WNCInterface - The WDCInterface is is a drop-in replacement for …

Avnet » Code » WNCInterface

The WDCInterface is is a drop-in replacement for an EthernetInterface class that allows the user to connect to the Internet with a Wistron NeWeb Corporation (WNC) M14A2A Series data module using the standard network Socket API's. This interface class is used in the AT&T Cellular IoT Starter Kit which is sold by Avnet (http://cloudconnectkits.org/product/att-cellular-iot-starter-kit).

Dependencies: WncControllerK64F

Dependents: WNCProximityMqtt Pubnub_ATT_IoT_SK_WNC_sync BluemixDemo BluemixQS ... more

See the WNCInterface README in the Wiki tab for detailed information on this library.

mbedtls/source/ssl_cli.c@12:0071cb144c7a, 2016-11-01 (annotated)

Committer:: JMF
Date:: Tue Nov 01 14:22:56 2016 +0000
Revision:: 12:0071cb144c7a

Adding mbedtls files

Who changed what in which revision?

User	Revision	Line number	New contents of line
JMF	12:0071cb144c7a	1	/*
JMF	12:0071cb144c7a	2	* SSLv3/TLSv1 client-side functions
JMF	12:0071cb144c7a	3	*
JMF	12:0071cb144c7a	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
JMF	12:0071cb144c7a	5	* SPDX-License-Identifier: Apache-2.0
JMF	12:0071cb144c7a	6	*
JMF	12:0071cb144c7a	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
JMF	12:0071cb144c7a	8	* not use this file except in compliance with the License.
JMF	12:0071cb144c7a	9	* You may obtain a copy of the License at
JMF	12:0071cb144c7a	10	*
JMF	12:0071cb144c7a	11	* http://www.apache.org/licenses/LICENSE-2.0
JMF	12:0071cb144c7a	12	*
JMF	12:0071cb144c7a	13	* Unless required by applicable law or agreed to in writing, software
JMF	12:0071cb144c7a	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
JMF	12:0071cb144c7a	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
JMF	12:0071cb144c7a	16	* See the License for the specific language governing permissions and
JMF	12:0071cb144c7a	17	* limitations under the License.
JMF	12:0071cb144c7a	18	*
JMF	12:0071cb144c7a	19	* This file is part of mbed TLS (https://tls.mbed.org)
JMF	12:0071cb144c7a	20	*/
JMF	12:0071cb144c7a	21
JMF	12:0071cb144c7a	22	#if !defined(MBEDTLS_CONFIG_FILE)
JMF	12:0071cb144c7a	23	#include "mbedtls/config.h"
JMF	12:0071cb144c7a	24	#else
JMF	12:0071cb144c7a	25	#include MBEDTLS_CONFIG_FILE
JMF	12:0071cb144c7a	26	#endif
JMF	12:0071cb144c7a	27
JMF	12:0071cb144c7a	28	#if defined(MBEDTLS_SSL_CLI_C)
JMF	12:0071cb144c7a	29
JMF	12:0071cb144c7a	30	#if defined(MBEDTLS_PLATFORM_C)
JMF	12:0071cb144c7a	31	#include "mbedtls/platform.h"
JMF	12:0071cb144c7a	32	#else
JMF	12:0071cb144c7a	33	#include <stdlib.h>
JMF	12:0071cb144c7a	34	#define mbedtls_calloc calloc
JMF	12:0071cb144c7a	35	#define mbedtls_free free
JMF	12:0071cb144c7a	36	#endif
JMF	12:0071cb144c7a	37
JMF	12:0071cb144c7a	38	#include "mbedtls/debug.h"
JMF	12:0071cb144c7a	39	#include "mbedtls/ssl.h"
JMF	12:0071cb144c7a	40	#include "mbedtls/ssl_internal.h"
JMF	12:0071cb144c7a	41
JMF	12:0071cb144c7a	42	#include <string.h>
JMF	12:0071cb144c7a	43
JMF	12:0071cb144c7a	44	#include <stdint.h>
JMF	12:0071cb144c7a	45
JMF	12:0071cb144c7a	46	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	47	#include "mbedtls/platform_time.h"
JMF	12:0071cb144c7a	48	#endif
JMF	12:0071cb144c7a	49
JMF	12:0071cb144c7a	50	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	51	/* Implementation that should never be optimized out by the compiler */
JMF	12:0071cb144c7a	52	static void mbedtls_zeroize( void *v, size_t n ) {
JMF	12:0071cb144c7a	53	volatile unsigned char p = v; while( n-- ) p++ = 0;
JMF	12:0071cb144c7a	54	}
JMF	12:0071cb144c7a	55	#endif
JMF	12:0071cb144c7a	56
JMF	12:0071cb144c7a	57	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	58	static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	59	unsigned char *buf,
JMF	12:0071cb144c7a	60	size_t *olen )
JMF	12:0071cb144c7a	61	{
JMF	12:0071cb144c7a	62	unsigned char *p = buf;
JMF	12:0071cb144c7a	63	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	64	size_t hostname_len;
JMF	12:0071cb144c7a	65
JMF	12:0071cb144c7a	66	*olen = 0;
JMF	12:0071cb144c7a	67
JMF	12:0071cb144c7a	68	if( ssl->hostname == NULL )
JMF	12:0071cb144c7a	69	return;
JMF	12:0071cb144c7a	70
JMF	12:0071cb144c7a	71	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
JMF	12:0071cb144c7a	72	ssl->hostname ) );
JMF	12:0071cb144c7a	73
JMF	12:0071cb144c7a	74	hostname_len = strlen( ssl->hostname );
JMF	12:0071cb144c7a	75
JMF	12:0071cb144c7a	76	if( end < p \|\| (size_t)( end - p ) < hostname_len + 9 )
JMF	12:0071cb144c7a	77	{
JMF	12:0071cb144c7a	78	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	79	return;
JMF	12:0071cb144c7a	80	}
JMF	12:0071cb144c7a	81
JMF	12:0071cb144c7a	82	/*
JMF	12:0071cb144c7a	83	* struct {
JMF	12:0071cb144c7a	84	* NameType name_type;
JMF	12:0071cb144c7a	85	* select (name_type) {
JMF	12:0071cb144c7a	86	* case host_name: HostName;
JMF	12:0071cb144c7a	87	* } name;
JMF	12:0071cb144c7a	88	* } ServerName;
JMF	12:0071cb144c7a	89	*
JMF	12:0071cb144c7a	90	* enum {
JMF	12:0071cb144c7a	91	* host_name(0), (255)
JMF	12:0071cb144c7a	92	* } NameType;
JMF	12:0071cb144c7a	93	*
JMF	12:0071cb144c7a	94	* opaque HostName<1..2^16-1>;
JMF	12:0071cb144c7a	95	*
JMF	12:0071cb144c7a	96	* struct {
JMF	12:0071cb144c7a	97	* ServerName server_name_list<1..2^16-1>
JMF	12:0071cb144c7a	98	* } ServerNameList;
JMF	12:0071cb144c7a	99	*/
JMF	12:0071cb144c7a	100	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	101	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
JMF	12:0071cb144c7a	102
JMF	12:0071cb144c7a	103	*p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	104	*p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
JMF	12:0071cb144c7a	105
JMF	12:0071cb144c7a	106	*p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	107	*p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
JMF	12:0071cb144c7a	108
JMF	12:0071cb144c7a	109	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
JMF	12:0071cb144c7a	110	*p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	111	*p++ = (unsigned char)( ( hostname_len ) & 0xFF );
JMF	12:0071cb144c7a	112
JMF	12:0071cb144c7a	113	memcpy( p, ssl->hostname, hostname_len );
JMF	12:0071cb144c7a	114
JMF	12:0071cb144c7a	115	*olen = hostname_len + 9;
JMF	12:0071cb144c7a	116	}
JMF	12:0071cb144c7a	117	#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
JMF	12:0071cb144c7a	118
JMF	12:0071cb144c7a	119	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	120	static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	121	unsigned char *buf,
JMF	12:0071cb144c7a	122	size_t *olen )
JMF	12:0071cb144c7a	123	{
JMF	12:0071cb144c7a	124	unsigned char *p = buf;
JMF	12:0071cb144c7a	125	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	126
JMF	12:0071cb144c7a	127	*olen = 0;
JMF	12:0071cb144c7a	128
JMF	12:0071cb144c7a	129	if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
JMF	12:0071cb144c7a	130	return;
JMF	12:0071cb144c7a	131
JMF	12:0071cb144c7a	132	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
JMF	12:0071cb144c7a	133
JMF	12:0071cb144c7a	134	if( end < p \|\| (size_t)( end - p ) < 5 + ssl->verify_data_len )
JMF	12:0071cb144c7a	135	{
JMF	12:0071cb144c7a	136	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	137	return;
JMF	12:0071cb144c7a	138	}
JMF	12:0071cb144c7a	139
JMF	12:0071cb144c7a	140	/*
JMF	12:0071cb144c7a	141	* Secure renegotiation
JMF	12:0071cb144c7a	142	*/
JMF	12:0071cb144c7a	143	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	144	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
JMF	12:0071cb144c7a	145
JMF	12:0071cb144c7a	146	*p++ = 0x00;
JMF	12:0071cb144c7a	147	*p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
JMF	12:0071cb144c7a	148	*p++ = ssl->verify_data_len & 0xFF;
JMF	12:0071cb144c7a	149
JMF	12:0071cb144c7a	150	memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
JMF	12:0071cb144c7a	151
JMF	12:0071cb144c7a	152	*olen = 5 + ssl->verify_data_len;
JMF	12:0071cb144c7a	153	}
JMF	12:0071cb144c7a	154	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	155
JMF	12:0071cb144c7a	156	/*
JMF	12:0071cb144c7a	157	* Only if we handle at least one key exchange that needs signatures.
JMF	12:0071cb144c7a	158	*/
JMF	12:0071cb144c7a	159	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
JMF	12:0071cb144c7a	160	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
JMF	12:0071cb144c7a	161	static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	162	unsigned char *buf,
JMF	12:0071cb144c7a	163	size_t *olen )
JMF	12:0071cb144c7a	164	{
JMF	12:0071cb144c7a	165	unsigned char *p = buf;
JMF	12:0071cb144c7a	166	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	167	size_t sig_alg_len = 0;
JMF	12:0071cb144c7a	168	const int *md;
JMF	12:0071cb144c7a	169	#if defined(MBEDTLS_RSA_C) \|\| defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	170	unsigned char *sig_alg_list = buf + 6;
JMF	12:0071cb144c7a	171	#endif
JMF	12:0071cb144c7a	172
JMF	12:0071cb144c7a	173	*olen = 0;
JMF	12:0071cb144c7a	174
JMF	12:0071cb144c7a	175	if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	176	return;
JMF	12:0071cb144c7a	177
JMF	12:0071cb144c7a	178	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
JMF	12:0071cb144c7a	179
JMF	12:0071cb144c7a	180	for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
JMF	12:0071cb144c7a	181	{
JMF	12:0071cb144c7a	182	#if defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	183	sig_alg_len += 2;
JMF	12:0071cb144c7a	184	#endif
JMF	12:0071cb144c7a	185	#if defined(MBEDTLS_RSA_C)
JMF	12:0071cb144c7a	186	sig_alg_len += 2;
JMF	12:0071cb144c7a	187	#endif
JMF	12:0071cb144c7a	188	}
JMF	12:0071cb144c7a	189
JMF	12:0071cb144c7a	190	if( end < p \|\| (size_t)( end - p ) < sig_alg_len + 6 )
JMF	12:0071cb144c7a	191	{
JMF	12:0071cb144c7a	192	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	193	return;
JMF	12:0071cb144c7a	194	}
JMF	12:0071cb144c7a	195
JMF	12:0071cb144c7a	196	/*
JMF	12:0071cb144c7a	197	* Prepare signature_algorithms extension (TLS 1.2)
JMF	12:0071cb144c7a	198	*/
JMF	12:0071cb144c7a	199	sig_alg_len = 0;
JMF	12:0071cb144c7a	200
JMF	12:0071cb144c7a	201	for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
JMF	12:0071cb144c7a	202	{
JMF	12:0071cb144c7a	203	#if defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	204	sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
JMF	12:0071cb144c7a	205	sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
JMF	12:0071cb144c7a	206	#endif
JMF	12:0071cb144c7a	207	#if defined(MBEDTLS_RSA_C)
JMF	12:0071cb144c7a	208	sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
JMF	12:0071cb144c7a	209	sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
JMF	12:0071cb144c7a	210	#endif
JMF	12:0071cb144c7a	211	}
JMF	12:0071cb144c7a	212
JMF	12:0071cb144c7a	213	/*
JMF	12:0071cb144c7a	214	* enum {
JMF	12:0071cb144c7a	215	* none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
JMF	12:0071cb144c7a	216	* sha512(6), (255)
JMF	12:0071cb144c7a	217	* } HashAlgorithm;
JMF	12:0071cb144c7a	218	*
JMF	12:0071cb144c7a	219	* enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
JMF	12:0071cb144c7a	220	* SignatureAlgorithm;
JMF	12:0071cb144c7a	221	*
JMF	12:0071cb144c7a	222	* struct {
JMF	12:0071cb144c7a	223	* HashAlgorithm hash;
JMF	12:0071cb144c7a	224	* SignatureAlgorithm signature;
JMF	12:0071cb144c7a	225	* } SignatureAndHashAlgorithm;
JMF	12:0071cb144c7a	226	*
JMF	12:0071cb144c7a	227	* SignatureAndHashAlgorithm
JMF	12:0071cb144c7a	228	* supported_signature_algorithms<2..2^16-2>;
JMF	12:0071cb144c7a	229	*/
JMF	12:0071cb144c7a	230	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	231	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
JMF	12:0071cb144c7a	232
JMF	12:0071cb144c7a	233	*p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	234	*p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
JMF	12:0071cb144c7a	235
JMF	12:0071cb144c7a	236	*p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	237	*p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
JMF	12:0071cb144c7a	238
JMF	12:0071cb144c7a	239	*olen = 6 + sig_alg_len;
JMF	12:0071cb144c7a	240	}
JMF	12:0071cb144c7a	241	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
JMF	12:0071cb144c7a	242	MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
JMF	12:0071cb144c7a	243
JMF	12:0071cb144c7a	244	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	245	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	246	static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	247	unsigned char *buf,
JMF	12:0071cb144c7a	248	size_t *olen )
JMF	12:0071cb144c7a	249	{
JMF	12:0071cb144c7a	250	unsigned char *p = buf;
JMF	12:0071cb144c7a	251	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	252	unsigned char *elliptic_curve_list = p + 6;
JMF	12:0071cb144c7a	253	size_t elliptic_curve_len = 0;
JMF	12:0071cb144c7a	254	const mbedtls_ecp_curve_info *info;
JMF	12:0071cb144c7a	255	#if defined(MBEDTLS_ECP_C)
JMF	12:0071cb144c7a	256	const mbedtls_ecp_group_id *grp_id;
JMF	12:0071cb144c7a	257	#else
JMF	12:0071cb144c7a	258	((void) ssl);
JMF	12:0071cb144c7a	259	#endif
JMF	12:0071cb144c7a	260
JMF	12:0071cb144c7a	261	*olen = 0;
JMF	12:0071cb144c7a	262
JMF	12:0071cb144c7a	263	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) );
JMF	12:0071cb144c7a	264
JMF	12:0071cb144c7a	265	#if defined(MBEDTLS_ECP_C)
JMF	12:0071cb144c7a	266	for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
JMF	12:0071cb144c7a	267	{
JMF	12:0071cb144c7a	268	info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
JMF	12:0071cb144c7a	269	#else
JMF	12:0071cb144c7a	270	for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
JMF	12:0071cb144c7a	271	{
JMF	12:0071cb144c7a	272	#endif
JMF	12:0071cb144c7a	273	if( info == NULL )
JMF	12:0071cb144c7a	274	{
JMF	12:0071cb144c7a	275	MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
JMF	12:0071cb144c7a	276	return;
JMF	12:0071cb144c7a	277	}
JMF	12:0071cb144c7a	278
JMF	12:0071cb144c7a	279	elliptic_curve_len += 2;
JMF	12:0071cb144c7a	280	}
JMF	12:0071cb144c7a	281
JMF	12:0071cb144c7a	282	if( end < p \|\| (size_t)( end - p ) < 6 + elliptic_curve_len )
JMF	12:0071cb144c7a	283	{
JMF	12:0071cb144c7a	284	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	285	return;
JMF	12:0071cb144c7a	286	}
JMF	12:0071cb144c7a	287
JMF	12:0071cb144c7a	288	elliptic_curve_len = 0;
JMF	12:0071cb144c7a	289
JMF	12:0071cb144c7a	290	#if defined(MBEDTLS_ECP_C)
JMF	12:0071cb144c7a	291	for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
JMF	12:0071cb144c7a	292	{
JMF	12:0071cb144c7a	293	info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
JMF	12:0071cb144c7a	294	#else
JMF	12:0071cb144c7a	295	for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
JMF	12:0071cb144c7a	296	{
JMF	12:0071cb144c7a	297	#endif
JMF	12:0071cb144c7a	298	elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
JMF	12:0071cb144c7a	299	elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
JMF	12:0071cb144c7a	300	}
JMF	12:0071cb144c7a	301
JMF	12:0071cb144c7a	302	if( elliptic_curve_len == 0 )
JMF	12:0071cb144c7a	303	return;
JMF	12:0071cb144c7a	304
JMF	12:0071cb144c7a	305	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	306	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES ) & 0xFF );
JMF	12:0071cb144c7a	307
JMF	12:0071cb144c7a	308	*p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	309	*p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
JMF	12:0071cb144c7a	310
JMF	12:0071cb144c7a	311	*p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	312	*p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
JMF	12:0071cb144c7a	313
JMF	12:0071cb144c7a	314	*olen = 6 + elliptic_curve_len;
JMF	12:0071cb144c7a	315	}
JMF	12:0071cb144c7a	316
JMF	12:0071cb144c7a	317	static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	318	unsigned char *buf,
JMF	12:0071cb144c7a	319	size_t *olen )
JMF	12:0071cb144c7a	320	{
JMF	12:0071cb144c7a	321	unsigned char *p = buf;
JMF	12:0071cb144c7a	322	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	323
JMF	12:0071cb144c7a	324	*olen = 0;
JMF	12:0071cb144c7a	325
JMF	12:0071cb144c7a	326	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) );
JMF	12:0071cb144c7a	327
JMF	12:0071cb144c7a	328	if( end < p \|\| (size_t)( end - p ) < 6 )
JMF	12:0071cb144c7a	329	{
JMF	12:0071cb144c7a	330	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	331	return;
JMF	12:0071cb144c7a	332	}
JMF	12:0071cb144c7a	333
JMF	12:0071cb144c7a	334	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	335	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
JMF	12:0071cb144c7a	336
JMF	12:0071cb144c7a	337	*p++ = 0x00;
JMF	12:0071cb144c7a	338	*p++ = 2;
JMF	12:0071cb144c7a	339
JMF	12:0071cb144c7a	340	*p++ = 1;
JMF	12:0071cb144c7a	341	*p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
JMF	12:0071cb144c7a	342
JMF	12:0071cb144c7a	343	*olen = 6;
JMF	12:0071cb144c7a	344	}
JMF	12:0071cb144c7a	345	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
JMF	12:0071cb144c7a	346	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	347
JMF	12:0071cb144c7a	348	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	349	static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	350	unsigned char *buf,
JMF	12:0071cb144c7a	351	size_t *olen )
JMF	12:0071cb144c7a	352	{
JMF	12:0071cb144c7a	353	int ret;
JMF	12:0071cb144c7a	354	unsigned char *p = buf;
JMF	12:0071cb144c7a	355	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	356	size_t kkpp_len;
JMF	12:0071cb144c7a	357
JMF	12:0071cb144c7a	358	*olen = 0;
JMF	12:0071cb144c7a	359
JMF	12:0071cb144c7a	360	/* Skip costly extension if we can't use EC J-PAKE anyway */
JMF	12:0071cb144c7a	361	if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
JMF	12:0071cb144c7a	362	return;
JMF	12:0071cb144c7a	363
JMF	12:0071cb144c7a	364	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) );
JMF	12:0071cb144c7a	365
JMF	12:0071cb144c7a	366	if( end - p < 4 )
JMF	12:0071cb144c7a	367	{
JMF	12:0071cb144c7a	368	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	369	return;
JMF	12:0071cb144c7a	370	}
JMF	12:0071cb144c7a	371
JMF	12:0071cb144c7a	372	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	373	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
JMF	12:0071cb144c7a	374
JMF	12:0071cb144c7a	375	/*
JMF	12:0071cb144c7a	376	* We may need to send ClientHello multiple times for Hello verification.
JMF	12:0071cb144c7a	377	* We don't want to compute fresh values every time (both for performance
JMF	12:0071cb144c7a	378	* and consistency reasons), so cache the extension content.
JMF	12:0071cb144c7a	379	*/
JMF	12:0071cb144c7a	380	if( ssl->handshake->ecjpake_cache == NULL \|\|
JMF	12:0071cb144c7a	381	ssl->handshake->ecjpake_cache_len == 0 )
JMF	12:0071cb144c7a	382	{
JMF	12:0071cb144c7a	383	MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
JMF	12:0071cb144c7a	384
JMF	12:0071cb144c7a	385	ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	386	p + 2, end - p - 2, &kkpp_len,
JMF	12:0071cb144c7a	387	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	388	if( ret != 0 )
JMF	12:0071cb144c7a	389	{
JMF	12:0071cb144c7a	390	MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
JMF	12:0071cb144c7a	391	return;
JMF	12:0071cb144c7a	392	}
JMF	12:0071cb144c7a	393
JMF	12:0071cb144c7a	394	ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
JMF	12:0071cb144c7a	395	if( ssl->handshake->ecjpake_cache == NULL )
JMF	12:0071cb144c7a	396	{
JMF	12:0071cb144c7a	397	MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
JMF	12:0071cb144c7a	398	return;
JMF	12:0071cb144c7a	399	}
JMF	12:0071cb144c7a	400
JMF	12:0071cb144c7a	401	memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
JMF	12:0071cb144c7a	402	ssl->handshake->ecjpake_cache_len = kkpp_len;
JMF	12:0071cb144c7a	403	}
JMF	12:0071cb144c7a	404	else
JMF	12:0071cb144c7a	405	{
JMF	12:0071cb144c7a	406	MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
JMF	12:0071cb144c7a	407
JMF	12:0071cb144c7a	408	kkpp_len = ssl->handshake->ecjpake_cache_len;
JMF	12:0071cb144c7a	409
JMF	12:0071cb144c7a	410	if( (size_t)( end - p - 2 ) < kkpp_len )
JMF	12:0071cb144c7a	411	{
JMF	12:0071cb144c7a	412	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	413	return;
JMF	12:0071cb144c7a	414	}
JMF	12:0071cb144c7a	415
JMF	12:0071cb144c7a	416	memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
JMF	12:0071cb144c7a	417	}
JMF	12:0071cb144c7a	418
JMF	12:0071cb144c7a	419	*p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	420	*p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
