1 /* 2 * TLS 1.3 functionality shared between client and server 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 */ 19 20 #include "common.h" 21 22 #if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) 23 24 #include <string.h> 25 26 #include "mbedtls/error.h" 27 #include "mbedtls/debug.h" 28 #include "mbedtls/oid.h" 29 #include "mbedtls/platform.h" 30 #include "mbedtls/constant_time.h" 31 #include "psa/crypto.h" 32 #include "mbedtls/psa_util.h" 33 34 #include "ssl_misc.h" 35 #include "ssl_tls13_invasive.h" 36 #include "ssl_tls13_keys.h" 37 #include "ssl_debug_helpers.h" 38 39 #include "psa/crypto.h" 40 #include "mbedtls/psa_util.h" 41 42 #define PSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \ 43 psa_to_ssl_errors, \ 44 psa_generic_status_to_mbedtls) 45 46 const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[ 47 MBEDTLS_SERVER_HELLO_RANDOM_LEN] = 48 { 0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11, 49 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91, 50 0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E, 51 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C }; 52 53 int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl, 54 unsigned hs_type, 55 unsigned char **buf, 56 size_t *buf_len) 57 { 58 int ret; 59 60 if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) { 61 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret); 62 goto cleanup; 63 } 64 65 if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || 66 ssl->in_msg[0] != hs_type) { 67 MBEDTLS_SSL_DEBUG_MSG(1, ("Receive unexpected handshake message.")); 68 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE, 69 MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE); 70 ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE; 71 goto cleanup; 72 } 73 74 /* 75 * Jump handshake header (4 bytes, see Section 4 of RFC 8446). 76 * ... 77 * HandshakeType msg_type; 78 * uint24 length; 79 * ... 80 */ 81 *buf = ssl->in_msg + 4; 82 *buf_len = ssl->in_hslen - 4; 83 84 cleanup: 85 86 return ret; 87 } 88 89 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) 90 /* 91 * STATE HANDLING: Read CertificateVerify 92 */ 93 /* Macro to express the maximum length of the verify structure. 94 * 95 * The structure is computed per TLS 1.3 specification as: 96 * - 64 bytes of octet 32, 97 * - 33 bytes for the context string 98 * (which is either "TLS 1.3, client CertificateVerify" 99 * or "TLS 1.3, server CertificateVerify"), 100 * - 1 byte for the octet 0x0, which serves as a separator, 101 * - 32 or 48 bytes for the Transcript-Hash(Handshake Context, Certificate) 102 * (depending on the size of the transcript_hash) 103 * 104 * This results in a total size of 105 * - 130 bytes for a SHA256-based transcript hash, or 106 * (64 + 33 + 1 + 32 bytes) 107 * - 146 bytes for a SHA384-based transcript hash. 108 * (64 + 33 + 1 + 48 bytes) 109 * 110 */ 111 #define SSL_VERIFY_STRUCT_MAX_SIZE (64 + \ 112 33 + \ 113 1 + \ 114 MBEDTLS_TLS1_3_MD_MAX_SIZE \ 115 ) 116 117 /* 118 * The ssl_tls13_create_verify_structure() creates the verify structure. 119 * As input, it requires the transcript hash. 120 * 121 * The caller has to ensure that the buffer has size at least 122 * SSL_VERIFY_STRUCT_MAX_SIZE bytes. 123 */ 124 static void ssl_tls13_create_verify_structure(const unsigned char *transcript_hash, 125 size_t transcript_hash_len, 126 unsigned char *verify_buffer, 127 size_t *verify_buffer_len, 128 int from) 129 { 130 size_t idx; 131 132 /* RFC 8446, Section 4.4.3: 133 * 134 * The digital signature [in the CertificateVerify message] is then 135 * computed over the concatenation of: 136 * - A string that consists of octet 32 (0x20) repeated 64 times 137 * - The context string 138 * - A single 0 byte which serves as the separator 139 * - The content to be signed 140 */ 141 memset(verify_buffer, 0x20, 64); 142 idx = 64; 143 144 if (from == MBEDTLS_SSL_IS_CLIENT) { 145 memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(client_cv)); 146 idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(client_cv); 147 } else { /* from == MBEDTLS_SSL_IS_SERVER */ 148 memcpy(verify_buffer + idx, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(server_cv)); 149 idx += MBEDTLS_SSL_TLS1_3_LBL_LEN(server_cv); 150 } 151 152 verify_buffer[idx++] = 0x0; 153 154 memcpy(verify_buffer + idx, transcript_hash, transcript_hash_len); 155 idx += transcript_hash_len; 156 157 *verify_buffer_len = idx; 158 } 159 160 MBEDTLS_CHECK_RETURN_CRITICAL 161 static int ssl_tls13_parse_certificate_verify(mbedtls_ssl_context *ssl, 162 const unsigned char *buf, 163 const unsigned char *end, 164 const unsigned char *verify_buffer, 165 size_t verify_buffer_len) 166 { 167 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 168 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 169 const unsigned char *p = buf; 170 uint16_t algorithm; 171 size_t signature_len; 172 mbedtls_pk_type_t sig_alg; 173 mbedtls_md_type_t md_alg; 174 psa_algorithm_t hash_alg = PSA_ALG_NONE; 175 unsigned char verify_hash[PSA_HASH_MAX_SIZE]; 176 size_t verify_hash_len; 177 178 void const *options = NULL; 179 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) 180 mbedtls_pk_rsassa_pss_options rsassa_pss_options; 181 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ 182 183 /* 184 * struct { 185 * SignatureScheme algorithm; 186 * opaque signature<0..2^16-1>; 187 * } CertificateVerify; 188 */ 189 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); 190 algorithm = MBEDTLS_GET_UINT16_BE(p, 0); 191 p += 2; 192 193 /* RFC 8446 section 4.4.3 194 * 195 * If the CertificateVerify message is sent by a server, the signature algorithm 196 * MUST be one offered in the client's "signature_algorithms" extension unless 197 * no valid certificate chain can be produced without unsupported algorithms 198 * 199 * RFC 8446 section 4.4.2.2 200 * 201 * If the client cannot construct an acceptable chain using the provided 202 * certificates and decides to abort the handshake, then it MUST abort the handshake 203 * with an appropriate certificate-related alert (by default, "unsupported_certificate"). 204 * 205 * Check if algorithm is an offered signature algorithm. 