Arcola / mbedtls

mbed TLS upgraded to 2.6.0

Fork of mbedtls by Mark Radbourne

library/ssl_srv.c@2:bbdeda018a3c, 2017-09-29 (annotated)

Committer:
Jasper Wallace
Date:
Fri Sep 29 19:50:30 2017 +0100
Revision:
2:bbdeda018a3c
Parent:
0:cdf462088d13 
Update to mbedtls 2.6.0, many changes.



Changes to mbedtls sources made:



in include/mbedtls/config.h comment out:



#define MBEDTLS_FS_IO

#define MBEDTLS_NET_C

#define MBEDTLS_TIMING_C



uncomment:



#define MBEDTLS_NO_PLATFORM_ENTROPY



remove the following directorys:



programs

yotta

visualc

Who changed what in which revision?

UserRevisionLine numberNew contents of line
markrad 0:cdf462088d13 1 /*
markrad 0:cdf462088d13 2 * SSLv3/TLSv1 server-side functions
markrad 0:cdf462088d13 3 *
markrad 0:cdf462088d13 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
markrad 0:cdf462088d13 5 * SPDX-License-Identifier: Apache-2.0
markrad 0:cdf462088d13 6 *
markrad 0:cdf462088d13 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
markrad 0:cdf462088d13 8 * not use this file except in compliance with the License.
markrad 0:cdf462088d13 9 * You may obtain a copy of the License at
markrad 0:cdf462088d13 10 *
markrad 0:cdf462088d13 11 * http://www.apache.org/licenses/LICENSE-2.0
markrad 0:cdf462088d13 12 *
markrad 0:cdf462088d13 13 * Unless required by applicable law or agreed to in writing, software
markrad 0:cdf462088d13 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
markrad 0:cdf462088d13 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
markrad 0:cdf462088d13 16 * See the License for the specific language governing permissions and
markrad 0:cdf462088d13 17 * limitations under the License.
markrad 0:cdf462088d13 18 *
markrad 0:cdf462088d13 19 * This file is part of mbed TLS (https://tls.mbed.org)
markrad 0:cdf462088d13 20 */
markrad 0:cdf462088d13 21
markrad 0:cdf462088d13 22 #if !defined(MBEDTLS_CONFIG_FILE)
markrad 0:cdf462088d13 23 #include "mbedtls/config.h"
markrad 0:cdf462088d13 24 #else
markrad 0:cdf462088d13 25 #include MBEDTLS_CONFIG_FILE
markrad 0:cdf462088d13 26 #endif
markrad 0:cdf462088d13 27
markrad 0:cdf462088d13 28 #if defined(MBEDTLS_SSL_SRV_C)
markrad 0:cdf462088d13 29
markrad 0:cdf462088d13 30 #if defined(MBEDTLS_PLATFORM_C)
markrad 0:cdf462088d13 31 #include "mbedtls/platform.h"
markrad 0:cdf462088d13 32 #else
markrad 0:cdf462088d13 33 #include <stdlib.h>
markrad 0:cdf462088d13 34 #define mbedtls_calloc calloc
markrad 0:cdf462088d13 35 #define mbedtls_free free
markrad 0:cdf462088d13 36 #endif
markrad 0:cdf462088d13 37
markrad 0:cdf462088d13 38 #include "mbedtls/debug.h"
markrad 0:cdf462088d13 39 #include "mbedtls/ssl.h"
markrad 0:cdf462088d13 40 #include "mbedtls/ssl_internal.h"
markrad 0:cdf462088d13 41
markrad 0:cdf462088d13 42 #include <string.h>
markrad 0:cdf462088d13 43
markrad 0:cdf462088d13 44 #if defined(MBEDTLS_ECP_C)
markrad 0:cdf462088d13 45 #include "mbedtls/ecp.h"
markrad 0:cdf462088d13 46 #endif
markrad 0:cdf462088d13 47
markrad 0:cdf462088d13 48 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 49 #include "mbedtls/platform_time.h"
markrad 0:cdf462088d13 50 #endif
markrad 0:cdf462088d13 51
markrad 0:cdf462088d13 52 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 53 /* Implementation that should never be optimized out by the compiler */
markrad 0:cdf462088d13 54 static void mbedtls_zeroize( void *v, size_t n ) {
markrad 0:cdf462088d13 55 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
markrad 0:cdf462088d13 56 }
markrad 0:cdf462088d13 57 #endif
markrad 0:cdf462088d13 58
markrad 0:cdf462088d13 59 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
markrad 0:cdf462088d13 60 int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 61 const unsigned char *info,
markrad 0:cdf462088d13 62 size_t ilen )
markrad 0:cdf462088d13 63 {
markrad 0:cdf462088d13 64 if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
markrad 0:cdf462088d13 65 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 66
markrad 0:cdf462088d13 67 mbedtls_free( ssl->cli_id );
markrad 0:cdf462088d13 68
markrad 0:cdf462088d13 69 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
markrad 0:cdf462088d13 70 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
markrad 0:cdf462088d13 71
markrad 0:cdf462088d13 72 memcpy( ssl->cli_id, info, ilen );
markrad 0:cdf462088d13 73 ssl->cli_id_len = ilen;
markrad 0:cdf462088d13 74
markrad 0:cdf462088d13 75 return( 0 );
markrad 0:cdf462088d13 76 }
markrad 0:cdf462088d13 77
markrad 0:cdf462088d13 78 void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
markrad 0:cdf462088d13 79 mbedtls_ssl_cookie_write_t *f_cookie_write,
markrad 0:cdf462088d13 80 mbedtls_ssl_cookie_check_t *f_cookie_check,
markrad 0:cdf462088d13 81 void *p_cookie )
markrad 0:cdf462088d13 82 {
markrad 0:cdf462088d13 83 conf->f_cookie_write = f_cookie_write;
markrad 0:cdf462088d13 84 conf->f_cookie_check = f_cookie_check;
markrad 0:cdf462088d13 85 conf->p_cookie = p_cookie;
markrad 0:cdf462088d13 86 }
markrad 0:cdf462088d13 87 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
markrad 0:cdf462088d13 88
markrad 0:cdf462088d13 89 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
markrad 0:cdf462088d13 90 static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 91 const unsigned char *buf,
markrad 0:cdf462088d13 92 size_t len )
markrad 0:cdf462088d13 93 {
markrad 0:cdf462088d13 94 int ret;
markrad 0:cdf462088d13 95 size_t servername_list_size, hostname_len;
markrad 0:cdf462088d13 96 const unsigned char *p;
markrad 0:cdf462088d13 97
markrad 0:cdf462088d13 98 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
markrad 0:cdf462088d13 99
markrad 0:cdf462088d13 100 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
markrad 0:cdf462088d13 101 if( servername_list_size + 2 != len )
markrad 0:cdf462088d13 102 {
markrad 0:cdf462088d13 103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 104 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 105 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 106 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 107 }
markrad 0:cdf462088d13 108
markrad 0:cdf462088d13 109 p = buf + 2;
markrad 0:cdf462088d13 110 while( servername_list_size > 0 )
markrad 0:cdf462088d13 111 {
markrad 0:cdf462088d13 112 hostname_len = ( ( p[1] << 8 ) | p[2] );
markrad 0:cdf462088d13 113 if( hostname_len + 3 > servername_list_size )
markrad 0:cdf462088d13 114 {
markrad 0:cdf462088d13 115 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 116 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 117 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 118 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 119 }
markrad 0:cdf462088d13 120
markrad 0:cdf462088d13 121 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
markrad 0:cdf462088d13 122 {
markrad 0:cdf462088d13 123 ret = ssl->conf->f_sni( ssl->conf->p_sni,
markrad 0:cdf462088d13 124 ssl, p + 3, hostname_len );
markrad 0:cdf462088d13 125 if( ret != 0 )
markrad 0:cdf462088d13 126 {
markrad 0:cdf462088d13 127 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
markrad 0:cdf462088d13 128 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 129 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
markrad 0:cdf462088d13 130 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 131 }
markrad 0:cdf462088d13 132 return( 0 );
markrad 0:cdf462088d13 133 }
markrad 0:cdf462088d13 134
markrad 0:cdf462088d13 135 servername_list_size -= hostname_len + 3;
markrad 0:cdf462088d13 136 p += hostname_len + 3;
markrad 0:cdf462088d13 137 }
markrad 0:cdf462088d13 138
markrad 0:cdf462088d13 139 if( servername_list_size != 0 )
markrad 0:cdf462088d13 140 {
markrad 0:cdf462088d13 141 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 142 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 143 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
markrad 0:cdf462088d13 144 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 145 }
markrad 0:cdf462088d13 146
markrad 0:cdf462088d13 147 return( 0 );
markrad 0:cdf462088d13 148 }
markrad 0:cdf462088d13 149 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
markrad 0:cdf462088d13 150
markrad 0:cdf462088d13 151 static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 152 const unsigned char *buf,
markrad 0:cdf462088d13 153 size_t len )
markrad 0:cdf462088d13 154 {
markrad 0:cdf462088d13 155 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 156 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 157 {
markrad 0:cdf462088d13 158 /* Check verify-data in constant-time. The length OTOH is no secret */
markrad 0:cdf462088d13 159 if( len != 1 + ssl->verify_data_len ||
markrad 0:cdf462088d13 160 buf[0] != ssl->verify_data_len ||
markrad 0:cdf462088d13 161 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
markrad 0:cdf462088d13 162 ssl->verify_data_len ) != 0 )
markrad 0:cdf462088d13 163 {
markrad 0:cdf462088d13 164 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Jasper Wallace 2:bbdeda018a3c 165 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 166 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 167 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 168 }
markrad 0:cdf462088d13 169 }
markrad 0:cdf462088d13 170 else
markrad 0:cdf462088d13 171 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 172 {
markrad 0:cdf462088d13 173 if( len != 1 || buf[0] != 0x0 )
markrad 0:cdf462088d13 174 {
markrad 0:cdf462088d13 175 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Jasper Wallace 2:bbdeda018a3c 176 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 177 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 178 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 179 }
markrad 0:cdf462088d13 180
markrad 0:cdf462088d13 181 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
markrad 0:cdf462088d13 182 }
markrad 0:cdf462088d13 183
markrad 0:cdf462088d13 184 return( 0 );
markrad 0:cdf462088d13 185 }
markrad 0:cdf462088d13 186
markrad 0:cdf462088d13 187 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
markrad 0:cdf462088d13 188 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Jasper Wallace 2:bbdeda018a3c 189
Jasper Wallace 2:bbdeda018a3c 190 /*
Jasper Wallace 2:bbdeda018a3c 191 * Status of the implementation of signature-algorithms extension:
Jasper Wallace 2:bbdeda018a3c 192 *
Jasper Wallace 2:bbdeda018a3c 193 * Currently, we are only considering the signature-algorithm extension
Jasper Wallace 2:bbdeda018a3c 194 * to pick a ciphersuite which allows us to send the ServerKeyExchange
Jasper Wallace 2:bbdeda018a3c 195 * message with a signature-hash combination that the user allows.
Jasper Wallace 2:bbdeda018a3c 196 *
Jasper Wallace 2:bbdeda018a3c 197 * We do *not* check whether all certificates in our certificate
Jasper Wallace 2:bbdeda018a3c 198 * chain are signed with an allowed signature-hash pair.
Jasper Wallace 2:bbdeda018a3c 199 * This needs to be done at a later stage.
Jasper Wallace 2:bbdeda018a3c 200 *
Jasper Wallace 2:bbdeda018a3c 201 */
markrad 0:cdf462088d13 202 static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 203 const unsigned char *buf,
markrad 0:cdf462088d13 204 size_t len )
markrad 0:cdf462088d13 205 {
markrad 0:cdf462088d13 206 size_t sig_alg_list_size;
Jasper Wallace 2:bbdeda018a3c 207
markrad 0:cdf462088d13 208 const unsigned char *p;
markrad 0:cdf462088d13 209 const unsigned char *end = buf + len;
Jasper Wallace 2:bbdeda018a3c 210
Jasper Wallace 2:bbdeda018a3c 211 mbedtls_md_type_t md_cur;
Jasper Wallace 2:bbdeda018a3c 212 mbedtls_pk_type_t sig_cur;
markrad 0:cdf462088d13 213
markrad 0:cdf462088d13 214 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
markrad 0:cdf462088d13 215 if( sig_alg_list_size + 2 != len ||
markrad 0:cdf462088d13 216 sig_alg_list_size % 2 != 0 )
markrad 0:cdf462088d13 217 {
markrad 0:cdf462088d13 218 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 219 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 220 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 221 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 222 }
markrad 0:cdf462088d13 223
Jasper Wallace 2:bbdeda018a3c 224 /* Currently we only guarantee signing the ServerKeyExchange message according
Jasper Wallace 2:bbdeda018a3c 225 * to the constraints specified in this extension (see above), so it suffices
Jasper Wallace 2:bbdeda018a3c 226 * to remember only one suitable hash for each possible signature algorithm.
markrad 0:cdf462088d13 227 *
Jasper Wallace 2:bbdeda018a3c 228 * This will change when we also consider certificate signatures,
Jasper Wallace 2:bbdeda018a3c 229 * in which case we will need to remember the whole signature-hash
Jasper Wallace 2:bbdeda018a3c 230 * pair list from the extension.
markrad 0:cdf462088d13 231 */
Jasper Wallace 2:bbdeda018a3c 232
Jasper Wallace 2:bbdeda018a3c 233 for( p = buf + 2; p < end; p += 2 )
Jasper Wallace 2:bbdeda018a3c 234 {
Jasper Wallace 2:bbdeda018a3c 235 /* Silently ignore unknown signature or hash algorithms. */
Jasper Wallace 2:bbdeda018a3c 236
Jasper Wallace 2:bbdeda018a3c 237 if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
Jasper Wallace 2:bbdeda018a3c 238 {
Jasper Wallace 2:bbdeda018a3c 239 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext"
Jasper Wallace 2:bbdeda018a3c 240 " unknown sig alg encoding %d", p[1] ) );
Jasper Wallace 2:bbdeda018a3c 241 continue;
Jasper Wallace 2:bbdeda018a3c 242 }
Jasper Wallace 2:bbdeda018a3c 243
Jasper Wallace 2:bbdeda018a3c 244 /* Check if we support the hash the user proposes */
Jasper Wallace 2:bbdeda018a3c 245 md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
Jasper Wallace 2:bbdeda018a3c 246 if( md_cur == MBEDTLS_MD_NONE )
Jasper Wallace 2:bbdeda018a3c 247 {
Jasper Wallace 2:bbdeda018a3c 248 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
Jasper Wallace 2:bbdeda018a3c 249 " unknown hash alg encoding %d", p[0] ) );
Jasper Wallace 2:bbdeda018a3c 250 continue;
Jasper Wallace 2:bbdeda018a3c 251 }
Jasper Wallace 2:bbdeda018a3c 252
Jasper Wallace 2:bbdeda018a3c 253 if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
Jasper Wallace 2:bbdeda018a3c 254 {
Jasper Wallace 2:bbdeda018a3c 255 mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
Jasper Wallace 2:bbdeda018a3c 256 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
Jasper Wallace 2:bbdeda018a3c 257 " match sig %d and hash %d",
Jasper Wallace 2:bbdeda018a3c 258 sig_cur, md_cur ) );
Jasper Wallace 2:bbdeda018a3c 259 }
Jasper Wallace 2:bbdeda018a3c 260 else
Jasper Wallace 2:bbdeda018a3c 261 {
Jasper Wallace 2:bbdeda018a3c 262 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: "
Jasper Wallace 2:bbdeda018a3c 263 "hash alg %d not supported", md_cur ) );
markrad 0:cdf462088d13 264 }
markrad 0:cdf462088d13 265 }
markrad 0:cdf462088d13 266
markrad 0:cdf462088d13 267 return( 0 );
markrad 0:cdf462088d13 268 }
markrad 0:cdf462088d13 269 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
markrad 0:cdf462088d13 270 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
markrad 0:cdf462088d13 271
markrad 0:cdf462088d13 272 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 273 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 274 static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 275 const unsigned char *buf,
markrad 0:cdf462088d13 276 size_t len )
markrad 0:cdf462088d13 277 {
markrad 0:cdf462088d13 278 size_t list_size, our_size;
markrad 0:cdf462088d13 279 const unsigned char *p;
markrad 0:cdf462088d13 280 const mbedtls_ecp_curve_info *curve_info, **curves;
markrad 0:cdf462088d13 281
markrad 0:cdf462088d13 282 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
markrad 0:cdf462088d13 283 if( list_size + 2 != len ||
markrad 0:cdf462088d13 284 list_size % 2 != 0 )
markrad 0:cdf462088d13 285 {
markrad 0:cdf462088d13 286 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 287 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 288 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 289 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 290 }
markrad 0:cdf462088d13 291
markrad 0:cdf462088d13 292 /* Should never happen unless client duplicates the extension */
markrad 0:cdf462088d13 293 if( ssl->handshake->curves != NULL )
markrad 0:cdf462088d13 294 {
markrad 0:cdf462088d13 295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 296 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 297 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 298 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 299 }
markrad 0:cdf462088d13 300
markrad 0:cdf462088d13 301 /* Don't allow our peer to make us allocate too much memory,
markrad 0:cdf462088d13 302 * and leave room for a final 0 */
markrad 0:cdf462088d13 303 our_size = list_size / 2 + 1;
markrad 0:cdf462088d13 304 if( our_size > MBEDTLS_ECP_DP_MAX )
markrad 0:cdf462088d13 305 our_size = MBEDTLS_ECP_DP_MAX;
markrad 0:cdf462088d13 306
markrad 0:cdf462088d13 307 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
Jasper Wallace 2:bbdeda018a3c 308 {
Jasper Wallace 2:bbdeda018a3c 309 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 310 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
markrad 0:cdf462088d13 311 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Jasper Wallace 2:bbdeda018a3c 312 }
markrad 0:cdf462088d13 313
markrad 0:cdf462088d13 314 ssl->handshake->curves = curves;
markrad 0:cdf462088d13 315
markrad 0:cdf462088d13 316 p = buf + 2;
markrad 0:cdf462088d13 317 while( list_size > 0 && our_size > 1 )
markrad 0:cdf462088d13 318 {
markrad 0:cdf462088d13 319 curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
markrad 0:cdf462088d13 320
markrad 0:cdf462088d13 321 if( curve_info != NULL )
markrad 0:cdf462088d13 322 {
markrad 0:cdf462088d13 323 *curves++ = curve_info;
markrad 0:cdf462088d13 324 our_size--;
markrad 0:cdf462088d13 325 }
markrad 0:cdf462088d13 326
markrad 0:cdf462088d13 327 list_size -= 2;
markrad 0:cdf462088d13 328 p += 2;
markrad 0:cdf462088d13 329 }
markrad 0:cdf462088d13 330
markrad 0:cdf462088d13 331 return( 0 );
markrad 0:cdf462088d13 332 }
markrad 0:cdf462088d13 333
markrad 0:cdf462088d13 334 static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 335 const unsigned char *buf,
markrad 0:cdf462088d13 336 size_t len )
markrad 0:cdf462088d13 337 {
markrad 0:cdf462088d13 338 size_t list_size;
markrad 0:cdf462088d13 339 const unsigned char *p;
markrad 0:cdf462088d13 340
markrad 0:cdf462088d13 341 list_size = buf[0];
markrad 0:cdf462088d13 342 if( list_size + 1 != len )
markrad 0:cdf462088d13 343 {
markrad 0:cdf462088d13 344 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 345 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 346 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 347 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 348 }
markrad 0:cdf462088d13 349
markrad 0:cdf462088d13 350 p = buf + 1;
markrad 0:cdf462088d13 351 while( list_size > 0 )
markrad 0:cdf462088d13 352 {
markrad 0:cdf462088d13 353 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
markrad 0:cdf462088d13 354 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
markrad 0:cdf462088d13 355 {
markrad 0:cdf462088d13 356 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 357 ssl->handshake->ecdh_ctx.point_format = p[0];
markrad 0:cdf462088d13 358 #endif
markrad 0:cdf462088d13 359 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 360 ssl->handshake->ecjpake_ctx.point_format = p[0];
markrad 0:cdf462088d13 361 #endif
markrad 0:cdf462088d13 362 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
markrad 0:cdf462088d13 363 return( 0 );
markrad 0:cdf462088d13 364 }
markrad 0:cdf462088d13 365
markrad 0:cdf462088d13 366 list_size--;
markrad 0:cdf462088d13 367 p++;
markrad 0:cdf462088d13 368 }
markrad 0:cdf462088d13 369
markrad 0:cdf462088d13 370 return( 0 );
markrad 0:cdf462088d13 371 }
markrad 0:cdf462088d13 372 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
markrad 0:cdf462088d13 373 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 374
markrad 0:cdf462088d13 375 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 376 static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 377 const unsigned char *buf,
markrad 0:cdf462088d13 378 size_t len )
markrad 0:cdf462088d13 379 {
markrad 0:cdf462088d13 380 int ret;
markrad 0:cdf462088d13 381
markrad 0:cdf462088d13 382 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
markrad 0:cdf462088d13 383 {
markrad 0:cdf462088d13 384 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
markrad 0:cdf462088d13 385 return( 0 );
markrad 0:cdf462088d13 386 }
markrad 0:cdf462088d13 387
markrad 0:cdf462088d13 388 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 389 buf, len ) ) != 0 )
markrad 0:cdf462088d13 390 {
markrad 0:cdf462088d13 391 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Jasper Wallace 2:bbdeda018a3c 392 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 393 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
markrad 0:cdf462088d13 394 return( ret );
markrad 0:cdf462088d13 395 }
markrad 0:cdf462088d13 396
markrad 0:cdf462088d13 397 /* Only mark the extension as OK when we're sure it is */
markrad 0:cdf462088d13 398 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
markrad 0:cdf462088d13 399
markrad 0:cdf462088d13 400 return( 0 );
markrad 0:cdf462088d13 401 }
markrad 0:cdf462088d13 402 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 403
markrad 0:cdf462088d13 404 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 405 static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 406 const unsigned char *buf,
markrad 0:cdf462088d13 407 size_t len )
markrad 0:cdf462088d13 408 {
markrad 0:cdf462088d13 409 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
markrad 0:cdf462088d13 410 {
markrad 0:cdf462088d13 411 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 412 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 413 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
markrad 0:cdf462088d13 414 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 415 }
markrad 0:cdf462088d13 416
markrad 0:cdf462088d13 417 ssl->session_negotiate->mfl_code = buf[0];
markrad 0:cdf462088d13 418
markrad 0:cdf462088d13 419 return( 0 );
markrad 0:cdf462088d13 420 }
markrad 0:cdf462088d13 421 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
markrad 0:cdf462088d13 422
markrad 0:cdf462088d13 423 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 424 static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 425 const unsigned char *buf,
markrad 0:cdf462088d13 426 size_t len )
markrad 0:cdf462088d13 427 {
markrad 0:cdf462088d13 428 if( len != 0 )
markrad 0:cdf462088d13 429 {
markrad 0:cdf462088d13 430 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 431 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 432 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 433 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 434 }
markrad 0:cdf462088d13 435
markrad 0:cdf462088d13 436 ((void) buf);
markrad 0:cdf462088d13 437
markrad 0:cdf462088d13 438 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
markrad 0:cdf462088d13 439 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
markrad 0:cdf462088d13 440
markrad 0:cdf462088d13 441 return( 0 );
markrad 0:cdf462088d13 442 }
markrad 0:cdf462088d13 443 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
markrad 0:cdf462088d13 444
markrad 0:cdf462088d13 445 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 446 static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 447 const unsigned char *buf,
markrad 0:cdf462088d13 448 size_t len )
markrad 0:cdf462088d13 449 {
markrad 0:cdf462088d13 450 if( len != 0 )
markrad 0:cdf462088d13 451 {
markrad 0:cdf462088d13 452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 453 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 454 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 455 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 456 }
markrad 0:cdf462088d13 457
markrad 0:cdf462088d13 458 ((void) buf);
markrad 0:cdf462088d13 459
markrad 0:cdf462088d13 460 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
markrad 0:cdf462088d13 461 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 462 {
markrad 0:cdf462088d13 463 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
markrad 0:cdf462088d13 464 }
markrad 0:cdf462088d13 465
markrad 0:cdf462088d13 466 return( 0 );
markrad 0:cdf462088d13 467 }
markrad 0:cdf462088d13 468 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
markrad 0:cdf462088d13 469
markrad 0:cdf462088d13 470 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 471 static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 472 const unsigned char *buf,
markrad 0:cdf462088d13 473 size_t len )
markrad 0:cdf462088d13 474 {
markrad 0:cdf462088d13 475 if( len != 0 )
markrad 0:cdf462088d13 476 {
markrad 0:cdf462088d13 477 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 478 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 479 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 480 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 481 }
markrad 0:cdf462088d13 482
markrad 0:cdf462088d13 483 ((void) buf);
markrad 0:cdf462088d13 484
markrad 0:cdf462088d13 485 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
markrad 0:cdf462088d13 486 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 487 {
markrad 0:cdf462088d13 488 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
markrad 0:cdf462088d13 489 }
markrad 0:cdf462088d13 490
markrad 0:cdf462088d13 491 return( 0 );
markrad 0:cdf462088d13 492 }
markrad 0:cdf462088d13 493 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
markrad 0:cdf462088d13 494
markrad 0:cdf462088d13 495 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 496 static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 497 unsigned char *buf,
markrad 0:cdf462088d13 498 size_t len )
markrad 0:cdf462088d13 499 {
markrad 0:cdf462088d13 500 int ret;
markrad 0:cdf462088d13 501 mbedtls_ssl_session session;
markrad 0:cdf462088d13 502
markrad 0:cdf462088d13 503 mbedtls_ssl_session_init( &session );
markrad 0:cdf462088d13 504
markrad 0:cdf462088d13 505 if( ssl->conf->f_ticket_parse == NULL ||
markrad 0:cdf462088d13 506 ssl->conf->f_ticket_write == NULL )
markrad 0:cdf462088d13 507 {
markrad 0:cdf462088d13 508 return( 0 );
markrad 0:cdf462088d13 509 }
markrad 0:cdf462088d13 510
markrad 0:cdf462088d13 511 /* Remember the client asked us to send a new ticket */
markrad 0:cdf462088d13 512 ssl->handshake->new_session_ticket = 1;
markrad 0:cdf462088d13 513
markrad 0:cdf462088d13 514 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
markrad 0:cdf462088d13 515
markrad 0:cdf462088d13 516 if( len == 0 )
markrad 0:cdf462088d13 517 return( 0 );
markrad 0:cdf462088d13 518
markrad 0:cdf462088d13 519 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 520 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 521 {
markrad 0:cdf462088d13 522 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
markrad 0:cdf462088d13 523 return( 0 );
markrad 0:cdf462088d13 524 }
