Jerry Yu | 3cc4c2a | 2021-08-06 16:29:08 +0800 | [diff] [blame] | 1 | /* |
Jerry Yu | b9930e7 | 2021-08-06 17:11:51 +0800 | [diff] [blame] | 2 | * TLS 1.3 server-side functions |
Jerry Yu | 3cc4c2a | 2021-08-06 16:29:08 +0800 | [diff] [blame] | 3 | * |
| 4 | * Copyright The Mbed TLS Contributors |
| 5 | * SPDX-License-Identifier: Apache-2.0 |
| 6 | * |
| 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | * not use this file except in compliance with the License. |
| 9 | * You may obtain a copy of the License at |
| 10 | * |
| 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | * |
| 13 | * Unless required by applicable law or agreed to in writing, software |
| 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | * See the License for the specific language governing permissions and |
| 17 | * limitations under the License. |
| 18 | */ |
| 19 | |
| 20 | #include "common.h" |
| 21 | |
Jerry Yu | fb4b647 | 2022-01-27 15:03:26 +0800 | [diff] [blame] | 22 | #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) |
Jerry Yu | 3cc4c2a | 2021-08-06 16:29:08 +0800 | [diff] [blame] | 23 | |
Jerry Yu | 687101b | 2021-09-14 16:03:56 +0800 | [diff] [blame] | 24 | #include "mbedtls/debug.h" |
| 25 | |
Jerry Yu | 3cc4c2a | 2021-08-06 16:29:08 +0800 | [diff] [blame] | 26 | #include "ssl_misc.h" |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 27 | #include "ssl_tls13_keys.h" |
Gilles Peskine | 923d5c9 | 2021-12-15 12:56:54 +0100 | [diff] [blame] | 28 | #include "ssl_debug_helpers.h" |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 29 | #include <string.h> |
| 30 | #if defined(MBEDTLS_ECP_C) |
| 31 | #include "mbedtls/ecp.h" |
| 32 | #include "ecp_internal.h" |
| 33 | #endif /* MBEDTLS_ECP_C */ |
Jerry Yu | 3cc4c2a | 2021-08-06 16:29:08 +0800 | [diff] [blame] | 34 | |
XiaokangQian | a9c5841 | 2022-02-17 09:41:26 +0000 | [diff] [blame^] | 35 | #if defined(MBEDTLS_PLATFORM_C) |
| 36 | #include "mbedtls/platform.h" |
| 37 | #else |
| 38 | #include <stdlib.h> |
| 39 | #define mbedtls_calloc calloc |
| 40 | #define mbedtls_free free |
| 41 | #endif /* MBEDTLS_PLATFORM_C */ |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 42 | |
| 43 | /* From RFC 8446: |
| 44 | * struct { |
| 45 | * select (Handshake.msg_type) { |
| 46 | * case client_hello: |
| 47 | * ProtocolVersion versions<2..254>; |
| 48 | * case server_hello: // and HelloRetryRequest |
| 49 | * ProtocolVersion selected_version; |
| 50 | * }; |
| 51 | * } SupportedVersions; |
| 52 | */ |
| 53 | static int ssl_tls13_parse_supported_versions_ext( mbedtls_ssl_context *ssl, |
| 54 | const unsigned char *buf, |
| 55 | const unsigned char *end ) |
| 56 | { |
| 57 | size_t list_len; |
| 58 | int tls13_supported = 0; |
| 59 | int major_ver, minor_ver; |
| 60 | const unsigned char *p = buf; |
| 61 | const unsigned char *version_end; |
| 62 | |
| 63 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 1 ); |
| 64 | |
| 65 | list_len = p[0]; |
| 66 | p += 1; |
| 67 | |
| 68 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, list_len ); |
| 69 | if( list_len % 2 != 0 ) |
| 70 | { |
| 71 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Invalid supported version list length %" MBEDTLS_PRINTF_SIZET, |
| 72 | list_len ) ); |
| 73 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 74 | } |
| 75 | |
| 76 | version_end = p + list_len; |
| 77 | while( p < version_end ) |
| 78 | { |
| 79 | mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p ); |
| 80 | |
| 81 | /* In this implementation we only support TLS 1.3 and DTLS 1.3. */ |
| 82 | if( major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 && |
| 83 | minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 ) |
| 84 | { |
| 85 | tls13_supported = 1; |
| 86 | break; |
| 87 | } |
| 88 | |
| 89 | p += 2; |
| 90 | } |
| 91 | |
| 92 | if( tls13_supported == 0 ) |
| 93 | { |
| 94 | /* When we support runtime negotiation of TLS 1.2 and TLS 1.3, we need |
| 95 | * a graceful fallback to TLS 1.2 in this case. */ |
| 96 | |
| 97 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS 1.3 is not supported by the client" ) ); |
| 98 | |
| 99 | MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION, |
| 100 | MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ); |
| 101 | return( MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ); |
| 102 | } |
| 103 | |
| 104 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Negotiated version. Supported is [%d:%d]", |
| 105 | major_ver, minor_ver ) ); |
| 106 | |
| 107 | ssl->major_ver = major_ver; |
| 108 | ssl->minor_ver = minor_ver; |
| 109 | ssl->handshake->max_major_ver = ssl->major_ver; |
| 110 | ssl->handshake->max_minor_ver = ssl->minor_ver; |
| 111 | return( 0 ); |
| 112 | } |
| 113 | |
| 114 | #if ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) ) |