JMF	12:0071cb144c7a	421
JMF	12:0071cb144c7a	422	*olen = kkpp_len + 4;
JMF	12:0071cb144c7a	423	}
JMF	12:0071cb144c7a	424	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	425
JMF	12:0071cb144c7a	426	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	427	static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	428	unsigned char *buf,
JMF	12:0071cb144c7a	429	size_t *olen )
JMF	12:0071cb144c7a	430	{
JMF	12:0071cb144c7a	431	unsigned char *p = buf;
JMF	12:0071cb144c7a	432	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	433
JMF	12:0071cb144c7a	434	*olen = 0;
JMF	12:0071cb144c7a	435
JMF	12:0071cb144c7a	436	if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) {
JMF	12:0071cb144c7a	437	return;
JMF	12:0071cb144c7a	438	}
JMF	12:0071cb144c7a	439
JMF	12:0071cb144c7a	440	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) );
JMF	12:0071cb144c7a	441
JMF	12:0071cb144c7a	442	if( end < p \|\| (size_t)( end - p ) < 5 )
JMF	12:0071cb144c7a	443	{
JMF	12:0071cb144c7a	444	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	445	return;
JMF	12:0071cb144c7a	446	}
JMF	12:0071cb144c7a	447
JMF	12:0071cb144c7a	448	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	449	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
JMF	12:0071cb144c7a	450
JMF	12:0071cb144c7a	451	*p++ = 0x00;
JMF	12:0071cb144c7a	452	*p++ = 1;
JMF	12:0071cb144c7a	453
JMF	12:0071cb144c7a	454	*p++ = ssl->conf->mfl_code;
JMF	12:0071cb144c7a	455
JMF	12:0071cb144c7a	456	*olen = 5;
JMF	12:0071cb144c7a	457	}
JMF	12:0071cb144c7a	458	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
JMF	12:0071cb144c7a	459
JMF	12:0071cb144c7a	460	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	461	static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	462	unsigned char buf, size_t olen )
JMF	12:0071cb144c7a	463	{
JMF	12:0071cb144c7a	464	unsigned char *p = buf;
JMF	12:0071cb144c7a	465	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	466
JMF	12:0071cb144c7a	467	*olen = 0;
JMF	12:0071cb144c7a	468
JMF	12:0071cb144c7a	469	if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
JMF	12:0071cb144c7a	470	{
JMF	12:0071cb144c7a	471	return;
JMF	12:0071cb144c7a	472	}
JMF	12:0071cb144c7a	473
JMF	12:0071cb144c7a	474	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) );
JMF	12:0071cb144c7a	475
JMF	12:0071cb144c7a	476	if( end < p \|\| (size_t)( end - p ) < 4 )
JMF	12:0071cb144c7a	477	{
JMF	12:0071cb144c7a	478	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	479	return;
JMF	12:0071cb144c7a	480	}
JMF	12:0071cb144c7a	481
JMF	12:0071cb144c7a	482	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	483	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
JMF	12:0071cb144c7a	484
JMF	12:0071cb144c7a	485	*p++ = 0x00;
JMF	12:0071cb144c7a	486	*p++ = 0x00;
JMF	12:0071cb144c7a	487
JMF	12:0071cb144c7a	488	*olen = 4;
JMF	12:0071cb144c7a	489	}
JMF	12:0071cb144c7a	490	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
JMF	12:0071cb144c7a	491
JMF	12:0071cb144c7a	492	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	493	static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	494	unsigned char buf, size_t olen )
JMF	12:0071cb144c7a	495	{
JMF	12:0071cb144c7a	496	unsigned char *p = buf;
JMF	12:0071cb144c7a	497	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	498
JMF	12:0071cb144c7a	499	*olen = 0;
JMF	12:0071cb144c7a	500
JMF	12:0071cb144c7a	501	if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED \|\|
JMF	12:0071cb144c7a	502	ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	503	{
JMF	12:0071cb144c7a	504	return;
JMF	12:0071cb144c7a	505	}
JMF	12:0071cb144c7a	506
JMF	12:0071cb144c7a	507	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac "
JMF	12:0071cb144c7a	508	"extension" ) );
JMF	12:0071cb144c7a	509
JMF	12:0071cb144c7a	510	if( end < p \|\| (size_t)( end - p ) < 4 )
JMF	12:0071cb144c7a	511	{
JMF	12:0071cb144c7a	512	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	513	return;
JMF	12:0071cb144c7a	514	}
JMF	12:0071cb144c7a	515
JMF	12:0071cb144c7a	516	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	517	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
JMF	12:0071cb144c7a	518
JMF	12:0071cb144c7a	519	*p++ = 0x00;
JMF	12:0071cb144c7a	520	*p++ = 0x00;
JMF	12:0071cb144c7a	521
JMF	12:0071cb144c7a	522	*olen = 4;
JMF	12:0071cb144c7a	523	}
JMF	12:0071cb144c7a	524	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
JMF	12:0071cb144c7a	525
JMF	12:0071cb144c7a	526	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	527	static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	528	unsigned char buf, size_t olen )
JMF	12:0071cb144c7a	529	{
JMF	12:0071cb144c7a	530	unsigned char *p = buf;
JMF	12:0071cb144c7a	531	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	532
JMF	12:0071cb144c7a	533	*olen = 0;
JMF	12:0071cb144c7a	534
JMF	12:0071cb144c7a	535	if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
JMF	12:0071cb144c7a	536	ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	537	{
JMF	12:0071cb144c7a	538	return;
JMF	12:0071cb144c7a	539	}
JMF	12:0071cb144c7a	540
JMF	12:0071cb144c7a	541	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret "
JMF	12:0071cb144c7a	542	"extension" ) );
JMF	12:0071cb144c7a	543
JMF	12:0071cb144c7a	544	if( end < p \|\| (size_t)( end - p ) < 4 )
JMF	12:0071cb144c7a	545	{
JMF	12:0071cb144c7a	546	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	547	return;
JMF	12:0071cb144c7a	548	}
JMF	12:0071cb144c7a	549
JMF	12:0071cb144c7a	550	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	551	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
JMF	12:0071cb144c7a	552
JMF	12:0071cb144c7a	553	*p++ = 0x00;
JMF	12:0071cb144c7a	554	*p++ = 0x00;
JMF	12:0071cb144c7a	555
JMF	12:0071cb144c7a	556	*olen = 4;
JMF	12:0071cb144c7a	557	}
JMF	12:0071cb144c7a	558	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
JMF	12:0071cb144c7a	559
JMF	12:0071cb144c7a	560	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	561	static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	562	unsigned char buf, size_t olen )
JMF	12:0071cb144c7a	563	{
JMF	12:0071cb144c7a	564	unsigned char *p = buf;
JMF	12:0071cb144c7a	565	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	566	size_t tlen = ssl->session_negotiate->ticket_len;
JMF	12:0071cb144c7a	567
JMF	12:0071cb144c7a	568	*olen = 0;
JMF	12:0071cb144c7a	569
JMF	12:0071cb144c7a	570	if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
JMF	12:0071cb144c7a	571	{
JMF	12:0071cb144c7a	572	return;
JMF	12:0071cb144c7a	573	}
JMF	12:0071cb144c7a	574
JMF	12:0071cb144c7a	575	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) );
JMF	12:0071cb144c7a	576
JMF	12:0071cb144c7a	577	if( end < p \|\| (size_t)( end - p ) < 4 + tlen )
JMF	12:0071cb144c7a	578	{
JMF	12:0071cb144c7a	579	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	580	return;
JMF	12:0071cb144c7a	581	}
JMF	12:0071cb144c7a	582
JMF	12:0071cb144c7a	583	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	584	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
JMF	12:0071cb144c7a	585
JMF	12:0071cb144c7a	586	*p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	587	*p++ = (unsigned char)( ( tlen ) & 0xFF );
JMF	12:0071cb144c7a	588
JMF	12:0071cb144c7a	589	*olen = 4;
JMF	12:0071cb144c7a	590
JMF	12:0071cb144c7a	591	if( ssl->session_negotiate->ticket == NULL \|\| tlen == 0 )
JMF	12:0071cb144c7a	592	{
JMF	12:0071cb144c7a	593	return;
JMF	12:0071cb144c7a	594	}
JMF	12:0071cb144c7a	595
JMF	12:0071cb144c7a	596	MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) );
JMF	12:0071cb144c7a	597
JMF	12:0071cb144c7a	598	memcpy( p, ssl->session_negotiate->ticket, tlen );
JMF	12:0071cb144c7a	599
JMF	12:0071cb144c7a	600	*olen += tlen;
JMF	12:0071cb144c7a	601	}
JMF	12:0071cb144c7a	602	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	603
JMF	12:0071cb144c7a	604	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	605	static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	606	unsigned char buf, size_t olen )
JMF	12:0071cb144c7a	607	{
JMF	12:0071cb144c7a	608	unsigned char *p = buf;
JMF	12:0071cb144c7a	609	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	610	size_t alpnlen = 0;
JMF	12:0071cb144c7a	611	const char **cur;
JMF	12:0071cb144c7a	612
JMF	12:0071cb144c7a	613	*olen = 0;
JMF	12:0071cb144c7a	614
JMF	12:0071cb144c7a	615	if( ssl->conf->alpn_list == NULL )
JMF	12:0071cb144c7a	616	{
JMF	12:0071cb144c7a	617	return;
JMF	12:0071cb144c7a	618	}
JMF	12:0071cb144c7a	619
JMF	12:0071cb144c7a	620	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
JMF	12:0071cb144c7a	621
JMF	12:0071cb144c7a	622	for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
JMF	12:0071cb144c7a	623	alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1;
JMF	12:0071cb144c7a	624
JMF	12:0071cb144c7a	625	if( end < p \|\| (size_t)( end - p ) < 6 + alpnlen )
JMF	12:0071cb144c7a	626	{
JMF	12:0071cb144c7a	627	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	628	return;
JMF	12:0071cb144c7a	629	}
JMF	12:0071cb144c7a	630
JMF	12:0071cb144c7a	631	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	632	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
JMF	12:0071cb144c7a	633
JMF	12:0071cb144c7a	634	/*
JMF	12:0071cb144c7a	635	* opaque ProtocolName<1..2^8-1>;
JMF	12:0071cb144c7a	636	*
JMF	12:0071cb144c7a	637	* struct {
JMF	12:0071cb144c7a	638	* ProtocolName protocol_name_list<2..2^16-1>
JMF	12:0071cb144c7a	639	* } ProtocolNameList;
JMF	12:0071cb144c7a	640	*/
JMF	12:0071cb144c7a	641
JMF	12:0071cb144c7a	642	/* Skip writing extension and list length for now */
JMF	12:0071cb144c7a	643	p += 4;
JMF	12:0071cb144c7a	644
JMF	12:0071cb144c7a	645	for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
JMF	12:0071cb144c7a	646	{
JMF	12:0071cb144c7a	647	p = (unsigned char)( strlen( cur ) & 0xFF );
JMF	12:0071cb144c7a	648	memcpy( p + 1, cur, p );
JMF	12:0071cb144c7a	649	p += 1 + *p;
JMF	12:0071cb144c7a	650	}
JMF	12:0071cb144c7a	651
JMF	12:0071cb144c7a	652	*olen = p - buf;
JMF	12:0071cb144c7a	653
JMF	12:0071cb144c7a	654	/* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
JMF	12:0071cb144c7a	655	buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	656	buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
JMF	12:0071cb144c7a	657
JMF	12:0071cb144c7a	658	/* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
JMF	12:0071cb144c7a	659	buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	660	buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
JMF	12:0071cb144c7a	661	}
JMF	12:0071cb144c7a	662	#endif /* MBEDTLS_SSL_ALPN */
JMF	12:0071cb144c7a	663
JMF	12:0071cb144c7a	664	/*
JMF	12:0071cb144c7a	665	* Generate random bytes for ClientHello
JMF	12:0071cb144c7a	666	*/
JMF	12:0071cb144c7a	667	static int ssl_generate_random( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	668	{
JMF	12:0071cb144c7a	669	int ret;
JMF	12:0071cb144c7a	670	unsigned char *p = ssl->handshake->randbytes;
JMF	12:0071cb144c7a	671	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	672	mbedtls_time_t t;
JMF	12:0071cb144c7a	673	#endif
JMF	12:0071cb144c7a	674
JMF	12:0071cb144c7a	675	/*
JMF	12:0071cb144c7a	676	* When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
JMF	12:0071cb144c7a	677	*/
JMF	12:0071cb144c7a	678	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	679	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
JMF	12:0071cb144c7a	680	ssl->handshake->verify_cookie != NULL )
JMF	12:0071cb144c7a	681	{
JMF	12:0071cb144c7a	682	return( 0 );
JMF	12:0071cb144c7a	683	}
JMF	12:0071cb144c7a	684	#endif
JMF	12:0071cb144c7a	685
JMF	12:0071cb144c7a	686	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	687	t = mbedtls_time( NULL );
JMF	12:0071cb144c7a	688	*p++ = (unsigned char)( t >> 24 );
JMF	12:0071cb144c7a	689	*p++ = (unsigned char)( t >> 16 );
JMF	12:0071cb144c7a	690	*p++ = (unsigned char)( t >> 8 );
JMF	12:0071cb144c7a	691	*p++ = (unsigned char)( t );
JMF	12:0071cb144c7a	692
JMF	12:0071cb144c7a	693	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
JMF	12:0071cb144c7a	694	#else
JMF	12:0071cb144c7a	695	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
JMF	12:0071cb144c7a	696	return( ret );
JMF	12:0071cb144c7a	697
JMF	12:0071cb144c7a	698	p += 4;
JMF	12:0071cb144c7a	699	#endif /* MBEDTLS_HAVE_TIME */
JMF	12:0071cb144c7a	700
JMF	12:0071cb144c7a	701	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
JMF	12:0071cb144c7a	702	return( ret );
JMF	12:0071cb144c7a	703
JMF	12:0071cb144c7a	704	return( 0 );
JMF	12:0071cb144c7a	705	}
JMF	12:0071cb144c7a	706
JMF	12:0071cb144c7a	707	static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	708	{
JMF	12:0071cb144c7a	709	int ret;
JMF	12:0071cb144c7a	710	size_t i, n, olen, ext_len = 0;
JMF	12:0071cb144c7a	711	unsigned char *buf;
JMF	12:0071cb144c7a	712	unsigned char p, q;
JMF	12:0071cb144c7a	713	unsigned char offer_compress;
JMF	12:0071cb144c7a	714	const int *ciphersuites;
JMF	12:0071cb144c7a	715	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
JMF	12:0071cb144c7a	716
JMF	12:0071cb144c7a	717	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
JMF	12:0071cb144c7a	718
JMF	12:0071cb144c7a	719	if( ssl->conf->f_rng == NULL )
JMF	12:0071cb144c7a	720	{
JMF	12:0071cb144c7a	721	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
JMF	12:0071cb144c7a	722	return( MBEDTLS_ERR_SSL_NO_RNG );
JMF	12:0071cb144c7a	723	}
JMF	12:0071cb144c7a	724
JMF	12:0071cb144c7a	725	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	726	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	727	#endif
JMF	12:0071cb144c7a	728	{
JMF	12:0071cb144c7a	729	ssl->major_ver = ssl->conf->min_major_ver;
JMF	12:0071cb144c7a	730	ssl->minor_ver = ssl->conf->min_minor_ver;
JMF	12:0071cb144c7a	731	}
JMF	12:0071cb144c7a	732
JMF	12:0071cb144c7a	733	if( ssl->conf->max_major_ver == 0 )
JMF	12:0071cb144c7a	734	{
JMF	12:0071cb144c7a	735	MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, "
JMF	12:0071cb144c7a	736	"consider using mbedtls_ssl_config_defaults()" ) );
JMF	12:0071cb144c7a	737	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	738	}
JMF	12:0071cb144c7a	739
JMF	12:0071cb144c7a	740	/*
JMF	12:0071cb144c7a	741	* 0 . 0 handshake type
JMF	12:0071cb144c7a	742	* 1 . 3 handshake length
JMF	12:0071cb144c7a	743	* 4 . 5 highest version supported
JMF	12:0071cb144c7a	744	* 6 . 9 current UNIX time
JMF	12:0071cb144c7a	745	* 10 . 37 random bytes
JMF	12:0071cb144c7a	746	*/
JMF	12:0071cb144c7a	747	buf = ssl->out_msg;
JMF	12:0071cb144c7a	748	p = buf + 4;
JMF	12:0071cb144c7a	749
JMF	12:0071cb144c7a	750	mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
JMF	12:0071cb144c7a	751	ssl->conf->transport, p );
JMF	12:0071cb144c7a	752	p += 2;
JMF	12:0071cb144c7a	753
JMF	12:0071cb144c7a	754	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
JMF	12:0071cb144c7a	755	buf[4], buf[5] ) );
JMF	12:0071cb144c7a	756
JMF	12:0071cb144c7a	757	if( ( ret = ssl_generate_random( ssl ) ) != 0 )
JMF	12:0071cb144c7a	758	{
JMF	12:0071cb144c7a	759	MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
JMF	12:0071cb144c7a	760	return( ret );
JMF	12:0071cb144c7a	761	}
JMF	12:0071cb144c7a	762
JMF	12:0071cb144c7a	763	memcpy( p, ssl->handshake->randbytes, 32 );
JMF	12:0071cb144c7a	764	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
JMF	12:0071cb144c7a	765	p += 32;
JMF	12:0071cb144c7a	766
JMF	12:0071cb144c7a	767	/*
JMF	12:0071cb144c7a	768	* 38 . 38 session id length
JMF	12:0071cb144c7a	769	* 39 . 39+n session id
JMF	12:0071cb144c7a	770	* 39+n . 39+n DTLS only: cookie length (1 byte)
JMF	12:0071cb144c7a	771	* 40+n . .. DTSL only: cookie
JMF	12:0071cb144c7a	772	* .. . .. ciphersuitelist length (2 bytes)
JMF	12:0071cb144c7a	773	* .. . .. ciphersuitelist
JMF	12:0071cb144c7a	774	* .. . .. compression methods length (1 byte)
JMF	12:0071cb144c7a	775	* .. . .. compression methods
JMF	12:0071cb144c7a	776	* .. . .. extensions length (2 bytes)
JMF	12:0071cb144c7a	777	* .. . .. extensions
JMF	12:0071cb144c7a	778	*/
JMF	12:0071cb144c7a	779	n = ssl->session_negotiate->id_len;
JMF	12:0071cb144c7a	780
JMF	12:0071cb144c7a	781	if( n < 16 \|\| n > 32 \|\|
JMF	12:0071cb144c7a	782	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	783	ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE \|\|
JMF	12:0071cb144c7a	784	#endif
JMF	12:0071cb144c7a	785	ssl->handshake->resume == 0 )
JMF	12:0071cb144c7a	786	{
JMF	12:0071cb144c7a	787	n = 0;
JMF	12:0071cb144c7a	788	}
JMF	12:0071cb144c7a	789
JMF	12:0071cb144c7a	790	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	791	/*
JMF	12:0071cb144c7a	792	* RFC 5077 section 3.4: "When presenting a ticket, the client MAY
JMF	12:0071cb144c7a	793	* generate and include a Session ID in the TLS ClientHello."
JMF	12:0071cb144c7a	794	*/
JMF	12:0071cb144c7a	795	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	796	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	797	#endif
JMF	12:0071cb144c7a	798	{
JMF	12:0071cb144c7a	799	if( ssl->session_negotiate->ticket != NULL &&
JMF	12:0071cb144c7a	800	ssl->session_negotiate->ticket_len != 0 )
JMF	12:0071cb144c7a	801	{
JMF	12:0071cb144c7a	802	ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 );
JMF	12:0071cb144c7a	803
JMF	12:0071cb144c7a	804	if( ret != 0 )
JMF	12:0071cb144c7a	805	return( ret );
JMF	12:0071cb144c7a	806
JMF	12:0071cb144c7a	807	ssl->session_negotiate->id_len = n = 32;
JMF	12:0071cb144c7a	808	}
JMF	12:0071cb144c7a	809	}
JMF	12:0071cb144c7a	810	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	811
JMF	12:0071cb144c7a	812	*p++ = (unsigned char) n;
JMF	12:0071cb144c7a	813
JMF	12:0071cb144c7a	814	for( i = 0; i < n; i++ )
JMF	12:0071cb144c7a	815	*p++ = ssl->session_negotiate->id[i];
JMF	12:0071cb144c7a	816
JMF	12:0071cb144c7a	817	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
JMF	12:0071cb144c7a	818	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
JMF	12:0071cb144c7a	819
JMF	12:0071cb144c7a	820	/*
JMF	12:0071cb144c7a	821	* DTLS cookie
JMF	12:0071cb144c7a	822	*/
JMF	12:0071cb144c7a	823	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	824	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	825	{
JMF	12:0071cb144c7a	826	if( ssl->handshake->verify_cookie == NULL )
JMF	12:0071cb144c7a	827	{
JMF	12:0071cb144c7a	828	MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
JMF	12:0071cb144c7a	829	*p++ = 0;
JMF	12:0071cb144c7a	830	}
JMF	12:0071cb144c7a	831	else
JMF	12:0071cb144c7a	832	{
JMF	12:0071cb144c7a	833	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
JMF	12:0071cb144c7a	834	ssl->handshake->verify_cookie,
JMF	12:0071cb144c7a	835	ssl->handshake->verify_cookie_len );
JMF	12:0071cb144c7a	836
JMF	12:0071cb144c7a	837	*p++ = ssl->handshake->verify_cookie_len;
JMF	12:0071cb144c7a	838	memcpy( p, ssl->handshake->verify_cookie,
JMF	12:0071cb144c7a	839	ssl->handshake->verify_cookie_len );
JMF	12:0071cb144c7a	840	p += ssl->handshake->verify_cookie_len;
JMF	12:0071cb144c7a	841	}
JMF	12:0071cb144c7a	842	}
JMF	12:0071cb144c7a	843	#endif
JMF	12:0071cb144c7a	844
JMF	12:0071cb144c7a	845	/*
JMF	12:0071cb144c7a	846	* Ciphersuite list
JMF	12:0071cb144c7a	847	*/
JMF	12:0071cb144c7a	848	ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
JMF	12:0071cb144c7a	849
JMF	12:0071cb144c7a	850	/* Skip writing ciphersuite length for now */
JMF	12:0071cb144c7a	851	n = 0;
JMF	12:0071cb144c7a	852	q = p;
JMF	12:0071cb144c7a	853	p += 2;
JMF	12:0071cb144c7a	854
JMF	12:0071cb144c7a	855	for( i = 0; ciphersuites[i] != 0; i++ )
JMF	12:0071cb144c7a	856	{
JMF	12:0071cb144c7a	857	ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
JMF	12:0071cb144c7a	858
JMF	12:0071cb144c7a	859	if( ciphersuite_info == NULL )
JMF	12:0071cb144c7a	860	continue;
JMF	12:0071cb144c7a	861
JMF	12:0071cb144c7a	862	if( ciphersuite_info->min_minor_ver > ssl->conf->max_minor_ver \|\|
JMF	12:0071cb144c7a	863	ciphersuite_info->max_minor_ver < ssl->conf->min_minor_ver )
JMF	12:0071cb144c7a	864	continue;
JMF	12:0071cb144c7a	865
JMF	12:0071cb144c7a	866	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	867	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
JMF	12:0071cb144c7a	868	( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
JMF	12:0071cb144c7a	869	continue;
JMF	12:0071cb144c7a	870	#endif
JMF	12:0071cb144c7a	871
JMF	12:0071cb144c7a	872	#if defined(MBEDTLS_ARC4_C)
JMF	12:0071cb144c7a	873	if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
JMF	12:0071cb144c7a	874	ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