markrad 0:cdf462088d13 525 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 526
markrad 0:cdf462088d13 527 /*
markrad 0:cdf462088d13 528 * Failures are ok: just ignore the ticket and proceed.
markrad 0:cdf462088d13 529 */
markrad 0:cdf462088d13 530 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
markrad 0:cdf462088d13 531 buf, len ) ) != 0 )
markrad 0:cdf462088d13 532 {
markrad 0:cdf462088d13 533 mbedtls_ssl_session_free( &session );
markrad 0:cdf462088d13 534
markrad 0:cdf462088d13 535 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
markrad 0:cdf462088d13 536 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
markrad 0:cdf462088d13 537 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
markrad 0:cdf462088d13 538 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
markrad 0:cdf462088d13 539 else
markrad 0:cdf462088d13 540 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
markrad 0:cdf462088d13 541
markrad 0:cdf462088d13 542 return( 0 );
markrad 0:cdf462088d13 543 }
markrad 0:cdf462088d13 544
markrad 0:cdf462088d13 545 /*
markrad 0:cdf462088d13 546 * Keep the session ID sent by the client, since we MUST send it back to
markrad 0:cdf462088d13 547 * inform them we're accepting the ticket (RFC 5077 section 3.4)
markrad 0:cdf462088d13 548 */
markrad 0:cdf462088d13 549 session.id_len = ssl->session_negotiate->id_len;
markrad 0:cdf462088d13 550 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
markrad 0:cdf462088d13 551
markrad 0:cdf462088d13 552 mbedtls_ssl_session_free( ssl->session_negotiate );
markrad 0:cdf462088d13 553 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
markrad 0:cdf462088d13 554
markrad 0:cdf462088d13 555 /* Zeroize instead of free as we copied the content */
markrad 0:cdf462088d13 556 mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
markrad 0:cdf462088d13 557
markrad 0:cdf462088d13 558 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
markrad 0:cdf462088d13 559
markrad 0:cdf462088d13 560 ssl->handshake->resume = 1;
markrad 0:cdf462088d13 561
markrad 0:cdf462088d13 562 /* Don't send a new ticket after all, this one is OK */
markrad 0:cdf462088d13 563 ssl->handshake->new_session_ticket = 0;
markrad 0:cdf462088d13 564
markrad 0:cdf462088d13 565 return( 0 );
markrad 0:cdf462088d13 566 }
markrad 0:cdf462088d13 567 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 568
markrad 0:cdf462088d13 569 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 570 static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 571 const unsigned char *buf, size_t len )
markrad 0:cdf462088d13 572 {
markrad 0:cdf462088d13 573 size_t list_len, cur_len, ours_len;
markrad 0:cdf462088d13 574 const unsigned char *theirs, *start, *end;
markrad 0:cdf462088d13 575 const char **ours;
markrad 0:cdf462088d13 576
markrad 0:cdf462088d13 577 /* If ALPN not configured, just ignore the extension */
markrad 0:cdf462088d13 578 if( ssl->conf->alpn_list == NULL )
markrad 0:cdf462088d13 579 return( 0 );
markrad 0:cdf462088d13 580
markrad 0:cdf462088d13 581 /*
markrad 0:cdf462088d13 582 * opaque ProtocolName<1..2^8-1>;
markrad 0:cdf462088d13 583 *
markrad 0:cdf462088d13 584 * struct {
markrad 0:cdf462088d13 585 * ProtocolName protocol_name_list<2..2^16-1>
markrad 0:cdf462088d13 586 * } ProtocolNameList;
markrad 0:cdf462088d13 587 */
markrad 0:cdf462088d13 588
markrad 0:cdf462088d13 589 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
markrad 0:cdf462088d13 590 if( len < 4 )
Jasper Wallace 2:bbdeda018a3c 591 {
Jasper Wallace 2:bbdeda018a3c 592 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 593 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 594 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Jasper Wallace 2:bbdeda018a3c 595 }
markrad 0:cdf462088d13 596
markrad 0:cdf462088d13 597 list_len = ( buf[0] << 8 ) | buf[1];
markrad 0:cdf462088d13 598 if( list_len != len - 2 )
Jasper Wallace 2:bbdeda018a3c 599 {
Jasper Wallace 2:bbdeda018a3c 600 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 601 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 602 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Jasper Wallace 2:bbdeda018a3c 603 }
markrad 0:cdf462088d13 604
markrad 0:cdf462088d13 605 /*
markrad 0:cdf462088d13 606 * Use our order of preference
markrad 0:cdf462088d13 607 */
markrad 0:cdf462088d13 608 start = buf + 2;
markrad 0:cdf462088d13 609 end = buf + len;
markrad 0:cdf462088d13 610 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
markrad 0:cdf462088d13 611 {
markrad 0:cdf462088d13 612 ours_len = strlen( *ours );
markrad 0:cdf462088d13 613 for( theirs = start; theirs != end; theirs += cur_len )
markrad 0:cdf462088d13 614 {
markrad 0:cdf462088d13 615 /* If the list is well formed, we should get equality first */
markrad 0:cdf462088d13 616 if( theirs > end )
Jasper Wallace 2:bbdeda018a3c 617 {
Jasper Wallace 2:bbdeda018a3c 618 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 619 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
markrad 0:cdf462088d13 620 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Jasper Wallace 2:bbdeda018a3c 621 }
markrad 0:cdf462088d13 622
markrad 0:cdf462088d13 623 cur_len = *theirs++;
markrad 0:cdf462088d13 624
markrad 0:cdf462088d13 625 /* Empty strings MUST NOT be included */
markrad 0:cdf462088d13 626 if( cur_len == 0 )
Jasper Wallace 2:bbdeda018a3c 627 {
Jasper Wallace 2:bbdeda018a3c 628 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 629 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
markrad 0:cdf462088d13 630 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Jasper Wallace 2:bbdeda018a3c 631 }
markrad 0:cdf462088d13 632
markrad 0:cdf462088d13 633 if( cur_len == ours_len &&
markrad 0:cdf462088d13 634 memcmp( theirs, *ours, cur_len ) == 0 )
markrad 0:cdf462088d13 635 {
markrad 0:cdf462088d13 636 ssl->alpn_chosen = *ours;
markrad 0:cdf462088d13 637 return( 0 );
markrad 0:cdf462088d13 638 }
markrad 0:cdf462088d13 639 }
markrad 0:cdf462088d13 640 }
markrad 0:cdf462088d13 641
markrad 0:cdf462088d13 642 /* If we get there, no match was found */
markrad 0:cdf462088d13 643 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 644 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
markrad 0:cdf462088d13 645 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 646 }
markrad 0:cdf462088d13 647 #endif /* MBEDTLS_SSL_ALPN */
markrad 0:cdf462088d13 648
markrad 0:cdf462088d13 649 /*
markrad 0:cdf462088d13 650 * Auxiliary functions for ServerHello parsing and related actions
markrad 0:cdf462088d13 651 */
markrad 0:cdf462088d13 652
markrad 0:cdf462088d13 653 #if defined(MBEDTLS_X509_CRT_PARSE_C)
markrad 0:cdf462088d13 654 /*
markrad 0:cdf462088d13 655 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
markrad 0:cdf462088d13 656 */
markrad 0:cdf462088d13 657 #if defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 658 static int ssl_check_key_curve( mbedtls_pk_context *pk,
markrad 0:cdf462088d13 659 const mbedtls_ecp_curve_info **curves )
markrad 0:cdf462088d13 660 {
markrad 0:cdf462088d13 661 const mbedtls_ecp_curve_info **crv = curves;
markrad 0:cdf462088d13 662 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
markrad 0:cdf462088d13 663
markrad 0:cdf462088d13 664 while( *crv != NULL )
markrad 0:cdf462088d13 665 {
markrad 0:cdf462088d13 666 if( (*crv)->grp_id == grp_id )
markrad 0:cdf462088d13 667 return( 0 );
markrad 0:cdf462088d13 668 crv++;
markrad 0:cdf462088d13 669 }
markrad 0:cdf462088d13 670
markrad 0:cdf462088d13 671 return( -1 );
markrad 0:cdf462088d13 672 }
markrad 0:cdf462088d13 673 #endif /* MBEDTLS_ECDSA_C */
markrad 0:cdf462088d13 674
markrad 0:cdf462088d13 675 /*
markrad 0:cdf462088d13 676 * Try picking a certificate for this ciphersuite,
markrad 0:cdf462088d13 677 * return 0 on success and -1 on failure.
markrad 0:cdf462088d13 678 */
markrad 0:cdf462088d13 679 static int ssl_pick_cert( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 680 const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
markrad 0:cdf462088d13 681 {
markrad 0:cdf462088d13 682 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
Jasper Wallace 2:bbdeda018a3c 683 mbedtls_pk_type_t pk_alg =
Jasper Wallace 2:bbdeda018a3c 684 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
markrad 0:cdf462088d13 685 uint32_t flags;
markrad 0:cdf462088d13 686
markrad 0:cdf462088d13 687 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
markrad 0:cdf462088d13 688 if( ssl->handshake->sni_key_cert != NULL )
markrad 0:cdf462088d13 689 list = ssl->handshake->sni_key_cert;
markrad 0:cdf462088d13 690 else
markrad 0:cdf462088d13 691 #endif
markrad 0:cdf462088d13 692 list = ssl->conf->key_cert;
markrad 0:cdf462088d13 693
markrad 0:cdf462088d13 694 if( pk_alg == MBEDTLS_PK_NONE )
markrad 0:cdf462088d13 695 return( 0 );
markrad 0:cdf462088d13 696
markrad 0:cdf462088d13 697 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
markrad 0:cdf462088d13 698
markrad 0:cdf462088d13 699 if( list == NULL )
markrad 0:cdf462088d13 700 {
markrad 0:cdf462088d13 701 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
markrad 0:cdf462088d13 702 return( -1 );
markrad 0:cdf462088d13 703 }
markrad 0:cdf462088d13 704
markrad 0:cdf462088d13 705 for( cur = list; cur != NULL; cur = cur->next )
markrad 0:cdf462088d13 706 {
markrad 0:cdf462088d13 707 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
markrad 0:cdf462088d13 708 cur->cert );
markrad 0:cdf462088d13 709
markrad 0:cdf462088d13 710 if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
markrad 0:cdf462088d13 711 {
markrad 0:cdf462088d13 712 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
markrad 0:cdf462088d13 713 continue;
markrad 0:cdf462088d13 714 }
markrad 0:cdf462088d13 715
markrad 0:cdf462088d13 716 /*
markrad 0:cdf462088d13 717 * This avoids sending the client a cert it'll reject based on
markrad 0:cdf462088d13 718 * keyUsage or other extensions.
markrad 0:cdf462088d13 719 *
markrad 0:cdf462088d13 720 * It also allows the user to provision different certificates for
markrad 0:cdf462088d13 721 * different uses based on keyUsage, eg if they want to avoid signing
markrad 0:cdf462088d13 722 * and decrypting with the same RSA key.
markrad 0:cdf462088d13 723 */
markrad 0:cdf462088d13 724 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
markrad 0:cdf462088d13 725 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
markrad 0:cdf462088d13 726 {
markrad 0:cdf462088d13 727 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
markrad 0:cdf462088d13 728 "(extended) key usage extension" ) );
markrad 0:cdf462088d13 729 continue;
markrad 0:cdf462088d13 730 }
markrad 0:cdf462088d13 731
markrad 0:cdf462088d13 732 #if defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 733 if( pk_alg == MBEDTLS_PK_ECDSA &&
markrad 0:cdf462088d13 734 ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
markrad 0:cdf462088d13 735 {
markrad 0:cdf462088d13 736 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
markrad 0:cdf462088d13 737 continue;
markrad 0:cdf462088d13 738 }
markrad 0:cdf462088d13 739 #endif
markrad 0:cdf462088d13 740
markrad 0:cdf462088d13 741 /*
markrad 0:cdf462088d13 742 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
markrad 0:cdf462088d13 743 * present them a SHA-higher cert rather than failing if it's the only
markrad 0:cdf462088d13 744 * one we got that satisfies the other conditions.
markrad 0:cdf462088d13 745 */
markrad 0:cdf462088d13 746 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
markrad 0:cdf462088d13 747 cur->cert->sig_md != MBEDTLS_MD_SHA1 )
markrad 0:cdf462088d13 748 {
markrad 0:cdf462088d13 749 if( fallback == NULL )
markrad 0:cdf462088d13 750 fallback = cur;
markrad 0:cdf462088d13 751 {
markrad 0:cdf462088d13 752 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
markrad 0:cdf462088d13 753 "sha-2 with pre-TLS 1.2 client" ) );
markrad 0:cdf462088d13 754 continue;
markrad 0:cdf462088d13 755 }
markrad 0:cdf462088d13 756 }
markrad 0:cdf462088d13 757
markrad 0:cdf462088d13 758 /* If we get there, we got a winner */
markrad 0:cdf462088d13 759 break;
markrad 0:cdf462088d13 760 }
markrad 0:cdf462088d13 761
markrad 0:cdf462088d13 762 if( cur == NULL )
markrad 0:cdf462088d13 763 cur = fallback;
markrad 0:cdf462088d13 764
markrad 0:cdf462088d13 765 /* Do not update ssl->handshake->key_cert unless there is a match */
markrad 0:cdf462088d13 766 if( cur != NULL )
markrad 0:cdf462088d13 767 {
markrad 0:cdf462088d13 768 ssl->handshake->key_cert = cur;
markrad 0:cdf462088d13 769 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
markrad 0:cdf462088d13 770 ssl->handshake->key_cert->cert );
markrad 0:cdf462088d13 771 return( 0 );
markrad 0:cdf462088d13 772 }
markrad 0:cdf462088d13 773
markrad 0:cdf462088d13 774 return( -1 );
markrad 0:cdf462088d13 775 }
markrad 0:cdf462088d13 776 #endif /* MBEDTLS_X509_CRT_PARSE_C */
markrad 0:cdf462088d13 777
markrad 0:cdf462088d13 778 /*
markrad 0:cdf462088d13 779 * Check if a given ciphersuite is suitable for use with our config/keys/etc
markrad 0:cdf462088d13 780 * Sets ciphersuite_info only if the suite matches.
markrad 0:cdf462088d13 781 */
markrad 0:cdf462088d13 782 static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
markrad 0:cdf462088d13 783 const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
markrad 0:cdf462088d13 784 {
markrad 0:cdf462088d13 785 const mbedtls_ssl_ciphersuite_t *suite_info;
markrad 0:cdf462088d13 786
Jasper Wallace 2:bbdeda018a3c 787 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Jasper Wallace 2:bbdeda018a3c 788 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Jasper Wallace 2:bbdeda018a3c 789 mbedtls_pk_type_t sig_type;
Jasper Wallace 2:bbdeda018a3c 790 #endif
Jasper Wallace 2:bbdeda018a3c 791
markrad 0:cdf462088d13 792 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
markrad 0:cdf462088d13 793 if( suite_info == NULL )
markrad 0:cdf462088d13 794 {
markrad 0:cdf462088d13 795 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 796 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 797 }
markrad 0:cdf462088d13 798
markrad 0:cdf462088d13 799 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
markrad 0:cdf462088d13 800
markrad 0:cdf462088d13 801 if( suite_info->min_minor_ver > ssl->minor_ver ||
markrad 0:cdf462088d13 802 suite_info->max_minor_ver < ssl->minor_ver )
markrad 0:cdf462088d13 803 {
markrad 0:cdf462088d13 804 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
markrad 0:cdf462088d13 805 return( 0 );
markrad 0:cdf462088d13 806 }
markrad 0:cdf462088d13 807
markrad 0:cdf462088d13 808 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 809 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
markrad 0:cdf462088d13 810 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
markrad 0:cdf462088d13 811 return( 0 );
markrad 0:cdf462088d13 812 #endif
markrad 0:cdf462088d13 813
markrad 0:cdf462088d13 814 #if defined(MBEDTLS_ARC4_C)
markrad 0:cdf462088d13 815 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
markrad 0:cdf462088d13 816 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
markrad 0:cdf462088d13 817 {
markrad 0:cdf462088d13 818 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
markrad 0:cdf462088d13 819 return( 0 );
markrad 0:cdf462088d13 820 }
markrad 0:cdf462088d13 821 #endif
markrad 0:cdf462088d13 822
markrad 0:cdf462088d13 823 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 824 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
markrad 0:cdf462088d13 825 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
markrad 0:cdf462088d13 826 {
markrad 0:cdf462088d13 827 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
markrad 0:cdf462088d13 828 "not configured or ext missing" ) );
markrad 0:cdf462088d13 829 return( 0 );
markrad 0:cdf462088d13 830 }
markrad 0:cdf462088d13 831 #endif
markrad 0:cdf462088d13 832
markrad 0:cdf462088d13 833
markrad 0:cdf462088d13 834 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 835 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
markrad 0:cdf462088d13 836 ( ssl->handshake->curves == NULL ||
markrad 0:cdf462088d13 837 ssl->handshake->curves[0] == NULL ) )
markrad 0:cdf462088d13 838 {
markrad 0:cdf462088d13 839 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
markrad 0:cdf462088d13 840 "no common elliptic curve" ) );
markrad 0:cdf462088d13 841 return( 0 );
markrad 0:cdf462088d13 842 }
markrad 0:cdf462088d13 843 #endif
markrad 0:cdf462088d13 844
markrad 0:cdf462088d13 845 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
markrad 0:cdf462088d13 846 /* If the ciphersuite requires a pre-shared key and we don't
markrad 0:cdf462088d13 847 * have one, skip it now rather than failing later */
markrad 0:cdf462088d13 848 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
markrad 0:cdf462088d13 849 ssl->conf->f_psk == NULL &&
markrad 0:cdf462088d13 850 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
markrad 0:cdf462088d13 851 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
markrad 0:cdf462088d13 852 {
markrad 0:cdf462088d13 853 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
markrad 0:cdf462088d13 854 return( 0 );
markrad 0:cdf462088d13 855 }
markrad 0:cdf462088d13 856 #endif
markrad 0:cdf462088d13 857
Jasper Wallace 2:bbdeda018a3c 858 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Jasper Wallace 2:bbdeda018a3c 859 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Jasper Wallace 2:bbdeda018a3c 860 /* If the ciphersuite requires signing, check whether
Jasper Wallace 2:bbdeda018a3c 861 * a suitable hash algorithm is present. */
Jasper Wallace 2:bbdeda018a3c 862 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Jasper Wallace 2:bbdeda018a3c 863 {
Jasper Wallace 2:bbdeda018a3c 864 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg( suite_info );
Jasper Wallace 2:bbdeda018a3c 865 if( sig_type != MBEDTLS_PK_NONE &&
Jasper Wallace 2:bbdeda018a3c 866 mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs, sig_type ) == MBEDTLS_MD_NONE )
Jasper Wallace 2:bbdeda018a3c 867 {
Jasper Wallace 2:bbdeda018a3c 868 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm "
Jasper Wallace 2:bbdeda018a3c 869 "for signature algorithm %d", sig_type ) );
Jasper Wallace 2:bbdeda018a3c 870 return( 0 );
Jasper Wallace 2:bbdeda018a3c 871 }
Jasper Wallace 2:bbdeda018a3c 872 }
Jasper Wallace 2:bbdeda018a3c 873
Jasper Wallace 2:bbdeda018a3c 874 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Jasper Wallace 2:bbdeda018a3c 875 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Jasper Wallace 2:bbdeda018a3c 876
markrad 0:cdf462088d13 877 #if defined(MBEDTLS_X509_CRT_PARSE_C)
markrad 0:cdf462088d13 878 /*
markrad 0:cdf462088d13 879 * Final check: if ciphersuite requires us to have a
markrad 0:cdf462088d13 880 * certificate/key of a particular type:
markrad 0:cdf462088d13 881 * - select the appropriate certificate if we have one, or
markrad 0:cdf462088d13 882 * - try the next ciphersuite if we don't
markrad 0:cdf462088d13 883 * This must be done last since we modify the key_cert list.
markrad 0:cdf462088d13 884 */
markrad 0:cdf462088d13 885 if( ssl_pick_cert( ssl, suite_info ) != 0 )
markrad 0:cdf462088d13 886 {
markrad 0:cdf462088d13 887 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
markrad 0:cdf462088d13 888 "no suitable certificate" ) );
markrad 0:cdf462088d13 889 return( 0 );
markrad 0:cdf462088d13 890 }
markrad 0:cdf462088d13 891 #endif
markrad 0:cdf462088d13 892
markrad 0:cdf462088d13 893 *ciphersuite_info = suite_info;
markrad 0:cdf462088d13 894 return( 0 );
markrad 0:cdf462088d13 895 }
markrad 0:cdf462088d13 896
markrad 0:cdf462088d13 897 #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
markrad 0:cdf462088d13 898 static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 899 {
markrad 0:cdf462088d13 900 int ret, got_common_suite;
markrad 0:cdf462088d13 901 unsigned int i, j;
markrad 0:cdf462088d13 902 size_t n;
markrad 0:cdf462088d13 903 unsigned int ciph_len, sess_len, chal_len;
markrad 0:cdf462088d13 904 unsigned char *buf, *p;
markrad 0:cdf462088d13 905 const int *ciphersuites;
markrad 0:cdf462088d13 906 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
markrad 0:cdf462088d13 907
markrad 0:cdf462088d13 908 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
markrad 0:cdf462088d13 909
markrad 0:cdf462088d13 910 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 911 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 912 {
markrad 0:cdf462088d13 913 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Jasper Wallace 2:bbdeda018a3c 914 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 915 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 916 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 917 }
markrad 0:cdf462088d13 918 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 919
markrad 0:cdf462088d13 920 buf = ssl->in_hdr;
markrad 0:cdf462088d13 921
markrad 0:cdf462088d13 922 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
markrad 0:cdf462088d13 923
markrad 0:cdf462088d13 924 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
markrad 0:cdf462088d13 925 buf[2] ) );
markrad 0:cdf462088d13 926 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
markrad 0:cdf462088d13 927 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
markrad 0:cdf462088d13 928 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
markrad 0:cdf462088d13 929 buf[3], buf[4] ) );
markrad 0:cdf462088d13 930
markrad 0:cdf462088d13 931 /*
markrad 0:cdf462088d13 932 * SSLv2 Client Hello
markrad 0:cdf462088d13 933 *
markrad 0:cdf462088d13 934 * Record layer:
markrad 0:cdf462088d13 935 * 0 . 1 message length
markrad 0:cdf462088d13 936 *
markrad 0:cdf462088d13 937 * SSL layer:
markrad 0:cdf462088d13 938 * 2 . 2 message type
markrad 0:cdf462088d13 939 * 3 . 4 protocol version
markrad 0:cdf462088d13 940 */
markrad 0:cdf462088d13 941 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
markrad 0:cdf462088d13 942 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
markrad 0:cdf462088d13 943 {
markrad 0:cdf462088d13 944 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 945 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 946 }
markrad 0:cdf462088d13 947
markrad 0:cdf462088d13 948 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
markrad 0:cdf462088d13 949
markrad 0:cdf462088d13 950 if( n < 17 || n > 512 )
markrad 0:cdf462088d13 951 {
markrad 0:cdf462088d13 952 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 953 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 954 }
markrad 0:cdf462088d13 955
markrad 0:cdf462088d13 956 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
markrad 0:cdf462088d13 957 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
markrad 0:cdf462088d13 958 ? buf[4] : ssl->conf->max_minor_ver;
markrad 0:cdf462088d13 959
markrad 0:cdf462088d13 960 if( ssl->minor_ver < ssl->conf->min_minor_ver )
markrad 0:cdf462088d13 961 {
markrad 0:cdf462088d13 962 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
markrad 0:cdf462088d13 963 " [%d:%d] < [%d:%d]",
markrad 0:cdf462088d13 964 ssl->major_ver, ssl->minor_ver,
markrad 0:cdf462088d13 965 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
markrad 0:cdf462088d13 966
markrad 0:cdf462088d13 967 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 968 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
markrad 0:cdf462088d13 969 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
markrad 0:cdf462088d13 970 }
markrad 0:cdf462088d13 971
markrad 0:cdf462088d13 972 ssl->handshake->max_major_ver = buf[3];
markrad 0:cdf462088d13 973 ssl->handshake->max_minor_ver = buf[4];
markrad 0:cdf462088d13 974
markrad 0:cdf462088d13 975 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
markrad 0:cdf462088d13 976 {
markrad 0:cdf462088d13 977 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
markrad 0:cdf462088d13 978 return( ret );
markrad 0:cdf462088d13 979 }
markrad 0:cdf462088d13 980
markrad 0:cdf462088d13 981 ssl->handshake->update_checksum( ssl, buf + 2, n );
markrad 0:cdf462088d13 982
markrad 0:cdf462088d13 983 buf = ssl->in_msg;
markrad 0:cdf462088d13 984 n = ssl->in_left - 5;
markrad 0:cdf462088d13 985
markrad 0:cdf462088d13 986 /*
markrad 0:cdf462088d13 987 * 0 . 1 ciphersuitelist length
markrad 0:cdf462088d13 988 * 2 . 3 session id length
markrad 0:cdf462088d13 989 * 4 . 5 challenge length
markrad 0:cdf462088d13 990 * 6 . .. ciphersuitelist
markrad 0:cdf462088d13 991 * .. . .. session id
markrad 0:cdf462088d13 992 * .. . .. challenge
markrad 0:cdf462088d13 993 */
markrad 0:cdf462088d13 994 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
markrad 0:cdf462088d13 995
markrad 0:cdf462088d13 996 ciph_len = ( buf[0] << 8 ) | buf[1];
markrad 0:cdf462088d13 997 sess_len = ( buf[2] << 8 ) | buf[3];
markrad 0:cdf462088d13 998 chal_len = ( buf[4] << 8 ) | buf[5];
markrad 0:cdf462088d13 999
markrad 0:cdf462088d13 1000 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
markrad 0:cdf462088d13 1001 ciph_len, sess_len, chal_len ) );
markrad 0:cdf462088d13 1002
markrad 0:cdf462088d13 1003 /*
markrad 0:cdf462088d13 1004 * Make sure each parameter length is valid
markrad 0:cdf462088d13 1005 */
markrad 0:cdf462088d13 1006 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
markrad 0:cdf462088d13 1007 {
markrad 0:cdf462088d13 1008 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1009 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1010 }
markrad 0:cdf462088d13 1011
markrad 0:cdf462088d13 1012 if( sess_len > 32 )
markrad 0:cdf462088d13 1013 {
markrad 0:cdf462088d13 1014 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1015 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1016 }
markrad 0:cdf462088d13 1017
markrad 0:cdf462088d13 1018 if( chal_len < 8 || chal_len > 32 )
markrad 0:cdf462088d13 1019 {
markrad 0:cdf462088d13 1020 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1021 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1022 }
markrad 0:cdf462088d13 1023
markrad 0:cdf462088d13 1024 if( n != 6 + ciph_len + sess_len + chal_len )
markrad 0:cdf462088d13 1025 {
markrad 0:cdf462088d13 1026 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1027 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1028 }
markrad 0:cdf462088d13 1029
markrad 0:cdf462088d13 1030 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
markrad 0:cdf462088d13 1031 buf + 6, ciph_len );
markrad 0:cdf462088d13 1032 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
markrad 0:cdf462088d13 1033 buf + 6 + ciph_len, sess_len );
markrad 0:cdf462088d13 1034 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
markrad 0:cdf462088d13 1035 buf + 6 + ciph_len + sess_len, chal_len );
markrad 0:cdf462088d13 1036
markrad 0:cdf462088d13 1037 p = buf + 6 + ciph_len;
markrad 0:cdf462088d13 1038 ssl->session_negotiate->id_len = sess_len;
markrad 0:cdf462088d13 1039 memset( ssl->session_negotiate->id, 0,
markrad 0:cdf462088d13 1040 sizeof( ssl->session_negotiate->id ) );
markrad 0:cdf462088d13 1041 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
markrad 0:cdf462088d13 1042
markrad 0:cdf462088d13 1043 p += sess_len;