| 115 | /* This function parses the TLS 1.3 supported_groups extension and |
| 116 | * stores the received groups in ssl->handshake->curves. |
| 117 | * |
| 118 | * From RFC 8446: |
| 119 | * enum { |
| 120 | * ... (0xFFFF) |
| 121 | * } NamedGroup; |
| 122 | * struct { |
| 123 | * NamedGroup named_group_list<2..2^16-1>; |
| 124 | * } NamedGroupList; |
| 125 | */ |
| 126 | static int mbedtls_ssl_tls13_parse_supported_groups_ext( |
| 127 | mbedtls_ssl_context *ssl, |
| 128 | const unsigned char *buf, const unsigned char *end ) |
| 129 | { |
| 130 | |
| 131 | size_t list_size, our_size; |
| 132 | const unsigned char *p = buf; |
| 133 | const mbedtls_ecp_curve_info *curve_info, **curves; |
| 134 | const unsigned char *extentions_end; |
| 135 | |
| 136 | MBEDTLS_SSL_DEBUG_BUF( 3, "supported_groups extension", p, end - buf ); |
| 137 | list_size = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 138 | p += 2; |
| 139 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, list_size ); |
| 140 | if( list_size % 2 != 0 ) |
| 141 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 142 | |
| 143 | /* TODO: At the moment, this can happen when receiving a second |
| 144 | * ClientHello after an HRR. We should properly reset the |
| 145 | * state upon receiving an HRR, in which case we should |
| 146 | * not observe handshake->curves already being allocated. */ |
| 147 | if( ssl->handshake->curves != NULL ) |
| 148 | { |
| 149 | mbedtls_free( ssl->handshake->curves ); |
| 150 | ssl->handshake->curves = NULL; |
| 151 | } |
| 152 | |
| 153 | /* Don't allow our peer to make us allocate too much memory, |
| 154 | * and leave room for a final 0 */ |
| 155 | our_size = list_size / 2 + 1; |
| 156 | if( our_size > MBEDTLS_ECP_DP_MAX ) |
| 157 | our_size = MBEDTLS_ECP_DP_MAX; |
| 158 | |
| 159 | if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL ) |
| 160 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
| 161 | |
| 162 | extentions_end = p + list_size; |
| 163 | ssl->handshake->curves = curves; |
| 164 | |
| 165 | while ( p < extentions_end && our_size > 1 ) |
| 166 | { |
| 167 | uint16_t tls_grp_id = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 168 | curve_info = mbedtls_ecp_curve_info_from_tls_id( tls_grp_id ); |
| 169 | |
| 170 | /* mbedtls_ecp_curve_info_from_tls_id() uses the mbedtls_ecp_curve_info |
| 171 | * data structure (defined in ecp.c), which only includes the list of |
| 172 | * curves implemented. Hence, we only add curves that are also supported |
| 173 | * and implemented by the server. */ |
| 174 | if( curve_info != NULL ) |
| 175 | { |
| 176 | *curves++ = curve_info; |
| 177 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "supported curve: %s", curve_info->name ) ); |
| 178 | our_size--; |
| 179 | } |
| 180 | |
| 181 | p += 2; |
| 182 | } |
| 183 | |
| 184 | return( 0 ); |
| 185 | |
| 186 | } |
| 187 | #endif /* MBEDTLS_ECDH_C || ( MBEDTLS_ECDSA_C */ |
| 188 | |
XiaokangQian | a9c5841 | 2022-02-17 09:41:26 +0000 | [diff] [blame^] | 189 | #if ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) ) |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 190 | /* TODO: Code for MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED missing */ |
| 191 | /* |
| 192 | * ssl_tls13_parse_key_shares_ext() verifies whether the information in the |
| 193 | * extension is correct and stores the provided key shares. Whether this is an |
| 194 | * acceptable key share depends on the selected ciphersuite. |
| 195 | * |
| 196 | * Possible return values are: |
| 197 | * - 0: Successful processing of the client provided key share extension. |
| 198 | * - MBEDTLS_ERR_SSL_HRR_REQUIRED: The key share provided by the client |
| 199 | * does not match a group supported by the server. A HelloRetryRequest will |
| 200 | * be needed. |
| 201 | * - Another negative return value for fatal errors. |
| 202 | */ |
| 203 | |
| 204 | static int ssl_tls13_parse_key_shares_ext( mbedtls_ssl_context *ssl, |
| 205 | const unsigned char *buf, |
| 206 | const unsigned char *end ) |
| 207 | { |
| 208 | int ret = 0; |
| 209 | unsigned char const *p = buf; |
| 210 | unsigned char const *extentions_end; |
| 211 | |
| 212 | size_t total_ext_len, cur_share_len; |
| 213 | int match_found = 0; |
| 214 | |
| 215 | /* From RFC 8446: |
| 216 | * |
| 217 | * struct { |
| 218 | * KeyShareEntry client_shares<0..2^16-1>; |
| 219 | * } KeyShareClientHello; |
| 220 | * |
| 221 | */ |
| 222 | |
| 223 | /* Read total legnth of KeyShareClientHello */ |
| 224 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); |
| 225 | |
| 226 | total_ext_len = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 227 | p += 2; |
| 228 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, total_ext_len ); |
| 229 | |
| 230 | ssl->handshake->offered_group_id = 0; |
| 231 | extentions_end = p + total_ext_len; |
| 232 | |
