1 /* 2 * TLS 1.2 and 1.3 client-side functions 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 * 19 * This file is part of mbed TLS ( https://tls.mbed.org ) 20 */ 21 22 #include "common.h" 23 24 #if defined(MBEDTLS_SSL_CLI_C) 25 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) || defined(MBEDTLS_SSL_PROTO_TLS1_2) 26 27 #include <string.h> 28 29 #include "mbedtls/debug.h" 30 #include "mbedtls/error.h" 31 #include "mbedtls/platform.h" 32 33 #include "ssl_client.h" 34 #include "ssl_misc.h" 35 #include "ssl_tls13_keys.h" 36 #include "ssl_debug_helpers.h" 37 38 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 39 MBEDTLS_CHECK_RETURN_CRITICAL 40 static int ssl_write_hostname_ext(mbedtls_ssl_context *ssl, 41 unsigned char *buf, 42 const unsigned char *end, 43 size_t *olen) 44 { 45 unsigned char *p = buf; 46 size_t hostname_len; 47 48 *olen = 0; 49 50 if (ssl->hostname == NULL) { 51 return 0; 52 } 53 54 MBEDTLS_SSL_DEBUG_MSG(3, 55 ("client hello, adding server name extension: %s", 56 ssl->hostname)); 57 58 hostname_len = strlen(ssl->hostname); 59 60 MBEDTLS_SSL_CHK_BUF_PTR(p, end, hostname_len + 9); 61 62 /* 63 * Sect. 3, RFC 6066 (TLS Extensions Definitions) 64 * 65 * In order to provide any of the server names, clients MAY include an 66 * extension of type "server_name" in the (extended) client hello. The 67 * "extension_data" field of this extension SHALL contain 68 * "ServerNameList" where: 69 * 70 * struct { 71 * NameType name_type; 72 * select (name_type) { 73 * case host_name: HostName; 74 * } name; 75 * } ServerName; 76 * 77 * enum { 78 * host_name(0), (255) 79 * } NameType; 80 * 81 * opaque HostName<1..2^16-1>; 82 * 83 * struct { 84 * ServerName server_name_list<1..2^16-1> 85 * } ServerNameList; 86 * 87 */ 88 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SERVERNAME, p, 0); 89 p += 2; 90 91 MBEDTLS_PUT_UINT16_BE(hostname_len + 5, p, 0); 92 p += 2; 93 94 MBEDTLS_PUT_UINT16_BE(hostname_len + 3, p, 0); 95 p += 2; 96 97 *p++ = MBEDTLS_BYTE_0(MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME); 98 99 MBEDTLS_PUT_UINT16_BE(hostname_len, p, 0); 100 p += 2; 101 102 memcpy(p, ssl->hostname, hostname_len); 103 104 *olen = hostname_len + 9; 105 106 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 107 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_SERVERNAME); 108 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ 109 return 0; 110 } 111 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 112 113 #if defined(MBEDTLS_SSL_ALPN) 114 /* 115 * ssl_write_alpn_ext() 116 * 117 * Structure of the application_layer_protocol_negotiation extension in 118 * ClientHello: 119 * 120 * opaque ProtocolName<1..2^8-1>; 121 * 122 * struct { 123 * ProtocolName protocol_name_list<2..2^16-1> 124 * } ProtocolNameList; 125 * 126 */ 127 MBEDTLS_CHECK_RETURN_CRITICAL 128 static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl, 129 unsigned char *buf, 130 const unsigned char *end, 131 size_t *out_len) 132 { 133 unsigned char *p = buf; 134 135 *out_len = 0; 136 137 if (ssl->conf->alpn_list == NULL) { 138 return 0; 139 } 140 141 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, adding alpn extension")); 142 143 144 /* Check we have enough space for the extension type (2 bytes), the 145 * extension length (2 bytes) and the protocol_name_list length (2 bytes). 146 */ 147 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6); 148 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ALPN, p, 0); 149 /* Skip writing extension and list length for now */ 150 p += 6; 151 152 /* 153 * opaque ProtocolName<1..2^8-1>; 154 * 155 * struct { 156 * ProtocolName protocol_name_list<2..2^16-1> 157 * } ProtocolNameList; 158 */ 159 for (const char **cur = ssl->conf->alpn_list; *cur != NULL; cur++) { 160 /* 161 * mbedtls_ssl_conf_set_alpn_protocols() checked that the length of 162 * protocol names is less than 255. 