markrad 0:cdf462088d13 1044 memset( ssl->handshake->randbytes, 0, 64 );
markrad 0:cdf462088d13 1045 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
markrad 0:cdf462088d13 1046
markrad 0:cdf462088d13 1047 /*
markrad 0:cdf462088d13 1048 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
markrad 0:cdf462088d13 1049 */
markrad 0:cdf462088d13 1050 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
markrad 0:cdf462088d13 1051 {
markrad 0:cdf462088d13 1052 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
markrad 0:cdf462088d13 1053 {
markrad 0:cdf462088d13 1054 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
markrad 0:cdf462088d13 1055 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1056 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
markrad 0:cdf462088d13 1057 {
markrad 0:cdf462088d13 1058 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
markrad 0:cdf462088d13 1059 "during renegotiation" ) );
markrad 0:cdf462088d13 1060
Jasper Wallace 2:bbdeda018a3c 1061 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1062 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 1063 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1064 }
markrad 0:cdf462088d13 1065 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 1066 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
markrad 0:cdf462088d13 1067 break;
markrad 0:cdf462088d13 1068 }
markrad 0:cdf462088d13 1069 }
markrad 0:cdf462088d13 1070
markrad 0:cdf462088d13 1071 #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
markrad 0:cdf462088d13 1072 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
markrad 0:cdf462088d13 1073 {
markrad 0:cdf462088d13 1074 if( p[0] == 0 &&
markrad 0:cdf462088d13 1075 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
markrad 0:cdf462088d13 1076 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
markrad 0:cdf462088d13 1077 {
markrad 0:cdf462088d13 1078 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
markrad 0:cdf462088d13 1079
markrad 0:cdf462088d13 1080 if( ssl->minor_ver < ssl->conf->max_minor_ver )
markrad 0:cdf462088d13 1081 {
markrad 0:cdf462088d13 1082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
markrad 0:cdf462088d13 1083
markrad 0:cdf462088d13 1084 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 1085 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
markrad 0:cdf462088d13 1086
markrad 0:cdf462088d13 1087 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1088 }
markrad 0:cdf462088d13 1089
markrad 0:cdf462088d13 1090 break;
markrad 0:cdf462088d13 1091 }
markrad 0:cdf462088d13 1092 }
markrad 0:cdf462088d13 1093 #endif /* MBEDTLS_SSL_FALLBACK_SCSV */
markrad 0:cdf462088d13 1094
markrad 0:cdf462088d13 1095 got_common_suite = 0;
markrad 0:cdf462088d13 1096 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
markrad 0:cdf462088d13 1097 ciphersuite_info = NULL;
markrad 0:cdf462088d13 1098 #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
markrad 0:cdf462088d13 1099 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
markrad 0:cdf462088d13 1100 for( i = 0; ciphersuites[i] != 0; i++ )
markrad 0:cdf462088d13 1101 #else
markrad 0:cdf462088d13 1102 for( i = 0; ciphersuites[i] != 0; i++ )
markrad 0:cdf462088d13 1103 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
markrad 0:cdf462088d13 1104 #endif
markrad 0:cdf462088d13 1105 {
markrad 0:cdf462088d13 1106 if( p[0] != 0 ||
markrad 0:cdf462088d13 1107 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
markrad 0:cdf462088d13 1108 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
markrad 0:cdf462088d13 1109 continue;
markrad 0:cdf462088d13 1110
markrad 0:cdf462088d13 1111 got_common_suite = 1;
markrad 0:cdf462088d13 1112
markrad 0:cdf462088d13 1113 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
markrad 0:cdf462088d13 1114 &ciphersuite_info ) ) != 0 )
markrad 0:cdf462088d13 1115 return( ret );
markrad 0:cdf462088d13 1116
markrad 0:cdf462088d13 1117 if( ciphersuite_info != NULL )
markrad 0:cdf462088d13 1118 goto have_ciphersuite_v2;
markrad 0:cdf462088d13 1119 }
markrad 0:cdf462088d13 1120
markrad 0:cdf462088d13 1121 if( got_common_suite )
markrad 0:cdf462088d13 1122 {
markrad 0:cdf462088d13 1123 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
markrad 0:cdf462088d13 1124 "but none of them usable" ) );
markrad 0:cdf462088d13 1125 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
markrad 0:cdf462088d13 1126 }
markrad 0:cdf462088d13 1127 else
markrad 0:cdf462088d13 1128 {
markrad 0:cdf462088d13 1129 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
markrad 0:cdf462088d13 1130 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
markrad 0:cdf462088d13 1131 }
markrad 0:cdf462088d13 1132
markrad 0:cdf462088d13 1133 have_ciphersuite_v2:
markrad 0:cdf462088d13 1134 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
markrad 0:cdf462088d13 1135
markrad 0:cdf462088d13 1136 ssl->session_negotiate->ciphersuite = ciphersuites[i];
markrad 0:cdf462088d13 1137 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
markrad 0:cdf462088d13 1138
markrad 0:cdf462088d13 1139 /*
markrad 0:cdf462088d13 1140 * SSLv2 Client Hello relevant renegotiation security checks
markrad 0:cdf462088d13 1141 */
markrad 0:cdf462088d13 1142 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
markrad 0:cdf462088d13 1143 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
markrad 0:cdf462088d13 1144 {
markrad 0:cdf462088d13 1145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Jasper Wallace 2:bbdeda018a3c 1146 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1147 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 1148 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1149 }
markrad 0:cdf462088d13 1150
markrad 0:cdf462088d13 1151 ssl->in_left = 0;
markrad 0:cdf462088d13 1152 ssl->state++;
markrad 0:cdf462088d13 1153
markrad 0:cdf462088d13 1154 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
markrad 0:cdf462088d13 1155
markrad 0:cdf462088d13 1156 return( 0 );
markrad 0:cdf462088d13 1157 }
markrad 0:cdf462088d13 1158 #endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
markrad 0:cdf462088d13 1159
Jasper Wallace 2:bbdeda018a3c 1160 /* This function doesn't alert on errors that happen early during
Jasper Wallace 2:bbdeda018a3c 1161 ClientHello parsing because they might indicate that the client is
Jasper Wallace 2:bbdeda018a3c 1162 not talking SSL/TLS at all and would not understand our alert. */
markrad 0:cdf462088d13 1163 static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 1164 {
markrad 0:cdf462088d13 1165 int ret, got_common_suite;
markrad 0:cdf462088d13 1166 size_t i, j;
markrad 0:cdf462088d13 1167 size_t ciph_offset, comp_offset, ext_offset;
markrad 0:cdf462088d13 1168 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
markrad 0:cdf462088d13 1169 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1170 size_t cookie_offset, cookie_len;
markrad 0:cdf462088d13 1171 #endif
markrad 0:cdf462088d13 1172 unsigned char *buf, *p, *ext;
markrad 0:cdf462088d13 1173 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1174 int renegotiation_info_seen = 0;
markrad 0:cdf462088d13 1175 #endif
markrad 0:cdf462088d13 1176 int handshake_failure = 0;
markrad 0:cdf462088d13 1177 const int *ciphersuites;
markrad 0:cdf462088d13 1178 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
markrad 0:cdf462088d13 1179 int major, minor;
markrad 0:cdf462088d13 1180
Jasper Wallace 2:bbdeda018a3c 1181 /* If there is no signature-algorithm extension present,
Jasper Wallace 2:bbdeda018a3c 1182 * we need to fall back to the default values for allowed
Jasper Wallace 2:bbdeda018a3c 1183 * signature-hash pairs. */
Jasper Wallace 2:bbdeda018a3c 1184 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Jasper Wallace 2:bbdeda018a3c 1185 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Jasper Wallace 2:bbdeda018a3c 1186 int sig_hash_alg_ext_present = 0;
Jasper Wallace 2:bbdeda018a3c 1187 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Jasper Wallace 2:bbdeda018a3c 1188 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Jasper Wallace 2:bbdeda018a3c 1189
markrad 0:cdf462088d13 1190 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
markrad 0:cdf462088d13 1191
markrad 0:cdf462088d13 1192 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
markrad 0:cdf462088d13 1193 read_record_header:
markrad 0:cdf462088d13 1194 #endif
markrad 0:cdf462088d13 1195 /*
markrad 0:cdf462088d13 1196 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
markrad 0:cdf462088d13 1197 * otherwise read it ourselves manually in order to support SSLv2
markrad 0:cdf462088d13 1198 * ClientHello, which doesn't use the same record layer format.
markrad 0:cdf462088d13 1199 */
markrad 0:cdf462088d13 1200 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1201 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 1202 #endif
markrad 0:cdf462088d13 1203 {
markrad 0:cdf462088d13 1204 if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
markrad 0:cdf462088d13 1205 {
Jasper Wallace 2:bbdeda018a3c 1206 /* No alert on a read error. */
markrad 0:cdf462088d13 1207 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
markrad 0:cdf462088d13 1208 return( ret );
markrad 0:cdf462088d13 1209 }
markrad 0:cdf462088d13 1210 }
markrad 0:cdf462088d13 1211
markrad 0:cdf462088d13 1212 buf = ssl->in_hdr;
markrad 0:cdf462088d13 1213
markrad 0:cdf462088d13 1214 #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
markrad 0:cdf462088d13 1215 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1216 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
markrad 0:cdf462088d13 1217 #endif
markrad 0:cdf462088d13 1218 if( ( buf[0] & 0x80 ) != 0 )
Jasper Wallace 2:bbdeda018a3c 1219 return( ssl_parse_client_hello_v2( ssl ) );
markrad 0:cdf462088d13 1220 #endif
markrad 0:cdf462088d13 1221
markrad 0:cdf462088d13 1222 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
markrad 0:cdf462088d13 1223
markrad 0:cdf462088d13 1224 /*
markrad 0:cdf462088d13 1225 * SSLv3/TLS Client Hello
markrad 0:cdf462088d13 1226 *
markrad 0:cdf462088d13 1227 * Record layer:
markrad 0:cdf462088d13 1228 * 0 . 0 message type
markrad 0:cdf462088d13 1229 * 1 . 2 protocol version
markrad 0:cdf462088d13 1230 * 3 . 11 DTLS: epoch + record sequence number
markrad 0:cdf462088d13 1231 * 3 . 4 message length
markrad 0:cdf462088d13 1232 */
markrad 0:cdf462088d13 1233 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
markrad 0:cdf462088d13 1234 buf[0] ) );
markrad 0:cdf462088d13 1235
markrad 0:cdf462088d13 1236 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 1237 {
markrad 0:cdf462088d13 1238 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1239 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1240 }
markrad 0:cdf462088d13 1241
markrad 0:cdf462088d13 1242 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
markrad 0:cdf462088d13 1243 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
markrad 0:cdf462088d13 1244
markrad 0:cdf462088d13 1245 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
markrad 0:cdf462088d13 1246 buf[1], buf[2] ) );
markrad 0:cdf462088d13 1247
markrad 0:cdf462088d13 1248 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
markrad 0:cdf462088d13 1249
markrad 0:cdf462088d13 1250 /* According to RFC 5246 Appendix E.1, the version here is typically
markrad 0:cdf462088d13 1251 * "{03,00}, the lowest version number supported by the client, [or] the
markrad 0:cdf462088d13 1252 * value of ClientHello.client_version", so the only meaningful check here
markrad 0:cdf462088d13 1253 * is the major version shouldn't be less than 3 */
markrad 0:cdf462088d13 1254 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
markrad 0:cdf462088d13 1255 {
markrad 0:cdf462088d13 1256 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1257 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1258 }
markrad 0:cdf462088d13 1259
markrad 0:cdf462088d13 1260 /* For DTLS if this is the initial handshake, remember the client sequence
markrad 0:cdf462088d13 1261 * number to use it in our next message (RFC 6347 4.2.1) */
markrad 0:cdf462088d13 1262 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1263 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
markrad 0:cdf462088d13 1264 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1265 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
markrad 0:cdf462088d13 1266 #endif
markrad 0:cdf462088d13 1267 )
markrad 0:cdf462088d13 1268 {
markrad 0:cdf462088d13 1269 /* Epoch should be 0 for initial handshakes */
markrad 0:cdf462088d13 1270 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
markrad 0:cdf462088d13 1271 {
markrad 0:cdf462088d13 1272 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1273 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1274 }
markrad 0:cdf462088d13 1275
markrad 0:cdf462088d13 1276 memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
markrad 0:cdf462088d13 1277
markrad 0:cdf462088d13 1278 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
markrad 0:cdf462088d13 1279 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
markrad 0:cdf462088d13 1280 {
markrad 0:cdf462088d13 1281 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
markrad 0:cdf462088d13 1282 ssl->next_record_offset = 0;
markrad 0:cdf462088d13 1283 ssl->in_left = 0;
markrad 0:cdf462088d13 1284 goto read_record_header;
markrad 0:cdf462088d13 1285 }
markrad 0:cdf462088d13 1286
markrad 0:cdf462088d13 1287 /* No MAC to check yet, so we can update right now */
markrad 0:cdf462088d13 1288 mbedtls_ssl_dtls_replay_update( ssl );
markrad 0:cdf462088d13 1289 #endif
markrad 0:cdf462088d13 1290 }
markrad 0:cdf462088d13 1291 #endif /* MBEDTLS_SSL_PROTO_DTLS */
markrad 0:cdf462088d13 1292
markrad 0:cdf462088d13 1293 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
markrad 0:cdf462088d13 1294
markrad 0:cdf462088d13 1295 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1296 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 1297 {
markrad 0:cdf462088d13 1298 /* Set by mbedtls_ssl_read_record() */
markrad 0:cdf462088d13 1299 msg_len = ssl->in_hslen;
markrad 0:cdf462088d13 1300 }
markrad 0:cdf462088d13 1301 else
markrad 0:cdf462088d13 1302 #endif
markrad 0:cdf462088d13 1303 {
markrad 0:cdf462088d13 1304 if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
markrad 0:cdf462088d13 1305 {
markrad 0:cdf462088d13 1306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1307 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1308 }
markrad 0:cdf462088d13 1309
Jasper Wallace 2:bbdeda018a3c 1310 if( ( ret = mbedtls_ssl_fetch_input( ssl,
Jasper Wallace 2:bbdeda018a3c 1311 mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
markrad 0:cdf462088d13 1312 {
markrad 0:cdf462088d13 1313 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
markrad 0:cdf462088d13 1314 return( ret );
markrad 0:cdf462088d13 1315 }
markrad 0:cdf462088d13 1316
markrad 0:cdf462088d13 1317 /* Done reading this record, get ready for the next one */
markrad 0:cdf462088d13 1318 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1319 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1320 ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
markrad 0:cdf462088d13 1321 else
markrad 0:cdf462088d13 1322 #endif
markrad 0:cdf462088d13 1323 ssl->in_left = 0;
markrad 0:cdf462088d13 1324 }
markrad 0:cdf462088d13 1325
markrad 0:cdf462088d13 1326 buf = ssl->in_msg;
markrad 0:cdf462088d13 1327
markrad 0:cdf462088d13 1328 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
markrad 0:cdf462088d13 1329
markrad 0:cdf462088d13 1330 ssl->handshake->update_checksum( ssl, buf, msg_len );
markrad 0:cdf462088d13 1331
markrad 0:cdf462088d13 1332 /*
markrad 0:cdf462088d13 1333 * Handshake layer:
markrad 0:cdf462088d13 1334 * 0 . 0 handshake type
markrad 0:cdf462088d13 1335 * 1 . 3 handshake length
markrad 0:cdf462088d13 1336 * 4 . 5 DTLS only: message seqence number
markrad 0:cdf462088d13 1337 * 6 . 8 DTLS only: fragment offset
markrad 0:cdf462088d13 1338 * 9 . 11 DTLS only: fragment length
markrad 0:cdf462088d13 1339 */
markrad 0:cdf462088d13 1340 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
markrad 0:cdf462088d13 1341 {
markrad 0:cdf462088d13 1342 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1343 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1344 }
markrad 0:cdf462088d13 1345
markrad 0:cdf462088d13 1346 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
markrad 0:cdf462088d13 1347
markrad 0:cdf462088d13 1348 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
markrad 0:cdf462088d13 1349 {
markrad 0:cdf462088d13 1350 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1351 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1352 }
markrad 0:cdf462088d13 1353
markrad 0:cdf462088d13 1354 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
markrad 0:cdf462088d13 1355 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
markrad 0:cdf462088d13 1356
markrad 0:cdf462088d13 1357 /* We don't support fragmentation of ClientHello (yet?) */
markrad 0:cdf462088d13 1358 if( buf[1] != 0 ||
markrad 0:cdf462088d13 1359 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
markrad 0:cdf462088d13 1360 {
markrad 0:cdf462088d13 1361 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1362 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1363 }
markrad 0:cdf462088d13 1364
markrad 0:cdf462088d13 1365 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1366 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1367 {
markrad 0:cdf462088d13 1368 /*
markrad 0:cdf462088d13 1369 * Copy the client's handshake message_seq on initial handshakes,
markrad 0:cdf462088d13 1370 * check sequence number on renego.
markrad 0:cdf462088d13 1371 */
markrad 0:cdf462088d13 1372 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1373 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
markrad 0:cdf462088d13 1374 {
markrad 0:cdf462088d13 1375 /* This couldn't be done in ssl_prepare_handshake_record() */
markrad 0:cdf462088d13 1376 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
markrad 0:cdf462088d13 1377 ssl->in_msg[5];
markrad 0:cdf462088d13 1378
markrad 0:cdf462088d13 1379 if( cli_msg_seq != ssl->handshake->in_msg_seq )
markrad 0:cdf462088d13 1380 {
markrad 0:cdf462088d13 1381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
markrad 0:cdf462088d13 1382 "%d (expected %d)", cli_msg_seq,
markrad 0:cdf462088d13 1383 ssl->handshake->in_msg_seq ) );
markrad 0:cdf462088d13 1384 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1385 }
markrad 0:cdf462088d13 1386
markrad 0:cdf462088d13 1387 ssl->handshake->in_msg_seq++;
markrad 0:cdf462088d13 1388 }
markrad 0:cdf462088d13 1389 else
markrad 0:cdf462088d13 1390 #endif
markrad 0:cdf462088d13 1391 {
markrad 0:cdf462088d13 1392 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
markrad 0:cdf462088d13 1393 ssl->in_msg[5];
markrad 0:cdf462088d13 1394 ssl->handshake->out_msg_seq = cli_msg_seq;
markrad 0:cdf462088d13 1395 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
markrad 0:cdf462088d13 1396 }
markrad 0:cdf462088d13 1397
markrad 0:cdf462088d13 1398 /*
markrad 0:cdf462088d13 1399 * For now we don't support fragmentation, so make sure
markrad 0:cdf462088d13 1400 * fragment_offset == 0 and fragment_length == length
markrad 0:cdf462088d13 1401 */
markrad 0:cdf462088d13 1402 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
markrad 0:cdf462088d13 1403 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
markrad 0:cdf462088d13 1404 {
markrad 0:cdf462088d13 1405 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
markrad 0:cdf462088d13 1406 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
markrad 0:cdf462088d13 1407 }
markrad 0:cdf462088d13 1408 }
markrad 0:cdf462088d13 1409 #endif /* MBEDTLS_SSL_PROTO_DTLS */
markrad 0:cdf462088d13 1410
markrad 0:cdf462088d13 1411 buf += mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 1412 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 1413
markrad 0:cdf462088d13 1414 /*
markrad 0:cdf462088d13 1415 * ClientHello layer:
markrad 0:cdf462088d13 1416 * 0 . 1 protocol version
markrad 0:cdf462088d13 1417 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
markrad 0:cdf462088d13 1418 * 34 . 35 session id length (1 byte)
markrad 0:cdf462088d13 1419 * 35 . 34+x session id
markrad 0:cdf462088d13 1420 * 35+x . 35+x DTLS only: cookie length (1 byte)
markrad 0:cdf462088d13 1421 * 36+x . .. DTLS only: cookie
markrad 0:cdf462088d13 1422 * .. . .. ciphersuite list length (2 bytes)
markrad 0:cdf462088d13 1423 * .. . .. ciphersuite list
markrad 0:cdf462088d13 1424 * .. . .. compression alg. list length (1 byte)
markrad 0:cdf462088d13 1425 * .. . .. compression alg. list
markrad 0:cdf462088d13 1426 * .. . .. extensions length (2 bytes, optional)
markrad 0:cdf462088d13 1427 * .. . .. extensions (optional)
markrad 0:cdf462088d13 1428 */
markrad 0:cdf462088d13 1429
markrad 0:cdf462088d13 1430 /*
markrad 0:cdf462088d13 1431 * Minimal length (with everything empty and extensions ommitted) is
markrad 0:cdf462088d13 1432 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
markrad 0:cdf462088d13 1433 * read at least up to session id length without worrying.
markrad 0:cdf462088d13 1434 */
markrad 0:cdf462088d13 1435 if( msg_len < 38 )
markrad 0:cdf462088d13 1436 {
markrad 0:cdf462088d13 1437 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1438 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1439 }
markrad 0:cdf462088d13 1440
markrad 0:cdf462088d13 1441 /*
markrad 0:cdf462088d13 1442 * Check and save the protocol version
markrad 0:cdf462088d13 1443 */
markrad 0:cdf462088d13 1444 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
markrad 0:cdf462088d13 1445
markrad 0:cdf462088d13 1446 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
markrad 0:cdf462088d13 1447 ssl->conf->transport, buf );
markrad 0:cdf462088d13 1448
markrad 0:cdf462088d13 1449 ssl->handshake->max_major_ver = ssl->major_ver;
markrad 0:cdf462088d13 1450 ssl->handshake->max_minor_ver = ssl->minor_ver;
markrad 0:cdf462088d13 1451
markrad 0:cdf462088d13 1452 if( ssl->major_ver < ssl->conf->min_major_ver ||
markrad 0:cdf462088d13 1453 ssl->minor_ver < ssl->conf->min_minor_ver )
markrad 0:cdf462088d13 1454 {
markrad 0:cdf462088d13 1455 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
markrad 0:cdf462088d13 1456 " [%d:%d] < [%d:%d]",
markrad 0:cdf462088d13 1457 ssl->major_ver, ssl->minor_ver,
markrad 0:cdf462088d13 1458 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
markrad 0:cdf462088d13 1459 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 1460 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1461 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1462 }
markrad 0:cdf462088d13 1463
markrad 0:cdf462088d13 1464 if( ssl->major_ver > ssl->conf->max_major_ver )
markrad 0:cdf462088d13 1465 {
markrad 0:cdf462088d13 1466 ssl->major_ver = ssl->conf->max_major_ver;
markrad 0:cdf462088d13 1467 ssl->minor_ver = ssl->conf->max_minor_ver;
markrad 0:cdf462088d13 1468 }
markrad 0:cdf462088d13 1469 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
markrad 0:cdf462088d13 1470 ssl->minor_ver = ssl->conf->max_minor_ver;
markrad 0:cdf462088d13 1471
markrad 0:cdf462088d13 1472 /*
markrad 0:cdf462088d13 1473 * Save client random (inc. Unix time)
markrad 0:cdf462088d13 1474 */
markrad 0:cdf462088d13 1475 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
markrad 0:cdf462088d13 1476
markrad 0:cdf462088d13 1477 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
markrad 0:cdf462088d13 1478
markrad 0:cdf462088d13 1479 /*
markrad 0:cdf462088d13 1480 * Check the session ID length and save session ID
markrad 0:cdf462088d13 1481 */
markrad 0:cdf462088d13 1482 sess_len = buf[34];
markrad 0:cdf462088d13 1483
markrad 0:cdf462088d13 1484 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
markrad 0:cdf462088d13 1485 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
markrad 0:cdf462088d13 1486 {
markrad 0:cdf462088d13 1487 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1488 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1489 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1490 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1491 }
markrad 0:cdf462088d13 1492
markrad 0:cdf462088d13 1493 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
markrad 0:cdf462088d13 1494
markrad 0:cdf462088d13 1495 ssl->session_negotiate->id_len = sess_len;
markrad 0:cdf462088d13 1496 memset( ssl->session_negotiate->id, 0,
markrad 0:cdf462088d13 1497 sizeof( ssl->session_negotiate->id ) );
markrad 0:cdf462088d13 1498 memcpy( ssl->session_negotiate->id, buf + 35,
markrad 0:cdf462088d13 1499 ssl->session_negotiate->id_len );
markrad 0:cdf462088d13 1500
markrad 0:cdf462088d13 1501 /*
markrad 0:cdf462088d13 1502 * Check the cookie length and content
markrad 0:cdf462088d13 1503 */
markrad 0:cdf462088d13 1504 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1505 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1506 {
markrad 0:cdf462088d13 1507 cookie_offset = 35 + sess_len;
markrad 0:cdf462088d13 1508 cookie_len = buf[cookie_offset];
markrad 0:cdf462088d13 1509
markrad 0:cdf462088d13 1510 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
markrad 0:cdf462088d13 1511 {
markrad 0:cdf462088d13 1512 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1513 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1514 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
markrad 0:cdf462088d13 1515 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1516 }
markrad 0:cdf462088d13 1517
markrad 0:cdf462088d13 1518 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
markrad 0:cdf462088d13 1519 buf + cookie_offset + 1, cookie_len );
markrad 0:cdf462088d13 1520
markrad 0:cdf462088d13 1521 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
markrad 0:cdf462088d13 1522 if( ssl->conf->f_cookie_check != NULL
markrad 0:cdf462088d13 1523 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1524 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
markrad 0:cdf462088d13 1525 #endif
markrad 0:cdf462088d13 1526 )
markrad 0:cdf462088d13 1527 {
markrad 0:cdf462088d13 1528 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
markrad 0:cdf462088d13 1529 buf + cookie_offset + 1, cookie_len,
markrad 0:cdf462088d13 1530 ssl->cli_id, ssl->cli_id_len ) != 0 )
markrad 0:cdf462088d13 1531 {
markrad 0:cdf462088d13 1532 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
markrad 0:cdf462088d13 1533 ssl->handshake->verify_cookie_len = 1;
markrad 0:cdf462088d13 1534 }
markrad 0:cdf462088d13 1535 else
markrad 0:cdf462088d13 1536 {
markrad 0:cdf462088d13 1537 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
markrad 0:cdf462088d13 1538 ssl->handshake->verify_cookie_len = 0;
markrad 0:cdf462088d13 1539 }
markrad 0:cdf462088d13 1540 }
markrad 0:cdf462088d13 1541 else
markrad 0:cdf462088d13 1542 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
markrad 0:cdf462088d13 1543 {
markrad 0:cdf462088d13 1544 /* We know we didn't send a cookie, so it should be empty */
