1 /* 2 * TLS server-side functions 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 6 */ 7 8 #include "common.h" 9 10 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2) 11 12 #include "mbedtls/platform.h" 13 14 #include "mbedtls/ssl.h" 15 #include "ssl_misc.h" 16 #include "debug_internal.h" 17 #include "mbedtls/error.h" 18 #include "mbedtls/platform_util.h" 19 #include "constant_time_internal.h" 20 #include "mbedtls/constant_time.h" 21 22 #include <string.h> 23 24 #if defined(MBEDTLS_USE_PSA_CRYPTO) 25 /* Define a local translating function to save code size by not using too many 26 * arguments in each translating place. */ 27 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) || \ 28 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) 29 static int local_err_translation(psa_status_t status) 30 { 31 return psa_status_to_mbedtls(status, psa_to_ssl_errors, 32 ARRAY_LENGTH(psa_to_ssl_errors), 33 psa_generic_status_to_mbedtls); 34 } 35 #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status) 36 #endif 37 #endif 38 39 #if defined(MBEDTLS_ECP_C) 40 #include "mbedtls/ecp.h" 41 #endif 42 43 #if defined(MBEDTLS_HAVE_TIME) 44 #include "mbedtls/platform_time.h" 45 #endif 46 47 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 48 int mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context *ssl, 49 const unsigned char *info, 50 size_t ilen) 51 { 52 if (ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER) { 53 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 54 } 55 56 mbedtls_free(ssl->cli_id); 57 58 if ((ssl->cli_id = mbedtls_calloc(1, ilen)) == NULL) { 59 return MBEDTLS_ERR_SSL_ALLOC_FAILED; 60 } 61 62 memcpy(ssl->cli_id, info, ilen); 63 ssl->cli_id_len = ilen; 64 65 return 0; 66 } 67 68 void mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config *conf, 69 mbedtls_ssl_cookie_write_t *f_cookie_write, 70 mbedtls_ssl_cookie_check_t *f_cookie_check, 71 void *p_cookie) 72 { 73 conf->f_cookie_write = f_cookie_write; 74 conf->f_cookie_check = f_cookie_check; 75 conf->p_cookie = p_cookie; 76 } 77 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 78 79 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 80 MBEDTLS_CHECK_RETURN_CRITICAL 81 static int ssl_conf_has_psk_or_cb(mbedtls_ssl_config const *conf) 82 { 83 if (conf->f_psk != NULL) { 84 return 1; 85 } 86 87 if (conf->psk_identity_len == 0 || conf->psk_identity == NULL) { 88 return 0; 89 } 90 91 92 #if defined(MBEDTLS_USE_PSA_CRYPTO) 93 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) { 94 return 1; 95 } 96 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 97 98 if (conf->psk != NULL && conf->psk_len != 0) { 99 return 1; 100 } 101 102 return 0; 103 } 104 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ 105 106 MBEDTLS_CHECK_RETURN_CRITICAL 107 static int ssl_parse_renegotiation_info(mbedtls_ssl_context *ssl, 108 const unsigned char *buf, 109 size_t len) 110 { 111 #if defined(MBEDTLS_SSL_RENEGOTIATION) 112 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 113 /* Check verify-data in constant-time. The length OTOH is no secret */ 114 if (len != 1 + ssl->verify_data_len || 115 buf[0] != ssl->verify_data_len || 116 mbedtls_ct_memcmp(buf + 1, ssl->peer_verify_data, 117 ssl->verify_data_len) != 0) { 118 MBEDTLS_SSL_DEBUG_MSG(1, ("non-matching renegotiation info")); 119 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 120 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 121 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 122 } 123 } else 124 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 125 { 126 if (len != 1 || buf[0] != 0x0) { 127 MBEDTLS_SSL_DEBUG_MSG(1, ("non-zero length renegotiation info")); 128 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 129 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 130 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 131 } 132 133 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; 134 } 135 136 return 0; 137 } 138 139 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 140 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 141 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 142 /* 143 * Function for parsing a supported groups (TLS 1.3) or supported elliptic 144 * curves (TLS 1.2) extension. 145 * 146 * The "extension_data" field of a supported groups extension contains a 147 * "NamedGroupList" value (TLS 1.3 RFC8446): 148 * enum { 149 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019), 150 * x25519(0x001D), x448(0x001E), 151 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102), 152 * ffdhe6144(0x0103), ffdhe8192(0x0104), 153 * ffdhe_private_use(0x01FC..0x01FF), 154 * ecdhe_private_use(0xFE00..0xFEFF), 155 * (0xFFFF) 156 * } NamedGroup; 157 * struct { 158 * NamedGroup named_group_list<2..2^16-1>; 159 * } NamedGroupList; 160 * 161 * The "extension_data" field of a supported elliptic curves extension contains 162 * a "NamedCurveList" value (TLS 1.2 RFC 8422): 163 * enum { 164 * deprecated(1..22), 165 * secp256r1 (23), secp384r1 (24), secp521r1 (25), 166 * x25519(29), x448(30), 167 * reserved (0xFE00..0xFEFF), 168 * deprecated(0xFF01..0xFF02), 169 * (0xFFFF) 170 * } NamedCurve; 171 * struct { 172 * NamedCurve named_curve_list<2..2^16-1> 173 * } NamedCurveList; 174 * 175 * The TLS 1.3 supported groups extension was defined to be a compatible 176 * generalization of the TLS 1.2 supported elliptic curves extension. They both 177 * share the same extension identifier. 178 * 179 */ 180 MBEDTLS_CHECK_RETURN_CRITICAL 181 static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl, 182 const unsigned char *buf, 183 size_t len) 184 { 185 size_t list_size, our_size; 186 const unsigned char *p; 187 uint16_t *curves_tls_id; 188 189 if (len < 2) { 190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 192 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 193 return MBEDTLS_ERR_SSL_DECODE_ERROR; 194 } 195 list_size = MBEDTLS_GET_UINT16_BE(buf, 0); 196 if (list_size + 2 != len || 197 list_size % 2 != 0) { 198 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 199 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 200 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 201 return MBEDTLS_ERR_SSL_DECODE_ERROR; 202 } 203 204 /* Should never happen unless client duplicates the extension */ 205 if (ssl->handshake->curves_tls_id != NULL) { 206 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 207 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 208 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 209 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 210 } 211 212 /* Don't allow our peer to make us allocate too much memory, 213 * and leave room for a final 0 */ 214 our_size = list_size / 2 + 1; 215 if (our_size > MBEDTLS_ECP_DP_MAX) { 216 our_size = MBEDTLS_ECP_DP_MAX; 217 } 218 219 if ((curves_tls_id = mbedtls_calloc(our_size, 220 sizeof(*curves_tls_id))) == NULL) { 221 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 222 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR); 223 return MBEDTLS_ERR_SSL_ALLOC_FAILED; 224 } 225 226 ssl->handshake->curves_tls_id = curves_tls_id; 227 228 p = buf + 2; 229 while (list_size > 0 && our_size > 1) { 230 uint16_t curr_tls_id = MBEDTLS_GET_UINT16_BE(p, 0); 231 232 if (mbedtls_ssl_get_ecp_group_id_from_tls_id(curr_tls_id) != 233 MBEDTLS_ECP_DP_NONE) { 234 *curves_tls_id++ = curr_tls_id; 235 our_size--; 236 } 237 238 list_size -= 2; 239 p += 2; 240 } 241 242 return 0; 243 } 244 245 MBEDTLS_CHECK_RETURN_CRITICAL 246 static int ssl_parse_supported_point_formats(mbedtls_ssl_context *ssl, 247 const unsigned char *buf, 248 size_t len) 249 { 250 size_t list_size; 251 const unsigned char *p; 252 253 if (len == 0 || (size_t) (buf[0] + 1) != len) { 254 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 255 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 256 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 257 return MBEDTLS_ERR_SSL_DECODE_ERROR; 258 } 259 list_size = buf[0]; 260 261 p = buf + 1; 262 while (list_size > 0) { 263 if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || 264 p[0] == MBEDTLS_ECP_PF_COMPRESSED) { 265 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ 266 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) 267 ssl->handshake->ecdh_ctx.point_format = p[0]; 268 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */ 269 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ 270 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 271 mbedtls_ecjpake_set_point_format(&ssl->handshake->ecjpake_ctx, 272 p[0]); 273 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 274 MBEDTLS_SSL_DEBUG_MSG(4, ("point format selected: %d", p[0])); 275 return 0; 276 } 277 278 list_size--; 279 p++; 280 } 281 282 return 0; 283 } 284 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || 285 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED || 286 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 287 288 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 289 MBEDTLS_CHECK_RETURN_CRITICAL 290 static int ssl_parse_ecjpake_kkpp(mbedtls_ssl_context *ssl, 291 const unsigned char *buf, 292 size_t len) 293 { 294 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 295 296 #if defined(MBEDTLS_USE_PSA_CRYPTO) 297 if (ssl->handshake->psa_pake_ctx_is_ok != 1) 298 #else 299 if (mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0) 300 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 301 { 302 MBEDTLS_SSL_DEBUG_MSG(3, ("skip ecjpake kkpp extension")); 303 return 0; 304 } 305 306 #if defined(MBEDTLS_USE_PSA_CRYPTO) 307 if ((ret = mbedtls_psa_ecjpake_read_round( 308 &ssl->handshake->psa_pake_ctx, buf, len, 309 MBEDTLS_ECJPAKE_ROUND_ONE)) != 0) { 310 psa_destroy_key(ssl->handshake->psa_pake_password); 311 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 312 313 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round one", ret); 314 mbedtls_ssl_send_alert_message( 315 ssl, 316 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 317 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 318 319 return ret; 320 } 321 #else 322 if ((ret = mbedtls_ecjpake_read_round_one(&ssl->handshake->ecjpake_ctx, 323 buf, len)) != 0) { 324 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_one", ret); 325 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 326 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 327 return ret; 328 } 329 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 330 331 /* Only mark the extension as OK when we're sure it is */ 332 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK; 333 334 return 0; 335 } 336 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 337 338 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 339 MBEDTLS_CHECK_RETURN_CRITICAL 340 static int ssl_parse_max_fragment_length_ext(mbedtls_ssl_context *ssl, 341 const unsigned char *buf, 342 size_t len) 343 { 344 if (len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID) { 345 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 346 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 347 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 348 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 349 } 350 351 ssl->session_negotiate->mfl_code = buf[0]; 352 353 return 0; 354 } 355 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 356 357 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 358 MBEDTLS_CHECK_RETURN_CRITICAL 359 static int ssl_parse_cid_ext(mbedtls_ssl_context *ssl, 360 const unsigned char *buf, 361 size_t len) 362 { 363 size_t peer_cid_len; 364 365 /* CID extension only makes sense in DTLS */ 366 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 367 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 368 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 369 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 370 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 371 } 372 373 /* 374 * struct { 375 * opaque cid<0..2^8-1>; 376 * } ConnectionId; 377 */ 378 379 if (len < 1) { 380 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 381 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 382 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 383 return MBEDTLS_ERR_SSL_DECODE_ERROR; 384 } 385 386 peer_cid_len = *buf++; 387 len--; 388 389 if (len != peer_cid_len) { 390 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 391 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 392 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 393 return MBEDTLS_ERR_SSL_DECODE_ERROR; 394 } 395 396 /* Ignore CID if the user has disabled its use. */ 397 if (ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) { 398 /* Leave ssl->handshake->cid_in_use in its default 399 * value of MBEDTLS_SSL_CID_DISABLED. */ 400 MBEDTLS_SSL_DEBUG_MSG(3, ("Client sent CID extension, but CID disabled")); 401 return 0; 402 } 403 404 if (peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX) { 405 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 406 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 407 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 408 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 409 } 410 411 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED; 412 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len; 413 memcpy(ssl->handshake->peer_cid, buf, peer_cid_len); 414 415 MBEDTLS_SSL_DEBUG_MSG(3, ("Use of CID extension negotiated")); 416 MBEDTLS_SSL_DEBUG_BUF(3, "Client CID", buf, peer_cid_len); 417 418 return 0; 419 } 420 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 421 422 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 423 MBEDTLS_CHECK_RETURN_CRITICAL 424 static int ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context *ssl, 425 const unsigned char *buf, 426 size_t len) 427 { 428 if (len != 0) { 429 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 430 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 431 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 432 return MBEDTLS_ERR_SSL_DECODE_ERROR; 433 } 434 435 ((void) buf); 436 437 if (ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED) { 438 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; 439 } 440 441 return 0; 442 } 443 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 444 445 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 446 MBEDTLS_CHECK_RETURN_CRITICAL 447 static int ssl_parse_extended_ms_ext(mbedtls_ssl_context *ssl, 448 const unsigned char *buf, 449 size_t len) 450 { 451 if (len != 0) { 452 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 453 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 454 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 455 return MBEDTLS_ERR_SSL_DECODE_ERROR; 456 } 457 458 ((void) buf); 459 460 if (ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) { 461 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; 462 } 463 464 return 0; 465 } 466 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 467 468 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 469 MBEDTLS_CHECK_RETURN_CRITICAL 470 static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl, 471 unsigned char *buf, 472 size_t len) 473 { 474 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 475 mbedtls_ssl_session session; 476 477 mbedtls_ssl_session_init(&session); 478 479 if (ssl->conf->f_ticket_parse == NULL || 480 ssl->conf->f_ticket_write == NULL) { 481 return 0; 482 } 483 484 /* Remember the client asked us to send a new ticket */ 485 ssl->handshake->new_session_ticket = 1; 486 487 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket length: %" MBEDTLS_PRINTF_SIZET, len)); 488 489 if (len == 0) { 490 return 0; 491 } 492 493 #if defined(MBEDTLS_SSL_RENEGOTIATION) 494 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 495 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket rejected: renegotiating")); 496 return 0; 497 } 498 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 499 500 /* 501 * Failures are ok: just ignore the ticket and proceed. 502 */ 503 if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket, &session, 504 buf, len)) != 0) { 505 mbedtls_ssl_session_free(&session); 506 507 if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) { 508 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic")); 509 } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) { 510 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired")); 511 } else { 512 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_parse", ret); 513 } 514 515 return 0; 516 } 517 518 /* 519 * Keep the session ID sent by the client, since we MUST send it back to 520 * inform them we're accepting the ticket (RFC 5077 section 3.4) 521 */ 522 session.id_len = ssl->session_negotiate->id_len; 523 memcpy(&session.id, ssl->session_negotiate->id, session.id_len); 524 525 mbedtls_ssl_session_free(ssl->session_negotiate); 526 memcpy(ssl->session_negotiate, &session, sizeof(mbedtls_ssl_session)); 527 528 /* Zeroize instead of free as we copied the content */ 529 mbedtls_platform_zeroize(&session, sizeof(mbedtls_ssl_session)); 530 531 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from ticket")); 532 533 ssl->handshake->resume = 1; 534 535 /* Don't send a new ticket after all, this one is OK */ 536 ssl->handshake->new_session_ticket = 0; 537 538 return 0; 539 } 540 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 541 542 #if defined(MBEDTLS_SSL_DTLS_SRTP) 543 MBEDTLS_CHECK_RETURN_CRITICAL 544 static int ssl_parse_use_srtp_ext(mbedtls_ssl_context *ssl, 545 const unsigned char *buf, 546 size_t len) 547 { 548 mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET; 549 size_t i, j; 550 size_t profile_length; 551 uint16_t mki_length; 552 /*! 