blob: 5a0c69fa7a4ea75fda999be4e02efc12b5a5779f [file] [log] [blame]
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08001/*
Jerry Yub9930e72021-08-06 17:11:51 +08002 * TLS 1.3 server-side functions
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Gilles Peskine449bd832023-01-11 14:50:10 +010018 */
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080019
20#include "common.h"
21
Jerry Yufb4b6472022-01-27 15:03:26 +080022#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
Jerry Yu3cc4c2a2021-08-06 16:29:08 +080023
Jerry Yu687101b2021-09-14 16:03:56 +080024#include "mbedtls/debug.h"
Xiaofei Baicba64af2022-02-15 10:00:56 +000025#include "mbedtls/error.h"
26#include "mbedtls/platform.h"
Jerry Yu1c105562022-07-10 06:32:38 +000027#include "mbedtls/constant_time.h"
Manuel Pégourié-Gonnardd55d66f2023-06-20 10:14:58 +020028#include "mbedtls/oid.h"
Manuel Pégourié-Gonnard02b10d82023-03-28 12:33:20 +020029#include "md_psa.h"
Jerry Yu3bf2c642022-03-30 22:02:12 +080030
Xiaofei Bai9ca09d42022-02-14 12:57:18 +000031#include "ssl_misc.h"
32#include "ssl_tls13_keys.h"
33#include "ssl_debug_helpers.h"
34
Jerry Yuf35ba382022-08-23 17:58:26 +080035
Jerry Yuc5a23a02022-08-25 10:51:44 +080036static const mbedtls_ssl_ciphersuite_t *ssl_tls13_validate_peer_ciphersuite(
Gilles Peskine449bd832023-01-11 14:50:10 +010037 mbedtls_ssl_context *ssl,
38 unsigned int cipher_suite)
Jerry Yuf35ba382022-08-23 17:58:26 +080039{
40 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +010041 if (!mbedtls_ssl_tls13_cipher_suite_is_offered(ssl, cipher_suite)) {
42 return NULL;
Jerry Yuf35ba382022-08-23 17:58:26 +080043 }
Gilles Peskine449bd832023-01-11 14:50:10 +010044
45 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(cipher_suite);
46 if ((mbedtls_ssl_validate_ciphersuite(ssl, ciphersuite_info,
47 ssl->tls_version,
48 ssl->tls_version) != 0)) {
49 return NULL;
50 }
51 return ciphersuite_info;
Jerry Yuf35ba382022-08-23 17:58:26 +080052}
53
Ronald Cron41a443a2022-10-04 16:38:25 +020054#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yue19e3b92022-07-08 12:04:51 +000055/* From RFC 8446:
56 *
57 * enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
58 * struct {
59 * PskKeyExchangeMode ke_modes<1..255>;
60 * } PskKeyExchangeModes;
61 */
Jerry Yu6e74a7e2022-07-20 20:49:32 +080062MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +010063static int ssl_tls13_parse_key_exchange_modes_ext(mbedtls_ssl_context *ssl,
64 const unsigned char *buf,
65 const unsigned char *end)
Jerry Yue19e3b92022-07-08 12:04:51 +000066{
Jerry Yu299e31f2022-07-13 23:06:36 +080067 const unsigned char *p = buf;
Jerry Yue19e3b92022-07-08 12:04:51 +000068 size_t ke_modes_len;
69 int ke_modes = 0;
70
Jerry Yu854dd9e2022-07-15 14:28:27 +080071 /* Read ke_modes length (1 Byte) */
Gilles Peskine449bd832023-01-11 14:50:10 +010072 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
Jerry Yu299e31f2022-07-13 23:06:36 +080073 ke_modes_len = *p++;
Jerry Yue19e3b92022-07-08 12:04:51 +000074 /* Currently, there are only two PSK modes, so even without looking
75 * at the content, something's wrong if the list has more than 2 items. */
Gilles Peskine449bd832023-01-11 14:50:10 +010076 if (ke_modes_len > 2) {
77 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
78 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
79 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu299e31f2022-07-13 23:06:36 +080080 }
Jerry Yue19e3b92022-07-08 12:04:51 +000081
Gilles Peskine449bd832023-01-11 14:50:10 +010082 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, ke_modes_len);
Jerry Yue19e3b92022-07-08 12:04:51 +000083
Gilles Peskine449bd832023-01-11 14:50:10 +010084 while (ke_modes_len-- != 0) {
85 switch (*p++) {
86 case MBEDTLS_SSL_TLS1_3_PSK_MODE_PURE:
87 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
88 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK KEX MODE"));
89 break;
90 case MBEDTLS_SSL_TLS1_3_PSK_MODE_ECDHE:
91 ke_modes |= MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
92 MBEDTLS_SSL_DEBUG_MSG(3, ("Found PSK_EPHEMERAL KEX MODE"));
93 break;
94 default:
95 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
96 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
97 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yue19e3b92022-07-08 12:04:51 +000098 }
99 }
100
101 ssl->handshake->tls13_kex_modes = ke_modes;
Gilles Peskine449bd832023-01-11 14:50:10 +0100102 return 0;
Jerry Yue19e3b92022-07-08 12:04:51 +0000103}
Jerry Yu1c105562022-07-10 06:32:38 +0000104
Jerry Yue9d4fc02022-08-20 19:21:15 +0800105#define SSL_TLS1_3_OFFERED_PSK_NOT_MATCH 1
106#define SSL_TLS1_3_OFFERED_PSK_MATCH 0
Jerry Yu95699e72022-08-21 19:22:23 +0800107
108#if defined(MBEDTLS_SSL_SESSION_TICKETS)
109
110MBEDTLS_CHECK_RETURN_CRITICAL
111static int ssl_tls13_offered_psks_check_identity_match_ticket(
Gilles Peskine449bd832023-01-11 14:50:10 +0100112 mbedtls_ssl_context *ssl,
113 const unsigned char *identity,
114 size_t identity_len,
115 uint32_t obfuscated_ticket_age,
116 mbedtls_ssl_session *session)
Jerry Yu95699e72022-08-21 19:22:23 +0800117{
Jerry Yufd310eb2022-09-06 09:16:35 +0800118 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu95699e72022-08-21 19:22:23 +0800119 unsigned char *ticket_buffer;
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800120#if defined(MBEDTLS_HAVE_TIME)
121 mbedtls_time_t now;
Jerry Yuacff8232022-09-14 14:35:11 +0800122 uint64_t age_in_s;
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800123 int64_t age_diff_in_ms;
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800124#endif
Jerry Yu95699e72022-08-21 19:22:23 +0800125
126 ((void) obfuscated_ticket_age);
127
Gilles Peskine449bd832023-01-11 14:50:10 +0100128 MBEDTLS_SSL_DEBUG_MSG(2, ("=> check_identity_match_ticket"));
Jerry Yu95699e72022-08-21 19:22:23 +0800129
Jerry Yufd310eb2022-09-06 09:16:35 +0800130 /* Ticket parser is not configured, Skip */
Gilles Peskine449bd832023-01-11 14:50:10 +0100131 if (ssl->conf->f_ticket_parse == NULL || identity_len == 0) {
132 return 0;
133 }
Jerry Yu95699e72022-08-21 19:22:23 +0800134
Jerry Yu4746b102022-09-13 11:11:48 +0800135 /* We create a copy of the encrypted ticket since the ticket parsing
136 * function is allowed to use its input buffer as an output buffer
137 * (in-place decryption). We do, however, need the original buffer for
138 * computing the PSK binder value.
Jerry Yu95699e72022-08-21 19:22:23 +0800139 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100140 ticket_buffer = mbedtls_calloc(1, identity_len);
141 if (ticket_buffer == NULL) {
142 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
143 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
Jerry Yu95699e72022-08-21 19:22:23 +0800144 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100145 memcpy(ticket_buffer, identity, identity_len);
Jerry Yu95699e72022-08-21 19:22:23 +0800146
Gilles Peskine449bd832023-01-11 14:50:10 +0100147 if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket,
148 session,
149 ticket_buffer, identity_len)) != 0) {
150 if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) {
151 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic"));
152 } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) {
153 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired"));
154 } else {
155 MBEDTLS_SSL_DEBUG_RET(1, "ticket_parse", ret);
156 }
Jerry Yu95699e72022-08-21 19:22:23 +0800157 }
158
159 /* We delete the temporary buffer */
Gilles Peskine449bd832023-01-11 14:50:10 +0100160 mbedtls_free(ticket_buffer);
Jerry Yu95699e72022-08-21 19:22:23 +0800161
Jerry Yuce3b95e2023-10-31 16:02:04 +0800162#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
163 if (ret == 0 && session->tls_version != MBEDTLS_SSL_VERSION_TLS1_3) {
164 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket version invalid."));
165 ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
166 }
167#endif
168
Gilles Peskine449bd832023-01-11 14:50:10 +0100169 if (ret != 0) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800170 goto exit;
171 }
Jerry Yu95699e72022-08-21 19:22:23 +0800172
Pengyu Lv3eb49be2022-12-05 16:35:12 +0800173 /* RFC 8446 section 4.2.9
174 *
175 * Servers SHOULD NOT send NewSessionTicket with tickets that are not
176 * compatible with the advertised modes; however, if a server does so,
177 * the impact will just be that the client's attempts at resumption fail.
178 *
179 * We regard the ticket with incompatible key exchange modes as not match.
180 */
Pengyu Lv18946532023-01-12 12:28:09 +0800181 ret = MBEDTLS_ERR_ERROR_GENERIC_ERROR;
Pengyu Lv4938a562023-01-16 11:28:49 +0800182 MBEDTLS_SSL_PRINT_TICKET_FLAGS(4,
Pengyu Lv80270b22023-01-12 11:54:04 +0800183 session->ticket_flags);
Pengyu Lve2f1dbf2023-01-16 12:28:27 +0800184 if (mbedtls_ssl_tls13_check_kex_modes(
185 ssl,
186 mbedtls_ssl_session_get_ticket_flags(
187 session,
188 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ALL))) {
Pengyu Lv3eb49be2022-12-05 16:35:12 +0800189 MBEDTLS_SSL_DEBUG_MSG(3, ("No suitable key exchange mode"));
190 goto exit;
191 }
192
Gilles Peskine449bd832023-01-11 14:50:10 +0100193 ret = MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED;
194#if defined(MBEDTLS_HAVE_TIME)
195 now = mbedtls_time(NULL);
196
197 if (now < session->start) {
198 MBEDTLS_SSL_DEBUG_MSG(
199 3, ("Invalid ticket start time ( now=%" MBEDTLS_PRINTF_LONGLONG
200 ", start=%" MBEDTLS_PRINTF_LONGLONG " )",
201 (long long) now, (long long) session->start));
202 goto exit;
203 }
204
205 age_in_s = (uint64_t) (now - session->start);
Jerry Yu95699e72022-08-21 19:22:23 +0800206
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800207 /* RFC 8446 section 4.6.1
208 *
209 * Servers MUST NOT use any value greater than 604800 seconds (7 days).
210 *
211 * RFC 8446 section 4.2.11.1
212 *
213 * Clients MUST NOT attempt to use tickets which have ages greater than
214 * the "ticket_lifetime" value which was provided with the ticket.
215 *
216 * For time being, the age MUST be less than 604800 seconds (7 days).
217 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100218 if (age_in_s > 604800) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800219 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +0100220 3, ("Ticket age exceeds limitation ticket_age=%lu",
221 (long unsigned int) age_in_s));
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800222 goto exit;
223 }
Jerry Yu95699e72022-08-21 19:22:23 +0800224
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800225 /* RFC 8446 section 4.2.10
226 *
227 * For PSKs provisioned via NewSessionTicket, a server MUST validate that
228 * the ticket age for the selected PSK identity (computed by subtracting
229 * ticket_age_add from PskIdentity.obfuscated_ticket_age modulo 2^32) is
230 * within a small tolerance of the time since the ticket was issued.
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800231 *
Jerry Yu0a55cc62022-09-15 16:15:06 +0800232 * NOTE: When `now == session->start`, `age_diff_in_ms` may be negative
233 * as the age units are different on the server (s) and in the
234 * client (ms) side. Add a -1000 ms tolerance window to take this
235 * into account.
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800236 */
Jerry Yuf7dad3c2022-09-14 22:31:39 +0800237 age_diff_in_ms = age_in_s * 1000;
Gilles Peskine449bd832023-01-11 14:50:10 +0100238 age_diff_in_ms -= (obfuscated_ticket_age - session->ticket_age_add);
239 if (age_diff_in_ms <= -1000 ||
240 age_diff_in_ms > MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE) {
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800241 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +0100242 3, ("Ticket age outside tolerance window ( diff=%d )",
243 (int) age_diff_in_ms));
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800244 goto exit;
245 }
246
247 ret = 0;
Jerry Yu95699e72022-08-21 19:22:23 +0800248
249#endif /* MBEDTLS_HAVE_TIME */
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800250
251exit:
Gilles Peskine449bd832023-01-11 14:50:10 +0100252 if (ret != 0) {
253 mbedtls_ssl_session_free(session);
254 }
Jerry Yu95699e72022-08-21 19:22:23 +0800255
Gilles Peskine449bd832023-01-11 14:50:10 +0100256 MBEDTLS_SSL_DEBUG_MSG(2, ("<= check_identity_match_ticket"));
257 return ret;
Jerry Yu95699e72022-08-21 19:22:23 +0800258}
259#endif /* MBEDTLS_SSL_SESSION_TICKETS */
260
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800261MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yu1c105562022-07-10 06:32:38 +0000262static int ssl_tls13_offered_psks_check_identity_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100263 mbedtls_ssl_context *ssl,
264 const unsigned char *identity,
265 size_t identity_len,
266 uint32_t obfuscated_ticket_age,
267 int *psk_type,
268 mbedtls_ssl_session *session)
Jerry Yu1c105562022-07-10 06:32:38 +0000269{
Ronald Cron606671e2023-02-17 11:36:33 +0100270 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
271
Jerry Yu95699e72022-08-21 19:22:23 +0800272 ((void) session);
273 ((void) obfuscated_ticket_age);
Jerry Yu5725f1c2022-08-21 17:27:16 +0800274 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL;
Jerry Yu95699e72022-08-21 19:22:23 +0800275
Gilles Peskine449bd832023-01-11 14:50:10 +0100276 MBEDTLS_SSL_DEBUG_BUF(4, "identity", identity, identity_len);
Jerry Yu95699e72022-08-21 19:22:23 +0800277 ssl->handshake->resume = 0;
278
Jerry Yu95699e72022-08-21 19:22:23 +0800279#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100280 if (ssl_tls13_offered_psks_check_identity_match_ticket(
Jerry Yu8d4bbba2022-09-13 14:15:48 +0800281 ssl, identity, identity_len, obfuscated_ticket_age,
Gilles Peskine449bd832023-01-11 14:50:10 +0100282 session) == SSL_TLS1_3_OFFERED_PSK_MATCH) {
Jerry Yu95699e72022-08-21 19:22:23 +0800283 ssl->handshake->resume = 1;
284 *psk_type = MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION;
Ronald Cron606671e2023-02-17 11:36:33 +0100285 ret = mbedtls_ssl_set_hs_psk(ssl,
286 session->resumption_key,
287 session->resumption_key_len);
288 if (ret != 0) {
289 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
290 return ret;
291 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100292
293 MBEDTLS_SSL_DEBUG_BUF(4, "Ticket-resumed PSK:",
294 session->resumption_key,
295 session->resumption_key_len);
296 MBEDTLS_SSL_DEBUG_MSG(4, ("ticket: obfuscated_ticket_age: %u",
297 (unsigned) obfuscated_ticket_age));
298 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu95699e72022-08-21 19:22:23 +0800299 }
300#endif /* MBEDTLS_SSL_SESSION_TICKETS */
301
Jerry Yu1c105562022-07-10 06:32:38 +0000302 /* Check identity with external configured function */
Gilles Peskine449bd832023-01-11 14:50:10 +0100303 if (ssl->conf->f_psk != NULL) {
304 if (ssl->conf->f_psk(
305 ssl->conf->p_psk, ssl, identity, identity_len) == 0) {
306 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000307 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100308 return SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000309 }
310
Gilles Peskine449bd832023-01-11 14:50:10 +0100311 MBEDTLS_SSL_DEBUG_BUF(5, "identity", identity, identity_len);
Jerry Yu1c105562022-07-10 06:32:38 +0000312 /* Check identity with pre-configured psk */
Gilles Peskine449bd832023-01-11 14:50:10 +0100313 if (ssl->conf->psk_identity != NULL &&
Jerry Yu2f0abc92022-07-22 19:34:48 +0800314 identity_len == ssl->conf->psk_identity_len &&
Gilles Peskine449bd832023-01-11 14:50:10 +0100315 mbedtls_ct_memcmp(ssl->conf->psk_identity,
316 identity, identity_len) == 0) {
Ronald Cron606671e2023-02-17 11:36:33 +0100317 ret = mbedtls_ssl_set_hs_psk(ssl, ssl->conf->psk, ssl->conf->psk_len);
318 if (ret != 0) {
319 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_set_hs_psk", ret);
320 return ret;
321 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100322 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000323 }
324
Gilles Peskine449bd832023-01-11 14:50:10 +0100325 return SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000326}
327
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800328MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000329static int ssl_tls13_offered_psks_check_binder_match(
330 mbedtls_ssl_context *ssl,
331 const unsigned char *binder, size_t binder_len,
332 int psk_type, psa_algorithm_t psk_hash_alg)
Jerry Yu1c105562022-07-10 06:32:38 +0000333{
334 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu96a2e362022-07-21 15:11:34 +0800335
Jerry Yudaf375a2022-07-20 21:31:43 +0800336 unsigned char transcript[PSA_HASH_MAX_SIZE];
Jerry Yu1c105562022-07-10 06:32:38 +0000337 size_t transcript_len;
Jerry Yu2f0abc92022-07-22 19:34:48 +0800338 unsigned char *psk;
Jerry Yu96a2e362022-07-21 15:11:34 +0800339 size_t psk_len;
Jerry Yudaf375a2022-07-20 21:31:43 +0800340 unsigned char server_computed_binder[PSA_HASH_MAX_SIZE];
Jerry Yu1c105562022-07-10 06:32:38 +0000341
Jerry Yu1c105562022-07-10 06:32:38 +0000342 /* Get current state of handshake transcript. */
Jerry Yu29d9faa2022-08-23 17:52:45 +0800343 ret = mbedtls_ssl_get_handshake_transcript(
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +0200344 ssl, mbedtls_md_type_from_psa_alg(psk_hash_alg),
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 transcript, sizeof(transcript), &transcript_len);
346 if (ret != 0) {
347 return ret;
348 }
Jerry Yu1c105562022-07-10 06:32:38 +0000349
Gilles Peskine449bd832023-01-11 14:50:10 +0100350 ret = mbedtls_ssl_tls13_export_handshake_psk(ssl, &psk, &psk_len);
351 if (ret != 0) {
352 return ret;
353 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800354
Gilles Peskine449bd832023-01-11 14:50:10 +0100355 ret = mbedtls_ssl_tls13_create_psk_binder(ssl, psk_hash_alg,
356 psk, psk_len, psk_type,
357 transcript,
358 server_computed_binder);
Jerry Yu96a2e362022-07-21 15:11:34 +0800359#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100360 mbedtls_free((void *) psk);
Jerry Yu96a2e362022-07-21 15:11:34 +0800361#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100362 if (ret != 0) {
363 MBEDTLS_SSL_DEBUG_MSG(1, ("PSK binder calculation failed."));
364 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu1c105562022-07-10 06:32:38 +0000365 }
366
Gilles Peskine449bd832023-01-11 14:50:10 +0100367 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( computed ): ",
368 server_computed_binder, transcript_len);
369 MBEDTLS_SSL_DEBUG_BUF(3, "psk binder ( received ): ", binder, binder_len);
Jerry Yu1c105562022-07-10 06:32:38 +0000370
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 if (mbedtls_ct_memcmp(server_computed_binder, binder, binder_len) == 0) {
372 return SSL_TLS1_3_OFFERED_PSK_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000373 }
374
Gilles Peskine449bd832023-01-11 14:50:10 +0100375 mbedtls_platform_zeroize(server_computed_binder,
376 sizeof(server_computed_binder));
377 return SSL_TLS1_3_OFFERED_PSK_NOT_MATCH;
Jerry Yu1c105562022-07-10 06:32:38 +0000378}
Jerry Yu96a2e362022-07-21 15:11:34 +0800379
Jerry Yu5725f1c2022-08-21 17:27:16 +0800380MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yuf35ba382022-08-23 17:58:26 +0800381static int ssl_tls13_select_ciphersuite_for_psk(
Gilles Peskine449bd832023-01-11 14:50:10 +0100382 mbedtls_ssl_context *ssl,
383 const unsigned char *cipher_suites,
384 const unsigned char *cipher_suites_end,
385 uint16_t *selected_ciphersuite,
386 const mbedtls_ssl_ciphersuite_t **selected_ciphersuite_info)
Jerry Yu5725f1c2022-08-21 17:27:16 +0800387{
Jerry Yuf35ba382022-08-23 17:58:26 +0800388 psa_algorithm_t psk_hash_alg = PSA_ALG_SHA_256;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800389
Jerry Yu0baf9072022-08-25 11:21:04 +0800390 *selected_ciphersuite = 0;
391 *selected_ciphersuite_info = NULL;
392
Jerry Yuf35ba382022-08-23 17:58:26 +0800393 /* RFC 8446, page 55.
394 *
395 * For externally established PSKs, the Hash algorithm MUST be set when the
396 * PSK is established or default to SHA-256 if no such algorithm is defined.