markrad 0:cdf462088d13 1545 if( cookie_len != 0 )
markrad 0:cdf462088d13 1546 {
Jasper Wallace 2:bbdeda018a3c 1547 /* This may be an attacker's probe, so don't send an alert */
markrad 0:cdf462088d13 1548 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
markrad 0:cdf462088d13 1549 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1550 }
markrad 0:cdf462088d13 1551
markrad 0:cdf462088d13 1552 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
markrad 0:cdf462088d13 1553 }
markrad 0:cdf462088d13 1554
markrad 0:cdf462088d13 1555 /*
markrad 0:cdf462088d13 1556 * Check the ciphersuitelist length (will be parsed later)
markrad 0:cdf462088d13 1557 */
markrad 0:cdf462088d13 1558 ciph_offset = cookie_offset + 1 + cookie_len;
markrad 0:cdf462088d13 1559 }
markrad 0:cdf462088d13 1560 else
markrad 0:cdf462088d13 1561 #endif /* MBEDTLS_SSL_PROTO_DTLS */
markrad 0:cdf462088d13 1562 ciph_offset = 35 + sess_len;
markrad 0:cdf462088d13 1563
markrad 0:cdf462088d13 1564 ciph_len = ( buf[ciph_offset + 0] << 8 )
markrad 0:cdf462088d13 1565 | ( buf[ciph_offset + 1] );
markrad 0:cdf462088d13 1566
markrad 0:cdf462088d13 1567 if( ciph_len < 2 ||
markrad 0:cdf462088d13 1568 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
markrad 0:cdf462088d13 1569 ( ciph_len % 2 ) != 0 )
markrad 0:cdf462088d13 1570 {
markrad 0:cdf462088d13 1571 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1572 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1573 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1574 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1575 }
markrad 0:cdf462088d13 1576
markrad 0:cdf462088d13 1577 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
markrad 0:cdf462088d13 1578 buf + ciph_offset + 2, ciph_len );
markrad 0:cdf462088d13 1579
markrad 0:cdf462088d13 1580 /*
markrad 0:cdf462088d13 1581 * Check the compression algorithms length and pick one
markrad 0:cdf462088d13 1582 */
markrad 0:cdf462088d13 1583 comp_offset = ciph_offset + 2 + ciph_len;
markrad 0:cdf462088d13 1584
markrad 0:cdf462088d13 1585 comp_len = buf[comp_offset];
markrad 0:cdf462088d13 1586
markrad 0:cdf462088d13 1587 if( comp_len < 1 ||
markrad 0:cdf462088d13 1588 comp_len > 16 ||
markrad 0:cdf462088d13 1589 comp_len + comp_offset + 1 > msg_len )
markrad 0:cdf462088d13 1590 {
markrad 0:cdf462088d13 1591 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1592 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1593 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1594 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1595 }
markrad 0:cdf462088d13 1596
markrad 0:cdf462088d13 1597 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
markrad 0:cdf462088d13 1598 buf + comp_offset + 1, comp_len );
markrad 0:cdf462088d13 1599
markrad 0:cdf462088d13 1600 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
markrad 0:cdf462088d13 1601 #if defined(MBEDTLS_ZLIB_SUPPORT)
markrad 0:cdf462088d13 1602 for( i = 0; i < comp_len; ++i )
markrad 0:cdf462088d13 1603 {
markrad 0:cdf462088d13 1604 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
markrad 0:cdf462088d13 1605 {
markrad 0:cdf462088d13 1606 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
markrad 0:cdf462088d13 1607 break;
markrad 0:cdf462088d13 1608 }
markrad 0:cdf462088d13 1609 }
markrad 0:cdf462088d13 1610 #endif
markrad 0:cdf462088d13 1611
markrad 0:cdf462088d13 1612 /* See comments in ssl_write_client_hello() */
markrad 0:cdf462088d13 1613 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1614 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1615 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
markrad 0:cdf462088d13 1616 #endif
markrad 0:cdf462088d13 1617
markrad 0:cdf462088d13 1618 /* Do not parse the extensions if the protocol is SSLv3 */
markrad 0:cdf462088d13 1619 #if defined(MBEDTLS_SSL_PROTO_SSL3)
markrad 0:cdf462088d13 1620 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
markrad 0:cdf462088d13 1621 {
markrad 0:cdf462088d13 1622 #endif
markrad 0:cdf462088d13 1623 /*
markrad 0:cdf462088d13 1624 * Check the extension length
markrad 0:cdf462088d13 1625 */
markrad 0:cdf462088d13 1626 ext_offset = comp_offset + 1 + comp_len;
markrad 0:cdf462088d13 1627 if( msg_len > ext_offset )
markrad 0:cdf462088d13 1628 {
markrad 0:cdf462088d13 1629 if( msg_len < ext_offset + 2 )
markrad 0:cdf462088d13 1630 {
markrad 0:cdf462088d13 1631 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1632 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1633 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1634 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1635 }
markrad 0:cdf462088d13 1636
markrad 0:cdf462088d13 1637 ext_len = ( buf[ext_offset + 0] << 8 )
markrad 0:cdf462088d13 1638 | ( buf[ext_offset + 1] );
markrad 0:cdf462088d13 1639
markrad 0:cdf462088d13 1640 if( ( ext_len > 0 && ext_len < 4 ) ||
markrad 0:cdf462088d13 1641 msg_len != ext_offset + 2 + ext_len )
markrad 0:cdf462088d13 1642 {
markrad 0:cdf462088d13 1643 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1644 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1645 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1646 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1647 }
markrad 0:cdf462088d13 1648 }
markrad 0:cdf462088d13 1649 else
markrad 0:cdf462088d13 1650 ext_len = 0;
markrad 0:cdf462088d13 1651
markrad 0:cdf462088d13 1652 ext = buf + ext_offset + 2;
markrad 0:cdf462088d13 1653 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
markrad 0:cdf462088d13 1654
markrad 0:cdf462088d13 1655 while( ext_len != 0 )
markrad 0:cdf462088d13 1656 {
markrad 0:cdf462088d13 1657 unsigned int ext_id = ( ( ext[0] << 8 )
markrad 0:cdf462088d13 1658 | ( ext[1] ) );
markrad 0:cdf462088d13 1659 unsigned int ext_size = ( ( ext[2] << 8 )
markrad 0:cdf462088d13 1660 | ( ext[3] ) );
markrad 0:cdf462088d13 1661
markrad 0:cdf462088d13 1662 if( ext_size + 4 > ext_len )
markrad 0:cdf462088d13 1663 {
markrad 0:cdf462088d13 1664 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1665 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1666 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1667 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1668 }
markrad 0:cdf462088d13 1669 switch( ext_id )
markrad 0:cdf462088d13 1670 {
markrad 0:cdf462088d13 1671 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
markrad 0:cdf462088d13 1672 case MBEDTLS_TLS_EXT_SERVERNAME:
markrad 0:cdf462088d13 1673 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
markrad 0:cdf462088d13 1674 if( ssl->conf->f_sni == NULL )
markrad 0:cdf462088d13 1675 break;
markrad 0:cdf462088d13 1676
markrad 0:cdf462088d13 1677 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1678 if( ret != 0 )
markrad 0:cdf462088d13 1679 return( ret );
markrad 0:cdf462088d13 1680 break;
markrad 0:cdf462088d13 1681 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
markrad 0:cdf462088d13 1682
markrad 0:cdf462088d13 1683 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
markrad 0:cdf462088d13 1684 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
markrad 0:cdf462088d13 1685 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1686 renegotiation_info_seen = 1;
markrad 0:cdf462088d13 1687 #endif
markrad 0:cdf462088d13 1688
markrad 0:cdf462088d13 1689 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1690 if( ret != 0 )
markrad 0:cdf462088d13 1691 return( ret );
markrad 0:cdf462088d13 1692 break;
markrad 0:cdf462088d13 1693
markrad 0:cdf462088d13 1694 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
markrad 0:cdf462088d13 1695 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
markrad 0:cdf462088d13 1696 case MBEDTLS_TLS_EXT_SIG_ALG:
markrad 0:cdf462088d13 1697 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
markrad 0:cdf462088d13 1698 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1699 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
markrad 0:cdf462088d13 1700 break;
markrad 0:cdf462088d13 1701 #endif
markrad 0:cdf462088d13 1702 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1703 if( ret != 0 )
markrad 0:cdf462088d13 1704 return( ret );
Jasper Wallace 2:bbdeda018a3c 1705
Jasper Wallace 2:bbdeda018a3c 1706 sig_hash_alg_ext_present = 1;
markrad 0:cdf462088d13 1707 break;
markrad 0:cdf462088d13 1708 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
markrad 0:cdf462088d13 1709 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
markrad 0:cdf462088d13 1710
markrad 0:cdf462088d13 1711 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 1712 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1713 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
markrad 0:cdf462088d13 1714 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
markrad 0:cdf462088d13 1715
markrad 0:cdf462088d13 1716 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1717 if( ret != 0 )
markrad 0:cdf462088d13 1718 return( ret );
markrad 0:cdf462088d13 1719 break;
markrad 0:cdf462088d13 1720
markrad 0:cdf462088d13 1721 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
markrad 0:cdf462088d13 1722 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
markrad 0:cdf462088d13 1723 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
markrad 0:cdf462088d13 1724
markrad 0:cdf462088d13 1725 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1726 if( ret != 0 )
markrad 0:cdf462088d13 1727 return( ret );
markrad 0:cdf462088d13 1728 break;
markrad 0:cdf462088d13 1729 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
markrad 0:cdf462088d13 1730 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 1731
markrad 0:cdf462088d13 1732 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 1733 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
markrad 0:cdf462088d13 1734 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
markrad 0:cdf462088d13 1735
markrad 0:cdf462088d13 1736 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1737 if( ret != 0 )
markrad 0:cdf462088d13 1738 return( ret );
markrad 0:cdf462088d13 1739 break;
markrad 0:cdf462088d13 1740 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 1741
markrad 0:cdf462088d13 1742 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 1743 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
markrad 0:cdf462088d13 1744 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
markrad 0:cdf462088d13 1745
markrad 0:cdf462088d13 1746 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1747 if( ret != 0 )
markrad 0:cdf462088d13 1748 return( ret );
markrad 0:cdf462088d13 1749 break;
markrad 0:cdf462088d13 1750 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
markrad 0:cdf462088d13 1751
markrad 0:cdf462088d13 1752 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 1753 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
markrad 0:cdf462088d13 1754 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
markrad 0:cdf462088d13 1755
markrad 0:cdf462088d13 1756 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1757 if( ret != 0 )
markrad 0:cdf462088d13 1758 return( ret );
markrad 0:cdf462088d13 1759 break;
markrad 0:cdf462088d13 1760 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
markrad 0:cdf462088d13 1761
markrad 0:cdf462088d13 1762 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 1763 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
markrad 0:cdf462088d13 1764 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
markrad 0:cdf462088d13 1765
markrad 0:cdf462088d13 1766 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1767 if( ret != 0 )
markrad 0:cdf462088d13 1768 return( ret );
markrad 0:cdf462088d13 1769 break;
markrad 0:cdf462088d13 1770 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
markrad 0:cdf462088d13 1771
markrad 0:cdf462088d13 1772 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 1773 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
markrad 0:cdf462088d13 1774 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
markrad 0:cdf462088d13 1775
markrad 0:cdf462088d13 1776 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1777 if( ret != 0 )
markrad 0:cdf462088d13 1778 return( ret );
markrad 0:cdf462088d13 1779 break;
markrad 0:cdf462088d13 1780 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
markrad 0:cdf462088d13 1781
markrad 0:cdf462088d13 1782 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 1783 case MBEDTLS_TLS_EXT_SESSION_TICKET:
markrad 0:cdf462088d13 1784 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
markrad 0:cdf462088d13 1785
markrad 0:cdf462088d13 1786 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1787 if( ret != 0 )
markrad 0:cdf462088d13 1788 return( ret );
markrad 0:cdf462088d13 1789 break;
markrad 0:cdf462088d13 1790 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 1791
markrad 0:cdf462088d13 1792 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 1793 case MBEDTLS_TLS_EXT_ALPN:
markrad 0:cdf462088d13 1794 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
markrad 0:cdf462088d13 1795
markrad 0:cdf462088d13 1796 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
markrad 0:cdf462088d13 1797 if( ret != 0 )
markrad 0:cdf462088d13 1798 return( ret );
markrad 0:cdf462088d13 1799 break;
markrad 0:cdf462088d13 1800 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 1801
markrad 0:cdf462088d13 1802 default:
markrad 0:cdf462088d13 1803 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
markrad 0:cdf462088d13 1804 ext_id ) );
markrad 0:cdf462088d13 1805 }
markrad 0:cdf462088d13 1806
markrad 0:cdf462088d13 1807 ext_len -= 4 + ext_size;
markrad 0:cdf462088d13 1808 ext += 4 + ext_size;
markrad 0:cdf462088d13 1809
markrad 0:cdf462088d13 1810 if( ext_len > 0 && ext_len < 4 )
markrad 0:cdf462088d13 1811 {
markrad 0:cdf462088d13 1812 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Jasper Wallace 2:bbdeda018a3c 1813 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1814 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
markrad 0:cdf462088d13 1815 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1816 }
markrad 0:cdf462088d13 1817 }
markrad 0:cdf462088d13 1818 #if defined(MBEDTLS_SSL_PROTO_SSL3)
markrad 0:cdf462088d13 1819 }
markrad 0:cdf462088d13 1820 #endif
markrad 0:cdf462088d13 1821
markrad 0:cdf462088d13 1822 #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Jasper Wallace 2:bbdeda018a3c 1823 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
markrad 0:cdf462088d13 1824 {
markrad 0:cdf462088d13 1825 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
markrad 0:cdf462088d13 1826 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
markrad 0:cdf462088d13 1827 {
markrad 0:cdf462088d13 1828 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
markrad 0:cdf462088d13 1829
markrad 0:cdf462088d13 1830 if( ssl->minor_ver < ssl->conf->max_minor_ver )
markrad 0:cdf462088d13 1831 {
markrad 0:cdf462088d13 1832 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
markrad 0:cdf462088d13 1833
markrad 0:cdf462088d13 1834 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
markrad 0:cdf462088d13 1835 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
markrad 0:cdf462088d13 1836
markrad 0:cdf462088d13 1837 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1838 }
markrad 0:cdf462088d13 1839
markrad 0:cdf462088d13 1840 break;
markrad 0:cdf462088d13 1841 }
markrad 0:cdf462088d13 1842 }
markrad 0:cdf462088d13 1843 #endif /* MBEDTLS_SSL_FALLBACK_SCSV */
markrad 0:cdf462088d13 1844
Jasper Wallace 2:bbdeda018a3c 1845 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Jasper Wallace 2:bbdeda018a3c 1846 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Jasper Wallace 2:bbdeda018a3c 1847
Jasper Wallace 2:bbdeda018a3c 1848 /*
Jasper Wallace 2:bbdeda018a3c 1849 * Try to fall back to default hash SHA1 if the client
Jasper Wallace 2:bbdeda018a3c 1850 * hasn't provided any preferred signature-hash combinations.
Jasper Wallace 2:bbdeda018a3c 1851 */
Jasper Wallace 2:bbdeda018a3c 1852 if( sig_hash_alg_ext_present == 0 )
Jasper Wallace 2:bbdeda018a3c 1853 {
Jasper Wallace 2:bbdeda018a3c 1854 mbedtls_md_type_t md_default = MBEDTLS_MD_SHA1;
Jasper Wallace 2:bbdeda018a3c 1855
Jasper Wallace 2:bbdeda018a3c 1856 if( mbedtls_ssl_check_sig_hash( ssl, md_default ) != 0 )
Jasper Wallace 2:bbdeda018a3c 1857 md_default = MBEDTLS_MD_NONE;
Jasper Wallace 2:bbdeda018a3c 1858
Jasper Wallace 2:bbdeda018a3c 1859 mbedtls_ssl_sig_hash_set_const_hash( &ssl->handshake->hash_algs, md_default );
Jasper Wallace 2:bbdeda018a3c 1860 }
Jasper Wallace 2:bbdeda018a3c 1861
Jasper Wallace 2:bbdeda018a3c 1862 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Jasper Wallace 2:bbdeda018a3c 1863 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Jasper Wallace 2:bbdeda018a3c 1864
markrad 0:cdf462088d13 1865 /*
markrad 0:cdf462088d13 1866 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
markrad 0:cdf462088d13 1867 */
markrad 0:cdf462088d13 1868 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
markrad 0:cdf462088d13 1869 {
markrad 0:cdf462088d13 1870 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
markrad 0:cdf462088d13 1871 {
markrad 0:cdf462088d13 1872 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
markrad 0:cdf462088d13 1873 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1874 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
markrad 0:cdf462088d13 1875 {
Jasper Wallace 2:bbdeda018a3c 1876 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Jasper Wallace 2:bbdeda018a3c 1877 "during renegotiation" ) );
Jasper Wallace 2:bbdeda018a3c 1878 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1879 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 1880 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1881 }
markrad 0:cdf462088d13 1882 #endif
markrad 0:cdf462088d13 1883 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
markrad 0:cdf462088d13 1884 break;
markrad 0:cdf462088d13 1885 }
markrad 0:cdf462088d13 1886 }
markrad 0:cdf462088d13 1887
markrad 0:cdf462088d13 1888 /*
markrad 0:cdf462088d13 1889 * Renegotiation security checks
markrad 0:cdf462088d13 1890 */
markrad 0:cdf462088d13 1891 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
markrad 0:cdf462088d13 1892 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
markrad 0:cdf462088d13 1893 {
markrad 0:cdf462088d13 1894 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
markrad 0:cdf462088d13 1895 handshake_failure = 1;
markrad 0:cdf462088d13 1896 }
markrad 0:cdf462088d13 1897 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 1898 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
markrad 0:cdf462088d13 1899 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
markrad 0:cdf462088d13 1900 renegotiation_info_seen == 0 )
markrad 0:cdf462088d13 1901 {
markrad 0:cdf462088d13 1902 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
markrad 0:cdf462088d13 1903 handshake_failure = 1;
markrad 0:cdf462088d13 1904 }
markrad 0:cdf462088d13 1905 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
markrad 0:cdf462088d13 1906 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
markrad 0:cdf462088d13 1907 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
markrad 0:cdf462088d13 1908 {
markrad 0:cdf462088d13 1909 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
markrad 0:cdf462088d13 1910 handshake_failure = 1;
markrad 0:cdf462088d13 1911 }
markrad 0:cdf462088d13 1912 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
markrad 0:cdf462088d13 1913 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
markrad 0:cdf462088d13 1914 renegotiation_info_seen == 1 )
markrad 0:cdf462088d13 1915 {
markrad 0:cdf462088d13 1916 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
markrad 0:cdf462088d13 1917 handshake_failure = 1;
markrad 0:cdf462088d13 1918 }
markrad 0:cdf462088d13 1919 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 1920
markrad 0:cdf462088d13 1921 if( handshake_failure == 1 )
markrad 0:cdf462088d13 1922 {
Jasper Wallace 2:bbdeda018a3c 1923 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1924 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 1925 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
markrad 0:cdf462088d13 1926 }
markrad 0:cdf462088d13 1927
markrad 0:cdf462088d13 1928 /*
markrad 0:cdf462088d13 1929 * Search for a matching ciphersuite
markrad 0:cdf462088d13 1930 * (At the end because we need information from the EC-based extensions
markrad 0:cdf462088d13 1931 * and certificate from the SNI callback triggered by the SNI extension.)
markrad 0:cdf462088d13 1932 */
markrad 0:cdf462088d13 1933 got_common_suite = 0;
markrad 0:cdf462088d13 1934 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
markrad 0:cdf462088d13 1935 ciphersuite_info = NULL;
markrad 0:cdf462088d13 1936 #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
markrad 0:cdf462088d13 1937 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
markrad 0:cdf462088d13 1938 for( i = 0; ciphersuites[i] != 0; i++ )
markrad 0:cdf462088d13 1939 #else
markrad 0:cdf462088d13 1940 for( i = 0; ciphersuites[i] != 0; i++ )
markrad 0:cdf462088d13 1941 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
markrad 0:cdf462088d13 1942 #endif
markrad 0:cdf462088d13 1943 {
markrad 0:cdf462088d13 1944 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
markrad 0:cdf462088d13 1945 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
markrad 0:cdf462088d13 1946 continue;
markrad 0:cdf462088d13 1947
markrad 0:cdf462088d13 1948 got_common_suite = 1;
markrad 0:cdf462088d13 1949
markrad 0:cdf462088d13 1950 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
markrad 0:cdf462088d13 1951 &ciphersuite_info ) ) != 0 )
markrad 0:cdf462088d13 1952 return( ret );
markrad 0:cdf462088d13 1953
markrad 0:cdf462088d13 1954 if( ciphersuite_info != NULL )
markrad 0:cdf462088d13 1955 goto have_ciphersuite;
markrad 0:cdf462088d13 1956 }
markrad 0:cdf462088d13 1957
markrad 0:cdf462088d13 1958 if( got_common_suite )
markrad 0:cdf462088d13 1959 {
markrad 0:cdf462088d13 1960 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
markrad 0:cdf462088d13 1961 "but none of them usable" ) );
Jasper Wallace 2:bbdeda018a3c 1962 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1963 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 1964 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
markrad 0:cdf462088d13 1965 }
markrad 0:cdf462088d13 1966 else
markrad 0:cdf462088d13 1967 {
markrad 0:cdf462088d13 1968 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Jasper Wallace 2:bbdeda018a3c 1969 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 1970 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
markrad 0:cdf462088d13 1971 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
markrad 0:cdf462088d13 1972 }
markrad 0:cdf462088d13 1973
markrad 0:cdf462088d13 1974 have_ciphersuite:
markrad 0:cdf462088d13 1975 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
markrad 0:cdf462088d13 1976
markrad 0:cdf462088d13 1977 ssl->session_negotiate->ciphersuite = ciphersuites[i];
markrad 0:cdf462088d13 1978 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
markrad 0:cdf462088d13 1979
markrad 0:cdf462088d13 1980 ssl->state++;
markrad 0:cdf462088d13 1981
markrad 0:cdf462088d13 1982 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 1983 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 1984 mbedtls_ssl_recv_flight_completed( ssl );
markrad 0:cdf462088d13 1985 #endif
markrad 0:cdf462088d13 1986
Jasper Wallace 2:bbdeda018a3c 1987 /* Debugging-only output for testsuite */
Jasper Wallace 2:bbdeda018a3c 1988 #if defined(MBEDTLS_DEBUG_C) && \
Jasper Wallace 2:bbdeda018a3c 1989 defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Jasper Wallace 2:bbdeda018a3c 1990 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Jasper Wallace 2:bbdeda018a3c 1991 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Jasper Wallace 2:bbdeda018a3c 1992 {
Jasper Wallace 2:bbdeda018a3c 1993 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg( ciphersuite_info );
Jasper Wallace 2:bbdeda018a3c 1994 if( sig_alg != MBEDTLS_PK_NONE )
Jasper Wallace 2:bbdeda018a3c 1995 {
Jasper Wallace 2:bbdeda018a3c 1996 mbedtls_md_type_t md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
Jasper Wallace 2:bbdeda018a3c 1997 sig_alg );
Jasper Wallace 2:bbdeda018a3c 1998 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
Jasper Wallace 2:bbdeda018a3c 1999 mbedtls_ssl_hash_from_md_alg( md_alg ) ) );
Jasper Wallace 2:bbdeda018a3c 2000 }
Jasper Wallace 2:bbdeda018a3c 2001 else
Jasper Wallace 2:bbdeda018a3c 2002 {
Jasper Wallace 2:bbdeda018a3c 2003 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm "
Jasper Wallace 2:bbdeda018a3c 2004 "%d - should not happen", sig_alg ) );
Jasper Wallace 2:bbdeda018a3c 2005 }
Jasper Wallace 2:bbdeda018a3c 2006 }
Jasper Wallace 2:bbdeda018a3c 2007 #endif
Jasper Wallace 2:bbdeda018a3c 2008
markrad 0:cdf462088d13 2009 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
markrad 0:cdf462088d13 2010
markrad 0:cdf462088d13 2011 return( 0 );
markrad 0:cdf462088d13 2012 }
markrad 0:cdf462088d13 2013
markrad 0:cdf462088d13 2014 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 2015 static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2016 unsigned char *buf,
markrad 0:cdf462088d13 2017 size_t *olen )
markrad 0:cdf462088d13 2018 {
markrad 0:cdf462088d13 2019 unsigned char *p = buf;
markrad 0:cdf462088d13 2020
markrad 0:cdf462088d13 2021 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
markrad 0:cdf462088d13 2022 {
markrad 0:cdf462088d13 2023 *olen = 0;
markrad 0:cdf462088d13 2024 return;
markrad 0:cdf462088d13 2025 }
markrad 0:cdf462088d13 2026
markrad 0:cdf462088d13 2027 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
markrad 0:cdf462088d13 2028
markrad 0:cdf462088d13 2029 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2030 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
markrad 0:cdf462088d13 2031
markrad 0:cdf462088d13 2032 *p++ = 0x00;
markrad 0:cdf462088d13 2033 *p++ = 0x00;
markrad 0:cdf462088d13 2034
markrad 0:cdf462088d13 2035 *olen = 4;
markrad 0:cdf462088d13 2036 }
markrad 0:cdf462088d13 2037 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
markrad 0:cdf462088d13 2038
markrad 0:cdf462088d13 2039 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 2040 static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2041 unsigned char *buf,
markrad 0:cdf462088d13 2042 size_t *olen )
markrad 0:cdf462088d13 2043 {
markrad 0:cdf462088d13 2044 unsigned char *p = buf;
markrad 0:cdf462088d13 2045 const mbedtls_ssl_ciphersuite_t *suite = NULL;
markrad 0:cdf462088d13 2046 const mbedtls_cipher_info_t *cipher = NULL;
markrad 0:cdf462088d13 2047
markrad 0:cdf462088d13 2048 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
markrad 0:cdf462088d13 2049 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 2050 {
markrad 0:cdf462088d13 2051 *olen = 0;
markrad 0:cdf462088d13 2052 return;
markrad 0:cdf462088d13 2053 }
markrad 0:cdf462088d13 2054
markrad 0:cdf462088d13 2055 /*
markrad 0:cdf462088d13 2056 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