163 */ 164 size_t protocol_name_len = strlen(*cur); 165 166 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 1 + protocol_name_len); 167 *p++ = (unsigned char) protocol_name_len; 168 memcpy(p, *cur, protocol_name_len); 169 p += protocol_name_len; 170 } 171 172 *out_len = p - buf; 173 174 /* List length = *out_len - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */ 175 MBEDTLS_PUT_UINT16_BE(*out_len - 6, buf, 4); 176 177 /* Extension length = *out_len - 2 (ext_type) - 2 (ext_len) */ 178 MBEDTLS_PUT_UINT16_BE(*out_len - 4, buf, 2); 179 180 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 181 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_ALPN); 182 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ 183 return 0; 184 } 185 #endif /* MBEDTLS_SSL_ALPN */ 186 187 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 188 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 189 /* 190 * Function for writing a supported groups (TLS 1.3) or supported elliptic 191 * curves (TLS 1.2) extension. 192 * 193 * The "extension_data" field of a supported groups extension contains a 194 * "NamedGroupList" value (TLS 1.3 RFC8446): 195 * enum { 196 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019), 197 * x25519(0x001D), x448(0x001E), 198 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102), 199 * ffdhe6144(0x0103), ffdhe8192(0x0104), 200 * ffdhe_private_use(0x01FC..0x01FF), 201 * ecdhe_private_use(0xFE00..0xFEFF), 202 * (0xFFFF) 203 * } NamedGroup; 204 * struct { 205 * NamedGroup named_group_list<2..2^16-1>; 206 * } NamedGroupList; 207 * 208 * The "extension_data" field of a supported elliptic curves extension contains 209 * a "NamedCurveList" value (TLS 1.2 RFC 8422): 210 * enum { 211 * deprecated(1..22), 212 * secp256r1 (23), secp384r1 (24), secp521r1 (25), 213 * x25519(29), x448(30), 214 * reserved (0xFE00..0xFEFF), 215 * deprecated(0xFF01..0xFF02), 216 * (0xFFFF) 217 * } NamedCurve; 218 * struct { 219 * NamedCurve named_curve_list<2..2^16-1> 220 * } NamedCurveList; 221 * 222 * The TLS 1.3 supported groups extension was defined to be a compatible 223 * generalization of the TLS 1.2 supported elliptic curves extension. They both 224 * share the same extension identifier. 225 * 226 * DHE groups are not supported yet. 227 */ 228 MBEDTLS_CHECK_RETURN_CRITICAL 229 static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, 230 unsigned char *buf, 231 const unsigned char *end, 232 size_t *out_len) 233 { 234 unsigned char *p = buf; 235 unsigned char *named_group_list; /* Start of named_group_list */ 236 size_t named_group_list_len; /* Length of named_group_list */ 237 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl); 238 239 *out_len = 0; 240 241 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, adding supported_groups extension")); 242 243 /* Check if we have space for header and length fields: 244 * - extension_type (2 bytes) 245 * - extension_data_length (2 bytes) 246 * - named_group_list_length (2 bytes) 247 */ 248 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 6); 249 p += 6; 250 251 named_group_list = p; 252 253 if (group_list == NULL) { 254 return MBEDTLS_ERR_SSL_BAD_CONFIG; 255 } 256 257 for (; *group_list != 0; group_list++) { 258 MBEDTLS_SSL_DEBUG_MSG(1, ("got supported group(%04x)", *group_list)); 259 260 #if defined(MBEDTLS_ECP_C) 261 if ((mbedtls_ssl_conf_is_tls13_enabled(ssl->conf) && 262 mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list)) || 263 (mbedtls_ssl_conf_is_tls12_enabled(ssl->conf) && 264 mbedtls_ssl_tls12_named_group_is_ecdhe(*group_list))) { 265 if (mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) == 266 MBEDTLS_ECP_DP_NONE) { 267 continue; 268 } 269 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 270 MBEDTLS_PUT_UINT16_BE(*group_list, p, 0); 271 p += 2; 272 MBEDTLS_SSL_DEBUG_MSG(3, ("NamedGroup: %s ( %x )", 273 mbedtls_ssl_get_curve_name_from_tls_id(*group_list), 274 *group_list)); 275 } 276 #endif /* MBEDTLS_ECP_C */ 277 /* Add DHE groups here */ 278 279 } 280 281 /* Length of named_group_list */ 282 named_group_list_len = p - named_group_list; 283 if (named_group_list_len == 0) { 284 MBEDTLS_SSL_DEBUG_MSG(1, ("No group available.")); 285 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 286 } 287 288 /* Write extension_type */ 289 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0); 290 /* Write extension_data_length */ 291 MBEDTLS_PUT_UINT16_BE(named_group_list_len + 2, buf, 2); 292 /* Write length of named_group_list */ 293 MBEDTLS_PUT_UINT16_BE(named_group_list_len, buf, 4); 294 295 MBEDTLS_SSL_DEBUG_BUF(3, "Supported groups extension", 296 buf + 4, named_group_list_len + 2); 297 298 *out_len = p - buf; 299 300 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 301 mbedtls_ssl_tls13_set_hs_sent_ext_mask( 302 ssl, MBEDTLS_TLS_EXT_SUPPORTED_GROUPS); 303 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ 304 305 return 0; 306 } 307 308 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || 309 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 310 311 MBEDTLS_CHECK_RETURN_CRITICAL 312 static int ssl_write_client_hello_cipher_suites( 313 mbedtls_ssl_context *ssl, 314 unsigned char *buf, 315 unsigned char *end, 316 int *tls12_uses_ec, 317 size_t *out_len) 318 { 319 unsigned char *p = buf; 320 const int *ciphersuite_list; 321 unsigned char *cipher_suites; /* Start of the cipher_suites list */ 322 size_t cipher_suites_len; 323 324 *tls12_uses_ec = 0; 325 *out_len = 0; 326 327 /* 328 * Ciphersuite list 329 * 330 * This is a list of the symmetric cipher options supported by 331 * the client, specifically the record protection algorithm 332 * ( including secret key length ) and a hash to be used with 333 * HKDF, in descending order of client preference. 334 */ 335 ciphersuite_list = ssl->conf->ciphersuite_list; 336 337 /* Check there is space for the cipher suite list length (2 bytes). */ 338 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 339 p += 2; 340 341 /* Write cipher_suites 342 * CipherSuite cipher_suites<2..2^16-2>; 343 */ 344 cipher_suites = p; 345 for (size_t i = 0; ciphersuite_list[i] != 0; i++) { 346 int cipher_suite = ciphersuite_list[i]; 347 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 348 349 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(cipher_suite); 350 351 if (mbedtls_ssl_validate_ciphersuite(ssl, ciphersuite_info, 352 ssl->handshake->min_tls_version, 353 ssl->tls_version) != 0) { 354 continue; 355 } 356 357 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ 358 (defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 359 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)) 360 *tls12_uses_ec |= mbedtls_ssl_ciphersuite_uses_ec(ciphersuite_info); 361 #endif 362 363 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, add ciphersuite: %04x, %s", 364 (unsigned int) cipher_suite, 365 ciphersuite_info->name)); 366 367 /* Check there is space for the cipher suite identifier (2 bytes). */ 368 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 369 MBEDTLS_PUT_UINT16_BE(cipher_suite, p, 0); 370 p += 2; 371 } 372 373 /* 374 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV 375 */ 376 int renegotiating = 0; 377 #if defined(MBEDTLS_SSL_RENEGOTIATION) 378 renegotiating = (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE); 379 #endif 380 if (!renegotiating) { 381 MBEDTLS_SSL_DEBUG_MSG(3, ("adding EMPTY_RENEGOTIATION_INFO_SCSV")); 382 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 383 MBEDTLS_PUT_UINT16_BE(MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO, p, 0); 384 p += 2; 385 } 386 387 /* Write the cipher_suites length in number of bytes */ 388 cipher_suites_len = p - cipher_suites; 389 MBEDTLS_PUT_UINT16_BE(cipher_suites_len, buf, 0); 390 MBEDTLS_SSL_DEBUG_MSG(3, 391 ("client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites", 392 cipher_suites_len/2)); 393 394 /* Output