Arcola / mbedtls

mbed TLS upgraded to 2.6.0

Fork of mbedtls by Mark Radbourne

library/ssl_cli.c@0:cdf462088d13, 2017-01-05 (annotated)

Committer:
markrad
Date:
Thu Jan 05 00:18:44 2017 +0000
Revision:
0:cdf462088d13
Child:
2:bbdeda018a3c
Initial commit

Who changed what in which revision?

UserRevisionLine numberNew contents of line
markrad 0:cdf462088d13 1 /*
markrad 0:cdf462088d13 2 * SSLv3/TLSv1 client-side functions
markrad 0:cdf462088d13 3 *
markrad 0:cdf462088d13 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
markrad 0:cdf462088d13 5 * SPDX-License-Identifier: Apache-2.0
markrad 0:cdf462088d13 6 *
markrad 0:cdf462088d13 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
markrad 0:cdf462088d13 8 * not use this file except in compliance with the License.
markrad 0:cdf462088d13 9 * You may obtain a copy of the License at
markrad 0:cdf462088d13 10 *
markrad 0:cdf462088d13 11 * http://www.apache.org/licenses/LICENSE-2.0
markrad 0:cdf462088d13 12 *
markrad 0:cdf462088d13 13 * Unless required by applicable law or agreed to in writing, software
markrad 0:cdf462088d13 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
markrad 0:cdf462088d13 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
markrad 0:cdf462088d13 16 * See the License for the specific language governing permissions and
markrad 0:cdf462088d13 17 * limitations under the License.
markrad 0:cdf462088d13 18 *
markrad 0:cdf462088d13 19 * This file is part of mbed TLS (https://tls.mbed.org)
markrad 0:cdf462088d13 20 */
markrad 0:cdf462088d13 21
markrad 0:cdf462088d13 22 #if !defined(MBEDTLS_CONFIG_FILE)
markrad 0:cdf462088d13 23 #include "mbedtls/config.h"
markrad 0:cdf462088d13 24 #else
markrad 0:cdf462088d13 25 #include MBEDTLS_CONFIG_FILE
markrad 0:cdf462088d13 26 #endif
markrad 0:cdf462088d13 27
markrad 0:cdf462088d13 28 #if defined(MBEDTLS_SSL_CLI_C)
markrad 0:cdf462088d13 29
markrad 0:cdf462088d13 30 #if defined(MBEDTLS_PLATFORM_C)
markrad 0:cdf462088d13 31 #include "mbedtls/platform.h"
markrad 0:cdf462088d13 32 #else
markrad 0:cdf462088d13 33 #include <stdlib.h>
markrad 0:cdf462088d13 34 #define mbedtls_calloc calloc
markrad 0:cdf462088d13 35 #define mbedtls_free free
markrad 0:cdf462088d13 36 #endif
markrad 0:cdf462088d13 37
markrad 0:cdf462088d13 38 #include "mbedtls/debug.h"
markrad 0:cdf462088d13 39 #include "mbedtls/ssl.h"
markrad 0:cdf462088d13 40 #include "mbedtls/ssl_internal.h"
markrad 0:cdf462088d13 41
markrad 0:cdf462088d13 42 #include <string.h>
markrad 0:cdf462088d13 43
markrad 0:cdf462088d13 44 #include <stdint.h>
markrad 0:cdf462088d13 45
markrad 0:cdf462088d13 46 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 47 #include "mbedtls/platform_time.h"
markrad 0:cdf462088d13 48 #endif
markrad 0:cdf462088d13 49
markrad 0:cdf462088d13 50 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 51 /* Implementation that should never be optimized out by the compiler */
markrad 0:cdf462088d13 52 static void mbedtls_zeroize( void *v, size_t n ) {
markrad 0:cdf462088d13 53 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
markrad 0:cdf462088d13 54 }
markrad 0:cdf462088d13 55 #endif
markrad 0:cdf462088d13 56
markrad 0:cdf462088d13 57 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
markrad 0:cdf462088d13 58 static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 59 unsigned char *buf,
markrad 0:cdf462088d13 60 size_t *olen )
markrad 0:cdf462088d13 61 {
markrad 0:cdf462088d13 62 unsigned char *p = buf;
markrad 0:cdf462088d13 63 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 64 size_t hostname_len;
markrad 0:cdf462088d13 65
markrad 0:cdf462088d13 66 *olen = 0;
markrad 0:cdf462088d13 67
markrad 0:cdf462088d13 68 if( ssl->hostname == NULL )
markrad 0:cdf462088d13 69 return;
markrad 0:cdf462088d13 70
markrad 0:cdf462088d13 71 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
markrad 0:cdf462088d13 72 ssl->hostname ) );
markrad 0:cdf462088d13 73
markrad 0:cdf462088d13 74 hostname_len = strlen( ssl->hostname );
markrad 0:cdf462088d13 75
markrad 0:cdf462088d13 76 if( end < p || (size_t)( end - p ) < hostname_len + 9 )
markrad 0:cdf462088d13 77 {
markrad 0:cdf462088d13 78 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 79 return;
markrad 0:cdf462088d13 80 }
markrad 0:cdf462088d13 81
markrad 0:cdf462088d13 82 /*
markrad 0:cdf462088d13 83 * struct {
markrad 0:cdf462088d13 84 * NameType name_type;
markrad 0:cdf462088d13 85 * select (name_type) {
markrad 0:cdf462088d13 86 * case host_name: HostName;
markrad 0:cdf462088d13 87 * } name;
markrad 0:cdf462088d13 88 * } ServerName;
markrad 0:cdf462088d13 89 *
markrad 0:cdf462088d13 90 * enum {
markrad 0:cdf462088d13 91 * host_name(0), (255)
markrad 0:cdf462088d13 92 * } NameType;
markrad 0:cdf462088d13 93 *
markrad 0:cdf462088d13 94 * opaque HostName<1..2^16-1>;
markrad 0:cdf462088d13 95 *
markrad 0:cdf462088d13 96 * struct {
markrad 0:cdf462088d13 97 * ServerName server_name_list<1..2^16-1>
markrad 0:cdf462088d13 98 * } ServerNameList;
markrad 0:cdf462088d13 99 */
markrad 0:cdf462088d13 100 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
markrad 0:cdf462088d13 101 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
markrad 0:cdf462088d13 102
markrad 0:cdf462088d13 103 *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 104 *p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
markrad 0:cdf462088d13 105
markrad 0:cdf462088d13 106 *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 107 *p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
markrad 0:cdf462088d13 108
markrad 0:cdf462088d13 109 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
markrad 0:cdf462088d13 110 *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
markrad 0:cdf462088d13 111 *p++ = (unsigned char)( ( hostname_len ) & 0xFF );
markrad 0:cdf462088d13 112
markrad 0:cdf462088d13 113 memcpy( p, ssl->hostname, hostname_len );
markrad 0:cdf462088d13 114
markrad 0:cdf462088d13 115 *olen = hostname_len + 9;
markrad 0:cdf462088d13 116 }
markrad 0:cdf462088d13 117 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
markrad 0:cdf462088d13 118
markrad 0:cdf462088d13 119 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 120 static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 121 unsigned char *buf,
markrad 0:cdf462088d13 122 size_t *olen )
markrad 0:cdf462088d13 123 {
markrad 0:cdf462088d13 124 unsigned char *p = buf;
markrad 0:cdf462088d13 125 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 126
markrad 0:cdf462088d13 127 *olen = 0;
markrad 0:cdf462088d13 128
markrad 0:cdf462088d13 129 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
markrad 0:cdf462088d13 130 return;
markrad 0:cdf462088d13 131
markrad 0:cdf462088d13 132 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
markrad 0:cdf462088d13 133
markrad 0:cdf462088d13 134 if( end < p || (size_t)( end - p ) < 5 + ssl->verify_data_len )
markrad 0:cdf462088d13 135 {
markrad 0:cdf462088d13 136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 137 return;
markrad 0:cdf462088d13 138 }
markrad 0:cdf462088d13 139
markrad 0:cdf462088d13 140 /*
markrad 0:cdf462088d13 141 * Secure renegotiation
markrad 0:cdf462088d13 142 */
markrad 0:cdf462088d13 143 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
markrad 0:cdf462088d13 144 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
markrad 0:cdf462088d13 145
markrad 0:cdf462088d13 146 *p++ = 0x00;
markrad 0:cdf462088d13 147 *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
markrad 0:cdf462088d13 148 *p++ = ssl->verify_data_len & 0xFF;
markrad 0:cdf462088d13 149
markrad 0:cdf462088d13 150 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
markrad 0:cdf462088d13 151
markrad 0:cdf462088d13 152 *olen = 5 + ssl->verify_data_len;
markrad 0:cdf462088d13 153 }
markrad 0:cdf462088d13 154 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 155
markrad 0:cdf462088d13 156 /*
markrad 0:cdf462088d13 157 * Only if we handle at least one key exchange that needs signatures.
markrad 0:cdf462088d13 158 */
markrad 0:cdf462088d13 159 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
markrad 0:cdf462088d13 160 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
markrad 0:cdf462088d13 161 static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 162 unsigned char *buf,
markrad 0:cdf462088d13 163 size_t *olen )
markrad 0:cdf462088d13 164 {
markrad 0:cdf462088d13 165 unsigned char *p = buf;
markrad 0:cdf462088d13 166 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 167 size_t sig_alg_len = 0;
markrad 0:cdf462088d13 168 const int *md;
markrad 0:cdf462088d13 169 #if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 170 unsigned char *sig_alg_list = buf + 6;
markrad 0:cdf462088d13 171 #endif
markrad 0:cdf462088d13 172
markrad 0:cdf462088d13 173 *olen = 0;
markrad 0:cdf462088d13 174
markrad 0:cdf462088d13 175 if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 176 return;
markrad 0:cdf462088d13 177
markrad 0:cdf462088d13 178 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
markrad 0:cdf462088d13 179
markrad 0:cdf462088d13 180 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
markrad 0:cdf462088d13 181 {
markrad 0:cdf462088d13 182 #if defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 183 sig_alg_len += 2;
markrad 0:cdf462088d13 184 #endif
markrad 0:cdf462088d13 185 #if defined(MBEDTLS_RSA_C)
markrad 0:cdf462088d13 186 sig_alg_len += 2;
markrad 0:cdf462088d13 187 #endif
markrad 0:cdf462088d13 188 }
markrad 0:cdf462088d13 189
markrad 0:cdf462088d13 190 if( end < p || (size_t)( end - p ) < sig_alg_len + 6 )
markrad 0:cdf462088d13 191 {
markrad 0:cdf462088d13 192 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 193 return;
markrad 0:cdf462088d13 194 }
markrad 0:cdf462088d13 195
markrad 0:cdf462088d13 196 /*
markrad 0:cdf462088d13 197 * Prepare signature_algorithms extension (TLS 1.2)
markrad 0:cdf462088d13 198 */
markrad 0:cdf462088d13 199 sig_alg_len = 0;
markrad 0:cdf462088d13 200
markrad 0:cdf462088d13 201 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
markrad 0:cdf462088d13 202 {
markrad 0:cdf462088d13 203 #if defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 204 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
markrad 0:cdf462088d13 205 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
markrad 0:cdf462088d13 206 #endif
markrad 0:cdf462088d13 207 #if defined(MBEDTLS_RSA_C)
markrad 0:cdf462088d13 208 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
markrad 0:cdf462088d13 209 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
markrad 0:cdf462088d13 210 #endif
markrad 0:cdf462088d13 211 }
markrad 0:cdf462088d13 212
markrad 0:cdf462088d13 213 /*
markrad 0:cdf462088d13 214 * enum {
markrad 0:cdf462088d13 215 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
markrad 0:cdf462088d13 216 * sha512(6), (255)
markrad 0:cdf462088d13 217 * } HashAlgorithm;
markrad 0:cdf462088d13 218 *
markrad 0:cdf462088d13 219 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
markrad 0:cdf462088d13 220 * SignatureAlgorithm;
markrad 0:cdf462088d13 221 *
markrad 0:cdf462088d13 222 * struct {
markrad 0:cdf462088d13 223 * HashAlgorithm hash;
markrad 0:cdf462088d13 224 * SignatureAlgorithm signature;
markrad 0:cdf462088d13 225 * } SignatureAndHashAlgorithm;
markrad 0:cdf462088d13 226 *
markrad 0:cdf462088d13 227 * SignatureAndHashAlgorithm
markrad 0:cdf462088d13 228 * supported_signature_algorithms<2..2^16-2>;
markrad 0:cdf462088d13 229 */
markrad 0:cdf462088d13 230 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
markrad 0:cdf462088d13 231 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
markrad 0:cdf462088d13 232
markrad 0:cdf462088d13 233 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 234 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
markrad 0:cdf462088d13 235
markrad 0:cdf462088d13 236 *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
markrad 0:cdf462088d13 237 *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
markrad 0:cdf462088d13 238
markrad 0:cdf462088d13 239 *olen = 6 + sig_alg_len;
markrad 0:cdf462088d13 240 }
markrad 0:cdf462088d13 241 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
markrad 0:cdf462088d13 242 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
markrad 0:cdf462088d13 243
markrad 0:cdf462088d13 244 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 245 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 246 static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 247 unsigned char *buf,
markrad 0:cdf462088d13 248 size_t *olen )
markrad 0:cdf462088d13 249 {
markrad 0:cdf462088d13 250 unsigned char *p = buf;
markrad 0:cdf462088d13 251 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 252 unsigned char *elliptic_curve_list = p + 6;
markrad 0:cdf462088d13 253 size_t elliptic_curve_len = 0;
markrad 0:cdf462088d13 254 const mbedtls_ecp_curve_info *info;
markrad 0:cdf462088d13 255 #if defined(MBEDTLS_ECP_C)
markrad 0:cdf462088d13 256 const mbedtls_ecp_group_id *grp_id;
markrad 0:cdf462088d13 257 #else
markrad 0:cdf462088d13 258 ((void) ssl);
markrad 0:cdf462088d13 259 #endif
markrad 0:cdf462088d13 260
markrad 0:cdf462088d13 261 *olen = 0;
markrad 0:cdf462088d13 262
markrad 0:cdf462088d13 263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) );
markrad 0:cdf462088d13 264
markrad 0:cdf462088d13 265 #if defined(MBEDTLS_ECP_C)
markrad 0:cdf462088d13 266 for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
markrad 0:cdf462088d13 267 {
markrad 0:cdf462088d13 268 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
markrad 0:cdf462088d13 269 #else
markrad 0:cdf462088d13 270 for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
markrad 0:cdf462088d13 271 {
markrad 0:cdf462088d13 272 #endif
markrad 0:cdf462088d13 273 if( info == NULL )
markrad 0:cdf462088d13 274 {
markrad 0:cdf462088d13 275 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
markrad 0:cdf462088d13 276 return;
markrad 0:cdf462088d13 277 }
markrad 0:cdf462088d13 278
markrad 0:cdf462088d13 279 elliptic_curve_len += 2;
markrad 0:cdf462088d13 280 }
markrad 0:cdf462088d13 281
markrad 0:cdf462088d13 282 if( end < p || (size_t)( end - p ) < 6 + elliptic_curve_len )
markrad 0:cdf462088d13 283 {
markrad 0:cdf462088d13 284 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 285 return;
markrad 0:cdf462088d13 286 }
markrad 0:cdf462088d13 287
markrad 0:cdf462088d13 288 elliptic_curve_len = 0;
markrad 0:cdf462088d13 289
markrad 0:cdf462088d13 290 #if defined(MBEDTLS_ECP_C)
markrad 0:cdf462088d13 291 for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
markrad 0:cdf462088d13 292 {
markrad 0:cdf462088d13 293 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
markrad 0:cdf462088d13 294 #else
markrad 0:cdf462088d13 295 for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
markrad 0:cdf462088d13 296 {
markrad 0:cdf462088d13 297 #endif
markrad 0:cdf462088d13 298 elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
markrad 0:cdf462088d13 299 elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
markrad 0:cdf462088d13 300 }
markrad 0:cdf462088d13 301
markrad 0:cdf462088d13 302 if( elliptic_curve_len == 0 )
markrad 0:cdf462088d13 303 return;
markrad 0:cdf462088d13 304
markrad 0:cdf462088d13 305 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF );
markrad 0:cdf462088d13 306 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES ) & 0xFF );
markrad 0:cdf462088d13 307
markrad 0:cdf462088d13 308 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 309 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
markrad 0:cdf462088d13 310
markrad 0:cdf462088d13 311 *p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 312 *p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
markrad 0:cdf462088d13 313
markrad 0:cdf462088d13 314 *olen = 6 + elliptic_curve_len;
markrad 0:cdf462088d13 315 }
markrad 0:cdf462088d13 316
markrad 0:cdf462088d13 317 static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 318 unsigned char *buf,
markrad 0:cdf462088d13 319 size_t *olen )
markrad 0:cdf462088d13 320 {
markrad 0:cdf462088d13 321 unsigned char *p = buf;
markrad 0:cdf462088d13 322 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 323
markrad 0:cdf462088d13 324 *olen = 0;
markrad 0:cdf462088d13 325
markrad 0:cdf462088d13 326 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) );
markrad 0:cdf462088d13 327
markrad 0:cdf462088d13 328 if( end < p || (size_t)( end - p ) < 6 )
markrad 0:cdf462088d13 329 {
markrad 0:cdf462088d13 330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 331 return;
markrad 0:cdf462088d13 332 }
markrad 0:cdf462088d13 333
markrad 0:cdf462088d13 334 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
markrad 0:cdf462088d13 335 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
markrad 0:cdf462088d13 336
markrad 0:cdf462088d13 337 *p++ = 0x00;
markrad 0:cdf462088d13 338 *p++ = 2;
markrad 0:cdf462088d13 339
markrad 0:cdf462088d13 340 *p++ = 1;
markrad 0:cdf462088d13 341 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
markrad 0:cdf462088d13 342
markrad 0:cdf462088d13 343 *olen = 6;
markrad 0:cdf462088d13 344 }
markrad 0:cdf462088d13 345 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
markrad 0:cdf462088d13 346 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 347
markrad 0:cdf462088d13 348 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 349 static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 350 unsigned char *buf,
markrad 0:cdf462088d13 351 size_t *olen )
markrad 0:cdf462088d13 352 {
markrad 0:cdf462088d13 353 int ret;
markrad 0:cdf462088d13 354 unsigned char *p = buf;
markrad 0:cdf462088d13 355 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 356 size_t kkpp_len;
markrad 0:cdf462088d13 357
markrad 0:cdf462088d13 358 *olen = 0;
markrad 0:cdf462088d13 359
markrad 0:cdf462088d13 360 /* Skip costly extension if we can't use EC J-PAKE anyway */
markrad 0:cdf462088d13 361 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
markrad 0:cdf462088d13 362 return;
markrad 0:cdf462088d13 363
markrad 0:cdf462088d13 364 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) );
markrad 0:cdf462088d13 365
markrad 0:cdf462088d13 366 if( end - p < 4 )
markrad 0:cdf462088d13 367 {
markrad 0:cdf462088d13 368 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 369 return;
markrad 0:cdf462088d13 370 }
markrad 0:cdf462088d13 371
markrad 0:cdf462088d13 372 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
markrad 0:cdf462088d13 373 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
markrad 0:cdf462088d13 374
markrad 0:cdf462088d13 375 /*
markrad 0:cdf462088d13 376 * We may need to send ClientHello multiple times for Hello verification.
markrad 0:cdf462088d13 377 * We don't want to compute fresh values every time (both for performance
markrad 0:cdf462088d13 378 * and consistency reasons), so cache the extension content.