JMF	12:0071cb144c7a	875	continue;
JMF	12:0071cb144c7a	876	#endif
JMF	12:0071cb144c7a	877
JMF	12:0071cb144c7a	878	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	879	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
JMF	12:0071cb144c7a	880	mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
JMF	12:0071cb144c7a	881	continue;
JMF	12:0071cb144c7a	882	#endif
JMF	12:0071cb144c7a	883
JMF	12:0071cb144c7a	884	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
JMF	12:0071cb144c7a	885	ciphersuites[i] ) );
JMF	12:0071cb144c7a	886
JMF	12:0071cb144c7a	887	n++;
JMF	12:0071cb144c7a	888	*p++ = (unsigned char)( ciphersuites[i] >> 8 );
JMF	12:0071cb144c7a	889	*p++ = (unsigned char)( ciphersuites[i] );
JMF	12:0071cb144c7a	890	}
JMF	12:0071cb144c7a	891
JMF	12:0071cb144c7a	892	/*
JMF	12:0071cb144c7a	893	* Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
JMF	12:0071cb144c7a	894	*/
JMF	12:0071cb144c7a	895	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	896	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	897	#endif
JMF	12:0071cb144c7a	898	{
JMF	12:0071cb144c7a	899	*p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
JMF	12:0071cb144c7a	900	*p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
JMF	12:0071cb144c7a	901	n++;
JMF	12:0071cb144c7a	902	}
JMF	12:0071cb144c7a	903
JMF	12:0071cb144c7a	904	/* Some versions of OpenSSL don't handle it correctly if not at end */
JMF	12:0071cb144c7a	905	#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
JMF	12:0071cb144c7a	906	if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
JMF	12:0071cb144c7a	907	{
JMF	12:0071cb144c7a	908	MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
JMF	12:0071cb144c7a	909	*p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
JMF	12:0071cb144c7a	910	*p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
JMF	12:0071cb144c7a	911	n++;
JMF	12:0071cb144c7a	912	}
JMF	12:0071cb144c7a	913	#endif
JMF	12:0071cb144c7a	914
JMF	12:0071cb144c7a	915	*q++ = (unsigned char)( n >> 7 );
JMF	12:0071cb144c7a	916	*q++ = (unsigned char)( n << 1 );
JMF	12:0071cb144c7a	917
JMF	12:0071cb144c7a	918	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
JMF	12:0071cb144c7a	919
JMF	12:0071cb144c7a	920	#if defined(MBEDTLS_ZLIB_SUPPORT)
JMF	12:0071cb144c7a	921	offer_compress = 1;
JMF	12:0071cb144c7a	922	#else
JMF	12:0071cb144c7a	923	offer_compress = 0;
JMF	12:0071cb144c7a	924	#endif
JMF	12:0071cb144c7a	925
JMF	12:0071cb144c7a	926	/*
JMF	12:0071cb144c7a	927	* We don't support compression with DTLS right now: is many records come
JMF	12:0071cb144c7a	928	* in the same datagram, uncompressing one could overwrite the next one.
JMF	12:0071cb144c7a	929	* We don't want to add complexity for handling that case unless there is
JMF	12:0071cb144c7a	930	* an actual need for it.
JMF	12:0071cb144c7a	931	*/
JMF	12:0071cb144c7a	932	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	933	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	934	offer_compress = 0;
JMF	12:0071cb144c7a	935	#endif
JMF	12:0071cb144c7a	936
JMF	12:0071cb144c7a	937	if( offer_compress )
JMF	12:0071cb144c7a	938	{
JMF	12:0071cb144c7a	939	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
JMF	12:0071cb144c7a	940	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
JMF	12:0071cb144c7a	941	MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) );
JMF	12:0071cb144c7a	942
JMF	12:0071cb144c7a	943	*p++ = 2;
JMF	12:0071cb144c7a	944	*p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
JMF	12:0071cb144c7a	945	*p++ = MBEDTLS_SSL_COMPRESS_NULL;
JMF	12:0071cb144c7a	946	}
JMF	12:0071cb144c7a	947	else
JMF	12:0071cb144c7a	948	{
JMF	12:0071cb144c7a	949	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
JMF	12:0071cb144c7a	950	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
JMF	12:0071cb144c7a	951	MBEDTLS_SSL_COMPRESS_NULL ) );
JMF	12:0071cb144c7a	952
JMF	12:0071cb144c7a	953	*p++ = 1;
JMF	12:0071cb144c7a	954	*p++ = MBEDTLS_SSL_COMPRESS_NULL;
JMF	12:0071cb144c7a	955	}
JMF	12:0071cb144c7a	956
JMF	12:0071cb144c7a	957	// First write extensions, then the total length
JMF	12:0071cb144c7a	958	//
JMF	12:0071cb144c7a	959	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	960	ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	961	ext_len += olen;
JMF	12:0071cb144c7a	962	#endif
JMF	12:0071cb144c7a	963
JMF	12:0071cb144c7a	964	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	965	ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	966	ext_len += olen;
JMF	12:0071cb144c7a	967	#endif
JMF	12:0071cb144c7a	968
JMF	12:0071cb144c7a	969	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
JMF	12:0071cb144c7a	970	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
JMF	12:0071cb144c7a	971	ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	972	ext_len += olen;
JMF	12:0071cb144c7a	973	#endif
JMF	12:0071cb144c7a	974
JMF	12:0071cb144c7a	975	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	976	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	977	ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	978	ext_len += olen;
JMF	12:0071cb144c7a	979
JMF	12:0071cb144c7a	980	ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	981	ext_len += olen;
JMF	12:0071cb144c7a	982	#endif
JMF	12:0071cb144c7a	983
JMF	12:0071cb144c7a	984	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	985	ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	986	ext_len += olen;
JMF	12:0071cb144c7a	987	#endif
JMF	12:0071cb144c7a	988
JMF	12:0071cb144c7a	989	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	990	ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	991	ext_len += olen;
JMF	12:0071cb144c7a	992	#endif
JMF	12:0071cb144c7a	993
JMF	12:0071cb144c7a	994	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	995	ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	996	ext_len += olen;
JMF	12:0071cb144c7a	997	#endif
JMF	12:0071cb144c7a	998
JMF	12:0071cb144c7a	999	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	1000	ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	1001	ext_len += olen;
JMF	12:0071cb144c7a	1002	#endif
JMF	12:0071cb144c7a	1003
JMF	12:0071cb144c7a	1004	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	1005	ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	1006	ext_len += olen;
JMF	12:0071cb144c7a	1007	#endif
JMF	12:0071cb144c7a	1008
JMF	12:0071cb144c7a	1009	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	1010	ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	1011	ext_len += olen;
JMF	12:0071cb144c7a	1012	#endif
JMF	12:0071cb144c7a	1013
JMF	12:0071cb144c7a	1014	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	1015	ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	1016	ext_len += olen;
JMF	12:0071cb144c7a	1017	#endif
JMF	12:0071cb144c7a	1018
JMF	12:0071cb144c7a	1019	/* olen unused if all extensions are disabled */
JMF	12:0071cb144c7a	1020	((void) olen);
JMF	12:0071cb144c7a	1021
JMF	12:0071cb144c7a	1022	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
JMF	12:0071cb144c7a	1023	ext_len ) );
JMF	12:0071cb144c7a	1024
JMF	12:0071cb144c7a	1025	if( ext_len > 0 )
JMF	12:0071cb144c7a	1026	{
JMF	12:0071cb144c7a	1027	*p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	1028	*p++ = (unsigned char)( ( ext_len ) & 0xFF );
JMF	12:0071cb144c7a	1029	p += ext_len;
JMF	12:0071cb144c7a	1030	}
JMF	12:0071cb144c7a	1031
JMF	12:0071cb144c7a	1032	ssl->out_msglen = p - buf;
JMF	12:0071cb144c7a	1033	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	1034	ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
JMF	12:0071cb144c7a	1035
JMF	12:0071cb144c7a	1036	ssl->state++;
JMF	12:0071cb144c7a	1037
JMF	12:0071cb144c7a	1038	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1039	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1040	mbedtls_ssl_send_flight_completed( ssl );
JMF	12:0071cb144c7a	1041	#endif
JMF	12:0071cb144c7a	1042
JMF	12:0071cb144c7a	1043	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1044	{
JMF	12:0071cb144c7a	1045	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	1046	return( ret );
JMF	12:0071cb144c7a	1047	}
JMF	12:0071cb144c7a	1048
JMF	12:0071cb144c7a	1049	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
JMF	12:0071cb144c7a	1050
JMF	12:0071cb144c7a	1051	return( 0 );
JMF	12:0071cb144c7a	1052	}
JMF	12:0071cb144c7a	1053
JMF	12:0071cb144c7a	1054	static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1055	const unsigned char *buf,
JMF	12:0071cb144c7a	1056	size_t len )
JMF	12:0071cb144c7a	1057	{
JMF	12:0071cb144c7a	1058	int ret;
JMF	12:0071cb144c7a	1059
JMF	12:0071cb144c7a	1060	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1061	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	1062	{
JMF	12:0071cb144c7a	1063	/* Check verify-data in constant-time. The length OTOH is no secret */
JMF	12:0071cb144c7a	1064	if( len != 1 + ssl->verify_data_len * 2 \|\|
JMF	12:0071cb144c7a	1065	buf[0] != ssl->verify_data_len * 2 \|\|
JMF	12:0071cb144c7a	1066	mbedtls_ssl_safer_memcmp( buf + 1,
JMF	12:0071cb144c7a	1067	ssl->own_verify_data, ssl->verify_data_len ) != 0 \|\|
JMF	12:0071cb144c7a	1068	mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
JMF	12:0071cb144c7a	1069	ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
JMF	12:0071cb144c7a	1070	{
JMF	12:0071cb144c7a	1071	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
JMF	12:0071cb144c7a	1072
JMF	12:0071cb144c7a	1073	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1074	return( ret );
JMF	12:0071cb144c7a	1075
JMF	12:0071cb144c7a	1076	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1077	}
JMF	12:0071cb144c7a	1078	}
JMF	12:0071cb144c7a	1079	else
JMF	12:0071cb144c7a	1080	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	1081	{
JMF	12:0071cb144c7a	1082	if( len != 1 \|\| buf[0] != 0x00 )
JMF	12:0071cb144c7a	1083	{
JMF	12:0071cb144c7a	1084	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
JMF	12:0071cb144c7a	1085
JMF	12:0071cb144c7a	1086	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1087	return( ret );
JMF	12:0071cb144c7a	1088
JMF	12:0071cb144c7a	1089	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1090	}
JMF	12:0071cb144c7a	1091
JMF	12:0071cb144c7a	1092	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
JMF	12:0071cb144c7a	1093	}
JMF	12:0071cb144c7a	1094
JMF	12:0071cb144c7a	1095	return( 0 );
JMF	12:0071cb144c7a	1096	}
JMF	12:0071cb144c7a	1097
JMF	12:0071cb144c7a	1098	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	1099	static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1100	const unsigned char *buf,
JMF	12:0071cb144c7a	1101	size_t len )
JMF	12:0071cb144c7a	1102	{
JMF	12:0071cb144c7a	1103	/*
JMF	12:0071cb144c7a	1104	* server should use the extension only if we did,
JMF	12:0071cb144c7a	1105	* and if so the server's value should match ours (and len is always 1)
JMF	12:0071cb144c7a	1106	*/
JMF	12:0071cb144c7a	1107	if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE \|\|
JMF	12:0071cb144c7a	1108	len != 1 \|\|
JMF	12:0071cb144c7a	1109	buf[0] != ssl->conf->mfl_code )
JMF	12:0071cb144c7a	1110	{
JMF	12:0071cb144c7a	1111	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1112	}
JMF	12:0071cb144c7a	1113
JMF	12:0071cb144c7a	1114	return( 0 );
JMF	12:0071cb144c7a	1115	}
JMF	12:0071cb144c7a	1116	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
JMF	12:0071cb144c7a	1117
JMF	12:0071cb144c7a	1118	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	1119	static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1120	const unsigned char *buf,
JMF	12:0071cb144c7a	1121	size_t len )
JMF	12:0071cb144c7a	1122	{
JMF	12:0071cb144c7a	1123	if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED \|\|
JMF	12:0071cb144c7a	1124	len != 0 )
JMF	12:0071cb144c7a	1125	{
JMF	12:0071cb144c7a	1126	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1127	}
JMF	12:0071cb144c7a	1128
JMF	12:0071cb144c7a	1129	((void) buf);
JMF	12:0071cb144c7a	1130
JMF	12:0071cb144c7a	1131	ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
JMF	12:0071cb144c7a	1132
JMF	12:0071cb144c7a	1133	return( 0 );
JMF	12:0071cb144c7a	1134	}
JMF	12:0071cb144c7a	1135	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
JMF	12:0071cb144c7a	1136
JMF	12:0071cb144c7a	1137	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	1138	static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1139	const unsigned char *buf,
JMF	12:0071cb144c7a	1140	size_t len )
JMF	12:0071cb144c7a	1141	{
JMF	12:0071cb144c7a	1142	if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED \|\|
JMF	12:0071cb144c7a	1143	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 \|\|
JMF	12:0071cb144c7a	1144	len != 0 )
JMF	12:0071cb144c7a	1145	{
JMF	12:0071cb144c7a	1146	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1147	}
JMF	12:0071cb144c7a	1148
JMF	12:0071cb144c7a	1149	((void) buf);
JMF	12:0071cb144c7a	1150
JMF	12:0071cb144c7a	1151	ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
JMF	12:0071cb144c7a	1152
JMF	12:0071cb144c7a	1153	return( 0 );
JMF	12:0071cb144c7a	1154	}
JMF	12:0071cb144c7a	1155	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
JMF	12:0071cb144c7a	1156
JMF	12:0071cb144c7a	1157	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	1158	static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1159	const unsigned char *buf,
JMF	12:0071cb144c7a	1160	size_t len )
JMF	12:0071cb144c7a	1161	{
JMF	12:0071cb144c7a	1162	if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
JMF	12:0071cb144c7a	1163	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 \|\|
JMF	12:0071cb144c7a	1164	len != 0 )
JMF	12:0071cb144c7a	1165	{
JMF	12:0071cb144c7a	1166	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1167	}
JMF	12:0071cb144c7a	1168
JMF	12:0071cb144c7a	1169	((void) buf);
JMF	12:0071cb144c7a	1170
JMF	12:0071cb144c7a	1171	ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
JMF	12:0071cb144c7a	1172
JMF	12:0071cb144c7a	1173	return( 0 );
JMF	12:0071cb144c7a	1174	}
JMF	12:0071cb144c7a	1175	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
JMF	12:0071cb144c7a	1176
JMF	12:0071cb144c7a	1177	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	1178	static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1179	const unsigned char *buf,
JMF	12:0071cb144c7a	1180	size_t len )
JMF	12:0071cb144c7a	1181	{
JMF	12:0071cb144c7a	1182	if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED \|\|
JMF	12:0071cb144c7a	1183	len != 0 )
JMF	12:0071cb144c7a	1184	{
JMF	12:0071cb144c7a	1185	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1186	}
JMF	12:0071cb144c7a	1187
JMF	12:0071cb144c7a	1188	((void) buf);
JMF	12:0071cb144c7a	1189
JMF	12:0071cb144c7a	1190	ssl->handshake->new_session_ticket = 1;
JMF	12:0071cb144c7a	1191
JMF	12:0071cb144c7a	1192	return( 0 );
JMF	12:0071cb144c7a	1193	}
JMF	12:0071cb144c7a	1194	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	1195
JMF	12:0071cb144c7a	1196	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	1197	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1198	static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1199	const unsigned char *buf,
JMF	12:0071cb144c7a	1200	size_t len )
JMF	12:0071cb144c7a	1201	{
JMF	12:0071cb144c7a	1202	size_t list_size;
JMF	12:0071cb144c7a	1203	const unsigned char *p;
JMF	12:0071cb144c7a	1204
JMF	12:0071cb144c7a	1205	list_size = buf[0];
JMF	12:0071cb144c7a	1206	if( list_size + 1 != len )
JMF	12:0071cb144c7a	1207	{
JMF	12:0071cb144c7a	1208	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1209	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1210	}
JMF	12:0071cb144c7a	1211
JMF	12:0071cb144c7a	1212	p = buf + 1;
JMF	12:0071cb144c7a	1213	while( list_size > 0 )
JMF	12:0071cb144c7a	1214	{
JMF	12:0071cb144c7a	1215	if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED \|\|
JMF	12:0071cb144c7a	1216	p[0] == MBEDTLS_ECP_PF_COMPRESSED )
JMF	12:0071cb144c7a	1217	{
JMF	12:0071cb144c7a	1218	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	1219	ssl->handshake->ecdh_ctx.point_format = p[0];
JMF	12:0071cb144c7a	1220	#endif
JMF	12:0071cb144c7a	1221	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1222	ssl->handshake->ecjpake_ctx.point_format = p[0];
JMF	12:0071cb144c7a	1223	#endif
JMF	12:0071cb144c7a	1224	MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
JMF	12:0071cb144c7a	1225	return( 0 );
JMF	12:0071cb144c7a	1226	}
JMF	12:0071cb144c7a	1227
JMF	12:0071cb144c7a	1228	list_size--;
JMF	12:0071cb144c7a	1229	p++;
JMF	12:0071cb144c7a	1230	}
JMF	12:0071cb144c7a	1231
JMF	12:0071cb144c7a	1232	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
JMF	12:0071cb144c7a	1233	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1234	}
JMF	12:0071cb144c7a	1235	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
JMF	12:0071cb144c7a	1236	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	1237
JMF	12:0071cb144c7a	1238	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1239	static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1240	const unsigned char *buf,
JMF	12:0071cb144c7a	1241	size_t len )
JMF	12:0071cb144c7a	1242	{
JMF	12:0071cb144c7a	1243	int ret;
JMF	12:0071cb144c7a	1244
JMF	12:0071cb144c7a	1245	if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
JMF	12:0071cb144c7a	1246	MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	1247	{
JMF	12:0071cb144c7a	1248	MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
JMF	12:0071cb144c7a	1249	return( 0 );
JMF	12:0071cb144c7a	1250	}
JMF	12:0071cb144c7a	1251
JMF	12:0071cb144c7a	1252	/* If we got here, we no longer need our cached extension */
JMF	12:0071cb144c7a	1253	mbedtls_free( ssl->handshake->ecjpake_cache );
JMF	12:0071cb144c7a	1254	ssl->handshake->ecjpake_cache = NULL;
JMF	12:0071cb144c7a	1255	ssl->handshake->ecjpake_cache_len = 0;
JMF	12:0071cb144c7a	1256
JMF	12:0071cb144c7a	1257	if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	1258	buf, len ) ) != 0 )
JMF	12:0071cb144c7a	1259	{
JMF	12:0071cb144c7a	1260	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
JMF	12:0071cb144c7a	1261	return( ret );
JMF	12:0071cb144c7a	1262	}
JMF	12:0071cb144c7a	1263
JMF	12:0071cb144c7a	1264	return( 0 );
JMF	12:0071cb144c7a	1265	}
JMF	12:0071cb144c7a	1266	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	1267
JMF	12:0071cb144c7a	1268	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	1269	static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1270	const unsigned char *buf, size_t len )
JMF	12:0071cb144c7a	1271	{
JMF	12:0071cb144c7a	1272	size_t list_len, name_len;
JMF	12:0071cb144c7a	1273	const char **p;
JMF	12:0071cb144c7a	1274
JMF	12:0071cb144c7a	1275	/* If we didn't send it, the server shouldn't send it */
JMF	12:0071cb144c7a	1276	if( ssl->conf->alpn_list == NULL )
JMF	12:0071cb144c7a	1277	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1278
JMF	12:0071cb144c7a	1279	/*
JMF	12:0071cb144c7a	1280	* opaque ProtocolName<1..2^8-1>;
JMF	12:0071cb144c7a	1281	*
JMF	12:0071cb144c7a	1282	* struct {
JMF	12:0071cb144c7a	1283	* ProtocolName protocol_name_list<2..2^16-1>
JMF	12:0071cb144c7a	1284	* } ProtocolNameList;
JMF	12:0071cb144c7a	1285	*
JMF	12:0071cb144c7a	1286	* the "ProtocolNameList" MUST contain exactly one "ProtocolName"
JMF	12:0071cb144c7a	1287	*/
JMF	12:0071cb144c7a	1288
JMF	12:0071cb144c7a	1289	/* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
JMF	12:0071cb144c7a	1290	if( len < 4 )
JMF	12:0071cb144c7a	1291	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1292
JMF	12:0071cb144c7a	1293	list_len = ( buf[0] << 8 ) \| buf[1];
JMF	12:0071cb144c7a	1294	if( list_len != len - 2 )
JMF	12:0071cb144c7a	1295	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1296
JMF	12:0071cb144c7a	1297	name_len = buf[2];
JMF	12:0071cb144c7a	1298	if( name_len != list_len - 1 )
JMF	12:0071cb144c7a	1299	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1300
JMF	12:0071cb144c7a	1301	/* Check that the server chosen protocol was in our list and save it */
JMF	12:0071cb144c7a	1302	for( p = ssl->conf->alpn_list; *p != NULL; p++ )
JMF	12:0071cb144c7a	1303	{
JMF	12:0071cb144c7a	1304	if( name_len == strlen( *p ) &&
JMF	12:0071cb144c7a	1305	memcmp( buf + 3, *p, name_len ) == 0 )
JMF	12:0071cb144c7a	1306	{
JMF	12:0071cb144c7a	1307	ssl->alpn_chosen = *p;
JMF	12:0071cb144c7a	1308	return( 0 );
JMF	12:0071cb144c7a	1309	}
JMF	12:0071cb144c7a	1310	}
JMF	12:0071cb144c7a	1311
JMF	12:0071cb144c7a	1312	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1313	}