the total length of cipher_suites field. */ 395 *out_len = p - buf; 396 397 return 0; 398 } 399 400 /* 401 * Structure of the TLS 1.3 ClientHello message: 402 * 403 * struct { 404 * ProtocolVersion legacy_version = 0x0303; // TLS v1.2 405 * Random random; 406 * opaque legacy_session_id<0..32>; 407 * CipherSuite cipher_suites<2..2^16-2>; 408 * opaque legacy_compression_methods<1..2^8-1>; 409 * Extension extensions<8..2^16-1>; 410 * } ClientHello; 411 * 412 * Structure of the (D)TLS 1.2 ClientHello message: 413 * 414 * struct { 415 * ProtocolVersion client_version; 416 * Random random; 417 * SessionID session_id; 418 * opaque cookie<0..2^8-1>; // DTLS 1.2 ONLY 419 * CipherSuite cipher_suites<2..2^16-2>; 420 * CompressionMethod compression_methods<1..2^8-1>; 421 * select (extensions_present) { 422 * case false: 423 * struct {}; 424 * case true: 425 * Extension extensions<0..2^16-1>; 426 * }; 427 * } ClientHello; 428 */ 429 MBEDTLS_CHECK_RETURN_CRITICAL 430 static int ssl_write_client_hello_body(mbedtls_ssl_context *ssl, 431 unsigned char *buf, 432 unsigned char *end, 433 size_t *out_len, 434 size_t *binders_len) 435 { 436 int ret; 437 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 438 unsigned char *p = buf; 439 unsigned char *p_extensions_len; /* Pointer to extensions length */ 440 size_t output_len; /* Length of buffer used by function */ 441 size_t extensions_len; /* Length of the list of extensions*/ 442 int tls12_uses_ec = 0; 443 444 *out_len = 0; 445 *binders_len = 0; 446 447 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 448 unsigned char propose_tls12 = 449 (handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2) 450 && 451 (MBEDTLS_SSL_VERSION_TLS1_2 <= ssl->tls_version); 452 #endif 453 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 454 unsigned char propose_tls13 = 455 (handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3) 456 && 457 (MBEDTLS_SSL_VERSION_TLS1_3 <= ssl->tls_version); 458 #endif 459 460 /* 461 * Write client_version (TLS 1.2) or legacy_version (TLS 1.3) 462 * 463 * In all cases this is the TLS 1.2 version. 464 */ 465 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 466 mbedtls_ssl_write_version(p, ssl->conf->transport, 467 MBEDTLS_SSL_VERSION_TLS1_2); 468 p += 2; 469 470 /* ... 471 * Random random; 472 * ... 473 * 474 * The random bytes have been prepared by ssl_prepare_client_hello() into 475 * the handshake->randbytes buffer and are copied here into the output 476 * buffer. 477 */ 478 MBEDTLS_SSL_CHK_BUF_PTR(p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN); 479 memcpy(p, handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN); 480 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes", 481 p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN); 482 p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN; 483 484 /* TLS 1.2: 485 * ... 486 * SessionID session_id; 487 * ... 488 * with 489 * opaque SessionID<0..32>; 490 * 491 * TLS 1.3: 492 * ... 493 * opaque legacy_session_id<0..32>; 494 * ... 495 * 496 * The (legacy) session identifier bytes have been prepared by 497 * ssl_prepare_client_hello() into the ssl->session_negotiate->id buffer 498 * and are copied here into the output buffer. 499 */ 500 MBEDTLS_SSL_CHK_BUF_PTR(p, end, ssl->session_negotiate->id_len + 1); 501 *p++ = (unsigned char) ssl->session_negotiate->id_len; 502 memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len); 503 p += ssl->session_negotiate->id_len; 504 505 MBEDTLS_SSL_DEBUG_BUF(3, "session id", ssl->session_negotiate->id, 506 ssl->session_negotiate->id_len); 507 508 /* DTLS 1.2 ONLY 509 * ... 510 * opaque cookie<0..2^8-1>; 511 * ... 