| 233 | /* We try to find a suitable key share entry and copy it to the |
| 234 | * handshake context. Later, we have to find out whether we can do |
| 235 | * something with the provided key share or whether we have to |
| 236 | * dismiss it and send a HelloRetryRequest message. */ |
| 237 | |
| 238 | for( ; p < extentions_end; p += cur_share_len ) |
| 239 | { |
| 240 | uint16_t their_group; |
| 241 | mbedtls_ecp_group_id their_curve; |
| 242 | mbedtls_ecp_curve_info const *their_curve_info; |
| 243 | unsigned char const *end_of_share; |
| 244 | |
| 245 | /* |
| 246 | * struct { |
| 247 | * NamedGroup group; |
| 248 | * opaque key_exchange<1..2^16-1>; |
| 249 | * } KeyShareEntry; |
| 250 | */ |
| 251 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extentions_end, 4 ); |
| 252 | |
| 253 | their_group = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 254 | p += 2; |
| 255 | |
| 256 | cur_share_len = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 257 | p += 2; |
| 258 | |
| 259 | end_of_share = p + cur_share_len; |
| 260 | |
| 261 | /* Continue parsing even if we have already found a match, |
| 262 | * for input validation purposes. */ |
| 263 | if( match_found == 1 ) |
| 264 | continue; |
| 265 | |
| 266 | /* |
| 267 | * NamedGroup matching |
| 268 | * |
| 269 | * For now, we only support ECDHE groups, but e.g. |
| 270 | * PQC KEMs will need to be added at a later stage. |
| 271 | */ |
| 272 | |
| 273 | /* Type 1: ECDHE shares |
| 274 | * |
| 275 | * - Check if we recognize the group |
| 276 | * - Check if it's supported |
| 277 | */ |
| 278 | |
| 279 | const mbedtls_ecp_curve_info *curve_info; |
| 280 | curve_info = mbedtls_ecp_curve_info_from_tls_id( their_group ); |
| 281 | if( curve_info == NULL ) |
| 282 | return( MBEDTLS_ECP_DP_NONE ); |
| 283 | their_curve = curve_info->grp_id; |
| 284 | if( mbedtls_ssl_check_curve( ssl, their_curve ) != 0 ) |
| 285 | continue; |
| 286 | |
| 287 | /* Type 2..X: Other kinds of shares */ |
| 288 | /* TO BE ADDED */ |
| 289 | |
| 290 | /* Skip if we no match succeeded. */ |
| 291 | if( their_curve == MBEDTLS_ECP_DP_NONE ) |
| 292 | { |
| 293 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "Unrecognized NamedGroup %u", |
| 294 | (unsigned) their_group ) ); |
| 295 | continue; |
| 296 | } |
| 297 | |
| 298 | match_found = 1; |
| 299 | |
| 300 | /* KeyShare parsing |
| 301 | * |
| 302 | * Once we add more key share types, this needs to be a switch |
| 303 | * over the (type of) the named curve */ |
| 304 | |
| 305 | /* Type 1: ECDHE shares |
| 306 | * |
| 307 | * - Setup ECDHE context |
| 308 | * - Import client's public key |
| 309 | * - Apply further curve checks |
| 310 | */ |
| 311 | |
| 312 | their_curve_info = mbedtls_ecp_curve_info_from_grp_id( their_curve ); |
| 313 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", their_curve_info->name ) ); |
| 314 | |
| 315 | ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx, their_curve ); |
| 316 | if( ret != 0 ) |
| 317 | { |
| 318 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_setup()", ret ); |
| 319 | return( ret ); |
| 320 | } |
| 321 | |
| 322 | ret = mbedtls_ecdh_import_public_raw( &ssl->handshake->ecdh_ctx, |
| 323 | p, end_of_share ); |
| 324 | if( ret != 0 ) |
| 325 | { |
| 326 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_import_public_raw()", ret ); |
| 327 | return( ret ); |
| 328 | } |
| 329 | |
| 330 | ssl->handshake->offered_group_id = their_group; |
| 331 | } |
| 332 | |
| 333 | if( match_found == 0 ) |
| 334 | { |
| 335 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching key share" ) ); |
| 336 | return( MBEDTLS_ERR_SSL_HRR_REQUIRED ); |
| 337 | } |
| 338 | return( 0 ); |
| 339 | } |
| 340 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ |
| 341 | |
| 342 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 343 | static int ssl_tls13_parse_cookie_ext( mbedtls_ssl_context *ssl, |
| 344 | const unsigned char *buf, |
| 345 | const unsigned char *end ) |
| 346 | { |
| 347 | int ret = 0; |
| 348 | size_t cookie_len; |
| 349 | unsigned char const *p = buf; |
| 350 | mbedtls_ssl_handshake_params *handshake = ssl->handshake; |
| 351 | |
| 352 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse cookie extension" ) ); |
| 353 | |
| 354 | if( ssl->conf->f_cookie_check != NULL ) |
| 355 | { |
| 356 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); |
| 357 | cookie_len = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 358 | p += 2; |
| 359 | |
| 360 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cookie_len ); |
| 361 | |
| 362 | MBEDTLS_SSL_DEBUG_BUF( 3, "Received cookie", p, cookie_len ); |
| 363 | |
| 364 | if( ssl->conf->f_cookie_check( ssl->conf->p_cookie, |
| 365 | p, cookie_len, ssl->cli_id, |
| 366 | ssl->cli_id_len ) != 0 ) |
| 367 | { |
