blob: 234098a7fb191b047a3760d764219aed1bbb9b45 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 client-side functions
3 *
Bence Szépkúti1e148272020-08-07 13:07:28 +02004 * Copyright The Mbed TLS Contributors
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakker5121ce52009-01-03 21:22:43 +000018 */
19
Gilles Peskinedb09ef62020-06-03 01:43:33 +020020#include "common.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000021
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if defined(MBEDTLS_SSL_CLI_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000023
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020024#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000025#include "mbedtls/platform.h"
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +020026#else
Rich Evans00ab4702015-02-06 13:43:58 +000027#include <stdlib.h>
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020028#define mbedtls_calloc calloc
SimonBd5800b72016-04-26 07:43:27 +010029#define mbedtls_free free
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +020030#endif
31
SimonBd5800b72016-04-26 07:43:27 +010032#include "mbedtls/ssl.h"
33#include "mbedtls/ssl_internal.h"
Janos Follath73c616b2019-12-18 15:07:04 +000034#include "mbedtls/debug.h"
35#include "mbedtls/error.h"
SimonBd5800b72016-04-26 07:43:27 +010036
Hanno Beckerbb89e272019-01-08 12:54:37 +000037#if defined(MBEDTLS_USE_PSA_CRYPTO)
38#include "mbedtls/psa_util.h"
39#endif /* MBEDTLS_USE_PSA_CRYPTO */
40
SimonBd5800b72016-04-26 07:43:27 +010041#include <string.h>
42
Manuel Pégourié-Gonnard93866642015-06-22 19:21:23 +020043#include <stdint.h>
Paul Bakkerfa9b1002013-07-03 15:31:03 +020044
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020045#if defined(MBEDTLS_HAVE_TIME)
Simon Butcherb5b6af22016-07-13 14:46:18 +010046#include "mbedtls/platform_time.h"
Paul Bakkerfa9b1002013-07-03 15:31:03 +020047#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -050050#include "mbedtls/platform_util.h"
Paul Bakker34617722014-06-13 17:20:13 +020051#endif
52
Gilles Peskineeccd8882020-03-10 12:19:08 +010053#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Becker520224e2018-10-26 11:38:07 +010054static int ssl_conf_has_static_psk( mbedtls_ssl_config const *conf )
Hanno Becker2e4f6162018-10-23 11:54:44 +010055{
56 if( conf->psk_identity == NULL ||
57 conf->psk_identity_len == 0 )
58 {
59 return( 0 );
60 }
61
62 if( conf->psk != NULL && conf->psk_len != 0 )
63 return( 1 );
64
65#if defined(MBEDTLS_USE_PSA_CRYPTO)
66 if( conf->psk_opaque != 0 )
67 return( 1 );
68#endif /* MBEDTLS_USE_PSA_CRYPTO */
69
70 return( 0 );
71}
Hanno Beckerdfab8e22018-10-23 11:59:34 +010072
73#if defined(MBEDTLS_USE_PSA_CRYPTO)
Hanno Becker520224e2018-10-26 11:38:07 +010074static int ssl_conf_has_static_raw_psk( mbedtls_ssl_config const *conf )
Hanno Beckerdfab8e22018-10-23 11:59:34 +010075{
76 if( conf->psk_identity == NULL ||
77 conf->psk_identity_len == 0 )
78 {
79 return( 0 );
80 }
81
82 if( conf->psk != NULL && conf->psk_len != 0 )
83 return( 1 );
84
85 return( 0 );
86}
87#endif /* MBEDTLS_USE_PSA_CRYPTO */
88
Gilles Peskineeccd8882020-03-10 12:19:08 +010089#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Hanno Becker2e4f6162018-10-23 11:54:44 +010090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020091#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Hanno Becker261602c2017-04-12 14:54:42 +010092static int ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
93 unsigned char *buf,
94 const unsigned char *end,
95 size_t *olen )
Paul Bakkerd3edc862013-03-20 16:07:17 +010096{
97 unsigned char *p = buf;
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +010098 size_t hostname_len;
Paul Bakkerd3edc862013-03-20 16:07:17 +010099
100 *olen = 0;
101
Paul Bakker66d5d072014-06-17 16:39:18 +0200102 if( ssl->hostname == NULL )
Hanno Becker261602c2017-04-12 14:54:42 +0100103 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100104
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100105 MBEDTLS_SSL_DEBUG_MSG( 3,
106 ( "client hello, adding server name extension: %s",
107 ssl->hostname ) );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100108
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +0100109 hostname_len = strlen( ssl->hostname );
110
Hanno Becker261602c2017-04-12 14:54:42 +0100111 MBEDTLS_SSL_CHK_BUF_PTR( p, end, hostname_len + 9 );
Simon Butchered997662015-09-28 02:14:30 +0100112
Paul Bakkerd3edc862013-03-20 16:07:17 +0100113 /*
Hanno Becker1a9a51c2017-04-07 13:02:16 +0100114 * Sect. 3, RFC 6066 (TLS Extensions Definitions)
115 *
116 * In order to provide any of the server names, clients MAY include an
117 * extension of type "server_name" in the (extended) client hello. The
118 * "extension_data" field of this extension SHALL contain
119 * "ServerNameList" where:
120 *
Paul Bakkerd3edc862013-03-20 16:07:17 +0100121 * struct {
122 * NameType name_type;
123 * select (name_type) {
124 * case host_name: HostName;
125 * } name;
126 * } ServerName;
127 *
128 * enum {
129 * host_name(0), (255)
130 * } NameType;
131 *
132 * opaque HostName<1..2^16-1>;
133 *
134 * struct {
135 * ServerName server_name_list<1..2^16-1>
136 * } ServerNameList;
Hanno Becker1a9a51c2017-04-07 13:02:16 +0100137 *
Paul Bakkerd3edc862013-03-20 16:07:17 +0100138 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200139 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
140 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100141
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +0100142 *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
143 *p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100144
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +0100145 *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
146 *p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100147
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200148 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +0100149 *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
150 *p++ = (unsigned char)( ( hostname_len ) & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100151
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +0100152 memcpy( p, ssl->hostname, hostname_len );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100153
Manuel Pégourié-Gonnardba26c242015-05-06 10:47:06 +0100154 *olen = hostname_len + 9;
Hanno Becker261602c2017-04-12 14:54:42 +0100155
156 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100157}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200158#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakkerd3edc862013-03-20 16:07:17 +0100159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200160#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker261602c2017-04-12 14:54:42 +0100161static int ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
162 unsigned char *buf,
163 const unsigned char *end,
164 size_t *olen )
Paul Bakkerd3edc862013-03-20 16:07:17 +0100165{
166 unsigned char *p = buf;
167
168 *olen = 0;
169
Hanno Becker40f8b512017-10-12 14:58:55 +0100170 /* We're always including an TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the
171 * initial ClientHello, in which case also adding the renegotiation
172 * info extension is NOT RECOMMENDED as per RFC 5746 Section 3.4. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200173 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Hanno Becker261602c2017-04-12 14:54:42 +0100174 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100175
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100176 MBEDTLS_SSL_DEBUG_MSG( 3,
177 ( "client hello, adding renegotiation extension" ) );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100178
Hanno Becker261602c2017-04-12 14:54:42 +0100179 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 5 + ssl->verify_data_len );
Simon Butchered997662015-09-28 02:14:30 +0100180
Paul Bakkerd3edc862013-03-20 16:07:17 +0100181 /*
182 * Secure renegotiation
183 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100184 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 )
185 & 0xFF );
186 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO )
187 & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100188
189 *p++ = 0x00;
190 *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
191 *p++ = ssl->verify_data_len & 0xFF;
192
193 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
194
195 *olen = 5 + ssl->verify_data_len;
Hanno Becker261602c2017-04-12 14:54:42 +0100196
197 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100198}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200199#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd3edc862013-03-20 16:07:17 +0100200
Manuel Pégourié-Gonnardd9423232014-12-02 11:57:29 +0100201/*
202 * Only if we handle at least one key exchange that needs signatures.
203 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200204#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +0100205 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker261602c2017-04-12 14:54:42 +0100206static int ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
207 unsigned char *buf,
208 const unsigned char *end,
209 size_t *olen )
Paul Bakkerd3edc862013-03-20 16:07:17 +0100210{
211 unsigned char *p = buf;
Paul Bakkerd3edc862013-03-20 16:07:17 +0100212 size_t sig_alg_len = 0;
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200213 const int *md;
Hanno Becker261602c2017-04-12 14:54:42 +0100214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5bfd9682014-06-24 15:18:11 +0200216 unsigned char *sig_alg_list = buf + 6;
217#endif
Paul Bakkerd3edc862013-03-20 16:07:17 +0100218
219 *olen = 0;
220
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200221 if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Hanno Becker261602c2017-04-12 14:54:42 +0100222 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100223
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100224 MBEDTLS_SSL_DEBUG_MSG( 3,
225 ( "client hello, adding signature_algorithms extension" ) );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100226
Hanno Beckere131bfe2017-04-12 14:54:42 +0100227 if( ssl->conf->sig_hashes == NULL )
228 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
229
Simon Butchered997662015-09-28 02:14:30 +0100230 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
231 {
232#if defined(MBEDTLS_ECDSA_C)
233 sig_alg_len += 2;
234#endif
235#if defined(MBEDTLS_RSA_C)
236 sig_alg_len += 2;
237#endif
Hanno Beckere131bfe2017-04-12 14:54:42 +0100238 if( sig_alg_len > MBEDTLS_SSL_MAX_SIG_HASH_ALG_LIST_LEN )
239 {
240 MBEDTLS_SSL_DEBUG_MSG( 3,
241 ( "length in bytes of sig-hash-alg extension too big" ) );
242 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
243 }
Simon Butchered997662015-09-28 02:14:30 +0100244 }
245
Hanno Beckere131bfe2017-04-12 14:54:42 +0100246 /* Empty signature algorithms list, this is a configuration error. */
247 if( sig_alg_len == 0 )
248 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
249
Hanno Becker261602c2017-04-12 14:54:42 +0100250 MBEDTLS_SSL_CHK_BUF_PTR( p, end, sig_alg_len + 6 );
Simon Butchered997662015-09-28 02:14:30 +0100251
Paul Bakkerd3edc862013-03-20 16:07:17 +0100252 /*
253 * Prepare signature_algorithms extension (TLS 1.2)
254 */
Simon Butchered997662015-09-28 02:14:30 +0100255 sig_alg_len = 0;
256
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200257 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
258 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200259#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200260 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
261 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnardd11eb7c2013-08-22 15:57:15 +0200262#endif
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200263#if defined(MBEDTLS_RSA_C)
264 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
265 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnardd11eb7c2013-08-22 15:57:15 +0200266#endif
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200267 }
Paul Bakkerd3edc862013-03-20 16:07:17 +0100268
269 /*
270 * enum {
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200271 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
272 * sha512(6), (255)
Paul Bakkerd3edc862013-03-20 16:07:17 +0100273 * } HashAlgorithm;
274 *
275 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
276 * SignatureAlgorithm;
277 *
278 * struct {
279 * HashAlgorithm hash;
280 * SignatureAlgorithm signature;
281 * } SignatureAndHashAlgorithm;
282 *
283 * SignatureAndHashAlgorithm
284 * supported_signature_algorithms<2..2^16-2>;
285 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200286 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
287 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100288
289 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
290 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
291
292 *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
293 *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
294
Paul Bakkerd3edc862013-03-20 16:07:17 +0100295 *olen = 6 + sig_alg_len;
Hanno Becker261602c2017-04-12 14:54:42 +0100296
297 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100298}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200299#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Gilles Peskineeccd8882020-03-10 12:19:08 +0100300 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
Paul Bakkerd3edc862013-03-20 16:07:17 +0100301
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +0200302#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +0100303 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Hanno Becker261602c2017-04-12 14:54:42 +0100304static int ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
305 unsigned char *buf,
306 const unsigned char *end,
307 size_t *olen )
Paul Bakkerd3edc862013-03-20 16:07:17 +0100308{
309 unsigned char *p = buf;
Manuel Pégourié-Gonnard8e205fc2014-01-23 17:27:10 +0100310 unsigned char *elliptic_curve_list = p + 6;
Paul Bakkerd3edc862013-03-20 16:07:17 +0100311 size_t elliptic_curve_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200312 const mbedtls_ecp_curve_info *info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200313 const mbedtls_ecp_group_id *grp_id;
Paul Bakkerd3edc862013-03-20 16:07:17 +0100314
315 *olen = 0;
316
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100317 MBEDTLS_SSL_DEBUG_MSG( 3,
318 ( "client hello, adding supported_elliptic_curves extension" ) );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100319
Hanno Beckere131bfe2017-04-12 14:54:42 +0100320 if( ssl->conf->curve_list == NULL )
321 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
322
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100323 for( grp_id = ssl->conf->curve_list;
324 *grp_id != MBEDTLS_ECP_DP_NONE;
325 grp_id++ )
Manuel Pégourié-Gonnardcd49f762014-02-04 15:14:13 +0100326 {
Gilles Peskinef9828522017-05-03 12:28:43 +0200327 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
Janos Follath8a317052016-04-21 23:37:09 +0100328 if( info == NULL )
329 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100330 MBEDTLS_SSL_DEBUG_MSG( 1,
331 ( "invalid curve in ssl configuration" ) );
Hanno Beckere131bfe2017-04-12 14:54:42 +0100332 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Janos Follath8a317052016-04-21 23:37:09 +0100333 }
Simon Butchered997662015-09-28 02:14:30 +0100334 elliptic_curve_len += 2;
Hanno Beckere131bfe2017-04-12 14:54:42 +0100335
336 if( elliptic_curve_len > MBEDTLS_SSL_MAX_CURVE_LIST_LEN )
337 {
338 MBEDTLS_SSL_DEBUG_MSG( 3,
339 ( "malformed supported_elliptic_curves extension in config" ) );
340 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
341 }
Simon Butchered997662015-09-28 02:14:30 +0100342 }
343
Hanno Beckere131bfe2017-04-12 14:54:42 +0100344 /* Empty elliptic curve list, this is a configuration error. */
Hanno Becker261602c2017-04-12 14:54:42 +0100345 if( elliptic_curve_len == 0 )
Hanno Beckere131bfe2017-04-12 14:54:42 +0100346 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
Hanno Becker261602c2017-04-12 14:54:42 +0100347
348 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 + elliptic_curve_len );
Simon Butchered997662015-09-28 02:14:30 +0100349
350 elliptic_curve_len = 0;
351
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100352 for( grp_id = ssl->conf->curve_list;
353 *grp_id != MBEDTLS_ECP_DP_NONE;
354 grp_id++ )
Simon Butchered997662015-09-28 02:14:30 +0100355 {
Gilles Peskinef9828522017-05-03 12:28:43 +0200356 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
Manuel Pégourié-Gonnardcd49f762014-02-04 15:14:13 +0100357 elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
358 elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200359 }
Paul Bakker5dc6b5f2013-06-29 23:26:34 +0200360
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100361 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 )
362 & 0xFF );
363 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES )
364 & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100365
366 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
367 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
368
369 *p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
370 *p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
371
Paul Bakkerd3edc862013-03-20 16:07:17 +0100372 *olen = 6 + elliptic_curve_len;
Hanno Becker261602c2017-04-12 14:54:42 +0100373
374 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100375}
376
Hanno Becker261602c2017-04-12 14:54:42 +0100377static int ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
378 unsigned char *buf,
379 const unsigned char *end,
380 size_t *olen )
Paul Bakkerd3edc862013-03-20 16:07:17 +0100381{
382 unsigned char *p = buf;
Hanno Becker261602c2017-04-12 14:54:42 +0100383 (void) ssl; /* ssl used for debugging only */
Paul Bakkerd3edc862013-03-20 16:07:17 +0100384
385 *olen = 0;
386
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100387 MBEDTLS_SSL_DEBUG_MSG( 3,
388 ( "client hello, adding supported_point_formats extension" ) );
Hanno Becker261602c2017-04-12 14:54:42 +0100389 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
Simon Butchered997662015-09-28 02:14:30 +0100390
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100391 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 )
392 & 0xFF );
393 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS )
394 & 0xFF );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100395
396 *p++ = 0x00;
Paul Bakkerd3edc862013-03-20 16:07:17 +0100397 *p++ = 2;
Manuel Pégourié-Gonnard6b8846d2013-08-15 17:42:02 +0200398
399 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200400 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Paul Bakkerd3edc862013-03-20 16:07:17 +0100401
Manuel Pégourié-Gonnard6b8846d2013-08-15 17:42:02 +0200402 *olen = 6;
Hanno Becker261602c2017-04-12 14:54:42 +0100403
404 return( 0 );
Paul Bakkerd3edc862013-03-20 16:07:17 +0100405}
Darryl Green11999bb2018-03-13 15:22:58 +0000406#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
Robert Cragieae8535d2015-10-06 17:11:18 +0100407 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakkerd3edc862013-03-20 16:07:17 +0100408
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200409#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Hanno Becker261602c2017-04-12 14:54:42 +0100410static int ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
411 unsigned char *buf,
412 const unsigned char *end,
413 size_t *olen )
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200414{
Janos Follath865b3eb2019-12-16 11:46:15 +0000415 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200416 unsigned char *p = buf;
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200417 size_t kkpp_len;
418
419 *olen = 0;
420
421 /* Skip costly extension if we can't use EC J-PAKE anyway */
422 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
Hanno Becker261602c2017-04-12 14:54:42 +0100423 return( 0 );
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200424
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100425 MBEDTLS_SSL_DEBUG_MSG( 3,
426 ( "client hello, adding ecjpake_kkpp extension" ) );
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200427
Hanno Becker261602c2017-04-12 14:54:42 +0100428 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200429
430 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
431 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
432
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +0200433 /*
434 * We may need to send ClientHello multiple times for Hello verification.
435 * We don't want to compute fresh values every time (both for performance
436 * and consistency reasons), so cache the extension content.
