1 /*
2 * TLS server-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6 */
7
8 #include "common.h"
9
10 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2)
11
12 #include "mbedtls/platform.h"
13
14 #include "mbedtls/ssl.h"
15 #include "ssl_misc.h"
16 #include "debug_internal.h"
17 #include "mbedtls/error.h"
18 #include "mbedtls/platform_util.h"
19 #include "constant_time_internal.h"
20 #include "mbedtls/constant_time.h"
21
22 #include <string.h>
23
24 #if defined(MBEDTLS_USE_PSA_CRYPTO)
25 /* Define a local translating function to save code size by not using too many
26 * arguments in each translating place. */
27 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) || \
28 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
local_err_translation(psa_status_t status)29 static int local_err_translation(psa_status_t status)
30 {
31 return psa_status_to_mbedtls(status, psa_to_ssl_errors,
32 ARRAY_LENGTH(psa_to_ssl_errors),
33 psa_generic_status_to_mbedtls);
34 }
35 #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
36 #endif
37 #endif
38
39 #if defined(MBEDTLS_ECP_C)
40 #include "mbedtls/ecp.h"
41 #endif
42
43 #if defined(MBEDTLS_HAVE_TIME)
44 #include "mbedtls/platform_time.h"
45 #endif
46
47 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context * ssl,const unsigned char * info,size_t ilen)48 int mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context *ssl,
49 const unsigned char *info,
50 size_t ilen)
51 {
52 if (ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER) {
53 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
54 }
55
56 mbedtls_free(ssl->cli_id);
57
58 if ((ssl->cli_id = mbedtls_calloc(1, ilen)) == NULL) {
59 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
60 }
61
62 memcpy(ssl->cli_id, info, ilen);
63 ssl->cli_id_len = ilen;
64
65 return 0;
66 }
67
mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config * conf,mbedtls_ssl_cookie_write_t * f_cookie_write,mbedtls_ssl_cookie_check_t * f_cookie_check,void * p_cookie)68 void mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config *conf,
69 mbedtls_ssl_cookie_write_t *f_cookie_write,
70 mbedtls_ssl_cookie_check_t *f_cookie_check,
71 void *p_cookie)
72 {
73 conf->f_cookie_write = f_cookie_write;
74 conf->f_cookie_check = f_cookie_check;
75 conf->p_cookie = p_cookie;
76 }
77 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
78
79 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
80 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_conf_has_psk_or_cb(mbedtls_ssl_config const * conf)81 static int ssl_conf_has_psk_or_cb(mbedtls_ssl_config const *conf)
82 {
83 if (conf->f_psk != NULL) {
84 return 1;
85 }
86
87 if (conf->psk_identity_len == 0 || conf->psk_identity == NULL) {
88 return 0;
89 }
90
91
92 #if defined(MBEDTLS_USE_PSA_CRYPTO)
93 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) {
94 return 1;
95 }
96 #endif /* MBEDTLS_USE_PSA_CRYPTO */
97
98 if (conf->psk != NULL && conf->psk_len != 0) {
99 return 1;
100 }
101
102 return 0;
103 }
104 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
105
106 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_renegotiation_info(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)107 static int ssl_parse_renegotiation_info(mbedtls_ssl_context *ssl,
108 const unsigned char *buf,
109 size_t len)
110 {
111 #if defined(MBEDTLS_SSL_RENEGOTIATION)
112 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
113 /* Check verify-data in constant-time. The length OTOH is no secret */
114 if (len != 1 + ssl->verify_data_len ||
115 buf[0] != ssl->verify_data_len ||
116 mbedtls_ct_memcmp(buf + 1, ssl->peer_verify_data,
117 ssl->verify_data_len) != 0) {
118 MBEDTLS_SSL_DEBUG_MSG(1, ("non-matching renegotiation info"));
119 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
120 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
121 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
122 }
123 } else
124 #endif /* MBEDTLS_SSL_RENEGOTIATION */
125 {
126 if (len != 1 || buf[0] != 0x0) {
127 MBEDTLS_SSL_DEBUG_MSG(1, ("non-zero length renegotiation info"));
128 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
129 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
130 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
131 }
132
133 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
134 }
135
136 return 0;
137 }
138
139 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
140 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
141 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
142 /*
143 * Function for parsing a supported groups (TLS 1.3) or supported elliptic
144 * curves (TLS 1.2) extension.
145 *
146 * The "extension_data" field of a supported groups extension contains a
147 * "NamedGroupList" value (TLS 1.3 RFC8446):
148 * enum {
149 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
150 * x25519(0x001D), x448(0x001E),
151 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
152 * ffdhe6144(0x0103), ffdhe8192(0x0104),
153 * ffdhe_private_use(0x01FC..0x01FF),
154 * ecdhe_private_use(0xFE00..0xFEFF),
155 * (0xFFFF)
156 * } NamedGroup;
157 * struct {
158 * NamedGroup named_group_list<2..2^16-1>;
159 * } NamedGroupList;
160 *
161 * The "extension_data" field of a supported elliptic curves extension contains
162 * a "NamedCurveList" value (TLS 1.2 RFC 8422):
163 * enum {
164 * deprecated(1..22),
165 * secp256r1 (23), secp384r1 (24), secp521r1 (25),
166 * x25519(29), x448(30),
167 * reserved (0xFE00..0xFEFF),
168 * deprecated(0xFF01..0xFF02),
169 * (0xFFFF)
170 * } NamedCurve;
171 * struct {
172 * NamedCurve named_curve_list<2..2^16-1>
173 * } NamedCurveList;
174 *
175 * The TLS 1.3 supported groups extension was defined to be a compatible
176 * generalization of the TLS 1.2 supported elliptic curves extension. They both
177 * share the same extension identifier.
178 *
179 */
180 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_supported_groups_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)181 static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl,
182 const unsigned char *buf,
183 size_t len)
184 {
185 size_t list_size, our_size;
186 const unsigned char *p;
187 uint16_t *curves_tls_id;
188
189 if (len < 2) {
190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
192 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
193 return MBEDTLS_ERR_SSL_DECODE_ERROR;
194 }
195 list_size = MBEDTLS_GET_UINT16_BE(buf, 0);
196 if (list_size + 2 != len ||
197 list_size % 2 != 0) {
198 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
199 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
200 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
201 return MBEDTLS_ERR_SSL_DECODE_ERROR;
202 }
203
204 /* Should never happen unless client duplicates the extension */
205 if (ssl->handshake->curves_tls_id != NULL) {
206 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
207 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
208 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
209 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
210 }
211
212 /* Don't allow our peer to make us allocate too much memory,
213 * and leave room for a final 0 */
214 our_size = list_size / 2 + 1;
215 if (our_size > MBEDTLS_ECP_DP_MAX) {
216 our_size = MBEDTLS_ECP_DP_MAX;
217 }
218
219 if ((curves_tls_id = mbedtls_calloc(our_size,
220 sizeof(*curves_tls_id))) == NULL) {
221 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
222 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR);
223 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
224 }
225
226 ssl->handshake->curves_tls_id = curves_tls_id;
227
228 p = buf + 2;
229 while (list_size > 0 && our_size > 1) {
230 uint16_t curr_tls_id = MBEDTLS_GET_UINT16_BE(p, 0);
231
232 if (mbedtls_ssl_get_ecp_group_id_from_tls_id(curr_tls_id) !=
233 MBEDTLS_ECP_DP_NONE) {
234 *curves_tls_id++ = curr_tls_id;
235 our_size--;
236 }
237
238 list_size -= 2;
239 p += 2;
240 }
241
242 return 0;
243 }
244
245 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_supported_point_formats(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)246 static int ssl_parse_supported_point_formats(mbedtls_ssl_context *ssl,
247 const unsigned char *buf,
248 size_t len)
249 {
250 size_t list_size;
251 const unsigned char *p;
252
253 if (len == 0 || (size_t) (buf[0] + 1) != len) {
254 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
255 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
256 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
257 return MBEDTLS_ERR_SSL_DECODE_ERROR;
258 }
259 list_size = buf[0];
260
261 p = buf + 1;
262 while (list_size > 0) {
263 if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
264 p[0] == MBEDTLS_ECP_PF_COMPRESSED) {
265 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
266 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED)
267 ssl->handshake->ecdh_ctx.point_format = p[0];
268 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */
269 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
270 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
271 mbedtls_ecjpake_set_point_format(&ssl->handshake->ecjpake_ctx,
272 p[0]);
273 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
274 MBEDTLS_SSL_DEBUG_MSG(4, ("point format selected: %d", p[0]));
275 return 0;
276 }
277
278 list_size--;
279 p++;
280 }
281
282 return 0;
283 }
284 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
285 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED ||
286 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
287
288 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
289 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_ecjpake_kkpp(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)290 static int ssl_parse_ecjpake_kkpp(mbedtls_ssl_context *ssl,
291 const unsigned char *buf,
292 size_t len)
293 {
294 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
295
296 #if defined(MBEDTLS_USE_PSA_CRYPTO)
297 if (ssl->handshake->psa_pake_ctx_is_ok != 1)
298 #else
299 if (mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0)
300 #endif /* MBEDTLS_USE_PSA_CRYPTO */
301 {
302 MBEDTLS_SSL_DEBUG_MSG(3, ("skip ecjpake kkpp extension"));
303 return 0;
304 }
305
306 #if defined(MBEDTLS_USE_PSA_CRYPTO)
307 if ((ret = mbedtls_psa_ecjpake_read_round(
308 &ssl->handshake->psa_pake_ctx, buf, len,
309 MBEDTLS_ECJPAKE_ROUND_ONE)) != 0) {
310 psa_destroy_key(ssl->handshake->psa_pake_password);
311 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
312
313 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round one", ret);
314 mbedtls_ssl_send_alert_message(
315 ssl,
316 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
317 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
318
319 return ret;
320 }
321 #else
322 if ((ret = mbedtls_ecjpake_read_round_one(&ssl->handshake->ecjpake_ctx,
323 buf, len)) != 0) {
324 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_one", ret);
325 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
326 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
327 return ret;
328 }
329 #endif /* MBEDTLS_USE_PSA_CRYPTO */
330
331 /* Only mark the extension as OK when we're sure it is */
332 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
333
334 return 0;
335 }
336 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
337
338 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
339 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_max_fragment_length_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)340 static int ssl_parse_max_fragment_length_ext(mbedtls_ssl_context *ssl,
341 const unsigned char *buf,
342 size_t len)
343 {
344 if (len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID) {
345 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
346 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
347 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
348 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
349 }
350
351 ssl->session_negotiate->mfl_code = buf[0];
352
353 return 0;
354 }
355 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
356
357 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
358 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_cid_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)359 static int ssl_parse_cid_ext(mbedtls_ssl_context *ssl,
360 const unsigned char *buf,
361 size_t len)
362 {
363 size_t peer_cid_len;
364
365 /* CID extension only makes sense in DTLS */
366 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
367 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
368 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
369 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
370 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
371 }
372
373 /*
374 * struct {
375 * opaque cid<0..2^8-1>;
376 * } ConnectionId;
377 */
378
379 if (len < 1) {
380 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
381 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
382 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
383 return MBEDTLS_ERR_SSL_DECODE_ERROR;
384 }
385
386 peer_cid_len = *buf++;
387 len--;
388
389 if (len != peer_cid_len) {
390 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
391 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
392 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
393 return MBEDTLS_ERR_SSL_DECODE_ERROR;
394 }
395
396 /* Ignore CID if the user has disabled its use. */
397 if (ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) {
398 /* Leave ssl->handshake->cid_in_use in its default
399 * value of MBEDTLS_SSL_CID_DISABLED. */
400 MBEDTLS_SSL_DEBUG_MSG(3, ("Client sent CID extension, but CID disabled"));
401 return 0;
402 }
403
404 if (peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX) {
405 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
406 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
407 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER);
408 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
409 }
410
411 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
412 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
413 memcpy(ssl->handshake->peer_cid, buf, peer_cid_len);
414
415 MBEDTLS_SSL_DEBUG_MSG(3, ("Use of CID extension negotiated"));
416 MBEDTLS_SSL_DEBUG_BUF(3, "Client CID", buf, peer_cid_len);
417
418 return 0;
419 }
420 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
421
422 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
423 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)424 static int ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context *ssl,
425 const unsigned char *buf,
426 size_t len)
427 {
428 if (len != 0) {
429 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
430 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
431 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
432 return MBEDTLS_ERR_SSL_DECODE_ERROR;
433 }
434
435 ((void) buf);
436
437 if (ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED) {
438 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
439 }
440
441 return 0;
442 }
443 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
444
445 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
446 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_extended_ms_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)447 static int ssl_parse_extended_ms_ext(mbedtls_ssl_context *ssl,
448 const unsigned char *buf,
449 size_t len)
450 {
451 if (len != 0) {
452 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
453 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
454 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
455 return MBEDTLS_ERR_SSL_DECODE_ERROR;
456 }
457
458 ((void) buf);
459
460 if (ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) {
461 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
462 }
463
464 return 0;
465 }
466 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
467
468 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
469 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_session_ticket_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t len)470 static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl,
471 unsigned char *buf,
472 size_t len)
473 {
474 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
475 mbedtls_ssl_session session;
476
477 mbedtls_ssl_session_init(&session);
478
479 if (ssl->conf->f_ticket_parse == NULL ||
480 ssl->conf->f_ticket_write == NULL) {
481 return 0;
482 }
483
484 /* Remember the client asked us to send a new ticket */
485 ssl->handshake->new_session_ticket = 1;
486
487 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket length: %" MBEDTLS_PRINTF_SIZET, len));
488
489 if (len == 0) {
490 return 0;
491 }
492
493 #if defined(MBEDTLS_SSL_RENEGOTIATION)
494 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
495 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket rejected: renegotiating"));
496 return 0;
497 }
498 #endif /* MBEDTLS_SSL_RENEGOTIATION */
499
500 /*
501 * Failures are ok: just ignore the ticket and proceed.
502 */
503 if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket, &session,
504 buf, len)) != 0) {
505 mbedtls_ssl_session_free(&session);
506
507 if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) {
508 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic"));
509 } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) {
510 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired"));
511 } else {
512 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_parse", ret);
513 }
514
515 return 0;
516 }
517
518 /*
519 * Keep the session ID sent by the client, since we MUST send it back to
520 * inform them we're accepting the ticket (RFC 5077 section 3.4)
521 */
522 session.id_len = ssl->session_negotiate->id_len;
523 memcpy(&session.id, ssl->session_negotiate->id, session.id_len);
524
525 mbedtls_ssl_session_free(ssl->session_negotiate);
526 memcpy(ssl->session_negotiate, &session, sizeof(mbedtls_ssl_session));
527
528 /* Zeroize instead of free as we copied the content */
529 mbedtls_platform_zeroize(&session, sizeof(mbedtls_ssl_session));
530
531 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from ticket"));
532
533 ssl->handshake->resume = 1;
534
535 /* Don't send a new ticket after all, this one is OK */
536 ssl->handshake->new_session_ticket = 0;
537
538 return 0;
539 }
540 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
541
542 #if defined(MBEDTLS_SSL_DTLS_SRTP)
543 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_use_srtp_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)544 static int ssl_parse_use_srtp_ext(mbedtls_ssl_context *ssl,
545 const unsigned char *buf,
546 size_t len)
547 {
548 mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET;
549 size_t i, j;
550 size_t profile_length;
551 uint16_t mki_length;
552 /*! 2 bytes for profile length and 1 byte for mki len */
553 const size_t size_of_lengths = 3;
554
555 /* If use_srtp is not configured, just ignore the extension */
556 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) ||
557 (ssl->conf->dtls_srtp_profile_list == NULL) ||
558 (ssl->conf->dtls_srtp_profile_list_len == 0)) {
559 return 0;
560 }
561
562 /* RFC5764 section 4.1.1
563 * uint8 SRTPProtectionProfile[2];
564 *
565 * struct {
566 * SRTPProtectionProfiles SRTPProtectionProfiles;
567 * opaque srtp_mki<0..255>;
568 * } UseSRTPData;
569
570 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
571 */
572
573 /*
574 * Min length is 5: at least one protection profile(2 bytes)
575 * and length(2 bytes) + srtp_mki length(1 byte)
576 * Check here that we have at least 2 bytes of protection profiles length
577 * and one of srtp_mki length
578 */
579 if (len < size_of_lengths) {
580 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
581 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
582 return MBEDTLS_ERR_SSL_DECODE_ERROR;
583 }
584
585 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET;
586
587 /* first 2 bytes are protection profile length(in bytes) */
588 profile_length = (buf[0] << 8) | buf[1];
589 buf += 2;
590
591 /* The profile length cannot be bigger than input buffer size - lengths fields */
592 if (profile_length > len - size_of_lengths ||
593 profile_length % 2 != 0) { /* profiles are 2 bytes long, so the length must be even */
594 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
595 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
596 return MBEDTLS_ERR_SSL_DECODE_ERROR;
597 }
598 /*
599 * parse the extension list values are defined in
600 * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml
601 */
602 for (j = 0; j < profile_length; j += 2) {
603 uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1];
604 client_protection = mbedtls_ssl_check_srtp_profile_value(protection_profile_value);
605
606 if (client_protection != MBEDTLS_TLS_SRTP_UNSET) {
607 MBEDTLS_SSL_DEBUG_MSG(3, ("found srtp profile: %s",
608 mbedtls_ssl_get_srtp_profile_as_string(
609 client_protection)));
610 } else {
611 continue;
612 }
613 /* check if suggested profile is in our list */
614 for (i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++) {
615 if (client_protection == ssl->conf->dtls_srtp_profile_list[i]) {
616 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i];
617 MBEDTLS_SSL_DEBUG_MSG(3, ("selected srtp profile: %s",
618 mbedtls_ssl_get_srtp_profile_as_string(
619 client_protection)));
620 break;
621 }
622 }
623 if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET) {
624 break;
625 }
626 }
627 buf += profile_length; /* buf points to the mki length */
628 mki_length = *buf;
629 buf++;
630
631 if (mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH ||
632 mki_length + profile_length + size_of_lengths != len) {
633 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
634 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
635 return MBEDTLS_ERR_SSL_DECODE_ERROR;
636 }
637
638 /* Parse the mki only if present and mki is supported locally */
639 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED &&
640 mki_length > 0) {
641 ssl->dtls_srtp_info.mki_len = mki_length;
642
643 memcpy(ssl->dtls_srtp_info.mki_value, buf, mki_length);
644
645 MBEDTLS_SSL_DEBUG_BUF(3, "using mki", ssl->dtls_srtp_info.mki_value,
646 ssl->dtls_srtp_info.mki_len);
647 }
648
649 return 0;
650 }
651 #endif /* MBEDTLS_SSL_DTLS_SRTP */
652
653 /*
654 * Auxiliary functions for ServerHello parsing and related actions
655 */
656
657 #if defined(MBEDTLS_X509_CRT_PARSE_C)
658 /*
659 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
660 */
661 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
662 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_check_key_curve(mbedtls_pk_context * pk,uint16_t * curves_tls_id)663 static int ssl_check_key_curve(mbedtls_pk_context *pk,
664 uint16_t *curves_tls_id)
665 {
666 uint16_t *curr_tls_id = curves_tls_id;
667 mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk);
668 mbedtls_ecp_group_id curr_grp_id;
669
670 while (*curr_tls_id != 0) {
671 curr_grp_id = mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id);
672 if (curr_grp_id == grp_id) {
673 return 0;
674 }
675 curr_tls_id++;
676 }
677
678 return -1;
679 }
680 #endif /* MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED */
681
682 /*
683 * Try picking a certificate for this ciphersuite,
684 * return 0 on success and -1 on failure.