markrad 0:cdf462088d13 379 */
markrad 0:cdf462088d13 380 if( ssl->handshake->ecjpake_cache == NULL ||
markrad 0:cdf462088d13 381 ssl->handshake->ecjpake_cache_len == 0 )
markrad 0:cdf462088d13 382 {
markrad 0:cdf462088d13 383 MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
markrad 0:cdf462088d13 384
markrad 0:cdf462088d13 385 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 386 p + 2, end - p - 2, &kkpp_len,
markrad 0:cdf462088d13 387 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 388 if( ret != 0 )
markrad 0:cdf462088d13 389 {
markrad 0:cdf462088d13 390 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
markrad 0:cdf462088d13 391 return;
markrad 0:cdf462088d13 392 }
markrad 0:cdf462088d13 393
markrad 0:cdf462088d13 394 ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
markrad 0:cdf462088d13 395 if( ssl->handshake->ecjpake_cache == NULL )
markrad 0:cdf462088d13 396 {
markrad 0:cdf462088d13 397 MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
markrad 0:cdf462088d13 398 return;
markrad 0:cdf462088d13 399 }
markrad 0:cdf462088d13 400
markrad 0:cdf462088d13 401 memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
markrad 0:cdf462088d13 402 ssl->handshake->ecjpake_cache_len = kkpp_len;
markrad 0:cdf462088d13 403 }
markrad 0:cdf462088d13 404 else
markrad 0:cdf462088d13 405 {
markrad 0:cdf462088d13 406 MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
markrad 0:cdf462088d13 407
markrad 0:cdf462088d13 408 kkpp_len = ssl->handshake->ecjpake_cache_len;
markrad 0:cdf462088d13 409
markrad 0:cdf462088d13 410 if( (size_t)( end - p - 2 ) < kkpp_len )
markrad 0:cdf462088d13 411 {
markrad 0:cdf462088d13 412 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 413 return;
markrad 0:cdf462088d13 414 }
markrad 0:cdf462088d13 415
markrad 0:cdf462088d13 416 memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
markrad 0:cdf462088d13 417 }
markrad 0:cdf462088d13 418
markrad 0:cdf462088d13 419 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
markrad 0:cdf462088d13 420 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
markrad 0:cdf462088d13 421
markrad 0:cdf462088d13 422 *olen = kkpp_len + 4;
markrad 0:cdf462088d13 423 }
markrad 0:cdf462088d13 424 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 425
markrad 0:cdf462088d13 426 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 427 static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 428 unsigned char *buf,
markrad 0:cdf462088d13 429 size_t *olen )
markrad 0:cdf462088d13 430 {
markrad 0:cdf462088d13 431 unsigned char *p = buf;
markrad 0:cdf462088d13 432 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 433
markrad 0:cdf462088d13 434 *olen = 0;
markrad 0:cdf462088d13 435
markrad 0:cdf462088d13 436 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) {
markrad 0:cdf462088d13 437 return;
markrad 0:cdf462088d13 438 }
markrad 0:cdf462088d13 439
markrad 0:cdf462088d13 440 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) );
markrad 0:cdf462088d13 441
markrad 0:cdf462088d13 442 if( end < p || (size_t)( end - p ) < 5 )
markrad 0:cdf462088d13 443 {
markrad 0:cdf462088d13 444 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 445 return;
markrad 0:cdf462088d13 446 }
markrad 0:cdf462088d13 447
markrad 0:cdf462088d13 448 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
markrad 0:cdf462088d13 449 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
markrad 0:cdf462088d13 450
markrad 0:cdf462088d13 451 *p++ = 0x00;
markrad 0:cdf462088d13 452 *p++ = 1;
markrad 0:cdf462088d13 453
markrad 0:cdf462088d13 454 *p++ = ssl->conf->mfl_code;
markrad 0:cdf462088d13 455
markrad 0:cdf462088d13 456 *olen = 5;
markrad 0:cdf462088d13 457 }
markrad 0:cdf462088d13 458 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
markrad 0:cdf462088d13 459
markrad 0:cdf462088d13 460 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 461 static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 462 unsigned char *buf, size_t *olen )
markrad 0:cdf462088d13 463 {
markrad 0:cdf462088d13 464 unsigned char *p = buf;
markrad 0:cdf462088d13 465 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 466
markrad 0:cdf462088d13 467 *olen = 0;
markrad 0:cdf462088d13 468
markrad 0:cdf462088d13 469 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
markrad 0:cdf462088d13 470 {
markrad 0:cdf462088d13 471 return;
markrad 0:cdf462088d13 472 }
markrad 0:cdf462088d13 473
markrad 0:cdf462088d13 474 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) );
markrad 0:cdf462088d13 475
markrad 0:cdf462088d13 476 if( end < p || (size_t)( end - p ) < 4 )
markrad 0:cdf462088d13 477 {
markrad 0:cdf462088d13 478 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 479 return;
markrad 0:cdf462088d13 480 }
markrad 0:cdf462088d13 481
markrad 0:cdf462088d13 482 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
markrad 0:cdf462088d13 483 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
markrad 0:cdf462088d13 484
markrad 0:cdf462088d13 485 *p++ = 0x00;
markrad 0:cdf462088d13 486 *p++ = 0x00;
markrad 0:cdf462088d13 487
markrad 0:cdf462088d13 488 *olen = 4;
markrad 0:cdf462088d13 489 }
markrad 0:cdf462088d13 490 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
markrad 0:cdf462088d13 491
markrad 0:cdf462088d13 492 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 493 static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 494 unsigned char *buf, size_t *olen )
markrad 0:cdf462088d13 495 {
markrad 0:cdf462088d13 496 unsigned char *p = buf;
markrad 0:cdf462088d13 497 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 498
markrad 0:cdf462088d13 499 *olen = 0;
markrad 0:cdf462088d13 500
markrad 0:cdf462088d13 501 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
markrad 0:cdf462088d13 502 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 503 {
markrad 0:cdf462088d13 504 return;
markrad 0:cdf462088d13 505 }
markrad 0:cdf462088d13 506
markrad 0:cdf462088d13 507 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac "
markrad 0:cdf462088d13 508 "extension" ) );
markrad 0:cdf462088d13 509
markrad 0:cdf462088d13 510 if( end < p || (size_t)( end - p ) < 4 )
markrad 0:cdf462088d13 511 {
markrad 0:cdf462088d13 512 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 513 return;
markrad 0:cdf462088d13 514 }
markrad 0:cdf462088d13 515
markrad 0:cdf462088d13 516 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
markrad 0:cdf462088d13 517 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
markrad 0:cdf462088d13 518
markrad 0:cdf462088d13 519 *p++ = 0x00;
markrad 0:cdf462088d13 520 *p++ = 0x00;
markrad 0:cdf462088d13 521
markrad 0:cdf462088d13 522 *olen = 4;
markrad 0:cdf462088d13 523 }
markrad 0:cdf462088d13 524 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
markrad 0:cdf462088d13 525
markrad 0:cdf462088d13 526 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 527 static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 528 unsigned char *buf, size_t *olen )
markrad 0:cdf462088d13 529 {
markrad 0:cdf462088d13 530 unsigned char *p = buf;
markrad 0:cdf462088d13 531 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 532
markrad 0:cdf462088d13 533 *olen = 0;
markrad 0:cdf462088d13 534
markrad 0:cdf462088d13 535 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
markrad 0:cdf462088d13 536 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 537 {
markrad 0:cdf462088d13 538 return;
markrad 0:cdf462088d13 539 }
markrad 0:cdf462088d13 540
markrad 0:cdf462088d13 541 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret "
markrad 0:cdf462088d13 542 "extension" ) );
markrad 0:cdf462088d13 543
markrad 0:cdf462088d13 544 if( end < p || (size_t)( end - p ) < 4 )
markrad 0:cdf462088d13 545 {
markrad 0:cdf462088d13 546 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 547 return;
markrad 0:cdf462088d13 548 }
markrad 0:cdf462088d13 549
markrad 0:cdf462088d13 550 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
markrad 0:cdf462088d13 551 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
markrad 0:cdf462088d13 552
markrad 0:cdf462088d13 553 *p++ = 0x00;
markrad 0:cdf462088d13 554 *p++ = 0x00;
markrad 0:cdf462088d13 555
markrad 0:cdf462088d13 556 *olen = 4;
markrad 0:cdf462088d13 557 }
markrad 0:cdf462088d13 558 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
markrad 0:cdf462088d13 559
markrad 0:cdf462088d13 560 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 561 static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 562 unsigned char *buf, size_t *olen )
markrad 0:cdf462088d13 563 {
markrad 0:cdf462088d13 564 unsigned char *p = buf;
markrad 0:cdf462088d13 565 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 566 size_t tlen = ssl->session_negotiate->ticket_len;
markrad 0:cdf462088d13 567
markrad 0:cdf462088d13 568 *olen = 0;
markrad 0:cdf462088d13 569
markrad 0:cdf462088d13 570 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
markrad 0:cdf462088d13 571 {
markrad 0:cdf462088d13 572 return;
markrad 0:cdf462088d13 573 }
markrad 0:cdf462088d13 574
markrad 0:cdf462088d13 575 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) );
markrad 0:cdf462088d13 576
markrad 0:cdf462088d13 577 if( end < p || (size_t)( end - p ) < 4 + tlen )
markrad 0:cdf462088d13 578 {
markrad 0:cdf462088d13 579 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 580 return;
markrad 0:cdf462088d13 581 }
markrad 0:cdf462088d13 582
markrad 0:cdf462088d13 583 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
markrad 0:cdf462088d13 584 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
markrad 0:cdf462088d13 585
markrad 0:cdf462088d13 586 *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
markrad 0:cdf462088d13 587 *p++ = (unsigned char)( ( tlen ) & 0xFF );
markrad 0:cdf462088d13 588
markrad 0:cdf462088d13 589 *olen = 4;
markrad 0:cdf462088d13 590
markrad 0:cdf462088d13 591 if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
markrad 0:cdf462088d13 592 {
markrad 0:cdf462088d13 593 return;
markrad 0:cdf462088d13 594 }
markrad 0:cdf462088d13 595
markrad 0:cdf462088d13 596 MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) );
markrad 0:cdf462088d13 597
markrad 0:cdf462088d13 598 memcpy( p, ssl->session_negotiate->ticket, tlen );
markrad 0:cdf462088d13 599
markrad 0:cdf462088d13 600 *olen += tlen;
markrad 0:cdf462088d13 601 }
markrad 0:cdf462088d13 602 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 603
markrad 0:cdf462088d13 604 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 605 static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 606 unsigned char *buf, size_t *olen )
markrad 0:cdf462088d13 607 {
markrad 0:cdf462088d13 608 unsigned char *p = buf;
markrad 0:cdf462088d13 609 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 610 size_t alpnlen = 0;
markrad 0:cdf462088d13 611 const char **cur;
markrad 0:cdf462088d13 612
markrad 0:cdf462088d13 613 *olen = 0;
markrad 0:cdf462088d13 614
markrad 0:cdf462088d13 615 if( ssl->conf->alpn_list == NULL )
markrad 0:cdf462088d13 616 {
markrad 0:cdf462088d13 617 return;
markrad 0:cdf462088d13 618 }
markrad 0:cdf462088d13 619
markrad 0:cdf462088d13 620 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
markrad 0:cdf462088d13 621
markrad 0:cdf462088d13 622 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
markrad 0:cdf462088d13 623 alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1;
markrad 0:cdf462088d13 624
markrad 0:cdf462088d13 625 if( end < p || (size_t)( end - p ) < 6 + alpnlen )
markrad 0:cdf462088d13 626 {
markrad 0:cdf462088d13 627 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 628 return;
markrad 0:cdf462088d13 629 }
markrad 0:cdf462088d13 630
markrad 0:cdf462088d13 631 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
markrad 0:cdf462088d13 632 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
markrad 0:cdf462088d13 633
markrad 0:cdf462088d13 634 /*
markrad 0:cdf462088d13 635 * opaque ProtocolName<1..2^8-1>;
markrad 0:cdf462088d13 636 *
markrad 0:cdf462088d13 637 * struct {
markrad 0:cdf462088d13 638 * ProtocolName protocol_name_list<2..2^16-1>
markrad 0:cdf462088d13 639 * } ProtocolNameList;
markrad 0:cdf462088d13 640 */
markrad 0:cdf462088d13 641
markrad 0:cdf462088d13 642 /* Skip writing extension and list length for now */
markrad 0:cdf462088d13 643 p += 4;
markrad 0:cdf462088d13 644
markrad 0:cdf462088d13 645 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
markrad 0:cdf462088d13 646 {
markrad 0:cdf462088d13 647 *p = (unsigned char)( strlen( *cur ) & 0xFF );
markrad 0:cdf462088d13 648 memcpy( p + 1, *cur, *p );
markrad 0:cdf462088d13 649 p += 1 + *p;
markrad 0:cdf462088d13 650 }
markrad 0:cdf462088d13 651
markrad 0:cdf462088d13 652 *olen = p - buf;
markrad 0:cdf462088d13 653
markrad 0:cdf462088d13 654 /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
markrad 0:cdf462088d13 655 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 656 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
markrad 0:cdf462088d13 657
markrad 0:cdf462088d13 658 /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
markrad 0:cdf462088d13 659 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 660 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
markrad 0:cdf462088d13 661 }
markrad 0:cdf462088d13 662 #endif /* MBEDTLS_SSL_ALPN */
markrad 0:cdf462088d13 663
markrad 0:cdf462088d13 664 /*
markrad 0:cdf462088d13 665 * Generate random bytes for ClientHello
markrad 0:cdf462088d13 666 */
markrad 0:cdf462088d13 667 static int ssl_generate_random( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 668 {
markrad 0:cdf462088d13 669 int ret;
markrad 0:cdf462088d13 670 unsigned char *p = ssl->handshake->randbytes;
markrad 0:cdf462088d13 671 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 672 mbedtls_time_t t;
markrad 0:cdf462088d13 673 #endif
markrad 0:cdf462088d13 674
markrad 0:cdf462088d13 675 /*
markrad 0:cdf462088d13 676 * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
markrad 0:cdf462088d13 677 */
markrad 0:cdf462088d13 678 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 679 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
markrad 0:cdf462088d13 680 ssl->handshake->verify_cookie != NULL )
markrad 0:cdf462088d13 681 {
markrad 0:cdf462088d13 682 return( 0 );
markrad 0:cdf462088d13 683 }
markrad 0:cdf462088d13 684 #endif
markrad 0:cdf462088d13 685
markrad 0:cdf462088d13 686 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 687 t = mbedtls_time( NULL );
markrad 0:cdf462088d13 688 *p++ = (unsigned char)( t >> 24 );
markrad 0:cdf462088d13 689 *p++ = (unsigned char)( t >> 16 );
markrad 0:cdf462088d13 690 *p++ = (unsigned char)( t >> 8 );
markrad 0:cdf462088d13 691 *p++ = (unsigned char)( t );
markrad 0:cdf462088d13 692
markrad 0:cdf462088d13 693 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
markrad 0:cdf462088d13 694 #else
markrad 0:cdf462088d13 695 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
markrad 0:cdf462088d13 696 return( ret );
markrad 0:cdf462088d13 697
markrad 0:cdf462088d13 698 p += 4;
markrad 0:cdf462088d13 699 #endif /* MBEDTLS_HAVE_TIME */
markrad 0:cdf462088d13 700
markrad 0:cdf462088d13 701 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
markrad 0:cdf462088d13 702 return( ret );
markrad 0:cdf462088d13 703
markrad 0:cdf462088d13 704 return( 0 );
markrad 0:cdf462088d13 705 }
markrad 0:cdf462088d13 706
markrad 0:cdf462088d13 707 static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 708 {
markrad 0:cdf462088d13 709 int ret;
markrad 0:cdf462088d13 710 size_t i, n, olen, ext_len = 0;
markrad 0:cdf462088d13 711 unsigned char *buf;
markrad 0:cdf462088d13 712 unsigned char *p, *q;
markrad 0:cdf462088d13 713 unsigned char offer_compress;
markrad 0:cdf462088d13 714 const int *ciphersuites;
markrad 0:cdf462088d13 715 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
markrad 0:cdf462088d13 716
markrad 0:cdf462088d13 717 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
markrad 0:cdf462088d13 718
markrad 0:cdf462088d13 719 if( ssl->conf->f_rng == NULL )
markrad 0:cdf462088d13 720 {
markrad 0:cdf462088d13 721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
markrad 0:cdf462088d13 722 return( MBEDTLS_ERR_SSL_NO_RNG );
markrad 0:cdf462088d13 723 }
markrad 0:cdf462088d13 724
markrad 0:cdf462088d13 725 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 726 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 727 #endif
markrad 0:cdf462088d13 728 {
markrad 0:cdf462088d13 729 ssl->major_ver = ssl->conf->min_major_ver;
markrad 0:cdf462088d13 730 ssl->minor_ver = ssl->conf->min_minor_ver;
markrad 0:cdf462088d13 731 }
markrad 0:cdf462088d13 732
markrad 0:cdf462088d13 733 if( ssl->conf->max_major_ver == 0 )
markrad 0:cdf462088d13 734 {
markrad 0:cdf462088d13 735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, "
markrad 0:cdf462088d13 736 "consider using mbedtls_ssl_config_defaults()" ) );
markrad 0:cdf462088d13 737 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 738 }
markrad 0:cdf462088d13 739
markrad 0:cdf462088d13 740 /*
markrad 0:cdf462088d13 741 * 0 . 0 handshake type
markrad 0:cdf462088d13 742 * 1 . 3 handshake length
markrad 0:cdf462088d13 743 * 4 . 5 highest version supported
markrad 0:cdf462088d13 744 * 6 . 9 current UNIX time
markrad 0:cdf462088d13 745 * 10 . 37 random bytes
markrad 0:cdf462088d13 746 */
markrad 0:cdf462088d13 747 buf = ssl->out_msg;
markrad 0:cdf462088d13 748 p = buf + 4;
markrad 0:cdf462088d13 749
markrad 0:cdf462088d13 750 mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
markrad 0:cdf462088d13 751 ssl->conf->transport, p );
markrad 0:cdf462088d13 752 p += 2;
markrad 0:cdf462088d13 753
markrad 0:cdf462088d13 754 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
markrad 0:cdf462088d13 755 buf[4], buf[5] ) );
markrad 0:cdf462088d13 756
markrad 0:cdf462088d13 757 if( ( ret = ssl_generate_random( ssl ) ) != 0 )
markrad 0:cdf462088d13 758 {
markrad 0:cdf462088d13 759 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
markrad 0:cdf462088d13 760 return( ret );
markrad 0:cdf462088d13 761 }
markrad 0:cdf462088d13 762
markrad 0:cdf462088d13 763 memcpy( p, ssl->handshake->randbytes, 32 );
markrad 0:cdf462088d13 764 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
markrad 0:cdf462088d13 765 p += 32;
markrad 0:cdf462088d13 766
markrad 0:cdf462088d13 767 /*
markrad 0:cdf462088d13 768 * 38 . 38 session id length
markrad 0:cdf462088d13 769 * 39 . 39+n session id
markrad 0:cdf462088d13 770 * 39+n . 39+n DTLS only: cookie length (1 byte)
markrad 0:cdf462088d13 771 * 40+n . .. DTSL only: cookie
markrad 0:cdf462088d13 772 * .. . .. ciphersuitelist length (2 bytes)
markrad 0:cdf462088d13 773 * .. . .. ciphersuitelist
markrad 0:cdf462088d13 774 * .. . .. compression methods length (1 byte)
markrad 0:cdf462088d13 775 * .. . .. compression methods
markrad 0:cdf462088d13 776 * .. . .. extensions length (2 bytes)
markrad 0:cdf462088d13 777 * .. . .. extensions
markrad 0:cdf462088d13 778 */
markrad 0:cdf462088d13 779 n = ssl->session_negotiate->id_len;
markrad 0:cdf462088d13 780
markrad 0:cdf462088d13 781 if( n < 16 || n > 32 ||
markrad 0:cdf462088d13 782 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 783 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
markrad 0:cdf462088d13 784 #endif
markrad 0:cdf462088d13 785 ssl->handshake->resume == 0 )
markrad 0:cdf462088d13 786 {
markrad 0:cdf462088d13 787 n = 0;
markrad 0:cdf462088d13 788 }
markrad 0:cdf462088d13 789
markrad 0:cdf462088d13 790 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 791 /*
markrad 0:cdf462088d13 792 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
markrad 0:cdf462088d13 793 * generate and include a Session ID in the TLS ClientHello."
