755}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200756#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200757
Johan Pascalb62bb512015-12-03 21:56:45 +0100758#if defined(MBEDTLS_SSL_DTLS_SRTP)
759static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
Ron Eldoref72faf2018-07-12 11:54:20 +0300760 const unsigned char *buf,
761 size_t len )
Johan Pascalb62bb512015-12-03 21:56:45 +0100762{
Johan Pascal43f94902020-09-22 12:25:52 +0200763 mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET;
Johan Pascalb62bb512015-12-03 21:56:45 +0100764 size_t i,j;
Johan Pascalf6417ec2020-09-22 15:15:19 +0200765 size_t profile_length;
766 uint16_t mki_length;
Ron Eldor313d7b52018-12-10 14:56:21 +0200767 /*! 2 bytes for profile length and 1 byte for mki len */
768 const size_t size_of_lengths = 3;
Johan Pascalb62bb512015-12-03 21:56:45 +0100769
770 /* If use_srtp is not configured, just ignore the extension */
Johan Pascalc3ccd982020-10-28 17:18:18 +0100771 if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
772 ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
773 ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
Johan Pascal85269572020-08-25 10:01:54 +0200774 {
Johan Pascalb62bb512015-12-03 21:56:45 +0100775 return( 0 );
Johan Pascal85269572020-08-25 10:01:54 +0200776 }
Johan Pascalb62bb512015-12-03 21:56:45 +0100777
778 /* RFC5764 section 4.1.1
779 * uint8 SRTPProtectionProfile[2];
780 *
781 * struct {
782 * SRTPProtectionProfiles SRTPProtectionProfiles;
783 * opaque srtp_mki<0..255>;
784 * } UseSRTPData;
785
786 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
Johan Pascalb62bb512015-12-03 21:56:45 +0100787 */
788
Ron Eldoref72faf2018-07-12 11:54:20 +0300789 /*
790 * Min length is 5: at least one protection profile(2 bytes)
791 * and length(2 bytes) + srtp_mki length(1 byte)
Johan Pascal042d4562020-08-25 12:14:02 +0200792 * Check here that we have at least 2 bytes of protection profiles length
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200793 * and one of srtp_mki length
Ron Eldoref72faf2018-07-12 11:54:20 +0300794 */
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200795 if( len < size_of_lengths )
Ron Eldor313d7b52018-12-10 14:56:21 +0200796 {
797 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100798 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
799 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Ron Eldor313d7b52018-12-10 14:56:21 +0200800 }
Johan Pascalb62bb512015-12-03 21:56:45 +0100801
Johan Pascal43f94902020-09-22 12:25:52 +0200802 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET;
Ron Eldor591f1622018-01-22 12:30:04 +0200803
Ron Eldoref72faf2018-07-12 11:54:20 +0300804 /* first 2 bytes are protection profile length(in bytes) */
805 profile_length = ( buf[0] << 8 ) | buf[1];
Johan Pascal042d4562020-08-25 12:14:02 +0200806 buf += 2;
Ron Eldor591f1622018-01-22 12:30:04 +0200807
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200808 /* The profile length cannot be bigger than input buffer size - lengths fields */
809 if( profile_length > len - size_of_lengths ||
Johan Pascal042d4562020-08-25 12:14:02 +0200810 profile_length % 2 != 0 ) /* profiles are 2 bytes long, so the length must be even */
Ron Eldor313d7b52018-12-10 14:56:21 +0200811 {
812 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100813 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
814 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Ron Eldor313d7b52018-12-10 14:56:21 +0200815 }
Ron Eldoref72faf2018-07-12 11:54:20 +0300816 /*
817 * parse the extension list values are defined in
818 * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml
819 */
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200820 for( j = 0; j < profile_length; j += 2 )
Johan Pascalb62bb512015-12-03 21:56:45 +0100821 {
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200822 uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1];
Johan Pascal43f94902020-09-22 12:25:52 +0200823 client_protection = mbedtls_ssl_check_srtp_profile_value( protection_profile_value );
Johan Pascalb62bb512015-12-03 21:56:45 +0100824
Johan Pascal43f94902020-09-22 12:25:52 +0200825 if( client_protection != MBEDTLS_TLS_SRTP_UNSET )
Ron Eldorb4655392018-07-05 18:25:39 +0300826 {
Johan Pascal43f94902020-09-22 12:25:52 +0200827 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found srtp profile: %s",
828 mbedtls_ssl_get_srtp_profile_as_string(
829 client_protection ) ) );
Ron Eldorb4655392018-07-05 18:25:39 +0300830 }
Johan Pascal85269572020-08-25 10:01:54 +0200831 else
832 {
833 continue;
834 }
Ron Eldor591f1622018-01-22 12:30:04 +0200835 /* check if suggested profile is in our list */
Ron Eldora9788042018-12-05 11:04:31 +0200836 for( i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++)
Ron Eldor591f1622018-01-22 12:30:04 +0200837 {
838 if( client_protection == ssl->conf->dtls_srtp_profile_list[i] )
839 {
Ron Eldor3adb9922017-12-21 10:15:08 +0200840 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i];
Johan Pascal43f94902020-09-22 12:25:52 +0200841 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected srtp profile: %s",
842 mbedtls_ssl_get_srtp_profile_as_string(
843 client_protection ) ) );
Ron Eldor591f1622018-01-22 12:30:04 +0200844 break;
Johan Pascalb62bb512015-12-03 21:56:45 +0100845 }
846 }
Johan Pascal43f94902020-09-22 12:25:52 +0200847 if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET )
Ron Eldor591f1622018-01-22 12:30:04 +0200848 break;
849 }
Johan Pascal042d4562020-08-25 12:14:02 +0200850 buf += profile_length; /* buf points to the mki length */
851 mki_length = *buf;
852 buf++;
Ron Eldor591f1622018-01-22 12:30:04 +0200853
Johan Pascal042d4562020-08-25 12:14:02 +0200854 if( mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH ||
855 mki_length + profile_length + size_of_lengths != len )
856 {
857 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +0100858 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
859 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Johan Pascal042d4562020-08-25 12:14:02 +0200860 }
861
862 /* Parse the mki only if present and mki is supported locally */
863 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED &&
864 mki_length > 0 )
865 {
866 ssl->dtls_srtp_info.mki_len = mki_length;
867
Johan Pascal5ef72d22020-10-28 17:05:47 +0100868 memcpy( ssl->dtls_srtp_info.mki_value, buf, mki_length );
Ron Eldorb4655392018-07-05 18:25:39 +0300869
Ron Eldoref72faf2018-07-12 11:54:20 +0300870 MBEDTLS_SSL_DEBUG_BUF( 3, "using mki", ssl->dtls_srtp_info.mki_value,
871 ssl->dtls_srtp_info.mki_len );
Johan Pascalb62bb512015-12-03 21:56:45 +0100872 }
873
Johan Pascal042d4562020-08-25 12:14:02 +0200874 return( 0 );
Johan Pascalb62bb512015-12-03 21:56:45 +0100875}
876#endif /* MBEDTLS_SSL_DTLS_SRTP */
877
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100878/*
879 * Auxiliary functions for ServerHello parsing and related actions
880 */
881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200882#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100883/*
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100884 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100885 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200886#if defined(MBEDTLS_ECDSA_C)
887static int ssl_check_key_curve( mbedtls_pk_context *pk,
888 const mbedtls_ecp_curve_info **curves )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100889{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200890 const mbedtls_ecp_curve_info **crv = curves;
891 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100892
893 while( *crv != NULL )
894 {
895 if( (*crv)->grp_id == grp_id )
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100896 return( 0 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100897 crv++;
898 }
899
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100900 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100901}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200902#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100903
904/*
905 * Try picking a certificate for this ciphersuite,
906 * return 0 on success and -1 on failure.
907 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200908static int ssl_pick_cert( mbedtls_ssl_context *ssl,
909 const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100910{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200911 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100912 mbedtls_pk_type_t pk_alg =
913 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200914 uint32_t flags;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100915
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200916#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100917 if( ssl->handshake->sni_key_cert != NULL )
918 list = ssl->handshake->sni_key_cert;
919 else
920#endif
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200921 list = ssl->conf->key_cert;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100922
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200923 if( pk_alg == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100924 return( 0 );
925
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200926 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000927
Manuel Pégourié-Gonnarde540b492015-07-07 12:44:38 +0200928 if( list == NULL )
929 {
930 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
931 return( -1 );
932 }
933
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100934 for( cur = list; cur != NULL; cur = cur->next )
935 {
Andrzej Kurek7ed01e82020-03-18 11:51:59 -0400936 flags = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200937 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000938 cur->cert );
939
Gilles Peskinee198df52018-01-05 21:17:45 +0100940 if( ! mbedtls_pk_can_do( &cur->cert->pk, pk_alg ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000941 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200942 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100943 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000944 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100945
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200946 /*
947 * This avoids sending the client a cert it'll reject based on
948 * keyUsage or other extensions.
949 *
950 * It also allows the user to provision different certificates for
951 * different uses based on keyUsage, eg if they want to avoid signing
952 * and decrypting with the same RSA key.
953 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200954 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +0100955 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200956 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200957 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000958 "(extended) key usage extension" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200959 continue;
960 }
961
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200962#if defined(MBEDTLS_ECDSA_C)
963 if( pk_alg == MBEDTLS_PK_ECDSA &&
Gilles Peskine81d4e892017-10-27 10:18:44 +0200964 ssl_check_key_curve( &cur->cert->pk, ssl->handshake->curves ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000965 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200966 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100967 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000968 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100969#endif
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100970
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100971 /*
972 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
973 * present them a SHA-higher cert rather than failing if it's the only
974 * one we got that satisfies the other conditions.
975 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200976 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
977 cur->cert->sig_md != MBEDTLS_MD_SHA1 )
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100978 {
979 if( fallback == NULL )
980 fallback = cur;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000981 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200982 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000983 "sha-2 with pre-TLS 1.2 client" ) );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100984 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000985 }
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100986 }
987
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100988 /* If we get there, we got a winner */
989 break;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100990 }
991
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000992 if( cur == NULL )
993 cur = fallback;
994
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200995 /* Do not update ssl->handshake->key_cert unless there is a match */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100996 if( cur != NULL )
997 {
998 ssl->handshake->key_cert = cur;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200999 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001000 ssl->handshake->key_cert->cert );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +01001001 return( 0 );
1002 }
1003
1004 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001005}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001006#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001007
1008/*
1009 * Check if a given ciphersuite is suitable for use with our config/keys/etc
1010 * Sets ciphersuite_info only if the suite matches.
1011 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001012static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
1013 const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001014{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001015 const mbedtls_ssl_ciphersuite_t *suite_info;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001016
Hanno Becker7e5437a2017-04-28 17:15:26 +01001017#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001018 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01001019 mbedtls_pk_type_t sig_type;
1020#endif
1021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001022 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001023 if( suite_info == NULL )
1024 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1026 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001027 }
1028
Hanno Becker5c5efdf2019-01-28 14:59:35 +00001029 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %#04x (%s)",
Paul Elliott3891caf2020-12-17 18:42:40 +00001030 (unsigned int) suite_id, suite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001031
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001032 if( suite_info->min_minor_ver > ssl->minor_ver ||
1033 suite_info->max_minor_ver < ssl->minor_ver )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001034 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001035 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001036 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001037 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001038
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001039#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001040 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001041 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +01001042 return( 0 );
1043#endif
1044
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +02001045#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1046 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001047 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +02001048 {
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001049 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
1050 "not configured or ext missing" ) );
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +02001051 return( 0 );
1052 }
1053#endif
1054
1055
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001056#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
1057 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001058 ( ssl->handshake->curves == NULL ||
1059 ssl->handshake->curves[0] == NULL ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001060 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001061 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001062 "no common elliptic curve" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001063 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001064 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001065#endif
1066
Gilles Peskineeccd8882020-03-10 12:19:08 +01001067#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001068 /* If the ciphersuite requires a pre-shared key and we don't
1069 * have one, skip it now rather than failing later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001070 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Hanno Becker845b9462018-10-26 12:07:29 +01001071 ssl_conf_has_psk_or_cb( ssl->conf ) == 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001072 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001073 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001074 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001075 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001076#endif
1077
Hanno Becker7e5437a2017-04-28 17:15:26 +01001078#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001079 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01001080 /* If the ciphersuite requires signing, check whether
1081 * a suitable hash algorithm is present. */
1082 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1083 {
1084 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg( suite_info );
1085 if( sig_type != MBEDTLS_PK_NONE &&
1086 mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs, sig_type ) == MBEDTLS_MD_NONE )
1087 {
1088 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm "
Paul Elliott3891caf2020-12-17 18:42:40 +00001089 "for signature algorithm %u", (unsigned) sig_type ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +01001090 return( 0 );
1091 }
1092 }
1093
1094#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Gilles Peskineeccd8882020-03-10 12:19:08 +01001095 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Hanno Becker7e5437a2017-04-28 17:15:26 +01001096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001097#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001098 /*
1099 * Final check: if ciphersuite requires us to have a
1100 * certificate/key of a particular type:
1101 * - select the appropriate certificate if we have one, or
1102 * - try the next ciphersuite if we don't
1103 * This must be done last since we modify the key_cert list.