| 368 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) ); |
| 369 | handshake->verify_cookie_len = 1; |
| 370 | ret = MBEDTLS_ERR_SSL_HRR_REQUIRED; |
| 371 | } |
| 372 | else |
| 373 | { |
| 374 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) ); |
| 375 | handshake->verify_cookie_len = 0; |
| 376 | } |
| 377 | } |
| 378 | else { |
| 379 | /* TBD: Check under what cases this is appropriate */ |
| 380 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) ); |
| 381 | } |
| 382 | |
| 383 | return( ret ); |
| 384 | } |
| 385 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 386 | |
| 387 | /* |
| 388 | * |
| 389 | * STATE HANDLING: ClientHello |
| 390 | * |
| 391 | * There are three possible classes of outcomes when parsing the CH: |
| 392 | * |
| 393 | * 1) The CH was well-formed and matched the server's configuration. |
| 394 | * |
| 395 | * In this case, the server progresses to sending its ServerHello. |
| 396 | * |
| 397 | * 2) The CH was well-formed but didn't match the server's configuration. |
| 398 | * |
| 399 | * For example, the client might not have offered a key share which |
| 400 | * the server supports, or the server might require a cookie. |
| 401 | * |
| 402 | * In this case, the server sends a HelloRetryRequest. |
| 403 | * |
| 404 | * 3) The CH was ill-formed |
| 405 | * |
| 406 | * In this case, we abort the handshake. |
| 407 | * |
| 408 | */ |
| 409 | |
| 410 | /* |
| 411 | * Overview |
| 412 | */ |
| 413 | |
| 414 | /* Main entry point from the state machine; orchestrates the otherfunctions. */ |
| 415 | static int ssl_client_hello_process( mbedtls_ssl_context *ssl ); |
| 416 | |
| 417 | static int ssl_client_hello_parse( mbedtls_ssl_context *ssl, |
| 418 | const unsigned char *buf, |
| 419 | const unsigned char *end ); |
| 420 | |
| 421 | /* Update the handshake state machine */ |
| 422 | /* TODO: At the moment, this doesn't update the state machine - why? */ |
| 423 | static int ssl_client_hello_postprocess( mbedtls_ssl_context *ssl, |
| 424 | int hrr_required ); |
| 425 | |
| 426 | /* |
| 427 | * Implementation |
| 428 | */ |
| 429 | |
| 430 | #define SSL_CLIENT_HELLO_OK 0 |
| 431 | #define SSL_CLIENT_HELLO_HRR_REQUIRED 1 |
| 432 | |
| 433 | static int ssl_client_hello_process( mbedtls_ssl_context *ssl ) |
| 434 | { |
| 435 | |
| 436 | int ret = 0; |
| 437 | int hrr_required = SSL_CLIENT_HELLO_OK; |
| 438 | unsigned char* buf = NULL; |
| 439 | size_t buflen = 0; |
| 440 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) ); |
| 441 | |
| 442 | ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; |
| 443 | MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_tls13_fetch_handshake_msg( |
| 444 | ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, |
| 445 | &buf, &buflen ) ); |
| 446 | |
| 447 | mbedtls_ssl_tls13_add_hs_hdr_to_checksum( ssl, |
| 448 | MBEDTLS_SSL_HS_CLIENT_HELLO, |
| 449 | buflen ); |
| 450 | |
| 451 | MBEDTLS_SSL_PROC_CHK_NEG( ssl_client_hello_parse( ssl, buf, buf + buflen ) ); |
| 452 | hrr_required = ret; |
| 453 | |
| 454 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "postprocess" ) ); |
| 455 | MBEDTLS_SSL_PROC_CHK( ssl_client_hello_postprocess( ssl, hrr_required ) ); |
| 456 | |
| 457 | cleanup: |
| 458 | |
| 459 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) ); |
| 460 | return( ret ); |
| 461 | } |
| 462 | |
| 463 | static void ssl_debug_print_client_hello_exts( mbedtls_ssl_context *ssl ) |
| 464 | { |
| 465 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Extensions:" ) ); |
| 466 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- KEY_SHARE_EXTENSION ( %s )", |
| 467 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_KEY_SHARE ) > 0 ) ? |
| 468 | "TRUE" : "FALSE" ) ); |
| 469 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- PSK_KEY_EXCHANGE_MODES_EXTENSION ( %s )", |
| 470 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PSK_KEY_EXCHANGE_MODES ) > 0 ) ? |
| 471 | "TRUE" : "FALSE" ) ); |
| 472 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- PRE_SHARED_KEY_EXTENSION ( %s )", |
| 473 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_PRE_SHARED_KEY ) > 0 ) ? |
| 474 | "TRUE" : "FALSE" ) ); |
| 475 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SIGNATURE_ALGORITHM_EXTENSION ( %s )", |
| 476 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SIG_ALG ) > 0 ) ? |
| 477 | "TRUE" : "FALSE" ) ); |
| 478 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SUPPORTED_GROUPS_EXTENSION ( %s )", |
| 479 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SUPPORTED_GROUPS ) >0 ) ? |
| 480 | "TRUE" : "FALSE" ) ); |
| 481 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SUPPORTED_VERSION_EXTENSION ( %s )", |
| 482 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS ) > 0 ) ? |
| 483 | "TRUE" : "FALSE" ) ); |
| 484 | #if defined ( MBEDTLS_SSL_SERVER_NAME_INDICATION ) |