2 bytes for profile length and 1 byte for mki len */ 553 const size_t size_of_lengths = 3; 554 555 /* If use_srtp is not configured, just ignore the extension */ 556 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || 557 (ssl->conf->dtls_srtp_profile_list == NULL) || 558 (ssl->conf->dtls_srtp_profile_list_len == 0)) { 559 return 0; 560 } 561 562 /* RFC5764 section 4.1.1 563 * uint8 SRTPProtectionProfile[2]; 564 * 565 * struct { 566 * SRTPProtectionProfiles SRTPProtectionProfiles; 567 * opaque srtp_mki<0..255>; 568 * } UseSRTPData; 569 570 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>; 571 */ 572 573 /* 574 * Min length is 5: at least one protection profile(2 bytes) 575 * and length(2 bytes) + srtp_mki length(1 byte) 576 * Check here that we have at least 2 bytes of protection profiles length 577 * and one of srtp_mki length 578 */ 579 if (len < size_of_lengths) { 580 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 581 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 582 return MBEDTLS_ERR_SSL_DECODE_ERROR; 583 } 584 585 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET; 586 587 /* first 2 bytes are protection profile length(in bytes) */ 588 profile_length = (buf[0] << 8) | buf[1]; 589 buf += 2; 590 591 /* The profile length cannot be bigger than input buffer size - lengths fields */ 592 if (profile_length > len - size_of_lengths || 593 profile_length % 2 != 0) { /* profiles are 2 bytes long, so the length must be even */ 594 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 595 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 596 return MBEDTLS_ERR_SSL_DECODE_ERROR; 597 } 598 /* 599 * parse the extension list values are defined in 600 * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml 601 */ 602 for (j = 0; j < profile_length; j += 2) { 603 uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1]; 604 client_protection = mbedtls_ssl_check_srtp_profile_value(protection_profile_value); 605 606 if (client_protection != MBEDTLS_TLS_SRTP_UNSET) { 607 MBEDTLS_SSL_DEBUG_MSG(3, ("found srtp profile: %s", 608 mbedtls_ssl_get_srtp_profile_as_string( 609 client_protection))); 610 } else { 611 continue; 612 } 613 /* check if suggested profile is in our list */ 614 for (i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++) { 615 if (client_protection == ssl->conf->dtls_srtp_profile_list[i]) { 616 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i]; 617 MBEDTLS_SSL_DEBUG_MSG(3, ("selected srtp profile: %s", 618 mbedtls_ssl_get_srtp_profile_as_string( 619 client_protection))); 620 break; 621 } 622 } 623 if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET) { 624 break; 625 } 626 } 627 buf += profile_length; /* buf points to the mki length */ 628 mki_length = *buf; 629 buf++; 630 631 if (mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH || 632 mki_length + profile_length + size_of_lengths != len) { 633 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 634 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 635 return MBEDTLS_ERR_SSL_DECODE_ERROR; 636 } 637 638 /* Parse the mki only if present and mki is supported locally */ 639 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED && 640 mki_length > 0) { 641 ssl->dtls_srtp_info.mki_len = mki_length; 642 643 memcpy(ssl->dtls_srtp_info.mki_value, buf, mki_length); 644 645 MBEDTLS_SSL_DEBUG_BUF(3, "using mki", ssl->dtls_srtp_info.mki_value, 646 ssl->dtls_srtp_info.mki_len); 647 } 648 649 return 0; 650 } 651 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 652 653 /* 654 * Auxiliary functions for ServerHello parsing and related actions 655 */ 656 657 #if defined(MBEDTLS_X509_CRT_PARSE_C) 658 /* 659 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise 660 */ 661 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 662 MBEDTLS_CHECK_RETURN_CRITICAL 663 static int ssl_check_key_curve(mbedtls_pk_context *pk, 664 uint16_t *curves_tls_id) 665 { 666 uint16_t *curr_tls_id = curves_tls_id; 667 mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk); 668 mbedtls_ecp_group_id curr_grp_id; 669 670 while (*curr_tls_id != 0) { 671 curr_grp_id = mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id); 672 if (curr_grp_id == grp_id) { 673 return 0; 674 } 675 curr_tls_id++; 676 } 677 678 return -1; 679 } 680 #endif /* MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED */ 681 682 /* 683 * Try picking a certificate for this ciphersuite, 684 * return 0 on success and -1 on failure. 685 */ 686 MBEDTLS_CHECK_RETURN_CRITICAL 687 static int ssl_pick_cert(mbedtls_ssl_context *ssl, 688 const mbedtls_ssl_ciphersuite_t *ciphersuite_info) 689 { 690 mbedtls_ssl_key_cert *cur, *list; 691 #if defined(MBEDTLS_USE_PSA_CRYPTO) 692 psa_algorithm_t pk_alg = 693 mbedtls_ssl_get_ciphersuite_sig_pk_psa_alg(ciphersuite_info); 694 psa_key_usage_t pk_usage = 695 mbedtls_ssl_get_ciphersuite_sig_pk_psa_usage(ciphersuite_info); 696 #else 697 mbedtls_pk_type_t pk_alg = 698 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info); 699 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 700 uint32_t flags; 701 702 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 703 if (ssl->handshake->sni_key_cert != NULL) { 704 list = ssl->handshake->sni_key_cert; 705 } else 706 #endif 707 list = ssl->conf->key_cert; 708 709 int pk_alg_is_none = 0; 710 #if defined(MBEDTLS_USE_PSA_CRYPTO) 711 pk_alg_is_none = (pk_alg == PSA_ALG_NONE); 712 #else 713 pk_alg_is_none = (pk_alg == MBEDTLS_PK_NONE); 714 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 715 if (pk_alg_is_none) { 716 return 0; 717 } 718 719 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite requires certificate")); 720 721 if (list == NULL) { 722 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate")); 723 return -1; 724 } 725 726 for (cur = list; cur != NULL; cur = cur->next) { 727 flags = 0; 728 MBEDTLS_SSL_DEBUG_CRT(3, "candidate certificate chain, certificate", 729 cur->cert); 730 731 int key_type_matches = 0; 732 #if defined(MBEDTLS_USE_PSA_CRYPTO) 733 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 734 key_type_matches = ((ssl->conf->f_async_sign_start != NULL || 735 ssl->conf->f_async_decrypt_start != NULL || 736 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)) && 737 mbedtls_pk_can_do_ext(&cur->cert->pk, pk_alg, pk_usage)); 738 #else 739 key_type_matches = ( 740 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)); 741 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 742 #else 743 key_type_matches = mbedtls_pk_can_do(&cur->cert->pk, pk_alg); 744 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 745 if (!key_type_matches) { 746 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: key type")); 747 continue; 748 } 749 750 /* 751 * This avoids sending the client a cert it'll reject based on 752 * keyUsage or other extensions. 753 * 754 * It also allows the user to provision different certificates for 755 * different uses based on keyUsage, eg if they want to avoid signing 756 * and decrypting with the same RSA key. 757 */ 758 if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info, 759 MBEDTLS_SSL_IS_CLIENT, 760 MBEDTLS_SSL_VERSION_TLS1_2, 761 &flags) != 0) { 762 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: " 763 "(extended) key usage extension")); 764 continue; 765 } 766 767 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 768 if (pk_alg == MBEDTLS_PK_ECDSA && 769 ssl_check_key_curve(&cur->cert->pk, 770 ssl->handshake->curves_tls_id) != 0) { 771 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: elliptic curve")); 772 continue; 773 } 774 #endif 775 776 /* If we get there, we got a winner */ 777 break; 778 } 779 780 /* Do not update ssl->handshake->key_cert unless there is a match */ 781 if (cur != NULL) { 782 ssl->handshake->key_cert = cur; 783 MBEDTLS_SSL_DEBUG_CRT(3, "selected certificate chain, certificate", 784 ssl->handshake->key_cert->cert); 785 return 0; 786 } 787 788 return -1; 789 } 790 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 791 792 /* 793 * Check if a given ciphersuite is suitable for use with our config/keys/etc 794 * Sets ciphersuite_info only if the suite matches. 795 */ 796 MBEDTLS_CHECK_RETURN_CRITICAL 797 static int ssl_ciphersuite_match(mbedtls_ssl_context *ssl, int suite_id, 798 const mbedtls_ssl_ciphersuite_t **ciphersuite_info) 799 { 800 const mbedtls_ssl_ciphersuite_t *suite_info; 801 802 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 803 mbedtls_pk_type_t sig_type; 804 #endif 805 806 suite_info = mbedtls_ssl_ciphersuite_from_id(suite_id); 807 if (suite_info == NULL) { 808 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 809 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 810 } 811 812 MBEDTLS_SSL_DEBUG_MSG(3, ("trying ciphersuite: %#04x (%s)", 813 (unsigned int) suite_id, suite_info->name)); 814 815 if (suite_info->min_tls_version > ssl->tls_version || 816 suite_info->max_tls_version < ssl->tls_version) { 817 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: version")); 818 return 0; 819 } 820 821 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 822 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && 823 (ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK) == 0) { 824 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: ecjpake " 825 "not configured or ext missing")); 826 return 0; 827 } 828 #endif 829 830 831 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 832 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 833 if (mbedtls_ssl_ciphersuite_uses_ec(suite_info) && 834 (ssl->handshake->curves_tls_id == NULL || 835 ssl->handshake->curves_tls_id[0] == 0)) { 836 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: " 837 "no common elliptic curve")); 838 return 0; 839 } 840 #endif 841 842 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 843 /* If the ciphersuite requires a pre-shared key and we don't 844 * have one, skip it now rather than failing later */ 845 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) && 846 ssl_conf_has_psk_or_cb(ssl->conf) == 0) { 847 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no pre-shared key")); 848 return 0; 849 } 850 #endif 851 852 #if defined(MBEDTLS_X509_CRT_PARSE_C) 853 /* 854 * Final check: if ciphersuite requires us to have a 855 * certificate/key of a particular type: 856 * - select the appropriate certificate if we have one, or 857 * - try the next ciphersuite if we don't 858 * This must be done last since we modify the key_cert list. 859 */ 860 if (ssl_pick_cert(ssl, suite_info) != 0) { 861 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: " 862 "no suitable certificate")); 863 return 0; 864 } 865 #endif 866 867 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 868 /* If the ciphersuite requires signing, check whether 869 * a suitable hash algorithm is present. */ 870 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg(suite_info); 871 if (sig_type != MBEDTLS_PK_NONE && 872 mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( 873 ssl, mbedtls_ssl_sig_from_pk_alg(sig_type)) == MBEDTLS_SSL_HASH_NONE) { 874 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no suitable hash algorithm " 875 "for signature algorithm %u", (unsigned) sig_type)); 876 return 0; 877 } 878 879 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 880 881 *ciphersuite_info = suite_info; 882 return 0; 883 } 884 885 /* This function doesn't alert on errors that happen early during 886 ClientHello parsing because they might indicate that the client is 887 not talking SSL/TLS at all and would not understand our alert. */ 888 MBEDTLS_CHECK_RETURN_CRITICAL 889 static int ssl_parse_client_hello(mbedtls_ssl_context *ssl) 890 { 891 int ret, got_common_suite; 892 size_t i, j; 893 size_t ciph_offset, comp_offset, ext_offset; 894 size_t msg_len, ciph_len, sess_len, comp_len, ext_len; 895 #if defined(MBEDTLS_SSL_PROTO_DTLS) 896 size_t cookie_offset, cookie_len; 897 #endif 898 unsigned char *buf, *p, *ext; 899 #if defined(MBEDTLS_SSL_RENEGOTIATION) 900 int renegotiation_info_seen = 0; 901 #endif 902 int handshake_failure = 0; 903 const int *ciphersuites; 904 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 905 906 /* If there is no signature-algorithm extension present, 907 * we need to fall back to the default values for allowed 908 * signature-hash pairs. */ 909 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 910 int sig_hash_alg_ext_present = 0; 911 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 912 913 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello")); 914 915 int renegotiating; 916 917 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 918 read_record_header: 919 #endif 920 /* 921 * If renegotiating, then the input was read with mbedtls_ssl_read_record(), 922 * otherwise read it ourselves manually in order to support SSLv2 923 * ClientHello, which doesn't use the same record layer format. 924 * Otherwise in a scenario of TLS 1.3/TLS 1.2 version negotiation, the 925 * ClientHello has been already fully fetched by the TLS 1.3 code and the 926 * flag ssl->keep_current_message is raised. 927 */ 928 renegotiating = 0; 929 #if defined(MBEDTLS_SSL_RENEGOTIATION) 930 renegotiating = (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE); 931 #endif 932 if (!renegotiating && !ssl->keep_current_message) { 933 if ((ret = mbedtls_ssl_fetch_input(ssl, 5)) != 0) { 934 /* No alert on a read error. */ 935 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); 936 return ret; 937 } 938 } 939 940 buf = ssl->in_hdr; 941 942 MBEDTLS_SSL_DEBUG_BUF(4, "record header", buf, mbedtls_ssl_in_hdr_len(ssl)); 943 944 /* 945 * TLS Client Hello 946 * 947 * Record layer: 948 * 0 . 0 message type 949 * 1 . 2 protocol version 950 * 3 . 11 DTLS: epoch + record sequence number 951 * 3 . 4 message length 952 */ 953 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message type: %d", 954 buf[0])); 955 956 if (buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE) { 957 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 958 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 959 } 960 961 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message len.: %d", 962 MBEDTLS_GET_UINT16_BE(ssl->in_len, 0))); 963 964 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, protocol version: [%d:%d]", 965 buf[1], buf[2])); 966 967 /* For DTLS if this is the initial handshake, remember the client sequence 968 * number to use it in our next message (RFC 6347 4.2.1) */ 969 #if defined(MBEDTLS_SSL_PROTO_DTLS) 970 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM 971 #if defined(MBEDTLS_SSL_RENEGOTIATION) 972 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE 973 #endif 974 ) { 975 /* Epoch should be 0 for initial handshakes */ 976 if (ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0) { 977 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 978 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 979 } 980 981 memcpy(&ssl->cur_out_ctr[2], ssl->in_ctr + 2, 982 sizeof(ssl->cur_out_ctr) - 2); 983 984 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 985 if (mbedtls_ssl_dtls_replay_check(ssl) != 0) { 986 MBEDTLS_SSL_DEBUG_MSG(1, ("replayed record, discarding")); 987 ssl->next_record_offset = 0; 988 ssl->in_left = 0; 989 goto read_record_header; 990 } 991 992 /* No MAC to check yet, so we can update right now */ 993 mbedtls_ssl_dtls_replay_update(ssl); 994 #endif 995 } 996 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 997 998 msg_len = MBEDTLS_GET_UINT16_BE(ssl->in_len, 0); 999 1000 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1001 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 1002 /* Set by mbedtls_ssl_read_record() */ 1003 msg_len = ssl->in_hslen; 1004 } else 1005 #endif 1006 { 1007 if (ssl->keep_current_message) { 1008 ssl->keep_current_message = 0; 1009 } else { 1010 if (msg_len > MBEDTLS_SSL_IN_CONTENT_LEN) { 1011 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1012 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 1013 } 1014 1015 if ((ret = mbedtls_ssl_fetch_input(ssl, 1016 mbedtls_ssl_in_hdr_len(ssl) + msg_len)) != 0) { 1017 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); 1018 return ret; 1019 } 1020 1021 /* Done reading this record, get ready for the next one */ 1022 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1023 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1024 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len(ssl); 1025 } else 1026 #endif 1027 ssl->in_left = 0; 1028 } 1029 } 1030 1031 buf = ssl->in_msg; 1032 1033 MBEDTLS_SSL_DEBUG_BUF(4, "record contents", buf, msg_len); 1034 1035 ret = ssl->handshake->update_checksum(ssl, buf, msg_len); 1036 if (0 != ret) { 1037 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret); 1038 return ret; 1039 } 1040 1041 /* 1042 * Handshake layer: 1043 * 0 . 0 handshake type 1044 * 1 . 3 handshake length 1045 * 4 . 5 DTLS only: message sequence number 1046 * 6 . 8 DTLS only: fragment offset 1047 * 9 . 11 DTLS only: fragment length 1048 */ 1049 if (msg_len < mbedtls_ssl_hs_hdr_len(ssl)) { 1050 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1051 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1052 } 1053 1054 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake type: %d", buf[0])); 1055 1056 if (buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO) { 1057 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1058 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 1059 } 1060 1061 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1062 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1063 /* 1064 * Copy the client's handshake message_seq on initial handshakes, 1065 * check sequence number on renego. 1066 */ 1067 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1068 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { 1069 /* This couldn't be done in ssl_prepare_handshake_record() */ 1070 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4); 1071 if (cli_msg_seq != ssl->handshake->in_msg_seq) { 1072 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message_seq: " 1073 "%u (expected %u)", cli_msg_seq, 1074 ssl->handshake->in_msg_seq)); 1075 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1076 } 1077 1078 ssl->handshake->in_msg_seq++; 1079 } else 1080 #endif 1081 { 1082 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4); 1083 ssl->handshake->out_msg_seq = cli_msg_seq; 1084 ssl->handshake->in_msg_seq = cli_msg_seq + 1; 1085 } 1086 { 1087 /* 1088 * For now we don't support fragmentation, so make sure 1089 * fragment_offset == 0 and fragment_length == length 1090 */ 1091 size_t fragment_offset, fragment_length, length; 1092 fragment_offset = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 6); 1093 fragment_length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 9); 1094 length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 1); 1095 MBEDTLS_SSL_DEBUG_MSG( 1096 4, ("fragment_offset=%u fragment_length=%u length=%u", 1097 (unsigned) fragment_offset, (unsigned) fragment_length, 1098 (unsigned) length)); 1099 if (fragment_offset != 0 || length != fragment_length) { 1100 MBEDTLS_SSL_DEBUG_MSG(1, ("ClientHello fragmentation not supported")); 1101 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 1102 } 1103 } 1104 } 1105 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 1106 1107 buf += mbedtls_ssl_hs_hdr_len(ssl); 1108 msg_len -= mbedtls_ssl_hs_hdr_len(ssl); 1109 1110 /* 1111 * ClientHello layout: 1112 * 0 . 1 protocol version 1113 * 2 . 33 random bytes (starting with 4 bytes of Unix time) 1114 * 34 . 34 session id length (1 byte) 1115 * 35 . 34+x session id, where x = session id length from byte 34 1116 * 35+x . 35+x DTLS only: cookie length (1 byte) 1117 * 36+x . .. DTLS only: cookie 1118 * .. . .. ciphersuite list length (2 bytes) 1119 * .. . .. ciphersuite list 1120 * .. . .. compression alg. list length (1 byte) 1121 * .. . .. compression alg. list 1122 * .. . .. extensions length (2 bytes, optional) 1123 * .. . .. extensions (optional) 1124 */ 1125 1126 /* 1127 * Minimal length (with everything empty and extensions omitted) is 1128 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can 1129 * read at least up to session id length without worrying. 