512 */ 513 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS) 514 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 515 #if !defined(MBEDTLS_SSL_PROTO_TLS1_3) 516 uint8_t cookie_len = 0; 517 #else 518 uint16_t cookie_len = 0; 519 #endif /* !MBEDTLS_SSL_PROTO_TLS1_3 */ 520 521 if (handshake->cookie != NULL) { 522 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie", 523 handshake->cookie, 524 handshake->cookie_len); 525 cookie_len = handshake->cookie_len; 526 } 527 528 MBEDTLS_SSL_CHK_BUF_PTR(p, end, cookie_len + 1); 529 *p++ = (unsigned char) cookie_len; 530 if (cookie_len > 0) { 531 memcpy(p, handshake->cookie, cookie_len); 532 p += cookie_len; 533 } 534 } 535 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */ 536 537 /* Write cipher_suites */ 538 ret = ssl_write_client_hello_cipher_suites(ssl, p, end, 539 &tls12_uses_ec, 540 &output_len); 541 if (ret != 0) { 542 return ret; 543 } 544 p += output_len; 545 546 /* Write legacy_compression_methods (TLS 1.3) or 547 * compression_methods (TLS 1.2) 548 * 549 * For every TLS 1.3 ClientHello, this vector MUST contain exactly 550 * one byte set to zero, which corresponds to the 'null' compression 551 * method in prior versions of TLS. 552 * 553 * For TLS 1.2 ClientHello, for security reasons we do not support 554 * compression anymore, thus also just the 'null' compression method. 555 */ 556 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 557 *p++ = 1; 558 *p++ = MBEDTLS_SSL_COMPRESS_NULL; 559 560 /* Write extensions */ 561 562 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 563 /* Keeping track of the included extensions */ 564 handshake->sent_extensions = MBEDTLS_SSL_EXT_MASK_NONE; 565 #endif 566 567 /* First write extensions, then the total length */ 568 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 2); 569 p_extensions_len = p; 570 p += 2; 571 572 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 573 /* Write server name extension */ 574 ret = ssl_write_hostname_ext(ssl, p, end, &output_len); 575 if (ret != 0) { 576 return ret; 577 } 578 p += output_len; 579 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 580 581 #if defined(MBEDTLS_SSL_ALPN) 582 ret = ssl_write_alpn_ext(ssl, p, end, &output_len); 583 if (ret != 0) { 584 return ret; 585 } 586 p += output_len; 587 #endif /* MBEDTLS_SSL_ALPN */ 588 589 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 590 if (propose_tls13) { 591 ret = mbedtls_ssl_tls13_write_client_hello_exts(ssl, p, end, 592 &output_len); 593 if (ret != 0) { 594 return ret; 595 } 596 p += output_len; 597 } 598 #endif 599 600 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 601 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 602 if ( 603 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 604 (propose_tls13 && 605 mbedtls_ssl_conf_tls13_some_ephemeral_enabled(ssl)) || 606 #endif 607 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 608 (propose_tls12 && tls12_uses_ec) || 609 #endif 610 0) { 611 ret = ssl_write_supported_groups_ext(ssl, p, end, &output_len); 612 if (ret != 0) { 613 return ret; 614 } 615 p += output_len; 616 } 617 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 618 619 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) 620 if ( 621 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 622 (propose_tls13 && mbedtls_ssl_conf_tls13_ephemeral_enabled(ssl)) || 623 #endif 624 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 625 propose_tls12 || 626 #endif 627 0) { 628 ret = mbedtls_ssl_write_sig_alg_ext(ssl, p, end, &output_len); 629 if (ret != 0) { 630 return ret; 631 } 632 p += output_len; 633 } 634 #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ 635 636 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 637 if (propose_tls12) { 638 ret = mbedtls_ssl_tls12_write_client_hello_exts(ssl, p, end, 639 tls12_uses_ec, 640 &output_len); 641 if (ret != 0) { 642 return ret; 643 } 644 p += output_len; 645 } 646 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 647 648 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) 649 /* The "pre_shared_key" extension (RFC 8446 Section 4.2.11) 650 * MUST be the last extension in the ClientHello. 