206 */ 207 if (!mbedtls_ssl_sig_alg_is_offered(ssl, algorithm)) { 208 /* algorithm not in offered signature algorithms list */ 209 MBEDTLS_SSL_DEBUG_MSG(1, ("Received signature algorithm(%04x) is not " 210 "offered.", 211 (unsigned int) algorithm)); 212 goto error; 213 } 214 215 if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( 216 algorithm, &sig_alg, &md_alg) != 0) { 217 goto error; 218 } 219 220 hash_alg = mbedtls_hash_info_psa_from_md(md_alg); 221 if (hash_alg == 0) { 222 goto error; 223 } 224 225 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate Verify: Signature algorithm ( %04x )", 226 (unsigned int) algorithm)); 227 228 /* 229 * Check the certificate's key type matches the signature alg 230 */ 231 if (!mbedtls_pk_can_do(&ssl->session_negotiate->peer_cert->pk, sig_alg)) { 232 MBEDTLS_SSL_DEBUG_MSG(1, ("signature algorithm doesn't match cert key")); 233 goto error; 234 } 235 236 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); 237 signature_len = MBEDTLS_GET_UINT16_BE(p, 0); 238 p += 2; 239 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, signature_len); 240 241 status = psa_hash_compute(hash_alg, 242 verify_buffer, 243 verify_buffer_len, 244 verify_hash, 245 sizeof(verify_hash), 246 &verify_hash_len); 247 if (status != PSA_SUCCESS) { 248 MBEDTLS_SSL_DEBUG_RET(1, "hash computation PSA error", status); 249 goto error; 250 } 251 252 MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); 253 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) 254 if (sig_alg == MBEDTLS_PK_RSASSA_PSS) { 255 rsassa_pss_options.mgf1_hash_id = md_alg; 256 257 rsassa_pss_options.expected_salt_len = PSA_HASH_LENGTH(hash_alg); 258 options = (const void *) &rsassa_pss_options; 259 } 260 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ 261 262 if ((ret = mbedtls_pk_verify_ext(sig_alg, options, 263 &ssl->session_negotiate->peer_cert->pk, 264 md_alg, verify_hash, verify_hash_len, 265 p, signature_len)) == 0) { 266 return 0; 267 } 268 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify_ext", ret); 269 270 error: 271 /* RFC 8446 section 4.4.3 272 * 273 * If the verification fails, the receiver MUST terminate the handshake 274 * with a "decrypt_error" alert. 275 */ 276 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR, 277 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE); 278 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 279 280 } 281 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ 282 283 int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl) 284 { 285 286 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) 287 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 288 unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE]; 289 size_t verify_buffer_len; 290 unsigned char transcript[MBEDTLS_TLS1_3_MD_MAX_SIZE]; 291 size_t transcript_len; 292 unsigned char *buf; 293 size_t buf_len; 294 295 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); 296 297 MBEDTLS_SSL_PROC_CHK( 298 mbedtls_ssl_tls13_fetch_handshake_msg(ssl, 299 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, &buf_len)); 300 301 /* Need to calculate the hash of the transcript first 302 * before reading the message since otherwise it gets 303 * included in the transcript 304 */ 305 ret = mbedtls_ssl_get_handshake_transcript(ssl, 306 ssl->handshake->ciphersuite_info->mac, 307 transcript, sizeof(transcript), 308 &transcript_len); 309 if (ret != 0) { 310 MBEDTLS_SSL_PEND_FATAL_ALERT( 311 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR, 312 MBEDTLS_ERR_SSL_INTERNAL_ERROR); 313 return ret; 314 } 315 316 MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash", transcript, transcript_len); 317 318 /* Create verify structure */ 319 ssl_tls13_create_verify_structure(transcript, 320 transcript_len, 321 verify_buffer, 322 &verify_buffer_len, 323 (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) ? 324 MBEDTLS_SSL_IS_SERVER : 325 MBEDTLS_SSL_IS_CLIENT); 326 327 /* Process the message contents */ 328 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_verify(ssl, buf, 329 buf + buf_len, verify_buffer, 330 verify_buffer_len)); 331 332 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, 333 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, 334 buf, buf_len)); 335 336 cleanup: 337 338 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify")); 339 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_process_certificate_verify", ret); 340 return ret; 341 #else 342 ((void) ssl); 343 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 344 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 345 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ 346 } 347 348 /* 349 * 350 * STATE HANDLING: Incoming Certificate. 351 * 352 */ 353 354 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) 355 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 356 /* 357 * Structure of Certificate message: 358 * 359 * enum { 360 * X509(0), 361 * RawPublicKey(2), 362 * (255) 363 * } CertificateType; 364 * 365 * struct { 366 * select (certificate_type) { 367 * case RawPublicKey: 368 * * From RFC 7250 ASN.1_subjectPublicKeyInfo * 369 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; 370 * case X509: 371 * opaque cert_data<1..2^24-1>; 372 * }; 373 * Extension extensions<0..2^16-1>; 374 * } CertificateEntry; 375 * 376 * struct { 377 * opaque certificate_request_context<0..2^8-1>; 378 * CertificateEntry certificate_list<0..2^24-1>; 379 * } Certificate; 380 * 381 */ 382 383 /* Parse certificate chain send by the server. */ 384 MBEDTLS_CHECK_RETURN_CRITICAL 385 MBEDTLS_STATIC_TESTABLE 386 int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl, 387 const unsigned char *buf, 388 const unsigned char *end) 389 { 390 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 391 size_t certificate_request_context_len = 0; 392 size_t certificate_list_len = 0; 393 const unsigned char *p = buf; 394 const unsigned char *certificate_list_end; 395 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 396 397 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 4); 398 certificate_request_context_len = p[0]; 399 certificate_list_len = MBEDTLS_GET_UINT24_BE(p, 1); 400 p += 4; 401 402 /* In theory, the certificate list can be up to 2^24 Bytes, but we don't 403 * support anything beyond 2^16 = 64K. 404 */ 405 if ((certificate_request_context_len != 0) || 406 (certificate_list_len >= 0x10000)) { 407 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate message")); 408 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, 409 MBEDTLS_ERR_SSL_DECODE_ERROR); 410 return MBEDTLS_ERR_SSL_DECODE_ERROR; 411 } 412 413 /* In case we tried to reuse a session but it failed */ 414 if (ssl->session_negotiate->peer_cert != NULL) { 415 mbedtls_x509_crt_free(ssl->session_negotiate->peer_cert); 416 mbedtls_free(ssl->session_negotiate->peer_cert); 417 } 418 419 if (certificate_list_len == 0) { 420 ssl->session_negotiate->peer_cert = NULL; 421 ret = 0; 422 goto exit; 423 } 424 425 if ((ssl->session_negotiate->peer_cert = 426 mbedtls_calloc(1, sizeof(mbedtls_x509_crt))) == NULL) { 427 MBEDTLS_SSL_DEBUG_MSG(1, ("alloc( %" MBEDTLS_PRINTF_SIZET " bytes ) failed", 428 sizeof(mbedtls_x509_crt))); 429 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR, 430 MBEDTLS_ERR_SSL_ALLOC_FAILED); 431 return MBEDTLS_ERR_SSL_ALLOC_FAILED; 432 } 433 434 mbedtls_x509_crt_init(ssl->session_negotiate->peer_cert); 435 436 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, certificate_list_len); 437 certificate_list_end = p + certificate_list_len; 438 while (p < certificate_list_end) { 439 size_t cert_data_len, extensions_len; 440 const unsigned char *extensions_end; 441 442 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 3); 443 cert_data_len = MBEDTLS_GET_UINT24_BE(p, 0); 444 p += 3; 445 446 /* In theory, the CRT can be up to 2^24 Bytes, but we don't support 447 * anything beyond 2^16 = 64K. Otherwise as in the TLS 1.2 code, 448 * check that we have a minimum of 128 bytes of data, this is not 449 * clear why we need that though. 450 */ 451 if ((cert_data_len < 128) || (cert_data_len >= 0x10000)) { 452 MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message")); 453 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, 454 MBEDTLS_ERR_SSL_DECODE_ERROR); 455 return MBEDTLS_ERR_SSL_DECODE_ERROR; 456 } 457 458 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, cert_data_len); 459 ret = mbedtls_x509_crt_parse_der(ssl->session_negotiate->peer_cert, 460 p, cert_data_len); 461 462 switch (ret) { 463 case 0: /*ok*/ 464 break; 465 case MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + MBEDTLS_ERR_OID_NOT_FOUND: 466 /* Ignore certificate with an unknown algorithm: maybe a 467 prior certificate was already trusted. */ 468 break; 469 470 case MBEDTLS_ERR_X509_ALLOC_FAILED: 471 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR, 472 MBEDTLS_ERR_X509_ALLOC_FAILED); 473 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret); 474 return ret; 475 476 case MBEDTLS_ERR_X509_UNKNOWN_VERSION: 477 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT, 478 MBEDTLS_ERR_X509_UNKNOWN_VERSION); 479 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret); 480 return ret; 481 482 default: 483 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT, 484 ret); 485 MBEDTLS_SSL_DEBUG_RET(1, " mbedtls_x509_crt_parse_der", ret); 486 return ret; 487 } 488 489 p += cert_data_len; 490 491 /* Certificate extensions length */ 492 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, 2); 493 extensions_len = MBEDTLS_GET_UINT16_BE(p, 0); 494 p += 2; 495 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, certificate_list_end, extensions_len); 496 497 extensions_end = p + extensions_len; 498 handshake->received_extensions = MBEDTLS_SSL_EXT_MASK_NONE; 499 500 while (p < extensions_end) { 501 unsigned int extension_type; 502 size_t extension_data_len; 503 504 /* 505 * struct { 506 * ExtensionType extension_type; (2 bytes) 507 * opaque extension_data<0..2^16-1>; 508 * } Extension; 509 */ 510 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, 4); 511 extension_type = MBEDTLS_GET_UINT16_BE(p, 0); 512 extension_data_len = MBEDTLS_GET_UINT16_BE(p, 2); 513 p += 4; 514 515 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, extensions_end, extension_data_len); 516 517 ret = mbedtls_ssl_tls13_check_received_extension( 518 ssl, MBEDTLS_SSL_HS_CERTIFICATE, extension_type, 519 MBEDTLS_SSL_TLS1_3_ALLOWED_EXTS_OF_CT); 520 if (ret != 0) { 521 return ret; 522 } 523 524 switch (extension_type) { 525 default: 526 MBEDTLS_SSL_PRINT_EXT( 527 3, MBEDTLS_SSL_HS_CERTIFICATE, 528 extension_type, "( ignored )"); 529 break; 530 } 531 532 p += extension_data_len; 533 } 534 535 MBEDTLS_SSL_PRINT_EXTS(3, MBEDTLS_SSL_HS_CERTIFICATE, 536 handshake->received_extensions); 537 } 538 539 exit: 540 /* Check that all the message is consumed. */ 541 if (p != end) { 542 MBEDTLS_SSL_DEBUG_MSG(1, ("bad Certificate message")); 543 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, 544 MBEDTLS_ERR_SSL_DECODE_ERROR); 545 return MBEDTLS_ERR_SSL_DECODE_ERROR; 546 } 547 548 MBEDTLS_SSL_DEBUG_CRT(3, "peer certificate", ssl->session_negotiate->peer_cert); 549 550 return ret; 551 } 552 #else 553 MBEDTLS_CHECK_RETURN_CRITICAL 554 MBEDTLS_STATIC_TESTABLE 555 int mbedtls_ssl_tls13_parse_certificate(mbedtls_ssl_context *ssl, 556 const unsigned char *buf, 557 const unsigned char *end) 558 { 559 ((void) ssl); 560 ((void) buf); 561 ((void) end); 562 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 563 } 564 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 565 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ 566 567 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) 568 #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) 569 /* Validate certificate chain sent by the server. */ 570 MBEDTLS_CHECK_RETURN_CRITICAL 571 static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl) 572 { 573 int ret = 0; 574 int authmode = MBEDTLS_SSL_VERIFY_REQUIRED; 575 mbedtls_x509_crt *ca_chain; 576 mbedtls_x509_crl *ca_crl; 577 const char *ext_oid; 578 size_t ext_len; 579 uint32_t verify_result = 0; 580 581 /* If SNI was used, overwrite authentication mode 582 * from the configuration. */ 583 #if defined(MBEDTLS_SSL_SRV_C) 584 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { 585 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 586 if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) { 587 authmode = ssl->handshake->sni_authmode; 588 } else 589 #endif 590 authmode = ssl->conf->authmode; 591 } 592 #endif 593 594 /* 595 * If the peer hasn't sent a certificate ( i.e. it sent 596 * an empty certificate chain ), this is reflected in the peer CRT 597 * structure being unset. 598 * Check for that and handle it depending on the 599 * authentication mode. 600 */ 601 if (ssl->session_negotiate->peer_cert == NULL) { 602 MBEDTLS_SSL_DEBUG_MSG(1, ("peer has no certificate")); 603 604 #if defined(MBEDTLS_SSL_SRV_C) 605 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) { 606 /* The client was asked for a certificate but didn't send 607 * one. The client should know what's going on, so we 608 * don't send an alert. 