1130 */ 1131 if (msg_len < 38) { 1132 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1133 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1134 } 1135 1136 /* 1137 * Check and save the protocol version 1138 */ 1139 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, version", buf, 2); 1140 1141 ssl->tls_version = (mbedtls_ssl_protocol_version) mbedtls_ssl_read_version(buf, 1142 ssl->conf->transport); 1143 ssl->session_negotiate->tls_version = ssl->tls_version; 1144 ssl->session_negotiate->endpoint = ssl->conf->endpoint; 1145 1146 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) { 1147 MBEDTLS_SSL_DEBUG_MSG(1, ("server only supports TLS 1.2")); 1148 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1149 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION); 1150 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION; 1151 } 1152 1153 /* 1154 * Save client random (inc. Unix time) 1155 */ 1156 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes", buf + 2, 32); 1157 1158 memcpy(ssl->handshake->randbytes, buf + 2, 32); 1159 1160 /* 1161 * Check the session ID length and save session ID 1162 */ 1163 sess_len = buf[34]; 1164 1165 if (sess_len > sizeof(ssl->session_negotiate->id) || 1166 sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */ 1167 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1168 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1169 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1170 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1171 } 1172 1173 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id", buf + 35, sess_len); 1174 1175 ssl->session_negotiate->id_len = sess_len; 1176 memset(ssl->session_negotiate->id, 0, 1177 sizeof(ssl->session_negotiate->id)); 1178 memcpy(ssl->session_negotiate->id, buf + 35, 1179 ssl->session_negotiate->id_len); 1180 1181 /* 1182 * Check the cookie length and content 1183 */ 1184 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1185 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1186 cookie_offset = 35 + sess_len; 1187 cookie_len = buf[cookie_offset]; 1188 1189 if (cookie_offset + 1 + cookie_len + 2 > msg_len) { 1190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1192 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1193 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1194 } 1195 1196 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie", 1197 buf + cookie_offset + 1, cookie_len); 1198 1199 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 1200 if (ssl->conf->f_cookie_check != NULL 1201 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1202 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE 1203 #endif 1204 ) { 1205 if (ssl->conf->f_cookie_check(ssl->conf->p_cookie, 1206 buf + cookie_offset + 1, cookie_len, 1207 ssl->cli_id, ssl->cli_id_len) != 0) { 1208 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification failed")); 1209 ssl->handshake->cookie_verify_result = 1; 1210 } else { 1211 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification passed")); 1212 ssl->handshake->cookie_verify_result = 0; 1213 } 1214 } else 1215 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 1216 { 1217 /* We know we didn't send a cookie, so it should be empty */ 1218 if (cookie_len != 0) { 1219 /* This may be an attacker's probe, so don't send an alert */ 1220 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1221 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1222 } 1223 1224 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification skipped")); 1225 } 1226 1227 /* 1228 * Check the ciphersuitelist length (will be parsed later) 1229 */ 1230 ciph_offset = cookie_offset + 1 + cookie_len; 1231 } else 1232 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 1233 ciph_offset = 35 + sess_len; 1234 1235 ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset); 1236 1237 if (ciph_len < 2 || 1238 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */ 1239 (ciph_len % 2) != 0) { 1240 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1241 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1242 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1243 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1244 } 1245 1246 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, ciphersuitelist", 1247 buf + ciph_offset + 2, ciph_len); 1248 1249 /* 1250 * Check the compression algorithm's length. 1251 * The list contents are ignored because implementing 1252 * MBEDTLS_SSL_COMPRESS_NULL is mandatory and is the only 1253 * option supported by Mbed TLS. 1254 */ 1255 comp_offset = ciph_offset + 2 + ciph_len; 1256 1257 comp_len = buf[comp_offset]; 1258 1259 if (comp_len < 1 || 1260 comp_len > 16 || 1261 comp_len + comp_offset + 1 > msg_len) { 1262 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1263 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1264 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1265 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1266 } 1267 1268 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, compression", 1269 buf + comp_offset + 1, comp_len); 1270 1271 /* 1272 * Check the extension length 1273 */ 1274 ext_offset = comp_offset + 1 + comp_len; 1275 if (msg_len > ext_offset) { 1276 if (msg_len < ext_offset + 2) { 1277 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1278 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1279 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1280 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1281 } 1282 1283 ext_len = MBEDTLS_GET_UINT16_BE(buf, ext_offset); 1284 1285 if (msg_len != ext_offset + 2 + ext_len) { 1286 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1287 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1288 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1289 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1290 } 1291 } else { 1292 ext_len = 0; 1293 } 1294 1295 ext = buf + ext_offset + 2; 1296 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", ext, ext_len); 1297 1298 while (ext_len != 0) { 1299 unsigned int ext_id; 1300 unsigned int ext_size; 1301 if (ext_len < 4) { 1302 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1303 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1304 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1305 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1306 } 1307 ext_id = MBEDTLS_GET_UINT16_BE(ext, 0); 1308 ext_size = MBEDTLS_GET_UINT16_BE(ext, 2); 1309 1310 if (ext_size + 4 > ext_len) { 1311 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1312 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1313 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1314 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1315 } 1316 switch (ext_id) { 1317 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 1318 case MBEDTLS_TLS_EXT_SERVERNAME: 1319 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension")); 1320 ret = mbedtls_ssl_parse_server_name_ext(ssl, ext + 4, 1321 ext + 4 + ext_size); 1322 if (ret != 0) { 1323 return ret; 1324 } 1325 break; 1326 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 1327 1328 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: 1329 MBEDTLS_SSL_DEBUG_MSG(3, ("found renegotiation extension")); 1330 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1331 renegotiation_info_seen = 1; 1332 #endif 1333 1334 ret = ssl_parse_renegotiation_info(ssl, ext + 4, ext_size); 1335 if (ret != 0) { 1336 return ret; 1337 } 1338 break; 1339 1340 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1341 case MBEDTLS_TLS_EXT_SIG_ALG: 1342 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension")); 1343 1344 ret = mbedtls_ssl_parse_sig_alg_ext(ssl, ext + 4, ext + 4 + ext_size); 1345 if (ret != 0) { 1346 return ret; 1347 } 1348 1349 sig_hash_alg_ext_present = 1; 1350 break; 1351 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1352 1353 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 1354 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 1355 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1356 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS: 1357 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported elliptic curves extension")); 1358 1359 ret = ssl_parse_supported_groups_ext(ssl, ext + 4, ext_size); 1360 if (ret != 0) { 1361 return ret; 1362 } 1363 break; 1364 1365 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: 1366 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported point formats extension")); 1367 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT; 1368 1369 ret = ssl_parse_supported_point_formats(ssl, ext + 4, ext_size); 1370 if (ret != 0) { 1371 return ret; 1372 } 1373 break; 1374 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || \ 1375 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED || 1376 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1377 1378 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1379 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: 1380 MBEDTLS_SSL_DEBUG_MSG(3, ("found ecjpake kkpp extension")); 1381 1382 ret = ssl_parse_ecjpake_kkpp(ssl, ext + 4, ext_size); 1383 if (ret != 0) { 1384 return ret; 1385 } 1386 break; 1387 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1388 1389 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 1390 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: 1391 MBEDTLS_SSL_DEBUG_MSG(3, ("found max fragment length extension")); 1392 1393 ret = ssl_parse_max_fragment_length_ext(ssl, ext + 4, ext_size); 1394 if (ret != 0) { 1395 return ret; 1396 } 1397 break; 1398 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 1399 1400 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 1401 case MBEDTLS_TLS_EXT_CID: 1402 MBEDTLS_SSL_DEBUG_MSG(3, ("found CID extension")); 1403 1404 ret = ssl_parse_cid_ext(ssl, ext + 4, ext_size); 1405 if (ret != 0) { 1406 return ret; 1407 } 1408 break; 1409 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 1410 1411 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 1412 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: 1413 MBEDTLS_SSL_DEBUG_MSG(3, ("found encrypt then mac extension")); 1414 1415 ret = ssl_parse_encrypt_then_mac_ext(ssl, ext + 4, ext_size); 1416 if (ret != 0) { 1417 return ret; 1418 } 1419 break; 1420 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 1421 1422 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 1423 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: 1424 MBEDTLS_SSL_DEBUG_MSG(3, ("found extended master secret extension")); 1425 1426 ret = ssl_parse_extended_ms_ext(ssl, ext + 4, ext_size); 1427 if (ret != 0) { 1428 return ret; 1429 } 1430 break; 1431 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 1432 1433 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 1434 case MBEDTLS_TLS_EXT_SESSION_TICKET: 1435 MBEDTLS_SSL_DEBUG_MSG(3, ("found session ticket extension")); 1436 1437 ret = ssl_parse_session_ticket_ext(ssl, ext + 4, ext_size); 1438 if (ret != 0) { 1439 return ret; 1440 } 1441 break; 1442 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 1443 1444 #if defined(MBEDTLS_SSL_ALPN) 1445 case MBEDTLS_TLS_EXT_ALPN: 1446 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension")); 1447 1448 ret = mbedtls_ssl_parse_alpn_ext(ssl, ext + 4, 1449 ext + 4 + ext_size); 1450 if (ret != 0) { 1451 return ret; 1452 } 1453 break; 1454 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 1455 1456 #if defined(MBEDTLS_SSL_DTLS_SRTP) 1457 case MBEDTLS_TLS_EXT_USE_SRTP: 1458 MBEDTLS_SSL_DEBUG_MSG(3, ("found use_srtp extension")); 1459 1460 ret = ssl_parse_use_srtp_ext(ssl, ext + 4, ext_size); 1461 if (ret != 0) { 1462 return ret; 1463 } 1464 break; 1465 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 1466 1467 default: 1468 MBEDTLS_SSL_DEBUG_MSG(3, ("unknown extension found: %u (ignoring)", 1469 ext_id)); 1470 } 1471 1472 ext_len -= 4 + ext_size; 1473 ext += 4 + ext_size; 1474 } 1475 1476 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1477 1478 /* 1479 * Try to fall back to default hash SHA1 if the client 1480 * hasn't provided any preferred signature-hash combinations. 1481 */ 1482 if (!sig_hash_alg_ext_present) { 1483 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs; 1484 const uint16_t default_sig_algs[] = { 1485 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 1486 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, 1487 MBEDTLS_SSL_HASH_SHA1), 1488 #endif 1489 #if defined(MBEDTLS_RSA_C) 1490 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, 1491 MBEDTLS_SSL_HASH_SHA1), 1492 #endif 1493 MBEDTLS_TLS_SIG_NONE 1494 }; 1495 1496 MBEDTLS_STATIC_ASSERT(sizeof(default_sig_algs) / sizeof(default_sig_algs[0]) 1497 <= MBEDTLS_RECEIVED_SIG_ALGS_SIZE, 1498 "default_sig_algs is too big"); 1499 1500 memcpy(received_sig_algs, default_sig_algs, sizeof(default_sig_algs)); 1501 } 1502 1503 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1504 1505 /* 1506 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV 1507 */ 1508 for (i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2) { 1509 if (p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO) { 1510 MBEDTLS_SSL_DEBUG_MSG(3, ("received TLS_EMPTY_RENEGOTIATION_INFO ")); 1511 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1512 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { 1513 MBEDTLS_SSL_DEBUG_MSG(1, ("received RENEGOTIATION SCSV " 1514 "during renegotiation")); 1515 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1516 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1517 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1518 } 1519 #endif 1520 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; 1521 break; 1522 } 1523 } 1524 1525 /* 1526 * Renegotiation security checks 1527 */ 1528 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION && 1529 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) { 1530 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation, breaking off handshake")); 1531 handshake_failure = 1; 1532 } 1533 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1534 else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 1535 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && 1536 renegotiation_info_seen == 0) { 1537 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension missing (secure)")); 1538 handshake_failure = 1; 1539 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 1540 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 1541 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) { 1542 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation not allowed")); 1543 handshake_failure = 1; 1544 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 1545 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 1546 renegotiation_info_seen == 1) { 1547 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension present (legacy)")); 1548 handshake_failure = 1; 1549 } 1550 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 1551 1552 if (handshake_failure == 1) { 1553 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1554 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1555 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1556 } 1557 1558 /* 1559 * Server certification selection (after processing TLS extensions) 1560 */ 1561 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) { 1562 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret); 1563 return ret; 1564 } 1565 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 1566 ssl->handshake->sni_name = NULL; 1567 ssl->handshake->sni_name_len = 0; 1568 #endif 1569 1570 /* 1571 * Search for a matching ciphersuite 1572 * (At the end because we need information from the EC-based extensions 1573 * and certificate from the SNI callback triggered by the SNI extension 1574 * or certificate from server certificate selection callback.) 1575 */ 1576 got_common_suite = 0; 1577 ciphersuites = ssl->conf->ciphersuite_list; 1578 ciphersuite_info = NULL; 1579 1580 if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT) { 1581 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) { 1582 for (i = 0; ciphersuites[i] != 0; i++) { 1583 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) { 1584 continue; 1585 } 1586 1587 got_common_suite = 1; 1588 1589 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], 1590 &ciphersuite_info)) != 0) { 1591 return ret; 1592 } 1593 1594 if (ciphersuite_info != NULL) { 1595 goto have_ciphersuite; 1596 } 1597 } 1598 } 1599 } else { 1600 for (i = 0; ciphersuites[i] != 0; i++) { 1601 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) { 1602 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) { 1603 continue; 1604 } 1605 1606 got_common_suite = 1; 1607 1608 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], 1609 &ciphersuite_info)) != 0) { 1610 return ret; 1611 } 1612 1613 if (ciphersuite_info != NULL) { 1614 goto have_ciphersuite; 1615 } 1616 } 1617 } 1618 } 1619 1620 if (got_common_suite) { 1621 MBEDTLS_SSL_DEBUG_MSG(1, ("got ciphersuites in common, " 1622 "but none of them usable")); 1623 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1624 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1625 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1626 } else { 1627 MBEDTLS_SSL_DEBUG_MSG(1, ("got no ciphersuites in common")); 1628 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1629 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1630 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1631 } 1632 1633 have_ciphersuite: 1634 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %s", ciphersuite_info->name)); 1635 1636 ssl->session_negotiate->ciphersuite = ciphersuites[i]; 1637 ssl->handshake->ciphersuite_info = ciphersuite_info; 1638 1639 mbedtls_ssl_handshake_increment_state(ssl); 1640 1641 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1642 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1643 mbedtls_ssl_recv_flight_completed(ssl); 1644 } 1645 #endif 1646 1647 /* Debugging-only output for testsuite */ 1648 #if defined(MBEDTLS_DEBUG_C) && \ 1649 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1650 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg(ciphersuite_info); 1651 if (sig_alg != MBEDTLS_PK_NONE) { 1652 unsigned int sig_hash = mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( 1653 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg)); 1654 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext: %u", 1655 sig_hash)); 1656 } else { 1657 MBEDTLS_SSL_DEBUG_MSG(3, ("no hash algorithm for signature algorithm " 1658 "%u - should not happen", (unsigned) sig_alg)); 1659 } 1660 #endif 1661 1662 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello")); 1663 1664 return 0; 1665 } 1666 1667 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 1668 static void ssl_write_cid_ext(mbedtls_ssl_context *ssl, 1669 unsigned char *buf, 1670 size_t *olen) 1671 { 1672 unsigned char *p = buf; 1673 size_t ext_len; 1674 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 1675 1676 *olen = 0; 1677 1678 /* Skip writing the extension if we don't want to use it or if 1679 * the client hasn't offered it. */ 1680 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED) { 1681 return; 1682 } 1683 1684 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX 1685 * which is at most 255, so the increment cannot overflow. */ 1686 if (end < p || (size_t) (end - p) < (unsigned) (ssl->own_cid_len + 5)) { 1687 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); 1688 return; 1689 } 1690 1691 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding CID extension")); 1692 1693 /* 1694 * struct { 1695 * opaque cid<0..2^8-1>; 1696 * } ConnectionId; 1697 */ 1698 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_CID, p, 0); 1699 p += 2; 1700 ext_len = (size_t) ssl->own_cid_len + 1; 1701 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0); 1702 p += 2; 1703 1704 *p++ = (uint8_t) ssl->own_cid_len; 1705 memcpy(p, ssl->own_cid, ssl->own_cid_len); 1706 1707 *olen = ssl->own_cid_len + 5; 1708 } 1709 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 1710 1711 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) 1712 static void ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context *ssl, 1713 unsigned char *buf, 1714 size_t *olen) 1715 { 1716 unsigned char *p = buf; 1717 const mbedtls_ssl_ciphersuite_t *suite = NULL; 1718 1719 /* 1720 * RFC 7366: "If a server receives an encrypt-then-MAC request extension 1721 * from a client and then selects a stream or Authenticated Encryption 1722 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an 1723 * encrypt-then-MAC response extension back to the client." 