mbedtls - mbedtls ported to mbed-classic

sandbox » Code » mbedtls

mbedtls ported to mbed-classic

Fork of mbedtls by Christopher Haster

source/ssl_srv.c@1:24750b9ad5ef, 2016-01-22 (annotated)

Committer:: Christopher Haster
Date:: Fri Jan 22 16:44:49 2016 -0600
Revision:: 1:24750b9ad5ef

Initial move of mbedtls to mercurial

Who changed what in which revision?

User	Revision	Line number	New contents of line
Christopher Haster	1:24750b9ad5ef	1	/*
Christopher Haster	1:24750b9ad5ef	2	* SSLv3/TLSv1 server-side functions
Christopher Haster	1:24750b9ad5ef	3	*
Christopher Haster	1:24750b9ad5ef	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Christopher Haster	1:24750b9ad5ef	5	* SPDX-License-Identifier: Apache-2.0
Christopher Haster	1:24750b9ad5ef	6	*
Christopher Haster	1:24750b9ad5ef	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
Christopher Haster	1:24750b9ad5ef	8	* not use this file except in compliance with the License.
Christopher Haster	1:24750b9ad5ef	9	* You may obtain a copy of the License at
Christopher Haster	1:24750b9ad5ef	10	*
Christopher Haster	1:24750b9ad5ef	11	* http://www.apache.org/licenses/LICENSE-2.0
Christopher Haster	1:24750b9ad5ef	12	*
Christopher Haster	1:24750b9ad5ef	13	* Unless required by applicable law or agreed to in writing, software
Christopher Haster	1:24750b9ad5ef	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
Christopher Haster	1:24750b9ad5ef	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
Christopher Haster	1:24750b9ad5ef	16	* See the License for the specific language governing permissions and
Christopher Haster	1:24750b9ad5ef	17	* limitations under the License.
Christopher Haster	1:24750b9ad5ef	18	*
Christopher Haster	1:24750b9ad5ef	19	* This file is part of mbed TLS (https://tls.mbed.org)
Christopher Haster	1:24750b9ad5ef	20	*/
Christopher Haster	1:24750b9ad5ef	21
Christopher Haster	1:24750b9ad5ef	22	#if !defined(MBEDTLS_CONFIG_FILE)
Christopher Haster	1:24750b9ad5ef	23	#include "mbedtls/config.h"
Christopher Haster	1:24750b9ad5ef	24	#else
Christopher Haster	1:24750b9ad5ef	25	#include MBEDTLS_CONFIG_FILE
Christopher Haster	1:24750b9ad5ef	26	#endif
Christopher Haster	1:24750b9ad5ef	27
Christopher Haster	1:24750b9ad5ef	28	#if defined(MBEDTLS_SSL_SRV_C)
Christopher Haster	1:24750b9ad5ef	29
Christopher Haster	1:24750b9ad5ef	30	#include "mbedtls/debug.h"
Christopher Haster	1:24750b9ad5ef	31	#include "mbedtls/ssl.h"
Christopher Haster	1:24750b9ad5ef	32	#include "mbedtls/ssl_internal.h"
Christopher Haster	1:24750b9ad5ef	33
Christopher Haster	1:24750b9ad5ef	34	#include <string.h>
Christopher Haster	1:24750b9ad5ef	35
Christopher Haster	1:24750b9ad5ef	36	#if defined(MBEDTLS_ECP_C)
Christopher Haster	1:24750b9ad5ef	37	#include "mbedtls/ecp.h"
Christopher Haster	1:24750b9ad5ef	38	#endif
Christopher Haster	1:24750b9ad5ef	39
Christopher Haster	1:24750b9ad5ef	40	#if defined(MBEDTLS_PLATFORM_C)
Christopher Haster	1:24750b9ad5ef	41	#include "mbedtls/platform.h"
Christopher Haster	1:24750b9ad5ef	42	#else
Christopher Haster	1:24750b9ad5ef	43	#include <stdlib.h>
Christopher Haster	1:24750b9ad5ef	44	#define mbedtls_calloc calloc
Christopher Haster	1:24750b9ad5ef	45	#define mbedtls_free free
Christopher Haster	1:24750b9ad5ef	46	#endif
Christopher Haster	1:24750b9ad5ef	47
Christopher Haster	1:24750b9ad5ef	48	#if defined(MBEDTLS_HAVE_TIME)
Christopher Haster	1:24750b9ad5ef	49	#include <time.h>
Christopher Haster	1:24750b9ad5ef	50	#endif
Christopher Haster	1:24750b9ad5ef	51
Christopher Haster	1:24750b9ad5ef	52	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	53	/* Implementation that should never be optimized out by the compiler */
Christopher Haster	1:24750b9ad5ef	54	static void mbedtls_zeroize( void *v, size_t n ) {
Christopher Haster	1:24750b9ad5ef	55	volatile unsigned char p = v; while( n-- ) p++ = 0;
Christopher Haster	1:24750b9ad5ef	56	}
Christopher Haster	1:24750b9ad5ef	57	#endif
Christopher Haster	1:24750b9ad5ef	58
Christopher Haster	1:24750b9ad5ef	59	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Christopher Haster	1:24750b9ad5ef	60	int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	61	const unsigned char *info,
Christopher Haster	1:24750b9ad5ef	62	size_t ilen )
Christopher Haster	1:24750b9ad5ef	63	{
Christopher Haster	1:24750b9ad5ef	64	if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
Christopher Haster	1:24750b9ad5ef	65	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Christopher Haster	1:24750b9ad5ef	66
Christopher Haster	1:24750b9ad5ef	67	mbedtls_free( ssl->cli_id );
Christopher Haster	1:24750b9ad5ef	68
Christopher Haster	1:24750b9ad5ef	69	if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Christopher Haster	1:24750b9ad5ef	70	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Christopher Haster	1:24750b9ad5ef	71
Christopher Haster	1:24750b9ad5ef	72	memcpy( ssl->cli_id, info, ilen );
Christopher Haster	1:24750b9ad5ef	73	ssl->cli_id_len = ilen;
Christopher Haster	1:24750b9ad5ef	74
Christopher Haster	1:24750b9ad5ef	75	return( 0 );
Christopher Haster	1:24750b9ad5ef	76	}
Christopher Haster	1:24750b9ad5ef	77
Christopher Haster	1:24750b9ad5ef	78	void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Christopher Haster	1:24750b9ad5ef	79	mbedtls_ssl_cookie_write_t *f_cookie_write,
Christopher Haster	1:24750b9ad5ef	80	mbedtls_ssl_cookie_check_t *f_cookie_check,
Christopher Haster	1:24750b9ad5ef	81	void *p_cookie )
Christopher Haster	1:24750b9ad5ef	82	{
Christopher Haster	1:24750b9ad5ef	83	conf->f_cookie_write = f_cookie_write;
Christopher Haster	1:24750b9ad5ef	84	conf->f_cookie_check = f_cookie_check;
Christopher Haster	1:24750b9ad5ef	85	conf->p_cookie = p_cookie;
Christopher Haster	1:24750b9ad5ef	86	}
Christopher Haster	1:24750b9ad5ef	87	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Christopher Haster	1:24750b9ad5ef	88
Christopher Haster	1:24750b9ad5ef	89	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Christopher Haster	1:24750b9ad5ef	90	static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	91	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	92	size_t len )
Christopher Haster	1:24750b9ad5ef	93	{
Christopher Haster	1:24750b9ad5ef	94	int ret;
Christopher Haster	1:24750b9ad5ef	95	size_t servername_list_size, hostname_len;
Christopher Haster	1:24750b9ad5ef	96	const unsigned char *p;
Christopher Haster	1:24750b9ad5ef	97
Christopher Haster	1:24750b9ad5ef	98	MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Christopher Haster	1:24750b9ad5ef	99
Christopher Haster	1:24750b9ad5ef	100	servername_list_size = ( ( buf[0] << 8 ) \| ( buf[1] ) );
Christopher Haster	1:24750b9ad5ef	101	if( servername_list_size + 2 != len )
Christopher Haster	1:24750b9ad5ef	102	{
Christopher Haster	1:24750b9ad5ef	103	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	104	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	105	}
Christopher Haster	1:24750b9ad5ef	106
Christopher Haster	1:24750b9ad5ef	107	p = buf + 2;
Christopher Haster	1:24750b9ad5ef	108	while( servername_list_size > 0 )
Christopher Haster	1:24750b9ad5ef	109	{
Christopher Haster	1:24750b9ad5ef	110	hostname_len = ( ( p[1] << 8 ) \| p[2] );
Christopher Haster	1:24750b9ad5ef	111	if( hostname_len + 3 > servername_list_size )
Christopher Haster	1:24750b9ad5ef	112	{
Christopher Haster	1:24750b9ad5ef	113	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	114	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	115	}
Christopher Haster	1:24750b9ad5ef	116
Christopher Haster	1:24750b9ad5ef	117	if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Christopher Haster	1:24750b9ad5ef	118	{
Christopher Haster	1:24750b9ad5ef	119	ret = ssl->conf->f_sni( ssl->conf->p_sni,
Christopher Haster	1:24750b9ad5ef	120	ssl, p + 3, hostname_len );
Christopher Haster	1:24750b9ad5ef	121	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	122	{
Christopher Haster	1:24750b9ad5ef	123	MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
Christopher Haster	1:24750b9ad5ef	124	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	125	MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
Christopher Haster	1:24750b9ad5ef	126	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	127	}
Christopher Haster	1:24750b9ad5ef	128	return( 0 );
Christopher Haster	1:24750b9ad5ef	129	}
Christopher Haster	1:24750b9ad5ef	130
Christopher Haster	1:24750b9ad5ef	131	servername_list_size -= hostname_len + 3;
Christopher Haster	1:24750b9ad5ef	132	p += hostname_len + 3;
Christopher Haster	1:24750b9ad5ef	133	}
Christopher Haster	1:24750b9ad5ef	134
Christopher Haster	1:24750b9ad5ef	135	if( servername_list_size != 0 )
Christopher Haster	1:24750b9ad5ef	136	{
Christopher Haster	1:24750b9ad5ef	137	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	138	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	139	}
Christopher Haster	1:24750b9ad5ef	140
Christopher Haster	1:24750b9ad5ef	141	return( 0 );
Christopher Haster	1:24750b9ad5ef	142	}
Christopher Haster	1:24750b9ad5ef	143	#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Christopher Haster	1:24750b9ad5ef	144
Christopher Haster	1:24750b9ad5ef	145	static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	146	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	147	size_t len )
Christopher Haster	1:24750b9ad5ef	148	{
Christopher Haster	1:24750b9ad5ef	149	int ret;
Christopher Haster	1:24750b9ad5ef	150
Christopher Haster	1:24750b9ad5ef	151	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	152	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	153	{
Christopher Haster	1:24750b9ad5ef	154	/* Check verify-data in constant-time. The length OTOH is no secret */
Christopher Haster	1:24750b9ad5ef	155	if( len != 1 + ssl->verify_data_len \|\|
Christopher Haster	1:24750b9ad5ef	156	buf[0] != ssl->verify_data_len \|\|
Christopher Haster	1:24750b9ad5ef	157	mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
Christopher Haster	1:24750b9ad5ef	158	ssl->verify_data_len ) != 0 )
Christopher Haster	1:24750b9ad5ef	159	{
Christopher Haster	1:24750b9ad5ef	160	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Christopher Haster	1:24750b9ad5ef	161
Christopher Haster	1:24750b9ad5ef	162	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	163	return( ret );
Christopher Haster	1:24750b9ad5ef	164
Christopher Haster	1:24750b9ad5ef	165	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	166	}
Christopher Haster	1:24750b9ad5ef	167	}
Christopher Haster	1:24750b9ad5ef	168	else
Christopher Haster	1:24750b9ad5ef	169	#endif /* MBEDTLS_SSL_RENEGOTIATION */
Christopher Haster	1:24750b9ad5ef	170	{
Christopher Haster	1:24750b9ad5ef	171	if( len != 1 \|\| buf[0] != 0x0 )
Christopher Haster	1:24750b9ad5ef	172	{
Christopher Haster	1:24750b9ad5ef	173	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Christopher Haster	1:24750b9ad5ef	174
Christopher Haster	1:24750b9ad5ef	175	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	176	return( ret );
Christopher Haster	1:24750b9ad5ef	177
Christopher Haster	1:24750b9ad5ef	178	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	179	}
Christopher Haster	1:24750b9ad5ef	180
Christopher Haster	1:24750b9ad5ef	181	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Christopher Haster	1:24750b9ad5ef	182	}
Christopher Haster	1:24750b9ad5ef	183
Christopher Haster	1:24750b9ad5ef	184	return( 0 );
Christopher Haster	1:24750b9ad5ef	185	}
Christopher Haster	1:24750b9ad5ef	186
Christopher Haster	1:24750b9ad5ef	187	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Christopher Haster	1:24750b9ad5ef	188	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Christopher Haster	1:24750b9ad5ef	189	static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	190	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	191	size_t len )
Christopher Haster	1:24750b9ad5ef	192	{
Christopher Haster	1:24750b9ad5ef	193	size_t sig_alg_list_size;
Christopher Haster	1:24750b9ad5ef	194	const unsigned char *p;
Christopher Haster	1:24750b9ad5ef	195	const unsigned char *end = buf + len;
Christopher Haster	1:24750b9ad5ef	196	const int *md_cur;
Christopher Haster	1:24750b9ad5ef	197
Christopher Haster	1:24750b9ad5ef	198
Christopher Haster	1:24750b9ad5ef	199	sig_alg_list_size = ( ( buf[0] << 8 ) \| ( buf[1] ) );
Christopher Haster	1:24750b9ad5ef	200	if( sig_alg_list_size + 2 != len \|\|
Christopher Haster	1:24750b9ad5ef	201	sig_alg_list_size % 2 != 0 )
Christopher Haster	1:24750b9ad5ef	202	{
Christopher Haster	1:24750b9ad5ef	203	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	204	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	205	}
Christopher Haster	1:24750b9ad5ef	206
Christopher Haster	1:24750b9ad5ef	207	/*
Christopher Haster	1:24750b9ad5ef	208	* For now, ignore the SignatureAlgorithm part and rely on offered
Christopher Haster	1:24750b9ad5ef	209	* ciphersuites only for that part. To be fixed later.
Christopher Haster	1:24750b9ad5ef	210	*
Christopher Haster	1:24750b9ad5ef	211	* So, just look at the HashAlgorithm part.