JMF	12:0071cb144c7a	1314	#endif /* MBEDTLS_SSL_ALPN */
JMF	12:0071cb144c7a	1315
JMF	12:0071cb144c7a	1316	/*
JMF	12:0071cb144c7a	1317	* Parse HelloVerifyRequest. Only called after verifying the HS type.
JMF	12:0071cb144c7a	1318	*/
JMF	12:0071cb144c7a	1319	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1320	static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	1321	{
JMF	12:0071cb144c7a	1322	const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	1323	int major_ver, minor_ver;
JMF	12:0071cb144c7a	1324	unsigned char cookie_len;
JMF	12:0071cb144c7a	1325
JMF	12:0071cb144c7a	1326	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
JMF	12:0071cb144c7a	1327
JMF	12:0071cb144c7a	1328	/*
JMF	12:0071cb144c7a	1329	* struct {
JMF	12:0071cb144c7a	1330	* ProtocolVersion server_version;
JMF	12:0071cb144c7a	1331	* opaque cookie<0..2^8-1>;
JMF	12:0071cb144c7a	1332	* } HelloVerifyRequest;
JMF	12:0071cb144c7a	1333	*/
JMF	12:0071cb144c7a	1334	MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
JMF	12:0071cb144c7a	1335	mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
JMF	12:0071cb144c7a	1336	p += 2;
JMF	12:0071cb144c7a	1337
JMF	12:0071cb144c7a	1338	/*
JMF	12:0071cb144c7a	1339	* Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
JMF	12:0071cb144c7a	1340	* even is lower than our min version.
JMF	12:0071cb144c7a	1341	*/
JMF	12:0071cb144c7a	1342	if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 \|\|
JMF	12:0071cb144c7a	1343	minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 \|\|
JMF	12:0071cb144c7a	1344	major_ver > ssl->conf->max_major_ver \|\|
JMF	12:0071cb144c7a	1345	minor_ver > ssl->conf->max_minor_ver )
JMF	12:0071cb144c7a	1346	{
JMF	12:0071cb144c7a	1347	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
JMF	12:0071cb144c7a	1348
JMF	12:0071cb144c7a	1349	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	1350	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	1351
JMF	12:0071cb144c7a	1352	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	1353	}
JMF	12:0071cb144c7a	1354
JMF	12:0071cb144c7a	1355	cookie_len = *p++;
JMF	12:0071cb144c7a	1356	MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
JMF	12:0071cb144c7a	1357
JMF	12:0071cb144c7a	1358	mbedtls_free( ssl->handshake->verify_cookie );
JMF	12:0071cb144c7a	1359
JMF	12:0071cb144c7a	1360	ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
JMF	12:0071cb144c7a	1361	if( ssl->handshake->verify_cookie == NULL )
JMF	12:0071cb144c7a	1362	{
JMF	12:0071cb144c7a	1363	MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
JMF	12:0071cb144c7a	1364	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
JMF	12:0071cb144c7a	1365	}
JMF	12:0071cb144c7a	1366
JMF	12:0071cb144c7a	1367	memcpy( ssl->handshake->verify_cookie, p, cookie_len );
JMF	12:0071cb144c7a	1368	ssl->handshake->verify_cookie_len = cookie_len;
JMF	12:0071cb144c7a	1369
JMF	12:0071cb144c7a	1370	/* Start over at ClientHello */
JMF	12:0071cb144c7a	1371	ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
JMF	12:0071cb144c7a	1372	mbedtls_ssl_reset_checksum( ssl );
JMF	12:0071cb144c7a	1373
JMF	12:0071cb144c7a	1374	mbedtls_ssl_recv_flight_completed( ssl );
JMF	12:0071cb144c7a	1375
JMF	12:0071cb144c7a	1376	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
JMF	12:0071cb144c7a	1377
JMF	12:0071cb144c7a	1378	return( 0 );
JMF	12:0071cb144c7a	1379	}
JMF	12:0071cb144c7a	1380	#endif /* MBEDTLS_SSL_PROTO_DTLS */
JMF	12:0071cb144c7a	1381
JMF	12:0071cb144c7a	1382	static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	1383	{
JMF	12:0071cb144c7a	1384	int ret, i;
JMF	12:0071cb144c7a	1385	size_t n;
JMF	12:0071cb144c7a	1386	size_t ext_len;
JMF	12:0071cb144c7a	1387	unsigned char buf, ext;
JMF	12:0071cb144c7a	1388	unsigned char comp;
JMF	12:0071cb144c7a	1389	#if defined(MBEDTLS_ZLIB_SUPPORT)
JMF	12:0071cb144c7a	1390	int accept_comp;
JMF	12:0071cb144c7a	1391	#endif
JMF	12:0071cb144c7a	1392	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1393	int renegotiation_info_seen = 0;
JMF	12:0071cb144c7a	1394	#endif
JMF	12:0071cb144c7a	1395	int handshake_failure = 0;
JMF	12:0071cb144c7a	1396	const mbedtls_ssl_ciphersuite_t *suite_info;
JMF	12:0071cb144c7a	1397	#if defined(MBEDTLS_DEBUG_C)
JMF	12:0071cb144c7a	1398	uint32_t t;
JMF	12:0071cb144c7a	1399	#endif
JMF	12:0071cb144c7a	1400
JMF	12:0071cb144c7a	1401	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
JMF	12:0071cb144c7a	1402
JMF	12:0071cb144c7a	1403	buf = ssl->in_msg;
JMF	12:0071cb144c7a	1404
JMF	12:0071cb144c7a	1405	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1406	{
JMF	12:0071cb144c7a	1407	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	1408	return( ret );
JMF	12:0071cb144c7a	1409	}
JMF	12:0071cb144c7a	1410
JMF	12:0071cb144c7a	1411	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	1412	{
JMF	12:0071cb144c7a	1413	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1414	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
JMF	12:0071cb144c7a	1415	{
JMF	12:0071cb144c7a	1416	ssl->renego_records_seen++;
JMF	12:0071cb144c7a	1417
JMF	12:0071cb144c7a	1418	if( ssl->conf->renego_max_records >= 0 &&
JMF	12:0071cb144c7a	1419	ssl->renego_records_seen > ssl->conf->renego_max_records )
JMF	12:0071cb144c7a	1420	{
JMF	12:0071cb144c7a	1421	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
JMF	12:0071cb144c7a	1422	"but not honored by server" ) );
JMF	12:0071cb144c7a	1423	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	1424	}
JMF	12:0071cb144c7a	1425
JMF	12:0071cb144c7a	1426	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
JMF	12:0071cb144c7a	1427	return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
JMF	12:0071cb144c7a	1428	}
JMF	12:0071cb144c7a	1429	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	1430
JMF	12:0071cb144c7a	1431	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1432	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	1433	}
JMF	12:0071cb144c7a	1434
JMF	12:0071cb144c7a	1435	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1436	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1437	{
JMF	12:0071cb144c7a	1438	if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
JMF	12:0071cb144c7a	1439	{
JMF	12:0071cb144c7a	1440	MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
JMF	12:0071cb144c7a	1441	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
JMF	12:0071cb144c7a	1442	return( ssl_parse_hello_verify_request( ssl ) );
JMF	12:0071cb144c7a	1443	}
JMF	12:0071cb144c7a	1444	else
JMF	12:0071cb144c7a	1445	{
JMF	12:0071cb144c7a	1446	/* We made it through the verification process */
JMF	12:0071cb144c7a	1447	mbedtls_free( ssl->handshake->verify_cookie );
JMF	12:0071cb144c7a	1448	ssl->handshake->verify_cookie = NULL;
JMF	12:0071cb144c7a	1449	ssl->handshake->verify_cookie_len = 0;
JMF	12:0071cb144c7a	1450	}
JMF	12:0071cb144c7a	1451	}
JMF	12:0071cb144c7a	1452	#endif /* MBEDTLS_SSL_PROTO_DTLS */
JMF	12:0071cb144c7a	1453
JMF	12:0071cb144c7a	1454	if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) \|\|
JMF	12:0071cb144c7a	1455	buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
JMF	12:0071cb144c7a	1456	{
JMF	12:0071cb144c7a	1457	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1458	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1459	}
JMF	12:0071cb144c7a	1460
JMF	12:0071cb144c7a	1461	/*
JMF	12:0071cb144c7a	1462	* 0 . 1 server_version
JMF	12:0071cb144c7a	1463	* 2 . 33 random (maybe including 4 bytes of Unix time)
JMF	12:0071cb144c7a	1464	* 34 . 34 session_id length = n
JMF	12:0071cb144c7a	1465	* 35 . 34+n session_id
JMF	12:0071cb144c7a	1466	* 35+n . 36+n cipher_suite
JMF	12:0071cb144c7a	1467	* 37+n . 37+n compression_method
JMF	12:0071cb144c7a	1468	*
JMF	12:0071cb144c7a	1469	* 38+n . 39+n extensions length (optional)
JMF	12:0071cb144c7a	1470	* 40+n . .. extensions
JMF	12:0071cb144c7a	1471	*/
JMF	12:0071cb144c7a	1472	buf += mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	1473
JMF	12:0071cb144c7a	1474	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
JMF	12:0071cb144c7a	1475	mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
JMF	12:0071cb144c7a	1476	ssl->conf->transport, buf + 0 );
JMF	12:0071cb144c7a	1477
JMF	12:0071cb144c7a	1478	if( ssl->major_ver < ssl->conf->min_major_ver \|\|
JMF	12:0071cb144c7a	1479	ssl->minor_ver < ssl->conf->min_minor_ver \|\|
JMF	12:0071cb144c7a	1480	ssl->major_ver > ssl->conf->max_major_ver \|\|
JMF	12:0071cb144c7a	1481	ssl->minor_ver > ssl->conf->max_minor_ver )
JMF	12:0071cb144c7a	1482	{
JMF	12:0071cb144c7a	1483	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
JMF	12:0071cb144c7a	1484	" min: [%d:%d], server: [%d:%d], max: [%d:%d]",
JMF	12:0071cb144c7a	1485	ssl->conf->min_major_ver, ssl->conf->min_minor_ver,
JMF	12:0071cb144c7a	1486	ssl->major_ver, ssl->minor_ver,
JMF	12:0071cb144c7a	1487	ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) );
JMF	12:0071cb144c7a	1488
JMF	12:0071cb144c7a	1489	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	1490	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	1491
JMF	12:0071cb144c7a	1492	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	1493	}
JMF	12:0071cb144c7a	1494
JMF	12:0071cb144c7a	1495	#if defined(MBEDTLS_DEBUG_C)
JMF	12:0071cb144c7a	1496	t = ( (uint32_t) buf[2] << 24 )
JMF	12:0071cb144c7a	1497	\| ( (uint32_t) buf[3] << 16 )
JMF	12:0071cb144c7a	1498	\| ( (uint32_t) buf[4] << 8 )
JMF	12:0071cb144c7a	1499	\| ( (uint32_t) buf[5] );
JMF	12:0071cb144c7a	1500	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
JMF	12:0071cb144c7a	1501	#endif
JMF	12:0071cb144c7a	1502
JMF	12:0071cb144c7a	1503	memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
JMF	12:0071cb144c7a	1504
JMF	12:0071cb144c7a	1505	n = buf[34];
JMF	12:0071cb144c7a	1506
JMF	12:0071cb144c7a	1507	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
JMF	12:0071cb144c7a	1508
JMF	12:0071cb144c7a	1509	if( n > 32 )
JMF	12:0071cb144c7a	1510	{
JMF	12:0071cb144c7a	1511	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1512	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1513	}
JMF	12:0071cb144c7a	1514
JMF	12:0071cb144c7a	1515	if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
JMF	12:0071cb144c7a	1516	{
JMF	12:0071cb144c7a	1517	ext_len = ( ( buf[38 + n] << 8 )
JMF	12:0071cb144c7a	1518	\| ( buf[39 + n] ) );
JMF	12:0071cb144c7a	1519
JMF	12:0071cb144c7a	1520	if( ( ext_len > 0 && ext_len < 4 ) \|\|
JMF	12:0071cb144c7a	1521	ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
JMF	12:0071cb144c7a	1522	{
JMF	12:0071cb144c7a	1523	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1524	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1525	}
JMF	12:0071cb144c7a	1526	}
JMF	12:0071cb144c7a	1527	else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
JMF	12:0071cb144c7a	1528	{
JMF	12:0071cb144c7a	1529	ext_len = 0;
JMF	12:0071cb144c7a	1530	}
JMF	12:0071cb144c7a	1531	else
JMF	12:0071cb144c7a	1532	{
JMF	12:0071cb144c7a	1533	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1534	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1535	}
JMF	12:0071cb144c7a	1536
JMF	12:0071cb144c7a	1537	/* ciphersuite (used later) */
JMF	12:0071cb144c7a	1538	i = ( buf[35 + n] << 8 ) \| buf[36 + n];
JMF	12:0071cb144c7a	1539
JMF	12:0071cb144c7a	1540	/*
JMF	12:0071cb144c7a	1541	* Read and check compression
JMF	12:0071cb144c7a	1542	*/
JMF	12:0071cb144c7a	1543	comp = buf[37 + n];
JMF	12:0071cb144c7a	1544
JMF	12:0071cb144c7a	1545	#if defined(MBEDTLS_ZLIB_SUPPORT)
JMF	12:0071cb144c7a	1546	/* See comments in ssl_write_client_hello() */
JMF	12:0071cb144c7a	1547	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1548	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1549	accept_comp = 0;
JMF	12:0071cb144c7a	1550	else
JMF	12:0071cb144c7a	1551	#endif
JMF	12:0071cb144c7a	1552	accept_comp = 1;
JMF	12:0071cb144c7a	1553
JMF	12:0071cb144c7a	1554	if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
JMF	12:0071cb144c7a	1555	( comp != MBEDTLS_SSL_COMPRESS_DEFLATE \|\| accept_comp == 0 ) )
JMF	12:0071cb144c7a	1556	#else /* MBEDTLS_ZLIB_SUPPORT */
JMF	12:0071cb144c7a	1557	if( comp != MBEDTLS_SSL_COMPRESS_NULL )
JMF	12:0071cb144c7a	1558	#endif/* MBEDTLS_ZLIB_SUPPORT */
JMF	12:0071cb144c7a	1559	{
JMF	12:0071cb144c7a	1560	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
JMF	12:0071cb144c7a	1561	return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
JMF	12:0071cb144c7a	1562	}
JMF	12:0071cb144c7a	1563
JMF	12:0071cb144c7a	1564	/*
JMF	12:0071cb144c7a	1565	* Initialize update checksum functions
JMF	12:0071cb144c7a	1566	*/
JMF	12:0071cb144c7a	1567	ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
JMF	12:0071cb144c7a	1568
JMF	12:0071cb144c7a	1569	if( ssl->transform_negotiate->ciphersuite_info == NULL )
JMF	12:0071cb144c7a	1570	{
JMF	12:0071cb144c7a	1571	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) );
JMF	12:0071cb144c7a	1572	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	1573	}
JMF	12:0071cb144c7a	1574
JMF	12:0071cb144c7a	1575	mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
JMF	12:0071cb144c7a	1576
JMF	12:0071cb144c7a	1577	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
JMF	12:0071cb144c7a	1578	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
JMF	12:0071cb144c7a	1579
JMF	12:0071cb144c7a	1580	/*
JMF	12:0071cb144c7a	1581	* Check if the session can be resumed
JMF	12:0071cb144c7a	1582	*/
JMF	12:0071cb144c7a	1583	if( ssl->handshake->resume == 0 \|\| n == 0 \|\|
JMF	12:0071cb144c7a	1584	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1585	ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE \|\|
JMF	12:0071cb144c7a	1586	#endif
JMF	12:0071cb144c7a	1587	ssl->session_negotiate->ciphersuite != i \|\|
JMF	12:0071cb144c7a	1588	ssl->session_negotiate->compression != comp \|\|
JMF	12:0071cb144c7a	1589	ssl->session_negotiate->id_len != n \|\|
JMF	12:0071cb144c7a	1590	memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
JMF	12:0071cb144c7a	1591	{
JMF	12:0071cb144c7a	1592	ssl->state++;
JMF	12:0071cb144c7a	1593	ssl->handshake->resume = 0;
JMF	12:0071cb144c7a	1594	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	1595	ssl->session_negotiate->start = mbedtls_time( NULL );
JMF	12:0071cb144c7a	1596	#endif
JMF	12:0071cb144c7a	1597	ssl->session_negotiate->ciphersuite = i;
JMF	12:0071cb144c7a	1598	ssl->session_negotiate->compression = comp;
JMF	12:0071cb144c7a	1599	ssl->session_negotiate->id_len = n;
JMF	12:0071cb144c7a	1600	memcpy( ssl->session_negotiate->id, buf + 35, n );
JMF	12:0071cb144c7a	1601	}
JMF	12:0071cb144c7a	1602	else
JMF	12:0071cb144c7a	1603	{
JMF	12:0071cb144c7a	1604	ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
JMF	12:0071cb144c7a	1605
JMF	12:0071cb144c7a	1606	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1607	{
JMF	12:0071cb144c7a	1608	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
JMF	12:0071cb144c7a	1609	return( ret );
JMF	12:0071cb144c7a	1610	}
JMF	12:0071cb144c7a	1611	}
JMF	12:0071cb144c7a	1612
JMF	12:0071cb144c7a	1613	MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
JMF	12:0071cb144c7a	1614	ssl->handshake->resume ? "a" : "no" ) );
JMF	12:0071cb144c7a	1615
JMF	12:0071cb144c7a	1616	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
JMF	12:0071cb144c7a	1617	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
JMF	12:0071cb144c7a	1618
JMF	12:0071cb144c7a	1619	suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
JMF	12:0071cb144c7a	1620	if( suite_info == NULL
JMF	12:0071cb144c7a	1621	#if defined(MBEDTLS_ARC4_C)
JMF	12:0071cb144c7a	1622	\|\| ( ssl->conf->arc4_disabled &&
JMF	12:0071cb144c7a	1623	suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
JMF	12:0071cb144c7a	1624	#endif
JMF	12:0071cb144c7a	1625	)
JMF	12:0071cb144c7a	1626	{
JMF	12:0071cb144c7a	1627	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1628	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1629	}
JMF	12:0071cb144c7a	1630
JMF	12:0071cb144c7a	1631	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
JMF	12:0071cb144c7a	1632
JMF	12:0071cb144c7a	1633	i = 0;
JMF	12:0071cb144c7a	1634	while( 1 )
JMF	12:0071cb144c7a	1635	{
JMF	12:0071cb144c7a	1636	if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
JMF	12:0071cb144c7a	1637	{
JMF	12:0071cb144c7a	1638	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1639	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1640	}
JMF	12:0071cb144c7a	1641
JMF	12:0071cb144c7a	1642	if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
JMF	12:0071cb144c7a	1643	ssl->session_negotiate->ciphersuite )
JMF	12:0071cb144c7a	1644	{
JMF	12:0071cb144c7a	1645	break;
JMF	12:0071cb144c7a	1646	}
JMF	12:0071cb144c7a	1647	}
JMF	12:0071cb144c7a	1648
JMF	12:0071cb144c7a	1649	if( comp != MBEDTLS_SSL_COMPRESS_NULL
JMF	12:0071cb144c7a	1650	#if defined(MBEDTLS_ZLIB_SUPPORT)
JMF	12:0071cb144c7a	1651	&& comp != MBEDTLS_SSL_COMPRESS_DEFLATE
JMF	12:0071cb144c7a	1652	#endif
JMF	12:0071cb144c7a	1653	)
JMF	12:0071cb144c7a	1654	{
JMF	12:0071cb144c7a	1655	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1656	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1657	}
JMF	12:0071cb144c7a	1658	ssl->session_negotiate->compression = comp;
JMF	12:0071cb144c7a	1659
JMF	12:0071cb144c7a	1660	ext = buf + 40 + n;
JMF	12:0071cb144c7a	1661
JMF	12:0071cb144c7a	1662	MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
JMF	12:0071cb144c7a	1663
JMF	12:0071cb144c7a	1664	while( ext_len )
JMF	12:0071cb144c7a	1665	{
JMF	12:0071cb144c7a	1666	unsigned int ext_id = ( ( ext[0] << 8 )
JMF	12:0071cb144c7a	1667	\| ( ext[1] ) );
JMF	12:0071cb144c7a	1668	unsigned int ext_size = ( ( ext[2] << 8 )
JMF	12:0071cb144c7a	1669	\| ( ext[3] ) );
JMF	12:0071cb144c7a	1670
JMF	12:0071cb144c7a	1671	if( ext_size + 4 > ext_len )
JMF	12:0071cb144c7a	1672	{
JMF	12:0071cb144c7a	1673	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1674	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1675	}
JMF	12:0071cb144c7a	1676
JMF	12:0071cb144c7a	1677	switch( ext_id )
JMF	12:0071cb144c7a	1678	{
JMF	12:0071cb144c7a	1679	case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
JMF	12:0071cb144c7a	1680	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
JMF	12:0071cb144c7a	1681	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1682	renegotiation_info_seen = 1;
JMF	12:0071cb144c7a	1683	#endif
JMF	12:0071cb144c7a	1684
JMF	12:0071cb144c7a	1685	if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
JMF	12:0071cb144c7a	1686	ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1687	return( ret );
JMF	12:0071cb144c7a	1688
JMF	12:0071cb144c7a	1689	break;
JMF	12:0071cb144c7a	1690
JMF	12:0071cb144c7a	1691	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	1692	case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
JMF	12:0071cb144c7a	1693	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
JMF	12:0071cb144c7a	1694
JMF	12:0071cb144c7a	1695	if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
JMF	12:0071cb144c7a	1696	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1697	{
JMF	12:0071cb144c7a	1698	return( ret );
JMF	12:0071cb144c7a	1699	}
JMF	12:0071cb144c7a	1700
JMF	12:0071cb144c7a	1701	break;
JMF	12:0071cb144c7a	1702	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
JMF	12:0071cb144c7a	1703
JMF	12:0071cb144c7a	1704	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	1705	case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
JMF	12:0071cb144c7a	1706	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
JMF	12:0071cb144c7a	1707
JMF	12:0071cb144c7a	1708	if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
JMF	12:0071cb144c7a	1709	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1710	{
JMF	12:0071cb144c7a	1711	return( ret );
JMF	12:0071cb144c7a	1712	}
JMF	12:0071cb144c7a	1713
JMF	12:0071cb144c7a	1714	break;
JMF	12:0071cb144c7a	1715	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
JMF	12:0071cb144c7a	1716
JMF	12:0071cb144c7a	1717	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	1718	case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
JMF	12:0071cb144c7a	1719	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
JMF	12:0071cb144c7a	1720
JMF	12:0071cb144c7a	1721	if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
JMF	12:0071cb144c7a	1722	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1723	{
JMF	12:0071cb144c7a	1724	return( ret );
JMF	12:0071cb144c7a	1725	}
JMF	12:0071cb144c7a	1726
JMF	12:0071cb144c7a	1727	break;