651 */ 652 if (propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled(ssl)) { 653 ret = mbedtls_ssl_tls13_write_identities_of_pre_shared_key_ext( 654 ssl, p, end, &output_len, binders_len); 655 if (ret != 0) { 656 return ret; 657 } 658 p += output_len; 659 } 660 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */ 661 662 /* Write the length of the list of extensions. */ 663 extensions_len = p - p_extensions_len - 2; 664 665 if (extensions_len == 0) { 666 p = p_extensions_len; 667 } else { 668 MBEDTLS_PUT_UINT16_BE(extensions_len, p_extensions_len, 0); 669 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, total extension length: %" \ 670 MBEDTLS_PRINTF_SIZET, extensions_len)); 671 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", 672 p_extensions_len, extensions_len); 673 } 674 675 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 676 MBEDTLS_SSL_PRINT_EXTS( 677 3, MBEDTLS_SSL_HS_CLIENT_HELLO, handshake->sent_extensions); 678 #endif 679 680 *out_len = p - buf; 681 return 0; 682 } 683 684 MBEDTLS_CHECK_RETURN_CRITICAL 685 static int ssl_generate_random(mbedtls_ssl_context *ssl) 686 { 687 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 688 unsigned char *randbytes = ssl->handshake->randbytes; 689 size_t gmt_unix_time_len = 0; 690 691 /* 692 * Generate the random bytes 693 * 694 * TLS 1.2 case: 695 * struct { 696 * uint32 gmt_unix_time; 697 * opaque random_bytes[28]; 698 * } Random; 699 * 700 * TLS 1.3 case: 701 * opaque Random[32]; 702 */ 703 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) { 704 #if defined(MBEDTLS_HAVE_TIME) 705 mbedtls_time_t gmt_unix_time = mbedtls_time(NULL); 706 MBEDTLS_PUT_UINT32_BE(gmt_unix_time, randbytes, 0); 707 gmt_unix_time_len = 4; 708 709 MBEDTLS_SSL_DEBUG_MSG(3, 710 ("client hello, current time: %" MBEDTLS_PRINTF_LONGLONG, 711 (long long) gmt_unix_time)); 712 #endif /* MBEDTLS_HAVE_TIME */ 713 } 714 715 ret = ssl->conf->f_rng(ssl->conf->p_rng, 716 randbytes + gmt_unix_time_len, 717 MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len); 718 return ret; 719 } 720 721 MBEDTLS_CHECK_RETURN_CRITICAL 722 static int ssl_prepare_client_hello(mbedtls_ssl_context *ssl) 723 { 724 int ret; 725 size_t session_id_len; 726 mbedtls_ssl_session *session_negotiate = ssl->session_negotiate; 727 728 if (session_negotiate == NULL) { 729 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 730 } 731 732 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ 733 defined(MBEDTLS_SSL_SESSION_TICKETS) && \ 734 defined(MBEDTLS_HAVE_TIME) 735 736 /* Check if a tls13 ticket has been configured. */ 737 if (ssl->handshake->resume != 0 && 738 session_negotiate->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 && 739 session_negotiate->ticket != NULL) { 740 mbedtls_time_t now = mbedtls_time(NULL); 741 uint64_t age = (uint64_t) (now - session_negotiate->ticket_received); 742 if (session_negotiate->ticket_received > now || 743 age > session_negotiate->ticket_lifetime) { 744 /* Without valid ticket, disable session resumption.*/ 745 MBEDTLS_SSL_DEBUG_MSG( 746 3, ("Ticket expired, disable session resumption")); 747 ssl->handshake->resume = 0; 748 } 749 } 750 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 && 751 MBEDTLS_SSL_SESSION_TICKETS && 752 MBEDTLS_HAVE_TIME */ 753 754 if (ssl->conf->f_rng == NULL) { 755 MBEDTLS_SSL_DEBUG_MSG(1, ("no RNG provided")); 756 return MBEDTLS_ERR_SSL_NO_RNG; 757 } 758 759 /* Bet on the highest configured version if we are not in a TLS 1.2 760 * renegotiation or session resumption. 761 */ 762 #if defined(MBEDTLS_SSL_RENEGOTIATION) 763 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 764 ssl->handshake->min_tls_version = ssl->tls_version; 765 } else 766 #endif 767 { 768 if (ssl->handshake->resume) { 769 ssl->tls_version = session_negotiate->tls_version; 770 ssl->handshake->min_tls_version = ssl->tls_version; 771 } else { 772 ssl->tls_version = ssl->conf->max_tls_version; 773 ssl->handshake->min_tls_version = ssl->conf->min_tls_version; 774 } 775 } 776 777 /* 778 * Generate the random bytes, except when responding to a verify request 779 * where we MUST reuse the previously generated random bytes 780 * (RFC 6347 4.2.1). 