Christopher Haster	1:24750b9ad5ef	212	*/
Christopher Haster	1:24750b9ad5ef	213	for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
Christopher Haster	1:24750b9ad5ef	214	for( p = buf + 2; p < end; p += 2 ) {
Christopher Haster	1:24750b9ad5ef	215	if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
Christopher Haster	1:24750b9ad5ef	216	ssl->handshake->sig_alg = p[0];
Christopher Haster	1:24750b9ad5ef	217	goto have_sig_alg;
Christopher Haster	1:24750b9ad5ef	218	}
Christopher Haster	1:24750b9ad5ef	219	}
Christopher Haster	1:24750b9ad5ef	220	}
Christopher Haster	1:24750b9ad5ef	221
Christopher Haster	1:24750b9ad5ef	222	/* Some key echanges do not need signatures at all */
Christopher Haster	1:24750b9ad5ef	223	MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
Christopher Haster	1:24750b9ad5ef	224	return( 0 );
Christopher Haster	1:24750b9ad5ef	225
Christopher Haster	1:24750b9ad5ef	226	have_sig_alg:
Christopher Haster	1:24750b9ad5ef	227	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
Christopher Haster	1:24750b9ad5ef	228	ssl->handshake->sig_alg ) );
Christopher Haster	1:24750b9ad5ef	229
Christopher Haster	1:24750b9ad5ef	230	return( 0 );
Christopher Haster	1:24750b9ad5ef	231	}
Christopher Haster	1:24750b9ad5ef	232	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Christopher Haster	1:24750b9ad5ef	233	MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Christopher Haster	1:24750b9ad5ef	234
Christopher Haster	1:24750b9ad5ef	235	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
Christopher Haster	1:24750b9ad5ef	236	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	237	static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	238	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	239	size_t len )
Christopher Haster	1:24750b9ad5ef	240	{
Christopher Haster	1:24750b9ad5ef	241	size_t list_size, our_size;
Christopher Haster	1:24750b9ad5ef	242	const unsigned char *p;
Christopher Haster	1:24750b9ad5ef	243	const mbedtls_ecp_curve_info curve_info, *curves;
Christopher Haster	1:24750b9ad5ef	244
Christopher Haster	1:24750b9ad5ef	245	list_size = ( ( buf[0] << 8 ) \| ( buf[1] ) );
Christopher Haster	1:24750b9ad5ef	246	if( list_size + 2 != len \|\|
Christopher Haster	1:24750b9ad5ef	247	list_size % 2 != 0 )
Christopher Haster	1:24750b9ad5ef	248	{
Christopher Haster	1:24750b9ad5ef	249	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	250	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	251	}
Christopher Haster	1:24750b9ad5ef	252
Christopher Haster	1:24750b9ad5ef	253	/* Should never happen unless client duplicates the extension */
Christopher Haster	1:24750b9ad5ef	254	if( ssl->handshake->curves != NULL )
Christopher Haster	1:24750b9ad5ef	255	{
Christopher Haster	1:24750b9ad5ef	256	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	257	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	258	}
Christopher Haster	1:24750b9ad5ef	259
Christopher Haster	1:24750b9ad5ef	260	/* Don't allow our peer to make us allocate too much memory,
Christopher Haster	1:24750b9ad5ef	261	* and leave room for a final 0 */
Christopher Haster	1:24750b9ad5ef	262	our_size = list_size / 2 + 1;
Christopher Haster	1:24750b9ad5ef	263	if( our_size > MBEDTLS_ECP_DP_MAX )
Christopher Haster	1:24750b9ad5ef	264	our_size = MBEDTLS_ECP_DP_MAX;
Christopher Haster	1:24750b9ad5ef	265
Christopher Haster	1:24750b9ad5ef	266	if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
Christopher Haster	1:24750b9ad5ef	267	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Christopher Haster	1:24750b9ad5ef	268
Christopher Haster	1:24750b9ad5ef	269	ssl->handshake->curves = curves;
Christopher Haster	1:24750b9ad5ef	270
Christopher Haster	1:24750b9ad5ef	271	p = buf + 2;
Christopher Haster	1:24750b9ad5ef	272	while( list_size > 0 && our_size > 1 )
Christopher Haster	1:24750b9ad5ef	273	{
Christopher Haster	1:24750b9ad5ef	274	curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) \| p[1] );
Christopher Haster	1:24750b9ad5ef	275
Christopher Haster	1:24750b9ad5ef	276	if( curve_info != NULL )
Christopher Haster	1:24750b9ad5ef	277	{
Christopher Haster	1:24750b9ad5ef	278	*curves++ = curve_info;
Christopher Haster	1:24750b9ad5ef	279	our_size--;
Christopher Haster	1:24750b9ad5ef	280	}
Christopher Haster	1:24750b9ad5ef	281
Christopher Haster	1:24750b9ad5ef	282	list_size -= 2;
Christopher Haster	1:24750b9ad5ef	283	p += 2;
Christopher Haster	1:24750b9ad5ef	284	}
Christopher Haster	1:24750b9ad5ef	285
Christopher Haster	1:24750b9ad5ef	286	return( 0 );
Christopher Haster	1:24750b9ad5ef	287	}
Christopher Haster	1:24750b9ad5ef	288
Christopher Haster	1:24750b9ad5ef	289	static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	290	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	291	size_t len )
Christopher Haster	1:24750b9ad5ef	292	{
Christopher Haster	1:24750b9ad5ef	293	size_t list_size;
Christopher Haster	1:24750b9ad5ef	294	const unsigned char *p;
Christopher Haster	1:24750b9ad5ef	295
Christopher Haster	1:24750b9ad5ef	296	list_size = buf[0];
Christopher Haster	1:24750b9ad5ef	297	if( list_size + 1 != len )
Christopher Haster	1:24750b9ad5ef	298	{
Christopher Haster	1:24750b9ad5ef	299	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	300	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	301	}
Christopher Haster	1:24750b9ad5ef	302
Christopher Haster	1:24750b9ad5ef	303	p = buf + 1;
Christopher Haster	1:24750b9ad5ef	304	while( list_size > 0 )
Christopher Haster	1:24750b9ad5ef	305	{
Christopher Haster	1:24750b9ad5ef	306	if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED \|\|
Christopher Haster	1:24750b9ad5ef	307	p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Christopher Haster	1:24750b9ad5ef	308	{
Christopher Haster	1:24750b9ad5ef	309	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C)
Christopher Haster	1:24750b9ad5ef	310	ssl->handshake->ecdh_ctx.point_format = p[0];
Christopher Haster	1:24750b9ad5ef	311	#endif
Christopher Haster	1:24750b9ad5ef	312	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	313	ssl->handshake->ecjpake_ctx.point_format = p[0];
Christopher Haster	1:24750b9ad5ef	314	#endif
Christopher Haster	1:24750b9ad5ef	315	MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Christopher Haster	1:24750b9ad5ef	316	return( 0 );
Christopher Haster	1:24750b9ad5ef	317	}
Christopher Haster	1:24750b9ad5ef	318
Christopher Haster	1:24750b9ad5ef	319	list_size--;
Christopher Haster	1:24750b9ad5ef	320	p++;
Christopher Haster	1:24750b9ad5ef	321	}
Christopher Haster	1:24750b9ad5ef	322
Christopher Haster	1:24750b9ad5ef	323	return( 0 );
Christopher Haster	1:24750b9ad5ef	324	}
Christopher Haster	1:24750b9ad5ef	325	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
Christopher Haster	1:24750b9ad5ef	326	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	327
Christopher Haster	1:24750b9ad5ef	328	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	329	static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	330	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	331	size_t len )
Christopher Haster	1:24750b9ad5ef	332	{
Christopher Haster	1:24750b9ad5ef	333	int ret;
Christopher Haster	1:24750b9ad5ef	334
Christopher Haster	1:24750b9ad5ef	335	if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
Christopher Haster	1:24750b9ad5ef	336	{
Christopher Haster	1:24750b9ad5ef	337	MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
Christopher Haster	1:24750b9ad5ef	338	return( 0 );
Christopher Haster	1:24750b9ad5ef	339	}
Christopher Haster	1:24750b9ad5ef	340
Christopher Haster	1:24750b9ad5ef	341	if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
Christopher Haster	1:24750b9ad5ef	342	buf, len ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	343	{
Christopher Haster	1:24750b9ad5ef	344	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Christopher Haster	1:24750b9ad5ef	345	return( ret );
Christopher Haster	1:24750b9ad5ef	346	}
Christopher Haster	1:24750b9ad5ef	347
Christopher Haster	1:24750b9ad5ef	348	/* Only mark the extension as OK when we're sure it is */
Christopher Haster	1:24750b9ad5ef	349	ssl->handshake->cli_exts \|= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
Christopher Haster	1:24750b9ad5ef	350
Christopher Haster	1:24750b9ad5ef	351	return( 0 );
Christopher Haster	1:24750b9ad5ef	352	}
Christopher Haster	1:24750b9ad5ef	353	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	354
Christopher Haster	1:24750b9ad5ef	355	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Christopher Haster	1:24750b9ad5ef	356	static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	357	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	358	size_t len )
Christopher Haster	1:24750b9ad5ef	359	{
Christopher Haster	1:24750b9ad5ef	360	if( len != 1 \|\| buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Christopher Haster	1:24750b9ad5ef	361	{
Christopher Haster	1:24750b9ad5ef	362	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	363	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	364	}
Christopher Haster	1:24750b9ad5ef	365
Christopher Haster	1:24750b9ad5ef	366	ssl->session_negotiate->mfl_code = buf[0];
Christopher Haster	1:24750b9ad5ef	367
Christopher Haster	1:24750b9ad5ef	368	return( 0 );
Christopher Haster	1:24750b9ad5ef	369	}
Christopher Haster	1:24750b9ad5ef	370	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Christopher Haster	1:24750b9ad5ef	371
Christopher Haster	1:24750b9ad5ef	372	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Christopher Haster	1:24750b9ad5ef	373	static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	374	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	375	size_t len )
Christopher Haster	1:24750b9ad5ef	376	{
Christopher Haster	1:24750b9ad5ef	377	if( len != 0 )
Christopher Haster	1:24750b9ad5ef	378	{
Christopher Haster	1:24750b9ad5ef	379	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	380	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	381	}
Christopher Haster	1:24750b9ad5ef	382
Christopher Haster	1:24750b9ad5ef	383	((void) buf);
Christopher Haster	1:24750b9ad5ef	384
Christopher Haster	1:24750b9ad5ef	385	if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Christopher Haster	1:24750b9ad5ef	386	ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Christopher Haster	1:24750b9ad5ef	387
Christopher Haster	1:24750b9ad5ef	388	return( 0 );
Christopher Haster	1:24750b9ad5ef	389	}
Christopher Haster	1:24750b9ad5ef	390	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Christopher Haster	1:24750b9ad5ef	391
Christopher Haster	1:24750b9ad5ef	392	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Christopher Haster	1:24750b9ad5ef	393	static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	394	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	395	size_t len )
Christopher Haster	1:24750b9ad5ef	396	{
Christopher Haster	1:24750b9ad5ef	397	if( len != 0 )
Christopher Haster	1:24750b9ad5ef	398	{
Christopher Haster	1:24750b9ad5ef	399	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	400	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	401	}
Christopher Haster	1:24750b9ad5ef	402
Christopher Haster	1:24750b9ad5ef	403	((void) buf);
Christopher Haster	1:24750b9ad5ef	404
Christopher Haster	1:24750b9ad5ef	405	if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
Christopher Haster	1:24750b9ad5ef	406	ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Christopher Haster	1:24750b9ad5ef	407	{
Christopher Haster	1:24750b9ad5ef	408	ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Christopher Haster	1:24750b9ad5ef	409	}
Christopher Haster	1:24750b9ad5ef	410
Christopher Haster	1:24750b9ad5ef	411	return( 0 );
Christopher Haster	1:24750b9ad5ef	412	}
Christopher Haster	1:24750b9ad5ef	413	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Christopher Haster	1:24750b9ad5ef	414
Christopher Haster	1:24750b9ad5ef	415	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Christopher Haster	1:24750b9ad5ef	416	static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	417	const unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	418	size_t len )
Christopher Haster	1:24750b9ad5ef	419	{
Christopher Haster	1:24750b9ad5ef	420	if( len != 0 )
Christopher Haster	1:24750b9ad5ef	421	{
Christopher Haster	1:24750b9ad5ef	422	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	423	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	424	}
Christopher Haster	1:24750b9ad5ef	425
Christopher Haster	1:24750b9ad5ef	426	((void) buf);
Christopher Haster	1:24750b9ad5ef	427
Christopher Haster	1:24750b9ad5ef	428	if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
Christopher Haster	1:24750b9ad5ef	429	ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Christopher Haster	1:24750b9ad5ef	430	{
Christopher Haster	1:24750b9ad5ef	431	ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Christopher Haster	1:24750b9ad5ef	432	}
Christopher Haster	1:24750b9ad5ef	433
Christopher Haster	1:24750b9ad5ef	434	return( 0 );
Christopher Haster	1:24750b9ad5ef	435	}
Christopher Haster	1:24750b9ad5ef	436	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Christopher Haster	1:24750b9ad5ef	437
Christopher Haster	1:24750b9ad5ef	438	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	439	static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	440	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	441	size_t len )
Christopher Haster	1:24750b9ad5ef	442	{
Christopher Haster	1:24750b9ad5ef	443	int ret;
Christopher Haster	1:24750b9ad5ef	444	mbedtls_ssl_session session;
Christopher Haster	1:24750b9ad5ef	445
Christopher Haster	1:24750b9ad5ef	446	mbedtls_ssl_session_init( &session );
Christopher Haster	1:24750b9ad5ef	447
Christopher Haster	1:24750b9ad5ef	448	if( ssl->conf->f_ticket_parse == NULL \|\|
Christopher Haster	1:24750b9ad5ef	449	ssl->conf->f_ticket_write == NULL )
Christopher Haster	1:24750b9ad5ef	450	{
Christopher Haster	1:24750b9ad5ef	451	return( 0 );
Christopher Haster	1:24750b9ad5ef	452	}
Christopher Haster	1:24750b9ad5ef	453
Christopher Haster	1:24750b9ad5ef	454	/* Remember the client asked us to send a new ticket */
Christopher Haster	1:24750b9ad5ef	455	ssl->handshake->new_session_ticket = 1;
Christopher Haster	1:24750b9ad5ef	456
Christopher Haster	1:24750b9ad5ef	457	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
Christopher Haster	1:24750b9ad5ef	458
Christopher Haster	1:24750b9ad5ef	459	if( len == 0 )
Christopher Haster	1:24750b9ad5ef	460	return( 0 );
Christopher Haster	1:24750b9ad5ef	461
Christopher Haster	1:24750b9ad5ef	462	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	463	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	464	{
Christopher Haster	1:24750b9ad5ef	465	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Christopher Haster	1:24750b9ad5ef	466	return( 0 );
Christopher Haster	1:24750b9ad5ef	467	}
Christopher Haster	1:24750b9ad5ef	468	#endif /* MBEDTLS_SSL_RENEGOTIATION */
Christopher Haster	1:24750b9ad5ef	469
Christopher Haster	1:24750b9ad5ef	470	/*
Christopher Haster	1:24750b9ad5ef	471	* Failures are ok: just ignore the ticket and proceed.
Christopher Haster	1:24750b9ad5ef	472	*/
Christopher Haster	1:24750b9ad5ef	473	if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
Christopher Haster	1:24750b9ad5ef	474	buf, len ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	475	{
Christopher Haster	1:24750b9ad5ef	476	mbedtls_ssl_session_free( &session );
Christopher Haster	1:24750b9ad5ef	477
Christopher Haster	1:24750b9ad5ef	478	if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
Christopher Haster	1:24750b9ad5ef	479	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
Christopher Haster	1:24750b9ad5ef	480	else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
Christopher Haster	1:24750b9ad5ef	481	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
Christopher Haster	1:24750b9ad5ef	482	else
Christopher Haster	1:24750b9ad5ef	483	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
Christopher Haster	1:24750b9ad5ef	484
Christopher Haster	1:24750b9ad5ef	485	return( 0 );
Christopher Haster	1:24750b9ad5ef	486	}
Christopher Haster	1:24750b9ad5ef	487
Christopher Haster	1:24750b9ad5ef	488	/*
Christopher Haster	1:24750b9ad5ef	489	* Keep the session ID sent by the client, since we MUST send it back to
Christopher Haster	1:24750b9ad5ef	490	* inform them we're accepting the ticket (RFC 5077 section 3.4)
Christopher Haster	1:24750b9ad5ef	491	*/
Christopher Haster	1:24750b9ad5ef	492	session.id_len = ssl->session_negotiate->id_len;
Christopher Haster	1:24750b9ad5ef	493	memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Christopher Haster	1:24750b9ad5ef	494
Christopher Haster	1:24750b9ad5ef	495	mbedtls_ssl_session_free( ssl->session_negotiate );
Christopher Haster	1:24750b9ad5ef	496	memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
Christopher Haster	1:24750b9ad5ef	497
Christopher Haster	1:24750b9ad5ef	498	/* Zeroize instead of free as we copied the content */
Christopher Haster	1:24750b9ad5ef	499	mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
Christopher Haster	1:24750b9ad5ef	500
Christopher Haster	1:24750b9ad5ef	501	MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Christopher Haster	1:24750b9ad5ef	502
Christopher Haster	1:24750b9ad5ef	503	ssl->handshake->resume = 1;
Christopher Haster	1:24750b9ad5ef	504
Christopher Haster	1:24750b9ad5ef	505	/* Don't send a new ticket after all, this one is OK */
Christopher Haster	1:24750b9ad5ef	506	ssl->handshake->new_session_ticket = 0;
Christopher Haster	1:24750b9ad5ef	507
Christopher Haster	1:24750b9ad5ef	508	return( 0 );
Christopher Haster	1:24750b9ad5ef	509	}
Christopher Haster	1:24750b9ad5ef	510	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Christopher Haster	1:24750b9ad5ef	511
Christopher Haster	1:24750b9ad5ef	512	#if defined(MBEDTLS_SSL_ALPN)
Christopher Haster	1:24750b9ad5ef	513	static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	514	const unsigned char *buf, size_t len )
Christopher Haster	1:24750b9ad5ef	515	{
Christopher Haster	1:24750b9ad5ef	516	size_t list_len, cur_len, ours_len;
Christopher Haster	1:24750b9ad5ef	517	const unsigned char theirs, start, *end;
Christopher Haster	1:24750b9ad5ef	518	const char **ours;
Christopher Haster	1:24750b9ad5ef	519
Christopher Haster	1:24750b9ad5ef	520	/* If ALPN not configured, just ignore the extension */
Christopher Haster	1:24750b9ad5ef	521	if( ssl->conf->alpn_list == NULL )
Christopher Haster	1:24750b9ad5ef	522	return( 0 );
Christopher Haster	1:24750b9ad5ef	523
Christopher Haster	1:24750b9ad5ef	524	/*
Christopher Haster	1:24750b9ad5ef	525	* opaque ProtocolName<1..2^8-1>;
Christopher Haster	1:24750b9ad5ef	526	*
Christopher Haster	1:24750b9ad5ef	527	* struct {
Christopher Haster	1:24750b9ad5ef	528	* ProtocolName protocol_name_list<2..2^16-1>
Christopher Haster	1:24750b9ad5ef	529	* } ProtocolNameList;
Christopher Haster	1:24750b9ad5ef	530	*/
Christopher Haster	1:24750b9ad5ef	531
Christopher Haster	1:24750b9ad5ef	532	/* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
Christopher Haster	1:24750b9ad5ef	533	if( len < 4 )
Christopher Haster	1:24750b9ad5ef	534	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	535
Christopher Haster	1:24750b9ad5ef	536	list_len = ( buf[0] << 8 ) \| buf[1];
Christopher Haster	1:24750b9ad5ef	537	if( list_len != len - 2 )
Christopher Haster	1:24750b9ad5ef	538	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	539
Christopher Haster	1:24750b9ad5ef	540	/*
Christopher Haster	1:24750b9ad5ef	541	* Use our order of preference
Christopher Haster	1:24750b9ad5ef	542	*/
Christopher Haster	1:24750b9ad5ef	543	start = buf + 2;
Christopher Haster	1:24750b9ad5ef	544	end = buf + len;
Christopher Haster	1:24750b9ad5ef	545	for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Christopher Haster	1:24750b9ad5ef	546	{
Christopher Haster	1:24750b9ad5ef	547	ours_len = strlen( *ours );
Christopher Haster	1:24750b9ad5ef	548	for( theirs = start; theirs != end; theirs += cur_len )
Christopher Haster	1:24750b9ad5ef	549	{
Christopher Haster	1:24750b9ad5ef	550	/* If the list is well formed, we should get equality first */
Christopher Haster	1:24750b9ad5ef	551	if( theirs > end )
Christopher Haster	1:24750b9ad5ef	552	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	553
Christopher Haster	1:24750b9ad5ef	554	cur_len = *theirs++;
Christopher Haster	1:24750b9ad5ef	555
Christopher Haster	1:24750b9ad5ef	556	/* Empty strings MUST NOT be included */
Christopher Haster	1:24750b9ad5ef	557	if( cur_len == 0 )
Christopher Haster	1:24750b9ad5ef	558	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	559
Christopher Haster	1:24750b9ad5ef	560	if( cur_len == ours_len &&
Christopher Haster	1:24750b9ad5ef	561	memcmp( theirs, *ours, cur_len ) == 0 )
Christopher Haster	1:24750b9ad5ef	562	{
Christopher Haster	1:24750b9ad5ef	563	ssl->alpn_chosen = *ours;
Christopher Haster	1:24750b9ad5ef	564	return( 0 );
Christopher Haster	1:24750b9ad5ef	565	}
Christopher Haster	1:24750b9ad5ef	566	}
Christopher Haster	1:24750b9ad5ef	567	}
Christopher Haster	1:24750b9ad5ef	568
Christopher Haster	1:24750b9ad5ef	569	/* If we get there, no match was found */
Christopher Haster	1:24750b9ad5ef	570	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	571	MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
Christopher Haster	1:24750b9ad5ef	572	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	573	}
Christopher Haster	1:24750b9ad5ef	574	#endif /* MBEDTLS_SSL_ALPN */
Christopher Haster	1:24750b9ad5ef	575
Christopher Haster	1:24750b9ad5ef	576	/*
Christopher Haster	1:24750b9ad5ef	577	* Auxiliary functions for ServerHello parsing and related actions
Christopher Haster	1:24750b9ad5ef	578	*/
Christopher Haster	1:24750b9ad5ef	579
Christopher Haster	1:24750b9ad5ef	580	#if defined(MBEDTLS_X509_CRT_PARSE_C)
Christopher Haster	1:24750b9ad5ef	581	/*
Christopher Haster	1:24750b9ad5ef	582	* Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Christopher Haster	1:24750b9ad5ef	583	*/
Christopher Haster	1:24750b9ad5ef	584	#if defined(MBEDTLS_ECDSA_C)
Christopher Haster	1:24750b9ad5ef	585	static int ssl_check_key_curve( mbedtls_pk_context *pk,
Christopher Haster	1:24750b9ad5ef	586	const mbedtls_ecp_curve_info **curves )
Christopher Haster	1:24750b9ad5ef	587	{
Christopher Haster	1:24750b9ad5ef	588	const mbedtls_ecp_curve_info **crv = curves;
Christopher Haster	1:24750b9ad5ef	589	mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Christopher Haster	1:24750b9ad5ef	590
Christopher Haster	1:24750b9ad5ef	591	while( *crv != NULL )
Christopher Haster	1:24750b9ad5ef	592	{
Christopher Haster	1:24750b9ad5ef	593	if( (*crv)->grp_id == grp_id )
Christopher Haster	1:24750b9ad5ef	594	return( 0 );
Christopher Haster	1:24750b9ad5ef	595	crv++;
Christopher Haster	1:24750b9ad5ef	596	}
Christopher Haster	1:24750b9ad5ef	597
Christopher Haster	1:24750b9ad5ef	598	return( -1 );
Christopher Haster	1:24750b9ad5ef	599	}
Christopher Haster	1:24750b9ad5ef	600	#endif /* MBEDTLS_ECDSA_C */
Christopher Haster	1:24750b9ad5ef	601
Christopher Haster	1:24750b9ad5ef	602	/*
Christopher Haster	1:24750b9ad5ef	603	* Try picking a certificate for this ciphersuite,
Christopher Haster	1:24750b9ad5ef	604	* return 0 on success and -1 on failure.
Christopher Haster	1:24750b9ad5ef	605	*/
Christopher Haster	1:24750b9ad5ef	606	static int ssl_pick_cert( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	607	const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
Christopher Haster	1:24750b9ad5ef	608	{
Christopher Haster	1:24750b9ad5ef	609	mbedtls_ssl_key_cert cur, list, *fallback = NULL;
Christopher Haster	1:24750b9ad5ef	610	mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Christopher Haster	1:24750b9ad5ef	611	uint32_t flags;
Christopher Haster	1:24750b9ad5ef	612
Christopher Haster	1:24750b9ad5ef	613	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Christopher Haster	1:24750b9ad5ef	614	if( ssl->handshake->sni_key_cert != NULL )
Christopher Haster	1:24750b9ad5ef	615	list = ssl->handshake->sni_key_cert;
Christopher Haster	1:24750b9ad5ef	616	else
Christopher Haster	1:24750b9ad5ef	617	#endif
Christopher Haster	1:24750b9ad5ef	618	list = ssl->conf->key_cert;
Christopher Haster	1:24750b9ad5ef	619
Christopher Haster	1:24750b9ad5ef	620	if( pk_alg == MBEDTLS_PK_NONE )
Christopher Haster	1:24750b9ad5ef	621	return( 0 );
Christopher Haster	1:24750b9ad5ef	622
Christopher Haster	1:24750b9ad5ef	623	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Christopher Haster	1:24750b9ad5ef	624
Christopher Haster	1:24750b9ad5ef	625	if( list == NULL )
Christopher Haster	1:24750b9ad5ef	626	{
Christopher Haster	1:24750b9ad5ef	627	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
Christopher Haster	1:24750b9ad5ef	628	return( -1 );
Christopher Haster	1:24750b9ad5ef	629	}
Christopher Haster	1:24750b9ad5ef	630
Christopher Haster	1:24750b9ad5ef	631	for( cur = list; cur != NULL; cur = cur->next )
Christopher Haster	1:24750b9ad5ef	632	{
Christopher Haster	1:24750b9ad5ef	633	MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
Christopher Haster	1:24750b9ad5ef	634	cur->cert );
Christopher Haster	1:24750b9ad5ef	635
Christopher Haster	1:24750b9ad5ef	636	if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
Christopher Haster	1:24750b9ad5ef	637	{
Christopher Haster	1:24750b9ad5ef	638	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Christopher Haster	1:24750b9ad5ef	639	continue;
Christopher Haster	1:24750b9ad5ef	640	}
Christopher Haster	1:24750b9ad5ef	641
Christopher Haster	1:24750b9ad5ef	642	/*
Christopher Haster	1:24750b9ad5ef	643	* This avoids sending the client a cert it'll reject based on
Christopher Haster	1:24750b9ad5ef	644	* keyUsage or other extensions.