markrad 0:cdf462088d13 794 */
markrad 0:cdf462088d13 795 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 796 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 797 #endif
markrad 0:cdf462088d13 798 {
markrad 0:cdf462088d13 799 if( ssl->session_negotiate->ticket != NULL &&
markrad 0:cdf462088d13 800 ssl->session_negotiate->ticket_len != 0 )
markrad 0:cdf462088d13 801 {
markrad 0:cdf462088d13 802 ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 );
markrad 0:cdf462088d13 803
markrad 0:cdf462088d13 804 if( ret != 0 )
markrad 0:cdf462088d13 805 return( ret );
markrad 0:cdf462088d13 806
markrad 0:cdf462088d13 807 ssl->session_negotiate->id_len = n = 32;
markrad 0:cdf462088d13 808 }
markrad 0:cdf462088d13 809 }
markrad 0:cdf462088d13 810 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 811
markrad 0:cdf462088d13 812 *p++ = (unsigned char) n;
markrad 0:cdf462088d13 813
markrad 0:cdf462088d13 814 for( i = 0; i < n; i++ )
markrad 0:cdf462088d13 815 *p++ = ssl->session_negotiate->id[i];
markrad 0:cdf462088d13 816
markrad 0:cdf462088d13 817 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
markrad 0:cdf462088d13 818 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
markrad 0:cdf462088d13 819
markrad 0:cdf462088d13 820 /*
markrad 0:cdf462088d13 821 * DTLS cookie
markrad 0:cdf462088d13 822 */
markrad 0:cdf462088d13 823 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 824 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 825 {
markrad 0:cdf462088d13 826 if( ssl->handshake->verify_cookie == NULL )
markrad 0:cdf462088d13 827 {
markrad 0:cdf462088d13 828 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
markrad 0:cdf462088d13 829 *p++ = 0;
markrad 0:cdf462088d13 830 }
markrad 0:cdf462088d13 831 else
markrad 0:cdf462088d13 832 {
markrad 0:cdf462088d13 833 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
markrad 0:cdf462088d13 834 ssl->handshake->verify_cookie,
markrad 0:cdf462088d13 835 ssl->handshake->verify_cookie_len );
markrad 0:cdf462088d13 836
markrad 0:cdf462088d13 837 *p++ = ssl->handshake->verify_cookie_len;
markrad 0:cdf462088d13 838 memcpy( p, ssl->handshake->verify_cookie,
markrad 0:cdf462088d13 839 ssl->handshake->verify_cookie_len );
markrad 0:cdf462088d13 840 p += ssl->handshake->verify_cookie_len;
markrad 0:cdf462088d13 841 }
markrad 0:cdf462088d13 842 }
markrad 0:cdf462088d13 843 #endif
markrad 0:cdf462088d13 844
markrad 0:cdf462088d13 845 /*
markrad 0:cdf462088d13 846 * Ciphersuite list
markrad 0:cdf462088d13 847 */
markrad 0:cdf462088d13 848 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
markrad 0:cdf462088d13 849
markrad 0:cdf462088d13 850 /* Skip writing ciphersuite length for now */
markrad 0:cdf462088d13 851 n = 0;
markrad 0:cdf462088d13 852 q = p;
markrad 0:cdf462088d13 853 p += 2;
markrad 0:cdf462088d13 854
markrad 0:cdf462088d13 855 for( i = 0; ciphersuites[i] != 0; i++ )
markrad 0:cdf462088d13 856 {
markrad 0:cdf462088d13 857 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
markrad 0:cdf462088d13 858
markrad 0:cdf462088d13 859 if( ciphersuite_info == NULL )
markrad 0:cdf462088d13 860 continue;
markrad 0:cdf462088d13 861
markrad 0:cdf462088d13 862 if( ciphersuite_info->min_minor_ver > ssl->conf->max_minor_ver ||
markrad 0:cdf462088d13 863 ciphersuite_info->max_minor_ver < ssl->conf->min_minor_ver )
markrad 0:cdf462088d13 864 continue;
markrad 0:cdf462088d13 865
markrad 0:cdf462088d13 866 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 867 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
markrad 0:cdf462088d13 868 ( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
markrad 0:cdf462088d13 869 continue;
markrad 0:cdf462088d13 870 #endif
markrad 0:cdf462088d13 871
markrad 0:cdf462088d13 872 #if defined(MBEDTLS_ARC4_C)
markrad 0:cdf462088d13 873 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
markrad 0:cdf462088d13 874 ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
markrad 0:cdf462088d13 875 continue;
markrad 0:cdf462088d13 876 #endif
markrad 0:cdf462088d13 877
markrad 0:cdf462088d13 878 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 879 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
markrad 0:cdf462088d13 880 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
markrad 0:cdf462088d13 881 continue;
markrad 0:cdf462088d13 882 #endif
markrad 0:cdf462088d13 883
markrad 0:cdf462088d13 884 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
markrad 0:cdf462088d13 885 ciphersuites[i] ) );
markrad 0:cdf462088d13 886
markrad 0:cdf462088d13 887 n++;
markrad 0:cdf462088d13 888 *p++ = (unsigned char)( ciphersuites[i] >> 8 );
markrad 0:cdf462088d13 889 *p++ = (unsigned char)( ciphersuites[i] );
markrad 0:cdf462088d13 890 }
markrad 0:cdf462088d13 891
markrad 0:cdf462088d13 892 /*
markrad 0:cdf462088d13 893 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
markrad 0:cdf462088d13 894 */
markrad 0:cdf462088d13 895 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 896 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 897 #endif
markrad 0:cdf462088d13 898 {
markrad 0:cdf462088d13 899 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
markrad 0:cdf462088d13 900 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
markrad 0:cdf462088d13 901 n++;
markrad 0:cdf462088d13 902 }
markrad 0:cdf462088d13 903
markrad 0:cdf462088d13 904 /* Some versions of OpenSSL don't handle it correctly if not at end */
markrad 0:cdf462088d13 905 #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
markrad 0:cdf462088d13 906 if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
markrad 0:cdf462088d13 907 {
markrad 0:cdf462088d13 908 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
markrad 0:cdf462088d13 909 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
markrad 0:cdf462088d13 910 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
markrad 0:cdf462088d13 911 n++;
markrad 0:cdf462088d13 912 }
markrad 0:cdf462088d13 913 #endif
markrad 0:cdf462088d13 914
markrad 0:cdf462088d13 915 *q++ = (unsigned char)( n >> 7 );
markrad 0:cdf462088d13 916 *q++ = (unsigned char)( n << 1 );
markrad 0:cdf462088d13 917
markrad 0:cdf462088d13 918 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
markrad 0:cdf462088d13 919
markrad 0:cdf462088d13 920 #if defined(MBEDTLS_ZLIB_SUPPORT)
markrad 0:cdf462088d13 921 offer_compress = 1;
markrad 0:cdf462088d13 922 #else
markrad 0:cdf462088d13 923 offer_compress = 0;
markrad 0:cdf462088d13 924 #endif
markrad 0:cdf462088d13 925
markrad 0:cdf462088d13 926 /*
markrad 0:cdf462088d13 927 * We don't support compression with DTLS right now: is many records come
markrad 0:cdf462088d13 928 * in the same datagram, uncompressing one could overwrite the next one.
markrad 0:cdf462088d13 929 * We don't want to add complexity for handling that case unless there is
markrad 0:cdf462088d13 930 * an actual need for it.
markrad 0:cdf462088d13 931 */
markrad 0:cdf462088d13 932 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 933 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 934 offer_compress = 0;
markrad 0:cdf462088d13 935 #endif
markrad 0:cdf462088d13 936
markrad 0:cdf462088d13 937 if( offer_compress )
markrad 0:cdf462088d13 938 {
markrad 0:cdf462088d13 939 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
markrad 0:cdf462088d13 940 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
markrad 0:cdf462088d13 941 MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) );
markrad 0:cdf462088d13 942
markrad 0:cdf462088d13 943 *p++ = 2;
markrad 0:cdf462088d13 944 *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
markrad 0:cdf462088d13 945 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
markrad 0:cdf462088d13 946 }
markrad 0:cdf462088d13 947 else
markrad 0:cdf462088d13 948 {
markrad 0:cdf462088d13 949 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
markrad 0:cdf462088d13 950 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
markrad 0:cdf462088d13 951 MBEDTLS_SSL_COMPRESS_NULL ) );
markrad 0:cdf462088d13 952
markrad 0:cdf462088d13 953 *p++ = 1;
markrad 0:cdf462088d13 954 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
markrad 0:cdf462088d13 955 }
markrad 0:cdf462088d13 956
markrad 0:cdf462088d13 957 // First write extensions, then the total length
markrad 0:cdf462088d13 958 //
markrad 0:cdf462088d13 959 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
markrad 0:cdf462088d13 960 ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 961 ext_len += olen;
markrad 0:cdf462088d13 962 #endif
markrad 0:cdf462088d13 963
markrad 0:cdf462088d13 964 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 965 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 966 ext_len += olen;
markrad 0:cdf462088d13 967 #endif
markrad 0:cdf462088d13 968
markrad 0:cdf462088d13 969 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
markrad 0:cdf462088d13 970 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
markrad 0:cdf462088d13 971 ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 972 ext_len += olen;
markrad 0:cdf462088d13 973 #endif
markrad 0:cdf462088d13 974
markrad 0:cdf462088d13 975 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 976 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 977 ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 978 ext_len += olen;
markrad 0:cdf462088d13 979
markrad 0:cdf462088d13 980 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 981 ext_len += olen;
markrad 0:cdf462088d13 982 #endif
markrad 0:cdf462088d13 983
markrad 0:cdf462088d13 984 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 985 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 986 ext_len += olen;
markrad 0:cdf462088d13 987 #endif
markrad 0:cdf462088d13 988
markrad 0:cdf462088d13 989 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 990 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 991 ext_len += olen;
markrad 0:cdf462088d13 992 #endif
markrad 0:cdf462088d13 993
markrad 0:cdf462088d13 994 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 995 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 996 ext_len += olen;
markrad 0:cdf462088d13 997 #endif
markrad 0:cdf462088d13 998
markrad 0:cdf462088d13 999 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 1000 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 1001 ext_len += olen;
markrad 0:cdf462088d13 1002 #endif
markrad 0:cdf462088d13 1003
markrad 0:cdf462088d13 1004 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 1005 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 1006 ext_len += olen;
markrad 0:cdf462088d13 1007 #endif
markrad 0:cdf462088d13 1008
markrad 0:cdf462088d13 1009 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 1010 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 1011 ext_len += olen;
markrad 0:cdf462088d13 1012 #endif
markrad 0:cdf462088d13 1013
markrad 0:cdf462088d13 1014 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 1015 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 1016 ext_len += olen;
markrad 0:cdf462088d13 1017 #endif
markrad 0:cdf462088d13 1018
markrad 0:cdf462088d13 1019 /* olen unused if all extensions are disabled */
markrad 0:cdf462088d13 1020 ((void) olen);
markrad 0:cdf462088d13 1021
markrad 0:cdf462088d13 1022 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
markrad 0:cdf462088d13 1023 ext_len ) );
markrad 0:cdf462088d13 1024
markrad 0:cdf462088d13 1025 if( ext_len > 0 )
markrad 0:cdf462088d13 1026 {
markrad 0:cdf462088d13 1027 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
markrad 0:cdf462088d13 1028 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
markrad 0:cdf462088d13 1029 p += ext_len;
markrad 0:cdf462088d13 1030 }
markrad 0:cdf462088d13 1031
markrad 0:cdf462088d13 1032 ssl->out_msglen = p - buf;
markrad 0:cdf462088d13 1033 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 1034 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
markrad 0:cdf462088d13 1035
markrad 0:cdf462088d13 1036 ssl->state++;
markrad 0:cdf462088d13 1037
markrad 0:cdf462088d13 1038 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1039 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1040 mbedtls_ssl_send_flight_completed( ssl );
markrad 0:cdf462088d13 1041 #endif
markrad 0:cdf462088d13 1042
markrad 0:cdf462088d13 1043 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 1044 {
markrad 0:cdf462088d13 1045 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 1046 return( ret );
markrad 0:cdf462088d13 1047 }
markrad 0:cdf462088d13 1048
markrad 0:cdf462088d13 1049 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
markrad 0:cdf462088d13 1050
markrad 0:cdf462088d13 1051 return( 0 );
markrad 0:cdf462088d13 1052 }
markrad 0:cdf462088d13 1053
markrad 0:cdf462088d13 1054 static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1055 const unsigned char *buf,
markrad 0:cdf462088d13 1056 size_t len )
markrad 0:cdf462088d13 1057 {
markrad 0:cdf462088d13 1058 int ret;
markrad 0:cdf462088d13 1059
markrad 0:cdf462088d13 1060 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1061 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 1062 {
markrad 0:cdf462088d13 1063 /* Check verify-data in constant-time. The length OTOH is no secret */
markrad 0:cdf462088d13 1064 if( len != 1 + ssl->verify_data_len * 2 ||
markrad 0:cdf462088d13 1065 buf[0] != ssl->verify_data_len * 2 ||
markrad 0:cdf462088d13 1066 mbedtls_ssl_safer_memcmp( buf + 1,
markrad 0:cdf462088d13 1067 ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
markrad 0:cdf462088d13 1068 mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
markrad 0:cdf462088d13 1069 ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
markrad 0:cdf462088d13 1070 {
markrad 0:cdf462088d13 1071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
markrad 0:cdf462088d13 1072
markrad 0:cdf462088d13 1073 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
markrad 0:cdf462088d13 1074 return( ret );
markrad 0:cdf462088d13 1075
markrad 0:cdf462088d13 1076 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1077 }
markrad 0:cdf462088d13 1078 }
markrad 0:cdf462088d13 1079 else
markrad 0:cdf462088d13 1080 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 1081 {
markrad 0:cdf462088d13 1082 if( len != 1 || buf[0] != 0x00 )
markrad 0:cdf462088d13 1083 {
markrad 0:cdf462088d13 1084 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
markrad 0:cdf462088d13 1085
markrad 0:cdf462088d13 1086 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
markrad 0:cdf462088d13 1087 return( ret );
markrad 0:cdf462088d13 1088
markrad 0:cdf462088d13 1089 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1090 }
markrad 0:cdf462088d13 1091
markrad 0:cdf462088d13 1092 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
markrad 0:cdf462088d13 1093 }
markrad 0:cdf462088d13 1094
markrad 0:cdf462088d13 1095 return( 0 );
markrad 0:cdf462088d13 1096 }
markrad 0:cdf462088d13 1097
markrad 0:cdf462088d13 1098 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 1099 static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1100 const unsigned char *buf,
markrad 0:cdf462088d13 1101 size_t len )
markrad 0:cdf462088d13 1102 {
markrad 0:cdf462088d13 1103 /*
markrad 0:cdf462088d13 1104 * server should use the extension only if we did,
markrad 0:cdf462088d13 1105 * and if so the server's value should match ours (and len is always 1)
markrad 0:cdf462088d13 1106 */
markrad 0:cdf462088d13 1107 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ||
markrad 0:cdf462088d13 1108 len != 1 ||
markrad 0:cdf462088d13 1109 buf[0] != ssl->conf->mfl_code )
markrad 0:cdf462088d13 1110 {
markrad 0:cdf462088d13 1111 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1112 }
markrad 0:cdf462088d13 1113
markrad 0:cdf462088d13 1114 return( 0 );
markrad 0:cdf462088d13 1115 }
markrad 0:cdf462088d13 1116 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
markrad 0:cdf462088d13 1117
markrad 0:cdf462088d13 1118 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 1119 static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1120 const unsigned char *buf,
markrad 0:cdf462088d13 1121 size_t len )
markrad 0:cdf462088d13 1122 {
markrad 0:cdf462088d13 1123 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ||
markrad 0:cdf462088d13 1124 len != 0 )
markrad 0:cdf462088d13 1125 {
markrad 0:cdf462088d13 1126 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1127 }
markrad 0:cdf462088d13 1128
markrad 0:cdf462088d13 1129 ((void) buf);
markrad 0:cdf462088d13 1130
markrad 0:cdf462088d13 1131 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
markrad 0:cdf462088d13 1132
markrad 0:cdf462088d13 1133 return( 0 );
markrad 0:cdf462088d13 1134 }
markrad 0:cdf462088d13 1135 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
markrad 0:cdf462088d13 1136
markrad 0:cdf462088d13 1137 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 1138 static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1139 const unsigned char *buf,
markrad 0:cdf462088d13 1140 size_t len )
markrad 0:cdf462088d13 1141 {
markrad 0:cdf462088d13 1142 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
markrad 0:cdf462088d13 1143 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
markrad 0:cdf462088d13 1144 len != 0 )
markrad 0:cdf462088d13 1145 {
markrad 0:cdf462088d13 1146 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1147 }
markrad 0:cdf462088d13 1148
markrad 0:cdf462088d13 1149 ((void) buf);
markrad 0:cdf462088d13 1150
markrad 0:cdf462088d13 1151 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
markrad 0:cdf462088d13 1152
markrad 0:cdf462088d13 1153 return( 0 );
markrad 0:cdf462088d13 1154 }
markrad 0:cdf462088d13 1155 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
markrad 0:cdf462088d13 1156
markrad 0:cdf462088d13 1157 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 1158 static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1159 const unsigned char *buf,
markrad 0:cdf462088d13 1160 size_t len )
markrad 0:cdf462088d13 1161 {
markrad 0:cdf462088d13 1162 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
markrad 0:cdf462088d13 1163 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
markrad 0:cdf462088d13 1164 len != 0 )
markrad 0:cdf462088d13 1165 {
markrad 0:cdf462088d13 1166 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1167 }
markrad 0:cdf462088d13 1168
markrad 0:cdf462088d13 1169 ((void) buf);
markrad 0:cdf462088d13 1170
markrad 0:cdf462088d13 1171 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
markrad 0:cdf462088d13 1172
markrad 0:cdf462088d13 1173 return( 0 );
markrad 0:cdf462088d13 1174 }
markrad 0:cdf462088d13 1175 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
markrad 0:cdf462088d13 1176
markrad 0:cdf462088d13 1177 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 1178 static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1179 const unsigned char *buf,
markrad 0:cdf462088d13 1180 size_t len )
markrad 0:cdf462088d13 1181 {
markrad 0:cdf462088d13 1182 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ||
markrad 0:cdf462088d13 1183 len != 0 )
markrad 0:cdf462088d13 1184 {
markrad 0:cdf462088d13 1185 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1186 }
markrad 0:cdf462088d13 1187
markrad 0:cdf462088d13 1188 ((void) buf);
markrad 0:cdf462088d13 1189
markrad 0:cdf462088d13 1190 ssl->handshake->new_session_ticket = 1;
markrad 0:cdf462088d13 1191
markrad 0:cdf462088d13 1192 return( 0 );
markrad 0:cdf462088d13 1193 }
markrad 0:cdf462088d13 1194 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 1195
markrad 0:cdf462088d13 1196 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 1197 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1198 static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1199 const unsigned char *buf,
markrad 0:cdf462088d13 1200 size_t len )
markrad 0:cdf462088d13 1201 {
markrad 0:cdf462088d13 1202 size_t list_size;
markrad 0:cdf462088d13 1203 const unsigned char *p;
markrad 0:cdf462088d13 1204
markrad 0:cdf462088d13 1205 list_size = buf[0];
markrad 0:cdf462088d13 1206 if( list_size + 1 != len )
markrad 0:cdf462088d13 1207 {
markrad 0:cdf462088d13 1208 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1209 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1210 }
markrad 0:cdf462088d13 1211
markrad 0:cdf462088d13 1212 p = buf + 1;
markrad 0:cdf462088d13 1213 while( list_size > 0 )
markrad 0:cdf462088d13 1214 {
markrad 0:cdf462088d13 1215 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
markrad 0:cdf462088d13 1216 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
markrad 0:cdf462088d13 1217 {
markrad 0:cdf462088d13 1218 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 1219 ssl->handshake->ecdh_ctx.point_format = p[0];
markrad 0:cdf462088d13 1220 #endif
markrad 0:cdf462088d13 1221 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1222 ssl->handshake->ecjpake_ctx.point_format = p[0];
markrad 0:cdf462088d13 1223 #endif
markrad 0:cdf462088d13 1224 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
markrad 0:cdf462088d13 1225 return( 0 );
markrad 0:cdf462088d13 1226 }
markrad 0:cdf462088d13 1227
markrad 0:cdf462088d13 1228 list_size--;
markrad 0:cdf462088d13 1229 p++;
markrad 0:cdf462088d13 1230 }
markrad 0:cdf462088d13 1231
markrad 0:cdf462088d13 1232 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
markrad 0:cdf462088d13 1233 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1234 }
markrad 0:cdf462088d13 1235 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
markrad 0:cdf462088d13 1236 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 1237
markrad 0:cdf462088d13 1238 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1239 static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1240 const unsigned char *buf,
markrad 0:cdf462088d13 1241 size_t len )
markrad 0:cdf462088d13 1242 {
markrad 0:cdf462088d13 1243 int ret;
markrad 0:cdf462088d13 1244
markrad 0:cdf462088d13 1245 if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
markrad 0:cdf462088d13 1246 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 1247 {
markrad 0:cdf462088d13 1248 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
markrad 0:cdf462088d13 1249 return( 0 );
markrad 0:cdf462088d13 1250 }
markrad 0:cdf462088d13 1251
markrad 0:cdf462088d13 1252 /* If we got here, we no longer need our cached extension */
markrad 0:cdf462088d13 1253 mbedtls_free( ssl->handshake->ecjpake_cache );
markrad 0:cdf462088d13 1254 ssl->handshake->ecjpake_cache = NULL;
markrad 0:cdf462088d13 1255 ssl->handshake->ecjpake_cache_len = 0;
markrad 0:cdf462088d13 1256
markrad 0:cdf462088d13 1257 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 1258 buf, len ) ) != 0 )
markrad 0:cdf462088d13 1259 {
markrad 0:cdf462088d13 1260 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
markrad 0:cdf462088d13 1261 return( ret );
markrad 0:cdf462088d13 1262 }
markrad 0:cdf462088d13 1263
markrad 0:cdf462088d13 1264 return( 0 );
markrad 0:cdf462088d13 1265 }
markrad 0:cdf462088d13 1266 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 1267
markrad 0:cdf462088d13 1268 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 1269 static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1270 const unsigned char *buf, size_t len )
markrad 0:cdf462088d13 1271 {
markrad 0:cdf462088d13 1272 size_t list_len, name_len;
markrad 0:cdf462088d13 1273 const char **p;
markrad 0:cdf462088d13 1274
markrad 0:cdf462088d13 1275 /* If we didn't send it, the server shouldn't send it */
markrad 0:cdf462088d13 1276 if( ssl->conf->alpn_list == NULL )
markrad 0:cdf462088d13 1277 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1278
markrad 0:cdf462088d13 1279 /*
markrad 0:cdf462088d13 1280 * opaque ProtocolName<1..2^8-1>;
markrad 0:cdf462088d13 1281 *
markrad 0:cdf462088d13 1282 * struct {
markrad 0:cdf462088d13 1283 * ProtocolName protocol_name_list<2..2^16-1>
markrad 0:cdf462088d13 1284 * } ProtocolNameList;
markrad 0:cdf462088d13 1285 *
markrad 0:cdf462088d13 1286 * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
markrad 0:cdf462088d13 1287 */
markrad 0:cdf462088d13 1288
markrad 0:cdf462088d13 1289 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
markrad 0:cdf462088d13 1290 if( len < 4 )
markrad 0:cdf462088d13 1291 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1292
markrad 0:cdf462088d13 1293 list_len = ( buf[0] << 8 ) | buf[1];
markrad 0:cdf462088d13 1294 if( list_len != len - 2 )
markrad 0:cdf462088d13 1295 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1296
markrad 0:cdf462088d13 1297 name_len = buf[2];
markrad 0:cdf462088d13 1298 if( name_len != list_len - 1 )
markrad 0:cdf462088d13 1299 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1300
markrad 0:cdf462088d13 1301 /* Check that the server chosen protocol was in our list and save it */
markrad 0:cdf462088d13 1302 for( p = ssl->conf->alpn_list; *p != NULL; p++ )
markrad 0:cdf462088d13 1303 {
markrad 0:cdf462088d13 1304 if( name_len == strlen( *p ) &&
markrad 0:cdf462088d13 1305 memcmp( buf + 3, *p, name_len ) == 0 )
markrad 0:cdf462088d13 1306 {
markrad 0:cdf462088d13 1307 ssl->alpn_chosen = *p;
markrad 0:cdf462088d13 1308 return( 0 );
markrad 0:cdf462088d13 1309 }
markrad 0:cdf462088d13 1310 }
markrad 0:cdf462088d13 1311
markrad 0:cdf462088d13 1312 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1313 }
markrad 0:cdf462088d13 1314 #endif /* MBEDTLS_SSL_ALPN */
markrad 0:cdf462088d13 1315
markrad 0:cdf462088d13 1316 /*
markrad 0:cdf462088d13 1317 * Parse HelloVerifyRequest. Only called after verifying the HS type.