397 *
398 */
Jerry Yu5725f1c2022-08-21 17:27:16 +0800399
Jerry Yu5725f1c2022-08-21 17:27:16 +0800400 /*
401 * Search for a matching ciphersuite
402 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100403 for (const unsigned char *p = cipher_suites;
404 p < cipher_suites_end; p += 2) {
Jerry Yu5725f1c2022-08-21 17:27:16 +0800405 uint16_t cipher_suite;
Jerry Yuf35ba382022-08-23 17:58:26 +0800406 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800407
Gilles Peskine449bd832023-01-11 14:50:10 +0100408 cipher_suite = MBEDTLS_GET_UINT16_BE(p, 0);
409 ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(ssl,
410 cipher_suite);
411 if (ciphersuite_info == NULL) {
Jerry Yu5725f1c2022-08-21 17:27:16 +0800412 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100413 }
Jerry Yu5725f1c2022-08-21 17:27:16 +0800414
Jerry Yu5725f1c2022-08-21 17:27:16 +0800415 /* MAC of selected ciphersuite MUST be same with PSK binder if exist.
416 * Otherwise, client should reject.
417 */
Dave Rodgman2eab4622023-10-05 13:30:37 +0100418 if (psk_hash_alg ==
419 mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac)) {
Jerry Yuf35ba382022-08-23 17:58:26 +0800420 *selected_ciphersuite = cipher_suite;
421 *selected_ciphersuite_info = ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +0100422 return 0;
Jerry Yuf35ba382022-08-23 17:58:26 +0800423 }
424 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100425 MBEDTLS_SSL_DEBUG_MSG(2, ("No matched ciphersuite"));
426 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yuf35ba382022-08-23 17:58:26 +0800427}
Jerry Yu5725f1c2022-08-21 17:27:16 +0800428
Jerry Yu82534862022-08-30 10:42:33 +0800429#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yuf35ba382022-08-23 17:58:26 +0800430MBEDTLS_CHECK_RETURN_CRITICAL
431static int ssl_tls13_select_ciphersuite_for_resumption(
Gilles Peskine449bd832023-01-11 14:50:10 +0100432 mbedtls_ssl_context *ssl,
433 const unsigned char *cipher_suites,
434 const unsigned char *cipher_suites_end,
435 mbedtls_ssl_session *session,
436 uint16_t *selected_ciphersuite,
437 const mbedtls_ssl_ciphersuite_t **selected_ciphersuite_info)
Jerry Yuf35ba382022-08-23 17:58:26 +0800438{
Jerry Yu82534862022-08-30 10:42:33 +0800439
Jerry Yuf35ba382022-08-23 17:58:26 +0800440 *selected_ciphersuite = 0;
441 *selected_ciphersuite_info = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 for (const unsigned char *p = cipher_suites; p < cipher_suites_end; p += 2) {
443 uint16_t cipher_suite = MBEDTLS_GET_UINT16_BE(p, 0);
Jerry Yu82534862022-08-30 10:42:33 +0800444 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
445
Gilles Peskine449bd832023-01-11 14:50:10 +0100446 if (cipher_suite != session->ciphersuite) {
Jerry Yu82534862022-08-30 10:42:33 +0800447 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100448 }
Jerry Yu82534862022-08-30 10:42:33 +0800449
Gilles Peskine449bd832023-01-11 14:50:10 +0100450 ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(ssl,
451 cipher_suite);
452 if (ciphersuite_info == NULL) {
Jerry Yu82534862022-08-30 10:42:33 +0800453 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100454 }
Jerry Yu82534862022-08-30 10:42:33 +0800455
Jerry Yu4746b102022-09-13 11:11:48 +0800456 *selected_ciphersuite = cipher_suite;
Jerry Yu82534862022-08-30 10:42:33 +0800457 *selected_ciphersuite_info = ciphersuite_info;
458
Gilles Peskine449bd832023-01-11 14:50:10 +0100459 return 0;
Jerry Yu82534862022-08-30 10:42:33 +0800460 }
461
Gilles Peskine449bd832023-01-11 14:50:10 +0100462 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800463}
Jerry Yuf35ba382022-08-23 17:58:26 +0800464
Jerry Yu82534862022-08-30 10:42:33 +0800465MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100466static int ssl_tls13_session_copy_ticket(mbedtls_ssl_session *dst,
467 const mbedtls_ssl_session *src)
Jerry Yu82534862022-08-30 10:42:33 +0800468{
Jerry Yu82534862022-08-30 10:42:33 +0800469 dst->ticket_age_add = src->ticket_age_add;
470 dst->ticket_flags = src->ticket_flags;
471 dst->resumption_key_len = src->resumption_key_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100472 if (src->resumption_key_len == 0) {
473 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
474 }
475 memcpy(dst->resumption_key, src->resumption_key, src->resumption_key_len);
Jerry Yu4746b102022-09-13 11:11:48 +0800476
Gilles Peskine449bd832023-01-11 14:50:10 +0100477 return 0;
Jerry Yu82534862022-08-30 10:42:33 +0800478}
479#endif /* MBEDTLS_SSL_SESSION_TICKETS */
480
Jerry Yu1c105562022-07-10 06:32:38 +0000481/* Parser for pre_shared_key extension in client hello
482 * struct {
483 * opaque identity<1..2^16-1>;
484 * uint32 obfuscated_ticket_age;
485 * } PskIdentity;
486 *
487 * opaque PskBinderEntry<32..255>;
488 *
489 * struct {
490 * PskIdentity identities<7..2^16-1>;
491 * PskBinderEntry binders<33..2^16-1>;
492 * } OfferedPsks;
493 *
494 * struct {
495 * select (Handshake.msg_type) {
496 * case client_hello: OfferedPsks;
497 * ....
498 * };
499 * } PreSharedKeyExtension;
500 */
Jerry Yu6e74a7e2022-07-20 20:49:32 +0800501MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000502static int ssl_tls13_parse_pre_shared_key_ext(
503 mbedtls_ssl_context *ssl,
504 const unsigned char *pre_shared_key_ext,
505 const unsigned char *pre_shared_key_ext_end,
506 const unsigned char *ciphersuites,
507 const unsigned char *ciphersuites_end)
Jerry Yu1c105562022-07-10 06:32:38 +0000508{
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100509 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu29d9faa2022-08-23 17:52:45 +0800510 const unsigned char *identities = pre_shared_key_ext;
Jerry Yu568ec252022-07-22 21:27:34 +0800511 const unsigned char *p_identity_len;
512 size_t identities_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000513 const unsigned char *identities_end;
Jerry Yu568ec252022-07-22 21:27:34 +0800514 const unsigned char *binders;
515 const unsigned char *p_binder_len;
516 size_t binders_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000517 const unsigned char *binders_end;
Jerry Yu96a2e362022-07-21 15:11:34 +0800518 int matched_identity = -1;
519 int identity_id = -1;
Jerry Yu1c105562022-07-10 06:32:38 +0000520
Gilles Peskine449bd832023-01-11 14:50:10 +0100521 MBEDTLS_SSL_DEBUG_BUF(3, "pre_shared_key extension",
522 pre_shared_key_ext,
523 pre_shared_key_ext_end - pre_shared_key_ext);
Jerry Yu1c105562022-07-10 06:32:38 +0000524
Jerry Yu96a2e362022-07-21 15:11:34 +0800525 /* identities_len 2 bytes
526 * identities_data >= 7 bytes
527 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100528 MBEDTLS_SSL_CHK_BUF_READ_PTR(identities, pre_shared_key_ext_end, 7 + 2);
529 identities_len = MBEDTLS_GET_UINT16_BE(identities, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800530 p_identity_len = identities + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100531 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, pre_shared_key_ext_end,
532 identities_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800533 identities_end = p_identity_len + identities_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000534
Jerry Yu96a2e362022-07-21 15:11:34 +0800535 /* binders_len 2 bytes
536 * binders >= 33 bytes
537 */
Jerry Yu568ec252022-07-22 21:27:34 +0800538 binders = identities_end;
Gilles Peskine449bd832023-01-11 14:50:10 +0100539 MBEDTLS_SSL_CHK_BUF_READ_PTR(binders, pre_shared_key_ext_end, 33 + 2);
540 binders_len = MBEDTLS_GET_UINT16_BE(binders, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800541 p_binder_len = binders + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100542 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, pre_shared_key_ext_end, binders_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800543 binders_end = p_binder_len + binders_len;
Jerry Yu1c105562022-07-10 06:32:38 +0000544
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100545 ret = ssl->handshake->update_checksum(ssl, pre_shared_key_ext,
546 identities_end - pre_shared_key_ext);
547 if (0 != ret) {
548 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
549 return ret;
550 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800551
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 while (p_identity_len < identities_end && p_binder_len < binders_end) {
Jerry Yu1c105562022-07-10 06:32:38 +0000553 const unsigned char *identity;
Jerry Yu568ec252022-07-22 21:27:34 +0800554 size_t identity_len;
Jerry Yu82534862022-08-30 10:42:33 +0800555 uint32_t obfuscated_ticket_age;
Jerry Yu96a2e362022-07-21 15:11:34 +0800556 const unsigned char *binder;
Jerry Yu568ec252022-07-22 21:27:34 +0800557 size_t binder_len;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800558 int psk_type;
559 uint16_t cipher_suite;
Jerry Yu29d9faa2022-08-23 17:52:45 +0800560 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu82534862022-08-30 10:42:33 +0800561#if defined(MBEDTLS_SSL_SESSION_TICKETS)
562 mbedtls_ssl_session session;
Gilles Peskine449bd832023-01-11 14:50:10 +0100563 mbedtls_ssl_session_init(&session);
Jerry Yu82534862022-08-30 10:42:33 +0800564#endif
Jerry Yubb852022022-07-20 21:10:44 +0800565
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_identity_len, identities_end, 2 + 1 + 4);
567 identity_len = MBEDTLS_GET_UINT16_BE(p_identity_len, 0);
Jerry Yu568ec252022-07-22 21:27:34 +0800568 identity = p_identity_len + 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100569 MBEDTLS_SSL_CHK_BUF_READ_PTR(identity, identities_end, identity_len + 4);
570 obfuscated_ticket_age = MBEDTLS_GET_UINT32_BE(identity, identity_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800571 p_identity_len += identity_len + 6;
Jerry Yu1c105562022-07-10 06:32:38 +0000572
Gilles Peskine449bd832023-01-11 14:50:10 +0100573 MBEDTLS_SSL_CHK_BUF_READ_PTR(p_binder_len, binders_end, 1 + 32);
Jerry Yu568ec252022-07-22 21:27:34 +0800574 binder_len = *p_binder_len;
575 binder = p_binder_len + 1;
Gilles Peskine449bd832023-01-11 14:50:10 +0100576 MBEDTLS_SSL_CHK_BUF_READ_PTR(binder, binders_end, binder_len);
Jerry Yu568ec252022-07-22 21:27:34 +0800577 p_binder_len += binder_len + 1;
Jerry Yu96a2e362022-07-21 15:11:34 +0800578
Jerry Yu96a2e362022-07-21 15:11:34 +0800579 identity_id++;
Gilles Peskine449bd832023-01-11 14:50:10 +0100580 if (matched_identity != -1) {
Jerry Yu1c105562022-07-10 06:32:38 +0000581 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100582 }
Jerry Yu1c105562022-07-10 06:32:38 +0000583
Jerry Yu96a2e362022-07-21 15:11:34 +0800584 ret = ssl_tls13_offered_psks_check_identity_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100585 ssl, identity, identity_len, obfuscated_ticket_age,
586 &psk_type, &session);
587 if (ret != SSL_TLS1_3_OFFERED_PSK_MATCH) {
Jerry Yu96a2e362022-07-21 15:11:34 +0800588 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +0100589 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800590
Gilles Peskine449bd832023-01-11 14:50:10 +0100591 MBEDTLS_SSL_DEBUG_MSG(4, ("found matched identity"));
592 switch (psk_type) {
Jerry Yu0baf9072022-08-25 11:21:04 +0800593 case MBEDTLS_SSL_TLS1_3_PSK_EXTERNAL:
594 ret = ssl_tls13_select_ciphersuite_for_psk(
Gilles Peskine449bd832023-01-11 14:50:10 +0100595 ssl, ciphersuites, ciphersuites_end,
596 &cipher_suite, &ciphersuite_info);
Jerry Yu0baf9072022-08-25 11:21:04 +0800597 break;
598 case MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION:
Jerry Yu82534862022-08-30 10:42:33 +0800599#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yu0baf9072022-08-25 11:21:04 +0800600 ret = ssl_tls13_select_ciphersuite_for_resumption(
Gilles Peskine449bd832023-01-11 14:50:10 +0100601 ssl, ciphersuites, ciphersuites_end, &session,
602 &cipher_suite, &ciphersuite_info);
603 if (ret != 0) {
604 mbedtls_ssl_session_free(&session);
605 }
Jerry Yu82534862022-08-30 10:42:33 +0800606#else
607 ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
608#endif
Jerry Yu0baf9072022-08-25 11:21:04 +0800609 break;
610 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100611 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu0baf9072022-08-25 11:21:04 +0800612 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100613 if (ret != 0) {
Jerry Yuf35ba382022-08-23 17:58:26 +0800614 /* See below, no cipher_suite available, abort handshake */
615 MBEDTLS_SSL_PEND_FATAL_ALERT(
616 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
Gilles Peskine449bd832023-01-11 14:50:10 +0100617 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
Jerry Yuf35ba382022-08-23 17:58:26 +0800618 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +0100619 2, "ssl_tls13_select_ciphersuite", ret);
620 return ret;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800621 }
622
Jerry Yu96a2e362022-07-21 15:11:34 +0800623 ret = ssl_tls13_offered_psks_check_binder_match(
Gilles Peskine449bd832023-01-11 14:50:10 +0100624 ssl, binder, binder_len, psk_type,
Dave Rodgman2eab4622023-10-05 13:30:37 +0100625 mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac));
Gilles Peskine449bd832023-01-11 14:50:10 +0100626 if (ret != SSL_TLS1_3_OFFERED_PSK_MATCH) {
Jerry Yuc5a23a02022-08-25 10:51:44 +0800627 /* For security reasons, the handshake should be aborted when we
628 * fail to validate a binder value. See RFC 8446 section 4.2.11.2
629 * and appendix E.6. */
Jerry Yu82534862022-08-30 10:42:33 +0800630#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100631 mbedtls_ssl_session_free(&session);
Jerry Yu82534862022-08-30 10:42:33 +0800632#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100633 MBEDTLS_SSL_DEBUG_MSG(3, ("Invalid binder."));
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000634 MBEDTLS_SSL_DEBUG_RET(
635 1, "ssl_tls13_offered_psks_check_binder_match", ret);
Jerry Yu96a2e362022-07-21 15:11:34 +0800636 MBEDTLS_SSL_PEND_FATAL_ALERT(
637 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
Gilles Peskine449bd832023-01-11 14:50:10 +0100638 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
639 return ret;
Jerry Yu96a2e362022-07-21 15:11:34 +0800640 }
Jerry Yu96a2e362022-07-21 15:11:34 +0800641
642 matched_identity = identity_id;
Jerry Yu5725f1c2022-08-21 17:27:16 +0800643
644 /* Update handshake parameters */
Jerry Yue5834fd2022-08-29 20:16:09 +0800645 ssl->handshake->ciphersuite_info = ciphersuite_info;
Jerry Yu4746b102022-09-13 11:11:48 +0800646 ssl->session_negotiate->ciphersuite = cipher_suite;
Gilles Peskine449bd832023-01-11 14:50:10 +0100647 MBEDTLS_SSL_DEBUG_MSG(2, ("overwrite ciphersuite: %04x - %s",
648 cipher_suite, ciphersuite_info->name));
Jerry Yu82534862022-08-30 10:42:33 +0800649#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Gilles Peskine449bd832023-01-11 14:50:10 +0100650 if (psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
651 ret = ssl_tls13_session_copy_ticket(ssl->session_negotiate,
652 &session);
653 mbedtls_ssl_session_free(&session);
654 if (ret != 0) {
655 return ret;
656 }
Jerry Yu82534862022-08-30 10:42:33 +0800657 }
658#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Jerry Yu1c105562022-07-10 06:32:38 +0000659 }
660
Gilles Peskine449bd832023-01-11 14:50:10 +0100661 if (p_identity_len != identities_end || p_binder_len != binders_end) {
662 MBEDTLS_SSL_DEBUG_MSG(3, ("pre_shared_key extension decode error"));
663 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
664 MBEDTLS_ERR_SSL_DECODE_ERROR);
665 return MBEDTLS_ERR_SSL_DECODE_ERROR;
Jerry Yu1c105562022-07-10 06:32:38 +0000666 }
667
Jerry Yu6f1db3f2022-07-22 23:05:59 +0800668 /* Update the handshake transcript with the binder list. */
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000669 ret = ssl->handshake->update_checksum(
670 ssl, identities_end, (size_t) (binders_end - identities_end));
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +0100671 if (0 != ret) {
672 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
673 return ret;
674 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100675 if (matched_identity == -1) {
676 MBEDTLS_SSL_DEBUG_MSG(3, ("No matched PSK or ticket."));
677 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Jerry Yu1c105562022-07-10 06:32:38 +0000678 }
679
Gilles Peskine449bd832023-01-11 14:50:10 +0100680 ssl->handshake->selected_identity = (uint16_t) matched_identity;
681 MBEDTLS_SSL_DEBUG_MSG(3, ("Pre shared key found"));
Jerry Yu1c105562022-07-10 06:32:38 +0000682
Gilles Peskine449bd832023-01-11 14:50:10 +0100683 return 0;
Jerry Yu1c105562022-07-10 06:32:38 +0000684}
Jerry Yu032b15ce2022-07-11 06:10:03 +0000685
686/*
687 * struct {
688 * select ( Handshake.msg_type ) {
689 * ....
690 * case server_hello:
691 * uint16 selected_identity;
692 * }
693 * } PreSharedKeyExtension;
694 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100695static int ssl_tls13_write_server_pre_shared_key_ext(mbedtls_ssl_context *ssl,
696 unsigned char *buf,
697 unsigned char *end,
698 size_t *olen)
Jerry Yu032b15ce2022-07-11 06:10:03 +0000699{
Gilles Peskine449bd832023-01-11 14:50:10 +0100700 unsigned char *p = (unsigned char *) buf;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000701
702 *olen = 0;
703
David Horstmann21b89762022-10-06 18:34:28 +0100704 int not_using_psk = 0;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000705#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +0100706 not_using_psk = (mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque));
Jerry Yu032b15ce2022-07-11 06:10:03 +0000707#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100708 not_using_psk = (ssl->handshake->psk == NULL);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000709#endif
Gilles Peskine449bd832023-01-11 14:50:10 +0100710 if (not_using_psk) {
Jerry Yu032b15ce2022-07-11 06:10:03 +0000711 /* We shouldn't have called this extension writer unless we've
712 * chosen to use a PSK. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000714 }
715
Gilles Peskine449bd832023-01-11 14:50:10 +0100716 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding pre_shared_key extension"));
717 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000718
Gilles Peskine449bd832023-01-11 14:50:10 +0100719 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_PRE_SHARED_KEY, p, 0);
720 MBEDTLS_PUT_UINT16_BE(2, p, 2);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000721
Gilles Peskine449bd832023-01-11 14:50:10 +0100722 MBEDTLS_PUT_UINT16_BE(ssl->handshake->selected_identity, p, 4);
Jerry Yu032b15ce2022-07-11 06:10:03 +0000723
724 *olen = 6;
725
Gilles Peskine449bd832023-01-11 14:50:10 +0100726 MBEDTLS_SSL_DEBUG_MSG(4, ("sent selected_identity: %u",
727 ssl->handshake->selected_identity));
Jerry Yu032b15ce2022-07-11 06:10:03 +0000728
Gilles Peskine449bd832023-01-11 14:50:10 +0100729 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_PRE_SHARED_KEY);
Jerry Yub95dd362022-11-08 21:19:34 +0800730
Gilles Peskine449bd832023-01-11 14:50:10 +0100731 return 0;
Jerry Yu032b15ce2022-07-11 06:10:03 +0000732}
733
Ronald Cron41a443a2022-10-04 16:38:25 +0200734#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yue19e3b92022-07-08 12:04:51 +0000735
XiaokangQian7807f9f2022-02-15 10:04:37 +0000736/* From RFC 8446:
737 * struct {
XiaokangQiancfd925f2022-04-14 07:10:37 +0000738 * ProtocolVersion versions<2..254>;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000739 * } SupportedVersions;
740 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200741MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100742static int ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context *ssl,
743 const unsigned char *buf,
744 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000745{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000746 const unsigned char *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000747 size_t versions_len;
XiaokangQian4080a7f2022-04-11 09:55:18 +0000748 const unsigned char *versions_end;
XiaokangQian0a1b54e2022-04-21 03:01:38 +0000749 uint16_t tls_version;
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100750 int found_supported_version = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000751
Gilles Peskine449bd832023-01-11 14:50:10 +0100752 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 1);
XiaokangQian4080a7f2022-04-11 09:55:18 +0000753 versions_len = p[0];
XiaokangQian7807f9f2022-02-15 10:04:37 +0000754 p += 1;
755
Gilles Peskine449bd832023-01-11 14:50:10 +0100756 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, versions_len);
XiaokangQian4080a7f2022-04-11 09:55:18 +0000757 versions_end = p + versions_len;
Gilles Peskine449bd832023-01-11 14:50:10 +0100758 while (p < versions_end) {
759 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, versions_end, 2);
760 tls_version = mbedtls_ssl_read_version(p, ssl->conf->transport);
XiaokangQianb67384d2022-04-19 00:02:38 +0000761 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000762
Ronald Cron3bd2b022023-04-03 16:45:39 +0200763 if (MBEDTLS_SSL_VERSION_TLS1_3 == tls_version) {
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100764 found_supported_version = 1;
765 break;
766 }
767
Ronald Cron3bd2b022023-04-03 16:45:39 +0200768 if ((MBEDTLS_SSL_VERSION_TLS1_2 == tls_version) &&
769 mbedtls_ssl_conf_is_tls12_enabled(ssl->conf)) {
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100770 found_supported_version = 1;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000771 break;
772 }
XiaokangQian7807f9f2022-02-15 10:04:37 +0000773 }
774
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100775 if (!found_supported_version) {
776 MBEDTLS_SSL_DEBUG_MSG(1, ("No supported version found."));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000777
Gilles Peskine449bd832023-01-11 14:50:10 +0100778 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
779 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
780 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000781 }
782
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100783 MBEDTLS_SSL_DEBUG_MSG(1, ("Negotiated version: [%04x]",
Gilles Peskine449bd832023-01-11 14:50:10 +0100784 (unsigned int) tls_version));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000785
Ronald Cron5af4c7f2023-03-07 20:46:59 +0100786 return (int) tls_version;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000787}
788
Przemek Stekiel8c0a9532023-06-15 16:48:19 +0200789#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
XiaokangQiane8ff3502022-04-22 02:34:40 +0000790/*
XiaokangQian7807f9f2022-02-15 10:04:37 +0000791 *
792 * From RFC 8446:
793 * enum {
794 * ... (0xFFFF)
795 * } NamedGroup;
796 * struct {
797 * NamedGroup named_group_list<2..2^16-1>;
798 * } NamedGroupList;
799 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200800MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100801static int ssl_tls13_parse_supported_groups_ext(mbedtls_ssl_context *ssl,
802 const unsigned char *buf,
803 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000804{
XiaokangQian7807f9f2022-02-15 10:04:37 +0000805 const unsigned char *p = buf;
XiaokangQian84823772022-04-19 07:57:30 +0000806 size_t named_group_list_len;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000807 const unsigned char *named_group_list_end;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000808
Gilles Peskine449bd832023-01-11 14:50:10 +0100809 MBEDTLS_SSL_DEBUG_BUF(3, "supported_groups extension", p, end - buf);
810 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
811 named_group_list_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000812 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100813 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, named_group_list_len);
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000814 named_group_list_end = p + named_group_list_len;
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000815 ssl->handshake->hrr_selected_group = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000816
Gilles Peskine449bd832023-01-11 14:50:10 +0100817 while (p < named_group_list_end) {
XiaokangQian08037552022-04-20 07:16:41 +0000818 uint16_t named_group;
Gilles Peskine449bd832023-01-11 14:50:10 +0100819 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, named_group_list_end, 2);
820 named_group = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian08037552022-04-20 07:16:41 +0000821 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000822
Gilles Peskine449bd832023-01-11 14:50:10 +0100823 MBEDTLS_SSL_DEBUG_MSG(2,
824 ("got named group: %s(%04x)",
825 mbedtls_ssl_named_group_to_str(named_group),
826 named_group));
XiaokangQian08037552022-04-20 07:16:41 +0000827
Gilles Peskine449bd832023-01-11 14:50:10 +0100828 if (!mbedtls_ssl_named_group_is_offered(ssl, named_group) ||
829 !mbedtls_ssl_named_group_is_supported(named_group) ||
830 ssl->handshake->hrr_selected_group != 0) {
XiaokangQian08037552022-04-20 07:16:41 +0000831 continue;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000832 }
833
Gilles Peskine449bd832023-01-11 14:50:10 +0100834 MBEDTLS_SSL_DEBUG_MSG(2,
835 ("add named group %s(%04x) into received list.",
836 mbedtls_ssl_named_group_to_str(named_group),
837 named_group));
Jerry Yuc1be19f2022-04-23 16:11:39 +0800838
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000839 ssl->handshake->hrr_selected_group = named_group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000840 }
841
Gilles Peskine449bd832023-01-11 14:50:10 +0100842 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000843
844}
Przemek Stekiel8c0a9532023-06-15 16:48:19 +0200845#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000846
XiaokangQian08037552022-04-20 07:16:41 +0000847#define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1
848
Valerio Settic9ae8622023-07-25 11:23:50 +0200849#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000850/*
851 * ssl_tls13_parse_key_shares_ext() verifies whether the information in the
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000852 * extension is correct and stores the first acceptable key share and its
853 * associated group.
