2022-02-18 17:24:56 +01:00
|
|
|
/*
|
|
|
|
* TLS 1.2 and 1.3 client-side functions
|
|
|
|
*
|
|
|
|
* Copyright The Mbed TLS Contributors
|
|
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
|
|
* not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
|
|
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*
|
|
|
|
* This file is part of mbed TLS ( https://tls.mbed.org )
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "common.h"
|
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_CLI_C)
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) || defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
|
|
|
2022-02-18 18:41:08 +01:00
|
|
|
#if defined(MBEDTLS_PLATFORM_C)
|
|
|
|
#include "mbedtls/platform.h"
|
|
|
|
#else
|
|
|
|
#include <stdlib.h>
|
|
|
|
#define mbedtls_calloc calloc
|
|
|
|
#define mbedtls_free free
|
|
|
|
#endif
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
#include <string.h>
|
|
|
|
|
|
|
|
#include "mbedtls/debug.h"
|
|
|
|
#include "mbedtls/error.h"
|
2022-02-18 18:41:08 +01:00
|
|
|
#if defined(MBEDTLS_HAVE_TIME)
|
|
|
|
#include "mbedtls/platform_time.h"
|
|
|
|
#endif
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
#include "ssl_client.h"
|
|
|
|
#include "ssl_misc.h"
|
|
|
|
#include "ssl_tls13_keys.h"
|
|
|
|
#include "ssl_debug_helpers.h"
|
|
|
|
|
2022-03-17 15:22:07 +01:00
|
|
|
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-03-17 15:22:07 +01:00
|
|
|
static int ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
|
|
|
|
unsigned char *buf,
|
|
|
|
const unsigned char *end,
|
|
|
|
size_t *olen )
|
|
|
|
{
|
|
|
|
unsigned char *p = buf;
|
|
|
|
size_t hostname_len;
|
|
|
|
|
|
|
|
*olen = 0;
|
|
|
|
|
|
|
|
if( ssl->hostname == NULL )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3,
|
|
|
|
( "client hello, adding server name extension: %s",
|
|
|
|
ssl->hostname ) );
|
|
|
|
|
|
|
|
hostname_len = strlen( ssl->hostname );
|
|
|
|
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, hostname_len + 9 );
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Sect. 3, RFC 6066 (TLS Extensions Definitions)
|
|
|
|
*
|
|
|
|
* In order to provide any of the server names, clients MAY include an
|
|
|
|
* extension of type "server_name" in the (extended) client hello. The
|
|
|
|
* "extension_data" field of this extension SHALL contain
|
|
|
|
* "ServerNameList" where:
|
|
|
|
*
|
|
|
|
* struct {
|
|
|
|
* NameType name_type;
|
|
|
|
* select (name_type) {
|
|
|
|
* case host_name: HostName;
|
|
|
|
* } name;
|
|
|
|
* } ServerName;
|
|
|
|
*
|
|
|
|
* enum {
|
|
|
|
* host_name(0), (255)
|
|
|
|
* } NameType;
|
|
|
|
*
|
|
|
|
* opaque HostName<1..2^16-1>;
|
|
|
|
*
|
|
|
|
* struct {
|
|
|
|
* ServerName server_name_list<1..2^16-1>
|
|
|
|
* } ServerNameList;
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SERVERNAME, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
|
|
|
|
MBEDTLS_PUT_UINT16_BE( hostname_len + 5, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
|
|
|
|
MBEDTLS_PUT_UINT16_BE( hostname_len + 3, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
|
|
|
|
*p++ = MBEDTLS_BYTE_0( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME );
|
|
|
|
|
|
|
|
MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
|
|
|
|
memcpy( p, ssl->hostname, hostname_len );
|
|
|
|
|
|
|
|
*olen = hostname_len + 9;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
#if defined(MBEDTLS_SSL_ALPN)
|
|
|
|
/*
|
2022-02-18 17:29:39 +01:00
|
|
|
* ssl_write_alpn_ext()
|
2022-02-18 17:24:56 +01:00
|
|
|
*
|
|
|
|
* Structure of the application_layer_protocol_negotiation extension in
|
|
|
|
* ClientHello:
|
|
|
|
*
|
|
|
|
* opaque ProtocolName<1..2^8-1>;
|
|
|
|
*
|
|
|
|
* struct {
|
|
|
|
* ProtocolName protocol_name_list<2..2^16-1>
|
|
|
|
* } ProtocolNameList;
|
|
|
|
*
|
|
|
|
*/
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-02-18 17:29:39 +01:00
|
|
|
static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
|
|
|
|
unsigned char *buf,
|
|
|
|
const unsigned char *end,
|
|
|
|
size_t *out_len )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
|
|
|
unsigned char *p = buf;
|
|
|
|
|
|
|
|
*out_len = 0;
|
|
|
|
|
|
|
|
if( ssl->conf->alpn_list == NULL )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
|
|
|
|
|
|
|
|
|
|
|
|
/* Check we have enough space for the extension type (2 bytes), the
|
|
|
|
* extension length (2 bytes) and the protocol_name_list length (2 bytes).