437 */
438 if( ssl->handshake->ecjpake_cache == NULL ||
439 ssl->handshake->ecjpake_cache_len == 0 )
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200440 {
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +0200441 MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
442
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +0200443 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
Hanno Becker261602c2017-04-12 14:54:42 +0100444 p + 2, end - p - 2, &kkpp_len,
445 ssl->conf->f_rng, ssl->conf->p_rng );
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +0200446 if( ret != 0 )
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +0200447 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100448 MBEDTLS_SSL_DEBUG_RET( 1 ,
449 "mbedtls_ecjpake_write_round_one", ret );
Hanno Becker261602c2017-04-12 14:54:42 +0100450 return( ret );
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +0200451 }
452
453 ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
454 if( ssl->handshake->ecjpake_cache == NULL )
455 {
456 MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
Hanno Becker261602c2017-04-12 14:54:42 +0100457 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +0200458 }
459
460 memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
461 ssl->handshake->ecjpake_cache_len = kkpp_len;
462 }
463 else
464 {
465 MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
466
467 kkpp_len = ssl->handshake->ecjpake_cache_len;
Hanno Becker261602c2017-04-12 14:54:42 +0100468 MBEDTLS_SSL_CHK_BUF_PTR( p + 2, end, kkpp_len );
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +0200469
470 memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200471 }
472
473 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
474 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
475
476 *olen = kkpp_len + 4;
Hanno Becker261602c2017-04-12 14:54:42 +0100477
478 return( 0 );
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +0200479}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +0200480#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakkerc3f177a2012-04-11 16:11:49 +0000481
Hanno Beckera0e20d02019-05-15 14:03:01 +0100482#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker261602c2017-04-12 14:54:42 +0100483static int ssl_write_cid_ext( mbedtls_ssl_context *ssl,
484 unsigned char *buf,
485 const unsigned char *end,
486 size_t *olen )
Hanno Becker49770ff2019-04-25 16:55:15 +0100487{
488 unsigned char *p = buf;
489 size_t ext_len;
Hanno Becker49770ff2019-04-25 16:55:15 +0100490
491 /*
Hanno Beckerebcc9132019-05-15 10:26:32 +0100492 * Quoting draft-ietf-tls-dtls-connection-id-05
493 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Becker49770ff2019-04-25 16:55:15 +0100494 *
495 * struct {
496 * opaque cid<0..2^8-1>;
497 * } ConnectionId;
498 */
499
500 *olen = 0;
501 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
502 ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
503 {
Hanno Becker261602c2017-04-12 14:54:42 +0100504 return( 0 );
Hanno Becker49770ff2019-04-25 16:55:15 +0100505 }
506 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding CID extension" ) );
507
508 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
509 * which is at most 255, so the increment cannot overflow. */
Hanno Becker261602c2017-04-12 14:54:42 +0100510 MBEDTLS_SSL_CHK_BUF_PTR( p, end, (unsigned)( ssl->own_cid_len + 5 ) );
Hanno Becker49770ff2019-04-25 16:55:15 +0100511
512 /* Add extension ID + size */
513 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID >> 8 ) & 0xFF );
514 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID ) & 0xFF );
515 ext_len = (size_t) ssl->own_cid_len + 1;
516 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
517 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
518
519 *p++ = (uint8_t) ssl->own_cid_len;
520 memcpy( p, ssl->own_cid, ssl->own_cid_len );
521
522 *olen = ssl->own_cid_len + 5;
Hanno Becker261602c2017-04-12 14:54:42 +0100523
524 return( 0 );
Hanno Becker49770ff2019-04-25 16:55:15 +0100525}
Hanno Beckera0e20d02019-05-15 14:03:01 +0100526#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker49770ff2019-04-25 16:55:15 +0100527
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200528#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker261602c2017-04-12 14:54:42 +0100529static int ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
530 unsigned char *buf,
531 const unsigned char *end,
532 size_t *olen )
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200533{
534 unsigned char *p = buf;
535
Simon Butcher0fc94e92015-09-28 20:52:04 +0100536 *olen = 0;
537
Hanno Becker261602c2017-04-12 14:54:42 +0100538 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
539 return( 0 );
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200540
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100541 MBEDTLS_SSL_DEBUG_MSG( 3,
542 ( "client hello, adding max_fragment_length extension" ) );
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200543
Hanno Becker261602c2017-04-12 14:54:42 +0100544 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 5 );
Simon Butchered997662015-09-28 02:14:30 +0100545
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100546 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 )
547 & 0xFF );
548 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH )
549 & 0xFF );
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200550
551 *p++ = 0x00;
552 *p++ = 1;
553
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200554 *p++ = ssl->conf->mfl_code;
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200555
556 *olen = 5;
Hanno Becker261602c2017-04-12 14:54:42 +0100557
558 return( 0 );
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200559}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200560#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +0200561
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200562#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Becker261602c2017-04-12 14:54:42 +0100563static int ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
564 unsigned char *buf,
565 const unsigned char *end,
566 size_t *olen )
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200567{
568 unsigned char *p = buf;
569
Simon Butcher0fc94e92015-09-28 20:52:04 +0100570 *olen = 0;
571
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200572 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Hanno Becker261602c2017-04-12 14:54:42 +0100573 return( 0 );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200574
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100575 MBEDTLS_SSL_DEBUG_MSG( 3,
576 ( "client hello, adding truncated_hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200577
Hanno Becker261602c2017-04-12 14:54:42 +0100578 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
Simon Butchered997662015-09-28 02:14:30 +0100579
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200580 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
581 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200582
583 *p++ = 0x00;
584 *p++ = 0x00;
585
586 *olen = 4;
Hanno Becker261602c2017-04-12 14:54:42 +0100587
588 return( 0 );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200589}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200590#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200591
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200592#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker261602c2017-04-12 14:54:42 +0100593static int ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
594 unsigned char *buf,
595 const unsigned char *end,
596 size_t *olen )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100597{
598 unsigned char *p = buf;
599
Simon Butcher0fc94e92015-09-28 20:52:04 +0100600 *olen = 0;
601
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200602 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
603 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker261602c2017-04-12 14:54:42 +0100604 return( 0 );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100605
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100606 MBEDTLS_SSL_DEBUG_MSG( 3,
607 ( "client hello, adding encrypt_then_mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100608
Hanno Becker261602c2017-04-12 14:54:42 +0100609 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
Simon Butchered997662015-09-28 02:14:30 +0100610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200611 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
612 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100613
614 *p++ = 0x00;
615 *p++ = 0x00;
616
617 *olen = 4;
Hanno Becker261602c2017-04-12 14:54:42 +0100618
619 return( 0 );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100620}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200621#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100622
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Becker261602c2017-04-12 14:54:42 +0100624static int ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
625 unsigned char *buf,
626 const unsigned char *end,
627 size_t *olen )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200628{
629 unsigned char *p = buf;
630
Simon Butcher0fc94e92015-09-28 20:52:04 +0100631 *olen = 0;
632
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200633 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
634 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker261602c2017-04-12 14:54:42 +0100635 return( 0 );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200636
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100637 MBEDTLS_SSL_DEBUG_MSG( 3,
638 ( "client hello, adding extended_master_secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200639
Hanno Becker261602c2017-04-12 14:54:42 +0100640 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
Simon Butchered997662015-09-28 02:14:30 +0100641
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100642 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 )
643 & 0xFF );
644 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET )
645 & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200646
647 *p++ = 0x00;
648 *p++ = 0x00;
649
650 *olen = 4;
Hanno Becker261602c2017-04-12 14:54:42 +0100651
652 return( 0 );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200653}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200654#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200655
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200656#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker261602c2017-04-12 14:54:42 +0100657static int ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
658 unsigned char *buf,
659 const unsigned char *end,
660 size_t *olen )
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200661{
662 unsigned char *p = buf;
663 size_t tlen = ssl->session_negotiate->ticket_len;
664
Simon Butcher0fc94e92015-09-28 20:52:04 +0100665 *olen = 0;
666
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200667 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
Hanno Becker261602c2017-04-12 14:54:42 +0100668 return( 0 );
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200669
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100670 MBEDTLS_SSL_DEBUG_MSG( 3,
671 ( "client hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200672
Hanno Becker261602c2017-04-12 14:54:42 +0100673 /* The addition is safe here since the ticket length is 16 bit. */
674 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 + tlen );
Simon Butchered997662015-09-28 02:14:30 +0100675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200676 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
677 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200678
679 *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
680 *p++ = (unsigned char)( ( tlen ) & 0xFF );
681
682 *olen = 4;
683
Simon Butchered997662015-09-28 02:14:30 +0100684 if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
Hanno Becker261602c2017-04-12 14:54:42 +0100685 return( 0 );
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200686
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100687 MBEDTLS_SSL_DEBUG_MSG( 3,
688 ( "sending session ticket of length %d", tlen ) );
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200689
690 memcpy( p, ssl->session_negotiate->ticket, tlen );
691
692 *olen += tlen;
Hanno Becker261602c2017-04-12 14:54:42 +0100693
694 return( 0 );
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200695}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200696#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +0200697
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200698#if defined(MBEDTLS_SSL_ALPN)
Hanno Becker261602c2017-04-12 14:54:42 +0100699static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
700 unsigned char *buf,
701 const unsigned char *end,
702 size_t *olen )
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200703{
704 unsigned char *p = buf;
Simon Butchered997662015-09-28 02:14:30 +0100705 size_t alpnlen = 0;
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200706 const char **cur;
707
Simon Butcher0fc94e92015-09-28 20:52:04 +0100708 *olen = 0;
709
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200710 if( ssl->conf->alpn_list == NULL )
Hanno Becker261602c2017-04-12 14:54:42 +0100711 return( 0 );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200713 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200714
Simon Butchered997662015-09-28 02:14:30 +0100715 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
Hanno Beckere131bfe2017-04-12 14:54:42 +0100716 alpnlen += strlen( *cur ) + 1;
Simon Butchered997662015-09-28 02:14:30 +0100717
Hanno Becker261602c2017-04-12 14:54:42 +0100718 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 + alpnlen );
Simon Butchered997662015-09-28 02:14:30 +0100719
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200720 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
721 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200722
723 /*
724 * opaque ProtocolName<1..2^8-1>;
725 *
726 * struct {
727 * ProtocolName protocol_name_list<2..2^16-1>
728 * } ProtocolNameList;
729 */
730
731 /* Skip writing extension and list length for now */
732 p += 4;
733
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200734 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200735 {
Hanno Beckere131bfe2017-04-12 14:54:42 +0100736 /*
737 * mbedtls_ssl_conf_set_alpn_protocols() checked that the length of
738 * protocol names is less than 255.
739 */
740 *p = (unsigned char)strlen( *cur );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200741 memcpy( p + 1, *cur, *p );
742 p += 1 + *p;
743 }
744
745 *olen = p - buf;
746
747 /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
748 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
749 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
750
751 /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
752 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
753 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
Hanno Becker261602c2017-04-12 14:54:42 +0100754
755 return( 0 );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200756}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200757#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +0200758
Ron Eldora9788042018-12-05 11:04:31 +0200759#if defined(MBEDTLS_SSL_DTLS_SRTP)
Johan Pascal77696ee2020-09-22 21:49:40 +0200760static int ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
Johan Pascald387aa02020-09-23 18:47:56 +0200761 unsigned char *buf,
762 const unsigned char *end,
763 size_t *olen )
Johan Pascalb62bb512015-12-03 21:56:45 +0100764{
765 unsigned char *p = buf;
Johan Pascalf6417ec2020-09-22 15:15:19 +0200766 size_t protection_profiles_index = 0, ext_len = 0;
767 uint16_t mki_len = 0, profile_value = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +0100768
769 *olen = 0;
770
Ron Eldora9788042018-12-05 11:04:31 +0200771 if( ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
772 ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
Johan Pascalb62bb512015-12-03 21:56:45 +0100773 {
Johan Pascal77696ee2020-09-22 21:49:40 +0200774 return( 0 );
Johan Pascalb62bb512015-12-03 21:56:45 +0100775 }
776
Ron Eldora9788042018-12-05 11:04:31 +0200777 /* RFC 5764 section 4.1.1
Johan Pascalb62bb512015-12-03 21:56:45 +0100778 * uint8 SRTPProtectionProfile[2];
779 *
780 * struct {
781 * SRTPProtectionProfiles SRTPProtectionProfiles;
782 * opaque srtp_mki<0..255>;
783 * } UseSRTPData;
Johan Pascalb62bb512015-12-03 21:56:45 +0100784 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
Johan Pascalb62bb512015-12-03 21:56:45 +0100785 */
Johan Pascal9bc97ca2020-09-21 23:44:45 +0200786 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED )
Ron Eldor591f1622018-01-22 12:30:04 +0200787 {
788 mki_len = ssl->dtls_srtp_info.mki_len;
789 }
Ron Eldoref72faf2018-07-12 11:54:20 +0300790 /* Extension length = 2 bytes for profiles length,
791 * ssl->conf->dtls_srtp_profile_list_len * 2 (each profile is 2 bytes length ),
792 * 1 byte for srtp_mki vector length and the mki_len value
793 */
Ron Eldor089c9fe2018-12-06 17:12:49 +0200794 ext_len = 2 + 2 * ( ssl->conf->dtls_srtp_profile_list_len ) + 1 + mki_len;
795
Johan Pascal77696ee2020-09-22 21:49:40 +0200796 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding use_srtp extension" ) );
797
798 /* Check there is room in the buffer for the extension + 4 bytes
799 * - the extension tag (2 bytes)
800 * - the extension length (2 bytes)
801 */
802 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ext_len + 4 );
803
804 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP >> 8 ) & 0xFF );
805 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP ) & 0xFF );
806
807
Ron Eldor089c9fe2018-12-06 17:12:49 +0200808 *p++ = (unsigned char)( ( ( ext_len & 0xFF00 ) >> 8 ) & 0xFF );
809 *p++ = (unsigned char)( ext_len & 0xFF );
Johan Pascalb62bb512015-12-03 21:56:45 +0100810
Ron Eldor3adb9922017-12-21 10:15:08 +0200811 /* protection profile length: 2*(ssl->conf->dtls_srtp_profile_list_len) */
Johan Pascalaae4d222020-09-22 21:21:39 +0200812 /* micro-optimization:
813 * the list size is limited to MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH
814 * which is lower than 127, so the upper byte of the length is always 0
815 * For the documentation, the more generic code is left in comments
816 * *p++ = (unsigned char)( ( ( 2 * ssl->conf->dtls_srtp_profile_list_len )
817 * >> 8 ) & 0xFF );
818 */
819 *p++ = 0;
Johan Pascale79c1e82020-09-22 15:51:27 +0200820 *p++ = (unsigned char)( ( 2 * ssl->conf->dtls_srtp_profile_list_len )
Ron Eldoref72faf2018-07-12 11:54:20 +0300821 & 0xFF );
Johan Pascalb62bb512015-12-03 21:56:45 +0100822
Ron Eldoref72faf2018-07-12 11:54:20 +0300823 for( protection_profiles_index=0;
824 protection_profiles_index < ssl->conf->dtls_srtp_profile_list_len;
825 protection_profiles_index++ )
Johan Pascalb62bb512015-12-03 21:56:45 +0100826 {
Johan Pascal43f94902020-09-22 12:25:52 +0200827 profile_value = mbedtls_ssl_check_srtp_profile_value
Ron Eldor089c9fe2018-12-06 17:12:49 +0200828 ( ssl->conf->dtls_srtp_profile_list[protection_profiles_index] );
Johan Pascal43f94902020-09-22 12:25:52 +0200829 if( profile_value != MBEDTLS_TLS_SRTP_UNSET )
Ron Eldor089c9fe2018-12-06 17:12:49 +0200830 {
831 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_write_use_srtp_ext, add profile: %04x",
832 profile_value ) );
833 *p++ = ( ( profile_value >> 8 ) & 0xFF );
834 *p++ = ( profile_value & 0xFF );
835 }
836 else
837 {
838 /*
839 * Note: we shall never arrive here as protection profiles
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200840 * is checked by mbedtls_ssl_conf_dtls_srtp_protection_profiles function
Ron Eldor089c9fe2018-12-06 17:12:49 +0200841 */
Johan Pascale79c1e82020-09-22 15:51:27 +0200842 MBEDTLS_SSL_DEBUG_MSG( 3,
843 ( "client hello, "
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200844 "illegal DTLS-SRTP protection profile %d",
Johan Pascale79c1e82020-09-22 15:51:27 +0200845 ssl->conf->dtls_srtp_profile_list[protection_profiles_index]
846 ) );
Johan Pascal76fdf1d2020-10-22 23:31:00 +0200847 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
Johan Pascalb62bb512015-12-03 21:56:45 +0100848 }
849 }
850
Ron Eldor591f1622018-01-22 12:30:04 +0200851 *p++ = mki_len & 0xFF;
852
853 if( mki_len != 0 )
854 {
Ron Eldor75870ec2018-12-06 17:31:55 +0200855 memcpy( p, ssl->dtls_srtp_info.mki_value, mki_len );
Ron Eldor313d7b52018-12-10 14:56:21 +0200856 /*
857 * Increment p to point to the current position.
858 */
859 p += mki_len;
Ron Eldoref72faf2018-07-12 11:54:20 +0300860 MBEDTLS_SSL_DEBUG_BUF( 3, "sending mki", ssl->dtls_srtp_info.mki_value,
861 ssl->dtls_srtp_info.mki_len );
Ron Eldor591f1622018-01-22 12:30:04 +0200862 }
863
Ron Eldoref72faf2018-07-12 11:54:20 +0300864 /*
865 * total extension length: extension type (2 bytes)
866 * + extension length (2 bytes)
867 * + protection profile length (2 bytes)
868 * + 2 * number of protection profiles
869 * + srtp_mki vector length(1 byte)
Ron Eldor313d7b52018-12-10 14:56:21 +0200870 * + mki value
Ron Eldoref72faf2018-07-12 11:54:20 +0300871 */
Ron Eldor313d7b52018-12-10 14:56:21 +0200872 *olen = p - buf;
Johan Pascal77696ee2020-09-22 21:49:40 +0200873
874 return( 0 );
Johan Pascalb62bb512015-12-03 21:56:45 +0100875}
876#endif /* MBEDTLS_SSL_DTLS_SRTP */
877
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200878/*
879 * Generate random bytes for ClientHello
880 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200881static int ssl_generate_random( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200882{
Janos Follath865b3eb2019-12-16 11:46:15 +0000883 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200884 unsigned char *p = ssl->handshake->randbytes;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +0100886 mbedtls_time_t t;
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200887#endif
888
Manuel Pégourié-Gonnardfb2d2232014-07-22 15:59:14 +0200889 /*
890 * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
891 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200892#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200893 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardfb2d2232014-07-22 15:59:14 +0200894 ssl->handshake->verify_cookie != NULL )
895 {
896 return( 0 );
897 }
898#endif
899
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200900#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +0100901 t = mbedtls_time( NULL );
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200902 *p++ = (unsigned char)( t >> 24 );
903 *p++ = (unsigned char)( t >> 16 );
904 *p++ = (unsigned char)( t >> 8 );
905 *p++ = (unsigned char)( t );
906
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200907 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200908#else
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +0100909 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200910 return( ret );
911
912 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200913#endif /* MBEDTLS_HAVE_TIME */
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200914
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +0100915 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +0200916 return( ret );
917
918 return( 0 );
919}
920
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +0100921/**
922 * \brief Validate cipher suite against config in SSL context.
923 *
924 * \param suite_info cipher suite to validate
925 * \param ssl SSL context
Andrzej Kurek03bac442018-04-25 05:06:07 -0400926 * \param min_minor_ver Minimal minor version to accept a cipher suite
927 * \param max_minor_ver Maximal minor version to accept a cipher suite
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +0100928 *
929 * \return 0 if valid, else 1
930 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +0100931static int ssl_validate_ciphersuite(
932 const mbedtls_ssl_ciphersuite_t * suite_info,
933 const mbedtls_ssl_context * ssl,
934 int min_minor_ver, int max_minor_ver )
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +0100935{
Andrzej Kurek03bac442018-04-25 05:06:07 -0400936 (void) ssl;
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +0100937 if( suite_info == NULL )
938 return( 1 );
939
Andrzej Kurek03bac442018-04-25 05:06:07 -0400940 if( suite_info->min_minor_ver > max_minor_ver ||
941 suite_info->max_minor_ver < min_minor_ver )
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +0100942 return( 1 );
943
944#if defined(MBEDTLS_SSL_PROTO_DTLS)
945 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
946 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
947 return( 1 );
948#endif
949
950#if defined(MBEDTLS_ARC4_C)
951 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
952 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
953 return( 1 );
954#endif
955
956#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
957 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
958 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
959 return( 1 );
960#endif
961
Hanno Becker2e4f6162018-10-23 11:54:44 +0100962 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
Gilles Peskineeccd8882020-03-10 12:19:08 +0100963#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Becker2e4f6162018-10-23 11:54:44 +0100964 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Hanno Becker520224e2018-10-26 11:38:07 +0100965 ssl_conf_has_static_psk( ssl->conf ) == 0 )
Hanno Becker2e4f6162018-10-23 11:54:44 +0100966 {
967 return( 1 );
968 }
Gilles Peskineeccd8882020-03-10 12:19:08 +0100969#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Hanno Becker2e4f6162018-10-23 11:54:44 +0100970
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +0100971 return( 0 );
972}
973
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200974static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +0000975{
Janos Follath865b3eb2019-12-16 11:46:15 +0000976 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakkerd3edc862013-03-20 16:07:17 +0100977 size_t i, n, olen, ext_len = 0;
Hanno Becker261602c2017-04-12 14:54:42 +0100978
Paul Bakker5121ce52009-01-03 21:22:43 +0000979 unsigned char *buf;
Paul Bakker2fbefde2013-06-29 16:01:15 +0200980 unsigned char *p, *q;
Hanno Becker261602c2017-04-12 14:54:42 +0100981 const unsigned char *end;
982
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +0200983 unsigned char offer_compress;
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200984 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200985 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Ron Eldor755bb6a2018-02-14 19:30:48 +0200986#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
987 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
988 int uses_ec = 0;
989#endif
Paul Bakker5121ce52009-01-03 21:22:43 +0000990
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200991 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +0000992
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +0100993 if( ssl->conf->f_rng == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +0100994 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200995 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
996 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +0100997 }
998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200999#if defined(MBEDTLS_SSL_RENEGOTIATION)
1000 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001001#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001002 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001003 ssl->major_ver = ssl->conf->min_major_ver;
1004 ssl->minor_ver = ssl->conf->min_minor_ver;
Paul Bakker48916f92012-09-16 19:57:18 +00001005 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001006
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02001007 if( ssl->conf->max_major_ver == 0 )
Paul Bakker490ecc82011-10-06 13:04:09 +00001008 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001009 MBEDTLS_SSL_DEBUG_MSG( 1,
1010 ( "configured max major version is invalid, consider using mbedtls_ssl_config_defaults()" ) );
Manuel Pégourié-Gonnard1897af92015-05-10 23:27:38 +02001011 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker490ecc82011-10-06 13:04:09 +00001012 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001013
Hanno Becker261602c2017-04-12 14:54:42 +01001014 buf = ssl->out_msg;
1015 end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN;
1016
Paul Bakker5121ce52009-01-03 21:22:43 +00001017 /*
Hanno Becker261602c2017-04-12 14:54:42 +01001018 * Check if there's enough space for the first part of the ClientHello
1019 * consisting of the 38 bytes described below, the session identifier (at
1020 * most 32 bytes) and its length (1 byte).