XiaokangQian7807f9f2022-02-15 10:04:37 +0000854 *
855 * Possible return values are:
856 * - 0: Successful processing of the client provided key share extension.
Xiaokang Qian9f1747b2023-03-30 02:50:04 +0000857 * - SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH: The key shares provided by
858 * the client does not match a group supported by the server. A
859 * HelloRetryRequest will be needed.
XiaokangQiane8ff3502022-04-22 02:34:40 +0000860 * - A negative value for fatal errors.
Jerry Yuc1be19f2022-04-23 16:11:39 +0800861 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200862MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100863static int ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context *ssl,
864 const unsigned char *buf,
865 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000866{
XiaokangQianb67384d2022-04-19 00:02:38 +0000867 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000868 unsigned char const *p = buf;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000869 unsigned char const *client_shares_end;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800870 size_t client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000871
872 /* From RFC 8446:
873 *
874 * struct {
875 * KeyShareEntry client_shares<0..2^16-1>;
876 * } KeyShareClientHello;
877 *
878 */
879
Gilles Peskine449bd832023-01-11 14:50:10 +0100880 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2);
881 client_shares_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000882 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +0100883 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, client_shares_len);
XiaokangQian7807f9f2022-02-15 10:04:37 +0000884
885 ssl->handshake->offered_group_id = 0;
XiaokangQian8f9dfe42022-04-15 02:52:39 +0000886 client_shares_end = p + client_shares_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000887
888 /* We try to find a suitable key share entry and copy it to the
889 * handshake context. Later, we have to find out whether we can do
890 * something with the provided key share or whether we have to
XiaokangQianc5763b52022-04-02 03:34:37 +0000891 * dismiss it and send a HelloRetryRequest message.
892 */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000893
Gilles Peskine449bd832023-01-11 14:50:10 +0100894 while (p < client_shares_end) {
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000895 uint16_t group;
Jerry Yuc1be19f2022-04-23 16:11:39 +0800896 size_t key_exchange_len;
Jerry Yu086edc22022-05-05 10:50:38 +0800897 const unsigned char *key_exchange;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000898
899 /*
900 * struct {
901 * NamedGroup group;
902 * opaque key_exchange<1..2^16-1>;
903 * } KeyShareEntry;
904 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100905 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, 4);
906 group = MBEDTLS_GET_UINT16_BE(p, 0);
907 key_exchange_len = MBEDTLS_GET_UINT16_BE(p, 2);
Jerry Yuc1be19f2022-04-23 16:11:39 +0800908 p += 4;
Jerry Yu086edc22022-05-05 10:50:38 +0800909 key_exchange = p;
Gilles Peskine449bd832023-01-11 14:50:10 +0100910 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, client_shares_end, key_exchange_len);
Jerry Yu086edc22022-05-05 10:50:38 +0800911 p += key_exchange_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000912
913 /* Continue parsing even if we have already found a match,
XiaokangQianc5763b52022-04-02 03:34:37 +0000914 * for input validation purposes.
915 */
Gilles Peskine449bd832023-01-11 14:50:10 +0100916 if (!mbedtls_ssl_named_group_is_offered(ssl, group) ||
917 !mbedtls_ssl_named_group_is_supported(group) ||
918 ssl->handshake->offered_group_id != 0) {
XiaokangQian060d8672022-04-21 09:24:56 +0000919 continue;
920 }
XiaokangQian060d8672022-04-21 09:24:56 +0000921
XiaokangQian7807f9f2022-02-15 10:04:37 +0000922 /*
Przemek Stekielc89f3ea2023-05-18 15:45:53 +0200923 * ECDHE and FFDHE groups are supported
XiaokangQian7807f9f2022-02-15 10:04:37 +0000924 */
Przemek Stekielc89f3ea2023-05-18 15:45:53 +0200925 if (mbedtls_ssl_tls13_named_group_is_ecdhe(group) ||
Przemek Stekield5f79e72023-06-29 09:08:43 +0200926 mbedtls_ssl_tls13_named_group_is_ffdh(group)) {
Przemek Stekielc89f3ea2023-05-18 15:45:53 +0200927 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDH/FFDH group: %s (%04x)",
Gilles Peskine449bd832023-01-11 14:50:10 +0100928 mbedtls_ssl_named_group_to_str(group),
929 group));
Przemek Stekiel7ac93be2023-07-04 10:02:38 +0200930 ret = mbedtls_ssl_tls13_read_public_xxdhe_share(
Gilles Peskine449bd832023-01-11 14:50:10 +0100931 ssl, key_exchange - 2, key_exchange_len + 2);
932 if (ret != 0) {
933 return ret;
934 }
XiaokangQian4e8cd7b2022-04-21 09:48:09 +0000935
Gilles Peskine449bd832023-01-11 14:50:10 +0100936 } else {
937 MBEDTLS_SSL_DEBUG_MSG(4, ("Unrecognized NamedGroup %u",
938 (unsigned) group));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000939 continue;
940 }
941
XiaokangQian9b5d04b2022-04-10 10:20:43 +0000942 ssl->handshake->offered_group_id = group;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000943 }
944
Jerry Yuc1be19f2022-04-23 16:11:39 +0800945
Gilles Peskine449bd832023-01-11 14:50:10 +0100946 if (ssl->handshake->offered_group_id == 0) {
947 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching key share"));
948 return SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000949 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100950 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000951}
Valerio Settic9ae8622023-07-25 11:23:50 +0200952#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000953
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200954MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +0100955static int ssl_tls13_client_hello_has_exts(mbedtls_ssl_context *ssl,
956 int exts_mask)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000957{
Jerry Yu0c354a22022-08-29 15:25:36 +0800958 int masked = ssl->handshake->received_extensions & exts_mask;
Gilles Peskine449bd832023-01-11 14:50:10 +0100959 return masked == exts_mask;
XiaokangQian7807f9f2022-02-15 10:04:37 +0000960}
961
Jerry Yue5991322022-11-07 14:03:44 +0800962#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +0200963MBEDTLS_CHECK_RETURN_CRITICAL
XiaokangQianb67384d2022-04-19 00:02:38 +0000964static int ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +0100965 mbedtls_ssl_context *ssl)
XiaokangQian7807f9f2022-02-15 10:04:37 +0000966{
Gilles Peskine449bd832023-01-11 14:50:10 +0100967 return ssl_tls13_client_hello_has_exts(
968 ssl,
969 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
970 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
971 MBEDTLS_SSL_EXT_MASK(SIG_ALG));
XiaokangQian7807f9f2022-02-15 10:04:37 +0000972}
Jerry Yue5991322022-11-07 14:03:44 +0800973#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +0000974
Jerry Yue5991322022-11-07 14:03:44 +0800975#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
Jerry Yu77f01482022-07-11 07:03:24 +0000976MBEDTLS_CHECK_RETURN_CRITICAL
977static int ssl_tls13_client_hello_has_exts_for_psk_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +0100978 mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +0000979{
Gilles Peskine449bd832023-01-11 14:50:10 +0100980 return ssl_tls13_client_hello_has_exts(
981 ssl,
982 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
983 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
Jerry Yu77f01482022-07-11 07:03:24 +0000984}
Jerry Yue5991322022-11-07 14:03:44 +0800985#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED */
Jerry Yu77f01482022-07-11 07:03:24 +0000986
Jerry Yue5991322022-11-07 14:03:44 +0800987#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Jerry Yu77f01482022-07-11 07:03:24 +0000988MBEDTLS_CHECK_RETURN_CRITICAL
989static int ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +0100990 mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +0000991{
Gilles Peskine449bd832023-01-11 14:50:10 +0100992 return ssl_tls13_client_hello_has_exts(
993 ssl,
994 MBEDTLS_SSL_EXT_MASK(SUPPORTED_GROUPS) |
995 MBEDTLS_SSL_EXT_MASK(KEY_SHARE) |
996 MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY) |
997 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES));
Jerry Yu77f01482022-07-11 07:03:24 +0000998}
Jerry Yue5991322022-11-07 14:03:44 +0800999#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED */
Jerry Yu77f01482022-07-11 07:03:24 +00001000
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001001MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001002static int ssl_tls13_check_ephemeral_key_exchange(mbedtls_ssl_context *ssl)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001003{
Jerry Yue5991322022-11-07 14:03:44 +08001004#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001005 return mbedtls_ssl_conf_tls13_ephemeral_enabled(ssl) &&
1006 ssl_tls13_client_hello_has_exts_for_ephemeral_key_exchange(ssl);
Jerry Yue5991322022-11-07 14:03:44 +08001007#else
1008 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001009 return 0;
Jerry Yue5991322022-11-07 14:03:44 +08001010#endif
Jerry Yu77f01482022-07-11 07:03:24 +00001011}
XiaokangQian7807f9f2022-02-15 10:04:37 +00001012
Jerry Yu77f01482022-07-11 07:03:24 +00001013MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001014static int ssl_tls13_check_psk_key_exchange(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001015{
Jerry Yue5991322022-11-07 14:03:44 +08001016#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001017 return mbedtls_ssl_conf_tls13_psk_enabled(ssl) &&
1018 mbedtls_ssl_tls13_psk_enabled(ssl) &&
1019 ssl_tls13_client_hello_has_exts_for_psk_key_exchange(ssl);
Jerry Yu77f01482022-07-11 07:03:24 +00001020#else
1021 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001022 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001023#endif
1024}
XiaokangQian7807f9f2022-02-15 10:04:37 +00001025
Jerry Yu77f01482022-07-11 07:03:24 +00001026MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001027static int ssl_tls13_check_psk_ephemeral_key_exchange(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001028{
Jerry Yue5991322022-11-07 14:03:44 +08001029#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01001030 return mbedtls_ssl_conf_tls13_psk_ephemeral_enabled(ssl) &&
1031 mbedtls_ssl_tls13_psk_ephemeral_enabled(ssl) &&
1032 ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(ssl);
Jerry Yu77f01482022-07-11 07:03:24 +00001033#else
1034 ((void) ssl);
Gilles Peskine449bd832023-01-11 14:50:10 +01001035 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001036#endif
1037}
1038
Gilles Peskine449bd832023-01-11 14:50:10 +01001039static int ssl_tls13_determine_key_exchange_mode(mbedtls_ssl_context *ssl)
Jerry Yu77f01482022-07-11 07:03:24 +00001040{
1041 /*
1042 * Determine the key exchange algorithm to use.
1043 * There are three types of key exchanges supported in TLS 1.3:
1044 * - (EC)DH with ECDSA,
1045 * - (EC)DH with PSK,
1046 * - plain PSK.
1047 *
1048 * The PSK-based key exchanges may additionally be used with 0-RTT.
1049 *
1050 * Our built-in order of preference is
Jerry Yuce6ed702022-07-22 21:49:53 +08001051 * 1 ) (EC)DHE-PSK Mode ( psk_ephemeral )
1052 * 2 ) Certificate Mode ( ephemeral )
1053 * 3 ) Plain PSK Mode ( psk )
Jerry Yu77f01482022-07-11 07:03:24 +00001054 */
1055
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001056 ssl->handshake->key_exchange_mode =
1057 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_NONE;
Jerry Yu77f01482022-07-11 07:03:24 +00001058
Gilles Peskine449bd832023-01-11 14:50:10 +01001059 if (ssl_tls13_check_psk_ephemeral_key_exchange(ssl)) {
Jerry Yu77f01482022-07-11 07:03:24 +00001060 ssl->handshake->key_exchange_mode =
1061 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001062 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk_ephemeral"));
1063 } else
1064 if (ssl_tls13_check_ephemeral_key_exchange(ssl)) {
Jerry Yu77f01482022-07-11 07:03:24 +00001065 ssl->handshake->key_exchange_mode =
1066 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
Gilles Peskine449bd832023-01-11 14:50:10 +01001067 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: ephemeral"));
1068 } else
1069 if (ssl_tls13_check_psk_key_exchange(ssl)) {
Jerry Yuce6ed702022-07-22 21:49:53 +08001070 ssl->handshake->key_exchange_mode =
1071 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
Gilles Peskine449bd832023-01-11 14:50:10 +01001072 MBEDTLS_SSL_DEBUG_MSG(2, ("key exchange mode: psk"));
1073 } else {
Jerry Yu77f01482022-07-11 07:03:24 +00001074 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001075 1,
1076 ("ClientHello message misses mandatory extensions."));
1077 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_MISSING_EXTENSION,
1078 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1079 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu77f01482022-07-11 07:03:24 +00001080 }
1081
Gilles Peskine449bd832023-01-11 14:50:10 +01001082 return 0;
Jerry Yu77f01482022-07-11 07:03:24 +00001083
XiaokangQian7807f9f2022-02-15 10:04:37 +00001084}
1085
XiaokangQian81802f42022-06-10 13:25:22 +00001086#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
Ronald Cron928cbd32022-10-04 16:14:26 +02001087 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Ronald Cron67ea2542022-09-15 17:34:42 +02001088
1089#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001090static psa_algorithm_t ssl_tls13_iana_sig_alg_to_psa_alg(uint16_t sig_alg)
Ronald Cron67ea2542022-09-15 17:34:42 +02001091{
Gilles Peskine449bd832023-01-11 14:50:10 +01001092 switch (sig_alg) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001093 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001094 return PSA_ALG_ECDSA(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001095 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001096 return PSA_ALG_ECDSA(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001097 case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001098 return PSA_ALG_ECDSA(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001099 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001100 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001101 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001102 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001103 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001104 return PSA_ALG_RSA_PSS(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001105 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
Gilles Peskine449bd832023-01-11 14:50:10 +01001106 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256);
Ronald Cron67ea2542022-09-15 17:34:42 +02001107 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384:
Gilles Peskine449bd832023-01-11 14:50:10 +01001108 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_384);
Ronald Cron67ea2542022-09-15 17:34:42 +02001109 case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512:
Gilles Peskine449bd832023-01-11 14:50:10 +01001110 return PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_512);
Ronald Cron67ea2542022-09-15 17:34:42 +02001111 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01001112 return PSA_ALG_NONE;
Ronald Cron67ea2542022-09-15 17:34:42 +02001113 }
1114}
1115#endif /* MBEDTLS_USE_PSA_CRYPTO */
1116
XiaokangQian23c5be62022-06-07 02:04:34 +00001117/*
XiaokangQianfb665a82022-06-15 03:57:21 +00001118 * Pick best ( private key, certificate chain ) pair based on the signature
1119 * algorithms supported by the client.
XiaokangQian23c5be62022-06-07 02:04:34 +00001120 */
Ronald Cronce7d76e2022-07-08 18:56:49 +02001121MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001122static int ssl_tls13_pick_key_cert(mbedtls_ssl_context *ssl)
XiaokangQian23c5be62022-06-07 02:04:34 +00001123{
XiaokangQianfb665a82022-06-15 03:57:21 +00001124 mbedtls_ssl_key_cert *key_cert, *key_cert_list;
XiaokangQian81802f42022-06-10 13:25:22 +00001125 const uint16_t *sig_alg = ssl->handshake->received_sig_algs;
XiaokangQian23c5be62022-06-07 02:04:34 +00001126
1127#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01001128 if (ssl->handshake->sni_key_cert != NULL) {
XiaokangQianfb665a82022-06-15 03:57:21 +00001129 key_cert_list = ssl->handshake->sni_key_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001130 } else
XiaokangQian23c5be62022-06-07 02:04:34 +00001131#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Gilles Peskine449bd832023-01-11 14:50:10 +01001132 key_cert_list = ssl->conf->key_cert;
XiaokangQian23c5be62022-06-07 02:04:34 +00001133
Gilles Peskine449bd832023-01-11 14:50:10 +01001134 if (key_cert_list == NULL) {
1135 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate"));
1136 return -1;
XiaokangQian23c5be62022-06-07 02:04:34 +00001137 }
1138
Gilles Peskine449bd832023-01-11 14:50:10 +01001139 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) {
1140 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001141 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001142 }
Ronald Cron67ea2542022-09-15 17:34:42 +02001143
Gilles Peskine449bd832023-01-11 14:50:10 +01001144 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001145 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001146 }
Ronald Cron67ea2542022-09-15 17:34:42 +02001147
Gilles Peskine449bd832023-01-11 14:50:10 +01001148 for (key_cert = key_cert_list; key_cert != NULL;
1149 key_cert = key_cert->next) {
Ronald Cron67ea2542022-09-15 17:34:42 +02001150#if defined(MBEDTLS_USE_PSA_CRYPTO)
1151 psa_algorithm_t psa_alg = PSA_ALG_NONE;
1152#endif /* MBEDTLS_USE_PSA_CRYPTO */
1153
Gilles Peskine449bd832023-01-11 14:50:10 +01001154 MBEDTLS_SSL_DEBUG_CRT(3, "certificate (chain) candidate",
1155 key_cert->cert);
XiaokangQian81802f42022-06-10 13:25:22 +00001156
1157 /*
Gilles Peskine449bd832023-01-11 14:50:10 +01001158 * This avoids sending the client a cert it'll reject based on
1159 * keyUsage or other extensions.