685 */
686 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_pick_cert(mbedtls_ssl_context * ssl,const mbedtls_ssl_ciphersuite_t * ciphersuite_info)687 static int ssl_pick_cert(mbedtls_ssl_context *ssl,
688 const mbedtls_ssl_ciphersuite_t *ciphersuite_info)
689 {
690 mbedtls_ssl_key_cert *cur, *list;
691 #if defined(MBEDTLS_USE_PSA_CRYPTO)
692 psa_algorithm_t pk_alg =
693 mbedtls_ssl_get_ciphersuite_sig_pk_psa_alg(ciphersuite_info);
694 psa_key_usage_t pk_usage =
695 mbedtls_ssl_get_ciphersuite_sig_pk_psa_usage(ciphersuite_info);
696 #else
697 mbedtls_pk_type_t pk_alg =
698 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info);
699 #endif /* MBEDTLS_USE_PSA_CRYPTO */
700 uint32_t flags;
701
702 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
703 if (ssl->handshake->sni_key_cert != NULL) {
704 list = ssl->handshake->sni_key_cert;
705 } else
706 #endif
707 list = ssl->conf->key_cert;
708
709 int pk_alg_is_none = 0;
710 #if defined(MBEDTLS_USE_PSA_CRYPTO)
711 pk_alg_is_none = (pk_alg == PSA_ALG_NONE);
712 #else
713 pk_alg_is_none = (pk_alg == MBEDTLS_PK_NONE);
714 #endif /* MBEDTLS_USE_PSA_CRYPTO */
715 if (pk_alg_is_none) {
716 return 0;
717 }
718
719 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite requires certificate"));
720
721 if (list == NULL) {
722 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate"));
723 return -1;
724 }
725
726 for (cur = list; cur != NULL; cur = cur->next) {
727 flags = 0;
728 MBEDTLS_SSL_DEBUG_CRT(3, "candidate certificate chain, certificate",
729 cur->cert);
730
731 int key_type_matches = 0;
732 #if defined(MBEDTLS_USE_PSA_CRYPTO)
733 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
734 key_type_matches = ((ssl->conf->f_async_sign_start != NULL ||
735 ssl->conf->f_async_decrypt_start != NULL ||
736 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)) &&
737 mbedtls_pk_can_do_ext(&cur->cert->pk, pk_alg, pk_usage));
738 #else
739 key_type_matches = (
740 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage));
741 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
742 #else
743 key_type_matches = mbedtls_pk_can_do(&cur->cert->pk, pk_alg);
744 #endif /* MBEDTLS_USE_PSA_CRYPTO */
745 if (!key_type_matches) {
746 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: key type"));
747 continue;
748 }
749
750 /*
751 * This avoids sending the client a cert it'll reject based on
752 * keyUsage or other extensions.
753 *
754 * It also allows the user to provision different certificates for
755 * different uses based on keyUsage, eg if they want to avoid signing
756 * and decrypting with the same RSA key.
757 */
758 if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info,
759 MBEDTLS_SSL_IS_CLIENT,
760 MBEDTLS_SSL_VERSION_TLS1_2,
761 &flags) != 0) {
762 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: "
763 "(extended) key usage extension"));
764 continue;
765 }
766
767 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
768 if (pk_alg == MBEDTLS_PK_ECDSA &&
769 ssl_check_key_curve(&cur->cert->pk,
770 ssl->handshake->curves_tls_id) != 0) {
771 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: elliptic curve"));
772 continue;
773 }
774 #endif
775
776 /* If we get there, we got a winner */
777 break;
778 }
779
780 /* Do not update ssl->handshake->key_cert unless there is a match */
781 if (cur != NULL) {
782 ssl->handshake->key_cert = cur;
783 MBEDTLS_SSL_DEBUG_CRT(3, "selected certificate chain, certificate",
784 ssl->handshake->key_cert->cert);
785 return 0;
786 }
787
788 return -1;
789 }
790 #endif /* MBEDTLS_X509_CRT_PARSE_C */
791
792 /*
793 * Check if a given ciphersuite is suitable for use with our config/keys/etc
794 * Sets ciphersuite_info only if the suite matches.
795 */
796 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_ciphersuite_match(mbedtls_ssl_context * ssl,int suite_id,const mbedtls_ssl_ciphersuite_t ** ciphersuite_info)797 static int ssl_ciphersuite_match(mbedtls_ssl_context *ssl, int suite_id,
798 const mbedtls_ssl_ciphersuite_t **ciphersuite_info)
799 {
800 const mbedtls_ssl_ciphersuite_t *suite_info;
801
802 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
803 mbedtls_pk_type_t sig_type;
804 #endif
805
806 suite_info = mbedtls_ssl_ciphersuite_from_id(suite_id);
807 if (suite_info == NULL) {
808 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
809 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
810 }
811
812 MBEDTLS_SSL_DEBUG_MSG(3, ("trying ciphersuite: %#04x (%s)",
813 (unsigned int) suite_id, suite_info->name));
814
815 if (suite_info->min_tls_version > ssl->tls_version ||
816 suite_info->max_tls_version < ssl->tls_version) {
817 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: version"));
818 return 0;
819 }
820
821 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
822 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
823 (ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK) == 0) {
824 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: ecjpake "
825 "not configured or ext missing"));
826 return 0;
827 }
828 #endif
829
830
831 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
832 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
833 if (mbedtls_ssl_ciphersuite_uses_ec(suite_info) &&
834 (ssl->handshake->curves_tls_id == NULL ||
835 ssl->handshake->curves_tls_id[0] == 0)) {
836 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: "
837 "no common elliptic curve"));
838 return 0;
839 }
840 #endif
841
842 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
843 /* If the ciphersuite requires a pre-shared key and we don't
844 * have one, skip it now rather than failing later */
845 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) &&
846 ssl_conf_has_psk_or_cb(ssl->conf) == 0) {
847 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no pre-shared key"));
848 return 0;
849 }
850 #endif
851
852 #if defined(MBEDTLS_X509_CRT_PARSE_C)
853 /*
854 * Final check: if ciphersuite requires us to have a
855 * certificate/key of a particular type:
856 * - select the appropriate certificate if we have one, or
857 * - try the next ciphersuite if we don't
858 * This must be done last since we modify the key_cert list.
859 */
860 if (ssl_pick_cert(ssl, suite_info) != 0) {
861 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: "
862 "no suitable certificate"));
863 return 0;
864 }
865 #endif
866
867 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
868 /* If the ciphersuite requires signing, check whether
869 * a suitable hash algorithm is present. */
870 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg(suite_info);
871 if (sig_type != MBEDTLS_PK_NONE &&
872 mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
873 ssl, mbedtls_ssl_sig_from_pk_alg(sig_type)) == MBEDTLS_SSL_HASH_NONE) {
874 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no suitable hash algorithm "
875 "for signature algorithm %u", (unsigned) sig_type));
876 return 0;
877 }
878
879 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
880
881 *ciphersuite_info = suite_info;
882 return 0;
883 }
884
885 /* This function doesn't alert on errors that happen early during
886 ClientHello parsing because they might indicate that the client is
887 not talking SSL/TLS at all and would not understand our alert. */
888 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_hello(mbedtls_ssl_context * ssl)889 static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
890 {
891 int ret, got_common_suite;
892 size_t i, j;
893 size_t ciph_offset, comp_offset, ext_offset;
894 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
895 #if defined(MBEDTLS_SSL_PROTO_DTLS)
896 size_t cookie_offset, cookie_len;
897 #endif
898 unsigned char *buf, *p, *ext;
899 #if defined(MBEDTLS_SSL_RENEGOTIATION)
900 int renegotiation_info_seen = 0;
901 #endif
902 int handshake_failure = 0;
903 const int *ciphersuites;
904 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
905
906 /* If there is no signature-algorithm extension present,
907 * we need to fall back to the default values for allowed
908 * signature-hash pairs. */
909 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
910 int sig_hash_alg_ext_present = 0;
911 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
912
913 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
914
915 int renegotiating;
916
917 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
918 read_record_header:
919 #endif
920 /*
921 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
922 * otherwise read it ourselves manually in order to support SSLv2
923 * ClientHello, which doesn't use the same record layer format.
924 * Otherwise in a scenario of TLS 1.3/TLS 1.2 version negotiation, the
925 * ClientHello has been already fully fetched by the TLS 1.3 code and the
926 * flag ssl->keep_current_message is raised.
927 */
928 renegotiating = 0;
929 #if defined(MBEDTLS_SSL_RENEGOTIATION)
930 renegotiating = (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE);
931 #endif
932 if (!renegotiating && !ssl->keep_current_message) {
933 if ((ret = mbedtls_ssl_fetch_input(ssl, 5)) != 0) {
934 /* No alert on a read error. */
935 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret);
936 return ret;
937 }
938 }
939
940 buf = ssl->in_hdr;
941
942 MBEDTLS_SSL_DEBUG_BUF(4, "record header", buf, mbedtls_ssl_in_hdr_len(ssl));
943
944 /*
945 * TLS Client Hello
946 *
947 * Record layer:
948 * 0 . 0 message type
949 * 1 . 2 protocol version
950 * 3 . 11 DTLS: epoch + record sequence number
951 * 3 . 4 message length
952 */
953 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message type: %d",
954 buf[0]));
955
956 if (buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE) {
957 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
958 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
959 }
960
961 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message len.: %d",
962 MBEDTLS_GET_UINT16_BE(ssl->in_len, 0)));
963
964 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, protocol version: [%d:%d]",
965 buf[1], buf[2]));
966
967 /* For DTLS if this is the initial handshake, remember the client sequence
968 * number to use it in our next message (RFC 6347 4.2.1) */
969 #if defined(MBEDTLS_SSL_PROTO_DTLS)
970 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
971 #if defined(MBEDTLS_SSL_RENEGOTIATION)
972 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
973 #endif
974 ) {
975 /* Epoch should be 0 for initial handshakes */
976 if (ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0) {
977 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
978 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
979 }
980
981 memcpy(&ssl->cur_out_ctr[2], ssl->in_ctr + 2,
982 sizeof(ssl->cur_out_ctr) - 2);
983
984 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
985 if (mbedtls_ssl_dtls_replay_check(ssl) != 0) {
986 MBEDTLS_SSL_DEBUG_MSG(1, ("replayed record, discarding"));
987 ssl->next_record_offset = 0;
988 ssl->in_left = 0;
989 goto read_record_header;
990 }
991
992 /* No MAC to check yet, so we can update right now */
993 mbedtls_ssl_dtls_replay_update(ssl);
994 #endif
995 }
996 #endif /* MBEDTLS_SSL_PROTO_DTLS */
997
998 msg_len = MBEDTLS_GET_UINT16_BE(ssl->in_len, 0);
999
1000 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1001 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
1002 /* Set by mbedtls_ssl_read_record() */
1003 msg_len = ssl->in_hslen;
1004 } else
1005 #endif
1006 {
1007 if (ssl->keep_current_message) {
1008 ssl->keep_current_message = 0;
1009 } else {
1010 if (msg_len > MBEDTLS_SSL_IN_CONTENT_LEN) {
1011 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1012 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
1013 }
1014
1015 if ((ret = mbedtls_ssl_fetch_input(ssl,
1016 mbedtls_ssl_in_hdr_len(ssl) + msg_len)) != 0) {
1017 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret);
1018 return ret;
1019 }
1020
1021 /* Done reading this record, get ready for the next one */
1022 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1023 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1024 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len(ssl);
1025 } else
1026 #endif
1027 ssl->in_left = 0;
1028 }
1029 }
1030
1031 buf = ssl->in_msg;
1032
1033 MBEDTLS_SSL_DEBUG_BUF(4, "record contents", buf, msg_len);
1034
1035 ret = ssl->handshake->update_checksum(ssl, buf, msg_len);
1036 if (0 != ret) {
1037 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret);
1038 return ret;
1039 }
1040
1041 /*
1042 * Handshake layer:
1043 * 0 . 0 handshake type
1044 * 1 . 3 handshake length
1045 * 4 . 5 DTLS only: message sequence number
1046 * 6 . 8 DTLS only: fragment offset
1047 * 9 . 11 DTLS only: fragment length
1048 */
1049 if (msg_len < mbedtls_ssl_hs_hdr_len(ssl)) {
1050 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1051 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1052 }
1053
1054 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake type: %d", buf[0]));
1055
1056 if (buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO) {
1057 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1058 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
1059 }
1060
1061 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1062 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1063 /*
1064 * Copy the client's handshake message_seq on initial handshakes,
1065 * check sequence number on renego.
1066 */
1067 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1068 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
1069 /* This couldn't be done in ssl_prepare_handshake_record() */
1070 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4);
1071 if (cli_msg_seq != ssl->handshake->in_msg_seq) {
1072 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message_seq: "
1073 "%u (expected %u)", cli_msg_seq,
1074 ssl->handshake->in_msg_seq));
1075 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1076 }
1077
1078 ssl->handshake->in_msg_seq++;
1079 } else
1080 #endif
1081 {
1082 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4);
1083 ssl->handshake->out_msg_seq = cli_msg_seq;
1084 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1085 }
1086 {
1087 /*
1088 * For now we don't support fragmentation, so make sure
1089 * fragment_offset == 0 and fragment_length == length
1090 */
1091 size_t fragment_offset, fragment_length, length;
1092 fragment_offset = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 6);
1093 fragment_length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 9);
1094 length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 1);
1095 MBEDTLS_SSL_DEBUG_MSG(
1096 4, ("fragment_offset=%u fragment_length=%u length=%u",
1097 (unsigned) fragment_offset, (unsigned) fragment_length,
1098 (unsigned) length));
1099 if (fragment_offset != 0 || length != fragment_length) {
1100 MBEDTLS_SSL_DEBUG_MSG(1, ("ClientHello fragmentation not supported"));
1101 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1102 }
1103 }
1104 }
1105 #endif /* MBEDTLS_SSL_PROTO_DTLS */
1106
1107 buf += mbedtls_ssl_hs_hdr_len(ssl);
1108 msg_len -= mbedtls_ssl_hs_hdr_len(ssl);
1109
1110 /*
1111 * ClientHello layout:
1112 * 0 . 1 protocol version
1113 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1114 * 34 . 34 session id length (1 byte)
1115 * 35 . 34+x session id, where x = session id length from byte 34
1116 * 35+x . 35+x DTLS only: cookie length (1 byte)
1117 * 36+x . .. DTLS only: cookie
1118 * .. . .. ciphersuite list length (2 bytes)
1119 * .. . .. ciphersuite list
1120 * .. . .. compression alg. list length (1 byte)
1121 * .. . .. compression alg. list
1122 * .. . .. extensions length (2 bytes, optional)
1123 * .. . .. extensions (optional)
1124 */
1125
1126 /*
1127 * Minimal length (with everything empty and extensions omitted) is
1128 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1129 * read at least up to session id length without worrying.