1021 *
1022 * Use static upper bounds instead of the actual values
1023 * to allow the compiler to optimize this away.
1024 */
1025 MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 38 + 1 + 32 );
1026
1027 /*
1028 * The 38 first bytes of the ClientHello:
1029 * 0 . 0 handshake type (written later)
1030 * 1 . 3 handshake length (written later)
Paul Bakker5121ce52009-01-03 21:22:43 +00001031 * 4 . 5 highest version supported
1032 * 6 . 9 current UNIX time
1033 * 10 . 37 random bytes
Hanno Becker261602c2017-04-12 14:54:42 +01001034 *
1035 * The current UNIX time (4 bytes) and following 28 random bytes are written
1036 * by ssl_generate_random() into ssl->handshake->randbytes buffer and then
1037 * copied from there into the output buffer.
Paul Bakker5121ce52009-01-03 21:22:43 +00001038 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001039
Hanno Becker261602c2017-04-12 14:54:42 +01001040 p = buf + 4;
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001041 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
1042 ssl->conf->max_minor_ver,
1043 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001044 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00001045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
Paul Bakker5121ce52009-01-03 21:22:43 +00001047 buf[4], buf[5] ) );
1048
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +02001049 if( ( ret = ssl_generate_random( ssl ) ) != 0 )
1050 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001051 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001052 return( ret );
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +02001053 }
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001054
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +02001055 memcpy( p, ssl->handshake->randbytes, 32 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001056 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
Manuel Pégourié-Gonnardb760f002014-07-22 15:53:27 +02001057 p += 32;
Paul Bakker5121ce52009-01-03 21:22:43 +00001058
1059 /*
1060 * 38 . 38 session id length
1061 * 39 . 39+n session id
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001062 * 39+n . 39+n DTLS only: cookie length (1 byte)
Hanno Becker261602c2017-04-12 14:54:42 +01001063 * 40+n . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001064 * .. . .. ciphersuitelist length (2 bytes)
1065 * .. . .. ciphersuitelist
1066 * .. . .. compression methods length (1 byte)
Paul Bakkerc3f177a2012-04-11 16:11:49 +00001067 * .. . .. compression methods
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001068 * .. . .. extensions length (2 bytes)
Paul Bakkerc3f177a2012-04-11 16:11:49 +00001069 * .. . .. extensions
Paul Bakker5121ce52009-01-03 21:22:43 +00001070 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001071 n = ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001072
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001073 if( n < 16 || n > 32 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001074#if defined(MBEDTLS_SSL_RENEGOTIATION)
1075 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001076#endif
Paul Bakker0a597072012-09-25 21:55:46 +00001077 ssl->handshake->resume == 0 )
Manuel Pégourié-Gonnard6377e412013-07-31 16:31:33 +02001078 {
Paul Bakker5121ce52009-01-03 21:22:43 +00001079 n = 0;
Manuel Pégourié-Gonnard6377e412013-07-31 16:31:33 +02001080 }
1081
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001082#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard6377e412013-07-31 16:31:33 +02001083 /*
1084 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
1085 * generate and include a Session ID in the TLS ClientHello."
1086 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001087#if defined(MBEDTLS_SSL_RENEGOTIATION)
1088 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001089#endif
Manuel Pégourié-Gonnardd2b35ec2015-03-10 11:40:43 +00001090 {
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001091 if( ssl->session_negotiate->ticket != NULL &&
1092 ssl->session_negotiate->ticket_len != 0 )
1093 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001094 ret = ssl->conf->f_rng( ssl->conf->p_rng,
1095 ssl->session_negotiate->id, 32 );
Manuel Pégourié-Gonnard6377e412013-07-31 16:31:33 +02001096
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001097 if( ret != 0 )
1098 return( ret );
Manuel Pégourié-Gonnard6377e412013-07-31 16:31:33 +02001099
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001100 ssl->session_negotiate->id_len = n = 32;
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001101 }
Manuel Pégourié-Gonnard6377e412013-07-31 16:31:33 +02001102 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001103#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Paul Bakker5121ce52009-01-03 21:22:43 +00001104
Hanno Becker261602c2017-04-12 14:54:42 +01001105 /*
1106 * The first check of the output buffer size above (
1107 * MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 38 + 1 + 32 );)
1108 * has checked that there is enough space in the output buffer for the
1109 * session identifier length byte and the session identifier (n <= 32).
1110 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001111 *p++ = (unsigned char) n;
1112
1113 for( i = 0; i < n; i++ )
Paul Bakker48916f92012-09-16 19:57:18 +00001114 *p++ = ssl->session_negotiate->id[i];
Paul Bakker5121ce52009-01-03 21:22:43 +00001115
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001116 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
1117 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00001118
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001119 /*
Hanno Becker261602c2017-04-12 14:54:42 +01001120 * With 'n' being the length of the session identifier
1121 *
1122 * 39+n . 39+n DTLS only: cookie length (1 byte)
1123 * 40+n . .. DTLS only: cookie
1124 * .. . .. ciphersuitelist length (2 bytes)
1125 * .. . .. ciphersuitelist
1126 * .. . .. compression methods length (1 byte)
1127 * .. . .. compression methods
1128 * .. . .. extensions length (2 bytes)
1129 * .. . .. extensions
1130 */
1131
1132 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001133 * DTLS cookie
1134 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001136 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001137 {
Hanno Becker261602c2017-04-12 14:54:42 +01001138 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
1139
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001140 if( ssl->handshake->verify_cookie == NULL )
1141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001142 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001143 *p++ = 0;
1144 }
1145 else
1146 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001147 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001148 ssl->handshake->verify_cookie,
1149 ssl->handshake->verify_cookie_len );
1150
1151 *p++ = ssl->handshake->verify_cookie_len;
Hanno Becker261602c2017-04-12 14:54:42 +01001152
1153 MBEDTLS_SSL_CHK_BUF_PTR( p, end,
1154 ssl->handshake->verify_cookie_len );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001155 memcpy( p, ssl->handshake->verify_cookie,
1156 ssl->handshake->verify_cookie_len );
1157 p += ssl->handshake->verify_cookie_len;
1158 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001159 }
1160#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001161
Paul Bakker48916f92012-09-16 19:57:18 +00001162 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001163 * Ciphersuite list
Paul Bakker48916f92012-09-16 19:57:18 +00001164 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001165 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001166
1167 /* Skip writing ciphersuite length for now */
1168 n = 0;
1169 q = p;
Hanno Becker261602c2017-04-12 14:54:42 +01001170
1171 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001172 p += 2;
1173
Paul Bakker2fbefde2013-06-29 16:01:15 +02001174 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker5121ce52009-01-03 21:22:43 +00001175 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001176 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
Paul Bakker2fbefde2013-06-29 16:01:15 +02001177
Andrzej Kurek03bac442018-04-25 05:06:07 -04001178 if( ssl_validate_ciphersuite( ciphersuite_info, ssl,
1179 ssl->conf->min_minor_ver,
1180 ssl->conf->max_minor_ver ) != 0 )
Paul Bakker2fbefde2013-06-29 16:01:15 +02001181 continue;
1182
Hanno Becker3c88c652019-01-02 11:17:25 +00001183 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %#04x (%s)",
Hanno Beckerecea07d2018-11-07 16:24:35 +00001184 ciphersuites[i], ciphersuite_info->name ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001185
Ron Eldor755bb6a2018-02-14 19:30:48 +02001186#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1187 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1188 uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
1189#endif
1190
Hanno Becker261602c2017-04-12 14:54:42 +01001191 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1192
Paul Bakker2fbefde2013-06-29 16:01:15 +02001193 n++;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001194 *p++ = (unsigned char)( ciphersuites[i] >> 8 );
1195 *p++ = (unsigned char)( ciphersuites[i] );
Paul Bakker5121ce52009-01-03 21:22:43 +00001196 }
1197
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001198 MBEDTLS_SSL_DEBUG_MSG( 3,
1199 ( "client hello, got %d ciphersuites (excluding SCSVs)", n ) );
Ron Eldor714785d2017-08-28 13:55:55 +03001200
Manuel Pégourié-Gonnard5d9cde22015-01-22 10:49:41 +00001201 /*
1202 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1203 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204#if defined(MBEDTLS_SSL_RENEGOTIATION)
1205 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard5d9cde22015-01-22 10:49:41 +00001206#endif
1207 {
Ron Eldor4a2fb4c2017-09-10 17:03:50 +03001208 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
Hanno Becker261602c2017-04-12 14:54:42 +01001209 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001210 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
1211 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
Manuel Pégourié-Gonnard5d9cde22015-01-22 10:49:41 +00001212 n++;
1213 }
1214
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001215 /* Some versions of OpenSSL don't handle it correctly if not at end */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard684b0592015-05-06 09:27:31 +01001217 if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001218 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001219 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
Hanno Becker261602c2017-04-12 14:54:42 +01001220
1221 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001222 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
1223 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
Manuel Pégourié-Gonnard1cbd39d2014-10-20 13:34:59 +02001224 n++;
1225 }
1226#endif
1227
Paul Bakker2fbefde2013-06-29 16:01:15 +02001228 *q++ = (unsigned char)( n >> 7 );
1229 *q++ = (unsigned char)( n << 1 );
1230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001231#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001232 offer_compress = 1;
Paul Bakker2770fbd2012-07-03 13:30:23 +00001233#else
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001234 offer_compress = 0;
1235#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001236
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001237 /*
Johannes H4e5d23f2018-01-06 09:46:57 +01001238 * We don't support compression with DTLS right now: if many records come
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001239 * in the same datagram, uncompressing one could overwrite the next one.
1240 * We don't want to add complexity for handling that case unless there is
1241 * an actual need for it.
1242 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001243#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001244 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001245 offer_compress = 0;
1246#endif
1247
1248 if( offer_compress )
1249 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001250 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
1251 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001252 MBEDTLS_SSL_COMPRESS_DEFLATE,
1253 MBEDTLS_SSL_COMPRESS_NULL ) );
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001254
Hanno Becker261602c2017-04-12 14:54:42 +01001255 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 3 );
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001256 *p++ = 2;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001257 *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
1258 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001259 }
1260 else
1261 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001262 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
1263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
1264 MBEDTLS_SSL_COMPRESS_NULL ) );
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001265
Hanno Becker261602c2017-04-12 14:54:42 +01001266 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001267 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001268 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001269 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001270
Hanno Becker261602c2017-04-12 14:54:42 +01001271 /* First write extensions, then the total length */
1272
1273 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1274
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001275#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Hanno Becker261602c2017-04-12 14:54:42 +01001276 if( ( ret = ssl_write_hostname_ext( ssl, p + 2 + ext_len,
1277 end, &olen ) ) != 0 )
1278 {
1279 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_hostname_ext", ret );
1280 return( ret );
1281 }
Paul Bakkerd3edc862013-03-20 16:07:17 +01001282 ext_len += olen;
Paul Bakker0be444a2013-08-27 21:55:01 +02001283#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001284
Hanno Becker40f8b512017-10-12 14:58:55 +01001285 /* Note that TLS_EMPTY_RENEGOTIATION_INFO_SCSV is always added
1286 * even if MBEDTLS_SSL_RENEGOTIATION is not defined. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001287#if defined(MBEDTLS_SSL_RENEGOTIATION)
Hanno Becker261602c2017-04-12 14:54:42 +01001288 if( ( ret = ssl_write_renegotiation_ext( ssl, p + 2 + ext_len,
1289 end, &olen ) ) != 0 )
1290 {
1291 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_renegotiation_ext", ret );
1292 return( ret );
1293 }
Paul Bakkerd3edc862013-03-20 16:07:17 +01001294 ext_len += olen;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001295#endif
Paul Bakkerc3f177a2012-04-11 16:11:49 +00001296
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001297#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Gilles Peskineeccd8882020-03-10 12:19:08 +01001298 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
Hanno Becker261602c2017-04-12 14:54:42 +01001299 if( ( ret = ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len,
1300 end, &olen ) ) != 0 )
1301 {
1302 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_signature_algorithms_ext", ret );
1303 return( ret );
1304 }
Paul Bakkerd3edc862013-03-20 16:07:17 +01001305 ext_len += olen;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001306#endif
Paul Bakkerc3f177a2012-04-11 16:11:49 +00001307
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02001308#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001309 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Ron Eldor755bb6a2018-02-14 19:30:48 +02001310 if( uses_ec )
1311 {
Hanno Becker261602c2017-04-12 14:54:42 +01001312 if( ( ret = ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len,
1313 end, &olen ) ) != 0 )
1314 {
1315 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_supported_elliptic_curves_ext", ret );
1316 return( ret );
1317 }
Ron Eldor755bb6a2018-02-14 19:30:48 +02001318 ext_len += olen;
Paul Bakker41c83d32013-03-20 14:39:14 +01001319
Hanno Becker261602c2017-04-12 14:54:42 +01001320 if( ( ret = ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len,
1321 end, &olen ) ) != 0 )
1322 {
1323 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_supported_point_formats_ext", ret );
1324 return( ret );
1325 }
Ron Eldor755bb6a2018-02-14 19:30:48 +02001326 ext_len += olen;
1327 }
Paul Bakker41c83d32013-03-20 14:39:14 +01001328#endif
1329
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02001330#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Hanno Becker261602c2017-04-12 14:54:42 +01001331 if( ( ret = ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len,
1332 end, &olen ) ) != 0 )
1333 {
1334 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_ecjpake_kkpp_ext", ret );
1335 return( ret );
1336 }
Manuel Pégourié-Gonnard294139b2015-09-15 16:55:05 +02001337 ext_len += olen;
1338#endif
1339
Hanno Beckera0e20d02019-05-15 14:03:01 +01001340#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker261602c2017-04-12 14:54:42 +01001341 if( ( ret = ssl_write_cid_ext( ssl, p + 2 + ext_len, end, &olen ) ) != 0 )
1342 {
1343 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_cid_ext", ret );
1344 return( ret );
1345 }
Hanno Becker49770ff2019-04-25 16:55:15 +01001346 ext_len += olen;
Hanno Beckera0e20d02019-05-15 14:03:01 +01001347#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker49770ff2019-04-25 16:55:15 +01001348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001349#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Hanno Becker261602c2017-04-12 14:54:42 +01001350 if( ( ret = ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len,
1351 end, &olen ) ) != 0 )
1352 {
1353 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_max_fragment_length_ext", ret );
1354 return( ret );
1355 }
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +02001356 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02001357#endif
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +02001358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001359#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Hanno Becker261602c2017-04-12 14:54:42 +01001360 if( ( ret = ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len,
1361 end, &olen ) ) != 0 )
1362 {
1363 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_truncated_hmac_ext", ret );
1364 return( ret );
1365 }
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001366 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02001367#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001368
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001369#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Hanno Becker261602c2017-04-12 14:54:42 +01001370 if( ( ret = ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len,
1371 end, &olen ) ) != 0 )
1372 {
1373 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_encrypt_then_mac_ext", ret );
1374 return( ret );
1375 }
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001376 ext_len += olen;
1377#endif
1378
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001379#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Becker261602c2017-04-12 14:54:42 +01001380 if( ( ret = ssl_write_extended_ms_ext( ssl, p + 2 + ext_len,
1381 end, &olen ) ) != 0 )
1382 {
1383 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_extended_ms_ext", ret );
1384 return( ret );
1385 }
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001386 ext_len += olen;
1387#endif
1388
Simon Butcher5624ec82015-09-29 01:06:06 +01001389#if defined(MBEDTLS_SSL_ALPN)
Hanno Becker261602c2017-04-12 14:54:42 +01001390 if( ( ret = ssl_write_alpn_ext( ssl, p + 2 + ext_len,
1391 end, &olen ) ) != 0 )
1392 {
1393 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_alpn_ext", ret );
1394 return( ret );
1395 }
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02001396 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02001397#endif
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02001398
Johan Pascalb62bb512015-12-03 21:56:45 +01001399#if defined(MBEDTLS_SSL_DTLS_SRTP)
Ron Eldor3adb9922017-12-21 10:15:08 +02001400 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1401 {
Johan Pascal77696ee2020-09-22 21:49:40 +02001402 if( ( ret = ssl_write_use_srtp_ext( ssl, p + 2 + ext_len,
Johan Pascald387aa02020-09-23 18:47:56 +02001403 end, &olen ) ) != 0 )
Johan Pascal77696ee2020-09-22 21:49:40 +02001404 {
1405 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_use_srtp_ext", ret );
1406 return( ret );
1407 }
Ron Eldor3adb9922017-12-21 10:15:08 +02001408 ext_len += olen;
1409 }
Johan Pascalb62bb512015-12-03 21:56:45 +01001410#endif
1411
Simon Butcher5624ec82015-09-29 01:06:06 +01001412#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Hanno Becker261602c2017-04-12 14:54:42 +01001413 if( ( ret = ssl_write_session_ticket_ext( ssl, p + 2 + ext_len,
1414 end, &olen ) ) != 0 )
1415 {
1416 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_session_ticket_ext", ret );
1417 return( ret );
1418 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001419 ext_len += olen;
1420#endif
1421
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001422 /* olen unused if all extensions are disabled */
1423 ((void) olen);
1424
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001425 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
Hanno Becker261602c2017-04-12 14:54:42 +01001426 ext_len ) );
Paul Bakkerc3f177a2012-04-11 16:11:49 +00001427
Paul Bakkera7036632014-04-30 10:15:38 +02001428 if( ext_len > 0 )
1429 {
Hanno Becker261602c2017-04-12 14:54:42 +01001430 /* No need to check for space here, because the extension
1431 * writing functions already took care of that. */
Paul Bakkera7036632014-04-30 10:15:38 +02001432 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1433 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
1434 p += ext_len;
1435 }
Paul Bakker41c83d32013-03-20 14:39:14 +01001436
Paul Bakker5121ce52009-01-03 21:22:43 +00001437 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001438 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1439 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00001440
1441 ssl->state++;
1442
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001443#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001444 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001445 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02001446#endif
1447
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02001448 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001449 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02001450 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001451 return( ret );
1452 }
1453
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02001454#if defined(MBEDTLS_SSL_PROTO_DTLS)
1455 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
1456 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
1457 {
1458 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
1459 return( ret );
1460 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01001461#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02001462
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001463 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001464
1465 return( 0 );
1466}
1467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001468static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02001469 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +00001470 size_t len )
1471{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001472#if defined(MBEDTLS_SSL_RENEGOTIATION)
1473 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +00001474 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01001475 /* Check verify-data in constant-time. The length OTOH is no secret */
Paul Bakker48916f92012-09-16 19:57:18 +00001476 if( len != 1 + ssl->verify_data_len * 2 ||
1477 buf[0] != ssl->verify_data_len * 2 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001478 mbedtls_ssl_safer_memcmp( buf + 1,
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01001479 ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001480 mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01001481 ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001482 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001484 mbedtls_ssl_send_alert_message(