1160 */
1161 if (mbedtls_x509_crt_check_key_usage(
1162 key_cert->cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0 ||
XiaokangQian81802f42022-06-10 13:25:22 +00001163 mbedtls_x509_crt_check_extended_key_usage(
XiaokangQianfb665a82022-06-15 03:57:21 +00001164 key_cert->cert, MBEDTLS_OID_SERVER_AUTH,
Gilles Peskine449bd832023-01-11 14:50:10 +01001165 MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH)) != 0) {
1166 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
1167 "(extended) key usage extension"));
XiaokangQian81802f42022-06-10 13:25:22 +00001168 continue;
1169 }
XiaokangQian23c5be62022-06-07 02:04:34 +00001170
Gilles Peskine449bd832023-01-11 14:50:10 +01001171 MBEDTLS_SSL_DEBUG_MSG(3,
1172 ("ssl_tls13_pick_key_cert:"
1173 "check signature algorithm %s [%04x]",
1174 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1175 *sig_alg));
Ronald Cron67ea2542022-09-15 17:34:42 +02001176#if defined(MBEDTLS_USE_PSA_CRYPTO)
Gilles Peskine449bd832023-01-11 14:50:10 +01001177 psa_alg = ssl_tls13_iana_sig_alg_to_psa_alg(*sig_alg);
Ronald Cron67ea2542022-09-15 17:34:42 +02001178#endif /* MBEDTLS_USE_PSA_CRYPTO */
1179
Gilles Peskine449bd832023-01-11 14:50:10 +01001180 if (mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
1181 *sig_alg, &key_cert->cert->pk)
Ronald Cron67ea2542022-09-15 17:34:42 +02001182#if defined(MBEDTLS_USE_PSA_CRYPTO)
1183 && psa_alg != PSA_ALG_NONE &&
Gilles Peskine449bd832023-01-11 14:50:10 +01001184 mbedtls_pk_can_do_ext(&key_cert->cert->pk, psa_alg,
1185 PSA_KEY_USAGE_SIGN_HASH) == 1
Ronald Cron67ea2542022-09-15 17:34:42 +02001186#endif /* MBEDTLS_USE_PSA_CRYPTO */
Gilles Peskine449bd832023-01-11 14:50:10 +01001187 ) {
XiaokangQianfb665a82022-06-15 03:57:21 +00001188 ssl->handshake->key_cert = key_cert;
Gilles Peskine449bd832023-01-11 14:50:10 +01001189 MBEDTLS_SSL_DEBUG_MSG(3,
1190 ("ssl_tls13_pick_key_cert:"
1191 "selected signature algorithm"
1192 " %s [%04x]",
1193 mbedtls_ssl_sig_alg_to_str(*sig_alg),
1194 *sig_alg));
XiaokangQianfb665a82022-06-15 03:57:21 +00001195 MBEDTLS_SSL_DEBUG_CRT(
Gilles Peskine449bd832023-01-11 14:50:10 +01001196 3, "selected certificate (chain)",
1197 ssl->handshake->key_cert->cert);
1198 return 0;
XiaokangQian81802f42022-06-10 13:25:22 +00001199 }
XiaokangQian81802f42022-06-10 13:25:22 +00001200 }
XiaokangQian23c5be62022-06-07 02:04:34 +00001201 }
1202
Gilles Peskine449bd832023-01-11 14:50:10 +01001203 MBEDTLS_SSL_DEBUG_MSG(2, ("ssl_tls13_pick_key_cert:"
1204 "no suitable certificate found"));
1205 return -1;
XiaokangQian23c5be62022-06-07 02:04:34 +00001206}
XiaokangQian81802f42022-06-10 13:25:22 +00001207#endif /* MBEDTLS_X509_CRT_PARSE_C &&
Ronald Cron928cbd32022-10-04 16:14:26 +02001208 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian23c5be62022-06-07 02:04:34 +00001209
XiaokangQian4080a7f2022-04-11 09:55:18 +00001210/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001211 *
1212 * STATE HANDLING: ClientHello
1213 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001214 * There are three possible classes of outcomes when parsing the ClientHello:
XiaokangQianed582dd2022-04-13 08:21:05 +00001215 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001216 * 1) The ClientHello was well-formed and matched the server's configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +00001217 *
1218 * In this case, the server progresses to sending its ServerHello.
1219 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001220 * 2) The ClientHello was well-formed but didn't match the server's
1221 * configuration.
XiaokangQianed582dd2022-04-13 08:21:05 +00001222 *
1223 * For example, the client might not have offered a key share which
1224 * the server supports, or the server might require a cookie.
1225 *
1226 * In this case, the server sends a HelloRetryRequest.
1227 *
XiaokangQianb67384d2022-04-19 00:02:38 +00001228 * 3) The ClientHello was ill-formed
XiaokangQianed582dd2022-04-13 08:21:05 +00001229 *
1230 * In this case, we abort the handshake.
1231 *
1232 */
1233
1234/*
XiaokangQian4080a7f2022-04-11 09:55:18 +00001235 * Structure of this message:
1236 *
XiaokangQiane8ff3502022-04-22 02:34:40 +00001237 * uint16 ProtocolVersion;
1238 * opaque Random[32];
1239 * uint8 CipherSuite[2]; // Cryptographic suite selector
XiaokangQian4080a7f2022-04-11 09:55:18 +00001240 *
XiaokangQiane8ff3502022-04-22 02:34:40 +00001241 * struct {
1242 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
1243 * Random random;
1244 * opaque legacy_session_id<0..32>;
1245 * CipherSuite cipher_suites<2..2^16-2>;
1246 * opaque legacy_compression_methods<1..2^8-1>;
1247 * Extension extensions<8..2^16-1>;
1248 * } ClientHello;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001249 */
XiaokangQianed582dd2022-04-13 08:21:05 +00001250
1251#define SSL_CLIENT_HELLO_OK 0
1252#define SSL_CLIENT_HELLO_HRR_REQUIRED 1
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001253#define SSL_CLIENT_HELLO_TLS1_2 2
XiaokangQianed582dd2022-04-13 08:21:05 +00001254
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001255MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001256static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl,
1257 const unsigned char *buf,
1258 const unsigned char *end)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001259{
XiaokangQianb67384d2022-04-19 00:02:38 +00001260 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1261 const unsigned char *p = buf;
Ronald Crond540d992023-03-07 09:41:48 +01001262 const unsigned char *random;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001263 size_t legacy_session_id_len;
Ronald Croncada4102023-03-07 09:51:39 +01001264 const unsigned char *legacy_session_id;
XiaokangQian318dc762022-04-20 09:43:51 +00001265 size_t cipher_suites_len;
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001266 const unsigned char *cipher_suites;
XiaokangQian060d8672022-04-21 09:24:56 +00001267 const unsigned char *cipher_suites_end;
XiaokangQianb67384d2022-04-19 00:02:38 +00001268 size_t extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001269 const unsigned char *extensions_end;
Ronald Croneff56732023-04-03 17:36:31 +02001270 const unsigned char *supported_versions_data;
1271 const unsigned char *supported_versions_data_end;
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001272 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
Jerry Yu49ca9282022-05-05 11:05:22 +08001273 int hrr_required = 0;
Ronald Cron8a74f072023-06-14 17:59:29 +02001274 int no_usable_share_for_key_agreement = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001275
Ronald Cron41a443a2022-10-04 16:38:25 +02001276#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yu29d9faa2022-08-23 17:52:45 +08001277 const unsigned char *pre_shared_key_ext = NULL;
Jerry Yu1c105562022-07-10 06:32:38 +00001278 const unsigned char *pre_shared_key_ext_end = NULL;
Ronald Cron41a443a2022-10-04 16:38:25 +02001279#endif
XiaokangQian7807f9f2022-02-15 10:04:37 +00001280
XiaokangQian7807f9f2022-02-15 10:04:37 +00001281 /*
XiaokangQianb67384d2022-04-19 00:02:38 +00001282 * ClientHello layout:
XiaokangQian7807f9f2022-02-15 10:04:37 +00001283 * 0 . 1 protocol version
XiaokangQiane8ff3502022-04-22 02:34:40 +00001284 * 2 . 33 random bytes
XiaokangQianc5763b52022-04-02 03:34:37 +00001285 * 34 . 34 session id length ( 1 byte )
XiaokangQian7807f9f2022-02-15 10:04:37 +00001286 * 35 . 34+x session id
XiaokangQian7807f9f2022-02-15 10:04:37 +00001287 * .. . .. ciphersuite list length ( 2 bytes )
1288 * .. . .. ciphersuite list
1289 * .. . .. compression alg. list length ( 1 byte )
1290 * .. . .. compression alg. list
1291 * .. . .. extensions length ( 2 bytes, optional )
1292 * .. . .. extensions ( optional )
1293 */
1294
XiaokangQianb67384d2022-04-19 00:02:38 +00001295 /*
bootstrap-prime6dbbf442022-05-17 19:30:44 -04001296 * Minimal length ( with everything empty and extensions omitted ) is
XiaokangQian7807f9f2022-02-15 10:04:37 +00001297 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1298 * read at least up to session id length without worrying.
1299 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001300 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 38);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001301
1302 /* ...
1303 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
1304 * ...
1305 * with ProtocolVersion defined as:
1306 * uint16 ProtocolVersion;
1307 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001308 if (mbedtls_ssl_read_version(p, ssl->conf->transport) !=
1309 MBEDTLS_SSL_VERSION_TLS1_2) {
1310 MBEDTLS_SSL_DEBUG_MSG(1, ("Unsupported version of TLS."));
1311 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION,
1312 MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION);
1313 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001314 }
1315 p += 2;
1316
Jerry Yuc1be19f2022-04-23 16:11:39 +08001317 /* ...
1318 * Random random;
1319 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001320 * with Random defined as:
1321 * opaque Random[32];
XiaokangQian7807f9f2022-02-15 10:04:37 +00001322 */
Ronald Crond540d992023-03-07 09:41:48 +01001323 random = p;
XiaokangQian08037552022-04-20 07:16:41 +00001324 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001325
Jerry Yuc1be19f2022-04-23 16:11:39 +08001326 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001327 * opaque legacy_session_id<0..32>;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001328 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +00001329 */
Ronald Croncada4102023-03-07 09:51:39 +01001330 legacy_session_id_len = *(p++);
1331 legacy_session_id = p;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001332
XiaokangQianb67384d2022-04-19 00:02:38 +00001333 /*
1334 * Check we have enough data for the legacy session identifier
Jerry Yue95c8af2022-07-26 15:48:20 +08001335 * and the ciphersuite list length.
XiaokangQianb67384d2022-04-19 00:02:38 +00001336 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001337 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, legacy_session_id_len + 2);
XiaokangQian4080a7f2022-04-11 09:55:18 +00001338 p += legacy_session_id_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001339
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001340 /* ...
1341 * CipherSuite cipher_suites<2..2^16-2>;
1342 * ...
1343 * with CipherSuite defined as:
1344 * uint8 CipherSuite[2];
1345 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001346 cipher_suites_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001347 p += 2;
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001348 cipher_suites = p;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001349
Ronald Cronfc7ae872023-02-16 15:32:19 +01001350 /*
1351 * The length of the ciphersuite list has to be even.
1352 */
1353 if (cipher_suites_len & 1) {
1354 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
1355 MBEDTLS_ERR_SSL_DECODE_ERROR);
1356 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1357 }
1358
XiaokangQianb67384d2022-04-19 00:02:38 +00001359 /* Check we have enough data for the ciphersuite list, the legacy
1360 * compression methods and the length of the extensions.
Jerry Yue95c8af2022-07-26 15:48:20 +08001361 *
1362 * cipher_suites cipher_suites_len bytes
1363 * legacy_compression_methods 2 bytes
1364 * extensions_len 2 bytes
XiaokangQianb67384d2022-04-19 00:02:38 +00001365 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001366 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, cipher_suites_len + 2 + 2);
Ronald Cron8c527d02023-03-07 15:47:47 +01001367 p += cipher_suites_len;
1368 cipher_suites_end = p;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001369
1370 /*
Ronald Cron8c527d02023-03-07 15:47:47 +01001371 * Search for the supported versions extension and parse it to determine
1372 * if the client supports TLS 1.3.
1373 */
1374 ret = mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts(
1375 ssl, p + 2, end,
Ronald Croneff56732023-04-03 17:36:31 +02001376 &supported_versions_data, &supported_versions_data_end);
Ronald Cron8c527d02023-03-07 15:47:47 +01001377 if (ret < 0) {
1378 MBEDTLS_SSL_DEBUG_RET(1,
1379 ("mbedtls_ssl_tls13_is_supported_versions_ext_present_in_exts"), ret);
1380 return ret;
1381 }
1382
1383 if (ret == 0) {
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001384 return SSL_CLIENT_HELLO_TLS1_2;
Ronald Cron8c527d02023-03-07 15:47:47 +01001385 }
1386
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001387 if (ret == 1) {
1388 ret = ssl_tls13_parse_supported_versions_ext(ssl,
Ronald Croneff56732023-04-03 17:36:31 +02001389 supported_versions_data,
1390 supported_versions_data_end);
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001391 if (ret < 0) {
1392 MBEDTLS_SSL_DEBUG_RET(1,
1393 ("ssl_tls13_parse_supported_versions_ext"), ret);
1394 return ret;
1395 }
1396
Ronald Cronb828c7d2023-04-03 16:37:22 +02001397 /*
1398 * The supported versions extension was parsed successfully as the
1399 * value returned by ssl_tls13_parse_supported_versions_ext() is
1400 * positive. The return value is then equal to
1401 * MBEDTLS_SSL_VERSION_TLS1_2 or MBEDTLS_SSL_VERSION_TLS1_3, defining
1402 * the TLS version to negotiate.
1403 */
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001404 if (MBEDTLS_SSL_VERSION_TLS1_2 == ret) {
1405 return SSL_CLIENT_HELLO_TLS1_2;
1406 }
Ronald Cron8c527d02023-03-07 15:47:47 +01001407 }
1408
1409 /*
1410 * We negotiate TLS 1.3.
Ronald Cron64582392023-03-07 09:21:40 +01001411 */
1412 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1413
1414#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1415 /* Store minor version for later use with ticket serialization. */
1416 ssl->session_negotiate->tls_version = MBEDTLS_SSL_VERSION_TLS1_3;
1417 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
1418#endif
1419
1420 /*
Ronald Crondad02b22023-04-06 09:57:52 +02001421 * We are negotiating the version 1.3 of the protocol. Do what we have
Ronald Croncada4102023-03-07 09:51:39 +01001422 * postponed: copy of the client random bytes, copy of the legacy session
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001423 * identifier and selection of the TLS 1.3 cipher suite.
Ronald Crond540d992023-03-07 09:41:48 +01001424 */
1425 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes",
1426 random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1427 memcpy(&handshake->randbytes[0], random, MBEDTLS_CLIENT_HELLO_RANDOM_LEN);
1428
Ronald Croncada4102023-03-07 09:51:39 +01001429 if (legacy_session_id_len > sizeof(ssl->session_negotiate->id)) {
1430 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1431 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1432 }
1433 ssl->session_negotiate->id_len = legacy_session_id_len;
1434 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id",
1435 legacy_session_id, legacy_session_id_len);
1436 memcpy(&ssl->session_negotiate->id[0],
1437 legacy_session_id, legacy_session_id_len);
1438
Ronald Crond540d992023-03-07 09:41:48 +01001439 /*
Jerry Yu5725f1c2022-08-21 17:27:16 +08001440 * Search for a matching ciphersuite
1441 */
Ronald Cron2f16b4e2023-03-07 10:07:32 +01001442 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, list of cipher suites",
1443 cipher_suites, cipher_suites_len);
Ronald Crone45afd72023-04-04 15:10:06 +02001444 for (const unsigned char *cipher_suites_p = cipher_suites;
1445 cipher_suites_p < cipher_suites_end; cipher_suites_p += 2) {
XiaokangQiane8ff3502022-04-22 02:34:40 +00001446 uint16_t cipher_suite;
Gilles Peskine449bd832023-01-11 14:50:10 +01001447 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001448
Ronald Crond89360b2023-02-21 08:53:33 +01001449 /*
Ronald Crone45afd72023-04-04 15:10:06 +02001450 * "cipher_suites_end - cipher_suites_p is even" is an invariant of the
1451 * loop. As cipher_suites_end - cipher_suites_p > 0, we have
1452 * cipher_suites_end - cipher_suites_p >= 2 and it is thus safe to read
1453 * two bytes.
Ronald Crond89360b2023-02-21 08:53:33 +01001454 */
Ronald Crone45afd72023-04-04 15:10:06 +02001455 cipher_suite = MBEDTLS_GET_UINT16_BE(cipher_suites_p, 0);
Jerry Yuc5a23a02022-08-25 10:51:44 +08001456 ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(
Gilles Peskine449bd832023-01-11 14:50:10 +01001457 ssl, cipher_suite);
1458 if (ciphersuite_info == NULL) {
Jerry Yu5725f1c2022-08-21 17:27:16 +08001459 continue;
Gilles Peskine449bd832023-01-11 14:50:10 +01001460 }
Jerry Yu5725f1c2022-08-21 17:27:16 +08001461
Jerry Yu5725f1c2022-08-21 17:27:16 +08001462 ssl->session_negotiate->ciphersuite = cipher_suite;
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001463 handshake->ciphersuite_info = ciphersuite_info;
Gilles Peskine449bd832023-01-11 14:50:10 +01001464 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %04x - %s",
1465 cipher_suite,
1466 ciphersuite_info->name));
Ronald Cron25e9ec62023-02-16 15:35:16 +01001467 break;
XiaokangQian17f974c2022-04-19 09:57:41 +00001468 }
Jerry Yu5725f1c2022-08-21 17:27:16 +08001469
Gilles Peskine449bd832023-01-11 14:50:10 +01001470 if (handshake->ciphersuite_info == NULL) {
1471 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
1472 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
1473 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5725f1c2022-08-21 17:27:16 +08001474 }
Jerry Yuc1be19f2022-04-23 16:11:39 +08001475
XiaokangQian4080a7f2022-04-11 09:55:18 +00001476 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001477 * opaque legacy_compression_methods<1..2^8-1>;
XiaokangQian4080a7f2022-04-11 09:55:18 +00001478 * ...
XiaokangQian7807f9f2022-02-15 10:04:37 +00001479 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001480 if (p[0] != 1 || p[1] != MBEDTLS_SSL_COMPRESS_NULL) {
1481 MBEDTLS_SSL_DEBUG_MSG(1, ("bad legacy compression method"));
1482 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
1483 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1484 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001485 }
XiaokangQianb67384d2022-04-19 00:02:38 +00001486 p += 2;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001487
Jerry Yuc1be19f2022-04-23 16:11:39 +08001488 /* ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001489 * Extension extensions<8..2^16-1>;
Jerry Yuc1be19f2022-04-23 16:11:39 +08001490 * ...
XiaokangQianb67384d2022-04-19 00:02:38 +00001491 * with Extension defined as:
1492 * struct {
1493 * ExtensionType extension_type;
1494 * opaque extension_data<0..2^16-1>;
1495 * } Extension;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001496 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001497 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001498 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01001499 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, extensions_len);
XiaokangQiane8ff3502022-04-22 02:34:40 +00001500 extensions_end = p + extensions_len;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001501
Gilles Peskine449bd832023-01-11 14:50:10 +01001502 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", p, extensions_len);
Jerry Yu63a459c2022-10-31 13:38:40 +08001503 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
Jerry Yu0c354a22022-08-29 15:25:36 +08001504
Gilles Peskine449bd832023-01-11 14:50:10 +01001505 while (p < extensions_end) {
XiaokangQian7807f9f2022-02-15 10:04:37 +00001506 unsigned int extension_type;
1507 size_t extension_data_len;
1508 const unsigned char *extension_data_end;
1509
Jerry Yu0c354a22022-08-29 15:25:36 +08001510 /* RFC 8446, section 4.2.11
Jerry Yu1c9247c2022-07-21 12:37:39 +08001511 *
1512 * The "pre_shared_key" extension MUST be the last extension in the
1513 * ClientHello (this facilitates implementation as described below).
1514 * Servers MUST check that it is the last extension and otherwise fail
1515 * the handshake with an "illegal_parameter" alert.
1516 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001517 if (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY)) {
Jerry Yu1c9247c2022-07-21 12:37:39 +08001518 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01001519 3, ("pre_shared_key is not last extension."));
Jerry Yu1c9247c2022-07-21 12:37:39 +08001520 MBEDTLS_SSL_PEND_FATAL_ALERT(
1521 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01001522 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1523 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu1c9247c2022-07-21 12:37:39 +08001524 }
1525
Gilles Peskine449bd832023-01-11 14:50:10 +01001526 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4);
1527 extension_type = MBEDTLS_GET_UINT16_BE(p, 0);
1528 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001529 p += 4;
1530
Gilles Peskine449bd832023-01-11 14:50:10 +01001531 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len);
XiaokangQian7807f9f2022-02-15 10:04:37 +00001532 extension_data_end = p + extension_data_len;
1533
Jerry Yuc4bf5d62022-10-29 09:08:47 +08001534 ret = mbedtls_ssl_tls13_check_received_extension(
Gilles Peskine449bd832023-01-11 14:50:10 +01001535 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, extension_type,
1536 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CH);
1537 if (ret != 0) {
1538 return ret;
1539 }
Jerry Yue18dc7e2022-08-04 16:29:22 +08001540
Gilles Peskine449bd832023-01-11 14:50:10 +01001541 switch (extension_type) {
XiaokangQian40a35232022-05-07 09:02:40 +00001542#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1543 case MBEDTLS_TLS_EXT_SERVERNAME:
Gilles Peskine449bd832023-01-11 14:50:10 +01001544 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension"));
1545 ret = mbedtls_ssl_parse_server_name_ext(ssl, p,
1546 extension_data_end);
1547 if (ret != 0) {
XiaokangQian40a35232022-05-07 09:02:40 +00001548 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001549 1, "mbedtls_ssl_parse_servername_ext", ret);
1550 return ret;
XiaokangQian40a35232022-05-07 09:02:40 +00001551 }
XiaokangQian40a35232022-05-07 09:02:40 +00001552 break;
1553#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1554
Przemek Stekiel8c0a9532023-06-15 16:48:19 +02001555#if defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001556 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
Gilles Peskine449bd832023-01-11 14:50:10 +01001557 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported group extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001558
1559 /* Supported Groups Extension
1560 *
1561 * When sent by the client, the "supported_groups" extension
1562 * indicates the named groups which the client supports,
1563 * ordered from most preferred to least preferred.