1130 */
1131 if (msg_len < 38) {
1132 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1133 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1134 }
1135
1136 /*
1137 * Check and save the protocol version
1138 */
1139 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, version", buf, 2);
1140
1141 ssl->tls_version = (mbedtls_ssl_protocol_version) mbedtls_ssl_read_version(buf,
1142 ssl->conf->transport);
1143 ssl->session_negotiate->tls_version = ssl->tls_version;
1144 ssl->session_negotiate->endpoint = ssl->conf->endpoint;
1145
1146 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) {
1147 MBEDTLS_SSL_DEBUG_MSG(1, ("server only supports TLS 1.2"));
1148 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1149 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION);
1150 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
1151 }
1152
1153 /*
1154 * Save client random (inc. Unix time)
1155 */
1156 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes", buf + 2, 32);
1157
1158 memcpy(ssl->handshake->randbytes, buf + 2, 32);
1159
1160 /*
1161 * Check the session ID length and save session ID
1162 */
1163 sess_len = buf[34];
1164
1165 if (sess_len > sizeof(ssl->session_negotiate->id) ||
1166 sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */
1167 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1168 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1169 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1170 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1171 }
1172
1173 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id", buf + 35, sess_len);
1174
1175 ssl->session_negotiate->id_len = sess_len;
1176 memset(ssl->session_negotiate->id, 0,
1177 sizeof(ssl->session_negotiate->id));
1178 memcpy(ssl->session_negotiate->id, buf + 35,
1179 ssl->session_negotiate->id_len);
1180
1181 /*
1182 * Check the cookie length and content
1183 */
1184 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1185 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1186 cookie_offset = 35 + sess_len;
1187 cookie_len = buf[cookie_offset];
1188
1189 if (cookie_offset + 1 + cookie_len + 2 > msg_len) {
1190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1192 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1193 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1194 }
1195
1196 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie",
1197 buf + cookie_offset + 1, cookie_len);
1198
1199 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
1200 if (ssl->conf->f_cookie_check != NULL
1201 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1202 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
1203 #endif
1204 ) {
1205 if (ssl->conf->f_cookie_check(ssl->conf->p_cookie,
1206 buf + cookie_offset + 1, cookie_len,
1207 ssl->cli_id, ssl->cli_id_len) != 0) {
1208 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification failed"));
1209 ssl->handshake->cookie_verify_result = 1;
1210 } else {
1211 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification passed"));
1212 ssl->handshake->cookie_verify_result = 0;
1213 }
1214 } else
1215 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
1216 {
1217 /* We know we didn't send a cookie, so it should be empty */
1218 if (cookie_len != 0) {
1219 /* This may be an attacker's probe, so don't send an alert */
1220 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1221 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1222 }
1223
1224 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification skipped"));
1225 }
1226
1227 /*
1228 * Check the ciphersuitelist length (will be parsed later)
1229 */
1230 ciph_offset = cookie_offset + 1 + cookie_len;
1231 } else
1232 #endif /* MBEDTLS_SSL_PROTO_DTLS */
1233 ciph_offset = 35 + sess_len;
1234
1235 ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset);
1236
1237 if (ciph_len < 2 ||
1238 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1239 (ciph_len % 2) != 0) {
1240 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1241 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1242 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1243 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1244 }
1245
1246 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, ciphersuitelist",
1247 buf + ciph_offset + 2, ciph_len);
1248
1249 /*
1250 * Check the compression algorithm's length.
1251 * The list contents are ignored because implementing
1252 * MBEDTLS_SSL_COMPRESS_NULL is mandatory and is the only
1253 * option supported by Mbed TLS.
1254 */
1255 comp_offset = ciph_offset + 2 + ciph_len;
1256
1257 comp_len = buf[comp_offset];
1258
1259 if (comp_len < 1 ||
1260 comp_len > 16 ||
1261 comp_len + comp_offset + 1 > msg_len) {
1262 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1263 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1264 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1265 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1266 }
1267
1268 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, compression",
1269 buf + comp_offset + 1, comp_len);
1270
1271 /*
1272 * Check the extension length
1273 */
1274 ext_offset = comp_offset + 1 + comp_len;
1275 if (msg_len > ext_offset) {
1276 if (msg_len < ext_offset + 2) {
1277 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1278 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1279 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1280 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1281 }
1282
1283 ext_len = MBEDTLS_GET_UINT16_BE(buf, ext_offset);
1284
1285 if (msg_len != ext_offset + 2 + ext_len) {
1286 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1287 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1288 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1289 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1290 }
1291 } else {
1292 ext_len = 0;
1293 }
1294
1295 ext = buf + ext_offset + 2;
1296 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", ext, ext_len);
1297
1298 while (ext_len != 0) {
1299 unsigned int ext_id;
1300 unsigned int ext_size;
1301 if (ext_len < 4) {
1302 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1303 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1304 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1305 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1306 }
1307 ext_id = MBEDTLS_GET_UINT16_BE(ext, 0);
1308 ext_size = MBEDTLS_GET_UINT16_BE(ext, 2);
1309
1310 if (ext_size + 4 > ext_len) {
1311 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
1312 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1313 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
1314 return MBEDTLS_ERR_SSL_DECODE_ERROR;
1315 }
1316 switch (ext_id) {
1317 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1318 case MBEDTLS_TLS_EXT_SERVERNAME:
1319 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension"));
1320 ret = mbedtls_ssl_parse_server_name_ext(ssl, ext + 4,
1321 ext + 4 + ext_size);
1322 if (ret != 0) {
1323 return ret;
1324 }
1325 break;
1326 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
1327
1328 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1329 MBEDTLS_SSL_DEBUG_MSG(3, ("found renegotiation extension"));
1330 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1331 renegotiation_info_seen = 1;
1332 #endif
1333
1334 ret = ssl_parse_renegotiation_info(ssl, ext + 4, ext_size);
1335 if (ret != 0) {
1336 return ret;
1337 }
1338 break;
1339
1340 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1341 case MBEDTLS_TLS_EXT_SIG_ALG:
1342 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension"));
1343
1344 ret = mbedtls_ssl_parse_sig_alg_ext(ssl, ext + 4, ext + 4 + ext_size);
1345 if (ret != 0) {
1346 return ret;
1347 }
1348
1349 sig_hash_alg_ext_present = 1;
1350 break;
1351 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1352
1353 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
1354 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
1355 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1356 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS:
1357 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported elliptic curves extension"));
1358
1359 ret = ssl_parse_supported_groups_ext(ssl, ext + 4, ext_size);
1360 if (ret != 0) {
1361 return ret;
1362 }
1363 break;
1364
1365 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1366 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported point formats extension"));
1367 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
1368
1369 ret = ssl_parse_supported_point_formats(ssl, ext + 4, ext_size);
1370 if (ret != 0) {
1371 return ret;
1372 }
1373 break;
1374 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || \
1375 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED ||
1376 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1377
1378 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1379 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1380 MBEDTLS_SSL_DEBUG_MSG(3, ("found ecjpake kkpp extension"));
1381
1382 ret = ssl_parse_ecjpake_kkpp(ssl, ext + 4, ext_size);
1383 if (ret != 0) {
1384 return ret;
1385 }
1386 break;
1387 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1388
1389 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1390 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1391 MBEDTLS_SSL_DEBUG_MSG(3, ("found max fragment length extension"));
1392
1393 ret = ssl_parse_max_fragment_length_ext(ssl, ext + 4, ext_size);
1394 if (ret != 0) {
1395 return ret;
1396 }
1397 break;
1398 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1399
1400 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
1401 case MBEDTLS_TLS_EXT_CID:
1402 MBEDTLS_SSL_DEBUG_MSG(3, ("found CID extension"));
1403
1404 ret = ssl_parse_cid_ext(ssl, ext + 4, ext_size);
1405 if (ret != 0) {
1406 return ret;
1407 }
1408 break;
1409 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1410
1411 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1412 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1413 MBEDTLS_SSL_DEBUG_MSG(3, ("found encrypt then mac extension"));
1414
1415 ret = ssl_parse_encrypt_then_mac_ext(ssl, ext + 4, ext_size);
1416 if (ret != 0) {
1417 return ret;
1418 }
1419 break;
1420 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1421
1422 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1423 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1424 MBEDTLS_SSL_DEBUG_MSG(3, ("found extended master secret extension"));
1425
1426 ret = ssl_parse_extended_ms_ext(ssl, ext + 4, ext_size);
1427 if (ret != 0) {
1428 return ret;
1429 }
1430 break;
1431 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1432
1433 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1434 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1435 MBEDTLS_SSL_DEBUG_MSG(3, ("found session ticket extension"));
1436
1437 ret = ssl_parse_session_ticket_ext(ssl, ext + 4, ext_size);
1438 if (ret != 0) {
1439 return ret;
1440 }
1441 break;
1442 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1443
1444 #if defined(MBEDTLS_SSL_ALPN)
1445 case MBEDTLS_TLS_EXT_ALPN:
1446 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension"));
1447
1448 ret = mbedtls_ssl_parse_alpn_ext(ssl, ext + 4,
1449 ext + 4 + ext_size);
1450 if (ret != 0) {
1451 return ret;
1452 }
1453 break;
1454 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1455
1456 #if defined(MBEDTLS_SSL_DTLS_SRTP)
1457 case MBEDTLS_TLS_EXT_USE_SRTP:
1458 MBEDTLS_SSL_DEBUG_MSG(3, ("found use_srtp extension"));
1459
1460 ret = ssl_parse_use_srtp_ext(ssl, ext + 4, ext_size);
1461 if (ret != 0) {
1462 return ret;
1463 }
1464 break;
1465 #endif /* MBEDTLS_SSL_DTLS_SRTP */
1466
1467 default:
1468 MBEDTLS_SSL_DEBUG_MSG(3, ("unknown extension found: %u (ignoring)",
1469 ext_id));
1470 }
1471
1472 ext_len -= 4 + ext_size;
1473 ext += 4 + ext_size;
1474 }
1475
1476 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1477
1478 /*
1479 * Try to fall back to default hash SHA1 if the client
1480 * hasn't provided any preferred signature-hash combinations.
1481 */
1482 if (!sig_hash_alg_ext_present) {
1483 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs;
1484 const uint16_t default_sig_algs[] = {
1485 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
1486 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA,
1487 MBEDTLS_SSL_HASH_SHA1),
1488 #endif
1489 #if defined(MBEDTLS_RSA_C)
1490 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA,
1491 MBEDTLS_SSL_HASH_SHA1),
1492 #endif
1493 MBEDTLS_TLS_SIG_NONE
1494 };
1495
1496 MBEDTLS_STATIC_ASSERT(sizeof(default_sig_algs) / sizeof(default_sig_algs[0])
1497 <= MBEDTLS_RECEIVED_SIG_ALGS_SIZE,
1498 "default_sig_algs is too big");
1499
1500 memcpy(received_sig_algs, default_sig_algs, sizeof(default_sig_algs));
1501 }
1502
1503 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
1504
1505 /*
1506 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1507 */
1508 for (i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2) {
1509 if (p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO) {
1510 MBEDTLS_SSL_DEBUG_MSG(3, ("received TLS_EMPTY_RENEGOTIATION_INFO "));
1511 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1512 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) {
1513 MBEDTLS_SSL_DEBUG_MSG(1, ("received RENEGOTIATION SCSV "
1514 "during renegotiation"));
1515 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1516 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1517 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1518 }
1519 #endif
1520 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
1521 break;
1522 }
1523 }
1524
1525 /*
1526 * Renegotiation security checks
1527 */
1528 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
1529 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) {
1530 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation, breaking off handshake"));
1531 handshake_failure = 1;
1532 }
1533 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1534 else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1535 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
1536 renegotiation_info_seen == 0) {
1537 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension missing (secure)"));
1538 handshake_failure = 1;
1539 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1540 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1541 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) {
1542 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation not allowed"));
1543 handshake_failure = 1;
1544 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1545 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1546 renegotiation_info_seen == 1) {
1547 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension present (legacy)"));
1548 handshake_failure = 1;
1549 }
1550 #endif /* MBEDTLS_SSL_RENEGOTIATION */
1551
1552 if (handshake_failure == 1) {
1553 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1554 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1555 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1556 }
1557
1558 /*
1559 * Server certification selection (after processing TLS extensions)
1560 */
1561 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) {
1562 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret);
1563 return ret;
1564 }
1565 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1566 ssl->handshake->sni_name = NULL;
1567 ssl->handshake->sni_name_len = 0;
1568 #endif
1569
1570 /*
1571 * Search for a matching ciphersuite
1572 * (At the end because we need information from the EC-based extensions
1573 * and certificate from the SNI callback triggered by the SNI extension
1574 * or certificate from server certificate selection callback.)
1575 */
1576 got_common_suite = 0;
1577 ciphersuites = ssl->conf->ciphersuite_list;
1578 ciphersuite_info = NULL;
1579
1580 if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT) {
1581 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) {
1582 for (i = 0; ciphersuites[i] != 0; i++) {
1583 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) {
1584 continue;
1585 }
1586
1587 got_common_suite = 1;
1588
1589 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i],
1590 &ciphersuite_info)) != 0) {
1591 return ret;
1592 }
1593
1594 if (ciphersuite_info != NULL) {
1595 goto have_ciphersuite;
1596 }
1597 }
1598 }
1599 } else {
1600 for (i = 0; ciphersuites[i] != 0; i++) {
1601 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) {
1602 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) {
1603 continue;
1604 }
1605
1606 got_common_suite = 1;
1607
1608 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i],
1609 &ciphersuite_info)) != 0) {
1610 return ret;
1611 }
1612
1613 if (ciphersuite_info != NULL) {
1614 goto have_ciphersuite;
1615 }
1616 }
1617 }
1618 }
1619
1620 if (got_common_suite) {
1621 MBEDTLS_SSL_DEBUG_MSG(1, ("got ciphersuites in common, "
1622 "but none of them usable"));
1623 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1624 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1625 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1626 } else {
1627 MBEDTLS_SSL_DEBUG_MSG(1, ("got no ciphersuites in common"));
1628 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1629 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
1630 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
1631 }
1632
1633 have_ciphersuite:
1634 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %s", ciphersuite_info->name));
1635
1636 ssl->session_negotiate->ciphersuite = ciphersuites[i];
1637 ssl->handshake->ciphersuite_info = ciphersuite_info;
1638
1639 mbedtls_ssl_handshake_increment_state(ssl);
1640
1641 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1642 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
1643 mbedtls_ssl_recv_flight_completed(ssl);
1644 }
1645 #endif
1646
1647 /* Debugging-only output for testsuite */
1648 #if defined(MBEDTLS_DEBUG_C) && \
1649 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1650 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg(ciphersuite_info);
1651 if (sig_alg != MBEDTLS_PK_NONE) {
1652 unsigned int sig_hash = mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
1653 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg));
1654 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext: %u",
1655 sig_hash));
1656 } else {
1657 MBEDTLS_SSL_DEBUG_MSG(3, ("no hash algorithm for signature algorithm "
1658 "%u - should not happen", (unsigned) sig_alg));
1659 }
1660 #endif
1661
1662 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello"));
1663
1664 return 0;
1665 }
1666
1667 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
ssl_write_cid_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1668 static void ssl_write_cid_ext(mbedtls_ssl_context *ssl,
1669 unsigned char *buf,
1670 size_t *olen)
1671 {
1672 unsigned char *p = buf;
1673 size_t ext_len;
1674 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1675
1676 *olen = 0;
1677
1678 /* Skip writing the extension if we don't want to use it or if
1679 * the client hasn't offered it. */
1680 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED) {
1681 return;
1682 }
1683
1684 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
1685 * which is at most 255, so the increment cannot overflow. */
1686 if (end < p || (size_t) (end - p) < (unsigned) (ssl->own_cid_len + 5)) {
1687 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
1688 return;
1689 }
1690
1691 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding CID extension"));
1692
1693 /*
1694 * struct {
1695 * opaque cid<0..2^8-1>;
1696 * } ConnectionId;
1697 */
1698 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_CID, p, 0);
1699 p += 2;
1700 ext_len = (size_t) ssl->own_cid_len + 1;
1701 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0);
1702 p += 2;
1703
1704 *p++ = (uint8_t) ssl->own_cid_len;
1705 memcpy(p, ssl->own_cid, ssl->own_cid_len);
1706
1707 *olen = ssl->own_cid_len + 5;
1708 }
1709 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1710
1711 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1712 static void ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context *ssl,
1713 unsigned char *buf,
1714 size_t *olen)
1715 {
1716 unsigned char *p = buf;
1717 const mbedtls_ssl_ciphersuite_t *suite = NULL;
1718
1719 /*
1720 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
1721 * from a client and then selects a stream or Authenticated Encryption
1722 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
1723 * encrypt-then-MAC response extension back to the client."