| 485 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- SERVERNAME_EXTENSION ( %s )", |
| 486 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_SERVERNAME ) > 0 ) ? |
| 487 | "TRUE" : "FALSE" ) ); |
| 488 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
| 489 | #if defined ( MBEDTLS_SSL_COOKIE_C ) |
| 490 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "- COOKIE_EXTENSION ( %s )", |
| 491 | ( ( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_COOKIE ) >0 ) ? |
| 492 | "TRUE" : "FALSE" ) ); |
| 493 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 494 | } |
| 495 | |
| 496 | static int ssl_client_hello_has_exts( mbedtls_ssl_context *ssl, |
| 497 | int ext_id_mask ) |
| 498 | { |
| 499 | int masked = ssl->handshake->extensions_present & ext_id_mask; |
| 500 | return( masked == ext_id_mask ); |
| 501 | } |
| 502 | |
| 503 | static int ssl_client_hello_has_cert_extensions( mbedtls_ssl_context *ssl ) |
| 504 | { |
| 505 | return( ssl_client_hello_has_exts( ssl, |
| 506 | MBEDTLS_SSL_EXT_SUPPORTED_GROUPS | |
| 507 | MBEDTLS_SSL_EXT_KEY_SHARE | |
| 508 | MBEDTLS_SSL_EXT_SIG_ALG ) ); |
| 509 | } |
| 510 | |
| 511 | static int ssl_check_certificate_key_exchange( mbedtls_ssl_context *ssl ) |
| 512 | { |
| 513 | if( !mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) ) |
| 514 | return( 0 ); |
| 515 | |
| 516 | if( !ssl_client_hello_has_cert_extensions( ssl ) ) |
| 517 | return( 0 ); |
| 518 | |
| 519 | ssl->handshake->tls13_kex_modes = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL; |
| 520 | return( 1 ); |
| 521 | } |
| 522 | |
| 523 | static int ssl_client_hello_parse( mbedtls_ssl_context *ssl, |
| 524 | const unsigned char *buf, |
| 525 | const unsigned char *end ) |
| 526 | { |
| 527 | int ret; |
| 528 | size_t i, j; |
| 529 | size_t comp_len, sess_len; |
| 530 | size_t cipher_suites_len; |
| 531 | size_t ext_len; |
| 532 | const unsigned char *ciph_offset; |
| 533 | const unsigned char *p = buf; |
| 534 | const unsigned char *extensions_end; |
| 535 | |
| 536 | const int* ciphersuites; |
| 537 | const mbedtls_ssl_ciphersuite_t* ciphersuite_info; |
| 538 | |
| 539 | int hrr_required = 0; |
| 540 | |
| 541 | ssl->handshake->extensions_present = MBEDTLS_SSL_EXT_NONE; |
| 542 | |
| 543 | /* |
| 544 | * ClientHello layer: |
| 545 | * 0 . 1 protocol version |
| 546 | * 2 . 33 random bytes ( starting with 4 bytes of Unix time ) |
| 547 | * 34 . 35 session id length ( 1 byte ) |
| 548 | * 35 . 34+x session id |
| 549 | * 35+x . 35+x DTLS only: cookie length ( 1 byte ) |
| 550 | * 36+x . .. DTLS only: cookie |
| 551 | * .. . .. ciphersuite list length ( 2 bytes ) |
| 552 | * .. . .. ciphersuite list |
| 553 | * .. . .. compression alg. list length ( 1 byte ) |
| 554 | * .. . .. compression alg. list |
| 555 | * .. . .. extensions length ( 2 bytes, optional ) |
| 556 | * .. . .. extensions ( optional ) |
| 557 | */ |
| 558 | |
| 559 | /* TBD: Needs to be updated due to mandatory extensions |
| 560 | * Minimal length ( with everything empty and extensions ommitted ) is |
| 561 | * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can |
| 562 | * read at least up to session id length without worrying. |
| 563 | */ |
| 564 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 38 ); |
| 565 | |
| 566 | /* ... |
| 567 | * ProtocolVersion legacy_version = 0x0303; // TLS 1.2 |
| 568 | * ... |
| 569 | * with ProtocolVersion defined as: |
| 570 | * uint16 ProtocolVersion; |
| 571 | */ |
| 572 | if( !( p[0] == MBEDTLS_SSL_MAJOR_VERSION_3 && |
| 573 | p[1] == MBEDTLS_SSL_MINOR_VERSION_3 ) ) |
| 574 | { |
| 575 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Unsupported version of TLS." ) ); |
| 576 | MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION, |
| 577 | MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION ); |
| 578 | ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION; |
| 579 | return ret; |
| 580 | } |
| 581 | p += 2; |
| 582 | |
| 583 | /* |
| 584 | * Save client random |
| 585 | */ |
| 586 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 ); |
| 587 | |
| 588 | memcpy( &ssl->handshake->randbytes[0], p, 32 ); |
| 589 | p += 32; /* skip random bytes */ |
| 590 | |
| 591 | /* |
| 592 | * Parse session ID |
| 593 | */ |
| 594 | sess_len = p[0]; |
| 595 | p++; /* skip session id length */ |
| 596 | |
| 597 | if( sess_len > 32 ) |
| 598 | { |
| 599 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 600 | return( MBEDTLS_ERR_SSL_DECODE_ERROR ); |
| 601 | } |
| 602 | |
| 603 | ssl->session_negotiate->id_len = sess_len; |
| 604 | |
| 605 | /* Note that this field is echoed even if |
| 606 | * the client's value corresponded to a cached pre-TLS 1.3 session |
| 607 | * which the server has chosen not to resume. A client which |
| 608 | * receives a legacy_session_id_echo field that does not match what |