|
|
|
|
*/
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
|
|
|
|
MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
|
|
|
|
/* Skip writing extension and list length for now */
|
|
|
|
p += 6;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* opaque ProtocolName<1..2^8-1>;
|
|
|
|
*
|
|
|
|
* struct {
|
|
|
|
* ProtocolName protocol_name_list<2..2^16-1>
|
|
|
|
* } ProtocolNameList;
|
|
|
|
*/
|
|
|
|
for( const char **cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* mbedtls_ssl_conf_set_alpn_protocols() checked that the length of
|
|
|
|
* protocol names is less than 255.
|
|
|
|
*/
|
|
|
|
size_t protocol_name_len = strlen( *cur );
|
|
|
|
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 + protocol_name_len );
|
|
|
|
*p++ = (unsigned char)protocol_name_len;
|
|
|
|
memcpy( p, *cur, protocol_name_len );
|
|
|
|
p += protocol_name_len;
|
|
|
|
}
|
|
|
|
|
|
|
|
*out_len = p - buf;
|
|
|
|
|
|
|
|
/* List length = *out_len - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
|
|
|
|
MBEDTLS_PUT_UINT16_BE( *out_len - 6, buf, 4 );
|
|
|
|
|
|
|
|
/* Extension length = *out_len - 2 (ext_type) - 2 (ext_len) */
|
|
|
|
MBEDTLS_PUT_UINT16_BE( *out_len - 4, buf, 2 );
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_ALPN */
|
|
|
|
|
2022-03-17 15:22:07 +01:00
|
|
|
#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
|
|
|
|
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
|
|
|
|
/*
|
|
|
|
* Function for writing a supported groups (TLS 1.3) or supported elliptic
|
|
|
|
* curves (TLS 1.2) extension.
|
|
|
|
*
|
|
|
|
* The "extension_data" field of a supported groups extension contains a
|
|
|
|
* "NamedGroupList" value (TLS 1.3 RFC8446):
|
|
|
|
* enum {
|
|
|
|
* secp256r1(0x0017), secp384r1(0x0018), secp521r1(0x0019),
|
|
|
|
* x25519(0x001D), x448(0x001E),
|
|
|
|
* ffdhe2048(0x0100), ffdhe3072(0x0101), ffdhe4096(0x0102),
|
|
|
|
* ffdhe6144(0x0103), ffdhe8192(0x0104),
|
|
|
|
* ffdhe_private_use(0x01FC..0x01FF),
|
|
|
|
* ecdhe_private_use(0xFE00..0xFEFF),
|
|
|
|
* (0xFFFF)
|
|
|
|
* } NamedGroup;
|
|
|
|
* struct {
|
|
|
|
* NamedGroup named_group_list<2..2^16-1>;
|
|
|
|
* } NamedGroupList;
|
|
|
|
*
|
|
|
|
* The "extension_data" field of a supported elliptic curves extension contains
|
|
|
|
* a "NamedCurveList" value (TLS 1.2 RFC 8422):
|
|
|
|
* enum {
|
|
|
|
* deprecated(1..22),
|
|
|
|
* secp256r1 (23), secp384r1 (24), secp521r1 (25),
|
|
|
|
* x25519(29), x448(30),
|
|
|
|
* reserved (0xFE00..0xFEFF),
|
|
|
|
* deprecated(0xFF01..0xFF02),
|
|
|
|
* (0xFFFF)
|
|
|
|
* } NamedCurve;
|
|
|
|
* struct {
|
|
|
|
* NamedCurve named_curve_list<2..2^16-1>
|
|
|
|
* } NamedCurveList;
|
|
|
|
*
|
|
|
|
* The TLS 1.3 supported groups extension was defined to be a compatible
|
|
|
|
* generalization of the TLS 1.2 supported elliptic curves extension. They both
|
|
|
|
* share the same extension identifier.
|
|
|
|
*
|
|
|
|
* DHE groups are not supported yet.