1485 ssl,
1486 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1487 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001488 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00001489 }
1490 }
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001491 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001492#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001493 {
1494 if( len != 1 || buf[0] != 0x00 )
1495 {
Ronald Cron5ee57072020-06-11 09:34:06 +02001496 MBEDTLS_SSL_DEBUG_MSG( 1,
1497 ( "non-zero length renegotiation info" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001498 mbedtls_ssl_send_alert_message(
1499 ssl,
1500 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1501 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001502 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001503 }
1504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001505 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001506 }
Paul Bakker48916f92012-09-16 19:57:18 +00001507
1508 return( 0 );
1509}
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001511#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1512static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02001513 const unsigned char *buf,
Manuel Pégourié-Gonnardde600e52013-07-17 10:14:38 +02001514 size_t len )
1515{
1516 /*
1517 * server should use the extension only if we did,
1518 * and if so the server's value should match ours (and len is always 1)
1519 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001520 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ||
Manuel Pégourié-Gonnardde600e52013-07-17 10:14:38 +02001521 len != 1 ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001522 buf[0] != ssl->conf->mfl_code )
Manuel Pégourié-Gonnardde600e52013-07-17 10:14:38 +02001523 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001524 MBEDTLS_SSL_DEBUG_MSG( 1,
1525 ( "non-matching max fragment length extension" ) );
1526 mbedtls_ssl_send_alert_message(
1527 ssl,
1528 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1529 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001530 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnardde600e52013-07-17 10:14:38 +02001531 }
1532
1533 return( 0 );
1534}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001535#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Paul Bakker48916f92012-09-16 19:57:18 +00001536
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001537#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1538static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001539 const unsigned char *buf,
1540 size_t len )
1541{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001542 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ||
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001543 len != 0 )
1544 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001545 MBEDTLS_SSL_DEBUG_MSG( 1,
1546 ( "non-matching truncated HMAC extension" ) );
1547 mbedtls_ssl_send_alert_message(
1548 ssl,
1549 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1550 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001551 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001552 }
1553
1554 ((void) buf);
1555
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001556 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001557
1558 return( 0 );
1559}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001560#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001561
Hanno Beckera0e20d02019-05-15 14:03:01 +01001562#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckera8373a12019-04-26 15:37:26 +01001563static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl,
1564 const unsigned char *buf,
1565 size_t len )
1566{
1567 size_t peer_cid_len;
1568
1569 if( /* CID extension only makes sense in DTLS */
1570 ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
1571 /* The server must only send the CID extension if we have offered it. */
Hanno Becker22626482019-05-03 12:46:59 +01001572 ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
Hanno Beckera8373a12019-04-26 15:37:26 +01001573 {
Hanno Becker22626482019-05-03 12:46:59 +01001574 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension unexpected" ) );
Hanno Beckera8373a12019-04-26 15:37:26 +01001575 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker22626482019-05-03 12:46:59 +01001576 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1577 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1578 }
1579
1580 if( len == 0 )
1581 {
1582 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
1583 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1584 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Hanno Beckera8373a12019-04-26 15:37:26 +01001585 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1586 }
1587
1588 peer_cid_len = *buf++;
1589 len--;
1590
1591 if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
1592 {
Hanno Becker22626482019-05-03 12:46:59 +01001593 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
Hanno Beckera8373a12019-04-26 15:37:26 +01001594 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker22626482019-05-03 12:46:59 +01001595 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Hanno Beckera8373a12019-04-26 15:37:26 +01001596 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1597 }
1598
1599 if( len != peer_cid_len )
1600 {
Hanno Becker22626482019-05-03 12:46:59 +01001601 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
Hanno Beckera8373a12019-04-26 15:37:26 +01001602 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Hanno Becker22626482019-05-03 12:46:59 +01001603 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Hanno Beckera8373a12019-04-26 15:37:26 +01001604 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1605 }
1606
Hanno Becker5a299902019-05-03 12:47:49 +01001607 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
Hanno Beckera8373a12019-04-26 15:37:26 +01001608 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
1609 memcpy( ssl->handshake->peer_cid, buf, peer_cid_len );
1610
1611 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
1612 MBEDTLS_SSL_DEBUG_BUF( 3, "Server CID", buf, peer_cid_len );
1613
Hanno Beckera8373a12019-04-26 15:37:26 +01001614 return( 0 );
1615}
Hanno Beckera0e20d02019-05-15 14:03:01 +01001616#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckera8373a12019-04-26 15:37:26 +01001617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001618#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1619static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001620 const unsigned char *buf,
1621 size_t len )
1622{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001623 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001624 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001625 len != 0 )
1626 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001627 MBEDTLS_SSL_DEBUG_MSG( 1,
1628 ( "non-matching encrypt-then-MAC extension" ) );
1629 mbedtls_ssl_send_alert_message(
1630 ssl,
1631 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1632 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001633 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001634 }
1635
1636 ((void) buf);
1637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001638 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001639
1640 return( 0 );
1641}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001642#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001643
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001644#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1645static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001646 const unsigned char *buf,
1647 size_t len )
1648{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001649 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001650 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001651 len != 0 )
1652 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001653 MBEDTLS_SSL_DEBUG_MSG( 1,
1654 ( "non-matching extended master secret extension" ) );
1655 mbedtls_ssl_send_alert_message(
1656 ssl,
1657 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1658 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001659 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001660 }
1661
1662 ((void) buf);
1663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001664 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001665
1666 return( 0 );
1667}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001668#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001670#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1671static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02001672 const unsigned char *buf,
1673 size_t len )
1674{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001675 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ||
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02001676 len != 0 )
1677 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001678 MBEDTLS_SSL_DEBUG_MSG( 1,
1679 ( "non-matching session ticket extension" ) );
1680 mbedtls_ssl_send_alert_message(
1681 ssl,
1682 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1683 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001684 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +02001685 }
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02001686
1687 ((void) buf);
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02001688
1689 ssl->handshake->new_session_ticket = 1;
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02001690
1691 return( 0 );
1692}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001693#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02001694
Robert Cragie136884c2015-10-02 13:34:31 +01001695#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001696 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001697static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001698 const unsigned char *buf,
1699 size_t len )
1700{
1701 size_t list_size;
1702 const unsigned char *p;
1703
Philippe Antoine747fd532018-05-30 09:13:21 +02001704 if( len == 0 || (size_t)( buf[0] + 1 ) != len )
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001705 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001706 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001707 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1708 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001709 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001710 }
Philippe Antoine747fd532018-05-30 09:13:21 +02001711 list_size = buf[0];
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001712
Manuel Pégourié-Gonnardfd35af12014-06-23 14:10:13 +02001713 p = buf + 1;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001714 while( list_size > 0 )
1715 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001716 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
1717 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001718 {
Robert Cragie136884c2015-10-02 13:34:31 +01001719#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +02001720 ssl->handshake->ecdh_ctx.point_format = p[0];
Gilles Peskine064a85c2017-05-10 10:46:40 +02001721#endif
Robert Cragieae8535d2015-10-06 17:11:18 +01001722#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Robert Cragie136884c2015-10-02 13:34:31 +01001723 ssl->handshake->ecjpake_ctx.point_format = p[0];
1724#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001725 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001726 return( 0 );
1727 }
1728
1729 list_size--;
1730 p++;
1731 }
1732
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001734 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1735 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001736 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001737}
Darryl Green11999bb2018-03-13 15:22:58 +00001738#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
Robert Cragieae8535d2015-10-06 17:11:18 +01001739 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001740
Manuel Pégourié-Gonnard0a1324a2015-09-16 16:01:00 +02001741#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1742static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
1743 const unsigned char *buf,
1744 size_t len )
1745{
Janos Follath865b3eb2019-12-16 11:46:15 +00001746 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard0a1324a2015-09-16 16:01:00 +02001747
Hanno Beckere694c3e2017-12-27 21:34:08 +00001748 if( ssl->handshake->ciphersuite_info->key_exchange !=
Manuel Pégourié-Gonnard0a1324a2015-09-16 16:01:00 +02001749 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
1750 {
1751 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
1752 return( 0 );
1753 }
1754
Manuel Pégourié-Gonnardd0d8cb32015-09-17 14:16:30 +02001755 /* If we got here, we no longer need our cached extension */
1756 mbedtls_free( ssl->handshake->ecjpake_cache );
1757 ssl->handshake->ecjpake_cache = NULL;
1758 ssl->handshake->ecjpake_cache_len = 0;
1759
Manuel Pégourié-Gonnard0a1324a2015-09-16 16:01:00 +02001760 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
1761 buf, len ) ) != 0 )
1762 {
1763 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001764 mbedtls_ssl_send_alert_message(
1765 ssl,
1766 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1767 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard0a1324a2015-09-16 16:01:00 +02001768 return( ret );
1769 }
1770
1771 return( 0 );
1772}
1773#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00001774
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001775#if defined(MBEDTLS_SSL_ALPN)
1776static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001777 const unsigned char *buf, size_t len )
1778{
1779 size_t list_len, name_len;
1780 const char **p;
1781
1782 /* If we didn't send it, the server shouldn't send it */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001783 if( ssl->conf->alpn_list == NULL )
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001784 {
1785 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01001786 mbedtls_ssl_send_alert_message(
1787 ssl,
1788 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1789 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001790 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001791 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001792
1793 /*
1794 * opaque ProtocolName<1..2^8-1>;
1795 *
1796 * struct {
1797 * ProtocolName protocol_name_list<2..2^16-1>
1798 * } ProtocolNameList;
1799 *
1800 * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
1801 */
1802
1803 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
1804 if( len < 4 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001805 {
1806 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1807 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001808 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001809 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001810
1811 list_len = ( buf[0] << 8 ) | buf[1];
1812 if( list_len != len - 2 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001813 {
1814 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1815 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001816 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001817 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001818
1819 name_len = buf[2];
1820 if( name_len != list_len - 1 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001821 {
1822 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1823 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001824 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001825 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001826
1827 /* Check that the server chosen protocol was in our list and save it */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001828 for( p = ssl->conf->alpn_list; *p != NULL; p++ )
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001829 {
1830 if( name_len == strlen( *p ) &&
1831 memcmp( buf + 3, *p, name_len ) == 0 )
1832 {
1833 ssl->alpn_chosen = *p;
1834 return( 0 );
1835 }
1836 }
1837
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001838 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001839 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1840 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001841 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001842}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001843#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02001844
Johan Pascalb62bb512015-12-03 21:56:45 +01001845#if defined(MBEDTLS_SSL_DTLS_SRTP)
1846static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
Ron Eldoref72faf2018-07-12 11:54:20 +03001847 const unsigned char *buf,
1848 size_t len )
Johan Pascalb62bb512015-12-03 21:56:45 +01001849{
Johan Pascal43f94902020-09-22 12:25:52 +02001850 mbedtls_ssl_srtp_profile server_protection = MBEDTLS_TLS_SRTP_UNSET;
Ron Eldor591f1622018-01-22 12:30:04 +02001851 size_t i, mki_len = 0;
Johan Pascalb62bb512015-12-03 21:56:45 +01001852 uint16_t server_protection_profile_value = 0;
1853
1854 /* If use_srtp is not configured, just ignore the extension */
Ron Eldoref72faf2018-07-12 11:54:20 +03001855 if( ssl->conf->dtls_srtp_profile_list == NULL ||
1856 ssl->conf->dtls_srtp_profile_list_len == 0 )
Johan Pascalb62bb512015-12-03 21:56:45 +01001857 return( 0 );
1858
Ron Eldora9788042018-12-05 11:04:31 +02001859 /* RFC 5764 section 4.1.1
Johan Pascalb62bb512015-12-03 21:56:45 +01001860 * uint8 SRTPProtectionProfile[2];
1861 *
1862 * struct {
1863 * SRTPProtectionProfiles SRTPProtectionProfiles;
1864 * opaque srtp_mki<0..255>;
1865 * } UseSRTPData;
1866
1867 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
1868 *
Johan Pascalb62bb512015-12-03 21:56:45 +01001869 */
Johan Pascalf6417ec2020-09-22 15:15:19 +02001870 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED )
Ron Eldor591f1622018-01-22 12:30:04 +02001871 {
1872 mki_len = ssl->dtls_srtp_info.mki_len;
1873 }
Johan Pascalb62bb512015-12-03 21:56:45 +01001874
Ron Eldoref72faf2018-07-12 11:54:20 +03001875 /*
Johan Pascal76fdf1d2020-10-22 23:31:00 +02001876 * Length is 5 + optional mki_value : one protection profile length (2 bytes)
1877 * + protection profile (2 bytes)
1878 * + mki_len(1 byte)
Ron Eldor313d7b52018-12-10 14:56:21 +02001879 * and optional srtp_mki
Ron Eldoref72faf2018-07-12 11:54:20 +03001880 */
Johan Pascal76fdf1d2020-10-22 23:31:00 +02001881 if( len != ( buf[4] + 5u ) )
Johan Pascalb62bb512015-12-03 21:56:45 +01001882 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1883
1884 /*
1885 * get the server protection profile
1886 */
Ron Eldoref72faf2018-07-12 11:54:20 +03001887
1888 /*
1889 * protection profile length must be 0x0002 as we must have only
1890 * one protection profile in server Hello
1891 */
Ron Eldor089c9fe2018-12-06 17:12:49 +02001892 if( ( buf[0] != 0 ) || ( buf[1] != 2 ) )
Johan Pascalb62bb512015-12-03 21:56:45 +01001893 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Ron Eldor089c9fe2018-12-06 17:12:49 +02001894
1895 server_protection_profile_value = ( buf[2] << 8 ) | buf[3];
Johan Pascal43f94902020-09-22 12:25:52 +02001896 server_protection = mbedtls_ssl_check_srtp_profile_value(
1897 server_protection_profile_value );
1898 if( server_protection != MBEDTLS_TLS_SRTP_UNSET )
Ron Eldoref72faf2018-07-12 11:54:20 +03001899 {
Johan Pascal43f94902020-09-22 12:25:52 +02001900 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found srtp profile: %s",
1901 mbedtls_ssl_get_srtp_profile_as_string(
1902 server_protection ) ) );
Johan Pascalb62bb512015-12-03 21:56:45 +01001903 }
1904
Johan Pascal43f94902020-09-22 12:25:52 +02001905 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET;
Ron Eldor591f1622018-01-22 12:30:04 +02001906
Johan Pascalb62bb512015-12-03 21:56:45 +01001907 /*
1908 * Check we have the server profile in our list
1909 */
Ron Eldor3adb9922017-12-21 10:15:08 +02001910 for( i=0; i < ssl->conf->dtls_srtp_profile_list_len; i++)
Johan Pascalb62bb512015-12-03 21:56:45 +01001911 {
Ron Eldoref72faf2018-07-12 11:54:20 +03001912 if( server_protection == ssl->conf->dtls_srtp_profile_list[i] ) {
Ron Eldor3adb9922017-12-21 10:15:08 +02001913 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i];
Johan Pascal43f94902020-09-22 12:25:52 +02001914 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected srtp profile: %s",
1915 mbedtls_ssl_get_srtp_profile_as_string(
1916 server_protection ) ) );
Ron Eldor591f1622018-01-22 12:30:04 +02001917 break;
Johan Pascalb62bb512015-12-03 21:56:45 +01001918 }
1919 }
1920
Ron Eldor591f1622018-01-22 12:30:04 +02001921 /* If no match was found : server problem, it shall never answer with incompatible profile */
Johan Pascal43f94902020-09-22 12:25:52 +02001922 if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
Ron Eldor591f1622018-01-22 12:30:04 +02001923 {
1924 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Ron Eldoref72faf2018-07-12 11:54:20 +03001925 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Ron Eldor591f1622018-01-22 12:30:04 +02001926 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1927 }
Ron Eldoref72faf2018-07-12 11:54:20 +03001928 /*
1929 * RFC5764:
Ron Eldor591f1622018-01-22 12:30:04 +02001930 * If the client detects a nonzero-length MKI in the server's response
1931 * that is different than the one the client offered, then the client
1932 * MUST abort the handshake and SHOULD send an invalid_parameter alert.
1933 */
Ron Eldor313d7b52018-12-10 14:56:21 +02001934 if( len > 5 && ( buf[4] != mki_len ||
1935 ( memcmp( ssl->dtls_srtp_info.mki_value, &buf[5], mki_len ) ) ) )
Ron Eldor591f1622018-01-22 12:30:04 +02001936 {
1937 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1938 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1939 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1940 }
Ron Eldorb4655392018-07-05 18:25:39 +03001941#if defined (MBEDTLS_DEBUG_C)
Ron Eldoref72faf2018-07-12 11:54:20 +03001942 if( len > 5 )
Ron Eldorb4655392018-07-05 18:25:39 +03001943 {
Ron Eldora9788042018-12-05 11:04:31 +02001944 MBEDTLS_SSL_DEBUG_BUF( 3, "received mki", ssl->dtls_srtp_info.mki_value,
1945 ssl->dtls_srtp_info.mki_len );
Ron Eldorb4655392018-07-05 18:25:39 +03001946 }
1947#endif
Ron Eldora9788042018-12-05 11:04:31 +02001948 return( 0 );
Johan Pascalb62bb512015-12-03 21:56:45 +01001949}
1950#endif /* MBEDTLS_SSL_DTLS_SRTP */
1951
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001952/*
1953 * Parse HelloVerifyRequest. Only called after verifying the HS type.
1954 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001955#if defined(MBEDTLS_SSL_PROTO_DTLS)
1956static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001957{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001958 const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001959 int major_ver, minor_ver;
1960 unsigned char cookie_len;
1961
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001962 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001963
Gilles Peskineb64bf062019-09-27 14:02:44 +02001964 /* Check that there is enough room for:
1965 * - 2 bytes of version
1966 * - 1 byte of cookie_len
1967 */
1968 if( mbedtls_ssl_hs_hdr_len( ssl ) + 3 > ssl->in_msglen )
1969 {
1970 MBEDTLS_SSL_DEBUG_MSG( 1,
1971 ( "incoming HelloVerifyRequest message is too short" ) );
1972 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1973 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1974 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1975 }
1976
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001977 /*
1978 * struct {
1979 * ProtocolVersion server_version;
1980 * opaque cookie<0..2^8-1>;
1981 * } HelloVerifyRequest;
1982 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001983 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001984 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001985 p += 2;
1986
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02001987 /*
1988 * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
1989 * even is lower than our min version.