| 609 | * it sent in the ClientHello MUST abort the handshake with an |
| 610 | * "illegal_parameter" alert. |
| 611 | */ |
| 612 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id length ( %" MBEDTLS_PRINTF_SIZET " )", sess_len ) ); |
| 613 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf, sess_len ); |
| 614 | |
| 615 | memcpy( &ssl->session_negotiate->id[0], p, sess_len ); /* write session id */ |
| 616 | p += sess_len; |
| 617 | |
| 618 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); |
| 619 | cipher_suites_len = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 620 | p += 2; |
| 621 | |
| 622 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, cipher_suites_len ); |
| 623 | |
| 624 | /* store pointer to ciphersuite list */ |
| 625 | ciph_offset = p; |
| 626 | |
| 627 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist", |
| 628 | p, cipher_suites_len ); |
| 629 | |
| 630 | /* skip ciphersuites for now */ |
| 631 | p += cipher_suites_len; |
| 632 | |
| 633 | /* |
| 634 | * For TLS 1.3 we are not using compression. |
| 635 | */ |
XiaokangQian | a9c5841 | 2022-02-17 09:41:26 +0000 | [diff] [blame^] | 636 | comp_len = p[0]; |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 637 | p++; |
| 638 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, comp_len ); |
| 639 | |
| 640 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression", |
| 641 | p, comp_len ); |
| 642 | |
| 643 | /* Determine whether we are indeed using null compression */ |
XiaokangQian | a9c5841 | 2022-02-17 09:41:26 +0000 | [diff] [blame^] | 644 | if( ( comp_len != 1 ) && ( p[0] == 0 ) ) |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 645 | { |
| 646 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
| 647 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
| 648 | } |
| 649 | |
| 650 | /* skip compression */ |
| 651 | p++; |
| 652 | |
| 653 | /* |
| 654 | * Check the extension length |
| 655 | */ |
| 656 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 ); |
| 657 | |
| 658 | ext_len = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 659 | p += 2; |
| 660 | extensions_end = p + ext_len; |
| 661 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, ext_len ); |
| 662 | |
| 663 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", p, ext_len ); |
| 664 | |
| 665 | while( p < extensions_end ) |
| 666 | { |
| 667 | unsigned int extension_type; |
| 668 | size_t extension_data_len; |
| 669 | const unsigned char *extension_data_end; |
| 670 | |
| 671 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 4 ); |
| 672 | extension_type = MBEDTLS_GET_UINT16_BE( p, 0 ); |
| 673 | extension_data_len = MBEDTLS_GET_UINT16_BE( p, 2 ); |
| 674 | p += 4; |
| 675 | |
| 676 | MBEDTLS_SSL_CHK_BUF_READ_PTR( p, extensions_end, extension_data_len ); |
| 677 | extension_data_end = p + extension_data_len; |
| 678 | |
| 679 | switch( extension_type ) |
| 680 | { |
| 681 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 682 | case MBEDTLS_TLS_EXT_COOKIE: |
| 683 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found cookie extension" ) ); |
| 684 | |
| 685 | ret = ssl_tls13_parse_cookie_ext( ssl, p, |
| 686 | extension_data_end ); |
| 687 | |
| 688 | /* if cookie verification failed then we return a hello retry |
| 689 | * message, or return success and set cookie extension present |
| 690 | */ |
| 691 | if( ret == MBEDTLS_ERR_SSL_HRR_REQUIRED ) |
| 692 | { |
| 693 | hrr_required = 1; |
| 694 | } |
| 695 | else if( ret == 0 ) |
| 696 | { |
| 697 | ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_COOKIE; |
| 698 | } |
| 699 | break; |
| 700 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 701 | |
| 702 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
| 703 | case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS: |
| 704 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported group extension" ) ); |
| 705 | |
| 706 | /* Supported Groups Extension |
| 707 | * |
| 708 | * When sent by the client, the "supported_groups" extension |
| 709 | * indicates the named groups which the client supports, |
| 710 | * ordered from most preferred to least preferred. |
| 711 | */ |
| 712 | ret = mbedtls_ssl_tls13_parse_supported_groups_ext( ssl, p, |
| 713 | extension_data_end ); |
| 714 | if( ret != 0 ) |
| 715 | { |
| 716 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 717 | "mbedtls_ssl_parse_supported_groups_ext", ret ); |
| 718 | return( ret ); |
| 719 | } |
| 720 | |
| 721 | ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS; |
| 722 | break; |
| 723 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ |
| 724 | |
| 725 | #if ( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) ) |
| 726 | case MBEDTLS_TLS_EXT_KEY_SHARE: |
| 727 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found key share extension" ) ); |