1564 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001565 ret = ssl_tls13_parse_supported_groups_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001566 ssl, p, extension_data_end);
1567 if (ret != 0) {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001568 MBEDTLS_SSL_DEBUG_RET(
Xiaokang Qian8bce0e62023-04-04 10:15:48 +00001569 1, "ssl_tls13_parse_supported_groups_ext", ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01001570 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001571 }
1572
XiaokangQian7807f9f2022-02-15 10:04:37 +00001573 break;
Przemek Stekiel8c0a9532023-06-15 16:48:19 +02001574#endif /* PSA_WANT_ALG_ECDH || PSA_WANT_ALG_FFDH*/
XiaokangQian7807f9f2022-02-15 10:04:37 +00001575
Valerio Settic9ae8622023-07-25 11:23:50 +02001576#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001577 case MBEDTLS_TLS_EXT_KEY_SHARE:
Gilles Peskine449bd832023-01-11 14:50:10 +01001578 MBEDTLS_SSL_DEBUG_MSG(3, ("found key share extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001579
1580 /*
1581 * Key Share Extension
1582 *
1583 * When sent by the client, the "key_share" extension
1584 * contains the endpoint's cryptographic parameters for
1585 * ECDHE/DHE key establishment methods.
1586 */
Jerry Yuc1be19f2022-04-23 16:11:39 +08001587 ret = ssl_tls13_parse_key_shares_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001588 ssl, p, extension_data_end);
1589 if (ret == SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH) {
Ronald Cron8a74f072023-06-14 17:59:29 +02001590 MBEDTLS_SSL_DEBUG_MSG(2, ("No usable share for key agreement."));
1591 no_usable_share_for_key_agreement = 1;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001592 }
1593
Gilles Peskine449bd832023-01-11 14:50:10 +01001594 if (ret < 0) {
Jerry Yu582dd062022-04-22 21:59:01 +08001595 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001596 1, "ssl_tls13_parse_key_shares_ext", ret);
1597 return ret;
Jerry Yu582dd062022-04-22 21:59:01 +08001598 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001599
XiaokangQian7807f9f2022-02-15 10:04:37 +00001600 break;
Valerio Settic9ae8622023-07-25 11:23:50 +02001601#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001602
1603 case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS:
Ronald Cron8c527d02023-03-07 15:47:47 +01001604 /* Already parsed */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001605 break;
1606
Ronald Cron41a443a2022-10-04 16:38:25 +02001607#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yue19e3b92022-07-08 12:04:51 +00001608 case MBEDTLS_TLS_EXT_PSK_KEY_EXCHANGE_MODES:
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001609 MBEDTLS_SSL_DEBUG_MSG(
1610 3, ("found psk key exchange modes extension"));
Jerry Yue19e3b92022-07-08 12:04:51 +00001611
1612 ret = ssl_tls13_parse_key_exchange_modes_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001613 ssl, p, extension_data_end);
1614 if (ret != 0) {
Jerry Yue19e3b92022-07-08 12:04:51 +00001615 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001616 1, "ssl_tls13_parse_key_exchange_modes_ext", ret);
1617 return ret;
Jerry Yue19e3b92022-07-08 12:04:51 +00001618 }
1619
Jerry Yue19e3b92022-07-08 12:04:51 +00001620 break;
Ronald Cron41a443a2022-10-04 16:38:25 +02001621#endif
Jerry Yue19e3b92022-07-08 12:04:51 +00001622
Jerry Yu1c105562022-07-10 06:32:38 +00001623 case MBEDTLS_TLS_EXT_PRE_SHARED_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01001624 MBEDTLS_SSL_DEBUG_MSG(3, ("found pre_shared_key extension"));
1625 if ((handshake->received_extensions &
1626 MBEDTLS_SSL_EXT_MASK(PSK_KEY_EXCHANGE_MODES)) == 0) {
Jerry Yu13ab81d2022-07-22 23:17:11 +08001627 MBEDTLS_SSL_PEND_FATAL_ALERT(
1628 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
Gilles Peskine449bd832023-01-11 14:50:10 +01001629 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
1630 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
Jerry Yu13ab81d2022-07-22 23:17:11 +08001631 }
Ronald Cron41a443a2022-10-04 16:38:25 +02001632#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Jerry Yu1c105562022-07-10 06:32:38 +00001633 /* Delay processing of the PSK identity once we have
1634 * found out which algorithms to use. We keep a pointer
1635 * to the buffer and the size for later processing.
1636 */
Jerry Yu29d9faa2022-08-23 17:52:45 +08001637 pre_shared_key_ext = p;
Jerry Yu1c105562022-07-10 06:32:38 +00001638 pre_shared_key_ext_end = extension_data_end;
Jerry Yue18dc7e2022-08-04 16:29:22 +08001639#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yu1c105562022-07-10 06:32:38 +00001640 break;
Jerry Yu1c105562022-07-10 06:32:38 +00001641
XiaokangQianacb39922022-06-17 10:18:48 +00001642#if defined(MBEDTLS_SSL_ALPN)
1643 case MBEDTLS_TLS_EXT_ALPN:
Gilles Peskine449bd832023-01-11 14:50:10 +01001644 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension"));
XiaokangQianacb39922022-06-17 10:18:48 +00001645
Gilles Peskine449bd832023-01-11 14:50:10 +01001646 ret = mbedtls_ssl_parse_alpn_ext(ssl, p, extension_data_end);
1647 if (ret != 0) {
XiaokangQianacb39922022-06-17 10:18:48 +00001648 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001649 1, ("mbedtls_ssl_parse_alpn_ext"), ret);
1650 return ret;
XiaokangQianacb39922022-06-17 10:18:48 +00001651 }
XiaokangQianacb39922022-06-17 10:18:48 +00001652 break;
1653#endif /* MBEDTLS_SSL_ALPN */
1654
Ronald Cron928cbd32022-10-04 16:14:26 +02001655#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001656 case MBEDTLS_TLS_EXT_SIG_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +01001657 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension"));
XiaokangQian7807f9f2022-02-15 10:04:37 +00001658
Gabor Mezei078e8032022-04-27 21:17:56 +02001659 ret = mbedtls_ssl_parse_sig_alg_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001660 ssl, p, extension_data_end);
1661 if (ret != 0) {
Xiaokang Qian49f39c12023-04-06 02:31:02 +00001662 MBEDTLS_SSL_DEBUG_RET(
1663 1, "mbedtls_ssl_parse_sig_alg_ext", ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01001664 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001665 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001666 break;
Ronald Cron928cbd32022-10-04 16:14:26 +02001667#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001668
Jan Bruckner151f6422023-02-10 12:45:19 +01001669#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
1670 case MBEDTLS_TLS_EXT_RECORD_SIZE_LIMIT:
1671 MBEDTLS_SSL_DEBUG_MSG(3, ("found record_size_limit extension"));
1672
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00001673 ret = mbedtls_ssl_tls13_parse_record_size_limit_ext(
1674 ssl, p, extension_data_end);
Jan Bruckner151f6422023-02-10 12:45:19 +01001675
Xiaokang Qian09c3ccc2023-04-04 10:18:38 +00001676 /*
1677 * TODO: Return unconditionally here until we handle the record
1678 * size limit correctly.
1679 * Once handled correctly, only return in case of errors.
1680 */
Jan Bruckner151f6422023-02-10 12:45:19 +01001681 return ret;
1682
1683 break;
1684#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */
1685
XiaokangQian7807f9f2022-02-15 10:04:37 +00001686 default:
Jerry Yu79aa7212022-11-08 21:30:21 +08001687 MBEDTLS_SSL_PRINT_EXT(
Jerry Yu63a459c2022-10-31 13:38:40 +08001688 3, MBEDTLS_SSL_HS_CLIENT_HELLO,
Gilles Peskine449bd832023-01-11 14:50:10 +01001689 extension_type, "( ignored )");
Jerry Yu0c354a22022-08-29 15:25:36 +08001690 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001691 }
1692
1693 p += extension_data_len;
1694 }
1695
Gilles Peskine449bd832023-01-11 14:50:10 +01001696 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CLIENT_HELLO,
1697 handshake->received_extensions);
Jerry Yue18dc7e2022-08-04 16:29:22 +08001698
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001699 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl,
1700 MBEDTLS_SSL_HS_CLIENT_HELLO,
1701 p - buf);
1702 if (0 != ret) {
1703 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_add_hs_hdr_to_checksum"), ret);
1704 return ret;
1705 }
Jerry Yu032b15ce2022-07-11 06:10:03 +00001706
Ronald Cron41a443a2022-10-04 16:38:25 +02001707#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
XiaokangQian7807f9f2022-02-15 10:04:37 +00001708 /* Update checksum with either
1709 * - The entire content of the CH message, if no PSK extension is present
1710 * - The content up to but excluding the PSK extension, if present.
1711 */
Jerry Yu1c105562022-07-10 06:32:38 +00001712 /* If we've settled on a PSK-based exchange, parse PSK identity ext */
Gilles Peskine449bd832023-01-11 14:50:10 +01001713 if (mbedtls_ssl_tls13_some_psk_enabled(ssl) &&
1714 mbedtls_ssl_conf_tls13_some_psk_enabled(ssl) &&
1715 (handshake->received_extensions & MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY))) {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001716 ret = handshake->update_checksum(ssl, buf,
1717 pre_shared_key_ext - buf);
1718 if (0 != ret) {
1719 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1720 return ret;
1721 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001722 ret = ssl_tls13_parse_pre_shared_key_ext(ssl,
1723 pre_shared_key_ext,
1724 pre_shared_key_ext_end,
1725 cipher_suites,
1726 cipher_suites_end);
1727 if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) {
1728 handshake->received_extensions &= ~MBEDTLS_SSL_EXT_MASK(PRE_SHARED_KEY);
1729 } else if (ret != 0) {
Jerry Yu63a459c2022-10-31 13:38:40 +08001730 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01001731 1, "ssl_tls13_parse_pre_shared_key_ext", ret);
1732 return ret;
Jerry Yu1c105562022-07-10 06:32:38 +00001733 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001734 } else
Ronald Cron41a443a2022-10-04 16:38:25 +02001735#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */
Jerry Yu1c105562022-07-10 06:32:38 +00001736 {
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01001737 ret = handshake->update_checksum(ssl, buf, p - buf);
1738 if (0 != ret) {
1739 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1740 return ret;
1741 }
Jerry Yu1c105562022-07-10 06:32:38 +00001742 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001743
Gilles Peskine449bd832023-01-11 14:50:10 +01001744 ret = ssl_tls13_determine_key_exchange_mode(ssl);
1745 if (ret < 0) {
1746 return ret;
1747 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00001748
Ronald Cron8a74f072023-06-14 17:59:29 +02001749 if (ssl->handshake->key_exchange_mode !=
1750 MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK) {
1751 hrr_required = (no_usable_share_for_key_agreement != 0);
1752 }
1753
Gilles Peskine449bd832023-01-11 14:50:10 +01001754 mbedtls_ssl_optimize_checksum(ssl, handshake->ciphersuite_info);
Jerry Yue5834fd2022-08-29 20:16:09 +08001755
Gilles Peskine449bd832023-01-11 14:50:10 +01001756 return hrr_required ? SSL_CLIENT_HELLO_HRR_REQUIRED : SSL_CLIENT_HELLO_OK;
XiaokangQian75fe8c72022-06-15 09:42:45 +00001757}
1758
Jerry Yuab0da372023-02-08 13:55:24 +08001759#if defined(MBEDTLS_SSL_EARLY_DATA)
1760static void ssl_tls13_update_early_data_status(mbedtls_ssl_context *ssl)
1761{
1762 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
1763
1764 if ((handshake->received_extensions &
1765 MBEDTLS_SSL_EXT_MASK(EARLY_DATA)) == 0) {
1766 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yub47b2992023-10-18 15:50:35 +08001767 1, ("EarlyData: no early data extension received."));
Jerry Yuab0da372023-02-08 13:55:24 +08001768 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_RECEIVED;
1769 return;
1770 }
1771
1772 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED;
1773
Jerry Yu985c9672022-12-04 14:06:30 +08001774 if (ssl->conf->early_data_enabled == MBEDTLS_SSL_EARLY_DATA_DISABLED) {
1775 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu985c9672022-12-04 14:06:30 +08001776 1,
Jerry Yu454dda32023-10-31 15:13:54 +08001777 ("EarlyData: rejected, feature disabled in server configuration."));
Jerry Yu985c9672022-12-04 14:06:30 +08001778 return;
1779 }
1780
Jerry Yu454dda32023-10-31 15:13:54 +08001781 if (!handshake->resume) {
1782 /* We currently support early data only in the case of PSKs established
1783 via a NewSessionTicket message thus in the case of a session
1784 resumption. */
Jerry Yu985c9672022-12-04 14:06:30 +08001785 MBEDTLS_SSL_DEBUG_MSG(
Jerry Yu454dda32023-10-31 15:13:54 +08001786 1, ("EarlyData: rejected, not resumption session."));
Jerry Yu985c9672022-12-04 14:06:30 +08001787 return;
1788 }
1789
Jerry Yu985c9672022-12-04 14:06:30 +08001790
1791 /* TODO: Add more checks here. */
1792
1793 ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED;
1794
Jerry Yuab0da372023-02-08 13:55:24 +08001795}
1796#endif /* MBEDTLS_SSL_EARLY_DATA */
1797
XiaokangQian75fe8c72022-06-15 09:42:45 +00001798/* Update the handshake state machine */
1799
Ronald Cronce7d76e2022-07-08 18:56:49 +02001800MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001801static int ssl_tls13_postprocess_client_hello(mbedtls_ssl_context *ssl)
XiaokangQian75fe8c72022-06-15 09:42:45 +00001802{
1803 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1804
XiaokangQian7807f9f2022-02-15 10:04:37 +00001805 /*
XiaokangQianfb665a82022-06-15 03:57:21 +00001806 * Server certificate selection
1807 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001808 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) {
1809 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret);
1810 return ret;
XiaokangQianfb665a82022-06-15 03:57:21 +00001811 }
1812#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1813 ssl->handshake->sni_name = NULL;
1814 ssl->handshake->sni_name_len = 0;
1815#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
XiaokangQian7807f9f2022-02-15 10:04:37 +00001816
Gilles Peskine449bd832023-01-11 14:50:10 +01001817 ret = mbedtls_ssl_tls13_key_schedule_stage_early(ssl);
1818 if (ret != 0) {
1819 MBEDTLS_SSL_DEBUG_RET(1,
1820 "mbedtls_ssl_tls1_3_key_schedule_stage_early", ret);
1821 return ret;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001822 }
1823
Jerry Yuab0da372023-02-08 13:55:24 +08001824#if defined(MBEDTLS_SSL_EARLY_DATA)
1825 /* There is enough information, update early data state. */
1826 ssl_tls13_update_early_data_status(ssl);
Jerry Yuab0da372023-02-08 13:55:24 +08001827#endif /* MBEDTLS_SSL_EARLY_DATA */
1828
Gilles Peskine449bd832023-01-11 14:50:10 +01001829 return 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00001830
1831}
1832
1833/*
XiaokangQianed582dd2022-04-13 08:21:05 +00001834 * Main entry point from the state machine; orchestrates the otherfunctions.
1835 */
1836
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001837MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001838static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
XiaokangQianed582dd2022-04-13 08:21:05 +00001839{
1840
XiaokangQian08037552022-04-20 07:16:41 +00001841 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01001842 unsigned char *buf = NULL;
XiaokangQianed582dd2022-04-13 08:21:05 +00001843 size_t buflen = 0;
Jerry Yu4ca91402022-05-09 15:50:57 +08001844 int parse_client_hello_ret;
1845
Gilles Peskine449bd832023-01-11 14:50:10 +01001846 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
XiaokangQianed582dd2022-04-13 08:21:05 +00001847
Gilles Peskine449bd832023-01-11 14:50:10 +01001848 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
1849 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
1850 &buf, &buflen));
XiaokangQianed582dd2022-04-13 08:21:05 +00001851
Gilles Peskine449bd832023-01-11 14:50:10 +01001852 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf,
1853 buf + buflen));
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001854 parse_client_hello_ret = ret; /* Store positive return value of
1855 * parse_client_hello,
1856 * as negative error codes are handled
Jerry Yuf41553b2022-05-09 22:20:30 +08001857 * by MBEDTLS_SSL_PROC_CHK_NEG. */
Jerry Yu4ca91402022-05-09 15:50:57 +08001858
Ronald Cronb828c7d2023-04-03 16:37:22 +02001859 /*
1860 * Version 1.2 of the protocol has been chosen, set the
1861 * ssl->keep_current_message flag for the ClientHello to be kept and parsed
1862 * as a TLS 1.2 ClientHello. We also change ssl->tls_version to
1863 * MBEDTLS_SSL_VERSION_TLS1_2 thus from now on mbedtls_ssl_handshake_step()
1864 * will dispatch to the TLS 1.2 state machine.