1104 */
1105 if( ssl_pick_cert( ssl, suite_info ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001106 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001107 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001108 "no suitable certificate" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001109 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001110 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001111#endif
1112
1113 *ciphersuite_info = suite_info;
1114 return( 0 );
1115}
1116
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001117/* This function doesn't alert on errors that happen early during
1118 ClientHello parsing because they might indicate that the client is
1119 not talking SSL/TLS at all and would not understand our alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001120static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001121{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001122 int ret, got_common_suite;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001123 size_t i, j;
1124 size_t ciph_offset, comp_offset, ext_offset;
1125 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001126#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001127 size_t cookie_offset, cookie_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001128#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001129 unsigned char *buf, *p, *ext;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001130#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001131 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001132#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001133 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001134 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001136 int major, minor;
Paul Bakker5121ce52009-01-03 21:22:43 +00001137
Hanno Becker7e5437a2017-04-28 17:15:26 +01001138 /* If there is no signature-algorithm extension present,
1139 * we need to fall back to the default values for allowed
1140 * signature-hash pairs. */
1141#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001142 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01001143 int sig_hash_alg_ext_present = 0;
1144#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Gilles Peskineeccd8882020-03-10 12:19:08 +01001145 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Hanno Becker7e5437a2017-04-28 17:15:26 +01001146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001147 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001148
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001149#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001150read_record_header:
1151#endif
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001152 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001153 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001154 * otherwise read it ourselves manually in order to support SSLv2
1155 * ClientHello, which doesn't use the same record layer format.
1156 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001157#if defined(MBEDTLS_SSL_RENEGOTIATION)
1158 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001159#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001160 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001161 if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001162 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001163 /* No alert on a read error. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001164 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001165 return( ret );
1166 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001167 }
1168
1169 buf = ssl->in_hdr;
1170
Hanno Becker5903de42019-05-03 14:46:38 +01001171 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_in_hdr_len( ssl ) );
Paul Bakkerec636f32012-09-09 19:17:02 +00001172
Paul Bakkerec636f32012-09-09 19:17:02 +00001173 /*
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001174 * TLS Client Hello
Paul Bakkerec636f32012-09-09 19:17:02 +00001175 *
1176 * Record layer:
1177 * 0 . 0 message type
1178 * 1 . 2 protocol version
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001179 * 3 . 11 DTLS: epoch + record sequence number
Paul Bakkerec636f32012-09-09 19:17:02 +00001180 * 3 . 4 message length
1181 */
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001182 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, message type: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001183 buf[0] ) );
1184
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001185 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001186 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001187 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001188 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001189 }
1190
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001191 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, message len.: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001192 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
1193
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001194 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, protocol version: [%d:%d]",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001195 buf[1], buf[2] ) );
1196
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001197 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001198
1199 /* According to RFC 5246 Appendix E.1, the version here is typically
1200 * "{03,00}, the lowest version number supported by the client, [or] the
1201 * value of ClientHello.client_version", so the only meaningful check here
1202 * is the major version shouldn't be less than 3 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001203 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001204 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001205 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001206 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
Paul Bakkerec636f32012-09-09 19:17:02 +00001207 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001208
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001209 /* For DTLS if this is the initial handshake, remember the client sequence
1210 * number to use it in our next message (RFC 6347 4.2.1) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001211#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001212 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001213#if defined(MBEDTLS_SSL_RENEGOTIATION)
1214 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Manuel Pégourié-Gonnard3a173f42015-01-22 13:30:33 +00001215#endif
1216 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001217 {
1218 /* Epoch should be 0 for initial handshakes */
1219 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
1220 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001221 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001222 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001223 }
1224
Hanno Becker19859472018-08-06 09:40:20 +01001225 memcpy( ssl->cur_out_ctr + 2, ssl->in_ctr + 2, 6 );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001227#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1228 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001229 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001230 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001231 ssl->next_record_offset = 0;
1232 ssl->in_left = 0;
1233 goto read_record_header;
1234 }
1235
1236 /* No MAC to check yet, so we can update right now */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001237 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001238#endif
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001239 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001240#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001241
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001242 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Paul Bakker5121ce52009-01-03 21:22:43 +00001243
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001244#if defined(MBEDTLS_SSL_RENEGOTIATION)
1245 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001246 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001247 /* Set by mbedtls_ssl_read_record() */
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001248 msg_len = ssl->in_hslen;
1249 }
1250 else
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001251#endif
Paul Bakkerec636f32012-09-09 19:17:02 +00001252 {
Angus Grattond8213d02016-05-25 20:56:48 +10001253 if( msg_len > MBEDTLS_SSL_IN_CONTENT_LEN )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001254 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001255 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001256 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001257 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001258
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01001259 if( ( ret = mbedtls_ssl_fetch_input( ssl,
Hanno Becker5903de42019-05-03 14:46:38 +01001260 mbedtls_ssl_in_hdr_len( ssl ) + msg_len ) ) != 0 )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001262 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001263 return( ret );
1264 }
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001265
1266 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001267#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001268 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Hanno Becker5903de42019-05-03 14:46:38 +01001269 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len( ssl );
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001270 else
1271#endif
1272 ssl->in_left = 0;
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001273 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001274
1275 buf = ssl->in_msg;
Paul Bakkerec636f32012-09-09 19:17:02 +00001276
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001277 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001278
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001279 ssl->handshake->update_checksum( ssl, buf, msg_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001280
1281 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001282 * Handshake layer:
1283 * 0 . 0 handshake type
1284 * 1 . 3 handshake length
1285 * 4 . 5 DTLS only: message seqence number
1286 * 6 . 8 DTLS only: fragment offset
1287 * 9 . 11 DTLS only: fragment length
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001288 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001289 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001290 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001291 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001292 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001293 }
1294
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001295 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001297 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001298 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001299 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001300 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001301 }
1302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001303 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001304 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1305
1306 /* We don't support fragmentation of ClientHello (yet?) */
1307 if( buf[1] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001308 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001309 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001310 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001311 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001312 }
1313
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001314#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001315 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001316 {
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001317 /*
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001318 * Copy the client's handshake message_seq on initial handshakes,
1319 * check sequence number on renego.
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001320 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001321#if defined(MBEDTLS_SSL_RENEGOTIATION)
1322 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001323 {
1324 /* This couldn't be done in ssl_prepare_handshake_record() */
1325 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1326 ssl->in_msg[5];
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001327
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001328 if( cli_msg_seq != ssl->handshake->in_msg_seq )
1329 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Paul Elliott9f352112020-12-09 14:55:45 +00001331 "%u (expected %u)", cli_msg_seq,
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001332 ssl->handshake->in_msg_seq ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001333 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001334 }
1335
1336 ssl->handshake->in_msg_seq++;
1337 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001338 else
1339#endif
1340 {
1341 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1342 ssl->in_msg[5];
1343 ssl->handshake->out_msg_seq = cli_msg_seq;
1344 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1345 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001346
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001347 /*
1348 * For now we don't support fragmentation, so make sure
1349 * fragment_offset == 0 and fragment_length == length
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001350 */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001351 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
1352 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
1353 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001354 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
1355 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001356 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001357 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001358#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001360 buf += mbedtls_ssl_hs_hdr_len( ssl );
1361 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001362
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001363 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001364 * ClientHello layer:
1365 * 0 . 1 protocol version
1366 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1367 * 34 . 35 session id length (1 byte)
1368 * 35 . 34+x session id
1369 * 35+x . 35+x DTLS only: cookie length (1 byte)
1370 * 36+x . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001371 * .. . .. ciphersuite list length (2 bytes)
1372 * .. . .. ciphersuite list
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001373 * .. . .. compression alg. list length (1 byte)
1374 * .. . .. compression alg. list
1375 * .. . .. extensions length (2 bytes, optional)
1376 * .. . .. extensions (optional)
Paul Bakkerec636f32012-09-09 19:17:02 +00001377 */
Paul Bakkerec636f32012-09-09 19:17:02 +00001378
1379 /*
Antonin Décimo36e89b52019-01-23 15:24:37 +01001380 * Minimal length (with everything empty and extensions omitted) is
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001381 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1382 * read at least up to session id length without worrying.
Paul Bakkerec636f32012-09-09 19:17:02 +00001383 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001384 if( msg_len < 38 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001387 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001388 }
1389
1390 /*
1391 * Check and save the protocol version
1392 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001393 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001394
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001395 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001396 ssl->conf->transport, buf );
Hanno Beckerfadbdbb2021-07-23 06:25:48 +01001397 ssl->session_negotiate->minor_ver = ssl->minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001398
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001399 ssl->handshake->max_major_ver = ssl->major_ver;
1400 ssl->handshake->max_minor_ver = ssl->minor_ver;
1401
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001402 if( ssl->major_ver < ssl->conf->min_major_ver ||
1403 ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00001404 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001405 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001406 " [%d:%d] < [%d:%d]",
1407 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001408 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001409 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1410 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Hanno Beckerbc000442021-06-24 09:18:19 +01001411 return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001412 }
1413
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001414 if( ssl->major_ver > ssl->conf->max_major_ver )
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001415 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001416 ssl->major_ver = ssl->conf->max_major_ver;
1417 ssl->minor_ver = ssl->conf->max_minor_ver;
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001418 }
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001419 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
1420 ssl->minor_ver = ssl->conf->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001421
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001422 /*
1423 * Save client random (inc. Unix time)
1424 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001425 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001426
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001427 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001428
1429 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001430 * Check the session ID length and save session ID
Paul Bakkerec636f32012-09-09 19:17:02 +00001431 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001432 sess_len = buf[34];
Paul Bakkerec636f32012-09-09 19:17:02 +00001433
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001434 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001435 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Paul Bakkerec636f32012-09-09 19:17:02 +00001436 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001438 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1439 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001440 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakkerec636f32012-09-09 19:17:02 +00001441 }
1442
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001443 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001444
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001445 ssl->session_negotiate->id_len = sess_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001446 memset( ssl->session_negotiate->id, 0,
1447 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001448 memcpy( ssl->session_negotiate->id, buf + 35,
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001449 ssl->session_negotiate->id_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001450
1451 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001452 * Check the cookie length and content
1453 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001454#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001455 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001456 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001457 cookie_offset = 35 + sess_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001458 cookie_len = buf[cookie_offset];
1459
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001460 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001462 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001463 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker90d59dd2021-06-24 11:17:13 +01001464 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1465 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001466 }
1467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001468 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001469 buf + cookie_offset + 1, cookie_len );
1470
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001471#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001472 if( ssl->conf->f_cookie_check != NULL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001473#if defined(MBEDTLS_SSL_RENEGOTIATION)
1474 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001475#endif
1476 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001477 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001478 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001479 buf + cookie_offset + 1, cookie_len,
1480 ssl->cli_id, ssl->cli_id_len ) != 0 )
1481 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001482 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001483 ssl->handshake->verify_cookie_len = 1;
1484 }
1485 else
1486 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001488 ssl->handshake->verify_cookie_len = 0;
1489 }
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001490 }
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02001491 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001493 {
1494 /* We know we didn't send a cookie, so it should be empty */
1495 if( cookie_len != 0 )
1496 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001497 /* This may be an attacker's probe, so don't send an alert */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001498 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001499 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001500 }
1501
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001502 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001503 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001504
1505 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001506 * Check the ciphersuitelist length (will be parsed later)
Paul Bakkerec636f32012-09-09 19:17:02 +00001507 */
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001508 ciph_offset = cookie_offset + 1 + cookie_len;
Manuel Pégourié-Gonnarda06d7fe2015-03-13 10:36:55 +00001509 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001510 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001511#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001512 ciph_offset = 35 + sess_len;
Paul Bakkerec636f32012-09-09 19:17:02 +00001513
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001514 ciph_len = ( buf[ciph_offset + 0] << 8 )
1515 | ( buf[ciph_offset + 1] );
1516
1517 if( ciph_len < 2 ||
1518 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1519 ( ciph_len % 2 ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001520 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001521 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001522 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1523 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001524 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakkerec636f32012-09-09 19:17:02 +00001525 }