markrad 0:cdf462088d13 2057 * from a client and then selects a stream or Authenticated Encryption
markrad 0:cdf462088d13 2058 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
markrad 0:cdf462088d13 2059 * encrypt-then-MAC response extension back to the client."
markrad 0:cdf462088d13 2060 */
markrad 0:cdf462088d13 2061 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
markrad 0:cdf462088d13 2062 ssl->session_negotiate->ciphersuite ) ) == NULL ||
markrad 0:cdf462088d13 2063 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
markrad 0:cdf462088d13 2064 cipher->mode != MBEDTLS_MODE_CBC )
markrad 0:cdf462088d13 2065 {
markrad 0:cdf462088d13 2066 *olen = 0;
markrad 0:cdf462088d13 2067 return;
markrad 0:cdf462088d13 2068 }
markrad 0:cdf462088d13 2069
markrad 0:cdf462088d13 2070 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
markrad 0:cdf462088d13 2071
markrad 0:cdf462088d13 2072 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2073 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
markrad 0:cdf462088d13 2074
markrad 0:cdf462088d13 2075 *p++ = 0x00;
markrad 0:cdf462088d13 2076 *p++ = 0x00;
markrad 0:cdf462088d13 2077
markrad 0:cdf462088d13 2078 *olen = 4;
markrad 0:cdf462088d13 2079 }
markrad 0:cdf462088d13 2080 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
markrad 0:cdf462088d13 2081
markrad 0:cdf462088d13 2082 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 2083 static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2084 unsigned char *buf,
markrad 0:cdf462088d13 2085 size_t *olen )
markrad 0:cdf462088d13 2086 {
markrad 0:cdf462088d13 2087 unsigned char *p = buf;
markrad 0:cdf462088d13 2088
markrad 0:cdf462088d13 2089 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
markrad 0:cdf462088d13 2090 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 2091 {
markrad 0:cdf462088d13 2092 *olen = 0;
markrad 0:cdf462088d13 2093 return;
markrad 0:cdf462088d13 2094 }
markrad 0:cdf462088d13 2095
markrad 0:cdf462088d13 2096 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
markrad 0:cdf462088d13 2097 "extension" ) );
markrad 0:cdf462088d13 2098
markrad 0:cdf462088d13 2099 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2100 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
markrad 0:cdf462088d13 2101
markrad 0:cdf462088d13 2102 *p++ = 0x00;
markrad 0:cdf462088d13 2103 *p++ = 0x00;
markrad 0:cdf462088d13 2104
markrad 0:cdf462088d13 2105 *olen = 4;
markrad 0:cdf462088d13 2106 }
markrad 0:cdf462088d13 2107 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
markrad 0:cdf462088d13 2108
markrad 0:cdf462088d13 2109 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 2110 static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2111 unsigned char *buf,
markrad 0:cdf462088d13 2112 size_t *olen )
markrad 0:cdf462088d13 2113 {
markrad 0:cdf462088d13 2114 unsigned char *p = buf;
markrad 0:cdf462088d13 2115
markrad 0:cdf462088d13 2116 if( ssl->handshake->new_session_ticket == 0 )
markrad 0:cdf462088d13 2117 {
markrad 0:cdf462088d13 2118 *olen = 0;
markrad 0:cdf462088d13 2119 return;
markrad 0:cdf462088d13 2120 }
markrad 0:cdf462088d13 2121
markrad 0:cdf462088d13 2122 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
markrad 0:cdf462088d13 2123
markrad 0:cdf462088d13 2124 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2125 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
markrad 0:cdf462088d13 2126
markrad 0:cdf462088d13 2127 *p++ = 0x00;
markrad 0:cdf462088d13 2128 *p++ = 0x00;
markrad 0:cdf462088d13 2129
markrad 0:cdf462088d13 2130 *olen = 4;
markrad 0:cdf462088d13 2131 }
markrad 0:cdf462088d13 2132 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 2133
markrad 0:cdf462088d13 2134 static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2135 unsigned char *buf,
markrad 0:cdf462088d13 2136 size_t *olen )
markrad 0:cdf462088d13 2137 {
markrad 0:cdf462088d13 2138 unsigned char *p = buf;
markrad 0:cdf462088d13 2139
markrad 0:cdf462088d13 2140 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
markrad 0:cdf462088d13 2141 {
markrad 0:cdf462088d13 2142 *olen = 0;
markrad 0:cdf462088d13 2143 return;
markrad 0:cdf462088d13 2144 }
markrad 0:cdf462088d13 2145
markrad 0:cdf462088d13 2146 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
markrad 0:cdf462088d13 2147
markrad 0:cdf462088d13 2148 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2149 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
markrad 0:cdf462088d13 2150
markrad 0:cdf462088d13 2151 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 2152 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
markrad 0:cdf462088d13 2153 {
markrad 0:cdf462088d13 2154 *p++ = 0x00;
markrad 0:cdf462088d13 2155 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
markrad 0:cdf462088d13 2156 *p++ = ssl->verify_data_len * 2 & 0xFF;
markrad 0:cdf462088d13 2157
markrad 0:cdf462088d13 2158 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
markrad 0:cdf462088d13 2159 p += ssl->verify_data_len;
markrad 0:cdf462088d13 2160 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
markrad 0:cdf462088d13 2161 p += ssl->verify_data_len;
markrad 0:cdf462088d13 2162 }
markrad 0:cdf462088d13 2163 else
markrad 0:cdf462088d13 2164 #endif /* MBEDTLS_SSL_RENEGOTIATION */
markrad 0:cdf462088d13 2165 {
markrad 0:cdf462088d13 2166 *p++ = 0x00;
markrad 0:cdf462088d13 2167 *p++ = 0x01;
markrad 0:cdf462088d13 2168 *p++ = 0x00;
markrad 0:cdf462088d13 2169 }
markrad 0:cdf462088d13 2170
markrad 0:cdf462088d13 2171 *olen = p - buf;
markrad 0:cdf462088d13 2172 }
markrad 0:cdf462088d13 2173
markrad 0:cdf462088d13 2174 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 2175 static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2176 unsigned char *buf,
markrad 0:cdf462088d13 2177 size_t *olen )
markrad 0:cdf462088d13 2178 {
markrad 0:cdf462088d13 2179 unsigned char *p = buf;
markrad 0:cdf462088d13 2180
markrad 0:cdf462088d13 2181 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
markrad 0:cdf462088d13 2182 {
markrad 0:cdf462088d13 2183 *olen = 0;
markrad 0:cdf462088d13 2184 return;
markrad 0:cdf462088d13 2185 }
markrad 0:cdf462088d13 2186
markrad 0:cdf462088d13 2187 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
markrad 0:cdf462088d13 2188
markrad 0:cdf462088d13 2189 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2190 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
markrad 0:cdf462088d13 2191
markrad 0:cdf462088d13 2192 *p++ = 0x00;
markrad 0:cdf462088d13 2193 *p++ = 1;
markrad 0:cdf462088d13 2194
markrad 0:cdf462088d13 2195 *p++ = ssl->session_negotiate->mfl_code;
markrad 0:cdf462088d13 2196
markrad 0:cdf462088d13 2197 *olen = 5;
markrad 0:cdf462088d13 2198 }
markrad 0:cdf462088d13 2199 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
markrad 0:cdf462088d13 2200
markrad 0:cdf462088d13 2201 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 2202 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2203 static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2204 unsigned char *buf,
markrad 0:cdf462088d13 2205 size_t *olen )
markrad 0:cdf462088d13 2206 {
markrad 0:cdf462088d13 2207 unsigned char *p = buf;
markrad 0:cdf462088d13 2208 ((void) ssl);
markrad 0:cdf462088d13 2209
markrad 0:cdf462088d13 2210 if( ( ssl->handshake->cli_exts &
markrad 0:cdf462088d13 2211 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
markrad 0:cdf462088d13 2212 {
markrad 0:cdf462088d13 2213 *olen = 0;
markrad 0:cdf462088d13 2214 return;
markrad 0:cdf462088d13 2215 }
markrad 0:cdf462088d13 2216
markrad 0:cdf462088d13 2217 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
markrad 0:cdf462088d13 2218
markrad 0:cdf462088d13 2219 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2220 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
markrad 0:cdf462088d13 2221
markrad 0:cdf462088d13 2222 *p++ = 0x00;
markrad 0:cdf462088d13 2223 *p++ = 2;
markrad 0:cdf462088d13 2224
markrad 0:cdf462088d13 2225 *p++ = 1;
markrad 0:cdf462088d13 2226 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
markrad 0:cdf462088d13 2227
markrad 0:cdf462088d13 2228 *olen = 6;
markrad 0:cdf462088d13 2229 }
markrad 0:cdf462088d13 2230 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 2231
markrad 0:cdf462088d13 2232 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2233 static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2234 unsigned char *buf,
markrad 0:cdf462088d13 2235 size_t *olen )
markrad 0:cdf462088d13 2236 {
markrad 0:cdf462088d13 2237 int ret;
markrad 0:cdf462088d13 2238 unsigned char *p = buf;
markrad 0:cdf462088d13 2239 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 2240 size_t kkpp_len;
markrad 0:cdf462088d13 2241
markrad 0:cdf462088d13 2242 *olen = 0;
markrad 0:cdf462088d13 2243
markrad 0:cdf462088d13 2244 /* Skip costly computation if not needed */
markrad 0:cdf462088d13 2245 if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
markrad 0:cdf462088d13 2246 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2247 return;
markrad 0:cdf462088d13 2248
markrad 0:cdf462088d13 2249 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
markrad 0:cdf462088d13 2250
markrad 0:cdf462088d13 2251 if( end - p < 4 )
markrad 0:cdf462088d13 2252 {
markrad 0:cdf462088d13 2253 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
markrad 0:cdf462088d13 2254 return;
markrad 0:cdf462088d13 2255 }
markrad 0:cdf462088d13 2256
markrad 0:cdf462088d13 2257 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2258 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
markrad 0:cdf462088d13 2259
markrad 0:cdf462088d13 2260 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 2261 p + 2, end - p - 2, &kkpp_len,
markrad 0:cdf462088d13 2262 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2263 if( ret != 0 )
markrad 0:cdf462088d13 2264 {
markrad 0:cdf462088d13 2265 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
markrad 0:cdf462088d13 2266 return;
markrad 0:cdf462088d13 2267 }
markrad 0:cdf462088d13 2268
markrad 0:cdf462088d13 2269 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2270 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
markrad 0:cdf462088d13 2271
markrad 0:cdf462088d13 2272 *olen = kkpp_len + 4;
markrad 0:cdf462088d13 2273 }
markrad 0:cdf462088d13 2274 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 2275
markrad 0:cdf462088d13 2276 #if defined(MBEDTLS_SSL_ALPN )
markrad 0:cdf462088d13 2277 static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 2278 unsigned char *buf, size_t *olen )
markrad 0:cdf462088d13 2279 {
markrad 0:cdf462088d13 2280 if( ssl->alpn_chosen == NULL )
markrad 0:cdf462088d13 2281 {
markrad 0:cdf462088d13 2282 *olen = 0;
markrad 0:cdf462088d13 2283 return;
markrad 0:cdf462088d13 2284 }
markrad 0:cdf462088d13 2285
markrad 0:cdf462088d13 2286 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
markrad 0:cdf462088d13 2287
markrad 0:cdf462088d13 2288 /*
markrad 0:cdf462088d13 2289 * 0 . 1 ext identifier
markrad 0:cdf462088d13 2290 * 2 . 3 ext length
markrad 0:cdf462088d13 2291 * 4 . 5 protocol list length
markrad 0:cdf462088d13 2292 * 6 . 6 protocol name length
markrad 0:cdf462088d13 2293 * 7 . 7+n protocol name
markrad 0:cdf462088d13 2294 */
markrad 0:cdf462088d13 2295 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2296 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
markrad 0:cdf462088d13 2297
markrad 0:cdf462088d13 2298 *olen = 7 + strlen( ssl->alpn_chosen );
markrad 0:cdf462088d13 2299
markrad 0:cdf462088d13 2300 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2301 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
markrad 0:cdf462088d13 2302
markrad 0:cdf462088d13 2303 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2304 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
markrad 0:cdf462088d13 2305
markrad 0:cdf462088d13 2306 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
markrad 0:cdf462088d13 2307
markrad 0:cdf462088d13 2308 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
markrad 0:cdf462088d13 2309 }
markrad 0:cdf462088d13 2310 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
markrad 0:cdf462088d13 2311
markrad 0:cdf462088d13 2312 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
markrad 0:cdf462088d13 2313 static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2314 {
markrad 0:cdf462088d13 2315 int ret;
markrad 0:cdf462088d13 2316 unsigned char *p = ssl->out_msg + 4;
markrad 0:cdf462088d13 2317 unsigned char *cookie_len_byte;
markrad 0:cdf462088d13 2318
markrad 0:cdf462088d13 2319 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
markrad 0:cdf462088d13 2320
markrad 0:cdf462088d13 2321 /*
markrad 0:cdf462088d13 2322 * struct {
markrad 0:cdf462088d13 2323 * ProtocolVersion server_version;
markrad 0:cdf462088d13 2324 * opaque cookie<0..2^8-1>;
markrad 0:cdf462088d13 2325 * } HelloVerifyRequest;
markrad 0:cdf462088d13 2326 */
markrad 0:cdf462088d13 2327
markrad 0:cdf462088d13 2328 /* The RFC is not clear on this point, but sending the actual negotiated
markrad 0:cdf462088d13 2329 * version looks like the most interoperable thing to do. */
markrad 0:cdf462088d13 2330 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
markrad 0:cdf462088d13 2331 ssl->conf->transport, p );
markrad 0:cdf462088d13 2332 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
markrad 0:cdf462088d13 2333 p += 2;
markrad 0:cdf462088d13 2334
markrad 0:cdf462088d13 2335 /* If we get here, f_cookie_check is not null */
markrad 0:cdf462088d13 2336 if( ssl->conf->f_cookie_write == NULL )
markrad 0:cdf462088d13 2337 {
markrad 0:cdf462088d13 2338 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
markrad 0:cdf462088d13 2339 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2340 }
markrad 0:cdf462088d13 2341
markrad 0:cdf462088d13 2342 /* Skip length byte until we know the length */
markrad 0:cdf462088d13 2343 cookie_len_byte = p++;
markrad 0:cdf462088d13 2344
markrad 0:cdf462088d13 2345 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
markrad 0:cdf462088d13 2346 &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
markrad 0:cdf462088d13 2347 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
markrad 0:cdf462088d13 2348 {
markrad 0:cdf462088d13 2349 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
markrad 0:cdf462088d13 2350 return( ret );
markrad 0:cdf462088d13 2351 }
markrad 0:cdf462088d13 2352
markrad 0:cdf462088d13 2353 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
markrad 0:cdf462088d13 2354
markrad 0:cdf462088d13 2355 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
markrad 0:cdf462088d13 2356
markrad 0:cdf462088d13 2357 ssl->out_msglen = p - ssl->out_msg;
markrad 0:cdf462088d13 2358 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 2359 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
markrad 0:cdf462088d13 2360
markrad 0:cdf462088d13 2361 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
markrad 0:cdf462088d13 2362
markrad 0:cdf462088d13 2363 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 2364 {
markrad 0:cdf462088d13 2365 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 2366 return( ret );
markrad 0:cdf462088d13 2367 }
markrad 0:cdf462088d13 2368
markrad 0:cdf462088d13 2369 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
markrad 0:cdf462088d13 2370
markrad 0:cdf462088d13 2371 return( 0 );
markrad 0:cdf462088d13 2372 }
markrad 0:cdf462088d13 2373 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
markrad 0:cdf462088d13 2374
markrad 0:cdf462088d13 2375 static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2376 {
markrad 0:cdf462088d13 2377 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 2378 mbedtls_time_t t;
markrad 0:cdf462088d13 2379 #endif
markrad 0:cdf462088d13 2380 int ret;
markrad 0:cdf462088d13 2381 size_t olen, ext_len = 0, n;
markrad 0:cdf462088d13 2382 unsigned char *buf, *p;
markrad 0:cdf462088d13 2383
markrad 0:cdf462088d13 2384 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
markrad 0:cdf462088d13 2385
markrad 0:cdf462088d13 2386 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
markrad 0:cdf462088d13 2387 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
markrad 0:cdf462088d13 2388 ssl->handshake->verify_cookie_len != 0 )
markrad 0:cdf462088d13 2389 {
markrad 0:cdf462088d13 2390 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
markrad 0:cdf462088d13 2391 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
markrad 0:cdf462088d13 2392
markrad 0:cdf462088d13 2393 return( ssl_write_hello_verify_request( ssl ) );
markrad 0:cdf462088d13 2394 }
markrad 0:cdf462088d13 2395 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
markrad 0:cdf462088d13 2396
markrad 0:cdf462088d13 2397 if( ssl->conf->f_rng == NULL )
markrad 0:cdf462088d13 2398 {
markrad 0:cdf462088d13 2399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
markrad 0:cdf462088d13 2400 return( MBEDTLS_ERR_SSL_NO_RNG );
markrad 0:cdf462088d13 2401 }
markrad 0:cdf462088d13 2402
markrad 0:cdf462088d13 2403 /*
markrad 0:cdf462088d13 2404 * 0 . 0 handshake type
markrad 0:cdf462088d13 2405 * 1 . 3 handshake length
markrad 0:cdf462088d13 2406 * 4 . 5 protocol version
markrad 0:cdf462088d13 2407 * 6 . 9 UNIX time()
markrad 0:cdf462088d13 2408 * 10 . 37 random bytes
markrad 0:cdf462088d13 2409 */
markrad 0:cdf462088d13 2410 buf = ssl->out_msg;
markrad 0:cdf462088d13 2411 p = buf + 4;
markrad 0:cdf462088d13 2412
markrad 0:cdf462088d13 2413 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
markrad 0:cdf462088d13 2414 ssl->conf->transport, p );
markrad 0:cdf462088d13 2415 p += 2;
markrad 0:cdf462088d13 2416
markrad 0:cdf462088d13 2417 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
markrad 0:cdf462088d13 2418 buf[4], buf[5] ) );
markrad 0:cdf462088d13 2419
markrad 0:cdf462088d13 2420 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 2421 t = mbedtls_time( NULL );
markrad 0:cdf462088d13 2422 *p++ = (unsigned char)( t >> 24 );
markrad 0:cdf462088d13 2423 *p++ = (unsigned char)( t >> 16 );
markrad 0:cdf462088d13 2424 *p++ = (unsigned char)( t >> 8 );
markrad 0:cdf462088d13 2425 *p++ = (unsigned char)( t );
markrad 0:cdf462088d13 2426
markrad 0:cdf462088d13 2427 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
markrad 0:cdf462088d13 2428 #else
markrad 0:cdf462088d13 2429 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
markrad 0:cdf462088d13 2430 return( ret );
markrad 0:cdf462088d13 2431
markrad 0:cdf462088d13 2432 p += 4;
markrad 0:cdf462088d13 2433 #endif /* MBEDTLS_HAVE_TIME */
markrad 0:cdf462088d13 2434
markrad 0:cdf462088d13 2435 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
markrad 0:cdf462088d13 2436 return( ret );
markrad 0:cdf462088d13 2437
markrad 0:cdf462088d13 2438 p += 28;
markrad 0:cdf462088d13 2439
markrad 0:cdf462088d13 2440 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
markrad 0:cdf462088d13 2441
markrad 0:cdf462088d13 2442 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
markrad 0:cdf462088d13 2443
markrad 0:cdf462088d13 2444 /*
markrad 0:cdf462088d13 2445 * Resume is 0 by default, see ssl_handshake_init().
markrad 0:cdf462088d13 2446 * It may be already set to 1 by ssl_parse_session_ticket_ext().
markrad 0:cdf462088d13 2447 * If not, try looking up session ID in our cache.
markrad 0:cdf462088d13 2448 */
markrad 0:cdf462088d13 2449 if( ssl->handshake->resume == 0 &&
markrad 0:cdf462088d13 2450 #if defined(MBEDTLS_SSL_RENEGOTIATION)
markrad 0:cdf462088d13 2451 ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
markrad 0:cdf462088d13 2452 #endif
markrad 0:cdf462088d13 2453 ssl->session_negotiate->id_len != 0 &&
markrad 0:cdf462088d13 2454 ssl->conf->f_get_cache != NULL &&
markrad 0:cdf462088d13 2455 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
markrad 0:cdf462088d13 2456 {
markrad 0:cdf462088d13 2457 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
markrad 0:cdf462088d13 2458 ssl->handshake->resume = 1;
markrad 0:cdf462088d13 2459 }
markrad 0:cdf462088d13 2460
markrad 0:cdf462088d13 2461 if( ssl->handshake->resume == 0 )
markrad 0:cdf462088d13 2462 {
markrad 0:cdf462088d13 2463 /*
markrad 0:cdf462088d13 2464 * New session, create a new session id,
markrad 0:cdf462088d13 2465 * unless we're about to issue a session ticket
markrad 0:cdf462088d13 2466 */
markrad 0:cdf462088d13 2467 ssl->state++;
markrad 0:cdf462088d13 2468
markrad 0:cdf462088d13 2469 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 2470 ssl->session_negotiate->start = mbedtls_time( NULL );
markrad 0:cdf462088d13 2471 #endif
markrad 0:cdf462088d13 2472
markrad 0:cdf462088d13 2473 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 2474 if( ssl->handshake->new_session_ticket != 0 )
markrad 0:cdf462088d13 2475 {
markrad 0:cdf462088d13 2476 ssl->session_negotiate->id_len = n = 0;
markrad 0:cdf462088d13 2477 memset( ssl->session_negotiate->id, 0, 32 );
markrad 0:cdf462088d13 2478 }
markrad 0:cdf462088d13 2479 else
markrad 0:cdf462088d13 2480 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 2481 {
markrad 0:cdf462088d13 2482 ssl->session_negotiate->id_len = n = 32;
markrad 0:cdf462088d13 2483 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
markrad 0:cdf462088d13 2484 n ) ) != 0 )
markrad 0:cdf462088d13 2485 return( ret );
markrad 0:cdf462088d13 2486 }
markrad 0:cdf462088d13 2487 }
markrad 0:cdf462088d13 2488 else
markrad 0:cdf462088d13 2489 {
markrad 0:cdf462088d13 2490 /*
markrad 0:cdf462088d13 2491 * Resuming a session
markrad 0:cdf462088d13 2492 */
markrad 0:cdf462088d13 2493 n = ssl->session_negotiate->id_len;
markrad 0:cdf462088d13 2494 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
markrad 0:cdf462088d13 2495
markrad 0:cdf462088d13 2496 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
markrad 0:cdf462088d13 2497 {
markrad 0:cdf462088d13 2498 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
markrad 0:cdf462088d13 2499 return( ret );
markrad 0:cdf462088d13 2500 }
markrad 0:cdf462088d13 2501 }
markrad 0:cdf462088d13 2502
markrad 0:cdf462088d13 2503 /*
markrad 0:cdf462088d13 2504 * 38 . 38 session id length
markrad 0:cdf462088d13 2505 * 39 . 38+n session id
markrad 0:cdf462088d13 2506 * 39+n . 40+n chosen ciphersuite
markrad 0:cdf462088d13 2507 * 41+n . 41+n chosen compression alg.
markrad 0:cdf462088d13 2508 * 42+n . 43+n extensions length
markrad 0:cdf462088d13 2509 * 44+n . 43+n+m extensions
markrad 0:cdf462088d13 2510 */
markrad 0:cdf462088d13 2511 *p++ = (unsigned char) ssl->session_negotiate->id_len;
markrad 0:cdf462088d13 2512 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
markrad 0:cdf462088d13 2513 p += ssl->session_negotiate->id_len;
markrad 0:cdf462088d13 2514
markrad 0:cdf462088d13 2515 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
markrad 0:cdf462088d13 2516 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
markrad 0:cdf462088d13 2517 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
markrad 0:cdf462088d13 2518 ssl->handshake->resume ? "a" : "no" ) );
markrad 0:cdf462088d13 2519
markrad 0:cdf462088d13 2520 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
markrad 0:cdf462088d13 2521 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
markrad 0:cdf462088d13 2522 *p++ = (unsigned char)( ssl->session_negotiate->compression );
markrad 0:cdf462088d13 2523
markrad 0:cdf462088d13 2524 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
markrad 0:cdf462088d13 2525 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
markrad 0:cdf462088d13 2526 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
markrad 0:cdf462088d13 2527 ssl->session_negotiate->compression ) );
markrad 0:cdf462088d13 2528
markrad 0:cdf462088d13 2529 /* Do not write the extensions if the protocol is SSLv3 */
markrad 0:cdf462088d13 2530 #if defined(MBEDTLS_SSL_PROTO_SSL3)
markrad 0:cdf462088d13 2531 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
markrad 0:cdf462088d13 2532 {
markrad 0:cdf462088d13 2533 #endif
markrad 0:cdf462088d13 2534
markrad 0:cdf462088d13 2535 /*
markrad 0:cdf462088d13 2536 * First write extensions, then the total length
markrad 0:cdf462088d13 2537 */
markrad 0:cdf462088d13 2538 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2539 ext_len += olen;
markrad 0:cdf462088d13 2540
markrad 0:cdf462088d13 2541 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
markrad 0:cdf462088d13 2542 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2543 ext_len += olen;
markrad 0:cdf462088d13 2544 #endif
markrad 0:cdf462088d13 2545
markrad 0:cdf462088d13 2546 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
markrad 0:cdf462088d13 2547 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2548 ext_len += olen;
markrad 0:cdf462088d13 2549 #endif
markrad 0:cdf462088d13 2550
markrad 0:cdf462088d13 2551 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
markrad 0:cdf462088d13 2552 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2553 ext_len += olen;
markrad 0:cdf462088d13 2554 #endif
markrad 0:cdf462088d13 2555
markrad 0:cdf462088d13 2556 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
markrad 0:cdf462088d13 2557 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2558 ext_len += olen;
markrad 0:cdf462088d13 2559 #endif
markrad 0:cdf462088d13 2560
markrad 0:cdf462088d13 2561 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 2562 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2563 ext_len += olen;
markrad 0:cdf462088d13 2564 #endif
markrad 0:cdf462088d13 2565
markrad 0:cdf462088d13 2566 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
markrad 0:cdf462088d13 2567 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2568 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2569 ext_len += olen;
markrad 0:cdf462088d13 2570 #endif
markrad 0:cdf462088d13 2571
markrad 0:cdf462088d13 2572 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2573 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2574 ext_len += olen;
markrad 0:cdf462088d13 2575 #endif
markrad 0:cdf462088d13 2576
markrad 0:cdf462088d13 2577 #if defined(MBEDTLS_SSL_ALPN)
markrad 0:cdf462088d13 2578 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
markrad 0:cdf462088d13 2579 ext_len += olen;
markrad 0:cdf462088d13 2580 #endif
markrad 0:cdf462088d13 2581
markrad 0:cdf462088d13 2582 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
markrad 0:cdf462088d13 2583
markrad 0:cdf462088d13 2584 if( ext_len > 0 )
markrad 0:cdf462088d13 2585 {
markrad 0:cdf462088d13 2586 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
markrad 0:cdf462088d13 2587 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
markrad 0:cdf462088d13 2588 p += ext_len;
markrad 0:cdf462088d13 2589 }
markrad 0:cdf462088d13 2590
markrad 0:cdf462088d13 2591 #if defined(MBEDTLS_SSL_PROTO_SSL3)
markrad 0:cdf462088d13 2592 }
markrad 0:cdf462088d13 2593 #endif
markrad 0:cdf462088d13 2594
markrad 0:cdf462088d13 2595 ssl->out_msglen = p - buf;
markrad 0:cdf462088d13 2596 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 2597 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
markrad 0:cdf462088d13 2598