|
|
|
|
*/
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-03-17 15:22:07 +01:00
|
|
|
static int ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
|
|
|
|
unsigned char *buf,
|
|
|
|
const unsigned char *end,
|
|
|
|
size_t *out_len )
|
|
|
|
{
|
|
|
|
unsigned char *p = buf ;
|
|
|
|
unsigned char *named_group_list; /* Start of named_group_list */
|
|
|
|
size_t named_group_list_len; /* Length of named_group_list */
|
|
|
|
const uint16_t *group_list = mbedtls_ssl_get_groups( ssl );
|
|
|
|
|
|
|
|
*out_len = 0;
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_groups extension" ) );
|
|
|
|
|
|
|
|
/* Check if we have space for header and length fields:
|
|
|
|
* - extension_type (2 bytes)
|
|
|
|
* - extension_data_length (2 bytes)
|
|
|
|
* - named_group_list_length (2 bytes)
|
|
|
|
*/
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
|
|
|
|
p += 6;
|
|
|
|
|
|
|
|
named_group_list = p;
|
|
|
|
|
|
|
|
if( group_list == NULL )
|
|
|
|
return( MBEDTLS_ERR_SSL_BAD_CONFIG );
|
|
|
|
|
|
|
|
for( ; *group_list != 0; group_list++ )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 1, ( "got supported group(%04x)", *group_list ) );
|
|
|
|
|
|
|
|
#if defined(MBEDTLS_ECP_C)
|
|
|
|
if( ( mbedtls_ssl_conf_is_tls13_enabled( ssl->conf ) &&
|
|
|
|
mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) ||
|
|
|
|
( mbedtls_ssl_conf_is_tls12_enabled( ssl->conf ) &&
|
|
|
|
mbedtls_ssl_tls12_named_group_is_ecdhe( *group_list ) ) )
|
|
|
|
{
|
|
|
|
const mbedtls_ecp_curve_info *curve_info;
|
|
|
|
curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
|
|
|
|
if( curve_info == NULL )
|
|
|
|
continue;
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
|
|
|
MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
|
|
|
|
curve_info->name, *group_list ) );
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_ECP_C */
|
|
|
|
/* Add DHE groups here */
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Length of named_group_list */
|
|
|
|
named_group_list_len = p - named_group_list;
|
|
|
|
if( named_group_list_len == 0 )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 1, ( "No group available." ) );
|
|
|
|
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Write extension_type */
|
|
|
|
MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_GROUPS, buf, 0 );
|
|
|
|
/* Write extension_data_length */
|
|
|
|
MBEDTLS_PUT_UINT16_BE( named_group_list_len + 2, buf, 2 );
|
|
|
|
/* Write length of named_group_list */
|
|
|
|
MBEDTLS_PUT_UINT16_BE( named_group_list_len, buf, 4 );
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_BUF( 3, "Supported groups extension",
|
|
|
|
buf + 4, named_group_list_len + 2 );
|
|
|
|
|
|
|
|
*out_len = p - buf;
|
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
|
|
|
ssl->handshake->extensions_present |= MBEDTLS_SSL_EXT_SUPPORTED_GROUPS;
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
|
|
|
|
MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
|
|
|
|
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-02-18 17:29:39 +01:00
|
|
|
static int ssl_write_client_hello_cipher_suites(
|
2022-02-18 17:24:56 +01:00
|
|
|
mbedtls_ssl_context *ssl,
|
|
|
|
unsigned char *buf,
|
|
|
|
unsigned char *end,
|
2022-02-19 18:30:46 +01:00
|
|
|
int *tls12_uses_ec,
|
2022-02-18 17:24:56 +01:00
|
|
|
size_t *out_len )
|
|
|
|
{
|
|
|
|
unsigned char *p = buf;
|
|
|
|
const int *ciphersuite_list;
|
|
|
|
unsigned char *cipher_suites; /* Start of the cipher_suites list */
|
|
|
|
size_t cipher_suites_len;
|
|
|
|
|
2022-02-19 18:30:46 +01:00
|
|
|
*tls12_uses_ec = 0;
|
|
|
|
*out_len = 0;
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Ciphersuite list
|
|
|
|
*
|
|
|
|
* This is a list of the symmetric cipher options supported by
|
|
|
|
* the client, specifically the record protection algorithm
|
|
|
|
* ( including secret key length ) and a hash to be used with
|
|
|
|
* HKDF, in descending order of client preference.
|
|
|
|
*/
|
|
|
|
ciphersuite_list = ssl->conf->ciphersuite_list;
|
|
|
|
|
|
|
|
/* Check there is space for the cipher suite list length (2 bytes). */
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
|
|
|
p += 2;
|
|
|
|
|
2022-03-31 14:13:57 +02:00
|
|
|
/* Write cipher_suites
|
|
|
|
* CipherSuite cipher_suites<2..2^16-2>;
|
|
|
|
*/
|
2022-02-18 17:24:56 +01:00
|
|
|
cipher_suites = p;
|
|
|
|
for ( size_t i = 0; ciphersuite_list[i] != 0; i++ )
|
|
|
|
{
|
|
|
|
int cipher_suite = ciphersuite_list[i];
|
|
|
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
|
|
|
|
|
|
|
|
ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( cipher_suite );
|
2022-02-19 18:30:46 +01:00
|
|
|
|
2022-03-30 13:57:40 +02:00
|
|
|
if( mbedtls_ssl_validate_ciphersuite( ssl, ciphersuite_info,
|
2022-04-08 01:07:11 +02:00
|
|
|
ssl->handshake->min_tls_version,
|
2022-03-15 00:04:24 +01:00
|
|
|
ssl->tls_version ) != 0 )
|
2022-02-18 17:24:56 +01:00
|
|
|
continue;
|
|
|
|
|