Christopher Haster	1:24750b9ad5ef	645	*
Christopher Haster	1:24750b9ad5ef	646	* It also allows the user to provision different certificates for
Christopher Haster	1:24750b9ad5ef	647	* different uses based on keyUsage, eg if they want to avoid signing
Christopher Haster	1:24750b9ad5ef	648	* and decrypting with the same RSA key.
Christopher Haster	1:24750b9ad5ef	649	*/
Christopher Haster	1:24750b9ad5ef	650	if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Christopher Haster	1:24750b9ad5ef	651	MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Christopher Haster	1:24750b9ad5ef	652	{
Christopher Haster	1:24750b9ad5ef	653	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Christopher Haster	1:24750b9ad5ef	654	"(extended) key usage extension" ) );
Christopher Haster	1:24750b9ad5ef	655	continue;
Christopher Haster	1:24750b9ad5ef	656	}
Christopher Haster	1:24750b9ad5ef	657
Christopher Haster	1:24750b9ad5ef	658	#if defined(MBEDTLS_ECDSA_C)
Christopher Haster	1:24750b9ad5ef	659	if( pk_alg == MBEDTLS_PK_ECDSA &&
Christopher Haster	1:24750b9ad5ef	660	ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
Christopher Haster	1:24750b9ad5ef	661	{
Christopher Haster	1:24750b9ad5ef	662	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
Christopher Haster	1:24750b9ad5ef	663	continue;
Christopher Haster	1:24750b9ad5ef	664	}
Christopher Haster	1:24750b9ad5ef	665	#endif
Christopher Haster	1:24750b9ad5ef	666
Christopher Haster	1:24750b9ad5ef	667	/*
Christopher Haster	1:24750b9ad5ef	668	* Try to select a SHA-1 certificate for pre-1.2 clients, but still
Christopher Haster	1:24750b9ad5ef	669	* present them a SHA-higher cert rather than failing if it's the only
Christopher Haster	1:24750b9ad5ef	670	* one we got that satisfies the other conditions.
Christopher Haster	1:24750b9ad5ef	671	*/
Christopher Haster	1:24750b9ad5ef	672	if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
Christopher Haster	1:24750b9ad5ef	673	cur->cert->sig_md != MBEDTLS_MD_SHA1 )
Christopher Haster	1:24750b9ad5ef	674	{
Christopher Haster	1:24750b9ad5ef	675	if( fallback == NULL )
Christopher Haster	1:24750b9ad5ef	676	fallback = cur;
Christopher Haster	1:24750b9ad5ef	677	{
Christopher Haster	1:24750b9ad5ef	678	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Christopher Haster	1:24750b9ad5ef	679	"sha-2 with pre-TLS 1.2 client" ) );
Christopher Haster	1:24750b9ad5ef	680	continue;
Christopher Haster	1:24750b9ad5ef	681	}
Christopher Haster	1:24750b9ad5ef	682	}
Christopher Haster	1:24750b9ad5ef	683
Christopher Haster	1:24750b9ad5ef	684	/* If we get there, we got a winner */
Christopher Haster	1:24750b9ad5ef	685	break;
Christopher Haster	1:24750b9ad5ef	686	}
Christopher Haster	1:24750b9ad5ef	687
Christopher Haster	1:24750b9ad5ef	688	if( cur == NULL )
Christopher Haster	1:24750b9ad5ef	689	cur = fallback;
Christopher Haster	1:24750b9ad5ef	690
Christopher Haster	1:24750b9ad5ef	691	/* Do not update ssl->handshake->key_cert unless there is a match */
Christopher Haster	1:24750b9ad5ef	692	if( cur != NULL )
Christopher Haster	1:24750b9ad5ef	693	{
Christopher Haster	1:24750b9ad5ef	694	ssl->handshake->key_cert = cur;
Christopher Haster	1:24750b9ad5ef	695	MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Christopher Haster	1:24750b9ad5ef	696	ssl->handshake->key_cert->cert );
Christopher Haster	1:24750b9ad5ef	697	return( 0 );
Christopher Haster	1:24750b9ad5ef	698	}
Christopher Haster	1:24750b9ad5ef	699
Christopher Haster	1:24750b9ad5ef	700	return( -1 );
Christopher Haster	1:24750b9ad5ef	701	}
Christopher Haster	1:24750b9ad5ef	702	#endif /* MBEDTLS_X509_CRT_PARSE_C */
Christopher Haster	1:24750b9ad5ef	703
Christopher Haster	1:24750b9ad5ef	704	/*
Christopher Haster	1:24750b9ad5ef	705	* Check if a given ciphersuite is suitable for use with our config/keys/etc
Christopher Haster	1:24750b9ad5ef	706	* Sets ciphersuite_info only if the suite matches.
Christopher Haster	1:24750b9ad5ef	707	*/
Christopher Haster	1:24750b9ad5ef	708	static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
Christopher Haster	1:24750b9ad5ef	709	const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
Christopher Haster	1:24750b9ad5ef	710	{
Christopher Haster	1:24750b9ad5ef	711	const mbedtls_ssl_ciphersuite_t *suite_info;
Christopher Haster	1:24750b9ad5ef	712
Christopher Haster	1:24750b9ad5ef	713	suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Christopher Haster	1:24750b9ad5ef	714	if( suite_info == NULL )
Christopher Haster	1:24750b9ad5ef	715	{
Christopher Haster	1:24750b9ad5ef	716	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	717	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	718	}
Christopher Haster	1:24750b9ad5ef	719
Christopher Haster	1:24750b9ad5ef	720	MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
Christopher Haster	1:24750b9ad5ef	721
Christopher Haster	1:24750b9ad5ef	722	if( suite_info->min_minor_ver > ssl->minor_ver \|\|
Christopher Haster	1:24750b9ad5ef	723	suite_info->max_minor_ver < ssl->minor_ver )
Christopher Haster	1:24750b9ad5ef	724	{
Christopher Haster	1:24750b9ad5ef	725	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Christopher Haster	1:24750b9ad5ef	726	return( 0 );
Christopher Haster	1:24750b9ad5ef	727	}
Christopher Haster	1:24750b9ad5ef	728
Christopher Haster	1:24750b9ad5ef	729	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	730	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Christopher Haster	1:24750b9ad5ef	731	( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
Christopher Haster	1:24750b9ad5ef	732	return( 0 );
Christopher Haster	1:24750b9ad5ef	733	#endif
Christopher Haster	1:24750b9ad5ef	734
Christopher Haster	1:24750b9ad5ef	735	#if defined(MBEDTLS_ARC4_C)
Christopher Haster	1:24750b9ad5ef	736	if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
Christopher Haster	1:24750b9ad5ef	737	suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Christopher Haster	1:24750b9ad5ef	738	{
Christopher Haster	1:24750b9ad5ef	739	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
Christopher Haster	1:24750b9ad5ef	740	return( 0 );
Christopher Haster	1:24750b9ad5ef	741	}
Christopher Haster	1:24750b9ad5ef	742	#endif
Christopher Haster	1:24750b9ad5ef	743
Christopher Haster	1:24750b9ad5ef	744	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	745	if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
Christopher Haster	1:24750b9ad5ef	746	( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
Christopher Haster	1:24750b9ad5ef	747	{
Christopher Haster	1:24750b9ad5ef	748	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
Christopher Haster	1:24750b9ad5ef	749	"not configured or ext missing" ) );
Christopher Haster	1:24750b9ad5ef	750	return( 0 );
Christopher Haster	1:24750b9ad5ef	751	}
Christopher Haster	1:24750b9ad5ef	752	#endif
Christopher Haster	1:24750b9ad5ef	753
Christopher Haster	1:24750b9ad5ef	754
Christopher Haster	1:24750b9ad5ef	755	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C)
Christopher Haster	1:24750b9ad5ef	756	if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Christopher Haster	1:24750b9ad5ef	757	( ssl->handshake->curves == NULL \|\|
Christopher Haster	1:24750b9ad5ef	758	ssl->handshake->curves[0] == NULL ) )
Christopher Haster	1:24750b9ad5ef	759	{
Christopher Haster	1:24750b9ad5ef	760	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Christopher Haster	1:24750b9ad5ef	761	"no common elliptic curve" ) );
Christopher Haster	1:24750b9ad5ef	762	return( 0 );
Christopher Haster	1:24750b9ad5ef	763	}
Christopher Haster	1:24750b9ad5ef	764	#endif
Christopher Haster	1:24750b9ad5ef	765
Christopher Haster	1:24750b9ad5ef	766	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	767	/* If the ciphersuite requires a pre-shared key and we don't
Christopher Haster	1:24750b9ad5ef	768	* have one, skip it now rather than failing later */
Christopher Haster	1:24750b9ad5ef	769	if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Christopher Haster	1:24750b9ad5ef	770	ssl->conf->f_psk == NULL &&
Christopher Haster	1:24750b9ad5ef	771	( ssl->conf->psk == NULL \|\| ssl->conf->psk_identity == NULL \|\|
Christopher Haster	1:24750b9ad5ef	772	ssl->conf->psk_identity_len == 0 \|\| ssl->conf->psk_len == 0 ) )
Christopher Haster	1:24750b9ad5ef	773	{
Christopher Haster	1:24750b9ad5ef	774	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Christopher Haster	1:24750b9ad5ef	775	return( 0 );
Christopher Haster	1:24750b9ad5ef	776	}
Christopher Haster	1:24750b9ad5ef	777	#endif
Christopher Haster	1:24750b9ad5ef	778
Christopher Haster	1:24750b9ad5ef	779	#if defined(MBEDTLS_X509_CRT_PARSE_C)
Christopher Haster	1:24750b9ad5ef	780	/*
Christopher Haster	1:24750b9ad5ef	781	* Final check: if ciphersuite requires us to have a
Christopher Haster	1:24750b9ad5ef	782	* certificate/key of a particular type:
Christopher Haster	1:24750b9ad5ef	783	* - select the appropriate certificate if we have one, or
Christopher Haster	1:24750b9ad5ef	784	* - try the next ciphersuite if we don't
Christopher Haster	1:24750b9ad5ef	785	* This must be done last since we modify the key_cert list.
Christopher Haster	1:24750b9ad5ef	786	*/
Christopher Haster	1:24750b9ad5ef	787	if( ssl_pick_cert( ssl, suite_info ) != 0 )
Christopher Haster	1:24750b9ad5ef	788	{
Christopher Haster	1:24750b9ad5ef	789	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Christopher Haster	1:24750b9ad5ef	790	"no suitable certificate" ) );
Christopher Haster	1:24750b9ad5ef	791	return( 0 );
Christopher Haster	1:24750b9ad5ef	792	}
Christopher Haster	1:24750b9ad5ef	793	#endif
Christopher Haster	1:24750b9ad5ef	794
Christopher Haster	1:24750b9ad5ef	795	*ciphersuite_info = suite_info;
Christopher Haster	1:24750b9ad5ef	796	return( 0 );
Christopher Haster	1:24750b9ad5ef	797	}
Christopher Haster	1:24750b9ad5ef	798
Christopher Haster	1:24750b9ad5ef	799	#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
Christopher Haster	1:24750b9ad5ef	800	static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	801	{
Christopher Haster	1:24750b9ad5ef	802	int ret, got_common_suite;
Christopher Haster	1:24750b9ad5ef	803	unsigned int i, j;
Christopher Haster	1:24750b9ad5ef	804	size_t n;
Christopher Haster	1:24750b9ad5ef	805	unsigned int ciph_len, sess_len, chal_len;
Christopher Haster	1:24750b9ad5ef	806	unsigned char buf, p;
Christopher Haster	1:24750b9ad5ef	807	const int *ciphersuites;
Christopher Haster	1:24750b9ad5ef	808	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	809
Christopher Haster	1:24750b9ad5ef	810	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
Christopher Haster	1:24750b9ad5ef	811
Christopher Haster	1:24750b9ad5ef	812	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	813	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	814	{
Christopher Haster	1:24750b9ad5ef	815	MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Christopher Haster	1:24750b9ad5ef	816
Christopher Haster	1:24750b9ad5ef	817	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	818	return( ret );
Christopher Haster	1:24750b9ad5ef	819
Christopher Haster	1:24750b9ad5ef	820	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	821	}
Christopher Haster	1:24750b9ad5ef	822	#endif /* MBEDTLS_SSL_RENEGOTIATION */
Christopher Haster	1:24750b9ad5ef	823
Christopher Haster	1:24750b9ad5ef	824	buf = ssl->in_hdr;
Christopher Haster	1:24750b9ad5ef	825
Christopher Haster	1:24750b9ad5ef	826	MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
Christopher Haster	1:24750b9ad5ef	827
Christopher Haster	1:24750b9ad5ef	828	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
Christopher Haster	1:24750b9ad5ef	829	buf[2] ) );
Christopher Haster	1:24750b9ad5ef	830	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
Christopher Haster	1:24750b9ad5ef	831	( ( buf[0] & 0x7F ) << 8 ) \| buf[1] ) );
Christopher Haster	1:24750b9ad5ef	832	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
Christopher Haster	1:24750b9ad5ef	833	buf[3], buf[4] ) );
Christopher Haster	1:24750b9ad5ef	834
Christopher Haster	1:24750b9ad5ef	835	/*
Christopher Haster	1:24750b9ad5ef	836	* SSLv2 Client Hello
Christopher Haster	1:24750b9ad5ef	837	*
Christopher Haster	1:24750b9ad5ef	838	* Record layer:
Christopher Haster	1:24750b9ad5ef	839	* 0 . 1 message length
Christopher Haster	1:24750b9ad5ef	840	*
Christopher Haster	1:24750b9ad5ef	841	* SSL layer:
Christopher Haster	1:24750b9ad5ef	842	* 2 . 2 message type
Christopher Haster	1:24750b9ad5ef	843	* 3 . 4 protocol version
Christopher Haster	1:24750b9ad5ef	844	*/
Christopher Haster	1:24750b9ad5ef	845	if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO \|\|
Christopher Haster	1:24750b9ad5ef	846	buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	847	{
Christopher Haster	1:24750b9ad5ef	848	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	849	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	850	}
Christopher Haster	1:24750b9ad5ef	851
Christopher Haster	1:24750b9ad5ef	852	n = ( ( buf[0] << 8 ) \| buf[1] ) & 0x7FFF;
Christopher Haster	1:24750b9ad5ef	853
Christopher Haster	1:24750b9ad5ef	854	if( n < 17 \|\| n > 512 )
Christopher Haster	1:24750b9ad5ef	855	{
Christopher Haster	1:24750b9ad5ef	856	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	857	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	858	}
Christopher Haster	1:24750b9ad5ef	859
Christopher Haster	1:24750b9ad5ef	860	ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Christopher Haster	1:24750b9ad5ef	861	ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
Christopher Haster	1:24750b9ad5ef	862	? buf[4] : ssl->conf->max_minor_ver;
Christopher Haster	1:24750b9ad5ef	863
Christopher Haster	1:24750b9ad5ef	864	if( ssl->minor_ver < ssl->conf->min_minor_ver )
Christopher Haster	1:24750b9ad5ef	865	{
Christopher Haster	1:24750b9ad5ef	866	MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Christopher Haster	1:24750b9ad5ef	867	" [%d:%d] < [%d:%d]",
Christopher Haster	1:24750b9ad5ef	868	ssl->major_ver, ssl->minor_ver,
Christopher Haster	1:24750b9ad5ef	869	ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Christopher Haster	1:24750b9ad5ef	870
Christopher Haster	1:24750b9ad5ef	871	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	872	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Christopher Haster	1:24750b9ad5ef	873	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Christopher Haster	1:24750b9ad5ef	874	}
Christopher Haster	1:24750b9ad5ef	875
Christopher Haster	1:24750b9ad5ef	876	ssl->handshake->max_major_ver = buf[3];
Christopher Haster	1:24750b9ad5ef	877	ssl->handshake->max_minor_ver = buf[4];
Christopher Haster	1:24750b9ad5ef	878
Christopher Haster	1:24750b9ad5ef	879	if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	880	{
Christopher Haster	1:24750b9ad5ef	881	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Christopher Haster	1:24750b9ad5ef	882	return( ret );
Christopher Haster	1:24750b9ad5ef	883	}
Christopher Haster	1:24750b9ad5ef	884
Christopher Haster	1:24750b9ad5ef	885	ssl->handshake->update_checksum( ssl, buf + 2, n );
Christopher Haster	1:24750b9ad5ef	886
Christopher Haster	1:24750b9ad5ef	887	buf = ssl->in_msg;
Christopher Haster	1:24750b9ad5ef	888	n = ssl->in_left - 5;
Christopher Haster	1:24750b9ad5ef	889
Christopher Haster	1:24750b9ad5ef	890	/*
Christopher Haster	1:24750b9ad5ef	891	* 0 . 1 ciphersuitelist length
Christopher Haster	1:24750b9ad5ef	892	* 2 . 3 session id length
Christopher Haster	1:24750b9ad5ef	893	* 4 . 5 challenge length
Christopher Haster	1:24750b9ad5ef	894	* 6 . .. ciphersuitelist
Christopher Haster	1:24750b9ad5ef	895	* .. . .. session id
Christopher Haster	1:24750b9ad5ef	896	* .. . .. challenge
Christopher Haster	1:24750b9ad5ef	897	*/
Christopher Haster	1:24750b9ad5ef	898	MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
Christopher Haster	1:24750b9ad5ef	899
Christopher Haster	1:24750b9ad5ef	900	ciph_len = ( buf[0] << 8 ) \| buf[1];
Christopher Haster	1:24750b9ad5ef	901	sess_len = ( buf[2] << 8 ) \| buf[3];
Christopher Haster	1:24750b9ad5ef	902	chal_len = ( buf[4] << 8 ) \| buf[5];
Christopher Haster	1:24750b9ad5ef	903
Christopher Haster	1:24750b9ad5ef	904	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
Christopher Haster	1:24750b9ad5ef	905	ciph_len, sess_len, chal_len ) );
Christopher Haster	1:24750b9ad5ef	906
Christopher Haster	1:24750b9ad5ef	907	/*
Christopher Haster	1:24750b9ad5ef	908	* Make sure each parameter length is valid
Christopher Haster	1:24750b9ad5ef	909	*/
Christopher Haster	1:24750b9ad5ef	910	if( ciph_len < 3 \|\| ( ciph_len % 3 ) != 0 )
Christopher Haster	1:24750b9ad5ef	911	{
Christopher Haster	1:24750b9ad5ef	912	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	913	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	914	}
Christopher Haster	1:24750b9ad5ef	915
Christopher Haster	1:24750b9ad5ef	916	if( sess_len > 32 )
Christopher Haster	1:24750b9ad5ef	917	{
Christopher Haster	1:24750b9ad5ef	918	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	919	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	920	}
Christopher Haster	1:24750b9ad5ef	921
Christopher Haster	1:24750b9ad5ef	922	if( chal_len < 8 \|\| chal_len > 32 )
Christopher Haster	1:24750b9ad5ef	923	{
Christopher Haster	1:24750b9ad5ef	924	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	925	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	926	}
Christopher Haster	1:24750b9ad5ef	927
Christopher Haster	1:24750b9ad5ef	928	if( n != 6 + ciph_len + sess_len + chal_len )
Christopher Haster	1:24750b9ad5ef	929	{
Christopher Haster	1:24750b9ad5ef	930	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	931	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	932	}
Christopher Haster	1:24750b9ad5ef	933
Christopher Haster	1:24750b9ad5ef	934	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Christopher Haster	1:24750b9ad5ef	935	buf + 6, ciph_len );
Christopher Haster	1:24750b9ad5ef	936	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
Christopher Haster	1:24750b9ad5ef	937	buf + 6 + ciph_len, sess_len );
Christopher Haster	1:24750b9ad5ef	938	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
Christopher Haster	1:24750b9ad5ef	939	buf + 6 + ciph_len + sess_len, chal_len );
Christopher Haster	1:24750b9ad5ef	940
Christopher Haster	1:24750b9ad5ef	941	p = buf + 6 + ciph_len;
Christopher Haster	1:24750b9ad5ef	942	ssl->session_negotiate->id_len = sess_len;
Christopher Haster	1:24750b9ad5ef	943	memset( ssl->session_negotiate->id, 0,
Christopher Haster	1:24750b9ad5ef	944	sizeof( ssl->session_negotiate->id ) );
Christopher Haster	1:24750b9ad5ef	945	memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
Christopher Haster	1:24750b9ad5ef	946
Christopher Haster	1:24750b9ad5ef	947	p += sess_len;
Christopher Haster	1:24750b9ad5ef	948	memset( ssl->handshake->randbytes, 0, 64 );
Christopher Haster	1:24750b9ad5ef	949	memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
Christopher Haster	1:24750b9ad5ef	950
Christopher Haster	1:24750b9ad5ef	951	/*
Christopher Haster	1:24750b9ad5ef	952	* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Christopher Haster	1:24750b9ad5ef	953	*/
Christopher Haster	1:24750b9ad5ef	954	for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
Christopher Haster	1:24750b9ad5ef	955	{
Christopher Haster	1:24750b9ad5ef	956	if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Christopher Haster	1:24750b9ad5ef	957	{