markrad 0:cdf462088d13 2599 ret = mbedtls_ssl_write_record( ssl );
markrad 0:cdf462088d13 2600
markrad 0:cdf462088d13 2601 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
markrad 0:cdf462088d13 2602
markrad 0:cdf462088d13 2603 return( ret );
markrad 0:cdf462088d13 2604 }
markrad 0:cdf462088d13 2605
markrad 0:cdf462088d13 2606 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2607 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2608 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
markrad 0:cdf462088d13 2609 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 2610 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
markrad 0:cdf462088d13 2611 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 2612 static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2613 {
Jasper Wallace 2:bbdeda018a3c 2614 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Jasper Wallace 2:bbdeda018a3c 2615 ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2616
markrad 0:cdf462088d13 2617 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
markrad 0:cdf462088d13 2618
markrad 0:cdf462088d13 2619 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2620 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 2621 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2622 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 2623 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2624 {
markrad 0:cdf462088d13 2625 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
markrad 0:cdf462088d13 2626 ssl->state++;
markrad 0:cdf462088d13 2627 return( 0 );
markrad 0:cdf462088d13 2628 }
markrad 0:cdf462088d13 2629
markrad 0:cdf462088d13 2630 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 2631 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 2632 }
markrad 0:cdf462088d13 2633 #else
markrad 0:cdf462088d13 2634 static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2635 {
markrad 0:cdf462088d13 2636 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Jasper Wallace 2:bbdeda018a3c 2637 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Jasper Wallace 2:bbdeda018a3c 2638 ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2639 size_t dn_size, total_dn_size; /* excluding length bytes */
markrad 0:cdf462088d13 2640 size_t ct_len, sa_len; /* including length bytes */
markrad 0:cdf462088d13 2641 unsigned char *buf, *p;
markrad 0:cdf462088d13 2642 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 2643 const mbedtls_x509_crt *crt;
markrad 0:cdf462088d13 2644 int authmode;
markrad 0:cdf462088d13 2645
markrad 0:cdf462088d13 2646 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
markrad 0:cdf462088d13 2647
markrad 0:cdf462088d13 2648 ssl->state++;
markrad 0:cdf462088d13 2649
markrad 0:cdf462088d13 2650 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
markrad 0:cdf462088d13 2651 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
markrad 0:cdf462088d13 2652 authmode = ssl->handshake->sni_authmode;
markrad 0:cdf462088d13 2653 else
markrad 0:cdf462088d13 2654 #endif
markrad 0:cdf462088d13 2655 authmode = ssl->conf->authmode;
markrad 0:cdf462088d13 2656
markrad 0:cdf462088d13 2657 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 2658 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 2659 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2660 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 2661 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
markrad 0:cdf462088d13 2662 authmode == MBEDTLS_SSL_VERIFY_NONE )
markrad 0:cdf462088d13 2663 {
markrad 0:cdf462088d13 2664 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
markrad 0:cdf462088d13 2665 return( 0 );
markrad 0:cdf462088d13 2666 }
markrad 0:cdf462088d13 2667
markrad 0:cdf462088d13 2668 /*
markrad 0:cdf462088d13 2669 * 0 . 0 handshake type
markrad 0:cdf462088d13 2670 * 1 . 3 handshake length
markrad 0:cdf462088d13 2671 * 4 . 4 cert type count
markrad 0:cdf462088d13 2672 * 5 .. m-1 cert types
markrad 0:cdf462088d13 2673 * m .. m+1 sig alg length (TLS 1.2 only)
markrad 0:cdf462088d13 2674 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
markrad 0:cdf462088d13 2675 * n .. n+1 length of all DNs
markrad 0:cdf462088d13 2676 * n+2 .. n+3 length of DN 1
markrad 0:cdf462088d13 2677 * n+4 .. ... Distinguished Name #1
markrad 0:cdf462088d13 2678 * ... .. ... length of DN 2, etc.
markrad 0:cdf462088d13 2679 */
markrad 0:cdf462088d13 2680 buf = ssl->out_msg;
markrad 0:cdf462088d13 2681 p = buf + 4;
markrad 0:cdf462088d13 2682
markrad 0:cdf462088d13 2683 /*
markrad 0:cdf462088d13 2684 * Supported certificate types
markrad 0:cdf462088d13 2685 *
markrad 0:cdf462088d13 2686 * ClientCertificateType certificate_types<1..2^8-1>;
markrad 0:cdf462088d13 2687 * enum { (255) } ClientCertificateType;
markrad 0:cdf462088d13 2688 */
markrad 0:cdf462088d13 2689 ct_len = 0;
markrad 0:cdf462088d13 2690
markrad 0:cdf462088d13 2691 #if defined(MBEDTLS_RSA_C)
markrad 0:cdf462088d13 2692 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
markrad 0:cdf462088d13 2693 #endif
markrad 0:cdf462088d13 2694 #if defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 2695 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
markrad 0:cdf462088d13 2696 #endif
markrad 0:cdf462088d13 2697
markrad 0:cdf462088d13 2698 p[0] = (unsigned char) ct_len++;
markrad 0:cdf462088d13 2699 p += ct_len;
markrad 0:cdf462088d13 2700
markrad 0:cdf462088d13 2701 sa_len = 0;
markrad 0:cdf462088d13 2702 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 2703 /*
markrad 0:cdf462088d13 2704 * Add signature_algorithms for verify (TLS 1.2)
markrad 0:cdf462088d13 2705 *
markrad 0:cdf462088d13 2706 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
markrad 0:cdf462088d13 2707 *
markrad 0:cdf462088d13 2708 * struct {
markrad 0:cdf462088d13 2709 * HashAlgorithm hash;
markrad 0:cdf462088d13 2710 * SignatureAlgorithm signature;
markrad 0:cdf462088d13 2711 * } SignatureAndHashAlgorithm;
markrad 0:cdf462088d13 2712 *
markrad 0:cdf462088d13 2713 * enum { (255) } HashAlgorithm;
markrad 0:cdf462088d13 2714 * enum { (255) } SignatureAlgorithm;
markrad 0:cdf462088d13 2715 */
markrad 0:cdf462088d13 2716 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 2717 {
markrad 0:cdf462088d13 2718 const int *cur;
markrad 0:cdf462088d13 2719
markrad 0:cdf462088d13 2720 /*
markrad 0:cdf462088d13 2721 * Supported signature algorithms
markrad 0:cdf462088d13 2722 */
markrad 0:cdf462088d13 2723 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
markrad 0:cdf462088d13 2724 {
markrad 0:cdf462088d13 2725 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *cur );
markrad 0:cdf462088d13 2726
markrad 0:cdf462088d13 2727 if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
markrad 0:cdf462088d13 2728 continue;
markrad 0:cdf462088d13 2729
markrad 0:cdf462088d13 2730 #if defined(MBEDTLS_RSA_C)
markrad 0:cdf462088d13 2731 p[2 + sa_len++] = hash;
markrad 0:cdf462088d13 2732 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
markrad 0:cdf462088d13 2733 #endif
markrad 0:cdf462088d13 2734 #if defined(MBEDTLS_ECDSA_C)
markrad 0:cdf462088d13 2735 p[2 + sa_len++] = hash;
markrad 0:cdf462088d13 2736 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
markrad 0:cdf462088d13 2737 #endif
markrad 0:cdf462088d13 2738 }
markrad 0:cdf462088d13 2739
markrad 0:cdf462088d13 2740 p[0] = (unsigned char)( sa_len >> 8 );
markrad 0:cdf462088d13 2741 p[1] = (unsigned char)( sa_len );
markrad 0:cdf462088d13 2742 sa_len += 2;
markrad 0:cdf462088d13 2743 p += sa_len;
markrad 0:cdf462088d13 2744 }
markrad 0:cdf462088d13 2745 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 2746
markrad 0:cdf462088d13 2747 /*
markrad 0:cdf462088d13 2748 * DistinguishedName certificate_authorities<0..2^16-1>;
markrad 0:cdf462088d13 2749 * opaque DistinguishedName<1..2^16-1>;
markrad 0:cdf462088d13 2750 */
markrad 0:cdf462088d13 2751 p += 2;
markrad 0:cdf462088d13 2752
markrad 0:cdf462088d13 2753 total_dn_size = 0;
Jasper Wallace 2:bbdeda018a3c 2754
Jasper Wallace 2:bbdeda018a3c 2755 if( ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED )
markrad 0:cdf462088d13 2756 {
Jasper Wallace 2:bbdeda018a3c 2757 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Jasper Wallace 2:bbdeda018a3c 2758 if( ssl->handshake->sni_ca_chain != NULL )
Jasper Wallace 2:bbdeda018a3c 2759 crt = ssl->handshake->sni_ca_chain;
Jasper Wallace 2:bbdeda018a3c 2760 else
Jasper Wallace 2:bbdeda018a3c 2761 #endif
Jasper Wallace 2:bbdeda018a3c 2762 crt = ssl->conf->ca_chain;
Jasper Wallace 2:bbdeda018a3c 2763
Jasper Wallace 2:bbdeda018a3c 2764 while( crt != NULL && crt->version != 0 )
markrad 0:cdf462088d13 2765 {
Jasper Wallace 2:bbdeda018a3c 2766 dn_size = crt->subject_raw.len;
Jasper Wallace 2:bbdeda018a3c 2767
Jasper Wallace 2:bbdeda018a3c 2768 if( end < p ||
Jasper Wallace 2:bbdeda018a3c 2769 (size_t)( end - p ) < dn_size ||
Jasper Wallace 2:bbdeda018a3c 2770 (size_t)( end - p ) < 2 + dn_size )
Jasper Wallace 2:bbdeda018a3c 2771 {
Jasper Wallace 2:bbdeda018a3c 2772 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
Jasper Wallace 2:bbdeda018a3c 2773 break;
Jasper Wallace 2:bbdeda018a3c 2774 }
Jasper Wallace 2:bbdeda018a3c 2775
Jasper Wallace 2:bbdeda018a3c 2776 *p++ = (unsigned char)( dn_size >> 8 );
Jasper Wallace 2:bbdeda018a3c 2777 *p++ = (unsigned char)( dn_size );
Jasper Wallace 2:bbdeda018a3c 2778 memcpy( p, crt->subject_raw.p, dn_size );
Jasper Wallace 2:bbdeda018a3c 2779 p += dn_size;
Jasper Wallace 2:bbdeda018a3c 2780
Jasper Wallace 2:bbdeda018a3c 2781 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
Jasper Wallace 2:bbdeda018a3c 2782
Jasper Wallace 2:bbdeda018a3c 2783 total_dn_size += 2 + dn_size;
Jasper Wallace 2:bbdeda018a3c 2784 crt = crt->next;
markrad 0:cdf462088d13 2785 }
markrad 0:cdf462088d13 2786 }
markrad 0:cdf462088d13 2787
markrad 0:cdf462088d13 2788 ssl->out_msglen = p - buf;
markrad 0:cdf462088d13 2789 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 2790 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
markrad 0:cdf462088d13 2791 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
markrad 0:cdf462088d13 2792 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
markrad 0:cdf462088d13 2793
markrad 0:cdf462088d13 2794 ret = mbedtls_ssl_write_record( ssl );
markrad 0:cdf462088d13 2795
markrad 0:cdf462088d13 2796 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
markrad 0:cdf462088d13 2797
markrad 0:cdf462088d13 2798 return( ret );
markrad 0:cdf462088d13 2799 }
markrad 0:cdf462088d13 2800 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
markrad 0:cdf462088d13 2801 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
markrad 0:cdf462088d13 2802 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
markrad 0:cdf462088d13 2803 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
markrad 0:cdf462088d13 2804 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
markrad 0:cdf462088d13 2805 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 2806
markrad 0:cdf462088d13 2807 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
markrad 0:cdf462088d13 2808 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
markrad 0:cdf462088d13 2809 static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2810 {
markrad 0:cdf462088d13 2811 int ret;
markrad 0:cdf462088d13 2812
markrad 0:cdf462088d13 2813 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
markrad 0:cdf462088d13 2814 {
markrad 0:cdf462088d13 2815 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
markrad 0:cdf462088d13 2816 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
markrad 0:cdf462088d13 2817 }
markrad 0:cdf462088d13 2818
markrad 0:cdf462088d13 2819 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 2820 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
markrad 0:cdf462088d13 2821 MBEDTLS_ECDH_OURS ) ) != 0 )
markrad 0:cdf462088d13 2822 {
markrad 0:cdf462088d13 2823 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
markrad 0:cdf462088d13 2824 return( ret );
markrad 0:cdf462088d13 2825 }
markrad 0:cdf462088d13 2826
markrad 0:cdf462088d13 2827 return( 0 );
markrad 0:cdf462088d13 2828 }
markrad 0:cdf462088d13 2829 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
markrad 0:cdf462088d13 2830 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
markrad 0:cdf462088d13 2831
markrad 0:cdf462088d13 2832 static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 2833 {
markrad 0:cdf462088d13 2834 int ret;
markrad 0:cdf462088d13 2835 size_t n = 0;
markrad 0:cdf462088d13 2836 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
markrad 0:cdf462088d13 2837 ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 2838
Jasper Wallace 2:bbdeda018a3c 2839 #if defined(MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED)
markrad 0:cdf462088d13 2840 unsigned char *p = ssl->out_msg + 4;
Jasper Wallace 2:bbdeda018a3c 2841 size_t len;
Jasper Wallace 2:bbdeda018a3c 2842 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
markrad 0:cdf462088d13 2843 unsigned char *dig_signed = p;
Jasper Wallace 2:bbdeda018a3c 2844 size_t dig_signed_len = 0;
Jasper Wallace 2:bbdeda018a3c 2845 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Jasper Wallace 2:bbdeda018a3c 2846 #endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
markrad 0:cdf462088d13 2847
markrad 0:cdf462088d13 2848 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
markrad 0:cdf462088d13 2849
Jasper Wallace 2:bbdeda018a3c 2850 /*
Jasper Wallace 2:bbdeda018a3c 2851 *
Jasper Wallace 2:bbdeda018a3c 2852 * Part 1: Extract static ECDH parameters and abort
Jasper Wallace 2:bbdeda018a3c 2853 * if ServerKeyExchange not needed.
Jasper Wallace 2:bbdeda018a3c 2854 *
Jasper Wallace 2:bbdeda018a3c 2855 */
Jasper Wallace 2:bbdeda018a3c 2856
Jasper Wallace 2:bbdeda018a3c 2857 /* For suites involving ECDH, extract DH parameters
Jasper Wallace 2:bbdeda018a3c 2858 * from certificate at this point. */
Jasper Wallace 2:bbdeda018a3c 2859 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
Jasper Wallace 2:bbdeda018a3c 2860 if( mbedtls_ssl_ciphersuite_uses_ecdh( ciphersuite_info ) )
Jasper Wallace 2:bbdeda018a3c 2861 {
Jasper Wallace 2:bbdeda018a3c 2862 ssl_get_ecdh_params_from_cert( ssl );
Jasper Wallace 2:bbdeda018a3c 2863 }
Jasper Wallace 2:bbdeda018a3c 2864 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
Jasper Wallace 2:bbdeda018a3c 2865
Jasper Wallace 2:bbdeda018a3c 2866 /* Key exchanges not involving ephemeral keys don't use
Jasper Wallace 2:bbdeda018a3c 2867 * ServerKeyExchange, so end here. */
Jasper Wallace 2:bbdeda018a3c 2868 #if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
Jasper Wallace 2:bbdeda018a3c 2869 if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
markrad 0:cdf462088d13 2870 {
markrad 0:cdf462088d13 2871 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
markrad 0:cdf462088d13 2872 ssl->state++;
markrad 0:cdf462088d13 2873 return( 0 );
markrad 0:cdf462088d13 2874 }
Jasper Wallace 2:bbdeda018a3c 2875 #endif /* MBEDTLS_KEY_EXCHANGE__NON_PFS__ENABLED */
Jasper Wallace 2:bbdeda018a3c 2876
Jasper Wallace 2:bbdeda018a3c 2877 /*
Jasper Wallace 2:bbdeda018a3c 2878 *
Jasper Wallace 2:bbdeda018a3c 2879 * Part 2: Provide key exchange parameters for chosen ciphersuite.
Jasper Wallace 2:bbdeda018a3c 2880 *
Jasper Wallace 2:bbdeda018a3c 2881 */
Jasper Wallace 2:bbdeda018a3c 2882
Jasper Wallace 2:bbdeda018a3c 2883 /*
Jasper Wallace 2:bbdeda018a3c 2884 * - ECJPAKE key exchanges
Jasper Wallace 2:bbdeda018a3c 2885 */
markrad 0:cdf462088d13 2886 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 2887 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 2888 {
markrad 0:cdf462088d13 2889 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
markrad 0:cdf462088d13 2890
markrad 0:cdf462088d13 2891 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
Jasper Wallace 2:bbdeda018a3c 2892 p, end - p, &len, ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 2893 if( ret != 0 )
markrad 0:cdf462088d13 2894 {
markrad 0:cdf462088d13 2895 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
markrad 0:cdf462088d13 2896 return( ret );
markrad 0:cdf462088d13 2897 }
markrad 0:cdf462088d13 2898
Jasper Wallace 2:bbdeda018a3c 2899 p += len;
Jasper Wallace 2:bbdeda018a3c 2900 n += len;
markrad 0:cdf462088d13 2901 }
markrad 0:cdf462088d13 2902 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 2903
Jasper Wallace 2:bbdeda018a3c 2904 /*
Jasper Wallace 2:bbdeda018a3c 2905 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
Jasper Wallace 2:bbdeda018a3c 2906 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
Jasper Wallace 2:bbdeda018a3c 2907 * we use empty support identity hints here.
Jasper Wallace 2:bbdeda018a3c 2908 **/
Jasper Wallace 2:bbdeda018a3c 2909 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
markrad 0:cdf462088d13 2910 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
markrad 0:cdf462088d13 2911 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 2912 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
markrad 0:cdf462088d13 2913 {
markrad 0:cdf462088d13 2914 *(p++) = 0x00;
markrad 0:cdf462088d13 2915 *(p++) = 0x00;
markrad 0:cdf462088d13 2916
markrad 0:cdf462088d13 2917 n += 2;
markrad 0:cdf462088d13 2918 }
markrad 0:cdf462088d13 2919 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
markrad 0:cdf462088d13 2920 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
markrad 0:cdf462088d13 2921
Jasper Wallace 2:bbdeda018a3c 2922 /*
Jasper Wallace 2:bbdeda018a3c 2923 * - DHE key exchanges
Jasper Wallace 2:bbdeda018a3c 2924 */
Jasper Wallace 2:bbdeda018a3c 2925 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED)
Jasper Wallace 2:bbdeda018a3c 2926 if( mbedtls_ssl_ciphersuite_uses_dhe( ciphersuite_info ) )
markrad 0:cdf462088d13 2927 {
markrad 0:cdf462088d13 2928 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
markrad 0:cdf462088d13 2929 {
markrad 0:cdf462088d13 2930 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
markrad 0:cdf462088d13 2931 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 2932 }
markrad 0:cdf462088d13 2933
markrad 0:cdf462088d13 2934 /*
markrad 0:cdf462088d13 2935 * Ephemeral DH parameters:
markrad 0:cdf462088d13 2936 *
markrad 0:cdf462088d13 2937 * struct {
markrad 0:cdf462088d13 2938 * opaque dh_p<1..2^16-1>;
markrad 0:cdf462088d13 2939 * opaque dh_g<1..2^16-1>;
markrad 0:cdf462088d13 2940 * opaque dh_Ys<1..2^16-1>;
markrad 0:cdf462088d13 2941 * } ServerDHParams;
markrad 0:cdf462088d13 2942 */
markrad 0:cdf462088d13 2943 if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 ||
markrad 0:cdf462088d13 2944 ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
markrad 0:cdf462088d13 2945 {
markrad 0:cdf462088d13 2946 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
markrad 0:cdf462088d13 2947 return( ret );
markrad 0:cdf462088d13 2948 }
markrad 0:cdf462088d13 2949
markrad 0:cdf462088d13 2950 if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
markrad 0:cdf462088d13 2951 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
markrad 0:cdf462088d13 2952 p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 2953 {
markrad 0:cdf462088d13 2954 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
markrad 0:cdf462088d13 2955 return( ret );
markrad 0:cdf462088d13 2956 }
markrad 0:cdf462088d13 2957
Jasper Wallace 2:bbdeda018a3c 2958 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
markrad 0:cdf462088d13 2959 dig_signed = p;
markrad 0:cdf462088d13 2960 dig_signed_len = len;
Jasper Wallace 2:bbdeda018a3c 2961 #endif
markrad 0:cdf462088d13 2962
markrad 0:cdf462088d13 2963 p += len;
markrad 0:cdf462088d13 2964 n += len;
markrad 0:cdf462088d13 2965
markrad 0:cdf462088d13 2966 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
markrad 0:cdf462088d13 2967 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
markrad 0:cdf462088d13 2968 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
markrad 0:cdf462088d13 2969 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
markrad 0:cdf462088d13 2970 }
Jasper Wallace 2:bbdeda018a3c 2971 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED */
Jasper Wallace 2:bbdeda018a3c 2972
Jasper Wallace 2:bbdeda018a3c 2973 /*
Jasper Wallace 2:bbdeda018a3c 2974 * - ECDHE key exchanges
Jasper Wallace 2:bbdeda018a3c 2975 */
markrad 0:cdf462088d13 2976 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
Jasper Wallace 2:bbdeda018a3c 2977 if( mbedtls_ssl_ciphersuite_uses_ecdhe( ciphersuite_info ) )
markrad 0:cdf462088d13 2978 {
markrad 0:cdf462088d13 2979 /*
markrad 0:cdf462088d13 2980 * Ephemeral ECDH parameters:
markrad 0:cdf462088d13 2981 *
markrad 0:cdf462088d13 2982 * struct {
markrad 0:cdf462088d13 2983 * ECParameters curve_params;
markrad 0:cdf462088d13 2984 * ECPoint public;
markrad 0:cdf462088d13 2985 * } ServerECDHParams;
markrad 0:cdf462088d13 2986 */
markrad 0:cdf462088d13 2987 const mbedtls_ecp_curve_info **curve = NULL;
markrad 0:cdf462088d13 2988 const mbedtls_ecp_group_id *gid;
markrad 0:cdf462088d13 2989
markrad 0:cdf462088d13 2990 /* Match our preference list against the offered curves */
markrad 0:cdf462088d13 2991 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
markrad 0:cdf462088d13 2992 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
markrad 0:cdf462088d13 2993 if( (*curve)->grp_id == *gid )
markrad 0:cdf462088d13 2994 goto curve_matching_done;
markrad 0:cdf462088d13 2995
markrad 0:cdf462088d13 2996 curve_matching_done:
markrad 0:cdf462088d13 2997 if( curve == NULL || *curve == NULL )
markrad 0:cdf462088d13 2998 {
markrad 0:cdf462088d13 2999 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
markrad 0:cdf462088d13 3000 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
markrad 0:cdf462088d13 3001 }
markrad 0:cdf462088d13 3002
markrad 0:cdf462088d13 3003 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
markrad 0:cdf462088d13 3004
markrad 0:cdf462088d13 3005 if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
markrad 0:cdf462088d13 3006 (*curve)->grp_id ) ) != 0 )
markrad 0:cdf462088d13 3007 {
markrad 0:cdf462088d13 3008 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
markrad 0:cdf462088d13 3009 return( ret );
markrad 0:cdf462088d13 3010 }
markrad 0:cdf462088d13 3011
markrad 0:cdf462088d13 3012 if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
markrad 0:cdf462088d13 3013 p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
markrad 0:cdf462088d13 3014 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 3015 {
markrad 0:cdf462088d13 3016 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
markrad 0:cdf462088d13 3017 return( ret );
markrad 0:cdf462088d13 3018 }
markrad 0:cdf462088d13 3019
Jasper Wallace 2:bbdeda018a3c 3020 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Jasper Wallace 2:bbdeda018a3c 3021 dig_signed = p;
markrad 0:cdf462088d13 3022 dig_signed_len = len;
Jasper Wallace 2:bbdeda018a3c 3023 #endif
markrad 0:cdf462088d13 3024
markrad 0:cdf462088d13 3025 p += len;
markrad 0:cdf462088d13 3026 n += len;
markrad 0:cdf462088d13 3027
markrad 0:cdf462088d13 3028 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
markrad 0:cdf462088d13 3029 }
markrad 0:cdf462088d13 3030 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
markrad 0:cdf462088d13 3031
Jasper Wallace 2:bbdeda018a3c 3032 /*
Jasper Wallace 2:bbdeda018a3c 3033 *
Jasper Wallace 2:bbdeda018a3c 3034 * Part 3: For key exchanges involving the server signing the
Jasper Wallace 2:bbdeda018a3c 3035 * exchange parameters, compute and add the signature here.
Jasper Wallace 2:bbdeda018a3c 3036 *
Jasper Wallace 2:bbdeda018a3c 3037 */
Jasper Wallace 2:bbdeda018a3c 3038 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Jasper Wallace 2:bbdeda018a3c 3039 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
markrad 0:cdf462088d13 3040 {
markrad 0:cdf462088d13 3041 size_t signature_len = 0;
markrad 0:cdf462088d13 3042 unsigned int hashlen = 0;
markrad 0:cdf462088d13 3043 unsigned char hash[64];
markrad 0:cdf462088d13 3044
markrad 0:cdf462088d13 3045 /*
Jasper Wallace 2:bbdeda018a3c 3046 * 3.1: Choose hash algorithm:
Jasper Wallace 2:bbdeda018a3c 3047 * A: For TLS 1.2, obey signature-hash-algorithm extension
Jasper Wallace 2:bbdeda018a3c 3048 * to choose appropriate hash.
Jasper Wallace 2:bbdeda018a3c 3049 * B: For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1
Jasper Wallace 2:bbdeda018a3c 3050 * (RFC 4492, Sec. 5.4)
Jasper Wallace 2:bbdeda018a3c 3051 * C: Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3)
markrad 0:cdf462088d13 3052 */
Jasper Wallace 2:bbdeda018a3c 3053
Jasper Wallace 2:bbdeda018a3c 3054 mbedtls_md_type_t md_alg;
Jasper Wallace 2:bbdeda018a3c 3055
markrad 0:cdf462088d13 3056 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Jasper Wallace 2:bbdeda018a3c 3057 mbedtls_pk_type_t sig_alg =
Jasper Wallace 2:bbdeda018a3c 3058 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
markrad 0:cdf462088d13 3059 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 3060 {
Jasper Wallace 2:bbdeda018a3c 3061 /* A: For TLS 1.2, obey signature-hash-algorithm extension
Jasper Wallace 2:bbdeda018a3c 3062 * (RFC 5246, Sec. 7.4.1.4.1). */
Jasper Wallace 2:bbdeda018a3c 3063 if( sig_alg == MBEDTLS_PK_NONE ||
Jasper Wallace 2:bbdeda018a3c 3064 ( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
Jasper Wallace 2:bbdeda018a3c 3065 sig_alg ) ) == MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 3066 {
markrad 0:cdf462088d13 3067 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Jasper Wallace 2:bbdeda018a3c 3068 /* (... because we choose a cipher suite
Jasper Wallace 2:bbdeda018a3c 3069 * only if there is a matching hash.) */
markrad 0:cdf462088d13 3070 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3071 }
markrad 0:cdf462088d13 3072 }
markrad 0:cdf462088d13 3073 else
markrad 0:cdf462088d13 3074 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 3075 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
markrad 0:cdf462088d13 3076 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Jasper Wallace 2:bbdeda018a3c 3077 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
markrad 0:cdf462088d13 3078 {
Jasper Wallace 2:bbdeda018a3c 3079 /* B: Default hash SHA1 */
markrad 0:cdf462088d13 3080 md_alg = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 3081 }
markrad 0:cdf462088d13 3082 else
Jasper Wallace 2:bbdeda018a3c 3083 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
Jasper Wallace 2:bbdeda018a3c 3084 MBEDTLS_SSL_PROTO_TLS1_1 */
markrad 0:cdf462088d13 3085 {
Jasper Wallace 2:bbdeda018a3c 3086 /* C: MD5 + SHA1 */
markrad 0:cdf462088d13 3087 md_alg = MBEDTLS_MD_NONE;
markrad 0:cdf462088d13 3088 }
markrad 0:cdf462088d13 3089
Jasper Wallace 2:bbdeda018a3c 3090 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pick hash algorithm %d for signing", md_alg ) );
Jasper Wallace 2:bbdeda018a3c 3091
markrad 0:cdf462088d13 3092 /*
Jasper Wallace 2:bbdeda018a3c 3093 * 3.2: Compute the hash to be signed
markrad 0:cdf462088d13 3094 */
markrad 0:cdf462088d13 3095 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
markrad 0:cdf462088d13 3096 defined(MBEDTLS_SSL_PROTO_TLS1_1)