2022-02-19 18:30:46 +01:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
|
|
|
|
( defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
|
|
|
|
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) )
|
|
|
|
*tls12_uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
|
|
|
|
#endif
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x, %s",
|
|
|
|
(unsigned int) cipher_suite,
|
|
|
|
ciphersuite_info->name ) );
|
|
|
|
|
|
|
|
/* Check there is space for the cipher suite identifier (2 bytes). */
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
|
|
|
MBEDTLS_PUT_UINT16_BE( cipher_suite, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
}
|
|
|
|
|
2022-02-19 18:30:46 +01:00
|
|
|
/*
|
|
|
|
* Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
|
|
|
|
*/
|
|
|
|
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
|
|
|
if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
|
|
|
|
#endif
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
|
|
|
MBEDTLS_PUT_UINT16_BE( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO, p, 0 );
|
|
|
|
p += 2;
|
|
|
|
}
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
/* Write the cipher_suites length in number of bytes */
|
|
|
|
cipher_suites_len = p - cipher_suites;
|
|
|
|
MBEDTLS_PUT_UINT16_BE( cipher_suites_len, buf, 0 );
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3,
|
|
|
|
( "client hello, got %" MBEDTLS_PRINTF_SIZET " cipher suites",
|
|
|
|
cipher_suites_len/2 ) );
|
|
|
|
|
|
|
|
/* Output the total length of cipher_suites field. */
|
|
|
|
*out_len = p - buf;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2022-02-18 17:38:42 +01:00
|
|
|
* Structure of the TLS 1.3 ClientHello message:
|
2022-02-18 17:24:56 +01:00
|
|
|
*
|
|
|
|
* struct {
|
|
|
|
* ProtocolVersion legacy_version = 0x0303; // TLS v1.2
|
|
|
|
* Random random;
|
|
|
|
* opaque legacy_session_id<0..32>;
|
|
|
|
* CipherSuite cipher_suites<2..2^16-2>;
|
|
|
|
* opaque legacy_compression_methods<1..2^8-1>;
|
|
|
|
* Extension extensions<8..2^16-1>;
|
|
|
|
* } ClientHello;
|
2022-02-18 17:38:42 +01:00
|
|
|
*
|
|
|
|
* Structure of the (D)TLS 1.2 ClientHello message:
|
|
|
|
*
|
|
|
|
* struct {
|
|
|
|
* ProtocolVersion client_version;
|
|
|
|
* Random random;
|
|
|
|
* SessionID session_id;
|
|
|
|
* opaque cookie<0..2^8-1>; // DTLS 1.2 ONLY
|
|
|
|
* CipherSuite cipher_suites<2..2^16-2>;
|
|
|
|
* CompressionMethod compression_methods<1..2^8-1>;
|
|
|
|
* select (extensions_present) {
|
|
|
|
* case false:
|
|
|
|
* struct {};
|
|
|
|
* case true:
|
|
|
|
* Extension extensions<0..2^16-1>;
|
|
|
|
* };
|
|
|
|
* } ClientHello;
|
2022-02-18 17:24:56 +01:00
|
|
|
*/
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-02-18 17:29:39 +01:00
|
|
|
static int ssl_write_client_hello_body( mbedtls_ssl_context *ssl,
|
|
|
|
unsigned char *buf,
|
|
|
|
unsigned char *end,
|
2022-07-05 10:21:43 +02:00
|
|
|
size_t *out_len,
|
|
|
|
size_t *binders_len )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
|
|
|
int ret;
|
2022-02-20 10:35:26 +01:00
|
|
|
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
|
|
|
|
unsigned char *p = buf;
|
2022-02-18 17:24:56 +01:00
|
|
|
unsigned char *p_extensions_len; /* Pointer to extensions length */
|
|
|
|
size_t output_len; /* Length of buffer used by function */
|
|
|
|
size_t extensions_len; /* Length of the list of extensions*/
|
2022-02-20 10:35:26 +01:00
|
|
|
int tls12_uses_ec = 0;
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
*out_len = 0;
|
2022-07-05 10:21:43 +02:00
|
|
|
*binders_len = 0;
|
2022-02-18 17:24:56 +01:00
|
|
|
|
2022-02-20 10:35:26 +01:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
2022-03-30 20:24:51 +02:00
|
|
|
unsigned char propose_tls12 =
|
2022-04-08 01:07:11 +02:00
|
|
|
( handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_2 )
|
2022-03-30 20:24:51 +02:00
|
|
|
&&
|
2022-03-15 00:04:24 +01:00
|
|
|
( MBEDTLS_SSL_VERSION_TLS1_2 <= ssl->tls_version );
|
2022-02-20 10:35:26 +01:00
|
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
2022-03-30 20:24:51 +02:00
|
|
|
unsigned char propose_tls13 =
|
2022-04-08 01:07:11 +02:00
|
|
|
( handshake->min_tls_version <= MBEDTLS_SSL_VERSION_TLS1_3 )
|
2022-03-30 20:24:51 +02:00
|
|
|
&&
|
2022-03-15 00:04:24 +01:00
|
|
|
( MBEDTLS_SSL_VERSION_TLS1_3 <= ssl->tls_version );
|
2022-02-20 10:35:26 +01:00
|
|
|
#endif
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
/*
|
2022-02-18 17:53:01 +01:00
|
|
|
* Write client_version (TLS 1.2) or legacy_version (TLS 1.3)
|
2022-02-18 17:24:56 +01:00
|
|
|
*
|
2022-02-18 17:53:01 +01:00
|
|
|
* In all cases this is the TLS 1.2 version.
|
2022-02-18 17:24:56 +01:00
|
|
|
*/
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
2022-03-15 08:23:42 +01:00
|
|
|
mbedtls_ssl_write_version( p, ssl->conf->transport,
|
|
|
|
MBEDTLS_SSL_VERSION_TLS1_2 );
|
2022-02-18 17:24:56 +01:00
|
|
|
p += 2;
|
|
|
|
|
2022-02-18 18:41:08 +01:00
|
|
|
/* ...