1526
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001527 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001528 buf + ciph_offset + 2, ciph_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001529
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001530 /*
1531 * Check the compression algorithms length and pick one
1532 */
1533 comp_offset = ciph_offset + 2 + ciph_len;
1534
1535 comp_len = buf[comp_offset];
1536
1537 if( comp_len < 1 ||
1538 comp_len > 16 ||
1539 comp_len + comp_offset + 1 > msg_len )
Paul Bakkerec636f32012-09-09 19:17:02 +00001540 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001542 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1543 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001544 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakkerec636f32012-09-09 19:17:02 +00001545 }
1546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001547 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001548 buf + comp_offset + 1, comp_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001549
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001550 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001551 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001552#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001553 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001554 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001555#endif
Simon Butcher584a5472016-05-23 16:24:52 +01001556 /*
1557 * Check the extension length
1558 */
1559 ext_offset = comp_offset + 1 + comp_len;
1560 if( msg_len > ext_offset )
Paul Bakker48916f92012-09-16 19:57:18 +00001561 {
Simon Butcher584a5472016-05-23 16:24:52 +01001562 if( msg_len < ext_offset + 2 )
1563 {
1564 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001565 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1566 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001567 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001568 }
1569
1570 ext_len = ( buf[ext_offset + 0] << 8 )
1571 | ( buf[ext_offset + 1] );
1572
Glenn Strauss8a8a83b2021-02-02 02:21:23 -05001573 if( msg_len != ext_offset + 2 + ext_len )
Simon Butcher584a5472016-05-23 16:24:52 +01001574 {
1575 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001576 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1577 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001578 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001579 }
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001580 }
Simon Butcher584a5472016-05-23 16:24:52 +01001581 else
1582 ext_len = 0;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001583
Simon Butcher584a5472016-05-23 16:24:52 +01001584 ext = buf + ext_offset + 2;
1585 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001586
Simon Butcher584a5472016-05-23 16:24:52 +01001587 while( ext_len != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001588 {
Philippe Antoine747fd532018-05-30 09:13:21 +02001589 unsigned int ext_id;
1590 unsigned int ext_size;
1591 if ( ext_len < 4 ) {
1592 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1593 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1594 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001595 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Philippe Antoine747fd532018-05-30 09:13:21 +02001596 }
1597 ext_id = ( ( ext[0] << 8 ) | ( ext[1] ) );
1598 ext_size = ( ( ext[2] << 8 ) | ( ext[3] ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001599
Simon Butcher584a5472016-05-23 16:24:52 +01001600 if( ext_size + 4 > ext_len )
1601 {
1602 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001603 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1604 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001605 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001606 }
1607 switch( ext_id )
1608 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001609#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001610 case MBEDTLS_TLS_EXT_SERVERNAME:
1611 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1612 if( ssl->conf->f_sni == NULL )
1613 break;
Paul Bakker5701cdc2012-09-27 21:49:42 +00001614
Simon Butcher584a5472016-05-23 16:24:52 +01001615 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1616 if( ret != 0 )
1617 return( ret );
1618 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001619#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001620
Simon Butcher584a5472016-05-23 16:24:52 +01001621 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1622 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001623#if defined(MBEDTLS_SSL_RENEGOTIATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001624 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001625#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001626
Simon Butcher584a5472016-05-23 16:24:52 +01001627 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1628 if( ret != 0 )
1629 return( ret );
1630 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001632#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001633 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001634 case MBEDTLS_TLS_EXT_SIG_ALG:
Ron Eldor73a38172017-10-03 15:58:26 +03001635 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1636
Simon Butcher584a5472016-05-23 16:24:52 +01001637 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1638 if( ret != 0 )
1639 return( ret );
Hanno Becker7e5437a2017-04-28 17:15:26 +01001640
1641 sig_hash_alg_ext_present = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001642 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001643#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Gilles Peskineeccd8882020-03-10 12:19:08 +01001644 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001645
Robert Cragie136884c2015-10-02 13:34:31 +01001646#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001647 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001648 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1649 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Paul Bakker41c83d32013-03-20 14:39:14 +01001650
Simon Butcher584a5472016-05-23 16:24:52 +01001651 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1652 if( ret != 0 )
1653 return( ret );
1654 break;
Paul Bakker41c83d32013-03-20 14:39:14 +01001655
Simon Butcher584a5472016-05-23 16:24:52 +01001656 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1657 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1658 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001659
Simon Butcher584a5472016-05-23 16:24:52 +01001660 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1661 if( ret != 0 )
1662 return( ret );
1663 break;
Robert Cragieae8535d2015-10-06 17:11:18 +01001664#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1665 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01001666
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001667#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001668 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1669 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001670
Simon Butcher584a5472016-05-23 16:24:52 +01001671 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
1672 if( ret != 0 )
1673 return( ret );
1674 break;
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001675#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1676
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001677#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Simon Butcher584a5472016-05-23 16:24:52 +01001678 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1679 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001680
Simon Butcher584a5472016-05-23 16:24:52 +01001681 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1682 if( ret != 0 )
1683 return( ret );
1684 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001685#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001686
Hanno Beckera0e20d02019-05-15 14:03:01 +01001687#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker89dcc882019-04-26 13:56:39 +01001688 case MBEDTLS_TLS_EXT_CID:
1689 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) );
1690
1691 ret = ssl_parse_cid_ext( ssl, ext + 4, ext_size );
1692 if( ret != 0 )
1693 return( ret );
1694 break;
Thomas Daubneye1c9a402021-06-15 11:26:43 +01001695#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker89dcc882019-04-26 13:56:39 +01001696
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001697#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001698 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1699 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001700
Simon Butcher584a5472016-05-23 16:24:52 +01001701 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1702 if( ret != 0 )
1703 return( ret );
1704 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001705#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001707#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Simon Butcher584a5472016-05-23 16:24:52 +01001708 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1709 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001710
Simon Butcher584a5472016-05-23 16:24:52 +01001711 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1712 if( ret != 0 )
1713 return( ret );
1714 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001715#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001716
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001717#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Simon Butcher584a5472016-05-23 16:24:52 +01001718 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1719 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001720
Simon Butcher584a5472016-05-23 16:24:52 +01001721 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1722 if( ret != 0 )
1723 return( ret );
1724 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001725#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001726
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001727#if defined(MBEDTLS_SSL_ALPN)
Simon Butcher584a5472016-05-23 16:24:52 +01001728 case MBEDTLS_TLS_EXT_ALPN:
1729 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001730
Simon Butcher584a5472016-05-23 16:24:52 +01001731 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1732 if( ret != 0 )
1733 return( ret );
1734 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001735#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001736
Johan Pascalb62bb512015-12-03 21:56:45 +01001737#if defined(MBEDTLS_SSL_DTLS_SRTP)
1738 case MBEDTLS_TLS_EXT_USE_SRTP:
1739 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found use_srtp extension" ) );
Johan Pascald576fdb2020-09-22 10:39:53 +02001740
Johan Pascalc3ccd982020-10-28 17:18:18 +01001741 ret = ssl_parse_use_srtp_ext( ssl, ext + 4, ext_size );
1742 if( ret != 0 )
1743 return( ret );
Johan Pascalb62bb512015-12-03 21:56:45 +01001744 break;
1745#endif /* MBEDTLS_SSL_DTLS_SRTP */
1746
Simon Butcher584a5472016-05-23 16:24:52 +01001747 default:
Paul Elliott9f352112020-12-09 14:55:45 +00001748 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %u (ignoring)",
Simon Butcher584a5472016-05-23 16:24:52 +01001749 ext_id ) );
1750 }
1751
1752 ext_len -= 4 + ext_size;
1753 ext += 4 + ext_size;
Paul Bakker48916f92012-09-16 19:57:18 +00001754 }
Janos Follathc6dab2b2016-05-23 14:27:02 +01001755
Hanno Becker7e5437a2017-04-28 17:15:26 +01001756#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001757 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01001758
1759 /*
1760 * Try to fall back to default hash SHA1 if the client
1761 * hasn't provided any preferred signature-hash combinations.
1762 */
1763 if( sig_hash_alg_ext_present == 0 )
1764 {
1765 mbedtls_md_type_t md_default = MBEDTLS_MD_SHA1;
1766
1767 if( mbedtls_ssl_check_sig_hash( ssl, md_default ) != 0 )
1768 md_default = MBEDTLS_MD_NONE;
1769
1770 mbedtls_ssl_sig_hash_set_const_hash( &ssl->handshake->hash_algs, md_default );
1771 }
1772
1773#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Gilles Peskineeccd8882020-03-10 12:19:08 +01001774 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Hanno Becker7e5437a2017-04-28 17:15:26 +01001775
Paul Bakker48916f92012-09-16 19:57:18 +00001776 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001777 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1778 */
1779 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
1780 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001781 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001782 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001783 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1784#if defined(MBEDTLS_SSL_RENEGOTIATION)
1785 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001786 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01001787 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
1788 "during renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001789 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1790 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Dave Rodgmanc50b7172021-06-29 14:40:23 +01001791 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001792 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001793#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001794 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001795 break;
1796 }
1797 }
1798
1799 /*
Paul Bakker48916f92012-09-16 19:57:18 +00001800 * Renegotiation security checks
1801 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001802 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001803 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001804 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001805 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001806 handshake_failure = 1;
1807 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001808#if defined(MBEDTLS_SSL_RENEGOTIATION)
1809 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1810 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001811 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001812 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001813 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001814 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00001815 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001816 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1817 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001818 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00001819 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001820 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001821 handshake_failure = 1;
1822 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001823 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1824 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001825 renegotiation_info_seen == 1 )
1826 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001828 handshake_failure = 1;
1829 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001830#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001831
1832 if( handshake_failure == 1 )
1833 {
Gilles Peskinec94f7352017-05-10 16:37:56 +02001834 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1835 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Hanno Becker90d59dd2021-06-24 11:17:13 +01001836 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Paul Bakker48916f92012-09-16 19:57:18 +00001837 }
Paul Bakker380da532012-04-18 16:10:25 +00001838
Paul Bakker41c83d32013-03-20 14:39:14 +01001839 /*
1840 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02001841 * (At the end because we need information from the EC-based extensions
1842 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01001843 */
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001844 got_common_suite = 0;
Hanno Beckerd60b6c62021-04-29 12:04:11 +01001845 ciphersuites = ssl->conf->ciphersuite_list;
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01001846 ciphersuite_info = NULL;
TRodziewicz8476f2f2021-06-02 14:34:47 +02001847
TRodziewicz3946f792021-06-14 12:11:18 +02001848 if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT)
TRodziewicz8476f2f2021-06-02 14:34:47 +02001849 {
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001850 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
TRodziewicz8476f2f2021-06-02 14:34:47 +02001851 for( i = 0; ciphersuites[i] != 0; i++ )
1852 {
1853 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1854 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1855 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01001856
TRodziewicz8476f2f2021-06-02 14:34:47 +02001857 got_common_suite = 1;
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001858
TRodziewicz8476f2f2021-06-02 14:34:47 +02001859 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1860 &ciphersuite_info ) ) != 0 )
1861 return( ret );
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001862
TRodziewicz8476f2f2021-06-02 14:34:47 +02001863 if( ciphersuite_info != NULL )
1864 goto have_ciphersuite;
1865 }
1866 } else {
1867 for( i = 0; ciphersuites[i] != 0; i++ )
1868 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
1869 {
1870 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1871 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1872 continue;
1873
1874 got_common_suite = 1;
1875
1876 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1877 &ciphersuite_info ) ) != 0 )
1878 return( ret );
1879
1880 if( ciphersuite_info != NULL )
1881 goto have_ciphersuite;
1882 }
1883 }
Paul Bakker41c83d32013-03-20 14:39:14 +01001884
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001885 if( got_common_suite )
1886 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001887 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001888 "but none of them usable" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001889 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1890 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Dave Rodgman096c4112021-06-29 09:52:06 +01001891 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001892 }
1893 else
1894 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001896 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1897 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Dave Rodgmanbb05cd02021-06-29 10:37:43 +01001898 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001899 }
Paul Bakker41c83d32013-03-20 14:39:14 +01001900
1901have_ciphersuite:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001902 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001903
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001904 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Beckere694c3e2017-12-27 21:34:08 +00001905 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker41c83d32013-03-20 14:39:14 +01001906
Paul Bakker5121ce52009-01-03 21:22:43 +00001907 ssl->state++;
1908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001909#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001910 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001911 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001912#endif
1913
Hanno Becker7e5437a2017-04-28 17:15:26 +01001914 /* Debugging-only output for testsuite */
1915#if defined(MBEDTLS_DEBUG_C) && \
1916 defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001917 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +01001918 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1919 {
1920 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg( ciphersuite_info );
1921 if( sig_alg != MBEDTLS_PK_NONE )
1922 {
1923 mbedtls_md_type_t md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
1924 sig_alg );
1925 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
1926 mbedtls_ssl_hash_from_md_alg( md_alg ) ) );
1927 }
1928 else
1929 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01001930 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm "
Paul Elliott3891caf2020-12-17 18:42:40 +00001931 "%u - should not happen", (unsigned) sig_alg ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +01001932 }
1933 }
1934#endif
1935
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001936 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001937
1938 return( 0 );
1939}
1940
Hanno Beckera0e20d02019-05-15 14:03:01 +01001941#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker51de2d32019-04-26 15:46:55 +01001942static void ssl_write_cid_ext( mbedtls_ssl_context *ssl,
1943 unsigned char *buf,
1944 size_t *olen )
1945{
1946 unsigned char *p = buf;
1947 size_t ext_len;
1948 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1949
1950 *olen = 0;
1951
1952 /* Skip writing the extension if we don't want to use it or if
1953 * the client hasn't offered it. */
1954 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED )
1955 return;
1956
1957 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
1958 * which is at most 255, so the increment cannot overflow. */
1959 if( end < p || (size_t)( end - p ) < (unsigned)( ssl->own_cid_len + 5 ) )
1960 {
1961 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
1962 return;
1963 }
1964
1965 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding CID extension" ) );
1966
1967 /*
Hanno Beckerebcc9132019-05-15 10:26:32 +01001968 * Quoting draft-ietf-tls-dtls-connection-id-05
1969 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Becker51de2d32019-04-26 15:46:55 +01001970 *
1971 * struct {
1972 * opaque cid<0..2^8-1>;
1973 * } ConnectionId;
1974 */
1975
1976 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID >> 8 ) & 0xFF );
1977 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID ) & 0xFF );
1978 ext_len = (size_t) ssl->own_cid_len + 1;
1979 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1980 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
1981
1982 *p++ = (uint8_t) ssl->own_cid_len;
1983 memcpy( p, ssl->own_cid, ssl->own_cid_len );
1984
1985 *olen = ssl->own_cid_len + 5;
1986}
Hanno Beckera0e20d02019-05-15 14:03:01 +01001987#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker51de2d32019-04-26 15:46:55 +01001988
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001989#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1990static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001991 unsigned char *buf,
1992 size_t *olen )
1993{
1994 unsigned char *p = buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001995 const mbedtls_ssl_ciphersuite_t *suite = NULL;
1996 const mbedtls_cipher_info_t *cipher = NULL;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001997
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01001998 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001999 {
2000 *olen = 0;
2001 return;
2002 }
2003
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002004 /*
2005 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
2006 * from a client and then selects a stream or Authenticated Encryption
2007 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
2008 * encrypt-then-MAC response extension back to the client."