Christopher Haster	1:24750b9ad5ef	958	MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
Christopher Haster	1:24750b9ad5ef	959	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	960	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Christopher Haster	1:24750b9ad5ef	961	{
Christopher Haster	1:24750b9ad5ef	962	MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Christopher Haster	1:24750b9ad5ef	963	"during renegotiation" ) );
Christopher Haster	1:24750b9ad5ef	964
Christopher Haster	1:24750b9ad5ef	965	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	966	return( ret );
Christopher Haster	1:24750b9ad5ef	967
Christopher Haster	1:24750b9ad5ef	968	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	969	}
Christopher Haster	1:24750b9ad5ef	970	#endif /* MBEDTLS_SSL_RENEGOTIATION */
Christopher Haster	1:24750b9ad5ef	971	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Christopher Haster	1:24750b9ad5ef	972	break;
Christopher Haster	1:24750b9ad5ef	973	}
Christopher Haster	1:24750b9ad5ef	974	}
Christopher Haster	1:24750b9ad5ef	975
Christopher Haster	1:24750b9ad5ef	976	#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Christopher Haster	1:24750b9ad5ef	977	for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
Christopher Haster	1:24750b9ad5ef	978	{
Christopher Haster	1:24750b9ad5ef	979	if( p[0] == 0 &&
Christopher Haster	1:24750b9ad5ef	980	p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
Christopher Haster	1:24750b9ad5ef	981	p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Christopher Haster	1:24750b9ad5ef	982	{
Christopher Haster	1:24750b9ad5ef	983	MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
Christopher Haster	1:24750b9ad5ef	984
Christopher Haster	1:24750b9ad5ef	985	if( ssl->minor_ver < ssl->conf->max_minor_ver )
Christopher Haster	1:24750b9ad5ef	986	{
Christopher Haster	1:24750b9ad5ef	987	MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Christopher Haster	1:24750b9ad5ef	988
Christopher Haster	1:24750b9ad5ef	989	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	990	MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Christopher Haster	1:24750b9ad5ef	991
Christopher Haster	1:24750b9ad5ef	992	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	993	}
Christopher Haster	1:24750b9ad5ef	994
Christopher Haster	1:24750b9ad5ef	995	break;
Christopher Haster	1:24750b9ad5ef	996	}
Christopher Haster	1:24750b9ad5ef	997	}
Christopher Haster	1:24750b9ad5ef	998	#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Christopher Haster	1:24750b9ad5ef	999
Christopher Haster	1:24750b9ad5ef	1000	got_common_suite = 0;
Christopher Haster	1:24750b9ad5ef	1001	ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Christopher Haster	1:24750b9ad5ef	1002	ciphersuite_info = NULL;
Christopher Haster	1:24750b9ad5ef	1003	#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Christopher Haster	1:24750b9ad5ef	1004	for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Christopher Haster	1:24750b9ad5ef	1005	{
Christopher Haster	1:24750b9ad5ef	1006	for( i = 0; ciphersuites[i] != 0; i++ )
Christopher Haster	1:24750b9ad5ef	1007	#else
Christopher Haster	1:24750b9ad5ef	1008	for( i = 0; ciphersuites[i] != 0; i++ )
Christopher Haster	1:24750b9ad5ef	1009	{
Christopher Haster	1:24750b9ad5ef	1010	for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Christopher Haster	1:24750b9ad5ef	1011	#endif
Christopher Haster	1:24750b9ad5ef	1012	{
Christopher Haster	1:24750b9ad5ef	1013	if( p[0] != 0 \|\|
Christopher Haster	1:24750b9ad5ef	1014	p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) \|\|
Christopher Haster	1:24750b9ad5ef	1015	p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
Christopher Haster	1:24750b9ad5ef	1016	continue;
Christopher Haster	1:24750b9ad5ef	1017
Christopher Haster	1:24750b9ad5ef	1018	got_common_suite = 1;
Christopher Haster	1:24750b9ad5ef	1019
Christopher Haster	1:24750b9ad5ef	1020	if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
Christopher Haster	1:24750b9ad5ef	1021	&ciphersuite_info ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1022	return( ret );
Christopher Haster	1:24750b9ad5ef	1023
Christopher Haster	1:24750b9ad5ef	1024	if( ciphersuite_info != NULL )
Christopher Haster	1:24750b9ad5ef	1025	goto have_ciphersuite_v2;
Christopher Haster	1:24750b9ad5ef	1026	}
Christopher Haster	1:24750b9ad5ef	1027	}
Christopher Haster	1:24750b9ad5ef	1028
Christopher Haster	1:24750b9ad5ef	1029	if( got_common_suite )
Christopher Haster	1:24750b9ad5ef	1030	{
Christopher Haster	1:24750b9ad5ef	1031	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Christopher Haster	1:24750b9ad5ef	1032	"but none of them usable" ) );
Christopher Haster	1:24750b9ad5ef	1033	return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Christopher Haster	1:24750b9ad5ef	1034	}
Christopher Haster	1:24750b9ad5ef	1035	else
Christopher Haster	1:24750b9ad5ef	1036	{
Christopher Haster	1:24750b9ad5ef	1037	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Christopher Haster	1:24750b9ad5ef	1038	return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Christopher Haster	1:24750b9ad5ef	1039	}
Christopher Haster	1:24750b9ad5ef	1040
Christopher Haster	1:24750b9ad5ef	1041	have_ciphersuite_v2:
Christopher Haster	1:24750b9ad5ef	1042	MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Christopher Haster	1:24750b9ad5ef	1043
Christopher Haster	1:24750b9ad5ef	1044	ssl->session_negotiate->ciphersuite = ciphersuites[i];
Christopher Haster	1:24750b9ad5ef	1045	ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	1046	mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Christopher Haster	1:24750b9ad5ef	1047
Christopher Haster	1:24750b9ad5ef	1048	/*
Christopher Haster	1:24750b9ad5ef	1049	* SSLv2 Client Hello relevant renegotiation security checks
Christopher Haster	1:24750b9ad5ef	1050	*/
Christopher Haster	1:24750b9ad5ef	1051	if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Christopher Haster	1:24750b9ad5ef	1052	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	1053	{
Christopher Haster	1:24750b9ad5ef	1054	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Christopher Haster	1:24750b9ad5ef	1055
Christopher Haster	1:24750b9ad5ef	1056	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1057	return( ret );
Christopher Haster	1:24750b9ad5ef	1058
Christopher Haster	1:24750b9ad5ef	1059	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1060	}
Christopher Haster	1:24750b9ad5ef	1061
Christopher Haster	1:24750b9ad5ef	1062	ssl->in_left = 0;
Christopher Haster	1:24750b9ad5ef	1063	ssl->state++;
Christopher Haster	1:24750b9ad5ef	1064
Christopher Haster	1:24750b9ad5ef	1065	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
Christopher Haster	1:24750b9ad5ef	1066
Christopher Haster	1:24750b9ad5ef	1067	return( 0 );
Christopher Haster	1:24750b9ad5ef	1068	}
Christopher Haster	1:24750b9ad5ef	1069	#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
Christopher Haster	1:24750b9ad5ef	1070
Christopher Haster	1:24750b9ad5ef	1071	static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	1072	{
Christopher Haster	1:24750b9ad5ef	1073	int ret, got_common_suite;
Christopher Haster	1:24750b9ad5ef	1074	size_t i, j;
Christopher Haster	1:24750b9ad5ef	1075	size_t ciph_offset, comp_offset, ext_offset;
Christopher Haster	1:24750b9ad5ef	1076	size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Christopher Haster	1:24750b9ad5ef	1077	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1078	size_t cookie_offset, cookie_len;
Christopher Haster	1:24750b9ad5ef	1079	#endif
Christopher Haster	1:24750b9ad5ef	1080	unsigned char buf, p, *ext;
Christopher Haster	1:24750b9ad5ef	1081	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1082	int renegotiation_info_seen = 0;
Christopher Haster	1:24750b9ad5ef	1083	#endif
Christopher Haster	1:24750b9ad5ef	1084	int handshake_failure = 0;
Christopher Haster	1:24750b9ad5ef	1085	const int *ciphersuites;
Christopher Haster	1:24750b9ad5ef	1086	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	1087	int major, minor;
Christopher Haster	1:24750b9ad5ef	1088
Christopher Haster	1:24750b9ad5ef	1089	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Christopher Haster	1:24750b9ad5ef	1090
Christopher Haster	1:24750b9ad5ef	1091	#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Christopher Haster	1:24750b9ad5ef	1092	read_record_header:
Christopher Haster	1:24750b9ad5ef	1093	#endif
Christopher Haster	1:24750b9ad5ef	1094	/*
Christopher Haster	1:24750b9ad5ef	1095	* If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Christopher Haster	1:24750b9ad5ef	1096	* otherwise read it ourselves manually in order to support SSLv2
Christopher Haster	1:24750b9ad5ef	1097	* ClientHello, which doesn't use the same record layer format.
Christopher Haster	1:24750b9ad5ef	1098	*/
Christopher Haster	1:24750b9ad5ef	1099	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1100	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	1101	#endif
Christopher Haster	1:24750b9ad5ef	1102	{
Christopher Haster	1:24750b9ad5ef	1103	if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1104	{
Christopher Haster	1:24750b9ad5ef	1105	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Christopher Haster	1:24750b9ad5ef	1106	return( ret );
Christopher Haster	1:24750b9ad5ef	1107	}
Christopher Haster	1:24750b9ad5ef	1108	}
Christopher Haster	1:24750b9ad5ef	1109
Christopher Haster	1:24750b9ad5ef	1110	buf = ssl->in_hdr;
Christopher Haster	1:24750b9ad5ef	1111
Christopher Haster	1:24750b9ad5ef	1112	#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
Christopher Haster	1:24750b9ad5ef	1113	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1114	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Christopher Haster	1:24750b9ad5ef	1115	#endif
Christopher Haster	1:24750b9ad5ef	1116	if( ( buf[0] & 0x80 ) != 0 )
Christopher Haster	1:24750b9ad5ef	1117	return ssl_parse_client_hello_v2( ssl );
Christopher Haster	1:24750b9ad5ef	1118	#endif
Christopher Haster	1:24750b9ad5ef	1119
Christopher Haster	1:24750b9ad5ef	1120	MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
Christopher Haster	1:24750b9ad5ef	1121
Christopher Haster	1:24750b9ad5ef	1122	/*
Christopher Haster	1:24750b9ad5ef	1123	* SSLv3/TLS Client Hello
Christopher Haster	1:24750b9ad5ef	1124	*
Christopher Haster	1:24750b9ad5ef	1125	* Record layer:
Christopher Haster	1:24750b9ad5ef	1126	* 0 . 0 message type
Christopher Haster	1:24750b9ad5ef	1127	* 1 . 2 protocol version
Christopher Haster	1:24750b9ad5ef	1128	* 3 . 11 DTLS: epoch + record sequence number
Christopher Haster	1:24750b9ad5ef	1129	* 3 . 4 message length
Christopher Haster	1:24750b9ad5ef	1130	*/
Christopher Haster	1:24750b9ad5ef	1131	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
Christopher Haster	1:24750b9ad5ef	1132	buf[0] ) );
Christopher Haster	1:24750b9ad5ef	1133
Christopher Haster	1:24750b9ad5ef	1134	if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	1135	{
Christopher Haster	1:24750b9ad5ef	1136	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1137	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1138	}
Christopher Haster	1:24750b9ad5ef	1139
Christopher Haster	1:24750b9ad5ef	1140	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
Christopher Haster	1:24750b9ad5ef	1141	( ssl->in_len[0] << 8 ) \| ssl->in_len[1] ) );
Christopher Haster	1:24750b9ad5ef	1142
Christopher Haster	1:24750b9ad5ef	1143	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
Christopher Haster	1:24750b9ad5ef	1144	buf[1], buf[2] ) );
Christopher Haster	1:24750b9ad5ef	1145
Christopher Haster	1:24750b9ad5ef	1146	mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Christopher Haster	1:24750b9ad5ef	1147
Christopher Haster	1:24750b9ad5ef	1148	/* According to RFC 5246 Appendix E.1, the version here is typically
Christopher Haster	1:24750b9ad5ef	1149	* "{03,00}, the lowest version number supported by the client, [or] the
Christopher Haster	1:24750b9ad5ef	1150	* value of ClientHello.client_version", so the only meaningful check here
Christopher Haster	1:24750b9ad5ef	1151	* is the major version shouldn't be less than 3 */
Christopher Haster	1:24750b9ad5ef	1152	if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	1153	{
Christopher Haster	1:24750b9ad5ef	1154	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1155	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1156	}
Christopher Haster	1:24750b9ad5ef	1157
Christopher Haster	1:24750b9ad5ef	1158	/* For DTLS if this is the initial handshake, remember the client sequence
Christopher Haster	1:24750b9ad5ef	1159	* number to use it in our next message (RFC 6347 4.2.1) */
Christopher Haster	1:24750b9ad5ef	1160	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1161	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
Christopher Haster	1:24750b9ad5ef	1162	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1163	&& ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Christopher Haster	1:24750b9ad5ef	1164	#endif
Christopher Haster	1:24750b9ad5ef	1165	)
Christopher Haster	1:24750b9ad5ef	1166	{
Christopher Haster	1:24750b9ad5ef	1167	/* Epoch should be 0 for initial handshakes */
Christopher Haster	1:24750b9ad5ef	1168	if( ssl->in_ctr[0] != 0 \|\| ssl->in_ctr[1] != 0 )
Christopher Haster	1:24750b9ad5ef	1169	{
Christopher Haster	1:24750b9ad5ef	1170	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1171	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1172	}
Christopher Haster	1:24750b9ad5ef	1173
Christopher Haster	1:24750b9ad5ef	1174	memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
Christopher Haster	1:24750b9ad5ef	1175
Christopher Haster	1:24750b9ad5ef	1176	#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Christopher Haster	1:24750b9ad5ef	1177	if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Christopher Haster	1:24750b9ad5ef	1178	{
Christopher Haster	1:24750b9ad5ef	1179	MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Christopher Haster	1:24750b9ad5ef	1180	ssl->next_record_offset = 0;
Christopher Haster	1:24750b9ad5ef	1181	ssl->in_left = 0;
Christopher Haster	1:24750b9ad5ef	1182	goto read_record_header;
Christopher Haster	1:24750b9ad5ef	1183	}
Christopher Haster	1:24750b9ad5ef	1184
Christopher Haster	1:24750b9ad5ef	1185	/* No MAC to check yet, so we can update right now */
Christopher Haster	1:24750b9ad5ef	1186	mbedtls_ssl_dtls_replay_update( ssl );
Christopher Haster	1:24750b9ad5ef	1187	#endif
Christopher Haster	1:24750b9ad5ef	1188	}
Christopher Haster	1:24750b9ad5ef	1189	#endif /* MBEDTLS_SSL_PROTO_DTLS */
Christopher Haster	1:24750b9ad5ef	1190
Christopher Haster	1:24750b9ad5ef	1191	msg_len = ( ssl->in_len[0] << 8 ) \| ssl->in_len[1];
Christopher Haster	1:24750b9ad5ef	1192
Christopher Haster	1:24750b9ad5ef	1193	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1194	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	1195	{
Christopher Haster	1:24750b9ad5ef	1196	/* Set by mbedtls_ssl_read_record() */
Christopher Haster	1:24750b9ad5ef	1197	msg_len = ssl->in_hslen;
Christopher Haster	1:24750b9ad5ef	1198	}
Christopher Haster	1:24750b9ad5ef	1199	else
Christopher Haster	1:24750b9ad5ef	1200	#endif
Christopher Haster	1:24750b9ad5ef	1201	{
Christopher Haster	1:24750b9ad5ef	1202	if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
Christopher Haster	1:24750b9ad5ef	1203	{
Christopher Haster	1:24750b9ad5ef	1204	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1205	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1206	}
Christopher Haster	1:24750b9ad5ef	1207
Christopher Haster	1:24750b9ad5ef	1208	if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1209	{
Christopher Haster	1:24750b9ad5ef	1210	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Christopher Haster	1:24750b9ad5ef	1211	return( ret );
Christopher Haster	1:24750b9ad5ef	1212	}
Christopher Haster	1:24750b9ad5ef	1213
Christopher Haster	1:24750b9ad5ef	1214	/* Done reading this record, get ready for the next one */
Christopher Haster	1:24750b9ad5ef	1215	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1216	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Christopher Haster	1:24750b9ad5ef	1217	ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
Christopher Haster	1:24750b9ad5ef	1218	else
Christopher Haster	1:24750b9ad5ef	1219	#endif
Christopher Haster	1:24750b9ad5ef	1220	ssl->in_left = 0;
Christopher Haster	1:24750b9ad5ef	1221	}
Christopher Haster	1:24750b9ad5ef	1222
Christopher Haster	1:24750b9ad5ef	1223	buf = ssl->in_msg;
Christopher Haster	1:24750b9ad5ef	1224
Christopher Haster	1:24750b9ad5ef	1225	MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Christopher Haster	1:24750b9ad5ef	1226
Christopher Haster	1:24750b9ad5ef	1227	ssl->handshake->update_checksum( ssl, buf, msg_len );
Christopher Haster	1:24750b9ad5ef	1228
Christopher Haster	1:24750b9ad5ef	1229	/*
Christopher Haster	1:24750b9ad5ef	1230	* Handshake layer:
Christopher Haster	1:24750b9ad5ef	1231	* 0 . 0 handshake type
Christopher Haster	1:24750b9ad5ef	1232	* 1 . 3 handshake length
Christopher Haster	1:24750b9ad5ef	1233	* 4 . 5 DTLS only: message seqence number
Christopher Haster	1:24750b9ad5ef	1234	* 6 . 8 DTLS only: fragment offset
Christopher Haster	1:24750b9ad5ef	1235	* 9 . 11 DTLS only: fragment length
Christopher Haster	1:24750b9ad5ef	1236	*/
Christopher Haster	1:24750b9ad5ef	1237	if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Christopher Haster	1:24750b9ad5ef	1238	{
Christopher Haster	1:24750b9ad5ef	1239	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1240	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1241	}
Christopher Haster	1:24750b9ad5ef	1242
Christopher Haster	1:24750b9ad5ef	1243	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Christopher Haster	1:24750b9ad5ef	1244
Christopher Haster	1:24750b9ad5ef	1245	if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Christopher Haster	1:24750b9ad5ef	1246	{
Christopher Haster	1:24750b9ad5ef	1247	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1248	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1249	}
Christopher Haster	1:24750b9ad5ef	1250
Christopher Haster	1:24750b9ad5ef	1251	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Christopher Haster	1:24750b9ad5ef	1252	( buf[1] << 16 ) \| ( buf[2] << 8 ) \| buf[3] ) );
Christopher Haster	1:24750b9ad5ef	1253
Christopher Haster	1:24750b9ad5ef	1254	/* We don't support fragmentation of ClientHello (yet?) */
Christopher Haster	1:24750b9ad5ef	1255	if( buf[1] != 0 \|\|
Christopher Haster	1:24750b9ad5ef	1256	msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) \| buf[3] ) )
Christopher Haster	1:24750b9ad5ef	1257	{
Christopher Haster	1:24750b9ad5ef	1258	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1259	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1260	}
Christopher Haster	1:24750b9ad5ef	1261
Christopher Haster	1:24750b9ad5ef	1262	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1263	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Christopher Haster	1:24750b9ad5ef	1264	{
Christopher Haster	1:24750b9ad5ef	1265	/*
Christopher Haster	1:24750b9ad5ef	1266	* Copy the client's handshake message_seq on initial handshakes,
Christopher Haster	1:24750b9ad5ef	1267	* check sequence number on renego.