|
|
|
|
* Random random;
|
|
|
|
* ...
|
|
|
|
*
|
|
|
|
* The random bytes have been prepared by ssl_prepare_client_hello() into
|
2022-02-20 10:35:26 +01:00
|
|
|
* the handshake->randbytes buffer and are copied here into the output
|
|
|
|
* buffer.
|
2022-02-18 18:41:08 +01:00
|
|
|
*/
|
2022-02-18 17:24:56 +01:00
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
|
2022-02-20 10:35:26 +01:00
|
|
|
memcpy( p, handshake->randbytes, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
|
2022-02-18 17:24:56 +01:00
|
|
|
MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes",
|
|
|
|
p, MBEDTLS_CLIENT_HELLO_RANDOM_LEN );
|
|
|
|
p += MBEDTLS_CLIENT_HELLO_RANDOM_LEN;
|
|
|
|
|
2022-02-19 17:32:53 +01:00
|
|
|
/* TLS 1.2:
|
|
|
|
* ...
|
|
|
|
* SessionID session_id;
|
|
|
|
* ...
|
|
|
|
* with
|
|
|
|
* opaque SessionID<0..32>;
|
2022-02-18 17:24:56 +01:00
|
|
|
*
|
2022-02-19 17:32:53 +01:00
|
|
|
* TLS 1.3:
|
|
|
|
* ...
|
|
|
|
* opaque legacy_session_id<0..32>;
|
|
|
|
* ...
|
|
|
|
*
|
2022-03-30 09:57:11 +02:00
|
|
|
* The (legacy) session identifier bytes have been prepared by
|
2022-02-19 17:32:53 +01:00
|
|
|
* ssl_prepare_client_hello() into the ssl->session_negotiate->id buffer
|
|
|
|
* and are copied here into the output buffer.
|
2022-02-18 17:24:56 +01:00
|
|
|
*/
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
|
|
|
|
*p++ = (unsigned char)ssl->session_negotiate->id_len;
|
|
|
|
memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
|
|
|
|
p += ssl->session_negotiate->id_len;
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
|
|
|
|
ssl->session_negotiate->id_len );
|
|
|
|
|
2022-02-19 18:11:26 +01:00
|
|
|
/* DTLS 1.2 ONLY
|
|
|
|
* ...
|
|
|
|
* opaque cookie<0..2^8-1>;
|
|
|
|
* ...
|
|
|
|
*/
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
|
|
|
|
if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
|
|
|
|
{
|
|
|
|
unsigned char cookie_len = 0;
|
|
|
|
|
2022-02-20 10:35:26 +01:00
|
|
|
if( handshake->cookie != NULL )
|
2022-02-19 18:11:26 +01:00
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
|
2022-02-20 10:35:26 +01:00
|
|
|
handshake->cookie,
|
|
|
|
handshake->verify_cookie_len );
|
|
|
|
cookie_len = handshake->verify_cookie_len;
|
2022-02-19 18:11:26 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, cookie_len + 1 );
|
|
|
|
*p++ = cookie_len;
|
|
|
|
if( cookie_len > 0 )
|
|
|
|
{
|
2022-02-20 10:35:26 +01:00
|
|
|
memcpy( p, handshake->cookie, cookie_len );
|
2022-02-19 18:11:26 +01:00
|
|
|
p += cookie_len;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
/* Write cipher_suites */
|
2022-02-19 18:30:46 +01:00
|
|
|
ret = ssl_write_client_hello_cipher_suites( ssl, p, end,
|
|
|
|
&tls12_uses_ec,
|
|
|
|
&output_len );
|
2022-02-18 17:24:56 +01:00
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
|
2022-02-20 10:24:39 +01:00
|
|
|
/* Write legacy_compression_methods (TLS 1.3) or
|
|
|
|
* compression_methods (TLS 1.2)
|
2022-02-18 17:24:56 +01:00
|
|
|
*
|
|
|
|
* For every TLS 1.3 ClientHello, this vector MUST contain exactly
|
|
|
|
* one byte set to zero, which corresponds to the 'null' compression
|
|
|
|
* method in prior versions of TLS.
|
2022-02-20 10:24:39 +01:00
|
|
|
*
|
|
|
|
* For TLS 1.2 ClientHello, for security reasons we do not support
|
|
|
|
* compression anymore, thus also just the 'null' compression method.