2009 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002010 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002011 ssl->session_negotiate->ciphersuite ) ) == NULL ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002012 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
2013 cipher->mode != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002014 {
2015 *olen = 0;
2016 return;
2017 }
2018
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002019 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002020
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002021 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
2022 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002023
2024 *p++ = 0x00;
2025 *p++ = 0x00;
2026
2027 *olen = 4;
2028}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002029#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002030
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002031#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2032static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002033 unsigned char *buf,
2034 size_t *olen )
2035{
2036 unsigned char *p = buf;
2037
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01002038 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002039 {
2040 *olen = 0;
2041 return;
2042 }
2043
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002044 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002045 "extension" ) );
2046
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002047 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
2048 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002049
2050 *p++ = 0x00;
2051 *p++ = 0x00;
2052
2053 *olen = 4;
2054}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002055#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002056
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002057#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2058static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002059 unsigned char *buf,
2060 size_t *olen )
2061{
2062 unsigned char *p = buf;
2063
2064 if( ssl->handshake->new_session_ticket == 0 )
2065 {
2066 *olen = 0;
2067 return;
2068 }
2069
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002070 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002071
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002072 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
2073 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002074
2075 *p++ = 0x00;
2076 *p++ = 0x00;
2077
2078 *olen = 4;
2079}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002080#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002081
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002082static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002083 unsigned char *buf,
2084 size_t *olen )
2085{
2086 unsigned char *p = buf;
2087
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002088 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002089 {
2090 *olen = 0;
2091 return;
2092 }
2093
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002094 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002095
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002096 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
2097 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002098
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002099#if defined(MBEDTLS_SSL_RENEGOTIATION)
2100 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002101 {
2102 *p++ = 0x00;
2103 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
2104 *p++ = ssl->verify_data_len * 2 & 0xFF;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002105
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002106 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
2107 p += ssl->verify_data_len;
2108 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
2109 p += ssl->verify_data_len;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002110 }
2111 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002112#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002113 {
2114 *p++ = 0x00;
2115 *p++ = 0x01;
2116 *p++ = 0x00;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002117 }
Manuel Pégourié-Gonnard19389752015-06-23 13:46:44 +02002118
2119 *olen = p - buf;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002120}
2121
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002122#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2123static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002124 unsigned char *buf,
2125 size_t *olen )
2126{
2127 unsigned char *p = buf;
2128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002129 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02002130 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002131 *olen = 0;
2132 return;
2133 }
2134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002135 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002137 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
2138 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002139
2140 *p++ = 0x00;
2141 *p++ = 1;
2142
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02002143 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002144
2145 *olen = 5;
2146}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002147#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002148
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002149#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002150 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002151static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002152 unsigned char *buf,
2153 size_t *olen )
2154{
2155 unsigned char *p = buf;
2156 ((void) ssl);
2157
Paul Bakker677377f2013-10-28 12:54:26 +01002158 if( ( ssl->handshake->cli_exts &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002159 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Paul Bakker677377f2013-10-28 12:54:26 +01002160 {
2161 *olen = 0;
2162 return;
2163 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002165 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002166
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002167 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
2168 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002169
2170 *p++ = 0x00;
2171 *p++ = 2;
2172
2173 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002174 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002175
2176 *olen = 6;
2177}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002178#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002179
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002180#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2181static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
2182 unsigned char *buf,
2183 size_t *olen )
2184{
Janos Follath865b3eb2019-12-16 11:46:15 +00002185 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002186 unsigned char *p = buf;
Angus Grattond8213d02016-05-25 20:56:48 +10002187 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002188 size_t kkpp_len;
2189
2190 *olen = 0;
2191
2192 /* Skip costly computation if not needed */
Hanno Beckere694c3e2017-12-27 21:34:08 +00002193 if( ssl->handshake->ciphersuite_info->key_exchange !=
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002194 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2195 return;
2196
2197 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
2198
2199 if( end - p < 4 )
2200 {
2201 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2202 return;
2203 }
2204
2205 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
2206 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
2207
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02002208 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
2209 p + 2, end - p - 2, &kkpp_len,
2210 ssl->conf->f_rng, ssl->conf->p_rng );
2211 if( ret != 0 )
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002212 {
2213 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
2214 return;
2215 }
2216
2217 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
2218 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
2219
2220 *olen = kkpp_len + 4;
2221}
2222#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2223
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002224#if defined(MBEDTLS_SSL_ALPN )
2225static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002226 unsigned char *buf, size_t *olen )
2227{
2228 if( ssl->alpn_chosen == NULL )
2229 {
2230 *olen = 0;
2231 return;
2232 }
2233
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002234 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002235
2236 /*
2237 * 0 . 1 ext identifier
2238 * 2 . 3 ext length
2239 * 4 . 5 protocol list length
2240 * 6 . 6 protocol name length
2241 * 7 . 7+n protocol name
2242 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002243 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
2244 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002245
2246 *olen = 7 + strlen( ssl->alpn_chosen );
2247
2248 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2249 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2250
2251 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2252 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2253
2254 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2255
2256 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2257}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002258#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002259
Ron Eldor3adb9922017-12-21 10:15:08 +02002260#if defined(MBEDTLS_SSL_DTLS_SRTP ) && defined(MBEDTLS_SSL_PROTO_DTLS)
Johan Pascalb62bb512015-12-03 21:56:45 +01002261static void ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
Ron Eldoref72faf2018-07-12 11:54:20 +03002262 unsigned char *buf,
2263 size_t *olen )
Johan Pascalb62bb512015-12-03 21:56:45 +01002264{
Ron Eldor75870ec2018-12-06 17:31:55 +02002265 size_t mki_len = 0, ext_len = 0;
Ron Eldor089c9fe2018-12-06 17:12:49 +02002266 uint16_t profile_value = 0;
Johan Pascal8f70fba2020-09-02 10:32:06 +02002267 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
2268
2269 *olen = 0;
Ron Eldor591f1622018-01-22 12:30:04 +02002270
Johan Pascalc3ccd982020-10-28 17:18:18 +01002271 if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
2272 ( ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET ) )
Johan Pascalb62bb512015-12-03 21:56:45 +01002273 {
Johan Pascalb62bb512015-12-03 21:56:45 +01002274 return;
2275 }
2276
2277 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding use_srtp extension" ) );
2278
Johan Pascald576fdb2020-09-22 10:39:53 +02002279 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED )
Ron Eldor591f1622018-01-22 12:30:04 +02002280 {
2281 mki_len = ssl->dtls_srtp_info.mki_len;
2282 }
2283
Johan Pascal9bc97ca2020-09-21 23:44:45 +02002284 /* The extension total size is 9 bytes :
2285 * - 2 bytes for the extension tag
2286 * - 2 bytes for the total size
2287 * - 2 bytes for the protection profile length
2288 * - 2 bytes for the protection profile
2289 * - 1 byte for the mki length
2290 * + the actual mki length
2291 * Check we have enough room in the output buffer */
Johan Pascald576fdb2020-09-22 10:39:53 +02002292 if( (size_t)( end - buf ) < mki_len + 9 )
Johan Pascal8f70fba2020-09-02 10:32:06 +02002293 {
2294 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2295 return;
2296 }
2297
Johan Pascalb62bb512015-12-03 21:56:45 +01002298 /* extension */
2299 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP >> 8 ) & 0xFF );
2300 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP ) & 0xFF );
Ron Eldoref72faf2018-07-12 11:54:20 +03002301 /*
2302 * total length 5 and mki value: only one profile(2 bytes)
2303 * and length(2 bytes) and srtp_mki )
2304 */
Ron Eldor591f1622018-01-22 12:30:04 +02002305 ext_len = 5 + mki_len;
2306 buf[2] = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2307 buf[3] = (unsigned char)( ext_len & 0xFF );
Johan Pascalb62bb512015-12-03 21:56:45 +01002308
2309 /* protection profile length: 2 */
2310 buf[4] = 0x00;
2311 buf[5] = 0x02;
Johan Pascal43f94902020-09-22 12:25:52 +02002312 profile_value = mbedtls_ssl_check_srtp_profile_value(
Johan Pascald576fdb2020-09-22 10:39:53 +02002313 ssl->dtls_srtp_info.chosen_dtls_srtp_profile );
Johan Pascal43f94902020-09-22 12:25:52 +02002314 if( profile_value != MBEDTLS_TLS_SRTP_UNSET )
Ron Eldor089c9fe2018-12-06 17:12:49 +02002315 {
2316 buf[6] = (unsigned char)( ( profile_value >> 8 ) & 0xFF );
2317 buf[7] = (unsigned char)( profile_value & 0xFF );
2318 }
2319 else
2320 {
Johan Pascal8f70fba2020-09-02 10:32:06 +02002321 MBEDTLS_SSL_DEBUG_MSG( 1, ( "use_srtp extension invalid profile" ) );
Ron Eldor089c9fe2018-12-06 17:12:49 +02002322 return;
Johan Pascalb62bb512015-12-03 21:56:45 +01002323 }
2324
Ron Eldor591f1622018-01-22 12:30:04 +02002325 buf[8] = mki_len & 0xFF;
Ron Eldor75870ec2018-12-06 17:31:55 +02002326 memcpy( &buf[9], ssl->dtls_srtp_info.mki_value, mki_len );
Johan Pascalb62bb512015-12-03 21:56:45 +01002327
Ron Eldor591f1622018-01-22 12:30:04 +02002328 *olen = 9 + mki_len;
Johan Pascalb62bb512015-12-03 21:56:45 +01002329}
2330#endif /* MBEDTLS_SSL_DTLS_SRTP */
2331
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002332#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2333static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002334{
Janos Follath865b3eb2019-12-16 11:46:15 +00002335 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002336 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002337 unsigned char *cookie_len_byte;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002339 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002340
2341 /*
2342 * struct {
2343 * ProtocolVersion server_version;
2344 * opaque cookie<0..2^8-1>;
2345 * } HelloVerifyRequest;
2346 */
2347
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02002348 /* The RFC is not clear on this point, but sending the actual negotiated
2349 * version looks like the most interoperable thing to do. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002350 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002351 ssl->conf->transport, p );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002352 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002353 p += 2;
2354
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002355 /* If we get here, f_cookie_check is not null */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002356 if( ssl->conf->f_cookie_write == NULL )
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002357 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
2359 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002360 }
2361
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002362 /* Skip length byte until we know the length */
2363 cookie_len_byte = p++;
2364
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002365 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Angus Grattond8213d02016-05-25 20:56:48 +10002366 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002367 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002368 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002369 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002370 return( ret );
2371 }
2372
2373 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
2374
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002375 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002376
2377 ssl->out_msglen = p - ssl->out_msg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002378 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2379 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002380
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002381 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002382
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002383 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002384 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002385 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002386 return( ret );
2387 }
2388
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002389#if defined(MBEDTLS_SSL_PROTO_DTLS)
2390 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2391 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2392 {
2393 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2394 return( ret );
2395 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01002396#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002397
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002398 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002399
2400 return( 0 );
2401}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002402#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002403
Hanno Beckerf6e09c62021-05-13 06:12:38 +01002404static void ssl_handle_id_based_session_resumption( mbedtls_ssl_context *ssl )
Hanno Becker64ce9742021-04-15 08:19:40 +01002405{
2406 int ret;
Hanno Beckera5b1a392021-04-15 16:48:01 +01002407 mbedtls_ssl_session session_tmp;
Hanno Becker64ce9742021-04-15 08:19:40 +01002408 mbedtls_ssl_session * const session = ssl->session_negotiate;
2409
2410 /* Resume is 0 by default, see ssl_handshake_init().
2411 * It may be already set to 1 by ssl_parse_session_ticket_ext(). */
2412 if( ssl->handshake->resume == 1 )
2413 return;
Hanno Becker7ad77962021-05-13 06:13:34 +01002414 if( session->id_len == 0 )
Hanno Becker64ce9742021-04-15 08:19:40 +01002415 return;
2416 if( ssl->conf->f_get_cache == NULL )
2417 return;
2418#if defined(MBEDTLS_SSL_RENEGOTIATION)
2419 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
2420 return;
2421#endif
2422
Hanno Beckera5b1a392021-04-15 16:48:01 +01002423 mbedtls_ssl_session_init( &session_tmp );
2424
Hanno Becker64ce9742021-04-15 08:19:40 +01002425 ret = ssl->conf->f_get_cache( ssl->conf->p_cache,
Hanno Beckerccdaf6e2021-04-15 09:26:17 +01002426 session->id,
2427 session->id_len,
Hanno Becker64ce9742021-04-15 08:19:40 +01002428 &session_tmp );
2429 if( ret != 0 )
2430 goto exit;
2431
2432 if( session->ciphersuite != session_tmp.ciphersuite ||
2433 session->compression != session_tmp.compression )
2434 {
2435 /* Mismatch between cached and negotiated session */
2436 goto exit;
2437 }
2438
2439 /* Move semantics */
Hanno Becker64ce9742021-04-15 08:19:40 +01002440 mbedtls_ssl_session_free( session );
2441 *session = session_tmp;
Hanno Beckerfc1f4132021-05-14 14:57:54 +01002442 memset( &session_tmp, 0, sizeof( session_tmp ) );
Hanno Becker64ce9742021-04-15 08:19:40 +01002443
2444 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
2445 ssl->handshake->resume = 1;
2446
2447exit:
2448
Hanno Beckerdf564022021-05-13 06:26:37 +01002449 mbedtls_ssl_session_free( &session_tmp );
Hanno Becker64ce9742021-04-15 08:19:40 +01002450}
2451
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002452static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002453{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002454#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002455 mbedtls_time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002456#endif
Janos Follath865b3eb2019-12-16 11:46:15 +00002457 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002458 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002459 unsigned char *buf, *p;
2460
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002461 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002462
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002463#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002464 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002465 ssl->handshake->verify_cookie_len != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002466 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002467 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
2468 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002469
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002470 return( ssl_write_hello_verify_request( ssl ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002471 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002472#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002473
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002474 if( ssl->conf->f_rng == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +01002475 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002476 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2477 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +01002478 }
2479
Paul Bakker5121ce52009-01-03 21:22:43 +00002480 /*
2481 * 0 . 0 handshake type
2482 * 1 . 3 handshake length
2483 * 4 . 5 protocol version
2484 * 6 . 9 UNIX time()
2485 * 10 . 37 random bytes
2486 */
2487 buf = ssl->out_msg;
2488 p = buf + 4;
2489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002490 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002491 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002492 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002494 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002495 buf[4], buf[5] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002497#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002498 t = mbedtls_time( NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +00002499 *p++ = (unsigned char)( t >> 24 );
2500 *p++ = (unsigned char)( t >> 16 );
2501 *p++ = (unsigned char)( t >> 8 );
2502 *p++ = (unsigned char)( t );
2503
Paul Elliottd48d5c62021-01-07 14:47:05 +00002504 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
2505 (long long) t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002506#else
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002507 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002508 return( ret );
2509
2510 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002511#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker5121ce52009-01-03 21:22:43 +00002512
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002513 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Paul Bakkera3d195c2011-11-27 21:07:34 +00002514 return( ret );
2515
2516 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00002517
Paul Bakker48916f92012-09-16 19:57:18 +00002518 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002520 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002521
Hanno Beckerf6e09c62021-05-13 06:12:38 +01002522 ssl_handle_id_based_session_resumption( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002523
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002524 if( ssl->handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002525 {
2526 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002527 * New session, create a new session id,
2528 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00002529 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002530 ssl->state++;
2531
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002532#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002533 ssl->session_negotiate->start = mbedtls_time( NULL );
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002534#endif
2535
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002536#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002537 if( ssl->handshake->new_session_ticket != 0 )
2538 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002539 ssl->session_negotiate->id_len = n = 0;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002540 memset( ssl->session_negotiate->id, 0, 32 );
2541 }
2542 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002543#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002544 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002545 ssl->session_negotiate->id_len = n = 32;
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002546 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02002547 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002548 return( ret );
2549 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002550 }
2551 else
2552 {
2553 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002554 * Resuming a session
Paul Bakker5121ce52009-01-03 21:22:43 +00002555 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002556 n = ssl->session_negotiate->id_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002557 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
Paul Bakkerff60ee62010-03-16 21:09:09 +00002558
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002559 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00002560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002561 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00002562 return( ret );
2563 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002564 }
2565
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002566 /*
2567 * 38 . 38 session id length
2568 * 39 . 38+n session id
2569 * 39+n . 40+n chosen ciphersuite
2570 * 41+n . 41+n chosen compression alg.