markrad 0:cdf462088d13 3097 if( md_alg == MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 3098 {
markrad 0:cdf462088d13 3099 mbedtls_md5_context mbedtls_md5;
markrad 0:cdf462088d13 3100 mbedtls_sha1_context mbedtls_sha1;
markrad 0:cdf462088d13 3101
markrad 0:cdf462088d13 3102 mbedtls_md5_init( &mbedtls_md5 );
markrad 0:cdf462088d13 3103 mbedtls_sha1_init( &mbedtls_sha1 );
markrad 0:cdf462088d13 3104
markrad 0:cdf462088d13 3105 /*
markrad 0:cdf462088d13 3106 * digitally-signed struct {
markrad 0:cdf462088d13 3107 * opaque md5_hash[16];
markrad 0:cdf462088d13 3108 * opaque sha_hash[20];
markrad 0:cdf462088d13 3109 * };
markrad 0:cdf462088d13 3110 *
markrad 0:cdf462088d13 3111 * md5_hash
markrad 0:cdf462088d13 3112 * MD5(ClientHello.random + ServerHello.random
markrad 0:cdf462088d13 3113 * + ServerParams);
markrad 0:cdf462088d13 3114 * sha_hash
markrad 0:cdf462088d13 3115 * SHA(ClientHello.random + ServerHello.random
markrad 0:cdf462088d13 3116 * + ServerParams);
markrad 0:cdf462088d13 3117 */
Jasper Wallace 2:bbdeda018a3c 3118
markrad 0:cdf462088d13 3119 mbedtls_md5_starts( &mbedtls_md5 );
markrad 0:cdf462088d13 3120 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
markrad 0:cdf462088d13 3121 mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
markrad 0:cdf462088d13 3122 mbedtls_md5_finish( &mbedtls_md5, hash );
markrad 0:cdf462088d13 3123
markrad 0:cdf462088d13 3124 mbedtls_sha1_starts( &mbedtls_sha1 );
markrad 0:cdf462088d13 3125 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
markrad 0:cdf462088d13 3126 mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
markrad 0:cdf462088d13 3127 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
markrad 0:cdf462088d13 3128
markrad 0:cdf462088d13 3129 hashlen = 36;
markrad 0:cdf462088d13 3130
markrad 0:cdf462088d13 3131 mbedtls_md5_free( &mbedtls_md5 );
markrad 0:cdf462088d13 3132 mbedtls_sha1_free( &mbedtls_sha1 );
markrad 0:cdf462088d13 3133 }
markrad 0:cdf462088d13 3134 else
markrad 0:cdf462088d13 3135 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
markrad 0:cdf462088d13 3136 MBEDTLS_SSL_PROTO_TLS1_1 */
markrad 0:cdf462088d13 3137 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
markrad 0:cdf462088d13 3138 defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 3139 if( md_alg != MBEDTLS_MD_NONE )
markrad 0:cdf462088d13 3140 {
markrad 0:cdf462088d13 3141 mbedtls_md_context_t ctx;
markrad 0:cdf462088d13 3142 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
markrad 0:cdf462088d13 3143
markrad 0:cdf462088d13 3144 mbedtls_md_init( &ctx );
markrad 0:cdf462088d13 3145
markrad 0:cdf462088d13 3146 /* Info from md_alg will be used instead */
markrad 0:cdf462088d13 3147 hashlen = 0;
markrad 0:cdf462088d13 3148
markrad 0:cdf462088d13 3149 /*
markrad 0:cdf462088d13 3150 * digitally-signed struct {
markrad 0:cdf462088d13 3151 * opaque client_random[32];
markrad 0:cdf462088d13 3152 * opaque server_random[32];
markrad 0:cdf462088d13 3153 * ServerDHParams params;
markrad 0:cdf462088d13 3154 * };
markrad 0:cdf462088d13 3155 */
markrad 0:cdf462088d13 3156 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
markrad 0:cdf462088d13 3157 {
markrad 0:cdf462088d13 3158 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
markrad 0:cdf462088d13 3159 return( ret );
markrad 0:cdf462088d13 3160 }
markrad 0:cdf462088d13 3161
markrad 0:cdf462088d13 3162 mbedtls_md_starts( &ctx );
markrad 0:cdf462088d13 3163 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
markrad 0:cdf462088d13 3164 mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
markrad 0:cdf462088d13 3165 mbedtls_md_finish( &ctx, hash );
markrad 0:cdf462088d13 3166 mbedtls_md_free( &ctx );
markrad 0:cdf462088d13 3167 }
markrad 0:cdf462088d13 3168 else
markrad 0:cdf462088d13 3169 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
markrad 0:cdf462088d13 3170 MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 3171 {
markrad 0:cdf462088d13 3172 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3173 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3174 }
markrad 0:cdf462088d13 3175
markrad 0:cdf462088d13 3176 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
markrad 0:cdf462088d13 3177 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
markrad 0:cdf462088d13 3178
markrad 0:cdf462088d13 3179 /*
Jasper Wallace 2:bbdeda018a3c 3180 * 3.3: Compute and add the signature
markrad 0:cdf462088d13 3181 */
markrad 0:cdf462088d13 3182 if( mbedtls_ssl_own_key( ssl ) == NULL )
markrad 0:cdf462088d13 3183 {
markrad 0:cdf462088d13 3184 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
markrad 0:cdf462088d13 3185 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
markrad 0:cdf462088d13 3186 }
markrad 0:cdf462088d13 3187
markrad 0:cdf462088d13 3188 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 3189 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 3190 {
Jasper Wallace 2:bbdeda018a3c 3191 /*
Jasper Wallace 2:bbdeda018a3c 3192 * For TLS 1.2, we need to specify signature and hash algorithm
Jasper Wallace 2:bbdeda018a3c 3193 * explicitly through a prefix to the signature.
Jasper Wallace 2:bbdeda018a3c 3194 *
Jasper Wallace 2:bbdeda018a3c 3195 * struct {
Jasper Wallace 2:bbdeda018a3c 3196 * HashAlgorithm hash;
Jasper Wallace 2:bbdeda018a3c 3197 * SignatureAlgorithm signature;
Jasper Wallace 2:bbdeda018a3c 3198 * } SignatureAndHashAlgorithm;
Jasper Wallace 2:bbdeda018a3c 3199 *
Jasper Wallace 2:bbdeda018a3c 3200 * struct {
Jasper Wallace 2:bbdeda018a3c 3201 * SignatureAndHashAlgorithm algorithm;
Jasper Wallace 2:bbdeda018a3c 3202 * opaque signature<0..2^16-1>;
Jasper Wallace 2:bbdeda018a3c 3203 * } DigitallySigned;
Jasper Wallace 2:bbdeda018a3c 3204 *
Jasper Wallace 2:bbdeda018a3c 3205 */
Jasper Wallace 2:bbdeda018a3c 3206
Jasper Wallace 2:bbdeda018a3c 3207 *(p++) = mbedtls_ssl_hash_from_md_alg( md_alg );
Jasper Wallace 2:bbdeda018a3c 3208 *(p++) = mbedtls_ssl_sig_from_pk_alg( sig_alg );
markrad 0:cdf462088d13 3209
markrad 0:cdf462088d13 3210 n += 2;
markrad 0:cdf462088d13 3211 }
markrad 0:cdf462088d13 3212 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 3213
markrad 0:cdf462088d13 3214 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
Jasper Wallace 2:bbdeda018a3c 3215 p + 2 , &signature_len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 3216 {
markrad 0:cdf462088d13 3217 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
markrad 0:cdf462088d13 3218 return( ret );
markrad 0:cdf462088d13 3219 }
markrad 0:cdf462088d13 3220
markrad 0:cdf462088d13 3221 *(p++) = (unsigned char)( signature_len >> 8 );
markrad 0:cdf462088d13 3222 *(p++) = (unsigned char)( signature_len );
markrad 0:cdf462088d13 3223 n += 2;
markrad 0:cdf462088d13 3224
markrad 0:cdf462088d13 3225 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
markrad 0:cdf462088d13 3226
markrad 0:cdf462088d13 3227 n += signature_len;
markrad 0:cdf462088d13 3228 }
Jasper Wallace 2:bbdeda018a3c 3229 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Jasper Wallace 2:bbdeda018a3c 3230
Jasper Wallace 2:bbdeda018a3c 3231 /* Done with actual work; add header and send. */
markrad 0:cdf462088d13 3232
markrad 0:cdf462088d13 3233 ssl->out_msglen = 4 + n;
markrad 0:cdf462088d13 3234 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 3235 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
markrad 0:cdf462088d13 3236
markrad 0:cdf462088d13 3237 ssl->state++;
markrad 0:cdf462088d13 3238
markrad 0:cdf462088d13 3239 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 3240 {
markrad 0:cdf462088d13 3241 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 3242 return( ret );
markrad 0:cdf462088d13 3243 }
markrad 0:cdf462088d13 3244
markrad 0:cdf462088d13 3245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
markrad 0:cdf462088d13 3246
markrad 0:cdf462088d13 3247 return( 0 );
markrad 0:cdf462088d13 3248 }
markrad 0:cdf462088d13 3249
markrad 0:cdf462088d13 3250 static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3251 {
markrad 0:cdf462088d13 3252 int ret;
markrad 0:cdf462088d13 3253
markrad 0:cdf462088d13 3254 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
markrad 0:cdf462088d13 3255
markrad 0:cdf462088d13 3256 ssl->out_msglen = 4;
markrad 0:cdf462088d13 3257 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 3258 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
markrad 0:cdf462088d13 3259
markrad 0:cdf462088d13 3260 ssl->state++;
markrad 0:cdf462088d13 3261
markrad 0:cdf462088d13 3262 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 3263 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
markrad 0:cdf462088d13 3264 mbedtls_ssl_send_flight_completed( ssl );
markrad 0:cdf462088d13 3265 #endif
markrad 0:cdf462088d13 3266
markrad 0:cdf462088d13 3267 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 3268 {
markrad 0:cdf462088d13 3269 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 3270 return( ret );
markrad 0:cdf462088d13 3271 }
markrad 0:cdf462088d13 3272
markrad 0:cdf462088d13 3273 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
markrad 0:cdf462088d13 3274
markrad 0:cdf462088d13 3275 return( 0 );
markrad 0:cdf462088d13 3276 }
markrad 0:cdf462088d13 3277
markrad 0:cdf462088d13 3278 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 3279 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
markrad 0:cdf462088d13 3280 static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
markrad 0:cdf462088d13 3281 const unsigned char *end )
markrad 0:cdf462088d13 3282 {
markrad 0:cdf462088d13 3283 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
markrad 0:cdf462088d13 3284 size_t n;
markrad 0:cdf462088d13 3285
markrad 0:cdf462088d13 3286 /*
markrad 0:cdf462088d13 3287 * Receive G^Y mod P, premaster = (G^Y)^X mod P
markrad 0:cdf462088d13 3288 */
markrad 0:cdf462088d13 3289 if( *p + 2 > end )
markrad 0:cdf462088d13 3290 {
markrad 0:cdf462088d13 3291 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3292 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3293 }
markrad 0:cdf462088d13 3294
markrad 0:cdf462088d13 3295 n = ( (*p)[0] << 8 ) | (*p)[1];
markrad 0:cdf462088d13 3296 *p += 2;
markrad 0:cdf462088d13 3297
markrad 0:cdf462088d13 3298 if( *p + n > end )
markrad 0:cdf462088d13 3299 {
markrad 0:cdf462088d13 3300 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3301 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3302 }
markrad 0:cdf462088d13 3303
markrad 0:cdf462088d13 3304 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
markrad 0:cdf462088d13 3305 {
markrad 0:cdf462088d13 3306 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
markrad 0:cdf462088d13 3307 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
markrad 0:cdf462088d13 3308 }
markrad 0:cdf462088d13 3309
markrad 0:cdf462088d13 3310 *p += n;
markrad 0:cdf462088d13 3311
markrad 0:cdf462088d13 3312 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
markrad 0:cdf462088d13 3313
markrad 0:cdf462088d13 3314 return( ret );
markrad 0:cdf462088d13 3315 }
markrad 0:cdf462088d13 3316 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
markrad 0:cdf462088d13 3317 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
markrad 0:cdf462088d13 3318
markrad 0:cdf462088d13 3319 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
markrad 0:cdf462088d13 3320 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
markrad 0:cdf462088d13 3321 static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
markrad 0:cdf462088d13 3322 const unsigned char *p,
markrad 0:cdf462088d13 3323 const unsigned char *end,
markrad 0:cdf462088d13 3324 size_t pms_offset )
markrad 0:cdf462088d13 3325 {
markrad 0:cdf462088d13 3326 int ret;
markrad 0:cdf462088d13 3327 size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
markrad 0:cdf462088d13 3328 unsigned char *pms = ssl->handshake->premaster + pms_offset;
markrad 0:cdf462088d13 3329 unsigned char ver[2];
markrad 0:cdf462088d13 3330 unsigned char fake_pms[48], peer_pms[48];
markrad 0:cdf462088d13 3331 unsigned char mask;
markrad 0:cdf462088d13 3332 size_t i, peer_pmslen;
markrad 0:cdf462088d13 3333 unsigned int diff;
markrad 0:cdf462088d13 3334
markrad 0:cdf462088d13 3335 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
markrad 0:cdf462088d13 3336 {
markrad 0:cdf462088d13 3337 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
markrad 0:cdf462088d13 3338 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
markrad 0:cdf462088d13 3339 }
markrad 0:cdf462088d13 3340
markrad 0:cdf462088d13 3341 /*
markrad 0:cdf462088d13 3342 * Decrypt the premaster using own private RSA key
markrad 0:cdf462088d13 3343 */
markrad 0:cdf462088d13 3344 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
markrad 0:cdf462088d13 3345 defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 3346 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
markrad 0:cdf462088d13 3347 {
markrad 0:cdf462088d13 3348 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
markrad 0:cdf462088d13 3349 *p++ != ( ( len ) & 0xFF ) )
markrad 0:cdf462088d13 3350 {
markrad 0:cdf462088d13 3351 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3352 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3353 }
markrad 0:cdf462088d13 3354 }
markrad 0:cdf462088d13 3355 #endif
markrad 0:cdf462088d13 3356
markrad 0:cdf462088d13 3357 if( p + len != end )
markrad 0:cdf462088d13 3358 {
markrad 0:cdf462088d13 3359 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3360 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3361 }
markrad 0:cdf462088d13 3362
markrad 0:cdf462088d13 3363 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
markrad 0:cdf462088d13 3364 ssl->handshake->max_minor_ver,
markrad 0:cdf462088d13 3365 ssl->conf->transport, ver );
markrad 0:cdf462088d13 3366
markrad 0:cdf462088d13 3367 /*
markrad 0:cdf462088d13 3368 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
markrad 0:cdf462088d13 3369 * must not cause the connection to end immediately; instead, send a
markrad 0:cdf462088d13 3370 * bad_record_mac later in the handshake.
markrad 0:cdf462088d13 3371 * Also, avoid data-dependant branches here to protect against
markrad 0:cdf462088d13 3372 * timing-based variants.
markrad 0:cdf462088d13 3373 */
markrad 0:cdf462088d13 3374 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
markrad 0:cdf462088d13 3375 if( ret != 0 )
markrad 0:cdf462088d13 3376 return( ret );
markrad 0:cdf462088d13 3377
markrad 0:cdf462088d13 3378 ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
markrad 0:cdf462088d13 3379 peer_pms, &peer_pmslen,
markrad 0:cdf462088d13 3380 sizeof( peer_pms ),
markrad 0:cdf462088d13 3381 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 3382
markrad 0:cdf462088d13 3383 diff = (unsigned int) ret;
markrad 0:cdf462088d13 3384 diff |= peer_pmslen ^ 48;
markrad 0:cdf462088d13 3385 diff |= peer_pms[0] ^ ver[0];
markrad 0:cdf462088d13 3386 diff |= peer_pms[1] ^ ver[1];
markrad 0:cdf462088d13 3387
markrad 0:cdf462088d13 3388 #if defined(MBEDTLS_SSL_DEBUG_ALL)
markrad 0:cdf462088d13 3389 if( diff != 0 )
markrad 0:cdf462088d13 3390 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3391 #endif
markrad 0:cdf462088d13 3392
markrad 0:cdf462088d13 3393 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
markrad 0:cdf462088d13 3394 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
markrad 0:cdf462088d13 3395 {
markrad 0:cdf462088d13 3396 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3397 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3398 }
markrad 0:cdf462088d13 3399 ssl->handshake->pmslen = 48;
markrad 0:cdf462088d13 3400
markrad 0:cdf462088d13 3401 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
markrad 0:cdf462088d13 3402 /* MSVC has a warning about unary minus on unsigned, but this is
markrad 0:cdf462088d13 3403 * well-defined and precisely what we want to do here */
markrad 0:cdf462088d13 3404 #if defined(_MSC_VER)
markrad 0:cdf462088d13 3405 #pragma warning( push )
markrad 0:cdf462088d13 3406 #pragma warning( disable : 4146 )
markrad 0:cdf462088d13 3407 #endif
markrad 0:cdf462088d13 3408 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
markrad 0:cdf462088d13 3409 #if defined(_MSC_VER)
markrad 0:cdf462088d13 3410 #pragma warning( pop )
markrad 0:cdf462088d13 3411 #endif
markrad 0:cdf462088d13 3412
markrad 0:cdf462088d13 3413 for( i = 0; i < ssl->handshake->pmslen; i++ )
markrad 0:cdf462088d13 3414 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
markrad 0:cdf462088d13 3415
markrad 0:cdf462088d13 3416 return( 0 );
markrad 0:cdf462088d13 3417 }
markrad 0:cdf462088d13 3418 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
markrad 0:cdf462088d13 3419 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
markrad 0:cdf462088d13 3420
markrad 0:cdf462088d13 3421 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
markrad 0:cdf462088d13 3422 static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
markrad 0:cdf462088d13 3423 const unsigned char *end )
markrad 0:cdf462088d13 3424 {
markrad 0:cdf462088d13 3425 int ret = 0;
markrad 0:cdf462088d13 3426 size_t n;
markrad 0:cdf462088d13 3427
markrad 0:cdf462088d13 3428 if( ssl->conf->f_psk == NULL &&
markrad 0:cdf462088d13 3429 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
markrad 0:cdf462088d13 3430 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
markrad 0:cdf462088d13 3431 {
markrad 0:cdf462088d13 3432 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
markrad 0:cdf462088d13 3433 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
markrad 0:cdf462088d13 3434 }
markrad 0:cdf462088d13 3435
markrad 0:cdf462088d13 3436 /*
markrad 0:cdf462088d13 3437 * Receive client pre-shared key identity name
markrad 0:cdf462088d13 3438 */
markrad 0:cdf462088d13 3439 if( *p + 2 > end )
markrad 0:cdf462088d13 3440 {
markrad 0:cdf462088d13 3441 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3442 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3443 }
markrad 0:cdf462088d13 3444
markrad 0:cdf462088d13 3445 n = ( (*p)[0] << 8 ) | (*p)[1];
markrad 0:cdf462088d13 3446 *p += 2;
markrad 0:cdf462088d13 3447
markrad 0:cdf462088d13 3448 if( n < 1 || n > 65535 || *p + n > end )
markrad 0:cdf462088d13 3449 {
markrad 0:cdf462088d13 3450 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3451 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3452 }
markrad 0:cdf462088d13 3453
markrad 0:cdf462088d13 3454 if( ssl->conf->f_psk != NULL )
markrad 0:cdf462088d13 3455 {
markrad 0:cdf462088d13 3456 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
markrad 0:cdf462088d13 3457 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
markrad 0:cdf462088d13 3458 }
markrad 0:cdf462088d13 3459 else
markrad 0:cdf462088d13 3460 {
markrad 0:cdf462088d13 3461 /* Identity is not a big secret since clients send it in the clear,
markrad 0:cdf462088d13 3462 * but treat it carefully anyway, just in case */
markrad 0:cdf462088d13 3463 if( n != ssl->conf->psk_identity_len ||
markrad 0:cdf462088d13 3464 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
markrad 0:cdf462088d13 3465 {
markrad 0:cdf462088d13 3466 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
markrad 0:cdf462088d13 3467 }
markrad 0:cdf462088d13 3468 }
markrad 0:cdf462088d13 3469
markrad 0:cdf462088d13 3470 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
markrad 0:cdf462088d13 3471 {
markrad 0:cdf462088d13 3472 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Jasper Wallace 2:bbdeda018a3c 3473 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Jasper Wallace 2:bbdeda018a3c 3474 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
markrad 0:cdf462088d13 3475 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
markrad 0:cdf462088d13 3476 }
markrad 0:cdf462088d13 3477
markrad 0:cdf462088d13 3478 *p += n;
markrad 0:cdf462088d13 3479
markrad 0:cdf462088d13 3480 return( 0 );
markrad 0:cdf462088d13 3481 }
markrad 0:cdf462088d13 3482 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
markrad 0:cdf462088d13 3483
markrad 0:cdf462088d13 3484 static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3485 {
markrad 0:cdf462088d13 3486 int ret;
markrad 0:cdf462088d13 3487 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
markrad 0:cdf462088d13 3488 unsigned char *p, *end;
markrad 0:cdf462088d13 3489
markrad 0:cdf462088d13 3490 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 3491
markrad 0:cdf462088d13 3492 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
markrad 0:cdf462088d13 3493
markrad 0:cdf462088d13 3494 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 3495 {
markrad 0:cdf462088d13 3496 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
markrad 0:cdf462088d13 3497 return( ret );
markrad 0:cdf462088d13 3498 }
markrad 0:cdf462088d13 3499
markrad 0:cdf462088d13 3500 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 3501 end = ssl->in_msg + ssl->in_hslen;
markrad 0:cdf462088d13 3502
markrad 0:cdf462088d13 3503 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
markrad 0:cdf462088d13 3504 {
markrad 0:cdf462088d13 3505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3506 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3507 }
markrad 0:cdf462088d13 3508
markrad 0:cdf462088d13 3509 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
markrad 0:cdf462088d13 3510 {
markrad 0:cdf462088d13 3511 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
markrad 0:cdf462088d13 3512 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3513 }
markrad 0:cdf462088d13 3514
markrad 0:cdf462088d13 3515 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
markrad 0:cdf462088d13 3516 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
markrad 0:cdf462088d13 3517 {
markrad 0:cdf462088d13 3518 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
markrad 0:cdf462088d13 3519 {
markrad 0:cdf462088d13 3520 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
markrad 0:cdf462088d13 3521 return( ret );
markrad 0:cdf462088d13 3522 }
markrad 0:cdf462088d13 3523
markrad 0:cdf462088d13 3524 if( p != end )
markrad 0:cdf462088d13 3525 {
markrad 0:cdf462088d13 3526 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
markrad 0:cdf462088d13 3527 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3528 }
markrad 0:cdf462088d13 3529
markrad 0:cdf462088d13 3530 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
markrad 0:cdf462088d13 3531 ssl->handshake->premaster,
markrad 0:cdf462088d13 3532 MBEDTLS_PREMASTER_SIZE,
markrad 0:cdf462088d13 3533 &ssl->handshake->pmslen,
markrad 0:cdf462088d13 3534 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 3535 {
markrad 0:cdf462088d13 3536 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
markrad 0:cdf462088d13 3537 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
markrad 0:cdf462088d13 3538 }
markrad 0:cdf462088d13 3539
markrad 0:cdf462088d13 3540 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
markrad 0:cdf462088d13 3541 }
markrad 0:cdf462088d13 3542 else
markrad 0:cdf462088d13 3543 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
markrad 0:cdf462088d13 3544 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
markrad 0:cdf462088d13 3545 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
markrad 0:cdf462088d13 3546 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
markrad 0:cdf462088d13 3547 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
markrad 0:cdf462088d13 3548 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
markrad 0:cdf462088d13 3549 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
markrad 0:cdf462088d13 3550 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
markrad 0:cdf462088d13 3551 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
markrad 0:cdf462088d13 3552 {
markrad 0:cdf462088d13 3553 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 3554 p, end - p) ) != 0 )
markrad 0:cdf462088d13 3555 {
markrad 0:cdf462088d13 3556 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
markrad 0:cdf462088d13 3557 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
markrad 0:cdf462088d13 3558 }
markrad 0:cdf462088d13 3559
markrad 0:cdf462088d13 3560 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
markrad 0:cdf462088d13 3561
markrad 0:cdf462088d13 3562 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 3563 &ssl->handshake->pmslen,
markrad 0:cdf462088d13 3564 ssl->handshake->premaster,
markrad 0:cdf462088d13 3565 MBEDTLS_MPI_MAX_SIZE,
markrad 0:cdf462088d13 3566 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
markrad 0:cdf462088d13 3567 {
markrad 0:cdf462088d13 3568 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
markrad 0:cdf462088d13 3569 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
markrad 0:cdf462088d13 3570 }
markrad 0:cdf462088d13 3571
markrad 0:cdf462088d13 3572 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
markrad 0:cdf462088d13 3573 }
markrad 0:cdf462088d13 3574 else
markrad 0:cdf462088d13 3575 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
markrad 0:cdf462088d13 3576 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
markrad 0:cdf462088d13 3577 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
markrad 0:cdf462088d13 3578 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
markrad 0:cdf462088d13 3579 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
markrad 0:cdf462088d13 3580 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
markrad 0:cdf462088d13 3581 {
markrad 0:cdf462088d13 3582 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
markrad 0:cdf462088d13 3583 {
markrad 0:cdf462088d13 3584 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
markrad 0:cdf462088d13 3585 return( ret );
markrad 0:cdf462088d13 3586 }
markrad 0:cdf462088d13 3587
markrad 0:cdf462088d13 3588 if( p != end )
markrad 0:cdf462088d13 3589 {
markrad 0:cdf462088d13 3590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
markrad 0:cdf462088d13 3591 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3592 }
markrad 0:cdf462088d13 3593
markrad 0:cdf462088d13 3594 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
markrad 0:cdf462088d13 3595 ciphersuite_info->key_exchange ) ) != 0 )
markrad 0:cdf462088d13 3596 {
markrad 0:cdf462088d13 3597 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
markrad 0:cdf462088d13 3598 return( ret );
markrad 0:cdf462088d13 3599 }
markrad 0:cdf462088d13 3600 }
markrad 0:cdf462088d13 3601 else
markrad 0:cdf462088d13 3602 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
markrad 0:cdf462088d13 3603 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
markrad 0:cdf462088d13 3604 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
markrad 0:cdf462088d13 3605 {
markrad 0:cdf462088d13 3606 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
markrad 0:cdf462088d13 3607 {
markrad 0:cdf462088d13 3608 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
markrad 0:cdf462088d13 3609 return( ret );
markrad 0:cdf462088d13 3610 }
markrad 0:cdf462088d13 3611
markrad 0:cdf462088d13 3612 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
markrad 0:cdf462088d13 3613 {