1990 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001991 if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
1992 minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ||
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001993 major_ver > ssl->conf->max_major_ver ||
1994 minor_ver > ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001995 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001996 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02001997
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001998 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1999 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002000
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002001 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002002 }
2003
2004 cookie_len = *p++;
Andres AG5a87c932016-09-26 14:53:05 +01002005 if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
2006 {
2007 MBEDTLS_SSL_DEBUG_MSG( 1,
2008 ( "cookie length does not match incoming message size" ) );
2009 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2010 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2011 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2012 }
Gilles Peskineb51130d2019-09-27 14:00:36 +02002013 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
Andres AG5a87c932016-09-26 14:53:05 +01002014
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002015 mbedtls_free( ssl->handshake->verify_cookie );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002016
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02002017 ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002018 if( ssl->handshake->verify_cookie == NULL )
2019 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02002020 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02002021 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002022 }
2023
2024 memcpy( ssl->handshake->verify_cookie, p, cookie_len );
2025 ssl->handshake->verify_cookie_len = cookie_len;
2026
Manuel Pégourié-Gonnard67427c02014-07-11 13:45:34 +02002027 /* Start over at ClientHello */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002028 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
2029 mbedtls_ssl_reset_checksum( ssl );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002030
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002031 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002032
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002033 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002034
2035 return( 0 );
2036}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002037#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002038
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002039static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002040{
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002041 int ret, i;
Paul Bakker23986e52011-04-24 08:57:21 +00002042 size_t n;
Manuel Pégourié-Gonnardf7cdbc02014-10-17 17:02:10 +02002043 size_t ext_len;
Paul Bakker48916f92012-09-16 19:57:18 +00002044 unsigned char *buf, *ext;
Manuel Pégourié-Gonnard1cf7b302015-06-24 22:28:19 +02002045 unsigned char comp;
2046#if defined(MBEDTLS_ZLIB_SUPPORT)
2047 int accept_comp;
2048#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002049#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00002050 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01002051#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002052 int handshake_failure = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002053 const mbedtls_ssl_ciphersuite_t *suite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00002054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002055 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002056
Hanno Becker327c93b2018-08-15 13:56:18 +01002057 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002058 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002059 /* No alert on a read error. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002060 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002061 return( ret );
2062 }
2063
Hanno Becker79594fd2019-05-08 09:38:41 +01002064 buf = ssl->in_msg;
2065
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002066 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002067 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002068#if defined(MBEDTLS_SSL_RENEGOTIATION)
2069 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +02002070 {
Manuel Pégourié-Gonnard44ade652014-08-19 13:58:40 +02002071 ssl->renego_records_seen++;
2072
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002073 if( ssl->conf->renego_max_records >= 0 &&
2074 ssl->renego_records_seen > ssl->conf->renego_max_records )
Manuel Pégourié-Gonnard44ade652014-08-19 13:58:40 +02002075 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002076 MBEDTLS_SSL_DEBUG_MSG( 1,
2077 ( "renegotiation requested, but not honored by server" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002078 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard44ade652014-08-19 13:58:40 +02002079 }
2080
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002081 MBEDTLS_SSL_DEBUG_MSG( 1,
2082 ( "non-handshake message during renegotiation" ) );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01002083
2084 ssl->keep_current_message = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002085 return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +02002086 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002087#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard65919622014-08-19 12:50:30 +02002088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002090 mbedtls_ssl_send_alert_message(
2091 ssl,
2092 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2093 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002094 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002095 }
2096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002097#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002098 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002099 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002100 if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002101 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002102 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
2103 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002104 return( ssl_parse_hello_verify_request( ssl ) );
2105 }
2106 else
2107 {
2108 /* We made it through the verification process */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002109 mbedtls_free( ssl->handshake->verify_cookie );
Manuel Pégourié-Gonnard74848812014-07-11 02:43:49 +02002110 ssl->handshake->verify_cookie = NULL;
2111 ssl->handshake->verify_cookie_len = 0;
2112 }
2113 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002114#endif /* MBEDTLS_SSL_PROTO_DTLS */
Paul Bakker5121ce52009-01-03 21:22:43 +00002115
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002116 if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) ||
2117 buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
Paul Bakker5121ce52009-01-03 21:22:43 +00002118 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002119 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002120 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2121 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002122 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker5121ce52009-01-03 21:22:43 +00002123 }
2124
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002125 /*
2126 * 0 . 1 server_version
2127 * 2 . 33 random (maybe including 4 bytes of Unix time)
2128 * 34 . 34 session_id length = n
2129 * 35 . 34+n session_id
2130 * 35+n . 36+n cipher_suite
2131 * 37+n . 37+n compression_method
2132 *
2133 * 38+n . 39+n extensions length (optional)
2134 * 40+n . .. extensions
2135 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002136 buf += mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002137
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002138 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
2139 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002140 ssl->conf->transport, buf + 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002141
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002142 if( ssl->major_ver < ssl->conf->min_major_ver ||
2143 ssl->minor_ver < ssl->conf->min_minor_ver ||
2144 ssl->major_ver > ssl->conf->max_major_ver ||
2145 ssl->minor_ver > ssl->conf->max_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00002146 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002147 MBEDTLS_SSL_DEBUG_MSG( 1,
2148 ( "server version out of bounds - min: [%d:%d], server: [%d:%d], max: [%d:%d]",
2149 ssl->conf->min_major_ver,
2150 ssl->conf->min_minor_ver,
2151 ssl->major_ver, ssl->minor_ver,
2152 ssl->conf->max_major_ver,
2153 ssl->conf->max_minor_ver ) );
Paul Bakker1d29fb52012-09-28 13:28:45 +00002154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002155 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2156 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00002157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002158 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00002159 }
2160
Andres Amaya Garcia6bce9cb2017-09-06 15:33:34 +01002161 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu",
2162 ( (uint32_t) buf[2] << 24 ) |
2163 ( (uint32_t) buf[3] << 16 ) |
2164 ( (uint32_t) buf[4] << 8 ) |
2165 ( (uint32_t) buf[5] ) ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002166
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002167 memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002168
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002169 n = buf[34];
Paul Bakker5121ce52009-01-03 21:22:43 +00002170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002171 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002172
Paul Bakker48916f92012-09-16 19:57:18 +00002173 if( n > 32 )
2174 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002175 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002176 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2177 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002178 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002179 }
2180
Manuel Pégourié-Gonnarda6e5bd52015-07-23 12:14:13 +02002181 if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
Paul Bakker5121ce52009-01-03 21:22:43 +00002182 {
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002183 ext_len = ( ( buf[38 + n] << 8 )
2184 | ( buf[39 + n] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002185
Paul Bakker48916f92012-09-16 19:57:18 +00002186 if( ( ext_len > 0 && ext_len < 4 ) ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002187 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
Paul Bakker48916f92012-09-16 19:57:18 +00002188 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002189 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002190 mbedtls_ssl_send_alert_message(
2191 ssl,
2192 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2193 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002194 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002195 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002196 }
Manuel Pégourié-Gonnarda6e5bd52015-07-23 12:14:13 +02002197 else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
Manuel Pégourié-Gonnardf7cdbc02014-10-17 17:02:10 +02002198 {
2199 ext_len = 0;
2200 }
2201 else
2202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002204 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2205 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002206 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Manuel Pégourié-Gonnardf7cdbc02014-10-17 17:02:10 +02002207 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002208
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002209 /* ciphersuite (used later) */
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002210 i = ( buf[35 + n] << 8 ) | buf[36 + n];
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002211
2212 /*
2213 * Read and check compression
2214 */
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002215 comp = buf[37 + n];
Paul Bakker5121ce52009-01-03 21:22:43 +00002216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002217#if defined(MBEDTLS_ZLIB_SUPPORT)
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002218 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002219#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002220 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002221 accept_comp = 0;
Manuel Pégourié-Gonnard1cf7b302015-06-24 22:28:19 +02002222 else
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002223#endif
Manuel Pégourié-Gonnard1cf7b302015-06-24 22:28:19 +02002224 accept_comp = 1;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002225
Manuel Pégourié-Gonnard1cf7b302015-06-24 22:28:19 +02002226 if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
2227 ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) )
2228#else /* MBEDTLS_ZLIB_SUPPORT */
2229 if( comp != MBEDTLS_SSL_COMPRESS_NULL )
2230#endif/* MBEDTLS_ZLIB_SUPPORT */
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002231 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002232 MBEDTLS_SSL_DEBUG_MSG( 1,
2233 ( "server hello, bad compression: %d", comp ) );
2234 mbedtls_ssl_send_alert_message(
2235 ssl,
2236 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2237 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002238 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02002239 }
2240
Paul Bakker380da532012-04-18 16:10:25 +00002241 /*
2242 * Initialize update checksum functions
2243 */
Hanno Beckere694c3e2017-12-27 21:34:08 +00002244 ssl->handshake->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
2245 if( ssl->handshake->ciphersuite_info == NULL )
Paul Bakker68884e32013-01-07 18:20:04 +01002246 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002247 MBEDTLS_SSL_DEBUG_MSG( 1,
2248 ( "ciphersuite info for %04x not found", i ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02002249 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2250 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002251 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker68884e32013-01-07 18:20:04 +01002252 }
Paul Bakker380da532012-04-18 16:10:25 +00002253
Hanno Beckere694c3e2017-12-27 21:34:08 +00002254 mbedtls_ssl_optimize_checksum( ssl, ssl->handshake->ciphersuite_info );
Manuel Pégourié-Gonnard3c599f12014-03-10 13:25:07 +01002255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002256 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2257 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00002258
2259 /*
2260 * Check if the session can be resumed
2261 */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002262 if( ssl->handshake->resume == 0 || n == 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002263#if defined(MBEDTLS_SSL_RENEGOTIATION)
2264 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002265#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002266 ssl->session_negotiate->ciphersuite != i ||
2267 ssl->session_negotiate->compression != comp ||
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002268 ssl->session_negotiate->id_len != n ||
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002269 memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002270 {
2271 ssl->state++;
Paul Bakker0a597072012-09-25 21:55:46 +00002272 ssl->handshake->resume = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002273#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002274 ssl->session_negotiate->start = mbedtls_time( NULL );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002275#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002276 ssl->session_negotiate->ciphersuite = i;
2277 ssl->session_negotiate->compression = comp;
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002278 ssl->session_negotiate->id_len = n;
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002279 memcpy( ssl->session_negotiate->id, buf + 35, n );
Paul Bakker5121ce52009-01-03 21:22:43 +00002280 }
2281 else
2282 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002283 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
Paul Bakkerff60ee62010-03-16 21:09:09 +00002284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002285 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00002286 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002287 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002288 mbedtls_ssl_send_alert_message(
2289 ssl,
2290 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2291 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Paul Bakkerff60ee62010-03-16 21:09:09 +00002292 return( ret );
2293 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002294 }
2295
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002296 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Paul Bakker0a597072012-09-25 21:55:46 +00002297 ssl->handshake->resume ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002298
Manuel Pégourié-Gonnard60884a12015-09-16 11:13:41 +02002299 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002300 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d",
2301 buf[37 + n] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002302
Andrzej Kurek03bac442018-04-25 05:06:07 -04002303 /*
2304 * Perform cipher suite validation in same way as in ssl_write_client_hello.
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +01002305 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002306 i = 0;
2307 while( 1 )
2308 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002309 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002310 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002311 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002312 mbedtls_ssl_send_alert_message(
2313 ssl,
2314 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2315 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002316 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker5121ce52009-01-03 21:22:43 +00002317 }
2318
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002319 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002320 ssl->session_negotiate->ciphersuite )
2321 {
Paul Bakker5121ce52009-01-03 21:22:43 +00002322 break;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002323 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002324 }
2325
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002326 suite_info = mbedtls_ssl_ciphersuite_from_id(
2327 ssl->session_negotiate->ciphersuite );
2328 if( ssl_validate_ciphersuite( suite_info, ssl, ssl->minor_ver,
2329 ssl->minor_ver ) != 0 )
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +01002330 {
2331 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002332 mbedtls_ssl_send_alert_message(
2333 ssl,
2334 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2335 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +01002336 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2337 }
2338
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002339 MBEDTLS_SSL_DEBUG_MSG( 3,
2340 ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
Mohammad Azim Khan1d3b5082018-04-18 19:35:00 +01002341
Gilles Peskineeccd8882020-03-10 12:19:08 +01002342#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardda19f4c2018-06-12 12:40:54 +02002343 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA &&
2344 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2345 {
2346 ssl->handshake->ecrs_enabled = 1;
2347 }
2348#endif
2349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002350 if( comp != MBEDTLS_SSL_COMPRESS_NULL
2351#if defined(MBEDTLS_ZLIB_SUPPORT)
2352 && comp != MBEDTLS_SSL_COMPRESS_DEFLATE
Paul Bakker2770fbd2012-07-03 13:30:23 +00002353#endif
2354 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002355 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002356 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002357 mbedtls_ssl_send_alert_message(
2358 ssl,
2359 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2360 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002361 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker5121ce52009-01-03 21:22:43 +00002362 }
Paul Bakker48916f92012-09-16 19:57:18 +00002363 ssl->session_negotiate->compression = comp;
Paul Bakker5121ce52009-01-03 21:22:43 +00002364
Manuel Pégourié-Gonnard0b3400d2014-09-10 21:23:41 +02002365 ext = buf + 40 + n;
Paul Bakker48916f92012-09-16 19:57:18 +00002366
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002367 MBEDTLS_SSL_DEBUG_MSG( 2,
2368 ( "server hello, total extension length: %d", ext_len ) );
Manuel Pégourié-Gonnarda0528492013-07-16 17:26:28 +02002369
Paul Bakker48916f92012-09-16 19:57:18 +00002370 while( ext_len )
2371 {
2372 unsigned int ext_id = ( ( ext[0] << 8 )
2373 | ( ext[1] ) );
2374 unsigned int ext_size = ( ( ext[2] << 8 )
2375 | ( ext[3] ) );
2376
2377 if( ext_size + 4 > ext_len )
2378 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002379 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002380 mbedtls_ssl_send_alert_message(
2381 ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2382 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002383 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002384 }
2385
2386 switch( ext_id )
2387 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002388 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
2389 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
2390#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00002391 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01002392#endif
Paul Bakker48916f92012-09-16 19:57:18 +00002393
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02002394 if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
2395 ext_size ) ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00002396 return( ret );
2397
2398 break;
2399
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002400#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2401 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002402 MBEDTLS_SSL_DEBUG_MSG( 3,
2403 ( "found max_fragment_length extension" ) );
Manuel Pégourié-Gonnardde600e52013-07-17 10:14:38 +02002404
2405 if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
2406 ext + 4, ext_size ) ) != 0 )
2407 {
2408 return( ret );
2409 }
2410
2411 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002412#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnardde600e52013-07-17 10:14:38 +02002413
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002414#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
2415 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
2416 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002417
2418 if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
2419 ext + 4, ext_size ) ) != 0 )
2420 {
2421 return( ret );
2422 }
2423
2424 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002425#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002426
Hanno Beckera0e20d02019-05-15 14:03:01 +01002427#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckera8373a12019-04-26 15:37:26 +01002428 case MBEDTLS_TLS_EXT_CID:
2429 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) );
2430
2431 if( ( ret = ssl_parse_cid_ext( ssl,
2432 ext + 4,
2433 ext_size ) ) != 0 )
2434 {
2435 return( ret );
2436 }
2437
2438 break;
Hanno Beckera0e20d02019-05-15 14:03:01 +01002439#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckera8373a12019-04-26 15:37:26 +01002440
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002441#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2442 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
2443 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002444
2445 if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
2446 ext + 4, ext_size ) ) != 0 )
2447 {
2448 return( ret );
2449 }
2450
2451 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002452#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002453
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002454#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2455 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002456 MBEDTLS_SSL_DEBUG_MSG( 3,
2457 ( "found extended_master_secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002458
2459 if( ( ret = ssl_parse_extended_ms_ext( ssl,
2460 ext + 4, ext_size ) ) != 0 )
2461 {
2462 return( ret );
2463 }
2464
2465 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002466#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002468#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2469 case MBEDTLS_TLS_EXT_SESSION_TICKET:
2470 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02002471
2472 if( ( ret = ssl_parse_session_ticket_ext( ssl,
2473 ext + 4, ext_size ) ) != 0 )
2474 {
2475 return( ret );
2476 }
2477
2478 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002479#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard60182ef2013-08-02 14:44:54 +02002480
Robert Cragie136884c2015-10-02 13:34:31 +01002481#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01002482 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002483 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002484 MBEDTLS_SSL_DEBUG_MSG( 3,
2485 ( "found supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002486
2487 if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
2488 ext + 4, ext_size ) ) != 0 )
2489 {
2490 return( ret );
2491 }
2492
2493 break;
Robert Cragieae8535d2015-10-06 17:11:18 +01002494#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
2495 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002496
Manuel Pégourié-Gonnard0a1324a2015-09-16 16:01:00 +02002497#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2498 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
2499 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
2500
2501 if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
2502 ext + 4, ext_size ) ) != 0 )
2503 {
2504 return( ret );
2505 }
2506
2507 break;
2508#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002510#if defined(MBEDTLS_SSL_ALPN)
2511 case MBEDTLS_TLS_EXT_ALPN:
2512 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002513
Johan Pascal76fdf1d2020-10-22 23:31:00 +02002514 if ( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2515 {
2516 if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
2517 return( ret );
2518 }
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002519
2520 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002521#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard0b874dc2014-04-07 10:57:45 +02002522
Johan Pascalb62bb512015-12-03 21:56:45 +01002523#if defined(MBEDTLS_SSL_DTLS_SRTP)
2524 case MBEDTLS_TLS_EXT_USE_SRTP:
2525 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found use_srtp extension" ) );
2526
2527 if( ( ret = ssl_parse_use_srtp_ext( ssl, ext + 4, ext_size ) ) != 0 )
2528 return( ret );
2529
2530 break;
2531#endif /* MBEDTLS_SSL_DTLS_SRTP */
2532
Paul Bakker48916f92012-09-16 19:57:18 +00002533 default:
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002534 MBEDTLS_SSL_DEBUG_MSG( 3,
2535 ( "unknown extension found: %d (ignoring)", ext_id ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002536 }
2537
2538 ext_len -= 4 + ext_size;
2539 ext += 4 + ext_size;
2540
2541 if( ext_len > 0 && ext_len < 4 )
2542 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002543 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2544 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002545 }
2546 }
2547
2548 /*
2549 * Renegotiation security checks
2550 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002551 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002552 ssl->conf->allow_legacy_renegotiation ==
2553 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakker48916f92012-09-16 19:57:18 +00002554 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002555 MBEDTLS_SSL_DEBUG_MSG( 1,
2556 ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002557 handshake_failure = 1;
2558 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002559#if defined(MBEDTLS_SSL_RENEGOTIATION)
2560 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2561 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakker48916f92012-09-16 19:57:18 +00002562 renegotiation_info_seen == 0 )
2563 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002564 MBEDTLS_SSL_DEBUG_MSG( 1,
2565 ( "renegotiation_info extension missing (secure)" ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002566 handshake_failure = 1;
2567 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002568 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2569 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002570 ssl->conf->allow_legacy_renegotiation ==
2571 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00002572 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002573 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002574 handshake_failure = 1;
2575 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002576 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2577 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002578 renegotiation_info_seen == 1 )
2579 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002580 MBEDTLS_SSL_DEBUG_MSG( 1,
2581 ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002582 handshake_failure = 1;
2583 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002584#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002585
2586 if( handshake_failure == 1 )
2587 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002588 mbedtls_ssl_send_alert_message(
2589 ssl,
2590 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2591 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002592 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002593 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002594
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002595 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002596
2597 return( 0 );
2598}
2599
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002600#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2601 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002602static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl,
2603 unsigned char **p,
Paul Bakker29e1f122013-04-16 13:07:56 +02002604 unsigned char *end )
2605{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002606 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker29e1f122013-04-16 13:07:56 +02002607
Paul Bakker29e1f122013-04-16 13:07:56 +02002608 /*
2609 * Ephemeral DH parameters:
2610 *
2611 * struct {
2612 * opaque dh_p<1..2^16-1>;
2613 * opaque dh_g<1..2^16-1>;
2614 * opaque dh_Ys<1..2^16-1>;
2615 * } ServerDHParams;
2616 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002617 if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx,
2618 p, end ) ) != 0 )
Paul Bakker29e1f122013-04-16 13:07:56 +02002619 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002620 MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
Paul Bakker29e1f122013-04-16 13:07:56 +02002621 return( ret );
2622 }
2623
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002624 if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
Paul Bakker29e1f122013-04-16 13:07:56 +02002625 {
Manuel Pégourié-Gonnardbd990d62015-06-11 14:49:42 +02002626 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
2627 ssl->handshake->dhm_ctx.len * 8,
2628 ssl->conf->dhm_min_bitlen ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002629 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker29e1f122013-04-16 13:07:56 +02002630 }
2631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002632 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2633 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2634 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker29e1f122013-04-16 13:07:56 +02002635
2636 return( ret );
2637}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002638#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2639 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker29e1f122013-04-16 13:07:56 +02002640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002641#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2642 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2643 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
2644 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2645 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2646static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002647{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002648 const mbedtls_ecp_curve_info *curve_info;
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002649 mbedtls_ecp_group_id grp_id;
2650#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
2651 grp_id = ssl->handshake->ecdh_ctx.grp.id;
2652#else
2653 grp_id = ssl->handshake->ecdh_ctx.grp_id;
2654#endif
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002655
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002656 curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002657 if( curve_info == NULL )
2658 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002659 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2660 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002661 }
2662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002663 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002664
Manuel Pégourié-Gonnardb541da62015-06-17 11:43:30 +02002665#if defined(MBEDTLS_ECP_C)
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002666 if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01002667#else
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002668 if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
2669 ssl->handshake->ecdh_ctx.grp.nbits > 521 )
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01002670#endif
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002671 return( -1 );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002672
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05002673 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2674 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002675
2676 return( 0 );
2677}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002678#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2679 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2680 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
2681 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2682 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002683
Hanno Beckerbb89e272019-01-08 12:54:37 +00002684#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
2685 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2686 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) )
2687static int ssl_parse_server_ecdh_params_psa( mbedtls_ssl_context *ssl,
2688 unsigned char **p,
2689 unsigned char *end )
2690{
2691 uint16_t tls_id;
Gilles Peskine42459802019-12-19 13:31:53 +01002692 size_t ecdh_bits = 0;
Hanno Beckerbb89e272019-01-08 12:54:37 +00002693 uint8_t ecpoint_len;
2694 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2695
2696 /*
2697 * Parse ECC group
2698 */
2699
2700 if( end - *p < 4 )
2701 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2702
2703 /* First byte is curve_type; only named_curve is handled */
2704 if( *(*p)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
2705 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2706
2707 /* Next two bytes are the namedcurve value */
2708 tls_id = *(*p)++;
2709 tls_id <<= 8;
2710 tls_id |= *(*p)++;
2711
2712 /* Convert EC group to PSA key type. */
Gilles Peskine42459802019-12-19 13:31:53 +01002713 if( ( handshake->ecdh_psa_type =
2714 mbedtls_psa_parse_tls_ecc_group( tls_id, &ecdh_bits ) ) == 0 )
Hanno Beckerbb89e272019-01-08 12:54:37 +00002715 {
2716 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2717 }
Gilles Peskine42459802019-12-19 13:31:53 +01002718 if( ecdh_bits > 0xffff )
2719 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2720 handshake->ecdh_bits = (uint16_t) ecdh_bits;
Hanno Beckerbb89e272019-01-08 12:54:37 +00002721
2722 /*
2723 * Put peer's ECDH public key in the format understood by PSA.