1724 */ 1725 suite = mbedtls_ssl_ciphersuite_from_id( 1726 ssl->session_negotiate->ciphersuite); 1727 if (suite == NULL) { 1728 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; 1729 } else { 1730 mbedtls_ssl_mode_t ssl_mode = 1731 mbedtls_ssl_get_mode_from_ciphersuite( 1732 ssl->session_negotiate->encrypt_then_mac, 1733 suite); 1734 1735 if (ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM) { 1736 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; 1737 } 1738 } 1739 1740 if (ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED) { 1741 *olen = 0; 1742 return; 1743 } 1744 1745 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding encrypt then mac extension")); 1746 1747 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC, p, 0); 1748 p += 2; 1749 1750 *p++ = 0x00; 1751 *p++ = 0x00; 1752 1753 *olen = 4; 1754 } 1755 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */ 1756 1757 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 1758 static void ssl_write_extended_ms_ext(mbedtls_ssl_context *ssl, 1759 unsigned char *buf, 1760 size_t *olen) 1761 { 1762 unsigned char *p = buf; 1763 1764 if (ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED) { 1765 *olen = 0; 1766 return; 1767 } 1768 1769 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding extended master secret " 1770 "extension")); 1771 1772 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET, p, 0); 1773 p += 2; 1774 1775 *p++ = 0x00; 1776 *p++ = 0x00; 1777 1778 *olen = 4; 1779 } 1780 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 1781 1782 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 1783 static void ssl_write_session_ticket_ext(mbedtls_ssl_context *ssl, 1784 unsigned char *buf, 1785 size_t *olen) 1786 { 1787 unsigned char *p = buf; 1788 1789 if (ssl->handshake->new_session_ticket == 0) { 1790 *olen = 0; 1791 return; 1792 } 1793 1794 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding session ticket extension")); 1795 1796 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SESSION_TICKET, p, 0); 1797 p += 2; 1798 1799 *p++ = 0x00; 1800 *p++ = 0x00; 1801 1802 *olen = 4; 1803 } 1804 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 1805 1806 static void ssl_write_renegotiation_ext(mbedtls_ssl_context *ssl, 1807 unsigned char *buf, 1808 size_t *olen) 1809 { 1810 unsigned char *p = buf; 1811 1812 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION) { 1813 *olen = 0; 1814 return; 1815 } 1816 1817 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, secure renegotiation extension")); 1818 1819 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_RENEGOTIATION_INFO, p, 0); 1820 p += 2; 1821 1822 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1823 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 1824 *p++ = 0x00; 1825 *p++ = (ssl->verify_data_len * 2 + 1) & 0xFF; 1826 *p++ = ssl->verify_data_len * 2 & 0xFF; 1827 1828 memcpy(p, ssl->peer_verify_data, ssl->verify_data_len); 1829 p += ssl->verify_data_len; 1830 memcpy(p, ssl->own_verify_data, ssl->verify_data_len); 1831 p += ssl->verify_data_len; 1832 } else 1833 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 1834 { 1835 *p++ = 0x00; 1836 *p++ = 0x01; 1837 *p++ = 0x00; 1838 } 1839 1840 *olen = (size_t) (p - buf); 1841 } 1842 1843 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 1844 static void ssl_write_max_fragment_length_ext(mbedtls_ssl_context *ssl, 1845 unsigned char *buf, 1846 size_t *olen) 1847 { 1848 unsigned char *p = buf; 1849 1850 if (ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE) { 1851 *olen = 0; 1852 return; 1853 } 1854 1855 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, max_fragment_length extension")); 1856 1857 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH, p, 0); 1858 p += 2; 1859 1860 *p++ = 0x00; 1861 *p++ = 1; 1862 1863 *p++ = ssl->session_negotiate->mfl_code; 1864 1865 *olen = 5; 1866 } 1867 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 1868 1869 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 1870 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 1871 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1872 static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl, 1873 unsigned char *buf, 1874 size_t *olen) 1875 { 1876 unsigned char *p = buf; 1877 ((void) ssl); 1878 1879 if ((ssl->handshake->cli_exts & 1880 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT) == 0) { 1881 *olen = 0; 1882 return; 1883 } 1884 1885 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, supported_point_formats extension")); 1886 1887 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS, p, 0); 1888 p += 2; 1889 1890 *p++ = 0x00; 1891 *p++ = 2; 1892 1893 *p++ = 1; 1894 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; 1895 1896 *olen = 6; 1897 } 1898 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || 1899 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED || 1900 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1901 1902 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1903 static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, 1904 unsigned char *buf, 1905 size_t *olen) 1906 { 1907 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1908 unsigned char *p = buf; 1909 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 1910 size_t kkpp_len; 1911 1912 *olen = 0; 1913 1914 /* Skip costly computation if not needed */ 1915 if (ssl->handshake->ciphersuite_info->key_exchange != 1916 MBEDTLS_KEY_EXCHANGE_ECJPAKE) { 1917 return; 1918 } 1919 1920 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension")); 1921 1922 if (end - p < 4) { 1923 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); 1924 return; 1925 } 1926 1927 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0); 1928 p += 2; 1929 1930 #if defined(MBEDTLS_USE_PSA_CRYPTO) 1931 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx, 1932 p + 2, (size_t) (end - p - 2), &kkpp_len, 1933 MBEDTLS_ECJPAKE_ROUND_ONE); 1934 if (ret != 0) { 1935 psa_destroy_key(ssl->handshake->psa_pake_password); 1936 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 1937 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret); 1938 return; 1939 } 1940 #else 1941 ret = mbedtls_ecjpake_write_round_one(&ssl->handshake->ecjpake_ctx, 1942 p + 2, (size_t) (end - p - 2), &kkpp_len, 1943 ssl->conf->f_rng, ssl->conf->p_rng); 1944 if (ret != 0) { 1945 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_one", ret); 1946 return; 1947 } 1948 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 1949 1950 MBEDTLS_PUT_UINT16_BE(kkpp_len, p, 0); 1951 p += 2; 1952 1953 *olen = kkpp_len + 4; 1954 } 1955 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1956 1957 #if defined(MBEDTLS_SSL_DTLS_SRTP) && defined(MBEDTLS_SSL_PROTO_DTLS) 1958 static void ssl_write_use_srtp_ext(mbedtls_ssl_context *ssl, 1959 unsigned char *buf, 1960 size_t *olen) 1961 { 1962 size_t mki_len = 0, ext_len = 0; 1963 uint16_t profile_value = 0; 1964 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 1965 1966 *olen = 0; 1967 1968 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || 1969 (ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET)) { 1970 return; 1971 } 1972 1973 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding use_srtp extension")); 1974 1975 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED) { 1976 mki_len = ssl->dtls_srtp_info.mki_len; 1977 } 1978 1979 /* The extension total size is 9 bytes : 1980 * - 2 bytes for the extension tag 1981 * - 2 bytes for the total size 1982 * - 2 bytes for the protection profile length 1983 * - 2 bytes for the protection profile 1984 * - 1 byte for the mki length 1985 * + the actual mki length 1986 * Check we have enough room in the output buffer */ 1987 if ((size_t) (end - buf) < mki_len + 9) { 1988 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); 1989 return; 1990 } 1991 1992 /* extension */ 1993 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_USE_SRTP, buf, 0); 1994 /* 1995 * total length 5 and mki value: only one profile(2 bytes) 1996 * and length(2 bytes) and srtp_mki ) 1997 */ 1998 ext_len = 5 + mki_len; 1999 MBEDTLS_PUT_UINT16_BE(ext_len, buf, 2); 2000 2001 /* protection profile length: 2 */ 2002 buf[4] = 0x00; 2003 buf[5] = 0x02; 2004 profile_value = mbedtls_ssl_check_srtp_profile_value( 2005 ssl->dtls_srtp_info.chosen_dtls_srtp_profile); 2006 if (profile_value != MBEDTLS_TLS_SRTP_UNSET) { 2007 MBEDTLS_PUT_UINT16_BE(profile_value, buf, 6); 2008 } else { 2009 MBEDTLS_SSL_DEBUG_MSG(1, ("use_srtp extension invalid profile")); 2010 return; 2011 } 2012 2013 buf[8] = mki_len & 0xFF; 2014 memcpy(&buf[9], ssl->dtls_srtp_info.mki_value, mki_len); 2015 2016 *olen = 9 + mki_len; 2017 } 2018 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 2019 2020 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 2021 MBEDTLS_CHECK_RETURN_CRITICAL 2022 static int ssl_write_hello_verify_request(mbedtls_ssl_context *ssl) 2023 { 2024 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2025 unsigned char *p = ssl->out_msg + 4; 2026 unsigned char *cookie_len_byte; 2027 2028 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello verify request")); 2029 2030 /* 2031 * struct { 2032 * ProtocolVersion server_version; 2033 * opaque cookie<0..2^8-1>; 2034 * } HelloVerifyRequest; 2035 */ 2036 2037 /* The RFC is not clear on this point, but sending the actual negotiated 2038 * version looks like the most interoperable thing to do. */ 2039 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version); 2040 MBEDTLS_SSL_DEBUG_BUF(3, "server version", p, 2); 2041 p += 2; 2042 2043 /* If we get here, f_cookie_check is not null */ 2044 if (ssl->conf->f_cookie_write == NULL) { 2045 MBEDTLS_SSL_DEBUG_MSG(1, ("inconsistent cookie callbacks")); 2046 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 2047 } 2048 2049 /* Skip length byte until we know the length */ 2050 cookie_len_byte = p++; 2051 2052 if ((ret = ssl->conf->f_cookie_write(ssl->conf->p_cookie, 2053 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN, 2054 ssl->cli_id, ssl->cli_id_len)) != 0) { 2055 MBEDTLS_SSL_DEBUG_RET(1, "f_cookie_write", ret); 2056 return ret; 2057 } 2058 2059 *cookie_len_byte = (unsigned char) (p - (cookie_len_byte + 1)); 2060 2061 MBEDTLS_SSL_DEBUG_BUF(3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte); 2062 2063 ssl->out_msglen = (size_t) (p - ssl->out_msg); 2064 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2065 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; 2066 2067 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT); 2068 2069 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 2070 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 2071 return ret; 2072 } 2073 2074 #if defined(MBEDTLS_SSL_PROTO_DTLS) 2075 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 2076 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { 2077 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); 2078 return ret; 2079 } 2080 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 2081 2082 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello verify request")); 2083 2084 return 0; 2085 } 2086 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 2087 2088 static void ssl_handle_id_based_session_resumption(mbedtls_ssl_context *ssl) 2089 { 2090 int ret; 2091 mbedtls_ssl_session session_tmp; 2092 mbedtls_ssl_session * const session = ssl->session_negotiate; 2093 2094 /* Resume is 0 by default, see ssl_handshake_init(). 2095 * It may be already set to 1 by ssl_parse_session_ticket_ext(). */ 2096 if (ssl->handshake->resume == 1) { 2097 return; 2098 } 2099 if (session->id_len == 0) { 2100 return; 2101 } 2102 if (ssl->conf->f_get_cache == NULL) { 2103 return; 2104 } 2105 #if defined(MBEDTLS_SSL_RENEGOTIATION) 2106 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 2107 return; 2108 } 2109 #endif 2110 2111 mbedtls_ssl_session_init(&session_tmp); 2112 2113 ret = ssl->conf->f_get_cache(ssl->conf->p_cache, 2114 session->id, 2115 session->id_len, 2116 &session_tmp); 2117 if (ret != 0) { 2118 goto exit; 2119 } 2120 2121 if (session->ciphersuite != session_tmp.ciphersuite) { 2122 /* Mismatch between cached and negotiated session */ 2123 goto exit; 2124 } 2125 2126 /* Move semantics */ 2127 mbedtls_ssl_session_free(session); 2128 *session = session_tmp; 2129 memset(&session_tmp, 0, sizeof(session_tmp)); 2130 2131 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from cache")); 2132 ssl->handshake->resume = 1; 2133 2134 exit: 2135 2136 mbedtls_ssl_session_free(&session_tmp); 2137 } 2138 2139 MBEDTLS_CHECK_RETURN_CRITICAL 2140 static int ssl_write_server_hello(mbedtls_ssl_context *ssl) 2141 { 2142 #if defined(MBEDTLS_HAVE_TIME) 2143 mbedtls_time_t t; 2144 #endif 2145 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2146 size_t olen, ext_len = 0, n; 2147 unsigned char *buf, *p; 2148 2149 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello")); 2150 2151 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 2152 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 2153 ssl->handshake->cookie_verify_result != 0) { 2154 MBEDTLS_SSL_DEBUG_MSG(2, ("client hello was not authenticated")); 2155 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello")); 2156 2157 return ssl_write_hello_verify_request(ssl); 2158 } 2159 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 2160 2161 /* 2162 * 0 . 0 handshake type 2163 * 1 . 3 handshake length 2164 * 4 . 5 protocol version 2165 * 6 . 9 UNIX time() 2166 * 10 . 37 random bytes 2167 */ 2168 buf = ssl->out_msg; 2169 p = buf + 4; 2170 2171 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version); 2172 p += 2; 2173 2174 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen version: [%d:%d]", 2175 buf[4], buf[5])); 2176 2177 #if defined(MBEDTLS_HAVE_TIME) 2178 t = mbedtls_time(NULL); 2179 MBEDTLS_PUT_UINT32_BE(t, p, 0); 2180 p += 4; 2181 2182 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, current time: %" MBEDTLS_PRINTF_LONGLONG, 2183 (long long) t)); 2184 #else 2185 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 4)) != 0) { 2186 return ret; 2187 } 2188 2189 p += 4; 2190 #endif /* MBEDTLS_HAVE_TIME */ 2191 2192 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 20)) != 0) { 2193 return ret; 2194 } 2195 p += 20; 2196 2197 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 2198 /* 2199 * RFC 8446 2200 * TLS 1.3 has a downgrade protection mechanism embedded in the server's 2201 * random value. TLS 1.3 servers which negotiate TLS 1.2 or below in 2202 * response to a ClientHello MUST set the last 8 bytes of their Random 2203 * value specially in their ServerHello. 2204 */ 2205 if (mbedtls_ssl_conf_is_tls13_enabled(ssl->conf)) { 2206 static const unsigned char magic_tls12_downgrade_string[] = 2207 { 'D', 'O', 'W', 'N', 'G', 'R', 'D', 1 }; 2208 2209 MBEDTLS_STATIC_ASSERT( 2210 sizeof(magic_tls12_downgrade_string) == 8, 2211 "magic_tls12_downgrade_string does not have the expected size"); 2212 2213 memcpy(p, magic_tls12_downgrade_string, 2214 sizeof(magic_tls12_downgrade_string)); 2215 } else 2216 #endif 2217 { 2218 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 8)) != 0) { 2219 return ret; 2220 } 2221 } 2222 p += 8; 2223 2224 memcpy(ssl->handshake->randbytes + 32, buf + 6, 32); 2225 2226 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", buf + 6, 32); 2227 2228 ssl_handle_id_based_session_resumption(ssl); 2229 2230 if (ssl->handshake->resume == 0) { 2231 /* 2232 * New session, create a new session id, 2233 * unless we're about to issue a session ticket 2234 */ 2235 mbedtls_ssl_handshake_increment_state(ssl); 2236 2237 #if defined(MBEDTLS_HAVE_TIME) 2238 ssl->session_negotiate->start = mbedtls_time(NULL); 2239 #endif 2240 2241 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 2242 if (ssl->handshake->new_session_ticket != 0) { 2243 ssl->session_negotiate->id_len = n = 0; 2244 memset(ssl->session_negotiate->id, 0, 32); 2245 } else 2246 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 2247 { 2248 ssl->session_negotiate->id_len = n = 32; 2249 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, ssl->session_negotiate->id, 2250 n)) != 0) { 2251 return ret; 2252 } 2253 } 2254 } else { 2255 /* 2256 * Resuming a session 2257 */ 2258 n = ssl->session_negotiate->id_len; 2259 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC); 2260 2261 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) { 2262 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret); 2263 return ret; 2264 } 2265 } 2266 2267 /* 2268 * 38 . 38 session id length 2269 * 39 . 38+n session id 2270 * 39+n . 40+n chosen ciphersuite 2271 * 41+n . 41+n chosen compression alg. 2272 * 42+n . 43+n extensions length 2273 * 44+n . 