2571 * 42+n . 43+n extensions length
2572 * 44+n . 43+n+m extensions
2573 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002574 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2575 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
2576 p += ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002577
Paul Elliottd48d5c62021-01-07 14:47:05 +00002578 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002579 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2580 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Paul Bakker0a597072012-09-25 21:55:46 +00002581 ssl->handshake->resume ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002582
Paul Bakker48916f92012-09-16 19:57:18 +00002583 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2584 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2585 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00002586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002587 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2588 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2589 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Elliott3891caf2020-12-17 18:42:40 +00002590 (unsigned int) ssl->session_negotiate->compression ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002591
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002592 /*
2593 * First write extensions, then the total length
2594 */
2595 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2596 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00002597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002598#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002599 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2600 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02002601#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002602
Hanno Beckera0e20d02019-05-15 14:03:01 +01002603#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker51de2d32019-04-26 15:46:55 +01002604 ssl_write_cid_ext( ssl, p + 2 + ext_len, &olen );
2605 ext_len += olen;
2606#endif
2607
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002608#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002609 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2610 ext_len += olen;
2611#endif
2612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002613#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002614 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2615 ext_len += olen;
2616#endif
2617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002618#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002619 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2620 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02002621#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002622
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002623#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01002624 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Ron Eldor755bb6a2018-02-14 19:30:48 +02002625 if ( mbedtls_ssl_ciphersuite_uses_ec(
2626 mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite ) ) )
2627 {
2628 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2629 ext_len += olen;
2630 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002631#endif
2632
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002633#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2634 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
2635 ext_len += olen;
2636#endif
2637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002638#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002639 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2640 ext_len += olen;
2641#endif
2642
Johan Pascalb62bb512015-12-03 21:56:45 +01002643#if defined(MBEDTLS_SSL_DTLS_SRTP)
Johan Pascalc3ccd982020-10-28 17:18:18 +01002644 ssl_write_use_srtp_ext( ssl, p + 2 + ext_len, &olen );
2645 ext_len += olen;
Johan Pascalb62bb512015-12-03 21:56:45 +01002646#endif
2647
Paul Elliottd48d5c62021-01-07 14:47:05 +00002648 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %" MBEDTLS_PRINTF_SIZET,
2649 ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002650
Paul Bakkera7036632014-04-30 10:15:38 +02002651 if( ext_len > 0 )
2652 {
2653 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2654 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2655 p += ext_len;
2656 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002657
2658 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002659 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2660 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002661
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002662 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002664 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002665
2666 return( ret );
2667}
2668
Gilles Peskineeccd8882020-03-10 12:19:08 +01002669#if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002670static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002671{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002672 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00002673 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002675 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002676
Hanno Becker77adddc2019-02-07 12:32:43 +00002677 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002678 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002679 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002680 ssl->state++;
2681 return( 0 );
2682 }
2683
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002684 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2685 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002686}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002687#else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002688static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002689{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002690 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002691 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00002692 ssl->handshake->ciphersuite_info;
irwirc9bc3002020-04-01 13:46:36 +03002693 uint16_t dn_size, total_dn_size; /* excluding length bytes */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002694 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00002695 unsigned char *buf, *p;
Angus Grattond8213d02016-05-25 20:56:48 +10002696 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002697 const mbedtls_x509_crt *crt;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002698 int authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00002699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002700 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002701
2702 ssl->state++;
2703
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002704#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2705 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
2706 authmode = ssl->handshake->sni_authmode;
2707 else
2708#endif
2709 authmode = ssl->conf->authmode;
2710
Hanno Becker77adddc2019-02-07 12:32:43 +00002711 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ||
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002712 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002713 {
Johan Pascal4f099262020-09-22 10:59:26 +02002714 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
2715 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002716 }
2717
2718 /*
2719 * 0 . 0 handshake type
2720 * 1 . 3 handshake length
2721 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01002722 * 5 .. m-1 cert types
2723 * m .. m+1 sig alg length (TLS 1.2 only)
Paul Bakker9af723c2014-05-01 13:03:14 +02002724 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00002725 * n .. n+1 length of all DNs
2726 * n+2 .. n+3 length of DN 1
2727 * n+4 .. ... Distinguished Name #1
2728 * ... .. ... length of DN 2, etc.
2729 */
2730 buf = ssl->out_msg;
2731 p = buf + 4;
2732
2733 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002734 * Supported certificate types
2735 *
2736 * ClientCertificateType certificate_types<1..2^8-1>;
2737 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00002738 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002739 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01002740
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002741#if defined(MBEDTLS_RSA_C)
2742 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002743#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002744#if defined(MBEDTLS_ECDSA_C)
2745 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002746#endif
2747
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002748 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002749 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01002750
Paul Bakker577e0062013-08-28 11:57:20 +02002751 sa_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002752#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01002753 /*
2754 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01002755 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002756 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2757 *
2758 * struct {
2759 * HashAlgorithm hash;
2760 * SignatureAlgorithm signature;
2761 * } SignatureAndHashAlgorithm;
2762 *
2763 * enum { (255) } HashAlgorithm;
2764 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01002765 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002766 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002767 {
Simon Butcher99000142016-10-13 17:21:01 +01002768 const int *cur;
Paul Bakkerf7abd422013-04-16 13:15:56 +02002769
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002770 /*
2771 * Supported signature algorithms
2772 */
Simon Butcher99000142016-10-13 17:21:01 +01002773 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
2774 {
2775 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *cur );
2776
2777 if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
2778 continue;
2779
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002780#if defined(MBEDTLS_RSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01002781 p[2 + sa_len++] = hash;
2782 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002783#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002784#if defined(MBEDTLS_ECDSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01002785 p[2 + sa_len++] = hash;
2786 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002787#endif
Simon Butcher99000142016-10-13 17:21:01 +01002788 }
Paul Bakker926af752012-11-23 13:38:07 +01002789
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002790 p[0] = (unsigned char)( sa_len >> 8 );
2791 p[1] = (unsigned char)( sa_len );
2792 sa_len += 2;
2793 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01002794 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002795#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002796
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002797 /*
2798 * DistinguishedName certificate_authorities<0..2^16-1>;
2799 * opaque DistinguishedName<1..2^16-1>;
2800 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002801 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002802
Paul Bakkerbc3d9842012-11-26 16:12:02 +01002803 total_dn_size = 0;
Janos Follath088ce432017-04-10 12:42:31 +01002804
2805 if( ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED )
Paul Bakker5121ce52009-01-03 21:22:43 +00002806 {
Hanno Becker8bf74f32019-03-27 11:01:30 +00002807 /* NOTE: If trusted certificates are provisioned
2808 * via a CA callback (configured through
2809 * `mbedtls_ssl_conf_ca_cb()`, then the
2810 * CertificateRequest is currently left empty. */
2811
Janos Follath088ce432017-04-10 12:42:31 +01002812#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2813 if( ssl->handshake->sni_ca_chain != NULL )
2814 crt = ssl->handshake->sni_ca_chain;
2815 else
2816#endif
2817 crt = ssl->conf->ca_chain;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02002818
Janos Follath088ce432017-04-10 12:42:31 +01002819 while( crt != NULL && crt->version != 0 )
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02002820 {
irwirc9bc3002020-04-01 13:46:36 +03002821 /* It follows from RFC 5280 A.1 that this length
2822 * can be represented in at most 11 bits. */
2823 dn_size = (uint16_t) crt->subject_raw.len;
Janos Follath088ce432017-04-10 12:42:31 +01002824
irwirc9bc3002020-04-01 13:46:36 +03002825 if( end < p || (size_t)( end - p ) < 2 + (size_t) dn_size )
Janos Follath088ce432017-04-10 12:42:31 +01002826 {
2827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
2828 break;
2829 }
2830
2831 *p++ = (unsigned char)( dn_size >> 8 );
2832 *p++ = (unsigned char)( dn_size );
2833 memcpy( p, crt->subject_raw.p, dn_size );
2834 p += dn_size;
2835
2836 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
2837
2838 total_dn_size += 2 + dn_size;
2839 crt = crt->next;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02002840 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002841 }
2842
Paul Bakker926af752012-11-23 13:38:07 +01002843 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002844 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2845 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002846 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
2847 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00002848
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002849 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002851 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002852
2853 return( ret );
2854}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002855#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002857#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2858 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2859static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002860{
Janos Follath865b3eb2019-12-16 11:46:15 +00002861 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002862
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002863 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002864 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002865 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
2866 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002867 }
2868
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002869 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
2870 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
2871 MBEDTLS_ECDH_OURS ) ) != 0 )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002873 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002874 return( ret );
2875 }
2876
2877 return( 0 );
2878}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002879#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2880 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002881
Gilles Peskineeccd8882020-03-10 12:19:08 +01002882#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002883 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskineebd30ae2018-01-06 03:34:20 +01002884static int ssl_resume_server_key_exchange( mbedtls_ssl_context *ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02002885 size_t *signature_len )
Paul Bakker41c83d32013-03-20 14:39:14 +01002886{
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02002887 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
2888 * signature length which will be added in ssl_write_server_key_exchange
2889 * after the call to ssl_prepare_server_key_exchange.
2890 * ssl_write_server_key_exchange also takes care of incrementing
2891 * ssl->out_msglen. */
2892 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2;
Angus Grattond8213d02016-05-25 20:56:48 +10002893 size_t sig_max_len = ( ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02002894 - sig_start );
Gilles Peskine8f97af72018-04-26 11:46:10 +02002895 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02002896 sig_start, signature_len, sig_max_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01002897 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
2898 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02002899 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02002900 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01002901 }
Gilles Peskined3eb0612018-01-08 17:07:44 +01002902 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_resume_server_key_exchange", ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01002903 return( ret );
2904}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002905#endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02002906 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01002907
Gilles Peskined3eb0612018-01-08 17:07:44 +01002908/* Prepare the ServerKeyExchange message, up to and including
Gilles Peskine168dae82018-04-25 23:35:42 +02002909 * calculating the signature if any, but excluding formatting the
2910 * signature and sending the message. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01002911static int ssl_prepare_server_key_exchange( mbedtls_ssl_context *ssl,
2912 size_t *signature_len )
Paul Bakker5690efc2011-05-26 13:16:06 +00002913{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002914 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00002915 ssl->handshake->ciphersuite_info;
2916
Gilles Peskineeccd8882020-03-10 12:19:08 +01002917#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED)
2918#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Gilles Peskine3ce9b902018-01-06 01:34:21 +01002919 unsigned char *dig_signed = NULL;
Gilles Peskineeccd8882020-03-10 12:19:08 +01002920#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
2921#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01002922
Gilles Peskine184a3fa2018-01-06 01:46:17 +01002923 (void) ciphersuite_info; /* unused in some configurations */
Gilles Peskineeccd8882020-03-10 12:19:08 +01002924#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Gilles Peskine22e695f2018-04-26 00:22:50 +02002925 (void) signature_len;
Gilles Peskineeccd8882020-03-10 12:19:08 +01002926#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01002927
Gilles Peskine16fe8fc2021-06-22 09:45:56 +02002928#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Gilles Peskinef00f1522021-06-22 00:09:00 +02002929#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
2930 size_t out_buf_len = ssl->out_buf_len - ( ssl->out_msg - ssl->out_buf );
2931#else
2932 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN - ( ssl->out_msg - ssl->out_buf );
2933#endif
Gilles Peskine16fe8fc2021-06-22 09:45:56 +02002934#endif
Gilles Peskinef00f1522021-06-22 00:09:00 +02002935
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01002936 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */
Paul Bakker5121ce52009-01-03 21:22:43 +00002937
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01002938 /*
2939 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01002940 * Part 1: Provide key exchange parameters for chosen ciphersuite.