1724 */
1725 suite = mbedtls_ssl_ciphersuite_from_id(
1726 ssl->session_negotiate->ciphersuite);
1727 if (suite == NULL) {
1728 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
1729 } else {
1730 mbedtls_ssl_mode_t ssl_mode =
1731 mbedtls_ssl_get_mode_from_ciphersuite(
1732 ssl->session_negotiate->encrypt_then_mac,
1733 suite);
1734
1735 if (ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM) {
1736 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
1737 }
1738 }
1739
1740 if (ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED) {
1741 *olen = 0;
1742 return;
1743 }
1744
1745 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding encrypt then mac extension"));
1746
1747 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC, p, 0);
1748 p += 2;
1749
1750 *p++ = 0x00;
1751 *p++ = 0x00;
1752
1753 *olen = 4;
1754 }
1755 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
1756
1757 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
ssl_write_extended_ms_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1758 static void ssl_write_extended_ms_ext(mbedtls_ssl_context *ssl,
1759 unsigned char *buf,
1760 size_t *olen)
1761 {
1762 unsigned char *p = buf;
1763
1764 if (ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED) {
1765 *olen = 0;
1766 return;
1767 }
1768
1769 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding extended master secret "
1770 "extension"));
1771
1772 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET, p, 0);
1773 p += 2;
1774
1775 *p++ = 0x00;
1776 *p++ = 0x00;
1777
1778 *olen = 4;
1779 }
1780 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1781
1782 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
ssl_write_session_ticket_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1783 static void ssl_write_session_ticket_ext(mbedtls_ssl_context *ssl,
1784 unsigned char *buf,
1785 size_t *olen)
1786 {
1787 unsigned char *p = buf;
1788
1789 if (ssl->handshake->new_session_ticket == 0) {
1790 *olen = 0;
1791 return;
1792 }
1793
1794 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding session ticket extension"));
1795
1796 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SESSION_TICKET, p, 0);
1797 p += 2;
1798
1799 *p++ = 0x00;
1800 *p++ = 0x00;
1801
1802 *olen = 4;
1803 }
1804 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1805
ssl_write_renegotiation_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1806 static void ssl_write_renegotiation_ext(mbedtls_ssl_context *ssl,
1807 unsigned char *buf,
1808 size_t *olen)
1809 {
1810 unsigned char *p = buf;
1811
1812 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION) {
1813 *olen = 0;
1814 return;
1815 }
1816
1817 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, secure renegotiation extension"));
1818
1819 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_RENEGOTIATION_INFO, p, 0);
1820 p += 2;
1821
1822 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1823 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
1824 *p++ = 0x00;
1825 *p++ = (ssl->verify_data_len * 2 + 1) & 0xFF;
1826 *p++ = ssl->verify_data_len * 2 & 0xFF;
1827
1828 memcpy(p, ssl->peer_verify_data, ssl->verify_data_len);
1829 p += ssl->verify_data_len;
1830 memcpy(p, ssl->own_verify_data, ssl->verify_data_len);
1831 p += ssl->verify_data_len;
1832 } else
1833 #endif /* MBEDTLS_SSL_RENEGOTIATION */
1834 {
1835 *p++ = 0x00;
1836 *p++ = 0x01;
1837 *p++ = 0x00;
1838 }
1839
1840 *olen = (size_t) (p - buf);
1841 }
1842
1843 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
ssl_write_max_fragment_length_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1844 static void ssl_write_max_fragment_length_ext(mbedtls_ssl_context *ssl,
1845 unsigned char *buf,
1846 size_t *olen)
1847 {
1848 unsigned char *p = buf;
1849
1850 if (ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE) {
1851 *olen = 0;
1852 return;
1853 }
1854
1855 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, max_fragment_length extension"));
1856
1857 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH, p, 0);
1858 p += 2;
1859
1860 *p++ = 0x00;
1861 *p++ = 1;
1862
1863 *p++ = ssl->session_negotiate->mfl_code;
1864
1865 *olen = 5;
1866 }
1867 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1868
1869 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
1870 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
1871 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_supported_point_formats_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1872 static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl,
1873 unsigned char *buf,
1874 size_t *olen)
1875 {
1876 unsigned char *p = buf;
1877 ((void) ssl);
1878
1879 if ((ssl->handshake->cli_exts &
1880 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT) == 0) {
1881 *olen = 0;
1882 return;
1883 }
1884
1885 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, supported_point_formats extension"));
1886
1887 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS, p, 0);
1888 p += 2;
1889
1890 *p++ = 0x00;
1891 *p++ = 2;
1892
1893 *p++ = 1;
1894 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
1895
1896 *olen = 6;
1897 }
1898 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED ||
1899 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED ||
1900 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1901
1902 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1903 static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
1904 unsigned char *buf,
1905 size_t *olen)
1906 {
1907 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1908 unsigned char *p = buf;
1909 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1910 size_t kkpp_len;
1911
1912 *olen = 0;
1913
1914 /* Skip costly computation if not needed */
1915 if (ssl->handshake->ciphersuite_info->key_exchange !=
1916 MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
1917 return;
1918 }
1919
1920 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension"));
1921
1922 if (end - p < 4) {
1923 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
1924 return;
1925 }
1926
1927 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0);
1928 p += 2;
1929
1930 #if defined(MBEDTLS_USE_PSA_CRYPTO)
1931 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx,
1932 p + 2, (size_t) (end - p - 2), &kkpp_len,
1933 MBEDTLS_ECJPAKE_ROUND_ONE);
1934 if (ret != 0) {
1935 psa_destroy_key(ssl->handshake->psa_pake_password);
1936 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
1937 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret);
1938 return;
1939 }
1940 #else
1941 ret = mbedtls_ecjpake_write_round_one(&ssl->handshake->ecjpake_ctx,
1942 p + 2, (size_t) (end - p - 2), &kkpp_len,
1943 ssl->conf->f_rng, ssl->conf->p_rng);
1944 if (ret != 0) {
1945 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_one", ret);
1946 return;
1947 }
1948 #endif /* MBEDTLS_USE_PSA_CRYPTO */
1949
1950 MBEDTLS_PUT_UINT16_BE(kkpp_len, p, 0);
1951 p += 2;
1952
1953 *olen = kkpp_len + 4;
1954 }
1955 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1956
1957 #if defined(MBEDTLS_SSL_DTLS_SRTP) && defined(MBEDTLS_SSL_PROTO_DTLS)
ssl_write_use_srtp_ext(mbedtls_ssl_context * ssl,unsigned char * buf,size_t * olen)1958 static void ssl_write_use_srtp_ext(mbedtls_ssl_context *ssl,
1959 unsigned char *buf,
1960 size_t *olen)
1961 {
1962 size_t mki_len = 0, ext_len = 0;
1963 uint16_t profile_value = 0;
1964 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
1965
1966 *olen = 0;
1967
1968 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) ||
1969 (ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET)) {
1970 return;
1971 }
1972
1973 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding use_srtp extension"));
1974
1975 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED) {
1976 mki_len = ssl->dtls_srtp_info.mki_len;
1977 }
1978
1979 /* The extension total size is 9 bytes :
1980 * - 2 bytes for the extension tag
1981 * - 2 bytes for the total size
1982 * - 2 bytes for the protection profile length
1983 * - 2 bytes for the protection profile
1984 * - 1 byte for the mki length
1985 * + the actual mki length
1986 * Check we have enough room in the output buffer */
1987 if ((size_t) (end - buf) < mki_len + 9) {
1988 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
1989 return;
1990 }
1991
1992 /* extension */
1993 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_USE_SRTP, buf, 0);
1994 /*
1995 * total length 5 and mki value: only one profile(2 bytes)
1996 * and length(2 bytes) and srtp_mki )
1997 */
1998 ext_len = 5 + mki_len;
1999 MBEDTLS_PUT_UINT16_BE(ext_len, buf, 2);
2000
2001 /* protection profile length: 2 */
2002 buf[4] = 0x00;
2003 buf[5] = 0x02;
2004 profile_value = mbedtls_ssl_check_srtp_profile_value(
2005 ssl->dtls_srtp_info.chosen_dtls_srtp_profile);
2006 if (profile_value != MBEDTLS_TLS_SRTP_UNSET) {
2007 MBEDTLS_PUT_UINT16_BE(profile_value, buf, 6);
2008 } else {
2009 MBEDTLS_SSL_DEBUG_MSG(1, ("use_srtp extension invalid profile"));
2010 return;
2011 }
2012
2013 buf[8] = mki_len & 0xFF;
2014 memcpy(&buf[9], ssl->dtls_srtp_info.mki_value, mki_len);
2015
2016 *olen = 9 + mki_len;
2017 }
2018 #endif /* MBEDTLS_SSL_DTLS_SRTP */
2019
2020 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2021 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_hello_verify_request(mbedtls_ssl_context * ssl)2022 static int ssl_write_hello_verify_request(mbedtls_ssl_context *ssl)
2023 {
2024 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2025 unsigned char *p = ssl->out_msg + 4;
2026 unsigned char *cookie_len_byte;
2027
2028 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello verify request"));
2029
2030 /*
2031 * struct {
2032 * ProtocolVersion server_version;
2033 * opaque cookie<0..2^8-1>;
2034 * } HelloVerifyRequest;
2035 */
2036
2037 /* The RFC is not clear on this point, but sending the actual negotiated
2038 * version looks like the most interoperable thing to do. */
2039 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version);
2040 MBEDTLS_SSL_DEBUG_BUF(3, "server version", p, 2);
2041 p += 2;
2042
2043 /* If we get here, f_cookie_check is not null */
2044 if (ssl->conf->f_cookie_write == NULL) {
2045 MBEDTLS_SSL_DEBUG_MSG(1, ("inconsistent cookie callbacks"));
2046 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2047 }
2048
2049 /* Skip length byte until we know the length */
2050 cookie_len_byte = p++;
2051
2052 if ((ret = ssl->conf->f_cookie_write(ssl->conf->p_cookie,
2053 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN,
2054 ssl->cli_id, ssl->cli_id_len)) != 0) {
2055 MBEDTLS_SSL_DEBUG_RET(1, "f_cookie_write", ret);
2056 return ret;
2057 }
2058
2059 *cookie_len_byte = (unsigned char) (p - (cookie_len_byte + 1));
2060
2061 MBEDTLS_SSL_DEBUG_BUF(3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte);
2062
2063 ssl->out_msglen = (size_t) (p - ssl->out_msg);
2064 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2065 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
2066
2067 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT);
2068
2069 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
2070 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
2071 return ret;
2072 }
2073
2074 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2075 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2076 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
2077 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
2078 return ret;
2079 }
2080 #endif /* MBEDTLS_SSL_PROTO_DTLS */
2081
2082 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello verify request"));
2083
2084 return 0;
2085 }
2086 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
2087
ssl_handle_id_based_session_resumption(mbedtls_ssl_context * ssl)2088 static void ssl_handle_id_based_session_resumption(mbedtls_ssl_context *ssl)
2089 {
2090 int ret;
2091 mbedtls_ssl_session session_tmp;
2092 mbedtls_ssl_session * const session = ssl->session_negotiate;
2093
2094 /* Resume is 0 by default, see ssl_handshake_init().
2095 * It may be already set to 1 by ssl_parse_session_ticket_ext(). */
2096 if (ssl->handshake->resume == 1) {
2097 return;
2098 }
2099 if (session->id_len == 0) {
2100 return;
2101 }
2102 if (ssl->conf->f_get_cache == NULL) {
2103 return;
2104 }
2105 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2106 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) {
2107 return;
2108 }
2109 #endif
2110
2111 mbedtls_ssl_session_init(&session_tmp);
2112
2113 ret = ssl->conf->f_get_cache(ssl->conf->p_cache,
2114 session->id,
2115 session->id_len,
2116 &session_tmp);
2117 if (ret != 0) {
2118 goto exit;
2119 }
2120
2121 if (session->ciphersuite != session_tmp.ciphersuite) {
2122 /* Mismatch between cached and negotiated session */
2123 goto exit;
2124 }
2125
2126 /* Move semantics */
2127 mbedtls_ssl_session_free(session);
2128 *session = session_tmp;
2129 memset(&session_tmp, 0, sizeof(session_tmp));
2130
2131 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from cache"));
2132 ssl->handshake->resume = 1;
2133
2134 exit:
2135
2136 mbedtls_ssl_session_free(&session_tmp);
2137 }
2138
2139 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_server_hello(mbedtls_ssl_context * ssl)2140 static int ssl_write_server_hello(mbedtls_ssl_context *ssl)
2141 {
2142 #if defined(MBEDTLS_HAVE_TIME)
2143 mbedtls_time_t t;
2144 #endif
2145 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2146 size_t olen, ext_len = 0, n;
2147 unsigned char *buf, *p;
2148
2149 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello"));
2150
2151 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2152 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
2153 ssl->handshake->cookie_verify_result != 0) {
2154 MBEDTLS_SSL_DEBUG_MSG(2, ("client hello was not authenticated"));
2155 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2156
2157 return ssl_write_hello_verify_request(ssl);
2158 }
2159 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
2160
2161 /*
2162 * 0 . 0 handshake type
2163 * 1 . 3 handshake length
2164 * 4 . 5 protocol version
2165 * 6 . 9 UNIX time()
2166 * 10 . 37 random bytes
2167 */
2168 buf = ssl->out_msg;
2169 p = buf + 4;
2170
2171 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version);
2172 p += 2;
2173
2174 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen version: [%d:%d]",
2175 buf[4], buf[5]));
2176
2177 #if defined(MBEDTLS_HAVE_TIME)
2178 t = mbedtls_time(NULL);
2179 MBEDTLS_PUT_UINT32_BE(t, p, 0);
2180 p += 4;
2181
2182 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
2183 (long long) t));
2184 #else
2185 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 4)) != 0) {
2186 return ret;
2187 }
2188
2189 p += 4;
2190 #endif /* MBEDTLS_HAVE_TIME */
2191
2192 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 20)) != 0) {
2193 return ret;
2194 }
2195 p += 20;
2196
2197 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
2198 /*
2199 * RFC 8446
2200 * TLS 1.3 has a downgrade protection mechanism embedded in the server's
2201 * random value. TLS 1.3 servers which negotiate TLS 1.2 or below in
2202 * response to a ClientHello MUST set the last 8 bytes of their Random
2203 * value specially in their ServerHello.
2204 */
2205 if (mbedtls_ssl_conf_is_tls13_enabled(ssl->conf)) {
2206 static const unsigned char magic_tls12_downgrade_string[] =
2207 { 'D', 'O', 'W', 'N', 'G', 'R', 'D', 1 };
2208
2209 MBEDTLS_STATIC_ASSERT(
2210 sizeof(magic_tls12_downgrade_string) == 8,
2211 "magic_tls12_downgrade_string does not have the expected size");
2212
2213 memcpy(p, magic_tls12_downgrade_string,
2214 sizeof(magic_tls12_downgrade_string));
2215 } else
2216 #endif
2217 {
2218 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 8)) != 0) {
2219 return ret;
2220 }
2221 }
2222 p += 8;
2223
2224 memcpy(ssl->handshake->randbytes + 32, buf + 6, 32);
2225
2226 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", buf + 6, 32);
2227
2228 ssl_handle_id_based_session_resumption(ssl);
2229
2230 if (ssl->handshake->resume == 0) {
2231 /*
2232 * New session, create a new session id,
2233 * unless we're about to issue a session ticket
2234 */
2235 mbedtls_ssl_handshake_increment_state(ssl);
2236
2237 #if defined(MBEDTLS_HAVE_TIME)
2238 ssl->session_negotiate->start = mbedtls_time(NULL);
2239 #endif
2240
2241 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2242 if (ssl->handshake->new_session_ticket != 0) {
2243 ssl->session_negotiate->id_len = n = 0;
2244 memset(ssl->session_negotiate->id, 0, 32);
2245 } else
2246 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
2247 {
2248 ssl->session_negotiate->id_len = n = 32;
2249 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, ssl->session_negotiate->id,
2250 n)) != 0) {
2251 return ret;
2252 }
2253 }
2254 } else {
2255 /*
2256 * Resuming a session
2257 */
2258 n = ssl->session_negotiate->id_len;
2259 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC);
2260
2261 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) {
2262 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret);
2263 return ret;
2264 }
2265 }
2266
2267 /*
2268 * 38 . 38 session id length
2269 * 39 . 38+n session id
2270 * 39+n . 40+n chosen ciphersuite
2271 * 41+n . 41+n chosen compression alg.