JMF	12:0071cb144c7a	1728	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
JMF	12:0071cb144c7a	1729
JMF	12:0071cb144c7a	1730	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	1731	case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
JMF	12:0071cb144c7a	1732	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) );
JMF	12:0071cb144c7a	1733
JMF	12:0071cb144c7a	1734	if( ( ret = ssl_parse_extended_ms_ext( ssl,
JMF	12:0071cb144c7a	1735	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1736	{
JMF	12:0071cb144c7a	1737	return( ret );
JMF	12:0071cb144c7a	1738	}
JMF	12:0071cb144c7a	1739
JMF	12:0071cb144c7a	1740	break;
JMF	12:0071cb144c7a	1741	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
JMF	12:0071cb144c7a	1742
JMF	12:0071cb144c7a	1743	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	1744	case MBEDTLS_TLS_EXT_SESSION_TICKET:
JMF	12:0071cb144c7a	1745	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
JMF	12:0071cb144c7a	1746
JMF	12:0071cb144c7a	1747	if( ( ret = ssl_parse_session_ticket_ext( ssl,
JMF	12:0071cb144c7a	1748	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1749	{
JMF	12:0071cb144c7a	1750	return( ret );
JMF	12:0071cb144c7a	1751	}
JMF	12:0071cb144c7a	1752
JMF	12:0071cb144c7a	1753	break;
JMF	12:0071cb144c7a	1754	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	1755
JMF	12:0071cb144c7a	1756	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	1757	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1758	case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
JMF	12:0071cb144c7a	1759	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) );
JMF	12:0071cb144c7a	1760
JMF	12:0071cb144c7a	1761	if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
JMF	12:0071cb144c7a	1762	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1763	{
JMF	12:0071cb144c7a	1764	return( ret );
JMF	12:0071cb144c7a	1765	}
JMF	12:0071cb144c7a	1766
JMF	12:0071cb144c7a	1767	break;
JMF	12:0071cb144c7a	1768	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
JMF	12:0071cb144c7a	1769	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	1770
JMF	12:0071cb144c7a	1771	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1772	case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
JMF	12:0071cb144c7a	1773	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
JMF	12:0071cb144c7a	1774
JMF	12:0071cb144c7a	1775	if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
JMF	12:0071cb144c7a	1776	ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1777	{
JMF	12:0071cb144c7a	1778	return( ret );
JMF	12:0071cb144c7a	1779	}
JMF	12:0071cb144c7a	1780
JMF	12:0071cb144c7a	1781	break;
JMF	12:0071cb144c7a	1782	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	1783
JMF	12:0071cb144c7a	1784	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	1785	case MBEDTLS_TLS_EXT_ALPN:
JMF	12:0071cb144c7a	1786	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
JMF	12:0071cb144c7a	1787
JMF	12:0071cb144c7a	1788	if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
JMF	12:0071cb144c7a	1789	return( ret );
JMF	12:0071cb144c7a	1790
JMF	12:0071cb144c7a	1791	break;
JMF	12:0071cb144c7a	1792	#endif /* MBEDTLS_SSL_ALPN */
JMF	12:0071cb144c7a	1793
JMF	12:0071cb144c7a	1794	default:
JMF	12:0071cb144c7a	1795	MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
JMF	12:0071cb144c7a	1796	ext_id ) );
JMF	12:0071cb144c7a	1797	}
JMF	12:0071cb144c7a	1798
JMF	12:0071cb144c7a	1799	ext_len -= 4 + ext_size;
JMF	12:0071cb144c7a	1800	ext += 4 + ext_size;
JMF	12:0071cb144c7a	1801
JMF	12:0071cb144c7a	1802	if( ext_len > 0 && ext_len < 4 )
JMF	12:0071cb144c7a	1803	{
JMF	12:0071cb144c7a	1804	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
JMF	12:0071cb144c7a	1805	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1806	}
JMF	12:0071cb144c7a	1807	}
JMF	12:0071cb144c7a	1808
JMF	12:0071cb144c7a	1809	/*
JMF	12:0071cb144c7a	1810	* Renegotiation security checks
JMF	12:0071cb144c7a	1811	*/
JMF	12:0071cb144c7a	1812	if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
JMF	12:0071cb144c7a	1813	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
JMF	12:0071cb144c7a	1814	{
JMF	12:0071cb144c7a	1815	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
JMF	12:0071cb144c7a	1816	handshake_failure = 1;
JMF	12:0071cb144c7a	1817	}
JMF	12:0071cb144c7a	1818	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1819	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
JMF	12:0071cb144c7a	1820	ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
JMF	12:0071cb144c7a	1821	renegotiation_info_seen == 0 )
JMF	12:0071cb144c7a	1822	{
JMF	12:0071cb144c7a	1823	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
JMF	12:0071cb144c7a	1824	handshake_failure = 1;
JMF	12:0071cb144c7a	1825	}
JMF	12:0071cb144c7a	1826	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
JMF	12:0071cb144c7a	1827	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
JMF	12:0071cb144c7a	1828	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
JMF	12:0071cb144c7a	1829	{
JMF	12:0071cb144c7a	1830	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
JMF	12:0071cb144c7a	1831	handshake_failure = 1;
JMF	12:0071cb144c7a	1832	}
JMF	12:0071cb144c7a	1833	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
JMF	12:0071cb144c7a	1834	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
JMF	12:0071cb144c7a	1835	renegotiation_info_seen == 1 )
JMF	12:0071cb144c7a	1836	{
JMF	12:0071cb144c7a	1837	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
JMF	12:0071cb144c7a	1838	handshake_failure = 1;
JMF	12:0071cb144c7a	1839	}
JMF	12:0071cb144c7a	1840	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	1841
JMF	12:0071cb144c7a	1842	if( handshake_failure == 1 )
JMF	12:0071cb144c7a	1843	{
JMF	12:0071cb144c7a	1844	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1845	return( ret );
JMF	12:0071cb144c7a	1846
JMF	12:0071cb144c7a	1847	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
JMF	12:0071cb144c7a	1848	}
JMF	12:0071cb144c7a	1849
JMF	12:0071cb144c7a	1850	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
JMF	12:0071cb144c7a	1851
JMF	12:0071cb144c7a	1852	return( 0 );
JMF	12:0071cb144c7a	1853	}
JMF	12:0071cb144c7a	1854
JMF	12:0071cb144c7a	1855	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	1856	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
JMF	12:0071cb144c7a	1857	static int ssl_parse_server_dh_params( mbedtls_ssl_context ssl, unsigned char *p,
JMF	12:0071cb144c7a	1858	unsigned char *end )
JMF	12:0071cb144c7a	1859	{
JMF	12:0071cb144c7a	1860	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	1861
JMF	12:0071cb144c7a	1862	/*
JMF	12:0071cb144c7a	1863	* Ephemeral DH parameters:
JMF	12:0071cb144c7a	1864	*
JMF	12:0071cb144c7a	1865	* struct {
JMF	12:0071cb144c7a	1866	* opaque dh_p<1..2^16-1>;
JMF	12:0071cb144c7a	1867	* opaque dh_g<1..2^16-1>;
JMF	12:0071cb144c7a	1868	* opaque dh_Ys<1..2^16-1>;
JMF	12:0071cb144c7a	1869	* } ServerDHParams;
JMF	12:0071cb144c7a	1870	*/
JMF	12:0071cb144c7a	1871	if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 )
JMF	12:0071cb144c7a	1872	{
JMF	12:0071cb144c7a	1873	MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
JMF	12:0071cb144c7a	1874	return( ret );
JMF	12:0071cb144c7a	1875	}
JMF	12:0071cb144c7a	1876
JMF	12:0071cb144c7a	1877	if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
JMF	12:0071cb144c7a	1878	{
JMF	12:0071cb144c7a	1879	MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
JMF	12:0071cb144c7a	1880	ssl->handshake->dhm_ctx.len * 8,
JMF	12:0071cb144c7a	1881	ssl->conf->dhm_min_bitlen ) );
JMF	12:0071cb144c7a	1882	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	1883	}
JMF	12:0071cb144c7a	1884
JMF	12:0071cb144c7a	1885	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
JMF	12:0071cb144c7a	1886	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
JMF	12:0071cb144c7a	1887	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
JMF	12:0071cb144c7a	1888
JMF	12:0071cb144c7a	1889	return( ret );
JMF	12:0071cb144c7a	1890	}
JMF	12:0071cb144c7a	1891	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	1892	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
JMF	12:0071cb144c7a	1893
JMF	12:0071cb144c7a	1894	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	1895	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	1896	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	1897	defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	1898	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	1899	static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	1900	{
JMF	12:0071cb144c7a	1901	const mbedtls_ecp_curve_info *curve_info;
JMF	12:0071cb144c7a	1902
JMF	12:0071cb144c7a	1903	curve_info = mbedtls_ecp_curve_info_from_grp_id( ssl->handshake->ecdh_ctx.grp.id );
JMF	12:0071cb144c7a	1904	if( curve_info == NULL )
JMF	12:0071cb144c7a	1905	{
JMF	12:0071cb144c7a	1906	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	1907	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	1908	}
JMF	12:0071cb144c7a	1909
JMF	12:0071cb144c7a	1910	MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
JMF	12:0071cb144c7a	1911
JMF	12:0071cb144c7a	1912	#if defined(MBEDTLS_ECP_C)
JMF	12:0071cb144c7a	1913	if( mbedtls_ssl_check_curve( ssl, ssl->handshake->ecdh_ctx.grp.id ) != 0 )
JMF	12:0071cb144c7a	1914	#else
JMF	12:0071cb144c7a	1915	if( ssl->handshake->ecdh_ctx.grp.nbits < 163 \|\|
JMF	12:0071cb144c7a	1916	ssl->handshake->ecdh_ctx.grp.nbits > 521 )
JMF	12:0071cb144c7a	1917	#endif
JMF	12:0071cb144c7a	1918	return( -1 );
JMF	12:0071cb144c7a	1919
JMF	12:0071cb144c7a	1920	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp", &ssl->handshake->ecdh_ctx.Qp );
JMF	12:0071cb144c7a	1921
JMF	12:0071cb144c7a	1922	return( 0 );
JMF	12:0071cb144c7a	1923	}
JMF	12:0071cb144c7a	1924	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	1925	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
JMF	12:0071cb144c7a	1926	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \|\|
JMF	12:0071cb144c7a	1927	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	1928	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
JMF	12:0071cb144c7a	1929
JMF	12:0071cb144c7a	1930	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	1931	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	1932	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
JMF	12:0071cb144c7a	1933	static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1934	unsigned char **p,
JMF	12:0071cb144c7a	1935	unsigned char *end )
JMF	12:0071cb144c7a	1936	{
JMF	12:0071cb144c7a	1937	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	1938
JMF	12:0071cb144c7a	1939	/*
JMF	12:0071cb144c7a	1940	* Ephemeral ECDH parameters:
JMF	12:0071cb144c7a	1941	*
JMF	12:0071cb144c7a	1942	* struct {
JMF	12:0071cb144c7a	1943	* ECParameters curve_params;
JMF	12:0071cb144c7a	1944	* ECPoint public;
JMF	12:0071cb144c7a	1945	* } ServerECDHParams;
JMF	12:0071cb144c7a	1946	*/
JMF	12:0071cb144c7a	1947	if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	1948	(const unsigned char **) p, end ) ) != 0 )
JMF	12:0071cb144c7a	1949	{
JMF	12:0071cb144c7a	1950	MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
JMF	12:0071cb144c7a	1951	return( ret );
JMF	12:0071cb144c7a	1952	}
JMF	12:0071cb144c7a	1953
JMF	12:0071cb144c7a	1954	if( ssl_check_server_ecdh_params( ssl ) != 0 )
JMF	12:0071cb144c7a	1955	{
JMF	12:0071cb144c7a	1956	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) );
JMF	12:0071cb144c7a	1957	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	1958	}
JMF	12:0071cb144c7a	1959
JMF	12:0071cb144c7a	1960	return( ret );
JMF	12:0071cb144c7a	1961	}
JMF	12:0071cb144c7a	1962	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	1963	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
JMF	12:0071cb144c7a	1964	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
JMF	12:0071cb144c7a	1965
JMF	12:0071cb144c7a	1966	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
JMF	12:0071cb144c7a	1967	static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1968	unsigned char **p,
JMF	12:0071cb144c7a	1969	unsigned char *end )
JMF	12:0071cb144c7a	1970	{
JMF	12:0071cb144c7a	1971	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	1972	size_t len;
JMF	12:0071cb144c7a	1973	((void) ssl);
JMF	12:0071cb144c7a	1974
JMF	12:0071cb144c7a	1975	/*
JMF	12:0071cb144c7a	1976	* PSK parameters:
JMF	12:0071cb144c7a	1977	*
JMF	12:0071cb144c7a	1978	* opaque psk_identity_hint<0..2^16-1>;
JMF	12:0071cb144c7a	1979	*/
JMF	12:0071cb144c7a	1980	len = (p)[0] << 8 \| (p)[1];
JMF	12:0071cb144c7a	1981	*p += 2;
JMF	12:0071cb144c7a	1982
JMF	12:0071cb144c7a	1983	if( (*p) + len > end )
JMF	12:0071cb144c7a	1984	{
JMF	12:0071cb144c7a	1985	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (psk_identity_hint length)" ) );
JMF	12:0071cb144c7a	1986	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	1987	}
JMF	12:0071cb144c7a	1988
JMF	12:0071cb144c7a	1989	/*
JMF	12:0071cb144c7a	1990	* Note: we currently ignore the PKS identity hint, as we only allow one
JMF	12:0071cb144c7a	1991	* PSK to be provisionned on the client. This could be changed later if
JMF	12:0071cb144c7a	1992	* someone needs that feature.
JMF	12:0071cb144c7a	1993	*/
JMF	12:0071cb144c7a	1994	*p += len;
JMF	12:0071cb144c7a	1995	ret = 0;
JMF	12:0071cb144c7a	1996
JMF	12:0071cb144c7a	1997	return( ret );
JMF	12:0071cb144c7a	1998	}
JMF	12:0071cb144c7a	1999	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
JMF	12:0071cb144c7a	2000
JMF	12:0071cb144c7a	2001	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2002	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
JMF	12:0071cb144c7a	2003	/*
JMF	12:0071cb144c7a	2004	* Generate a pre-master secret and encrypt it with the server's RSA key
JMF	12:0071cb144c7a	2005	*/
JMF	12:0071cb144c7a	2006	static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	2007	size_t offset, size_t *olen,
JMF	12:0071cb144c7a	2008	size_t pms_offset )
JMF	12:0071cb144c7a	2009	{
JMF	12:0071cb144c7a	2010	int ret;
JMF	12:0071cb144c7a	2011	size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
JMF	12:0071cb144c7a	2012	unsigned char *p = ssl->handshake->premaster + pms_offset;
JMF	12:0071cb144c7a	2013
JMF	12:0071cb144c7a	2014	if( offset + len_bytes > MBEDTLS_SSL_MAX_CONTENT_LEN )
JMF	12:0071cb144c7a	2015	{
JMF	12:0071cb144c7a	2016	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
JMF	12:0071cb144c7a	2017	return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
JMF	12:0071cb144c7a	2018	}
JMF	12:0071cb144c7a	2019
JMF	12:0071cb144c7a	2020	/*
JMF	12:0071cb144c7a	2021	* Generate (part of) the pre-master as
JMF	12:0071cb144c7a	2022	* struct {
JMF	12:0071cb144c7a	2023	* ProtocolVersion client_version;
JMF	12:0071cb144c7a	2024	* opaque random[46];
JMF	12:0071cb144c7a	2025	* } PreMasterSecret;
JMF	12:0071cb144c7a	2026	*/
JMF	12:0071cb144c7a	2027	mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
JMF	12:0071cb144c7a	2028	ssl->conf->transport, p );
JMF	12:0071cb144c7a	2029
JMF	12:0071cb144c7a	2030	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
JMF	12:0071cb144c7a	2031	{
JMF	12:0071cb144c7a	2032	MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
JMF	12:0071cb144c7a	2033	return( ret );
JMF	12:0071cb144c7a	2034	}
JMF	12:0071cb144c7a	2035
JMF	12:0071cb144c7a	2036	ssl->handshake->pmslen = 48;
JMF	12:0071cb144c7a	2037
JMF	12:0071cb144c7a	2038	if( ssl->session_negotiate->peer_cert == NULL )
JMF	12:0071cb144c7a	2039	{
JMF	12:0071cb144c7a	2040	MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
JMF	12:0071cb144c7a	2041	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2042	}
JMF	12:0071cb144c7a	2043
JMF	12:0071cb144c7a	2044	/*
JMF	12:0071cb144c7a	2045	* Now write it out, encrypted
JMF	12:0071cb144c7a	2046	*/
JMF	12:0071cb144c7a	2047	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
JMF	12:0071cb144c7a	2048	MBEDTLS_PK_RSA ) )
JMF	12:0071cb144c7a	2049	{
JMF	12:0071cb144c7a	2050	MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
JMF	12:0071cb144c7a	2051	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
JMF	12:0071cb144c7a	2052	}
JMF	12:0071cb144c7a	2053
JMF	12:0071cb144c7a	2054	if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk,
JMF	12:0071cb144c7a	2055	p, ssl->handshake->pmslen,
JMF	12:0071cb144c7a	2056	ssl->out_msg + offset + len_bytes, olen,
JMF	12:0071cb144c7a	2057	MBEDTLS_SSL_MAX_CONTENT_LEN - offset - len_bytes,
JMF	12:0071cb144c7a	2058	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	2059	{
JMF	12:0071cb144c7a	2060	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
JMF	12:0071cb144c7a	2061	return( ret );
JMF	12:0071cb144c7a	2062	}
JMF	12:0071cb144c7a	2063
JMF	12:0071cb144c7a	2064	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
JMF	12:0071cb144c7a	2065	defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2066	if( len_bytes == 2 )
JMF	12:0071cb144c7a	2067	{
JMF	12:0071cb144c7a	2068	ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
JMF	12:0071cb144c7a	2069	ssl->out_msg[offset+1] = (unsigned char)( *olen );
JMF	12:0071cb144c7a	2070	*olen += 2;
JMF	12:0071cb144c7a	2071	}
JMF	12:0071cb144c7a	2072	#endif
JMF	12:0071cb144c7a	2073
JMF	12:0071cb144c7a	2074	return( 0 );
JMF	12:0071cb144c7a	2075	}
JMF	12:0071cb144c7a	2076	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2077	MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
JMF	12:0071cb144c7a	2078
JMF	12:0071cb144c7a	2079	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2080	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2081	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2082	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2083	static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	2084	unsigned char **p,
JMF	12:0071cb144c7a	2085	unsigned char *end,
JMF	12:0071cb144c7a	2086	mbedtls_md_type_t *md_alg,
JMF	12:0071cb144c7a	2087	mbedtls_pk_type_t *pk_alg )
JMF	12:0071cb144c7a	2088	{
JMF	12:0071cb144c7a	2089	((void) ssl);
JMF	12:0071cb144c7a	2090	*md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	2091	*pk_alg = MBEDTLS_PK_NONE;
JMF	12:0071cb144c7a	2092
JMF	12:0071cb144c7a	2093	/* Only in TLS 1.2 */
JMF	12:0071cb144c7a	2094	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2095	{
JMF	12:0071cb144c7a	2096	return( 0 );
JMF	12:0071cb144c7a	2097	}
JMF	12:0071cb144c7a	2098
JMF	12:0071cb144c7a	2099	if( (*p) + 2 > end )
JMF	12:0071cb144c7a	2100	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2101
JMF	12:0071cb144c7a	2102	/*
JMF	12:0071cb144c7a	2103	* Get hash algorithm
JMF	12:0071cb144c7a	2104	*/
JMF	12:0071cb144c7a	2105	if( ( md_alg = mbedtls_ssl_md_alg_from_hash( (p)[0] ) ) == MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2106	{
JMF	12:0071cb144c7a	2107	MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
JMF	12:0071cb144c7a	2108	"HashAlgorithm %d", *(p)[0] ) );
JMF	12:0071cb144c7a	2109	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2110	}
JMF	12:0071cb144c7a	2111
JMF	12:0071cb144c7a	2112	/*
JMF	12:0071cb144c7a	2113	* Get signature algorithm
JMF	12:0071cb144c7a	2114	*/
JMF	12:0071cb144c7a	2115	if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( (p)[1] ) ) == MBEDTLS_PK_NONE )
JMF	12:0071cb144c7a	2116	{
JMF	12:0071cb144c7a	2117	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
JMF	12:0071cb144c7a	2118	"SignatureAlgorithm %d", (*p)[1] ) );
JMF	12:0071cb144c7a	2119	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2120	}
JMF	12:0071cb144c7a	2121
JMF	12:0071cb144c7a	2122	/*
JMF	12:0071cb144c7a	2123	* Check if the hash is acceptable
JMF	12:0071cb144c7a	2124	*/
JMF	12:0071cb144c7a	2125	if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
JMF	12:0071cb144c7a	2126	{
JMF	12:0071cb144c7a	2127	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm "
JMF	12:0071cb144c7a	2128	"that was not offered" ) );
JMF	12:0071cb144c7a	2129	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2130	}
JMF	12:0071cb144c7a	2131
JMF	12:0071cb144c7a	2132	MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) );
JMF	12:0071cb144c7a	2133	MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) );
JMF	12:0071cb144c7a	2134	*p += 2;
JMF	12:0071cb144c7a	2135
JMF	12:0071cb144c7a	2136	return( 0 );
JMF	12:0071cb144c7a	2137	}
JMF	12:0071cb144c7a	2138	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2139	MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2140	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2141	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2142