609 */ 610 ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING; 611 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL) { 612 return 0; 613 } else { 614 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_NO_CERT, 615 MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE); 616 return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE; 617 } 618 } 619 #endif /* MBEDTLS_SSL_SRV_C */ 620 621 #if defined(MBEDTLS_SSL_CLI_C) 622 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { 623 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_NO_CERT, 624 MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE); 625 return MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE; 626 } 627 #endif /* MBEDTLS_SSL_CLI_C */ 628 } 629 630 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 631 if (ssl->handshake->sni_ca_chain != NULL) { 632 ca_chain = ssl->handshake->sni_ca_chain; 633 ca_crl = ssl->handshake->sni_ca_crl; 634 } else 635 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 636 { 637 ca_chain = ssl->conf->ca_chain; 638 ca_crl = ssl->conf->ca_crl; 639 } 640 641 /* 642 * Main check: verify certificate 643 */ 644 ret = mbedtls_x509_crt_verify_with_profile( 645 ssl->session_negotiate->peer_cert, 646 ca_chain, ca_crl, 647 ssl->conf->cert_profile, 648 ssl->hostname, 649 &verify_result, 650 ssl->conf->f_vrfy, ssl->conf->p_vrfy); 651 652 if (ret != 0) { 653 MBEDTLS_SSL_DEBUG_RET(1, "x509_verify_cert", ret); 654 } 655 656 /* 657 * Secondary checks: always done, but change 'ret' only if it was 0 658 */ 659 if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { 660 ext_oid = MBEDTLS_OID_SERVER_AUTH; 661 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_SERVER_AUTH); 662 } else { 663 ext_oid = MBEDTLS_OID_CLIENT_AUTH; 664 ext_len = MBEDTLS_OID_SIZE(MBEDTLS_OID_CLIENT_AUTH); 665 } 666 667 if ((mbedtls_x509_crt_check_key_usage( 668 ssl->session_negotiate->peer_cert, 669 MBEDTLS_X509_KU_DIGITAL_SIGNATURE) != 0) || 670 (mbedtls_x509_crt_check_extended_key_usage( 671 ssl->session_negotiate->peer_cert, 672 ext_oid, ext_len) != 0)) { 673 MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (usage extensions)")); 674 if (ret == 0) { 675 ret = MBEDTLS_ERR_SSL_BAD_CERTIFICATE; 676 } 677 } 678 679 /* mbedtls_x509_crt_verify_with_profile is supposed to report a 680 * verification failure through MBEDTLS_ERR_X509_CERT_VERIFY_FAILED, 681 * with details encoded in the verification flags. All other kinds 682 * of error codes, including those from the user provided f_vrfy 683 * functions, are treated as fatal and lead to a failure of 684 * mbedtls_ssl_tls13_parse_certificate even if verification was optional. 685 */ 686 if (authmode == MBEDTLS_SSL_VERIFY_OPTIONAL && 687 (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED || 688 ret == MBEDTLS_ERR_SSL_BAD_CERTIFICATE)) { 689 ret = 0; 690 } 691 692 if (ca_chain == NULL && authmode == MBEDTLS_SSL_VERIFY_REQUIRED) { 693 MBEDTLS_SSL_DEBUG_MSG(1, ("got no CA chain")); 694 ret = MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED; 695 } 696 697 if (ret != 0) { 698 /* The certificate may have been rejected for several reasons. 699 Pick one and send the corresponding alert. Which alert to send 700 may be a subject of debate in some cases. */ 701 if (verify_result & MBEDTLS_X509_BADCERT_OTHER) { 702 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED, ret); 703 } else if (verify_result & MBEDTLS_X509_BADCERT_CN_MISMATCH) { 704 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_BAD_CERT, ret); 705 } else if (verify_result & (MBEDTLS_X509_BADCERT_KEY_USAGE | 706 MBEDTLS_X509_BADCERT_EXT_KEY_USAGE | 707 MBEDTLS_X509_BADCERT_NS_CERT_TYPE | 708 MBEDTLS_X509_BADCERT_BAD_PK | 709 MBEDTLS_X509_BADCERT_BAD_KEY)) { 710 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT, ret); 711 } else if (verify_result & MBEDTLS_X509_BADCERT_EXPIRED) { 712 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_CERT_EXPIRED, ret); 713 } else if (verify_result & MBEDTLS_X509_BADCERT_REVOKED) { 714 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_CERT_REVOKED, ret); 715 } else if (verify_result & MBEDTLS_X509_BADCERT_NOT_TRUSTED) { 716 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA, ret); 717 } else { 718 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_CERT_UNKNOWN, ret); 719 } 720 } 721 722 #if defined(MBEDTLS_DEBUG_C) 723 if (verify_result != 0) { 724 MBEDTLS_SSL_DEBUG_MSG(3, ("! Certificate verification flags %08x", 725 (unsigned int) verify_result)); 726 } else { 727 MBEDTLS_SSL_DEBUG_MSG(3, ("Certificate verification flags clear")); 728 } 729 #endif /* MBEDTLS_DEBUG_C */ 730 731 ssl->session_negotiate->verify_result = verify_result; 732 return ret; 733 } 734 #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 735 MBEDTLS_CHECK_RETURN_CRITICAL 736 static int ssl_tls13_validate_certificate(mbedtls_ssl_context *ssl) 737 { 738 ((void) ssl); 739 return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 740 } 741 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ 742 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ 743 744 int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl) 745 { 746 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 747 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate")); 748 749 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) 750 unsigned char *buf; 751 size_t buf_len; 752 753 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( 754 ssl, MBEDTLS_SSL_HS_CERTIFICATE, 755 &buf, &buf_len)); 756 757 /* Parse the certificate chain sent by the peer. */ 758 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_parse_certificate(ssl, buf, 759 buf + buf_len)); 760 /* Validate the certificate chain and set the verification results. */ 761 MBEDTLS_SSL_PROC_CHK(ssl_tls13_validate_certificate(ssl)); 762 763 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, 764 MBEDTLS_SSL_HS_CERTIFICATE, buf, 765 buf_len)); 766 767 cleanup: 768 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ 769 770 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate")); 771 return ret; 772 } 773 #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) 774 /* 775 * enum { 776 * X509(0), 777 * RawPublicKey(2), 778 * (255) 779 * } CertificateType; 780 * 781 * struct { 782 * select (certificate_type) { 783 * case RawPublicKey: 784 * // From RFC 7250 ASN.1_subjectPublicKeyInfo 785 * opaque ASN1_subjectPublicKeyInfo<1..2^24-1>; 786 * 787 * case X509: 788 * opaque cert_data<1..2^24-1>; 789 * }; 790 * Extension extensions<0..2^16-1>; 791 * } CertificateEntry; 792 * 793 * struct { 794 * opaque certificate_request_context<0..2^8-1>; 795 * CertificateEntry certificate_list<0..2^24-1>; 796 * } Certificate; 797 */ 798 MBEDTLS_CHECK_RETURN_CRITICAL 799 static int ssl_tls13_write_certificate_body(mbedtls_ssl_context *ssl, 800 unsigned char *buf, 801 unsigned char *end, 802 size_t *out_len) 803 { 804 const mbedtls_x509_crt *crt = mbedtls_ssl_own_cert(ssl); 805 unsigned char *p = buf; 806 unsigned char *certificate_request_context = 807 ssl->handshake->certificate_request_context; 808 unsigned char certificate_request_context_len = 809 ssl->handshake->certificate_request_context_len; 810 unsigned char *p_certificate_list_len; 811 812 813 /* ... 