markrad 0:cdf462088d13 1318 */
markrad 0:cdf462088d13 1319 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1320 static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 1321 {
markrad 0:cdf462088d13 1322 const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 1323 int major_ver, minor_ver;
markrad 0:cdf462088d13 1324 unsigned char cookie_len;
markrad 0:cdf462088d13 1325
markrad 0:cdf462088d13 1326 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
markrad 0:cdf462088d13 1327
markrad 0:cdf462088d13 1328 /*
markrad 0:cdf462088d13 1329 * struct {
markrad 0:cdf462088d13 1330 * ProtocolVersion server_version;
markrad 0:cdf462088d13 1331 * opaque cookie<0..2^8-1>;
markrad 0:cdf462088d13 1332 * } HelloVerifyRequest;
markrad 0:cdf462088d13 1333 */
markrad 0:cdf462088d13 1334 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
markrad 0:cdf462088d13 1335 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
markrad 0:cdf462088d13 1336 p += 2;
markrad 0:cdf462088d13 1337
markrad 0:cdf462088d13 1338 /*
markrad 0:cdf462088d13 1339 * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
markrad 0:cdf462088d13 1340 * even is lower than our min version.
markrad 0:cdf462088d13 1341 */
markrad 0:cdf462088d13 1342 if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
markrad 0:cdf462088d13 1343 minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ||
markrad 0:cdf462088d13 1344 major_ver > ssl->conf->max_major_ver ||
markrad 0:cdf462088d13 1345 minor_ver > ssl->conf->max_minor_ver )
markrad 0:cdf462088d13 1346 {
markrad 0:cdf462088d13 1347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
markrad 0:cdf462088d13 1348
markrad 0:cdf462088d13 1349 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 1350 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1351
markrad 0:cdf462088d13 1352 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1353 }
markrad 0:cdf462088d13 1354
markrad 0:cdf462088d13 1355 cookie_len = *p++;
markrad 0:cdf462088d13 1356 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
markrad 0:cdf462088d13 1357
markrad 0:cdf462088d13 1358 if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
markrad 0:cdf462088d13 1359 {
markrad 0:cdf462088d13 1360 MBEDTLS_SSL_DEBUG_MSG( 1,
markrad 0:cdf462088d13 1361 ( "cookie length does not match incoming message size" ) );
markrad 0:cdf462088d13 1362 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 1363 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1364 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1365 }
markrad 0:cdf462088d13 1366
markrad 0:cdf462088d13 1367 mbedtls_free( ssl->handshake->verify_cookie );
markrad 0:cdf462088d13 1368
markrad 0:cdf462088d13 1369 ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
markrad 0:cdf462088d13 1370 if( ssl->handshake->verify_cookie == NULL )
markrad 0:cdf462088d13 1371 {
markrad 0:cdf462088d13 1372 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
markrad 0:cdf462088d13 1373 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
markrad 0:cdf462088d13 1374 }
markrad 0:cdf462088d13 1375
markrad 0:cdf462088d13 1376 memcpy( ssl->handshake->verify_cookie, p, cookie_len );
markrad 0:cdf462088d13 1377 ssl->handshake->verify_cookie_len = cookie_len;
markrad 0:cdf462088d13 1378
markrad 0:cdf462088d13 1379 /* Start over at ClientHello */
markrad 0:cdf462088d13 1380 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
markrad 0:cdf462088d13 1381 mbedtls_ssl_reset_checksum( ssl );
markrad 0:cdf462088d13 1382
markrad 0:cdf462088d13 1383 mbedtls_ssl_recv_flight_completed( ssl );
markrad 0:cdf462088d13 1384
markrad 0:cdf462088d13 1385 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
markrad 0:cdf462088d13 1386
markrad 0:cdf462088d13 1387 return( 0 );
markrad 0:cdf462088d13 1388 }
markrad 0:cdf462088d13 1389 #endif /* MBEDTLS_SSL_PROTO_DTLS */
markrad 0:cdf462088d13 1390
markrad 0:cdf462088d13 1391 static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 1392 {
markrad 0:cdf462088d13 1393 int ret, i;
markrad 0:cdf462088d13 1394 size_t n;
markrad 0:cdf462088d13 1395 size_t ext_len;
markrad 0:cdf462088d13 1396 unsigned char *buf, *ext;
markrad 0:cdf462088d13 1397 unsigned char comp;
markrad 0:cdf462088d13 1398 #if defined(MBEDTLS_ZLIB_SUPPORT)
markrad 0:cdf462088d13 1399 int accept_comp;
markrad 0:cdf462088d13 1400 #endif
markrad 0:cdf462088d13 1401 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1402 int renegotiation_info_seen = 0;
markrad 0:cdf462088d13 1403 #endif
markrad 0:cdf462088d13 1404 int handshake_failure = 0;
markrad 0:cdf462088d13 1405 const mbedtls_ssl_ciphersuite_t *suite_info;
markrad 0:cdf462088d13 1406 #if defined(MBEDTLS_DEBUG_C)
markrad 0:cdf462088d13 1407 uint32_t t;
markrad 0:cdf462088d13 1408 #endif
markrad 0:cdf462088d13 1409
markrad 0:cdf462088d13 1410 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
markrad 0:cdf462088d13 1411
markrad 0:cdf462088d13 1412 buf = ssl->in_msg;
markrad 0:cdf462088d13 1413
markrad 0:cdf462088d13 1414 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 1415 {
markrad 0:cdf462088d13 1416 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
markrad 0:cdf462088d13 1417 return( ret );
markrad 0:cdf462088d13 1418 }
markrad 0:cdf462088d13 1419
markrad 0:cdf462088d13 1420 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 1421 {
markrad 0:cdf462088d13 1422 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1423 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
markrad 0:cdf462088d13 1424 {
markrad 0:cdf462088d13 1425 ssl->renego_records_seen++;
markrad 0:cdf462088d13 1426
markrad 0:cdf462088d13 1427 if( ssl->conf->renego_max_records >= 0 &&
markrad 0:cdf462088d13 1428 ssl->renego_records_seen > ssl->conf->renego_max_records )
markrad 0:cdf462088d13 1429 {
markrad 0:cdf462088d13 1430 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
markrad 0:cdf462088d13 1431 "but not honored by server" ) );
markrad 0:cdf462088d13 1432 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 1433 }
markrad 0:cdf462088d13 1434
markrad 0:cdf462088d13 1435 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
markrad 0:cdf462088d13 1436 return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
markrad 0:cdf462088d13 1437 }
markrad 0:cdf462088d13 1438 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 1439
markrad 0:cdf462088d13 1440 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1441 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 1442 }
markrad 0:cdf462088d13 1443
markrad 0:cdf462088d13 1444 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1445 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1446 {
markrad 0:cdf462088d13 1447 if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
markrad 0:cdf462088d13 1448 {
markrad 0:cdf462088d13 1449 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
markrad 0:cdf462088d13 1450 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
markrad 0:cdf462088d13 1451 return( ssl_parse_hello_verify_request( ssl ) );
markrad 0:cdf462088d13 1452 }
markrad 0:cdf462088d13 1453 else
markrad 0:cdf462088d13 1454 {
markrad 0:cdf462088d13 1455 /* We made it through the verification process */
markrad 0:cdf462088d13 1456 mbedtls_free( ssl->handshake->verify_cookie );
markrad 0:cdf462088d13 1457 ssl->handshake->verify_cookie = NULL;
markrad 0:cdf462088d13 1458 ssl->handshake->verify_cookie_len = 0;
markrad 0:cdf462088d13 1459 }
markrad 0:cdf462088d13 1460 }
markrad 0:cdf462088d13 1461 #endif /* MBEDTLS_SSL_PROTO_DTLS */
markrad 0:cdf462088d13 1462
markrad 0:cdf462088d13 1463 if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) ||
markrad 0:cdf462088d13 1464 buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
markrad 0:cdf462088d13 1465 {
markrad 0:cdf462088d13 1466 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1467 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1468 }
markrad 0:cdf462088d13 1469
markrad 0:cdf462088d13 1470 /*
markrad 0:cdf462088d13 1471 * 0 . 1 server_version
markrad 0:cdf462088d13 1472 * 2 . 33 random (maybe including 4 bytes of Unix time)
markrad 0:cdf462088d13 1473 * 34 . 34 session_id length = n
markrad 0:cdf462088d13 1474 * 35 . 34+n session_id
markrad 0:cdf462088d13 1475 * 35+n . 36+n cipher_suite
markrad 0:cdf462088d13 1476 * 37+n . 37+n compression_method
markrad 0:cdf462088d13 1477 *
markrad 0:cdf462088d13 1478 * 38+n . 39+n extensions length (optional)
markrad 0:cdf462088d13 1479 * 40+n . .. extensions
markrad 0:cdf462088d13 1480 */
markrad 0:cdf462088d13 1481 buf += mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 1482
markrad 0:cdf462088d13 1483 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
markrad 0:cdf462088d13 1484 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
markrad 0:cdf462088d13 1485 ssl->conf->transport, buf + 0 );
markrad 0:cdf462088d13 1486
markrad 0:cdf462088d13 1487 if( ssl->major_ver < ssl->conf->min_major_ver ||
markrad 0:cdf462088d13 1488 ssl->minor_ver < ssl->conf->min_minor_ver ||
markrad 0:cdf462088d13 1489 ssl->major_ver > ssl->conf->max_major_ver ||
markrad 0:cdf462088d13 1490 ssl->minor_ver > ssl->conf->max_minor_ver )
markrad 0:cdf462088d13 1491 {
markrad 0:cdf462088d13 1492 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
markrad 0:cdf462088d13 1493 " min: [%d:%d], server: [%d:%d], max: [%d:%d]",
markrad 0:cdf462088d13 1494 ssl->conf->min_major_ver, ssl->conf->min_minor_ver,
markrad 0:cdf462088d13 1495 ssl->major_ver, ssl->minor_ver,
markrad 0:cdf462088d13 1496 ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) );
markrad 0:cdf462088d13 1497
markrad 0:cdf462088d13 1498 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 1499 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1500
markrad 0:cdf462088d13 1501 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1502 }
markrad 0:cdf462088d13 1503
markrad 0:cdf462088d13 1504 #if defined(MBEDTLS_DEBUG_C)
markrad 0:cdf462088d13 1505 t = ( (uint32_t) buf[2] << 24 )
markrad 0:cdf462088d13 1506 | ( (uint32_t) buf[3] << 16 )
markrad 0:cdf462088d13 1507 | ( (uint32_t) buf[4] << 8 )
markrad 0:cdf462088d13 1508 | ( (uint32_t) buf[5] );
markrad 0:cdf462088d13 1509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
markrad 0:cdf462088d13 1510 #endif
markrad 0:cdf462088d13 1511
markrad 0:cdf462088d13 1512 memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
markrad 0:cdf462088d13 1513
markrad 0:cdf462088d13 1514 n = buf[34];
markrad 0:cdf462088d13 1515
markrad 0:cdf462088d13 1516 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
markrad 0:cdf462088d13 1517
markrad 0:cdf462088d13 1518 if( n > 32 )
markrad 0:cdf462088d13 1519 {
markrad 0:cdf462088d13 1520 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1521 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1522 }
markrad 0:cdf462088d13 1523
markrad 0:cdf462088d13 1524 if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
markrad 0:cdf462088d13 1525 {
markrad 0:cdf462088d13 1526 ext_len = ( ( buf[38 + n] << 8 )
markrad 0:cdf462088d13 1527 | ( buf[39 + n] ) );
markrad 0:cdf462088d13 1528
markrad 0:cdf462088d13 1529 if( ( ext_len > 0 && ext_len < 4 ) ||
markrad 0:cdf462088d13 1530 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
markrad 0:cdf462088d13 1531 {
markrad 0:cdf462088d13 1532 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1533 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1534 }
markrad 0:cdf462088d13 1535 }
markrad 0:cdf462088d13 1536 else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
markrad 0:cdf462088d13 1537 {
markrad 0:cdf462088d13 1538 ext_len = 0;
markrad 0:cdf462088d13 1539 }
markrad 0:cdf462088d13 1540 else
markrad 0:cdf462088d13 1541 {
markrad 0:cdf462088d13 1542 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1543 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1544 }
markrad 0:cdf462088d13 1545
markrad 0:cdf462088d13 1546 /* ciphersuite (used later) */
markrad 0:cdf462088d13 1547 i = ( buf[35 + n] << 8 ) | buf[36 + n];
markrad 0:cdf462088d13 1548
markrad 0:cdf462088d13 1549 /*
markrad 0:cdf462088d13 1550 * Read and check compression
markrad 0:cdf462088d13 1551 */
markrad 0:cdf462088d13 1552 comp = buf[37 + n];
markrad 0:cdf462088d13 1553
markrad 0:cdf462088d13 1554 #if defined(MBEDTLS_ZLIB_SUPPORT)
markrad 0:cdf462088d13 1555 /* See comments in ssl_write_client_hello() */
markrad 0:cdf462088d13 1556 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1557 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1558 accept_comp = 0;
markrad 0:cdf462088d13 1559 else
markrad 0:cdf462088d13 1560 #endif
markrad 0:cdf462088d13 1561 accept_comp = 1;
markrad 0:cdf462088d13 1562
markrad 0:cdf462088d13 1563 if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
markrad 0:cdf462088d13 1564 ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) )
markrad 0:cdf462088d13 1565 #else /* MBEDTLS_ZLIB_SUPPORT */
markrad 0:cdf462088d13 1566 if( comp != MBEDTLS_SSL_COMPRESS_NULL )
markrad 0:cdf462088d13 1567 #endif/* MBEDTLS_ZLIB_SUPPORT */
markrad 0:cdf462088d13 1568 {
markrad 0:cdf462088d13 1569 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
markrad 0:cdf462088d13 1570 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
markrad 0:cdf462088d13 1571 }
markrad 0:cdf462088d13 1572
markrad 0:cdf462088d13 1573 /*
markrad 0:cdf462088d13 1574 * Initialize update checksum functions
markrad 0:cdf462088d13 1575 */
markrad 0:cdf462088d13 1576 ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
markrad 0:cdf462088d13 1577
markrad 0:cdf462088d13 1578 if( ssl->transform_negotiate->ciphersuite_info == NULL )
markrad 0:cdf462088d13 1579 {
markrad 0:cdf462088d13 1580 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) );
markrad 0:cdf462088d13 1581 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 1582 }
markrad 0:cdf462088d13 1583
markrad 0:cdf462088d13 1584 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
markrad 0:cdf462088d13 1585
markrad 0:cdf462088d13 1586 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
markrad 0:cdf462088d13 1587 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
markrad 0:cdf462088d13 1588
markrad 0:cdf462088d13 1589 /*
markrad 0:cdf462088d13 1590 * Check if the session can be resumed
markrad 0:cdf462088d13 1591 */
markrad 0:cdf462088d13 1592 if( ssl->handshake->resume == 0 || n == 0 ||
markrad 0:cdf462088d13 1593 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1594 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
markrad 0:cdf462088d13 1595 #endif
markrad 0:cdf462088d13 1596 ssl->session_negotiate->ciphersuite != i ||
markrad 0:cdf462088d13 1597 ssl->session_negotiate->compression != comp ||
markrad 0:cdf462088d13 1598 ssl->session_negotiate->id_len != n ||
markrad 0:cdf462088d13 1599 memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
markrad 0:cdf462088d13 1600 {
markrad 0:cdf462088d13 1601 ssl->state++;
markrad 0:cdf462088d13 1602 ssl->handshake->resume = 0;
markrad 0:cdf462088d13 1603 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 1604 ssl->session_negotiate->start = mbedtls_time( NULL );
markrad 0:cdf462088d13 1605 #endif
markrad 0:cdf462088d13 1606 ssl->session_negotiate->ciphersuite = i;
markrad 0:cdf462088d13 1607 ssl->session_negotiate->compression = comp;
markrad 0:cdf462088d13 1608 ssl->session_negotiate->id_len = n;
markrad 0:cdf462088d13 1609 memcpy( ssl->session_negotiate->id, buf + 35, n );
markrad 0:cdf462088d13 1610 }
markrad 0:cdf462088d13 1611 else
markrad 0:cdf462088d13 1612 {
markrad 0:cdf462088d13 1613 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
markrad 0:cdf462088d13 1614
markrad 0:cdf462088d13 1615 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
markrad 0:cdf462088d13 1616 {
markrad 0:cdf462088d13 1617 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
markrad 0:cdf462088d13 1618 return( ret );
markrad 0:cdf462088d13 1619 }
markrad 0:cdf462088d13 1620 }
markrad 0:cdf462088d13 1621
markrad 0:cdf462088d13 1622 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
markrad 0:cdf462088d13 1623 ssl->handshake->resume ? "a" : "no" ) );
markrad 0:cdf462088d13 1624
markrad 0:cdf462088d13 1625 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
markrad 0:cdf462088d13 1626 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
markrad 0:cdf462088d13 1627
markrad 0:cdf462088d13 1628 suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
markrad 0:cdf462088d13 1629 if( suite_info == NULL
markrad 0:cdf462088d13 1630 #if defined(MBEDTLS_ARC4_C)
markrad 0:cdf462088d13 1631 || ( ssl->conf->arc4_disabled &&
markrad 0:cdf462088d13 1632 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
markrad 0:cdf462088d13 1633 #endif
markrad 0:cdf462088d13 1634 )
markrad 0:cdf462088d13 1635 {
markrad 0:cdf462088d13 1636 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1637 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1638 }
markrad 0:cdf462088d13 1639
markrad 0:cdf462088d13 1640 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
markrad 0:cdf462088d13 1641
markrad 0:cdf462088d13 1642 i = 0;
markrad 0:cdf462088d13 1643 while( 1 )
markrad 0:cdf462088d13 1644 {
markrad 0:cdf462088d13 1645 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
markrad 0:cdf462088d13 1646 {
markrad 0:cdf462088d13 1647 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1648 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1649 }
markrad 0:cdf462088d13 1650
markrad 0:cdf462088d13 1651 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
markrad 0:cdf462088d13 1652 ssl->session_negotiate->ciphersuite )
markrad 0:cdf462088d13 1653 {
markrad 0:cdf462088d13 1654 break;
markrad 0:cdf462088d13 1655 }
markrad 0:cdf462088d13 1656 }
markrad 0:cdf462088d13 1657
markrad 0:cdf462088d13 1658 if( comp != MBEDTLS_SSL_COMPRESS_NULL
markrad 0:cdf462088d13 1659 #if defined(MBEDTLS_ZLIB_SUPPORT)