Christopher Haster	1:24750b9ad5ef	1268	*/
Christopher Haster	1:24750b9ad5ef	1269	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1270	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Christopher Haster	1:24750b9ad5ef	1271	{
Christopher Haster	1:24750b9ad5ef	1272	/* This couldn't be done in ssl_prepare_handshake_record() */
Christopher Haster	1:24750b9ad5ef	1273	unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) \|
Christopher Haster	1:24750b9ad5ef	1274	ssl->in_msg[5];
Christopher Haster	1:24750b9ad5ef	1275
Christopher Haster	1:24750b9ad5ef	1276	if( cli_msg_seq != ssl->handshake->in_msg_seq )
Christopher Haster	1:24750b9ad5ef	1277	{
Christopher Haster	1:24750b9ad5ef	1278	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Christopher Haster	1:24750b9ad5ef	1279	"%d (expected %d)", cli_msg_seq,
Christopher Haster	1:24750b9ad5ef	1280	ssl->handshake->in_msg_seq ) );
Christopher Haster	1:24750b9ad5ef	1281	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1282	}
Christopher Haster	1:24750b9ad5ef	1283
Christopher Haster	1:24750b9ad5ef	1284	ssl->handshake->in_msg_seq++;
Christopher Haster	1:24750b9ad5ef	1285	}
Christopher Haster	1:24750b9ad5ef	1286	else
Christopher Haster	1:24750b9ad5ef	1287	#endif
Christopher Haster	1:24750b9ad5ef	1288	{
Christopher Haster	1:24750b9ad5ef	1289	unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) \|
Christopher Haster	1:24750b9ad5ef	1290	ssl->in_msg[5];
Christopher Haster	1:24750b9ad5ef	1291	ssl->handshake->out_msg_seq = cli_msg_seq;
Christopher Haster	1:24750b9ad5ef	1292	ssl->handshake->in_msg_seq = cli_msg_seq + 1;
Christopher Haster	1:24750b9ad5ef	1293	}
Christopher Haster	1:24750b9ad5ef	1294
Christopher Haster	1:24750b9ad5ef	1295	/*
Christopher Haster	1:24750b9ad5ef	1296	* For now we don't support fragmentation, so make sure
Christopher Haster	1:24750b9ad5ef	1297	* fragment_offset == 0 and fragment_length == length
Christopher Haster	1:24750b9ad5ef	1298	*/
Christopher Haster	1:24750b9ad5ef	1299	if( ssl->in_msg[6] != 0 \|\| ssl->in_msg[7] != 0 \|\| ssl->in_msg[8] != 0 \|\|
Christopher Haster	1:24750b9ad5ef	1300	memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
Christopher Haster	1:24750b9ad5ef	1301	{
Christopher Haster	1:24750b9ad5ef	1302	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
Christopher Haster	1:24750b9ad5ef	1303	return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Christopher Haster	1:24750b9ad5ef	1304	}
Christopher Haster	1:24750b9ad5ef	1305	}
Christopher Haster	1:24750b9ad5ef	1306	#endif /* MBEDTLS_SSL_PROTO_DTLS */
Christopher Haster	1:24750b9ad5ef	1307
Christopher Haster	1:24750b9ad5ef	1308	buf += mbedtls_ssl_hs_hdr_len( ssl );
Christopher Haster	1:24750b9ad5ef	1309	msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Christopher Haster	1:24750b9ad5ef	1310
Christopher Haster	1:24750b9ad5ef	1311	/*
Christopher Haster	1:24750b9ad5ef	1312	* ClientHello layer:
Christopher Haster	1:24750b9ad5ef	1313	* 0 . 1 protocol version
Christopher Haster	1:24750b9ad5ef	1314	* 2 . 33 random bytes (starting with 4 bytes of Unix time)
Christopher Haster	1:24750b9ad5ef	1315	* 34 . 35 session id length (1 byte)
Christopher Haster	1:24750b9ad5ef	1316	* 35 . 34+x session id
Christopher Haster	1:24750b9ad5ef	1317	* 35+x . 35+x DTLS only: cookie length (1 byte)
Christopher Haster	1:24750b9ad5ef	1318	* 36+x . .. DTLS only: cookie
Christopher Haster	1:24750b9ad5ef	1319	* .. . .. ciphersuite list length (2 bytes)
Christopher Haster	1:24750b9ad5ef	1320	* .. . .. ciphersuite list
Christopher Haster	1:24750b9ad5ef	1321	* .. . .. compression alg. list length (1 byte)
Christopher Haster	1:24750b9ad5ef	1322	* .. . .. compression alg. list
Christopher Haster	1:24750b9ad5ef	1323	* .. . .. extensions length (2 bytes, optional)
Christopher Haster	1:24750b9ad5ef	1324	* .. . .. extensions (optional)
Christopher Haster	1:24750b9ad5ef	1325	*/
Christopher Haster	1:24750b9ad5ef	1326
Christopher Haster	1:24750b9ad5ef	1327	/*
Christopher Haster	1:24750b9ad5ef	1328	* Minimal length (with everything empty and extensions ommitted) is
Christopher Haster	1:24750b9ad5ef	1329	* 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
Christopher Haster	1:24750b9ad5ef	1330	* read at least up to session id length without worrying.
Christopher Haster	1:24750b9ad5ef	1331	*/
Christopher Haster	1:24750b9ad5ef	1332	if( msg_len < 38 )
Christopher Haster	1:24750b9ad5ef	1333	{
Christopher Haster	1:24750b9ad5ef	1334	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1335	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1336	}
Christopher Haster	1:24750b9ad5ef	1337
Christopher Haster	1:24750b9ad5ef	1338	/*
Christopher Haster	1:24750b9ad5ef	1339	* Check and save the protocol version
Christopher Haster	1:24750b9ad5ef	1340	*/
Christopher Haster	1:24750b9ad5ef	1341	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Christopher Haster	1:24750b9ad5ef	1342
Christopher Haster	1:24750b9ad5ef	1343	mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Christopher Haster	1:24750b9ad5ef	1344	ssl->conf->transport, buf );
Christopher Haster	1:24750b9ad5ef	1345
Christopher Haster	1:24750b9ad5ef	1346	ssl->handshake->max_major_ver = ssl->major_ver;
Christopher Haster	1:24750b9ad5ef	1347	ssl->handshake->max_minor_ver = ssl->minor_ver;
Christopher Haster	1:24750b9ad5ef	1348
Christopher Haster	1:24750b9ad5ef	1349	if( ssl->major_ver < ssl->conf->min_major_ver \|\|
Christopher Haster	1:24750b9ad5ef	1350	ssl->minor_ver < ssl->conf->min_minor_ver )
Christopher Haster	1:24750b9ad5ef	1351	{
Christopher Haster	1:24750b9ad5ef	1352	MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Christopher Haster	1:24750b9ad5ef	1353	" [%d:%d] < [%d:%d]",
Christopher Haster	1:24750b9ad5ef	1354	ssl->major_ver, ssl->minor_ver,
Christopher Haster	1:24750b9ad5ef	1355	ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Christopher Haster	1:24750b9ad5ef	1356
Christopher Haster	1:24750b9ad5ef	1357	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	1358	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Christopher Haster	1:24750b9ad5ef	1359
Christopher Haster	1:24750b9ad5ef	1360	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Christopher Haster	1:24750b9ad5ef	1361	}
Christopher Haster	1:24750b9ad5ef	1362
Christopher Haster	1:24750b9ad5ef	1363	if( ssl->major_ver > ssl->conf->max_major_ver )
Christopher Haster	1:24750b9ad5ef	1364	{
Christopher Haster	1:24750b9ad5ef	1365	ssl->major_ver = ssl->conf->max_major_ver;
Christopher Haster	1:24750b9ad5ef	1366	ssl->minor_ver = ssl->conf->max_minor_ver;
Christopher Haster	1:24750b9ad5ef	1367	}
Christopher Haster	1:24750b9ad5ef	1368	else if( ssl->minor_ver > ssl->conf->max_minor_ver )
Christopher Haster	1:24750b9ad5ef	1369	ssl->minor_ver = ssl->conf->max_minor_ver;
Christopher Haster	1:24750b9ad5ef	1370
Christopher Haster	1:24750b9ad5ef	1371	/*
Christopher Haster	1:24750b9ad5ef	1372	* Save client random (inc. Unix time)
Christopher Haster	1:24750b9ad5ef	1373	*/
Christopher Haster	1:24750b9ad5ef	1374	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Christopher Haster	1:24750b9ad5ef	1375
Christopher Haster	1:24750b9ad5ef	1376	memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Christopher Haster	1:24750b9ad5ef	1377
Christopher Haster	1:24750b9ad5ef	1378	/*
Christopher Haster	1:24750b9ad5ef	1379	* Check the session ID length and save session ID
Christopher Haster	1:24750b9ad5ef	1380	*/
Christopher Haster	1:24750b9ad5ef	1381	sess_len = buf[34];
Christopher Haster	1:24750b9ad5ef	1382
Christopher Haster	1:24750b9ad5ef	1383	if( sess_len > sizeof( ssl->session_negotiate->id ) \|\|
Christopher Haster	1:24750b9ad5ef	1384	sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Christopher Haster	1:24750b9ad5ef	1385	{
Christopher Haster	1:24750b9ad5ef	1386	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1387	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1388	}
Christopher Haster	1:24750b9ad5ef	1389
Christopher Haster	1:24750b9ad5ef	1390	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Christopher Haster	1:24750b9ad5ef	1391
Christopher Haster	1:24750b9ad5ef	1392	ssl->session_negotiate->id_len = sess_len;
Christopher Haster	1:24750b9ad5ef	1393	memset( ssl->session_negotiate->id, 0,
Christopher Haster	1:24750b9ad5ef	1394	sizeof( ssl->session_negotiate->id ) );
Christopher Haster	1:24750b9ad5ef	1395	memcpy( ssl->session_negotiate->id, buf + 35,
Christopher Haster	1:24750b9ad5ef	1396	ssl->session_negotiate->id_len );
Christopher Haster	1:24750b9ad5ef	1397
Christopher Haster	1:24750b9ad5ef	1398	/*
Christopher Haster	1:24750b9ad5ef	1399	* Check the cookie length and content
Christopher Haster	1:24750b9ad5ef	1400	*/
Christopher Haster	1:24750b9ad5ef	1401	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1402	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Christopher Haster	1:24750b9ad5ef	1403	{
Christopher Haster	1:24750b9ad5ef	1404	cookie_offset = 35 + sess_len;
Christopher Haster	1:24750b9ad5ef	1405	cookie_len = buf[cookie_offset];
Christopher Haster	1:24750b9ad5ef	1406
Christopher Haster	1:24750b9ad5ef	1407	if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Christopher Haster	1:24750b9ad5ef	1408	{
Christopher Haster	1:24750b9ad5ef	1409	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1410	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1411	}
Christopher Haster	1:24750b9ad5ef	1412
Christopher Haster	1:24750b9ad5ef	1413	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Christopher Haster	1:24750b9ad5ef	1414	buf + cookie_offset + 1, cookie_len );
Christopher Haster	1:24750b9ad5ef	1415
Christopher Haster	1:24750b9ad5ef	1416	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Christopher Haster	1:24750b9ad5ef	1417	if( ssl->conf->f_cookie_check != NULL
Christopher Haster	1:24750b9ad5ef	1418	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1419	&& ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Christopher Haster	1:24750b9ad5ef	1420	#endif
Christopher Haster	1:24750b9ad5ef	1421	)
Christopher Haster	1:24750b9ad5ef	1422	{
Christopher Haster	1:24750b9ad5ef	1423	if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Christopher Haster	1:24750b9ad5ef	1424	buf + cookie_offset + 1, cookie_len,
Christopher Haster	1:24750b9ad5ef	1425	ssl->cli_id, ssl->cli_id_len ) != 0 )
Christopher Haster	1:24750b9ad5ef	1426	{
Christopher Haster	1:24750b9ad5ef	1427	MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Christopher Haster	1:24750b9ad5ef	1428	ssl->handshake->verify_cookie_len = 1;
Christopher Haster	1:24750b9ad5ef	1429	}
Christopher Haster	1:24750b9ad5ef	1430	else
Christopher Haster	1:24750b9ad5ef	1431	{
Christopher Haster	1:24750b9ad5ef	1432	MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Christopher Haster	1:24750b9ad5ef	1433	ssl->handshake->verify_cookie_len = 0;
Christopher Haster	1:24750b9ad5ef	1434	}
Christopher Haster	1:24750b9ad5ef	1435	}
Christopher Haster	1:24750b9ad5ef	1436	else
Christopher Haster	1:24750b9ad5ef	1437	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Christopher Haster	1:24750b9ad5ef	1438	{
Christopher Haster	1:24750b9ad5ef	1439	/* We know we didn't send a cookie, so it should be empty */
Christopher Haster	1:24750b9ad5ef	1440	if( cookie_len != 0 )
Christopher Haster	1:24750b9ad5ef	1441	{
Christopher Haster	1:24750b9ad5ef	1442	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1443	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1444	}
Christopher Haster	1:24750b9ad5ef	1445
Christopher Haster	1:24750b9ad5ef	1446	MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Christopher Haster	1:24750b9ad5ef	1447	}
Christopher Haster	1:24750b9ad5ef	1448
Christopher Haster	1:24750b9ad5ef	1449	/*
Christopher Haster	1:24750b9ad5ef	1450	* Check the ciphersuitelist length (will be parsed later)
Christopher Haster	1:24750b9ad5ef	1451	*/
Christopher Haster	1:24750b9ad5ef	1452	ciph_offset = cookie_offset + 1 + cookie_len;
Christopher Haster	1:24750b9ad5ef	1453	}
Christopher Haster	1:24750b9ad5ef	1454	else
Christopher Haster	1:24750b9ad5ef	1455	#endif /* MBEDTLS_SSL_PROTO_DTLS */
Christopher Haster	1:24750b9ad5ef	1456	ciph_offset = 35 + sess_len;
Christopher Haster	1:24750b9ad5ef	1457
Christopher Haster	1:24750b9ad5ef	1458	ciph_len = ( buf[ciph_offset + 0] << 8 )
Christopher Haster	1:24750b9ad5ef	1459	\| ( buf[ciph_offset + 1] );
Christopher Haster	1:24750b9ad5ef	1460
Christopher Haster	1:24750b9ad5ef	1461	if( ciph_len < 2 \|\|
Christopher Haster	1:24750b9ad5ef	1462	ciph_len + 2 + ciph_offset + 1 > msg_len \|\| /* 1 for comp. alg. len */
Christopher Haster	1:24750b9ad5ef	1463	( ciph_len % 2 ) != 0 )
Christopher Haster	1:24750b9ad5ef	1464	{
Christopher Haster	1:24750b9ad5ef	1465	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1466	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1467	}
Christopher Haster	1:24750b9ad5ef	1468
Christopher Haster	1:24750b9ad5ef	1469	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Christopher Haster	1:24750b9ad5ef	1470	buf + ciph_offset + 2, ciph_len );
Christopher Haster	1:24750b9ad5ef	1471
Christopher Haster	1:24750b9ad5ef	1472	/*
Christopher Haster	1:24750b9ad5ef	1473	* Check the compression algorithms length and pick one
Christopher Haster	1:24750b9ad5ef	1474	*/
Christopher Haster	1:24750b9ad5ef	1475	comp_offset = ciph_offset + 2 + ciph_len;
Christopher Haster	1:24750b9ad5ef	1476
Christopher Haster	1:24750b9ad5ef	1477	comp_len = buf[comp_offset];
Christopher Haster	1:24750b9ad5ef	1478
Christopher Haster	1:24750b9ad5ef	1479	if( comp_len < 1 \|\|
Christopher Haster	1:24750b9ad5ef	1480	comp_len > 16 \|\|
Christopher Haster	1:24750b9ad5ef	1481	comp_len + comp_offset + 1 > msg_len )
Christopher Haster	1:24750b9ad5ef	1482	{
Christopher Haster	1:24750b9ad5ef	1483	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1484	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1485	}
Christopher Haster	1:24750b9ad5ef	1486
Christopher Haster	1:24750b9ad5ef	1487	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Christopher Haster	1:24750b9ad5ef	1488	buf + comp_offset + 1, comp_len );
Christopher Haster	1:24750b9ad5ef	1489
Christopher Haster	1:24750b9ad5ef	1490	ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Christopher Haster	1:24750b9ad5ef	1491	#if defined(MBEDTLS_ZLIB_SUPPORT)
Christopher Haster	1:24750b9ad5ef	1492	for( i = 0; i < comp_len; ++i )
Christopher Haster	1:24750b9ad5ef	1493	{
Christopher Haster	1:24750b9ad5ef	1494	if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
Christopher Haster	1:24750b9ad5ef	1495	{
Christopher Haster	1:24750b9ad5ef	1496	ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
Christopher Haster	1:24750b9ad5ef	1497	break;
Christopher Haster	1:24750b9ad5ef	1498	}
Christopher Haster	1:24750b9ad5ef	1499	}
Christopher Haster	1:24750b9ad5ef	1500	#endif
Christopher Haster	1:24750b9ad5ef	1501
Christopher Haster	1:24750b9ad5ef	1502	/* See comments in ssl_write_client_hello() */
Christopher Haster	1:24750b9ad5ef	1503	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1504	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Christopher Haster	1:24750b9ad5ef	1505	ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Christopher Haster	1:24750b9ad5ef	1506	#endif
Christopher Haster	1:24750b9ad5ef	1507
Christopher Haster	1:24750b9ad5ef	1508	/*
Christopher Haster	1:24750b9ad5ef	1509	* Check the extension length
Christopher Haster	1:24750b9ad5ef	1510	*/
Christopher Haster	1:24750b9ad5ef	1511	ext_offset = comp_offset + 1 + comp_len;
Christopher Haster	1:24750b9ad5ef	1512	if( msg_len > ext_offset )
Christopher Haster	1:24750b9ad5ef	1513	{
Christopher Haster	1:24750b9ad5ef	1514	if( msg_len < ext_offset + 2 )
Christopher Haster	1:24750b9ad5ef	1515	{
Christopher Haster	1:24750b9ad5ef	1516	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1517	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1518	}
Christopher Haster	1:24750b9ad5ef	1519
Christopher Haster	1:24750b9ad5ef	1520	ext_len = ( buf[ext_offset + 0] << 8 )
Christopher Haster	1:24750b9ad5ef	1521	\| ( buf[ext_offset + 1] );
Christopher Haster	1:24750b9ad5ef	1522
Christopher Haster	1:24750b9ad5ef	1523	if( ( ext_len > 0 && ext_len < 4 ) \|\|
Christopher Haster	1:24750b9ad5ef	1524	msg_len != ext_offset + 2 + ext_len )
Christopher Haster	1:24750b9ad5ef	1525	{
Christopher Haster	1:24750b9ad5ef	1526	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1527	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1528	}
Christopher Haster	1:24750b9ad5ef	1529	}
Christopher Haster	1:24750b9ad5ef	1530	else
Christopher Haster	1:24750b9ad5ef	1531	ext_len = 0;
Christopher Haster	1:24750b9ad5ef	1532
Christopher Haster	1:24750b9ad5ef	1533	ext = buf + ext_offset + 2;
Christopher Haster	1:24750b9ad5ef	1534	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Christopher Haster	1:24750b9ad5ef	1535
Christopher Haster	1:24750b9ad5ef	1536	while( ext_len != 0 )
Christopher Haster	1:24750b9ad5ef	1537	{
Christopher Haster	1:24750b9ad5ef	1538	unsigned int ext_id = ( ( ext[0] << 8 )
Christopher Haster	1:24750b9ad5ef	1539	\| ( ext[1] ) );
Christopher Haster	1:24750b9ad5ef	1540	unsigned int ext_size = ( ( ext[2] << 8 )
Christopher Haster	1:24750b9ad5ef	1541	\| ( ext[3] ) );
Christopher Haster	1:24750b9ad5ef	1542
Christopher Haster	1:24750b9ad5ef	1543	if( ext_size + 4 > ext_len )
Christopher Haster	1:24750b9ad5ef	1544	{
Christopher Haster	1:24750b9ad5ef	1545	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1546	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1547	}
Christopher Haster	1:24750b9ad5ef	1548	switch( ext_id )
Christopher Haster	1:24750b9ad5ef	1549	{
Christopher Haster	1:24750b9ad5ef	1550	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Christopher Haster	1:24750b9ad5ef	1551	case MBEDTLS_TLS_EXT_SERVERNAME:
Christopher Haster	1:24750b9ad5ef	1552	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
Christopher Haster	1:24750b9ad5ef	1553	if( ssl->conf->f_sni == NULL )
Christopher Haster	1:24750b9ad5ef	1554	break;
Christopher Haster	1:24750b9ad5ef	1555
Christopher Haster	1:24750b9ad5ef	1556	ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1557	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1558	return( ret );
Christopher Haster	1:24750b9ad5ef	1559	break;
Christopher Haster	1:24750b9ad5ef	1560	#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Christopher Haster	1:24750b9ad5ef	1561
Christopher Haster	1:24750b9ad5ef	1562	case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
Christopher Haster	1:24750b9ad5ef	1563	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
Christopher Haster	1:24750b9ad5ef	1564	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1565	renegotiation_info_seen = 1;
Christopher Haster	1:24750b9ad5ef	1566	#endif
Christopher Haster	1:24750b9ad5ef	1567
Christopher Haster	1:24750b9ad5ef	1568	ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1569	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1570	return( ret );
Christopher Haster	1:24750b9ad5ef	1571	break;
Christopher Haster	1:24750b9ad5ef	1572
Christopher Haster	1:24750b9ad5ef	1573	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Christopher Haster	1:24750b9ad5ef	1574	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Christopher Haster	1:24750b9ad5ef	1575	case MBEDTLS_TLS_EXT_SIG_ALG:
Christopher Haster	1:24750b9ad5ef	1576	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
Christopher Haster	1:24750b9ad5ef	1577	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1578	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Christopher Haster	1:24750b9ad5ef	1579	break;
Christopher Haster	1:24750b9ad5ef	1580	#endif
Christopher Haster	1:24750b9ad5ef	1581
Christopher Haster	1:24750b9ad5ef	1582	ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1583	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1584	return( ret );