814 * opaque certificate_request_context<0..2^8-1>; 815 * ... 816 */ 817 MBEDTLS_SSL_CHK_BUF_PTR(p, end, certificate_request_context_len + 1); 818 *p++ = certificate_request_context_len; 819 if (certificate_request_context_len > 0) { 820 memcpy(p, certificate_request_context, certificate_request_context_len); 821 p += certificate_request_context_len; 822 } 823 824 /* ... 825 * CertificateEntry certificate_list<0..2^24-1>; 826 * ... 827 */ 828 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 3); 829 p_certificate_list_len = p; 830 p += 3; 831 832 MBEDTLS_SSL_DEBUG_CRT(3, "own certificate", crt); 833 834 while (crt != NULL) { 835 size_t cert_data_len = crt->raw.len; 836 837 MBEDTLS_SSL_CHK_BUF_PTR(p, end, cert_data_len + 3 + 2); 838 MBEDTLS_PUT_UINT24_BE(cert_data_len, p, 0); 839 p += 3; 840 841 memcpy(p, crt->raw.p, cert_data_len); 842 p += cert_data_len; 843 crt = crt->next; 844 845 /* Currently, we don't have any certificate extensions defined. 846 * Hence, we are sending an empty extension with length zero. 847 */ 848 MBEDTLS_PUT_UINT16_BE(0, p, 0); 849 p += 2; 850 } 851 852 MBEDTLS_PUT_UINT24_BE(p - p_certificate_list_len - 3, 853 p_certificate_list_len, 0); 854 855 *out_len = p - buf; 856 857 MBEDTLS_SSL_PRINT_EXTS( 858 3, MBEDTLS_SSL_HS_CERTIFICATE, ssl->handshake->sent_extensions); 859 860 return 0; 861 } 862 863 int mbedtls_ssl_tls13_write_certificate(mbedtls_ssl_context *ssl) 864 { 865 int ret; 866 unsigned char *buf; 867 size_t buf_len, msg_len; 868 869 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate")); 870 871 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl, 872 MBEDTLS_SSL_HS_CERTIFICATE, &buf, 873 &buf_len)); 874 875 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_body(ssl, 876 buf, 877 buf + buf_len, 878 &msg_len)); 879 880 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, 881 MBEDTLS_SSL_HS_CERTIFICATE, buf, 882 msg_len)); 883 884 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg( 885 ssl, buf_len, msg_len)); 886 cleanup: 887 888 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate")); 889 return ret; 890 } 891 892 /* 893 * STATE HANDLING: Output Certificate Verify 894 */ 895 int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(uint16_t sig_alg, 896 mbedtls_pk_context *key) 897 { 898 mbedtls_pk_type_t pk_type = mbedtls_ssl_sig_from_pk(key); 899 size_t key_size = mbedtls_pk_get_bitlen(key); 900 901 switch (pk_type) { 902 case MBEDTLS_SSL_SIG_ECDSA: 903 switch (key_size) { 904 case 256: 905 return 906 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256; 907 908 case 384: 909 return 910 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384; 911 912 case 521: 913 return 914 sig_alg == MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512; 915 default: 916 break; 917 } 918 break; 919 920 case MBEDTLS_SSL_SIG_RSA: 921 switch (sig_alg) { 922 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: /* Intentional fallthrough */ 923 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: /* Intentional fallthrough */ 924 case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: 925 return 1; 926 927 default: 928 break; 929 } 930 break; 931 932 default: 933 break; 934 } 935 936 return 0; 937 } 938 939 MBEDTLS_CHECK_RETURN_CRITICAL 940 static int ssl_tls13_write_certificate_verify_body(mbedtls_ssl_context *ssl, 941 unsigned char *buf, 942 unsigned char *end, 943 size_t *out_len) 944 { 945 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 946 unsigned char *p = buf; 947 mbedtls_pk_context *own_key; 948 949 unsigned char handshake_hash[MBEDTLS_TLS1_3_MD_MAX_SIZE]; 950 size_t handshake_hash_len; 951 unsigned char verify_buffer[SSL_VERIFY_STRUCT_MAX_SIZE]; 952 size_t verify_buffer_len; 953 954 uint16_t *sig_alg = ssl->handshake->received_sig_algs; 955 size_t signature_len = 0; 956 957 *out_len = 0; 958 959 own_key = mbedtls_ssl_own_key(ssl); 960 if (own_key == NULL) { 961 MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); 962 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 963 } 964 965 ret = mbedtls_ssl_get_handshake_transcript(ssl, 966 ssl->handshake->ciphersuite_info->mac, 967 handshake_hash, 968 sizeof(handshake_hash), 969 &handshake_hash_len); 970 if (ret != 0) { 971 return ret; 972 } 973 974 MBEDTLS_SSL_DEBUG_BUF(3, "handshake hash", 975 handshake_hash, 976 handshake_hash_len); 977 978 ssl_tls13_create_verify_structure(handshake_hash, handshake_hash_len, 979 verify_buffer, &verify_buffer_len, 980 ssl->conf->endpoint); 981 982 /* 983 * struct { 984 * SignatureScheme algorithm; 985 * opaque signature<0..2^16-1>; 986 * } CertificateVerify; 987 */ 988 /* Check there is space for the algorithm identifier (2 bytes) and the 989 * signature length (2 bytes). 990 */ 991 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4); 992 993 for (; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++) { 994 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 995 mbedtls_pk_type_t pk_type = MBEDTLS_PK_NONE; 996 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE; 997 psa_algorithm_t psa_algorithm = PSA_ALG_NONE; 998 unsigned char verify_hash[PSA_HASH_MAX_SIZE]; 999 size_t verify_hash_len; 1000 1001 if (!mbedtls_ssl_sig_alg_is_offered(ssl, *sig_alg)) { 1002 continue; 1003 } 1004 1005 if (!mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(*sig_alg)) { 1006 continue; 1007 } 1008 1009 if (!mbedtls_ssl_tls13_check_sig_alg_cert_key_match(*sig_alg, own_key)) { 1010 continue; 1011 } 1012 1013 if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( 1014 *sig_alg, &pk_type, &md_alg) != 0) { 1015 return MBEDTLS_ERR_SSL_INTERNAL_ERROR; 1016 } 1017 1018 /* Hash verify buffer with indicated hash function */ 1019 psa_algorithm = mbedtls_hash_info_psa_from_md(md_alg); 1020 status = psa_hash_compute(psa_algorithm, 1021 verify_buffer, 1022 verify_buffer_len, 1023 verify_hash, sizeof(verify_hash), 1024 &verify_hash_len); 1025 if (status != PSA_SUCCESS) { 1026 return PSA_TO_MBEDTLS_ERR(status); 1027 } 1028 1029 MBEDTLS_SSL_DEBUG_BUF(3, "verify hash", verify_hash, verify_hash_len); 1030 1031 if ((ret = mbedtls_pk_sign_ext(pk_type, own_key, 1032 md_alg, verify_hash, verify_hash_len, 1033 p + 4, (size_t) (end - (p + 4)), &signature_len, 1034 ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { 1035 MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature failed with %s", 1036 mbedtls_ssl_sig_alg_to_str(*sig_alg))); 1037 MBEDTLS_SSL_DEBUG_RET(2, "mbedtls_pk_sign_ext", ret); 1038 1039 /* The signature failed. This is possible if the private key 1040 * was not suitable for the signature operation as purposely we 1041 * did not check its suitability completely. Let's try with 1042 * another signature algorithm. 