2724 */
2725
2726 ecpoint_len = *(*p)++;
2727 if( (size_t)( end - *p ) < ecpoint_len )
2728 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2729
Gilles Peskine42459802019-12-19 13:31:53 +01002730 if( mbedtls_psa_tls_ecpoint_to_psa_ec(
Hanno Beckerbb89e272019-01-08 12:54:37 +00002731 *p, ecpoint_len,
2732 handshake->ecdh_psa_peerkey,
2733 sizeof( handshake->ecdh_psa_peerkey ),
2734 &handshake->ecdh_psa_peerkey_len ) != 0 )
2735 {
2736 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
2737 }
2738
2739 *p += ecpoint_len;
2740 return( 0 );
2741}
2742#endif /* MBEDTLS_USE_PSA_CRYPTO &&
2743 ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2744 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ) */
2745
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002746#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2747 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2748 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2749static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
Paul Bakker29e1f122013-04-16 13:07:56 +02002750 unsigned char **p,
2751 unsigned char *end )
2752{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002753 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker29e1f122013-04-16 13:07:56 +02002754
Paul Bakker29e1f122013-04-16 13:07:56 +02002755 /*
2756 * Ephemeral ECDH parameters:
2757 *
2758 * struct {
2759 * ECParameters curve_params;
2760 * ECPoint public;
2761 * } ServerECDHParams;
2762 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002763 if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
Paul Bakker29e1f122013-04-16 13:07:56 +02002764 (const unsigned char **) p, end ) ) != 0 )
2765 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002766 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
Gilles Peskineeccd8882020-03-10 12:19:08 +01002767#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard1c1c20e2018-09-12 10:34:43 +02002768 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2769 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02002770#endif
Paul Bakker29e1f122013-04-16 13:07:56 +02002771 return( ret );
2772 }
2773
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002774 if( ssl_check_server_ecdh_params( ssl ) != 0 )
Paul Bakker29e1f122013-04-16 13:07:56 +02002775 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002776 MBEDTLS_SSL_DEBUG_MSG( 1,
2777 ( "bad server key exchange message (ECDHE curve)" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002778 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker29e1f122013-04-16 13:07:56 +02002779 }
2780
Paul Bakker29e1f122013-04-16 13:07:56 +02002781 return( ret );
2782}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002783#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2784 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2785 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker29e1f122013-04-16 13:07:56 +02002786
Gilles Peskineeccd8882020-03-10 12:19:08 +01002787#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002788static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002789 unsigned char **p,
2790 unsigned char *end )
2791{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002792 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
irwir6527bd62019-09-21 18:51:25 +03002793 uint16_t len;
Paul Bakkerc5a79cc2013-06-26 15:08:35 +02002794 ((void) ssl);
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002795
2796 /*
2797 * PSK parameters:
2798 *
2799 * opaque psk_identity_hint<0..2^16-1>;
2800 */
Hanno Becker0c161d12018-10-08 13:40:50 +01002801 if( end - (*p) < 2 )
Krzysztof Stachowiak740b2182018-03-13 11:31:14 +01002802 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002803 MBEDTLS_SSL_DEBUG_MSG( 1,
2804 ( "bad server key exchange message (psk_identity_hint length)" ) );
Krzysztof Stachowiak740b2182018-03-13 11:31:14 +01002805 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2806 }
Manuel Pégourié-Gonnard59b9fe22013-10-15 11:55:33 +02002807 len = (*p)[0] << 8 | (*p)[1];
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002808 *p += 2;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002809
irwir6527bd62019-09-21 18:51:25 +03002810 if( end - (*p) < len )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002811 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002812 MBEDTLS_SSL_DEBUG_MSG( 1,
2813 ( "bad server key exchange message (psk_identity_hint length)" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002814 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002815 }
2816
Manuel Pégourié-Gonnard9d624122016-02-22 11:10:14 +01002817 /*
2818 * Note: we currently ignore the PKS identity hint, as we only allow one
2819 * PSK to be provisionned on the client. This could be changed later if
2820 * someone needs that feature.
2821 */
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002822 *p += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002823 ret = 0;
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002824
2825 return( ret );
2826}
Gilles Peskineeccd8882020-03-10 12:19:08 +01002827#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02002828
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002829#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
2830 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002831/*
2832 * Generate a pre-master secret and encrypt it with the server's RSA key
2833 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002834static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002835 size_t offset, size_t *olen,
2836 size_t pms_offset )
2837{
Janos Follath865b3eb2019-12-16 11:46:15 +00002838 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002839 size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002840 unsigned char *p = ssl->handshake->premaster + pms_offset;
Hanno Beckerc7d7e292019-02-06 16:49:54 +00002841 mbedtls_pk_context * peer_pk;
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002842
Angus Grattond8213d02016-05-25 20:56:48 +10002843 if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02002844 {
2845 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
2846 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2847 }
2848
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002849 /*
2850 * Generate (part of) the pre-master as
2851 * struct {
2852 * ProtocolVersion client_version;
2853 * opaque random[46];
2854 * } PreMasterSecret;
2855 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002856 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
2857 ssl->conf->max_minor_ver,
2858 ssl->conf->transport, p );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002859
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002860 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002861 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002862 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002863 return( ret );
2864 }
2865
2866 ssl->handshake->pmslen = 48;
2867
Hanno Beckerc7d7e292019-02-06 16:49:54 +00002868#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2869 peer_pk = &ssl->handshake->peer_pubkey;
2870#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02002871 if( ssl->session_negotiate->peer_cert == NULL )
2872 {
Hanno Becker8273df82019-02-06 17:37:32 +00002873 /* Should never happen */
Hanno Becker62d58ed2019-02-26 11:51:06 +00002874 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker8273df82019-02-06 17:37:32 +00002875 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02002876 }
Hanno Beckerc7d7e292019-02-06 16:49:54 +00002877 peer_pk = &ssl->session_negotiate->peer_cert->pk;
2878#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02002879
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002880 /*
2881 * Now write it out, encrypted
2882 */
Hanno Beckerc7d7e292019-02-06 16:49:54 +00002883 if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_RSA ) )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
2886 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002887 }
2888
Hanno Beckerc7d7e292019-02-06 16:49:54 +00002889 if( ( ret = mbedtls_pk_encrypt( peer_pk,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002890 p, ssl->handshake->pmslen,
2891 ssl->out_msg + offset + len_bytes, olen,
Angus Grattond8213d02016-05-25 20:56:48 +10002892 MBEDTLS_SSL_OUT_CONTENT_LEN - offset - len_bytes,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002893 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002894 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002895 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002896 return( ret );
2897 }
2898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002899#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2900 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002901 if( len_bytes == 2 )
2902 {
2903 ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
2904 ssl->out_msg[offset+1] = (unsigned char)( *olen );
2905 *olen += 2;
2906 }
2907#endif
2908
Hanno Beckerae553dd2019-02-08 14:06:00 +00002909#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2910 /* We don't need the peer's public key anymore. Free it. */
2911 mbedtls_pk_free( peer_pk );
2912#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002913 return( 0 );
2914}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002915#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
2916 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker29e1f122013-04-16 13:07:56 +02002917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002918#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard5c2a7ca2015-10-23 08:48:41 +02002919#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2920 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2921 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002922static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
Paul Bakker29e1f122013-04-16 13:07:56 +02002923 unsigned char **p,
2924 unsigned char *end,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002925 mbedtls_md_type_t *md_alg,
2926 mbedtls_pk_type_t *pk_alg )
Paul Bakker29e1f122013-04-16 13:07:56 +02002927{
Paul Bakkerc5a79cc2013-06-26 15:08:35 +02002928 ((void) ssl);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002929 *md_alg = MBEDTLS_MD_NONE;
2930 *pk_alg = MBEDTLS_PK_NONE;
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02002931
2932 /* Only in TLS 1.2 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002933 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02002934 {
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02002935 return( 0 );
2936 }
Paul Bakker29e1f122013-04-16 13:07:56 +02002937
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002938 if( (*p) + 2 > end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002939 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker29e1f122013-04-16 13:07:56 +02002940
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02002941 /*
2942 * Get hash algorithm
2943 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002944 if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) )
2945 == MBEDTLS_MD_NONE )
Paul Bakker29e1f122013-04-16 13:07:56 +02002946 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002947 MBEDTLS_SSL_DEBUG_MSG( 1,
2948 ( "Server used unsupported HashAlgorithm %d", *(p)[0] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002949 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker29e1f122013-04-16 13:07:56 +02002950 }
2951
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02002952 /*
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02002953 * Get signature algorithm
2954 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002955 if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) )
2956 == MBEDTLS_PK_NONE )
Paul Bakker29e1f122013-04-16 13:07:56 +02002957 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002958 MBEDTLS_SSL_DEBUG_MSG( 1,
2959 ( "server used unsupported SignatureAlgorithm %d", (*p)[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002960 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker29e1f122013-04-16 13:07:56 +02002961 }
2962
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02002963 /*
2964 * Check if the hash is acceptable
2965 */
2966 if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
2967 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002968 MBEDTLS_SSL_DEBUG_MSG( 1,
2969 ( "server used HashAlgorithm %d that was not offered", *(p)[0] ) );
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +02002970 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2971 }
2972
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01002973 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d",
2974 (*p)[1] ) );
2975 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d",
2976 (*p)[0] ) );
Paul Bakker29e1f122013-04-16 13:07:56 +02002977 *p += 2;
2978
2979 return( 0 );
2980}
Manuel Pégourié-Gonnard5c2a7ca2015-10-23 08:48:41 +02002981#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2982 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2983 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002984#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker29e1f122013-04-16 13:07:56 +02002985
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002986#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2987 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2988static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002989{
Janos Follath865b3eb2019-12-16 11:46:15 +00002990 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002991 const mbedtls_ecp_keypair *peer_key;
Hanno Beckerbe7f5082019-02-06 17:44:07 +00002992 mbedtls_pk_context * peer_pk;
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01002993
Hanno Beckerbe7f5082019-02-06 17:44:07 +00002994#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2995 peer_pk = &ssl->handshake->peer_pubkey;
2996#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02002997 if( ssl->session_negotiate->peer_cert == NULL )
2998 {
Hanno Becker8273df82019-02-06 17:37:32 +00002999 /* Should never happen */
Hanno Beckerbd5580a2019-02-26 12:36:01 +00003000 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker8273df82019-02-06 17:37:32 +00003001 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02003002 }
Hanno Beckerbe7f5082019-02-06 17:44:07 +00003003 peer_pk = &ssl->session_negotiate->peer_cert->pk;
3004#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02003005
Hanno Beckerbe7f5082019-02-06 17:44:07 +00003006 if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003007 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003008 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
3009 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003010 }
3011
Hanno Beckerbe7f5082019-02-06 17:44:07 +00003012 peer_key = mbedtls_pk_ec( *peer_pk );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003014 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
3015 MBEDTLS_ECDH_THEIRS ) ) != 0 )
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003016 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003017 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003018 return( ret );
3019 }
3020
3021 if( ssl_check_server_ecdh_params( ssl ) != 0 )
3022 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003023 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
3024 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003025 }
3026
Hanno Beckerae553dd2019-02-08 14:06:00 +00003027#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3028 /* We don't need the peer's public key anymore. Free it,
3029 * so that more RAM is available for upcoming expensive
3030 * operations like ECDHE. */
3031 mbedtls_pk_free( peer_pk );
3032#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3033
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003034 return( ret );
3035}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003036#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
3037 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003038
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003039static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker41c83d32013-03-20 14:39:14 +01003040{
Janos Follath865b3eb2019-12-16 11:46:15 +00003041 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003042 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00003043 ssl->handshake->ciphersuite_info;
Andres Amaya Garcia53c77cc2017-06-27 16:15:06 +01003044 unsigned char *p = NULL, *end = NULL;
Paul Bakker5121ce52009-01-03 21:22:43 +00003045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003046 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003047
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003048#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3049 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003050 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003052 ssl->state++;
3053 return( 0 );
3054 }
Manuel Pégourié-Gonnardbac0e3b2013-10-15 11:54:47 +02003055 ((void) p);
3056 ((void) end);
3057#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00003058
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003059#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3060 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3061 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3062 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003063 {
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01003064 if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
3065 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003066 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003067 mbedtls_ssl_send_alert_message(
3068 ssl,
3069 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3070 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnardab240102014-02-04 16:18:07 +01003071 return( ret );
3072 }
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003073
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003074 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003075 ssl->state++;
3076 return( 0 );
3077 }
3078 ((void) p);
3079 ((void) end);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003080#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3081 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnardd18cc572013-12-11 17:45:46 +01003082
Gilles Peskineeccd8882020-03-10 12:19:08 +01003083#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003084 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02003085 ssl->handshake->ecrs_state == ssl_ecrs_ske_start_processing )
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003086 {
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02003087 goto start_processing;
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003088 }
Manuel Pégourié-Gonnard1f1f2a12017-05-18 11:27:06 +02003089#endif
3090
Hanno Becker327c93b2018-08-15 13:56:18 +01003091 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003092 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003093 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003094 return( ret );
3095 }
3096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003097 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003098 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003099 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003100 mbedtls_ssl_send_alert_message(
3101 ssl,
3102 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3103 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003104 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003105 }
3106
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02003107 /*
3108 * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
3109 * doesn't use a psk_identity_hint
3110 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003111 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003113 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3114 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Paul Bakker188c8de2013-04-19 09:13:37 +02003115 {
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003116 /* Current message is probably either
3117 * CertificateRequest or ServerHelloDone */
3118 ssl->keep_current_message = 1;
Paul Bakker188c8de2013-04-19 09:13:37 +02003119 goto exit;
3120 }
3121
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003122 MBEDTLS_SSL_DEBUG_MSG( 1,
3123 ( "server key exchange message must not be skipped" ) );
3124 mbedtls_ssl_send_alert_message(
3125 ssl,
3126 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3127 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003129 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003130 }
3131
Gilles Peskineeccd8882020-03-10 12:19:08 +01003132#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02003133 if( ssl->handshake->ecrs_enabled )
3134 ssl->handshake->ecrs_state = ssl_ecrs_ske_start_processing;
3135
3136start_processing:
3137#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003138 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker3b6a07b2013-03-21 11:56:50 +01003139 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003140 MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
Paul Bakker3b6a07b2013-03-21 11:56:50 +01003141
Gilles Peskineeccd8882020-03-10 12:19:08 +01003142#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003143 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3144 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3145 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3146 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02003147 {
3148 if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
3149 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003150 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003151 mbedtls_ssl_send_alert_message(
3152 ssl,
3153 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3154 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003155 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02003156 }
3157 } /* FALLTROUGH */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003158#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02003159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003160#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
3161 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3162 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3163 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02003164 ; /* nothing more to do */
3165 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003166#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
3167 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3168#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3169 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3170 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
3171 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00003172 {
Paul Bakker29e1f122013-04-16 13:07:56 +02003173 if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003174 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003175 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003176 mbedtls_ssl_send_alert_message(
3177 ssl,
3178 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3179 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003180 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003181 }
3182 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003183 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003184#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3185 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Hanno Beckerbb89e272019-01-08 12:54:37 +00003186#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
3187 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3188 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) )
3189 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3190 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
3191 {
3192 if( ssl_parse_server_ecdh_params_psa( ssl, &p, end ) != 0 )
3193 {
3194 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003195 mbedtls_ssl_send_alert_message(
3196 ssl,
3197 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3198 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Hanno Beckerbb89e272019-01-08 12:54:37 +00003199 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3200 }
3201 }
3202 else
3203#endif /* MBEDTLS_USE_PSA_CRYPTO &&
3204 ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3205 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003206#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3207 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
3208 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3209 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3210 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3211 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003212 {
3213 if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
3214 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003215 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003216 mbedtls_ssl_send_alert_message(
3217 ssl,
3218 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3219 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003220 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker41c83d32013-03-20 14:39:14 +01003221 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003222 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003223 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003224#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3225 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
3226 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003227#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3228 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3229 {
3230 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
3231 p, end - p );
3232 if( ret != 0 )
3233 {
3234 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003235 mbedtls_ssl_send_alert_message(
3236 ssl,
3237 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3238 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003239 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3240 }
3241 }
3242 else
3243#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003244 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003245 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3246 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003247 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003248
Gilles Peskineeccd8882020-03-10 12:19:08 +01003249#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003250 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003251 {
Manuel Pégourié-Gonnardd92d6a12014-09-10 15:25:02 +00003252 size_t sig_len, hashlen;
3253 unsigned char hash[64];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003254 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
3255 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
3256 unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnardd92d6a12014-09-10 15:25:02 +00003257 size_t params_len = p - params;
Manuel Pégourié-Gonnard1f1f2a12017-05-18 11:27:06 +02003258 void *rs_ctx = NULL;
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003259
Hanno Beckera6899bb2019-02-06 18:26:03 +00003260 mbedtls_pk_context * peer_pk;
3261
Paul Bakker29e1f122013-04-16 13:07:56 +02003262 /*
3263 * Handle the digitally-signed structure
3264 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003265#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3266 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003267 {
Paul Bakker9659dae2013-08-28 16:21:34 +02003268 if( ssl_parse_signature_algorithm( ssl, &p, end,
3269 &md_alg, &pk_alg ) != 0 )
3270 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003271 MBEDTLS_SSL_DEBUG_MSG( 1,
3272 ( "bad server key exchange message" ) );
3273 mbedtls_ssl_send_alert_message(
3274 ssl,
3275 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3276 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003277 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker9659dae2013-08-28 16:21:34 +02003278 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003279
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003280 if( pk_alg !=
3281 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003282 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003283 MBEDTLS_SSL_DEBUG_MSG( 1,
3284 ( "bad server key exchange message" ) );
3285 mbedtls_ssl_send_alert_message(
3286 ssl,
3287 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3288 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003289 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker1ef83d62012-04-11 12:09:53 +00003290 }
3291 }
Manuel Pégourié-Gonnard09edda82013-08-19 13:50:33 +02003292 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003293#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3294#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3295 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3296 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard09edda82013-08-19 13:50:33 +02003297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003298 pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Paul Bakker1ef83d62012-04-11 12:09:53 +00003299
Paul Bakker9659dae2013-08-28 16:21:34 +02003300 /* Default hash for ECDSA is SHA-1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003301 if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
3302 md_alg = MBEDTLS_MD_SHA1;
Paul Bakker9659dae2013-08-28 16:21:34 +02003303 }
3304 else
3305#endif
3306 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003307 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3308 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker9659dae2013-08-28 16:21:34 +02003309 }
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003310
3311 /*
3312 * Read signature
3313 */
Krzysztof Stachowiaka1098f82018-03-13 11:28:49 +01003314
3315 if( p > end - 2 )
3316 {
3317 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003318 mbedtls_ssl_send_alert_message(
3319 ssl,
3320 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3321 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Krzysztof Stachowiaka1098f82018-03-13 11:28:49 +01003322 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3323 }
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003324 sig_len = ( p[0] << 8 ) | p[1];
Paul Bakker1ef83d62012-04-11 12:09:53 +00003325 p += 2;
Paul Bakker1ef83d62012-04-11 12:09:53 +00003326
Krzysztof Stachowiak027f84c2018-03-13 11:29:24 +01003327 if( p != end - sig_len )
Paul Bakker41c83d32013-03-20 14:39:14 +01003328 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003329 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003330 mbedtls_ssl_send_alert_message(
3331 ssl,
3332 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3333 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003334 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Paul Bakker41c83d32013-03-20 14:39:14 +01003335 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003337 MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02003338
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003339 /*
3340 * Compute the hash that has been signed
3341 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003342#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3343 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3344 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakkerc3f177a2012-04-11 16:11:49 +00003345 {
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003346 hashlen = 36;
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003347 ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash, params,
3348 params_len );
3349 if( ret != 0 )
Andres Amaya Garciaf0e521e2017-06-28 12:11:42 +01003350 return( ret );
Paul Bakker29e1f122013-04-16 13:07:56 +02003351 }
3352 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003353#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3354 MBEDTLS_SSL_PROTO_TLS1_1 */
3355#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3356 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3357 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker29e1f122013-04-16 13:07:56 +02003358 {
Gilles Peskineca1d7422018-04-24 11:53:22 +02003359 ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
3360 params, params_len,
3361 md_alg );
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003362 if( ret != 0 )
Paul Bakker29e1f122013-04-16 13:07:56 +02003363 return( ret );
Paul Bakker29e1f122013-04-16 13:07:56 +02003364 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003365 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003366#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3367 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker29e1f122013-04-16 13:07:56 +02003368 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003369 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3370 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003371 }
Paul Bakker29e1f122013-04-16 13:07:56 +02003372
Gilles Peskineca1d7422018-04-24 11:53:22 +02003373 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
Paul Bakker29e1f122013-04-16 13:07:56 +02003374
Hanno Beckera6899bb2019-02-06 18:26:03 +00003375#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3376 peer_pk = &ssl->handshake->peer_pubkey;
3377#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02003378 if( ssl->session_negotiate->peer_cert == NULL )
3379 {
Hanno Becker8273df82019-02-06 17:37:32 +00003380 /* Should never happen */
Hanno Beckerbd5580a2019-02-26 12:36:01 +00003381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker8273df82019-02-06 17:37:32 +00003382 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02003383 }
Hanno Beckera6899bb2019-02-06 18:26:03 +00003384 peer_pk = &ssl->session_negotiate->peer_cert->pk;
3385#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Manuel Pégourié-Gonnard7f2f0622015-09-03 10:44:32 +02003386
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003387 /*
3388 * Verify signature
3389 */
Hanno Beckera6899bb2019-02-06 18:26:03 +00003390 if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003391 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003392 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003393 mbedtls_ssl_send_alert_message(
3394 ssl,
3395 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3396 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003397 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003398 }
3399
Gilles Peskineeccd8882020-03-10 12:19:08 +01003400#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003401 if( ssl->handshake->ecrs_enabled )
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +02003402 rs_ctx = &ssl->handshake->ecrs_ctx.pk;
Manuel Pégourié-Gonnard1f1f2a12017-05-18 11:27:06 +02003403#endif
3404
Hanno Beckera6899bb2019-02-06 18:26:03 +00003405 if( ( ret = mbedtls_pk_verify_restartable( peer_pk,
Manuel Pégourié-Gonnard1f1f2a12017-05-18 11:27:06 +02003406 md_alg, hash, hashlen, p, sig_len, rs_ctx ) ) != 0 )
Manuel Pégourié-Gonnardefebb0a2013-08-19 12:06:38 +02003407 {
Gilles Peskineeccd8882020-03-10 12:19:08 +01003408#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard1f1f2a12017-05-18 11:27:06 +02003409 if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
3410#endif
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003411 mbedtls_ssl_send_alert_message(
3412 ssl,
3413 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3414 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003415 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Gilles Peskineeccd8882020-03-10 12:19:08 +01003416#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02003417 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3418 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3419#endif
Paul Bakkerc70b9822013-04-07 22:00:46 +02003420 return( ret );
Paul Bakkerc3f177a2012-04-11 16:11:49 +00003421 }
Hanno Beckerae553dd2019-02-08 14:06:00 +00003422
3423#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3424 /* We don't need the peer's public key anymore. Free it,
3425 * so that more RAM is available for upcoming expensive
3426 * operations like ECDHE. */
3427 mbedtls_pk_free( peer_pk );
3428#endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
Paul Bakker5121ce52009-01-03 21:22:43 +00003429 }
Gilles Peskineeccd8882020-03-10 12:19:08 +01003430#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003431
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003432exit:
Paul Bakker5121ce52009-01-03 21:22:43 +00003433 ssl->state++;
3434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003435 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003436
3437 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003438}
3439
Gilles Peskineeccd8882020-03-10 12:19:08 +01003440#if ! defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003441static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003442{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003443 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00003444 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003445
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003446 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003447
Hanno Becker1aa267c2017-04-28 17:08:27 +01003448 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003449 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003450 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003451 ssl->state++;
3452 return( 0 );
3453 }
3454
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003455 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3456 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003457}
Gilles Peskineeccd8882020-03-10 12:19:08 +01003458#else /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003459static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003460{
Janos Follath865b3eb2019-12-16 11:46:15 +00003461 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003462 unsigned char *buf;
3463 size_t n = 0;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003464 size_t cert_type_len = 0, dn_len = 0;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003465 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00003466 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003468 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003469
Hanno Becker1aa267c2017-04-28 17:08:27 +01003470 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003471 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003472 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01003473 ssl->state++;
3474 return( 0 );
3475 }
3476
Hanno Becker327c93b2018-08-15 13:56:18 +01003477 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003478 {
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003479 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3480 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003481 }
3482
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003483 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3484 {
3485 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003486 mbedtls_ssl_send_alert_message(
3487 ssl,
3488 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3489 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003490 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3491 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003492
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003493 ssl->state++;
3494 ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST );
Paul Bakker5121ce52009-01-03 21:22:43 +00003495
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003496 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
Paul Bakker5121ce52009-01-03 21:22:43 +00003497 ssl->client_auth ? "a" : "no" ) );
3498
Paul Bakker926af752012-11-23 13:38:07 +01003499 if( ssl->client_auth == 0 )
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003500 {
Johan Pascala89ca862020-08-25 10:03:19 +02003501 /* Current message is probably the ServerHelloDone */
3502 ssl->keep_current_message = 1;
Paul Bakker926af752012-11-23 13:38:07 +01003503 goto exit;
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003504 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003505
Manuel Pégourié-Gonnard04c1b4e2014-09-10 19:25:43 +02003506 /*
3507 * struct {
3508 * ClientCertificateType certificate_types<1..2^8-1>;
3509 * SignatureAndHashAlgorithm
3510 * supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
3511 * DistinguishedName certificate_authorities<0..2^16-1>;
3512 * } CertificateRequest;
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003513 *
3514 * Since we only support a single certificate on clients, let's just
3515 * ignore all the information that's supposed to help us pick a
3516 * certificate.