781 */ 782 #if defined(MBEDTLS_SSL_PROTO_DTLS) 783 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || 784 (ssl->handshake->cookie == NULL)) 785 #endif 786 { 787 ret = ssl_generate_random(ssl); 788 if (ret != 0) { 789 MBEDTLS_SSL_DEBUG_RET(1, "Random bytes generation failed", ret); 790 return ret; 791 } 792 } 793 794 /* 795 * Prepare session identifier. At that point, the length of the session 796 * identifier in the SSL context `ssl->session_negotiate->id_len` is equal 797 * to zero, except in the case of a TLS 1.2 session renegotiation or 798 * session resumption. 799 */ 800 session_id_len = session_negotiate->id_len; 801 802 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 803 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2) { 804 if (session_id_len < 16 || session_id_len > 32 || 805 #if defined(MBEDTLS_SSL_RENEGOTIATION) 806 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE || 807 #endif 808 ssl->handshake->resume == 0) { 809 session_id_len = 0; 810 } 811 812 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 813 /* 814 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY 815 * generate and include a Session ID in the TLS ClientHello." 816 */ 817 int renegotiating = 0; 818 #if defined(MBEDTLS_SSL_RENEGOTIATION) 819 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 820 renegotiating = 1; 821 } 822 #endif 823 if (!renegotiating) { 824 if ((session_negotiate->ticket != NULL) && 825 (session_negotiate->ticket_len != 0)) { 826 session_id_len = 32; 827 } 828 } 829 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 830 } 831 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 832 833 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) 834 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { 835 /* 836 * Create a legacy session identifier for the purpose of middlebox 837 * compatibility only if one has not been created already, which is 838 * the case if we are here for the TLS 1.3 second ClientHello. 839 * 840 * Versions of TLS before TLS 1.3 supported a "session resumption" 841 * feature which has been merged with pre-shared keys in TLS 1.3 842 * version. A client which has a cached session ID set by a pre-TLS 1.3 843 * server SHOULD set this field to that value. In compatibility mode, 844 * this field MUST be non-empty, so a client not offering a pre-TLS 1.3 845 * session MUST generate a new 32-byte value. This value need not be 846 * random but SHOULD be unpredictable to avoid implementations fixating 847 * on a specific value (also known as ossification). Otherwise, it MUST 848 * be set as a zero-length vector ( i.e., a zero-valued single byte 849 * length field ). 850 */ 851 session_id_len = 32; 852 } 853 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ 854 855 if (session_id_len != session_negotiate->id_len) { 856 session_negotiate->id_len = session_id_len; 857 if (session_id_len > 0) { 858 ret = ssl->conf->f_rng(ssl->conf->p_rng, 859 session_negotiate->id, 860 session_id_len); 861 if (ret != 0) { 862 MBEDTLS_SSL_DEBUG_RET(1, "creating session id failed", ret); 863 return ret; 864 } 865 } 866 } 867 868 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ 869 defined(MBEDTLS_SSL_SESSION_TICKETS) && \ 870 defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 871 if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 && 872 ssl->handshake->resume) { 873 int hostname_mismatch = ssl->hostname != NULL || 874 session_negotiate->hostname != NULL; 875 if (ssl->hostname != NULL && session_negotiate->hostname != NULL) { 876 hostname_mismatch = strcmp( 877 ssl->hostname, session_negotiate->hostname) != 0; 878 } 879 880 if (hostname_mismatch) { 881 MBEDTLS_SSL_DEBUG_MSG( 882 1, ("Hostname mismatch the session ticket, " 883 "disable session resumption.")); 884 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 885 } 886 } else { 887 return mbedtls_ssl_session_set_hostname(session_negotiate, 888 ssl->hostname); 889 } 890 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 && 891 MBEDTLS_SSL_SESSION_TICKETS && 892 MBEDTLS_SSL_SERVER_NAME_INDICATION */ 893 894 return 0; 895 } 896 /* 897 * Write ClientHello handshake message. 