|
2022-02-18 17:24:56 +01:00
|
|
|
*/
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
|
|
|
*p++ = 1;
|
|
|
|
*p++ = MBEDTLS_SSL_COMPRESS_NULL;
|
|
|
|
|
|
|
|
/* Write extensions */
|
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
|
|
|
/* Keeping track of the included extensions */
|
2022-02-20 10:35:26 +01:00
|
|
|
handshake->extensions_present = MBEDTLS_SSL_EXT_NONE;
|
2022-02-18 17:24:56 +01:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/* First write extensions, then the total length */
|
|
|
|
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
|
|
|
|
p_extensions_len = p;
|
|
|
|
p += 2;
|
|
|
|
|
2022-03-29 18:57:54 +02:00
|
|
|
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
|
|
|
|
/* Write server name extension */
|
2022-03-17 15:22:07 +01:00
|
|
|
ret = ssl_write_hostname_ext( ssl, p, end, &output_len );
|
2022-02-18 17:24:56 +01:00
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
2022-03-29 18:57:54 +02:00
|
|
|
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_ALPN)
|
2022-02-18 17:29:39 +01:00
|
|
|
ret = ssl_write_alpn_ext( ssl, p, end, &output_len );
|
2022-02-18 17:24:56 +01:00
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
#endif /* MBEDTLS_SSL_ALPN */
|
|
|
|
|
2022-03-29 18:57:54 +02:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
2022-02-20 10:35:26 +01:00
|
|
|
if( propose_tls13 )
|
|
|
|
{
|
|
|
|
ret = mbedtls_ssl_tls13_write_client_hello_exts( ssl, p, end,
|
|
|
|
&output_len );
|
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
}
|
2022-03-29 18:57:54 +02:00
|
|
|
#endif
|
|
|
|
|
2022-02-20 10:35:26 +01:00
|
|
|
#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
|
|
|
|
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
|
|
|
|
if(
|
2022-02-18 17:24:56 +01:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
2022-02-20 10:35:26 +01:00
|
|
|
( propose_tls13 &&
|
|
|
|
mbedtls_ssl_conf_tls13_some_ephemeral_enabled( ssl ) ) ||
|
|
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
|
|
( propose_tls12 && tls12_uses_ec ) ||
|
|
|
|
#endif
|
|
|
|
0 )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
2022-03-17 15:22:07 +01:00
|
|
|
ret = ssl_write_supported_groups_ext( ssl, p, end, &output_len );
|
2022-02-18 17:24:56 +01:00
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
}
|
2022-02-20 10:35:26 +01:00
|
|
|
#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
|
2022-02-18 17:24:56 +01:00
|
|
|
|
2022-03-17 13:44:33 +01:00
|
|
|
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
|
2022-02-20 10:35:26 +01:00
|
|
|
if(
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
|
|
|
( propose_tls13 && mbedtls_ssl_conf_tls13_ephemeral_enabled( ssl ) ) ||
|
|
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
|
|
propose_tls12 ||
|
|
|
|
#endif
|
|
|
|
0 )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
2022-04-24 11:07:44 +02:00
|
|
|
ret = mbedtls_ssl_write_sig_alg_ext( ssl, p, end, &output_len );
|
2022-02-18 17:24:56 +01:00
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
|
|
|
|
|
2022-02-20 10:35:26 +01:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
|
|
if( propose_tls12 )
|
|
|
|
{
|
|
|
|
ret = mbedtls_ssl_tls12_write_client_hello_exts( ssl, p, end,
|
|
|
|
tls12_uses_ec,
|
|
|
|
&output_len );
|
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
2022-02-18 17:24:56 +01:00
|
|
|
|
2022-07-05 10:21:43 +02:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
|
|
|
|
defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
|
|
|
|
if( propose_tls13 && mbedtls_ssl_conf_tls13_some_psk_enabled( ssl ) )
|
|
|
|
{
|
|
|
|
ret = mbedtls_ssl_tls13_write_pre_shared_key_ext_without_binders(
|
|
|
|
ssl, p, end, &output_len, binders_len );
|
|
|
|
if( ret != 0 )
|
|
|
|
return( ret );
|
|
|
|
p += output_len;
|
|
|
|
}
|
2022-07-14 09:54:01 +02:00
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
|
2022-07-05 10:21:43 +02:00
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
/* Write the length of the list of extensions. */
|
|
|
|
extensions_len = p - p_extensions_len - 2;
|
2022-02-20 10:35:26 +01:00
|
|
|
|
|
|
|
if( extensions_len == 0 )
|
|
|
|
p = p_extensions_len;
|
|
|
|
else
|
|
|
|
{
|
|
|
|
MBEDTLS_PUT_UINT16_BE( extensions_len, p_extensions_len, 0 );
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" \
|
|
|
|
MBEDTLS_PRINTF_SIZET, extensions_len ) );
|
|
|
|
MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions",
|
|
|
|
p_extensions_len, extensions_len );
|
|
|
|
}
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
*out_len = p - buf;
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-02-18 18:41:08 +01:00
|
|
|
static int ssl_generate_random( mbedtls_ssl_context *ssl )
|
|
|
|
{
|
|
|
|
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
|
|
|
unsigned char *randbytes = ssl->handshake->randbytes;
|
|
|
|
size_t gmt_unix_time_len = 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Generate the random bytes
|
|
|
|
*
|
|
|
|
* TLS 1.2 case:
|
|
|
|
* struct {
|
|
|
|
* uint32 gmt_unix_time;
|
|
|
|
* opaque random_bytes[28];
|
|
|
|
* } Random;
|
|
|
|
*
|
|
|
|
* TLS 1.3 case:
|
|
|
|
* opaque Random[32];
|
|
|
|
*/
|
2022-03-15 00:04:24 +01:00
|
|
|
if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
|
2022-02-18 18:41:08 +01:00
|
|
|
{
|
|
|
|
#if defined(MBEDTLS_HAVE_TIME)
|
|
|
|
mbedtls_time_t gmt_unix_time = mbedtls_time( NULL );
|
|
|
|
MBEDTLS_PUT_UINT32_BE( gmt_unix_time, randbytes, 0 );
|
|
|
|
gmt_unix_time_len = 4;
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 3,
|
|
|
|
( "client hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
|
|
|
|
(long long) gmt_unix_time ) );
|
|
|
|
#endif /* MBEDTLS_HAVE_TIME */
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = ssl->conf->f_rng( ssl->conf->p_rng,
|
|
|
|
randbytes + gmt_unix_time_len,
|
|
|
|
MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2022-06-17 10:52:54 +02:00
|
|
|
MBEDTLS_CHECK_RETURN_CRITICAL
|
2022-02-18 17:29:39 +01:00
|
|
|
static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
|
|
|
int ret;
|
2022-02-19 17:32:53 +01:00
|
|
|
size_t session_id_len;
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
if( ssl->conf->f_rng == NULL )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
|
|
|
|
return( MBEDTLS_ERR_SSL_NO_RNG );
|
|
|
|
}
|
|
|
|
|
2022-02-18 17:45:10 +01:00
|
|
|
/* Bet on the highest configured version if we are not in a TLS 1.2
|
|
|
|
* renegotiation or session resumption.