Christopher Haster	1:24750b9ad5ef	1585	break;
Christopher Haster	1:24750b9ad5ef	1586	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
Christopher Haster	1:24750b9ad5ef	1587	MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Christopher Haster	1:24750b9ad5ef	1588
Christopher Haster	1:24750b9ad5ef	1589	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
Christopher Haster	1:24750b9ad5ef	1590	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	1591	case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
Christopher Haster	1:24750b9ad5ef	1592	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Christopher Haster	1:24750b9ad5ef	1593
Christopher Haster	1:24750b9ad5ef	1594	ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1595	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1596	return( ret );
Christopher Haster	1:24750b9ad5ef	1597	break;
Christopher Haster	1:24750b9ad5ef	1598
Christopher Haster	1:24750b9ad5ef	1599	case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
Christopher Haster	1:24750b9ad5ef	1600	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
Christopher Haster	1:24750b9ad5ef	1601	ssl->handshake->cli_exts \|= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Christopher Haster	1:24750b9ad5ef	1602
Christopher Haster	1:24750b9ad5ef	1603	ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1604	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1605	return( ret );
Christopher Haster	1:24750b9ad5ef	1606	break;
Christopher Haster	1:24750b9ad5ef	1607	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
Christopher Haster	1:24750b9ad5ef	1608	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	1609
Christopher Haster	1:24750b9ad5ef	1610	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	1611	case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
Christopher Haster	1:24750b9ad5ef	1612	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
Christopher Haster	1:24750b9ad5ef	1613
Christopher Haster	1:24750b9ad5ef	1614	ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1615	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1616	return( ret );
Christopher Haster	1:24750b9ad5ef	1617	break;
Christopher Haster	1:24750b9ad5ef	1618	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	1619
Christopher Haster	1:24750b9ad5ef	1620	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Christopher Haster	1:24750b9ad5ef	1621	case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
Christopher Haster	1:24750b9ad5ef	1622	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Christopher Haster	1:24750b9ad5ef	1623
Christopher Haster	1:24750b9ad5ef	1624	ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1625	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1626	return( ret );
Christopher Haster	1:24750b9ad5ef	1627	break;
Christopher Haster	1:24750b9ad5ef	1628	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Christopher Haster	1:24750b9ad5ef	1629
Christopher Haster	1:24750b9ad5ef	1630	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Christopher Haster	1:24750b9ad5ef	1631	case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
Christopher Haster	1:24750b9ad5ef	1632	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
Christopher Haster	1:24750b9ad5ef	1633
Christopher Haster	1:24750b9ad5ef	1634	ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1635	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1636	return( ret );
Christopher Haster	1:24750b9ad5ef	1637	break;
Christopher Haster	1:24750b9ad5ef	1638	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Christopher Haster	1:24750b9ad5ef	1639
Christopher Haster	1:24750b9ad5ef	1640	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Christopher Haster	1:24750b9ad5ef	1641	case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
Christopher Haster	1:24750b9ad5ef	1642	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Christopher Haster	1:24750b9ad5ef	1643
Christopher Haster	1:24750b9ad5ef	1644	ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1645	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1646	return( ret );
Christopher Haster	1:24750b9ad5ef	1647	break;
Christopher Haster	1:24750b9ad5ef	1648	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Christopher Haster	1:24750b9ad5ef	1649
Christopher Haster	1:24750b9ad5ef	1650	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Christopher Haster	1:24750b9ad5ef	1651	case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
Christopher Haster	1:24750b9ad5ef	1652	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Christopher Haster	1:24750b9ad5ef	1653
Christopher Haster	1:24750b9ad5ef	1654	ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1655	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1656	return( ret );
Christopher Haster	1:24750b9ad5ef	1657	break;
Christopher Haster	1:24750b9ad5ef	1658	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Christopher Haster	1:24750b9ad5ef	1659
Christopher Haster	1:24750b9ad5ef	1660	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	1661	case MBEDTLS_TLS_EXT_SESSION_TICKET:
Christopher Haster	1:24750b9ad5ef	1662	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Christopher Haster	1:24750b9ad5ef	1663
Christopher Haster	1:24750b9ad5ef	1664	ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1665	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1666	return( ret );
Christopher Haster	1:24750b9ad5ef	1667	break;
Christopher Haster	1:24750b9ad5ef	1668	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Christopher Haster	1:24750b9ad5ef	1669
Christopher Haster	1:24750b9ad5ef	1670	#if defined(MBEDTLS_SSL_ALPN)
Christopher Haster	1:24750b9ad5ef	1671	case MBEDTLS_TLS_EXT_ALPN:
Christopher Haster	1:24750b9ad5ef	1672	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Christopher Haster	1:24750b9ad5ef	1673
Christopher Haster	1:24750b9ad5ef	1674	ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
Christopher Haster	1:24750b9ad5ef	1675	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	1676	return( ret );
Christopher Haster	1:24750b9ad5ef	1677	break;
Christopher Haster	1:24750b9ad5ef	1678	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Christopher Haster	1:24750b9ad5ef	1679
Christopher Haster	1:24750b9ad5ef	1680	default:
Christopher Haster	1:24750b9ad5ef	1681	MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
Christopher Haster	1:24750b9ad5ef	1682	ext_id ) );
Christopher Haster	1:24750b9ad5ef	1683	}
Christopher Haster	1:24750b9ad5ef	1684
Christopher Haster	1:24750b9ad5ef	1685	ext_len -= 4 + ext_size;
Christopher Haster	1:24750b9ad5ef	1686	ext += 4 + ext_size;
Christopher Haster	1:24750b9ad5ef	1687
Christopher Haster	1:24750b9ad5ef	1688	if( ext_len > 0 && ext_len < 4 )
Christopher Haster	1:24750b9ad5ef	1689	{
Christopher Haster	1:24750b9ad5ef	1690	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Christopher Haster	1:24750b9ad5ef	1691	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1692	}
Christopher Haster	1:24750b9ad5ef	1693	}
Christopher Haster	1:24750b9ad5ef	1694
Christopher Haster	1:24750b9ad5ef	1695	#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Christopher Haster	1:24750b9ad5ef	1696	for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
Christopher Haster	1:24750b9ad5ef	1697	{
Christopher Haster	1:24750b9ad5ef	1698	if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
Christopher Haster	1:24750b9ad5ef	1699	p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Christopher Haster	1:24750b9ad5ef	1700	{
Christopher Haster	1:24750b9ad5ef	1701	MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
Christopher Haster	1:24750b9ad5ef	1702
Christopher Haster	1:24750b9ad5ef	1703	if( ssl->minor_ver < ssl->conf->max_minor_ver )
Christopher Haster	1:24750b9ad5ef	1704	{
Christopher Haster	1:24750b9ad5ef	1705	MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Christopher Haster	1:24750b9ad5ef	1706
Christopher Haster	1:24750b9ad5ef	1707	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	1708	MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Christopher Haster	1:24750b9ad5ef	1709
Christopher Haster	1:24750b9ad5ef	1710	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1711	}
Christopher Haster	1:24750b9ad5ef	1712
Christopher Haster	1:24750b9ad5ef	1713	break;
Christopher Haster	1:24750b9ad5ef	1714	}
Christopher Haster	1:24750b9ad5ef	1715	}
Christopher Haster	1:24750b9ad5ef	1716	#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Christopher Haster	1:24750b9ad5ef	1717
Christopher Haster	1:24750b9ad5ef	1718	/*
Christopher Haster	1:24750b9ad5ef	1719	* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Christopher Haster	1:24750b9ad5ef	1720	*/
Christopher Haster	1:24750b9ad5ef	1721	for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
Christopher Haster	1:24750b9ad5ef	1722	{
Christopher Haster	1:24750b9ad5ef	1723	if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Christopher Haster	1:24750b9ad5ef	1724	{
Christopher Haster	1:24750b9ad5ef	1725	MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
Christopher Haster	1:24750b9ad5ef	1726	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1727	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Christopher Haster	1:24750b9ad5ef	1728	{
Christopher Haster	1:24750b9ad5ef	1729	MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
Christopher Haster	1:24750b9ad5ef	1730
Christopher Haster	1:24750b9ad5ef	1731	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1732	return( ret );
Christopher Haster	1:24750b9ad5ef	1733
Christopher Haster	1:24750b9ad5ef	1734	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1735	}
Christopher Haster	1:24750b9ad5ef	1736	#endif
Christopher Haster	1:24750b9ad5ef	1737	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Christopher Haster	1:24750b9ad5ef	1738	break;
Christopher Haster	1:24750b9ad5ef	1739	}
Christopher Haster	1:24750b9ad5ef	1740	}
Christopher Haster	1:24750b9ad5ef	1741
Christopher Haster	1:24750b9ad5ef	1742	/*
Christopher Haster	1:24750b9ad5ef	1743	* Renegotiation security checks
Christopher Haster	1:24750b9ad5ef	1744	*/
Christopher Haster	1:24750b9ad5ef	1745	if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Christopher Haster	1:24750b9ad5ef	1746	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	1747	{
Christopher Haster	1:24750b9ad5ef	1748	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Christopher Haster	1:24750b9ad5ef	1749	handshake_failure = 1;
Christopher Haster	1:24750b9ad5ef	1750	}
Christopher Haster	1:24750b9ad5ef	1751	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1752	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
Christopher Haster	1:24750b9ad5ef	1753	ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Christopher Haster	1:24750b9ad5ef	1754	renegotiation_info_seen == 0 )
Christopher Haster	1:24750b9ad5ef	1755	{
Christopher Haster	1:24750b9ad5ef	1756	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Christopher Haster	1:24750b9ad5ef	1757	handshake_failure = 1;
Christopher Haster	1:24750b9ad5ef	1758	}
Christopher Haster	1:24750b9ad5ef	1759	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
Christopher Haster	1:24750b9ad5ef	1760	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Christopher Haster	1:24750b9ad5ef	1761	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Christopher Haster	1:24750b9ad5ef	1762	{
Christopher Haster	1:24750b9ad5ef	1763	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Christopher Haster	1:24750b9ad5ef	1764	handshake_failure = 1;
Christopher Haster	1:24750b9ad5ef	1765	}
Christopher Haster	1:24750b9ad5ef	1766	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
Christopher Haster	1:24750b9ad5ef	1767	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Christopher Haster	1:24750b9ad5ef	1768	renegotiation_info_seen == 1 )
Christopher Haster	1:24750b9ad5ef	1769	{
Christopher Haster	1:24750b9ad5ef	1770	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Christopher Haster	1:24750b9ad5ef	1771	handshake_failure = 1;
Christopher Haster	1:24750b9ad5ef	1772	}
Christopher Haster	1:24750b9ad5ef	1773	#endif /* MBEDTLS_SSL_RENEGOTIATION */
Christopher Haster	1:24750b9ad5ef	1774
Christopher Haster	1:24750b9ad5ef	1775	if( handshake_failure == 1 )
Christopher Haster	1:24750b9ad5ef	1776	{
Christopher Haster	1:24750b9ad5ef	1777	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1778	return( ret );
Christopher Haster	1:24750b9ad5ef	1779
Christopher Haster	1:24750b9ad5ef	1780	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Christopher Haster	1:24750b9ad5ef	1781	}
Christopher Haster	1:24750b9ad5ef	1782
Christopher Haster	1:24750b9ad5ef	1783	/*
Christopher Haster	1:24750b9ad5ef	1784	* Search for a matching ciphersuite
Christopher Haster	1:24750b9ad5ef	1785	* (At the end because we need information from the EC-based extensions
Christopher Haster	1:24750b9ad5ef	1786	* and certificate from the SNI callback triggered by the SNI extension.)
Christopher Haster	1:24750b9ad5ef	1787	*/
Christopher Haster	1:24750b9ad5ef	1788	got_common_suite = 0;
Christopher Haster	1:24750b9ad5ef	1789	ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Christopher Haster	1:24750b9ad5ef	1790	ciphersuite_info = NULL;
Christopher Haster	1:24750b9ad5ef	1791	#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Christopher Haster	1:24750b9ad5ef	1792	for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Christopher Haster	1:24750b9ad5ef	1793	{
Christopher Haster	1:24750b9ad5ef	1794	for( i = 0; ciphersuites[i] != 0; i++ )
Christopher Haster	1:24750b9ad5ef	1795	#else
Christopher Haster	1:24750b9ad5ef	1796	for( i = 0; ciphersuites[i] != 0; i++ )
Christopher Haster	1:24750b9ad5ef	1797	{
Christopher Haster	1:24750b9ad5ef	1798	for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Christopher Haster	1:24750b9ad5ef	1799	#endif
Christopher Haster	1:24750b9ad5ef	1800	{
Christopher Haster	1:24750b9ad5ef	1801	if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) \|\|
Christopher Haster	1:24750b9ad5ef	1802	p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
Christopher Haster	1:24750b9ad5ef	1803	continue;
Christopher Haster	1:24750b9ad5ef	1804
Christopher Haster	1:24750b9ad5ef	1805	got_common_suite = 1;
Christopher Haster	1:24750b9ad5ef	1806
Christopher Haster	1:24750b9ad5ef	1807	if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
Christopher Haster	1:24750b9ad5ef	1808	&ciphersuite_info ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	1809	return( ret );
Christopher Haster	1:24750b9ad5ef	1810
Christopher Haster	1:24750b9ad5ef	1811	if( ciphersuite_info != NULL )
Christopher Haster	1:24750b9ad5ef	1812	goto have_ciphersuite;
Christopher Haster	1:24750b9ad5ef	1813	}
Christopher Haster	1:24750b9ad5ef	1814	}
Christopher Haster	1:24750b9ad5ef	1815
Christopher Haster	1:24750b9ad5ef	1816	if( got_common_suite )
Christopher Haster	1:24750b9ad5ef	1817	{
Christopher Haster	1:24750b9ad5ef	1818	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Christopher Haster	1:24750b9ad5ef	1819	"but none of them usable" ) );
Christopher Haster	1:24750b9ad5ef	1820	mbedtls_ssl_send_fatal_handshake_failure( ssl );
Christopher Haster	1:24750b9ad5ef	1821	return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Christopher Haster	1:24750b9ad5ef	1822	}
Christopher Haster	1:24750b9ad5ef	1823	else
Christopher Haster	1:24750b9ad5ef	1824	{
Christopher Haster	1:24750b9ad5ef	1825	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Christopher Haster	1:24750b9ad5ef	1826	mbedtls_ssl_send_fatal_handshake_failure( ssl );
Christopher Haster	1:24750b9ad5ef	1827	return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Christopher Haster	1:24750b9ad5ef	1828	}
Christopher Haster	1:24750b9ad5ef	1829
Christopher Haster	1:24750b9ad5ef	1830	have_ciphersuite:
Christopher Haster	1:24750b9ad5ef	1831	MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Christopher Haster	1:24750b9ad5ef	1832
Christopher Haster	1:24750b9ad5ef	1833	ssl->session_negotiate->ciphersuite = ciphersuites[i];
Christopher Haster	1:24750b9ad5ef	1834	ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	1835	mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Christopher Haster	1:24750b9ad5ef	1836
Christopher Haster	1:24750b9ad5ef	1837	ssl->state++;
Christopher Haster	1:24750b9ad5ef	1838
Christopher Haster	1:24750b9ad5ef	1839	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	1840	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Christopher Haster	1:24750b9ad5ef	1841	mbedtls_ssl_recv_flight_completed( ssl );
Christopher Haster	1:24750b9ad5ef	1842	#endif
Christopher Haster	1:24750b9ad5ef	1843
Christopher Haster	1:24750b9ad5ef	1844	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Christopher Haster	1:24750b9ad5ef	1845
Christopher Haster	1:24750b9ad5ef	1846	return( 0 );
Christopher Haster	1:24750b9ad5ef	1847	}
Christopher Haster	1:24750b9ad5ef	1848
Christopher Haster	1:24750b9ad5ef	1849	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Christopher Haster	1:24750b9ad5ef	1850	static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	1851	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	1852	size_t *olen )
Christopher Haster	1:24750b9ad5ef	1853	{
Christopher Haster	1:24750b9ad5ef	1854	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	1855
Christopher Haster	1:24750b9ad5ef	1856	if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Christopher Haster	1:24750b9ad5ef	1857	{
Christopher Haster	1:24750b9ad5ef	1858	*olen = 0;
Christopher Haster	1:24750b9ad5ef	1859	return;
Christopher Haster	1:24750b9ad5ef	1860	}
Christopher Haster	1:24750b9ad5ef	1861
Christopher Haster	1:24750b9ad5ef	1862	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
Christopher Haster	1:24750b9ad5ef	1863
Christopher Haster	1:24750b9ad5ef	1864	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1865	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1866
Christopher Haster	1:24750b9ad5ef	1867	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1868	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1869
Christopher Haster	1:24750b9ad5ef	1870	*olen = 4;
Christopher Haster	1:24750b9ad5ef	1871	}
Christopher Haster	1:24750b9ad5ef	1872	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Christopher Haster	1:24750b9ad5ef	1873
Christopher Haster	1:24750b9ad5ef	1874	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Christopher Haster	1:24750b9ad5ef	1875	static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	1876	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	1877	size_t *olen )
Christopher Haster	1:24750b9ad5ef	1878	{
Christopher Haster	1:24750b9ad5ef	1879	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	1880	const mbedtls_ssl_ciphersuite_t *suite = NULL;
Christopher Haster	1:24750b9ad5ef	1881	const mbedtls_cipher_info_t *cipher = NULL;
Christopher Haster	1:24750b9ad5ef	1882
Christopher Haster	1:24750b9ad5ef	1883	if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
Christopher Haster	1:24750b9ad5ef	1884	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Christopher Haster	1:24750b9ad5ef	1885	{
Christopher Haster	1:24750b9ad5ef	1886	*olen = 0;
Christopher Haster	1:24750b9ad5ef	1887	return;
Christopher Haster	1:24750b9ad5ef	1888	}
Christopher Haster	1:24750b9ad5ef	1889
Christopher Haster	1:24750b9ad5ef	1890	/*
Christopher Haster	1:24750b9ad5ef	1891	* RFC 7366: "If a server receives an encrypt-then-MAC request extension
Christopher Haster	1:24750b9ad5ef	1892	* from a client and then selects a stream or Authenticated Encryption
Christopher Haster	1:24750b9ad5ef	1893	* with Associated Data (AEAD) ciphersuite, it MUST NOT send an
Christopher Haster	1:24750b9ad5ef	1894	* encrypt-then-MAC response extension back to the client."