898 * Handler for MBEDTLS_SSL_CLIENT_HELLO 899 */ 900 int mbedtls_ssl_write_client_hello(mbedtls_ssl_context *ssl) 901 { 902 int ret = 0; 903 unsigned char *buf; 904 size_t buf_len, msg_len, binders_len; 905 906 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write client hello")); 907 908 MBEDTLS_SSL_PROC_CHK(ssl_prepare_client_hello(ssl)); 909 910 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg( 911 ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, 912 &buf, &buf_len)); 913 914 MBEDTLS_SSL_PROC_CHK(ssl_write_client_hello_body(ssl, buf, 915 buf + buf_len, 916 &msg_len, 917 &binders_len)); 918 919 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS) 920 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 921 ssl->out_msglen = msg_len + 4; 922 mbedtls_ssl_send_flight_completed(ssl); 923 924 /* 925 * The two functions below may try to send data on the network and 926 * can return with the MBEDTLS_ERR_SSL_WANT_READ error code when they 927 * fail to do so and the transmission has to be retried later. In that 928 * case as in fatal error cases, we return immediately. But we must have 929 * set the handshake state to the next state at that point to ensure 930 * that we will not write and send again a ClientHello when we 931 * eventually succeed in sending the pending data. 932 */ 933 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO); 934 935 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 936 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 937 return ret; 938 } 939 940 if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { 941 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); 942 return ret; 943 } 944 } else 945 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */ 946 { 947 948 ret = mbedtls_ssl_add_hs_hdr_to_checksum(ssl, 949 MBEDTLS_SSL_HS_CLIENT_HELLO, 950 msg_len); 951 if (ret != 0) { 952 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_add_hs_hdr_to_checksum", ret); 953 return ret; 954 } 955 ret = ssl->handshake->update_checksum(ssl, buf, msg_len - binders_len); 956 if (ret != 0) { 957 MBEDTLS_SSL_DEBUG_RET(1, "update_checksum", ret); 958 return ret; 959 } 960 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) 961 if (binders_len > 0) { 962 MBEDTLS_SSL_PROC_CHK( 963 mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext( 964 ssl, buf + msg_len - binders_len, buf + msg_len)); 965 ret = ssl->handshake->update_checksum(ssl, buf + msg_len - binders_len, 966 binders_len); 967 if (ret != 0) { 968 MBEDTLS_SSL_DEBUG_RET(1, "update_checksum", ret); 969 return ret; 970 } 971 } 972 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */ 973 974 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg(ssl, 975 buf_len, 976 msg_len)); 977 978 /* 979 * Set next state. Note that if TLS 1.3 is proposed, this may be 980 * overwritten by mbedtls_ssl_tls13_finalize_client_hello(). 981 */ 982 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO); 983 984 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 985 if (ssl->handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3 && 986 MBEDTLS_SSL_VERSION_TLS1_3 <= ssl->tls_version) { 987 ret = mbedtls_ssl_tls13_finalize_client_hello(ssl); 988 } 989 #endif 990 } 991 992 cleanup: 993 994 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write client hello")); 995 return ret; 996 } 997 998 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 || MBEDTLS_SSL_PROTO_TLS1_2 */ 999 #endif /* MBEDTLS_SSL_CLI_C */ 1000