1865 */
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001866 if (SSL_CLIENT_HELLO_TLS1_2 == parse_client_hello_ret) {
1867 ssl->keep_current_message = 1;
1868 ssl->tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
1869 return 0;
1870 }
1871
Gilles Peskine449bd832023-01-11 14:50:10 +01001872 MBEDTLS_SSL_PROC_CHK(ssl_tls13_postprocess_client_hello(ssl));
Jerry Yu582dd062022-04-22 21:59:01 +08001873
Ronald Cron5af4c7f2023-03-07 20:46:59 +01001874 if (SSL_CLIENT_HELLO_OK == parse_client_hello_ret) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001875 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO);
1876 } else {
1877 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HELLO_RETRY_REQUEST);
1878 }
XiaokangQianed582dd2022-04-13 08:21:05 +00001879
1880cleanup:
1881
Gilles Peskine449bd832023-01-11 14:50:10 +01001882 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello"));
1883 return ret;
XiaokangQianed582dd2022-04-13 08:21:05 +00001884}
1885
1886/*
Jerry Yu1c3e6882022-04-20 21:23:40 +08001887 * Handler for MBEDTLS_SSL_SERVER_HELLO
Jerry Yu5b64ae92022-03-30 17:15:02 +08001888 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001889MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001890static int ssl_tls13_prepare_server_hello(mbedtls_ssl_context *ssl)
Jerry Yuf4b27e42022-03-30 17:32:21 +08001891{
Jerry Yu637a3f12022-04-20 21:37:58 +08001892 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1893 unsigned char *server_randbytes =
Gilles Peskine449bd832023-01-11 14:50:10 +01001894 ssl->handshake->randbytes + MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
1895 if (ssl->conf->f_rng == NULL) {
1896 MBEDTLS_SSL_DEBUG_MSG(1, ("no RNG provided"));
1897 return MBEDTLS_ERR_SSL_NO_RNG;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001898 }
1899
Gilles Peskine449bd832023-01-11 14:50:10 +01001900 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, server_randbytes,
1901 MBEDTLS_SERVER_HELLO_RANDOM_LEN)) != 0) {
1902 MBEDTLS_SSL_DEBUG_RET(1, "f_rng", ret);
1903 return ret;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001904 }
1905
Gilles Peskine449bd832023-01-11 14:50:10 +01001906 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", server_randbytes,
1907 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yuf4b27e42022-03-30 17:32:21 +08001908
1909#if defined(MBEDTLS_HAVE_TIME)
YxCda609132023-05-22 12:08:12 -07001910 ssl->session_negotiate->start = mbedtls_time(NULL);
Jerry Yuf4b27e42022-03-30 17:32:21 +08001911#endif /* MBEDTLS_HAVE_TIME */
1912
Gilles Peskine449bd832023-01-11 14:50:10 +01001913 return ret;
Jerry Yuf4b27e42022-03-30 17:32:21 +08001914}
1915
Jerry Yu3bf2c642022-03-30 22:02:12 +08001916/*
Jerry Yue74e04a2022-04-21 09:23:16 +08001917 * ssl_tls13_write_server_hello_supported_versions_ext ():
Jerry Yu3bf2c642022-03-30 22:02:12 +08001918 *
1919 * struct {
Jerry Yufb9f54d2022-04-06 10:08:34 +08001920 * ProtocolVersion selected_version;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001921 * } SupportedVersions;
1922 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001923MBEDTLS_CHECK_RETURN_CRITICAL
Jerry Yue74e04a2022-04-21 09:23:16 +08001924static int ssl_tls13_write_server_hello_supported_versions_ext(
Gilles Peskine449bd832023-01-11 14:50:10 +01001925 mbedtls_ssl_context *ssl,
1926 unsigned char *buf,
1927 unsigned char *end,
1928 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001929{
Jerry Yu3bf2c642022-03-30 22:02:12 +08001930 *out_len = 0;
1931
Gilles Peskine449bd832023-01-11 14:50:10 +01001932 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, write selected version"));
Jerry Yu3bf2c642022-03-30 22:02:12 +08001933
1934 /* Check if we have space to write the extension:
1935 * - extension_type (2 bytes)
1936 * - extension_data_length (2 bytes)
Jerry Yu349a6132022-04-14 20:52:56 +08001937 * - selected_version (2 bytes)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001938 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001939 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001940
Gilles Peskine449bd832023-01-11 14:50:10 +01001941 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, buf, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001942
Gilles Peskine449bd832023-01-11 14:50:10 +01001943 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001944
Gilles Peskine449bd832023-01-11 14:50:10 +01001945 mbedtls_ssl_write_version(buf + 4,
1946 ssl->conf->transport,
1947 ssl->tls_version);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001948
Gilles Peskine449bd832023-01-11 14:50:10 +01001949 MBEDTLS_SSL_DEBUG_MSG(3, ("supported version: [%04x]",
1950 ssl->tls_version));
Jerry Yu3bf2c642022-03-30 22:02:12 +08001951
Jerry Yu349a6132022-04-14 20:52:56 +08001952 *out_len = 6;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001953
Jerry Yub95dd362022-11-08 21:19:34 +08001954 mbedtls_ssl_tls13_set_hs_sent_ext_mask(
Gilles Peskine449bd832023-01-11 14:50:10 +01001955 ssl, MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS);
Jerry Yub95dd362022-11-08 21:19:34 +08001956
Gilles Peskine449bd832023-01-11 14:50:10 +01001957 return 0;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001958}
1959
Jerry Yud9436a12022-04-20 22:28:09 +08001960
Jerry Yu3bf2c642022-03-30 22:02:12 +08001961
1962/* Generate and export a single key share. For hybrid KEMs, this can
1963 * be called multiple times with the different components of the hybrid. */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02001964MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01001965static int ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context *ssl,
1966 uint16_t named_group,
1967 unsigned char *buf,
1968 unsigned char *end,
1969 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08001970{
1971 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu955ddd72022-04-22 22:27:33 +08001972
1973 *out_len = 0;
1974
Valerio Settic9ae8622023-07-25 11:23:50 +02001975#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED)
Przemek Stekiel29c219c2023-05-31 15:21:04 +02001976 if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group) ||
Przemek Stekield5f79e72023-06-29 09:08:43 +02001977 mbedtls_ssl_tls13_named_group_is_ffdh(named_group)) {
Przemek Stekiel408569f2023-07-06 11:26:44 +02001978 ret = mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange(
Gilles Peskine449bd832023-01-11 14:50:10 +01001979 ssl, named_group, buf, end, out_len);
1980 if (ret != 0) {
Jerry Yu89e103c2022-03-30 22:43:29 +08001981 MBEDTLS_SSL_DEBUG_RET(
Przemek Stekiel408569f2023-07-06 11:26:44 +02001982 1, "mbedtls_ssl_tls13_generate_and_write_xxdh_key_exchange",
Gilles Peskine449bd832023-01-11 14:50:10 +01001983 ret);
1984 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001985 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001986 } else
Valerio Settic9ae8622023-07-25 11:23:50 +02001987#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_EPHEMERAL_ENABLED */
Gilles Peskine449bd832023-01-11 14:50:10 +01001988 if (0 /* Other kinds of KEMs */) {
1989 } else {
Jerry Yu955ddd72022-04-22 22:27:33 +08001990 ((void) ssl);
1991 ((void) named_group);
1992 ((void) buf);
1993 ((void) end);
Jerry Yu3bf2c642022-03-30 22:02:12 +08001994 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
1995 }
1996
Gilles Peskine449bd832023-01-11 14:50:10 +01001997 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08001998}
1999
2000/*
2001 * ssl_tls13_write_key_share_ext
2002 *
2003 * Structure of key_share extension in ServerHello:
2004 *
Jerry Yu1c3e6882022-04-20 21:23:40 +08002005 * struct {
2006 * NamedGroup group;
2007 * opaque key_exchange<1..2^16-1>;
2008 * } KeyShareEntry;
2009 * struct {
2010 * KeyShareEntry server_share;
2011 * } KeyShareServerHello;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002012 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002013MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002014static int ssl_tls13_write_key_share_ext(mbedtls_ssl_context *ssl,
2015 unsigned char *buf,
2016 unsigned char *end,
2017 size_t *out_len)
Jerry Yu3bf2c642022-03-30 22:02:12 +08002018{
Jerry Yu955ddd72022-04-22 22:27:33 +08002019 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002020 unsigned char *p = buf;
Jerry Yu57d48412022-04-20 21:50:42 +08002021 uint16_t group = ssl->handshake->offered_group_id;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002022 unsigned char *server_share = buf + 4;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002023 size_t key_exchange_length;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002024
2025 *out_len = 0;
2026
Gilles Peskine449bd832023-01-11 14:50:10 +01002027 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding key share extension"));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002028
Gilles Peskine449bd832023-01-11 14:50:10 +01002029 MBEDTLS_SSL_DEBUG_MSG(2, ("server hello, write selected_group: %s (%04x)",
2030 mbedtls_ssl_named_group_to_str(group),
2031 group));
Jerry Yu58af2332022-09-06 11:19:31 +08002032
Jerry Yu3bf2c642022-03-30 22:02:12 +08002033 /* Check if we have space for header and length fields:
2034 * - extension_type (2 bytes)
2035 * - extension_data_length (2 bytes)
2036 * - group (2 bytes)
2037 * - key_exchange_length (2 bytes)
2038 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002039 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 8);
2040 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, p, 0);
2041 MBEDTLS_PUT_UINT16_BE(group, server_share, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002042 p += 8;
Jerry Yu57d48412022-04-20 21:50:42 +08002043
Jerry Yu3bf2c642022-03-30 22:02:12 +08002044 /* When we introduce PQC-ECDHE hybrids, we'll want to call this
2045 * function multiple times. */
Jerry Yu955ddd72022-04-22 22:27:33 +08002046 ret = ssl_tls13_generate_and_write_key_share(
Gilles Peskine449bd832023-01-11 14:50:10 +01002047 ssl, group, server_share + 4, end, &key_exchange_length);
2048 if (ret != 0) {
2049 return ret;
2050 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002051 p += key_exchange_length;
Jerry Yuc1be19f2022-04-23 16:11:39 +08002052
Gilles Peskine449bd832023-01-11 14:50:10 +01002053 MBEDTLS_PUT_UINT16_BE(key_exchange_length, server_share + 2, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002054
Gilles Peskine449bd832023-01-11 14:50:10 +01002055 MBEDTLS_PUT_UINT16_BE(p - server_share, buf, 2);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002056
Jerry Yu57d48412022-04-20 21:50:42 +08002057 *out_len = p - buf;
Jerry Yu955ddd72022-04-22 22:27:33 +08002058
Gilles Peskine449bd832023-01-11 14:50:10 +01002059 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
Jerry Yub95dd362022-11-08 21:19:34 +08002060
Gilles Peskine449bd832023-01-11 14:50:10 +01002061 return 0;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002062}
Jerry Yud9436a12022-04-20 22:28:09 +08002063
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002064MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002065static int ssl_tls13_write_hrr_key_share_ext(mbedtls_ssl_context *ssl,
2066 unsigned char *buf,
2067 unsigned char *end,
2068 size_t *out_len)
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002069{
2070 uint16_t selected_group = ssl->handshake->hrr_selected_group;
2071 /* key_share Extension
2072 *
2073 * struct {
2074 * select (Handshake.msg_type) {
2075 * ...
2076 * case hello_retry_request:
2077 * NamedGroup selected_group;
2078 * ...
2079 * };
2080 * } KeyShare;
2081 */
2082
2083 *out_len = 0;
2084
Jerry Yub0ac10b2022-05-05 11:10:08 +08002085 /*
2086 * For a pure PSK key exchange, there is no group to agree upon. The purpose
2087 * of the HRR is then to transmit a cookie to force the client to demonstrate
2088 * reachability at their apparent network address (primarily useful for DTLS).
2089 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002090 if (!mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2091 return 0;
2092 }
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002093
2094 /* We should only send the key_share extension if the client's initial
2095 * key share was not acceptable. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002096 if (ssl->handshake->offered_group_id != 0) {
2097 MBEDTLS_SSL_DEBUG_MSG(4, ("Skip key_share extension in HRR"));
2098 return 0;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002099 }
2100
Gilles Peskine449bd832023-01-11 14:50:10 +01002101 if (selected_group == 0) {
2102 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching named group found"));
2103 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002104 }
2105
Jerry Yub0ac10b2022-05-05 11:10:08 +08002106 /* Check if we have enough space:
2107 * - extension_type (2 bytes)
2108 * - extension_data_length (2 bytes)
2109 * - selected_group (2 bytes)
2110 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002111 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 6);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002112
Gilles Peskine449bd832023-01-11 14:50:10 +01002113 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_KEY_SHARE, buf, 0);
2114 MBEDTLS_PUT_UINT16_BE(2, buf, 2);
2115 MBEDTLS_PUT_UINT16_BE(selected_group, buf, 4);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002116
Gilles Peskine449bd832023-01-11 14:50:10 +01002117 MBEDTLS_SSL_DEBUG_MSG(3,
2118 ("HRR selected_group: %s (%x)",
2119 mbedtls_ssl_named_group_to_str(selected_group),
2120 selected_group));
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002121
2122 *out_len = 6;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002123
Gilles Peskine449bd832023-01-11 14:50:10 +01002124 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_KEY_SHARE);
Jerry Yub95dd362022-11-08 21:19:34 +08002125
Gilles Peskine449bd832023-01-11 14:50:10 +01002126 return 0;
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002127}
Jerry Yu3bf2c642022-03-30 22:02:12 +08002128
2129/*
2130 * Structure of ServerHello message:
2131 *
2132 * struct {
2133 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2
2134 * Random random;
2135 * opaque legacy_session_id_echo<0..32>;
2136 * CipherSuite cipher_suite;
2137 * uint8 legacy_compression_method = 0;
2138 * Extension extensions<6..2^16-1>;
2139 * } ServerHello;
2140 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002141MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002142static int ssl_tls13_write_server_hello_body(mbedtls_ssl_context *ssl,
2143 unsigned char *buf,
2144 unsigned char *end,
2145 size_t *out_len,
2146 int is_hrr)
Jerry Yu56404d72022-03-30 17:36:13 +08002147{
Jerry Yu955ddd72022-04-22 22:27:33 +08002148 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002149 unsigned char *p = buf;
Jerry Yud9436a12022-04-20 22:28:09 +08002150 unsigned char *p_extensions_len;
Jerry Yufbe3e642022-04-25 19:31:51 +08002151 size_t output_len;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002152
2153 *out_len = 0;
Jerry Yu50e00e32022-10-31 14:45:01 +08002154 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002155
Jerry Yucfc04b32022-04-21 09:31:58 +08002156 /* ...
2157 * ProtocolVersion legacy_version = 0x0303; // TLS 1.2
2158 * ...
2159 * with ProtocolVersion defined as:
2160 * uint16 ProtocolVersion;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002161 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002162 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2163 MBEDTLS_PUT_UINT16_BE(0x0303, p, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002164 p += 2;
2165
Jerry Yu1c3e6882022-04-20 21:23:40 +08002166 /* ...
2167 * Random random;
2168 * ...
Jerry Yucfc04b32022-04-21 09:31:58 +08002169 * with Random defined as:
2170 * opaque Random[MBEDTLS_SERVER_HELLO_RANDOM_LEN];
Jerry Yu1c3e6882022-04-20 21:23:40 +08002171 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002172 MBEDTLS_SSL_CHK_BUF_PTR(p, end, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2173 if (is_hrr) {
2174 memcpy(p, mbedtls_ssl_tls13_hello_retry_request_magic,
2175 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
2176 } else {
2177 memcpy(p, &ssl->handshake->randbytes[MBEDTLS_CLIENT_HELLO_RANDOM_LEN],
2178 MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yu23f7a6f2022-04-23 15:16:45 +08002179 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002180 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes",
2181 p, MBEDTLS_SERVER_HELLO_RANDOM_LEN);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002182 p += MBEDTLS_SERVER_HELLO_RANDOM_LEN;
2183
Jerry Yucfc04b32022-04-21 09:31:58 +08002184 /* ...
2185 * opaque legacy_session_id_echo<0..32>;
2186 * ...
Jerry Yu3bf2c642022-03-30 22:02:12 +08002187 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002188 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1 + ssl->session_negotiate->id_len);
2189 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2190 if (ssl->session_negotiate->id_len > 0) {
2191 memcpy(p, &ssl->session_negotiate->id[0],
2192 ssl->session_negotiate->id_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002193 p += ssl->session_negotiate->id_len;
Jerry Yu955ddd72022-04-22 22:27:33 +08002194
Gilles Peskine449bd832023-01-11 14:50:10 +01002195 MBEDTLS_SSL_DEBUG_BUF(3, "session id", ssl->session_negotiate->id,
2196 ssl->session_negotiate->id_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002197 }
2198
Jerry Yucfc04b32022-04-21 09:31:58 +08002199 /* ...
2200 * CipherSuite cipher_suite;
2201 * ...
2202 * with CipherSuite defined as:
2203 * uint8 CipherSuite[2];
Jerry Yu3bf2c642022-03-30 22:02:12 +08002204 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002205 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
2206 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002207 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002208 MBEDTLS_SSL_DEBUG_MSG(3,
2209 ("server hello, chosen ciphersuite: %s ( id=%d )",
2210 mbedtls_ssl_get_ciphersuite_name(
2211 ssl->session_negotiate->ciphersuite),
2212 ssl->session_negotiate->ciphersuite));
Jerry Yu3bf2c642022-03-30 22:02:12 +08002213
Jerry Yucfc04b32022-04-21 09:31:58 +08002214 /* ...
2215 * uint8 legacy_compression_method = 0;
2216 * ...
2217 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002218 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1);
Thomas Daubney31e03a82022-07-25 15:59:25 +01002219 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002220
Jerry Yucfc04b32022-04-21 09:31:58 +08002221 /* ...
2222 * Extension extensions<6..2^16-1>;
2223 * ...
2224 * struct {
2225 * ExtensionType extension_type; (2 bytes)
2226 * opaque extension_data<0..2^16-1>;
2227 * } Extension;
2228 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002229 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yud9436a12022-04-20 22:28:09 +08002230 p_extensions_len = p;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002231 p += 2;
2232
Gilles Peskine449bd832023-01-11 14:50:10 +01002233 if ((ret = ssl_tls13_write_server_hello_supported_versions_ext(
2234 ssl, p, end, &output_len)) != 0) {
Jerry Yu955ddd72022-04-22 22:27:33 +08002235 MBEDTLS_SSL_DEBUG_RET(
Gilles Peskine449bd832023-01-11 14:50:10 +01002236 1, "ssl_tls13_write_server_hello_supported_versions_ext", ret);
2237 return ret;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002238 }
2239 p += output_len;
2240
Gilles Peskine449bd832023-01-11 14:50:10 +01002241 if (mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) {
2242 if (is_hrr) {
2243 ret = ssl_tls13_write_hrr_key_share_ext(ssl, p, end, &output_len);
2244 } else {
2245 ret = ssl_tls13_write_key_share_ext(ssl, p, end, &output_len);
2246 }
2247 if (ret != 0) {
2248 return ret;
2249 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002250 p += output_len;
2251 }
Jerry Yu3bf2c642022-03-30 22:02:12 +08002252
Ronald Cron41a443a2022-10-04 16:38:25 +02002253#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002254 if (!is_hrr && mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2255 ret = ssl_tls13_write_server_pre_shared_key_ext(ssl, p, end, &output_len);
2256 if (ret != 0) {
2257 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_server_pre_shared_key_ext",
2258 ret);
2259 return ret;
Jerry Yu032b15ce2022-07-11 06:10:03 +00002260 }
2261 p += output_len;
2262 }
Ronald Cron41a443a2022-10-04 16:38:25 +02002263#endif
Jerry Yu032b15ce2022-07-11 06:10:03 +00002264
Gilles Peskine449bd832023-01-11 14:50:10 +01002265 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002266
Gilles Peskine449bd832023-01-11 14:50:10 +01002267 MBEDTLS_SSL_DEBUG_BUF(4, "server hello extensions",
2268 p_extensions_len, p - p_extensions_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002269
Jerry Yud9436a12022-04-20 22:28:09 +08002270 *out_len = p - buf;
Jerry Yu3bf2c642022-03-30 22:02:12 +08002271
Gilles Peskine449bd832023-01-11 14:50:10 +01002272 MBEDTLS_SSL_DEBUG_BUF(3, "server hello", buf, *out_len);
Jerry Yu3bf2c642022-03-30 22:02:12 +08002273
Jerry Yu7de2ff02022-11-08 21:43:46 +08002274 MBEDTLS_SSL_PRINT_EXTS(
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002275 3, is_hrr ? MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST :
Gilles Peskine449bd832023-01-11 14:50:10 +01002276 MBEDTLS_SSL_HS_SERVER_HELLO,
2277 ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002278
Gilles Peskine449bd832023-01-11 14:50:10 +01002279 return ret;
Jerry Yu56404d72022-03-30 17:36:13 +08002280}
2281
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002282MBEDTLS_CHECK_RETURN_CRITICAL
Xiaokang Qian934ce6f2023-02-06 10:23:04 +00002283static int ssl_tls13_finalize_server_hello(mbedtls_ssl_context *ssl)
Jerry Yue110d252022-05-05 10:19:22 +08002284{
2285 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002286 ret = mbedtls_ssl_tls13_compute_handshake_transform(ssl);
2287 if (ret != 0) {
2288 MBEDTLS_SSL_DEBUG_RET(1,
2289 "mbedtls_ssl_tls13_compute_handshake_transform",
2290 ret);
2291 return ret;
Jerry Yue110d252022-05-05 10:19:22 +08002292 }
2293
Gilles Peskine449bd832023-01-11 14:50:10 +01002294 return ret;
Jerry Yue110d252022-05-05 10:19:22 +08002295}
2296
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002297MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002298static int ssl_tls13_write_server_hello(mbedtls_ssl_context *ssl)
Jerry Yu5b64ae92022-03-30 17:15:02 +08002299{
Jerry Yu637a3f12022-04-20 21:37:58 +08002300 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yuf4b27e42022-03-30 17:32:21 +08002301 unsigned char *buf;
2302 size_t buf_len, msg_len;
2303
Gilles Peskine449bd832023-01-11 14:50:10 +01002304 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello"));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002305
Gilles Peskine449bd832023-01-11 14:50:10 +01002306 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_server_hello(ssl));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002307
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002308 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2309 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, &buf, &buf_len));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002310
Gilles Peskine449bd832023-01-11 14:50:10 +01002311 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2312 buf + buf_len,
2313 &msg_len,
2314 0));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002315
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002316 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002317 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
Jerry Yuf4b27e42022-03-30 17:32:21 +08002318
Gilles Peskine449bd832023-01-11 14:50:10 +01002319 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2320 ssl, buf_len, msg_len));
Jerry Yu637a3f12022-04-20 21:37:58 +08002321
Xiaokang Qian934ce6f2023-02-06 10:23:04 +00002322 MBEDTLS_SSL_PROC_CHK(ssl_tls13_finalize_server_hello(ssl));
Jerry Yue110d252022-05-05 10:19:22 +08002323
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002324#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2325 /* The server sends a dummy change_cipher_spec record immediately
2326 * after its first handshake message. This may either be after
2327 * a ServerHello or a HelloRetryRequest.
2328 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02002329 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002330 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002331#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002332 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002333#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yue110d252022-05-05 10:19:22 +08002334
Jerry Yuf4b27e42022-03-30 17:32:21 +08002335cleanup:
2336
Gilles Peskine449bd832023-01-11 14:50:10 +01002337 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2338 return ret;
Jerry Yu5b64ae92022-03-30 17:15:02 +08002339}
2340
Jerry Yu23d1a252022-05-12 18:08:59 +08002341
2342/*
2343 * Handler for MBEDTLS_SSL_HELLO_RETRY_REQUEST
2344 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002345MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002346static int ssl_tls13_prepare_hello_retry_request(mbedtls_ssl_context *ssl)
Jerry Yu23d1a252022-05-12 18:08:59 +08002347{
2348 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002349 if (ssl->handshake->hello_retry_request_count > 0) {
2350 MBEDTLS_SSL_DEBUG_MSG(1, ("Too many HRRs"));
2351 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2352 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2353 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu23d1a252022-05-12 18:08:59 +08002354 }
2355
2356 /*
2357 * Create stateless transcript hash for HRR
2358 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002359 MBEDTLS_SSL_DEBUG_MSG(4, ("Reset transcript for HRR"));
2360 ret = mbedtls_ssl_reset_transcript_for_hrr(ssl);
2361 if (ret != 0) {
2362 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_transcript_for_hrr", ret);
2363 return ret;
Jerry Yu23d1a252022-05-12 18:08:59 +08002364 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002365 mbedtls_ssl_session_reset_msg_layer(ssl, 0);
Jerry Yu23d1a252022-05-12 18:08:59 +08002366
Gilles Peskine449bd832023-01-11 14:50:10 +01002367 return 0;
Jerry Yu23d1a252022-05-12 18:08:59 +08002368}
2369
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002370MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002371static int ssl_tls13_write_hello_retry_request(mbedtls_ssl_context *ssl)
Jerry Yu23d1a252022-05-12 18:08:59 +08002372{
2373 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2374 unsigned char *buf;
2375 size_t buf_len, msg_len;
2376
Gilles Peskine449bd832023-01-11 14:50:10 +01002377 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello retry request"));
Jerry Yu23d1a252022-05-12 18:08:59 +08002378
Gilles Peskine449bd832023-01-11 14:50:10 +01002379 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_hello_retry_request(ssl));
Jerry Yu23d1a252022-05-12 18:08:59 +08002380
Gilles Peskine449bd832023-01-11 14:50:10 +01002381 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2382 ssl, MBEDTLS_SSL_HS_SERVER_HELLO,
2383 &buf, &buf_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002384
Gilles Peskine449bd832023-01-11 14:50:10 +01002385 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_server_hello_body(ssl, buf,
2386 buf + buf_len,
2387 &msg_len,
2388 1));
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002389 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Manuel Pégourié-Gonnard43cc1272023-02-06 11:48:19 +01002390 ssl, MBEDTLS_SSL_HS_SERVER_HELLO, buf, msg_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002391
2392
Gilles Peskine449bd832023-01-11 14:50:10 +01002393 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(ssl, buf_len,
2394 msg_len));
Jerry Yu23d1a252022-05-12 18:08:59 +08002395
2396 ssl->handshake->hello_retry_request_count++;
2397
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002398#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
2399 /* The server sends a dummy change_cipher_spec record immediately
2400 * after its first handshake message. This may either be after
2401 * a ServerHello or a HelloRetryRequest.