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002941 *
2942 */
2943
2944 /*
2945 * - ECJPAKE key exchanges
2946 */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02002947#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2948 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2949 {
Janos Follath865b3eb2019-12-16 11:46:15 +00002950 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Simon Butcher600c5e62018-06-14 08:58:59 +01002951 size_t len = 0;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02002952
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01002953 ret = mbedtls_ecjpake_write_round_two(
2954 &ssl->handshake->ecjpake_ctx,
2955 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10002956 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01002957 ssl->conf->f_rng, ssl->conf->p_rng );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02002958 if( ret != 0 )
2959 {
2960 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
2961 return( ret );
2962 }
2963
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01002964 ssl->out_msglen += len;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02002965 }
2966#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2967
Hanno Becker1aa267c2017-04-28 17:08:27 +01002968 /*
2969 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
2970 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
2971 * we use empty support identity hints here.
2972 **/
2973#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002974 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2975 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2976 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002977 {
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01002978 ssl->out_msg[ssl->out_msglen++] = 0x00;
2979 ssl->out_msg[ssl->out_msglen++] = 0x00;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002980 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002981#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2982 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002983
Hanno Becker7e5437a2017-04-28 17:15:26 +01002984 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01002985 * - DHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01002986 */
Gilles Peskineeccd8882020-03-10 12:19:08 +01002987#if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01002988 if( mbedtls_ssl_ciphersuite_uses_dhe( ciphersuite_info ) )
Paul Bakker48916f92012-09-16 19:57:18 +00002989 {
Janos Follath865b3eb2019-12-16 11:46:15 +00002990 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Simon Butcher600c5e62018-06-14 08:58:59 +01002991 size_t len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01002992
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002993 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
2994 {
2995 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
2996 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2997 }
2998
Paul Bakker41c83d32013-03-20 14:39:14 +01002999 /*
3000 * Ephemeral DH parameters:
3001 *
3002 * struct {
3003 * opaque dh_p<1..2^16-1>;
3004 * opaque dh_g<1..2^16-1>;
3005 * opaque dh_Ys<1..2^16-1>;
3006 * } ServerDHParams;
3007 */
Hanno Beckerab740562017-10-04 13:15:37 +01003008 if( ( ret = mbedtls_dhm_set_group( &ssl->handshake->dhm_ctx,
3009 &ssl->conf->dhm_P,
3010 &ssl->conf->dhm_G ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003011 {
Hanno Beckerab740562017-10-04 13:15:37 +01003012 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_set_group", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003013 return( ret );
3014 }
Paul Bakker48916f92012-09-16 19:57:18 +00003015
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003016 if( ( ret = mbedtls_dhm_make_params(
3017 &ssl->handshake->dhm_ctx,
Gilles Peskine487bbf62021-05-27 22:17:07 +02003018 (int) mbedtls_dhm_get_len( &ssl->handshake->dhm_ctx ),
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003019 ssl->out_msg + ssl->out_msglen, &len,
3020 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003021 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003022 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003023 return( ret );
3024 }
3025
Gilles Peskineeccd8882020-03-10 12:19:08 +01003026#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003027 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003028#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003029
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003030 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003032 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
3033 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
3034 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
3035 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker41c83d32013-03-20 14:39:14 +01003036 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003037#endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003038
Hanno Becker1aa267c2017-04-28 17:08:27 +01003039 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003040 * - ECDHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003041 */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003042#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003043 if( mbedtls_ssl_ciphersuite_uses_ecdhe( ciphersuite_info ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003044 {
Paul Bakker41c83d32013-03-20 14:39:14 +01003045 /*
3046 * Ephemeral ECDH parameters:
3047 *
3048 * struct {
3049 * ECParameters curve_params;
3050 * ECPoint public;
3051 * } ServerECDHParams;
3052 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003053 const mbedtls_ecp_curve_info **curve = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003054 const mbedtls_ecp_group_id *gid;
Janos Follath865b3eb2019-12-16 11:46:15 +00003055 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Simon Butcher600c5e62018-06-14 08:58:59 +01003056 size_t len = 0;
Gergely Budai987bfb52014-01-19 21:48:42 +01003057
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01003058 /* Match our preference list against the offered curves */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003059 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01003060 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
3061 if( (*curve)->grp_id == *gid )
3062 goto curve_matching_done;
3063
3064curve_matching_done:
Manuel Pégourié-Gonnardb86145e2015-06-23 14:11:39 +02003065 if( curve == NULL || *curve == NULL )
Gergely Budai987bfb52014-01-19 21:48:42 +01003066 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003067 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
Dave Rodgmanbb05cd02021-06-29 10:37:43 +01003068 return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
Gergely Budai987bfb52014-01-19 21:48:42 +01003069 }
Manuel Pégourié-Gonnardde053902014-02-04 13:58:39 +01003070
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003071 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
Gergely Budai987bfb52014-01-19 21:48:42 +01003072
Andrzej Kurekf093a3d2019-02-01 02:50:36 -05003073 if( ( ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx,
3074 (*curve)->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003075 {
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003076 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003077 return( ret );
3078 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003079
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003080 if( ( ret = mbedtls_ecdh_make_params(
3081 &ssl->handshake->ecdh_ctx, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003082 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003083 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen,
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003084 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003085 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003086 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003087 return( ret );
3088 }
3089
Gilles Peskineeccd8882020-03-10 12:19:08 +01003090#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003091 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003092#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003093
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003094 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003095
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003096 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3097 MBEDTLS_DEBUG_ECDH_Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01003098 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003099#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003100
Hanno Becker1aa267c2017-04-28 17:08:27 +01003101 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003102 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003103 * Part 2: For key exchanges involving the server signing the
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003104 * exchange parameters, compute and add the signature here.
3105 *
Hanno Becker1aa267c2017-04-28 17:08:27 +01003106 */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003107#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003108 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003109 {
Gilles Peskine1004c192018-01-08 16:59:14 +01003110 size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed;
Gilles Peskineca1d7422018-04-24 11:53:22 +02003111 size_t hashlen = 0;
Gilles Peskinee1efdf92018-01-05 21:18:37 +01003112 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
Janos Follath865b3eb2019-12-16 11:46:15 +00003113 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker23f36802012-09-28 14:15:14 +00003114
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003115 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003116 * 2.1: Choose hash algorithm:
TRodziewicz4ca18aa2021-05-20 14:46:20 +02003117 * For TLS 1.2, obey signature-hash-algorithm extension
3118 * to choose appropriate hash.
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003119 */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003120
3121 mbedtls_md_type_t md_alg;
3122
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003123#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003124 mbedtls_pk_type_t sig_alg =
3125 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003126 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003127 {
TRodziewicz4ca18aa2021-05-20 14:46:20 +02003128 /* For TLS 1.2, obey signature-hash-algorithm extension
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003129 * (RFC 5246, Sec. 7.4.1.4.1). */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003130 if( sig_alg == MBEDTLS_PK_NONE ||
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003131 ( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
3132 sig_alg ) ) == MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003133 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003134 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003135 /* (... because we choose a cipher suite
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003136 * only if there is a matching hash.) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003137 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003138 }
3139 }
Paul Bakker577e0062013-08-28 11:57:20 +02003140 else
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003141 {
TRodziewicz4ca18aa2021-05-20 14:46:20 +02003142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3143 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003144 }
TRodziewicz4ca18aa2021-05-20 14:46:20 +02003145#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003146
Paul Elliott3891caf2020-12-17 18:42:40 +00003147 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pick hash algorithm %u for signing", (unsigned) md_alg ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +01003148
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003149 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003150 * 2.2: Compute the hash to be signed
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003151 */
TRodziewicz0f82ec62021-05-12 17:49:18 +02003152#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003153 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003154 {
Gilles Peskineca1d7422018-04-24 11:53:22 +02003155 ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003156 dig_signed,
3157 dig_signed_len,
3158 md_alg );
3159 if( ret != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003160 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003161 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003162 else
TRodziewicz0f82ec62021-05-12 17:49:18 +02003163#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3166 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003167 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02003168
Gilles Peskineebd652f2018-01-05 21:18:59 +01003169 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003170
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003171 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003172 * 2.3: Compute and add the signature
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003173 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003174#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3175 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker23f36802012-09-28 14:15:14 +00003176 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003177 /*
3178 * For TLS 1.2, we need to specify signature and hash algorithm
Hanno Becker7e5437a2017-04-28 17:15:26 +01003179 * explicitly through a prefix to the signature.
3180 *
3181 * struct {
3182 * HashAlgorithm hash;
3183 * SignatureAlgorithm signature;
3184 * } SignatureAndHashAlgorithm;
3185 *
3186 * struct {
3187 * SignatureAndHashAlgorithm algorithm;
3188 * opaque signature<0..2^16-1>;
3189 * } DigitallySigned;
3190 *
3191 */
3192
Gilles Peskine1004c192018-01-08 16:59:14 +01003193 ssl->out_msg[ssl->out_msglen++] =
3194 mbedtls_ssl_hash_from_md_alg( md_alg );
3195 ssl->out_msg[ssl->out_msglen++] =
3196 mbedtls_ssl_sig_from_pk_alg( sig_alg );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003197 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003198#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003199
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003200#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003201 if( ssl->conf->f_async_sign_start != NULL )
3202 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003203 ret = ssl->conf->f_async_sign_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003204 mbedtls_ssl_own_cert( ssl ),
3205 md_alg, hash, hashlen );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003206 switch( ret )
3207 {
3208 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3209 /* act as if f_async_sign was null */
3210 break;
3211 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003212 ssl->handshake->async_in_progress = 1;
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003213 return( ssl_resume_server_key_exchange( ssl, signature_len ) );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003214 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003215 ssl->handshake->async_in_progress = 1;
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003216 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3217 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003218 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_sign_start", ret );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003219 return( ret );
3220 }
3221 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003222#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003223
3224 if( mbedtls_ssl_own_key( ssl ) == NULL )
3225 {
3226 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
3227 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3228 }
3229
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003230 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3231 * signature length which will be added in ssl_write_server_key_exchange
3232 * after the call to ssl_prepare_server_key_exchange.
3233 * ssl_write_server_key_exchange also takes care of incrementing
3234 * ssl->out_msglen. */
Gilles Peskine1004c192018-01-08 16:59:14 +01003235 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ),
3236 md_alg, hash, hashlen,
3237 ssl->out_msg + ssl->out_msglen + 2,
Gilles Peskinef00f1522021-06-22 00:09:00 +02003238 out_buf_len - ssl->out_msglen - 2,
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003239 signature_len,
Gilles Peskine1004c192018-01-08 16:59:14 +01003240 ssl->conf->f_rng,
3241 ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003242 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003243 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02003244 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003245 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003246 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003247#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00003248
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003249 return( 0 );
3250}
Paul Bakker1ef83d62012-04-11 12:09:53 +00003251
Gilles Peskined3eb0612018-01-08 17:07:44 +01003252/* Prepare the ServerKeyExchange message and send it. For ciphersuites
Gilles Peskine168dae82018-04-25 23:35:42 +02003253 * that do not include a ServerKeyExchange message, do nothing. Either
3254 * way, if successful, move on to the next step in the SSL state
3255 * machine. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003256static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
3257{
Janos Follath865b3eb2019-12-16 11:46:15 +00003258 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003259 size_t signature_len = 0;
Gilles Peskineeccd8882020-03-10 12:19:08 +01003260#if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003261 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00003262 ssl->handshake->ciphersuite_info;
Gilles Peskineeccd8882020-03-10 12:19:08 +01003263#endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003264
Gilles Peskined3eb0612018-01-08 17:07:44 +01003265 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
3266
Gilles Peskineeccd8882020-03-10 12:19:08 +01003267#if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
Gilles Peskined3eb0612018-01-08 17:07:44 +01003268 /* Extract static ECDH parameters and abort if ServerKeyExchange
3269 * is not needed. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003270 if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
3271 {
3272 /* For suites involving ECDH, extract DH parameters
3273 * from certificate at this point. */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003274#if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED)
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003275 if( mbedtls_ssl_ciphersuite_uses_ecdh( ciphersuite_info ) )
3276 {
3277 ssl_get_ecdh_params_from_cert( ssl );
3278 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003279#endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003280
3281 /* Key exchanges not involving ephemeral keys don't use
3282 * ServerKeyExchange, so end here. */
3283 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
3284 ssl->state++;
3285 return( 0 );
3286 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003287#endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003288
Gilles Peskineeccd8882020-03-10 12:19:08 +01003289#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003290 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskined3eb0612018-01-08 17:07:44 +01003291 /* If we have already prepared the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003292 * signature operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003293 if( ssl->handshake->async_in_progress != 0 )
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003294 {
3295 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming signature operation" ) );
3296 ret = ssl_resume_server_key_exchange( ssl, &signature_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003297 }
3298 else
Gilles Peskineeccd8882020-03-10 12:19:08 +01003299#endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003300 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003301 {
3302 /* ServerKeyExchange is needed. Prepare the message. */
3303 ret = ssl_prepare_server_key_exchange( ssl, &signature_len );
Gilles Peskined3eb0612018-01-08 17:07:44 +01003304 }
3305
3306 if( ret != 0 )
3307 {
Gilles Peskinead28bf02018-04-26 00:19:16 +02003308 /* If we're starting to write a new message, set ssl->out_msglen
3309 * to 0. But if we're resuming after an asynchronous message,
3310 * out_msglen is the amount of data written so far and mst be
3311 * preserved. */
Gilles Peskined3eb0612018-01-08 17:07:44 +01003312 if( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3313 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange (pending)" ) );
3314 else
3315 ssl->out_msglen = 0;
3316 return( ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003317 }
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003318
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003319 /* If there is a signature, write its length.