| 728 | |
| 729 | /* |
| 730 | * Key Share Extension |
| 731 | * |
| 732 | * When sent by the client, the "key_share" extension |
| 733 | * contains the endpoint's cryptographic parameters for |
| 734 | * ECDHE/DHE key establishment methods. |
| 735 | */ |
| 736 | ret = ssl_tls13_parse_key_shares_ext( ssl, p, extension_data_end ); |
| 737 | if( ret == MBEDTLS_ERR_SSL_HRR_REQUIRED ) |
| 738 | { |
| 739 | hrr_required = 1; |
| 740 | ret = 0; |
| 741 | } |
| 742 | |
| 743 | if( ret != 0 ) |
| 744 | return( ret ); |
| 745 | |
| 746 | ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_KEY_SHARE; |
| 747 | break; |
| 748 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ |
| 749 | |
| 750 | case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS: |
| 751 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported versions extension" ) ); |
| 752 | |
| 753 | ret = ssl_tls13_parse_supported_versions_ext( |
| 754 | ssl, p, extension_data_end ); |
| 755 | if( ret != 0 ) |
| 756 | { |
| 757 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 758 | ( "ssl_tls13_parse_supported_versions_ext" ), ret ); |
| 759 | return( ret ); |
| 760 | } |
| 761 | ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_VERSIONS; |
| 762 | break; |
| 763 | |
| 764 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
| 765 | case MBEDTLS_TLS_EXT_SIG_ALG: |
| 766 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) ); |
| 767 | |
| 768 | ret = mbedtls_ssl_tls13_parse_sig_alg_ext( ssl, p, |
| 769 | extension_data_end ); |
| 770 | if( ret != 0 ) |
| 771 | { |
| 772 | MBEDTLS_SSL_DEBUG_MSG( 1, |
| 773 | ( "ssl_parse_supported_signature_algorithms_server_ext ( %d )", |
| 774 | ret ) ); |
| 775 | return( ret ); |
| 776 | } |
| 777 | ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SIG_ALG; |
| 778 | break; |
| 779 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
| 780 | |
| 781 | default: |
| 782 | MBEDTLS_SSL_DEBUG_MSG( 3, |
| 783 | ( "unknown extension found: %ud ( ignoring )", |
| 784 | extension_type ) ); |
| 785 | } |
| 786 | |
| 787 | p += extension_data_len; |
| 788 | } |
| 789 | |
| 790 | /* Update checksum with either |
| 791 | * - The entire content of the CH message, if no PSK extension is present |
| 792 | * - The content up to but excluding the PSK extension, if present. |
| 793 | */ |
| 794 | ssl->handshake->update_checksum( ssl, buf, p - buf ); |
| 795 | /* |
| 796 | * Search for a matching ciphersuite |
| 797 | */ |
| 798 | ciphersuites = ssl->conf->ciphersuite_list; |
| 799 | ciphersuite_info = NULL; |
| 800 | for ( j = 0, p = ciph_offset; j < cipher_suites_len; j += 2, p += 2 ) |
| 801 | { |
| 802 | for ( i = 0; ciphersuites[i] != 0; i++ ) |
| 803 | { |
| 804 | if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || |
| 805 | p[1] != ( ( ciphersuites[i] ) & 0xFF ) ) |
| 806 | continue; |
| 807 | |
| 808 | ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( |
| 809 | ciphersuites[i] ); |
| 810 | |
| 811 | if( ciphersuite_info == NULL ) |
| 812 | { |
| 813 | MBEDTLS_SSL_DEBUG_MSG( |
| 814 | 1, |
| 815 | ( "mbedtls_ssl_ciphersuite_from_id: should never happen" ) ); |
| 816 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
| 817 | } |
| 818 | |
| 819 | goto have_ciphersuite; |
| 820 | |
| 821 | } |
| 822 | } |
| 823 | |
| 824 | return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); |
| 825 | |
| 826 | have_ciphersuite: |
| 827 | |
| 828 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", |
| 829 | ciphersuite_info->name ) ); |
| 830 | |
| 831 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
| 832 | ssl->handshake->ciphersuite_info = ciphersuite_info; |
| 833 | |
| 834 | /* List all the extensions we have received */ |
| 835 | ssl_debug_print_client_hello_exts( ssl ); |
| 836 | |
| 837 | /* |
| 838 | * Determine the key exchange algorithm to use. |
| 839 | * There are three types of key exchanges supported in TLS 1.3: |
| 840 | * - (EC)DH with ECDSA, |
| 841 | * - (EC)DH with PSK, |
| 842 | * - plain PSK. |
| 843 | * |
| 844 | * The PSK-based key exchanges may additionally be used with 0-RTT. |
| 845 | * |
| 846 | * Our built-in order of preference is |
| 847 | * 1 ) Plain PSK Mode |
| 848 | * 2 ) (EC)DHE-PSK Mode |
| 849 | * 3 ) Certificate Mode |
| 850 | */ |
| 851 | |
| 852 | if( !ssl_check_certificate_key_exchange( ssl ) ) |
| 853 | { |
| 854 | MBEDTLS_SSL_DEBUG_MSG( |
| 855 | 1, |
| 856 | ( "ClientHello message misses mandatory extensions." ) ); |
| 857 | MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION , |
| 858 | MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
| 859 | return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER ); |
| 860 | } |
| 861 | |
| 862 | #if defined(MBEDTLS_SSL_COOKIE_C) |
| 863 | /* If we failed to see a cookie extension, and we required it through the |