2402 */
Gabor Mezei96ae9262022-06-28 11:45:18 +02002403 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01002404 ssl, MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002405#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002406 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
Gabor Mezei7b39bf12022-05-24 16:04:14 +02002407#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
Jerry Yu23d1a252022-05-12 18:08:59 +08002408
2409cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01002410 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello retry request"));
2411 return ret;
Jerry Yu23d1a252022-05-12 18:08:59 +08002412}
2413
Jerry Yu5b64ae92022-03-30 17:15:02 +08002414/*
Jerry Yu4d3841a2022-04-16 12:37:19 +08002415 * Handler for MBEDTLS_SSL_ENCRYPTED_EXTENSIONS
2416 */
Jerry Yu4d3841a2022-04-16 12:37:19 +08002417
2418/*
2419 * struct {
2420 * Extension extensions<0..2 ^ 16 - 1>;
2421 * } EncryptedExtensions;
2422 *
2423 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002424MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002425static int ssl_tls13_write_encrypted_extensions_body(mbedtls_ssl_context *ssl,
2426 unsigned char *buf,
2427 unsigned char *end,
2428 size_t *out_len)
Jerry Yu4d3841a2022-04-16 12:37:19 +08002429{
XiaokangQianacb39922022-06-17 10:18:48 +00002430 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002431 unsigned char *p = buf;
2432 size_t extensions_len = 0;
Jerry Yu8937eb42022-05-03 12:12:14 +08002433 unsigned char *p_extensions_len;
XiaokangQianacb39922022-06-17 10:18:48 +00002434 size_t output_len;
Jerry Yu9da5e5a2022-05-03 15:46:09 +08002435
Jerry Yu4d3841a2022-04-16 12:37:19 +08002436 *out_len = 0;
2437
Gilles Peskine449bd832023-01-11 14:50:10 +01002438 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
Jerry Yu8937eb42022-05-03 12:12:14 +08002439 p_extensions_len = p;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002440 p += 2;
2441
Jerry Yu8937eb42022-05-03 12:12:14 +08002442 ((void) ssl);
XiaokangQianacb39922022-06-17 10:18:48 +00002443 ((void) ret);
2444 ((void) output_len);
2445
2446#if defined(MBEDTLS_SSL_ALPN)
Gilles Peskine449bd832023-01-11 14:50:10 +01002447 ret = mbedtls_ssl_write_alpn_ext(ssl, p, end, &output_len);
2448 if (ret != 0) {
2449 return ret;
2450 }
XiaokangQian95d5f542022-06-24 02:29:26 +00002451 p += output_len;
XiaokangQianacb39922022-06-17 10:18:48 +00002452#endif /* MBEDTLS_SSL_ALPN */
Jerry Yu4d3841a2022-04-16 12:37:19 +08002453
Jerry Yu71c14f12022-12-12 11:10:35 +08002454#if defined(MBEDTLS_SSL_EARLY_DATA)
2455 if (ssl->early_data_status == MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED) {
2456 ret = mbedtls_ssl_tls13_write_early_data_ext(ssl, p, end, &output_len);
2457 if (ret != 0) {
2458 return ret;
2459 }
2460 p += output_len;
2461 }
2462#endif /* MBEDTLS_SSL_EARLY_DATA */
2463
Gilles Peskine449bd832023-01-11 14:50:10 +01002464 extensions_len = (p - p_extensions_len) - 2;
2465 MBEDTLS_PUT_UINT16_BE(extensions_len, p_extensions_len, 0);
Jerry Yu8937eb42022-05-03 12:12:14 +08002466
2467 *out_len = p - buf;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002468
Gilles Peskine449bd832023-01-11 14:50:10 +01002469 MBEDTLS_SSL_DEBUG_BUF(4, "encrypted extensions", buf, *out_len);
Jerry Yu4d3841a2022-04-16 12:37:19 +08002470
Jerry Yu7de2ff02022-11-08 21:43:46 +08002471 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002472 3, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002473
Gilles Peskine449bd832023-01-11 14:50:10 +01002474 return 0;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002475}
2476
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002477MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002478static int ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context *ssl)
Jerry Yu4d3841a2022-04-16 12:37:19 +08002479{
2480 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2481 unsigned char *buf;
Jerry Yu39730a72022-05-03 12:14:04 +08002482 size_t buf_len, msg_len;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002483
Gilles Peskine449bd832023-01-11 14:50:10 +01002484 mbedtls_ssl_set_outbound_transform(ssl,
2485 ssl->handshake->transform_handshake);
Gabor Mezei54719122022-06-28 11:34:56 +02002486 MBEDTLS_SSL_DEBUG_MSG(
Gilles Peskine449bd832023-01-11 14:50:10 +01002487 3, ("switching to handshake transform for outbound data"));
Gabor Mezei54719122022-06-28 11:34:56 +02002488
Gilles Peskine449bd832023-01-11 14:50:10 +01002489 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write encrypted extensions"));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002490
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002491 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2492 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2493 &buf, &buf_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002494
Gilles Peskine449bd832023-01-11 14:50:10 +01002495 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_encrypted_extensions_body(
2496 ssl, buf, buf + buf_len, &msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002497
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002498 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002499 ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
2500 buf, msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002501
Gilles Peskine449bd832023-01-11 14:50:10 +01002502 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2503 ssl, buf_len, msg_len));
Jerry Yu4d3841a2022-04-16 12:37:19 +08002504
Ronald Cron928cbd32022-10-04 16:14:26 +02002505#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Gilles Peskine449bd832023-01-11 14:50:10 +01002506 if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
2507 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2508 } else {
2509 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
2510 }
Jerry Yu8937eb42022-05-03 12:12:14 +08002511#else
Gilles Peskine449bd832023-01-11 14:50:10 +01002512 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
Jerry Yu8937eb42022-05-03 12:12:14 +08002513#endif
2514
Jerry Yu4d3841a2022-04-16 12:37:19 +08002515cleanup:
2516
Gilles Peskine449bd832023-01-11 14:50:10 +01002517 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write encrypted extensions"));
2518 return ret;
Jerry Yu4d3841a2022-04-16 12:37:19 +08002519}
2520
Ronald Cron928cbd32022-10-04 16:14:26 +02002521#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQiana987e1d2022-05-07 01:25:58 +00002522#define SSL_CERTIFICATE_REQUEST_SEND_REQUEST 0
2523#define SSL_CERTIFICATE_REQUEST_SKIP 1
2524/* Coordination:
2525 * Check whether a CertificateRequest message should be written.
2526 * Returns a negative code on failure, or
2527 * - SSL_CERTIFICATE_REQUEST_SEND_REQUEST
2528 * - SSL_CERTIFICATE_REQUEST_SKIP
2529 * indicating if the writing of the CertificateRequest
2530 * should be skipped or not.
2531 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002532MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002533static int ssl_tls13_certificate_request_coordinate(mbedtls_ssl_context *ssl)
XiaokangQiana987e1d2022-05-07 01:25:58 +00002534{
2535 int authmode;
2536
XiaokangQian40a35232022-05-07 09:02:40 +00002537#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Gilles Peskine449bd832023-01-11 14:50:10 +01002538 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
XiaokangQian40a35232022-05-07 09:02:40 +00002539 authmode = ssl->handshake->sni_authmode;
Gilles Peskine449bd832023-01-11 14:50:10 +01002540 } else
XiaokangQian40a35232022-05-07 09:02:40 +00002541#endif
XiaokangQiana987e1d2022-05-07 01:25:58 +00002542 authmode = ssl->conf->authmode;
2543
Gilles Peskine449bd832023-01-11 14:50:10 +01002544 if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
Ronald Croneac00ad2022-09-13 10:16:31 +02002545 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
Gilles Peskine449bd832023-01-11 14:50:10 +01002546 return SSL_CERTIFICATE_REQUEST_SKIP;
Ronald Croneac00ad2022-09-13 10:16:31 +02002547 }
XiaokangQiana987e1d2022-05-07 01:25:58 +00002548
XiaokangQianc3017f62022-05-13 05:55:41 +00002549 ssl->handshake->certificate_request_sent = 1;
XiaokangQian189ded22022-05-10 08:12:17 +00002550
Gilles Peskine449bd832023-01-11 14:50:10 +01002551 return SSL_CERTIFICATE_REQUEST_SEND_REQUEST;
XiaokangQiana987e1d2022-05-07 01:25:58 +00002552}
2553
XiaokangQiancec9ae62022-05-06 07:28:50 +00002554/*
2555 * struct {
2556 * opaque certificate_request_context<0..2^8-1>;
2557 * Extension extensions<2..2^16-1>;
2558 * } CertificateRequest;
2559 *
2560 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002561MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002562static int ssl_tls13_write_certificate_request_body(mbedtls_ssl_context *ssl,
2563 unsigned char *buf,
2564 const unsigned char *end,
2565 size_t *out_len)
XiaokangQiancec9ae62022-05-06 07:28:50 +00002566{
2567 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2568 unsigned char *p = buf;
XiaokangQianec6efb92022-05-06 09:53:10 +00002569 size_t output_len = 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002570 unsigned char *p_extensions_len;
2571
2572 *out_len = 0;
2573
2574 /* Check if we have enough space:
2575 * - certificate_request_context (1 byte)
2576 * - extensions length (2 bytes)
2577 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002578 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002579
2580 /*
2581 * Write certificate_request_context
2582 */
2583 /*
2584 * We use a zero length context for the normal handshake
2585 * messages. For post-authentication handshake messages
2586 * this request context would be set to a non-zero value.
2587 */
2588 *p++ = 0x0;
2589
2590 /*
2591 * Write extensions
2592 */
2593 /* The extensions must contain the signature_algorithms. */
2594 p_extensions_len = p;
2595 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002596 ret = mbedtls_ssl_write_sig_alg_ext(ssl, p, end, &output_len);
2597 if (ret != 0) {
2598 return ret;
2599 }
XiaokangQiancec9ae62022-05-06 07:28:50 +00002600
XiaokangQianec6efb92022-05-06 09:53:10 +00002601 p += output_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01002602 MBEDTLS_PUT_UINT16_BE(p - p_extensions_len - 2, p_extensions_len, 0);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002603
2604 *out_len = p - buf;
2605
Jerry Yu7de2ff02022-11-08 21:43:46 +08002606 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01002607 3, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08002608
Gilles Peskine449bd832023-01-11 14:50:10 +01002609 return 0;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002610}
2611
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002612MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002613static int ssl_tls13_write_certificate_request(mbedtls_ssl_context *ssl)
XiaokangQiancec9ae62022-05-06 07:28:50 +00002614{
2615 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2616
Gilles Peskine449bd832023-01-11 14:50:10 +01002617 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002618
Gilles Peskine449bd832023-01-11 14:50:10 +01002619 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_certificate_request_coordinate(ssl));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002620
Gilles Peskine449bd832023-01-11 14:50:10 +01002621 if (ret == SSL_CERTIFICATE_REQUEST_SEND_REQUEST) {
XiaokangQiancec9ae62022-05-06 07:28:50 +00002622 unsigned char *buf;
2623 size_t buf_len, msg_len;
2624
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002625 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
2626 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2627 &buf, &buf_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002628
Gilles Peskine449bd832023-01-11 14:50:10 +01002629 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_request_body(
2630 ssl, buf, buf + buf_len, &msg_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002631
Manuel Pégourié-Gonnardb8b07aa2023-02-06 00:34:21 +01002632 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002633 ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
2634 buf, msg_len));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002635
Gilles Peskine449bd832023-01-11 14:50:10 +01002636 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
2637 ssl, buf_len, msg_len));
2638 } else if (ret == SSL_CERTIFICATE_REQUEST_SKIP) {
2639 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002640 ret = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002641 } else {
2642 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
XiaokangQiancec9ae62022-05-06 07:28:50 +00002643 ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2644 goto cleanup;
2645 }
2646
Gilles Peskine449bd832023-01-11 14:50:10 +01002647 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_CERTIFICATE);
XiaokangQiancec9ae62022-05-06 07:28:50 +00002648cleanup:
2649
Gilles Peskine449bd832023-01-11 14:50:10 +01002650 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request"));
2651 return ret;
XiaokangQiancec9ae62022-05-06 07:28:50 +00002652}
XiaokangQiancec9ae62022-05-06 07:28:50 +00002653
Jerry Yu4d3841a2022-04-16 12:37:19 +08002654/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002655 * Handler for MBEDTLS_SSL_SERVER_CERTIFICATE
Jerry Yu83da34e2022-04-16 13:59:52 +08002656 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002657MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002658static int ssl_tls13_write_server_certificate(mbedtls_ssl_context *ssl)
Jerry Yu83da34e2022-04-16 13:59:52 +08002659{
Jerry Yu5a26f302022-05-10 20:46:40 +08002660 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQianfb665a82022-06-15 03:57:21 +00002661
2662#if defined(MBEDTLS_X509_CRT_PARSE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01002663 if ((ssl_tls13_pick_key_cert(ssl) != 0) ||
2664 mbedtls_ssl_own_cert(ssl) == NULL) {
2665 MBEDTLS_SSL_DEBUG_MSG(2, ("No certificate available."));
2666 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2667 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2668 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
Jerry Yu5a26f302022-05-10 20:46:40 +08002669 }
XiaokangQianfb665a82022-06-15 03:57:21 +00002670#endif /* MBEDTLS_X509_CRT_PARSE_C */
Jerry Yu5a26f302022-05-10 20:46:40 +08002671
Gilles Peskine449bd832023-01-11 14:50:10 +01002672 ret = mbedtls_ssl_tls13_write_certificate(ssl);
2673 if (ret != 0) {
2674 return ret;
2675 }
2676 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_VERIFY);
2677 return 0;
Jerry Yu83da34e2022-04-16 13:59:52 +08002678}
2679
2680/*
Jerry Yuc6e6dbf2022-04-16 19:42:57 +08002681 * Handler for MBEDTLS_SSL_CERTIFICATE_VERIFY
Jerry Yu83da34e2022-04-16 13:59:52 +08002682 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002683MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002684static int ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl)
Jerry Yu83da34e2022-04-16 13:59:52 +08002685{
Gilles Peskine449bd832023-01-11 14:50:10 +01002686 int ret = mbedtls_ssl_tls13_write_certificate_verify(ssl);
2687 if (ret != 0) {
2688 return ret;
2689 }
2690 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
2691 return 0;
Jerry Yu83da34e2022-04-16 13:59:52 +08002692}
Ronald Cron928cbd32022-10-04 16:14:26 +02002693#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08002694
2695/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002696 * Handler for MBEDTLS_SSL_SERVER_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002697 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002698MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002699static int ssl_tls13_write_server_finished(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002700{
Jerry Yud6e253d2022-05-18 13:59:24 +08002701 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002702
Gilles Peskine449bd832023-01-11 14:50:10 +01002703 ret = mbedtls_ssl_tls13_write_finished_message(ssl);
2704 if (ret != 0) {
2705 return ret;
2706 }
Jerry Yu27bdc7c2022-04-16 13:33:27 +08002707
Gilles Peskine449bd832023-01-11 14:50:10 +01002708 ret = mbedtls_ssl_tls13_compute_application_transform(ssl);
2709 if (ret != 0) {
Jerry Yue3d67cb2022-05-19 15:33:10 +08002710 MBEDTLS_SSL_PEND_FATAL_ALERT(
Gilles Peskine449bd832023-01-11 14:50:10 +01002711 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
2712 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE);
2713 return ret;
Jerry Yue3d67cb2022-05-19 15:33:10 +08002714 }
XiaokangQianc3017f62022-05-13 05:55:41 +00002715
Gilles Peskine449bd832023-01-11 14:50:10 +01002716 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to handshake keys for inbound traffic"));
2717 mbedtls_ssl_set_inbound_transform(ssl, ssl->handshake->transform_handshake);
XiaokangQian189ded22022-05-10 08:12:17 +00002718
Gilles Peskine449bd832023-01-11 14:50:10 +01002719 if (ssl->handshake->certificate_request_sent) {
2720 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE);
2721 } else {
2722 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate"));
2723 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
2724 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_FINISHED);
Ronald Cron19385882022-06-15 16:26:13 +02002725 }
Ronald Cron63dc4632022-05-31 14:41:53 +02002726
Gilles Peskine449bd832023-01-11 14:50:10 +01002727 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08002728}
2729
2730/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002731 * Handler for MBEDTLS_SSL_CLIENT_FINISHED
Jerry Yu69dd8d42022-04-16 12:51:26 +08002732 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002733MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002734static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002735{
Jerry Yud6e253d2022-05-18 13:59:24 +08002736 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2737
Gilles Peskine449bd832023-01-11 14:50:10 +01002738 ret = mbedtls_ssl_tls13_process_finished_message(ssl);
2739 if (ret != 0) {
2740 return ret;
Jerry Yue3d67cb2022-05-19 15:33:10 +08002741 }
2742
Gilles Peskine449bd832023-01-11 14:50:10 +01002743 ret = mbedtls_ssl_tls13_compute_resumption_master_secret(ssl);
2744 if (ret != 0) {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002745 MBEDTLS_SSL_DEBUG_RET(
2746 1, "mbedtls_ssl_tls13_compute_resumption_master_secret", ret);
Gilles Peskine449bd832023-01-11 14:50:10 +01002747 }
2748
2749 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);
2750 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08002751}
2752
2753/*
Jerry Yud6e253d2022-05-18 13:59:24 +08002754 * Handler for MBEDTLS_SSL_HANDSHAKE_WRAPUP
Jerry Yu69dd8d42022-04-16 12:51:26 +08002755 */
Manuel Pégourié-Gonnarda3115dc2022-06-17 10:52:54 +02002756MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002757static int ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl)
Jerry Yu69dd8d42022-04-16 12:51:26 +08002758{
Gilles Peskine449bd832023-01-11 14:50:10 +01002759 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done"));
Jerry Yu03ed50b2022-04-16 17:13:30 +08002760
Gilles Peskine449bd832023-01-11 14:50:10 +01002761 mbedtls_ssl_tls13_handshake_wrapup(ssl);
Jerry Yue67bef42022-07-07 07:29:42 +00002762
Pengyu Lv3643fdb2023-01-12 16:46:28 +08002763#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
2764 defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Pengyu Lva1aa31b2022-12-13 13:49:59 +08002765/* TODO: Remove the check of SOME_PSK_ENABLED since SESSION_TICKETS requires
2766 * SOME_PSK_ENABLED to be enabled. Here is just to make CI happy. It is
2767 * expected to be resolved with issue#6395.