3517 *
3518 * We could check that our certificate matches the request, and bail out
3519 * if it doesn't, but it's simpler to just send the certificate anyway,
3520 * and give the server the opportunity to decide if it should terminate
3521 * the connection when it doesn't like our certificate.
3522 *
3523 * Same goes for the hash in TLS 1.2's signature_algorithms: at this
3524 * point we only have one hash available (see comments in
Simon Butcherc0957bd2016-03-01 13:16:57 +00003525 * write_certificate_verify), so let's just use what we have.
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003526 *
3527 * However, we still minimally parse the message to check it is at least
3528 * superficially sane.
Manuel Pégourié-Gonnard04c1b4e2014-09-10 19:25:43 +02003529 */
Paul Bakker926af752012-11-23 13:38:07 +01003530 buf = ssl->in_msg;
Paul Bakkerf7abd422013-04-16 13:15:56 +02003531
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003532 /* certificate_types */
Krzysztof Stachowiak73b183c2018-04-05 10:20:09 +02003533 if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) )
3534 {
3535 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
3536 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3537 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3538 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
3539 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003540 cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
Paul Bakker926af752012-11-23 13:38:07 +01003541 n = cert_type_len;
3542
Krzysztof Stachowiakbc145f72018-03-20 11:19:50 +01003543 /*
Krzysztof Stachowiak94d49972018-04-05 14:48:55 +02003544 * In the subsequent code there are two paths that read from buf:
Krzysztof Stachowiakbc145f72018-03-20 11:19:50 +01003545 * * the length of the signature algorithms field (if minor version of
3546 * SSL is 3),
3547 * * distinguished name length otherwise.
3548 * Both reach at most the index:
3549 * ...hdr_len + 2 + n,
3550 * therefore the buffer length at this point must be greater than that
3551 * regardless of the actual code path.
3552 */
3553 if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
Paul Bakker926af752012-11-23 13:38:07 +01003554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02003556 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3557 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003558 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
Paul Bakker926af752012-11-23 13:38:07 +01003559 }
3560
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003561 /* supported_signature_algorithms */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003562#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3563 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01003564 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003565 size_t sig_alg_len =
3566 ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
3567 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
Simon Butcher99000142016-10-13 17:21:01 +01003568#if defined(MBEDTLS_DEBUG_C)
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003569 unsigned char* sig_alg;
Simon Butcher99000142016-10-13 17:21:01 +01003570 size_t i;
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003571#endif
Simon Butcher99000142016-10-13 17:21:01 +01003572
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003573 /*
Krzysztof Stachowiak94d49972018-04-05 14:48:55 +02003574 * The furthest access in buf is in the loop few lines below:
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003575 * sig_alg[i + 1],
3576 * where:
3577 * sig_alg = buf + ...hdr_len + 3 + n,
3578 * max(i) = sig_alg_len - 1.
Krzysztof Stachowiak94d49972018-04-05 14:48:55 +02003579 * Therefore the furthest access is:
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003580 * buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
3581 * which reduces to:
3582 * buf[...hdr_len + 3 + n + sig_alg_len],
3583 * which is one less than we need the buf to be.
3584 */
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003585 if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl )
3586 + 3 + n + sig_alg_len )
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003587 {
3588 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003589 mbedtls_ssl_send_alert_message(
3590 ssl,
3591 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3592 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Krzysztof Stachowiakbc231cc2018-03-20 14:09:53 +01003593 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
3594 }
3595
3596#if defined(MBEDTLS_DEBUG_C)
3597 sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
Simon Butcher99000142016-10-13 17:21:01 +01003598 for( i = 0; i < sig_alg_len; i += 2 )
3599 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003600 MBEDTLS_SSL_DEBUG_MSG( 3,
3601 ( "Supported Signature Algorithm found: %d,%d",
3602 sig_alg[i], sig_alg[i + 1] ) );
Simon Butcher99000142016-10-13 17:21:01 +01003603 }
3604#endif
Paul Bakker926af752012-11-23 13:38:07 +01003605
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003606 n += 2 + sig_alg_len;
Paul Bakkerf7abd422013-04-16 13:15:56 +02003607 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003608#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker926af752012-11-23 13:38:07 +01003609
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003610 /* certificate_authorities */
3611 dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
3612 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
Paul Bakker926af752012-11-23 13:38:07 +01003613
3614 n += dn_len;
Manuel Pégourié-Gonnardd1b7f2b2016-02-24 14:13:22 +00003615 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
Paul Bakker926af752012-11-23 13:38:07 +01003616 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003617 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02003618 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3619 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003620 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
Paul Bakker926af752012-11-23 13:38:07 +01003621 }
3622
3623exit:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003624 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003625
3626 return( 0 );
3627}
Gilles Peskineeccd8882020-03-10 12:19:08 +01003628#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003630static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003631{
Janos Follath865b3eb2019-12-16 11:46:15 +00003632 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00003633
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003634 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003635
Hanno Becker327c93b2018-08-15 13:56:18 +01003636 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003637 {
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003638 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3639 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003640 }
Hanno Beckeraf0665d2017-05-24 09:16:26 +01003641
3642 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3643 {
3644 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
3645 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3646 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003648 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ||
3649 ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003650 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003651 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02003652 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3653 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003654 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003655 }
3656
3657 ssl->state++;
3658
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003659#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003660 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003661 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003662#endif
3663
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003664 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003665
3666 return( 0 );
3667}
3668
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003669static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003670{
Janos Follath865b3eb2019-12-16 11:46:15 +00003671 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003672
3673 size_t header_len;
3674 size_t content_len;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003675 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00003676 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003678 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003679
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003680#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3681 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003682 {
Paul Bakker5121ce52009-01-03 21:22:43 +00003683 /*
3684 * DHM key exchange -- send G^X mod P
3685 */
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003686 content_len = ssl->handshake->dhm_ctx.len;
Paul Bakker5121ce52009-01-03 21:22:43 +00003687
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003688 ssl->out_msg[4] = (unsigned char)( content_len >> 8 );
3689 ssl->out_msg[5] = (unsigned char)( content_len );
3690 header_len = 6;
Paul Bakker5121ce52009-01-03 21:22:43 +00003691
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003692 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003693 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3694 &ssl->out_msg[header_len], content_len,
3695 ssl->conf->f_rng, ssl->conf->p_rng );
Paul Bakker5121ce52009-01-03 21:22:43 +00003696 if( ret != 0 )
3697 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003698 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003699 return( ret );
3700 }
3701
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003702 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
3703 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker5121ce52009-01-03 21:22:43 +00003704
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003705 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003706 ssl->handshake->premaster,
3707 MBEDTLS_PREMASTER_SIZE,
3708 &ssl->handshake->pmslen,
3709 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003710 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003711 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003712 return( ret );
3713 }
3714
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003715 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker5121ce52009-01-03 21:22:43 +00003716 }
3717 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003718#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Hanno Becker4a63ed42019-01-08 11:39:35 +00003719#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
3720 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3721 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) )
3722 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3723 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
3724 {
3725 psa_status_t status;
Janos Follath53b8ec22019-08-08 10:28:27 +01003726 psa_key_attributes_t key_attributes;
Hanno Becker4a63ed42019-01-08 11:39:35 +00003727
3728 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3729
3730 unsigned char own_pubkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH];
3731 size_t own_pubkey_len;
3732 unsigned char *own_pubkey_ecpoint;
3733 size_t own_pubkey_ecpoint_len;
3734
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003735 header_len = 4;
Hanno Becker4a63ed42019-01-08 11:39:35 +00003736
Hanno Becker0a94a642019-01-11 14:35:30 +00003737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Perform PSA-based ECDH computation." ) );
3738
Hanno Becker4a63ed42019-01-08 11:39:35 +00003739 /*
3740 * Generate EC private key for ECDHE exchange.
3741 */
3742
Hanno Becker4a63ed42019-01-08 11:39:35 +00003743 /* The master secret is obtained from the shared ECDH secret by
3744 * applying the TLS 1.2 PRF with a specific salt and label. While
3745 * the PSA Crypto API encourages combining key agreement schemes
3746 * such as ECDH with fixed KDFs such as TLS 1.2 PRF, it does not
3747 * yet support the provisioning of salt + label to the KDF.
3748 * For the time being, we therefore need to split the computation
3749 * of the ECDH secret and the application of the TLS 1.2 PRF. */
Janos Follath53b8ec22019-08-08 10:28:27 +01003750 key_attributes = psa_key_attributes_init();
3751 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
Janos Follathdf3b0892019-08-08 11:12:24 +01003752 psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH );
Gilles Peskine42459802019-12-19 13:31:53 +01003753 psa_set_key_type( &key_attributes, handshake->ecdh_psa_type );
3754 psa_set_key_bits( &key_attributes, handshake->ecdh_bits );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003755
3756 /* Generate ECDH private key. */
Janos Follath53b8ec22019-08-08 10:28:27 +01003757 status = psa_generate_key( &key_attributes,
Janos Follathdf3b0892019-08-08 11:12:24 +01003758 &handshake->ecdh_psa_privkey );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003759 if( status != PSA_SUCCESS )
3760 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3761
3762 /* Export the public part of the ECDH private key from PSA
3763 * and convert it to ECPoint format used in ClientKeyExchange. */
3764 status = psa_export_public_key( handshake->ecdh_psa_privkey,
3765 own_pubkey, sizeof( own_pubkey ),
3766 &own_pubkey_len );
3767 if( status != PSA_SUCCESS )
3768 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3769
3770 if( mbedtls_psa_tls_psa_ec_to_ecpoint( own_pubkey,
3771 own_pubkey_len,
3772 &own_pubkey_ecpoint,
3773 &own_pubkey_ecpoint_len ) != 0 )
3774 {
3775 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3776 }
3777
3778 /* Copy ECPoint structure to outgoing message buffer. */
Andrzej Kurekade9e282019-05-07 08:19:33 -04003779 ssl->out_msg[header_len] = (unsigned char) own_pubkey_ecpoint_len;
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003780 memcpy( ssl->out_msg + header_len + 1,
3781 own_pubkey_ecpoint, own_pubkey_ecpoint_len );
3782 content_len = own_pubkey_ecpoint_len + 1;
Hanno Becker4a63ed42019-01-08 11:39:35 +00003783
Hanno Becker4a63ed42019-01-08 11:39:35 +00003784 /* The ECDH secret is the premaster secret used for key derivation. */
3785
Janos Follathdf3b0892019-08-08 11:12:24 +01003786 /* Compute ECDH shared secret. */
3787 status = psa_raw_key_agreement( PSA_ALG_ECDH,
3788 handshake->ecdh_psa_privkey,
3789 handshake->ecdh_psa_peerkey,
3790 handshake->ecdh_psa_peerkey_len,
3791 ssl->handshake->premaster,
3792 sizeof( ssl->handshake->premaster ),
3793 &ssl->handshake->pmslen );
Hanno Becker4a63ed42019-01-08 11:39:35 +00003794 if( status != PSA_SUCCESS )
3795 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3796
3797 status = psa_destroy_key( handshake->ecdh_psa_privkey );
3798 if( status != PSA_SUCCESS )
3799 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3800 handshake->ecdh_psa_privkey = 0;
3801 }
3802 else
3803#endif /* MBEDTLS_USE_PSA_CRYPTO &&
3804 ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3805 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003806#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3807 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3808 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3809 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3810 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3811 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3812 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3813 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01003814 {
3815 /*
3816 * ECDH key exchange -- send client public value
3817 */
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003818 header_len = 4;
Paul Bakker41c83d32013-03-20 14:39:14 +01003819
Gilles Peskineeccd8882020-03-10 12:19:08 +01003820#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003821 if( ssl->handshake->ecrs_enabled )
3822 {
Manuel Pégourié-Gonnardc37423f2018-10-16 10:28:17 +02003823 if( ssl->handshake->ecrs_state == ssl_ecrs_cke_ecdh_calc_secret )
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003824 goto ecdh_calc_secret;
Manuel Pégourié-Gonnard23e41622017-05-18 12:35:37 +02003825
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003826 mbedtls_ecdh_enable_restart( &ssl->handshake->ecdh_ctx );
3827 }
Manuel Pégourié-Gonnard2350b4e2017-05-16 09:26:48 +02003828#endif
3829
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003830 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003831 &content_len,
3832 &ssl->out_msg[header_len], 1000,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003833 ssl->conf->f_rng, ssl->conf->p_rng );
Paul Bakker41c83d32013-03-20 14:39:14 +01003834 if( ret != 0 )
3835 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003836 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
Gilles Peskineeccd8882020-03-10 12:19:08 +01003837#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02003838 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3839 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3840#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01003841 return( ret );
3842 }
3843
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003844 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3845 MBEDTLS_DEBUG_ECDH_Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01003846
Gilles Peskineeccd8882020-03-10 12:19:08 +01003847#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003848 if( ssl->handshake->ecrs_enabled )
3849 {
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003850 ssl->handshake->ecrs_n = content_len;
Manuel Pégourié-Gonnardc37423f2018-10-16 10:28:17 +02003851 ssl->handshake->ecrs_state = ssl_ecrs_cke_ecdh_calc_secret;
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003852 }
Manuel Pégourié-Gonnard2350b4e2017-05-16 09:26:48 +02003853
3854ecdh_calc_secret:
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02003855 if( ssl->handshake->ecrs_enabled )
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003856 content_len = ssl->handshake->ecrs_n;
Manuel Pégourié-Gonnard2350b4e2017-05-16 09:26:48 +02003857#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003858 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003859 &ssl->handshake->pmslen,
3860 ssl->handshake->premaster,
3861 MBEDTLS_MPI_MAX_SIZE,
3862 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003863 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003864 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Gilles Peskineeccd8882020-03-10 12:19:08 +01003865#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02003866 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3867 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3868#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01003869 return( ret );
3870 }
3871
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003872 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3873 MBEDTLS_DEBUG_ECDH_Z );
Paul Bakker41c83d32013-03-20 14:39:14 +01003874 }
3875 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003876#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3877 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3878 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3879 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Gilles Peskineeccd8882020-03-10 12:19:08 +01003880#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003881 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003882 {
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003883 /*
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003884 * opaque psk_identity<0..2^16-1>;
3885 */
Hanno Becker520224e2018-10-26 11:38:07 +01003886 if( ssl_conf_has_static_psk( ssl->conf ) == 0 )
Manuel Pégourié-Gonnardb4b19f32015-07-07 11:41:21 +02003887 {
Hanno Becker2e4f6162018-10-23 11:54:44 +01003888 /* We don't offer PSK suites if we don't have a PSK,
3889 * and we check that the server's choice is among the
3890 * ciphersuites we offered, so this should never happen. */
3891 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb4b19f32015-07-07 11:41:21 +02003892 }
Paul Bakkerd4a56ec2013-04-16 18:05:29 +02003893
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003894 header_len = 4;
3895 content_len = ssl->conf->psk_identity_len;
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003896
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003897 if( header_len + 2 + content_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003898 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003899 MBEDTLS_SSL_DEBUG_MSG( 1,
3900 ( "psk identity too long or SSL buffer too short" ) );
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003901 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3902 }
3903
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003904 ssl->out_msg[header_len++] = (unsigned char)( content_len >> 8 );
3905 ssl->out_msg[header_len++] = (unsigned char)( content_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003906
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003907 memcpy( ssl->out_msg + header_len,
3908 ssl->conf->psk_identity,
3909 ssl->conf->psk_identity_len );
3910 header_len += ssl->conf->psk_identity_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003911
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003912#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3913 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003914 {
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003915 content_len = 0;
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003916 }
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003917 else
3918#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003919#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3920 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003921 {
Hanno Beckerdfab8e22018-10-23 11:59:34 +01003922#if defined(MBEDTLS_USE_PSA_CRYPTO)
3923 /* Opaque PSKs are currently only supported for PSK-only suites. */
Hanno Becker520224e2018-10-26 11:38:07 +01003924 if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
Hanno Beckerdfab8e22018-10-23 11:59:34 +01003925 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3926#endif /* MBEDTLS_USE_PSA_CRYPTO */
3927
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003928 if( ( ret = ssl_write_encrypted_pms( ssl, header_len,
3929 &content_len, 2 ) ) != 0 )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003930 return( ret );
3931 }
3932 else
3933#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003934#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3935 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003936 {
Hanno Beckerdfab8e22018-10-23 11:59:34 +01003937#if defined(MBEDTLS_USE_PSA_CRYPTO)
3938 /* Opaque PSKs are currently only supported for PSK-only suites. */
Hanno Becker520224e2018-10-26 11:38:07 +01003939 if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
Hanno Beckerdfab8e22018-10-23 11:59:34 +01003940 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3941#endif /* MBEDTLS_USE_PSA_CRYPTO */
3942
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003943 /*
3944 * ClientDiffieHellmanPublic public (DHM send G^X mod P)
3945 */
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003946 content_len = ssl->handshake->dhm_ctx.len;
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003947
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003948 if( header_len + 2 + content_len >
3949 MBEDTLS_SSL_OUT_CONTENT_LEN )
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003950 {
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01003951 MBEDTLS_SSL_DEBUG_MSG( 1,
3952 ( "psk identity or DHM size too long or SSL buffer too short" ) );
Manuel Pégourié-Gonnardc6b5d832015-08-27 16:37:35 +02003953 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3954 }
3955
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003956 ssl->out_msg[header_len++] = (unsigned char)( content_len >> 8 );
3957 ssl->out_msg[header_len++] = (unsigned char)( content_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003958
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003959 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
3960 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003961 &ssl->out_msg[header_len], content_len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003962 ssl->conf->f_rng, ssl->conf->p_rng );
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003963 if( ret != 0 )
3964 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003965 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003966 return( ret );
3967 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003968 }
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003969 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003970#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3971#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3972 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003973 {
Hanno Beckerdfab8e22018-10-23 11:59:34 +01003974#if defined(MBEDTLS_USE_PSA_CRYPTO)
3975 /* Opaque PSKs are currently only supported for PSK-only suites. */
Hanno Becker520224e2018-10-26 11:38:07 +01003976 if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
Hanno Beckerdfab8e22018-10-23 11:59:34 +01003977 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3978#endif /* MBEDTLS_USE_PSA_CRYPTO */
3979
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003980 /*
3981 * ClientECDiffieHellmanPublic public;
3982 */
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00003983 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
3984 &content_len,
3985 &ssl->out_msg[header_len],
3986 MBEDTLS_SSL_OUT_CONTENT_LEN - header_len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003987 ssl->conf->f_rng, ssl->conf->p_rng );
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003988 if( ret != 0 )
3989 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003990 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003991 return( ret );
3992 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003993
Andrzej Kurekc470b6b2019-01-31 08:20:20 -05003994 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3995 MBEDTLS_DEBUG_ECDH_Q );
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003996 }
3997 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003998#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Manuel Pégourié-Gonnard72fb62d2013-10-14 14:01:58 +02003999 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004000 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4001 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004002 }
4003
Hanno Beckerafd311e2018-10-23 15:26:40 +01004004#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
4005 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
4006 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