markrad 0:cdf462088d13 1660 && comp != MBEDTLS_SSL_COMPRESS_DEFLATE
markrad 0:cdf462088d13 1661 #endif
markrad 0:cdf462088d13 1662 )
markrad 0:cdf462088d13 1663 {
markrad 0:cdf462088d13 1664 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1665 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1666 }
markrad 0:cdf462088d13 1667 ssl->session_negotiate->compression = comp;
markrad 0:cdf462088d13 1668
markrad 0:cdf462088d13 1669 ext = buf + 40 + n;
markrad 0:cdf462088d13 1670
markrad 0:cdf462088d13 1671 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
markrad 0:cdf462088d13 1672
markrad 0:cdf462088d13 1673 while( ext_len )
markrad 0:cdf462088d13 1674 {
markrad 0:cdf462088d13 1675 unsigned int ext_id = ( ( ext[0] << 8 )
markrad 0:cdf462088d13 1676 | ( ext[1] ) );
markrad 0:cdf462088d13 1677 unsigned int ext_size = ( ( ext[2] << 8 )
markrad 0:cdf462088d13 1678 | ( ext[3] ) );
markrad 0:cdf462088d13 1679
markrad 0:cdf462088d13 1680 if( ext_size + 4 > ext_len )
markrad 0:cdf462088d13 1681 {
markrad 0:cdf462088d13 1682 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1683 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1684 }
markrad 0:cdf462088d13 1685
markrad 0:cdf462088d13 1686 switch( ext_id )
markrad 0:cdf462088d13 1687 {
markrad 0:cdf462088d13 1688 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
markrad 0:cdf462088d13 1689 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
markrad 0:cdf462088d13 1690 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1691 renegotiation_info_seen = 1;
markrad 0:cdf462088d13 1692 #endif
markrad 0:cdf462088d13 1693
markrad 0:cdf462088d13 1694 if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
markrad 0:cdf462088d13 1695 ext_size ) ) != 0 )
markrad 0:cdf462088d13 1696 return( ret );
markrad 0:cdf462088d13 1697
markrad 0:cdf462088d13 1698 break;
markrad 0:cdf462088d13 1699
markrad 0:cdf462088d13 1700 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 1701 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
markrad 0:cdf462088d13 1702 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
markrad 0:cdf462088d13 1703
markrad 0:cdf462088d13 1704 if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
markrad 0:cdf462088d13 1705 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1706 {
markrad 0:cdf462088d13 1707 return( ret );
markrad 0:cdf462088d13 1708 }
markrad 0:cdf462088d13 1709
markrad 0:cdf462088d13 1710 break;
markrad 0:cdf462088d13 1711 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
markrad 0:cdf462088d13 1712
markrad 0:cdf462088d13 1713 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 1714 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
markrad 0:cdf462088d13 1715 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
markrad 0:cdf462088d13 1716
markrad 0:cdf462088d13 1717 if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
markrad 0:cdf462088d13 1718 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1719 {
markrad 0:cdf462088d13 1720 return( ret );
markrad 0:cdf462088d13 1721 }
markrad 0:cdf462088d13 1722
markrad 0:cdf462088d13 1723 break;
markrad 0:cdf462088d13 1724 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
markrad 0:cdf462088d13 1725
markrad 0:cdf462088d13 1726 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 1727 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
markrad 0:cdf462088d13 1728 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
markrad 0:cdf462088d13 1729
markrad 0:cdf462088d13 1730 if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
markrad 0:cdf462088d13 1731 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1732 {
markrad 0:cdf462088d13 1733 return( ret );
markrad 0:cdf462088d13 1734 }
markrad 0:cdf462088d13 1735
markrad 0:cdf462088d13 1736 break;
markrad 0:cdf462088d13 1737 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
markrad 0:cdf462088d13 1738
markrad 0:cdf462088d13 1739 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 1740 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
markrad 0:cdf462088d13 1741 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) );
markrad 0:cdf462088d13 1742
markrad 0:cdf462088d13 1743 if( ( ret = ssl_parse_extended_ms_ext( ssl,
markrad 0:cdf462088d13 1744 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1745 {
markrad 0:cdf462088d13 1746 return( ret );
markrad 0:cdf462088d13 1747 }
markrad 0:cdf462088d13 1748
markrad 0:cdf462088d13 1749 break;
markrad 0:cdf462088d13 1750 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
markrad 0:cdf462088d13 1751
markrad 0:cdf462088d13 1752 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 1753 case MBEDTLS_TLS_EXT_SESSION_TICKET:
markrad 0:cdf462088d13 1754 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
markrad 0:cdf462088d13 1755
markrad 0:cdf462088d13 1756 if( ( ret = ssl_parse_session_ticket_ext( ssl,
markrad 0:cdf462088d13 1757 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1758 {
markrad 0:cdf462088d13 1759 return( ret );
markrad 0:cdf462088d13 1760 }
markrad 0:cdf462088d13 1761
markrad 0:cdf462088d13 1762 break;
markrad 0:cdf462088d13 1763 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 1764
markrad 0:cdf462088d13 1765 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 1766 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1767 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
markrad 0:cdf462088d13 1768 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) );
markrad 0:cdf462088d13 1769
markrad 0:cdf462088d13 1770 if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
markrad 0:cdf462088d13 1771 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1772 {
markrad 0:cdf462088d13 1773 return( ret );
markrad 0:cdf462088d13 1774 }
markrad 0:cdf462088d13 1775
markrad 0:cdf462088d13 1776 break;
markrad 0:cdf462088d13 1777 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
markrad 0:cdf462088d13 1778 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 1779
markrad 0:cdf462088d13 1780 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1781 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
markrad 0:cdf462088d13 1782 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
markrad 0:cdf462088d13 1783
markrad 0:cdf462088d13 1784 if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
markrad 0:cdf462088d13 1785 ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1786 {
markrad 0:cdf462088d13 1787 return( ret );
markrad 0:cdf462088d13 1788 }
markrad 0:cdf462088d13 1789
markrad 0:cdf462088d13 1790 break;
markrad 0:cdf462088d13 1791 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 1792
markrad 0:cdf462088d13 1793 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 1794 case MBEDTLS_TLS_EXT_ALPN:
markrad 0:cdf462088d13 1795 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
markrad 0:cdf462088d13 1796
markrad 0:cdf462088d13 1797 if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
markrad 0:cdf462088d13 1798 return( ret );
markrad 0:cdf462088d13 1799
markrad 0:cdf462088d13 1800 break;
markrad 0:cdf462088d13 1801 #endif /* MBEDTLS_SSL_ALPN */
markrad 0:cdf462088d13 1802
markrad 0:cdf462088d13 1803 default:
markrad 0:cdf462088d13 1804 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
markrad 0:cdf462088d13 1805 ext_id ) );
markrad 0:cdf462088d13 1806 }
markrad 0:cdf462088d13 1807
markrad 0:cdf462088d13 1808 ext_len -= 4 + ext_size;
markrad 0:cdf462088d13 1809 ext += 4 + ext_size;
markrad 0:cdf462088d13 1810
markrad 0:cdf462088d13 1811 if( ext_len > 0 && ext_len < 4 )
markrad 0:cdf462088d13 1812 {
markrad 0:cdf462088d13 1813 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
markrad 0:cdf462088d13 1814 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1815 }
markrad 0:cdf462088d13 1816 }
markrad 0:cdf462088d13 1817
markrad 0:cdf462088d13 1818 /*
markrad 0:cdf462088d13 1819 * Renegotiation security checks
markrad 0:cdf462088d13 1820 */
markrad 0:cdf462088d13 1821 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
markrad 0:cdf462088d13 1822 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
markrad 0:cdf462088d13 1823 {
markrad 0:cdf462088d13 1824 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
markrad 0:cdf462088d13 1825 handshake_failure = 1;
markrad 0:cdf462088d13 1826 }
markrad 0:cdf462088d13 1827 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1828 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
markrad 0:cdf462088d13 1829 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
markrad 0:cdf462088d13 1830 renegotiation_info_seen == 0 )
markrad 0:cdf462088d13 1831 {
markrad 0:cdf462088d13 1832 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
markrad 0:cdf462088d13 1833 handshake_failure = 1;
markrad 0:cdf462088d13 1834 }
markrad 0:cdf462088d13 1835 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
markrad 0:cdf462088d13 1836 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
markrad 0:cdf462088d13 1837 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
markrad 0:cdf462088d13 1838 {
markrad 0:cdf462088d13 1839 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
markrad 0:cdf462088d13 1840 handshake_failure = 1;
markrad 0:cdf462088d13 1841 }
markrad 0:cdf462088d13 1842 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
markrad 0:cdf462088d13 1843 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
markrad 0:cdf462088d13 1844 renegotiation_info_seen == 1 )
markrad 0:cdf462088d13 1845 {
markrad 0:cdf462088d13 1846 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
markrad 0:cdf462088d13 1847 handshake_failure = 1;
markrad 0:cdf462088d13 1848 }
markrad 0:cdf462088d13 1849 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 1850
markrad 0:cdf462088d13 1851 if( handshake_failure == 1 )
markrad 0:cdf462088d13 1852 {
markrad 0:cdf462088d13 1853 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
markrad 0:cdf462088d13 1854 return( ret );
markrad 0:cdf462088d13 1855
markrad 0:cdf462088d13 1856 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
markrad 0:cdf462088d13 1857 }
markrad 0:cdf462088d13 1858
markrad 0:cdf462088d13 1859 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
markrad 0:cdf462088d13 1860
markrad 0:cdf462088d13 1861 return( 0 );
markrad 0:cdf462088d13 1862 }
markrad 0:cdf462088d13 1863
markrad 0:cdf462088d13 1864 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 1865 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
markrad 0:cdf462088d13 1866 static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl, unsigned char **p,
markrad 0:cdf462088d13 1867 unsigned char *end )
markrad 0:cdf462088d13 1868 {
markrad 0:cdf462088d13 1869 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
markrad 0:cdf462088d13 1870
markrad 0:cdf462088d13 1871 /*
markrad 0:cdf462088d13 1872 * Ephemeral DH parameters:
markrad 0:cdf462088d13 1873 *
markrad 0:cdf462088d13 1874 * struct {
markrad 0:cdf462088d13 1875 * opaque dh_p<1..2^16-1>;
markrad 0:cdf462088d13 1876 * opaque dh_g<1..2^16-1>;
markrad 0:cdf462088d13 1877 * opaque dh_Ys<1..2^16-1>;
markrad 0:cdf462088d13 1878 * } ServerDHParams;
markrad 0:cdf462088d13 1879 */
markrad 0:cdf462088d13 1880 if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 )
markrad 0:cdf462088d13 1881 {
markrad 0:cdf462088d13 1882 MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
markrad 0:cdf462088d13 1883 return( ret );
markrad 0:cdf462088d13 1884 }
markrad 0:cdf462088d13 1885
markrad 0:cdf462088d13 1886 if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
markrad 0:cdf462088d13 1887 {
markrad 0:cdf462088d13 1888 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
markrad 0:cdf462088d13 1889 ssl->handshake->dhm_ctx.len * 8,
markrad 0:cdf462088d13 1890 ssl->conf->dhm_min_bitlen ) );
markrad 0:cdf462088d13 1891 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 1892 }
markrad 0:cdf462088d13 1893
markrad 0:cdf462088d13 1894 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
markrad 0:cdf462088d13 1895 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
markrad 0:cdf462088d13 1896 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
markrad 0:cdf462088d13 1897
markrad 0:cdf462088d13 1898 return( ret );
markrad 0:cdf462088d13 1899 }
markrad 0:cdf462088d13 1900 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
markrad 0:cdf462088d13 1901 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
markrad 0:cdf462088d13 1902
markrad 0:cdf462088d13 1903 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 1904 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
markrad 0:cdf462088d13 1905 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
markrad 0:cdf462088d13 1906 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
markrad 0:cdf462088d13 1907 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
markrad 0:cdf462088d13 1908 static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 1909 {
markrad 0:cdf462088d13 1910 const mbedtls_ecp_curve_info *curve_info;
markrad 0:cdf462088d13 1911
markrad 0:cdf462088d13 1912 curve_info = mbedtls_ecp_curve_info_from_grp_id( ssl->handshake->ecdh_ctx.grp.id );
markrad 0:cdf462088d13 1913 if( curve_info == NULL )
markrad 0:cdf462088d13 1914 {
markrad 0:cdf462088d13 1915 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 1916 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 1917 }
markrad 0:cdf462088d13 1918
markrad 0:cdf462088d13 1919 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
markrad 0:cdf462088d13 1920
markrad 0:cdf462088d13 1921 #if defined(MBEDTLS_ECP_C)
markrad 0:cdf462088d13 1922 if( mbedtls_ssl_check_curve( ssl, ssl->handshake->ecdh_ctx.grp.id ) != 0 )
markrad 0:cdf462088d13 1923 #else
markrad 0:cdf462088d13 1924 if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
markrad 0:cdf462088d13 1925 ssl->handshake->ecdh_ctx.grp.nbits > 521 )
markrad 0:cdf462088d13 1926 #endif
markrad 0:cdf462088d13 1927 return( -1 );
markrad 0:cdf462088d13 1928
markrad 0:cdf462088d13 1929 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp", &ssl->handshake->ecdh_ctx.Qp );
markrad 0:cdf462088d13 1930
markrad 0:cdf462088d13 1931 return( 0 );
markrad 0:cdf462088d13 1932 }
markrad 0:cdf462088d13 1933 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 1934 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
markrad 0:cdf462088d13 1935 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
markrad 0:cdf462088d13 1936 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
markrad 0:cdf462088d13 1937 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
markrad 0:cdf462088d13 1938
markrad 0:cdf462088d13 1939 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 1940 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
markrad 0:cdf462088d13 1941 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
markrad 0:cdf462088d13 1942 static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1943 unsigned char **p,
markrad 0:cdf462088d13 1944 unsigned char *end )
markrad 0:cdf462088d13 1945 {
markrad 0:cdf462088d13 1946 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
markrad 0:cdf462088d13 1947
markrad 0:cdf462088d13 1948 /*
markrad 0:cdf462088d13 1949 * Ephemeral ECDH parameters:
markrad 0:cdf462088d13 1950 *
markrad 0:cdf462088d13 1951 * struct {
markrad 0:cdf462088d13 1952 * ECParameters curve_params;
markrad 0:cdf462088d13 1953 * ECPoint public;
markrad 0:cdf462088d13 1954 * } ServerECDHParams;
markrad 0:cdf462088d13 1955 */
markrad 0:cdf462088d13 1956 if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 1957 (const unsigned char **) p, end ) ) != 0 )
markrad 0:cdf462088d13 1958 {
markrad 0:cdf462088d13 1959 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
markrad 0:cdf462088d13 1960 return( ret );
markrad 0:cdf462088d13 1961 }
markrad 0:cdf462088d13 1962
markrad 0:cdf462088d13 1963 if( ssl_check_server_ecdh_params( ssl ) != 0 )
markrad 0:cdf462088d13 1964 {
markrad 0:cdf462088d13 1965 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) );
markrad 0:cdf462088d13 1966 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 1967 }
markrad 0:cdf462088d13 1968
markrad 0:cdf462088d13 1969 return( ret );
markrad 0:cdf462088d13 1970 }
markrad 0:cdf462088d13 1971 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 1972 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
markrad 0:cdf462088d13 1973 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
markrad 0:cdf462088d13 1974
markrad 0:cdf462088d13 1975 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
markrad 0:cdf462088d13 1976 static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 1977 unsigned char **p,
markrad 0:cdf462088d13 1978 unsigned char *end )
markrad 0:cdf462088d13 1979 {
markrad 0:cdf462088d13 1980 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
markrad 0:cdf462088d13 1981 size_t len;
markrad 0:cdf462088d13 1982 ((void) ssl);
markrad 0:cdf462088d13 1983
markrad 0:cdf462088d13 1984 /*
markrad 0:cdf462088d13 1985 * PSK parameters:
markrad 0:cdf462088d13 1986 *
markrad 0:cdf462088d13 1987 * opaque psk_identity_hint<0..2^16-1>;
markrad 0:cdf462088d13 1988 */
markrad 0:cdf462088d13 1989 len = (*p)[0] << 8 | (*p)[1];
markrad 0:cdf462088d13 1990 *p += 2;
markrad 0:cdf462088d13 1991
markrad 0:cdf462088d13 1992 if( (*p) + len > end )
markrad 0:cdf462088d13 1993 {
markrad 0:cdf462088d13 1994 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (psk_identity_hint length)" ) );
markrad 0:cdf462088d13 1995 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 1996 }
markrad 0:cdf462088d13 1997
markrad 0:cdf462088d13 1998 /*
markrad 0:cdf462088d13 1999 * Note: we currently ignore the PKS identity hint, as we only allow one
markrad 0:cdf462088d13 2000 * PSK to be provisionned on the client. This could be changed later if
markrad 0:cdf462088d13 2001 * someone needs that feature.