2768 */
Pengyu Lvc7af2c42022-12-01 16:33:00 +08002769 /* Sent NewSessionTicket message only when client supports PSK */
Pengyu Lv3643fdb2023-01-12 16:46:28 +08002770 if (mbedtls_ssl_tls13_some_psk_enabled(ssl)) {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00002771 mbedtls_ssl_handshake_set_state(
2772 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
Pengyu Lvc7af2c42022-12-01 16:33:00 +08002773 } else
Jerry Yufca4d572022-07-21 10:37:48 +08002774#endif
Pengyu Lv3643fdb2023-01-12 16:46:28 +08002775 {
2776 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
2777 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002778 return 0;
Jerry Yu69dd8d42022-04-16 12:51:26 +08002779}
2780
2781/*
Jerry Yua8d3c502022-10-30 14:51:23 +08002782 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00002783 */
2784#define SSL_NEW_SESSION_TICKET_SKIP 0
2785#define SSL_NEW_SESSION_TICKET_WRITE 1
2786MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002787static int ssl_tls13_write_new_session_ticket_coordinate(mbedtls_ssl_context *ssl)
Jerry Yue67bef42022-07-07 07:29:42 +00002788{
2789 /* Check whether the use of session tickets is enabled */
Gilles Peskine449bd832023-01-11 14:50:10 +01002790 if (ssl->conf->f_ticket_write == NULL) {
2791 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
2792 " callback is not set"));
2793 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yud0766ec2022-09-22 10:46:57 +08002794 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002795 if (ssl->conf->new_session_tickets_count == 0) {
2796 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: disabled,"
2797 " configured count is zero"));
2798 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yud0766ec2022-09-22 10:46:57 +08002799 }
2800
Gilles Peskine449bd832023-01-11 14:50:10 +01002801 if (ssl->handshake->new_session_tickets_count == 0) {
2802 MBEDTLS_SSL_DEBUG_MSG(2, ("NewSessionTicket: all tickets have "
2803 "been sent."));
2804 return SSL_NEW_SESSION_TICKET_SKIP;
Jerry Yue67bef42022-07-07 07:29:42 +00002805 }
2806
Gilles Peskine449bd832023-01-11 14:50:10 +01002807 return SSL_NEW_SESSION_TICKET_WRITE;
Jerry Yue67bef42022-07-07 07:29:42 +00002808}
2809
2810#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2811MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002812static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
2813 unsigned char *ticket_nonce,
2814 size_t ticket_nonce_size)
Jerry Yue67bef42022-07-07 07:29:42 +00002815{
2816 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2817 mbedtls_ssl_session *session = ssl->session;
2818 mbedtls_ssl_ciphersuite_t *ciphersuite_info;
2819 psa_algorithm_t psa_hash_alg;
2820 int hash_length;
2821
Gilles Peskine449bd832023-01-11 14:50:10 +01002822 MBEDTLS_SSL_DEBUG_MSG(2, ("=> prepare NewSessionTicket msg"));
Jerry Yue67bef42022-07-07 07:29:42 +00002823
2824#if defined(MBEDTLS_HAVE_TIME)
Gilles Peskine449bd832023-01-11 14:50:10 +01002825 session->start = mbedtls_time(NULL);
Jerry Yue67bef42022-07-07 07:29:42 +00002826#endif
2827
Pengyu Lv9f926952022-11-17 15:22:33 +08002828 /* Set ticket_flags depends on the advertised psk key exchange mode */
Pengyu Lv80270b22023-01-12 11:54:04 +08002829 mbedtls_ssl_session_clear_ticket_flags(
Pengyu Lv9eacb442022-12-09 14:39:19 +08002830 session, MBEDTLS_SSL_TLS1_3_TICKET_FLAGS_MASK);
Pengyu Lve6487fe2022-12-06 09:30:29 +08002831#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED)
Pengyu Lv80270b22023-01-12 11:54:04 +08002832 mbedtls_ssl_session_set_ticket_flags(
Pengyu Lv9eacb442022-12-09 14:39:19 +08002833 session, ssl->handshake->tls13_kex_modes);
Pengyu Lve6487fe2022-12-06 09:30:29 +08002834#endif
Pengyu Lv4938a562023-01-16 11:28:49 +08002835 MBEDTLS_SSL_PRINT_TICKET_FLAGS(4, session->ticket_flags);
Pengyu Lv9f926952022-11-17 15:22:33 +08002836
Jerry Yue67bef42022-07-07 07:29:42 +00002837 /* Generate ticket_age_add */
Gilles Peskine449bd832023-01-11 14:50:10 +01002838 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
2839 (unsigned char *) &session->ticket_age_add,
2840 sizeof(session->ticket_age_add)) != 0)) {
2841 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
2842 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002843 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002844 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
2845 (unsigned int) session->ticket_age_add));
Jerry Yue67bef42022-07-07 07:29:42 +00002846
2847 /* Generate ticket_nonce */
Gilles Peskine449bd832023-01-11 14:50:10 +01002848 ret = ssl->conf->f_rng(ssl->conf->p_rng, ticket_nonce, ticket_nonce_size);
2849 if (ret != 0) {
2850 MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_nonce", ret);
2851 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002852 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002853 MBEDTLS_SSL_DEBUG_BUF(3, "ticket_nonce:",
2854 ticket_nonce, ticket_nonce_size);
Jerry Yue67bef42022-07-07 07:29:42 +00002855
2856 ciphersuite_info =
Gilles Peskine449bd832023-01-11 14:50:10 +01002857 (mbedtls_ssl_ciphersuite_t *) ssl->handshake->ciphersuite_info;
Dave Rodgman2eab4622023-10-05 13:30:37 +01002858 psa_hash_alg = mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) ciphersuite_info->mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01002859 hash_length = PSA_HASH_LENGTH(psa_hash_alg);
2860 if (hash_length == -1 ||
2861 (size_t) hash_length > sizeof(session->resumption_key)) {
2862 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
Jerry Yufca4d572022-07-21 10:37:48 +08002863 }
2864
Jerry Yue67bef42022-07-07 07:29:42 +00002865 /* In this code the psk key length equals the length of the hash */
2866 session->resumption_key_len = hash_length;
2867 session->ciphersuite = ciphersuite_info->id;
2868
2869 /* Compute resumption key
2870 *
2871 * HKDF-Expand-Label( resumption_master_secret,
2872 * "resumption", ticket_nonce, Hash.length )
2873 */
2874 ret = mbedtls_ssl_tls13_hkdf_expand_label(
Gilles Peskine449bd832023-01-11 14:50:10 +01002875 psa_hash_alg,
2876 session->app_secrets.resumption_master_secret,
2877 hash_length,
2878 MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(resumption),
2879 ticket_nonce,
2880 ticket_nonce_size,
2881 session->resumption_key,
2882 hash_length);
Jerry Yue67bef42022-07-07 07:29:42 +00002883
Gilles Peskine449bd832023-01-11 14:50:10 +01002884 if (ret != 0) {
2885 MBEDTLS_SSL_DEBUG_RET(2,
2886 "Creating the ticket-resumed PSK failed",
2887 ret);
2888 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002889 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002890 MBEDTLS_SSL_DEBUG_BUF(3, "Ticket-resumed PSK",
2891 session->resumption_key,
2892 session->resumption_key_len);
Jerry Yue67bef42022-07-07 07:29:42 +00002893
Gilles Peskine449bd832023-01-11 14:50:10 +01002894 MBEDTLS_SSL_DEBUG_BUF(3, "resumption_master_secret",
2895 session->app_secrets.resumption_master_secret,
2896 hash_length);
Jerry Yue67bef42022-07-07 07:29:42 +00002897
Gilles Peskine449bd832023-01-11 14:50:10 +01002898 return 0;
Jerry Yue67bef42022-07-07 07:29:42 +00002899}
2900
2901/* This function creates a NewSessionTicket message in the following format:
2902 *
2903 * struct {
2904 * uint32 ticket_lifetime;
2905 * uint32 ticket_age_add;
2906 * opaque ticket_nonce<0..255>;
2907 * opaque ticket<1..2^16-1>;
2908 * Extension extensions<0..2^16-2>;
2909 * } NewSessionTicket;
2910 *
2911 * The ticket inside the NewSessionTicket message is an encrypted container
2912 * carrying the necessary information so that the server is later able to
2913 * re-start the communication.
2914 *
2915 * The following fields are placed inside the ticket by the
2916 * f_ticket_write() function:
2917 *
2918 * - creation time (start)
2919 * - flags (flags)
2920 * - age add (ticket_age_add)
2921 * - key (key)
2922 * - key length (key_len)
2923 * - ciphersuite (ciphersuite)
2924 */
2925MBEDTLS_CHECK_RETURN_CRITICAL
Gilles Peskine449bd832023-01-11 14:50:10 +01002926static int ssl_tls13_write_new_session_ticket_body(mbedtls_ssl_context *ssl,
2927 unsigned char *buf,
2928 unsigned char *end,
2929 size_t *out_len,
2930 unsigned char *ticket_nonce,
2931 size_t ticket_nonce_size)
Jerry Yue67bef42022-07-07 07:29:42 +00002932{
2933 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2934 unsigned char *p = buf;
2935 mbedtls_ssl_session *session = ssl->session;
2936 size_t ticket_len;
2937 uint32_t ticket_lifetime;
2938
2939 *out_len = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002940 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write NewSessionTicket msg"));
Jerry Yue67bef42022-07-07 07:29:42 +00002941
2942 /*
2943 * ticket_lifetime 4 bytes
2944 * ticket_age_add 4 bytes
2945 * ticket_nonce 1 + ticket_nonce_size bytes
2946 * ticket >=2 bytes
2947 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002948 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4 + 4 + 1 + ticket_nonce_size + 2);
Jerry Yue67bef42022-07-07 07:29:42 +00002949
2950 /* Generate ticket and ticket_lifetime */
Gilles Peskine449bd832023-01-11 14:50:10 +01002951 ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket,
2952 session,
2953 p + 9 + ticket_nonce_size + 2,
2954 end,
2955 &ticket_len,
2956 &ticket_lifetime);
2957 if (ret != 0) {
2958 MBEDTLS_SSL_DEBUG_RET(1, "write_ticket", ret);
2959 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00002960 }
2961 /* RFC 8446 4.6.1
2962 * ticket_lifetime: Indicates the lifetime in seconds as a 32-bit
2963 * unsigned integer in network byte order from the time of ticket
2964 * issuance. Servers MUST NOT use any value greater than
2965 * 604800 seconds (7 days). The value of zero indicates that the
2966 * ticket should be discarded immediately. Clients MUST NOT cache
2967 * tickets for longer than 7 days, regardless of the ticket_lifetime,
2968 * and MAY delete tickets earlier based on local policy. A server
2969 * MAY treat a ticket as valid for a shorter period of time than what
2970 * is stated in the ticket_lifetime.
2971 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002972 if (ticket_lifetime > 604800) {
Xiaokang Qian28af5012022-10-13 08:18:19 +00002973 ticket_lifetime = 604800;
Gilles Peskine449bd832023-01-11 14:50:10 +01002974 }
2975 MBEDTLS_PUT_UINT32_BE(ticket_lifetime, p, 0);
2976 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_lifetime: %u",
2977 (unsigned int) ticket_lifetime));
Jerry Yue67bef42022-07-07 07:29:42 +00002978
2979 /* Write ticket_age_add */
Gilles Peskine449bd832023-01-11 14:50:10 +01002980 MBEDTLS_PUT_UINT32_BE(session->ticket_age_add, p, 4);
2981 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket_age_add: %u",
2982 (unsigned int) session->ticket_age_add));
Jerry Yue67bef42022-07-07 07:29:42 +00002983
2984 /* Write ticket_nonce */
Gilles Peskine449bd832023-01-11 14:50:10 +01002985 p[8] = (unsigned char) ticket_nonce_size;
2986 if (ticket_nonce_size > 0) {
2987 memcpy(p + 9, ticket_nonce, ticket_nonce_size);
Jerry Yue67bef42022-07-07 07:29:42 +00002988 }
2989 p += 9 + ticket_nonce_size;
2990
2991 /* Write ticket */
Gilles Peskine449bd832023-01-11 14:50:10 +01002992 MBEDTLS_PUT_UINT16_BE(ticket_len, p, 0);
Jerry Yue67bef42022-07-07 07:29:42 +00002993 p += 2;
Gilles Peskine449bd832023-01-11 14:50:10 +01002994 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", p, ticket_len);
Jerry Yue67bef42022-07-07 07:29:42 +00002995 p += ticket_len;
2996
2997 /* Ticket Extensions
2998 *
2999 * Note: We currently don't have any extensions.
3000 * Set length to zero.
3001 */
Jerry Yuedab6372022-10-31 14:37:31 +08003002 ssl->handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE;
3003
Gilles Peskine449bd832023-01-11 14:50:10 +01003004 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2);
3005 MBEDTLS_PUT_UINT16_BE(0, p, 0);
Jerry Yue67bef42022-07-07 07:29:42 +00003006 p += 2;
3007
3008 *out_len = p - buf;
Gilles Peskine449bd832023-01-11 14:50:10 +01003009 MBEDTLS_SSL_DEBUG_BUF(4, "ticket", buf, *out_len);
3010 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket"));
Jerry Yue67bef42022-07-07 07:29:42 +00003011
Jerry Yu7de2ff02022-11-08 21:43:46 +08003012 MBEDTLS_SSL_PRINT_EXTS(
Gilles Peskine449bd832023-01-11 14:50:10 +01003013 3, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, ssl->handshake->sent_extensions);
Jerry Yu4b8f2f72022-10-31 13:31:22 +08003014
Gilles Peskine449bd832023-01-11 14:50:10 +01003015 return 0;
Jerry Yue67bef42022-07-07 07:29:42 +00003016}
3017
3018/*
Jerry Yua8d3c502022-10-30 14:51:23 +08003019 * Handler for MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00003020 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003021static int ssl_tls13_write_new_session_ticket(mbedtls_ssl_context *ssl)
Jerry Yue67bef42022-07-07 07:29:42 +00003022{
3023 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3024
Gilles Peskine449bd832023-01-11 14:50:10 +01003025 MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_write_new_session_ticket_coordinate(ssl));
Jerry Yue67bef42022-07-07 07:29:42 +00003026
Gilles Peskine449bd832023-01-11 14:50:10 +01003027 if (ret == SSL_NEW_SESSION_TICKET_WRITE) {
Jerry Yue67bef42022-07-07 07:29:42 +00003028 unsigned char ticket_nonce[MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH];
3029 unsigned char *buf;
3030 size_t buf_len, msg_len;
3031
Gilles Peskine449bd832023-01-11 14:50:10 +01003032 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_new_session_ticket(
3033 ssl, ticket_nonce, sizeof(ticket_nonce)));
Jerry Yue67bef42022-07-07 07:29:42 +00003034
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00003035 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(
3036 ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
3037 &buf, &buf_len));
Jerry Yue67bef42022-07-07 07:29:42 +00003038
Gilles Peskine449bd832023-01-11 14:50:10 +01003039 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_new_session_ticket_body(
3040 ssl, buf, buf + buf_len, &msg_len,
3041 ticket_nonce, sizeof(ticket_nonce)));
Jerry Yue67bef42022-07-07 07:29:42 +00003042
Gilles Peskine449bd832023-01-11 14:50:10 +01003043 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(
3044 ssl, buf_len, msg_len));
Jerry Yufca4d572022-07-21 10:37:48 +08003045
Jerry Yu359e65f2022-09-22 23:47:43 +08003046 /* Limit session tickets count to one when resumption connection.
3047 *
3048 * See document of mbedtls_ssl_conf_new_session_tickets.
3049 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003050 if (ssl->handshake->resume == 1) {
Jerry Yu359e65f2022-09-22 23:47:43 +08003051 ssl->handshake->new_session_tickets_count = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01003052 } else {
Jerry Yu359e65f2022-09-22 23:47:43 +08003053 ssl->handshake->new_session_tickets_count--;
Gilles Peskine449bd832023-01-11 14:50:10 +01003054 }
Jerry Yub7e3fa72022-09-22 11:07:18 +08003055
Jerry Yua8d3c502022-10-30 14:51:23 +08003056 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003057 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH);
3058 } else {
3059 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
Jerry Yue67bef42022-07-07 07:29:42 +00003060 }
3061
Jerry Yue67bef42022-07-07 07:29:42 +00003062cleanup:
3063
Gilles Peskine449bd832023-01-11 14:50:10 +01003064 return ret;
Jerry Yue67bef42022-07-07 07:29:42 +00003065}
3066#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3067
3068/*
XiaokangQiane8ff3502022-04-22 02:34:40 +00003069 * TLS 1.3 State Machine -- server side
XiaokangQian7807f9f2022-02-15 10:04:37 +00003070 */
Gilles Peskine449bd832023-01-11 14:50:10 +01003071int mbedtls_ssl_tls13_handshake_server_step(mbedtls_ssl_context *ssl)
Jerry Yub9930e72021-08-06 17:11:51 +08003072{
XiaokangQian08037552022-04-20 07:16:41 +00003073 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003074
Gilles Peskine449bd832023-01-11 14:50:10 +01003075 if (ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL) {
3076 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
3077 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00003078
Gilles Peskine449bd832023-01-11 14:50:10 +01003079 MBEDTLS_SSL_DEBUG_MSG(2, ("tls13 server state: %s(%d)",
Dave Rodgman2eab4622023-10-05 13:30:37 +01003080 mbedtls_ssl_states_str((mbedtls_ssl_states) ssl->state),
Gilles Peskine449bd832023-01-11 14:50:10 +01003081 ssl->state));
Jerry Yu6e81b272021-09-27 11:16:17 +08003082
Gilles Peskine449bd832023-01-11 14:50:10 +01003083 switch (ssl->state) {
XiaokangQian7807f9f2022-02-15 10:04:37 +00003084 /* start state */
3085 case MBEDTLS_SSL_HELLO_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003086 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
XiaokangQian08037552022-04-20 07:16:41 +00003087 ret = 0;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003088 break;
3089
XiaokangQian7807f9f2022-02-15 10:04:37 +00003090 case MBEDTLS_SSL_CLIENT_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003091 ret = ssl_tls13_process_client_hello(ssl);
3092 if (ret != 0) {
3093 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_process_client_hello", ret);
3094 }
Jerry Yuf41553b2022-05-09 22:20:30 +08003095 break;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003096
Jerry Yuf41553b2022-05-09 22:20:30 +08003097 case MBEDTLS_SSL_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003098 ret = ssl_tls13_write_hello_retry_request(ssl);
3099 if (ret != 0) {
3100 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_hello_retry_request", ret);
3101 return ret;
Jerry Yuf41553b2022-05-09 22:20:30 +08003102 }
XiaokangQian7807f9f2022-02-15 10:04:37 +00003103 break;
3104
Jerry Yu5b64ae92022-03-30 17:15:02 +08003105 case MBEDTLS_SSL_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003106 ret = ssl_tls13_write_server_hello(ssl);
Jerry Yu5b64ae92022-03-30 17:15:02 +08003107 break;
3108
Xiaofei Baicba64af2022-02-15 10:00:56 +00003109 case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS:
Gilles Peskine449bd832023-01-11 14:50:10 +01003110 ret = ssl_tls13_write_encrypted_extensions(ssl);
3111 if (ret != 0) {
3112 MBEDTLS_SSL_DEBUG_RET(1, "ssl_tls13_write_encrypted_extensions", ret);
3113 return ret;
Xiaofei Baicba64af2022-02-15 10:00:56 +00003114 }
Jerry Yu48330562022-05-06 21:35:44 +08003115 break;
Jerry Yu6a2cd9e2022-05-05 11:14:19 +08003116
Ronald Cron928cbd32022-10-04 16:14:26 +02003117#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00003118 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003119 ret = ssl_tls13_write_certificate_request(ssl);
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00003120 break;
Xiaofei Bai9ca09d42022-02-14 12:57:18 +00003121
Jerry Yu83da34e2022-04-16 13:59:52 +08003122 case MBEDTLS_SSL_SERVER_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +01003123 ret = ssl_tls13_write_server_certificate(ssl);
Jerry Yu83da34e2022-04-16 13:59:52 +08003124 break;
3125
3126 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Gilles Peskine449bd832023-01-11 14:50:10 +01003127 ret = ssl_tls13_write_certificate_verify(ssl);
Jerry Yu83da34e2022-04-16 13:59:52 +08003128 break;
Ronald Cron928cbd32022-10-04 16:14:26 +02003129#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
Jerry Yu83da34e2022-04-16 13:59:52 +08003130
Gilles Peskine449bd832023-01-11 14:50:10 +01003131 /*
3132 * Injection of dummy-CCS's for middlebox compatibility
3133 */
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003134#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
Gabor Mezeif7044ea2022-06-28 16:01:49 +02003135 case MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST:
Gilles Peskine449bd832023-01-11 14:50:10 +01003136 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3137 if (ret == 0) {
3138 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
3139 }
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003140 break;
3141
3142 case MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO:
Gilles Peskine449bd832023-01-11 14:50:10 +01003143 ret = mbedtls_ssl_tls13_write_change_cipher_spec(ssl);
3144 if (ret == 0) {
3145 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_ENCRYPTED_EXTENSIONS);
3146 }
Gabor Mezei7b39bf12022-05-24 16:04:14 +02003147 break;
3148#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
3149
Jerry Yu69dd8d42022-04-16 12:51:26 +08003150 case MBEDTLS_SSL_SERVER_FINISHED:
Gilles Peskine449bd832023-01-11 14:50:10 +01003151 ret = ssl_tls13_write_server_finished(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003152 break;
3153
3154 case MBEDTLS_SSL_CLIENT_FINISHED:
Gilles Peskine449bd832023-01-11 14:50:10 +01003155 ret = ssl_tls13_process_client_finished(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003156 break;
3157
Jerry Yu69dd8d42022-04-16 12:51:26 +08003158 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Gilles Peskine449bd832023-01-11 14:50:10 +01003159 ret = ssl_tls13_handshake_wrapup(ssl);
Jerry Yu69dd8d42022-04-16 12:51:26 +08003160 break;
3161
Ronald Cron766c0cd2022-10-18 12:17:11 +02003162#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
XiaokangQian6b916b12022-04-25 07:29:34 +00003163 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
Gilles Peskine449bd832023-01-11 14:50:10 +01003164 ret = mbedtls_ssl_tls13_process_certificate(ssl);
3165 if (ret == 0) {
3166 if (ssl->session_negotiate->peer_cert != NULL) {
Ronald Cron209cae92022-06-07 10:30:19 +02003167 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003168 ssl, MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY);
3169 } else {
3170 MBEDTLS_SSL_DEBUG_MSG(2, ("skip parse certificate verify"));
Ronald Cron209cae92022-06-07 10:30:19 +02003171 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003172 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
Ronald Cron19385882022-06-15 16:26:13 +02003173 }
XiaokangQian6b916b12022-04-25 07:29:34 +00003174 }
3175 break;
3176
3177 case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY:
Gilles Peskine449bd832023-01-11 14:50:10 +01003178 ret = mbedtls_ssl_tls13_process_certificate_verify(ssl);
3179 if (ret == 0) {
XiaokangQian6b916b12022-04-25 07:29:34 +00003180 mbedtls_ssl_handshake_set_state(
Gilles Peskine449bd832023-01-11 14:50:10 +01003181 ssl, MBEDTLS_SSL_CLIENT_FINISHED);
XiaokangQian6b916b12022-04-25 07:29:34 +00003182 }
3183 break;
Ronald Cron766c0cd2022-10-18 12:17:11 +02003184#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */
XiaokangQian6b916b12022-04-25 07:29:34 +00003185
Jerry Yue67bef42022-07-07 07:29:42 +00003186#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Jerry Yua8d3c502022-10-30 14:51:23 +08003187 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET:
Gilles Peskine449bd832023-01-11 14:50:10 +01003188 ret = ssl_tls13_write_new_session_ticket(ssl);
3189 if (ret != 0) {
3190 MBEDTLS_SSL_DEBUG_RET(1,
3191 "ssl_tls13_write_new_session_ticket ",
3192 ret);
Jerry Yue67bef42022-07-07 07:29:42 +00003193 }
3194 break;
Jerry Yua8d3c502022-10-30 14:51:23 +08003195 case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH:
Jerry Yue67bef42022-07-07 07:29:42 +00003196 /* This state is necessary to do the flush of the New Session
Jerry Yua8d3c502022-10-30 14:51:23 +08003197 * Ticket message written in MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET
Jerry Yue67bef42022-07-07 07:29:42 +00003198 * as part of ssl_prepare_handshake_step.
3199 */
3200 ret = 0;
Jerry Yud4e75002022-08-09 13:33:50 +08003201
Gilles Peskine449bd832023-01-11 14:50:10 +01003202 if (ssl->handshake->new_session_tickets_count == 0) {
3203 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_OVER);
3204 } else {
Xiaokang Qian9f1747b2023-03-30 02:50:04 +00003205 mbedtls_ssl_handshake_set_state(
3206 ssl, MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET);
Gilles Peskine449bd832023-01-11 14:50:10 +01003207 }
Jerry Yue67bef42022-07-07 07:29:42 +00003208 break;
3209
3210#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3211
XiaokangQian7807f9f2022-02-15 10:04:37 +00003212 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01003213 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state));
3214 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
XiaokangQian7807f9f2022-02-15 10:04:37 +00003215 }
3216
Gilles Peskine449bd832023-01-11 14:50:10 +01003217 return ret;
Jerry Yub9930e72021-08-06 17:11:51 +08003218}
Jerry Yu3cc4c2a2021-08-06 16:29:08 +08003219
Jerry Yufb4b6472022-01-27 15:03:26 +08003220#endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_3 */