Christopher Haster	1:24750b9ad5ef	1895	*/
Christopher Haster	1:24750b9ad5ef	1896	if( ( suite = mbedtls_ssl_ciphersuite_from_id(
Christopher Haster	1:24750b9ad5ef	1897	ssl->session_negotiate->ciphersuite ) ) == NULL \|\|
Christopher Haster	1:24750b9ad5ef	1898	( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL \|\|
Christopher Haster	1:24750b9ad5ef	1899	cipher->mode != MBEDTLS_MODE_CBC )
Christopher Haster	1:24750b9ad5ef	1900	{
Christopher Haster	1:24750b9ad5ef	1901	*olen = 0;
Christopher Haster	1:24750b9ad5ef	1902	return;
Christopher Haster	1:24750b9ad5ef	1903	}
Christopher Haster	1:24750b9ad5ef	1904
Christopher Haster	1:24750b9ad5ef	1905	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Christopher Haster	1:24750b9ad5ef	1906
Christopher Haster	1:24750b9ad5ef	1907	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1908	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1909
Christopher Haster	1:24750b9ad5ef	1910	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1911	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1912
Christopher Haster	1:24750b9ad5ef	1913	*olen = 4;
Christopher Haster	1:24750b9ad5ef	1914	}
Christopher Haster	1:24750b9ad5ef	1915	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Christopher Haster	1:24750b9ad5ef	1916
Christopher Haster	1:24750b9ad5ef	1917	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Christopher Haster	1:24750b9ad5ef	1918	static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	1919	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	1920	size_t *olen )
Christopher Haster	1:24750b9ad5ef	1921	{
Christopher Haster	1:24750b9ad5ef	1922	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	1923
Christopher Haster	1:24750b9ad5ef	1924	if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
Christopher Haster	1:24750b9ad5ef	1925	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Christopher Haster	1:24750b9ad5ef	1926	{
Christopher Haster	1:24750b9ad5ef	1927	*olen = 0;
Christopher Haster	1:24750b9ad5ef	1928	return;
Christopher Haster	1:24750b9ad5ef	1929	}
Christopher Haster	1:24750b9ad5ef	1930
Christopher Haster	1:24750b9ad5ef	1931	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Christopher Haster	1:24750b9ad5ef	1932	"extension" ) );
Christopher Haster	1:24750b9ad5ef	1933
Christopher Haster	1:24750b9ad5ef	1934	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1935	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1936
Christopher Haster	1:24750b9ad5ef	1937	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1938	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1939
Christopher Haster	1:24750b9ad5ef	1940	*olen = 4;
Christopher Haster	1:24750b9ad5ef	1941	}
Christopher Haster	1:24750b9ad5ef	1942	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Christopher Haster	1:24750b9ad5ef	1943
Christopher Haster	1:24750b9ad5ef	1944	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	1945	static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	1946	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	1947	size_t *olen )
Christopher Haster	1:24750b9ad5ef	1948	{
Christopher Haster	1:24750b9ad5ef	1949	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	1950
Christopher Haster	1:24750b9ad5ef	1951	if( ssl->handshake->new_session_ticket == 0 )
Christopher Haster	1:24750b9ad5ef	1952	{
Christopher Haster	1:24750b9ad5ef	1953	*olen = 0;
Christopher Haster	1:24750b9ad5ef	1954	return;
Christopher Haster	1:24750b9ad5ef	1955	}
Christopher Haster	1:24750b9ad5ef	1956
Christopher Haster	1:24750b9ad5ef	1957	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Christopher Haster	1:24750b9ad5ef	1958
Christopher Haster	1:24750b9ad5ef	1959	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1960	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1961
Christopher Haster	1:24750b9ad5ef	1962	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1963	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1964
Christopher Haster	1:24750b9ad5ef	1965	*olen = 4;
Christopher Haster	1:24750b9ad5ef	1966	}
Christopher Haster	1:24750b9ad5ef	1967	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Christopher Haster	1:24750b9ad5ef	1968
Christopher Haster	1:24750b9ad5ef	1969	static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	1970	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	1971	size_t *olen )
Christopher Haster	1:24750b9ad5ef	1972	{
Christopher Haster	1:24750b9ad5ef	1973	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	1974
Christopher Haster	1:24750b9ad5ef	1975	if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Christopher Haster	1:24750b9ad5ef	1976	{
Christopher Haster	1:24750b9ad5ef	1977	*olen = 0;
Christopher Haster	1:24750b9ad5ef	1978	return;
Christopher Haster	1:24750b9ad5ef	1979	}
Christopher Haster	1:24750b9ad5ef	1980
Christopher Haster	1:24750b9ad5ef	1981	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Christopher Haster	1:24750b9ad5ef	1982
Christopher Haster	1:24750b9ad5ef	1983	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1984	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	1985
Christopher Haster	1:24750b9ad5ef	1986	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	1987	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	1988	{
Christopher Haster	1:24750b9ad5ef	1989	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	1990	p++ = ( ssl->verify_data_len 2 + 1 ) & 0xFF;
Christopher Haster	1:24750b9ad5ef	1991	p++ = ssl->verify_data_len 2 & 0xFF;
Christopher Haster	1:24750b9ad5ef	1992
Christopher Haster	1:24750b9ad5ef	1993	memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
Christopher Haster	1:24750b9ad5ef	1994	p += ssl->verify_data_len;
Christopher Haster	1:24750b9ad5ef	1995	memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
Christopher Haster	1:24750b9ad5ef	1996	p += ssl->verify_data_len;
Christopher Haster	1:24750b9ad5ef	1997	}
Christopher Haster	1:24750b9ad5ef	1998	else
Christopher Haster	1:24750b9ad5ef	1999	#endif /* MBEDTLS_SSL_RENEGOTIATION */
Christopher Haster	1:24750b9ad5ef	2000	{
Christopher Haster	1:24750b9ad5ef	2001	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	2002	*p++ = 0x01;
Christopher Haster	1:24750b9ad5ef	2003	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	2004	}
Christopher Haster	1:24750b9ad5ef	2005
Christopher Haster	1:24750b9ad5ef	2006	*olen = p - buf;
Christopher Haster	1:24750b9ad5ef	2007	}
Christopher Haster	1:24750b9ad5ef	2008
Christopher Haster	1:24750b9ad5ef	2009	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Christopher Haster	1:24750b9ad5ef	2010	static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	2011	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	2012	size_t *olen )
Christopher Haster	1:24750b9ad5ef	2013	{
Christopher Haster	1:24750b9ad5ef	2014	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	2015
Christopher Haster	1:24750b9ad5ef	2016	if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Christopher Haster	1:24750b9ad5ef	2017	{
Christopher Haster	1:24750b9ad5ef	2018	*olen = 0;
Christopher Haster	1:24750b9ad5ef	2019	return;
Christopher Haster	1:24750b9ad5ef	2020	}
Christopher Haster	1:24750b9ad5ef	2021
Christopher Haster	1:24750b9ad5ef	2022	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Christopher Haster	1:24750b9ad5ef	2023
Christopher Haster	1:24750b9ad5ef	2024	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2025	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2026
Christopher Haster	1:24750b9ad5ef	2027	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	2028	*p++ = 1;
Christopher Haster	1:24750b9ad5ef	2029
Christopher Haster	1:24750b9ad5ef	2030	*p++ = ssl->session_negotiate->mfl_code;
Christopher Haster	1:24750b9ad5ef	2031
Christopher Haster	1:24750b9ad5ef	2032	*olen = 5;
Christopher Haster	1:24750b9ad5ef	2033	}
Christopher Haster	1:24750b9ad5ef	2034	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Christopher Haster	1:24750b9ad5ef	2035
Christopher Haster	1:24750b9ad5ef	2036	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
Christopher Haster	1:24750b9ad5ef	2037	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2038	static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	2039	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	2040	size_t *olen )
Christopher Haster	1:24750b9ad5ef	2041	{
Christopher Haster	1:24750b9ad5ef	2042	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	2043	((void) ssl);
Christopher Haster	1:24750b9ad5ef	2044
Christopher Haster	1:24750b9ad5ef	2045	if( ( ssl->handshake->cli_exts &
Christopher Haster	1:24750b9ad5ef	2046	MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Christopher Haster	1:24750b9ad5ef	2047	{
Christopher Haster	1:24750b9ad5ef	2048	*olen = 0;
Christopher Haster	1:24750b9ad5ef	2049	return;
Christopher Haster	1:24750b9ad5ef	2050	}
Christopher Haster	1:24750b9ad5ef	2051
Christopher Haster	1:24750b9ad5ef	2052	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Christopher Haster	1:24750b9ad5ef	2053
Christopher Haster	1:24750b9ad5ef	2054	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2055	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2056
Christopher Haster	1:24750b9ad5ef	2057	*p++ = 0x00;
Christopher Haster	1:24750b9ad5ef	2058	*p++ = 2;
Christopher Haster	1:24750b9ad5ef	2059
Christopher Haster	1:24750b9ad5ef	2060	*p++ = 1;
Christopher Haster	1:24750b9ad5ef	2061	*p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Christopher Haster	1:24750b9ad5ef	2062
Christopher Haster	1:24750b9ad5ef	2063	*olen = 6;
Christopher Haster	1:24750b9ad5ef	2064	}
Christopher Haster	1:24750b9ad5ef	2065	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\| MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	2066
Christopher Haster	1:24750b9ad5ef	2067	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2068	static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	2069	unsigned char *buf,
Christopher Haster	1:24750b9ad5ef	2070	size_t *olen )
Christopher Haster	1:24750b9ad5ef	2071	{
Christopher Haster	1:24750b9ad5ef	2072	int ret;
Christopher Haster	1:24750b9ad5ef	2073	unsigned char *p = buf;
Christopher Haster	1:24750b9ad5ef	2074	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
Christopher Haster	1:24750b9ad5ef	2075	size_t kkpp_len;
Christopher Haster	1:24750b9ad5ef	2076
Christopher Haster	1:24750b9ad5ef	2077	*olen = 0;
Christopher Haster	1:24750b9ad5ef	2078
Christopher Haster	1:24750b9ad5ef	2079	/* Skip costly computation if not needed */
Christopher Haster	1:24750b9ad5ef	2080	if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
Christopher Haster	1:24750b9ad5ef	2081	MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Christopher Haster	1:24750b9ad5ef	2082	return;
Christopher Haster	1:24750b9ad5ef	2083
Christopher Haster	1:24750b9ad5ef	2084	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
Christopher Haster	1:24750b9ad5ef	2085
Christopher Haster	1:24750b9ad5ef	2086	if( end - p < 4 )
Christopher Haster	1:24750b9ad5ef	2087	{
Christopher Haster	1:24750b9ad5ef	2088	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
Christopher Haster	1:24750b9ad5ef	2089	return;
Christopher Haster	1:24750b9ad5ef	2090	}
Christopher Haster	1:24750b9ad5ef	2091
Christopher Haster	1:24750b9ad5ef	2092	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2093	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2094
Christopher Haster	1:24750b9ad5ef	2095	ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
Christopher Haster	1:24750b9ad5ef	2096	p + 2, end - p - 2, &kkpp_len,
Christopher Haster	1:24750b9ad5ef	2097	ssl->conf->f_rng, ssl->conf->p_rng );
Christopher Haster	1:24750b9ad5ef	2098	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	2099	{
Christopher Haster	1:24750b9ad5ef	2100	MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
Christopher Haster	1:24750b9ad5ef	2101	return;
Christopher Haster	1:24750b9ad5ef	2102	}
Christopher Haster	1:24750b9ad5ef	2103
Christopher Haster	1:24750b9ad5ef	2104	*p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2105	*p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2106
Christopher Haster	1:24750b9ad5ef	2107	*olen = kkpp_len + 4;
Christopher Haster	1:24750b9ad5ef	2108	}
Christopher Haster	1:24750b9ad5ef	2109	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	2110
Christopher Haster	1:24750b9ad5ef	2111	#if defined(MBEDTLS_SSL_ALPN )
Christopher Haster	1:24750b9ad5ef	2112	static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	2113	unsigned char buf, size_t olen )
Christopher Haster	1:24750b9ad5ef	2114	{
Christopher Haster	1:24750b9ad5ef	2115	if( ssl->alpn_chosen == NULL )
Christopher Haster	1:24750b9ad5ef	2116	{
Christopher Haster	1:24750b9ad5ef	2117	*olen = 0;
Christopher Haster	1:24750b9ad5ef	2118	return;
Christopher Haster	1:24750b9ad5ef	2119	}
Christopher Haster	1:24750b9ad5ef	2120
Christopher Haster	1:24750b9ad5ef	2121	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Christopher Haster	1:24750b9ad5ef	2122
Christopher Haster	1:24750b9ad5ef	2123	/*
Christopher Haster	1:24750b9ad5ef	2124	* 0 . 1 ext identifier
Christopher Haster	1:24750b9ad5ef	2125	* 2 . 3 ext length
Christopher Haster	1:24750b9ad5ef	2126	* 4 . 5 protocol list length
Christopher Haster	1:24750b9ad5ef	2127	* 6 . 6 protocol name length
Christopher Haster	1:24750b9ad5ef	2128	* 7 . 7+n protocol name
Christopher Haster	1:24750b9ad5ef	2129	*/
Christopher Haster	1:24750b9ad5ef	2130	buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2131	buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2132
Christopher Haster	1:24750b9ad5ef	2133	*olen = 7 + strlen( ssl->alpn_chosen );
Christopher Haster	1:24750b9ad5ef	2134
Christopher Haster	1:24750b9ad5ef	2135	buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2136	buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2137
Christopher Haster	1:24750b9ad5ef	2138	buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2139	buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2140
Christopher Haster	1:24750b9ad5ef	2141	buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2142
Christopher Haster	1:24750b9ad5ef	2143	memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
Christopher Haster	1:24750b9ad5ef	2144	}
Christopher Haster	1:24750b9ad5ef	2145	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C */
Christopher Haster	1:24750b9ad5ef	2146
Christopher Haster	1:24750b9ad5ef	2147	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Christopher Haster	1:24750b9ad5ef	2148	static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	2149	{
Christopher Haster	1:24750b9ad5ef	2150	int ret;
Christopher Haster	1:24750b9ad5ef	2151	unsigned char *p = ssl->out_msg + 4;
Christopher Haster	1:24750b9ad5ef	2152	unsigned char *cookie_len_byte;
Christopher Haster	1:24750b9ad5ef	2153
Christopher Haster	1:24750b9ad5ef	2154	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Christopher Haster	1:24750b9ad5ef	2155
Christopher Haster	1:24750b9ad5ef	2156	/*
Christopher Haster	1:24750b9ad5ef	2157	* struct {
Christopher Haster	1:24750b9ad5ef	2158	* ProtocolVersion server_version;
Christopher Haster	1:24750b9ad5ef	2159	* opaque cookie<0..2^8-1>;
Christopher Haster	1:24750b9ad5ef	2160	* } HelloVerifyRequest;
Christopher Haster	1:24750b9ad5ef	2161	*/
Christopher Haster	1:24750b9ad5ef	2162
Christopher Haster	1:24750b9ad5ef	2163	/* The RFC is not clear on this point, but sending the actual negotiated
Christopher Haster	1:24750b9ad5ef	2164	* version looks like the most interoperable thing to do. */
Christopher Haster	1:24750b9ad5ef	2165	mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Christopher Haster	1:24750b9ad5ef	2166	ssl->conf->transport, p );
Christopher Haster	1:24750b9ad5ef	2167	MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Christopher Haster	1:24750b9ad5ef	2168	p += 2;
Christopher Haster	1:24750b9ad5ef	2169
Christopher Haster	1:24750b9ad5ef	2170	/* If we get here, f_cookie_check is not null */
Christopher Haster	1:24750b9ad5ef	2171	if( ssl->conf->f_cookie_write == NULL )
Christopher Haster	1:24750b9ad5ef	2172	{
Christopher Haster	1:24750b9ad5ef	2173	MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
Christopher Haster	1:24750b9ad5ef	2174	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	2175	}
Christopher Haster	1:24750b9ad5ef	2176
Christopher Haster	1:24750b9ad5ef	2177	/* Skip length byte until we know the length */
Christopher Haster	1:24750b9ad5ef	2178	cookie_len_byte = p++;
Christopher Haster	1:24750b9ad5ef	2179
Christopher Haster	1:24750b9ad5ef	2180	if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Christopher Haster	1:24750b9ad5ef	2181	&p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
Christopher Haster	1:24750b9ad5ef	2182	ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2183	{
Christopher Haster	1:24750b9ad5ef	2184	MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Christopher Haster	1:24750b9ad5ef	2185	return( ret );
Christopher Haster	1:24750b9ad5ef	2186	}
Christopher Haster	1:24750b9ad5ef	2187
Christopher Haster	1:24750b9ad5ef	2188	*cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
Christopher Haster	1:24750b9ad5ef	2189
Christopher Haster	1:24750b9ad5ef	2190	MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Christopher Haster	1:24750b9ad5ef	2191
Christopher Haster	1:24750b9ad5ef	2192	ssl->out_msglen = p - ssl->out_msg;
Christopher Haster	1:24750b9ad5ef	2193	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
Christopher Haster	1:24750b9ad5ef	2194	ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Christopher Haster	1:24750b9ad5ef	2195
Christopher Haster	1:24750b9ad5ef	2196	ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Christopher Haster	1:24750b9ad5ef	2197
Christopher Haster	1:24750b9ad5ef	2198	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2199	{
Christopher Haster	1:24750b9ad5ef	2200	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Christopher Haster	1:24750b9ad5ef	2201	return( ret );
Christopher Haster	1:24750b9ad5ef	2202	}
Christopher Haster	1:24750b9ad5ef	2203
Christopher Haster	1:24750b9ad5ef	2204	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Christopher Haster	1:24750b9ad5ef	2205
Christopher Haster	1:24750b9ad5ef	2206	return( 0 );
Christopher Haster	1:24750b9ad5ef	2207	}
Christopher Haster	1:24750b9ad5ef	2208	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Christopher Haster	1:24750b9ad5ef	2209
Christopher Haster	1:24750b9ad5ef	2210	static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	2211	{
Christopher Haster	1:24750b9ad5ef	2212	#if defined(MBEDTLS_HAVE_TIME)
Christopher Haster	1:24750b9ad5ef	2213	time_t t;
Christopher Haster	1:24750b9ad5ef	2214	#endif
Christopher Haster	1:24750b9ad5ef	2215	int ret;
Christopher Haster	1:24750b9ad5ef	2216	size_t olen, ext_len = 0, n;
Christopher Haster	1:24750b9ad5ef	2217	unsigned char buf, p;
Christopher Haster	1:24750b9ad5ef	2218
Christopher Haster	1:24750b9ad5ef	2219	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Christopher Haster	1:24750b9ad5ef	2220
Christopher Haster	1:24750b9ad5ef	2221	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Christopher Haster	1:24750b9ad5ef	2222	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Christopher Haster	1:24750b9ad5ef	2223	ssl->handshake->verify_cookie_len != 0 )
Christopher Haster	1:24750b9ad5ef	2224	{
Christopher Haster	1:24750b9ad5ef	2225	MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
Christopher Haster	1:24750b9ad5ef	2226	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Christopher Haster	1:24750b9ad5ef	2227
Christopher Haster	1:24750b9ad5ef	2228	return( ssl_write_hello_verify_request( ssl ) );
Christopher Haster	1:24750b9ad5ef	2229	}
Christopher Haster	1:24750b9ad5ef	2230	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Christopher Haster	1:24750b9ad5ef	2231
Christopher Haster	1:24750b9ad5ef	2232	if( ssl->conf->f_rng == NULL )
Christopher Haster	1:24750b9ad5ef	2233	{
Christopher Haster	1:24750b9ad5ef	2234	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
Christopher Haster	1:24750b9ad5ef	2235	return( MBEDTLS_ERR_SSL_NO_RNG );
Christopher Haster	1:24750b9ad5ef	2236	}
Christopher Haster	1:24750b9ad5ef	2237
Christopher Haster	1:24750b9ad5ef	2238	/*
Christopher Haster	1:24750b9ad5ef	2239	* 0 . 0 handshake type
Christopher Haster	1:24750b9ad5ef	2240	* 1 . 3 handshake length
Christopher Haster	1:24750b9ad5ef	2241	* 4 . 5 protocol version
Christopher Haster	1:24750b9ad5ef	2242	* 6 . 9 UNIX time()
Christopher Haster	1:24750b9ad5ef	2243	* 10 . 37 random bytes
Christopher Haster	1:24750b9ad5ef	2244	*/
Christopher Haster	1:24750b9ad5ef	2245	buf = ssl->out_msg;
Christopher Haster	1:24750b9ad5ef	2246	p = buf + 4;
Christopher Haster	1:24750b9ad5ef	2247
Christopher Haster	1:24750b9ad5ef	2248	mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Christopher Haster	1:24750b9ad5ef	2249	ssl->conf->transport, p );
Christopher Haster	1:24750b9ad5ef	2250	p += 2;
Christopher Haster	1:24750b9ad5ef	2251
Christopher Haster	1:24750b9ad5ef	2252	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Christopher Haster	1:24750b9ad5ef	2253	buf[4], buf[5] ) );
Christopher Haster	1:24750b9ad5ef	2254
Christopher Haster	1:24750b9ad5ef	2255	#if defined(MBEDTLS_HAVE_TIME)
Christopher Haster	1:24750b9ad5ef	2256	t = time( NULL );
Christopher Haster	1:24750b9ad5ef	2257	*p++ = (unsigned char)( t >> 24 );
Christopher Haster	1:24750b9ad5ef	2258	*p++ = (unsigned char)( t >> 16 );
Christopher Haster	1:24750b9ad5ef	2259	*p++ = (unsigned char)( t >> 8 );
Christopher Haster	1:24750b9ad5ef	2260	*p++ = (unsigned char)( t );
Christopher Haster	1:24750b9ad5ef	2261
Christopher Haster	1:24750b9ad5ef	2262	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Christopher Haster	1:24750b9ad5ef	2263	#else
Christopher Haster	1:24750b9ad5ef	2264	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2265	return( ret );
Christopher Haster	1:24750b9ad5ef	2266
Christopher Haster	1:24750b9ad5ef	2267	p += 4;
Christopher Haster	1:24750b9ad5ef	2268	#endif /* MBEDTLS_HAVE_TIME */
Christopher Haster	1:24750b9ad5ef	2269
Christopher Haster	1:24750b9ad5ef	2270	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2271	return( ret );
Christopher Haster	1:24750b9ad5ef	2272
Christopher Haster	1:24750b9ad5ef	2273	p += 28;
Christopher Haster	1:24750b9ad5ef	2274
Christopher Haster	1:24750b9ad5ef	2275	memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Christopher Haster	1:24750b9ad5ef	2276
Christopher Haster	1:24750b9ad5ef	2277	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Christopher Haster	1:24750b9ad5ef	2278
Christopher Haster	1:24750b9ad5ef	2279	/*
Christopher Haster	1:24750b9ad5ef	2280	* Resume is 0 by default, see ssl_handshake_init().