markrad 0:cdf462088d13 3614 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
markrad 0:cdf462088d13 3615 return( ret );
markrad 0:cdf462088d13 3616 }
markrad 0:cdf462088d13 3617
markrad 0:cdf462088d13 3618 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
markrad 0:cdf462088d13 3619 ciphersuite_info->key_exchange ) ) != 0 )
markrad 0:cdf462088d13 3620 {
markrad 0:cdf462088d13 3621 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
markrad 0:cdf462088d13 3622 return( ret );
markrad 0:cdf462088d13 3623 }
markrad 0:cdf462088d13 3624 }
markrad 0:cdf462088d13 3625 else
markrad 0:cdf462088d13 3626 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
markrad 0:cdf462088d13 3627 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
markrad 0:cdf462088d13 3628 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
markrad 0:cdf462088d13 3629 {
markrad 0:cdf462088d13 3630 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
markrad 0:cdf462088d13 3631 {
markrad 0:cdf462088d13 3632 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
markrad 0:cdf462088d13 3633 return( ret );
markrad 0:cdf462088d13 3634 }
markrad 0:cdf462088d13 3635 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
markrad 0:cdf462088d13 3636 {
markrad 0:cdf462088d13 3637 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
markrad 0:cdf462088d13 3638 return( ret );
markrad 0:cdf462088d13 3639 }
markrad 0:cdf462088d13 3640
markrad 0:cdf462088d13 3641 if( p != end )
markrad 0:cdf462088d13 3642 {
markrad 0:cdf462088d13 3643 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
markrad 0:cdf462088d13 3644 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
markrad 0:cdf462088d13 3645 }
markrad 0:cdf462088d13 3646
markrad 0:cdf462088d13 3647 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
markrad 0:cdf462088d13 3648 ciphersuite_info->key_exchange ) ) != 0 )
markrad 0:cdf462088d13 3649 {
markrad 0:cdf462088d13 3650 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
markrad 0:cdf462088d13 3651 return( ret );
markrad 0:cdf462088d13 3652 }
markrad 0:cdf462088d13 3653 }
markrad 0:cdf462088d13 3654 else
markrad 0:cdf462088d13 3655 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
markrad 0:cdf462088d13 3656 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
markrad 0:cdf462088d13 3657 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
markrad 0:cdf462088d13 3658 {
markrad 0:cdf462088d13 3659 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
markrad 0:cdf462088d13 3660 {
markrad 0:cdf462088d13 3661 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
markrad 0:cdf462088d13 3662 return( ret );
markrad 0:cdf462088d13 3663 }
markrad 0:cdf462088d13 3664
markrad 0:cdf462088d13 3665 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
markrad 0:cdf462088d13 3666 p, end - p ) ) != 0 )
markrad 0:cdf462088d13 3667 {
markrad 0:cdf462088d13 3668 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
markrad 0:cdf462088d13 3669 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
markrad 0:cdf462088d13 3670 }
markrad 0:cdf462088d13 3671
markrad 0:cdf462088d13 3672 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
markrad 0:cdf462088d13 3673
markrad 0:cdf462088d13 3674 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
markrad 0:cdf462088d13 3675 ciphersuite_info->key_exchange ) ) != 0 )
markrad 0:cdf462088d13 3676 {
markrad 0:cdf462088d13 3677 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
markrad 0:cdf462088d13 3678 return( ret );
markrad 0:cdf462088d13 3679 }
markrad 0:cdf462088d13 3680 }
markrad 0:cdf462088d13 3681 else
markrad 0:cdf462088d13 3682 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
markrad 0:cdf462088d13 3683 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
markrad 0:cdf462088d13 3684 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
markrad 0:cdf462088d13 3685 {
markrad 0:cdf462088d13 3686 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
markrad 0:cdf462088d13 3687 {
markrad 0:cdf462088d13 3688 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
markrad 0:cdf462088d13 3689 return( ret );
markrad 0:cdf462088d13 3690 }
markrad 0:cdf462088d13 3691 }
markrad 0:cdf462088d13 3692 else
markrad 0:cdf462088d13 3693 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
markrad 0:cdf462088d13 3694 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
markrad 0:cdf462088d13 3695 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 3696 {
markrad 0:cdf462088d13 3697 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 3698 p, end - p );
markrad 0:cdf462088d13 3699 if( ret != 0 )
markrad 0:cdf462088d13 3700 {
markrad 0:cdf462088d13 3701 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
markrad 0:cdf462088d13 3702 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
markrad 0:cdf462088d13 3703 }
markrad 0:cdf462088d13 3704
markrad 0:cdf462088d13 3705 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
markrad 0:cdf462088d13 3706 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
markrad 0:cdf462088d13 3707 ssl->conf->f_rng, ssl->conf->p_rng );
markrad 0:cdf462088d13 3708 if( ret != 0 )
markrad 0:cdf462088d13 3709 {
markrad 0:cdf462088d13 3710 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
markrad 0:cdf462088d13 3711 return( ret );
markrad 0:cdf462088d13 3712 }
markrad 0:cdf462088d13 3713 }
markrad 0:cdf462088d13 3714 else
markrad 0:cdf462088d13 3715 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
markrad 0:cdf462088d13 3716 {
markrad 0:cdf462088d13 3717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3718 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3719 }
markrad 0:cdf462088d13 3720
markrad 0:cdf462088d13 3721 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
markrad 0:cdf462088d13 3722 {
markrad 0:cdf462088d13 3723 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
markrad 0:cdf462088d13 3724 return( ret );
markrad 0:cdf462088d13 3725 }
markrad 0:cdf462088d13 3726
markrad 0:cdf462088d13 3727 ssl->state++;
markrad 0:cdf462088d13 3728
markrad 0:cdf462088d13 3729 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
markrad 0:cdf462088d13 3730
markrad 0:cdf462088d13 3731 return( 0 );
markrad 0:cdf462088d13 3732 }
markrad 0:cdf462088d13 3733
markrad 0:cdf462088d13 3734 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
markrad 0:cdf462088d13 3735 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 3736 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
markrad 0:cdf462088d13 3737 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
markrad 0:cdf462088d13 3738 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
markrad 0:cdf462088d13 3739 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
markrad 0:cdf462088d13 3740 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3741 {
Jasper Wallace 2:bbdeda018a3c 3742 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Jasper Wallace 2:bbdeda018a3c 3743 ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 3744
markrad 0:cdf462088d13 3745 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
markrad 0:cdf462088d13 3746
markrad 0:cdf462088d13 3747 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 3748 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 3749 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 3750 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 3751 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
markrad 0:cdf462088d13 3752 {
markrad 0:cdf462088d13 3753 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
markrad 0:cdf462088d13 3754 ssl->state++;
markrad 0:cdf462088d13 3755 return( 0 );
markrad 0:cdf462088d13 3756 }
markrad 0:cdf462088d13 3757
markrad 0:cdf462088d13 3758 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3759 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3760 }
markrad 0:cdf462088d13 3761 #else
markrad 0:cdf462088d13 3762 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3763 {
markrad 0:cdf462088d13 3764 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
markrad 0:cdf462088d13 3765 size_t i, sig_len;
markrad 0:cdf462088d13 3766 unsigned char hash[48];
markrad 0:cdf462088d13 3767 unsigned char *hash_start = hash;
markrad 0:cdf462088d13 3768 size_t hashlen;
markrad 0:cdf462088d13 3769 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 3770 mbedtls_pk_type_t pk_alg;
markrad 0:cdf462088d13 3771 #endif
markrad 0:cdf462088d13 3772 mbedtls_md_type_t md_alg;
Jasper Wallace 2:bbdeda018a3c 3773 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Jasper Wallace 2:bbdeda018a3c 3774 ssl->transform_negotiate->ciphersuite_info;
markrad 0:cdf462088d13 3775
markrad 0:cdf462088d13 3776 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
markrad 0:cdf462088d13 3777
markrad 0:cdf462088d13 3778 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
markrad 0:cdf462088d13 3779 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
markrad 0:cdf462088d13 3780 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
markrad 0:cdf462088d13 3781 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
markrad 0:cdf462088d13 3782 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
markrad 0:cdf462088d13 3783 ssl->session_negotiate->peer_cert == NULL )
markrad 0:cdf462088d13 3784 {
markrad 0:cdf462088d13 3785 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
markrad 0:cdf462088d13 3786 ssl->state++;
markrad 0:cdf462088d13 3787 return( 0 );
markrad 0:cdf462088d13 3788 }
markrad 0:cdf462088d13 3789
markrad 0:cdf462088d13 3790 /* Read the message without adding it to the checksum */
markrad 0:cdf462088d13 3791 do {
markrad 0:cdf462088d13 3792
markrad 0:cdf462088d13 3793 if( ( ret = mbedtls_ssl_read_record_layer( ssl ) ) != 0 )
markrad 0:cdf462088d13 3794 {
markrad 0:cdf462088d13 3795 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record_layer" ), ret );
markrad 0:cdf462088d13 3796 return( ret );
markrad 0:cdf462088d13 3797 }
markrad 0:cdf462088d13 3798
markrad 0:cdf462088d13 3799 ret = mbedtls_ssl_handle_message_type( ssl );
markrad 0:cdf462088d13 3800
markrad 0:cdf462088d13 3801 } while( MBEDTLS_ERR_SSL_NON_FATAL == ret );
markrad 0:cdf462088d13 3802
markrad 0:cdf462088d13 3803 if( 0 != ret )
markrad 0:cdf462088d13 3804 {
markrad 0:cdf462088d13 3805 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
markrad 0:cdf462088d13 3806 return( ret );
markrad 0:cdf462088d13 3807 }
markrad 0:cdf462088d13 3808
markrad 0:cdf462088d13 3809 ssl->state++;
markrad 0:cdf462088d13 3810
markrad 0:cdf462088d13 3811 /* Process the message contents */
markrad 0:cdf462088d13 3812 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
markrad 0:cdf462088d13 3813 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
markrad 0:cdf462088d13 3814 {
markrad 0:cdf462088d13 3815 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
markrad 0:cdf462088d13 3816 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3817 }
markrad 0:cdf462088d13 3818
markrad 0:cdf462088d13 3819 i = mbedtls_ssl_hs_hdr_len( ssl );
markrad 0:cdf462088d13 3820
markrad 0:cdf462088d13 3821 /*
markrad 0:cdf462088d13 3822 * struct {
markrad 0:cdf462088d13 3823 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
markrad 0:cdf462088d13 3824 * opaque signature<0..2^16-1>;
markrad 0:cdf462088d13 3825 * } DigitallySigned;
markrad 0:cdf462088d13 3826 */
markrad 0:cdf462088d13 3827 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
markrad 0:cdf462088d13 3828 defined(MBEDTLS_SSL_PROTO_TLS1_1)
markrad 0:cdf462088d13 3829 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 3830 {
markrad 0:cdf462088d13 3831 md_alg = MBEDTLS_MD_NONE;
markrad 0:cdf462088d13 3832 hashlen = 36;
markrad 0:cdf462088d13 3833
markrad 0:cdf462088d13 3834 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
markrad 0:cdf462088d13 3835 if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
markrad 0:cdf462088d13 3836 MBEDTLS_PK_ECDSA ) )
markrad 0:cdf462088d13 3837 {
markrad 0:cdf462088d13 3838 hash_start += 16;
markrad 0:cdf462088d13 3839 hashlen -= 16;
markrad 0:cdf462088d13 3840 md_alg = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 3841 }
markrad 0:cdf462088d13 3842 }
markrad 0:cdf462088d13 3843 else
markrad 0:cdf462088d13 3844 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
markrad 0:cdf462088d13 3845 MBEDTLS_SSL_PROTO_TLS1_1 */
markrad 0:cdf462088d13 3846 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
markrad 0:cdf462088d13 3847 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
markrad 0:cdf462088d13 3848 {
markrad 0:cdf462088d13 3849 if( i + 2 > ssl->in_hslen )
markrad 0:cdf462088d13 3850 {
markrad 0:cdf462088d13 3851 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
markrad 0:cdf462088d13 3852 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3853 }
markrad 0:cdf462088d13 3854
markrad 0:cdf462088d13 3855 /*
markrad 0:cdf462088d13 3856 * Hash
markrad 0:cdf462088d13 3857 */
markrad 0:cdf462088d13 3858 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] );
markrad 0:cdf462088d13 3859
markrad 0:cdf462088d13 3860 if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) )
markrad 0:cdf462088d13 3861 {
markrad 0:cdf462088d13 3862 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
markrad 0:cdf462088d13 3863 " for verify message" ) );
markrad 0:cdf462088d13 3864 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3865 }
markrad 0:cdf462088d13 3866
markrad 0:cdf462088d13 3867 #if !defined(MBEDTLS_MD_SHA1)
markrad 0:cdf462088d13 3868 if( MBEDTLS_MD_SHA1 == md_alg )
markrad 0:cdf462088d13 3869 hash_start += 16;
markrad 0:cdf462088d13 3870 #endif
markrad 0:cdf462088d13 3871
markrad 0:cdf462088d13 3872 /* Info from md_alg will be used instead */
markrad 0:cdf462088d13 3873 hashlen = 0;
markrad 0:cdf462088d13 3874
markrad 0:cdf462088d13 3875 i++;
markrad 0:cdf462088d13 3876
markrad 0:cdf462088d13 3877 /*
markrad 0:cdf462088d13 3878 * Signature
markrad 0:cdf462088d13 3879 */
markrad 0:cdf462088d13 3880 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
markrad 0:cdf462088d13 3881 == MBEDTLS_PK_NONE )
markrad 0:cdf462088d13 3882 {
markrad 0:cdf462088d13 3883 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
markrad 0:cdf462088d13 3884 " for verify message" ) );
markrad 0:cdf462088d13 3885 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3886 }
markrad 0:cdf462088d13 3887
markrad 0:cdf462088d13 3888 /*
markrad 0:cdf462088d13 3889 * Check the certificate's key type matches the signature alg
markrad 0:cdf462088d13 3890 */
markrad 0:cdf462088d13 3891 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
markrad 0:cdf462088d13 3892 {
markrad 0:cdf462088d13 3893 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
markrad 0:cdf462088d13 3894 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3895 }
markrad 0:cdf462088d13 3896
markrad 0:cdf462088d13 3897 i++;
markrad 0:cdf462088d13 3898 }
markrad 0:cdf462088d13 3899 else
markrad 0:cdf462088d13 3900 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
markrad 0:cdf462088d13 3901 {
markrad 0:cdf462088d13 3902 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
markrad 0:cdf462088d13 3903 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
markrad 0:cdf462088d13 3904 }
markrad 0:cdf462088d13 3905
markrad 0:cdf462088d13 3906 if( i + 2 > ssl->in_hslen )
markrad 0:cdf462088d13 3907 {
markrad 0:cdf462088d13 3908 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
markrad 0:cdf462088d13 3909 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3910 }
markrad 0:cdf462088d13 3911
markrad 0:cdf462088d13 3912 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
markrad 0:cdf462088d13 3913 i += 2;
markrad 0:cdf462088d13 3914
markrad 0:cdf462088d13 3915 if( i + sig_len != ssl->in_hslen )
markrad 0:cdf462088d13 3916 {
markrad 0:cdf462088d13 3917 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
markrad 0:cdf462088d13 3918 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
markrad 0:cdf462088d13 3919 }
markrad 0:cdf462088d13 3920
markrad 0:cdf462088d13 3921 /* Calculate hash and verify signature */
markrad 0:cdf462088d13 3922 ssl->handshake->calc_verify( ssl, hash );
markrad 0:cdf462088d13 3923
markrad 0:cdf462088d13 3924 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
markrad 0:cdf462088d13 3925 md_alg, hash_start, hashlen,
markrad 0:cdf462088d13 3926 ssl->in_msg + i, sig_len ) ) != 0 )
markrad 0:cdf462088d13 3927 {
markrad 0:cdf462088d13 3928 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
markrad 0:cdf462088d13 3929 return( ret );
markrad 0:cdf462088d13 3930 }
markrad 0:cdf462088d13 3931
markrad 0:cdf462088d13 3932 mbedtls_ssl_update_handshake_status( ssl );
markrad 0:cdf462088d13 3933
markrad 0:cdf462088d13 3934 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
markrad 0:cdf462088d13 3935
markrad 0:cdf462088d13 3936 return( ret );
markrad 0:cdf462088d13 3937 }
markrad 0:cdf462088d13 3938 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
markrad 0:cdf462088d13 3939 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
markrad 0:cdf462088d13 3940 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
markrad 0:cdf462088d13 3941 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
markrad 0:cdf462088d13 3942 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
markrad 0:cdf462088d13 3943 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
markrad 0:cdf462088d13 3944
markrad 0:cdf462088d13 3945 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 3946 static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 3947 {
markrad 0:cdf462088d13 3948 int ret;
markrad 0:cdf462088d13 3949 size_t tlen;
markrad 0:cdf462088d13 3950 uint32_t lifetime;
markrad 0:cdf462088d13 3951
markrad 0:cdf462088d13 3952 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
markrad 0:cdf462088d13 3953
markrad 0:cdf462088d13 3954 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
markrad 0:cdf462088d13 3955 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
markrad 0:cdf462088d13 3956
markrad 0:cdf462088d13 3957 /*
markrad 0:cdf462088d13 3958 * struct {
markrad 0:cdf462088d13 3959 * uint32 ticket_lifetime_hint;
markrad 0:cdf462088d13 3960 * opaque ticket<0..2^16-1>;
markrad 0:cdf462088d13 3961 * } NewSessionTicket;
markrad 0:cdf462088d13 3962 *
markrad 0:cdf462088d13 3963 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
markrad 0:cdf462088d13 3964 * 8 . 9 ticket_len (n)
markrad 0:cdf462088d13 3965 * 10 . 9+n ticket content
markrad 0:cdf462088d13 3966 */
markrad 0:cdf462088d13 3967
markrad 0:cdf462088d13 3968 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
markrad 0:cdf462088d13 3969 ssl->session_negotiate,
markrad 0:cdf462088d13 3970 ssl->out_msg + 10,
markrad 0:cdf462088d13 3971 ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
markrad 0:cdf462088d13 3972 &tlen, &lifetime ) ) != 0 )
markrad 0:cdf462088d13 3973 {
markrad 0:cdf462088d13 3974 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
markrad 0:cdf462088d13 3975 tlen = 0;
markrad 0:cdf462088d13 3976 }
markrad 0:cdf462088d13 3977
markrad 0:cdf462088d13 3978 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
markrad 0:cdf462088d13 3979 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
markrad 0:cdf462088d13 3980 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
markrad 0:cdf462088d13 3981 ssl->out_msg[7] = ( lifetime ) & 0xFF;
markrad 0:cdf462088d13 3982
markrad 0:cdf462088d13 3983 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
markrad 0:cdf462088d13 3984 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
markrad 0:cdf462088d13 3985
markrad 0:cdf462088d13 3986 ssl->out_msglen = 10 + tlen;
markrad 0:cdf462088d13 3987
markrad 0:cdf462088d13 3988 /*
markrad 0:cdf462088d13 3989 * Morally equivalent to updating ssl->state, but NewSessionTicket and
markrad 0:cdf462088d13 3990 * ChangeCipherSpec share the same state.
markrad 0:cdf462088d13 3991 */
markrad 0:cdf462088d13 3992 ssl->handshake->new_session_ticket = 0;
markrad 0:cdf462088d13 3993
markrad 0:cdf462088d13 3994 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
markrad 0:cdf462088d13 3995 {
markrad 0:cdf462088d13 3996 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
markrad 0:cdf462088d13 3997 return( ret );
markrad 0:cdf462088d13 3998 }
markrad 0:cdf462088d13 3999
markrad 0:cdf462088d13 4000 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
markrad 0:cdf462088d13 4001
markrad 0:cdf462088d13 4002 return( 0 );
markrad 0:cdf462088d13 4003 }
markrad 0:cdf462088d13 4004 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
markrad 0:cdf462088d13 4005
markrad 0:cdf462088d13 4006 /*
markrad 0:cdf462088d13 4007 * SSL handshake -- server side -- single step
markrad 0:cdf462088d13 4008 */
markrad 0:cdf462088d13 4009 int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
markrad 0:cdf462088d13 4010 {
markrad 0:cdf462088d13 4011 int ret = 0;
markrad 0:cdf462088d13 4012
markrad 0:cdf462088d13 4013 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
markrad 0:cdf462088d13 4014 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 4015
markrad 0:cdf462088d13 4016 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
markrad 0:cdf462088d13 4017
markrad 0:cdf462088d13 4018 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
markrad 0:cdf462088d13 4019 return( ret );
markrad 0:cdf462088d13 4020
markrad 0:cdf462088d13 4021 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 4022 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
markrad 0:cdf462088d13 4023 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
markrad 0:cdf462088d13 4024 {
markrad 0:cdf462088d13 4025 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
markrad 0:cdf462088d13 4026 return( ret );
markrad 0:cdf462088d13 4027 }
markrad 0:cdf462088d13 4028 #endif
markrad 0:cdf462088d13 4029
markrad 0:cdf462088d13 4030 switch( ssl->state )
markrad 0:cdf462088d13 4031 {
markrad 0:cdf462088d13 4032 case MBEDTLS_SSL_HELLO_REQUEST:
markrad 0:cdf462088d13 4033 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
markrad 0:cdf462088d13 4034 break;
markrad 0:cdf462088d13 4035
markrad 0:cdf462088d13 4036 /*
markrad 0:cdf462088d13 4037 * <== ClientHello
markrad 0:cdf462088d13 4038 */
markrad 0:cdf462088d13 4039 case MBEDTLS_SSL_CLIENT_HELLO:
markrad 0:cdf462088d13 4040 ret = ssl_parse_client_hello( ssl );
markrad 0:cdf462088d13 4041 break;
markrad 0:cdf462088d13 4042
markrad 0:cdf462088d13 4043 #if defined(MBEDTLS_SSL_PROTO_DTLS)
markrad 0:cdf462088d13 4044 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
markrad 0:cdf462088d13 4045 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
markrad 0:cdf462088d13 4046 #endif
markrad 0:cdf462088d13 4047
markrad 0:cdf462088d13 4048 /*
markrad 0:cdf462088d13 4049 * ==> ServerHello
markrad 0:cdf462088d13 4050 * Certificate
markrad 0:cdf462088d13 4051 * ( ServerKeyExchange )
markrad 0:cdf462088d13 4052 * ( CertificateRequest )
markrad 0:cdf462088d13 4053 * ServerHelloDone
markrad 0:cdf462088d13 4054 */
markrad 0:cdf462088d13 4055 case MBEDTLS_SSL_SERVER_HELLO:
markrad 0:cdf462088d13 4056 ret = ssl_write_server_hello( ssl );
markrad 0:cdf462088d13 4057 break;
markrad 0:cdf462088d13 4058
markrad 0:cdf462088d13 4059 case MBEDTLS_SSL_SERVER_CERTIFICATE:
markrad 0:cdf462088d13 4060 ret = mbedtls_ssl_write_certificate( ssl );
markrad 0:cdf462088d13 4061 break;
markrad 0:cdf462088d13 4062
markrad 0:cdf462088d13 4063 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
markrad 0:cdf462088d13 4064 ret = ssl_write_server_key_exchange( ssl );
markrad 0:cdf462088d13 4065 break;
markrad 0:cdf462088d13 4066
markrad 0:cdf462088d13 4067 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
markrad 0:cdf462088d13 4068 ret = ssl_write_certificate_request( ssl );
markrad 0:cdf462088d13 4069 break;
markrad 0:cdf462088d13 4070
markrad 0:cdf462088d13 4071 case MBEDTLS_SSL_SERVER_HELLO_DONE:
markrad 0:cdf462088d13 4072 ret = ssl_write_server_hello_done( ssl );
markrad 0:cdf462088d13 4073 break;
markrad 0:cdf462088d13 4074
markrad 0:cdf462088d13 4075 /*
markrad 0:cdf462088d13 4076 * <== ( Certificate/Alert )
markrad 0:cdf462088d13 4077 * ClientKeyExchange
markrad 0:cdf462088d13 4078 * ( CertificateVerify )
markrad 0:cdf462088d13 4079 * ChangeCipherSpec
markrad 0:cdf462088d13 4080 * Finished
markrad 0:cdf462088d13 4081 */
markrad 0:cdf462088d13 4082 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
markrad 0:cdf462088d13 4083 ret = mbedtls_ssl_parse_certificate( ssl );
markrad 0:cdf462088d13 4084 break;
markrad 0:cdf462088d13 4085
markrad 0:cdf462088d13 4086 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
markrad 0:cdf462088d13 4087 ret = ssl_parse_client_key_exchange( ssl );
markrad 0:cdf462088d13 4088 break;
markrad 0:cdf462088d13 4089
markrad 0:cdf462088d13 4090 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
markrad 0:cdf462088d13 4091 ret = ssl_parse_certificate_verify( ssl );
markrad 0:cdf462088d13 4092 break;
markrad 0:cdf462088d13 4093
markrad 0:cdf462088d13 4094 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
markrad 0:cdf462088d13 4095 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
markrad 0:cdf462088d13 4096 break;
markrad 0:cdf462088d13 4097
markrad 0:cdf462088d13 4098 case MBEDTLS_SSL_CLIENT_FINISHED:
markrad 0:cdf462088d13 4099 ret = mbedtls_ssl_parse_finished( ssl );
markrad 0:cdf462088d13 4100 break;
markrad 0:cdf462088d13 4101
markrad 0:cdf462088d13 4102 /*
markrad 0:cdf462088d13 4103 * ==> ( NewSessionTicket )
markrad 0:cdf462088d13 4104 * ChangeCipherSpec
markrad 0:cdf462088d13 4105 * Finished
markrad 0:cdf462088d13 4106 */
markrad 0:cdf462088d13 4107 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
markrad 0:cdf462088d13 4108 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
markrad 0:cdf462088d13 4109 if( ssl->handshake->new_session_ticket != 0 )
markrad 0:cdf462088d13 4110 ret = ssl_write_new_session_ticket( ssl );
markrad 0:cdf462088d13 4111 else
markrad 0:cdf462088d13 4112 #endif
markrad 0:cdf462088d13 4113 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
markrad 0:cdf462088d13 4114 break;
markrad 0:cdf462088d13 4115
markrad 0:cdf462088d13 4116 case MBEDTLS_SSL_SERVER_FINISHED:
markrad 0:cdf462088d13 4117 ret = mbedtls_ssl_write_finished( ssl );
markrad 0:cdf462088d13 4118 break;
markrad 0:cdf462088d13 4119
markrad 0:cdf462088d13 4120 case MBEDTLS_SSL_FLUSH_BUFFERS:
markrad 0:cdf462088d13 4121 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
markrad 0:cdf462088d13 4122 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
markrad 0:cdf462088d13 4123 break;
markrad 0:cdf462088d13 4124
markrad 0:cdf462088d13 4125 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
markrad 0:cdf462088d13 4126 mbedtls_ssl_handshake_wrapup( ssl );
markrad 0:cdf462088d13 4127 break;
markrad 0:cdf462088d13 4128
markrad 0:cdf462088d13 4129 default:
markrad 0:cdf462088d13 4130 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
markrad 0:cdf462088d13 4131 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
markrad 0:cdf462088d13 4132 }
markrad 0:cdf462088d13 4133
markrad 0:cdf462088d13 4134 return( ret );
markrad 0:cdf462088d13 4135 }
markrad 0:cdf462088d13 4136 #endif /* MBEDTLS_SSL_SRV_C */