2272 * 42+n . 43+n extensions length
2273 * 44+n . 43+n+m extensions
2274 */
2275 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2276 memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len);
2277 p += ssl->session_negotiate->id_len;
2278
2279 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n));
2280 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, session id", buf + 39, n);
2281 MBEDTLS_SSL_DEBUG_MSG(3, ("%s session has been resumed",
2282 ssl->handshake->resume ? "a" : "no"));
2283
2284 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0);
2285 p += 2;
2286 *p++ = MBEDTLS_BYTE_0(MBEDTLS_SSL_COMPRESS_NULL);
2287
2288 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen ciphersuite: %s",
2289 mbedtls_ssl_get_ciphersuite_name(ssl->session_negotiate->ciphersuite)));
2290 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, compress alg.: 0x%02X",
2291 (unsigned int) MBEDTLS_SSL_COMPRESS_NULL));
2292
2293 /*
2294 * First write extensions, then the total length
2295 */
2296 ssl_write_renegotiation_ext(ssl, p + 2 + ext_len, &olen);
2297 ext_len += olen;
2298
2299 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2300 ssl_write_max_fragment_length_ext(ssl, p + 2 + ext_len, &olen);
2301 ext_len += olen;
2302 #endif
2303
2304 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
2305 ssl_write_cid_ext(ssl, p + 2 + ext_len, &olen);
2306 ext_len += olen;
2307 #endif
2308
2309 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
2310 ssl_write_encrypt_then_mac_ext(ssl, p + 2 + ext_len, &olen);
2311 ext_len += olen;
2312 #endif
2313
2314 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2315 ssl_write_extended_ms_ext(ssl, p + 2 + ext_len, &olen);
2316 ext_len += olen;
2317 #endif
2318
2319 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2320 ssl_write_session_ticket_ext(ssl, p + 2 + ext_len, &olen);
2321 ext_len += olen;
2322 #endif
2323
2324 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \
2325 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \
2326 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2327 const mbedtls_ssl_ciphersuite_t *suite =
2328 mbedtls_ssl_ciphersuite_from_id(ssl->session_negotiate->ciphersuite);
2329 if (suite != NULL && mbedtls_ssl_ciphersuite_uses_ec(suite)) {
2330 ssl_write_supported_point_formats_ext(ssl, p + 2 + ext_len, &olen);
2331 ext_len += olen;
2332 }
2333 #endif
2334
2335 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2336 ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen);
2337 ext_len += olen;
2338 #endif
2339
2340 #if defined(MBEDTLS_SSL_ALPN)
2341 unsigned char *end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN - 4;
2342 if ((ret = mbedtls_ssl_write_alpn_ext(ssl, p + 2 + ext_len, end, &olen))
2343 != 0) {
2344 return ret;
2345 }
2346
2347 ext_len += olen;
2348 #endif
2349
2350 #if defined(MBEDTLS_SSL_DTLS_SRTP)
2351 ssl_write_use_srtp_ext(ssl, p + 2 + ext_len, &olen);
2352 ext_len += olen;
2353 #endif
2354
2355 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, total extension length: %" MBEDTLS_PRINTF_SIZET,
2356 ext_len));
2357
2358 if (ext_len > 0) {
2359 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0);
2360 p += 2 + ext_len;
2361 }
2362
2363 ssl->out_msglen = (size_t) (p - buf);
2364 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2365 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
2366
2367 ret = mbedtls_ssl_write_handshake_msg(ssl);
2368
2369 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello"));
2370
2371 return ret;
2372 }
2373
2374 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
2375 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_certificate_request(mbedtls_ssl_context * ssl)2376 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl)
2377 {
2378 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2379 ssl->handshake->ciphersuite_info;
2380
2381 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
2382
2383 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) {
2384 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
2385 mbedtls_ssl_handshake_increment_state(ssl);
2386 return 0;
2387 }
2388
2389 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
2390 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
2391 }
2392 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
2393 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_certificate_request(mbedtls_ssl_context * ssl)2394 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl)
2395 {
2396 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2397 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2398 ssl->handshake->ciphersuite_info;
2399 uint16_t dn_size, total_dn_size; /* excluding length bytes */
2400 size_t ct_len, sa_len; /* including length bytes */
2401 unsigned char *buf, *p;
2402 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
2403 const mbedtls_x509_crt *crt;
2404 int authmode;
2405
2406 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request"));
2407
2408 mbedtls_ssl_handshake_increment_state(ssl);
2409
2410 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2411 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) {
2412 authmode = ssl->handshake->sni_authmode;
2413 } else
2414 #endif
2415 authmode = ssl->conf->authmode;
2416
2417 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info) ||
2418 authmode == MBEDTLS_SSL_VERIFY_NONE) {
2419 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request"));
2420 return 0;
2421 }
2422
2423 /*
2424 * 0 . 0 handshake type
2425 * 1 . 3 handshake length
2426 * 4 . 4 cert type count
2427 * 5 .. m-1 cert types
2428 * m .. m+1 sig alg length (TLS 1.2 only)
2429 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
2430 * n .. n+1 length of all DNs
2431 * n+2 .. n+3 length of DN 1
2432 * n+4 .. ... Distinguished Name #1
2433 * ... .. ... length of DN 2, etc.
2434 */
2435 buf = ssl->out_msg;
2436 p = buf + 4;
2437
2438 /*
2439 * Supported certificate types
2440 *
2441 * ClientCertificateType certificate_types<1..2^8-1>;
2442 * enum { (255) } ClientCertificateType;
2443 */
2444 ct_len = 0;
2445
2446 #if defined(MBEDTLS_RSA_C)
2447 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
2448 #endif
2449 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED)
2450 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
2451 #endif
2452
2453 p[0] = (unsigned char) ct_len++;
2454 p += ct_len;
2455
2456 sa_len = 0;
2457
2458 /*
2459 * Add signature_algorithms for verify (TLS 1.2)
2460 *
2461 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2462 *
2463 * struct {
2464 * HashAlgorithm hash;
2465 * SignatureAlgorithm signature;
2466 * } SignatureAndHashAlgorithm;
2467 *
2468 * enum { (255) } HashAlgorithm;
2469 * enum { (255) } SignatureAlgorithm;
2470 */
2471 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl);
2472 if (sig_alg == NULL) {
2473 return MBEDTLS_ERR_SSL_BAD_CONFIG;
2474 }
2475
2476 for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) {
2477 unsigned char hash = MBEDTLS_BYTE_1(*sig_alg);
2478
2479 if (mbedtls_ssl_set_calc_verify_md(ssl, hash)) {
2480 continue;
2481 }
2482 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) {
2483 continue;
2484 }
2485
2486 /* Write elements at offsets starting from 1 (offset 0 is for the
2487 * length). Thus the offset of each element is the length of the
2488 * partial list including that element. */
2489 sa_len += 2;
2490 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, sa_len);
2491
2492 }
2493
2494 /* Fill in list length. */
2495 MBEDTLS_PUT_UINT16_BE(sa_len, p, 0);
2496 sa_len += 2;
2497 p += sa_len;
2498
2499 /*
2500 * DistinguishedName certificate_authorities<0..2^16-1>;
2501 * opaque DistinguishedName<1..2^16-1>;
2502 */
2503 p += 2;
2504
2505 total_dn_size = 0;
2506
2507 if (ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED) {
2508 /* NOTE: If trusted certificates are provisioned
2509 * via a CA callback (configured through
2510 * `mbedtls_ssl_conf_ca_cb()`, then the
2511 * CertificateRequest is currently left empty. */
2512
2513 #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
2514 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2515 if (ssl->handshake->dn_hints != NULL) {
2516 crt = ssl->handshake->dn_hints;
2517 } else
2518 #endif
2519 if (ssl->conf->dn_hints != NULL) {
2520 crt = ssl->conf->dn_hints;
2521 } else
2522 #endif
2523 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2524 if (ssl->handshake->sni_ca_chain != NULL) {
2525 crt = ssl->handshake->sni_ca_chain;
2526 } else
2527 #endif
2528 crt = ssl->conf->ca_chain;
2529
2530 while (crt != NULL && crt->version != 0) {
2531 /* It follows from RFC 5280 A.1 that this length
2532 * can be represented in at most 11 bits. */
2533 dn_size = (uint16_t) crt->subject_raw.len;
2534
2535 if (end < p || (size_t) (end - p) < 2 + (size_t) dn_size) {
2536 MBEDTLS_SSL_DEBUG_MSG(1, ("skipping CAs: buffer too short"));
2537 break;
2538 }
2539
2540 MBEDTLS_PUT_UINT16_BE(dn_size, p, 0);
2541 p += 2;
2542 memcpy(p, crt->subject_raw.p, dn_size);
2543 p += dn_size;
2544
2545 MBEDTLS_SSL_DEBUG_BUF(3, "requested DN", p - dn_size, dn_size);
2546
2547 total_dn_size += (unsigned short) (2 + dn_size);
2548 crt = crt->next;
2549 }
2550 }
2551
2552 ssl->out_msglen = (size_t) (p - buf);
2553 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2554 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
2555 MBEDTLS_PUT_UINT16_BE(total_dn_size, ssl->out_msg, 4 + ct_len + sa_len);
2556
2557 ret = mbedtls_ssl_write_handshake_msg(ssl);
2558
2559 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request"));
2560
2561 return ret;
2562 }
2563 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
2564
2565 #if (defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2566 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED))
2567 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2568 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_get_ecdh_params_from_cert(mbedtls_ssl_context * ssl)2569 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
2570 {
2571 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2572 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2573 mbedtls_pk_context *pk;
2574 mbedtls_pk_type_t pk_type;
2575 psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
2576 unsigned char buf[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
2577 size_t key_len;
2578 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2579 uint16_t tls_id = 0;
2580 psa_key_type_t key_type = PSA_KEY_TYPE_NONE;
2581 mbedtls_ecp_group_id grp_id;
2582 mbedtls_ecp_keypair *key;
2583 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
2584
2585 pk = mbedtls_ssl_own_key(ssl);
2586
2587 if (pk == NULL) {
2588 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
2589 }
2590
2591 pk_type = mbedtls_pk_get_type(pk);
2592
2593 switch (pk_type) {
2594 case MBEDTLS_PK_OPAQUE:
2595 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2596 case MBEDTLS_PK_ECKEY:
2597 case MBEDTLS_PK_ECKEY_DH:
2598 case MBEDTLS_PK_ECDSA:
2599 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
2600 if (!mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) {
2601 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
2602 }
2603
2604 /* Get the attributes of the key previously parsed by PK module in
2605 * order to extract its type and length (in bits). */
2606 status = psa_get_key_attributes(pk->priv_id, &key_attributes);
2607 if (status != PSA_SUCCESS) {
2608 ret = PSA_TO_MBEDTLS_ERR(status);
2609 goto exit;
2610 }
2611 ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes);
2612 ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes);
2613
2614 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2615 if (pk_type != MBEDTLS_PK_OPAQUE) {
2616 /* PK_ECKEY[_DH] and PK_ECDSA instead as parsed from the PK
2617 * module and only have ECDSA capabilities. Since we need
2618 * them for ECDH later, we export and then re-import them with
2619 * proper flags and algorithm. Of course We also set key's type
2620 * and bits that we just got above. */
2621 key_attributes = psa_key_attributes_init();
2622 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
2623 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
2624 psa_set_key_type(&key_attributes,
2625 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type));
2626 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits);
2627
2628 status = psa_export_key(pk->priv_id, buf, sizeof(buf), &key_len);
2629 if (status != PSA_SUCCESS) {
2630 ret = PSA_TO_MBEDTLS_ERR(status);
2631 goto exit;
2632 }
2633 status = psa_import_key(&key_attributes, buf, key_len,
2634 &ssl->handshake->xxdh_psa_privkey);
2635 if (status != PSA_SUCCESS) {
2636 ret = PSA_TO_MBEDTLS_ERR(status);
2637 goto exit;
2638 }
2639
2640 /* Set this key as owned by the TLS library: it will be its duty
2641 * to clear it exit. */
2642 ssl->handshake->xxdh_psa_privkey_is_external = 0;
2643
2644 ret = 0;
2645 break;
2646 }
2647 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
2648
2649 /* Opaque key is created by the user (externally from Mbed TLS)
2650 * so we assume it already has the right algorithm and flags
2651 * set. Just copy its ID as reference. */
2652 ssl->handshake->xxdh_psa_privkey = pk->priv_id;
2653 ssl->handshake->xxdh_psa_privkey_is_external = 1;
2654 ret = 0;
2655 break;
2656
2657 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA)
2658 case MBEDTLS_PK_ECKEY:
2659 case MBEDTLS_PK_ECKEY_DH:
2660 case MBEDTLS_PK_ECDSA:
2661 key = mbedtls_pk_ec_rw(*pk);
2662 grp_id = mbedtls_pk_get_ec_group_id(pk);
2663 if (grp_id == MBEDTLS_ECP_DP_NONE) {
2664 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
2665 }
2666 tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
2667 if (tls_id == 0) {
2668 /* This elliptic curve is not supported */
2669 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2670 }
2671
2672 /* If the above conversion to TLS ID was fine, then also this one will
2673 be, so there is no need to check the return value here */
2674 mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id, &key_type,
2675 &ssl->handshake->xxdh_psa_bits);
2676
2677 ssl->handshake->xxdh_psa_type = key_type;
2678
2679 key_attributes = psa_key_attributes_init();
2680 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
2681 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
2682 psa_set_key_type(&key_attributes,
2683 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type));
2684 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits);
2685
2686 ret = mbedtls_ecp_write_key_ext(key, &key_len, buf, sizeof(buf));
2687 if (ret != 0) {
2688 mbedtls_platform_zeroize(buf, sizeof(buf));
2689 break;
2690 }
2691
2692 status = psa_import_key(&key_attributes, buf, key_len,
2693 &ssl->handshake->xxdh_psa_privkey);
2694 if (status != PSA_SUCCESS) {
2695 ret = PSA_TO_MBEDTLS_ERR(status);
2696 mbedtls_platform_zeroize(buf, sizeof(buf));
2697 break;
2698 }
2699
2700 mbedtls_platform_zeroize(buf, sizeof(buf));
2701 ret = 0;
2702 break;
2703 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */
2704 default:
2705 ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
2706 }
2707
2708 exit:
2709 psa_reset_key_attributes(&key_attributes);
2710 mbedtls_platform_zeroize(buf, sizeof(buf));
2711
2712 return ret;
2713 }
2714 #else /* MBEDTLS_USE_PSA_CRYPTO */
2715 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_get_ecdh_params_from_cert(mbedtls_ssl_context * ssl)2716 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
2717 {
2718 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2719
2720 const mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl);
2721 if (private_key == NULL) {
2722 MBEDTLS_SSL_DEBUG_MSG(1, ("got no server private key"));
2723 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
2724 }
2725
2726 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_ECKEY)) {
2727 MBEDTLS_SSL_DEBUG_MSG(1, ("server key not ECDH capable"));
2728 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
2729 }
2730
2731 if ((ret = mbedtls_ecdh_get_params(&ssl->handshake->ecdh_ctx,
2732 mbedtls_pk_ec_ro(*mbedtls_ssl_own_key(ssl)),
2733 MBEDTLS_ECDH_OURS)) != 0) {
2734 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecdh_get_params"), ret);
2735 return ret;
2736 }
2737
2738 return 0;
2739 }
2740 #endif /* MBEDTLS_USE_PSA_CRYPTO */
2741 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2742 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2743
2744 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \
2745 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
2746 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_resume_server_key_exchange(mbedtls_ssl_context * ssl,size_t * signature_len)2747 static int ssl_resume_server_key_exchange(mbedtls_ssl_context *ssl,
2748 size_t *signature_len)
2749 {
2750 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
2751 * signature length which will be added in ssl_write_server_key_exchange
2752 * after the call to ssl_prepare_server_key_exchange.
2753 * ssl_write_server_key_exchange also takes care of incrementing
2754 * ssl->out_msglen. */
2755 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2;
2756 size_t sig_max_len = (ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN
2757 - sig_start);
2758 int ret = ssl->conf->f_async_resume(ssl,
2759 sig_start, signature_len, sig_max_len);
2760 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
2761 ssl->handshake->async_in_progress = 0;
2762 mbedtls_ssl_set_async_operation_data(ssl, NULL);
2763 }
2764 MBEDTLS_SSL_DEBUG_RET(2, "ssl_resume_server_key_exchange", ret);
2765 return ret;
2766 }
2767 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
2768 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
2769
2770 /* Prepare the ServerKeyExchange message, up to and including
2771 * calculating the signature if any, but excluding formatting the
2772 * signature and sending the message. */
2773 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_prepare_server_key_exchange(mbedtls_ssl_context * ssl,size_t * signature_len)2774 static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl,
2775 size_t *signature_len)
2776 {
2777 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2778 ssl->handshake->ciphersuite_info;
2779
2780 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED)
2781 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2782 unsigned char *dig_signed = NULL;
2783 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
2784 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */
2785
2786 (void) ciphersuite_info; /* unused in some configurations */
2787 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2788 (void) signature_len;
2789 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
2790
2791 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2792 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
2793 size_t out_buf_len = ssl->out_buf_len - (size_t) (ssl->out_msg - ssl->out_buf);
2794 #else
2795 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN - (size_t) (ssl->out_msg - ssl->out_buf);
2796 #endif
2797 #endif
2798
2799 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */
2800
2801 /*
2802 *
2803 * Part 1: Provide key exchange parameters for chosen ciphersuite.