43+n+m extensions 2274 */ 2275 *p++ = (unsigned char) ssl->session_negotiate->id_len; 2276 memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len); 2277 p += ssl->session_negotiate->id_len; 2278 2279 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n)); 2280 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, session id", buf + 39, n); 2281 MBEDTLS_SSL_DEBUG_MSG(3, ("%s session has been resumed", 2282 ssl->handshake->resume ? "a" : "no")); 2283 2284 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0); 2285 p += 2; 2286 *p++ = MBEDTLS_BYTE_0(MBEDTLS_SSL_COMPRESS_NULL); 2287 2288 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen ciphersuite: %s", 2289 mbedtls_ssl_get_ciphersuite_name(ssl->session_negotiate->ciphersuite))); 2290 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, compress alg.: 0x%02X", 2291 (unsigned int) MBEDTLS_SSL_COMPRESS_NULL)); 2292 2293 /* 2294 * First write extensions, then the total length 2295 */ 2296 ssl_write_renegotiation_ext(ssl, p + 2 + ext_len, &olen); 2297 ext_len += olen; 2298 2299 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 2300 ssl_write_max_fragment_length_ext(ssl, p + 2 + ext_len, &olen); 2301 ext_len += olen; 2302 #endif 2303 2304 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 2305 ssl_write_cid_ext(ssl, p + 2 + ext_len, &olen); 2306 ext_len += olen; 2307 #endif 2308 2309 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) 2310 ssl_write_encrypt_then_mac_ext(ssl, p + 2 + ext_len, &olen); 2311 ext_len += olen; 2312 #endif 2313 2314 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 2315 ssl_write_extended_ms_ext(ssl, p + 2 + ext_len, &olen); 2316 ext_len += olen; 2317 #endif 2318 2319 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 2320 ssl_write_session_ticket_ext(ssl, p + 2 + ext_len, &olen); 2321 ext_len += olen; 2322 #endif 2323 2324 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 2325 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 2326 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 2327 const mbedtls_ssl_ciphersuite_t *suite = 2328 mbedtls_ssl_ciphersuite_from_id(ssl->session_negotiate->ciphersuite); 2329 if (suite != NULL && mbedtls_ssl_ciphersuite_uses_ec(suite)) { 2330 ssl_write_supported_point_formats_ext(ssl, p + 2 + ext_len, &olen); 2331 ext_len += olen; 2332 } 2333 #endif 2334 2335 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 2336 ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen); 2337 ext_len += olen; 2338 #endif 2339 2340 #if defined(MBEDTLS_SSL_ALPN) 2341 unsigned char *end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN - 4; 2342 if ((ret = mbedtls_ssl_write_alpn_ext(ssl, p + 2 + ext_len, end, &olen)) 2343 != 0) { 2344 return ret; 2345 } 2346 2347 ext_len += olen; 2348 #endif 2349 2350 #if defined(MBEDTLS_SSL_DTLS_SRTP) 2351 ssl_write_use_srtp_ext(ssl, p + 2 + ext_len, &olen); 2352 ext_len += olen; 2353 #endif 2354 2355 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, total extension length: %" MBEDTLS_PRINTF_SIZET, 2356 ext_len)); 2357 2358 if (ext_len > 0) { 2359 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0); 2360 p += 2 + ext_len; 2361 } 2362 2363 ssl->out_msglen = (size_t) (p - buf); 2364 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2365 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO; 2366 2367 ret = mbedtls_ssl_write_handshake_msg(ssl); 2368 2369 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello")); 2370 2371 return ret; 2372 } 2373 2374 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) 2375 MBEDTLS_CHECK_RETURN_CRITICAL 2376 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl) 2377 { 2378 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2379 ssl->handshake->ciphersuite_info; 2380 2381 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request")); 2382 2383 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { 2384 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request")); 2385 mbedtls_ssl_handshake_increment_state(ssl); 2386 return 0; 2387 } 2388 2389 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 2390 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 2391 } 2392 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 2393 MBEDTLS_CHECK_RETURN_CRITICAL 2394 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl) 2395 { 2396 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 2397 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2398 ssl->handshake->ciphersuite_info; 2399 uint16_t dn_size, total_dn_size; /* excluding length bytes */ 2400 size_t ct_len, sa_len; /* including length bytes */ 2401 unsigned char *buf, *p; 2402 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 2403 const mbedtls_x509_crt *crt; 2404 int authmode; 2405 2406 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request")); 2407 2408 mbedtls_ssl_handshake_increment_state(ssl); 2409 2410 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2411 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) { 2412 authmode = ssl->handshake->sni_authmode; 2413 } else 2414 #endif 2415 authmode = ssl->conf->authmode; 2416 2417 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info) || 2418 authmode == MBEDTLS_SSL_VERIFY_NONE) { 2419 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request")); 2420 return 0; 2421 } 2422 2423 /* 2424 * 0 . 0 handshake type 2425 * 1 . 3 handshake length 2426 * 4 . 4 cert type count 2427 * 5 .. m-1 cert types 2428 * m .. m+1 sig alg length (TLS 1.2 only) 2429 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only) 2430 * n .. n+1 length of all DNs 2431 * n+2 .. n+3 length of DN 1 2432 * n+4 .. ... Distinguished Name #1 2433 * ... .. ... length of DN 2, etc. 2434 */ 2435 buf = ssl->out_msg; 2436 p = buf + 4; 2437 2438 /* 2439 * Supported certificate types 2440 * 2441 * ClientCertificateType certificate_types<1..2^8-1>; 2442 * enum { (255) } ClientCertificateType; 2443 */ 2444 ct_len = 0; 2445 2446 #if defined(MBEDTLS_RSA_C) 2447 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN; 2448 #endif 2449 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 2450 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN; 2451 #endif 2452 2453 p[0] = (unsigned char) ct_len++; 2454 p += ct_len; 2455 2456 sa_len = 0; 2457 2458 /* 2459 * Add signature_algorithms for verify (TLS 1.2) 2460 * 2461 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; 2462 * 2463 * struct { 2464 * HashAlgorithm hash; 2465 * SignatureAlgorithm signature; 2466 * } SignatureAndHashAlgorithm; 2467 * 2468 * enum { (255) } HashAlgorithm; 2469 * enum { (255) } SignatureAlgorithm; 2470 */ 2471 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl); 2472 if (sig_alg == NULL) { 2473 return MBEDTLS_ERR_SSL_BAD_CONFIG; 2474 } 2475 2476 for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) { 2477 unsigned char hash = MBEDTLS_BYTE_1(*sig_alg); 2478 2479 if (mbedtls_ssl_set_calc_verify_md(ssl, hash)) { 2480 continue; 2481 } 2482 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) { 2483 continue; 2484 } 2485 2486 /* Write elements at offsets starting from 1 (offset 0 is for the 2487 * length). Thus the offset of each element is the length of the 2488 * partial list including that element. */ 2489 sa_len += 2; 2490 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, sa_len); 2491 2492 } 2493 2494 /* Fill in list length. */ 2495 MBEDTLS_PUT_UINT16_BE(sa_len, p, 0); 2496 sa_len += 2; 2497 p += sa_len; 2498 2499 /* 2500 * DistinguishedName certificate_authorities<0..2^16-1>; 2501 * opaque DistinguishedName<1..2^16-1>; 2502 */ 2503 p += 2; 2504 2505 total_dn_size = 0; 2506 2507 if (ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED) { 2508 /* NOTE: If trusted certificates are provisioned 2509 * via a CA callback (configured through 2510 * `mbedtls_ssl_conf_ca_cb()`, then the 2511 * CertificateRequest is currently left empty. */ 2512 2513 #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) 2514 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2515 if (ssl->handshake->dn_hints != NULL) { 2516 crt = ssl->handshake->dn_hints; 2517 } else 2518 #endif 2519 if (ssl->conf->dn_hints != NULL) { 2520 crt = ssl->conf->dn_hints; 2521 } else 2522 #endif 2523 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2524 if (ssl->handshake->sni_ca_chain != NULL) { 2525 crt = ssl->handshake->sni_ca_chain; 2526 } else 2527 #endif 2528 crt = ssl->conf->ca_chain; 2529 2530 while (crt != NULL && crt->version != 0) { 2531 /* It follows from RFC 5280 A.1 that this length 2532 * can be represented in at most 11 bits. */ 2533 dn_size = (uint16_t) crt->subject_raw.len; 2534 2535 if (end < p || (size_t) (end - p) < 2 + (size_t) dn_size) { 2536 MBEDTLS_SSL_DEBUG_MSG(1, ("skipping CAs: buffer too short")); 2537 break; 2538 } 2539 2540 MBEDTLS_PUT_UINT16_BE(dn_size, p, 0); 2541 p += 2; 2542 memcpy(p, crt->subject_raw.p, dn_size); 2543 p += dn_size; 2544 2545 MBEDTLS_SSL_DEBUG_BUF(3, "requested DN", p - dn_size, dn_size); 2546 2547 total_dn_size += (unsigned short) (2 + dn_size); 2548 crt = crt->next; 2549 } 2550 } 2551 2552 ssl->out_msglen = (size_t) (p - buf); 2553 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2554 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST; 2555 MBEDTLS_PUT_UINT16_BE(total_dn_size, ssl->out_msg, 4 + ct_len + sa_len); 2556 2557 ret = mbedtls_ssl_write_handshake_msg(ssl); 2558 2559 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request")); 2560 2561 return ret; 2562 } 2563 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 2564 2565 #if (defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 2566 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)) 2567 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2568 MBEDTLS_CHECK_RETURN_CRITICAL 2569 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) 2570 { 2571 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2572 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 2573 mbedtls_pk_context *pk; 2574 mbedtls_pk_type_t pk_type; 2575 psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; 2576 unsigned char buf[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; 2577 size_t key_len; 2578 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2579 uint16_t tls_id = 0; 2580 psa_key_type_t key_type = PSA_KEY_TYPE_NONE; 2581 mbedtls_ecp_group_id grp_id; 2582 mbedtls_ecp_keypair *key; 2583 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */ 2584 2585 pk = mbedtls_ssl_own_key(ssl); 2586 2587 if (pk == NULL) { 2588 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; 2589 } 2590 2591 pk_type = mbedtls_pk_get_type(pk); 2592 2593 switch (pk_type) { 2594 case MBEDTLS_PK_OPAQUE: 2595 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2596 case MBEDTLS_PK_ECKEY: 2597 case MBEDTLS_PK_ECKEY_DH: 2598 case MBEDTLS_PK_ECDSA: 2599 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ 2600 if (!mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) { 2601 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; 2602 } 2603 2604 /* Get the attributes of the key previously parsed by PK module in 2605 * order to extract its type and length (in bits). */ 2606 status = psa_get_key_attributes(pk->priv_id, &key_attributes); 2607 if (status != PSA_SUCCESS) { 2608 ret = PSA_TO_MBEDTLS_ERR(status); 2609 goto exit; 2610 } 2611 ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes); 2612 ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes); 2613 2614 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2615 if (pk_type != MBEDTLS_PK_OPAQUE) { 2616 /* PK_ECKEY[_DH] and PK_ECDSA instead as parsed from the PK 2617 * module and only have ECDSA capabilities. Since we need 2618 * them for ECDH later, we export and then re-import them with 2619 * proper flags and algorithm. Of course We also set key's type 2620 * and bits that we just got above. */ 2621 key_attributes = psa_key_attributes_init(); 2622 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 2623 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 2624 psa_set_key_type(&key_attributes, 2625 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type)); 2626 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits); 2627 2628 status = psa_export_key(pk->priv_id, buf, sizeof(buf), &key_len); 2629 if (status != PSA_SUCCESS) { 2630 ret = PSA_TO_MBEDTLS_ERR(status); 2631 goto exit; 2632 } 2633 status = psa_import_key(&key_attributes, buf, key_len, 2634 &ssl->handshake->xxdh_psa_privkey); 2635 if (status != PSA_SUCCESS) { 2636 ret = PSA_TO_MBEDTLS_ERR(status); 2637 goto exit; 2638 } 2639 2640 /* Set this key as owned by the TLS library: it will be its duty 2641 * to clear it exit. */ 2642 ssl->handshake->xxdh_psa_privkey_is_external = 0; 2643 2644 ret = 0; 2645 break; 2646 } 2647 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ 2648 2649 /* Opaque key is created by the user (externally from Mbed TLS) 2650 * so we assume it already has the right algorithm and flags 2651 * set. Just copy its ID as reference. */ 2652 ssl->handshake->xxdh_psa_privkey = pk->priv_id; 2653 ssl->handshake->xxdh_psa_privkey_is_external = 1; 2654 ret = 0; 2655 break; 2656 2657 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2658 case MBEDTLS_PK_ECKEY: 2659 case MBEDTLS_PK_ECKEY_DH: 2660 case MBEDTLS_PK_ECDSA: 2661 key = mbedtls_pk_ec_rw(*pk); 2662 grp_id = mbedtls_pk_get_ec_group_id(pk); 2663 if (grp_id == MBEDTLS_ECP_DP_NONE) { 2664 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; 2665 } 2666 tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id); 2667 if (tls_id == 0) { 2668 /* This elliptic curve is not supported */ 2669 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 2670 } 2671 2672 /* If the above conversion to TLS ID was fine, then also this one will 2673 be, so there is no need to check the return value here */ 2674 mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id, &key_type, 2675 &ssl->handshake->xxdh_psa_bits); 2676 2677 ssl->handshake->xxdh_psa_type = key_type; 2678 2679 key_attributes = psa_key_attributes_init(); 2680 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 2681 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 2682 psa_set_key_type(&key_attributes, 2683 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type)); 2684 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits); 2685 2686 ret = mbedtls_ecp_write_key_ext(key, &key_len, buf, sizeof(buf)); 2687 if (ret != 0) { 2688 mbedtls_platform_zeroize(buf, sizeof(buf)); 2689 break; 2690 } 2691 2692 status = psa_import_key(&key_attributes, buf, key_len, 2693 &ssl->handshake->xxdh_psa_privkey); 2694 if (status != PSA_SUCCESS) { 2695 ret = PSA_TO_MBEDTLS_ERR(status); 2696 mbedtls_platform_zeroize(buf, sizeof(buf)); 2697 break; 2698 } 2699 2700 mbedtls_platform_zeroize(buf, sizeof(buf)); 2701 ret = 0; 2702 break; 2703 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */ 2704 default: 2705 ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; 2706 } 2707 2708 exit: 2709 psa_reset_key_attributes(&key_attributes); 2710 mbedtls_platform_zeroize(buf, sizeof(buf)); 2711 2712 return ret; 2713 } 2714 #else /* MBEDTLS_USE_PSA_CRYPTO */ 2715 MBEDTLS_CHECK_RETURN_CRITICAL 2716 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) 2717 { 2718 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2719 2720 const mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl); 2721 if (private_key == NULL) { 2722 MBEDTLS_SSL_DEBUG_MSG(1, ("got no server private key")); 2723 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 2724 } 2725 2726 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_ECKEY)) { 2727 MBEDTLS_SSL_DEBUG_MSG(1, ("server key not ECDH capable")); 2728 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; 2729 } 2730 2731 if ((ret = mbedtls_ecdh_get_params(&ssl->handshake->ecdh_ctx, 2732 mbedtls_pk_ec_ro(*mbedtls_ssl_own_key(ssl)), 2733 MBEDTLS_ECDH_OURS)) != 0) { 2734 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecdh_get_params"), ret); 2735 return ret; 2736 } 2737 2738 return 0; 2739 } 2740 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 2741 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || 2742 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 2743 2744 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ 2745 defined(MBEDTLS_SSL_ASYNC_PRIVATE) 2746 MBEDTLS_CHECK_RETURN_CRITICAL 2747 static int ssl_resume_server_key_exchange(mbedtls_ssl_context *ssl, 2748 size_t *signature_len) 2749 { 2750 /* Append the signature to ssl->out_msg, leaving 2 bytes for the 2751 * signature length which will be added in ssl_write_server_key_exchange 2752 * after the call to ssl_prepare_server_key_exchange. 2753 * ssl_write_server_key_exchange also takes care of incrementing 2754 * ssl->out_msglen. */ 2755 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2; 2756 size_t sig_max_len = (ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN 2757 - sig_start); 2758 int ret = ssl->conf->f_async_resume(ssl, 2759 sig_start, signature_len, sig_max_len); 2760 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 2761 ssl->handshake->async_in_progress = 0; 2762 mbedtls_ssl_set_async_operation_data(ssl, NULL); 2763 } 2764 MBEDTLS_SSL_DEBUG_RET(2, "ssl_resume_server_key_exchange", ret); 2765 return ret; 2766 } 2767 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && 2768 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ 2769 2770 /* Prepare the ServerKeyExchange message, up to and including 2771 * calculating the signature if any, but excluding formatting the 2772 * signature and sending the message. */ 2773 MBEDTLS_CHECK_RETURN_CRITICAL 2774 static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl, 2775 size_t *signature_len) 2776 { 2777 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2778 ssl->handshake->ciphersuite_info; 2779 2780 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) 2781 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2782 unsigned char *dig_signed = NULL; 2783 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 2784 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ 2785 2786 (void) ciphersuite_info; /* unused in some configurations */ 2787 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2788 (void) signature_len; 2789 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 2790 2791 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2792 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 2793 size_t out_buf_len = ssl->out_buf_len - (size_t) (ssl->out_msg - ssl->out_buf); 2794 #else 2795 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN - (size_t) (ssl->out_msg - ssl->out_buf); 2796 #endif 2797 #endif 2798 2799 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */ 2800 2801 /* 2802 * 2803 * Part 1: Provide key exchange parameters for chosen ciphersuite. 2804 * 2805 */ 2806 2807 /* 2808 * - ECJPAKE key exchanges 2809 */ 2810 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 2811 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { 2812 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2813 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2814 unsigned char *out_p = ssl->out_msg + ssl->out_msglen; 2815 unsigned char *end_p = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN - 2816 ssl->out_msglen; 2817 size_t output_offset = 0; 2818 size_t output_len = 0; 2819 2820 /* 2821 * The first 3 bytes are: 2822 * [0] MBEDTLS_ECP_TLS_NAMED_CURVE 2823 * [1, 2] elliptic curve's TLS ID 2824 * 2825 * However since we only support secp256r1 for now, we hardcode its 2826 * TLS ID here 2827 */ 2828 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( 2829 MBEDTLS_ECP_DP_SECP256R1); 2830 if (tls_id == 0) { 2831 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 2832 } 2833 *out_p = MBEDTLS_ECP_TLS_NAMED_CURVE; 2834 MBEDTLS_PUT_UINT16_BE(tls_id, out_p, 1); 2835 output_offset += 3; 2836 2837 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx, 2838 out_p + output_offset, 2839 end_p - out_p - output_offset, &output_len, 2840 MBEDTLS_ECJPAKE_ROUND_TWO); 2841 if (ret != 0) { 2842 psa_destroy_key(ssl->handshake->psa_pake_password); 2843 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 2844 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret); 2845 return ret; 2846 } 2847 2848 output_offset += output_len; 2849 ssl->out_msglen += output_offset; 2850 #else 2851 size_t len = 0; 2852 2853 ret = mbedtls_ecjpake_write_round_two( 2854 &ssl->handshake->ecjpake_ctx, 2855 ssl->out_msg + ssl->out_msglen, 2856 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len, 2857 ssl->conf->f_rng, ssl->conf->p_rng); 2858 if (ret != 0) { 2859 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_two", ret); 2860 return ret; 2861 } 2862 2863 ssl->out_msglen += len; 2864 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 2865 } 2866 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 2867 2868 /* 2869 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support 2870 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature, 2871 * we use empty support identity hints here. 2872 **/ 2873 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ 2874 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 2875 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || 2876 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { 2877 ssl->out_msg[ssl->out_msglen++] = 0x00; 2878 ssl->out_msg[ssl->out_msglen++] = 0x00; 2879 } 2880 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || 2881 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 2882 2883 /* 2884 * - DHE key exchanges 2885 */ 2886 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) 2887 if (mbedtls_ssl_ciphersuite_uses_dhe(ciphersuite_info)) { 2888 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2889 size_t len = 0; 2890 2891 if (ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL) { 2892 MBEDTLS_SSL_DEBUG_MSG(1, ("no DH parameters set")); 2893 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 2894 } 2895 2896 /* 2897 * Ephemeral DH parameters: 2898 * 2899 * struct { 2900 * opaque dh_p<1..2^16-1>; 2901 * opaque dh_g<1..2^16-1>; 2902 * opaque dh_Ys<1..2^16-1>; 2903 * } ServerDHParams; 2904 */ 2905 if ((ret = mbedtls_dhm_set_group(&ssl->handshake->dhm_ctx, 2906 &ssl->conf->dhm_P, 2907 &ssl->conf->dhm_G)) != 0) { 2908 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_set_group", ret); 2909 return ret; 2910 } 2911 2912 if ((ret = mbedtls_dhm_make_params( 2913 &ssl->handshake->dhm_ctx, 2914 (int) mbedtls_dhm_get_len(&ssl->handshake->dhm_ctx), 2915 ssl->out_msg + ssl->out_msglen, &len, 2916 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 2917 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_make_params", ret); 2918 return ret; 2919 } 2920 2921 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2922 dig_signed = ssl->out_msg + ssl->out_msglen; 2923 #endif 2924 2925 ssl->out_msglen += len; 2926 2927 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: X ", &ssl->handshake->dhm_ctx.X); 2928 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: P ", &ssl->handshake->dhm_ctx.P); 2929 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: G ", &ssl->handshake->dhm_ctx.G); 2930 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GX", &ssl->handshake->dhm_ctx.GX); 2931 } 2932 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */ 2933 2934 /* 2935 * - ECDHE key exchanges 2936 */ 2937 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) 2938 if (mbedtls_ssl_ciphersuite_uses_ecdhe(ciphersuite_info)) { 2939 /* 2940 * Ephemeral ECDH parameters: 2941 * 2942 * struct { 2943 * ECParameters curve_params; 2944 * ECPoint public; 2945 * } ServerECDHParams; 2946 */ 2947 uint16_t *curr_tls_id = ssl->handshake->curves_tls_id; 2948 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl); 2949 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2950 size_t len = 0; 2951 2952 /* Match our preference list against the offered curves */ 2953 if ((group_list == NULL) || (curr_tls_id == NULL)) { 2954 return MBEDTLS_ERR_SSL_BAD_CONFIG; 2955 } 2956 for (; *group_list != 0; group_list++) { 2957 for (curr_tls_id = ssl->handshake->curves_tls_id; 2958 *curr_tls_id != 0; curr_tls_id++) { 2959 if (*curr_tls_id == *group_list) { 2960 goto curve_matching_done; 2961 } 2962 } 2963 } 2964 2965 curve_matching_done: 2966 if (*curr_tls_id == 0) { 2967 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching curve for ECDHE")); 2968 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 2969 } 2970 2971 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDHE curve: %s", 2972 mbedtls_ssl_get_curve_name_from_tls_id(*curr_tls_id))); 2973 2974 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2975 psa_status_t status = PSA_ERROR_GENERIC_ERROR; 2976 psa_key_attributes_t key_attributes; 2977 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 2978 uint8_t *p = ssl->out_msg + ssl->out_msglen; 2979 const size_t header_size = 4; // curve_type(1), namedcurve(2), 2980 // data length(1) 2981 const size_t data_length_size = 1; 2982 psa_key_type_t key_type = PSA_KEY_TYPE_NONE; 2983 size_t ec_bits = 0; 2984 2985 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH computation.")); 2986 2987 /* Convert EC's TLS ID to PSA key type. */ 2988 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(*curr_tls_id, 2989 &key_type, 2990 &ec_bits) == PSA_ERROR_NOT_SUPPORTED) { 2991 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid ecc group parse.")); 2992 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 2993 } 2994 handshake->xxdh_psa_type = key_type; 2995 handshake->xxdh_psa_bits = ec_bits; 2996 2997 key_attributes = psa_key_attributes_init(); 2998 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 2999 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 3000 psa_set_key_type(&key_attributes, handshake->xxdh_psa_type); 3001 psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits); 3002 3003 /* 3004 * ECParameters curve_params 3005 * 3006 * First byte is curve_type, always named_curve 3007 */ 3008 *p++ = MBEDTLS_ECP_TLS_NAMED_CURVE; 3009 3010 /* 3011 * Next two bytes are the namedcurve value 3012 */ 3013 MBEDTLS_PUT_UINT16_BE(*curr_tls_id, p, 0); 3014 p += 2; 3015 3016 /* Generate ECDH private key. */ 3017 status = psa_generate_key(&key_attributes, 3018 &handshake->xxdh_psa_privkey); 3019 if (status != PSA_SUCCESS) { 3020 ret = PSA_TO_MBEDTLS_ERR(status); 3021 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret); 3022 return ret; 3023 } 3024 3025 /* 3026 * ECPoint public 3027 * 3028 * First byte is data length. 3029 * It will be filled later. p holds now the data length location. 3030 */ 3031 3032 /* Export the public part of the ECDH private key from PSA. 3033 * Make one byte space for the length. 3034 */ 3035 unsigned char *own_pubkey = p + data_length_size; 3036 3037 size_t own_pubkey_max_len = (size_t) (MBEDTLS_SSL_OUT_CONTENT_LEN 3038 - (own_pubkey - ssl->out_msg)); 3039 3040 status = psa_export_public_key(handshake->xxdh_psa_privkey, 3041 own_pubkey, own_pubkey_max_len, 3042 &len); 3043 if (status != PSA_SUCCESS) { 3044 ret = PSA_TO_MBEDTLS_ERR(status); 3045 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret); 3046 (void) psa_destroy_key(handshake->xxdh_psa_privkey); 3047 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3048 return ret; 3049 } 3050 3051 /* Store the length of the exported public key. */ 3052 *p = (uint8_t) len; 3053 3054 /* Determine full message length. */ 3055 len += header_size; 3056 #else 3057 mbedtls_ecp_group_id curr_grp_id = 3058 mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id); 3059 3060 if ((ret = mbedtls_ecdh_setup(&ssl->handshake->ecdh_ctx, 3061 curr_grp_id)) != 0) { 3062 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecp_group_load", ret); 3063 return ret; 3064 } 3065 3066 if ((ret = mbedtls_ecdh_make_params( 3067 &ssl->handshake->ecdh_ctx, &len, 3068 ssl->out_msg + ssl->out_msglen, 3069 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, 3070 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3071 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_make_params", ret); 3072 return ret; 3073 } 3074 3075 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3076 MBEDTLS_DEBUG_ECDH_Q); 3077 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3078 3079 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 3080 dig_signed = ssl->out_msg + ssl->out_msglen; 3081 #endif 3082 3083 ssl->out_msglen += len; 3084 } 3085 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */ 3086 3087 /* 3088 * 3089 * Part 2: For key exchanges involving the server signing the 3090 * exchange parameters, compute and add the signature here. 3091 * 3092 */ 3093 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 3094 if (mbedtls_ssl_ciphersuite_uses_server_signature(ciphersuite_info)) { 3095 if (dig_signed == NULL) { 3096 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3097 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3098 } 3099 3100 size_t dig_signed_len = (size_t) (ssl->out_msg + ssl->out_msglen - dig_signed); 3101 size_t hashlen = 0; 3102 unsigned char hash[MBEDTLS_MD_MAX_SIZE]; 3103 3104 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3105 3106 /* 3107 * 2.1: Choose hash algorithm: 3108 * For TLS 1.2, obey signature-hash-algorithm extension 3109 * to choose appropriate hash. 3110 */ 3111 3112 mbedtls_pk_type_t sig_alg = 3113 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info); 3114 3115 unsigned char sig_hash = 3116 (unsigned char) mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( 3117 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg)); 3118 3119 mbedtls_md_type_t md_alg = mbedtls_ssl_md_alg_from_hash(sig_hash); 3120 3121 /* For TLS 1.2, obey signature-hash-algorithm extension 3122 * (RFC 5246, Sec. 7.4.1.4.1). */ 3123 if (sig_alg == MBEDTLS_PK_NONE || md_alg == MBEDTLS_MD_NONE) { 3124 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3125 /* (... because we choose a cipher suite 3126 * only if there is a matching hash.) */ 3127 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3128 } 3129 3130 MBEDTLS_SSL_DEBUG_MSG(3, ("pick hash algorithm %u for signing", (unsigned) md_alg)); 3131 3132 /* 3133 * 2.2: Compute the hash to be signed 3134 */ 3135 if (md_alg != MBEDTLS_MD_NONE) { 3136 ret = mbedtls_ssl_get_key_exchange_md_tls1_2(ssl, hash, &hashlen, 3137 dig_signed, 3138 dig_signed_len, 3139 md_alg); 3140 if (ret != 0) { 3141 return ret; 3142 } 3143 } else { 3144 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3145 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3146 } 3147 3148 MBEDTLS_SSL_DEBUG_BUF(3, "parameters hash", hash, hashlen); 3149 3150 /* 3151 * 2.3: Compute and add the signature 3152 */ 3153 /* 3154 * We need to specify signature and hash algorithm explicitly through 3155 * a prefix to the signature. 3156 * 3157 * struct { 3158 * HashAlgorithm hash; 3159 * SignatureAlgorithm signature; 3160 * } SignatureAndHashAlgorithm; 3161 * 3162 * struct { 3163 * SignatureAndHashAlgorithm algorithm; 3164 * opaque signature<0..2^16-1>; 3165 * } DigitallySigned; 3166 * 3167 */ 3168 3169 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_hash_from_md_alg(md_alg); 3170 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_sig_from_pk_alg(sig_alg); 3171 3172 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3173 if (ssl->conf->f_async_sign_start != NULL) { 3174 ret = ssl->conf->f_async_sign_start(ssl, 3175 mbedtls_ssl_own_cert(ssl), 3176 md_alg, hash, hashlen); 3177 switch (ret) { 3178 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: 3179 /* act as if f_async_sign was null */ 3180 break; 3181 case 0: 3182 ssl->handshake->async_in_progress = 1; 3183 return ssl_resume_server_key_exchange(ssl, signature_len); 3184 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: 3185 ssl->handshake->async_in_progress = 1; 3186 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; 3187 default: 3188 MBEDTLS_SSL_DEBUG_RET(1, "f_async_sign_start", ret); 3189 return ret; 3190 } 3191 } 3192 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3193 3194 if (mbedtls_ssl_own_key(ssl) == NULL) { 3195 MBEDTLS_SSL_DEBUG_MSG(1, ("got no private key")); 3196 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 3197 } 3198 3199 /* Append the signature to ssl->out_msg, leaving 2 bytes for the 3200 * signature length which will be added in ssl_write_server_key_exchange 3201 * after the call to ssl_prepare_server_key_exchange. 3202 * ssl_write_server_key_exchange also takes care of incrementing 3203 * ssl->out_msglen. */ 3204 if ((ret = mbedtls_pk_sign(mbedtls_ssl_own_key(ssl), 3205 md_alg, hash, hashlen, 3206 ssl->out_msg + ssl->out_msglen + 2, 3207 out_buf_len - ssl->out_msglen - 2, 3208 signature_len, 3209 ssl->conf->f_rng, 3210 ssl->conf->p_rng)) != 0) { 3211 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_sign", ret); 3212 return ret; 3213 } 3214 } 3215 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 3216 3217 return 0; 3218 } 3219 3220 /* Prepare the ServerKeyExchange message and send it. For ciphersuites 3221 * that do not include a ServerKeyExchange message, do nothing. Either 3222 * way, if successful, move on to the next step in the SSL state 3223 * machine. */ 3224 MBEDTLS_CHECK_RETURN_CRITICAL 3225 static int ssl_write_server_key_exchange(mbedtls_ssl_context *ssl) 3226 { 3227 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3228 size_t signature_len = 0; 3229 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) 3230 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 3231 ssl->handshake->ciphersuite_info; 3232 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ 3233 3234 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server key exchange")); 3235 3236 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) 3237 /* Extract static ECDH parameters and abort if ServerKeyExchange 3238 * is not needed. */ 3239 if (mbedtls_ssl_ciphersuite_no_pfs(ciphersuite_info)) { 3240 /* For suites involving ECDH, extract DH parameters 3241 * from certificate at this point. */ 3242 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) 3243 if (mbedtls_ssl_ciphersuite_uses_ecdh(ciphersuite_info)) { 3244 ret = ssl_get_ecdh_params_from_cert(ssl); 3245 if (ret != 0) { 3246 MBEDTLS_SSL_DEBUG_RET(1, "ssl_get_ecdh_params_from_cert", ret); 3247 return ret; 3248 } 3249 } 3250 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ 3251 3252 /* Key exchanges not involving ephemeral keys don't use 3253 * ServerKeyExchange, so end here. */ 3254 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write server key exchange")); 3255 mbedtls_ssl_handshake_increment_state(ssl); 3256 return 0; 3257 } 3258 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ 3259 3260 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ 3261 defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3262 /* If we have already prepared the message and there is an ongoing 3263 * signature operation, resume signing. */ 3264 if (ssl->handshake->async_in_progress != 0) { 3265 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming signature operation")); 3266 ret = ssl_resume_server_key_exchange(ssl, &signature_len); 3267 } else 3268 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && 3269 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ 3270 { 3271 /* ServerKeyExchange is needed. Prepare the message. */ 3272 ret = ssl_prepare_server_key_exchange(ssl, &signature_len); 3273 } 3274 3275 if (ret != 0) { 3276 /* If we're starting to write a new message, set ssl->out_msglen 3277 * to 0. But if we're resuming after an asynchronous message, 3278 * out_msglen is the amount of data written so far and mst be 3279 * preserved. */ 3280 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 3281 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange (pending)")); 3282 } else { 3283 ssl->out_msglen = 0; 3284 } 3285 return ret; 3286 } 3287 3288 /* If there is a signature, write its length. 