Gilles Peskine168dae82018-04-25 23:35:42 +02003320 * ssl_prepare_server_key_exchange already wrote the signature
3321 * itself at its proper place in the output buffer. */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003322#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003323 if( signature_len != 0 )
3324 {
3325 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len >> 8 );
3326 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len );
3327
3328 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature",
3329 ssl->out_msg + ssl->out_msglen,
3330 signature_len );
3331
3332 /* Skip over the already-written signature */
3333 ssl->out_msglen += signature_len;
3334 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003335#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003336
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003337 /* Add header and send. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003338 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3339 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003340
3341 ssl->state++;
3342
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003343 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003344 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003345 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003346 return( ret );
3347 }
3348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003349 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003350 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003351}
3352
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003353static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003354{
Janos Follath865b3eb2019-12-16 11:46:15 +00003355 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003357 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003358
3359 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003360 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3361 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003362
3363 ssl->state++;
3364
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003365#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003366 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003367 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003368#endif
3369
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003370 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003371 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003372 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003373 return( ret );
3374 }
3375
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003376#if defined(MBEDTLS_SSL_PROTO_DTLS)
3377 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3378 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3379 {
3380 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
3381 return( ret );
3382 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01003383#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003385 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003386
3387 return( 0 );
3388}
3389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003390#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3391 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3392static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003393 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003394{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003395 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003396 size_t n;
3397
3398 /*
3399 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3400 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003401 if( *p + 2 > end )
3402 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003403 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003404 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003405 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02003406
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003407 n = ( (*p)[0] << 8 ) | (*p)[1];
3408 *p += 2;
3409
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003410 if( *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003411 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003412 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003413 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003414 }
3415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003416 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003417 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003418 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
Hanno Beckerb24e74b2021-06-24 09:52:01 +01003419 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003420 }
3421
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003422 *p += n;
3423
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003424 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003425
Paul Bakker70df2fb2013-04-17 17:19:09 +02003426 return( ret );
3427}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003428#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3429 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003430
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003431#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3432 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003433
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003434#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003435static int ssl_resume_decrypt_pms( mbedtls_ssl_context *ssl,
3436 unsigned char *peer_pms,
3437 size_t *peer_pmslen,
3438 size_t peer_pmssize )
3439{
Gilles Peskine8f97af72018-04-26 11:46:10 +02003440 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003441 peer_pms, peer_pmslen, peer_pmssize );
3442 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3443 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003444 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003445 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003446 }
3447 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_decrypt_encrypted_pms", ret );
3448 return( ret );
3449}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003450#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003451
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003452static int ssl_decrypt_encrypted_pms( mbedtls_ssl_context *ssl,
3453 const unsigned char *p,
3454 const unsigned char *end,
3455 unsigned char *peer_pms,
3456 size_t *peer_pmslen,
3457 size_t peer_pmssize )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003458{
Janos Follath865b3eb2019-12-16 11:46:15 +00003459 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine422ccab2018-01-11 18:29:01 +01003460 mbedtls_pk_context *private_key = mbedtls_ssl_own_key( ssl );
3461 mbedtls_pk_context *public_key = &mbedtls_ssl_own_cert( ssl )->pk;
3462 size_t len = mbedtls_pk_get_len( public_key );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003463
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003464#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003465 /* If we have already started decoding the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003466 * decryption operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003467 if( ssl->handshake->async_in_progress != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003468 {
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003469 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming decryption operation" ) );
3470 return( ssl_resume_decrypt_pms( ssl,
3471 peer_pms, peer_pmslen, peer_pmssize ) );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003472 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003473#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003474
3475 /*
Gilles Peskine422ccab2018-01-11 18:29:01 +01003476 * Prepare to decrypt the premaster using own private RSA key
Paul Bakker70df2fb2013-04-17 17:19:09 +02003477 */
TRodziewicz0f82ec62021-05-12 17:49:18 +02003478#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01003479 if ( p + 2 > end ) {
3480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003481 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01003482 }
3483 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
3484 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003485 {
Mateusz Starzyk06b07fb2021-02-18 13:55:21 +01003486 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003487 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003488 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003489#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003490
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003491 if( p + len != end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003492 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003493 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003494 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003495 }
3496
Gilles Peskine422ccab2018-01-11 18:29:01 +01003497 /*
3498 * Decrypt the premaster secret
3499 */
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003500#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003501 if( ssl->conf->f_async_decrypt_start != NULL )
3502 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003503 ret = ssl->conf->f_async_decrypt_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003504 mbedtls_ssl_own_cert( ssl ),
3505 p, len );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003506 switch( ret )
3507 {
3508 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3509 /* act as if f_async_decrypt_start was null */
3510 break;
3511 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003512 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003513 return( ssl_resume_decrypt_pms( ssl,
3514 peer_pms,
3515 peer_pmslen,
3516 peer_pmssize ) );
3517 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003518 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003519 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3520 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003521 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_decrypt_start", ret );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003522 return( ret );
3523 }
3524 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003525#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003526
Gilles Peskine422ccab2018-01-11 18:29:01 +01003527 if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_RSA ) )
3528 {
Gilles Peskine422ccab2018-01-11 18:29:01 +01003529 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
3530 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3531 }
3532
3533 ret = mbedtls_pk_decrypt( private_key, p, len,
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003534 peer_pms, peer_pmslen, peer_pmssize,
3535 ssl->conf->f_rng, ssl->conf->p_rng );
3536 return( ret );
3537}
3538
3539static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
3540 const unsigned char *p,
3541 const unsigned char *end,
3542 size_t pms_offset )
3543{
Janos Follath865b3eb2019-12-16 11:46:15 +00003544 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003545 unsigned char *pms = ssl->handshake->premaster + pms_offset;
3546 unsigned char ver[2];
3547 unsigned char fake_pms[48], peer_pms[48];
3548 unsigned char mask;
3549 size_t i, peer_pmslen;
3550 unsigned int diff;
3551
Gilles Peskine0a8352b2018-06-13 18:16:41 +02003552 /* In case of a failure in decryption, the decryption may write less than
3553 * 2 bytes of output, but we always read the first two bytes. It doesn't
3554 * matter in the end because diff will be nonzero in that case due to
André Maroneze79533292020-11-12 09:37:42 +01003555 * ret being nonzero, and we only care whether diff is 0.
3556 * But do initialize peer_pms and peer_pmslen for robustness anyway. This
3557 * also makes memory analyzers happy (don't access uninitialized memory,
3558 * even if it's an unsigned char). */
Gilles Peskine0a8352b2018-06-13 18:16:41 +02003559 peer_pms[0] = peer_pms[1] = ~0;
André Maroneze79533292020-11-12 09:37:42 +01003560 peer_pmslen = 0;
Gilles Peskine0a8352b2018-06-13 18:16:41 +02003561
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003562 ret = ssl_decrypt_encrypted_pms( ssl, p, end,
3563 peer_pms,
3564 &peer_pmslen,
3565 sizeof( peer_pms ) );
3566
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003567#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003568 if ( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3569 return( ret );
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003570#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003572 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Gilles Peskine2e333372018-04-24 13:22:10 +02003573 ssl->handshake->max_minor_ver,
3574 ssl->conf->transport, ver );
3575
3576 /* Avoid data-dependent branches while checking for invalid
3577 * padding, to protect against timing-based Bleichenbacher-type
3578 * attacks. */
3579 diff = (unsigned int) ret;
3580 diff |= peer_pmslen ^ 48;
3581 diff |= peer_pms[0] ^ ver[0];
3582 diff |= peer_pms[1] ^ ver[1];
3583
3584 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
gabor-mezei-arm9cb55692021-08-11 15:07:02 +02003585 mask = mbedtls_cf_uint_mask( diff );
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003586
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003587 /*
3588 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3589 * must not cause the connection to end immediately; instead, send a
3590 * bad_record_mac later in the handshake.
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003591 * To protect against timing-based variants of the attack, we must
3592 * not have any branch that depends on whether the decryption was
3593 * successful. In particular, always generate the fake premaster secret,
3594 * regardless of whether it will ultimately influence the output or not.
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003595 */
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003596 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003597 if( ret != 0 )
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003598 {
Gilles Peskinee1416382018-04-26 10:23:21 +02003599 /* It's ok to abort on an RNG failure, since this does not reveal
3600 * anything about the RSA decryption. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003601 return( ret );
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003602 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003603
Manuel Pégourié-Gonnard331ba572015-04-20 12:33:57 +01003604#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003605 if( diff != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003606 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003607#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003608
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003609 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
3610 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
3611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003612 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3613 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003614 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003615 ssl->handshake->pmslen = 48;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003616
Gilles Peskine422ccab2018-01-11 18:29:01 +01003617 /* Set pms to either the true or the fake PMS, without
3618 * data-dependent branches. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003619 for( i = 0; i < ssl->handshake->pmslen; i++ )
3620 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
3621
3622 return( 0 );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003623}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003624#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3625 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003626
Gilles Peskineeccd8882020-03-10 12:19:08 +01003627#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003628static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003629 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003630{
Paul Bakker6db455e2013-09-18 17:29:31 +02003631 int ret = 0;
irwir6527bd62019-09-21 18:51:25 +03003632 uint16_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003633
Hanno Becker845b9462018-10-26 12:07:29 +01003634 if( ssl_conf_has_psk_or_cb( ssl->conf ) == 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003635 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003636 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
3637 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003638 }
3639
3640 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003641 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02003642 */
Hanno Becker83c9f492017-06-26 13:52:14 +01003643 if( end - *p < 2 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003644 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003645 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003646 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003647 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003648
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003649 n = ( (*p)[0] << 8 ) | (*p)[1];
3650 *p += 2;
3651
irwir6527bd62019-09-21 18:51:25 +03003652 if( n == 0 || n > end - *p )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003653 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003654 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003655 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003656 }
3657
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003658 if( ssl->conf->f_psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02003659 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003660 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003661 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003662 }
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003663 else
Paul Bakker6db455e2013-09-18 17:29:31 +02003664 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01003665 /* Identity is not a big secret since clients send it in the clear,
3666 * but treat it carefully anyway, just in case */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003667 if( n != ssl->conf->psk_identity_len ||
gabor-mezei-arm46025642021-07-19 15:19:19 +02003668 mbedtls_cf_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003669 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003670 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003671 }
3672 }
3673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003674 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003675 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003676 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Gilles Peskinec94f7352017-05-10 16:37:56 +02003677 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3678 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003679 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003680 }
3681
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003682 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003683
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003684 return( 0 );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003685}
Gilles Peskineeccd8882020-03-10 12:19:08 +01003686#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02003687
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003688static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003689{
Janos Follath865b3eb2019-12-16 11:46:15 +00003690 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003691 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003692 unsigned char *p, *end;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003693
Hanno Beckere694c3e2017-12-27 21:34:08 +00003694 ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003695
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003696 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003697
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003698#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003699 ( defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3700 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) )
3701 if( ( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3702 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) &&
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003703 ( ssl->handshake->async_in_progress != 0 ) )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003704 {
3705 /* We've already read a record and there is an asynchronous
3706 * operation in progress to decrypt it. So skip reading the
Gilles Peskine168dae82018-04-25 23:35:42 +02003707 * record. */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003708 MBEDTLS_SSL_DEBUG_MSG( 3, ( "will resume decryption of previously-read record" ) );
3709 }
3710 else
3711#endif
Hanno Becker327c93b2018-08-15 13:56:18 +01003712 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003713 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003714 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003715 return( ret );
3716 }
3717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003718 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003719 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnardf8995832014-09-10 08:25:12 +00003720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003721 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003722 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003724 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003725 }
3726
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003727 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003728 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003729 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003730 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003731 }
3732
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003733#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3734 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003735 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003736 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003737 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003738 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003739 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003740 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003741
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003742 if( p != end )
3743 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003744 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003745 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003746 }
3747
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003748 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003749 ssl->handshake->premaster,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01003750 MBEDTLS_PREMASTER_SIZE,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02003751 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003752 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003753 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003754 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Hanno Beckerd3eec782021-06-24 10:21:46 +01003755 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003756 }
3757
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003758 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003759 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003760 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003761#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3762#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3763 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3764 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3765 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3766 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3767 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3768 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3769 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003770 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003771 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003772 p, end - p) ) != 0 )
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003773 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003774 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
Hanno Beckerb24e74b2021-06-24 09:52:01 +01003775 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003776 }
3777
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003778 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3779 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003781 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003782 &ssl->handshake->pmslen,
3783 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003784 MBEDTLS_MPI_MAX_SIZE,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003785 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003786 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003787 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Hanno Beckerd3eec782021-06-24 10:21:46 +01003788 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003789 }
3790
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003791 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3792 MBEDTLS_DEBUG_ECDH_Z );
Paul Bakker5121ce52009-01-03 21:22:43 +00003793 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003794 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003795#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3796 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3797 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3798 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3799#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3800 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003801 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003802 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003803 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003804 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003805 return( ret );
3806 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003807
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003808 if( p != end )
3809 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003810 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003811 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003812 }
3813
Hanno Becker845b9462018-10-26 12:07:29 +01003814#if defined(MBEDTLS_USE_PSA_CRYPTO)
3815 /* For opaque PSKs, we perform the PSK-to-MS derivation atomatically
3816 * and skip the intermediate PMS. */
Hanno Beckerc1385c12018-11-05 12:44:27 +00003817 if( ssl_use_opaque_psk( ssl ) == 1 )