| 864 | * configuration settings ( rr_config ), then we need to send a HRR msg. |
| 865 | * Conceptually, this is similiar to having received a cookie that failed |
| 866 | * the verification check. |
| 867 | */ |
| 868 | if( ( ssl->conf->rr_config == MBEDTLS_SSL_FORCE_RR_CHECK_ON ) && |
| 869 | !( ssl->handshake->extensions_present & MBEDTLS_SSL_EXT_COOKIE ) ) |
| 870 | { |
| 871 | MBEDTLS_SSL_DEBUG_MSG( |
| 872 | 2, |
| 873 | ( "Cookie extension missing. Need to send a HRR." ) ); |
| 874 | hrr_required = 1; |
| 875 | } |
| 876 | #endif /* MBEDTLS_SSL_COOKIE_C */ |
| 877 | |
| 878 | if( hrr_required == 1 ) |
| 879 | return( SSL_CLIENT_HELLO_HRR_REQUIRED ); |
| 880 | |
| 881 | return( 0 ); |
| 882 | } |
| 883 | |
| 884 | static int ssl_client_hello_postprocess( mbedtls_ssl_context* ssl, |
| 885 | int hrr_required ) |
| 886 | { |
| 887 | int ret = 0; |
| 888 | |
| 889 | if( ssl->handshake->hello_retry_request_count == 0 && |
| 890 | ssl->conf->rr_config == MBEDTLS_SSL_FORCE_RR_CHECK_ON ) |
| 891 | { |
| 892 | hrr_required = SSL_CLIENT_HELLO_HRR_REQUIRED; |
| 893 | } |
| 894 | |
| 895 | if( hrr_required == SSL_CLIENT_HELLO_HRR_REQUIRED ) |
| 896 | { |
| 897 | /* |
| 898 | * Create stateless transcript hash for HRR |
| 899 | */ |
| 900 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "Reset transcript for HRR" ) ); |
| 901 | ret = mbedtls_ssl_reset_transcript_for_hrr( ssl ); |
| 902 | if( ret != 0 ) |
| 903 | { |
| 904 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_reset_transcript_for_hrr", |
| 905 | ret ); |
| 906 | return( ret ); |
| 907 | } |
| 908 | mbedtls_ssl_session_reset_msg_layer( ssl, 0 ); |
| 909 | |
| 910 | /* Transmit Hello Retry Request */ |
| 911 | mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST ); |
| 912 | return( 0 ); |
| 913 | } |
| 914 | |
| 915 | ret = mbedtls_ssl_tls13_key_schedule_stage_early( ssl ); |
| 916 | if( ret != 0 ) |
| 917 | { |
| 918 | MBEDTLS_SSL_DEBUG_RET( 1, |
| 919 | "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret ); |
| 920 | return( ret ); |
| 921 | } |
| 922 | |
| 923 | mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO ); |
| 924 | return( 0 ); |
| 925 | |
| 926 | } |
| 927 | |
| 928 | /* |
| 929 | * TLS and DTLS 1.3 State Maschine -- server side |
| 930 | */ |
Jerry Yu | 2756193 | 2021-08-27 17:07:38 +0800 | [diff] [blame] | 931 | int mbedtls_ssl_tls13_handshake_server_step( mbedtls_ssl_context *ssl ) |
Jerry Yu | b9930e7 | 2021-08-06 17:11:51 +0800 | [diff] [blame] | 932 | { |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 933 | int ret = 0; |
| 934 | |
| 935 | if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL ) |
| 936 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| 937 | |
Jerry Yu | e3b3412 | 2021-09-28 17:53:35 +0800 | [diff] [blame] | 938 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "tls13 server state: %s(%d)", |
| 939 | mbedtls_ssl_states_str( ssl->state ), |
| 940 | ssl->state ) ); |
Jerry Yu | 6e81b27 | 2021-09-27 11:16:17 +0800 | [diff] [blame] | 941 | |
XiaokangQian | 7807f9f | 2022-02-15 10:04:37 +0000 | [diff] [blame] | 942 | if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) |
| 943 | return( ret ); |
| 944 | |
| 945 | switch( ssl->state ) |
| 946 | { |
| 947 | /* start state */ |
| 948 | case MBEDTLS_SSL_HELLO_REQUEST: |
| 949 | ssl->handshake->hello_retry_request_count = 0; |
| 950 | mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_HELLO ); |
| 951 | |
| 952 | break; |
| 953 | |
| 954 | /* ----- READ CLIENT HELLO ----*/ |
| 955 | |
| 956 | case MBEDTLS_SSL_CLIENT_HELLO: |
| 957 | |
| 958 | ret = ssl_client_hello_process( ssl ); |
| 959 | if( ret != 0 ) |
| 960 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_client_hello_process", ret ); |
| 961 | |
| 962 | break; |
| 963 | |
| 964 | case MBEDTLS_SSL_HANDSHAKE_WRAPUP: |
| 965 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) ); |
| 966 | |
| 967 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "Switch to application keys for all traffic" ) ); |
| 968 | |
| 969 | mbedtls_ssl_set_inbound_transform ( ssl, ssl->transform_application ); |
| 970 | mbedtls_ssl_set_outbound_transform( ssl, ssl->transform_application ); |
| 971 | |
| 972 | mbedtls_ssl_tls13_handshake_wrapup( ssl ); |
| 973 | mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET ); |
| 974 | |
| 975 | break; |
| 976 | |
| 977 | default: |
| 978 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) ); |
| 979 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
| 980 | } |
| 981 | |
| 982 | return( ret ); |
Jerry Yu | b9930e7 | 2021-08-06 17:11:51 +0800 | [diff] [blame] | 983 | } |
Jerry Yu | 3cc4c2a | 2021-08-06 16:29:08 +0800 | [diff] [blame] | 984 | |
Jerry Yu | fb4b647 | 2022-01-27 15:03:26 +0800 | [diff] [blame] | 985 | #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */ |