1 /* 2 * TLS server-side functions 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 6 */ 7 8 #include "common.h" 9 10 #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2) 11 12 #include "mbedtls/platform.h" 13 14 #include "mbedtls/ssl.h" 15 #include "ssl_misc.h" 16 #include "debug_internal.h" 17 #include "mbedtls/error.h" 18 #include "mbedtls/platform_util.h" 19 #include "constant_time_internal.h" 20 #include "mbedtls/constant_time.h" 21 22 #include <string.h> 23 24 #if defined(MBEDTLS_USE_PSA_CRYPTO) 25 /* Define a local translating function to save code size by not using too many 26 * arguments in each translating place. */ 27 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) || \ 28 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) 29 static int local_err_translation(psa_status_t status) 30 { 31 return psa_status_to_mbedtls(status, psa_to_ssl_errors, 32 ARRAY_LENGTH(psa_to_ssl_errors), 33 psa_generic_status_to_mbedtls); 34 } 35 #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status) 36 #endif 37 #endif 38 39 #if defined(MBEDTLS_ECP_C) 40 #include "mbedtls/ecp.h" 41 #endif 42 43 #if defined(MBEDTLS_HAVE_TIME) 44 #include "mbedtls/platform_time.h" 45 #endif 46 47 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 48 int mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context *ssl, 49 const unsigned char *info, 50 size_t ilen) 51 { 52 if (ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER) { 53 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 54 } 55 56 mbedtls_free(ssl->cli_id); 57 58 if ((ssl->cli_id = mbedtls_calloc(1, ilen)) == NULL) { 59 return MBEDTLS_ERR_SSL_ALLOC_FAILED; 60 } 61 62 memcpy(ssl->cli_id, info, ilen); 63 ssl->cli_id_len = ilen; 64 65 return 0; 66 } 67 68 void mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config *conf, 69 mbedtls_ssl_cookie_write_t *f_cookie_write, 70 mbedtls_ssl_cookie_check_t *f_cookie_check, 71 void *p_cookie) 72 { 73 conf->f_cookie_write = f_cookie_write; 74 conf->f_cookie_check = f_cookie_check; 75 conf->p_cookie = p_cookie; 76 } 77 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 78 79 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 80 MBEDTLS_CHECK_RETURN_CRITICAL 81 static int ssl_conf_has_psk_or_cb(mbedtls_ssl_config const *conf) 82 { 83 if (conf->f_psk != NULL) { 84 return 1; 85 } 86 87 if (conf->psk_identity_len == 0 || conf->psk_identity == NULL) { 88 return 0; 89 } 90 91 92 #if defined(MBEDTLS_USE_PSA_CRYPTO) 93 if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) { 94 return 1; 95 } 96 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 97 98 if (conf->psk != NULL && conf->psk_len != 0) { 99 return 1; 100 } 101 102 return 0; 103 } 104 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ 105 106 MBEDTLS_CHECK_RETURN_CRITICAL 107 static int ssl_parse_renegotiation_info(mbedtls_ssl_context *ssl, 108 const unsigned char *buf, 109 size_t len) 110 { 111 #if defined(MBEDTLS_SSL_RENEGOTIATION) 112 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 113 /* Check verify-data in constant-time. The length OTOH is no secret */ 114 if (len != 1 + ssl->verify_data_len || 115 buf[0] != ssl->verify_data_len || 116 mbedtls_ct_memcmp(buf + 1, ssl->peer_verify_data, 117 ssl->verify_data_len) != 0) { 118 MBEDTLS_SSL_DEBUG_MSG(1, ("non-matching renegotiation info")); 119 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 120 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 121 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 122 } 123 } else 124 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 125 { 126 if (len != 1 || buf[0] != 0x0) { 127 MBEDTLS_SSL_DEBUG_MSG(1, ("non-zero length renegotiation info")); 128 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 129 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 130 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 131 } 132 133 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; 134 } 135 136 return 0; 137 } 138 139 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 140 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 141 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 142 /* 143 * Function for parsing a supported groups (TLS 1.3) or supported elliptic 144 * curves (TLS 1.2) extension. 145 * 146 * The "extension_data" field of a supported groups extension contains a 147 * "NamedGroupList" value (TLS 1.3 RFC8446): 148 * enum { 149 * secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019), 150 * x25519(0x001D), x448(0x001E), 151 * ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102), 152 * ffdhe6144(0x0103), ffdhe8192(0x0104), 153 * ffdhe_private_use(0x01FC..0x01FF), 154 * ecdhe_private_use(0xFE00..0xFEFF), 155 * (0xFFFF) 156 * } NamedGroup; 157 * struct { 158 * NamedGroup named_group_list<2..2^16-1>; 159 * } NamedGroupList; 160 * 161 * The "extension_data" field of a supported elliptic curves extension contains 162 * a "NamedCurveList" value (TLS 1.2 RFC 8422): 163 * enum { 164 * deprecated(1..22), 165 * secp256r1 (23), secp384r1 (24), secp521r1 (25), 166 * x25519(29), x448(30), 167 * reserved (0xFE00..0xFEFF), 168 * deprecated(0xFF01..0xFF02), 169 * (0xFFFF) 170 * } NamedCurve; 171 * struct { 172 * NamedCurve named_curve_list<2..2^16-1> 173 * } NamedCurveList; 174 * 175 * The TLS 1.3 supported groups extension was defined to be a compatible 176 * generalization of the TLS 1.2 supported elliptic curves extension. They both 177 * share the same extension identifier. 178 * 179 */ 180 MBEDTLS_CHECK_RETURN_CRITICAL 181 static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl, 182 const unsigned char *buf, 183 size_t len) 184 { 185 size_t list_size, our_size; 186 const unsigned char *p; 187 uint16_t *curves_tls_id; 188 189 if (len < 2) { 190 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 191 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 192 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 193 return MBEDTLS_ERR_SSL_DECODE_ERROR; 194 } 195 list_size = MBEDTLS_GET_UINT16_BE(buf, 0); 196 if (list_size + 2 != len || 197 list_size % 2 != 0) { 198 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 199 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 200 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 201 return MBEDTLS_ERR_SSL_DECODE_ERROR; 202 } 203 204 /* Should never happen unless client duplicates the extension */ 205 if (ssl->handshake->curves_tls_id != NULL) { 206 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 207 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 208 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 209 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 210 } 211 212 /* Don't allow our peer to make us allocate too much memory, 213 * and leave room for a final 0 */ 214 our_size = list_size / 2 + 1; 215 if (our_size > MBEDTLS_ECP_DP_MAX) { 216 our_size = MBEDTLS_ECP_DP_MAX; 217 } 218 219 if ((curves_tls_id = mbedtls_calloc(our_size, 220 sizeof(*curves_tls_id))) == NULL) { 221 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 222 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR); 223 return MBEDTLS_ERR_SSL_ALLOC_FAILED; 224 } 225 226 ssl->handshake->curves_tls_id = curves_tls_id; 227 228 p = buf + 2; 229 while (list_size > 0 && our_size > 1) { 230 uint16_t curr_tls_id = MBEDTLS_GET_UINT16_BE(p, 0); 231 232 if (mbedtls_ssl_get_ecp_group_id_from_tls_id(curr_tls_id) != 233 MBEDTLS_ECP_DP_NONE) { 234 *curves_tls_id++ = curr_tls_id; 235 our_size--; 236 } 237 238 list_size -= 2; 239 p += 2; 240 } 241 242 return 0; 243 } 244 245 MBEDTLS_CHECK_RETURN_CRITICAL 246 static int ssl_parse_supported_point_formats(mbedtls_ssl_context *ssl, 247 const unsigned char *buf, 248 size_t len) 249 { 250 size_t list_size; 251 const unsigned char *p; 252 253 if (len == 0 || (size_t) (buf[0] + 1) != len) { 254 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 255 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 256 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 257 return MBEDTLS_ERR_SSL_DECODE_ERROR; 258 } 259 list_size = buf[0]; 260 261 p = buf + 1; 262 while (list_size > 0) { 263 if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || 264 p[0] == MBEDTLS_ECP_PF_COMPRESSED) { 265 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ 266 defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) 267 ssl->handshake->ecdh_ctx.point_format = p[0]; 268 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED */ 269 #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ 270 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 271 mbedtls_ecjpake_set_point_format(&ssl->handshake->ecjpake_ctx, 272 p[0]); 273 #endif /* !MBEDTLS_USE_PSA_CRYPTO && MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 274 MBEDTLS_SSL_DEBUG_MSG(4, ("point format selected: %d", p[0])); 275 return 0; 276 } 277 278 list_size--; 279 p++; 280 } 281 282 return 0; 283 } 284 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || 285 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED || 286 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 287 288 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 289 MBEDTLS_CHECK_RETURN_CRITICAL 290 static int ssl_parse_ecjpake_kkpp(mbedtls_ssl_context *ssl, 291 const unsigned char *buf, 292 size_t len) 293 { 294 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 295 296 #if defined(MBEDTLS_USE_PSA_CRYPTO) 297 if (ssl->handshake->psa_pake_ctx_is_ok != 1) 298 #else 299 if (mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0) 300 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 301 { 302 MBEDTLS_SSL_DEBUG_MSG(3, ("skip ecjpake kkpp extension")); 303 return 0; 304 } 305 306 #if defined(MBEDTLS_USE_PSA_CRYPTO) 307 if ((ret = mbedtls_psa_ecjpake_read_round( 308 &ssl->handshake->psa_pake_ctx, buf, len, 309 MBEDTLS_ECJPAKE_ROUND_ONE)) != 0) { 310 psa_destroy_key(ssl->handshake->psa_pake_password); 311 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 312 313 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round one", ret); 314 mbedtls_ssl_send_alert_message( 315 ssl, 316 MBEDTLS_SSL_ALERT_LEVEL_FATAL, 317 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 318 319 return ret; 320 } 321 #else 322 if ((ret = mbedtls_ecjpake_read_round_one(&ssl->handshake->ecjpake_ctx, 323 buf, len)) != 0) { 324 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_one", ret); 325 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 326 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 327 return ret; 328 } 329 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 330 331 /* Only mark the extension as OK when we're sure it is */ 332 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK; 333 334 return 0; 335 } 336 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 337 338 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 339 MBEDTLS_CHECK_RETURN_CRITICAL 340 static int ssl_parse_max_fragment_length_ext(mbedtls_ssl_context *ssl, 341 const unsigned char *buf, 342 size_t len) 343 { 344 if (len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID) { 345 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 346 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 347 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 348 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 349 } 350 351 ssl->session_negotiate->mfl_code = buf[0]; 352 353 return 0; 354 } 355 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 356 357 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 358 MBEDTLS_CHECK_RETURN_CRITICAL 359 static int ssl_parse_cid_ext(mbedtls_ssl_context *ssl, 360 const unsigned char *buf, 361 size_t len) 362 { 363 size_t peer_cid_len; 364 365 /* CID extension only makes sense in DTLS */ 366 if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 367 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 368 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 369 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 370 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 371 } 372 373 /* 374 * struct { 375 * opaque cid<0..2^8-1>; 376 * } ConnectionId; 377 */ 378 379 if (len < 1) { 380 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 381 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 382 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 383 return MBEDTLS_ERR_SSL_DECODE_ERROR; 384 } 385 386 peer_cid_len = *buf++; 387 len--; 388 389 if (len != peer_cid_len) { 390 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 391 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 392 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 393 return MBEDTLS_ERR_SSL_DECODE_ERROR; 394 } 395 396 /* Ignore CID if the user has disabled its use. */ 397 if (ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) { 398 /* Leave ssl->handshake->cid_in_use in its default 399 * value of MBEDTLS_SSL_CID_DISABLED. */ 400 MBEDTLS_SSL_DEBUG_MSG(3, ("Client sent CID extension, but CID disabled")); 401 return 0; 402 } 403 404 if (peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX) { 405 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 406 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 407 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); 408 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 409 } 410 411 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED; 412 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len; 413 memcpy(ssl->handshake->peer_cid, buf, peer_cid_len); 414 415 MBEDTLS_SSL_DEBUG_MSG(3, ("Use of CID extension negotiated")); 416 MBEDTLS_SSL_DEBUG_BUF(3, "Client CID", buf, peer_cid_len); 417 418 return 0; 419 } 420 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 421 422 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 423 MBEDTLS_CHECK_RETURN_CRITICAL 424 static int ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context *ssl, 425 const unsigned char *buf, 426 size_t len) 427 { 428 if (len != 0) { 429 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 430 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 431 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 432 return MBEDTLS_ERR_SSL_DECODE_ERROR; 433 } 434 435 ((void) buf); 436 437 if (ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED) { 438 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; 439 } 440 441 return 0; 442 } 443 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 444 445 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 446 MBEDTLS_CHECK_RETURN_CRITICAL 447 static int ssl_parse_extended_ms_ext(mbedtls_ssl_context *ssl, 448 const unsigned char *buf, 449 size_t len) 450 { 451 if (len != 0) { 452 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 453 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 454 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 455 return MBEDTLS_ERR_SSL_DECODE_ERROR; 456 } 457 458 ((void) buf); 459 460 if (ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) { 461 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; 462 } 463 464 return 0; 465 } 466 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 467 468 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 469 MBEDTLS_CHECK_RETURN_CRITICAL 470 static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl, 471 unsigned char *buf, 472 size_t len) 473 { 474 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 475 mbedtls_ssl_session session; 476 477 mbedtls_ssl_session_init(&session); 478 479 if (ssl->conf->f_ticket_parse == NULL || 480 ssl->conf->f_ticket_write == NULL) { 481 return 0; 482 } 483 484 /* Remember the client asked us to send a new ticket */ 485 ssl->handshake->new_session_ticket = 1; 486 487 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket length: %" MBEDTLS_PRINTF_SIZET, len)); 488 489 if (len == 0) { 490 return 0; 491 } 492 493 #if defined(MBEDTLS_SSL_RENEGOTIATION) 494 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 495 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket rejected: renegotiating")); 496 return 0; 497 } 498 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 499 500 /* 501 * Failures are ok: just ignore the ticket and proceed. 502 */ 503 if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket, &session, 504 buf, len)) != 0) { 505 mbedtls_ssl_session_free(&session); 506 507 if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) { 508 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic")); 509 } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) { 510 MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired")); 511 } else { 512 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_parse", ret); 513 } 514 515 return 0; 516 } 517 518 /* 519 * Keep the session ID sent by the client, since we MUST send it back to 520 * inform them we're accepting the ticket (RFC 5077 section 3.4) 521 */ 522 session.id_len = ssl->session_negotiate->id_len; 523 memcpy(&session.id, ssl->session_negotiate->id, session.id_len); 524 525 mbedtls_ssl_session_free(ssl->session_negotiate); 526 memcpy(ssl->session_negotiate, &session, sizeof(mbedtls_ssl_session)); 527 528 /* Zeroize instead of free as we copied the content */ 529 mbedtls_platform_zeroize(&session, sizeof(mbedtls_ssl_session)); 530 531 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from ticket")); 532 533 ssl->handshake->resume = 1; 534 535 /* Don't send a new ticket after all, this one is OK */ 536 ssl->handshake->new_session_ticket = 0; 537 538 return 0; 539 } 540 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 541 542 #if defined(MBEDTLS_SSL_DTLS_SRTP) 543 MBEDTLS_CHECK_RETURN_CRITICAL 544 static int ssl_parse_use_srtp_ext(mbedtls_ssl_context *ssl, 545 const unsigned char *buf, 546 size_t len) 547 { 548 mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET; 549 size_t i, j; 550 size_t profile_length; 551 uint16_t mki_length; 552 /*! 2 bytes for profile length and 1 byte for mki len */ 553 const size_t size_of_lengths = 3; 554 555 /* If use_srtp is not configured, just ignore the extension */ 556 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || 557 (ssl->conf->dtls_srtp_profile_list == NULL) || 558 (ssl->conf->dtls_srtp_profile_list_len == 0)) { 559 return 0; 560 } 561 562 /* RFC5764 section 4.1.1 563 * uint8 SRTPProtectionProfile[2]; 564 * 565 * struct { 566 * SRTPProtectionProfiles SRTPProtectionProfiles; 567 * opaque srtp_mki<0..255>; 568 * } UseSRTPData; 569 570 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>; 571 */ 572 573 /* 574 * Min length is 5: at least one protection profile(2 bytes) 575 * and length(2 bytes) + srtp_mki length(1 byte) 576 * Check here that we have at least 2 bytes of protection profiles length 577 * and one of srtp_mki length 578 */ 579 if (len < size_of_lengths) { 580 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 581 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 582 return MBEDTLS_ERR_SSL_DECODE_ERROR; 583 } 584 585 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET; 586 587 /* first 2 bytes are protection profile length(in bytes) */ 588 profile_length = (buf[0] << 8) | buf[1]; 589 buf += 2; 590 591 /* The profile length cannot be bigger than input buffer size - lengths fields */ 592 if (profile_length > len - size_of_lengths || 593 profile_length % 2 != 0) { /* profiles are 2 bytes long, so the length must be even */ 594 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 595 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 596 return MBEDTLS_ERR_SSL_DECODE_ERROR; 597 } 598 /* 599 * parse the extension list values are defined in 600 * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml 601 */ 602 for (j = 0; j < profile_length; j += 2) { 603 uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1]; 604 client_protection = mbedtls_ssl_check_srtp_profile_value(protection_profile_value); 605 606 if (client_protection != MBEDTLS_TLS_SRTP_UNSET) { 607 MBEDTLS_SSL_DEBUG_MSG(3, ("found srtp profile: %s", 608 mbedtls_ssl_get_srtp_profile_as_string( 609 client_protection))); 610 } else { 611 continue; 612 } 613 /* check if suggested profile is in our list */ 614 for (i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++) { 615 if (client_protection == ssl->conf->dtls_srtp_profile_list[i]) { 616 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i]; 617 MBEDTLS_SSL_DEBUG_MSG(3, ("selected srtp profile: %s", 618 mbedtls_ssl_get_srtp_profile_as_string( 619 client_protection))); 620 break; 621 } 622 } 623 if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET) { 624 break; 625 } 626 } 627 buf += profile_length; /* buf points to the mki length */ 628 mki_length = *buf; 629 buf++; 630 631 if (mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH || 632 mki_length + profile_length + size_of_lengths != len) { 633 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 634 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 635 return MBEDTLS_ERR_SSL_DECODE_ERROR; 636 } 637 638 /* Parse the mki only if present and mki is supported locally */ 639 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED && 640 mki_length > 0) { 641 ssl->dtls_srtp_info.mki_len = mki_length; 642 643 memcpy(ssl->dtls_srtp_info.mki_value, buf, mki_length); 644 645 MBEDTLS_SSL_DEBUG_BUF(3, "using mki", ssl->dtls_srtp_info.mki_value, 646 ssl->dtls_srtp_info.mki_len); 647 } 648 649 return 0; 650 } 651 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 652 653 /* 654 * Auxiliary functions for ServerHello parsing and related actions 655 */ 656 657 #if defined(MBEDTLS_X509_CRT_PARSE_C) 658 /* 659 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise 660 */ 661 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 662 MBEDTLS_CHECK_RETURN_CRITICAL 663 static int ssl_check_key_curve(mbedtls_pk_context *pk, 664 uint16_t *curves_tls_id) 665 { 666 uint16_t *curr_tls_id = curves_tls_id; 667 mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk); 668 mbedtls_ecp_group_id curr_grp_id; 669 670 while (*curr_tls_id != 0) { 671 curr_grp_id = mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id); 672 if (curr_grp_id == grp_id) { 673 return 0; 674 } 675 curr_tls_id++; 676 } 677 678 return -1; 679 } 680 #endif /* MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED */ 681 682 /* 683 * Try picking a certificate for this ciphersuite, 684 * return 0 on success and -1 on failure. 685 */ 686 MBEDTLS_CHECK_RETURN_CRITICAL 687 static int ssl_pick_cert(mbedtls_ssl_context *ssl, 688 const mbedtls_ssl_ciphersuite_t *ciphersuite_info) 689 { 690 mbedtls_ssl_key_cert *cur, *list; 691 #if defined(MBEDTLS_USE_PSA_CRYPTO) 692 psa_algorithm_t pk_alg = 693 mbedtls_ssl_get_ciphersuite_sig_pk_psa_alg(ciphersuite_info); 694 psa_key_usage_t pk_usage = 695 mbedtls_ssl_get_ciphersuite_sig_pk_psa_usage(ciphersuite_info); 696 #else 697 mbedtls_pk_type_t pk_alg = 698 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info); 699 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 700 uint32_t flags; 701 702 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 703 if (ssl->handshake->sni_key_cert != NULL) { 704 list = ssl->handshake->sni_key_cert; 705 } else 706 #endif 707 list = ssl->conf->key_cert; 708 709 int pk_alg_is_none = 0; 710 #if defined(MBEDTLS_USE_PSA_CRYPTO) 711 pk_alg_is_none = (pk_alg == PSA_ALG_NONE); 712 #else 713 pk_alg_is_none = (pk_alg == MBEDTLS_PK_NONE); 714 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 715 if (pk_alg_is_none) { 716 return 0; 717 } 718 719 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite requires certificate")); 720 721 if (list == NULL) { 722 MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate")); 723 return -1; 724 } 725 726 for (cur = list; cur != NULL; cur = cur->next) { 727 flags = 0; 728 MBEDTLS_SSL_DEBUG_CRT(3, "candidate certificate chain, certificate", 729 cur->cert); 730 731 int key_type_matches = 0; 732 #if defined(MBEDTLS_USE_PSA_CRYPTO) 733 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 734 key_type_matches = ((ssl->conf->f_async_sign_start != NULL || 735 ssl->conf->f_async_decrypt_start != NULL || 736 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)) && 737 mbedtls_pk_can_do_ext(&cur->cert->pk, pk_alg, pk_usage)); 738 #else 739 key_type_matches = ( 740 mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)); 741 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 742 #else 743 key_type_matches = mbedtls_pk_can_do(&cur->cert->pk, pk_alg); 744 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 745 if (!key_type_matches) { 746 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: key type")); 747 continue; 748 } 749 750 /* 751 * This avoids sending the client a cert it'll reject based on 752 * keyUsage or other extensions. 753 * 754 * It also allows the user to provision different certificates for 755 * different uses based on keyUsage, eg if they want to avoid signing 756 * and decrypting with the same RSA key. 757 */ 758 if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info, 759 MBEDTLS_SSL_IS_CLIENT, 760 MBEDTLS_SSL_VERSION_TLS1_2, 761 &flags) != 0) { 762 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: " 763 "(extended) key usage extension")); 764 continue; 765 } 766 767 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 768 if (pk_alg == MBEDTLS_PK_ECDSA && 769 ssl_check_key_curve(&cur->cert->pk, 770 ssl->handshake->curves_tls_id) != 0) { 771 MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: elliptic curve")); 772 continue; 773 } 774 #endif 775 776 /* If we get there, we got a winner */ 777 break; 778 } 779 780 /* Do not update ssl->handshake->key_cert unless there is a match */ 781 if (cur != NULL) { 782 ssl->handshake->key_cert = cur; 783 MBEDTLS_SSL_DEBUG_CRT(3, "selected certificate chain, certificate", 784 ssl->handshake->key_cert->cert); 785 return 0; 786 } 787 788 return -1; 789 } 790 #endif /* MBEDTLS_X509_CRT_PARSE_C */ 791 792 /* 793 * Check if a given ciphersuite is suitable for use with our config/keys/etc 794 * Sets ciphersuite_info only if the suite matches. 795 */ 796 MBEDTLS_CHECK_RETURN_CRITICAL 797 static int ssl_ciphersuite_match(mbedtls_ssl_context *ssl, int suite_id, 798 const mbedtls_ssl_ciphersuite_t **ciphersuite_info) 799 { 800 const mbedtls_ssl_ciphersuite_t *suite_info; 801 802 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 803 mbedtls_pk_type_t sig_type; 804 #endif 805 806 suite_info = mbedtls_ssl_ciphersuite_from_id(suite_id); 807 if (suite_info == NULL) { 808 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 809 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 810 } 811 812 MBEDTLS_SSL_DEBUG_MSG(3, ("trying ciphersuite: %#04x (%s)", 813 (unsigned int) suite_id, suite_info->name)); 814 815 if (suite_info->min_tls_version > ssl->tls_version || 816 suite_info->max_tls_version < ssl->tls_version) { 817 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: version")); 818 return 0; 819 } 820 821 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 822 if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && 823 (ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK) == 0) { 824 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: ecjpake " 825 "not configured or ext missing")); 826 return 0; 827 } 828 #endif 829 830 831 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 832 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 833 if (mbedtls_ssl_ciphersuite_uses_ec(suite_info) && 834 (ssl->handshake->curves_tls_id == NULL || 835 ssl->handshake->curves_tls_id[0] == 0)) { 836 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: " 837 "no common elliptic curve")); 838 return 0; 839 } 840 #endif 841 842 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 843 /* If the ciphersuite requires a pre-shared key and we don't 844 * have one, skip it now rather than failing later */ 845 if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) && 846 ssl_conf_has_psk_or_cb(ssl->conf) == 0) { 847 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no pre-shared key")); 848 return 0; 849 } 850 #endif 851 852 #if defined(MBEDTLS_X509_CRT_PARSE_C) 853 /* 854 * Final check: if ciphersuite requires us to have a 855 * certificate/key of a particular type: 856 * - select the appropriate certificate if we have one, or 857 * - try the next ciphersuite if we don't 858 * This must be done last since we modify the key_cert list. 859 */ 860 if (ssl_pick_cert(ssl, suite_info) != 0) { 861 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: " 862 "no suitable certificate")); 863 return 0; 864 } 865 #endif 866 867 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 868 /* If the ciphersuite requires signing, check whether 869 * a suitable hash algorithm is present. */ 870 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg(suite_info); 871 if (sig_type != MBEDTLS_PK_NONE && 872 mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( 873 ssl, mbedtls_ssl_sig_from_pk_alg(sig_type)) == MBEDTLS_SSL_HASH_NONE) { 874 MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no suitable hash algorithm " 875 "for signature algorithm %u", (unsigned) sig_type)); 876 return 0; 877 } 878 879 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 880 881 *ciphersuite_info = suite_info; 882 return 0; 883 } 884 885 /* This function doesn't alert on errors that happen early during 886 ClientHello parsing because they might indicate that the client is 887 not talking SSL/TLS at all and would not understand our alert. */ 888 MBEDTLS_CHECK_RETURN_CRITICAL 889 static int ssl_parse_client_hello(mbedtls_ssl_context *ssl) 890 { 891 int ret, got_common_suite; 892 size_t i, j; 893 size_t ciph_offset, comp_offset, ext_offset; 894 size_t msg_len, ciph_len, sess_len, comp_len, ext_len; 895 #if defined(MBEDTLS_SSL_PROTO_DTLS) 896 size_t cookie_offset, cookie_len; 897 #endif 898 unsigned char *buf, *p, *ext; 899 #if defined(MBEDTLS_SSL_RENEGOTIATION) 900 int renegotiation_info_seen = 0; 901 #endif 902 int handshake_failure = 0; 903 const int *ciphersuites; 904 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 905 906 /* If there is no signature-algorithm extension present, 907 * we need to fall back to the default values for allowed 908 * signature-hash pairs. */ 909 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 910 int sig_hash_alg_ext_present = 0; 911 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 912 913 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello")); 914 915 int renegotiating; 916 917 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 918 read_record_header: 919 #endif 920 /* 921 * If renegotiating, then the input was read with mbedtls_ssl_read_record(), 922 * otherwise read it ourselves manually in order to support SSLv2 923 * ClientHello, which doesn't use the same record layer format. 924 * Otherwise in a scenario of TLS 1.3/TLS 1.2 version negotiation, the 925 * ClientHello has been already fully fetched by the TLS 1.3 code and the 926 * flag ssl->keep_current_message is raised. 927 */ 928 renegotiating = 0; 929 #if defined(MBEDTLS_SSL_RENEGOTIATION) 930 renegotiating = (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE); 931 #endif 932 if (!renegotiating && !ssl->keep_current_message) { 933 if ((ret = mbedtls_ssl_fetch_input(ssl, 5)) != 0) { 934 /* No alert on a read error. */ 935 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); 936 return ret; 937 } 938 } 939 940 buf = ssl->in_hdr; 941 942 MBEDTLS_SSL_DEBUG_BUF(4, "record header", buf, mbedtls_ssl_in_hdr_len(ssl)); 943 944 /* 945 * TLS Client Hello 946 * 947 * Record layer: 948 * 0 . 0 message type 949 * 1 . 2 protocol version 950 * 3 . 11 DTLS: epoch + record sequence number 951 * 3 . 4 message length 952 */ 953 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message type: %d", 954 buf[0])); 955 956 if (buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE) { 957 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 958 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 959 } 960 961 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, message len.: %d", 962 MBEDTLS_GET_UINT16_BE(ssl->in_len, 0))); 963 964 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello, protocol version: [%d:%d]", 965 buf[1], buf[2])); 966 967 /* For DTLS if this is the initial handshake, remember the client sequence 968 * number to use it in our next message (RFC 6347 4.2.1) */ 969 #if defined(MBEDTLS_SSL_PROTO_DTLS) 970 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM 971 #if defined(MBEDTLS_SSL_RENEGOTIATION) 972 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE 973 #endif 974 ) { 975 /* Epoch should be 0 for initial handshakes */ 976 if (ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0) { 977 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 978 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 979 } 980 981 memcpy(&ssl->cur_out_ctr[2], ssl->in_ctr + 2, 982 sizeof(ssl->cur_out_ctr) - 2); 983 984 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) 985 if (mbedtls_ssl_dtls_replay_check(ssl) != 0) { 986 MBEDTLS_SSL_DEBUG_MSG(1, ("replayed record, discarding")); 987 ssl->next_record_offset = 0; 988 ssl->in_left = 0; 989 goto read_record_header; 990 } 991 992 /* No MAC to check yet, so we can update right now */ 993 mbedtls_ssl_dtls_replay_update(ssl); 994 #endif 995 } 996 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 997 998 msg_len = MBEDTLS_GET_UINT16_BE(ssl->in_len, 0); 999 1000 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1001 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 1002 /* Set by mbedtls_ssl_read_record() */ 1003 msg_len = ssl->in_hslen; 1004 } else 1005 #endif 1006 { 1007 if (ssl->keep_current_message) { 1008 ssl->keep_current_message = 0; 1009 } else { 1010 if (msg_len > MBEDTLS_SSL_IN_CONTENT_LEN) { 1011 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1012 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 1013 } 1014 1015 if ((ret = mbedtls_ssl_fetch_input(ssl, 1016 mbedtls_ssl_in_hdr_len(ssl) + msg_len)) != 0) { 1017 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); 1018 return ret; 1019 } 1020 1021 /* Done reading this record, get ready for the next one */ 1022 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1023 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1024 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len(ssl); 1025 } else 1026 #endif 1027 ssl->in_left = 0; 1028 } 1029 } 1030 1031 buf = ssl->in_msg; 1032 1033 MBEDTLS_SSL_DEBUG_BUF(4, "record contents", buf, msg_len); 1034 1035 ret = ssl->handshake->update_checksum(ssl, buf, msg_len); 1036 if (0 != ret) { 1037 MBEDTLS_SSL_DEBUG_RET(1, ("update_checksum"), ret); 1038 return ret; 1039 } 1040 1041 /* 1042 * Handshake layer: 1043 * 0 . 0 handshake type 1044 * 1 . 3 handshake length 1045 * 4 . 5 DTLS only: message sequence number 1046 * 6 . 8 DTLS only: fragment offset 1047 * 9 . 11 DTLS only: fragment length 1048 */ 1049 if (msg_len < mbedtls_ssl_hs_hdr_len(ssl)) { 1050 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1051 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1052 } 1053 1054 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake type: %d", buf[0])); 1055 1056 if (buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO) { 1057 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1058 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 1059 } 1060 { 1061 size_t handshake_len = MBEDTLS_GET_UINT24_BE(buf, 1); 1062 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake len.: %u", 1063 (unsigned) handshake_len)); 1064 1065 /* The record layer has a record size limit of 2^14 - 1 and 1066 * fragmentation is not supported, so buf[1] should be zero. */ 1067 if (buf[1] != 0) { 1068 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message: %u != 0", 1069 (unsigned) buf[1])); 1070 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1071 } 1072 1073 /* We don't support fragmentation of ClientHello (yet?) */ 1074 if (msg_len != mbedtls_ssl_hs_hdr_len(ssl) + handshake_len) { 1075 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message: %u != %u + %u", 1076 (unsigned) msg_len, 1077 (unsigned) mbedtls_ssl_hs_hdr_len(ssl), 1078 (unsigned) handshake_len)); 1079 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1080 } 1081 } 1082 1083 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1084 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1085 /* 1086 * Copy the client's handshake message_seq on initial handshakes, 1087 * check sequence number on renego. 1088 */ 1089 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1090 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { 1091 /* This couldn't be done in ssl_prepare_handshake_record() */ 1092 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4); 1093 if (cli_msg_seq != ssl->handshake->in_msg_seq) { 1094 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message_seq: " 1095 "%u (expected %u)", cli_msg_seq, 1096 ssl->handshake->in_msg_seq)); 1097 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1098 } 1099 1100 ssl->handshake->in_msg_seq++; 1101 } else 1102 #endif 1103 { 1104 unsigned int cli_msg_seq = (unsigned int) MBEDTLS_GET_UINT16_BE(ssl->in_msg, 4); 1105 ssl->handshake->out_msg_seq = cli_msg_seq; 1106 ssl->handshake->in_msg_seq = cli_msg_seq + 1; 1107 } 1108 { 1109 /* 1110 * For now we don't support fragmentation, so make sure 1111 * fragment_offset == 0 and fragment_length == length 1112 */ 1113 size_t fragment_offset, fragment_length, length; 1114 fragment_offset = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 6); 1115 fragment_length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 9); 1116 length = MBEDTLS_GET_UINT24_BE(ssl->in_msg, 1); 1117 MBEDTLS_SSL_DEBUG_MSG( 1118 4, ("fragment_offset=%u fragment_length=%u length=%u", 1119 (unsigned) fragment_offset, (unsigned) fragment_length, 1120 (unsigned) length)); 1121 if (fragment_offset != 0 || length != fragment_length) { 1122 MBEDTLS_SSL_DEBUG_MSG(1, ("ClientHello fragmentation not supported")); 1123 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 1124 } 1125 } 1126 } 1127 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 1128 1129 buf += mbedtls_ssl_hs_hdr_len(ssl); 1130 msg_len -= mbedtls_ssl_hs_hdr_len(ssl); 1131 1132 /* 1133 * ClientHello layout: 1134 * 0 . 1 protocol version 1135 * 2 . 33 random bytes (starting with 4 bytes of Unix time) 1136 * 34 . 34 session id length (1 byte) 1137 * 35 . 34+x session id, where x = session id length from byte 34 1138 * 35+x . 35+x DTLS only: cookie length (1 byte) 1139 * 36+x . .. DTLS only: cookie 1140 * .. . .. ciphersuite list length (2 bytes) 1141 * .. . .. ciphersuite list 1142 * .. . .. compression alg. list length (1 byte) 1143 * .. . .. compression alg. list 1144 * .. . .. extensions length (2 bytes, optional) 1145 * .. . .. extensions (optional) 1146 */ 1147 1148 /* 1149 * Minimal length (with everything empty and extensions omitted) is 1150 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can 1151 * read at least up to session id length without worrying. 1152 */ 1153 if (msg_len < 38) { 1154 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1155 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1156 } 1157 1158 /* 1159 * Check and save the protocol version 1160 */ 1161 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, version", buf, 2); 1162 1163 ssl->tls_version = (mbedtls_ssl_protocol_version) mbedtls_ssl_read_version(buf, 1164 ssl->conf->transport); 1165 ssl->session_negotiate->tls_version = ssl->tls_version; 1166 ssl->session_negotiate->endpoint = ssl->conf->endpoint; 1167 1168 if (ssl->tls_version != MBEDTLS_SSL_VERSION_TLS1_2) { 1169 MBEDTLS_SSL_DEBUG_MSG(1, ("server only supports TLS 1.2")); 1170 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1171 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION); 1172 return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION; 1173 } 1174 1175 /* 1176 * Save client random (inc. Unix time) 1177 */ 1178 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes", buf + 2, 32); 1179 1180 memcpy(ssl->handshake->randbytes, buf + 2, 32); 1181 1182 /* 1183 * Check the session ID length and save session ID 1184 */ 1185 sess_len = buf[34]; 1186 1187 if (sess_len > sizeof(ssl->session_negotiate->id) || 1188 sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */ 1189 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1190 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1191 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1192 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1193 } 1194 1195 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id", buf + 35, sess_len); 1196 1197 ssl->session_negotiate->id_len = sess_len; 1198 memset(ssl->session_negotiate->id, 0, 1199 sizeof(ssl->session_negotiate->id)); 1200 memcpy(ssl->session_negotiate->id, buf + 35, 1201 ssl->session_negotiate->id_len); 1202 1203 /* 1204 * Check the cookie length and content 1205 */ 1206 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1207 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1208 cookie_offset = 35 + sess_len; 1209 cookie_len = buf[cookie_offset]; 1210 1211 if (cookie_offset + 1 + cookie_len + 2 > msg_len) { 1212 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1213 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1214 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1215 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1216 } 1217 1218 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie", 1219 buf + cookie_offset + 1, cookie_len); 1220 1221 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 1222 if (ssl->conf->f_cookie_check != NULL 1223 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1224 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE 1225 #endif 1226 ) { 1227 if (ssl->conf->f_cookie_check(ssl->conf->p_cookie, 1228 buf + cookie_offset + 1, cookie_len, 1229 ssl->cli_id, ssl->cli_id_len) != 0) { 1230 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification failed")); 1231 ssl->handshake->cookie_verify_result = 1; 1232 } else { 1233 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification passed")); 1234 ssl->handshake->cookie_verify_result = 0; 1235 } 1236 } else 1237 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 1238 { 1239 /* We know we didn't send a cookie, so it should be empty */ 1240 if (cookie_len != 0) { 1241 /* This may be an attacker's probe, so don't send an alert */ 1242 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1243 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1244 } 1245 1246 MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification skipped")); 1247 } 1248 1249 /* 1250 * Check the ciphersuitelist length (will be parsed later) 1251 */ 1252 ciph_offset = cookie_offset + 1 + cookie_len; 1253 } else 1254 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 1255 ciph_offset = 35 + sess_len; 1256 1257 ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset); 1258 1259 if (ciph_len < 2 || 1260 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */ 1261 (ciph_len % 2) != 0) { 1262 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1263 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1264 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1265 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1266 } 1267 1268 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, ciphersuitelist", 1269 buf + ciph_offset + 2, ciph_len); 1270 1271 /* 1272 * Check the compression algorithm's length. 1273 * The list contents are ignored because implementing 1274 * MBEDTLS_SSL_COMPRESS_NULL is mandatory and is the only 1275 * option supported by Mbed TLS. 1276 */ 1277 comp_offset = ciph_offset + 2 + ciph_len; 1278 1279 comp_len = buf[comp_offset]; 1280 1281 if (comp_len < 1 || 1282 comp_len > 16 || 1283 comp_len + comp_offset + 1 > msg_len) { 1284 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1285 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1286 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1287 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1288 } 1289 1290 MBEDTLS_SSL_DEBUG_BUF(3, "client hello, compression", 1291 buf + comp_offset + 1, comp_len); 1292 1293 /* 1294 * Check the extension length 1295 */ 1296 ext_offset = comp_offset + 1 + comp_len; 1297 if (msg_len > ext_offset) { 1298 if (msg_len < ext_offset + 2) { 1299 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1300 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1301 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1302 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1303 } 1304 1305 ext_len = MBEDTLS_GET_UINT16_BE(buf, ext_offset); 1306 1307 if (msg_len != ext_offset + 2 + ext_len) { 1308 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1309 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1310 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1311 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1312 } 1313 } else { 1314 ext_len = 0; 1315 } 1316 1317 ext = buf + ext_offset + 2; 1318 MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", ext, ext_len); 1319 1320 while (ext_len != 0) { 1321 unsigned int ext_id; 1322 unsigned int ext_size; 1323 if (ext_len < 4) { 1324 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1325 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1326 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1327 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1328 } 1329 ext_id = MBEDTLS_GET_UINT16_BE(ext, 0); 1330 ext_size = MBEDTLS_GET_UINT16_BE(ext, 2); 1331 1332 if (ext_size + 4 > ext_len) { 1333 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); 1334 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1335 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); 1336 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1337 } 1338 switch (ext_id) { 1339 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 1340 case MBEDTLS_TLS_EXT_SERVERNAME: 1341 MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension")); 1342 ret = mbedtls_ssl_parse_server_name_ext(ssl, ext + 4, 1343 ext + 4 + ext_size); 1344 if (ret != 0) { 1345 return ret; 1346 } 1347 break; 1348 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 1349 1350 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: 1351 MBEDTLS_SSL_DEBUG_MSG(3, ("found renegotiation extension")); 1352 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1353 renegotiation_info_seen = 1; 1354 #endif 1355 1356 ret = ssl_parse_renegotiation_info(ssl, ext + 4, ext_size); 1357 if (ret != 0) { 1358 return ret; 1359 } 1360 break; 1361 1362 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1363 case MBEDTLS_TLS_EXT_SIG_ALG: 1364 MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension")); 1365 1366 ret = mbedtls_ssl_parse_sig_alg_ext(ssl, ext + 4, ext + 4 + ext_size); 1367 if (ret != 0) { 1368 return ret; 1369 } 1370 1371 sig_hash_alg_ext_present = 1; 1372 break; 1373 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1374 1375 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 1376 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 1377 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1378 case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS: 1379 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported elliptic curves extension")); 1380 1381 ret = ssl_parse_supported_groups_ext(ssl, ext + 4, ext_size); 1382 if (ret != 0) { 1383 return ret; 1384 } 1385 break; 1386 1387 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: 1388 MBEDTLS_SSL_DEBUG_MSG(3, ("found supported point formats extension")); 1389 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT; 1390 1391 ret = ssl_parse_supported_point_formats(ssl, ext + 4, ext_size); 1392 if (ret != 0) { 1393 return ret; 1394 } 1395 break; 1396 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || \ 1397 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED || 1398 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1399 1400 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1401 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: 1402 MBEDTLS_SSL_DEBUG_MSG(3, ("found ecjpake kkpp extension")); 1403 1404 ret = ssl_parse_ecjpake_kkpp(ssl, ext + 4, ext_size); 1405 if (ret != 0) { 1406 return ret; 1407 } 1408 break; 1409 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1410 1411 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 1412 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: 1413 MBEDTLS_SSL_DEBUG_MSG(3, ("found max fragment length extension")); 1414 1415 ret = ssl_parse_max_fragment_length_ext(ssl, ext + 4, ext_size); 1416 if (ret != 0) { 1417 return ret; 1418 } 1419 break; 1420 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 1421 1422 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 1423 case MBEDTLS_TLS_EXT_CID: 1424 MBEDTLS_SSL_DEBUG_MSG(3, ("found CID extension")); 1425 1426 ret = ssl_parse_cid_ext(ssl, ext + 4, ext_size); 1427 if (ret != 0) { 1428 return ret; 1429 } 1430 break; 1431 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 1432 1433 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 1434 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: 1435 MBEDTLS_SSL_DEBUG_MSG(3, ("found encrypt then mac extension")); 1436 1437 ret = ssl_parse_encrypt_then_mac_ext(ssl, ext + 4, ext_size); 1438 if (ret != 0) { 1439 return ret; 1440 } 1441 break; 1442 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 1443 1444 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 1445 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: 1446 MBEDTLS_SSL_DEBUG_MSG(3, ("found extended master secret extension")); 1447 1448 ret = ssl_parse_extended_ms_ext(ssl, ext + 4, ext_size); 1449 if (ret != 0) { 1450 return ret; 1451 } 1452 break; 1453 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 1454 1455 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 1456 case MBEDTLS_TLS_EXT_SESSION_TICKET: 1457 MBEDTLS_SSL_DEBUG_MSG(3, ("found session ticket extension")); 1458 1459 ret = ssl_parse_session_ticket_ext(ssl, ext + 4, ext_size); 1460 if (ret != 0) { 1461 return ret; 1462 } 1463 break; 1464 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 1465 1466 #if defined(MBEDTLS_SSL_ALPN) 1467 case MBEDTLS_TLS_EXT_ALPN: 1468 MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension")); 1469 1470 ret = mbedtls_ssl_parse_alpn_ext(ssl, ext + 4, 1471 ext + 4 + ext_size); 1472 if (ret != 0) { 1473 return ret; 1474 } 1475 break; 1476 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 1477 1478 #if defined(MBEDTLS_SSL_DTLS_SRTP) 1479 case MBEDTLS_TLS_EXT_USE_SRTP: 1480 MBEDTLS_SSL_DEBUG_MSG(3, ("found use_srtp extension")); 1481 1482 ret = ssl_parse_use_srtp_ext(ssl, ext + 4, ext_size); 1483 if (ret != 0) { 1484 return ret; 1485 } 1486 break; 1487 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 1488 1489 default: 1490 MBEDTLS_SSL_DEBUG_MSG(3, ("unknown extension found: %u (ignoring)", 1491 ext_id)); 1492 } 1493 1494 ext_len -= 4 + ext_size; 1495 ext += 4 + ext_size; 1496 } 1497 1498 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1499 1500 /* 1501 * Try to fall back to default hash SHA1 if the client 1502 * hasn't provided any preferred signature-hash combinations. 1503 */ 1504 if (!sig_hash_alg_ext_present) { 1505 uint16_t *received_sig_algs = ssl->handshake->received_sig_algs; 1506 const uint16_t default_sig_algs[] = { 1507 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 1508 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_ECDSA, 1509 MBEDTLS_SSL_HASH_SHA1), 1510 #endif 1511 #if defined(MBEDTLS_RSA_C) 1512 MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG(MBEDTLS_SSL_SIG_RSA, 1513 MBEDTLS_SSL_HASH_SHA1), 1514 #endif 1515 MBEDTLS_TLS_SIG_NONE 1516 }; 1517 1518 MBEDTLS_STATIC_ASSERT(sizeof(default_sig_algs) / sizeof(default_sig_algs[0]) 1519 <= MBEDTLS_RECEIVED_SIG_ALGS_SIZE, 1520 "default_sig_algs is too big"); 1521 1522 memcpy(received_sig_algs, default_sig_algs, sizeof(default_sig_algs)); 1523 } 1524 1525 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ 1526 1527 /* 1528 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV 1529 */ 1530 for (i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2) { 1531 if (p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO) { 1532 MBEDTLS_SSL_DEBUG_MSG(3, ("received TLS_EMPTY_RENEGOTIATION_INFO ")); 1533 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1534 if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { 1535 MBEDTLS_SSL_DEBUG_MSG(1, ("received RENEGOTIATION SCSV " 1536 "during renegotiation")); 1537 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1538 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1539 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1540 } 1541 #endif 1542 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; 1543 break; 1544 } 1545 } 1546 1547 /* 1548 * Renegotiation security checks 1549 */ 1550 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION && 1551 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) { 1552 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation, breaking off handshake")); 1553 handshake_failure = 1; 1554 } 1555 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1556 else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 1557 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && 1558 renegotiation_info_seen == 0) { 1559 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension missing (secure)")); 1560 handshake_failure = 1; 1561 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 1562 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 1563 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) { 1564 MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation not allowed")); 1565 handshake_failure = 1; 1566 } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 1567 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 1568 renegotiation_info_seen == 1) { 1569 MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension present (legacy)")); 1570 handshake_failure = 1; 1571 } 1572 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 1573 1574 if (handshake_failure == 1) { 1575 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1576 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1577 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1578 } 1579 1580 /* 1581 * Server certification selection (after processing TLS extensions) 1582 */ 1583 if (ssl->conf->f_cert_cb && (ret = ssl->conf->f_cert_cb(ssl)) != 0) { 1584 MBEDTLS_SSL_DEBUG_RET(1, "f_cert_cb", ret); 1585 return ret; 1586 } 1587 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 1588 ssl->handshake->sni_name = NULL; 1589 ssl->handshake->sni_name_len = 0; 1590 #endif 1591 1592 /* 1593 * Search for a matching ciphersuite 1594 * (At the end because we need information from the EC-based extensions 1595 * and certificate from the SNI callback triggered by the SNI extension 1596 * or certificate from server certificate selection callback.) 1597 */ 1598 got_common_suite = 0; 1599 ciphersuites = ssl->conf->ciphersuite_list; 1600 ciphersuite_info = NULL; 1601 1602 if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_CIPHERSUITE_ORDER_CLIENT) { 1603 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) { 1604 for (i = 0; ciphersuites[i] != 0; i++) { 1605 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) { 1606 continue; 1607 } 1608 1609 got_common_suite = 1; 1610 1611 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], 1612 &ciphersuite_info)) != 0) { 1613 return ret; 1614 } 1615 1616 if (ciphersuite_info != NULL) { 1617 goto have_ciphersuite; 1618 } 1619 } 1620 } 1621 } else { 1622 for (i = 0; ciphersuites[i] != 0; i++) { 1623 for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) { 1624 if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) { 1625 continue; 1626 } 1627 1628 got_common_suite = 1; 1629 1630 if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], 1631 &ciphersuite_info)) != 0) { 1632 return ret; 1633 } 1634 1635 if (ciphersuite_info != NULL) { 1636 goto have_ciphersuite; 1637 } 1638 } 1639 } 1640 } 1641 1642 if (got_common_suite) { 1643 MBEDTLS_SSL_DEBUG_MSG(1, ("got ciphersuites in common, " 1644 "but none of them usable")); 1645 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1646 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1647 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1648 } else { 1649 MBEDTLS_SSL_DEBUG_MSG(1, ("got no ciphersuites in common")); 1650 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 1651 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); 1652 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1653 } 1654 1655 have_ciphersuite: 1656 MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %s", ciphersuite_info->name)); 1657 1658 ssl->session_negotiate->ciphersuite = ciphersuites[i]; 1659 ssl->handshake->ciphersuite_info = ciphersuite_info; 1660 1661 ssl->state++; 1662 1663 #if defined(MBEDTLS_SSL_PROTO_DTLS) 1664 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 1665 mbedtls_ssl_recv_flight_completed(ssl); 1666 } 1667 #endif 1668 1669 /* Debugging-only output for testsuite */ 1670 #if defined(MBEDTLS_DEBUG_C) && \ 1671 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) 1672 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg(ciphersuite_info); 1673 if (sig_alg != MBEDTLS_PK_NONE) { 1674 unsigned int sig_hash = mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( 1675 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg)); 1676 MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext: %u", 1677 sig_hash)); 1678 } else { 1679 MBEDTLS_SSL_DEBUG_MSG(3, ("no hash algorithm for signature algorithm " 1680 "%u - should not happen", (unsigned) sig_alg)); 1681 } 1682 #endif 1683 1684 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello")); 1685 1686 return 0; 1687 } 1688 1689 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 1690 static void ssl_write_cid_ext(mbedtls_ssl_context *ssl, 1691 unsigned char *buf, 1692 size_t *olen) 1693 { 1694 unsigned char *p = buf; 1695 size_t ext_len; 1696 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 1697 1698 *olen = 0; 1699 1700 /* Skip writing the extension if we don't want to use it or if 1701 * the client hasn't offered it. */ 1702 if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED) { 1703 return; 1704 } 1705 1706 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX 1707 * which is at most 255, so the increment cannot overflow. */ 1708 if (end < p || (size_t) (end - p) < (unsigned) (ssl->own_cid_len + 5)) { 1709 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); 1710 return; 1711 } 1712 1713 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding CID extension")); 1714 1715 /* 1716 * struct { 1717 * opaque cid<0..2^8-1>; 1718 * } ConnectionId; 1719 */ 1720 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_CID, p, 0); 1721 p += 2; 1722 ext_len = (size_t) ssl->own_cid_len + 1; 1723 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0); 1724 p += 2; 1725 1726 *p++ = (uint8_t) ssl->own_cid_len; 1727 memcpy(p, ssl->own_cid, ssl->own_cid_len); 1728 1729 *olen = ssl->own_cid_len + 5; 1730 } 1731 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ 1732 1733 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) 1734 static void ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context *ssl, 1735 unsigned char *buf, 1736 size_t *olen) 1737 { 1738 unsigned char *p = buf; 1739 const mbedtls_ssl_ciphersuite_t *suite = NULL; 1740 1741 /* 1742 * RFC 7366: "If a server receives an encrypt-then-MAC request extension 1743 * from a client and then selects a stream or Authenticated Encryption 1744 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an 1745 * encrypt-then-MAC response extension back to the client." 1746 */ 1747 suite = mbedtls_ssl_ciphersuite_from_id( 1748 ssl->session_negotiate->ciphersuite); 1749 if (suite == NULL) { 1750 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; 1751 } else { 1752 mbedtls_ssl_mode_t ssl_mode = 1753 mbedtls_ssl_get_mode_from_ciphersuite( 1754 ssl->session_negotiate->encrypt_then_mac, 1755 suite); 1756 1757 if (ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM) { 1758 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; 1759 } 1760 } 1761 1762 if (ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED) { 1763 *olen = 0; 1764 return; 1765 } 1766 1767 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding encrypt then mac extension")); 1768 1769 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC, p, 0); 1770 p += 2; 1771 1772 *p++ = 0x00; 1773 *p++ = 0x00; 1774 1775 *olen = 4; 1776 } 1777 #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */ 1778 1779 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 1780 static void ssl_write_extended_ms_ext(mbedtls_ssl_context *ssl, 1781 unsigned char *buf, 1782 size_t *olen) 1783 { 1784 unsigned char *p = buf; 1785 1786 if (ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED) { 1787 *olen = 0; 1788 return; 1789 } 1790 1791 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding extended master secret " 1792 "extension")); 1793 1794 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET, p, 0); 1795 p += 2; 1796 1797 *p++ = 0x00; 1798 *p++ = 0x00; 1799 1800 *olen = 4; 1801 } 1802 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 1803 1804 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 1805 static void ssl_write_session_ticket_ext(mbedtls_ssl_context *ssl, 1806 unsigned char *buf, 1807 size_t *olen) 1808 { 1809 unsigned char *p = buf; 1810 1811 if (ssl->handshake->new_session_ticket == 0) { 1812 *olen = 0; 1813 return; 1814 } 1815 1816 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding session ticket extension")); 1817 1818 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SESSION_TICKET, p, 0); 1819 p += 2; 1820 1821 *p++ = 0x00; 1822 *p++ = 0x00; 1823 1824 *olen = 4; 1825 } 1826 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 1827 1828 static void ssl_write_renegotiation_ext(mbedtls_ssl_context *ssl, 1829 unsigned char *buf, 1830 size_t *olen) 1831 { 1832 unsigned char *p = buf; 1833 1834 if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION) { 1835 *olen = 0; 1836 return; 1837 } 1838 1839 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, secure renegotiation extension")); 1840 1841 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_RENEGOTIATION_INFO, p, 0); 1842 p += 2; 1843 1844 #if defined(MBEDTLS_SSL_RENEGOTIATION) 1845 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 1846 *p++ = 0x00; 1847 *p++ = (ssl->verify_data_len * 2 + 1) & 0xFF; 1848 *p++ = ssl->verify_data_len * 2 & 0xFF; 1849 1850 memcpy(p, ssl->peer_verify_data, ssl->verify_data_len); 1851 p += ssl->verify_data_len; 1852 memcpy(p, ssl->own_verify_data, ssl->verify_data_len); 1853 p += ssl->verify_data_len; 1854 } else 1855 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 1856 { 1857 *p++ = 0x00; 1858 *p++ = 0x01; 1859 *p++ = 0x00; 1860 } 1861 1862 *olen = (size_t) (p - buf); 1863 } 1864 1865 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 1866 static void ssl_write_max_fragment_length_ext(mbedtls_ssl_context *ssl, 1867 unsigned char *buf, 1868 size_t *olen) 1869 { 1870 unsigned char *p = buf; 1871 1872 if (ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE) { 1873 *olen = 0; 1874 return; 1875 } 1876 1877 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, max_fragment_length extension")); 1878 1879 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH, p, 0); 1880 p += 2; 1881 1882 *p++ = 0x00; 1883 *p++ = 1; 1884 1885 *p++ = ssl->session_negotiate->mfl_code; 1886 1887 *olen = 5; 1888 } 1889 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 1890 1891 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 1892 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 1893 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1894 static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl, 1895 unsigned char *buf, 1896 size_t *olen) 1897 { 1898 unsigned char *p = buf; 1899 ((void) ssl); 1900 1901 if ((ssl->handshake->cli_exts & 1902 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT) == 0) { 1903 *olen = 0; 1904 return; 1905 } 1906 1907 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, supported_point_formats extension")); 1908 1909 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS, p, 0); 1910 p += 2; 1911 1912 *p++ = 0x00; 1913 *p++ = 2; 1914 1915 *p++ = 1; 1916 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; 1917 1918 *olen = 6; 1919 } 1920 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED || 1921 MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED || 1922 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1923 1924 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 1925 static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, 1926 unsigned char *buf, 1927 size_t *olen) 1928 { 1929 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1930 unsigned char *p = buf; 1931 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 1932 size_t kkpp_len; 1933 1934 *olen = 0; 1935 1936 /* Skip costly computation if not needed */ 1937 if (ssl->handshake->ciphersuite_info->key_exchange != 1938 MBEDTLS_KEY_EXCHANGE_ECJPAKE) { 1939 return; 1940 } 1941 1942 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension")); 1943 1944 if (end - p < 4) { 1945 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); 1946 return; 1947 } 1948 1949 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0); 1950 p += 2; 1951 1952 #if defined(MBEDTLS_USE_PSA_CRYPTO) 1953 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx, 1954 p + 2, (size_t) (end - p - 2), &kkpp_len, 1955 MBEDTLS_ECJPAKE_ROUND_ONE); 1956 if (ret != 0) { 1957 psa_destroy_key(ssl->handshake->psa_pake_password); 1958 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 1959 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret); 1960 return; 1961 } 1962 #else 1963 ret = mbedtls_ecjpake_write_round_one(&ssl->handshake->ecjpake_ctx, 1964 p + 2, (size_t) (end - p - 2), &kkpp_len, 1965 ssl->conf->f_rng, ssl->conf->p_rng); 1966 if (ret != 0) { 1967 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_one", ret); 1968 return; 1969 } 1970 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 1971 1972 MBEDTLS_PUT_UINT16_BE(kkpp_len, p, 0); 1973 p += 2; 1974 1975 *olen = kkpp_len + 4; 1976 } 1977 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 1978 1979 #if defined(MBEDTLS_SSL_DTLS_SRTP) && defined(MBEDTLS_SSL_PROTO_DTLS) 1980 static void ssl_write_use_srtp_ext(mbedtls_ssl_context *ssl, 1981 unsigned char *buf, 1982 size_t *olen) 1983 { 1984 size_t mki_len = 0, ext_len = 0; 1985 uint16_t profile_value = 0; 1986 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 1987 1988 *olen = 0; 1989 1990 if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || 1991 (ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET)) { 1992 return; 1993 } 1994 1995 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding use_srtp extension")); 1996 1997 if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED) { 1998 mki_len = ssl->dtls_srtp_info.mki_len; 1999 } 2000 2001 /* The extension total size is 9 bytes : 2002 * - 2 bytes for the extension tag 2003 * - 2 bytes for the total size 2004 * - 2 bytes for the protection profile length 2005 * - 2 bytes for the protection profile 2006 * - 1 byte for the mki length 2007 * + the actual mki length 2008 * Check we have enough room in the output buffer */ 2009 if ((size_t) (end - buf) < mki_len + 9) { 2010 MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); 2011 return; 2012 } 2013 2014 /* extension */ 2015 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_USE_SRTP, buf, 0); 2016 /* 2017 * total length 5 and mki value: only one profile(2 bytes) 2018 * and length(2 bytes) and srtp_mki ) 2019 */ 2020 ext_len = 5 + mki_len; 2021 MBEDTLS_PUT_UINT16_BE(ext_len, buf, 2); 2022 2023 /* protection profile length: 2 */ 2024 buf[4] = 0x00; 2025 buf[5] = 0x02; 2026 profile_value = mbedtls_ssl_check_srtp_profile_value( 2027 ssl->dtls_srtp_info.chosen_dtls_srtp_profile); 2028 if (profile_value != MBEDTLS_TLS_SRTP_UNSET) { 2029 MBEDTLS_PUT_UINT16_BE(profile_value, buf, 6); 2030 } else { 2031 MBEDTLS_SSL_DEBUG_MSG(1, ("use_srtp extension invalid profile")); 2032 return; 2033 } 2034 2035 buf[8] = mki_len & 0xFF; 2036 memcpy(&buf[9], ssl->dtls_srtp_info.mki_value, mki_len); 2037 2038 *olen = 9 + mki_len; 2039 } 2040 #endif /* MBEDTLS_SSL_DTLS_SRTP */ 2041 2042 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 2043 MBEDTLS_CHECK_RETURN_CRITICAL 2044 static int ssl_write_hello_verify_request(mbedtls_ssl_context *ssl) 2045 { 2046 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2047 unsigned char *p = ssl->out_msg + 4; 2048 unsigned char *cookie_len_byte; 2049 2050 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello verify request")); 2051 2052 /* 2053 * struct { 2054 * ProtocolVersion server_version; 2055 * opaque cookie<0..2^8-1>; 2056 * } HelloVerifyRequest; 2057 */ 2058 2059 /* The RFC is not clear on this point, but sending the actual negotiated 2060 * version looks like the most interoperable thing to do. */ 2061 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version); 2062 MBEDTLS_SSL_DEBUG_BUF(3, "server version", p, 2); 2063 p += 2; 2064 2065 /* If we get here, f_cookie_check is not null */ 2066 if (ssl->conf->f_cookie_write == NULL) { 2067 MBEDTLS_SSL_DEBUG_MSG(1, ("inconsistent cookie callbacks")); 2068 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 2069 } 2070 2071 /* Skip length byte until we know the length */ 2072 cookie_len_byte = p++; 2073 2074 if ((ret = ssl->conf->f_cookie_write(ssl->conf->p_cookie, 2075 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN, 2076 ssl->cli_id, ssl->cli_id_len)) != 0) { 2077 MBEDTLS_SSL_DEBUG_RET(1, "f_cookie_write", ret); 2078 return ret; 2079 } 2080 2081 *cookie_len_byte = (unsigned char) (p - (cookie_len_byte + 1)); 2082 2083 MBEDTLS_SSL_DEBUG_BUF(3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte); 2084 2085 ssl->out_msglen = (size_t) (p - ssl->out_msg); 2086 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2087 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; 2088 2089 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT; 2090 2091 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 2092 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 2093 return ret; 2094 } 2095 2096 #if defined(MBEDTLS_SSL_PROTO_DTLS) 2097 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 2098 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { 2099 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); 2100 return ret; 2101 } 2102 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 2103 2104 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello verify request")); 2105 2106 return 0; 2107 } 2108 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 2109 2110 static void ssl_handle_id_based_session_resumption(mbedtls_ssl_context *ssl) 2111 { 2112 int ret; 2113 mbedtls_ssl_session session_tmp; 2114 mbedtls_ssl_session * const session = ssl->session_negotiate; 2115 2116 /* Resume is 0 by default, see ssl_handshake_init(). 2117 * It may be already set to 1 by ssl_parse_session_ticket_ext(). */ 2118 if (ssl->handshake->resume == 1) { 2119 return; 2120 } 2121 if (session->id_len == 0) { 2122 return; 2123 } 2124 if (ssl->conf->f_get_cache == NULL) { 2125 return; 2126 } 2127 #if defined(MBEDTLS_SSL_RENEGOTIATION) 2128 if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { 2129 return; 2130 } 2131 #endif 2132 2133 mbedtls_ssl_session_init(&session_tmp); 2134 2135 ret = ssl->conf->f_get_cache(ssl->conf->p_cache, 2136 session->id, 2137 session->id_len, 2138 &session_tmp); 2139 if (ret != 0) { 2140 goto exit; 2141 } 2142 2143 if (session->ciphersuite != session_tmp.ciphersuite) { 2144 /* Mismatch between cached and negotiated session */ 2145 goto exit; 2146 } 2147 2148 /* Move semantics */ 2149 mbedtls_ssl_session_free(session); 2150 *session = session_tmp; 2151 memset(&session_tmp, 0, sizeof(session_tmp)); 2152 2153 MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from cache")); 2154 ssl->handshake->resume = 1; 2155 2156 exit: 2157 2158 mbedtls_ssl_session_free(&session_tmp); 2159 } 2160 2161 MBEDTLS_CHECK_RETURN_CRITICAL 2162 static int ssl_write_server_hello(mbedtls_ssl_context *ssl) 2163 { 2164 #if defined(MBEDTLS_HAVE_TIME) 2165 mbedtls_time_t t; 2166 #endif 2167 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2168 size_t olen, ext_len = 0, n; 2169 unsigned char *buf, *p; 2170 2171 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello")); 2172 2173 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) 2174 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 2175 ssl->handshake->cookie_verify_result != 0) { 2176 MBEDTLS_SSL_DEBUG_MSG(2, ("client hello was not authenticated")); 2177 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello")); 2178 2179 return ssl_write_hello_verify_request(ssl); 2180 } 2181 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ 2182 2183 /* 2184 * 0 . 0 handshake type 2185 * 1 . 3 handshake length 2186 * 4 . 5 protocol version 2187 * 6 . 9 UNIX time() 2188 * 10 . 37 random bytes 2189 */ 2190 buf = ssl->out_msg; 2191 p = buf + 4; 2192 2193 mbedtls_ssl_write_version(p, ssl->conf->transport, ssl->tls_version); 2194 p += 2; 2195 2196 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen version: [%d:%d]", 2197 buf[4], buf[5])); 2198 2199 #if defined(MBEDTLS_HAVE_TIME) 2200 t = mbedtls_time(NULL); 2201 MBEDTLS_PUT_UINT32_BE(t, p, 0); 2202 p += 4; 2203 2204 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, current time: %" MBEDTLS_PRINTF_LONGLONG, 2205 (long long) t)); 2206 #else 2207 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 4)) != 0) { 2208 return ret; 2209 } 2210 2211 p += 4; 2212 #endif /* MBEDTLS_HAVE_TIME */ 2213 2214 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 20)) != 0) { 2215 return ret; 2216 } 2217 p += 20; 2218 2219 #if defined(MBEDTLS_SSL_PROTO_TLS1_3) 2220 /* 2221 * RFC 8446 2222 * TLS 1.3 has a downgrade protection mechanism embedded in the server's 2223 * random value. TLS 1.3 servers which negotiate TLS 1.2 or below in 2224 * response to a ClientHello MUST set the last 8 bytes of their Random 2225 * value specially in their ServerHello. 2226 */ 2227 if (mbedtls_ssl_conf_is_tls13_enabled(ssl->conf)) { 2228 static const unsigned char magic_tls12_downgrade_string[] = 2229 { 'D', 'O', 'W', 'N', 'G', 'R', 'D', 1 }; 2230 2231 MBEDTLS_STATIC_ASSERT( 2232 sizeof(magic_tls12_downgrade_string) == 8, 2233 "magic_tls12_downgrade_string does not have the expected size"); 2234 2235 memcpy(p, magic_tls12_downgrade_string, 2236 sizeof(magic_tls12_downgrade_string)); 2237 } else 2238 #endif 2239 { 2240 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 8)) != 0) { 2241 return ret; 2242 } 2243 } 2244 p += 8; 2245 2246 memcpy(ssl->handshake->randbytes + 32, buf + 6, 32); 2247 2248 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", buf + 6, 32); 2249 2250 ssl_handle_id_based_session_resumption(ssl); 2251 2252 if (ssl->handshake->resume == 0) { 2253 /* 2254 * New session, create a new session id, 2255 * unless we're about to issue a session ticket 2256 */ 2257 ssl->state++; 2258 2259 #if defined(MBEDTLS_HAVE_TIME) 2260 ssl->session_negotiate->start = mbedtls_time(NULL); 2261 #endif 2262 2263 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 2264 if (ssl->handshake->new_session_ticket != 0) { 2265 ssl->session_negotiate->id_len = n = 0; 2266 memset(ssl->session_negotiate->id, 0, 32); 2267 } else 2268 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 2269 { 2270 ssl->session_negotiate->id_len = n = 32; 2271 if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, ssl->session_negotiate->id, 2272 n)) != 0) { 2273 return ret; 2274 } 2275 } 2276 } else { 2277 /* 2278 * Resuming a session 2279 */ 2280 n = ssl->session_negotiate->id_len; 2281 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; 2282 2283 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) { 2284 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret); 2285 return ret; 2286 } 2287 } 2288 2289 /* 2290 * 38 . 38 session id length 2291 * 39 . 38+n session id 2292 * 39+n . 40+n chosen ciphersuite 2293 * 41+n . 41+n chosen compression alg. 2294 * 42+n . 43+n extensions length 2295 * 44+n . 43+n+m extensions 2296 */ 2297 *p++ = (unsigned char) ssl->session_negotiate->id_len; 2298 memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len); 2299 p += ssl->session_negotiate->id_len; 2300 2301 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n)); 2302 MBEDTLS_SSL_DEBUG_BUF(3, "server hello, session id", buf + 39, n); 2303 MBEDTLS_SSL_DEBUG_MSG(3, ("%s session has been resumed", 2304 ssl->handshake->resume ? "a" : "no")); 2305 2306 MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0); 2307 p += 2; 2308 *p++ = MBEDTLS_BYTE_0(MBEDTLS_SSL_COMPRESS_NULL); 2309 2310 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen ciphersuite: %s", 2311 mbedtls_ssl_get_ciphersuite_name(ssl->session_negotiate->ciphersuite))); 2312 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, compress alg.: 0x%02X", 2313 (unsigned int) MBEDTLS_SSL_COMPRESS_NULL)); 2314 2315 /* 2316 * First write extensions, then the total length 2317 */ 2318 ssl_write_renegotiation_ext(ssl, p + 2 + ext_len, &olen); 2319 ext_len += olen; 2320 2321 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 2322 ssl_write_max_fragment_length_ext(ssl, p + 2 + ext_len, &olen); 2323 ext_len += olen; 2324 #endif 2325 2326 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) 2327 ssl_write_cid_ext(ssl, p + 2 + ext_len, &olen); 2328 ext_len += olen; 2329 #endif 2330 2331 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM) 2332 ssl_write_encrypt_then_mac_ext(ssl, p + 2 + ext_len, &olen); 2333 ext_len += olen; 2334 #endif 2335 2336 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 2337 ssl_write_extended_ms_ext(ssl, p + 2 + ext_len, &olen); 2338 ext_len += olen; 2339 #endif 2340 2341 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 2342 ssl_write_session_ticket_ext(ssl, p + 2 + ext_len, &olen); 2343 ext_len += olen; 2344 #endif 2345 2346 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_1_2_ENABLED) || \ 2347 defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) || \ 2348 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 2349 const mbedtls_ssl_ciphersuite_t *suite = 2350 mbedtls_ssl_ciphersuite_from_id(ssl->session_negotiate->ciphersuite); 2351 if (suite != NULL && mbedtls_ssl_ciphersuite_uses_ec(suite)) { 2352 ssl_write_supported_point_formats_ext(ssl, p + 2 + ext_len, &olen); 2353 ext_len += olen; 2354 } 2355 #endif 2356 2357 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 2358 ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen); 2359 ext_len += olen; 2360 #endif 2361 2362 #if defined(MBEDTLS_SSL_ALPN) 2363 unsigned char *end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN - 4; 2364 if ((ret = mbedtls_ssl_write_alpn_ext(ssl, p + 2 + ext_len, end, &olen)) 2365 != 0) { 2366 return ret; 2367 } 2368 2369 ext_len += olen; 2370 #endif 2371 2372 #if defined(MBEDTLS_SSL_DTLS_SRTP) 2373 ssl_write_use_srtp_ext(ssl, p + 2 + ext_len, &olen); 2374 ext_len += olen; 2375 #endif 2376 2377 MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, total extension length: %" MBEDTLS_PRINTF_SIZET, 2378 ext_len)); 2379 2380 if (ext_len > 0) { 2381 MBEDTLS_PUT_UINT16_BE(ext_len, p, 0); 2382 p += 2 + ext_len; 2383 } 2384 2385 ssl->out_msglen = (size_t) (p - buf); 2386 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2387 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO; 2388 2389 ret = mbedtls_ssl_write_handshake_msg(ssl); 2390 2391 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello")); 2392 2393 return ret; 2394 } 2395 2396 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) 2397 MBEDTLS_CHECK_RETURN_CRITICAL 2398 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl) 2399 { 2400 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2401 ssl->handshake->ciphersuite_info; 2402 2403 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request")); 2404 2405 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { 2406 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request")); 2407 ssl->state++; 2408 return 0; 2409 } 2410 2411 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 2412 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 2413 } 2414 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 2415 MBEDTLS_CHECK_RETURN_CRITICAL 2416 static int ssl_write_certificate_request(mbedtls_ssl_context *ssl) 2417 { 2418 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 2419 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2420 ssl->handshake->ciphersuite_info; 2421 uint16_t dn_size, total_dn_size; /* excluding length bytes */ 2422 size_t ct_len, sa_len; /* including length bytes */ 2423 unsigned char *buf, *p; 2424 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; 2425 const mbedtls_x509_crt *crt; 2426 int authmode; 2427 2428 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request")); 2429 2430 ssl->state++; 2431 2432 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2433 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) { 2434 authmode = ssl->handshake->sni_authmode; 2435 } else 2436 #endif 2437 authmode = ssl->conf->authmode; 2438 2439 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info) || 2440 authmode == MBEDTLS_SSL_VERIFY_NONE) { 2441 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request")); 2442 return 0; 2443 } 2444 2445 /* 2446 * 0 . 0 handshake type 2447 * 1 . 3 handshake length 2448 * 4 . 4 cert type count 2449 * 5 .. m-1 cert types 2450 * m .. m+1 sig alg length (TLS 1.2 only) 2451 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only) 2452 * n .. n+1 length of all DNs 2453 * n+2 .. n+3 length of DN 1 2454 * n+4 .. ... Distinguished Name #1 2455 * ... .. ... length of DN 2, etc. 2456 */ 2457 buf = ssl->out_msg; 2458 p = buf + 4; 2459 2460 /* 2461 * Supported certificate types 2462 * 2463 * ClientCertificateType certificate_types<1..2^8-1>; 2464 * enum { (255) } ClientCertificateType; 2465 */ 2466 ct_len = 0; 2467 2468 #if defined(MBEDTLS_RSA_C) 2469 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN; 2470 #endif 2471 #if defined(MBEDTLS_KEY_EXCHANGE_ECDSA_CERT_REQ_ALLOWED_ENABLED) 2472 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN; 2473 #endif 2474 2475 p[0] = (unsigned char) ct_len++; 2476 p += ct_len; 2477 2478 sa_len = 0; 2479 2480 /* 2481 * Add signature_algorithms for verify (TLS 1.2) 2482 * 2483 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; 2484 * 2485 * struct { 2486 * HashAlgorithm hash; 2487 * SignatureAlgorithm signature; 2488 * } SignatureAndHashAlgorithm; 2489 * 2490 * enum { (255) } HashAlgorithm; 2491 * enum { (255) } SignatureAlgorithm; 2492 */ 2493 const uint16_t *sig_alg = mbedtls_ssl_get_sig_algs(ssl); 2494 if (sig_alg == NULL) { 2495 return MBEDTLS_ERR_SSL_BAD_CONFIG; 2496 } 2497 2498 for (; *sig_alg != MBEDTLS_TLS_SIG_NONE; sig_alg++) { 2499 unsigned char hash = MBEDTLS_BYTE_1(*sig_alg); 2500 2501 if (mbedtls_ssl_set_calc_verify_md(ssl, hash)) { 2502 continue; 2503 } 2504 if (!mbedtls_ssl_sig_alg_is_supported(ssl, *sig_alg)) { 2505 continue; 2506 } 2507 2508 /* Write elements at offsets starting from 1 (offset 0 is for the 2509 * length). Thus the offset of each element is the length of the 2510 * partial list including that element. */ 2511 sa_len += 2; 2512 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, sa_len); 2513 2514 } 2515 2516 /* Fill in list length. */ 2517 MBEDTLS_PUT_UINT16_BE(sa_len, p, 0); 2518 sa_len += 2; 2519 p += sa_len; 2520 2521 /* 2522 * DistinguishedName certificate_authorities<0..2^16-1>; 2523 * opaque DistinguishedName<1..2^16-1>; 2524 */ 2525 p += 2; 2526 2527 total_dn_size = 0; 2528 2529 if (ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED) { 2530 /* NOTE: If trusted certificates are provisioned 2531 * via a CA callback (configured through 2532 * `mbedtls_ssl_conf_ca_cb()`, then the 2533 * CertificateRequest is currently left empty. */ 2534 2535 #if defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) 2536 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2537 if (ssl->handshake->dn_hints != NULL) { 2538 crt = ssl->handshake->dn_hints; 2539 } else 2540 #endif 2541 if (ssl->conf->dn_hints != NULL) { 2542 crt = ssl->conf->dn_hints; 2543 } else 2544 #endif 2545 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 2546 if (ssl->handshake->sni_ca_chain != NULL) { 2547 crt = ssl->handshake->sni_ca_chain; 2548 } else 2549 #endif 2550 crt = ssl->conf->ca_chain; 2551 2552 while (crt != NULL && crt->version != 0) { 2553 /* It follows from RFC 5280 A.1 that this length 2554 * can be represented in at most 11 bits. */ 2555 dn_size = (uint16_t) crt->subject_raw.len; 2556 2557 if (end < p || (size_t) (end - p) < 2 + (size_t) dn_size) { 2558 MBEDTLS_SSL_DEBUG_MSG(1, ("skipping CAs: buffer too short")); 2559 break; 2560 } 2561 2562 MBEDTLS_PUT_UINT16_BE(dn_size, p, 0); 2563 p += 2; 2564 memcpy(p, crt->subject_raw.p, dn_size); 2565 p += dn_size; 2566 2567 MBEDTLS_SSL_DEBUG_BUF(3, "requested DN", p - dn_size, dn_size); 2568 2569 total_dn_size += (unsigned short) (2 + dn_size); 2570 crt = crt->next; 2571 } 2572 } 2573 2574 ssl->out_msglen = (size_t) (p - buf); 2575 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 2576 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST; 2577 MBEDTLS_PUT_UINT16_BE(total_dn_size, ssl->out_msg, 4 + ct_len + sa_len); 2578 2579 ret = mbedtls_ssl_write_handshake_msg(ssl); 2580 2581 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request")); 2582 2583 return ret; 2584 } 2585 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 2586 2587 #if (defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 2588 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)) 2589 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2590 MBEDTLS_CHECK_RETURN_CRITICAL 2591 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) 2592 { 2593 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2594 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 2595 mbedtls_pk_context *pk; 2596 mbedtls_pk_type_t pk_type; 2597 psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; 2598 unsigned char buf[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; 2599 size_t key_len; 2600 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2601 uint16_t tls_id = 0; 2602 psa_key_type_t key_type = PSA_KEY_TYPE_NONE; 2603 mbedtls_ecp_group_id grp_id; 2604 mbedtls_ecp_keypair *key; 2605 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */ 2606 2607 pk = mbedtls_ssl_own_key(ssl); 2608 2609 if (pk == NULL) { 2610 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; 2611 } 2612 2613 pk_type = mbedtls_pk_get_type(pk); 2614 2615 switch (pk_type) { 2616 case MBEDTLS_PK_OPAQUE: 2617 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2618 case MBEDTLS_PK_ECKEY: 2619 case MBEDTLS_PK_ECKEY_DH: 2620 case MBEDTLS_PK_ECDSA: 2621 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ 2622 if (!mbedtls_pk_can_do(pk, MBEDTLS_PK_ECKEY)) { 2623 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; 2624 } 2625 2626 /* Get the attributes of the key previously parsed by PK module in 2627 * order to extract its type and length (in bits). */ 2628 status = psa_get_key_attributes(pk->priv_id, &key_attributes); 2629 if (status != PSA_SUCCESS) { 2630 ret = PSA_TO_MBEDTLS_ERR(status); 2631 goto exit; 2632 } 2633 ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes); 2634 ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes); 2635 2636 #if defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2637 if (pk_type != MBEDTLS_PK_OPAQUE) { 2638 /* PK_ECKEY[_DH] and PK_ECDSA instead as parsed from the PK 2639 * module and only have ECDSA capabilities. Since we need 2640 * them for ECDH later, we export and then re-import them with 2641 * proper flags and algorithm. Of course We also set key's type 2642 * and bits that we just got above. */ 2643 key_attributes = psa_key_attributes_init(); 2644 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 2645 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 2646 psa_set_key_type(&key_attributes, 2647 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type)); 2648 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits); 2649 2650 status = psa_export_key(pk->priv_id, buf, sizeof(buf), &key_len); 2651 if (status != PSA_SUCCESS) { 2652 ret = PSA_TO_MBEDTLS_ERR(status); 2653 goto exit; 2654 } 2655 status = psa_import_key(&key_attributes, buf, key_len, 2656 &ssl->handshake->xxdh_psa_privkey); 2657 if (status != PSA_SUCCESS) { 2658 ret = PSA_TO_MBEDTLS_ERR(status); 2659 goto exit; 2660 } 2661 2662 /* Set this key as owned by the TLS library: it will be its duty 2663 * to clear it exit. */ 2664 ssl->handshake->xxdh_psa_privkey_is_external = 0; 2665 2666 ret = 0; 2667 break; 2668 } 2669 #endif /* MBEDTLS_PK_USE_PSA_EC_DATA */ 2670 2671 /* Opaque key is created by the user (externally from Mbed TLS) 2672 * so we assume it already has the right algorithm and flags 2673 * set. Just copy its ID as reference. */ 2674 ssl->handshake->xxdh_psa_privkey = pk->priv_id; 2675 ssl->handshake->xxdh_psa_privkey_is_external = 1; 2676 ret = 0; 2677 break; 2678 2679 #if !defined(MBEDTLS_PK_USE_PSA_EC_DATA) 2680 case MBEDTLS_PK_ECKEY: 2681 case MBEDTLS_PK_ECKEY_DH: 2682 case MBEDTLS_PK_ECDSA: 2683 key = mbedtls_pk_ec_rw(*pk); 2684 grp_id = mbedtls_pk_get_ec_group_id(pk); 2685 if (grp_id == MBEDTLS_ECP_DP_NONE) { 2686 return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; 2687 } 2688 tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id); 2689 if (tls_id == 0) { 2690 /* This elliptic curve is not supported */ 2691 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 2692 } 2693 2694 /* If the above conversion to TLS ID was fine, then also this one will 2695 be, so there is no need to check the return value here */ 2696 mbedtls_ssl_get_psa_curve_info_from_tls_id(tls_id, &key_type, 2697 &ssl->handshake->xxdh_psa_bits); 2698 2699 ssl->handshake->xxdh_psa_type = key_type; 2700 2701 key_attributes = psa_key_attributes_init(); 2702 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 2703 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 2704 psa_set_key_type(&key_attributes, 2705 PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type)); 2706 psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits); 2707 2708 ret = mbedtls_ecp_write_key_ext(key, &key_len, buf, sizeof(buf)); 2709 if (ret != 0) { 2710 mbedtls_platform_zeroize(buf, sizeof(buf)); 2711 break; 2712 } 2713 2714 status = psa_import_key(&key_attributes, buf, key_len, 2715 &ssl->handshake->xxdh_psa_privkey); 2716 if (status != PSA_SUCCESS) { 2717 ret = PSA_TO_MBEDTLS_ERR(status); 2718 mbedtls_platform_zeroize(buf, sizeof(buf)); 2719 break; 2720 } 2721 2722 mbedtls_platform_zeroize(buf, sizeof(buf)); 2723 ret = 0; 2724 break; 2725 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */ 2726 default: 2727 ret = MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; 2728 } 2729 2730 exit: 2731 psa_reset_key_attributes(&key_attributes); 2732 mbedtls_platform_zeroize(buf, sizeof(buf)); 2733 2734 return ret; 2735 } 2736 #else /* MBEDTLS_USE_PSA_CRYPTO */ 2737 MBEDTLS_CHECK_RETURN_CRITICAL 2738 static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) 2739 { 2740 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2741 2742 const mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl); 2743 if (private_key == NULL) { 2744 MBEDTLS_SSL_DEBUG_MSG(1, ("got no server private key")); 2745 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 2746 } 2747 2748 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_ECKEY)) { 2749 MBEDTLS_SSL_DEBUG_MSG(1, ("server key not ECDH capable")); 2750 return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; 2751 } 2752 2753 if ((ret = mbedtls_ecdh_get_params(&ssl->handshake->ecdh_ctx, 2754 mbedtls_pk_ec_ro(*mbedtls_ssl_own_key(ssl)), 2755 MBEDTLS_ECDH_OURS)) != 0) { 2756 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecdh_get_params"), ret); 2757 return ret; 2758 } 2759 2760 return 0; 2761 } 2762 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 2763 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || 2764 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 2765 2766 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ 2767 defined(MBEDTLS_SSL_ASYNC_PRIVATE) 2768 MBEDTLS_CHECK_RETURN_CRITICAL 2769 static int ssl_resume_server_key_exchange(mbedtls_ssl_context *ssl, 2770 size_t *signature_len) 2771 { 2772 /* Append the signature to ssl->out_msg, leaving 2 bytes for the 2773 * signature length which will be added in ssl_write_server_key_exchange 2774 * after the call to ssl_prepare_server_key_exchange. 2775 * ssl_write_server_key_exchange also takes care of incrementing 2776 * ssl->out_msglen. */ 2777 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2; 2778 size_t sig_max_len = (ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN 2779 - sig_start); 2780 int ret = ssl->conf->f_async_resume(ssl, 2781 sig_start, signature_len, sig_max_len); 2782 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 2783 ssl->handshake->async_in_progress = 0; 2784 mbedtls_ssl_set_async_operation_data(ssl, NULL); 2785 } 2786 MBEDTLS_SSL_DEBUG_RET(2, "ssl_resume_server_key_exchange", ret); 2787 return ret; 2788 } 2789 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && 2790 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ 2791 2792 /* Prepare the ServerKeyExchange message, up to and including 2793 * calculating the signature if any, but excluding formatting the 2794 * signature and sending the message. */ 2795 MBEDTLS_CHECK_RETURN_CRITICAL 2796 static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl, 2797 size_t *signature_len) 2798 { 2799 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 2800 ssl->handshake->ciphersuite_info; 2801 2802 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) 2803 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2804 unsigned char *dig_signed = NULL; 2805 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 2806 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ 2807 2808 (void) ciphersuite_info; /* unused in some configurations */ 2809 #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2810 (void) signature_len; 2811 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 2812 2813 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2814 #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) 2815 size_t out_buf_len = ssl->out_buf_len - (size_t) (ssl->out_msg - ssl->out_buf); 2816 #else 2817 size_t out_buf_len = MBEDTLS_SSL_OUT_BUFFER_LEN - (size_t) (ssl->out_msg - ssl->out_buf); 2818 #endif 2819 #endif 2820 2821 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */ 2822 2823 /* 2824 * 2825 * Part 1: Provide key exchange parameters for chosen ciphersuite. 2826 * 2827 */ 2828 2829 /* 2830 * - ECJPAKE key exchanges 2831 */ 2832 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 2833 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { 2834 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2835 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2836 unsigned char *out_p = ssl->out_msg + ssl->out_msglen; 2837 unsigned char *end_p = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN - 2838 ssl->out_msglen; 2839 size_t output_offset = 0; 2840 size_t output_len = 0; 2841 2842 /* 2843 * The first 3 bytes are: 2844 * [0] MBEDTLS_ECP_TLS_NAMED_CURVE 2845 * [1, 2] elliptic curve's TLS ID 2846 * 2847 * However since we only support secp256r1 for now, we hardcode its 2848 * TLS ID here 2849 */ 2850 uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( 2851 MBEDTLS_ECP_DP_SECP256R1); 2852 if (tls_id == 0) { 2853 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 2854 } 2855 *out_p = MBEDTLS_ECP_TLS_NAMED_CURVE; 2856 MBEDTLS_PUT_UINT16_BE(tls_id, out_p, 1); 2857 output_offset += 3; 2858 2859 ret = mbedtls_psa_ecjpake_write_round(&ssl->handshake->psa_pake_ctx, 2860 out_p + output_offset, 2861 end_p - out_p - output_offset, &output_len, 2862 MBEDTLS_ECJPAKE_ROUND_TWO); 2863 if (ret != 0) { 2864 psa_destroy_key(ssl->handshake->psa_pake_password); 2865 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 2866 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret); 2867 return ret; 2868 } 2869 2870 output_offset += output_len; 2871 ssl->out_msglen += output_offset; 2872 #else 2873 size_t len = 0; 2874 2875 ret = mbedtls_ecjpake_write_round_two( 2876 &ssl->handshake->ecjpake_ctx, 2877 ssl->out_msg + ssl->out_msglen, 2878 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len, 2879 ssl->conf->f_rng, ssl->conf->p_rng); 2880 if (ret != 0) { 2881 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_two", ret); 2882 return ret; 2883 } 2884 2885 ssl->out_msglen += len; 2886 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 2887 } 2888 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 2889 2890 /* 2891 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support 2892 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature, 2893 * we use empty support identity hints here. 2894 **/ 2895 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ 2896 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 2897 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || 2898 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { 2899 ssl->out_msg[ssl->out_msglen++] = 0x00; 2900 ssl->out_msg[ssl->out_msglen++] = 0x00; 2901 } 2902 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || 2903 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 2904 2905 /* 2906 * - DHE key exchanges 2907 */ 2908 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) 2909 if (mbedtls_ssl_ciphersuite_uses_dhe(ciphersuite_info)) { 2910 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2911 size_t len = 0; 2912 2913 if (ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL) { 2914 MBEDTLS_SSL_DEBUG_MSG(1, ("no DH parameters set")); 2915 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 2916 } 2917 2918 /* 2919 * Ephemeral DH parameters: 2920 * 2921 * struct { 2922 * opaque dh_p<1..2^16-1>; 2923 * opaque dh_g<1..2^16-1>; 2924 * opaque dh_Ys<1..2^16-1>; 2925 * } ServerDHParams; 2926 */ 2927 if ((ret = mbedtls_dhm_set_group(&ssl->handshake->dhm_ctx, 2928 &ssl->conf->dhm_P, 2929 &ssl->conf->dhm_G)) != 0) { 2930 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_set_group", ret); 2931 return ret; 2932 } 2933 2934 if ((ret = mbedtls_dhm_make_params( 2935 &ssl->handshake->dhm_ctx, 2936 (int) mbedtls_dhm_get_len(&ssl->handshake->dhm_ctx), 2937 ssl->out_msg + ssl->out_msglen, &len, 2938 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 2939 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_make_params", ret); 2940 return ret; 2941 } 2942 2943 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 2944 dig_signed = ssl->out_msg + ssl->out_msglen; 2945 #endif 2946 2947 ssl->out_msglen += len; 2948 2949 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: X ", &ssl->handshake->dhm_ctx.X); 2950 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: P ", &ssl->handshake->dhm_ctx.P); 2951 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: G ", &ssl->handshake->dhm_ctx.G); 2952 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GX", &ssl->handshake->dhm_ctx.GX); 2953 } 2954 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */ 2955 2956 /* 2957 * - ECDHE key exchanges 2958 */ 2959 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) 2960 if (mbedtls_ssl_ciphersuite_uses_ecdhe(ciphersuite_info)) { 2961 /* 2962 * Ephemeral ECDH parameters: 2963 * 2964 * struct { 2965 * ECParameters curve_params; 2966 * ECPoint public; 2967 * } ServerECDHParams; 2968 */ 2969 uint16_t *curr_tls_id = ssl->handshake->curves_tls_id; 2970 const uint16_t *group_list = mbedtls_ssl_get_groups(ssl); 2971 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 2972 size_t len = 0; 2973 2974 /* Match our preference list against the offered curves */ 2975 if ((group_list == NULL) || (curr_tls_id == NULL)) { 2976 return MBEDTLS_ERR_SSL_BAD_CONFIG; 2977 } 2978 for (; *group_list != 0; group_list++) { 2979 for (curr_tls_id = ssl->handshake->curves_tls_id; 2980 *curr_tls_id != 0; curr_tls_id++) { 2981 if (*curr_tls_id == *group_list) { 2982 goto curve_matching_done; 2983 } 2984 } 2985 } 2986 2987 curve_matching_done: 2988 if (*curr_tls_id == 0) { 2989 MBEDTLS_SSL_DEBUG_MSG(1, ("no matching curve for ECDHE")); 2990 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 2991 } 2992 2993 MBEDTLS_SSL_DEBUG_MSG(2, ("ECDHE curve: %s", 2994 mbedtls_ssl_get_curve_name_from_tls_id(*curr_tls_id))); 2995 2996 #if defined(MBEDTLS_USE_PSA_CRYPTO) 2997 psa_status_t status = PSA_ERROR_GENERIC_ERROR; 2998 psa_key_attributes_t key_attributes; 2999 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 3000 uint8_t *p = ssl->out_msg + ssl->out_msglen; 3001 const size_t header_size = 4; // curve_type(1), namedcurve(2), 3002 // data length(1) 3003 const size_t data_length_size = 1; 3004 psa_key_type_t key_type = PSA_KEY_TYPE_NONE; 3005 size_t ec_bits = 0; 3006 3007 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH computation.")); 3008 3009 /* Convert EC's TLS ID to PSA key type. */ 3010 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(*curr_tls_id, 3011 &key_type, 3012 &ec_bits) == PSA_ERROR_NOT_SUPPORTED) { 3013 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid ecc group parse.")); 3014 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 3015 } 3016 handshake->xxdh_psa_type = key_type; 3017 handshake->xxdh_psa_bits = ec_bits; 3018 3019 key_attributes = psa_key_attributes_init(); 3020 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 3021 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 3022 psa_set_key_type(&key_attributes, handshake->xxdh_psa_type); 3023 psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits); 3024 3025 /* 3026 * ECParameters curve_params 3027 * 3028 * First byte is curve_type, always named_curve 3029 */ 3030 *p++ = MBEDTLS_ECP_TLS_NAMED_CURVE; 3031 3032 /* 3033 * Next two bytes are the namedcurve value 3034 */ 3035 MBEDTLS_PUT_UINT16_BE(*curr_tls_id, p, 0); 3036 p += 2; 3037 3038 /* Generate ECDH private key. */ 3039 status = psa_generate_key(&key_attributes, 3040 &handshake->xxdh_psa_privkey); 3041 if (status != PSA_SUCCESS) { 3042 ret = PSA_TO_MBEDTLS_ERR(status); 3043 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret); 3044 return ret; 3045 } 3046 3047 /* 3048 * ECPoint public 3049 * 3050 * First byte is data length. 3051 * It will be filled later. p holds now the data length location. 3052 */ 3053 3054 /* Export the public part of the ECDH private key from PSA. 3055 * Make one byte space for the length. 3056 */ 3057 unsigned char *own_pubkey = p + data_length_size; 3058 3059 size_t own_pubkey_max_len = (size_t) (MBEDTLS_SSL_OUT_CONTENT_LEN 3060 - (own_pubkey - ssl->out_msg)); 3061 3062 status = psa_export_public_key(handshake->xxdh_psa_privkey, 3063 own_pubkey, own_pubkey_max_len, 3064 &len); 3065 if (status != PSA_SUCCESS) { 3066 ret = PSA_TO_MBEDTLS_ERR(status); 3067 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret); 3068 (void) psa_destroy_key(handshake->xxdh_psa_privkey); 3069 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3070 return ret; 3071 } 3072 3073 /* Store the length of the exported public key. */ 3074 *p = (uint8_t) len; 3075 3076 /* Determine full message length. */ 3077 len += header_size; 3078 #else 3079 mbedtls_ecp_group_id curr_grp_id = 3080 mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id); 3081 3082 if ((ret = mbedtls_ecdh_setup(&ssl->handshake->ecdh_ctx, 3083 curr_grp_id)) != 0) { 3084 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecp_group_load", ret); 3085 return ret; 3086 } 3087 3088 if ((ret = mbedtls_ecdh_make_params( 3089 &ssl->handshake->ecdh_ctx, &len, 3090 ssl->out_msg + ssl->out_msglen, 3091 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, 3092 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3093 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_make_params", ret); 3094 return ret; 3095 } 3096 3097 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3098 MBEDTLS_DEBUG_ECDH_Q); 3099 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3100 3101 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 3102 dig_signed = ssl->out_msg + ssl->out_msglen; 3103 #endif 3104 3105 ssl->out_msglen += len; 3106 } 3107 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */ 3108 3109 /* 3110 * 3111 * Part 2: For key exchanges involving the server signing the 3112 * exchange parameters, compute and add the signature here. 3113 * 3114 */ 3115 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 3116 if (mbedtls_ssl_ciphersuite_uses_server_signature(ciphersuite_info)) { 3117 if (dig_signed == NULL) { 3118 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3119 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3120 } 3121 3122 size_t dig_signed_len = (size_t) (ssl->out_msg + ssl->out_msglen - dig_signed); 3123 size_t hashlen = 0; 3124 unsigned char hash[MBEDTLS_MD_MAX_SIZE]; 3125 3126 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3127 3128 /* 3129 * 2.1: Choose hash algorithm: 3130 * For TLS 1.2, obey signature-hash-algorithm extension 3131 * to choose appropriate hash. 3132 */ 3133 3134 mbedtls_pk_type_t sig_alg = 3135 mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info); 3136 3137 unsigned char sig_hash = 3138 (unsigned char) mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg( 3139 ssl, mbedtls_ssl_sig_from_pk_alg(sig_alg)); 3140 3141 mbedtls_md_type_t md_alg = mbedtls_ssl_md_alg_from_hash(sig_hash); 3142 3143 /* For TLS 1.2, obey signature-hash-algorithm extension 3144 * (RFC 5246, Sec. 7.4.1.4.1). */ 3145 if (sig_alg == MBEDTLS_PK_NONE || md_alg == MBEDTLS_MD_NONE) { 3146 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3147 /* (... because we choose a cipher suite 3148 * only if there is a matching hash.) */ 3149 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3150 } 3151 3152 MBEDTLS_SSL_DEBUG_MSG(3, ("pick hash algorithm %u for signing", (unsigned) md_alg)); 3153 3154 /* 3155 * 2.2: Compute the hash to be signed 3156 */ 3157 if (md_alg != MBEDTLS_MD_NONE) { 3158 ret = mbedtls_ssl_get_key_exchange_md_tls1_2(ssl, hash, &hashlen, 3159 dig_signed, 3160 dig_signed_len, 3161 md_alg); 3162 if (ret != 0) { 3163 return ret; 3164 } 3165 } else { 3166 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3167 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3168 } 3169 3170 MBEDTLS_SSL_DEBUG_BUF(3, "parameters hash", hash, hashlen); 3171 3172 /* 3173 * 2.3: Compute and add the signature 3174 */ 3175 /* 3176 * We need to specify signature and hash algorithm explicitly through 3177 * a prefix to the signature. 3178 * 3179 * struct { 3180 * HashAlgorithm hash; 3181 * SignatureAlgorithm signature; 3182 * } SignatureAndHashAlgorithm; 3183 * 3184 * struct { 3185 * SignatureAndHashAlgorithm algorithm; 3186 * opaque signature<0..2^16-1>; 3187 * } DigitallySigned; 3188 * 3189 */ 3190 3191 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_hash_from_md_alg(md_alg); 3192 ssl->out_msg[ssl->out_msglen++] = mbedtls_ssl_sig_from_pk_alg(sig_alg); 3193 3194 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3195 if (ssl->conf->f_async_sign_start != NULL) { 3196 ret = ssl->conf->f_async_sign_start(ssl, 3197 mbedtls_ssl_own_cert(ssl), 3198 md_alg, hash, hashlen); 3199 switch (ret) { 3200 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: 3201 /* act as if f_async_sign was null */ 3202 break; 3203 case 0: 3204 ssl->handshake->async_in_progress = 1; 3205 return ssl_resume_server_key_exchange(ssl, signature_len); 3206 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: 3207 ssl->handshake->async_in_progress = 1; 3208 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; 3209 default: 3210 MBEDTLS_SSL_DEBUG_RET(1, "f_async_sign_start", ret); 3211 return ret; 3212 } 3213 } 3214 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3215 3216 if (mbedtls_ssl_own_key(ssl) == NULL) { 3217 MBEDTLS_SSL_DEBUG_MSG(1, ("got no private key")); 3218 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 3219 } 3220 3221 /* Append the signature to ssl->out_msg, leaving 2 bytes for the 3222 * signature length which will be added in ssl_write_server_key_exchange 3223 * after the call to ssl_prepare_server_key_exchange. 3224 * ssl_write_server_key_exchange also takes care of incrementing 3225 * ssl->out_msglen. */ 3226 if ((ret = mbedtls_pk_sign(mbedtls_ssl_own_key(ssl), 3227 md_alg, hash, hashlen, 3228 ssl->out_msg + ssl->out_msglen + 2, 3229 out_buf_len - ssl->out_msglen - 2, 3230 signature_len, 3231 ssl->conf->f_rng, 3232 ssl->conf->p_rng)) != 0) { 3233 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_sign", ret); 3234 return ret; 3235 } 3236 } 3237 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 3238 3239 return 0; 3240 } 3241 3242 /* Prepare the ServerKeyExchange message and send it. For ciphersuites 3243 * that do not include a ServerKeyExchange message, do nothing. Either 3244 * way, if successful, move on to the next step in the SSL state 3245 * machine. */ 3246 MBEDTLS_CHECK_RETURN_CRITICAL 3247 static int ssl_write_server_key_exchange(mbedtls_ssl_context *ssl) 3248 { 3249 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3250 size_t signature_len = 0; 3251 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) 3252 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 3253 ssl->handshake->ciphersuite_info; 3254 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ 3255 3256 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server key exchange")); 3257 3258 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) 3259 /* Extract static ECDH parameters and abort if ServerKeyExchange 3260 * is not needed. */ 3261 if (mbedtls_ssl_ciphersuite_no_pfs(ciphersuite_info)) { 3262 /* For suites involving ECDH, extract DH parameters 3263 * from certificate at this point. */ 3264 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) 3265 if (mbedtls_ssl_ciphersuite_uses_ecdh(ciphersuite_info)) { 3266 ret = ssl_get_ecdh_params_from_cert(ssl); 3267 if (ret != 0) { 3268 MBEDTLS_SSL_DEBUG_RET(1, "ssl_get_ecdh_params_from_cert", ret); 3269 return ret; 3270 } 3271 } 3272 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ 3273 3274 /* Key exchanges not involving ephemeral keys don't use 3275 * ServerKeyExchange, so end here. */ 3276 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write server key exchange")); 3277 ssl->state++; 3278 return 0; 3279 } 3280 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ 3281 3282 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ 3283 defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3284 /* If we have already prepared the message and there is an ongoing 3285 * signature operation, resume signing. */ 3286 if (ssl->handshake->async_in_progress != 0) { 3287 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming signature operation")); 3288 ret = ssl_resume_server_key_exchange(ssl, &signature_len); 3289 } else 3290 #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && 3291 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ 3292 { 3293 /* ServerKeyExchange is needed. Prepare the message. */ 3294 ret = ssl_prepare_server_key_exchange(ssl, &signature_len); 3295 } 3296 3297 if (ret != 0) { 3298 /* If we're starting to write a new message, set ssl->out_msglen 3299 * to 0. But if we're resuming after an asynchronous message, 3300 * out_msglen is the amount of data written so far and mst be 3301 * preserved. */ 3302 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 3303 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange (pending)")); 3304 } else { 3305 ssl->out_msglen = 0; 3306 } 3307 return ret; 3308 } 3309 3310 /* If there is a signature, write its length. 3311 * ssl_prepare_server_key_exchange already wrote the signature 3312 * itself at its proper place in the output buffer. */ 3313 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) 3314 if (signature_len != 0) { 3315 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_1(signature_len); 3316 ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_0(signature_len); 3317 3318 MBEDTLS_SSL_DEBUG_BUF(3, "my signature", 3319 ssl->out_msg + ssl->out_msglen, 3320 signature_len); 3321 3322 /* Skip over the already-written signature */ 3323 ssl->out_msglen += signature_len; 3324 } 3325 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ 3326 3327 /* Add header and send. */ 3328 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 3329 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE; 3330 3331 ssl->state++; 3332 3333 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 3334 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 3335 return ret; 3336 } 3337 3338 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange")); 3339 return 0; 3340 } 3341 3342 MBEDTLS_CHECK_RETURN_CRITICAL 3343 static int ssl_write_server_hello_done(mbedtls_ssl_context *ssl) 3344 { 3345 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3346 3347 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello done")); 3348 3349 ssl->out_msglen = 4; 3350 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 3351 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE; 3352 3353 ssl->state++; 3354 3355 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3356 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { 3357 mbedtls_ssl_send_flight_completed(ssl); 3358 } 3359 #endif 3360 3361 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 3362 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 3363 return ret; 3364 } 3365 3366 #if defined(MBEDTLS_SSL_PROTO_DTLS) 3367 if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 3368 (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { 3369 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); 3370 return ret; 3371 } 3372 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 3373 3374 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello done")); 3375 3376 return 0; 3377 } 3378 3379 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ 3380 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 3381 MBEDTLS_CHECK_RETURN_CRITICAL 3382 static int ssl_parse_client_dh_public(mbedtls_ssl_context *ssl, unsigned char **p, 3383 const unsigned char *end) 3384 { 3385 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 3386 size_t n; 3387 3388 /* 3389 * Receive G^Y mod P, premaster = (G^Y)^X mod P 3390 */ 3391 if (*p + 2 > end) { 3392 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3393 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3394 } 3395 3396 n = MBEDTLS_GET_UINT16_BE(*p, 0); 3397 *p += 2; 3398 3399 if (*p + n > end) { 3400 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3401 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3402 } 3403 3404 if ((ret = mbedtls_dhm_read_public(&ssl->handshake->dhm_ctx, *p, n)) != 0) { 3405 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_read_public", ret); 3406 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3407 } 3408 3409 *p += n; 3410 3411 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GY", &ssl->handshake->dhm_ctx.GY); 3412 3413 return ret; 3414 } 3415 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || 3416 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 3417 3418 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ 3419 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 3420 3421 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3422 MBEDTLS_CHECK_RETURN_CRITICAL 3423 static int ssl_resume_decrypt_pms(mbedtls_ssl_context *ssl, 3424 unsigned char *peer_pms, 3425 size_t *peer_pmslen, 3426 size_t peer_pmssize) 3427 { 3428 int ret = ssl->conf->f_async_resume(ssl, 3429 peer_pms, peer_pmslen, peer_pmssize); 3430 if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 3431 ssl->handshake->async_in_progress = 0; 3432 mbedtls_ssl_set_async_operation_data(ssl, NULL); 3433 } 3434 MBEDTLS_SSL_DEBUG_RET(2, "ssl_decrypt_encrypted_pms", ret); 3435 return ret; 3436 } 3437 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3438 3439 MBEDTLS_CHECK_RETURN_CRITICAL 3440 static int ssl_decrypt_encrypted_pms(mbedtls_ssl_context *ssl, 3441 const unsigned char *p, 3442 const unsigned char *end, 3443 unsigned char *peer_pms, 3444 size_t *peer_pmslen, 3445 size_t peer_pmssize) 3446 { 3447 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3448 3449 mbedtls_x509_crt *own_cert = mbedtls_ssl_own_cert(ssl); 3450 if (own_cert == NULL) { 3451 MBEDTLS_SSL_DEBUG_MSG(1, ("got no local certificate")); 3452 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE; 3453 } 3454 mbedtls_pk_context *public_key = &own_cert->pk; 3455 mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl); 3456 size_t len = mbedtls_pk_get_len(public_key); 3457 3458 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3459 /* If we have already started decoding the message and there is an ongoing 3460 * decryption operation, resume signing. */ 3461 if (ssl->handshake->async_in_progress != 0) { 3462 MBEDTLS_SSL_DEBUG_MSG(2, ("resuming decryption operation")); 3463 return ssl_resume_decrypt_pms(ssl, 3464 peer_pms, peer_pmslen, peer_pmssize); 3465 } 3466 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3467 3468 /* 3469 * Prepare to decrypt the premaster using own private RSA key 3470 */ 3471 if (p + 2 > end) { 3472 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3473 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3474 } 3475 if (*p++ != MBEDTLS_BYTE_1(len) || 3476 *p++ != MBEDTLS_BYTE_0(len)) { 3477 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3478 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3479 } 3480 3481 if (p + len != end) { 3482 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3483 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3484 } 3485 3486 /* 3487 * Decrypt the premaster secret 3488 */ 3489 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3490 if (ssl->conf->f_async_decrypt_start != NULL) { 3491 ret = ssl->conf->f_async_decrypt_start(ssl, 3492 mbedtls_ssl_own_cert(ssl), 3493 p, len); 3494 switch (ret) { 3495 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: 3496 /* act as if f_async_decrypt_start was null */ 3497 break; 3498 case 0: 3499 ssl->handshake->async_in_progress = 1; 3500 return ssl_resume_decrypt_pms(ssl, 3501 peer_pms, 3502 peer_pmslen, 3503 peer_pmssize); 3504 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: 3505 ssl->handshake->async_in_progress = 1; 3506 return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; 3507 default: 3508 MBEDTLS_SSL_DEBUG_RET(1, "f_async_decrypt_start", ret); 3509 return ret; 3510 } 3511 } 3512 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3513 3514 if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_RSA)) { 3515 MBEDTLS_SSL_DEBUG_MSG(1, ("got no RSA private key")); 3516 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 3517 } 3518 3519 ret = mbedtls_pk_decrypt(private_key, p, len, 3520 peer_pms, peer_pmslen, peer_pmssize, 3521 ssl->conf->f_rng, ssl->conf->p_rng); 3522 return ret; 3523 } 3524 3525 MBEDTLS_CHECK_RETURN_CRITICAL 3526 static int ssl_parse_encrypted_pms(mbedtls_ssl_context *ssl, 3527 const unsigned char *p, 3528 const unsigned char *end, 3529 size_t pms_offset) 3530 { 3531 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3532 unsigned char *pms = ssl->handshake->premaster + pms_offset; 3533 unsigned char ver[2]; 3534 unsigned char fake_pms[48], peer_pms[48]; 3535 size_t peer_pmslen; 3536 mbedtls_ct_condition_t diff; 3537 3538 /* In case of a failure in decryption, the decryption may write less than 3539 * 2 bytes of output, but we always read the first two bytes. It doesn't 3540 * matter in the end because diff will be nonzero in that case due to 3541 * ret being nonzero, and we only care whether diff is 0. 3542 * But do initialize peer_pms and peer_pmslen for robustness anyway. This 3543 * also makes memory analyzers happy (don't access uninitialized memory, 3544 * even if it's an unsigned char). */ 3545 peer_pms[0] = peer_pms[1] = ~0; 3546 peer_pmslen = 0; 3547 3548 ret = ssl_decrypt_encrypted_pms(ssl, p, end, 3549 peer_pms, 3550 &peer_pmslen, 3551 sizeof(peer_pms)); 3552 3553 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3554 if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { 3555 return ret; 3556 } 3557 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3558 3559 mbedtls_ssl_write_version(ver, ssl->conf->transport, 3560 ssl->session_negotiate->tls_version); 3561 3562 /* Avoid data-dependent branches while checking for invalid 3563 * padding, to protect against timing-based Bleichenbacher-type 3564 * attacks. */ 3565 diff = mbedtls_ct_bool(ret); 3566 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pmslen, 48)); 3567 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[0], ver[0])); 3568 diff = mbedtls_ct_bool_or(diff, mbedtls_ct_uint_ne(peer_pms[1], ver[1])); 3569 3570 /* 3571 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding 3572 * must not cause the connection to end immediately; instead, send a 3573 * bad_record_mac later in the handshake. 3574 * To protect against timing-based variants of the attack, we must 3575 * not have any branch that depends on whether the decryption was 3576 * successful. In particular, always generate the fake premaster secret, 3577 * regardless of whether it will ultimately influence the output or not. 3578 */ 3579 ret = ssl->conf->f_rng(ssl->conf->p_rng, fake_pms, sizeof(fake_pms)); 3580 if (ret != 0) { 3581 /* It's ok to abort on an RNG failure, since this does not reveal 3582 * anything about the RSA decryption. */ 3583 return ret; 3584 } 3585 3586 #if defined(MBEDTLS_SSL_DEBUG_ALL) 3587 if (diff != MBEDTLS_CT_FALSE) { 3588 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3589 } 3590 #endif 3591 3592 if (sizeof(ssl->handshake->premaster) < pms_offset || 3593 sizeof(ssl->handshake->premaster) - pms_offset < 48) { 3594 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 3595 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 3596 } 3597 ssl->handshake->pmslen = 48; 3598 3599 /* Set pms to either the true or the fake PMS, without 3600 * data-dependent branches. */ 3601 mbedtls_ct_memcpy_if(diff, pms, fake_pms, peer_pms, ssl->handshake->pmslen); 3602 3603 return 0; 3604 } 3605 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || 3606 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 3607 3608 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) 3609 MBEDTLS_CHECK_RETURN_CRITICAL 3610 static int ssl_parse_client_psk_identity(mbedtls_ssl_context *ssl, unsigned char **p, 3611 const unsigned char *end) 3612 { 3613 int ret = 0; 3614 uint16_t n; 3615 3616 if (ssl_conf_has_psk_or_cb(ssl->conf) == 0) { 3617 MBEDTLS_SSL_DEBUG_MSG(1, ("got no pre-shared key")); 3618 return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; 3619 } 3620 3621 /* 3622 * Receive client pre-shared key identity name 3623 */ 3624 if (end - *p < 2) { 3625 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3626 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3627 } 3628 3629 n = MBEDTLS_GET_UINT16_BE(*p, 0); 3630 *p += 2; 3631 3632 if (n == 0 || n > end - *p) { 3633 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3634 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3635 } 3636 3637 if (ssl->conf->f_psk != NULL) { 3638 if (ssl->conf->f_psk(ssl->conf->p_psk, ssl, *p, n) != 0) { 3639 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; 3640 } 3641 } else { 3642 /* Identity is not a big secret since clients send it in the clear, 3643 * but treat it carefully anyway, just in case */ 3644 if (n != ssl->conf->psk_identity_len || 3645 mbedtls_ct_memcmp(ssl->conf->psk_identity, *p, n) != 0) { 3646 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; 3647 } 3648 } 3649 3650 if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) { 3651 MBEDTLS_SSL_DEBUG_BUF(3, "Unknown PSK identity", *p, n); 3652 mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 3653 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY); 3654 return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; 3655 } 3656 3657 *p += n; 3658 3659 return 0; 3660 } 3661 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ 3662 3663 MBEDTLS_CHECK_RETURN_CRITICAL 3664 static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl) 3665 { 3666 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 3667 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 3668 unsigned char *p, *end; 3669 3670 ciphersuite_info = ssl->handshake->ciphersuite_info; 3671 3672 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client key exchange")); 3673 3674 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \ 3675 (defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ 3676 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)) 3677 if ((ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || 3678 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) && 3679 (ssl->handshake->async_in_progress != 0)) { 3680 /* We've already read a record and there is an asynchronous 3681 * operation in progress to decrypt it. So skip reading the 3682 * record. */ 3683 MBEDTLS_SSL_DEBUG_MSG(3, ("will resume decryption of previously-read record")); 3684 } else 3685 #endif 3686 if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) { 3687 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret); 3688 return ret; 3689 } 3690 3691 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl); 3692 end = ssl->in_msg + ssl->in_hslen; 3693 3694 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) { 3695 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3696 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 3697 } 3698 3699 if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE) { 3700 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); 3701 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 3702 } 3703 3704 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) 3705 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA) { 3706 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) { 3707 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret); 3708 return ret; 3709 } 3710 3711 if (p != end) { 3712 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); 3713 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3714 } 3715 3716 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx, 3717 ssl->handshake->premaster, 3718 MBEDTLS_PREMASTER_SIZE, 3719 &ssl->handshake->pmslen, 3720 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3721 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret); 3722 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3723 } 3724 3725 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K); 3726 } else 3727 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ 3728 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 3729 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ 3730 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 3731 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) 3732 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || 3733 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || 3734 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || 3735 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA) { 3736 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3737 size_t data_len = (size_t) (*p++); 3738 size_t buf_len = (size_t) (end - p); 3739 psa_status_t status = PSA_ERROR_GENERIC_ERROR; 3740 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 3741 3742 MBEDTLS_SSL_DEBUG_MSG(3, ("Read the peer's public key.")); 3743 3744 /* 3745 * We must have at least two bytes (1 for length, at least 1 for data) 3746 */ 3747 if (buf_len < 2) { 3748 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid buffer length: %" MBEDTLS_PRINTF_SIZET, 3749 buf_len)); 3750 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3751 } 3752 3753 if (data_len < 1 || data_len > buf_len) { 3754 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid data length: %" MBEDTLS_PRINTF_SIZET 3755 " > %" MBEDTLS_PRINTF_SIZET, 3756 data_len, buf_len)); 3757 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3758 } 3759 3760 /* Store peer's ECDH public key. */ 3761 if (data_len > sizeof(handshake->xxdh_psa_peerkey)) { 3762 MBEDTLS_SSL_DEBUG_MSG(1, ("Invalid public key length: %" MBEDTLS_PRINTF_SIZET 3763 " > %" MBEDTLS_PRINTF_SIZET, 3764 data_len, 3765 sizeof(handshake->xxdh_psa_peerkey))); 3766 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3767 } 3768 memcpy(handshake->xxdh_psa_peerkey, p, data_len); 3769 handshake->xxdh_psa_peerkey_len = data_len; 3770 3771 /* Compute ECDH shared secret. */ 3772 status = psa_raw_key_agreement( 3773 PSA_ALG_ECDH, handshake->xxdh_psa_privkey, 3774 handshake->xxdh_psa_peerkey, handshake->xxdh_psa_peerkey_len, 3775 handshake->premaster, sizeof(handshake->premaster), 3776 &handshake->pmslen); 3777 if (status != PSA_SUCCESS) { 3778 ret = PSA_TO_MBEDTLS_ERR(status); 3779 MBEDTLS_SSL_DEBUG_RET(1, "psa_raw_key_agreement", ret); 3780 if (handshake->xxdh_psa_privkey_is_external == 0) { 3781 (void) psa_destroy_key(handshake->xxdh_psa_privkey); 3782 } 3783 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3784 return ret; 3785 } 3786 3787 if (handshake->xxdh_psa_privkey_is_external == 0) { 3788 status = psa_destroy_key(handshake->xxdh_psa_privkey); 3789 3790 if (status != PSA_SUCCESS) { 3791 ret = PSA_TO_MBEDTLS_ERR(status); 3792 MBEDTLS_SSL_DEBUG_RET(1, "psa_destroy_key", ret); 3793 return ret; 3794 } 3795 } 3796 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3797 #else 3798 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx, 3799 p, (size_t) (end - p))) != 0) { 3800 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret); 3801 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3802 } 3803 3804 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3805 MBEDTLS_DEBUG_ECDH_QP); 3806 3807 if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, 3808 &ssl->handshake->pmslen, 3809 ssl->handshake->premaster, 3810 MBEDTLS_MPI_MAX_SIZE, 3811 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3812 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret); 3813 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3814 } 3815 3816 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 3817 MBEDTLS_DEBUG_ECDH_Z); 3818 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3819 } else 3820 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 3821 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || 3822 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || 3823 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 3824 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) 3825 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK) { 3826 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3827 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3828 return ret; 3829 } 3830 3831 if (p != end) { 3832 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); 3833 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3834 } 3835 3836 #if !defined(MBEDTLS_USE_PSA_CRYPTO) 3837 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3838 (mbedtls_key_exchange_type_t) ciphersuite_info-> 3839 key_exchange)) != 0) { 3840 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 3841 return ret; 3842 } 3843 #endif /* !MBEDTLS_USE_PSA_CRYPTO */ 3844 } else 3845 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ 3846 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 3847 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) { 3848 #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) 3849 if (ssl->handshake->async_in_progress != 0) { 3850 /* There is an asynchronous operation in progress to 3851 * decrypt the encrypted premaster secret, so skip 3852 * directly to resuming this operation. */ 3853 MBEDTLS_SSL_DEBUG_MSG(3, ("PSK identity already parsed")); 3854 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms 3855 * won't actually use it, but maintain p anyway for robustness. */ 3856 p += ssl->conf->psk_identity_len + 2; 3857 } else 3858 #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ 3859 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3860 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3861 return ret; 3862 } 3863 3864 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 2)) != 0) { 3865 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_encrypted_pms"), ret); 3866 return ret; 3867 } 3868 3869 #if !defined(MBEDTLS_USE_PSA_CRYPTO) 3870 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3871 (mbedtls_key_exchange_type_t) ciphersuite_info-> 3872 key_exchange)) != 0) { 3873 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 3874 return ret; 3875 } 3876 #endif /* !MBEDTLS_USE_PSA_CRYPTO */ 3877 } else 3878 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 3879 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 3880 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK) { 3881 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3882 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3883 return ret; 3884 } 3885 if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) { 3886 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret); 3887 return ret; 3888 } 3889 3890 if (p != end) { 3891 MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); 3892 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3893 } 3894 3895 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3896 unsigned char *pms = ssl->handshake->premaster; 3897 unsigned char *pms_end = pms + sizeof(ssl->handshake->premaster); 3898 size_t pms_len; 3899 3900 /* Write length only when we know the actual value */ 3901 if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx, 3902 pms + 2, pms_end - (pms + 2), &pms_len, 3903 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 3904 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret); 3905 return ret; 3906 } 3907 MBEDTLS_PUT_UINT16_BE(pms_len, pms, 0); 3908 pms += 2 + pms_len; 3909 3910 MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K); 3911 #else 3912 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 3913 (mbedtls_key_exchange_type_t) ciphersuite_info-> 3914 key_exchange)) != 0) { 3915 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 3916 return ret; 3917 } 3918 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 3919 } else 3920 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 3921 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 3922 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { 3923 #if defined(MBEDTLS_USE_PSA_CRYPTO) 3924 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 3925 psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED; 3926 size_t ecpoint_len; 3927 3928 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 3929 3930 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 3931 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 3932 psa_destroy_key(handshake->xxdh_psa_privkey); 3933 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3934 return ret; 3935 } 3936 3937 /* Keep a copy of the peer's public key */ 3938 if (p >= end) { 3939 psa_destroy_key(handshake->xxdh_psa_privkey); 3940 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3941 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3942 } 3943 3944 ecpoint_len = *(p++); 3945 if ((size_t) (end - p) < ecpoint_len) { 3946 psa_destroy_key(handshake->xxdh_psa_privkey); 3947 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3948 return MBEDTLS_ERR_SSL_DECODE_ERROR; 3949 } 3950 3951 /* When FFDH is enabled, the array handshake->xxdh_psa_peer_key size takes into account 3952 the sizes of the FFDH keys which are at least 2048 bits. 3953 The size of the array is thus greater than 256 bytes which is greater than any 3954 possible value of ecpoint_len (type uint8_t) and the check below can be skipped.*/ 3955 #if !defined(PSA_WANT_ALG_FFDH) 3956 if (ecpoint_len > sizeof(handshake->xxdh_psa_peerkey)) { 3957 psa_destroy_key(handshake->xxdh_psa_privkey); 3958 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3959 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 3960 } 3961 #else 3962 MBEDTLS_STATIC_ASSERT(sizeof(handshake->xxdh_psa_peerkey) >= UINT8_MAX, 3963 "peer key buffer too small"); 3964 #endif 3965 3966 memcpy(handshake->xxdh_psa_peerkey, p, ecpoint_len); 3967 handshake->xxdh_psa_peerkey_len = ecpoint_len; 3968 p += ecpoint_len; 3969 3970 /* As RFC 5489 section 2, the premaster secret is formed as follows: 3971 * - a uint16 containing the length (in octets) of the ECDH computation 3972 * - the octet string produced by the ECDH computation 3973 * - a uint16 containing the length (in octets) of the PSK 3974 * - the PSK itself 3975 */ 3976 unsigned char *psm = ssl->handshake->premaster; 3977 const unsigned char * const psm_end = 3978 psm + sizeof(ssl->handshake->premaster); 3979 /* uint16 to store length (in octets) of the ECDH computation */ 3980 const size_t zlen_size = 2; 3981 size_t zlen = 0; 3982 3983 /* Compute ECDH shared secret. */ 3984 status = psa_raw_key_agreement(PSA_ALG_ECDH, 3985 handshake->xxdh_psa_privkey, 3986 handshake->xxdh_psa_peerkey, 3987 handshake->xxdh_psa_peerkey_len, 3988 psm + zlen_size, 3989 psm_end - (psm + zlen_size), 3990 &zlen); 3991 3992 destruction_status = psa_destroy_key(handshake->xxdh_psa_privkey); 3993 handshake->xxdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; 3994 3995 if (status != PSA_SUCCESS) { 3996 return PSA_TO_MBEDTLS_ERR(status); 3997 } else if (destruction_status != PSA_SUCCESS) { 3998 return PSA_TO_MBEDTLS_ERR(destruction_status); 3999 } 4000 4001 /* Write the ECDH computation length before the ECDH computation */ 4002 MBEDTLS_PUT_UINT16_BE(zlen, psm, 0); 4003 psm += zlen_size + zlen; 4004 4005 #else /* MBEDTLS_USE_PSA_CRYPTO */ 4006 if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { 4007 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); 4008 return ret; 4009 } 4010 4011 if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx, 4012 p, (size_t) (end - p))) != 0) { 4013 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret); 4014 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4015 } 4016 4017 MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, 4018 MBEDTLS_DEBUG_ECDH_QP); 4019 4020 if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, 4021 (mbedtls_key_exchange_type_t) ciphersuite_info-> 4022 key_exchange)) != 0) { 4023 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); 4024 return ret; 4025 } 4026 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4027 } else 4028 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 4029 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) 4030 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) { 4031 if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 0)) != 0) { 4032 MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_parse_encrypted_pms_secret"), ret); 4033 return ret; 4034 } 4035 } else 4036 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ 4037 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 4038 if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { 4039 #if defined(MBEDTLS_USE_PSA_CRYPTO) 4040 if ((ret = mbedtls_psa_ecjpake_read_round( 4041 &ssl->handshake->psa_pake_ctx, p, (size_t) (end - p), 4042 MBEDTLS_ECJPAKE_ROUND_TWO)) != 0) { 4043 psa_destroy_key(ssl->handshake->psa_pake_password); 4044 psa_pake_abort(&ssl->handshake->psa_pake_ctx); 4045 4046 MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_input round two", ret); 4047 return ret; 4048 } 4049 #else 4050 ret = mbedtls_ecjpake_read_round_two(&ssl->handshake->ecjpake_ctx, 4051 p, (size_t) (end - p)); 4052 if (ret != 0) { 4053 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_two", ret); 4054 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4055 } 4056 4057 ret = mbedtls_ecjpake_derive_secret(&ssl->handshake->ecjpake_ctx, 4058 ssl->handshake->premaster, 32, &ssl->handshake->pmslen, 4059 ssl->conf->f_rng, ssl->conf->p_rng); 4060 if (ret != 0) { 4061 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_derive_secret", ret); 4062 return ret; 4063 } 4064 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 4065 } else 4066 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 4067 { 4068 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 4069 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4070 } 4071 4072 if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) { 4073 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret); 4074 return ret; 4075 } 4076 4077 ssl->state++; 4078 4079 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client key exchange")); 4080 4081 return 0; 4082 } 4083 4084 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) 4085 MBEDTLS_CHECK_RETURN_CRITICAL 4086 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) 4087 { 4088 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 4089 ssl->handshake->ciphersuite_info; 4090 4091 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); 4092 4093 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { 4094 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4095 ssl->state++; 4096 return 0; 4097 } 4098 4099 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 4100 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4101 } 4102 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 4103 MBEDTLS_CHECK_RETURN_CRITICAL 4104 static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) 4105 { 4106 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 4107 size_t i, sig_len; 4108 unsigned char hash[48]; 4109 unsigned char *hash_start = hash; 4110 size_t hashlen; 4111 mbedtls_pk_type_t pk_alg; 4112 mbedtls_md_type_t md_alg; 4113 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 4114 ssl->handshake->ciphersuite_info; 4115 mbedtls_pk_context *peer_pk; 4116 4117 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); 4118 4119 if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { 4120 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4121 ssl->state++; 4122 return 0; 4123 } 4124 4125 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 4126 if (ssl->session_negotiate->peer_cert == NULL) { 4127 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4128 ssl->state++; 4129 return 0; 4130 } 4131 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4132 if (ssl->session_negotiate->peer_cert_digest == NULL) { 4133 MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); 4134 ssl->state++; 4135 return 0; 4136 } 4137 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4138 4139 /* Read the message without adding it to the checksum */ 4140 ret = mbedtls_ssl_read_record(ssl, 0 /* no checksum update */); 4141 if (0 != ret) { 4142 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_read_record"), ret); 4143 return ret; 4144 } 4145 4146 ssl->state++; 4147 4148 /* Process the message contents */ 4149 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || 4150 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY) { 4151 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4152 return MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 4153 } 4154 4155 i = mbedtls_ssl_hs_hdr_len(ssl); 4156 4157 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 4158 peer_pk = &ssl->handshake->peer_pubkey; 4159 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4160 if (ssl->session_negotiate->peer_cert == NULL) { 4161 /* Should never happen */ 4162 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 4163 } 4164 peer_pk = &ssl->session_negotiate->peer_cert->pk; 4165 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 4166 4167 /* 4168 * struct { 4169 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only 4170 * opaque signature<0..2^16-1>; 4171 * } DigitallySigned; 4172 */ 4173 if (i + 2 > ssl->in_hslen) { 4174 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4175 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4176 } 4177 4178 /* 4179 * Hash 4180 */ 4181 md_alg = mbedtls_ssl_md_alg_from_hash(ssl->in_msg[i]); 4182 4183 if (md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md(ssl, ssl->in_msg[i])) { 4184 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg" 4185 " for verify message")); 4186 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 4187 } 4188 4189 #if !defined(MBEDTLS_MD_SHA1) 4190 if (MBEDTLS_MD_SHA1 == md_alg) { 4191 hash_start += 16; 4192 } 4193 #endif 4194 4195 /* Info from md_alg will be used instead */ 4196 hashlen = 0; 4197 4198 i++; 4199 4200 /* 4201 * Signature 4202 */ 4203 if ((pk_alg = mbedtls_ssl_pk_alg_from_sig(ssl->in_msg[i])) 4204 == MBEDTLS_PK_NONE) { 4205 MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg" 4206 " for verify message")); 4207 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 4208 } 4209 4210 /* 4211 * Check the certificate's key type matches the signature alg 4212 */ 4213 if (!mbedtls_pk_can_do(peer_pk, pk_alg)) { 4214 MBEDTLS_SSL_DEBUG_MSG(1, ("sig_alg doesn't match cert key")); 4215 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 4216 } 4217 4218 i++; 4219 4220 if (i + 2 > ssl->in_hslen) { 4221 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4222 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4223 } 4224 4225 sig_len = MBEDTLS_GET_UINT16_BE(ssl->in_msg, i); 4226 i += 2; 4227 4228 if (i + sig_len != ssl->in_hslen) { 4229 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); 4230 return MBEDTLS_ERR_SSL_DECODE_ERROR; 4231 } 4232 4233 /* Calculate hash and verify signature */ 4234 { 4235 size_t dummy_hlen; 4236 ret = ssl->handshake->calc_verify(ssl, hash, &dummy_hlen); 4237 if (0 != ret) { 4238 MBEDTLS_SSL_DEBUG_RET(1, ("calc_verify"), ret); 4239 return ret; 4240 } 4241 } 4242 4243 if ((ret = mbedtls_pk_verify(peer_pk, 4244 md_alg, hash_start, hashlen, 4245 ssl->in_msg + i, sig_len)) != 0) { 4246 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify", ret); 4247 return ret; 4248 } 4249 4250 ret = mbedtls_ssl_update_handshake_status(ssl); 4251 if (0 != ret) { 4252 MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_update_handshake_status"), ret); 4253 return ret; 4254 } 4255 4256 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify")); 4257 4258 return ret; 4259 } 4260 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ 4261 4262 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 4263 MBEDTLS_CHECK_RETURN_CRITICAL 4264 static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl) 4265 { 4266 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 4267 size_t tlen; 4268 uint32_t lifetime; 4269 4270 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write new session ticket")); 4271 4272 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 4273 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET; 4274 4275 /* 4276 * struct { 4277 * uint32 ticket_lifetime_hint; 4278 * opaque ticket<0..2^16-1>; 4279 * } NewSessionTicket; 4280 * 4281 * 4 . 7 ticket_lifetime_hint (0 = unspecified) 4282 * 8 . 9 ticket_len (n) 4283 * 10 . 9+n ticket content 4284 */ 4285 4286 #if defined(MBEDTLS_HAVE_TIME) 4287 ssl->session_negotiate->ticket_creation_time = mbedtls_ms_time(); 4288 #endif 4289 if ((ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket, 4290 ssl->session_negotiate, 4291 ssl->out_msg + 10, 4292 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN, 4293 &tlen, &lifetime)) != 0) { 4294 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_write", ret); 4295 tlen = 0; 4296 } 4297 4298 MBEDTLS_PUT_UINT32_BE(lifetime, ssl->out_msg, 4); 4299 MBEDTLS_PUT_UINT16_BE(tlen, ssl->out_msg, 8); 4300 ssl->out_msglen = 10 + tlen; 4301 4302 /* 4303 * Morally equivalent to updating ssl->state, but NewSessionTicket and 4304 * ChangeCipherSpec share the same state. 4305 */ 4306 ssl->handshake->new_session_ticket = 0; 4307 4308 if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { 4309 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); 4310 return ret; 4311 } 4312 4313 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket")); 4314 4315 return 0; 4316 } 4317 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 4318 4319 /* 4320 * SSL handshake -- server side -- single step 4321 */ 4322 int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl) 4323 { 4324 int ret = 0; 4325 4326 MBEDTLS_SSL_DEBUG_MSG(2, ("server state: %d", ssl->state)); 4327 4328 switch (ssl->state) { 4329 case MBEDTLS_SSL_HELLO_REQUEST: 4330 ssl->state = MBEDTLS_SSL_CLIENT_HELLO; 4331 break; 4332 4333 /* 4334 * <== ClientHello 4335 */ 4336 case MBEDTLS_SSL_CLIENT_HELLO: 4337 ret = ssl_parse_client_hello(ssl); 4338 break; 4339 4340 #if defined(MBEDTLS_SSL_PROTO_DTLS) 4341 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: 4342 return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED; 4343 #endif 4344 4345 /* 4346 * ==> ServerHello 4347 * Certificate 4348 * ( ServerKeyExchange ) 4349 * ( CertificateRequest ) 4350 * ServerHelloDone 4351 */ 4352 case MBEDTLS_SSL_SERVER_HELLO: 4353 ret = ssl_write_server_hello(ssl); 4354 break; 4355 4356 case MBEDTLS_SSL_SERVER_CERTIFICATE: 4357 ret = mbedtls_ssl_write_certificate(ssl); 4358 break; 4359 4360 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: 4361 ret = ssl_write_server_key_exchange(ssl); 4362 break; 4363 4364 case MBEDTLS_SSL_CERTIFICATE_REQUEST: 4365 ret = ssl_write_certificate_request(ssl); 4366 break; 4367 4368 case MBEDTLS_SSL_SERVER_HELLO_DONE: 4369 ret = ssl_write_server_hello_done(ssl); 4370 break; 4371 4372 /* 4373 * <== ( Certificate/Alert ) 4374 * ClientKeyExchange 4375 * ( CertificateVerify ) 4376 * ChangeCipherSpec 4377 * Finished 4378 */ 4379 case MBEDTLS_SSL_CLIENT_CERTIFICATE: 4380 ret = mbedtls_ssl_parse_certificate(ssl); 4381 break; 4382 4383 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: 4384 ret = ssl_parse_client_key_exchange(ssl); 4385 break; 4386 4387 case MBEDTLS_SSL_CERTIFICATE_VERIFY: 4388 ret = ssl_parse_certificate_verify(ssl); 4389 break; 4390 4391 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: 4392 ret = mbedtls_ssl_parse_change_cipher_spec(ssl); 4393 break; 4394 4395 case MBEDTLS_SSL_CLIENT_FINISHED: 4396 ret = mbedtls_ssl_parse_finished(ssl); 4397 break; 4398 4399 /* 4400 * ==> ( NewSessionTicket ) 4401 * ChangeCipherSpec 4402 * Finished 4403 */ 4404 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: 4405 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 4406 if (ssl->handshake->new_session_ticket != 0) { 4407 ret = ssl_write_new_session_ticket(ssl); 4408 } else 4409 #endif 4410 ret = mbedtls_ssl_write_change_cipher_spec(ssl); 4411 break; 4412 4413 case MBEDTLS_SSL_SERVER_FINISHED: 4414 ret = mbedtls_ssl_write_finished(ssl); 4415 break; 4416 4417 case MBEDTLS_SSL_FLUSH_BUFFERS: 4418 MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done")); 4419 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; 4420 break; 4421 4422 case MBEDTLS_SSL_HANDSHAKE_WRAPUP: 4423 mbedtls_ssl_handshake_wrapup(ssl); 4424 break; 4425 4426 default: 4427 MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state)); 4428 return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; 4429 } 4430 4431 return ret; 4432 } 4433 4434 void mbedtls_ssl_conf_preference_order(mbedtls_ssl_config *conf, int order) 4435 { 4436 conf->respect_cli_pref = order; 4437 } 4438 4439 #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_PROTO_TLS1_2 */ 4440