JMF	12:0071cb144c7a	2143	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2144	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2145	static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2146	{
JMF	12:0071cb144c7a	2147	int ret;
JMF	12:0071cb144c7a	2148	const mbedtls_ecp_keypair *peer_key;
JMF	12:0071cb144c7a	2149
JMF	12:0071cb144c7a	2150	if( ssl->session_negotiate->peer_cert == NULL )
JMF	12:0071cb144c7a	2151	{
JMF	12:0071cb144c7a	2152	MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
JMF	12:0071cb144c7a	2153	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2154	}
JMF	12:0071cb144c7a	2155
JMF	12:0071cb144c7a	2156	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
JMF	12:0071cb144c7a	2157	MBEDTLS_PK_ECKEY ) )
JMF	12:0071cb144c7a	2158	{
JMF	12:0071cb144c7a	2159	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
JMF	12:0071cb144c7a	2160	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
JMF	12:0071cb144c7a	2161	}
JMF	12:0071cb144c7a	2162
JMF	12:0071cb144c7a	2163	peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk );
JMF	12:0071cb144c7a	2164
JMF	12:0071cb144c7a	2165	if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
JMF	12:0071cb144c7a	2166	MBEDTLS_ECDH_THEIRS ) ) != 0 )
JMF	12:0071cb144c7a	2167	{
JMF	12:0071cb144c7a	2168	MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
JMF	12:0071cb144c7a	2169	return( ret );
JMF	12:0071cb144c7a	2170	}
JMF	12:0071cb144c7a	2171
JMF	12:0071cb144c7a	2172	if( ssl_check_server_ecdh_params( ssl ) != 0 )
JMF	12:0071cb144c7a	2173	{
JMF	12:0071cb144c7a	2174	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
JMF	12:0071cb144c7a	2175	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
JMF	12:0071cb144c7a	2176	}
JMF	12:0071cb144c7a	2177
JMF	12:0071cb144c7a	2178	return( ret );
JMF	12:0071cb144c7a	2179	}
JMF	12:0071cb144c7a	2180	#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\|
JMF	12:0071cb144c7a	2181	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2182
JMF	12:0071cb144c7a	2183	static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2184	{
JMF	12:0071cb144c7a	2185	int ret;
JMF	12:0071cb144c7a	2186	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2187	unsigned char p, end;
JMF	12:0071cb144c7a	2188
JMF	12:0071cb144c7a	2189	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
JMF	12:0071cb144c7a	2190
JMF	12:0071cb144c7a	2191	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
JMF	12:0071cb144c7a	2192	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
JMF	12:0071cb144c7a	2193	{
JMF	12:0071cb144c7a	2194	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
JMF	12:0071cb144c7a	2195	ssl->state++;
JMF	12:0071cb144c7a	2196	return( 0 );
JMF	12:0071cb144c7a	2197	}
JMF	12:0071cb144c7a	2198	((void) p);
JMF	12:0071cb144c7a	2199	((void) end);
JMF	12:0071cb144c7a	2200	#endif
JMF	12:0071cb144c7a	2201
JMF	12:0071cb144c7a	2202	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2203	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2204	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
JMF	12:0071cb144c7a	2205	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
JMF	12:0071cb144c7a	2206	{
JMF	12:0071cb144c7a	2207	if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2208	{
JMF	12:0071cb144c7a	2209	MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
JMF	12:0071cb144c7a	2210	return( ret );
JMF	12:0071cb144c7a	2211	}
JMF	12:0071cb144c7a	2212
JMF	12:0071cb144c7a	2213	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
JMF	12:0071cb144c7a	2214	ssl->state++;
JMF	12:0071cb144c7a	2215	return( 0 );
JMF	12:0071cb144c7a	2216	}
JMF	12:0071cb144c7a	2217	((void) p);
JMF	12:0071cb144c7a	2218	((void) end);
JMF	12:0071cb144c7a	2219	#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2220	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2221
JMF	12:0071cb144c7a	2222	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2223	{
JMF	12:0071cb144c7a	2224	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	2225	return( ret );
JMF	12:0071cb144c7a	2226	}
JMF	12:0071cb144c7a	2227
JMF	12:0071cb144c7a	2228	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	2229	{
JMF	12:0071cb144c7a	2230	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2231	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2232	}
JMF	12:0071cb144c7a	2233
JMF	12:0071cb144c7a	2234	/*
JMF	12:0071cb144c7a	2235	* ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
JMF	12:0071cb144c7a	2236	* doesn't use a psk_identity_hint
JMF	12:0071cb144c7a	2237	*/
JMF	12:0071cb144c7a	2238	if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
JMF	12:0071cb144c7a	2239	{
JMF	12:0071cb144c7a	2240	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2241	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
JMF	12:0071cb144c7a	2242	{
JMF	12:0071cb144c7a	2243	ssl->record_read = 1;
JMF	12:0071cb144c7a	2244	goto exit;
JMF	12:0071cb144c7a	2245	}
JMF	12:0071cb144c7a	2246
JMF	12:0071cb144c7a	2247	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2248	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2249	}
JMF	12:0071cb144c7a	2250
JMF	12:0071cb144c7a	2251	p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	2252	end = ssl->in_msg + ssl->in_hslen;
JMF	12:0071cb144c7a	2253	MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
JMF	12:0071cb144c7a	2254
JMF	12:0071cb144c7a	2255	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
JMF	12:0071cb144c7a	2256	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2257	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2258	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2259	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
JMF	12:0071cb144c7a	2260	{
JMF	12:0071cb144c7a	2261	if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
JMF	12:0071cb144c7a	2262	{
JMF	12:0071cb144c7a	2263	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2264	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2265	}
JMF	12:0071cb144c7a	2266	} /* FALLTROUGH */
JMF	12:0071cb144c7a	2267	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
JMF	12:0071cb144c7a	2268
JMF	12:0071cb144c7a	2269	#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	2270	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
JMF	12:0071cb144c7a	2271	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2272	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
JMF	12:0071cb144c7a	2273	; /* nothing more to do */
JMF	12:0071cb144c7a	2274	else
JMF	12:0071cb144c7a	2275	#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \|\|
JMF	12:0071cb144c7a	2276	MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
JMF	12:0071cb144c7a	2277	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2278	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
JMF	12:0071cb144c7a	2279	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
JMF	12:0071cb144c7a	2280	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
JMF	12:0071cb144c7a	2281	{
JMF	12:0071cb144c7a	2282	if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
JMF	12:0071cb144c7a	2283	{
JMF	12:0071cb144c7a	2284	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2285	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2286	}
JMF	12:0071cb144c7a	2287	}
JMF	12:0071cb144c7a	2288	else
JMF	12:0071cb144c7a	2289	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2290	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
JMF	12:0071cb144c7a	2291	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2292	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	2293	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2294	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
JMF	12:0071cb144c7a	2295	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	2296	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
JMF	12:0071cb144c7a	2297	{
JMF	12:0071cb144c7a	2298	if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
JMF	12:0071cb144c7a	2299	{
JMF	12:0071cb144c7a	2300	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2301	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2302	}
JMF	12:0071cb144c7a	2303	}
JMF	12:0071cb144c7a	2304	else
JMF	12:0071cb144c7a	2305	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2306	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \|\|
JMF	12:0071cb144c7a	2307	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2308	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2309	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2310	{
JMF	12:0071cb144c7a	2311	ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	2312	p, end - p );
JMF	12:0071cb144c7a	2313	if( ret != 0 )
JMF	12:0071cb144c7a	2314	{
JMF	12:0071cb144c7a	2315	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
JMF	12:0071cb144c7a	2316	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2317	}
JMF	12:0071cb144c7a	2318	}
JMF	12:0071cb144c7a	2319	else
JMF	12:0071cb144c7a	2320	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	2321	{
JMF	12:0071cb144c7a	2322	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2323	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2324	}
JMF	12:0071cb144c7a	2325
JMF	12:0071cb144c7a	2326	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2327	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2328	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2329	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
JMF	12:0071cb144c7a	2330	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
JMF	12:0071cb144c7a	2331	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
JMF	12:0071cb144c7a	2332	{
JMF	12:0071cb144c7a	2333	size_t sig_len, hashlen;
JMF	12:0071cb144c7a	2334	unsigned char hash[64];
JMF	12:0071cb144c7a	2335	mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	2336	mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
JMF	12:0071cb144c7a	2337	unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	2338	size_t params_len = p - params;
JMF	12:0071cb144c7a	2339
JMF	12:0071cb144c7a	2340	/*
JMF	12:0071cb144c7a	2341	* Handle the digitally-signed structure
JMF	12:0071cb144c7a	2342	*/
JMF	12:0071cb144c7a	2343	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2344	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2345	{
JMF	12:0071cb144c7a	2346	if( ssl_parse_signature_algorithm( ssl, &p, end,
JMF	12:0071cb144c7a	2347	&md_alg, &pk_alg ) != 0 )
JMF	12:0071cb144c7a	2348	{
JMF	12:0071cb144c7a	2349	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2350	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2351	}
JMF	12:0071cb144c7a	2352
JMF	12:0071cb144c7a	2353	if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
JMF	12:0071cb144c7a	2354	{
JMF	12:0071cb144c7a	2355	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2356	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2357	}
JMF	12:0071cb144c7a	2358	}
JMF	12:0071cb144c7a	2359	else
JMF	12:0071cb144c7a	2360	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2361	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
JMF	12:0071cb144c7a	2362	defined(MBEDTLS_SSL_PROTO_TLS1_1)
JMF	12:0071cb144c7a	2363	if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2364	{
JMF	12:0071cb144c7a	2365	pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
JMF	12:0071cb144c7a	2366
JMF	12:0071cb144c7a	2367	/* Default hash for ECDSA is SHA-1 */
JMF	12:0071cb144c7a	2368	if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2369	md_alg = MBEDTLS_MD_SHA1;
JMF	12:0071cb144c7a	2370	}
JMF	12:0071cb144c7a	2371	else
JMF	12:0071cb144c7a	2372	#endif
JMF	12:0071cb144c7a	2373	{
JMF	12:0071cb144c7a	2374	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2375	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2376	}
JMF	12:0071cb144c7a	2377
JMF	12:0071cb144c7a	2378	/*
JMF	12:0071cb144c7a	2379	* Read signature
JMF	12:0071cb144c7a	2380	*/
JMF	12:0071cb144c7a	2381	sig_len = ( p[0] << 8 ) \| p[1];
JMF	12:0071cb144c7a	2382	p += 2;
JMF	12:0071cb144c7a	2383
JMF	12:0071cb144c7a	2384	if( end != p + sig_len )
JMF	12:0071cb144c7a	2385	{
JMF	12:0071cb144c7a	2386	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2387	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	2388	}
JMF	12:0071cb144c7a	2389
JMF	12:0071cb144c7a	2390	MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
JMF	12:0071cb144c7a	2391
JMF	12:0071cb144c7a	2392	/*
JMF	12:0071cb144c7a	2393	* Compute the hash that has been signed
JMF	12:0071cb144c7a	2394	*/
JMF	12:0071cb144c7a	2395	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
JMF	12:0071cb144c7a	2396	defined(MBEDTLS_SSL_PROTO_TLS1_1)
JMF	12:0071cb144c7a	2397	if( md_alg == MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2398	{
JMF	12:0071cb144c7a	2399	mbedtls_md5_context mbedtls_md5;
JMF	12:0071cb144c7a	2400	mbedtls_sha1_context mbedtls_sha1;
JMF	12:0071cb144c7a	2401
JMF	12:0071cb144c7a	2402	mbedtls_md5_init( &mbedtls_md5 );
JMF	12:0071cb144c7a	2403	mbedtls_sha1_init( &mbedtls_sha1 );
JMF	12:0071cb144c7a	2404
JMF	12:0071cb144c7a	2405	hashlen = 36;
JMF	12:0071cb144c7a	2406
JMF	12:0071cb144c7a	2407	/*
JMF	12:0071cb144c7a	2408	* digitally-signed struct {
JMF	12:0071cb144c7a	2409	* opaque md5_hash[16];
JMF	12:0071cb144c7a	2410	* opaque sha_hash[20];
JMF	12:0071cb144c7a	2411	* };
JMF	12:0071cb144c7a	2412	*
JMF	12:0071cb144c7a	2413	* md5_hash
JMF	12:0071cb144c7a	2414	* MD5(ClientHello.random + ServerHello.random
JMF	12:0071cb144c7a	2415	* + ServerParams);
JMF	12:0071cb144c7a	2416	* sha_hash
JMF	12:0071cb144c7a	2417	* SHA(ClientHello.random + ServerHello.random
JMF	12:0071cb144c7a	2418	* + ServerParams);
JMF	12:0071cb144c7a	2419	*/
JMF	12:0071cb144c7a	2420	mbedtls_md5_starts( &mbedtls_md5 );
JMF	12:0071cb144c7a	2421	mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
JMF	12:0071cb144c7a	2422	mbedtls_md5_update( &mbedtls_md5, params, params_len );
JMF	12:0071cb144c7a	2423	mbedtls_md5_finish( &mbedtls_md5, hash );
JMF	12:0071cb144c7a	2424
JMF	12:0071cb144c7a	2425	mbedtls_sha1_starts( &mbedtls_sha1 );
JMF	12:0071cb144c7a	2426	mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
JMF	12:0071cb144c7a	2427	mbedtls_sha1_update( &mbedtls_sha1, params, params_len );
JMF	12:0071cb144c7a	2428	mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
JMF	12:0071cb144c7a	2429
JMF	12:0071cb144c7a	2430	mbedtls_md5_free( &mbedtls_md5 );
JMF	12:0071cb144c7a	2431	mbedtls_sha1_free( &mbedtls_sha1 );
JMF	12:0071cb144c7a	2432	}
JMF	12:0071cb144c7a	2433	else
JMF	12:0071cb144c7a	2434	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\| \
JMF	12:0071cb144c7a	2435	MBEDTLS_SSL_PROTO_TLS1_1 */
JMF	12:0071cb144c7a	2436	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
JMF	12:0071cb144c7a	2437	defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2438	if( md_alg != MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2439	{
JMF	12:0071cb144c7a	2440	mbedtls_md_context_t ctx;
JMF	12:0071cb144c7a	2441
JMF	12:0071cb144c7a	2442	mbedtls_md_init( &ctx );
JMF	12:0071cb144c7a	2443
JMF	12:0071cb144c7a	2444	/* Info from md_alg will be used instead */
JMF	12:0071cb144c7a	2445	hashlen = 0;
JMF	12:0071cb144c7a	2446
JMF	12:0071cb144c7a	2447	/*
JMF	12:0071cb144c7a	2448	* digitally-signed struct {
JMF	12:0071cb144c7a	2449	* opaque client_random[32];
JMF	12:0071cb144c7a	2450	* opaque server_random[32];
JMF	12:0071cb144c7a	2451	* ServerDHParams params;
JMF	12:0071cb144c7a	2452	* };
JMF	12:0071cb144c7a	2453	*/
JMF	12:0071cb144c7a	2454	if( ( ret = mbedtls_md_setup( &ctx,
JMF	12:0071cb144c7a	2455	mbedtls_md_info_from_type( md_alg ), 0 ) ) != 0 )
JMF	12:0071cb144c7a	2456	{
JMF	12:0071cb144c7a	2457	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
JMF	12:0071cb144c7a	2458	return( ret );
JMF	12:0071cb144c7a	2459	}
JMF	12:0071cb144c7a	2460
JMF	12:0071cb144c7a	2461	mbedtls_md_starts( &ctx );
JMF	12:0071cb144c7a	2462	mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
JMF	12:0071cb144c7a	2463	mbedtls_md_update( &ctx, params, params_len );
JMF	12:0071cb144c7a	2464	mbedtls_md_finish( &ctx, hash );
JMF	12:0071cb144c7a	2465	mbedtls_md_free( &ctx );
JMF	12:0071cb144c7a	2466	}
JMF	12:0071cb144c7a	2467	else
JMF	12:0071cb144c7a	2468	#endif /* MBEDTLS_SSL_PROTO_TLS1 \|\| MBEDTLS_SSL_PROTO_TLS1_1 \|\| \
JMF	12:0071cb144c7a	2469	MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2470	{
JMF	12:0071cb144c7a	2471	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2472	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2473	}
JMF	12:0071cb144c7a	2474
JMF	12:0071cb144c7a	2475	MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
JMF	12:0071cb144c7a	2476	(unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
JMF	12:0071cb144c7a	2477
JMF	12:0071cb144c7a	2478	if( ssl->session_negotiate->peer_cert == NULL )
JMF	12:0071cb144c7a	2479	{
JMF	12:0071cb144c7a	2480	MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
JMF	12:0071cb144c7a	2481	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2482	}
JMF	12:0071cb144c7a	2483
JMF	12:0071cb144c7a	2484	/*
JMF	12:0071cb144c7a	2485	* Verify signature
JMF	12:0071cb144c7a	2486	*/
JMF	12:0071cb144c7a	2487	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
JMF	12:0071cb144c7a	2488	{
JMF	12:0071cb144c7a	2489	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
JMF	12:0071cb144c7a	2490	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
JMF	12:0071cb144c7a	2491	}
JMF	12:0071cb144c7a	2492
JMF	12:0071cb144c7a	2493	if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
JMF	12:0071cb144c7a	2494	md_alg, hash, hashlen, p, sig_len ) ) != 0 )
JMF	12:0071cb144c7a	2495	{
JMF	12:0071cb144c7a	2496	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
JMF	12:0071cb144c7a	2497	return( ret );
JMF	12:0071cb144c7a	2498	}
JMF	12:0071cb144c7a	2499	}
JMF	12:0071cb144c7a	2500	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2501	MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2502	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2503
JMF	12:0071cb144c7a	2504	exit:
JMF	12:0071cb144c7a	2505	ssl->state++;
JMF	12:0071cb144c7a	2506
JMF	12:0071cb144c7a	2507	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
JMF	12:0071cb144c7a	2508
JMF	12:0071cb144c7a	2509	return( 0 );
JMF	12:0071cb144c7a	2510	}
JMF	12:0071cb144c7a	2511
JMF	12:0071cb144c7a	2512	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2513	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2514	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2515	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2516	static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2517	{
JMF	12:0071cb144c7a	2518	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2519
JMF	12:0071cb144c7a	2520	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
JMF	12:0071cb144c7a	2521
JMF	12:0071cb144c7a	2522	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2523	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2524	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2525	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	2526	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2527	{
JMF	12:0071cb144c7a	2528	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
JMF	12:0071cb144c7a	2529	ssl->state++;
JMF	12:0071cb144c7a	2530	return( 0 );
JMF	12:0071cb144c7a	2531	}
JMF	12:0071cb144c7a	2532
JMF	12:0071cb144c7a	2533	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2534	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2535	}
JMF	12:0071cb144c7a	2536	#else
JMF	12:0071cb144c7a	2537	static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2538	{
JMF	12:0071cb144c7a	2539	int ret;
JMF	12:0071cb144c7a	2540	unsigned char *buf;
JMF	12:0071cb144c7a	2541	size_t n = 0;
JMF	12:0071cb144c7a	2542	size_t cert_type_len = 0, dn_len = 0;
JMF	12:0071cb144c7a	2543	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2544
JMF	12:0071cb144c7a	2545	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
JMF	12:0071cb144c7a	2546
JMF	12:0071cb144c7a	2547	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2548	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2549	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2550	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	2551	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2552	{
JMF	12:0071cb144c7a	2553	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
JMF	12:0071cb144c7a	2554	ssl->state++;
JMF	12:0071cb144c7a	2555	return( 0 );
JMF	12:0071cb144c7a	2556	}
JMF	12:0071cb144c7a	2557