1043 */ 1044 continue; 1045 } 1046 1047 MBEDTLS_SSL_DEBUG_MSG(2, ("CertificateVerify signature with %s", 1048 mbedtls_ssl_sig_alg_to_str(*sig_alg))); 1049 1050 break; 1051 } 1052 1053 if (*sig_alg == MBEDTLS_TLS1_3_SIG_NONE) { 1054 MBEDTLS_SSL_DEBUG_MSG(1, ("no suitable signature algorithm")); 1055 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE, 1056 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE); 1057 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1058 } 1059 1060 MBEDTLS_PUT_UINT16_BE(*sig_alg, p, 0); 1061 MBEDTLS_PUT_UINT16_BE(signature_len, p, 2); 1062 1063 *out_len = 4 + signature_len; 1064 1065 return 0; 1066 } 1067 1068 int mbedtls_ssl_tls13_write_certificate_verify(mbedtls_ssl_context *ssl) 1069 { 1070 int ret = 0; 1071 unsigned char *buf; 1072 size_t buf_len, msg_len; 1073 1074 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate verify")); 1075 1076 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl, 1077 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, 1078 &buf_len)); 1079 1080 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_certificate_verify_body( 1081 ssl, buf, buf + buf_len, &msg_len)); 1082 1083 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, 1084 MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, buf, 1085 msg_len)); 1086 1087 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg( 1088 ssl, buf_len, msg_len)); 1089 1090 cleanup: 1091 1092 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate verify")); 1093 return ret; 1094 } 1095 1096 #endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ 1097 1098 /* 1099 * 1100 * STATE HANDLING: Incoming Finished message. 1101 */ 1102 /* 1103 * Implementation 1104 */ 1105 1106 MBEDTLS_CHECK_RETURN_CRITICAL 1107 static int ssl_tls13_preprocess_finished_message(mbedtls_ssl_context *ssl) 1108 { 1109 int ret; 1110 1111 ret = mbedtls_ssl_tls13_calculate_verify_data(ssl, 1112 ssl->handshake->state_local.finished_in.digest, 1113 sizeof(ssl->handshake->state_local.finished_in. 1114 digest), 1115 &ssl->handshake->state_local.finished_in.digest_len, 1116 ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT ? 1117 MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT); 1118 if (ret != 0) { 1119 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls13_calculate_verify_data", ret); 1120 return ret; 1121 } 1122 1123 return 0; 1124 } 1125 1126 MBEDTLS_CHECK_RETURN_CRITICAL 1127 static int ssl_tls13_parse_finished_message(mbedtls_ssl_context *ssl, 1128 const unsigned char *buf, 1129 const unsigned char *end) 1130 { 1131 /* 1132 * struct { 1133 * opaque verify_data[Hash.length]; 1134 * } Finished; 1135 */ 1136 const unsigned char *expected_verify_data = 1137 ssl->handshake->state_local.finished_in.digest; 1138 size_t expected_verify_data_len = 1139 ssl->handshake->state_local.finished_in.digest_len; 1140 /* Structural validation */ 1141 if ((size_t) (end - buf) != expected_verify_data_len) { 1142 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message")); 1143 1144 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR, 1145 MBEDTLS_ERR_SSL_DECODE_ERROR); 1146 return MBEDTLS_ERR_SSL_DECODE_ERROR; 1147 } 1148 1149 MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (self-computed):", 1150 expected_verify_data, 1151 expected_verify_data_len); 1152 MBEDTLS_SSL_DEBUG_BUF(4, "verify_data (received message):", buf, 1153 expected_verify_data_len); 1154 1155 /* Semantic validation */ 1156 if (mbedtls_ct_memcmp(buf, 1157 expected_verify_data, 1158 expected_verify_data_len) != 0) { 1159 MBEDTLS_SSL_DEBUG_MSG(1, ("bad finished message")); 1160 1161 MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR, 1162 MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE); 1163 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1164 } 1165 return 0; 1166 } 1167 1168 int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl) 1169 { 1170 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1171 unsigned char *buf; 1172 size_t buf_len; 1173 1174 MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message")); 1175 1176 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(ssl, 1177 MBEDTLS_SSL_HS_FINISHED, 1178 &buf, &buf_len)); 1179 1180 /* Preprocessing step: Compute handshake digest */ 1181 MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl)); 1182 1183 MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_finished_message(ssl, buf, buf + buf_len)); 1184 1185 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, 1186 MBEDTLS_SSL_HS_FINISHED, buf, buf_len)); 1187 1188 cleanup: 1189 1190 MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse finished message")); 1191 return ret; 1192 } 1193 1194 /* 1195 * 1196 * STATE HANDLING: Write and send Finished message. 1197 * 1198 */ 1199 /* 1200 * Implement 1201 */ 1202 1203 MBEDTLS_CHECK_RETURN_CRITICAL 1204 static int ssl_tls13_prepare_finished_message(mbedtls_ssl_context *ssl) 1205 { 1206 int ret; 1207 1208 /* Compute transcript of handshake up to now. */ 1209 ret = mbedtls_ssl_tls13_calculate_verify_data(ssl, 1210 ssl->handshake->state_local.finished_out.digest, 1211 sizeof(ssl->handshake->state_local.finished_out. 1212 digest), 1213 &ssl->handshake->state_local.finished_out.digest_len, 1214 ssl->conf->endpoint); 1215 1216 if (ret != 0) { 1217 MBEDTLS_SSL_DEBUG_RET(1, "calculate_verify_data failed", ret); 1218 return ret; 1219 } 1220 1221 return 0; 1222 } 1223 1224 MBEDTLS_CHECK_RETURN_CRITICAL 1225 static int ssl_tls13_write_finished_message_body(mbedtls_ssl_context *ssl, 1226 unsigned char *buf, 1227 unsigned char *end, 1228 size_t *out_len) 1229 { 1230 size_t verify_data_len = ssl->handshake->state_local.finished_out.digest_len; 1231 /* 1232 * struct { 1233 * opaque verify_data[Hash.length]; 1234 * } Finished; 1235 */ 1236 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, verify_data_len); 1237 1238 memcpy(buf, ssl->handshake->state_local.finished_out.digest, 