4007 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
Hanno Becker520224e2018-10-26 11:38:07 +01004008 ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
Hanno Beckerafd311e2018-10-23 15:26:40 +01004009 {
Ronald Cron5ee57072020-06-11 09:34:06 +02004010 MBEDTLS_SSL_DEBUG_MSG( 1,
4011 ( "skip PMS generation for opaque PSK" ) );
Hanno Beckerafd311e2018-10-23 15:26:40 +01004012 }
4013 else
4014#endif /* MBEDTLS_USE_PSA_CRYPTO &&
4015 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004016 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004017 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004018 {
Ronald Cron5ee57072020-06-11 09:34:06 +02004019 MBEDTLS_SSL_DEBUG_RET( 1,
4020 "mbedtls_ssl_psk_derive_premaster", ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004021 return( ret );
4022 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004023 }
4024 else
Gilles Peskineeccd8882020-03-10 12:19:08 +01004025#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004026#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
4027 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00004028 {
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00004029 header_len = 4;
4030 if( ( ret = ssl_write_encrypted_pms( ssl, header_len,
4031 &content_len, 0 ) ) != 0 )
Paul Bakkera3d195c2011-11-27 21:07:34 +00004032 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004033 }
Paul Bakkered27a042013-04-18 22:46:23 +02004034 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004035#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004036#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4037 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
4038 {
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00004039 header_len = 4;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004040
4041 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00004042 ssl->out_msg + header_len,
4043 MBEDTLS_SSL_OUT_CONTENT_LEN - header_len,
4044 &content_len,
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004045 ssl->conf->f_rng, ssl->conf->p_rng );
4046 if( ret != 0 )
4047 {
4048 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
4049 return( ret );
4050 }
4051
4052 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
4053 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
4054 ssl->conf->f_rng, ssl->conf->p_rng );
4055 if( ret != 0 )
4056 {
4057 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
4058 return( ret );
4059 }
4060 }
4061 else
4062#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Paul Bakkered27a042013-04-18 22:46:23 +02004063 {
4064 ((void) ciphersuite_info);
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004065 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4066 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakkered27a042013-04-18 22:46:23 +02004067 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004068
Hanno Beckerc14a3bb2019-01-14 09:41:16 +00004069 ssl->out_msglen = header_len + content_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004070 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4071 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00004072
4073 ssl->state++;
4074
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004075 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004076 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004077 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004078 return( ret );
4079 }
4080
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004081 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004082
4083 return( 0 );
4084}
4085
Gilles Peskineeccd8882020-03-10 12:19:08 +01004086#if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004087static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004088{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004089 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00004090 ssl->handshake->ciphersuite_info;
Janos Follath865b3eb2019-12-16 11:46:15 +00004091 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Paul Bakker5121ce52009-01-03 21:22:43 +00004092
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004093 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004094
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004095 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +02004096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004097 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +02004098 return( ret );
4099 }
4100
Hanno Becker77adddc2019-02-07 12:32:43 +00004101 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakkered27a042013-04-18 22:46:23 +02004102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004103 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02004104 ssl->state++;
4105 return( 0 );
4106 }
4107
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004108 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4109 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004110}
Gilles Peskineeccd8882020-03-10 12:19:08 +01004111#else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004112static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004113{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004114 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004115 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Beckere694c3e2017-12-27 21:34:08 +00004116 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004117 size_t n = 0, offset = 0;
4118 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004119 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004120 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02004121 size_t hashlen;
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004122 void *rs_ctx = NULL;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004123
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004124 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004125
Gilles Peskineeccd8882020-03-10 12:19:08 +01004126#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02004127 if( ssl->handshake->ecrs_enabled &&
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02004128 ssl->handshake->ecrs_state == ssl_ecrs_crt_vrfy_sign )
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02004129 {
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02004130 goto sign;
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02004131 }
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004132#endif
4133
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004134 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +02004135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004136 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Manuel Pégourié-Gonnardada30302014-10-20 20:33:10 +02004137 return( ret );
4138 }
4139
Hanno Becker77adddc2019-02-07 12:32:43 +00004140 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004142 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004143 ssl->state++;
4144 return( 0 );
4145 }
4146
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004147 if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004148 {
Johan Pascala89ca862020-08-25 10:03:19 +02004149 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
4150 ssl->state++;
4151 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00004152 }
4153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004154 if( mbedtls_ssl_own_key( ssl ) == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00004155 {
Manuel Pégourié-Gonnardb4b19f32015-07-07 11:41:21 +02004156 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004157 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker5121ce52009-01-03 21:22:43 +00004158 }
4159
4160 /*
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02004161 * Make a signature of the handshake digests
Paul Bakker5121ce52009-01-03 21:22:43 +00004162 */
Gilles Peskineeccd8882020-03-10 12:19:08 +01004163#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard0b23f162017-08-24 12:08:33 +02004164 if( ssl->handshake->ecrs_enabled )
4165 ssl->handshake->ecrs_state = ssl_ecrs_crt_vrfy_sign;
4166
4167sign:
4168#endif
4169
Manuel Pégourié-Gonnardde718b92019-05-03 11:43:28 +02004170 ssl->handshake->calc_verify( ssl, hash, &hashlen );
Paul Bakker5121ce52009-01-03 21:22:43 +00004171
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004172#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
4173 defined(MBEDTLS_SSL_PROTO_TLS1_1)
4174 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker1ef83d62012-04-11 12:09:53 +00004175 {
Paul Bakker926af752012-11-23 13:38:07 +01004176 /*
4177 * digitally-signed struct {
4178 * opaque md5_hash[16];
4179 * opaque sha_hash[20];
4180 * };
4181 *
4182 * md5_hash
4183 * MD5(handshake_messages);
4184 *
4185 * sha_hash
4186 * SHA(handshake_messages);
4187 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004188 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004189
4190 /*
4191 * For ECDSA, default hash is SHA-1 only
4192 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004193 if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004194 {
4195 hash_start += 16;
4196 hashlen -= 16;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004197 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004198 }
Paul Bakker926af752012-11-23 13:38:07 +01004199 }
4200 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004201#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
4202 MBEDTLS_SSL_PROTO_TLS1_1 */
4203#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4204 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01004205 {
4206 /*
4207 * digitally-signed struct {
4208 * opaque handshake_messages[handshake_messages_length];
4209 * };
4210 *
4211 * Taking shortcut here. We assume that the server always allows the
4212 * PRF Hash function and has sent it in the allowed signature
4213 * algorithms list received in the Certificate Request message.
4214 *
4215 * Until we encounter a server that does not, we will take this
4216 * shortcut.
4217 *
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01004218 * Reason: Otherwise we should have running hashes for SHA512 and
4219 * SHA224 in order to satisfy 'weird' needs from the server
4220 * side.
Paul Bakker926af752012-11-23 13:38:07 +01004221 */
Hanno Beckere694c3e2017-12-27 21:34:08 +00004222 if( ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
Paul Bakkerca4ab492012-04-18 14:23:57 +00004223 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004224 md_alg = MBEDTLS_MD_SHA384;
4225 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
Paul Bakkerca4ab492012-04-18 14:23:57 +00004226 }
4227 else
4228 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004229 md_alg = MBEDTLS_MD_SHA256;
4230 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
Paul Bakkerca4ab492012-04-18 14:23:57 +00004231 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004232 ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
Paul Bakker1ef83d62012-04-11 12:09:53 +00004233
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02004234 /* Info from md_alg will be used instead */
4235 hashlen = 0;
Paul Bakker1ef83d62012-04-11 12:09:53 +00004236 offset = 2;
4237 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02004238 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004239#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02004240 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004241 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4242 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02004243 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00004244
Gilles Peskineeccd8882020-03-10 12:19:08 +01004245#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnardd27d1a52017-08-15 11:49:08 +02004246 if( ssl->handshake->ecrs_enabled )
Manuel Pégourié-Gonnard15d7df22017-08-17 14:33:31 +02004247 rs_ctx = &ssl->handshake->ecrs_ctx.pk;
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004248#endif
4249
4250 if( ( ret = mbedtls_pk_sign_restartable( mbedtls_ssl_own_key( ssl ),
4251 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004252 ssl->out_msg + 6 + offset, &n,
Manuel Pégourié-Gonnard862cde52017-05-17 11:56:15 +02004253 ssl->conf->f_rng, ssl->conf->p_rng, rs_ctx ) ) != 0 )
Manuel Pégourié-Gonnard76c18a12013-08-20 16:50:40 +02004254 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004255 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Gilles Peskineeccd8882020-03-10 12:19:08 +01004256#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
Manuel Pégourié-Gonnard558da9c2018-06-13 12:02:12 +02004257 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
4258 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
4259#endif
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02004260 return( ret );
Manuel Pégourié-Gonnard76c18a12013-08-20 16:50:40 +02004261 }
Paul Bakker926af752012-11-23 13:38:07 +01004262
Paul Bakker1ef83d62012-04-11 12:09:53 +00004263 ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
4264 ssl->out_msg[5 + offset] = (unsigned char)( n );
Paul Bakker5121ce52009-01-03 21:22:43 +00004265
Paul Bakker1ef83d62012-04-11 12:09:53 +00004266 ssl->out_msglen = 6 + n + offset;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004267 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4268 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
Paul Bakker5121ce52009-01-03 21:22:43 +00004269
4270 ssl->state++;
4271
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004272 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004273 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004274 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004275 return( ret );
4276 }
4277
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004278 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004279
Paul Bakkered27a042013-04-18 22:46:23 +02004280 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004281}
Gilles Peskineeccd8882020-03-10 12:19:08 +01004282#endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00004283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004284#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4285static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004286{
Janos Follath865b3eb2019-12-16 11:46:15 +00004287 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004288 uint32_t lifetime;
4289 size_t ticket_len;
4290 unsigned char *ticket;
Manuel Pégourié-Gonnard000d5ae2014-09-10 21:52:12 +02004291 const unsigned char *msg;
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004293 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004294
Hanno Becker327c93b2018-08-15 13:56:18 +01004295 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004296 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004297 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004298 return( ret );
4299 }
4300
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004301 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004302 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004303 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
Hanno Beckerb2fff6d2017-05-08 11:06:19 +01004304 mbedtls_ssl_send_alert_message(
4305 ssl,
4306 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4307 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004308 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004309 }
4310
4311 /*
4312 * struct {
4313 * uint32 ticket_lifetime_hint;
4314 * opaque ticket<0..2^16-1>;
4315 * } NewSessionTicket;
4316 *
Manuel Pégourié-Gonnard000d5ae2014-09-10 21:52:12 +02004317 * 0 . 3 ticket_lifetime_hint
4318 * 4 . 5 ticket_len (n)
4319 * 6 . 5+n ticket content
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004320 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004321 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ||
4322 ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004323 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004324 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004325 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4326 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004327 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004328 }
4329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004330 msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004331
Philippe Antoineb5b25432018-05-11 11:06:29 +02004332 lifetime = ( ((uint32_t) msg[0]) << 24 ) | ( msg[1] << 16 ) |
4333 ( msg[2] << 8 ) | ( msg[3] );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004334
Manuel Pégourié-Gonnard000d5ae2014-09-10 21:52:12 +02004335 ticket_len = ( msg[4] << 8 ) | ( msg[5] );
4336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004337 if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004338 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004339 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004340 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4341 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004342 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004343 }
4344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004345 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004346
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02004347 /* We're not waiting for a NewSessionTicket message any more */
4348 ssl->handshake->new_session_ticket = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004349 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02004350
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004351 /*
4352 * Zero-length ticket means the server changed his mind and doesn't want
4353 * to send a ticket after all, so just forget it
4354 */
Paul Bakker66d5d072014-06-17 16:39:18 +02004355 if( ticket_len == 0 )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004356 return( 0 );
4357
Hanno Beckerb2964cb2019-01-30 14:46:35 +00004358 if( ssl->session != NULL && ssl->session->ticket != NULL )
4359 {
4360 mbedtls_platform_zeroize( ssl->session->ticket,
4361 ssl->session->ticket_len );
4362 mbedtls_free( ssl->session->ticket );
4363 ssl->session->ticket = NULL;
4364 ssl->session->ticket_len = 0;
4365 }
4366
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -05004367 mbedtls_platform_zeroize( ssl->session_negotiate->ticket,
4368 ssl->session_negotiate->ticket_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004369 mbedtls_free( ssl->session_negotiate->ticket );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004370 ssl->session_negotiate->ticket = NULL;
4371 ssl->session_negotiate->ticket_len = 0;
4372
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +02004373 if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004374 {
Manuel Pégourié-Gonnardb2a18a22015-05-27 16:29:56 +02004375 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02004376 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4377 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +02004378 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004379 }
4380
Manuel Pégourié-Gonnard000d5ae2014-09-10 21:52:12 +02004381 memcpy( ticket, msg + 6, ticket_len );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004382
4383 ssl->session_negotiate->ticket = ticket;
4384 ssl->session_negotiate->ticket_len = ticket_len;
4385 ssl->session_negotiate->ticket_lifetime = lifetime;
4386
4387 /*
4388 * RFC 5077 section 3.4:
4389 * "If the client receives a session ticket from the server, then it
4390 * discards any Session ID that was sent in the ServerHello."
4391 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004392 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02004393 ssl->session_negotiate->id_len = 0;
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004394
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004395 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004396
4397 return( 0 );
4398}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004399#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004400
Paul Bakker5121ce52009-01-03 21:22:43 +00004401/*
Paul Bakker1961b702013-01-25 14:49:24 +01004402 * SSL handshake -- client side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00004403 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004404int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004405{
4406 int ret = 0;
4407
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02004408 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004409 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004410
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004411 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01004412
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004413 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01004414 return( ret );
4415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004416#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02004417 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004418 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004419 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004420 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004421 return( ret );
4422 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01004423#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004424
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004425 /* Change state now, so that it is right in mbedtls_ssl_read_record(), used
Manuel Pégourié-Gonnardcd32a502014-09-20 13:54:12 +02004426 * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004427#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4428 if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
Manuel Pégourié-Gonnardcd32a502014-09-20 13:54:12 +02004429 ssl->handshake->new_session_ticket != 0 )
4430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004431 ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnardcd32a502014-09-20 13:54:12 +02004432 }
4433#endif
4434
Paul Bakker1961b702013-01-25 14:49:24 +01004435 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00004436 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004437 case MBEDTLS_SSL_HELLO_REQUEST:
4438 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00004439 break;
4440
Paul Bakker1961b702013-01-25 14:49:24 +01004441 /*
4442 * ==> ClientHello
4443 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004444 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004445 ret = ssl_write_client_hello( ssl );
4446 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004447
Paul Bakker1961b702013-01-25 14:49:24 +01004448 /*
4449 * <== ServerHello
4450 * Certificate
4451 * ( ServerKeyExchange )
4452 * ( CertificateRequest )
4453 * ServerHelloDone
4454 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004455 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004456 ret = ssl_parse_server_hello( ssl );
4457 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004458
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004459 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4460 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004461 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004462
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004463 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004464 ret = ssl_parse_server_key_exchange( ssl );
4465 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004467 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01004468 ret = ssl_parse_certificate_request( ssl );
4469 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004470
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004471 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01004472 ret = ssl_parse_server_hello_done( ssl );
4473 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004474
Paul Bakker1961b702013-01-25 14:49:24 +01004475 /*
4476 * ==> ( Certificate/Alert )
4477 * ClientKeyExchange
4478 * ( CertificateVerify )
4479 * ChangeCipherSpec
4480 * Finished
4481 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004482 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4483 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004484 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004485
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004486 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004487 ret = ssl_write_client_key_exchange( ssl );
4488 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004490 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01004491 ret = ssl_write_certificate_verify( ssl );
4492 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004493
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004494 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4495 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004496 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004497
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004498 case MBEDTLS_SSL_CLIENT_FINISHED:
4499 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004500 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004501
Paul Bakker1961b702013-01-25 14:49:24 +01004502 /*
Manuel Pégourié-Gonnarda5cc6022013-07-31 12:58:16 +02004503 * <== ( NewSessionTicket )
4504 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01004505 * Finished
4506 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004507#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4508 case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
Manuel Pégourié-Gonnardcd32a502014-09-20 13:54:12 +02004509 ret = ssl_parse_new_session_ticket( ssl );
4510 break;
Paul Bakkera503a632013-08-14 13:48:06 +02004511#endif
Manuel Pégourié-Gonnardcd32a502014-09-20 13:54:12 +02004512
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004513 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4514 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004515 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004517 case MBEDTLS_SSL_SERVER_FINISHED:
4518 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004519 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004520
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004521 case MBEDTLS_SSL_FLUSH_BUFFERS:
4522 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
4523 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01004524 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00004525
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004526 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4527 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004528 break;
Paul Bakker48916f92012-09-16 19:57:18 +00004529
Paul Bakker1961b702013-01-25 14:49:24 +01004530 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004531 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
4532 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker1961b702013-01-25 14:49:24 +01004533 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004534
4535 return( ret );
4536}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004537#endif /* MBEDTLS_SSL_CLI_C */