JMF	12:0071cb144c7a	2558	if( ssl->record_read == 0 )
JMF	12:0071cb144c7a	2559	{
JMF	12:0071cb144c7a	2560	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2561	{
JMF	12:0071cb144c7a	2562	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	2563	return( ret );
JMF	12:0071cb144c7a	2564	}
JMF	12:0071cb144c7a	2565
JMF	12:0071cb144c7a	2566	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	2567	{
JMF	12:0071cb144c7a	2568	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
JMF	12:0071cb144c7a	2569	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2570	}
JMF	12:0071cb144c7a	2571
JMF	12:0071cb144c7a	2572	ssl->record_read = 1;
JMF	12:0071cb144c7a	2573	}
JMF	12:0071cb144c7a	2574
JMF	12:0071cb144c7a	2575	ssl->client_auth = 0;
JMF	12:0071cb144c7a	2576	ssl->state++;
JMF	12:0071cb144c7a	2577
JMF	12:0071cb144c7a	2578	if( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST )
JMF	12:0071cb144c7a	2579	ssl->client_auth++;
JMF	12:0071cb144c7a	2580
JMF	12:0071cb144c7a	2581	MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
JMF	12:0071cb144c7a	2582	ssl->client_auth ? "a" : "no" ) );
JMF	12:0071cb144c7a	2583
JMF	12:0071cb144c7a	2584	if( ssl->client_auth == 0 )
JMF	12:0071cb144c7a	2585	goto exit;
JMF	12:0071cb144c7a	2586
JMF	12:0071cb144c7a	2587	ssl->record_read = 0;
JMF	12:0071cb144c7a	2588
JMF	12:0071cb144c7a	2589	/*
JMF	12:0071cb144c7a	2590	* struct {
JMF	12:0071cb144c7a	2591	* ClientCertificateType certificate_types<1..2^8-1>;
JMF	12:0071cb144c7a	2592	* SignatureAndHashAlgorithm
JMF	12:0071cb144c7a	2593	* supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
JMF	12:0071cb144c7a	2594	* DistinguishedName certificate_authorities<0..2^16-1>;
JMF	12:0071cb144c7a	2595	* } CertificateRequest;
JMF	12:0071cb144c7a	2596	*
JMF	12:0071cb144c7a	2597	* Since we only support a single certificate on clients, let's just
JMF	12:0071cb144c7a	2598	* ignore all the information that's supposed to help us pick a
JMF	12:0071cb144c7a	2599	* certificate.
JMF	12:0071cb144c7a	2600	*
JMF	12:0071cb144c7a	2601	* We could check that our certificate matches the request, and bail out
JMF	12:0071cb144c7a	2602	* if it doesn't, but it's simpler to just send the certificate anyway,
JMF	12:0071cb144c7a	2603	* and give the server the opportunity to decide if it should terminate
JMF	12:0071cb144c7a	2604	* the connection when it doesn't like our certificate.
JMF	12:0071cb144c7a	2605	*
JMF	12:0071cb144c7a	2606	* Same goes for the hash in TLS 1.2's signature_algorithms: at this
JMF	12:0071cb144c7a	2607	* point we only have one hash available (see comments in
JMF	12:0071cb144c7a	2608	* write_certificate_verify), so let's just use what we have.
JMF	12:0071cb144c7a	2609	*
JMF	12:0071cb144c7a	2610	* However, we still minimally parse the message to check it is at least
JMF	12:0071cb144c7a	2611	* superficially sane.
JMF	12:0071cb144c7a	2612	*/
JMF	12:0071cb144c7a	2613	buf = ssl->in_msg;
JMF	12:0071cb144c7a	2614
JMF	12:0071cb144c7a	2615	/* certificate_types */
JMF	12:0071cb144c7a	2616	cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
JMF	12:0071cb144c7a	2617	n = cert_type_len;
JMF	12:0071cb144c7a	2618
JMF	12:0071cb144c7a	2619	if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
JMF	12:0071cb144c7a	2620	{
JMF	12:0071cb144c7a	2621	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
JMF	12:0071cb144c7a	2622	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
JMF	12:0071cb144c7a	2623	}
JMF	12:0071cb144c7a	2624
JMF	12:0071cb144c7a	2625	/* supported_signature_algorithms */
JMF	12:0071cb144c7a	2626	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2627	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2628	{
JMF	12:0071cb144c7a	2629	size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
JMF	12:0071cb144c7a	2630	\| ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
JMF	12:0071cb144c7a	2631
JMF	12:0071cb144c7a	2632	n += 2 + sig_alg_len;
JMF	12:0071cb144c7a	2633
JMF	12:0071cb144c7a	2634	if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
JMF	12:0071cb144c7a	2635	{
JMF	12:0071cb144c7a	2636	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
JMF	12:0071cb144c7a	2637	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
JMF	12:0071cb144c7a	2638	}
JMF	12:0071cb144c7a	2639	}
JMF	12:0071cb144c7a	2640	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2641
JMF	12:0071cb144c7a	2642	/* certificate_authorities */
JMF	12:0071cb144c7a	2643	dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
JMF	12:0071cb144c7a	2644	\| ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
JMF	12:0071cb144c7a	2645
JMF	12:0071cb144c7a	2646	n += dn_len;
JMF	12:0071cb144c7a	2647	if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
JMF	12:0071cb144c7a	2648	{
JMF	12:0071cb144c7a	2649	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
JMF	12:0071cb144c7a	2650	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
JMF	12:0071cb144c7a	2651	}
JMF	12:0071cb144c7a	2652
JMF	12:0071cb144c7a	2653	exit:
JMF	12:0071cb144c7a	2654	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
JMF	12:0071cb144c7a	2655
JMF	12:0071cb144c7a	2656	return( 0 );
JMF	12:0071cb144c7a	2657	}
JMF	12:0071cb144c7a	2658	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
JMF	12:0071cb144c7a	2659	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
JMF	12:0071cb144c7a	2660	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
JMF	12:0071cb144c7a	2661	!MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2662
JMF	12:0071cb144c7a	2663	static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2664	{
JMF	12:0071cb144c7a	2665	int ret;
JMF	12:0071cb144c7a	2666
JMF	12:0071cb144c7a	2667	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
JMF	12:0071cb144c7a	2668
JMF	12:0071cb144c7a	2669	if( ssl->record_read == 0 )
JMF	12:0071cb144c7a	2670	{
JMF	12:0071cb144c7a	2671	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2672	{
JMF	12:0071cb144c7a	2673	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	2674	return( ret );
JMF	12:0071cb144c7a	2675	}
JMF	12:0071cb144c7a	2676
JMF	12:0071cb144c7a	2677	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	2678	{
JMF	12:0071cb144c7a	2679	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
JMF	12:0071cb144c7a	2680	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	2681	}
JMF	12:0071cb144c7a	2682	}
JMF	12:0071cb144c7a	2683	ssl->record_read = 0;
JMF	12:0071cb144c7a	2684
JMF	12:0071cb144c7a	2685	if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) \|\|
JMF	12:0071cb144c7a	2686	ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
JMF	12:0071cb144c7a	2687	{
JMF	12:0071cb144c7a	2688	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
JMF	12:0071cb144c7a	2689	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
JMF	12:0071cb144c7a	2690	}
JMF	12:0071cb144c7a	2691
JMF	12:0071cb144c7a	2692	ssl->state++;
JMF	12:0071cb144c7a	2693
JMF	12:0071cb144c7a	2694	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	2695	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	2696	mbedtls_ssl_recv_flight_completed( ssl );
JMF	12:0071cb144c7a	2697	#endif
JMF	12:0071cb144c7a	2698
JMF	12:0071cb144c7a	2699	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
JMF	12:0071cb144c7a	2700
JMF	12:0071cb144c7a	2701	return( 0 );
JMF	12:0071cb144c7a	2702	}
JMF	12:0071cb144c7a	2703
JMF	12:0071cb144c7a	2704	static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2705	{
JMF	12:0071cb144c7a	2706	int ret;
JMF	12:0071cb144c7a	2707	size_t i, n;
JMF	12:0071cb144c7a	2708	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2709
JMF	12:0071cb144c7a	2710	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
JMF	12:0071cb144c7a	2711
JMF	12:0071cb144c7a	2712	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
JMF	12:0071cb144c7a	2713	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
JMF	12:0071cb144c7a	2714	{
JMF	12:0071cb144c7a	2715	/*
JMF	12:0071cb144c7a	2716	* DHM key exchange -- send G^X mod P
JMF	12:0071cb144c7a	2717	*/
JMF	12:0071cb144c7a	2718	n = ssl->handshake->dhm_ctx.len;
JMF	12:0071cb144c7a	2719
JMF	12:0071cb144c7a	2720	ssl->out_msg[4] = (unsigned char)( n >> 8 );
JMF	12:0071cb144c7a	2721	ssl->out_msg[5] = (unsigned char)( n );
JMF	12:0071cb144c7a	2722	i = 6;
JMF	12:0071cb144c7a	2723
JMF	12:0071cb144c7a	2724	ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
JMF	12:0071cb144c7a	2725	(int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
JMF	12:0071cb144c7a	2726	&ssl->out_msg[i], n,
JMF	12:0071cb144c7a	2727	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2728	if( ret != 0 )
JMF	12:0071cb144c7a	2729	{
JMF	12:0071cb144c7a	2730	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
JMF	12:0071cb144c7a	2731	return( ret );
JMF	12:0071cb144c7a	2732	}
JMF	12:0071cb144c7a	2733
JMF	12:0071cb144c7a	2734	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
JMF	12:0071cb144c7a	2735	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
JMF	12:0071cb144c7a	2736
JMF	12:0071cb144c7a	2737	if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
JMF	12:0071cb144c7a	2738	ssl->handshake->premaster,
JMF	12:0071cb144c7a	2739	MBEDTLS_PREMASTER_SIZE,
JMF	12:0071cb144c7a	2740	&ssl->handshake->pmslen,
JMF	12:0071cb144c7a	2741	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	2742	{
JMF	12:0071cb144c7a	2743	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
JMF	12:0071cb144c7a	2744	return( ret );
JMF	12:0071cb144c7a	2745	}
JMF	12:0071cb144c7a	2746
JMF	12:0071cb144c7a	2747	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
JMF	12:0071cb144c7a	2748	}
JMF	12:0071cb144c7a	2749	else
JMF	12:0071cb144c7a	2750	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
JMF	12:0071cb144c7a	2751	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2752	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2753	defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2754	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2755	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
JMF	12:0071cb144c7a	2756	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA \|\|
JMF	12:0071cb144c7a	2757	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
JMF	12:0071cb144c7a	2758	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
JMF	12:0071cb144c7a	2759	{
JMF	12:0071cb144c7a	2760	/*
JMF	12:0071cb144c7a	2761	* ECDH key exchange -- send client public value
JMF	12:0071cb144c7a	2762	*/
JMF	12:0071cb144c7a	2763	i = 4;
JMF	12:0071cb144c7a	2764
JMF	12:0071cb144c7a	2765	ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	2766	&n,
JMF	12:0071cb144c7a	2767	&ssl->out_msg[i], 1000,
JMF	12:0071cb144c7a	2768	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2769	if( ret != 0 )
JMF	12:0071cb144c7a	2770	{
JMF	12:0071cb144c7a	2771	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
JMF	12:0071cb144c7a	2772	return( ret );
JMF	12:0071cb144c7a	2773	}
JMF	12:0071cb144c7a	2774
JMF	12:0071cb144c7a	2775	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
JMF	12:0071cb144c7a	2776
JMF	12:0071cb144c7a	2777	if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	2778	&ssl->handshake->pmslen,
JMF	12:0071cb144c7a	2779	ssl->handshake->premaster,
JMF	12:0071cb144c7a	2780	MBEDTLS_MPI_MAX_SIZE,
JMF	12:0071cb144c7a	2781	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	2782	{
JMF	12:0071cb144c7a	2783	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
JMF	12:0071cb144c7a	2784	return( ret );
JMF	12:0071cb144c7a	2785	}
JMF	12:0071cb144c7a	2786
JMF	12:0071cb144c7a	2787	MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
JMF	12:0071cb144c7a	2788	}
JMF	12:0071cb144c7a	2789	else
JMF	12:0071cb144c7a	2790	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2791	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
JMF	12:0071cb144c7a	2792	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2793	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2794	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
JMF	12:0071cb144c7a	2795	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2796	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2797	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2798	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
JMF	12:0071cb144c7a	2799	{
JMF	12:0071cb144c7a	2800	/*
JMF	12:0071cb144c7a	2801	* opaque psk_identity<0..2^16-1>;
JMF	12:0071cb144c7a	2802	*/
JMF	12:0071cb144c7a	2803	if( ssl->conf->psk == NULL \|\| ssl->conf->psk_identity == NULL )
JMF	12:0071cb144c7a	2804	{
JMF	12:0071cb144c7a	2805	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) );
JMF	12:0071cb144c7a	2806	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
JMF	12:0071cb144c7a	2807	}
JMF	12:0071cb144c7a	2808
JMF	12:0071cb144c7a	2809	i = 4;
JMF	12:0071cb144c7a	2810	n = ssl->conf->psk_identity_len;
JMF	12:0071cb144c7a	2811
JMF	12:0071cb144c7a	2812	if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
JMF	12:0071cb144c7a	2813	{
JMF	12:0071cb144c7a	2814	MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or "
JMF	12:0071cb144c7a	2815	"SSL buffer too short" ) );
JMF	12:0071cb144c7a	2816	return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
JMF	12:0071cb144c7a	2817	}
JMF	12:0071cb144c7a	2818
JMF	12:0071cb144c7a	2819	ssl->out_msg[i++] = (unsigned char)( n >> 8 );
JMF	12:0071cb144c7a	2820	ssl->out_msg[i++] = (unsigned char)( n );
JMF	12:0071cb144c7a	2821
JMF	12:0071cb144c7a	2822	memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len );
JMF	12:0071cb144c7a	2823	i += ssl->conf->psk_identity_len;
JMF	12:0071cb144c7a	2824
JMF	12:0071cb144c7a	2825	#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
JMF	12:0071cb144c7a	2826	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
JMF	12:0071cb144c7a	2827	{
JMF	12:0071cb144c7a	2828	n = 0;
JMF	12:0071cb144c7a	2829	}
JMF	12:0071cb144c7a	2830	else
JMF	12:0071cb144c7a	2831	#endif
JMF	12:0071cb144c7a	2832	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
JMF	12:0071cb144c7a	2833	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
JMF	12:0071cb144c7a	2834	{
JMF	12:0071cb144c7a	2835	if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 )
JMF	12:0071cb144c7a	2836	return( ret );
JMF	12:0071cb144c7a	2837	}
JMF	12:0071cb144c7a	2838	else
JMF	12:0071cb144c7a	2839	#endif
JMF	12:0071cb144c7a	2840	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
JMF	12:0071cb144c7a	2841	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
JMF	12:0071cb144c7a	2842	{
JMF	12:0071cb144c7a	2843	/*
JMF	12:0071cb144c7a	2844	* ClientDiffieHellmanPublic public (DHM send G^X mod P)
JMF	12:0071cb144c7a	2845	*/
JMF	12:0071cb144c7a	2846	n = ssl->handshake->dhm_ctx.len;
JMF	12:0071cb144c7a	2847
JMF	12:0071cb144c7a	2848	if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
JMF	12:0071cb144c7a	2849	{
JMF	12:0071cb144c7a	2850	MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long"
JMF	12:0071cb144c7a	2851	" or SSL buffer too short" ) );
JMF	12:0071cb144c7a	2852	return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
JMF	12:0071cb144c7a	2853	}
JMF	12:0071cb144c7a	2854
JMF	12:0071cb144c7a	2855	ssl->out_msg[i++] = (unsigned char)( n >> 8 );
JMF	12:0071cb144c7a	2856	ssl->out_msg[i++] = (unsigned char)( n );
JMF	12:0071cb144c7a	2857
JMF	12:0071cb144c7a	2858	ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
JMF	12:0071cb144c7a	2859	(int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
JMF	12:0071cb144c7a	2860	&ssl->out_msg[i], n,
JMF	12:0071cb144c7a	2861	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2862	if( ret != 0 )
JMF	12:0071cb144c7a	2863	{
JMF	12:0071cb144c7a	2864	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
JMF	12:0071cb144c7a	2865	return( ret );
JMF	12:0071cb144c7a	2866	}
JMF	12:0071cb144c7a	2867	}
JMF	12:0071cb144c7a	2868	else
JMF	12:0071cb144c7a	2869	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
JMF	12:0071cb144c7a	2870	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
JMF	12:0071cb144c7a	2871	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
JMF	12:0071cb144c7a	2872	{
JMF	12:0071cb144c7a	2873	/*
JMF	12:0071cb144c7a	2874	* ClientECDiffieHellmanPublic public;
JMF	12:0071cb144c7a	2875	*/
JMF	12:0071cb144c7a	2876	ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n,
JMF	12:0071cb144c7a	2877	&ssl->out_msg[i], MBEDTLS_SSL_MAX_CONTENT_LEN - i,
JMF	12:0071cb144c7a	2878	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2879	if( ret != 0 )
JMF	12:0071cb144c7a	2880	{
JMF	12:0071cb144c7a	2881	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
JMF	12:0071cb144c7a	2882	return( ret );
JMF	12:0071cb144c7a	2883	}
JMF	12:0071cb144c7a	2884
JMF	12:0071cb144c7a	2885	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
JMF	12:0071cb144c7a	2886	}
JMF	12:0071cb144c7a	2887	else
JMF	12:0071cb144c7a	2888	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
JMF	12:0071cb144c7a	2889	{
JMF	12:0071cb144c7a	2890	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2891	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2892	}
JMF	12:0071cb144c7a	2893
JMF	12:0071cb144c7a	2894	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
JMF	12:0071cb144c7a	2895	ciphersuite_info->key_exchange ) ) != 0 )
JMF	12:0071cb144c7a	2896	{
JMF	12:0071cb144c7a	2897	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
JMF	12:0071cb144c7a	2898	return( ret );
JMF	12:0071cb144c7a	2899	}
JMF	12:0071cb144c7a	2900	}
JMF	12:0071cb144c7a	2901	else
JMF	12:0071cb144c7a	2902	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
JMF	12:0071cb144c7a	2903	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
JMF	12:0071cb144c7a	2904	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
JMF	12:0071cb144c7a	2905	{
JMF	12:0071cb144c7a	2906	i = 4;
JMF	12:0071cb144c7a	2907	if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 )
JMF	12:0071cb144c7a	2908	return( ret );
JMF	12:0071cb144c7a	2909	}
JMF	12:0071cb144c7a	2910	else
JMF	12:0071cb144c7a	2911	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
JMF	12:0071cb144c7a	2912	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2913	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2914	{
JMF	12:0071cb144c7a	2915	i = 4;
JMF	12:0071cb144c7a	2916
JMF	12:0071cb144c7a	2917	ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	2918	ssl->out_msg + i, MBEDTLS_SSL_MAX_CONTENT_LEN - i, &n,
JMF	12:0071cb144c7a	2919	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2920	if( ret != 0 )
JMF	12:0071cb144c7a	2921	{
JMF	12:0071cb144c7a	2922	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
JMF	12:0071cb144c7a	2923	return( ret );
JMF	12:0071cb144c7a	2924	}
JMF	12:0071cb144c7a	2925
JMF	12:0071cb144c7a	2926	ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	2927	ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
JMF	12:0071cb144c7a	2928	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2929	if( ret != 0 )
JMF	12:0071cb144c7a	2930	{
JMF	12:0071cb144c7a	2931	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
JMF	12:0071cb144c7a	2932	return( ret );
JMF	12:0071cb144c7a	2933	}
JMF	12:0071cb144c7a	2934	}
JMF	12:0071cb144c7a	2935	else
JMF	12:0071cb144c7a	2936	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
JMF	12:0071cb144c7a	2937	{
JMF	12:0071cb144c7a	2938	((void) ciphersuite_info);
JMF	12:0071cb144c7a	2939	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2940	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2941	}
JMF	12:0071cb144c7a	2942
JMF	12:0071cb144c7a	2943	ssl->out_msglen = i + n;
JMF	12:0071cb144c7a	2944	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	2945	ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
JMF	12:0071cb144c7a	2946
JMF	12:0071cb144c7a	2947	ssl->state++;
JMF	12:0071cb144c7a	2948
JMF	12:0071cb144c7a	2949	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2950	{
JMF	12:0071cb144c7a	2951	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	2952	return( ret );
JMF	12:0071cb144c7a	2953	}
JMF	12:0071cb144c7a	2954
JMF	12:0071cb144c7a	2955	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
JMF	12:0071cb144c7a	2956
JMF	12:0071cb144c7a	2957	return( 0 );
JMF	12:0071cb144c7a	2958	}
JMF	12:0071cb144c7a	2959
JMF	12:0071cb144c7a	2960	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2961	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2962	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2963	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2964	static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2965	{