1239 verify_data_len); 1240 1241 *out_len = verify_data_len; 1242 return 0; 1243 } 1244 1245 /* Main entry point: orchestrates the other functions */ 1246 int mbedtls_ssl_tls13_write_finished_message(mbedtls_ssl_context *ssl) 1247 { 1248 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1249 unsigned char *buf; 1250 size_t buf_len, msg_len; 1251 1252 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished message")); 1253 1254 MBEDTLS_SSL_PROC_CHK(ssl_tls13_prepare_finished_message(ssl)); 1255 1256 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_start_handshake_msg(ssl, 1257 MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len)); 1258 1259 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_finished_message_body( 1260 ssl, buf, buf + buf_len, &msg_len)); 1261 1262 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_add_hs_msg_to_checksum(ssl, 1263 MBEDTLS_SSL_HS_FINISHED, buf, msg_len)); 1264 1265 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_finish_handshake_msg( 1266 ssl, buf_len, msg_len)); 1267 cleanup: 1268 1269 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write finished message")); 1270 return ret; 1271 } 1272 1273 void mbedtls_ssl_tls13_handshake_wrapup(mbedtls_ssl_context *ssl) 1274 { 1275 1276 MBEDTLS_SSL_DEBUG_MSG(3, ("=> handshake wrapup")); 1277 1278 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for inbound traffic")); 1279 mbedtls_ssl_set_inbound_transform(ssl, ssl->transform_application); 1280 1281 MBEDTLS_SSL_DEBUG_MSG(1, ("Switch to application keys for outbound traffic")); 1282 mbedtls_ssl_set_outbound_transform(ssl, ssl->transform_application); 1283 1284 /* 1285 * Free the previous session and switch to the current one. 1286 */ 1287 if (ssl->session) { 1288 mbedtls_ssl_session_free(ssl->session); 1289 mbedtls_free(ssl->session); 1290 } 1291 ssl->session = ssl->session_negotiate; 1292 ssl->session_negotiate = NULL; 1293 1294 MBEDTLS_SSL_DEBUG_MSG(3, ("<= handshake wrapup")); 1295 } 1296 1297 /* 1298 * 1299 * STATE HANDLING: Write ChangeCipherSpec 1300 * 1301 */ 1302 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) 1303 MBEDTLS_CHECK_RETURN_CRITICAL 1304 static int ssl_tls13_write_change_cipher_spec_body(mbedtls_ssl_context *ssl, 1305 unsigned char *buf, 1306 unsigned char *end, 1307 size_t *olen) 1308 { 1309 ((void) ssl); 1310 1311 MBEDTLS_SSL_CHK_BUF_PTR(buf, end, 1); 1312 buf[0] = 1; 1313 *olen = 1; 1314 1315 return 0; 1316 } 1317 1318 int mbedtls_ssl_tls13_write_change_cipher_spec(mbedtls_ssl_context *ssl) 1319 { 1320 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1321 1322 MBEDTLS_SSL_DEBUG_MSG(2, ("=> write change cipher spec")); 1323 1324 /* Write CCS message */ 1325 MBEDTLS_SSL_PROC_CHK(ssl_tls13_write_change_cipher_spec_body( 1326 ssl, ssl->out_msg, 1327 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN, 1328 &ssl->out_msglen)); 1329 1330 ssl->out_msgtype = MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC; 1331 1332 /* Dispatch message */ 1333 MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_write_record(ssl, 0)); 1334 1335 cleanup: 1336 1337 MBEDTLS_SSL_DEBUG_MSG(2, ("<= write change cipher spec")); 1338 return ret; 1339 } 1340 1341 #endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ 1342 1343 /* Early Data Indication Extension 1344 * 1345 * struct { 1346 * select ( Handshake.msg_type ) { 1347 * ... 1348 * case client_hello: Empty; 1349 * case encrypted_extensions: Empty; 1350 * }; 1351 * } EarlyDataIndication; 1352 */ 1353 #if defined(MBEDTLS_SSL_EARLY_DATA) 1354 int mbedtls_ssl_tls13_write_early_data_ext(mbedtls_ssl_context *ssl, 1355 unsigned char *buf, 1356 const unsigned char *end, 1357 size_t *out_len) 1358 { 1359 unsigned char *p = buf; 1360 *out_len = 0; 1361 ((void) ssl); 1362 1363 MBEDTLS_SSL_CHK_BUF_PTR(p, end, 4); 1364 1365 MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EARLY_DATA, p, 0); 1366 MBEDTLS_PUT_UINT16_BE(0, p, 2); 1367 1368 *out_len = 4; 1369 1370 mbedtls_ssl_tls13_set_hs_sent_ext_mask(ssl, MBEDTLS_TLS_EXT_EARLY_DATA); 1371 1372 return 0; 1373 } 1374 #endif /* MBEDTLS_SSL_EARLY_DATA */ 1375 1376 /* Reset SSL context and update hash for handling HRR. 1377 * 1378 * Replace Transcript-Hash(X) by 1379 * Transcript-Hash( message_hash || 1380 * 00 00 Hash.length || 1381 * X ) 1382 * A few states of the handshake are preserved, including: 1383 * - session ID 1384 * - session ticket 1385 * - negotiated ciphersuite 1386 */ 1387 int mbedtls_ssl_reset_transcript_for_hrr(mbedtls_ssl_context *ssl) 1388 { 1389 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 1390 unsigned char hash_transcript[PSA_HASH_MAX_SIZE + 4]; 1391 size_t hash_len; 1392 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 1393 ssl->handshake->ciphersuite_info; 1394 1395 MBEDTLS_SSL_DEBUG_MSG(3, ("Reset SSL session for HRR")); 1396 1397 ret = mbedtls_ssl_get_handshake_transcript(ssl, ciphersuite_info->mac, 1398 hash_transcript + 4, 1399 PSA_HASH_MAX_SIZE, 1400 &hash_len); 1401 if (ret != 0) { 1402 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_get_handshake_transcript", ret); 1403 return ret; 1404 } 1405 1406 hash_transcript[0] = MBEDTLS_SSL_HS_MESSAGE_HASH; 1407 hash_transcript[1] = 0; 1408 hash_transcript[2] = 0; 1409 hash_transcript[3] = (unsigned char) hash_len; 1410 1411 hash_len += 4; 1412 1413 MBEDTLS_SSL_DEBUG_BUF(4, "Truncated handshake transcript", 1414 hash_transcript, hash_len); 1415 1416 /* Reset running hash and replace it with a hash of the transcript */ 1417 ret = mbedtls_ssl_reset_checksum(ssl); 1418 if (ret != 0) { 1419 MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_reset_checksum", ret); 1420 return ret; 1421 } 1422 ret = ssl->handshake->update_checksum(ssl, hash_transcript, hash_len); 1423 if (ret != 0) { 1424 MBEDTLS_SSL_DEBUG_RET(1, "update_checksum", ret); 1425 return ret; 1426 } 1427 1428 return ret; 1429 } 1430 1431 #if defined(MBEDTLS_ECDH_C) 1432 1433 int mbedtls_ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context *ssl, 1434 const unsigned char *buf, 1435 size_t buf_len) 1436 { 1437 uint8_t *p = (uint8_t *) buf; 1438 const uint8_t *end = buf + buf_len; 1439 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 1440 1441 /* Get size of the TLS opaque key_exchange field of the KeyShareEntry struct. */ 1442 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); 1443 uint16_t peerkey_len = MBEDTLS_GET_UINT16_BE(p, 0); 1444 p += 2; 1445 1446 /* Check if key size is consistent with given buffer length. */ 1447 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, peerkey_len); 