3289 * ssl_prepare_server_key_exchange already wrote the signature 3290 * itself at its proper place in the output buffer. */ 3291 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 3292 if (signature_len != 0) { 3293 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_1(signature_len); 3294 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_0(signature_len); 3295 3296 MBEDTLS_SSL_DEBUG_BUF(3, "my signature", 3297 ssl->out_msg + ssl->out_msglen, 3298 signature_len); 3299 3300 /* Skip over the already-written signature */ 3301 ssl->out_msglen += signature_len; 3302 } 3303 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 3304 3305 /* Add header and send. */ 3306 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 3307 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE; 3308 3309 mbedtls_ssl_handshake_increment_state(ssl); 3310 3311 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 3312 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 3313 return ret; 3314 } 3315 3316 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange")); 3317 return 0; 3318 } 3319 3320 MBEDTLS_CHECK_RETURN_CRITICAL 3321 static int ssl_write_server_hello_done(mbedtls_ssl_context *ssl) 3322 { 3323 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3324 3325 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello done")); 3326 3327 ssl->out_msglen = 4; 3328 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 3329 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE; 3330 3331 mbedtls_ssl_handshake_increment_state(ssl); 3332 3333 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3334 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 3335 mbedtls_ssl_send_flight_completed(ssl); 3336 } 3337 #endif 3338 3339 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 3340 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 3341 return ret; 3342 } 3343 3344 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3345 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 3346 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { 3347 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); 3348 return ret; 3349 } 3350 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 3351 3352 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello done")); 3353 3354 return 0; 3355 } 3356 3357 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ 3358 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 3359 MBEDTLS_CHECK_RETURN_CRITICAL 3360 static int ssl_parse_client_dh_public(mbedtls_ssl_context *ssl, unsigned char **p, 3361 const unsigned char *end) 3362 { 3363 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 3364 size_t n; 3365 3366 /* 3367 * Receive G^Y mod P, premaster = (G^Y)^X mod P 3368 */ 3369 if (*p + 2 > end) { 3370 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3371 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3372 } 3373 3374 n = MBEDTLS_GET_UINT16_BE(*p, 0); 3375 *p += 2; 3376 3377 if (*p + n > end) { 3378 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3379 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3380 } 3381 3382 if ((ret = mbedtls_dhm_read_public(&ssl->handshake->dhm_ctx, *p, n)) != 0) { 3383 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_read_public", ret); 3384 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3385 } 3386 3387 *p += n; 3388 3389 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GY", &ssl->handshake->dhm_ctx.GY); 3390 3391 return ret; 3392 } 3393 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || 3394 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 3395 3396 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ 3397 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 3398 3399 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3400 MBEDTLS_CHECK_RETURN_CRITICAL 3401 static int ssl_resume_decrypt_pms(mbedtls_ssl_context *ssl, 3402 unsigned char *peer_pms, 3403 size_t *peer_pmslen, 3404 size_t peer_pmssize) 3405 { 3406 int ret = ssl->conf->f_async_resume(ssl, 3407 peer_pms, peer_pmslen, peer_pmssize); 3408 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 3409 ssl->handshake->async_in_progress = 0; 3410 mbedtls_ssl_set_async_operation_data(ssl, NULL); 3411 } 3412 MBEDTLS_SSL_DEBUG_RET(2, "ssl_decrypt_encrypted_pms", ret); 3413 return ret; 3414 } 3415 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3416 3417 MBEDTLS_CHECK_RETURN_CRITICAL 3418 static int ssl_decrypt_encrypted_pms(mbedtls_ssl_context *ssl, 3419 const unsigned char *p, 3420 const unsigned char *end, 3421 unsigned char *peer_pms, 3422 size_t *peer_pmslen, 3423 size_t peer_pmssize) 3424 { 3425 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3426 3427 mbedtls_x509_crt *own_cert = mbedtls_ssl_own_cert(ssl); 3428 if (own_cert == NULL) { 3429 MBEDTLS_SSL_DEBUG_MSG(1, ("got no local certificate")); 3430 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE; 3431 } 3432 mbedtls_pk_context *public_key = &own_cert->pk; 3433 mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl); 3434 size_t len = mbedtls_pk_get_len(public_key); 3435 3436 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3437 /* If we have already started decoding the message and there is an ongoing 3438 * decryption operation, resume signing. */ 3439 if (ssl->handshake->async_in_progress != 0) { 3440 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming decryption operation")); 3441 return ssl_resume_decrypt_pms(ssl, 3442 peer_pms, peer_pmslen, peer_pmssize); 3443 } 3444 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3445 3446 /* 3447 * Prepare to decrypt the premaster using own private RSA key 3448 */ 3449 if (p + 2 > end) { 3450 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3451 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3452 } 3453 if (*p++ != MBEDTLS_BYTE_1(len) || 3454 *p++ != MBEDTLS_BYTE_0(len)) { 3455 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3456 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3457 } 3458 3459 if (p + len != end) { 3460 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3461 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3462 } 3463 3464 /* 3465 * Decrypt the premaster secret 3466 */ 3467 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3468 if (ssl->conf->f_async_decrypt_start != NULL) { 3469 ret = ssl->conf->f_async_decrypt_start(ssl, 3470 mbedtls_ssl_own_cert(ssl), 3471 p, len); 3472 switch (ret) { 3473 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: 3474 /* act as if f_async_decrypt_start was null */ 3475 break; 3476 case 0: 3477 ssl->handshake->async_in_progress = 1; 3478 return ssl_resume_decrypt_pms(ssl, 3479 peer_pms, 3480 peer_pmslen, 3481 peer_pmssize); 3482 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: 3483 ssl->handshake->async_in_progress = 1; 3484 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; 3485 default: 3486 MBEDTLS_SSL_DEBUG_RET(1, "f_async_decrypt_start", ret); 3487 return ret; 3488 } 3489 } 3490 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3491 3492 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_RSA)) { 3493 MBEDTLS_SSL_DEBUG_MSG(1, ("got no RSA private key")); 3494 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 3495 } 3496 3497 ret = mbedtls_pk_decrypt(private_key, p, len, 3498 peer_pms, peer_pmslen, peer_pmssize, 3499 ssl->conf->f_rng, ssl->conf->p_rng); 3500 return ret; 3501 } 3502 3503 MBEDTLS_CHECK_RETURN_CRITICAL 3504 static int ssl_parse_encrypted_pms(mbedtls_ssl_context *ssl, 3505 const unsigned char *p, 3506 const unsigned char *end, 3507 size_t pms_offset) 3508 { 3509 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3510 unsigned char *pms = ssl->handshake->premaster + pms_offset; 3511 unsigned char ver[2]; 3512 unsigned char fake_pms[48], peer_pms[48]; 3513 size_t peer_pmslen; 3514 mbedtls_ct_condition_t diff; 3515 3516 /* In case of a failure in decryption, the decryption may write less than 3517 * 2 bytes of output, but we always read the first two bytes. It doesn't 3518 * matter in the end because diff will be nonzero in that case due to 3519 * ret being nonzero, and we only care whether diff is 0. 3520 * But do initialize peer_pms and peer_pmslen for robustness anyway. This 3521 * also makes memory analyzers happy (don't access uninitialized memory, 3522 * even if it's an unsigned char). */ 3523 peer_pms[0] = peer_pms[1] = ~0; 3524 peer_pmslen = 0; 3525 3526 ret = ssl_decrypt_encrypted_pms(ssl, p, end, 3527 peer_pms, 3528 &peer_pmslen, 3529 sizeof(peer_pms)); 3530 3531 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3532 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 3533 return ret; 3534 } 3535 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3536 3537 mbedtls_ssl_write_version(ver, ssl->conf->transport, 3538 ssl->session_negotiate->tls_version); 3539 3540 /* Avoid data-dependent branches while checking for invalid 3541 * padding, to protect against timing-based Bleichenbacher-type 3542 * attacks. */ 3543 diff = mbedtls_ct_bool(ret); 3544 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pmslen, 48)); 3545 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[0], ver[0])); 3546 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[1], ver[1])); 3547 3548 /* 3549 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding 3550 * must not cause the connection to end immediately; instead, send a 3551 * bad_record_mac later in the handshake. 3552 * To protect against timing-based variants of the attack, we must 3553 * not have any branch that depends on whether the decryption was 3554 * successful. In particular, always generate the fake premaster secret, 3555 * regardless of whether it will ultimately influence the output or not. 3556 */ 3557 ret = ssl->conf->f_rng(ssl->conf->p_rng, fake_pms, sizeof(fake_pms)); 3558 if (ret != 0) { 3559 /* It's ok to abort on an RNG failure, since this does not reveal 3560 * anything about the RSA decryption. */ 3561 return ret; 3562 } 3563 3564 #if defined(MBEDTLS_SSL_DEBUG_ALL) 3565 if (diff != MBEDTLS_CT_FALSE) { 3566 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3567 } 3568 #endif 3569 3570 if (sizeof(ssl->handshake->premaster) < pms_offset || 3571 sizeof(ssl->handshake->premaster) - pms_offset < 48) { 3572 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3573 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3574 } 3575 ssl->handshake->pmslen = 48; 3576 3577 /* Set pms to either the true or the fake PMS, without 3578 * data-dependent branches. */ 3579 mbedtls_ct_memcpy_if(diff, pms, fake_pms, peer_pms, ssl->handshake->pmslen); 3580 3581 return 0; 3582 } 3583 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || 3584 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 3585 3586 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 3587 MBEDTLS_CHECK_RETURN_CRITICAL 3588 static int ssl_parse_client_psk_identity(mbedtls_ssl_context *ssl, unsigned char **p, 3589 const unsigned char *end) 3590 { 3591 int ret = 0; 3592 uint16_t n; 3593 3594 if (ssl_conf_has_psk_or_cb(ssl->conf) == 0) { 3595 MBEDTLS_SSL_DEBUG_MSG(1, ("got no pre-shared key")); 3596 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 3597 } 3598 3599 /* 3600 * Receive client pre-shared key identity name 3601 */ 3602 if (end - *p < 2) { 3603 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3604 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3605 } 3606 3607 n = MBEDTLS_GET_UINT16_BE(*p, 0); 3608 *p += 2; 3609 3610 if (n == 0 || n > end - *p) { 3611 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3612 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3613 } 3614 3615 if (ssl->conf->f_psk != NULL) { 3616 if (ssl->conf->f_psk(ssl->conf->p_psk, ssl, *p, n) != 0) { 3617 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; 3618 } 3619 } else { 3620 /* Identity is not a big secret since clients send it in the clear, 3621 * but treat it carefully anyway, just in case */ 3622 if (n != ssl->conf->psk_identity_len || 3623 mbedtls_ct_memcmp(ssl->conf->psk_identity, *p, n) != 0) { 3624 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; 3625 } 3626 } 3627 3628 if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) { 3629 MBEDTLS_SSL_DEBUG_BUF(3, "Unknown PSK identity", *p, n); 3630 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 3631 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY); 3632 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; 3633 } 3634 3635 *p += n; 3636 3637 return 0; 3638 } 3639 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ 3640 3641 MBEDTLS_CHECK_RETURN_CRITICAL 3642 static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl) 3643 { 3644 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3645 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 3646 unsigned char *p, *end; 3647 3648 ciphersuite_info = ssl->handshake->ciphersuite_info; 3649 3650 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client key exchange")); 3651 3652 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \ 3653 (defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ 3654 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)) 3655 if ((ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || 3656 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) && 3657 (ssl->handshake->async_in_progress != 0)) { 3658 /* We've already read a record and there is an asynchronous 3659 * operation in progress to decrypt it. So skip reading the 3660 * record. */ 3661 MBEDTLS_SSL_DEBUG_MSG(3, ("will resume decryption of previously-read record")); 3662 } else 3663 #endif 3664 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) { 3665 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret); 3666 return ret; 3667 } 3668 3669 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl); 3670 end = ssl->in_msg + ssl->in_hslen; 3671 3672 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) { 3673 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3674 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 3675 } 3676 3677 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE) { 3678 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3679 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 3680 } 3681 3682 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) 3683 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA) { 3684 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) { 3685 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret); 3686 return ret; 3687 } 3688 3689 if (p != end) { 3690 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); 3691 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3692 } 3693 3694 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx, 3695 ssl->handshake->premaster, 3696 MBEDTLS_PREMASTER_SIZE, 3697 &ssl->handshake->pmslen, 3698 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3699 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret); 3700 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3701 } 3702 3703 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K); 3704 } else 3705 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ 3706 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 3707 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ 3708 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 3709 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) 3710 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || 3711 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || 3712 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || 3713 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA) { 3714 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3715 size_t data_len = (size_t) (*p++); 3716 size_t buf_len = (size_t) (end - p); 3717 psa_status_t status = PSA_ERROR_GENERIC_ERROR; 3718 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 3719 3720 MBEDTLS_SSL_DEBUG_MSG(3, ("Read the peer's public key.")); 3721 3722 /* 3723 * We must have at least two bytes (1 for length, at least 1 for data) 3724 */ 3725 if (buf_len < 2) { 3726 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length: %" MBEDTLS_PRINTF_SIZET, 3727 buf_len)); 3728 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3729 } 3730 3731 if (data_len < 1 || data_len > buf_len) { 3732 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length: %" MBEDTLS_PRINTF_SIZET 3733 " > %" MBEDTLS_PRINTF_SIZET, 3734 data_len, buf_len)); 3735 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3736 } 3737 3738 /* Store peer's ECDH public key. */ 3739 if (data_len > sizeof(handshake->xxdh_psa_peerkey)) { 3740 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %" MBEDTLS_PRINTF_SIZET 3741 " > %" MBEDTLS_PRINTF_SIZET, 3742 data_len, 3743 sizeof(handshake->xxdh_psa_peerkey))); 3744 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3745 } 3746 memcpy(handshake->xxdh_psa_peerkey, p, data_len); 3747 handshake->xxdh_psa_peerkey_len = data_len; 3748 3749 /* Compute ECDH shared secret. */ 3750 status = psa_raw_key_agreement( 3751 PSA_ALG_ECDH, handshake->xxdh_psa_privkey, 3752 handshake->xxdh_psa_peerkey, handshake->xxdh_psa_peerkey_len, 3753 handshake->premaster, sizeof(handshake->premaster), 3754 &handshake->pmslen); 3755 if (status != PSA_SUCCESS) { 3756 ret = PSA_TO_MBEDTLS_ERR(status); 3757 MBEDTLS_SSL_DEBUG_RET(1, "psa_raw_key_agreement", ret); 3758 if (handshake->xxdh_psa_privkey_is_external == 0) { 3759 (void) psa_destroy_key(handshake->xxdh_psa_privkey); 3760 } 3761 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3762 return ret; 3763 } 3764 3765 if (handshake->xxdh_psa_privkey_is_external == 0) { 3766 status = psa_destroy_key(handshake->xxdh_psa_privkey); 3767 3768 if (status != PSA_SUCCESS) { 3769 ret = PSA_TO_MBEDTLS_ERR(status); 3770 MBEDTLS_SSL_DEBUG_RET(1, "psa_destroy_key", ret); 3771 return ret; 3772 } 3773 } 3774 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3775 #else 3776 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx, 3777 p, (size_t) (end - p))) != 0) { 3778 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret); 3779 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3780 } 3781 3782 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3783 MBEDTLS_DEBUG_ECDH_QP); 3784 3785 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, 3786 &ssl->handshake->pmslen, 3787 ssl->handshake->premaster, 3788 MBEDTLS_MPI_MAX_SIZE, 3789 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3790 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret); 3791 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3792 } 3793 3794 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3795 MBEDTLS_DEBUG_ECDH_Z); 3796 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3797 } else 3798 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 3799 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || 3800 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || 3801 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 3802 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) 3803 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK) { 3804 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3805 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3806 return ret; 3807 } 3808 3809 if (p != end) { 3810 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); 3811 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3812 } 3813 3814 #if !defined(MBEDTLS_USE_PSA_CRYPTO) 3815 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3816 (mbedtls_key_exchange_type_t) ciphersuite_info-> 3817 key_exchange)) != 0) { 3818 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 3819 return ret; 3820 } 3821 #endif /* !MBEDTLS_USE_PSA_CRYPTO */ 3822 } else 3823 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ 3824 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 3825 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) { 3826 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3827 if (ssl->handshake->async_in_progress != 0) { 3828 /* There is an asynchronous operation in progress to 3829 * decrypt the encrypted premaster secret, so skip 3830 * directly to resuming this operation. */ 3831 MBEDTLS_SSL_DEBUG_MSG(3, ("PSK identity already parsed")); 3832 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms 3833 * won't actually use it, but maintain p anyway for robustness. */ 3834 p += ssl->conf->psk_identity_len + 2; 3835 } else 3836 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3837 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3838 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3839 return ret; 3840 } 3841 3842 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 2)) != 0) { 3843 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_encrypted_pms"), ret); 3844 return ret; 3845 } 3846 3847 #if !defined(MBEDTLS_USE_PSA_CRYPTO) 3848 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3849 (mbedtls_key_exchange_type_t) ciphersuite_info-> 3850 key_exchange)) != 