markrad 0:cdf462088d13 2002 */
markrad 0:cdf462088d13 2003 *p += len;
markrad 0:cdf462088d13 2004 ret = 0;
markrad 0:cdf462088d13 2005
markrad 0:cdf462088d13 2006 return( ret );
markrad 0:cdf462088d13 2007 }
markrad 0:cdf462088d13 2008 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
markrad 0:cdf462088d13 2009
markrad 0:cdf462088d13 2010 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2011 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
markrad 0:cdf462088d13 2012 /*
markrad 0:cdf462088d13 2013 * Generate a pre-master secret and encrypt it with the server's RSA key
markrad 0:cdf462088d13 2014 */
markrad 0:cdf462088d13 2015 static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2016 size_t offset, size_t *olen,
markrad 0:cdf462088d13 2017 size_t pms_offset )
markrad 0:cdf462088d13 2018 {
markrad 0:cdf462088d13 2019 int ret;
markrad 0:cdf462088d13 2020 size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
markrad 0:cdf462088d13 2021 unsigned char *p = ssl->handshake->premaster + pms_offset;
markrad 0:cdf462088d13 2022
markrad 0:cdf462088d13 2023 if( offset + len_bytes > MBEDTLS_SSL_MAX_CONTENT_LEN )
markrad 0:cdf462088d13 2024 {
markrad 0:cdf462088d13 2025 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
markrad 0:cdf462088d13 2026 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
markrad 0:cdf462088d13 2027 }
markrad 0:cdf462088d13 2028
markrad 0:cdf462088d13 2029 /*
markrad 0:cdf462088d13 2030 * Generate (part of) the pre-master as
markrad 0:cdf462088d13 2031 * struct {
markrad 0:cdf462088d13 2032 * ProtocolVersion client_version;
markrad 0:cdf462088d13 2033 * opaque random[46];
markrad 0:cdf462088d13 2034 * } PreMasterSecret;
markrad 0:cdf462088d13 2035 */
markrad 0:cdf462088d13 2036 mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
markrad 0:cdf462088d13 2037 ssl->conf->transport, p );
markrad 0:cdf462088d13 2038
markrad 0:cdf462088d13 2039 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
markrad 0:cdf462088d13 2040 {
markrad 0:cdf462088d13 2041 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
markrad 0:cdf462088d13 2042 return( ret );
markrad 0:cdf462088d13 2043 }
markrad 0:cdf462088d13 2044
markrad 0:cdf462088d13 2045 ssl->handshake->pmslen = 48;
markrad 0:cdf462088d13 2046
markrad 0:cdf462088d13 2047 if( ssl->session_negotiate->peer_cert == NULL )
markrad 0:cdf462088d13 2048 {
markrad 0:cdf462088d13 2049 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
markrad 0:cdf462088d13 2050 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2051 }
markrad 0:cdf462088d13 2052
markrad 0:cdf462088d13 2053 /*
markrad 0:cdf462088d13 2054 * Now write it out, encrypted
markrad 0:cdf462088d13 2055 */
markrad 0:cdf462088d13 2056 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
markrad 0:cdf462088d13 2057 MBEDTLS_PK_RSA ) )
markrad 0:cdf462088d13 2058 {
markrad 0:cdf462088d13 2059 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
markrad 0:cdf462088d13 2060 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
markrad 0:cdf462088d13 2061 }
markrad 0:cdf462088d13 2062
markrad 0:cdf462088d13 2063 if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk,
markrad 0:cdf462088d13 2064 p, ssl->handshake->pmslen,
markrad 0:cdf462088d13 2065 ssl->out_msg + offset + len_bytes, olen,
markrad 0:cdf462088d13 2066 MBEDTLS_SSL_MAX_CONTENT_LEN - offset - len_bytes,
markrad 0:cdf462088d13 2067 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 2068 {
markrad 0:cdf462088d13 2069 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
markrad 0:cdf462088d13 2070 return( ret );
markrad 0:cdf462088d13 2071 }
markrad 0:cdf462088d13 2072
markrad 0:cdf462088d13 2073 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
markrad 0:cdf462088d13 2074 defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 2075 if( len_bytes == 2 )
markrad 0:cdf462088d13 2076 {
markrad 0:cdf462088d13 2077 ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
markrad 0:cdf462088d13 2078 ssl->out_msg[offset+1] = (unsigned char)( *olen );
markrad 0:cdf462088d13 2079 *olen += 2;
markrad 0:cdf462088d13 2080 }
markrad 0:cdf462088d13 2081 #endif
markrad 0:cdf462088d13 2082
markrad 0:cdf462088d13 2083 return( 0 );
markrad 0:cdf462088d13 2084 }
markrad 0:cdf462088d13 2085 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
markrad 0:cdf462088d13 2086 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
markrad 0:cdf462088d13 2087
markrad 0:cdf462088d13 2088 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 2089 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2090 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2091 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 2092 static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2093 unsigned char **p,
markrad 0:cdf462088d13 2094 unsigned char *end,
markrad 0:cdf462088d13 2095 mbedtls_md_type_t *md_alg,
markrad 0:cdf462088d13 2096 mbedtls_pk_type_t *pk_alg )
markrad 0:cdf462088d13 2097 {
markrad 0:cdf462088d13 2098 ((void) ssl);
markrad 0:cdf462088d13 2099 *md_alg = MBEDTLS_MD_NONE;
markrad 0:cdf462088d13 2100 *pk_alg = MBEDTLS_PK_NONE;
markrad 0:cdf462088d13 2101
markrad 0:cdf462088d13 2102 /* Only in TLS 1.2 */
markrad 0:cdf462088d13 2103 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 2104 {
markrad 0:cdf462088d13 2105 return( 0 );
markrad 0:cdf462088d13 2106 }
markrad 0:cdf462088d13 2107
markrad 0:cdf462088d13 2108 if( (*p) + 2 > end )
markrad 0:cdf462088d13 2109 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2110
markrad 0:cdf462088d13 2111 /*
markrad 0:cdf462088d13 2112 * Get hash algorithm
markrad 0:cdf462088d13 2113 */
markrad 0:cdf462088d13 2114 if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) ) == MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 2115 {
markrad 0:cdf462088d13 2116 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
markrad 0:cdf462088d13 2117 "HashAlgorithm %d", *(p)[0] ) );
markrad 0:cdf462088d13 2118 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2119 }
markrad 0:cdf462088d13 2120
markrad 0:cdf462088d13 2121 /*
markrad 0:cdf462088d13 2122 * Get signature algorithm
markrad 0:cdf462088d13 2123 */
markrad 0:cdf462088d13 2124 if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) ) == MBEDTLS_PK_NONE )
markrad 0:cdf462088d13 2125 {
markrad 0:cdf462088d13 2126 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
markrad 0:cdf462088d13 2127 "SignatureAlgorithm %d", (*p)[1] ) );
markrad 0:cdf462088d13 2128 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2129 }
markrad 0:cdf462088d13 2130
markrad 0:cdf462088d13 2131 /*
markrad 0:cdf462088d13 2132 * Check if the hash is acceptable
markrad 0:cdf462088d13 2133 */
markrad 0:cdf462088d13 2134 if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
markrad 0:cdf462088d13 2135 {
markrad 0:cdf462088d13 2136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm "
markrad 0:cdf462088d13 2137 "that was not offered" ) );
markrad 0:cdf462088d13 2138 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2139 }
markrad 0:cdf462088d13 2140
markrad 0:cdf462088d13 2141 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) );
markrad 0:cdf462088d13 2142 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) );
markrad 0:cdf462088d13 2143 *p += 2;
markrad 0:cdf462088d13 2144
markrad 0:cdf462088d13 2145 return( 0 );
markrad 0:cdf462088d13 2146 }
markrad 0:cdf462088d13 2147 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2148 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2149 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 2150 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 2151
markrad 0:cdf462088d13 2152 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
markrad 0:cdf462088d13 2153 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
markrad 0:cdf462088d13 2154 static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2155 {
markrad 0:cdf462088d13 2156 int ret;
markrad 0:cdf462088d13 2157 const mbedtls_ecp_keypair *peer_key;
markrad 0:cdf462088d13 2158
markrad 0:cdf462088d13 2159 if( ssl->session_negotiate->peer_cert == NULL )
markrad 0:cdf462088d13 2160 {
markrad 0:cdf462088d13 2161 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
markrad 0:cdf462088d13 2162 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2163 }
markrad 0:cdf462088d13 2164
markrad 0:cdf462088d13 2165 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
markrad 0:cdf462088d13 2166 MBEDTLS_PK_ECKEY ) )
markrad 0:cdf462088d13 2167 {
markrad 0:cdf462088d13 2168 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
markrad 0:cdf462088d13 2169 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
markrad 0:cdf462088d13 2170 }
markrad 0:cdf462088d13 2171
markrad 0:cdf462088d13 2172 peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk );
markrad 0:cdf462088d13 2173
markrad 0:cdf462088d13 2174 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
markrad 0:cdf462088d13 2175 MBEDTLS_ECDH_THEIRS ) ) != 0 )
markrad 0:cdf462088d13 2176 {
markrad 0:cdf462088d13 2177 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
markrad 0:cdf462088d13 2178 return( ret );
markrad 0:cdf462088d13 2179 }
markrad 0:cdf462088d13 2180
markrad 0:cdf462088d13 2181 if( ssl_check_server_ecdh_params( ssl ) != 0 )
markrad 0:cdf462088d13 2182 {
markrad 0:cdf462088d13 2183 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
markrad 0:cdf462088d13 2184 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
markrad 0:cdf462088d13 2185 }
markrad 0:cdf462088d13 2186
markrad 0:cdf462088d13 2187 return( ret );
markrad 0:cdf462088d13 2188 }
markrad 0:cdf462088d13 2189 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
markrad 0:cdf462088d13 2190 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
markrad 0:cdf462088d13 2191
markrad 0:cdf462088d13 2192 static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2193 {
markrad 0:cdf462088d13 2194 int ret;
markrad 0:cdf462088d13 2195 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2196 unsigned char *p, *end;
markrad 0:cdf462088d13 2197
markrad 0:cdf462088d13 2198 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
markrad 0:cdf462088d13 2199
markrad 0:cdf462088d13 2200 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
markrad 0:cdf462088d13 2201 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
markrad 0:cdf462088d13 2202 {
markrad 0:cdf462088d13 2203 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
markrad 0:cdf462088d13 2204 ssl->state++;
markrad 0:cdf462088d13 2205 return( 0 );
markrad 0:cdf462088d13 2206 }
markrad 0:cdf462088d13 2207 ((void) p);
markrad 0:cdf462088d13 2208 ((void) end);
markrad 0:cdf462088d13 2209 #endif
markrad 0:cdf462088d13 2210
markrad 0:cdf462088d13 2211 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
markrad 0:cdf462088d13 2212 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
markrad 0:cdf462088d13 2213 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
markrad 0:cdf462088d13 2214 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
markrad 0:cdf462088d13 2215 {
markrad 0:cdf462088d13 2216 if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
markrad 0:cdf462088d13 2217 {
markrad 0:cdf462088d13 2218 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
markrad 0:cdf462088d13 2219 return( ret );
markrad 0:cdf462088d13 2220 }
markrad 0:cdf462088d13 2221
markrad 0:cdf462088d13 2222 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
markrad 0:cdf462088d13 2223 ssl->state++;
markrad 0:cdf462088d13 2224 return( 0 );
markrad 0:cdf462088d13 2225 }
markrad 0:cdf462088d13 2226 ((void) p);
markrad 0:cdf462088d13 2227 ((void) end);
markrad 0:cdf462088d13 2228 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
markrad 0:cdf462088d13 2229 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
markrad 0:cdf462088d13 2230
markrad 0:cdf462088d13 2231 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 2232 {
markrad 0:cdf462088d13 2233 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
markrad 0:cdf462088d13 2234 return( ret );
markrad 0:cdf462088d13 2235 }
markrad 0:cdf462088d13 2236
markrad 0:cdf462088d13 2237 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 2238 {
markrad 0:cdf462088d13 2239 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2240 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2241 }
markrad 0:cdf462088d13 2242
markrad 0:cdf462088d13 2243 /*
markrad 0:cdf462088d13 2244 * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
markrad 0:cdf462088d13 2245 * doesn't use a psk_identity_hint
markrad 0:cdf462088d13 2246 */
markrad 0:cdf462088d13 2247 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
markrad 0:cdf462088d13 2248 {
markrad 0:cdf462088d13 2249 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2250 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
markrad 0:cdf462088d13 2251 {
markrad 0:cdf462088d13 2252 ssl->record_read = 1;
markrad 0:cdf462088d13 2253 goto exit;
markrad 0:cdf462088d13 2254 }
markrad 0:cdf462088d13 2255
markrad 0:cdf462088d13 2256 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2257 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2258 }
markrad 0:cdf462088d13 2259
markrad 0:cdf462088d13 2260 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 2261 end = ssl->in_msg + ssl->in_hslen;
markrad 0:cdf462088d13 2262 MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
markrad 0:cdf462088d13 2263
markrad 0:cdf462088d13 2264 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
markrad 0:cdf462088d13 2265 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2266 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 2267 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2268 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
markrad 0:cdf462088d13 2269 {
markrad 0:cdf462088d13 2270 if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
markrad 0:cdf462088d13 2271 {
markrad 0:cdf462088d13 2272 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2273 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2274 }
markrad 0:cdf462088d13 2275 } /* FALLTROUGH */
markrad 0:cdf462088d13 2276 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
markrad 0:cdf462088d13 2277
markrad 0:cdf462088d13 2278 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
markrad 0:cdf462088d13 2279 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
markrad 0:cdf462088d13 2280 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2281 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
markrad 0:cdf462088d13 2282 ; /* nothing more to do */
markrad 0:cdf462088d13 2283 else
markrad 0:cdf462088d13 2284 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
markrad 0:cdf462088d13 2285 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
markrad 0:cdf462088d13 2286 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2287 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
markrad 0:cdf462088d13 2288 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
markrad 0:cdf462088d13 2289 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
markrad 0:cdf462088d13 2290 {
markrad 0:cdf462088d13 2291 if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
markrad 0:cdf462088d13 2292 {
markrad 0:cdf462088d13 2293 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2294 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2295 }
markrad 0:cdf462088d13 2296 }
markrad 0:cdf462088d13 2297 else
markrad 0:cdf462088d13 2298 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2299 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
markrad 0:cdf462088d13 2300 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2301 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
markrad 0:cdf462088d13 2302 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 2303 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
markrad 0:cdf462088d13 2304 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 2305 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
markrad 0:cdf462088d13 2306 {
markrad 0:cdf462088d13 2307 if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
markrad 0:cdf462088d13 2308 {
markrad 0:cdf462088d13 2309 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2310 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2311 }
markrad 0:cdf462088d13 2312 }
markrad 0:cdf462088d13 2313 else
markrad 0:cdf462088d13 2314 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2315 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
markrad 0:cdf462088d13 2316 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 2317 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2318 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2319 {
markrad 0:cdf462088d13 2320 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 2321 p, end - p );
markrad 0:cdf462088d13 2322 if( ret != 0 )
markrad 0:cdf462088d13 2323 {
markrad 0:cdf462088d13 2324 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
markrad 0:cdf462088d13 2325 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2326 }
markrad 0:cdf462088d13 2327 }
markrad 0:cdf462088d13 2328 else
markrad 0:cdf462088d13 2329 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 2330 {
markrad 0:cdf462088d13 2331 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2332 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2333 }
markrad 0:cdf462088d13 2334
markrad 0:cdf462088d13 2335 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2336 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2337 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 2338 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
markrad 0:cdf462088d13 2339 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
markrad 0:cdf462088d13 2340 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
markrad 0:cdf462088d13 2341 {
markrad 0:cdf462088d13 2342 size_t sig_len, hashlen;
markrad 0:cdf462088d13 2343 unsigned char hash[64];
markrad 0:cdf462088d13 2344 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
markrad 0:cdf462088d13 2345 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
markrad 0:cdf462088d13 2346 unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 2347 size_t params_len = p - params;
markrad 0:cdf462088d13 2348
markrad 0:cdf462088d13 2349 /*
markrad 0:cdf462088d13 2350 * Handle the digitally-signed structure
markrad 0:cdf462088d13 2351 */
markrad 0:cdf462088d13 2352 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 2353 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 2354 {
markrad 0:cdf462088d13 2355 if( ssl_parse_signature_algorithm( ssl, &p, end,
markrad 0:cdf462088d13 2356 &md_alg, &pk_alg ) != 0 )
markrad 0:cdf462088d13 2357 {
markrad 0:cdf462088d13 2358 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2359 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2360 }
markrad 0:cdf462088d13 2361
markrad 0:cdf462088d13 2362 if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
markrad 0:cdf462088d13 2363 {
markrad 0:cdf462088d13 2364 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2365 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2366 }
markrad 0:cdf462088d13 2367 }
markrad 0:cdf462088d13 2368 else
markrad 0:cdf462088d13 2369 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 2370 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
markrad 0:cdf462088d13 2371 defined(MBEDTLS_SSL_PROTO_TLS1_1)
markrad 0:cdf462088d13 2372 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 2373 {
markrad 0:cdf462088d13 2374 pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
markrad 0:cdf462088d13 2375
markrad 0:cdf462088d13 2376 /* Default hash for ECDSA is SHA-1 */
markrad 0:cdf462088d13 2377 if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 2378 md_alg = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 2379 }
markrad 0:cdf462088d13 2380 else
markrad 0:cdf462088d13 2381 #endif
markrad 0:cdf462088d13 2382 {
markrad 0:cdf462088d13 2383 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2384 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2385 }
markrad 0:cdf462088d13 2386
markrad 0:cdf462088d13 2387 /*
markrad 0:cdf462088d13 2388 * Read signature
markrad 0:cdf462088d13 2389 */
markrad 0:cdf462088d13 2390 sig_len = ( p[0] << 8 ) | p[1];
markrad 0:cdf462088d13 2391 p += 2;
markrad 0:cdf462088d13 2392
markrad 0:cdf462088d13 2393 if( end != p + sig_len )
markrad 0:cdf462088d13 2394 {
markrad 0:cdf462088d13 2395 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2396 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 2397 }
markrad 0:cdf462088d13 2398
markrad 0:cdf462088d13 2399 MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
markrad 0:cdf462088d13 2400
markrad 0:cdf462088d13 2401 /*
markrad 0:cdf462088d13 2402 * Compute the hash that has been signed
markrad 0:cdf462088d13 2403 */
markrad 0:cdf462088d13 2404 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
markrad 0:cdf462088d13 2405 defined(MBEDTLS_SSL_PROTO_TLS1_1)
markrad 0:cdf462088d13 2406 if( md_alg == MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 2407 {
markrad 0:cdf462088d13 2408 mbedtls_md5_context mbedtls_md5;
markrad 0:cdf462088d13 2409 mbedtls_sha1_context mbedtls_sha1;
markrad 0:cdf462088d13 2410
markrad 0:cdf462088d13 2411 mbedtls_md5_init( &mbedtls_md5 );
markrad 0:cdf462088d13 2412 mbedtls_sha1_init( &mbedtls_sha1 );
markrad 0:cdf462088d13 2413
markrad 0:cdf462088d13 2414 hashlen = 36;
markrad 0:cdf462088d13 2415
markrad 0:cdf462088d13 2416 /*
markrad 0:cdf462088d13 2417 * digitally-signed struct {
markrad 0:cdf462088d13 2418 * opaque md5_hash[16];
markrad 0:cdf462088d13 2419 * opaque sha_hash[20];
markrad 0:cdf462088d13 2420 * };
markrad 0:cdf462088d13 2421 *
markrad 0:cdf462088d13 2422 * md5_hash
markrad 0:cdf462088d13 2423 * MD5(ClientHello.random + ServerHello.random
markrad 0:cdf462088d13 2424 * + ServerParams);
markrad 0:cdf462088d13 2425 * sha_hash
markrad 0:cdf462088d13 2426 * SHA(ClientHello.random + ServerHello.random
markrad 0:cdf462088d13 2427 * + ServerParams);
markrad 0:cdf462088d13 2428 */
markrad 0:cdf462088d13 2429 mbedtls_md5_starts( &mbedtls_md5 );
markrad 0:cdf462088d13 2430 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
markrad 0:cdf462088d13 2431 mbedtls_md5_update( &mbedtls_md5, params, params_len );
markrad 0:cdf462088d13 2432 mbedtls_md5_finish( &mbedtls_md5, hash );
markrad 0:cdf462088d13 2433
markrad 0:cdf462088d13 2434 mbedtls_sha1_starts( &mbedtls_sha1 );
markrad 0:cdf462088d13 2435 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
markrad 0:cdf462088d13 2436 mbedtls_sha1_update( &mbedtls_sha1, params, params_len );
markrad 0:cdf462088d13 2437 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
markrad 0:cdf462088d13 2438
markrad 0:cdf462088d13 2439 mbedtls_md5_free( &mbedtls_md5 );
markrad 0:cdf462088d13 2440 mbedtls_sha1_free( &mbedtls_sha1 );
markrad 0:cdf462088d13 2441 }
markrad 0:cdf462088d13 2442 else
markrad 0:cdf462088d13 2443 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
markrad 0:cdf462088d13 2444 MBEDTLS_SSL_PROTO_TLS1_1 */
markrad 0:cdf462088d13 2445 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
markrad 0:cdf462088d13 2446 defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 2447 if( md_alg != MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 2448 {
markrad 0:cdf462088d13 2449 mbedtls_md_context_t ctx;
markrad 0:cdf462088d13 2450
markrad 0:cdf462088d13 2451 mbedtls_md_init( &ctx );
markrad 0:cdf462088d13 2452
markrad 0:cdf462088d13 2453 /* Info from md_alg will be used instead */
markrad 0:cdf462088d13 2454 hashlen = 0;
markrad 0:cdf462088d13 2455
markrad 0:cdf462088d13 2456 /*
markrad 0:cdf462088d13 2457 * digitally-signed struct {
markrad 0:cdf462088d13 2458 * opaque client_random[32];
markrad 0:cdf462088d13 2459 * opaque server_random[32];
markrad 0:cdf462088d13 2460 * ServerDHParams params;
markrad 0:cdf462088d13 2461 * };
markrad 0:cdf462088d13 2462 */
markrad 0:cdf462088d13 2463 if( ( ret = mbedtls_md_setup( &ctx,
markrad 0:cdf462088d13 2464 mbedtls_md_info_from_type( md_alg ), 0 ) ) != 0 )
markrad 0:cdf462088d13 2465 {
markrad 0:cdf462088d13 2466 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
markrad 0:cdf462088d13 2467 return( ret );
markrad 0:cdf462088d13 2468 }
markrad 0:cdf462088d13 2469
markrad 0:cdf462088d13 2470 mbedtls_md_starts( &ctx );
markrad 0:cdf462088d13 2471 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
markrad 0:cdf462088d13 2472 mbedtls_md_update( &ctx, params, params_len );
markrad 0:cdf462088d13 2473 mbedtls_md_finish( &ctx, hash );
markrad 0:cdf462088d13 2474 mbedtls_md_free( &ctx );
markrad 0:cdf462088d13 2475 }
markrad 0:cdf462088d13 2476 else
markrad 0:cdf462088d13 2477 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
markrad 0:cdf462088d13 2478 MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 2479 {
markrad 0:cdf462088d13 2480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2481 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2482 }
markrad 0:cdf462088d13 2483
markrad 0:cdf462088d13 2484 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
markrad 0:cdf462088d13 2485 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
markrad 0:cdf462088d13 2486
markrad 0:cdf462088d13 2487 if( ssl->session_negotiate->peer_cert == NULL )
markrad 0:cdf462088d13 2488 {
markrad 0:cdf462088d13 2489 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
markrad 0:cdf462088d13 2490 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2491 }
markrad 0:cdf462088d13 2492
markrad 0:cdf462088d13 2493 /*
markrad 0:cdf462088d13 2494 * Verify signature
markrad 0:cdf462088d13 2495 */
markrad 0:cdf462088d13 2496 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
markrad 0:cdf462088d13 2497 {
markrad 0:cdf462088d13 2498 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
markrad 0:cdf462088d13 2499 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
markrad 0:cdf462088d13 2500 }
markrad 0:cdf462088d13 2501
markrad 0:cdf462088d13 2502 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
markrad 0:cdf462088d13 2503 md_alg, hash, hashlen, p, sig_len ) ) != 0 )
markrad 0:cdf462088d13 2504 {
markrad 0:cdf462088d13 2505 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
markrad 0:cdf462088d13 2506 return( ret );
markrad 0:cdf462088d13 2507 }
markrad 0:cdf462088d13 2508 }
markrad 0:cdf462088d13 2509 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2510 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2511 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 2512
markrad 0:cdf462088d13 2513 exit:
markrad 0:cdf462088d13 2514 ssl->state++;
markrad 0:cdf462088d13 2515
markrad 0:cdf462088d13 2516 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
markrad 0:cdf462088d13 2517
markrad 0:cdf462088d13 2518 return( 0 );
markrad 0:cdf462088d13 2519 }
markrad 0:cdf462088d13 2520
markrad 0:cdf462088d13 2521 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2522 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2523 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
markrad 0:cdf462088d13 2524 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2525 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
markrad 0:cdf462088d13 2526 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 2527 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2528 {
markrad 0:cdf462088d13 2529 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2530
markrad 0:cdf462088d13 2531 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
markrad 0:cdf462088d13 2532
markrad 0:cdf462088d13 2533 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2534 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 2535 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2536 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 2537 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2538 {
markrad 0:cdf462088d13 2539 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
markrad 0:cdf462088d13 2540 ssl->state++;
markrad 0:cdf462088d13 2541 return( 0 );
markrad 0:cdf462088d13 2542 }
markrad 0:cdf462088d13 2543
markrad 0:cdf462088d13 2544 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2545 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2546 }
markrad 0:cdf462088d13 2547 #else
markrad 0:cdf462088d13 2548 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2549 {
markrad 0:cdf462088d13 2550 int ret;
markrad 0:cdf462088d13 2551 unsigned char *buf;
markrad 0:cdf462088d13 2552 size_t n = 0;
markrad 0:cdf462088d13 2553 size_t cert_type_len = 0, dn_len = 0;
markrad 0:cdf462088d13 2554 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2555
markrad 0:cdf462088d13 2556 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
markrad 0:cdf462088d13 2557
markrad 0:cdf462088d13 2558 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2559 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 2560 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2561 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 2562 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2563 {
markrad 0:cdf462088d13 2564 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
markrad 0:cdf462088d13 2565 ssl->state++;
markrad 0:cdf462088d13 2566 return( 0 );
markrad 0:cdf462088d13 2567 }
markrad 0:cdf462088d13 2568
markrad 0:cdf462088d13 2569 if( ssl->record_read == 0 )
markrad 0:cdf462088d13 2570 {
markrad 0:cdf462088d13 2571 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 2572 {
markrad 0:cdf462088d13 2573 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
markrad 0:cdf462088d13 2574 return( ret );
markrad 0:cdf462088d13 2575 }
markrad 0:cdf462088d13 2576
markrad 0:cdf462088d13 2577 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 2578 {
markrad 0:cdf462088d13 2579 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
markrad 0:cdf462088d13 2580 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2581 }
markrad 0:cdf462088d13 2582
markrad 0:cdf462088d13 2583 ssl->record_read = 1;
markrad 0:cdf462088d13 2584 }
markrad 0:cdf462088d13 2585
markrad 0:cdf462088d13 2586 ssl->client_auth = 0;
markrad 0:cdf462088d13 2587 ssl->state++;
markrad 0:cdf462088d13 2588
markrad 0:cdf462088d13 2589 if( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST )
markrad 0:cdf462088d13 2590 ssl->client_auth++;
markrad 0:cdf462088d13 2591
markrad 0:cdf462088d13 2592 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
markrad 0:cdf462088d13 2593 ssl->client_auth ? "a" : "no" ) );
markrad 0:cdf462088d13 2594
markrad 0:cdf462088d13 2595 if( ssl->client_auth == 0 )
markrad 0:cdf462088d13 2596 goto exit;
markrad 0:cdf462088d13 2597
markrad 0:cdf462088d13 2598 ssl->record_read = 0;
markrad 0:cdf462088d13 2599
markrad 0:cdf462088d13 2600 /*
markrad 0:cdf462088d13 2601 * struct {
markrad 0:cdf462088d13 2602 * ClientCertificateType certificate_types<1..2^8-1>;
markrad 0:cdf462088d13 2603 * SignatureAndHashAlgorithm
markrad 0:cdf462088d13 2604 * supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
markrad 0:cdf462088d13 2605 * DistinguishedName certificate_authorities<0..2^16-1>;
markrad 0:cdf462088d13 2606 * } CertificateRequest;
markrad 0:cdf462088d13 2607 *
markrad 0:cdf462088d13 2608 * Since we only support a single certificate on clients, let's just
markrad 0:cdf462088d13 2609 * ignore all the information that's supposed to help us pick a
markrad 0:cdf462088d13 2610 * certificate.