1448 1449 /* Store peer's ECDH public key. */ 1450 memcpy(handshake->ecdh_psa_peerkey, p, peerkey_len); 1451 handshake->ecdh_psa_peerkey_len = peerkey_len; 1452 1453 return 0; 1454 } 1455 1456 int mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange( 1457 mbedtls_ssl_context *ssl, 1458 uint16_t named_group, 1459 unsigned char *buf, 1460 unsigned char *end, 1461 size_t *out_len) 1462 { 1463 psa_status_t status = PSA_ERROR_GENERIC_ERROR; 1464 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 1465 psa_key_attributes_t key_attributes; 1466 size_t own_pubkey_len; 1467 mbedtls_ssl_handshake_params *handshake = ssl->handshake; 1468 psa_ecc_family_t ec_psa_family = 0; 1469 size_t ec_bits = 0; 1470 1471 MBEDTLS_SSL_DEBUG_MSG(1, ("Perform PSA-based ECDH computation.")); 1472 1473 /* Convert EC's TLS ID to PSA key type. */ 1474 if (mbedtls_ssl_get_psa_curve_info_from_tls_id(named_group, 1475 &ec_psa_family, 1476 &ec_bits) == PSA_ERROR_NOT_SUPPORTED) { 1477 return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; 1478 } 1479 handshake->ecdh_psa_type = PSA_KEY_TYPE_ECC_KEY_PAIR(ec_psa_family); 1480 ssl->handshake->ecdh_bits = ec_bits; 1481 1482 key_attributes = psa_key_attributes_init(); 1483 psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); 1484 psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); 1485 psa_set_key_type(&key_attributes, handshake->ecdh_psa_type); 1486 psa_set_key_bits(&key_attributes, handshake->ecdh_bits); 1487 1488 /* Generate ECDH private key. */ 1489 status = psa_generate_key(&key_attributes, 1490 &handshake->ecdh_psa_privkey); 1491 if (status != PSA_SUCCESS) { 1492 ret = PSA_TO_MBEDTLS_ERR(status); 1493 MBEDTLS_SSL_DEBUG_RET(1, "psa_generate_key", ret); 1494 return ret; 1495 1496 } 1497 1498 /* Export the public part of the ECDH private key from PSA. */ 1499 status = psa_export_public_key(handshake->ecdh_psa_privkey, 1500 buf, (size_t) (end - buf), 1501 &own_pubkey_len); 1502 if (status != PSA_SUCCESS) { 1503 ret = PSA_TO_MBEDTLS_ERR(status); 1504 MBEDTLS_SSL_DEBUG_RET(1, "psa_export_public_key", ret); 1505 return ret; 1506 1507 } 1508 1509 *out_len = own_pubkey_len; 1510 1511 return 0; 1512 } 1513 #endif /* MBEDTLS_ECDH_C */ 1514 1515 /* RFC 8446 section 4.2 1516 * 1517 * If an implementation receives an extension which it recognizes and which is 1518 * not specified for the message in which it appears, it MUST abort the handshake 1519 * with an "illegal_parameter" alert. 1520 * 1521 */ 1522 int mbedtls_ssl_tls13_check_received_extension( 1523 mbedtls_ssl_context *ssl, 1524 int hs_msg_type, 1525 unsigned int received_extension_type, 1526 uint32_t hs_msg_allowed_extensions_mask) 1527 { 1528 uint32_t extension_mask = mbedtls_ssl_get_extension_mask( 1529 received_extension_type); 1530 1531 MBEDTLS_SSL_PRINT_EXT( 1532 3, hs_msg_type, received_extension_type, "received"); 1533 1534 if ((extension_mask & hs_msg_allowed_extensions_mask) == 0) { 1535 MBEDTLS_SSL_PRINT_EXT( 1536 3, hs_msg_type, received_extension_type, "is illegal"); 1537 MBEDTLS_SSL_PEND_FATAL_ALERT( 1538 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1539 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); 1540 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 1541 } 1542 1543 ssl->handshake->received_extensions |= extension_mask; 1544 /* 1545 * If it is a message containing extension responses, check that we 1546 * previously sent the extension. 1547 */ 1548 switch (hs_msg_type) { 1549 case MBEDTLS_SSL_HS_SERVER_HELLO: 1550 case MBEDTLS_SSL_TLS1_3_HS_HELLO_RETRY_REQUEST: 1551 case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS: 1552 case MBEDTLS_SSL_HS_CERTIFICATE: 1553 /* Check if the received extension is sent by peer message.*/ 1554 if ((ssl->handshake->sent_extensions & extension_mask) != 0) { 1555 return 0; 1556 } 1557 break; 1558 default: 1559 return 0; 1560 } 1561 1562 MBEDTLS_SSL_PRINT_EXT( 1563 3, hs_msg_type, received_extension_type, "is unsupported"); 1564 MBEDTLS_SSL_PEND_FATAL_ALERT( 1565 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, 1566 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION); 1567 return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION; 1568 } 1569 1570 #if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) 1571 /* RFC 8449, section 4: 1572 * 1573 * The ExtensionData of the "record_size_limit" extension is 1574 * RecordSizeLimit: 1575 * uint16 RecordSizeLimit; 1576 */ 1577 MBEDTLS_CHECK_RETURN_CRITICAL 1578 int mbedtls_ssl_tls13_parse_record_size_limit_ext(mbedtls_ssl_context *ssl, 1579 const unsigned char *buf, 1580 const unsigned char *end) 1581 { 1582 const unsigned char *p = buf; 1583 uint16_t record_size_limit; 1584 const size_t extension_data_len = end - buf; 1585 1586 if (extension_data_len != MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH) { 1587 MBEDTLS_SSL_DEBUG_MSG(2, 1588 ("record_size_limit extension has invalid length: %" 1589 MBEDTLS_PRINTF_SIZET " Bytes", 1590 extension_data_len)); 1591 1592 MBEDTLS_SSL_PEND_FATAL_ALERT( 1593 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1594 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); 1595 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 1596 } 1597 1598 MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); 1599 record_size_limit = MBEDTLS_GET_UINT16_BE(p, 0); 1600 1601 MBEDTLS_SSL_DEBUG_MSG(2, ("RecordSizeLimit: %u Bytes", record_size_limit)); 1602 1603 /* RFC 8449, section 4 1604 * 1605 * Endpoints MUST NOT send a "record_size_limit" extension with a value 1606 * smaller than 64. An endpoint MUST treat receipt of a smaller value 1607 * as a fatal error and generate an "illegal_parameter" alert. 1608 */ 1609 if (record_size_limit < MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN) { 1610 MBEDTLS_SSL_PEND_FATAL_ALERT( 1611 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER, 1612 MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); 1613 return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; 1614 } 1615 1616 MBEDTLS_SSL_DEBUG_MSG(2, 1617 ( 1618 "record_size_limit extension is still in development. Aborting handshake.")); 1619 1620 MBEDTLS_SSL_PEND_FATAL_ALERT( 1621 MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_EXT, 1622 MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION); 1623 return MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION; 1624 } 1625 #endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */ 1626 1627 #endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */ 1628