|
|
|
|
*/
|
|
|
|
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
|
|
|
if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
|
2022-04-08 01:07:11 +02:00
|
|
|
ssl->handshake->min_tls_version = ssl->tls_version;
|
2022-02-18 17:45:10 +01:00
|
|
|
else
|
|
|
|
#endif
|
|
|
|
{
|
|
|
|
if( ssl->handshake->resume )
|
|
|
|
{
|
2022-03-15 00:04:24 +01:00
|
|
|
ssl->tls_version = ssl->session_negotiate->tls_version;
|
2022-04-08 01:07:11 +02:00
|
|
|
ssl->handshake->min_tls_version = ssl->tls_version;
|
2022-02-18 17:45:10 +01:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
2022-03-15 00:04:24 +01:00
|
|
|
ssl->tls_version = ssl->conf->max_tls_version;
|
2022-04-08 01:07:11 +02:00
|
|
|
ssl->handshake->min_tls_version = ssl->conf->min_tls_version;
|
2022-02-18 17:45:10 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-18 18:41:08 +01:00
|
|
|
/*
|
2022-03-30 09:57:11 +02:00
|
|
|
* Generate the random bytes, except when responding to a verify request
|
|
|
|
* where we MUST reuse the previoulsy generated random bytes
|
|
|
|
* (RFC 6347 4.2.1).
|
2022-02-18 18:41:08 +01:00
|
|
|
*/
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_DTLS)
|
|
|
|
if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
|
|
|
|
( ssl->handshake->cookie == NULL ) )
|
|
|
|
#endif
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
2022-02-18 18:41:08 +01:00
|
|
|
ret = ssl_generate_random( ssl );
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_RET( 1, "Random bytes generation failed", ret );
|
|
|
|
return( ret );
|
|
|
|
}
|
2022-02-18 17:24:56 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2022-03-30 09:57:11 +02:00
|
|
|
* Prepare session identifier. At that point, the length of the session
|
|
|
|
* identifier in the SSL context `ssl->session_negotiate->id_len` is equal
|
|
|
|
* to zero, except in the case of a TLS 1.2 session renegotiation or
|
|
|
|
* session resumption.
|
2022-02-18 17:24:56 +01:00
|
|
|
*/
|
2022-02-19 17:32:53 +01:00
|
|
|
session_id_len = ssl->session_negotiate->id_len;
|
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
2022-03-15 00:04:24 +01:00
|
|
|
if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
2022-02-19 17:32:53 +01:00
|
|
|
if( session_id_len < 16 || session_id_len > 32 ||
|
|
|
|
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
|
|
|
ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
|
|
|
|
#endif
|
|
|
|
ssl->handshake->resume == 0 )
|
2022-02-18 17:24:56 +01:00
|
|
|
{
|
2022-02-19 17:32:53 +01:00
|
|
|
session_id_len = 0;
|
2022-02-18 17:24:56 +01:00
|
|
|
}
|
2022-02-19 17:32:53 +01:00
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
|
|
|
|
/*
|
|
|
|
* RFC 5077 section 3.4: "When presenting a ticket, the client MAY
|
|
|
|
* generate and include a Session ID in the TLS ClientHello."
|
|
|
|
*/
|
|
|
|
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
|
|
|
if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
|
|
|
|
#endif
|
|
|
|
{
|
|
|
|
if( ( ssl->session_negotiate->ticket != NULL ) &&
|
|
|
|
( ssl->session_negotiate->ticket_len != 0 ) )
|
|
|
|
{
|
|
|
|
session_id_len = 32;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_SESSION_TICKETS */
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
|
2022-03-15 00:04:24 +01:00
|
|
|
if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
|
2022-02-19 17:32:53 +01:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Create a legacy session identifier for the purpose of middlebox
|
|
|
|
* compatibility only if one has not been created already, which is
|
|
|
|
* the case if we are here for the TLS 1.3 second ClientHello.