2804 *
2805 */
2806
2807 /*
2808 * - ECJPAKE key exchanges
2809 */
2810 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2811 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
2812 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2813 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2814 unsigned char *out_p = ssl->out_msg + ssl->out_msglen;
2815 unsigned char *end_p = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN -
2816 ssl->out_msglen;
2817 size_t output_offset = 0;
2818 size_t output_len = 0;
2819
2820 /*
2821 * The first 3 bytes are:
2822 * [0] MBEDTLS_ECP_TLS_NAMED_CURVE
2823 * [1, 2] elliptic curve's TLS ID
2824 *
2825 * However since we only support secp256r1 for now, we hardcode its
2826 * TLS ID here
2827 */
2828 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
2829 MBEDTLS_ECP_DP_SECP256R1);
2830 if (tls_id == 0) {
2831 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2832 }
2833 *out_p = MBEDTLS_ECP_TLS_NAMED_CURVE;
2834 MBEDTLS_PUT_UINT16_BE(tls_id, out_p, 1);
2835 output_offset += 3;
2836
2837 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx,
2838 out_p + output_offset,
2839 end_p - out_p - output_offset, &output_len,
2840 MBEDTLS_ECJPAKE_ROUND_TWO);
2841 if (ret != 0) {
2842 psa_destroy_key(ssl->handshake->psa_pake_password);
2843 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
2844 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret);
2845 return ret;
2846 }
2847
2848 output_offset += output_len;
2849 ssl->out_msglen += output_offset;
2850 #else
2851 size_t len = 0;
2852
2853 ret = mbedtls_ecjpake_write_round_two(
2854 &ssl->handshake->ecjpake_ctx,
2855 ssl->out_msg + ssl->out_msglen,
2856 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len,
2857 ssl->conf->f_rng, ssl->conf->p_rng);
2858 if (ret != 0) {
2859 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_two", ret);
2860 return ret;
2861 }
2862
2863 ssl->out_msglen += len;
2864 #endif /* MBEDTLS_USE_PSA_CRYPTO */
2865 }
2866 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2867
2868 /*
2869 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
2870 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
2871 * we use empty support identity hints here.
2872 **/
2873 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2874 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2875 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2876 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
2877 ssl->out_msg[ssl->out_msglen++] = 0x00;
2878 ssl->out_msg[ssl->out_msglen++] = 0x00;
2879 }
2880 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2881 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2882
2883 /*
2884 * - DHE key exchanges
2885 */
2886 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED)
2887 if (mbedtls_ssl_ciphersuite_uses_dhe(ciphersuite_info)) {
2888 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2889 size_t len = 0;
2890
2891 if (ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL) {
2892 MBEDTLS_SSL_DEBUG_MSG(1, ("no DH parameters set"));
2893 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
2894 }
2895
2896 /*
2897 * Ephemeral DH parameters:
2898 *
2899 * struct {
2900 * opaque dh_p<1..2^16-1>;
2901 * opaque dh_g<1..2^16-1>;
2902 * opaque dh_Ys<1..2^16-1>;
2903 * } ServerDHParams;
2904 */
2905 if ((ret = mbedtls_dhm_set_group(&ssl->handshake->dhm_ctx,
2906 &ssl->conf->dhm_P,
2907 &ssl->conf->dhm_G)) != 0) {
2908 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_set_group", ret);
2909 return ret;
2910 }
2911
2912 if ((ret = mbedtls_dhm_make_params(
2913 &ssl->handshake->dhm_ctx,
2914 (int) mbedtls_dhm_get_len(&ssl->handshake->dhm_ctx),
2915 ssl->out_msg + ssl->out_msglen, &len,
2916 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
2917 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_make_params", ret);
2918 return ret;
2919 }
2920
2921 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
2922 dig_signed = ssl->out_msg + ssl->out_msglen;
2923 #endif
2924
2925 ssl->out_msglen += len;
2926
2927 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: X ", &ssl->handshake->dhm_ctx.X);
2928 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: P ", &ssl->handshake->dhm_ctx.P);
2929 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: G ", &ssl->handshake->dhm_ctx.G);
2930 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GX", &ssl->handshake->dhm_ctx.GX);
2931 }
2932 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */
2933
2934 /*
2935 * - ECDHE key exchanges
2936 */
2937 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED)
2938 if (mbedtls_ssl_ciphersuite_uses_ecdhe(ciphersuite_info)) {
2939 /*
2940 * Ephemeral ECDH parameters:
2941 *
2942 * struct {
2943 * ECParameters curve_params;
2944 * ECPoint public;
2945 * } ServerECDHParams;
2946 */
2947 uint16_t *curr_tls_id = ssl->handshake->curves_tls_id;
2948 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl);
2949 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2950 size_t len = 0;
2951
2952 /* Match our preference list against the offered curves */
2953 if ((group_list == NULL) || (curr_tls_id == NULL)) {
2954 return MBEDTLS_ERR_SSL_BAD_CONFIG;
2955 }
2956 for (; *group_list != 0; group_list++) {
2957 for (curr_tls_id = ssl->handshake->curves_tls_id;
2958 *curr_tls_id != 0; curr_tls_id++) {
2959 if (*curr_tls_id == *group_list) {
2960 goto curve_matching_done;
2961 }
2962 }
2963 }
2964
2965 curve_matching_done:
2966 if (*curr_tls_id == 0) {
2967 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching curve for ECDHE"));
2968 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
2969 }
2970
2971 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDHE curve: %s",
2972 mbedtls_ssl_get_curve_name_from_tls_id(*curr_tls_id)));
2973
2974 #if defined(MBEDTLS_USE_PSA_CRYPTO)
2975 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
2976 psa_key_attributes_t key_attributes;
2977 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2978 uint8_t *p = ssl->out_msg + ssl->out_msglen;
2979 const size_t header_size = 4; // curve_type(1), namedcurve(2),
2980 // data length(1)
2981 const size_t data_length_size = 1;
2982 psa_key_type_t key_type = PSA_KEY_TYPE_NONE;
2983 size_t ec_bits = 0;
2984
2985 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH computation."));
2986
2987 /* Convert EC's TLS ID to PSA key type. */
2988 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(*curr_tls_id,
2989 &key_type,
2990 &ec_bits) == PSA_ERROR_NOT_SUPPORTED) {
2991 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid ecc group parse."));
2992 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
2993 }
2994 handshake->xxdh_psa_type = key_type;
2995 handshake->xxdh_psa_bits = ec_bits;
2996
2997 key_attributes = psa_key_attributes_init();
2998 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
2999 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
3000 psa_set_key_type(&key_attributes, handshake->xxdh_psa_type);
3001 psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
3002
3003 /*
3004 * ECParameters curve_params
3005 *
3006 * First byte is curve_type, always named_curve
3007 */
3008 *p++ = MBEDTLS_ECP_TLS_NAMED_CURVE;
3009
3010 /*
3011 * Next two bytes are the namedcurve value
3012 */
3013 MBEDTLS_PUT_UINT16_BE(*curr_tls_id, p, 0);
3014 p += 2;
3015
3016 /* Generate ECDH private key. */
3017 status = psa_generate_key(&key_attributes,
3018 &handshake->xxdh_psa_privkey);
3019 if (status != PSA_SUCCESS) {
3020 ret = PSA_TO_MBEDTLS_ERR(status);
3021 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret);
3022 return ret;
3023 }
3024
3025 /*
3026 * ECPoint public
3027 *
3028 * First byte is data length.
3029 * It will be filled later. p holds now the data length location.
3030 */
3031
3032 /* Export the public part of the ECDH private key from PSA.
3033 * Make one byte space for the length.
3034 */
3035 unsigned char *own_pubkey = p + data_length_size;
3036
3037 size_t own_pubkey_max_len = (size_t) (MBEDTLS_SSL_OUT_CONTENT_LEN
3038 - (own_pubkey - ssl->out_msg));
3039
3040 status = psa_export_public_key(handshake->xxdh_psa_privkey,
3041 own_pubkey, own_pubkey_max_len,
3042 &len);
3043 if (status != PSA_SUCCESS) {
3044 ret = PSA_TO_MBEDTLS_ERR(status);
3045 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret);
3046 (void) psa_destroy_key(handshake->xxdh_psa_privkey);
3047 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3048 return ret;
3049 }
3050
3051 /* Store the length of the exported public key. */
3052 *p = (uint8_t) len;
3053
3054 /* Determine full message length. */
3055 len += header_size;
3056 #else
3057 mbedtls_ecp_group_id curr_grp_id =
3058 mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id);
3059
3060 if ((ret = mbedtls_ecdh_setup(&ssl->handshake->ecdh_ctx,
3061 curr_grp_id)) != 0) {
3062 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecp_group_load", ret);
3063 return ret;
3064 }
3065
3066 if ((ret = mbedtls_ecdh_make_params(
3067 &ssl->handshake->ecdh_ctx, &len,
3068 ssl->out_msg + ssl->out_msglen,
3069 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen,
3070 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3071 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_make_params", ret);
3072 return ret;
3073 }
3074
3075 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3076 MBEDTLS_DEBUG_ECDH_Q);
3077 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3078
3079 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3080 dig_signed = ssl->out_msg + ssl->out_msglen;
3081 #endif
3082
3083 ssl->out_msglen += len;
3084 }
3085 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */
3086
3087 /*
3088 *
3089 * Part 2: For key exchanges involving the server signing the
3090 * exchange parameters, compute and add the signature here.
3091 *
3092 */
3093 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3094 if (mbedtls_ssl_ciphersuite_uses_server_signature(ciphersuite_info)) {
3095 if (dig_signed == NULL) {
3096 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3097 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3098 }
3099
3100 size_t dig_signed_len = (size_t) (ssl->out_msg + ssl->out_msglen - dig_signed);
3101 size_t hashlen = 0;
3102 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
3103
3104 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3105
3106 /*
3107 * 2.1: Choose hash algorithm:
3108 * For TLS 1.2, obey signature-hash-algorithm extension
3109 * to choose appropriate hash.
3110 */
3111
3112 mbedtls_pk_type_t sig_alg =
3113 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info);
3114
3115 unsigned char sig_hash =
3116 (unsigned char) mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
3117 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg));
3118
3119 mbedtls_md_type_t md_alg = mbedtls_ssl_md_alg_from_hash(sig_hash);
3120
3121 /* For TLS 1.2, obey signature-hash-algorithm extension
3122 * (RFC 5246, Sec. 7.4.1.4.1). */
3123 if (sig_alg == MBEDTLS_PK_NONE || md_alg == MBEDTLS_MD_NONE) {
3124 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3125 /* (... because we choose a cipher suite
3126 * only if there is a matching hash.) */
3127 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3128 }
3129
3130 MBEDTLS_SSL_DEBUG_MSG(3, ("pick hash algorithm %u for signing", (unsigned) md_alg));
3131
3132 /*
3133 * 2.2: Compute the hash to be signed
3134 */
3135 if (md_alg != MBEDTLS_MD_NONE) {
3136 ret = mbedtls_ssl_get_key_exchange_md_tls1_2(ssl, hash, &hashlen,
3137 dig_signed,
3138 dig_signed_len,
3139 md_alg);
3140 if (ret != 0) {
3141 return ret;
3142 }
3143 } else {
3144 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3145 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3146 }
3147
3148 MBEDTLS_SSL_DEBUG_BUF(3, "parameters hash", hash, hashlen);
3149
3150 /*
3151 * 2.3: Compute and add the signature
3152 */
3153 /*
3154 * We need to specify signature and hash algorithm explicitly through
3155 * a prefix to the signature.
3156 *
3157 * struct {
3158 * HashAlgorithm hash;
3159 * SignatureAlgorithm signature;
3160 * } SignatureAndHashAlgorithm;
3161 *
3162 * struct {
3163 * SignatureAndHashAlgorithm algorithm;
3164 * opaque signature<0..2^16-1>;
3165 * } DigitallySigned;
3166 *
3167 */
3168
3169 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_hash_from_md_alg(md_alg);
3170 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_sig_from_pk_alg(sig_alg);
3171
3172 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3173 if (ssl->conf->f_async_sign_start != NULL) {
3174 ret = ssl->conf->f_async_sign_start(ssl,
3175 mbedtls_ssl_own_cert(ssl),
3176 md_alg, hash, hashlen);
3177 switch (ret) {
3178 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3179 /* act as if f_async_sign was null */
3180 break;
3181 case 0:
3182 ssl->handshake->async_in_progress = 1;
3183 return ssl_resume_server_key_exchange(ssl, signature_len);
3184 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
3185 ssl->handshake->async_in_progress = 1;
3186 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS;
3187 default:
3188 MBEDTLS_SSL_DEBUG_RET(1, "f_async_sign_start", ret);
3189 return ret;
3190 }
3191 }
3192 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3193
3194 if (mbedtls_ssl_own_key(ssl) == NULL) {
3195 MBEDTLS_SSL_DEBUG_MSG(1, ("got no private key"));
3196 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
3197 }
3198
3199 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3200 * signature length which will be added in ssl_write_server_key_exchange
3201 * after the call to ssl_prepare_server_key_exchange.
3202 * ssl_write_server_key_exchange also takes care of incrementing
3203 * ssl->out_msglen. */
3204 if ((ret = mbedtls_pk_sign(mbedtls_ssl_own_key(ssl),
3205 md_alg, hash, hashlen,
3206 ssl->out_msg + ssl->out_msglen + 2,
3207 out_buf_len - ssl->out_msglen - 2,
3208 signature_len,
3209 ssl->conf->f_rng,
3210 ssl->conf->p_rng)) != 0) {
3211 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_sign", ret);
3212 return ret;
3213 }
3214 }
3215 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
3216
3217 return 0;
3218 }
3219
3220 /* Prepare the ServerKeyExchange message and send it. For ciphersuites
3221 * that do not include a ServerKeyExchange message, do nothing. Either
3222 * way, if successful, move on to the next step in the SSL state
3223 * machine. */
3224 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_server_key_exchange(mbedtls_ssl_context * ssl)3225 static int ssl_write_server_key_exchange(mbedtls_ssl_context *ssl)
3226 {
3227 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3228 size_t signature_len = 0;
3229 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
3230 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3231 ssl->handshake->ciphersuite_info;
3232 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
3233
3234 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server key exchange"));
3235
3236 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED)
3237 /* Extract static ECDH parameters and abort if ServerKeyExchange
3238 * is not needed. */
3239 if (mbedtls_ssl_ciphersuite_no_pfs(ciphersuite_info)) {
3240 /* For suites involving ECDH, extract DH parameters
3241 * from certificate at this point. */
3242 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED)
3243 if (mbedtls_ssl_ciphersuite_uses_ecdh(ciphersuite_info)) {
3244 ret = ssl_get_ecdh_params_from_cert(ssl);
3245 if (ret != 0) {
3246 MBEDTLS_SSL_DEBUG_RET(1, "ssl_get_ecdh_params_from_cert", ret);
3247 return ret;
3248 }
3249 }
3250 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */
3251
3252 /* Key exchanges not involving ephemeral keys don't use
3253 * ServerKeyExchange, so end here. */
3254 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write server key exchange"));
3255 mbedtls_ssl_handshake_increment_state(ssl);
3256 return 0;
3257 }
3258 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */
3259
3260 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \
3261 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3262 /* If we have already prepared the message and there is an ongoing
3263 * signature operation, resume signing. */
3264 if (ssl->handshake->async_in_progress != 0) {
3265 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming signature operation"));
3266 ret = ssl_resume_server_key_exchange(ssl, &signature_len);
3267 } else
3268 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) &&
3269 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
3270 {
3271 /* ServerKeyExchange is needed. Prepare the message. */
3272 ret = ssl_prepare_server_key_exchange(ssl, &signature_len);
3273 }
3274
3275 if (ret != 0) {
3276 /* If we're starting to write a new message, set ssl->out_msglen
3277 * to 0. But if we're resuming after an asynchronous message,
3278 * out_msglen is the amount of data written so far and mst be
3279 * preserved. */
3280 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
3281 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange (pending)"));
3282 } else {
3283 ssl->out_msglen = 0;
3284 }
3285 return ret;
3286 }
3287
3288 /* If there is a signature, write its length.