JMF	12:0071cb144c7a	2966	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2967	int ret;
JMF	12:0071cb144c7a	2968
JMF	12:0071cb144c7a	2969	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
JMF	12:0071cb144c7a	2970
JMF	12:0071cb144c7a	2971	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2972	{
JMF	12:0071cb144c7a	2973	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
JMF	12:0071cb144c7a	2974	return( ret );
JMF	12:0071cb144c7a	2975	}
JMF	12:0071cb144c7a	2976
JMF	12:0071cb144c7a	2977	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2978	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2979	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	2980	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2981	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2982	{
JMF	12:0071cb144c7a	2983	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
JMF	12:0071cb144c7a	2984	ssl->state++;
JMF	12:0071cb144c7a	2985	return( 0 );
JMF	12:0071cb144c7a	2986	}
JMF	12:0071cb144c7a	2987
JMF	12:0071cb144c7a	2988	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2989	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2990	}
JMF	12:0071cb144c7a	2991	#else
JMF	12:0071cb144c7a	2992	static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2993	{
JMF	12:0071cb144c7a	2994	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	2995	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2996	size_t n = 0, offset = 0;
JMF	12:0071cb144c7a	2997	unsigned char hash[48];
JMF	12:0071cb144c7a	2998	unsigned char *hash_start = hash;
JMF	12:0071cb144c7a	2999	mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	3000	unsigned int hashlen;
JMF	12:0071cb144c7a	3001
JMF	12:0071cb144c7a	3002	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
JMF	12:0071cb144c7a	3003
JMF	12:0071cb144c7a	3004	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3005	{
JMF	12:0071cb144c7a	3006	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
JMF	12:0071cb144c7a	3007	return( ret );
JMF	12:0071cb144c7a	3008	}
JMF	12:0071cb144c7a	3009
JMF	12:0071cb144c7a	3010	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	3011	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	3012	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	3013	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	3014	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	3015	{
JMF	12:0071cb144c7a	3016	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
JMF	12:0071cb144c7a	3017	ssl->state++;
JMF	12:0071cb144c7a	3018	return( 0 );
JMF	12:0071cb144c7a	3019	}
JMF	12:0071cb144c7a	3020
JMF	12:0071cb144c7a	3021	if( ssl->client_auth == 0 \|\| mbedtls_ssl_own_cert( ssl ) == NULL )
JMF	12:0071cb144c7a	3022	{
JMF	12:0071cb144c7a	3023	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
JMF	12:0071cb144c7a	3024	ssl->state++;
JMF	12:0071cb144c7a	3025	return( 0 );
JMF	12:0071cb144c7a	3026	}
JMF	12:0071cb144c7a	3027
JMF	12:0071cb144c7a	3028	if( mbedtls_ssl_own_key( ssl ) == NULL )
JMF	12:0071cb144c7a	3029	{
JMF	12:0071cb144c7a	3030	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
JMF	12:0071cb144c7a	3031	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
JMF	12:0071cb144c7a	3032	}
JMF	12:0071cb144c7a	3033
JMF	12:0071cb144c7a	3034	/*
JMF	12:0071cb144c7a	3035	* Make an RSA signature of the handshake digests
JMF	12:0071cb144c7a	3036	*/
JMF	12:0071cb144c7a	3037	ssl->handshake->calc_verify( ssl, hash );
JMF	12:0071cb144c7a	3038
JMF	12:0071cb144c7a	3039	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
JMF	12:0071cb144c7a	3040	defined(MBEDTLS_SSL_PROTO_TLS1_1)
JMF	12:0071cb144c7a	3041	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	3042	{
JMF	12:0071cb144c7a	3043	/*
JMF	12:0071cb144c7a	3044	* digitally-signed struct {
JMF	12:0071cb144c7a	3045	* opaque md5_hash[16];
JMF	12:0071cb144c7a	3046	* opaque sha_hash[20];
JMF	12:0071cb144c7a	3047	* };
JMF	12:0071cb144c7a	3048	*
JMF	12:0071cb144c7a	3049	* md5_hash
JMF	12:0071cb144c7a	3050	* MD5(handshake_messages);
JMF	12:0071cb144c7a	3051	*
JMF	12:0071cb144c7a	3052	* sha_hash
JMF	12:0071cb144c7a	3053	* SHA(handshake_messages);
JMF	12:0071cb144c7a	3054	*/
JMF	12:0071cb144c7a	3055	hashlen = 36;
JMF	12:0071cb144c7a	3056	md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	3057
JMF	12:0071cb144c7a	3058	/*
JMF	12:0071cb144c7a	3059	* For ECDSA, default hash is SHA-1 only
JMF	12:0071cb144c7a	3060	*/
JMF	12:0071cb144c7a	3061	if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
JMF	12:0071cb144c7a	3062	{
JMF	12:0071cb144c7a	3063	hash_start += 16;
JMF	12:0071cb144c7a	3064	hashlen -= 16;
JMF	12:0071cb144c7a	3065	md_alg = MBEDTLS_MD_SHA1;
JMF	12:0071cb144c7a	3066	}
JMF	12:0071cb144c7a	3067	}
JMF	12:0071cb144c7a	3068	else
JMF	12:0071cb144c7a	3069	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\| \
JMF	12:0071cb144c7a	3070	MBEDTLS_SSL_PROTO_TLS1_1 */
JMF	12:0071cb144c7a	3071	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	3072	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	3073	{
JMF	12:0071cb144c7a	3074	/*
JMF	12:0071cb144c7a	3075	* digitally-signed struct {
JMF	12:0071cb144c7a	3076	* opaque handshake_messages[handshake_messages_length];
JMF	12:0071cb144c7a	3077	* };
JMF	12:0071cb144c7a	3078	*
JMF	12:0071cb144c7a	3079	* Taking shortcut here. We assume that the server always allows the
JMF	12:0071cb144c7a	3080	* PRF Hash function and has sent it in the allowed signature
JMF	12:0071cb144c7a	3081	* algorithms list received in the Certificate Request message.
JMF	12:0071cb144c7a	3082	*
JMF	12:0071cb144c7a	3083	* Until we encounter a server that does not, we will take this
JMF	12:0071cb144c7a	3084	* shortcut.
JMF	12:0071cb144c7a	3085	*
JMF	12:0071cb144c7a	3086	* Reason: Otherwise we should have running hashes for SHA512 and SHA224
JMF	12:0071cb144c7a	3087	* in order to satisfy 'weird' needs from the server side.
JMF	12:0071cb144c7a	3088	*/
JMF	12:0071cb144c7a	3089	if( ssl->transform_negotiate->ciphersuite_info->mac ==
JMF	12:0071cb144c7a	3090	MBEDTLS_MD_SHA384 )
JMF	12:0071cb144c7a	3091	{
JMF	12:0071cb144c7a	3092	md_alg = MBEDTLS_MD_SHA384;
JMF	12:0071cb144c7a	3093	ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
JMF	12:0071cb144c7a	3094	}
JMF	12:0071cb144c7a	3095	else
JMF	12:0071cb144c7a	3096	{
JMF	12:0071cb144c7a	3097	md_alg = MBEDTLS_MD_SHA256;
JMF	12:0071cb144c7a	3098	ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
JMF	12:0071cb144c7a	3099	}
JMF	12:0071cb144c7a	3100	ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
JMF	12:0071cb144c7a	3101
JMF	12:0071cb144c7a	3102	/* Info from md_alg will be used instead */
JMF	12:0071cb144c7a	3103	hashlen = 0;
JMF	12:0071cb144c7a	3104	offset = 2;
JMF	12:0071cb144c7a	3105	}
JMF	12:0071cb144c7a	3106	else
JMF	12:0071cb144c7a	3107	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	3108	{
JMF	12:0071cb144c7a	3109	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	3110	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	3111	}
JMF	12:0071cb144c7a	3112
JMF	12:0071cb144c7a	3113	if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash_start, hashlen,
JMF	12:0071cb144c7a	3114	ssl->out_msg + 6 + offset, &n,
JMF	12:0071cb144c7a	3115	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	3116	{
JMF	12:0071cb144c7a	3117	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
JMF	12:0071cb144c7a	3118	return( ret );
JMF	12:0071cb144c7a	3119	}
JMF	12:0071cb144c7a	3120
JMF	12:0071cb144c7a	3121	ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
JMF	12:0071cb144c7a	3122	ssl->out_msg[5 + offset] = (unsigned char)( n );
JMF	12:0071cb144c7a	3123
JMF	12:0071cb144c7a	3124	ssl->out_msglen = 6 + n + offset;
JMF	12:0071cb144c7a	3125	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	3126	ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
JMF	12:0071cb144c7a	3127
JMF	12:0071cb144c7a	3128	ssl->state++;
JMF	12:0071cb144c7a	3129
JMF	12:0071cb144c7a	3130	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3131	{
JMF	12:0071cb144c7a	3132	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	3133	return( ret );
JMF	12:0071cb144c7a	3134	}
JMF	12:0071cb144c7a	3135
JMF	12:0071cb144c7a	3136	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
JMF	12:0071cb144c7a	3137
JMF	12:0071cb144c7a	3138	return( ret );
JMF	12:0071cb144c7a	3139	}
JMF	12:0071cb144c7a	3140	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
JMF	12:0071cb144c7a	3141	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
JMF	12:0071cb144c7a	3142	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
JMF	12:0071cb144c7a	3143
JMF	12:0071cb144c7a	3144	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	3145	static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3146	{
JMF	12:0071cb144c7a	3147	int ret;
JMF	12:0071cb144c7a	3148	uint32_t lifetime;
JMF	12:0071cb144c7a	3149	size_t ticket_len;
JMF	12:0071cb144c7a	3150	unsigned char *ticket;
JMF	12:0071cb144c7a	3151	const unsigned char *msg;
JMF	12:0071cb144c7a	3152
JMF	12:0071cb144c7a	3153	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
JMF	12:0071cb144c7a	3154
JMF	12:0071cb144c7a	3155	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3156	{
JMF	12:0071cb144c7a	3157	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	3158	return( ret );
JMF	12:0071cb144c7a	3159	}
JMF	12:0071cb144c7a	3160
JMF	12:0071cb144c7a	3161	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	3162	{
JMF	12:0071cb144c7a	3163	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
JMF	12:0071cb144c7a	3164	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
JMF	12:0071cb144c7a	3165	}
JMF	12:0071cb144c7a	3166
JMF	12:0071cb144c7a	3167	/*
JMF	12:0071cb144c7a	3168	* struct {
JMF	12:0071cb144c7a	3169	* uint32 ticket_lifetime_hint;
JMF	12:0071cb144c7a	3170	* opaque ticket<0..2^16-1>;
JMF	12:0071cb144c7a	3171	* } NewSessionTicket;
JMF	12:0071cb144c7a	3172	*
JMF	12:0071cb144c7a	3173	* 0 . 3 ticket_lifetime_hint
JMF	12:0071cb144c7a	3174	* 4 . 5 ticket_len (n)
JMF	12:0071cb144c7a	3175	* 6 . 5+n ticket content
JMF	12:0071cb144c7a	3176	*/
JMF	12:0071cb144c7a	3177	if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET \|\|
JMF	12:0071cb144c7a	3178	ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
JMF	12:0071cb144c7a	3179	{
JMF	12:0071cb144c7a	3180	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
JMF	12:0071cb144c7a	3181	return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
JMF	12:0071cb144c7a	3182	}
JMF	12:0071cb144c7a	3183
JMF	12:0071cb144c7a	3184	msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	3185
JMF	12:0071cb144c7a	3186	lifetime = ( msg[0] << 24 ) \| ( msg[1] << 16 ) \|
JMF	12:0071cb144c7a	3187	( msg[2] << 8 ) \| ( msg[3] );
JMF	12:0071cb144c7a	3188
JMF	12:0071cb144c7a	3189	ticket_len = ( msg[4] << 8 ) \| ( msg[5] );
JMF	12:0071cb144c7a	3190
JMF	12:0071cb144c7a	3191	if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
JMF	12:0071cb144c7a	3192	{
JMF	12:0071cb144c7a	3193	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
JMF	12:0071cb144c7a	3194	return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
JMF	12:0071cb144c7a	3195	}
JMF	12:0071cb144c7a	3196
JMF	12:0071cb144c7a	3197	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
JMF	12:0071cb144c7a	3198
JMF	12:0071cb144c7a	3199	/* We're not waiting for a NewSessionTicket message any more */
JMF	12:0071cb144c7a	3200	ssl->handshake->new_session_ticket = 0;
JMF	12:0071cb144c7a	3201	ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
JMF	12:0071cb144c7a	3202
JMF	12:0071cb144c7a	3203	/*
JMF	12:0071cb144c7a	3204	* Zero-length ticket means the server changed his mind and doesn't want
JMF	12:0071cb144c7a	3205	* to send a ticket after all, so just forget it
JMF	12:0071cb144c7a	3206	*/
JMF	12:0071cb144c7a	3207	if( ticket_len == 0 )
JMF	12:0071cb144c7a	3208	return( 0 );
JMF	12:0071cb144c7a	3209
JMF	12:0071cb144c7a	3210	mbedtls_zeroize( ssl->session_negotiate->ticket,
JMF	12:0071cb144c7a	3211	ssl->session_negotiate->ticket_len );
JMF	12:0071cb144c7a	3212	mbedtls_free( ssl->session_negotiate->ticket );
JMF	12:0071cb144c7a	3213	ssl->session_negotiate->ticket = NULL;
JMF	12:0071cb144c7a	3214	ssl->session_negotiate->ticket_len = 0;
JMF	12:0071cb144c7a	3215
JMF	12:0071cb144c7a	3216	if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
JMF	12:0071cb144c7a	3217	{
JMF	12:0071cb144c7a	3218	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
JMF	12:0071cb144c7a	3219	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
JMF	12:0071cb144c7a	3220	}
JMF	12:0071cb144c7a	3221
JMF	12:0071cb144c7a	3222	memcpy( ticket, msg + 6, ticket_len );
JMF	12:0071cb144c7a	3223
JMF	12:0071cb144c7a	3224	ssl->session_negotiate->ticket = ticket;
JMF	12:0071cb144c7a	3225	ssl->session_negotiate->ticket_len = ticket_len;
JMF	12:0071cb144c7a	3226	ssl->session_negotiate->ticket_lifetime = lifetime;
JMF	12:0071cb144c7a	3227
JMF	12:0071cb144c7a	3228	/*
JMF	12:0071cb144c7a	3229	* RFC 5077 section 3.4:
JMF	12:0071cb144c7a	3230	* "If the client receives a session ticket from the server, then it
JMF	12:0071cb144c7a	3231	* discards any Session ID that was sent in the ServerHello."
JMF	12:0071cb144c7a	3232	*/
JMF	12:0071cb144c7a	3233	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
JMF	12:0071cb144c7a	3234	ssl->session_negotiate->id_len = 0;
JMF	12:0071cb144c7a	3235
JMF	12:0071cb144c7a	3236	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
JMF	12:0071cb144c7a	3237
JMF	12:0071cb144c7a	3238	return( 0 );
JMF	12:0071cb144c7a	3239	}
JMF	12:0071cb144c7a	3240	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	3241
JMF	12:0071cb144c7a	3242	/*
JMF	12:0071cb144c7a	3243	* SSL handshake -- client side -- single step
JMF	12:0071cb144c7a	3244	*/
JMF	12:0071cb144c7a	3245	int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3246	{
JMF	12:0071cb144c7a	3247	int ret = 0;
JMF	12:0071cb144c7a	3248
JMF	12:0071cb144c7a	3249	if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER \|\| ssl->handshake == NULL )
JMF	12:0071cb144c7a	3250	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	3251
JMF	12:0071cb144c7a	3252	MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
JMF	12:0071cb144c7a	3253
JMF	12:0071cb144c7a	3254	if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3255	return( ret );
JMF	12:0071cb144c7a	3256
JMF	12:0071cb144c7a	3257	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	3258	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
JMF	12:0071cb144c7a	3259	ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
JMF	12:0071cb144c7a	3260	{
JMF	12:0071cb144c7a	3261	if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3262	return( ret );
JMF	12:0071cb144c7a	3263	}
JMF	12:0071cb144c7a	3264	#endif
JMF	12:0071cb144c7a	3265
JMF	12:0071cb144c7a	3266	/* Change state now, so that it is right in mbedtls_ssl_read_record(), used
JMF	12:0071cb144c7a	3267	* by DTLS for dropping out-of-sequence ChangeCipherSpec records */
JMF	12:0071cb144c7a	3268	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	3269	if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
JMF	12:0071cb144c7a	3270	ssl->handshake->new_session_ticket != 0 )
JMF	12:0071cb144c7a	3271	{
JMF	12:0071cb144c7a	3272	ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
JMF	12:0071cb144c7a	3273	}
JMF	12:0071cb144c7a	3274	#endif
JMF	12:0071cb144c7a	3275
JMF	12:0071cb144c7a	3276	switch( ssl->state )
JMF	12:0071cb144c7a	3277	{
JMF	12:0071cb144c7a	3278	case MBEDTLS_SSL_HELLO_REQUEST:
JMF	12:0071cb144c7a	3279	ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
JMF	12:0071cb144c7a	3280	break;
JMF	12:0071cb144c7a	3281
JMF	12:0071cb144c7a	3282	/*
JMF	12:0071cb144c7a	3283	* ==> ClientHello
JMF	12:0071cb144c7a	3284	*/
JMF	12:0071cb144c7a	3285	case MBEDTLS_SSL_CLIENT_HELLO:
JMF	12:0071cb144c7a	3286	ret = ssl_write_client_hello( ssl );
JMF	12:0071cb144c7a	3287	break;
JMF	12:0071cb144c7a	3288
JMF	12:0071cb144c7a	3289	/*
JMF	12:0071cb144c7a	3290	* <== ServerHello
JMF	12:0071cb144c7a	3291	* Certificate
JMF	12:0071cb144c7a	3292	* ( ServerKeyExchange )
JMF	12:0071cb144c7a	3293	* ( CertificateRequest )
JMF	12:0071cb144c7a	3294	* ServerHelloDone
JMF	12:0071cb144c7a	3295	*/
JMF	12:0071cb144c7a	3296	case MBEDTLS_SSL_SERVER_HELLO:
JMF	12:0071cb144c7a	3297	ret = ssl_parse_server_hello( ssl );
JMF	12:0071cb144c7a	3298	break;
JMF	12:0071cb144c7a	3299
JMF	12:0071cb144c7a	3300	case MBEDTLS_SSL_SERVER_CERTIFICATE:
JMF	12:0071cb144c7a	3301	ret = mbedtls_ssl_parse_certificate( ssl );
JMF	12:0071cb144c7a	3302	break;
JMF	12:0071cb144c7a	3303
JMF	12:0071cb144c7a	3304	case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
JMF	12:0071cb144c7a	3305	ret = ssl_parse_server_key_exchange( ssl );
JMF	12:0071cb144c7a	3306	break;
JMF	12:0071cb144c7a	3307
JMF	12:0071cb144c7a	3308	case MBEDTLS_SSL_CERTIFICATE_REQUEST:
JMF	12:0071cb144c7a	3309	ret = ssl_parse_certificate_request( ssl );
JMF	12:0071cb144c7a	3310	break;
JMF	12:0071cb144c7a	3311
JMF	12:0071cb144c7a	3312	case MBEDTLS_SSL_SERVER_HELLO_DONE:
JMF	12:0071cb144c7a	3313	ret = ssl_parse_server_hello_done( ssl );
JMF	12:0071cb144c7a	3314	break;
JMF	12:0071cb144c7a	3315
JMF	12:0071cb144c7a	3316	/*
JMF	12:0071cb144c7a	3317	* ==> ( Certificate/Alert )
JMF	12:0071cb144c7a	3318	* ClientKeyExchange
JMF	12:0071cb144c7a	3319	* ( CertificateVerify )
JMF	12:0071cb144c7a	3320	* ChangeCipherSpec
JMF	12:0071cb144c7a	3321	* Finished
JMF	12:0071cb144c7a	3322	*/
JMF	12:0071cb144c7a	3323	case MBEDTLS_SSL_CLIENT_CERTIFICATE:
JMF	12:0071cb144c7a	3324	ret = mbedtls_ssl_write_certificate( ssl );
JMF	12:0071cb144c7a	3325	break;
JMF	12:0071cb144c7a	3326
JMF	12:0071cb144c7a	3327	case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
JMF	12:0071cb144c7a	3328	ret = ssl_write_client_key_exchange( ssl );
JMF	12:0071cb144c7a	3329	break;
JMF	12:0071cb144c7a	3330
JMF	12:0071cb144c7a	3331	case MBEDTLS_SSL_CERTIFICATE_VERIFY:
JMF	12:0071cb144c7a	3332	ret = ssl_write_certificate_verify( ssl );
JMF	12:0071cb144c7a	3333	break;
JMF	12:0071cb144c7a	3334
JMF	12:0071cb144c7a	3335	case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
JMF	12:0071cb144c7a	3336	ret = mbedtls_ssl_write_change_cipher_spec( ssl );
JMF	12:0071cb144c7a	3337	break;
JMF	12:0071cb144c7a	3338
JMF	12:0071cb144c7a	3339	case MBEDTLS_SSL_CLIENT_FINISHED:
JMF	12:0071cb144c7a	3340	ret = mbedtls_ssl_write_finished( ssl );
JMF	12:0071cb144c7a	3341	break;
JMF	12:0071cb144c7a	3342
JMF	12:0071cb144c7a	3343	/*
JMF	12:0071cb144c7a	3344	* <== ( NewSessionTicket )
JMF	12:0071cb144c7a	3345	* ChangeCipherSpec
JMF	12:0071cb144c7a	3346	* Finished
JMF	12:0071cb144c7a	3347	*/
JMF	12:0071cb144c7a	3348	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	3349	case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
JMF	12:0071cb144c7a	3350	ret = ssl_parse_new_session_ticket( ssl );
JMF	12:0071cb144c7a	3351	break;
JMF	12:0071cb144c7a	3352	#endif
JMF	12:0071cb144c7a	3353
JMF	12:0071cb144c7a	3354	case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
JMF	12:0071cb144c7a	3355	ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
JMF	12:0071cb144c7a	3356	break;
JMF	12:0071cb144c7a	3357
JMF	12:0071cb144c7a	3358	case MBEDTLS_SSL_SERVER_FINISHED:
JMF	12:0071cb144c7a	3359	ret = mbedtls_ssl_parse_finished( ssl );
JMF	12:0071cb144c7a	3360	break;
JMF	12:0071cb144c7a	3361
JMF	12:0071cb144c7a	3362	case MBEDTLS_SSL_FLUSH_BUFFERS:
JMF	12:0071cb144c7a	3363	MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
JMF	12:0071cb144c7a	3364	ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
JMF	12:0071cb144c7a	3365	break;
JMF	12:0071cb144c7a	3366
JMF	12:0071cb144c7a	3367	case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
JMF	12:0071cb144c7a	3368	mbedtls_ssl_handshake_wrapup( ssl );
JMF	12:0071cb144c7a	3369	break;
JMF	12:0071cb144c7a	3370
JMF	12:0071cb144c7a	3371	default:
JMF	12:0071cb144c7a	3372	MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
JMF	12:0071cb144c7a	3373	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	3374	}
JMF	12:0071cb144c7a	3375
JMF	12:0071cb144c7a	3376	return( ret );
JMF	12:0071cb144c7a	3377	}
JMF	12:0071cb144c7a	3378	#endif /* MBEDTLS_SSL_CLI_C */

Repository toolbox

Export to desktop IDE

Repository details

Type:	Library
Created:	21 Sep 2016
Imports:	89
Forks:	1
Commits:	30
Dependents:	17
Dependencies:	1
Followers:	17

Developers

Avnet

Fred Kellerman

mbedtls/source/ssl_cli.c@12:0071cb144c7a, 2016-11-01 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Developers

Important Information for this Arm website

Access Warning