markrad 0:cdf462088d13 2611 *
markrad 0:cdf462088d13 2612 * We could check that our certificate matches the request, and bail out
markrad 0:cdf462088d13 2613 * if it doesn't, but it's simpler to just send the certificate anyway,
markrad 0:cdf462088d13 2614 * and give the server the opportunity to decide if it should terminate
markrad 0:cdf462088d13 2615 * the connection when it doesn't like our certificate.
markrad 0:cdf462088d13 2616 *
markrad 0:cdf462088d13 2617 * Same goes for the hash in TLS 1.2's signature_algorithms: at this
markrad 0:cdf462088d13 2618 * point we only have one hash available (see comments in
markrad 0:cdf462088d13 2619 * write_certificate_verify), so let's just use what we have.
markrad 0:cdf462088d13 2620 *
markrad 0:cdf462088d13 2621 * However, we still minimally parse the message to check it is at least
markrad 0:cdf462088d13 2622 * superficially sane.
markrad 0:cdf462088d13 2623 */
markrad 0:cdf462088d13 2624 buf = ssl->in_msg;
markrad 0:cdf462088d13 2625
markrad 0:cdf462088d13 2626 /* certificate_types */
markrad 0:cdf462088d13 2627 cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
markrad 0:cdf462088d13 2628 n = cert_type_len;
markrad 0:cdf462088d13 2629
markrad 0:cdf462088d13 2630 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
markrad 0:cdf462088d13 2631 {
markrad 0:cdf462088d13 2632 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
markrad 0:cdf462088d13 2633 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
markrad 0:cdf462088d13 2634 }
markrad 0:cdf462088d13 2635
markrad 0:cdf462088d13 2636 /* supported_signature_algorithms */
markrad 0:cdf462088d13 2637 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 2638 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 2639 {
markrad 0:cdf462088d13 2640 size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
markrad 0:cdf462088d13 2641 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
markrad 0:cdf462088d13 2642 #if defined(MBEDTLS_DEBUG_C)
markrad 0:cdf462088d13 2643 unsigned char* sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
markrad 0:cdf462088d13 2644 size_t i;
markrad 0:cdf462088d13 2645
markrad 0:cdf462088d13 2646 for( i = 0; i < sig_alg_len; i += 2 )
markrad 0:cdf462088d13 2647 {
markrad 0:cdf462088d13 2648 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d,%d", sig_alg[i], sig_alg[i + 1] ) );
markrad 0:cdf462088d13 2649 }
markrad 0:cdf462088d13 2650 #endif
markrad 0:cdf462088d13 2651
markrad 0:cdf462088d13 2652 n += 2 + sig_alg_len;
markrad 0:cdf462088d13 2653
markrad 0:cdf462088d13 2654 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
markrad 0:cdf462088d13 2655 {
markrad 0:cdf462088d13 2656 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
markrad 0:cdf462088d13 2657 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
markrad 0:cdf462088d13 2658 }
markrad 0:cdf462088d13 2659 }
markrad 0:cdf462088d13 2660 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 2661
markrad 0:cdf462088d13 2662 /* certificate_authorities */
markrad 0:cdf462088d13 2663 dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
markrad 0:cdf462088d13 2664 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
markrad 0:cdf462088d13 2665
markrad 0:cdf462088d13 2666 n += dn_len;
markrad 0:cdf462088d13 2667 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
markrad 0:cdf462088d13 2668 {
markrad 0:cdf462088d13 2669 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
markrad 0:cdf462088d13 2670 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
markrad 0:cdf462088d13 2671 }
markrad 0:cdf462088d13 2672
markrad 0:cdf462088d13 2673 exit:
markrad 0:cdf462088d13 2674 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
markrad 0:cdf462088d13 2675
markrad 0:cdf462088d13 2676 return( 0 );
markrad 0:cdf462088d13 2677 }
markrad 0:cdf462088d13 2678 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
markrad 0:cdf462088d13 2679 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
markrad 0:cdf462088d13 2680 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
markrad 0:cdf462088d13 2681 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
markrad 0:cdf462088d13 2682 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
markrad 0:cdf462088d13 2683 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 2684
markrad 0:cdf462088d13 2685 static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2686 {
markrad 0:cdf462088d13 2687 int ret;
markrad 0:cdf462088d13 2688
markrad 0:cdf462088d13 2689 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
markrad 0:cdf462088d13 2690
markrad 0:cdf462088d13 2691 if( ssl->record_read == 0 )
markrad 0:cdf462088d13 2692 {
markrad 0:cdf462088d13 2693 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 2694 {
markrad 0:cdf462088d13 2695 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
markrad 0:cdf462088d13 2696 return( ret );
markrad 0:cdf462088d13 2697 }
markrad 0:cdf462088d13 2698
markrad 0:cdf462088d13 2699 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 2700 {
markrad 0:cdf462088d13 2701 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
markrad 0:cdf462088d13 2702 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 2703 }
markrad 0:cdf462088d13 2704 }
markrad 0:cdf462088d13 2705 ssl->record_read = 0;
markrad 0:cdf462088d13 2706
markrad 0:cdf462088d13 2707 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ||
markrad 0:cdf462088d13 2708 ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
markrad 0:cdf462088d13 2709 {
markrad 0:cdf462088d13 2710 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
markrad 0:cdf462088d13 2711 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
markrad 0:cdf462088d13 2712 }
markrad 0:cdf462088d13 2713
markrad 0:cdf462088d13 2714 ssl->state++;
markrad 0:cdf462088d13 2715
markrad 0:cdf462088d13 2716 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 2717 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 2718 mbedtls_ssl_recv_flight_completed( ssl );
markrad 0:cdf462088d13 2719 #endif
markrad 0:cdf462088d13 2720
markrad 0:cdf462088d13 2721 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
markrad 0:cdf462088d13 2722
markrad 0:cdf462088d13 2723 return( 0 );
markrad 0:cdf462088d13 2724 }
markrad 0:cdf462088d13 2725
markrad 0:cdf462088d13 2726 static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2727 {
markrad 0:cdf462088d13 2728 int ret;
markrad 0:cdf462088d13 2729 size_t i, n;
markrad 0:cdf462088d13 2730 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2731
markrad 0:cdf462088d13 2732 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
markrad 0:cdf462088d13 2733
markrad 0:cdf462088d13 2734 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
markrad 0:cdf462088d13 2735 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
markrad 0:cdf462088d13 2736 {
markrad 0:cdf462088d13 2737 /*
markrad 0:cdf462088d13 2738 * DHM key exchange -- send G^X mod P
markrad 0:cdf462088d13 2739 */
markrad 0:cdf462088d13 2740 n = ssl->handshake->dhm_ctx.len;
markrad 0:cdf462088d13 2741
markrad 0:cdf462088d13 2742 ssl->out_msg[4] = (unsigned char)( n >> 8 );
markrad 0:cdf462088d13 2743 ssl->out_msg[5] = (unsigned char)( n );
markrad 0:cdf462088d13 2744 i = 6;
markrad 0:cdf462088d13 2745
markrad 0:cdf462088d13 2746 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
markrad 0:cdf462088d13 2747 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
markrad 0:cdf462088d13 2748 &ssl->out_msg[i], n,
markrad 0:cdf462088d13 2749 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2750 if( ret != 0 )
markrad 0:cdf462088d13 2751 {
markrad 0:cdf462088d13 2752 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
markrad 0:cdf462088d13 2753 return( ret );
markrad 0:cdf462088d13 2754 }
markrad 0:cdf462088d13 2755
markrad 0:cdf462088d13 2756 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
markrad 0:cdf462088d13 2757 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
markrad 0:cdf462088d13 2758
markrad 0:cdf462088d13 2759 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
markrad 0:cdf462088d13 2760 ssl->handshake->premaster,
markrad 0:cdf462088d13 2761 MBEDTLS_PREMASTER_SIZE,
markrad 0:cdf462088d13 2762 &ssl->handshake->pmslen,
markrad 0:cdf462088d13 2763 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 2764 {
markrad 0:cdf462088d13 2765 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
markrad 0:cdf462088d13 2766 return( ret );
markrad 0:cdf462088d13 2767 }
markrad 0:cdf462088d13 2768
markrad 0:cdf462088d13 2769 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
markrad 0:cdf462088d13 2770 }
markrad 0:cdf462088d13 2771 else
markrad 0:cdf462088d13 2772 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
markrad 0:cdf462088d13 2773 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 2774 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
markrad 0:cdf462088d13 2775 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
markrad 0:cdf462088d13 2776 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
markrad 0:cdf462088d13 2777 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
markrad 0:cdf462088d13 2778 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
markrad 0:cdf462088d13 2779 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
markrad 0:cdf462088d13 2780 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
markrad 0:cdf462088d13 2781 {
markrad 0:cdf462088d13 2782 /*
markrad 0:cdf462088d13 2783 * ECDH key exchange -- send client public value
markrad 0:cdf462088d13 2784 */
markrad 0:cdf462088d13 2785 i = 4;
markrad 0:cdf462088d13 2786
markrad 0:cdf462088d13 2787 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 2788 &n,
markrad 0:cdf462088d13 2789 &ssl->out_msg[i], 1000,
markrad 0:cdf462088d13 2790 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2791 if( ret != 0 )
markrad 0:cdf462088d13 2792 {
markrad 0:cdf462088d13 2793 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
markrad 0:cdf462088d13 2794 return( ret );
markrad 0:cdf462088d13 2795 }
markrad 0:cdf462088d13 2796
markrad 0:cdf462088d13 2797 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
markrad 0:cdf462088d13 2798
markrad 0:cdf462088d13 2799 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 2800 &ssl->handshake->pmslen,
markrad 0:cdf462088d13 2801 ssl->handshake->premaster,
markrad 0:cdf462088d13 2802 MBEDTLS_MPI_MAX_SIZE,
markrad 0:cdf462088d13 2803 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 2804 {
markrad 0:cdf462088d13 2805 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
markrad 0:cdf462088d13 2806 return( ret );
markrad 0:cdf462088d13 2807 }
markrad 0:cdf462088d13 2808
markrad 0:cdf462088d13 2809 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
markrad 0:cdf462088d13 2810 }
markrad 0:cdf462088d13 2811 else
markrad 0:cdf462088d13 2812 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 2813 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
markrad 0:cdf462088d13 2814 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
markrad 0:cdf462088d13 2815 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
markrad 0:cdf462088d13 2816 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
markrad 0:cdf462088d13 2817 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2818 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 2819 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2820 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
markrad 0:cdf462088d13 2821 {
markrad 0:cdf462088d13 2822 /*
markrad 0:cdf462088d13 2823 * opaque psk_identity<0..2^16-1>;
markrad 0:cdf462088d13 2824 */
markrad 0:cdf462088d13 2825 if( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL )
markrad 0:cdf462088d13 2826 {
markrad 0:cdf462088d13 2827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) );
markrad 0:cdf462088d13 2828 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
markrad 0:cdf462088d13 2829 }
markrad 0:cdf462088d13 2830
markrad 0:cdf462088d13 2831 i = 4;
markrad 0:cdf462088d13 2832 n = ssl->conf->psk_identity_len;
markrad 0:cdf462088d13 2833
markrad 0:cdf462088d13 2834 if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
markrad 0:cdf462088d13 2835 {
markrad 0:cdf462088d13 2836 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or "
markrad 0:cdf462088d13 2837 "SSL buffer too short" ) );
markrad 0:cdf462088d13 2838 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
markrad 0:cdf462088d13 2839 }
markrad 0:cdf462088d13 2840
markrad 0:cdf462088d13 2841 ssl->out_msg[i++] = (unsigned char)( n >> 8 );
markrad 0:cdf462088d13 2842 ssl->out_msg[i++] = (unsigned char)( n );
markrad 0:cdf462088d13 2843
markrad 0:cdf462088d13 2844 memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len );
markrad 0:cdf462088d13 2845 i += ssl->conf->psk_identity_len;
markrad 0:cdf462088d13 2846
markrad 0:cdf462088d13 2847 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
markrad 0:cdf462088d13 2848 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
markrad 0:cdf462088d13 2849 {
markrad 0:cdf462088d13 2850 n = 0;
markrad 0:cdf462088d13 2851 }
markrad 0:cdf462088d13 2852 else
markrad 0:cdf462088d13 2853 #endif
markrad 0:cdf462088d13 2854 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
markrad 0:cdf462088d13 2855 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
markrad 0:cdf462088d13 2856 {
markrad 0:cdf462088d13 2857 if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 )
markrad 0:cdf462088d13 2858 return( ret );
markrad 0:cdf462088d13 2859 }
markrad 0:cdf462088d13 2860 else
markrad 0:cdf462088d13 2861 #endif
markrad 0:cdf462088d13 2862 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
markrad 0:cdf462088d13 2863 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
markrad 0:cdf462088d13 2864 {
markrad 0:cdf462088d13 2865 /*
markrad 0:cdf462088d13 2866 * ClientDiffieHellmanPublic public (DHM send G^X mod P)
markrad 0:cdf462088d13 2867 */
markrad 0:cdf462088d13 2868 n = ssl->handshake->dhm_ctx.len;
markrad 0:cdf462088d13 2869
markrad 0:cdf462088d13 2870 if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
markrad 0:cdf462088d13 2871 {
markrad 0:cdf462088d13 2872 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long"
markrad 0:cdf462088d13 2873 " or SSL buffer too short" ) );
markrad 0:cdf462088d13 2874 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
markrad 0:cdf462088d13 2875 }
markrad 0:cdf462088d13 2876
markrad 0:cdf462088d13 2877 ssl->out_msg[i++] = (unsigned char)( n >> 8 );
markrad 0:cdf462088d13 2878 ssl->out_msg[i++] = (unsigned char)( n );
markrad 0:cdf462088d13 2879
markrad 0:cdf462088d13 2880 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
markrad 0:cdf462088d13 2881 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
markrad 0:cdf462088d13 2882 &ssl->out_msg[i], n,
markrad 0:cdf462088d13 2883 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2884 if( ret != 0 )
markrad 0:cdf462088d13 2885 {
markrad 0:cdf462088d13 2886 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
markrad 0:cdf462088d13 2887 return( ret );
markrad 0:cdf462088d13 2888 }
markrad 0:cdf462088d13 2889 }
markrad 0:cdf462088d13 2890 else
markrad 0:cdf462088d13 2891 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
markrad 0:cdf462088d13 2892 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
markrad 0:cdf462088d13 2893 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
markrad 0:cdf462088d13 2894 {
markrad 0:cdf462088d13 2895 /*
markrad 0:cdf462088d13 2896 * ClientECDiffieHellmanPublic public;
markrad 0:cdf462088d13 2897 */
markrad 0:cdf462088d13 2898 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n,
markrad 0:cdf462088d13 2899 &ssl->out_msg[i], MBEDTLS_SSL_MAX_CONTENT_LEN - i,
markrad 0:cdf462088d13 2900 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2901 if( ret != 0 )
markrad 0:cdf462088d13 2902 {
markrad 0:cdf462088d13 2903 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
markrad 0:cdf462088d13 2904 return( ret );
markrad 0:cdf462088d13 2905 }
markrad 0:cdf462088d13 2906
markrad 0:cdf462088d13 2907 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
markrad 0:cdf462088d13 2908 }
markrad 0:cdf462088d13 2909 else
markrad 0:cdf462088d13 2910 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
markrad 0:cdf462088d13 2911 {
markrad 0:cdf462088d13 2912 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2913 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2914 }
markrad 0:cdf462088d13 2915
markrad 0:cdf462088d13 2916 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
markrad 0:cdf462088d13 2917 ciphersuite_info->key_exchange ) ) != 0 )
markrad 0:cdf462088d13 2918 {
markrad 0:cdf462088d13 2919 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
markrad 0:cdf462088d13 2920 return( ret );
markrad 0:cdf462088d13 2921 }
markrad 0:cdf462088d13 2922 }
markrad 0:cdf462088d13 2923 else
markrad 0:cdf462088d13 2924 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
markrad 0:cdf462088d13 2925 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
markrad 0:cdf462088d13 2926 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
markrad 0:cdf462088d13 2927 {
markrad 0:cdf462088d13 2928 i = 4;
markrad 0:cdf462088d13 2929 if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 )
markrad 0:cdf462088d13 2930 return( ret );
markrad 0:cdf462088d13 2931 }
markrad 0:cdf462088d13 2932 else
markrad 0:cdf462088d13 2933 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
markrad 0:cdf462088d13 2934 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2935 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2936 {
markrad 0:cdf462088d13 2937 i = 4;
markrad 0:cdf462088d13 2938
markrad 0:cdf462088d13 2939 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 2940 ssl->out_msg + i, MBEDTLS_SSL_MAX_CONTENT_LEN - i, &n,
markrad 0:cdf462088d13 2941 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2942 if( ret != 0 )
markrad 0:cdf462088d13 2943 {
markrad 0:cdf462088d13 2944 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
markrad 0:cdf462088d13 2945 return( ret );
markrad 0:cdf462088d13 2946 }
markrad 0:cdf462088d13 2947
markrad 0:cdf462088d13 2948 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 2949 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
markrad 0:cdf462088d13 2950 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2951 if( ret != 0 )
markrad 0:cdf462088d13 2952 {
markrad 0:cdf462088d13 2953 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
markrad 0:cdf462088d13 2954 return( ret );
markrad 0:cdf462088d13 2955 }
markrad 0:cdf462088d13 2956 }
markrad 0:cdf462088d13 2957 else
markrad 0:cdf462088d13 2958 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
markrad 0:cdf462088d13 2959 {
markrad 0:cdf462088d13 2960 ((void) ciphersuite_info);
markrad 0:cdf462088d13 2961 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2962 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2963 }
markrad 0:cdf462088d13 2964
markrad 0:cdf462088d13 2965 ssl->out_msglen = i + n;
markrad 0:cdf462088d13 2966 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 2967 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
markrad 0:cdf462088d13 2968
markrad 0:cdf462088d13 2969 ssl->state++;
markrad 0:cdf462088d13 2970
markrad 0:cdf462088d13 2971 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 2972 {
markrad 0:cdf462088d13 2973 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 2974 return( ret );
markrad 0:cdf462088d13 2975 }
markrad 0:cdf462088d13 2976
markrad 0:cdf462088d13 2977 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
markrad 0:cdf462088d13 2978
markrad 0:cdf462088d13 2979 return( 0 );
markrad 0:cdf462088d13 2980 }
markrad 0:cdf462088d13 2981
markrad 0:cdf462088d13 2982 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2983 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2984 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
markrad 0:cdf462088d13 2985 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2986 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
markrad 0:cdf462088d13 2987 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 2988 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2989 {
markrad 0:cdf462088d13 2990 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2991 int ret;
markrad 0:cdf462088d13 2992
markrad 0:cdf462088d13 2993 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
markrad 0:cdf462088d13 2994
markrad 0:cdf462088d13 2995 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
markrad 0:cdf462088d13 2996 {
markrad 0:cdf462088d13 2997 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
markrad 0:cdf462088d13 2998 return( ret );
markrad 0:cdf462088d13 2999 }
markrad 0:cdf462088d13 3000
markrad 0:cdf462088d13 3001 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 3002 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 3003 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 3004 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 3005 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 3006 {
markrad 0:cdf462088d13 3007 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
markrad 0:cdf462088d13 3008 ssl->state++;
markrad 0:cdf462088d13 3009 return( 0 );
markrad 0:cdf462088d13 3010 }
markrad 0:cdf462088d13 3011
markrad 0:cdf462088d13 3012 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3013 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3014 }
markrad 0:cdf462088d13 3015 #else
markrad 0:cdf462088d13 3016 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3017 {
markrad 0:cdf462088d13 3018 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
markrad 0:cdf462088d13 3019 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 3020 size_t n = 0, offset = 0;
markrad 0:cdf462088d13 3021 unsigned char hash[48];
markrad 0:cdf462088d13 3022 unsigned char *hash_start = hash;
markrad 0:cdf462088d13 3023 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
markrad 0:cdf462088d13 3024 unsigned int hashlen;
markrad 0:cdf462088d13 3025
markrad 0:cdf462088d13 3026 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
markrad 0:cdf462088d13 3027
markrad 0:cdf462088d13 3028 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
markrad 0:cdf462088d13 3029 {
markrad 0:cdf462088d13 3030 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
markrad 0:cdf462088d13 3031 return( ret );
markrad 0:cdf462088d13 3032 }
markrad 0:cdf462088d13 3033
markrad 0:cdf462088d13 3034 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 3035 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 3036 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 3037 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 3038 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 3039 {
markrad 0:cdf462088d13 3040 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
markrad 0:cdf462088d13 3041 ssl->state++;
markrad 0:cdf462088d13 3042 return( 0 );
markrad 0:cdf462088d13 3043 }
markrad 0:cdf462088d13 3044
markrad 0:cdf462088d13 3045 if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
markrad 0:cdf462088d13 3046 {
markrad 0:cdf462088d13 3047 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
markrad 0:cdf462088d13 3048 ssl->state++;
markrad 0:cdf462088d13 3049 return( 0 );
markrad 0:cdf462088d13 3050 }
markrad 0:cdf462088d13 3051
markrad 0:cdf462088d13 3052 if( mbedtls_ssl_own_key( ssl ) == NULL )
markrad 0:cdf462088d13 3053 {
markrad 0:cdf462088d13 3054 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
markrad 0:cdf462088d13 3055 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
markrad 0:cdf462088d13 3056 }
markrad 0:cdf462088d13 3057
markrad 0:cdf462088d13 3058 /*
markrad 0:cdf462088d13 3059 * Make an RSA signature of the handshake digests
markrad 0:cdf462088d13 3060 */
markrad 0:cdf462088d13 3061 ssl->handshake->calc_verify( ssl, hash );
markrad 0:cdf462088d13 3062
markrad 0:cdf462088d13 3063 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
markrad 0:cdf462088d13 3064 defined(MBEDTLS_SSL_PROTO_TLS1_1)
markrad 0:cdf462088d13 3065 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 3066 {
markrad 0:cdf462088d13 3067 /*
markrad 0:cdf462088d13 3068 * digitally-signed struct {
markrad 0:cdf462088d13 3069 * opaque md5_hash[16];
markrad 0:cdf462088d13 3070 * opaque sha_hash[20];
markrad 0:cdf462088d13 3071 * };
markrad 0:cdf462088d13 3072 *
markrad 0:cdf462088d13 3073 * md5_hash
markrad 0:cdf462088d13 3074 * MD5(handshake_messages);
markrad 0:cdf462088d13 3075 *
markrad 0:cdf462088d13 3076 * sha_hash
markrad 0:cdf462088d13 3077 * SHA(handshake_messages);
markrad 0:cdf462088d13 3078 */
markrad 0:cdf462088d13 3079 hashlen = 36;
markrad 0:cdf462088d13 3080 md_alg = MBEDTLS_MD_NONE;
markrad 0:cdf462088d13 3081
markrad 0:cdf462088d13 3082 /*
markrad 0:cdf462088d13 3083 * For ECDSA, default hash is SHA-1 only
markrad 0:cdf462088d13 3084 */
markrad 0:cdf462088d13 3085 if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
markrad 0:cdf462088d13 3086 {
markrad 0:cdf462088d13 3087 hash_start += 16;
markrad 0:cdf462088d13 3088 hashlen -= 16;
markrad 0:cdf462088d13 3089 md_alg = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 3090 }
markrad 0:cdf462088d13 3091 }
markrad 0:cdf462088d13 3092 else
markrad 0:cdf462088d13 3093 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
markrad 0:cdf462088d13 3094 MBEDTLS_SSL_PROTO_TLS1_1 */
markrad 0:cdf462088d13 3095 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 3096 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 3097 {
markrad 0:cdf462088d13 3098 /*
markrad 0:cdf462088d13 3099 * digitally-signed struct {
markrad 0:cdf462088d13 3100 * opaque handshake_messages[handshake_messages_length];
markrad 0:cdf462088d13 3101 * };
markrad 0:cdf462088d13 3102 *
markrad 0:cdf462088d13 3103 * Taking shortcut here. We assume that the server always allows the
markrad 0:cdf462088d13 3104 * PRF Hash function and has sent it in the allowed signature
markrad 0:cdf462088d13 3105 * algorithms list received in the Certificate Request message.