3289 * ssl_prepare_server_key_exchange already wrote the signature
3290 * itself at its proper place in the output buffer. */
3291 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3292 if (signature_len != 0) {
3293 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_1(signature_len);
3294 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_0(signature_len);
3295
3296 MBEDTLS_SSL_DEBUG_BUF(3, "my signature",
3297 ssl->out_msg + ssl->out_msglen,
3298 signature_len);
3299
3300 /* Skip over the already-written signature */
3301 ssl->out_msglen += signature_len;
3302 }
3303 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
3304
3305 /* Add header and send. */
3306 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3307 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
3308
3309 mbedtls_ssl_handshake_increment_state(ssl);
3310
3311 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
3312 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
3313 return ret;
3314 }
3315
3316 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange"));
3317 return 0;
3318 }
3319
3320 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_server_hello_done(mbedtls_ssl_context * ssl)3321 static int ssl_write_server_hello_done(mbedtls_ssl_context *ssl)
3322 {
3323 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3324
3325 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello done"));
3326
3327 ssl->out_msglen = 4;
3328 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3329 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
3330
3331 mbedtls_ssl_handshake_increment_state(ssl);
3332
3333 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3334 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
3335 mbedtls_ssl_send_flight_completed(ssl);
3336 }
3337 #endif
3338
3339 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
3340 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
3341 return ret;
3342 }
3343
3344 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3345 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3346 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) {
3347 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret);
3348 return ret;
3349 }
3350 #endif /* MBEDTLS_SSL_PROTO_DTLS */
3351
3352 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello done"));
3353
3354 return 0;
3355 }
3356
3357 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3358 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3359 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_dh_public(mbedtls_ssl_context * ssl,unsigned char ** p,const unsigned char * end)3360 static int ssl_parse_client_dh_public(mbedtls_ssl_context *ssl, unsigned char **p,
3361 const unsigned char *end)
3362 {
3363 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3364 size_t n;
3365
3366 /*
3367 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3368 */
3369 if (*p + 2 > end) {
3370 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3371 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3372 }
3373
3374 n = MBEDTLS_GET_UINT16_BE(*p, 0);
3375 *p += 2;
3376
3377 if (*p + n > end) {
3378 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3379 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3380 }
3381
3382 if ((ret = mbedtls_dhm_read_public(&ssl->handshake->dhm_ctx, *p, n)) != 0) {
3383 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_read_public", ret);
3384 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3385 }
3386
3387 *p += n;
3388
3389 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GY", &ssl->handshake->dhm_ctx.GY);
3390
3391 return ret;
3392 }
3393 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3394 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3395
3396 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3397 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3398
3399 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3400 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_resume_decrypt_pms(mbedtls_ssl_context * ssl,unsigned char * peer_pms,size_t * peer_pmslen,size_t peer_pmssize)3401 static int ssl_resume_decrypt_pms(mbedtls_ssl_context *ssl,
3402 unsigned char *peer_pms,
3403 size_t *peer_pmslen,
3404 size_t peer_pmssize)
3405 {
3406 int ret = ssl->conf->f_async_resume(ssl,
3407 peer_pms, peer_pmslen, peer_pmssize);
3408 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
3409 ssl->handshake->async_in_progress = 0;
3410 mbedtls_ssl_set_async_operation_data(ssl, NULL);
3411 }
3412 MBEDTLS_SSL_DEBUG_RET(2, "ssl_decrypt_encrypted_pms", ret);
3413 return ret;
3414 }
3415 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3416
3417 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_decrypt_encrypted_pms(mbedtls_ssl_context * ssl,const unsigned char * p,const unsigned char * end,unsigned char * peer_pms,size_t * peer_pmslen,size_t peer_pmssize)3418 static int ssl_decrypt_encrypted_pms(mbedtls_ssl_context *ssl,
3419 const unsigned char *p,
3420 const unsigned char *end,
3421 unsigned char *peer_pms,
3422 size_t *peer_pmslen,
3423 size_t peer_pmssize)
3424 {
3425 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3426
3427 mbedtls_x509_crt *own_cert = mbedtls_ssl_own_cert(ssl);
3428 if (own_cert == NULL) {
3429 MBEDTLS_SSL_DEBUG_MSG(1, ("got no local certificate"));
3430 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE;
3431 }
3432 mbedtls_pk_context *public_key = &own_cert->pk;
3433 mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl);
3434 size_t len = mbedtls_pk_get_len(public_key);
3435
3436 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3437 /* If we have already started decoding the message and there is an ongoing
3438 * decryption operation, resume signing. */
3439 if (ssl->handshake->async_in_progress != 0) {
3440 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming decryption operation"));
3441 return ssl_resume_decrypt_pms(ssl,
3442 peer_pms, peer_pmslen, peer_pmssize);
3443 }
3444 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3445
3446 /*
3447 * Prepare to decrypt the premaster using own private RSA key
3448 */
3449 if (p + 2 > end) {
3450 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3451 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3452 }
3453 if (*p++ != MBEDTLS_BYTE_1(len) ||
3454 *p++ != MBEDTLS_BYTE_0(len)) {
3455 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3456 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3457 }
3458
3459 if (p + len != end) {
3460 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3461 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3462 }
3463
3464 /*
3465 * Decrypt the premaster secret
3466 */
3467 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3468 if (ssl->conf->f_async_decrypt_start != NULL) {
3469 ret = ssl->conf->f_async_decrypt_start(ssl,
3470 mbedtls_ssl_own_cert(ssl),
3471 p, len);
3472 switch (ret) {
3473 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3474 /* act as if f_async_decrypt_start was null */
3475 break;
3476 case 0:
3477 ssl->handshake->async_in_progress = 1;
3478 return ssl_resume_decrypt_pms(ssl,
3479 peer_pms,
3480 peer_pmslen,
3481 peer_pmssize);
3482 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
3483 ssl->handshake->async_in_progress = 1;
3484 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS;
3485 default:
3486 MBEDTLS_SSL_DEBUG_RET(1, "f_async_decrypt_start", ret);
3487 return ret;
3488 }
3489 }
3490 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3491
3492 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_RSA)) {
3493 MBEDTLS_SSL_DEBUG_MSG(1, ("got no RSA private key"));
3494 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
3495 }
3496
3497 ret = mbedtls_pk_decrypt(private_key, p, len,
3498 peer_pms, peer_pmslen, peer_pmssize,
3499 ssl->conf->f_rng, ssl->conf->p_rng);
3500 return ret;
3501 }
3502
3503 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_encrypted_pms(mbedtls_ssl_context * ssl,const unsigned char * p,const unsigned char * end,size_t pms_offset)3504 static int ssl_parse_encrypted_pms(mbedtls_ssl_context *ssl,
3505 const unsigned char *p,
3506 const unsigned char *end,
3507 size_t pms_offset)
3508 {
3509 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3510 unsigned char *pms = ssl->handshake->premaster + pms_offset;
3511 unsigned char ver[2];
3512 unsigned char fake_pms[48], peer_pms[48];
3513 size_t peer_pmslen;
3514 mbedtls_ct_condition_t diff;
3515
3516 /* In case of a failure in decryption, the decryption may write less than
3517 * 2 bytes of output, but we always read the first two bytes. It doesn't
3518 * matter in the end because diff will be nonzero in that case due to
3519 * ret being nonzero, and we only care whether diff is 0.
3520 * But do initialize peer_pms and peer_pmslen for robustness anyway. This
3521 * also makes memory analyzers happy (don't access uninitialized memory,
3522 * even if it's an unsigned char). */
3523 peer_pms[0] = peer_pms[1] = ~0;
3524 peer_pmslen = 0;
3525
3526 ret = ssl_decrypt_encrypted_pms(ssl, p, end,
3527 peer_pms,
3528 &peer_pmslen,
3529 sizeof(peer_pms));
3530
3531 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3532 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) {
3533 return ret;
3534 }
3535 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3536
3537 mbedtls_ssl_write_version(ver, ssl->conf->transport,
3538 ssl->session_negotiate->tls_version);
3539
3540 /* Avoid data-dependent branches while checking for invalid
3541 * padding, to protect against timing-based Bleichenbacher-type
3542 * attacks. */
3543 diff = mbedtls_ct_bool(ret);
3544 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pmslen, 48));
3545 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[0], ver[0]));
3546 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[1], ver[1]));
3547
3548 /*
3549 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3550 * must not cause the connection to end immediately; instead, send a
3551 * bad_record_mac later in the handshake.
3552 * To protect against timing-based variants of the attack, we must
3553 * not have any branch that depends on whether the decryption was
3554 * successful. In particular, always generate the fake premaster secret,
3555 * regardless of whether it will ultimately influence the output or not.
3556 */
3557 ret = ssl->conf->f_rng(ssl->conf->p_rng, fake_pms, sizeof(fake_pms));
3558 if (ret != 0) {
3559 /* It's ok to abort on an RNG failure, since this does not reveal
3560 * anything about the RSA decryption. */
3561 return ret;
3562 }
3563
3564 #if defined(MBEDTLS_SSL_DEBUG_ALL)
3565 if (diff != MBEDTLS_CT_FALSE) {
3566 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3567 }
3568 #endif
3569
3570 if (sizeof(ssl->handshake->premaster) < pms_offset ||
3571 sizeof(ssl->handshake->premaster) - pms_offset < 48) {
3572 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
3573 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
3574 }
3575 ssl->handshake->pmslen = 48;
3576
3577 /* Set pms to either the true or the fake PMS, without
3578 * data-dependent branches. */
3579 mbedtls_ct_memcpy_if(diff, pms, fake_pms, peer_pms, ssl->handshake->pmslen);
3580
3581 return 0;
3582 }
3583 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3584 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3585
3586 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
3587 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_psk_identity(mbedtls_ssl_context * ssl,unsigned char ** p,const unsigned char * end)3588 static int ssl_parse_client_psk_identity(mbedtls_ssl_context *ssl, unsigned char **p,
3589 const unsigned char *end)
3590 {
3591 int ret = 0;
3592 uint16_t n;
3593
3594 if (ssl_conf_has_psk_or_cb(ssl->conf) == 0) {
3595 MBEDTLS_SSL_DEBUG_MSG(1, ("got no pre-shared key"));
3596 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED;
3597 }
3598
3599 /*
3600 * Receive client pre-shared key identity name
3601 */
3602 if (end - *p < 2) {
3603 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3604 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3605 }
3606
3607 n = MBEDTLS_GET_UINT16_BE(*p, 0);
3608 *p += 2;
3609
3610 if (n == 0 || n > end - *p) {
3611 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3612 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3613 }
3614
3615 if (ssl->conf->f_psk != NULL) {
3616 if (ssl->conf->f_psk(ssl->conf->p_psk, ssl, *p, n) != 0) {
3617 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
3618 }
3619 } else {
3620 /* Identity is not a big secret since clients send it in the clear,
3621 * but treat it carefully anyway, just in case */
3622 if (n != ssl->conf->psk_identity_len ||
3623 mbedtls_ct_memcmp(ssl->conf->psk_identity, *p, n) != 0) {
3624 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
3625 }
3626 }
3627
3628 if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) {
3629 MBEDTLS_SSL_DEBUG_BUF(3, "Unknown PSK identity", *p, n);
3630 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3631 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY);
3632 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
3633 }
3634
3635 *p += n;
3636
3637 return 0;
3638 }
3639 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
3640
3641 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_client_key_exchange(mbedtls_ssl_context * ssl)3642 static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl)
3643 {
3644 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3645 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
3646 unsigned char *p, *end;
3647
3648 ciphersuite_info = ssl->handshake->ciphersuite_info;
3649
3650 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client key exchange"));
3651
3652 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \
3653 (defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3654 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED))
3655 if ((ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3656 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) &&
3657 (ssl->handshake->async_in_progress != 0)) {
3658 /* We've already read a record and there is an asynchronous
3659 * operation in progress to decrypt it. So skip reading the
3660 * record. */
3661 MBEDTLS_SSL_DEBUG_MSG(3, ("will resume decryption of previously-read record"));
3662 } else
3663 #endif
3664 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) {
3665 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
3666 return ret;
3667 }
3668
3669 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl);
3670 end = ssl->in_msg + ssl->in_hslen;
3671
3672 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
3673 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3674 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
3675 }
3676
3677 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE) {
3678 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message"));
3679 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
3680 }
3681
3682 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3683 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA) {
3684 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) {
3685 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret);
3686 return ret;
3687 }
3688
3689 if (p != end) {
3690 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange"));
3691 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3692 }
3693
3694 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
3695 ssl->handshake->premaster,
3696 MBEDTLS_PREMASTER_SIZE,
3697 &ssl->handshake->pmslen,
3698 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3699 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
3700 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3701 }
3702
3703 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
3704 } else
3705 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3706 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3707 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3708 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3709 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3710 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3711 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3712 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3713 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA) {
3714 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3715 size_t data_len = (size_t) (*p++);
3716 size_t buf_len = (size_t) (end - p);
3717 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
3718 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3719
3720 MBEDTLS_SSL_DEBUG_MSG(3, ("Read the peer's public key."));
3721
3722 /*
3723 * We must have at least two bytes (1 for length, at least 1 for data)
3724 */
3725 if (buf_len < 2) {
3726 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length: %" MBEDTLS_PRINTF_SIZET,
3727 buf_len));
3728 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3729 }
3730
3731 if (data_len < 1 || data_len > buf_len) {
3732 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length: %" MBEDTLS_PRINTF_SIZET
3733 " > %" MBEDTLS_PRINTF_SIZET,
3734 data_len, buf_len));
3735 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3736 }
3737
3738 /* Store peer's ECDH public key. */
3739 if (data_len > sizeof(handshake->xxdh_psa_peerkey)) {
3740 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %" MBEDTLS_PRINTF_SIZET
3741 " > %" MBEDTLS_PRINTF_SIZET,
3742 data_len,
3743 sizeof(handshake->xxdh_psa_peerkey)));
3744 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3745 }
3746 memcpy(handshake->xxdh_psa_peerkey, p, data_len);
3747 handshake->xxdh_psa_peerkey_len = data_len;
3748
3749 /* Compute ECDH shared secret. */
3750 status = psa_raw_key_agreement(
3751 PSA_ALG_ECDH, handshake->xxdh_psa_privkey,
3752 handshake->xxdh_psa_peerkey, handshake->xxdh_psa_peerkey_len,
3753 handshake->premaster, sizeof(handshake->premaster),
3754 &handshake->pmslen);
3755 if (status != PSA_SUCCESS) {
3756 ret = PSA_TO_MBEDTLS_ERR(status);
3757 MBEDTLS_SSL_DEBUG_RET(1, "psa_raw_key_agreement", ret);
3758 if (handshake->xxdh_psa_privkey_is_external == 0) {
3759 (void) psa_destroy_key(handshake->xxdh_psa_privkey);
3760 }
3761 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3762 return ret;
3763 }
3764
3765 if (handshake->xxdh_psa_privkey_is_external == 0) {
3766 status = psa_destroy_key(handshake->xxdh_psa_privkey);
3767
3768 if (status != PSA_SUCCESS) {
3769 ret = PSA_TO_MBEDTLS_ERR(status);
3770 MBEDTLS_SSL_DEBUG_RET(1, "psa_destroy_key", ret);
3771 return ret;
3772 }
3773 }
3774 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3775 #else
3776 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx,
3777 p, (size_t) (end - p))) != 0) {
3778 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret);
3779 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3780 }
3781
3782 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3783 MBEDTLS_DEBUG_ECDH_QP);
3784
3785 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx,
3786 &ssl->handshake->pmslen,
3787 ssl->handshake->premaster,
3788 MBEDTLS_MPI_MAX_SIZE,
3789 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3790 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
3791 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3792 }
3793
3794 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3795 MBEDTLS_DEBUG_ECDH_Z);
3796 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3797 } else
3798 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3799 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3800 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3801 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3802 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3803 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK) {
3804 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3805 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3806 return ret;
3807 }
3808
3809 if (p != end) {
3810 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange"));
3811 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3812 }
3813
3814 #if !defined(MBEDTLS_USE_PSA_CRYPTO)
3815 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3816 (mbedtls_key_exchange_type_t) ciphersuite_info->
3817 key_exchange)) != 0) {
3818 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
3819 return ret;
3820 }
3821 #endif /* !MBEDTLS_USE_PSA_CRYPTO */
3822 } else
3823 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
3824 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3825 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) {
3826 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
3827 if (ssl->handshake->async_in_progress != 0) {
3828 /* There is an asynchronous operation in progress to
3829 * decrypt the encrypted premaster secret, so skip
3830 * directly to resuming this operation. */
3831 MBEDTLS_SSL_DEBUG_MSG(3, ("PSK identity already parsed"));
3832 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms
3833 * won't actually use it, but maintain p anyway for robustness. */
3834 p += ssl->conf->psk_identity_len + 2;
3835 } else
3836 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
3837 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3838 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3839 return ret;
3840 }
3841
3842 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 2)) != 0) {
3843 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_encrypted_pms"), ret);
3844 return ret;
3845 }
3846
3847 #if !defined(MBEDTLS_USE_PSA_CRYPTO)
3848 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3849 (mbedtls_key_exchange_type_t) ciphersuite_info->
3850 key_exchange)) != 0) {
3851 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
3852 return ret;
3853 }
3854 #endif /* !MBEDTLS_USE_PSA_CRYPTO */
3855 } else
3856 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3857 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3858 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK) {
3859 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3860 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3861 return ret;
3862 }
3863 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) {
3864 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret);
3865 return ret;
3866 }
3867
3868 if (p != end) {
3869 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange"));
3870 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3871 }
3872
3873 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3874 unsigned char *pms = ssl->handshake->premaster;
3875 unsigned char *pms_end = pms + sizeof(ssl->handshake->premaster);
3876 size_t pms_len;
3877
3878 /* Write length only when we know the actual value */
3879 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx,
3880 pms + 2, pms_end - (pms + 2), &pms_len,
3881 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
3882 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret);
3883 return ret;
3884 }
3885 MBEDTLS_PUT_UINT16_BE(pms_len, pms, 0);
3886 pms += 2 + pms_len;
3887
3888 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K);
3889 #else
3890 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3891 (mbedtls_key_exchange_type_t) ciphersuite_info->
3892 key_exchange)) != 0) {
3893 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
3894 return ret;
3895 }
3896 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3897 } else
3898 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3899 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3900 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) {
3901 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3902 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3903 psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED;
3904 size_t ecpoint_len;
3905
3906 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3907
3908 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3909 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3910 psa_destroy_key(handshake->xxdh_psa_privkey);
3911 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3912 return ret;
3913 }
3914
3915 /* Keep a copy of the peer's public key */
3916 if (p >= end) {
3917 psa_destroy_key(handshake->xxdh_psa_privkey);
3918 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3919 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3920 }
3921
3922 ecpoint_len = *(p++);
3923 if ((size_t) (end - p) < ecpoint_len) {
3924 psa_destroy_key(handshake->xxdh_psa_privkey);
3925 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3926 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3927 }
3928
3929 /* When FFDH is enabled, the array handshake->xxdh_psa_peer_key size takes into account
3930 the sizes of the FFDH keys which are at least 2048 bits.