0) { 3851 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 3852 return ret; 3853 } 3854 #endif /* !MBEDTLS_USE_PSA_CRYPTO */ 3855 } else 3856 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 3857 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 3858 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK) { 3859 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3860 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3861 return ret; 3862 } 3863 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) { 3864 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret); 3865 return ret; 3866 } 3867 3868 if (p != end) { 3869 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); 3870 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3871 } 3872 3873 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3874 unsigned char *pms = ssl->handshake->premaster; 3875 unsigned char *pms_end = pms + sizeof(ssl->handshake->premaster); 3876 size_t pms_len; 3877 3878 /* Write length only when we know the actual value */ 3879 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx, 3880 pms + 2, pms_end - (pms + 2), &pms_len, 3881 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3882 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret); 3883 return ret; 3884 } 3885 MBEDTLS_PUT_UINT16_BE(pms_len, pms, 0); 3886 pms += 2 + pms_len; 3887 3888 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K); 3889 #else 3890 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3891 (mbedtls_key_exchange_type_t) ciphersuite_info-> 3892 key_exchange)) != 0) { 3893 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 3894 return ret; 3895 } 3896 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3897 } else 3898 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 3899 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 3900 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { 3901 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3902 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 3903 psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED; 3904 size_t ecpoint_len; 3905 3906 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 3907 3908 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3909 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3910 psa_destroy_key(handshake->xxdh_psa_privkey); 3911 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3912 return ret; 3913 } 3914 3915 /* Keep a copy of the peer's public key */ 3916 if (p >= end) { 3917 psa_destroy_key(handshake->xxdh_psa_privkey); 3918 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3919 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3920 } 3921 3922 ecpoint_len = *(p++); 3923 if ((size_t) (end - p) < ecpoint_len) { 3924 psa_destroy_key(handshake->xxdh_psa_privkey); 3925 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3926 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3927 } 3928 3929 /* When FFDH is enabled, the array handshake->xxdh_psa_peer_key size takes into account 3930 the sizes of the FFDH keys which are at least 2048 bits. 3931 The size of the array is thus greater than 256 bytes which is greater than any 3932 possible value of ecpoint_len (type uint8_t) and the check below can be skipped.*/ 3933 #if !defined(PSA_WANT_ALG_FFDH) 3934 if (ecpoint_len > sizeof(handshake->xxdh_psa_peerkey)) { 3935 psa_destroy_key(handshake->xxdh_psa_privkey); 3936 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3937 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3938 } 3939 #else 3940 MBEDTLS_STATIC_ASSERT(sizeof(handshake->xxdh_psa_peerkey) >= UINT8_MAX, 3941 "peer key buffer too small"); 3942 #endif 3943 3944 memcpy(handshake->xxdh_psa_peerkey, p, ecpoint_len); 3945 handshake->xxdh_psa_peerkey_len = ecpoint_len; 3946 p += ecpoint_len; 3947 3948 /* As RFC 5489 section 2, the premaster secret is formed as follows: 3949 * - a uint16 containing the length (in octets) of the ECDH computation 3950 * - the octet string produced by the ECDH computation 3951 * - a uint16 containing the length (in octets) of the PSK 3952 * - the PSK itself 3953 */ 3954 unsigned char *psm = ssl->handshake->premaster; 3955 const unsigned char * const psm_end = 3956 psm + sizeof(ssl->handshake->premaster); 3957 /* uint16 to store length (in octets) of the ECDH computation */ 3958 const size_t zlen_size = 2; 3959 size_t zlen = 0; 3960 3961 /* Compute ECDH shared secret. */ 3962 status = psa_raw_key_agreement(PSA_ALG_ECDH, 3963 handshake->xxdh_psa_privkey, 3964 handshake->xxdh_psa_peerkey, 3965 handshake->xxdh_psa_peerkey_len, 3966 psm + zlen_size, 3967 psm_end - (psm + zlen_size), 3968 &zlen); 3969 3970 destruction_status = psa_destroy_key(handshake->xxdh_psa_privkey); 3971 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3972 3973 if (status != PSA_SUCCESS) { 3974 return PSA_TO_MBEDTLS_ERR(status); 3975 } else if (destruction_status != PSA_SUCCESS) { 3976 return PSA_TO_MBEDTLS_ERR(destruction_status); 3977 } 3978 3979 /* Write the ECDH computation length before the ECDH computation */ 3980 MBEDTLS_PUT_UINT16_BE(zlen, psm, 0); 3981 psm += zlen_size + zlen; 3982 3983 #else /* MBEDTLS_USE_PSA_CRYPTO */ 3984 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3985 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3986 return ret; 3987 } 3988 3989 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx, 3990 p, (size_t) (end - p))) != 0) { 3991 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret); 3992 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3993 } 3994 3995 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3996 MBEDTLS_DEBUG_ECDH_QP); 3997 3998 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3999 (mbedtls_key_exchange_type_t) ciphersuite_info-> 4000 key_exchange)) != 0) { 4001 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 4002 return ret; 4003 } 4004 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4005 } else 4006 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 4007 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) 4008 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) { 4009 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 0)) != 0) { 4010 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_parse_encrypted_pms_secret"), ret); 4011 return ret; 4012 } 4013 } else 4014 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ 4015 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 4016 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { 4017 #if defined(MBEDTLS_USE_PSA_CRYPTO) 4018 if ((ret = mbedtls_psa_ecjpake_read_round( 4019 &ssl->handshake->psa_pake_ctx, p, (size_t) (end - p), 4020 MBEDTLS_ECJPAKE_ROUND_TWO)) != 0) { 4021 psa_destroy_key(ssl->handshake->psa_pake_password); 4022 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 4023 4024 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round two", ret); 4025 return ret; 4026 } 4027 #else 4028 ret = mbedtls_ecjpake_read_round_two(&ssl->handshake->ecjpake_ctx, 4029 p, (size_t) (end - p)); 4030 if (ret != 0) { 4031 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_two", ret); 4032 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4033 } 4034 4035 ret = mbedtls_ecjpake_derive_secret(&ssl->handshake->ecjpake_ctx, 4036 ssl->handshake->premaster, 32, &ssl->handshake->pmslen, 4037 ssl->conf->f_rng, ssl->conf->p_rng); 4038 if (ret != 0) { 4039 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_derive_secret", ret); 4040 return ret; 4041 } 4042 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4043 } else 4044 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 4045 { 4046 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 4047 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4048 } 4049 4050 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) { 4051 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret); 4052 return ret; 4053 } 4054 4055 mbedtls_ssl_handshake_increment_state(ssl); 4056 4057 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client key exchange")); 4058 4059 return 0; 4060 } 4061 4062 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) 4063 MBEDTLS_CHECK_RETURN_CRITICAL 4064 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) 4065 { 4066 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 4067 ssl->handshake->ciphersuite_info; 4068 4069 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); 4070 4071 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { 4072 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4073 mbedtls_ssl_handshake_increment_state(ssl); 4074 return 0; 4075 } 4076 4077 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 4078 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4079 } 4080 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 4081 MBEDTLS_CHECK_RETURN_CRITICAL 4082 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) 4083 { 4084 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 4085 size_t i, sig_len; 4086 unsigned char hash[48]; 4087 unsigned char *hash_start = hash; 4088 size_t hashlen; 4089 mbedtls_pk_type_t pk_alg; 4090 mbedtls_md_type_t md_alg; 4091 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 4092 ssl->handshake->ciphersuite_info; 4093 mbedtls_pk_context *peer_pk; 4094 4095 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); 4096 4097 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { 4098 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4099 mbedtls_ssl_handshake_increment_state(ssl); 4100 return 0; 4101 } 4102 4103 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 4104 if (ssl->session_negotiate->peer_cert == NULL) { 4105 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4106 mbedtls_ssl_handshake_increment_state(ssl); 4107 return 0; 4108 } 4109 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4110 if (ssl->session_negotiate->peer_cert_digest == NULL) { 4111 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4112 mbedtls_ssl_handshake_increment_state(ssl); 4113 return 0; 4114 } 4115 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4116 4117 /* Read the message without adding it to the checksum */ 4118 ret = mbedtls_ssl_read_record(ssl, 0 /* no checksum update */); 4119 if (0 != ret) { 4120 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_read_record"), ret); 4121 return ret; 4122 } 4123 4124 mbedtls_ssl_handshake_increment_state(ssl); 4125 4126 /* Process the message contents */ 4127 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || 4128 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY) { 4129 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4130 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 4131 } 4132 4133 i = mbedtls_ssl_hs_hdr_len(ssl); 4134 4135 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 4136 peer_pk = &ssl->handshake->peer_pubkey; 4137 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4138 if (ssl->session_negotiate->peer_cert == NULL) { 4139 /* Should never happen */ 4140 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4141 } 4142 peer_pk = &ssl->session_negotiate->peer_cert->pk; 4143 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4144 4145 /* 4146 * struct { 4147 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only 4148 * opaque signature<0..2^16-1>; 4149 * } DigitallySigned; 4150 */ 4151 if (i + 2 > ssl->in_hslen) { 4152 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4153 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4154 } 4155 4156 /* 4157 * Hash 4158 */ 4159 md_alg = mbedtls_ssl_md_alg_from_hash(ssl->in_msg[i]); 4160 4161 if (md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md(ssl, ssl->in_msg[i])) { 4162 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg" 4163 " for verify message")); 4164 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 4165 } 4166 4167 #if !defined(MBEDTLS_MD_SHA1) 4168 if (MBEDTLS_MD_SHA1 == md_alg) { 4169 hash_start += 16; 4170 } 4171 #endif 4172 4173 /* Info from md_alg will be used instead */ 4174 hashlen = 0; 4175 4176 i++; 4177 4178 /* 4179 * Signature 4180 */ 4181 if ((pk_alg = mbedtls_ssl_pk_alg_from_sig(ssl->in_msg[i])) 4182 == MBEDTLS_PK_NONE) { 4183 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg" 4184 " for verify message")); 4185 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 4186 } 4187 4188 /* 4189 * Check the certificate's key type matches the signature alg 4190 */ 4191 if (!mbedtls_pk_can_do(peer_pk, pk_alg)) { 4192 MBEDTLS_SSL_DEBUG_MSG(1, ("sig_alg doesn't match cert key")); 4193 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 4194 } 4195 4196 i++; 4197 4198 if (i + 2 > ssl->in_hslen) { 4199 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4200 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4201 } 4202 4203 sig_len = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i); 4204 i += 2; 4205 4206 if (i + sig_len != ssl->in_hslen) { 4207 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4208 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4209 } 4210 4211 /* Calculate hash and verify signature */ 4212 { 4213 size_t dummy_hlen; 4214 ret = ssl->handshake->calc_verify(ssl, hash, &dummy_hlen); 4215 if (0 != ret) { 4216 MBEDTLS_SSL_DEBUG_RET(1, ("calc_verify"), ret); 4217 return ret; 4218 } 4219 } 4220 4221 if ((ret = mbedtls_pk_verify(peer_pk, 4222 md_alg, hash_start, hashlen, 4223 ssl->in_msg + i, sig_len)) != 0) { 4224 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify", ret); 4225 return ret; 4226 } 4227 4228 ret = mbedtls_ssl_update_handshake_status(ssl); 4229 if (0 != ret) { 4230 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_update_handshake_status"), ret); 4231 return ret; 4232 } 4233 4234 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify")); 4235 4236 return ret; 4237 } 4238 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 4239 4240 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 4241 MBEDTLS_CHECK_RETURN_CRITICAL 4242 static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl) 4243 { 4244 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4245 size_t tlen; 4246 uint32_t lifetime; 4247 4248 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write new session ticket")); 4249 4250 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 4251 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET; 4252 4253 /* 4254 * struct { 4255 * uint32 ticket_lifetime_hint; 4256 * opaque ticket<0..2^16-1>; 4257 * } NewSessionTicket; 4258 * 4259 * 4 . 7 ticket_lifetime_hint (0 = unspecified) 4260 * 8 . 9 ticket_len (n) 4261 * 10 . 9+n ticket content 4262 */ 4263 4264 #if defined(MBEDTLS_HAVE_TIME) 4265 ssl->session_negotiate->ticket_creation_time = mbedtls_ms_time(); 4266 #endif 4267 if ((ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket, 4268 ssl->session_negotiate, 4269 ssl->out_msg + 10, 4270 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN, 4271 &tlen, &lifetime)) != 0) { 4272 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_write", ret); 4273 tlen = 0; 4274 } 4275 4276 MBEDTLS_PUT_UINT32_BE(lifetime, ssl->out_msg, 4); 4277 MBEDTLS_PUT_UINT16_BE(tlen, ssl->out_msg, 8); 4278 ssl->out_msglen = 10 + tlen; 4279 4280 /* 4281 * Morally equivalent to updating ssl->state, but NewSessionTicket and 4282 * ChangeCipherSpec share the same state. 4283 */ 4284 ssl->handshake->new_session_ticket = 0; 4285 4286 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 4287 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 4288 return ret; 4289 } 4290 4291 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket")); 4292 4293 return 0; 4294 } 4295 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 4296 4297 /* 4298 * SSL handshake -- server side -- single step 4299 */ 4300 int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl) 4301 { 4302 int ret = 0; 4303 4304 MBEDTLS_SSL_DEBUG_MSG(2, ("server state: %d", ssl->state)); 4305 4306 switch (ssl->state) { 4307 case MBEDTLS_SSL_HELLO_REQUEST: 4308 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CLIENT_HELLO); 4309 break; 4310 4311 /* 4312 * <== ClientHello 4313 */ 4314 case MBEDTLS_SSL_CLIENT_HELLO: 4315 ret = ssl_parse_client_hello(ssl); 4316 break; 4317 4318 #if defined(MBEDTLS_SSL_PROTO_DTLS) 4319 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: 4320 return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED; 4321 #endif 4322 4323 /* 4324 * ==> ServerHello 4325 * Certificate 4326 * ( ServerKeyExchange ) 4327 * ( CertificateRequest ) 4328 * ServerHelloDone 4329 */ 4330 case MBEDTLS_SSL_SERVER_HELLO: 4331 ret = ssl_write_server_hello(ssl); 4332 break; 4333 4334 case MBEDTLS_SSL_SERVER_CERTIFICATE: 4335 ret = mbedtls_ssl_write_certificate(ssl); 4336 break; 4337 4338 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: 4339 ret = ssl_write_server_key_exchange(ssl); 4340 break; 4341 4342 case MBEDTLS_SSL_CERTIFICATE_REQUEST: 4343 ret = ssl_write_certificate_request(ssl); 4344 break; 4345 4346 case MBEDTLS_SSL_SERVER_HELLO_DONE: 4347 ret = ssl_write_server_hello_done(ssl); 4348 break; 4349 4350 /* 4351 * <== ( Certificate/Alert ) 4352 * ClientKeyExchange 4353 * ( CertificateVerify ) 4354 * ChangeCipherSpec 4355 * Finished 4356 */ 4357 case MBEDTLS_SSL_CLIENT_CERTIFICATE: 4358 ret = mbedtls_ssl_parse_certificate(ssl); 4359 break; 4360 4361 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: 4362 ret = ssl_parse_client_key_exchange(ssl); 4363 break; 4364 4365 case MBEDTLS_SSL_CERTIFICATE_VERIFY: 4366 ret = ssl_parse_certificate_verify(ssl); 4367 break; 4368 4369 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: 4370 ret = mbedtls_ssl_parse_change_cipher_spec(ssl); 4371 break; 4372 4373 case MBEDTLS_SSL_CLIENT_FINISHED: 4374 ret = mbedtls_ssl_parse_finished(ssl); 4375 break; 4376 4377 /* 4378 * ==> ( NewSessionTicket ) 4379 * ChangeCipherSpec 4380 * Finished 4381 */ 4382 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: 4383 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 4384 if (ssl->handshake->new_session_ticket != 0) { 4385 ret = ssl_write_new_session_ticket(ssl); 4386 } else 4387 #endif 4388 ret = mbedtls_ssl_write_change_cipher_spec(ssl); 4389 break; 4390 4391 case MBEDTLS_SSL_SERVER_FINISHED: 4392 ret = mbedtls_ssl_write_finished(ssl); 4393 break; 4394 4395 case MBEDTLS_SSL_FLUSH_BUFFERS: 4396 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done")); 4397 mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP); 4398 break; 4399 4400 case MBEDTLS_SSL_HANDSHAKE_WRAPUP: 4401 mbedtls_ssl_handshake_wrapup(ssl); 4402 break; 4403 4404 default: 4405 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state)); 4406 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 4407 } 4408 4409 return ret; 4410 } 4411 4412 void mbedtls_ssl_conf_preference_order(mbedtls_ssl_config *conf, int order) 4413 { 4414 conf->respect_cli_pref = order; 4415 } 4416 4417 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_2 */ 4418