Hanno Becker845b9462018-10-26 12:07:29 +01003818 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skip PMS generation for opaque PSK" ) );
3819 else
3820#endif /* MBEDTLS_USE_PSA_CRYPTO */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003821 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003822 ciphersuite_info->key_exchange ) ) != 0 )
3823 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003824 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003825 return( ret );
3826 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003827 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003828 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003829#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
3830#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3831 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003832 {
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003833#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003834 if ( ssl->handshake->async_in_progress != 0 )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003835 {
3836 /* There is an asynchronous operation in progress to
3837 * decrypt the encrypted premaster secret, so skip
3838 * directly to resuming this operation. */
3839 MBEDTLS_SSL_DEBUG_MSG( 3, ( "PSK identity already parsed" ) );
3840 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms
3841 * won't actually use it, but maintain p anyway for robustness. */
3842 p += ssl->conf->psk_identity_len + 2;
3843 }
3844 else
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003845#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003846 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3847 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003848 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003849 return( ret );
3850 }
3851
Hanno Becker845b9462018-10-26 12:07:29 +01003852#if defined(MBEDTLS_USE_PSA_CRYPTO)
3853 /* Opaque PSKs are currently only supported for PSK-only. */
3854 if( ssl_use_opaque_psk( ssl ) == 1 )
3855 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3856#endif
3857
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003858 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
3859 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003860 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003861 return( ret );
3862 }
3863
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003864 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003865 ciphersuite_info->key_exchange ) ) != 0 )
3866 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003867 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003868 return( ret );
3869 }
3870 }
3871 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003872#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3873#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3874 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003875 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003876 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3877 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003878 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003879 return( ret );
3880 }
3881 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
3882 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003883 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003884 return( ret );
3885 }
3886
Hanno Becker845b9462018-10-26 12:07:29 +01003887#if defined(MBEDTLS_USE_PSA_CRYPTO)
3888 /* Opaque PSKs are currently only supported for PSK-only. */
3889 if( ssl_use_opaque_psk( ssl ) == 1 )
3890 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3891#endif
3892
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003893 if( p != end )
3894 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003895 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
Hanno Becker666b5b42021-06-24 10:13:31 +01003896 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003897 }
3898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003899 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003900 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003901 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003902 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003903 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003904 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003905 }
3906 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003907#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3908#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3909 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003910 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003911 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003914 return( ret );
3915 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003916
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003917 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003918 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003919 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003920 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
Hanno Beckerb24e74b2021-06-24 09:52:01 +01003921 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003922 }
3923
Hanno Becker845b9462018-10-26 12:07:29 +01003924#if defined(MBEDTLS_USE_PSA_CRYPTO)
3925 /* Opaque PSKs are currently only supported for PSK-only. */
3926 if( ssl_use_opaque_psk( ssl ) == 1 )
3927 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3928#endif
3929
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003930 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3931 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003933 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003934 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003935 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003936 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003937 return( ret );
3938 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003939 }
3940 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003941#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
3942#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3943 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01003944 {
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003945 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003946 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003947 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003948 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003949 }
3950 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003951 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003952#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003953#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3954 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3955 {
3956 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
3957 p, end - p );
3958 if( ret != 0 )
3959 {
3960 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
Hanno Beckercbc8f6f2021-06-24 10:32:31 +01003961 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003962 }
3963
3964 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
3965 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
3966 ssl->conf->f_rng, ssl->conf->p_rng );
3967 if( ret != 0 )
3968 {
3969 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
3970 return( ret );
3971 }
3972 }
3973 else
3974#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003975 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003976 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3977 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003978 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003979
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003980 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00003981 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003982 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00003983 return( ret );
3984 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003985
Paul Bakker5121ce52009-01-03 21:22:43 +00003986 ssl->state++;
3987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003988 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003989
3990 return( 0 );
3991}
3992
Gilles Peskineeccd8882020-03-10 12:19:08 +01003993#if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003994static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003995{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003996 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00003997 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003999 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004000
Hanno Becker77adddc2019-02-07 12:32:43 +00004001 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakkered27a042013-04-18 22:46:23 +02004002 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004003 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02004004 ssl->state++;
4005 return( 0 );
4006 }
4007
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004008 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4009 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004010}
Gilles Peskineeccd8882020-03-10 12:19:08 +01004011#else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004012static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004013{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004014 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004015 size_t i, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004016 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004017 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004018 size_t hashlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004019#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4020 mbedtls_pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02004021#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004022 mbedtls_md_type_t md_alg;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004023 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00004024 ssl->handshake->ciphersuite_info;
Hanno Beckera1ab9be2019-02-06 18:31:04 +00004025 mbedtls_pk_context * peer_pk;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004026
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004027 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004028
Hanno Becker2a831a42019-02-07 13:17:25 +00004029 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004030 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004031 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004032 ssl->state++;
4033 return( 0 );
4034 }
4035
Hanno Becker2a831a42019-02-07 13:17:25 +00004036#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4037 if( ssl->session_negotiate->peer_cert == NULL )
4038 {
4039 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
4040 ssl->state++;
4041 return( 0 );
4042 }
4043#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4044 if( ssl->session_negotiate->peer_cert_digest == NULL )
4045 {
4046 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
4047 ssl->state++;
4048 return( 0 );
4049 }
4050#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4051
Simon Butcher99000142016-10-13 17:21:01 +01004052 /* Read the message without adding it to the checksum */
Hanno Becker327c93b2018-08-15 13:56:18 +01004053 ret = mbedtls_ssl_read_record( ssl, 0 /* no checksum update */ );
Simon Butcher99000142016-10-13 17:21:01 +01004054 if( 0 != ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00004055 {
Hanno Becker327c93b2018-08-15 13:56:18 +01004056 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004057 return( ret );
4058 }
4059
4060 ssl->state++;
4061
Simon Butcher99000142016-10-13 17:21:01 +01004062 /* Process the message contents */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004063 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
4064 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00004065 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004066 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004067 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00004068 }
4069
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004070 i = mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004071
Hanno Beckera1ab9be2019-02-06 18:31:04 +00004072#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4073 peer_pk = &ssl->handshake->peer_pubkey;
4074#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4075 if( ssl->session_negotiate->peer_cert == NULL )
4076 {
4077 /* Should never happen */
4078 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4079 }
4080 peer_pk = &ssl->session_negotiate->peer_cert->pk;
4081#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4082
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004083 /*
4084 * struct {
4085 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
4086 * opaque signature<0..2^16-1>;
4087 * } DigitallySigned;
4088 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004089#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4090 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004091 {
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004092 if( i + 2 > ssl->in_hslen )
4093 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004094 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004095 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004096 }
4097
Paul Bakker5121ce52009-01-03 21:22:43 +00004098 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004099 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00004100 */
Simon Butcher99000142016-10-13 17:21:01 +01004101 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] );
4102
4103 if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004104 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004105 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004106 " for verify message" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004107 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Paul Bakker5121ce52009-01-03 21:22:43 +00004108 }
4109
Simon Butcher99000142016-10-13 17:21:01 +01004110#if !defined(MBEDTLS_MD_SHA1)
4111 if( MBEDTLS_MD_SHA1 == md_alg )
4112 hash_start += 16;
4113#endif
Paul Bakker926af752012-11-23 13:38:07 +01004114
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02004115 /* Info from md_alg will be used instead */
4116 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004117
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004118 i++;
4119
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004120 /*
4121 * Signature
4122 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004123 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
4124 == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004125 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004126 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004127 " for verify message" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004128 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004129 }
4130
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004131 /*
4132 * Check the certificate's key type matches the signature alg
4133 */
Hanno Beckera1ab9be2019-02-06 18:31:04 +00004134 if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004137 return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004138 }
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004139
4140 i++;
Paul Bakker577e0062013-08-28 11:57:20 +02004141 }
4142 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004143#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02004144 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4146 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004147 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02004148
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004149 if( i + 2 > ssl->in_hslen )
4150 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004151 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004152 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004153 }
4154
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004155 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
4156 i += 2;
Paul Bakker926af752012-11-23 13:38:07 +01004157
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004158 if( i + sig_len != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00004159 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerd934a2a2021-06-24 10:23:45 +01004161 return( MBEDTLS_ERR_SSL_DECODE_ERROR );
Paul Bakker5121ce52009-01-03 21:22:43 +00004162 }
4163
Simon Butcher99000142016-10-13 17:21:01 +01004164 /* Calculate hash and verify signature */
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02004165 {
4166 size_t dummy_hlen;
4167 ssl->handshake->calc_verify( ssl, hash, &dummy_hlen );
4168 }
Simon Butcher99000142016-10-13 17:21:01 +01004169
Hanno Beckera1ab9be2019-02-06 18:31:04 +00004170 if( ( ret = mbedtls_pk_verify( peer_pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004171 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004172 ssl->in_msg + i, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004173 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004174 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004175 return( ret );
4176 }
4177
Simon Butcher99000142016-10-13 17:21:01 +01004178 mbedtls_ssl_update_handshake_status( ssl );
4179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004180 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004181
Paul Bakkered27a042013-04-18 22:46:23 +02004182 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004183}
Gilles Peskineeccd8882020-03-10 12:19:08 +01004184#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00004185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004186#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4187static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004188{
Janos Follath865b3eb2019-12-16 11:46:15 +00004189 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004190 size_t tlen;
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004191 uint32_t lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004193 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004194
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004195 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4196 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004197
4198 /*
4199 * struct {
4200 * uint32 ticket_lifetime_hint;
4201 * opaque ticket<0..2^16-1>;
4202 * } NewSessionTicket;
4203 *
4204 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
4205 * 8 . 9 ticket_len (n)
4206 * 10 . 9+n ticket content
4207 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02004208
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004209 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +02004210 ssl->session_negotiate,
4211 ssl->out_msg + 10,
Angus Grattond8213d02016-05-25 20:56:48 +10004212 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004213 &tlen, &lifetime ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004214 {
Manuel Pégourié-Gonnarda4a47352015-05-15 15:14:54 +02004215 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004216 tlen = 0;
4217 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004218
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004219 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
4220 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
4221 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
4222 ssl->out_msg[7] = ( lifetime ) & 0xFF;
4223
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004224 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
4225 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004226
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004227 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004228
Manuel Pégourié-Gonnard145dfcb2014-02-26 14:23:33 +01004229 /*
4230 * Morally equivalent to updating ssl->state, but NewSessionTicket and
4231 * ChangeCipherSpec share the same state.
4232 */
4233 ssl->handshake->new_session_ticket = 0;
4234
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004235 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004236 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004237 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004238 return( ret );
4239 }
4240
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004241 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004242
4243 return( 0 );
4244}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004245#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004246
Paul Bakker5121ce52009-01-03 21:22:43 +00004247/*
Paul Bakker1961b702013-01-25 14:49:24 +01004248 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00004249 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004250int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004251{
4252 int ret = 0;
4253
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02004254 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004255 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004257 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01004258
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004259 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01004260 return( ret );
4261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004262#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004263 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004264 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004265 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004266 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004267 return( ret );
4268 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01004269#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004270
Paul Bakker1961b702013-01-25 14:49:24 +01004271 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00004272 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004273 case MBEDTLS_SSL_HELLO_REQUEST:
4274 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00004275 break;
4276
Paul Bakker1961b702013-01-25 14:49:24 +01004277 /*
4278 * <== ClientHello
4279 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004280 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004281 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004282 break;
Paul Bakker1961b702013-01-25 14:49:24 +01004283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004284#if defined(MBEDTLS_SSL_PROTO_DTLS)
4285 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
4286 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02004287#endif
4288
Paul Bakker1961b702013-01-25 14:49:24 +01004289 /*
4290 * ==> ServerHello
4291 * Certificate
4292 * ( ServerKeyExchange )
4293 * ( CertificateRequest )
4294 * ServerHelloDone
4295 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004296 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004297 ret = ssl_write_server_hello( ssl );
4298 break;
4299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004300 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4301 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004302 break;
4303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004304 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004305 ret = ssl_write_server_key_exchange( ssl );
4306 break;
4307
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004308 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01004309 ret = ssl_write_certificate_request( ssl );
4310 break;
4311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004312 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01004313 ret = ssl_write_server_hello_done( ssl );
4314 break;
4315
4316 /*
4317 * <== ( Certificate/Alert )
4318 * ClientKeyExchange
4319 * ( CertificateVerify )
4320 * ChangeCipherSpec
4321 * Finished
4322 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004323 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4324 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004325 break;
4326
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004327 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004328 ret = ssl_parse_client_key_exchange( ssl );
4329 break;
4330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004331 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01004332 ret = ssl_parse_certificate_verify( ssl );
4333 break;
4334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004335 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4336 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004337 break;
4338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004339 case MBEDTLS_SSL_CLIENT_FINISHED:
4340 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004341 break;
4342
4343 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004344 * ==> ( NewSessionTicket )
4345 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01004346 * Finished
4347 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004348 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4349#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02004350 if( ssl->handshake->new_session_ticket != 0 )
4351 ret = ssl_write_new_session_ticket( ssl );
4352 else
Paul Bakkera503a632013-08-14 13:48:06 +02004353#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004354 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004355 break;
4356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004357 case MBEDTLS_SSL_SERVER_FINISHED:
4358 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004359 break;
4360
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004361 case MBEDTLS_SSL_FLUSH_BUFFERS:
4362 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
4363 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01004364 break;
4365
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004366 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4367 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004368 break;
4369
4370 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004371 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
4372 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004373 }
4374
Paul Bakker5121ce52009-01-03 21:22:43 +00004375 return( ret );
4376}
TRodziewicz8476f2f2021-06-02 14:34:47 +02004377
TRodziewicz3946f792021-06-14 12:11:18 +02004378void mbedtls_ssl_conf_preference_order( mbedtls_ssl_config *conf, int order )
TRodziewicz8476f2f2021-06-02 14:34:47 +02004379{
TRodziewicz3946f792021-06-14 12:11:18 +02004380 conf->respect_cli_pref = order;
TRodziewicz8476f2f2021-06-02 14:34:47 +02004381}
4382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004383#endif /* MBEDTLS_SSL_SRV_C */