|
|
|
|
*
|
|
|
|
* Versions of TLS before TLS 1.3 supported a "session resumption"
|
|
|
|
* feature which has been merged with pre-shared keys in TLS 1.3
|
|
|
|
* version. A client which has a cached session ID set by a pre-TLS 1.3
|
|
|
|
* server SHOULD set this field to that value. In compatibility mode,
|
|
|
|
* this field MUST be non-empty, so a client not offering a pre-TLS 1.3
|
|
|
|
* session MUST generate a new 32-byte value. This value need not be
|
|
|
|
* random but SHOULD be unpredictable to avoid implementations fixating
|
|
|
|
* on a specific value (also known as ossification). Otherwise, it MUST
|
|
|
|
* be set as a zero-length vector ( i.e., a zero-valued single byte
|
|
|
|
* length field ).
|
|
|
|
*/
|
|
|
|
session_id_len = 32;
|
2022-02-18 17:24:56 +01:00
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
|
|
|
|
|
2022-02-19 17:32:53 +01:00
|
|
|
if( session_id_len != ssl->session_negotiate->id_len )
|
|
|
|
{
|
|
|
|
ssl->session_negotiate->id_len = session_id_len;
|
|
|
|
if( session_id_len > 0 )
|
|
|
|
{
|
|
|
|
ret = ssl->conf->f_rng( ssl->conf->p_rng,
|
|
|
|
ssl->session_negotiate->id,
|
|
|
|
session_id_len );
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-02-18 17:24:56 +01:00
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Write ClientHello handshake message.
|
|
|
|
* Handler for MBEDTLS_SSL_CLIENT_HELLO
|
|
|
|
*/
|
|
|
|
int mbedtls_ssl_write_client_hello( mbedtls_ssl_context *ssl )
|
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
unsigned char *buf;
|
2022-07-05 10:21:43 +02:00
|
|
|
size_t buf_len, msg_len, binders_len;
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
|
|
|
|
|
2022-02-18 17:29:39 +01:00
|
|
|
MBEDTLS_SSL_PROC_CHK( ssl_prepare_client_hello( ssl ) );
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_start_handshake_msg(
|
|
|
|
ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
|
|
|
|
&buf, &buf_len ) );
|
|
|
|
|
2022-02-18 17:29:39 +01:00
|
|
|
MBEDTLS_SSL_PROC_CHK( ssl_write_client_hello_body( ssl, buf,
|
|
|
|
buf + buf_len,
|
2022-07-05 10:21:43 +02:00
|
|
|
&msg_len,
|
|
|
|
&binders_len ) );
|
2022-02-18 17:24:56 +01:00
|
|
|
|
2022-02-21 09:50:36 +01:00
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_DTLS)
|
|
|
|
if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
|
|
|
|
{
|
|
|
|
ssl->out_msglen = msg_len + 4;
|
|
|
|
mbedtls_ssl_send_flight_completed( ssl );
|
|
|
|
|
2022-03-29 12:26:54 +02:00
|
|
|
/*
|
|
|
|
* The two functions below may try to send data on the network and
|
|
|
|
* can return with the MBEDTLS_ERR_SSL_WANT_READ error code when they
|
|
|
|
* fail to do so and the transmission has to be retried later. In that
|
2022-03-30 09:57:11 +02:00
|
|
|
* case as in fatal error cases, we return immediately. But we must have
|
2022-03-29 12:26:54 +02:00
|
|
|
* set the handshake state to the next state at that point to ensure
|
|
|
|
* that we will not write and send again a ClientHello when we
|
|
|
|
* eventually succeed in sending the pending data.
|
|
|
|
*/
|
|
|
|
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
|
|
|
|
|
2022-02-21 09:50:36 +01:00
|
|
|
if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
|
|
|
|
return( ret );
|
|
|
|
}
|
2022-02-18 17:24:56 +01:00
|
|
|
|
2022-03-29 12:26:54 +02:00
|
|
|
if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
|
2022-02-21 09:50:36 +01:00
|
|
|
{
|
|
|
|
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_PROTO_DTLS */
|
|
|
|
{
|
2022-07-05 10:21:43 +02:00
|
|
|
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
|
|
|
|
defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
|
|
|
|
if( binders_len > 0 )
|
|
|
|
{
|
|
|
|
MBEDTLS_SSL_PROC_CHK(
|
|
|
|
mbedtls_ssl_tls13_write_pre_shared_key_ext_binders(
|
|
|
|
ssl, buf + msg_len - binders_len, buf + msg_len ) );
|
|
|
|
}
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
|
|
|
|
|
2022-02-21 09:50:36 +01:00
|
|
|
mbedtls_ssl_add_hs_msg_to_checksum( ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
|
|
|
|
buf, msg_len );
|
|
|
|
MBEDTLS_SSL_PROC_CHK( mbedtls_ssl_finish_handshake_msg( ssl,
|
|
|
|
buf_len,
|
|
|
|
msg_len ) );
|
2022-03-29 12:26:54 +02:00
|
|
|
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO );
|
2022-02-21 09:50:36 +01:00
|
|
|
}
|
2022-02-18 17:24:56 +01:00
|
|
|
|
|
|
|
|
|
|
|
cleanup:
|
|
|
|
|
|
|
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 || MBEDTLS_SSL_PROTO_TLS1_2 */
|
|
|
|
#endif /* MBEDTLS_SSL_CLI_C */
|