3931 The size of the array is thus greater than 256 bytes which is greater than any
3932 possible value of ecpoint_len (type uint8_t) and the check below can be skipped.*/
3933 #if !defined(PSA_WANT_ALG_FFDH)
3934 if (ecpoint_len > sizeof(handshake->xxdh_psa_peerkey)) {
3935 psa_destroy_key(handshake->xxdh_psa_privkey);
3936 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3937 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
3938 }
3939 #else
3940 MBEDTLS_STATIC_ASSERT(sizeof(handshake->xxdh_psa_peerkey) >= UINT8_MAX,
3941 "peer key buffer too small");
3942 #endif
3943
3944 memcpy(handshake->xxdh_psa_peerkey, p, ecpoint_len);
3945 handshake->xxdh_psa_peerkey_len = ecpoint_len;
3946 p += ecpoint_len;
3947
3948 /* As RFC 5489 section 2, the premaster secret is formed as follows:
3949 * - a uint16 containing the length (in octets) of the ECDH computation
3950 * - the octet string produced by the ECDH computation
3951 * - a uint16 containing the length (in octets) of the PSK
3952 * - the PSK itself
3953 */
3954 unsigned char *psm = ssl->handshake->premaster;
3955 const unsigned char * const psm_end =
3956 psm + sizeof(ssl->handshake->premaster);
3957 /* uint16 to store length (in octets) of the ECDH computation */
3958 const size_t zlen_size = 2;
3959 size_t zlen = 0;
3960
3961 /* Compute ECDH shared secret. */
3962 status = psa_raw_key_agreement(PSA_ALG_ECDH,
3963 handshake->xxdh_psa_privkey,
3964 handshake->xxdh_psa_peerkey,
3965 handshake->xxdh_psa_peerkey_len,
3966 psm + zlen_size,
3967 psm_end - (psm + zlen_size),
3968 &zlen);
3969
3970 destruction_status = psa_destroy_key(handshake->xxdh_psa_privkey);
3971 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3972
3973 if (status != PSA_SUCCESS) {
3974 return PSA_TO_MBEDTLS_ERR(status);
3975 } else if (destruction_status != PSA_SUCCESS) {
3976 return PSA_TO_MBEDTLS_ERR(destruction_status);
3977 }
3978
3979 /* Write the ECDH computation length before the ECDH computation */
3980 MBEDTLS_PUT_UINT16_BE(zlen, psm, 0);
3981 psm += zlen_size + zlen;
3982
3983 #else /* MBEDTLS_USE_PSA_CRYPTO */
3984 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) {
3985 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret);
3986 return ret;
3987 }
3988
3989 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx,
3990 p, (size_t) (end - p))) != 0) {
3991 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret);
3992 return MBEDTLS_ERR_SSL_DECODE_ERROR;
3993 }
3994
3995 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx,
3996 MBEDTLS_DEBUG_ECDH_QP);
3997
3998 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl,
3999 (mbedtls_key_exchange_type_t) ciphersuite_info->
4000 key_exchange)) != 0) {
4001 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret);
4002 return ret;
4003 }
4004 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4005 } else
4006 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
4007 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
4008 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) {
4009 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 0)) != 0) {
4010 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_parse_encrypted_pms_secret"), ret);
4011 return ret;
4012 }
4013 } else
4014 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
4015 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4016 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
4017 #if defined(MBEDTLS_USE_PSA_CRYPTO)
4018 if ((ret = mbedtls_psa_ecjpake_read_round(
4019 &ssl->handshake->psa_pake_ctx, p, (size_t) (end - p),
4020 MBEDTLS_ECJPAKE_ROUND_TWO)) != 0) {
4021 psa_destroy_key(ssl->handshake->psa_pake_password);
4022 psa_pake_abort(&ssl->handshake->psa_pake_ctx);
4023
4024 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round two", ret);
4025 return ret;
4026 }
4027 #else
4028 ret = mbedtls_ecjpake_read_round_two(&ssl->handshake->ecjpake_ctx,
4029 p, (size_t) (end - p));
4030 if (ret != 0) {
4031 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_two", ret);
4032 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4033 }
4034
4035 ret = mbedtls_ecjpake_derive_secret(&ssl->handshake->ecjpake_ctx,
4036 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
4037 ssl->conf->f_rng, ssl->conf->p_rng);
4038 if (ret != 0) {
4039 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_derive_secret", ret);
4040 return ret;
4041 }
4042 #endif /* MBEDTLS_USE_PSA_CRYPTO */
4043 } else
4044 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
4045 {
4046 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
4047 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4048 }
4049
4050 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) {
4051 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret);
4052 return ret;
4053 }
4054
4055 mbedtls_ssl_handshake_increment_state(ssl);
4056
4057 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client key exchange"));
4058
4059 return 0;
4060 }
4061
4062 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
4063 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl)4064 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl)
4065 {
4066 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
4067 ssl->handshake->ciphersuite_info;
4068
4069 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify"));
4070
4071 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) {
4072 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4073 mbedtls_ssl_handshake_increment_state(ssl);
4074 return 0;
4075 }
4076
4077 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen"));
4078 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4079 }
4080 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
4081 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_parse_certificate_verify(mbedtls_ssl_context * ssl)4082 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl)
4083 {
4084 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
4085 size_t i, sig_len;
4086 unsigned char hash[48];
4087 unsigned char *hash_start = hash;
4088 size_t hashlen;
4089 mbedtls_pk_type_t pk_alg;
4090 mbedtls_md_type_t md_alg;
4091 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
4092 ssl->handshake->ciphersuite_info;
4093 mbedtls_pk_context *peer_pk;
4094
4095 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify"));
4096
4097 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) {
4098 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4099 mbedtls_ssl_handshake_increment_state(ssl);
4100 return 0;
4101 }
4102
4103 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4104 if (ssl->session_negotiate->peer_cert == NULL) {
4105 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4106 mbedtls_ssl_handshake_increment_state(ssl);
4107 return 0;
4108 }
4109 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4110 if (ssl->session_negotiate->peer_cert_digest == NULL) {
4111 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify"));
4112 mbedtls_ssl_handshake_increment_state(ssl);
4113 return 0;
4114 }
4115 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4116
4117 /* Read the message without adding it to the checksum */
4118 ret = mbedtls_ssl_read_record(ssl, 0 /* no checksum update */);
4119 if (0 != ret) {
4120 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_read_record"), ret);
4121 return ret;
4122 }
4123
4124 mbedtls_ssl_handshake_increment_state(ssl);
4125
4126 /* Process the message contents */
4127 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
4128 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY) {
4129 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4130 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
4131 }
4132
4133 i = mbedtls_ssl_hs_hdr_len(ssl);
4134
4135 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4136 peer_pk = &ssl->handshake->peer_pubkey;
4137 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4138 if (ssl->session_negotiate->peer_cert == NULL) {
4139 /* Should never happen */
4140 return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
4141 }
4142 peer_pk = &ssl->session_negotiate->peer_cert->pk;
4143 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4144
4145 /*
4146 * struct {
4147 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
4148 * opaque signature<0..2^16-1>;
4149 * } DigitallySigned;
4150 */
4151 if (i + 2 > ssl->in_hslen) {
4152 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4153 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4154 }
4155
4156 /*
4157 * Hash
4158 */
4159 md_alg = mbedtls_ssl_md_alg_from_hash(ssl->in_msg[i]);
4160
4161 if (md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md(ssl, ssl->in_msg[i])) {
4162 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg"
4163 " for verify message"));
4164 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
4165 }
4166
4167 #if !defined(MBEDTLS_MD_SHA1)
4168 if (MBEDTLS_MD_SHA1 == md_alg) {
4169 hash_start += 16;
4170 }
4171 #endif
4172
4173 /* Info from md_alg will be used instead */
4174 hashlen = 0;
4175
4176 i++;
4177
4178 /*
4179 * Signature
4180 */
4181 if ((pk_alg = mbedtls_ssl_pk_alg_from_sig(ssl->in_msg[i]))
4182 == MBEDTLS_PK_NONE) {
4183 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg"
4184 " for verify message"));
4185 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
4186 }
4187
4188 /*
4189 * Check the certificate's key type matches the signature alg
4190 */
4191 if (!mbedtls_pk_can_do(peer_pk, pk_alg)) {
4192 MBEDTLS_SSL_DEBUG_MSG(1, ("sig_alg doesn't match cert key"));
4193 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
4194 }
4195
4196 i++;
4197
4198 if (i + 2 > ssl->in_hslen) {
4199 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4200 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4201 }
4202
4203 sig_len = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i);
4204 i += 2;
4205
4206 if (i + sig_len != ssl->in_hslen) {
4207 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message"));
4208 return MBEDTLS_ERR_SSL_DECODE_ERROR;
4209 }
4210
4211 /* Calculate hash and verify signature */
4212 {
4213 size_t dummy_hlen;
4214 ret = ssl->handshake->calc_verify(ssl, hash, &dummy_hlen);
4215 if (0 != ret) {
4216 MBEDTLS_SSL_DEBUG_RET(1, ("calc_verify"), ret);
4217 return ret;
4218 }
4219 }
4220
4221 if ((ret = mbedtls_pk_verify(peer_pk,
4222 md_alg, hash_start, hashlen,
4223 ssl->in_msg + i, sig_len)) != 0) {
4224 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify", ret);
4225 return ret;
4226 }
4227
4228 ret = mbedtls_ssl_update_handshake_status(ssl);
4229 if (0 != ret) {
4230 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_update_handshake_status"), ret);
4231 return ret;
4232 }
4233
4234 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify"));
4235
4236 return ret;
4237 }
4238 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
4239
4240 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4241 MBEDTLS_CHECK_RETURN_CRITICAL
ssl_write_new_session_ticket(mbedtls_ssl_context * ssl)4242 static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl)
4243 {
4244 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4245 size_t tlen;
4246 uint32_t lifetime;
4247
4248 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write new session ticket"));
4249
4250 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4251 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
4252
4253 /*
4254 * struct {
4255 * uint32 ticket_lifetime_hint;
4256 * opaque ticket<0..2^16-1>;
4257 * } NewSessionTicket;
4258 *
4259 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
4260 * 8 . 9 ticket_len (n)
4261 * 10 . 9+n ticket content
4262 */
4263
4264 #if defined(MBEDTLS_HAVE_TIME)
4265 ssl->session_negotiate->ticket_creation_time = mbedtls_ms_time();
4266 #endif
4267 if ((ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket,
4268 ssl->session_negotiate,
4269 ssl->out_msg + 10,
4270 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
4271 &tlen, &lifetime)) != 0) {
4272 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_write", ret);
4273 tlen = 0;
4274 }
4275
4276 MBEDTLS_PUT_UINT32_BE(lifetime, ssl->out_msg, 4);
4277 MBEDTLS_PUT_UINT16_BE(tlen, ssl->out_msg, 8);
4278 ssl->out_msglen = 10 + tlen;
4279
4280 /*
4281 * Morally equivalent to updating ssl->state, but NewSessionTicket and
4282 * ChangeCipherSpec share the same state.
4283 */
4284 ssl->handshake->new_session_ticket = 0;
4285
4286 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) {
4287 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret);
4288 return ret;
4289 }
4290
4291 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket"));
4292
4293 return 0;
4294 }
4295 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4296
4297 /*
4298 * SSL handshake -- server side -- single step
4299 */
mbedtls_ssl_handshake_server_step(mbedtls_ssl_context * ssl)4300 int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl)
4301 {
4302 int ret = 0;
4303
4304 MBEDTLS_SSL_DEBUG_MSG(2, ("server state: %d", ssl->state));
4305
4306 switch (ssl->state) {
4307 case MBEDTLS_SSL_HELLO_REQUEST:
4308 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO);
4309 break;
4310
4311 /*
4312 * <== ClientHello
4313 */
4314 case MBEDTLS_SSL_CLIENT_HELLO:
4315 ret = ssl_parse_client_hello(ssl);
4316 break;
4317
4318 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4319 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
4320 return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED;
4321 #endif
4322
4323 /*
4324 * ==> ServerHello
4325 * Certificate
4326 * ( ServerKeyExchange )
4327 * ( CertificateRequest )
4328 * ServerHelloDone
4329 */
4330 case MBEDTLS_SSL_SERVER_HELLO:
4331 ret = ssl_write_server_hello(ssl);
4332 break;
4333
4334 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4335 ret = mbedtls_ssl_write_certificate(ssl);
4336 break;
4337
4338 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
4339 ret = ssl_write_server_key_exchange(ssl);
4340 break;
4341
4342 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
4343 ret = ssl_write_certificate_request(ssl);
4344 break;
4345
4346 case MBEDTLS_SSL_SERVER_HELLO_DONE:
4347 ret = ssl_write_server_hello_done(ssl);
4348 break;
4349
4350 /*
4351 * <== ( Certificate/Alert )
4352 * ClientKeyExchange
4353 * ( CertificateVerify )
4354 * ChangeCipherSpec
4355 * Finished
4356 */
4357 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4358 ret = mbedtls_ssl_parse_certificate(ssl);
4359 break;
4360
4361 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
4362 ret = ssl_parse_client_key_exchange(ssl);
4363 break;
4364
4365 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
4366 ret = ssl_parse_certificate_verify(ssl);
4367 break;
4368
4369 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4370 ret = mbedtls_ssl_parse_change_cipher_spec(ssl);
4371 break;
4372
4373 case MBEDTLS_SSL_CLIENT_FINISHED:
4374 ret = mbedtls_ssl_parse_finished(ssl);
4375 break;
4376
4377 /*
4378 * ==> ( NewSessionTicket )
4379 * ChangeCipherSpec
4380 * Finished
4381 */
4382 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4383 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4384 if (ssl->handshake->new_session_ticket != 0) {
4385 ret = ssl_write_new_session_ticket(ssl);
4386 } else
4387 #endif
4388 ret = mbedtls_ssl_write_change_cipher_spec(ssl);
4389 break;
4390
4391 case MBEDTLS_SSL_SERVER_FINISHED:
4392 ret = mbedtls_ssl_write_finished(ssl);
4393 break;
4394
4395 case MBEDTLS_SSL_FLUSH_BUFFERS:
4396 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done"));
4397 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);
4398 break;
4399
4400 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4401 mbedtls_ssl_handshake_wrapup(ssl);
4402 break;
4403
4404 default:
4405 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state));
4406 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
4407 }
4408
4409 return ret;
4410 }
4411
mbedtls_ssl_conf_preference_order(mbedtls_ssl_config * conf,int order)4412 void mbedtls_ssl_conf_preference_order(mbedtls_ssl_config *conf, int order)
4413 {
4414 conf->respect_cli_pref = order;
4415 }
4416
4417 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_2 */
4418