markrad 0:cdf462088d13 3106 *
markrad 0:cdf462088d13 3107 * Until we encounter a server that does not, we will take this
markrad 0:cdf462088d13 3108 * shortcut.
markrad 0:cdf462088d13 3109 *
markrad 0:cdf462088d13 3110 * Reason: Otherwise we should have running hashes for SHA512 and SHA224
markrad 0:cdf462088d13 3111 * in order to satisfy 'weird' needs from the server side.
markrad 0:cdf462088d13 3112 */
markrad 0:cdf462088d13 3113 if( ssl->transform_negotiate->ciphersuite_info->mac ==
markrad 0:cdf462088d13 3114 MBEDTLS_MD_SHA384 )
markrad 0:cdf462088d13 3115 {
markrad 0:cdf462088d13 3116 md_alg = MBEDTLS_MD_SHA384;
markrad 0:cdf462088d13 3117 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
markrad 0:cdf462088d13 3118 }
markrad 0:cdf462088d13 3119 else
markrad 0:cdf462088d13 3120 {
markrad 0:cdf462088d13 3121 md_alg = MBEDTLS_MD_SHA256;
markrad 0:cdf462088d13 3122 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
markrad 0:cdf462088d13 3123 }
markrad 0:cdf462088d13 3124 ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
markrad 0:cdf462088d13 3125
markrad 0:cdf462088d13 3126 /* Info from md_alg will be used instead */
markrad 0:cdf462088d13 3127 hashlen = 0;
markrad 0:cdf462088d13 3128 offset = 2;
markrad 0:cdf462088d13 3129 }
markrad 0:cdf462088d13 3130 else
markrad 0:cdf462088d13 3131 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 3132 {
markrad 0:cdf462088d13 3133 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3134 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3135 }
markrad 0:cdf462088d13 3136
markrad 0:cdf462088d13 3137 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash_start, hashlen,
markrad 0:cdf462088d13 3138 ssl->out_msg + 6 + offset, &n,
markrad 0:cdf462088d13 3139 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 3140 {
markrad 0:cdf462088d13 3141 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
markrad 0:cdf462088d13 3142 return( ret );
markrad 0:cdf462088d13 3143 }
markrad 0:cdf462088d13 3144
markrad 0:cdf462088d13 3145 ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
markrad 0:cdf462088d13 3146 ssl->out_msg[5 + offset] = (unsigned char)( n );
markrad 0:cdf462088d13 3147
markrad 0:cdf462088d13 3148 ssl->out_msglen = 6 + n + offset;
markrad 0:cdf462088d13 3149 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 3150 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
markrad 0:cdf462088d13 3151
markrad 0:cdf462088d13 3152 ssl->state++;
markrad 0:cdf462088d13 3153
markrad 0:cdf462088d13 3154 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 3155 {
markrad 0:cdf462088d13 3156 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 3157 return( ret );
markrad 0:cdf462088d13 3158 }
markrad 0:cdf462088d13 3159
markrad 0:cdf462088d13 3160 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
markrad 0:cdf462088d13 3161
markrad 0:cdf462088d13 3162 return( ret );
markrad 0:cdf462088d13 3163 }
markrad 0:cdf462088d13 3164 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
markrad 0:cdf462088d13 3165 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
markrad 0:cdf462088d13 3166 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
markrad 0:cdf462088d13 3167 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
markrad 0:cdf462088d13 3168 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
markrad 0:cdf462088d13 3169 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 3170
markrad 0:cdf462088d13 3171 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 3172 static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3173 {
markrad 0:cdf462088d13 3174 int ret;
markrad 0:cdf462088d13 3175 uint32_t lifetime;
markrad 0:cdf462088d13 3176 size_t ticket_len;
markrad 0:cdf462088d13 3177 unsigned char *ticket;
markrad 0:cdf462088d13 3178 const unsigned char *msg;
markrad 0:cdf462088d13 3179
markrad 0:cdf462088d13 3180 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
markrad 0:cdf462088d13 3181
markrad 0:cdf462088d13 3182 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 3183 {
markrad 0:cdf462088d13 3184 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
markrad 0:cdf462088d13 3185 return( ret );
markrad 0:cdf462088d13 3186 }
markrad 0:cdf462088d13 3187
markrad 0:cdf462088d13 3188 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 3189 {
markrad 0:cdf462088d13 3190 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
markrad 0:cdf462088d13 3191 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
markrad 0:cdf462088d13 3192 }
markrad 0:cdf462088d13 3193
markrad 0:cdf462088d13 3194 /*
markrad 0:cdf462088d13 3195 * struct {
markrad 0:cdf462088d13 3196 * uint32 ticket_lifetime_hint;
markrad 0:cdf462088d13 3197 * opaque ticket<0..2^16-1>;
markrad 0:cdf462088d13 3198 * } NewSessionTicket;
markrad 0:cdf462088d13 3199 *
markrad 0:cdf462088d13 3200 * 0 . 3 ticket_lifetime_hint
markrad 0:cdf462088d13 3201 * 4 . 5 ticket_len (n)
markrad 0:cdf462088d13 3202 * 6 . 5+n ticket content
markrad 0:cdf462088d13 3203 */
markrad 0:cdf462088d13 3204 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ||
markrad 0:cdf462088d13 3205 ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
markrad 0:cdf462088d13 3206 {
markrad 0:cdf462088d13 3207 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
markrad 0:cdf462088d13 3208 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
markrad 0:cdf462088d13 3209 }
markrad 0:cdf462088d13 3210
markrad 0:cdf462088d13 3211 msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 3212
markrad 0:cdf462088d13 3213 lifetime = ( msg[0] << 24 ) | ( msg[1] << 16 ) |
markrad 0:cdf462088d13 3214 ( msg[2] << 8 ) | ( msg[3] );
markrad 0:cdf462088d13 3215
markrad 0:cdf462088d13 3216 ticket_len = ( msg[4] << 8 ) | ( msg[5] );
markrad 0:cdf462088d13 3217
markrad 0:cdf462088d13 3218 if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
markrad 0:cdf462088d13 3219 {
markrad 0:cdf462088d13 3220 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
markrad 0:cdf462088d13 3221 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
markrad 0:cdf462088d13 3222 }
markrad 0:cdf462088d13 3223
markrad 0:cdf462088d13 3224 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
markrad 0:cdf462088d13 3225
markrad 0:cdf462088d13 3226 /* We're not waiting for a NewSessionTicket message any more */
markrad 0:cdf462088d13 3227 ssl->handshake->new_session_ticket = 0;
markrad 0:cdf462088d13 3228 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
markrad 0:cdf462088d13 3229
markrad 0:cdf462088d13 3230 /*
markrad 0:cdf462088d13 3231 * Zero-length ticket means the server changed his mind and doesn't want
markrad 0:cdf462088d13 3232 * to send a ticket after all, so just forget it
markrad 0:cdf462088d13 3233 */
markrad 0:cdf462088d13 3234 if( ticket_len == 0 )
markrad 0:cdf462088d13 3235 return( 0 );
markrad 0:cdf462088d13 3236
markrad 0:cdf462088d13 3237 mbedtls_zeroize( ssl->session_negotiate->ticket,
markrad 0:cdf462088d13 3238 ssl->session_negotiate->ticket_len );
markrad 0:cdf462088d13 3239 mbedtls_free( ssl->session_negotiate->ticket );
markrad 0:cdf462088d13 3240 ssl->session_negotiate->ticket = NULL;
markrad 0:cdf462088d13 3241 ssl->session_negotiate->ticket_len = 0;
markrad 0:cdf462088d13 3242
markrad 0:cdf462088d13 3243 if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
markrad 0:cdf462088d13 3244 {
markrad 0:cdf462088d13 3245 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
markrad 0:cdf462088d13 3246 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
markrad 0:cdf462088d13 3247 }
markrad 0:cdf462088d13 3248
markrad 0:cdf462088d13 3249 memcpy( ticket, msg + 6, ticket_len );
markrad 0:cdf462088d13 3250
markrad 0:cdf462088d13 3251 ssl->session_negotiate->ticket = ticket;
markrad 0:cdf462088d13 3252 ssl->session_negotiate->ticket_len = ticket_len;
markrad 0:cdf462088d13 3253 ssl->session_negotiate->ticket_lifetime = lifetime;
markrad 0:cdf462088d13 3254
markrad 0:cdf462088d13 3255 /*
markrad 0:cdf462088d13 3256 * RFC 5077 section 3.4:
markrad 0:cdf462088d13 3257 * "If the client receives a session ticket from the server, then it
markrad 0:cdf462088d13 3258 * discards any Session ID that was sent in the ServerHello."
markrad 0:cdf462088d13 3259 */
markrad 0:cdf462088d13 3260 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
markrad 0:cdf462088d13 3261 ssl->session_negotiate->id_len = 0;
markrad 0:cdf462088d13 3262
markrad 0:cdf462088d13 3263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
markrad 0:cdf462088d13 3264
markrad 0:cdf462088d13 3265 return( 0 );
markrad 0:cdf462088d13 3266 }
markrad 0:cdf462088d13 3267 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 3268
markrad 0:cdf462088d13 3269 /*
markrad 0:cdf462088d13 3270 * SSL handshake -- client side -- single step
markrad 0:cdf462088d13 3271 */
markrad 0:cdf462088d13 3272 int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3273 {
markrad 0:cdf462088d13 3274 int ret = 0;
markrad 0:cdf462088d13 3275
markrad 0:cdf462088d13 3276 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
markrad 0:cdf462088d13 3277 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 3278
markrad 0:cdf462088d13 3279 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
markrad 0:cdf462088d13 3280
markrad 0:cdf462088d13 3281 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
markrad 0:cdf462088d13 3282 return( ret );
markrad 0:cdf462088d13 3283
markrad 0:cdf462088d13 3284 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 3285 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
markrad 0:cdf462088d13 3286 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
markrad 0:cdf462088d13 3287 {
markrad 0:cdf462088d13 3288 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
markrad 0:cdf462088d13 3289 return( ret );
markrad 0:cdf462088d13 3290 }
markrad 0:cdf462088d13 3291 #endif
markrad 0:cdf462088d13 3292
markrad 0:cdf462088d13 3293 /* Change state now, so that it is right in mbedtls_ssl_read_record(), used
markrad 0:cdf462088d13 3294 * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
markrad 0:cdf462088d13 3295 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 3296 if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
markrad 0:cdf462088d13 3297 ssl->handshake->new_session_ticket != 0 )
markrad 0:cdf462088d13 3298 {
markrad 0:cdf462088d13 3299 ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
markrad 0:cdf462088d13 3300 }
markrad 0:cdf462088d13 3301 #endif
markrad 0:cdf462088d13 3302
markrad 0:cdf462088d13 3303 switch( ssl->state )
markrad 0:cdf462088d13 3304 {
markrad 0:cdf462088d13 3305 case MBEDTLS_SSL_HELLO_REQUEST:
markrad 0:cdf462088d13 3306 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
markrad 0:cdf462088d13 3307 break;
markrad 0:cdf462088d13 3308
markrad 0:cdf462088d13 3309 /*
markrad 0:cdf462088d13 3310 * ==> ClientHello
markrad 0:cdf462088d13 3311 */
markrad 0:cdf462088d13 3312 case MBEDTLS_SSL_CLIENT_HELLO:
markrad 0:cdf462088d13 3313 ret = ssl_write_client_hello( ssl );
markrad 0:cdf462088d13 3314 break;
markrad 0:cdf462088d13 3315
markrad 0:cdf462088d13 3316 /*
markrad 0:cdf462088d13 3317 * <== ServerHello
markrad 0:cdf462088d13 3318 * Certificate
markrad 0:cdf462088d13 3319 * ( ServerKeyExchange )
markrad 0:cdf462088d13 3320 * ( CertificateRequest )
markrad 0:cdf462088d13 3321 * ServerHelloDone
markrad 0:cdf462088d13 3322 */
markrad 0:cdf462088d13 3323 case MBEDTLS_SSL_SERVER_HELLO:
markrad 0:cdf462088d13 3324 ret = ssl_parse_server_hello( ssl );
markrad 0:cdf462088d13 3325 break;
markrad 0:cdf462088d13 3326
markrad 0:cdf462088d13 3327 case MBEDTLS_SSL_SERVER_CERTIFICATE:
markrad 0:cdf462088d13 3328 ret = mbedtls_ssl_parse_certificate( ssl );
markrad 0:cdf462088d13 3329 break;
markrad 0:cdf462088d13 3330
markrad 0:cdf462088d13 3331 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
markrad 0:cdf462088d13 3332 ret = ssl_parse_server_key_exchange( ssl );
markrad 0:cdf462088d13 3333 break;
markrad 0:cdf462088d13 3334
markrad 0:cdf462088d13 3335 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
markrad 0:cdf462088d13 3336 ret = ssl_parse_certificate_request( ssl );
markrad 0:cdf462088d13 3337 break;
markrad 0:cdf462088d13 3338
markrad 0:cdf462088d13 3339 case MBEDTLS_SSL_SERVER_HELLO_DONE:
markrad 0:cdf462088d13 3340 ret = ssl_parse_server_hello_done( ssl );
markrad 0:cdf462088d13 3341 break;
markrad 0:cdf462088d13 3342
markrad 0:cdf462088d13 3343 /*
markrad 0:cdf462088d13 3344 * ==> ( Certificate/Alert )
markrad 0:cdf462088d13 3345 * ClientKeyExchange
markrad 0:cdf462088d13 3346 * ( CertificateVerify )
markrad 0:cdf462088d13 3347 * ChangeCipherSpec
markrad 0:cdf462088d13 3348 * Finished
markrad 0:cdf462088d13 3349 */
markrad 0:cdf462088d13 3350 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
markrad 0:cdf462088d13 3351 ret = mbedtls_ssl_write_certificate( ssl );
markrad 0:cdf462088d13 3352 break;
markrad 0:cdf462088d13 3353
markrad 0:cdf462088d13 3354 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
markrad 0:cdf462088d13 3355 ret = ssl_write_client_key_exchange( ssl );
markrad 0:cdf462088d13 3356 break;
markrad 0:cdf462088d13 3357
markrad 0:cdf462088d13 3358 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
markrad 0:cdf462088d13 3359 ret = ssl_write_certificate_verify( ssl );
markrad 0:cdf462088d13 3360 break;
markrad 0:cdf462088d13 3361
markrad 0:cdf462088d13 3362 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
markrad 0:cdf462088d13 3363 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
markrad 0:cdf462088d13 3364 break;
markrad 0:cdf462088d13 3365
markrad 0:cdf462088d13 3366 case MBEDTLS_SSL_CLIENT_FINISHED:
markrad 0:cdf462088d13 3367 ret = mbedtls_ssl_write_finished( ssl );
markrad 0:cdf462088d13 3368 break;
markrad 0:cdf462088d13 3369
markrad 0:cdf462088d13 3370 /*
markrad 0:cdf462088d13 3371 * <== ( NewSessionTicket )
markrad 0:cdf462088d13 3372 * ChangeCipherSpec
markrad 0:cdf462088d13 3373 * Finished
markrad 0:cdf462088d13 3374 */
markrad 0:cdf462088d13 3375 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 3376 case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
markrad 0:cdf462088d13 3377 ret = ssl_parse_new_session_ticket( ssl );
markrad 0:cdf462088d13 3378 break;
markrad 0:cdf462088d13 3379 #endif
markrad 0:cdf462088d13 3380
markrad 0:cdf462088d13 3381 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
markrad 0:cdf462088d13 3382 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
markrad 0:cdf462088d13 3383 break;
markrad 0:cdf462088d13 3384
markrad 0:cdf462088d13 3385 case MBEDTLS_SSL_SERVER_FINISHED:
markrad 0:cdf462088d13 3386 ret = mbedtls_ssl_parse_finished( ssl );
markrad 0:cdf462088d13 3387 break;
markrad 0:cdf462088d13 3388
markrad 0:cdf462088d13 3389 case MBEDTLS_SSL_FLUSH_BUFFERS:
markrad 0:cdf462088d13 3390 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
markrad 0:cdf462088d13 3391 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
markrad 0:cdf462088d13 3392 break;
markrad 0:cdf462088d13 3393
markrad 0:cdf462088d13 3394 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
markrad 0:cdf462088d13 3395 mbedtls_ssl_handshake_wrapup( ssl );
markrad 0:cdf462088d13 3396 break;
markrad 0:cdf462088d13 3397
markrad 0:cdf462088d13 3398 default:
markrad 0:cdf462088d13 3399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
markrad 0:cdf462088d13 3400 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 3401 }
markrad 0:cdf462088d13 3402
markrad 0:cdf462088d13 3403 return( ret );
markrad 0:cdf462088d13 3404 }
markrad 0:cdf462088d13 3405 #endif /* MBEDTLS_SSL_CLI_C */