Christopher Haster	1:24750b9ad5ef	2281	* It may be already set to 1 by ssl_parse_session_ticket_ext().
Christopher Haster	1:24750b9ad5ef	2282	* If not, try looking up session ID in our cache.
Christopher Haster	1:24750b9ad5ef	2283	*/
Christopher Haster	1:24750b9ad5ef	2284	if( ssl->handshake->resume == 0 &&
Christopher Haster	1:24750b9ad5ef	2285	#if defined(MBEDTLS_SSL_RENEGOTIATION)
Christopher Haster	1:24750b9ad5ef	2286	ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
Christopher Haster	1:24750b9ad5ef	2287	#endif
Christopher Haster	1:24750b9ad5ef	2288	ssl->session_negotiate->id_len != 0 &&
Christopher Haster	1:24750b9ad5ef	2289	ssl->conf->f_get_cache != NULL &&
Christopher Haster	1:24750b9ad5ef	2290	ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
Christopher Haster	1:24750b9ad5ef	2291	{
Christopher Haster	1:24750b9ad5ef	2292	MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
Christopher Haster	1:24750b9ad5ef	2293	ssl->handshake->resume = 1;
Christopher Haster	1:24750b9ad5ef	2294	}
Christopher Haster	1:24750b9ad5ef	2295
Christopher Haster	1:24750b9ad5ef	2296	if( ssl->handshake->resume == 0 )
Christopher Haster	1:24750b9ad5ef	2297	{
Christopher Haster	1:24750b9ad5ef	2298	/*
Christopher Haster	1:24750b9ad5ef	2299	* New session, create a new session id,
Christopher Haster	1:24750b9ad5ef	2300	* unless we're about to issue a session ticket
Christopher Haster	1:24750b9ad5ef	2301	*/
Christopher Haster	1:24750b9ad5ef	2302	ssl->state++;
Christopher Haster	1:24750b9ad5ef	2303
Christopher Haster	1:24750b9ad5ef	2304	#if defined(MBEDTLS_HAVE_TIME)
Christopher Haster	1:24750b9ad5ef	2305	ssl->session_negotiate->start = time( NULL );
Christopher Haster	1:24750b9ad5ef	2306	#endif
Christopher Haster	1:24750b9ad5ef	2307
Christopher Haster	1:24750b9ad5ef	2308	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	2309	if( ssl->handshake->new_session_ticket != 0 )
Christopher Haster	1:24750b9ad5ef	2310	{
Christopher Haster	1:24750b9ad5ef	2311	ssl->session_negotiate->id_len = n = 0;
Christopher Haster	1:24750b9ad5ef	2312	memset( ssl->session_negotiate->id, 0, 32 );
Christopher Haster	1:24750b9ad5ef	2313	}
Christopher Haster	1:24750b9ad5ef	2314	else
Christopher Haster	1:24750b9ad5ef	2315	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Christopher Haster	1:24750b9ad5ef	2316	{
Christopher Haster	1:24750b9ad5ef	2317	ssl->session_negotiate->id_len = n = 32;
Christopher Haster	1:24750b9ad5ef	2318	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
Christopher Haster	1:24750b9ad5ef	2319	n ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2320	return( ret );
Christopher Haster	1:24750b9ad5ef	2321	}
Christopher Haster	1:24750b9ad5ef	2322	}
Christopher Haster	1:24750b9ad5ef	2323	else
Christopher Haster	1:24750b9ad5ef	2324	{
Christopher Haster	1:24750b9ad5ef	2325	/*
Christopher Haster	1:24750b9ad5ef	2326	* Resuming a session
Christopher Haster	1:24750b9ad5ef	2327	*/
Christopher Haster	1:24750b9ad5ef	2328	n = ssl->session_negotiate->id_len;
Christopher Haster	1:24750b9ad5ef	2329	ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
Christopher Haster	1:24750b9ad5ef	2330
Christopher Haster	1:24750b9ad5ef	2331	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2332	{
Christopher Haster	1:24750b9ad5ef	2333	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Christopher Haster	1:24750b9ad5ef	2334	return( ret );
Christopher Haster	1:24750b9ad5ef	2335	}
Christopher Haster	1:24750b9ad5ef	2336	}
Christopher Haster	1:24750b9ad5ef	2337
Christopher Haster	1:24750b9ad5ef	2338	/*
Christopher Haster	1:24750b9ad5ef	2339	* 38 . 38 session id length
Christopher Haster	1:24750b9ad5ef	2340	* 39 . 38+n session id
Christopher Haster	1:24750b9ad5ef	2341	* 39+n . 40+n chosen ciphersuite
Christopher Haster	1:24750b9ad5ef	2342	* 41+n . 41+n chosen compression alg.
Christopher Haster	1:24750b9ad5ef	2343	* 42+n . 43+n extensions length
Christopher Haster	1:24750b9ad5ef	2344	* 44+n . 43+n+m extensions
Christopher Haster	1:24750b9ad5ef	2345	*/
Christopher Haster	1:24750b9ad5ef	2346	*p++ = (unsigned char) ssl->session_negotiate->id_len;
Christopher Haster	1:24750b9ad5ef	2347	memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
Christopher Haster	1:24750b9ad5ef	2348	p += ssl->session_negotiate->id_len;
Christopher Haster	1:24750b9ad5ef	2349
Christopher Haster	1:24750b9ad5ef	2350	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
Christopher Haster	1:24750b9ad5ef	2351	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
Christopher Haster	1:24750b9ad5ef	2352	MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Christopher Haster	1:24750b9ad5ef	2353	ssl->handshake->resume ? "a" : "no" ) );
Christopher Haster	1:24750b9ad5ef	2354
Christopher Haster	1:24750b9ad5ef	2355	*p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
Christopher Haster	1:24750b9ad5ef	2356	*p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
Christopher Haster	1:24750b9ad5ef	2357	*p++ = (unsigned char)( ssl->session_negotiate->compression );
Christopher Haster	1:24750b9ad5ef	2358
Christopher Haster	1:24750b9ad5ef	2359	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
Christopher Haster	1:24750b9ad5ef	2360	mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
Christopher Haster	1:24750b9ad5ef	2361	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Christopher Haster	1:24750b9ad5ef	2362	ssl->session_negotiate->compression ) );
Christopher Haster	1:24750b9ad5ef	2363
Christopher Haster	1:24750b9ad5ef	2364	/*
Christopher Haster	1:24750b9ad5ef	2365	* First write extensions, then the total length
Christopher Haster	1:24750b9ad5ef	2366	*/
Christopher Haster	1:24750b9ad5ef	2367	ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2368	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2369
Christopher Haster	1:24750b9ad5ef	2370	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Christopher Haster	1:24750b9ad5ef	2371	ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2372	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2373	#endif
Christopher Haster	1:24750b9ad5ef	2374
Christopher Haster	1:24750b9ad5ef	2375	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Christopher Haster	1:24750b9ad5ef	2376	ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2377	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2378	#endif
Christopher Haster	1:24750b9ad5ef	2379
Christopher Haster	1:24750b9ad5ef	2380	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Christopher Haster	1:24750b9ad5ef	2381	ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2382	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2383	#endif
Christopher Haster	1:24750b9ad5ef	2384
Christopher Haster	1:24750b9ad5ef	2385	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Christopher Haster	1:24750b9ad5ef	2386	ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2387	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2388	#endif
Christopher Haster	1:24750b9ad5ef	2389
Christopher Haster	1:24750b9ad5ef	2390	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	2391	ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2392	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2393	#endif
Christopher Haster	1:24750b9ad5ef	2394
Christopher Haster	1:24750b9ad5ef	2395	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
Christopher Haster	1:24750b9ad5ef	2396	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2397	ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2398	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2399	#endif
Christopher Haster	1:24750b9ad5ef	2400
Christopher Haster	1:24750b9ad5ef	2401	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2402	ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2403	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2404	#endif
Christopher Haster	1:24750b9ad5ef	2405
Christopher Haster	1:24750b9ad5ef	2406	#if defined(MBEDTLS_SSL_ALPN)
Christopher Haster	1:24750b9ad5ef	2407	ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
Christopher Haster	1:24750b9ad5ef	2408	ext_len += olen;
Christopher Haster	1:24750b9ad5ef	2409	#endif
Christopher Haster	1:24750b9ad5ef	2410
Christopher Haster	1:24750b9ad5ef	2411	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Christopher Haster	1:24750b9ad5ef	2412
Christopher Haster	1:24750b9ad5ef	2413	if( ext_len > 0 )
Christopher Haster	1:24750b9ad5ef	2414	{
Christopher Haster	1:24750b9ad5ef	2415	*p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2416	*p++ = (unsigned char)( ( ext_len ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	2417	p += ext_len;
Christopher Haster	1:24750b9ad5ef	2418	}
Christopher Haster	1:24750b9ad5ef	2419
Christopher Haster	1:24750b9ad5ef	2420	ssl->out_msglen = p - buf;
Christopher Haster	1:24750b9ad5ef	2421	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
Christopher Haster	1:24750b9ad5ef	2422	ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Christopher Haster	1:24750b9ad5ef	2423
Christopher Haster	1:24750b9ad5ef	2424	ret = mbedtls_ssl_write_record( ssl );
Christopher Haster	1:24750b9ad5ef	2425
Christopher Haster	1:24750b9ad5ef	2426	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Christopher Haster	1:24750b9ad5ef	2427
Christopher Haster	1:24750b9ad5ef	2428	return( ret );
Christopher Haster	1:24750b9ad5ef	2429	}
Christopher Haster	1:24750b9ad5ef	2430
Christopher Haster	1:24750b9ad5ef	2431	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
Christopher Haster	1:24750b9ad5ef	2432	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Christopher Haster	1:24750b9ad5ef	2433	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
Christopher Haster	1:24750b9ad5ef	2434	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	2435	static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	2436	{
Christopher Haster	1:24750b9ad5ef	2437	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	2438
Christopher Haster	1:24750b9ad5ef	2439	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Christopher Haster	1:24750b9ad5ef	2440
Christopher Haster	1:24750b9ad5ef	2441	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2442	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2443	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2444	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2445	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Christopher Haster	1:24750b9ad5ef	2446	{
Christopher Haster	1:24750b9ad5ef	2447	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Christopher Haster	1:24750b9ad5ef	2448	ssl->state++;
Christopher Haster	1:24750b9ad5ef	2449	return( 0 );
Christopher Haster	1:24750b9ad5ef	2450	}
Christopher Haster	1:24750b9ad5ef	2451
Christopher Haster	1:24750b9ad5ef	2452	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	2453	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	2454	}
Christopher Haster	1:24750b9ad5ef	2455	#else
Christopher Haster	1:24750b9ad5ef	2456	static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	2457	{
Christopher Haster	1:24750b9ad5ef	2458	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Christopher Haster	1:24750b9ad5ef	2459	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	2460	size_t dn_size, total_dn_size; /* excluding length bytes */
Christopher Haster	1:24750b9ad5ef	2461	size_t ct_len, sa_len; /* including length bytes */
Christopher Haster	1:24750b9ad5ef	2462	unsigned char buf, p;
Christopher Haster	1:24750b9ad5ef	2463	const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
Christopher Haster	1:24750b9ad5ef	2464	const mbedtls_x509_crt *crt;
Christopher Haster	1:24750b9ad5ef	2465	int authmode;
Christopher Haster	1:24750b9ad5ef	2466
Christopher Haster	1:24750b9ad5ef	2467	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Christopher Haster	1:24750b9ad5ef	2468
Christopher Haster	1:24750b9ad5ef	2469	ssl->state++;
Christopher Haster	1:24750b9ad5ef	2470
Christopher Haster	1:24750b9ad5ef	2471	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Christopher Haster	1:24750b9ad5ef	2472	if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
Christopher Haster	1:24750b9ad5ef	2473	authmode = ssl->handshake->sni_authmode;
Christopher Haster	1:24750b9ad5ef	2474	else
Christopher Haster	1:24750b9ad5ef	2475	#endif
Christopher Haster	1:24750b9ad5ef	2476	authmode = ssl->conf->authmode;
Christopher Haster	1:24750b9ad5ef	2477
Christopher Haster	1:24750b9ad5ef	2478	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2479	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2480	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2481	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2482	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE \|\|
Christopher Haster	1:24750b9ad5ef	2483	authmode == MBEDTLS_SSL_VERIFY_NONE )
Christopher Haster	1:24750b9ad5ef	2484	{
Christopher Haster	1:24750b9ad5ef	2485	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Christopher Haster	1:24750b9ad5ef	2486	return( 0 );
Christopher Haster	1:24750b9ad5ef	2487	}
Christopher Haster	1:24750b9ad5ef	2488
Christopher Haster	1:24750b9ad5ef	2489	/*
Christopher Haster	1:24750b9ad5ef	2490	* 0 . 0 handshake type
Christopher Haster	1:24750b9ad5ef	2491	* 1 . 3 handshake length
Christopher Haster	1:24750b9ad5ef	2492	* 4 . 4 cert type count
Christopher Haster	1:24750b9ad5ef	2493	* 5 .. m-1 cert types
Christopher Haster	1:24750b9ad5ef	2494	* m .. m+1 sig alg length (TLS 1.2 only)
Christopher Haster	1:24750b9ad5ef	2495	* m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Christopher Haster	1:24750b9ad5ef	2496	* n .. n+1 length of all DNs
Christopher Haster	1:24750b9ad5ef	2497	* n+2 .. n+3 length of DN 1
Christopher Haster	1:24750b9ad5ef	2498	* n+4 .. ... Distinguished Name #1
Christopher Haster	1:24750b9ad5ef	2499	* ... .. ... length of DN 2, etc.
Christopher Haster	1:24750b9ad5ef	2500	*/
Christopher Haster	1:24750b9ad5ef	2501	buf = ssl->out_msg;
Christopher Haster	1:24750b9ad5ef	2502	p = buf + 4;
Christopher Haster	1:24750b9ad5ef	2503
Christopher Haster	1:24750b9ad5ef	2504	/*
Christopher Haster	1:24750b9ad5ef	2505	* Supported certificate types
Christopher Haster	1:24750b9ad5ef	2506	*
Christopher Haster	1:24750b9ad5ef	2507	* ClientCertificateType certificate_types<1..2^8-1>;
Christopher Haster	1:24750b9ad5ef	2508	* enum { (255) } ClientCertificateType;
Christopher Haster	1:24750b9ad5ef	2509	*/
Christopher Haster	1:24750b9ad5ef	2510	ct_len = 0;
Christopher Haster	1:24750b9ad5ef	2511
Christopher Haster	1:24750b9ad5ef	2512	#if defined(MBEDTLS_RSA_C)
Christopher Haster	1:24750b9ad5ef	2513	p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Christopher Haster	1:24750b9ad5ef	2514	#endif
Christopher Haster	1:24750b9ad5ef	2515	#if defined(MBEDTLS_ECDSA_C)
Christopher Haster	1:24750b9ad5ef	2516	p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Christopher Haster	1:24750b9ad5ef	2517	#endif
Christopher Haster	1:24750b9ad5ef	2518
Christopher Haster	1:24750b9ad5ef	2519	p[0] = (unsigned char) ct_len++;
Christopher Haster	1:24750b9ad5ef	2520	p += ct_len;
Christopher Haster	1:24750b9ad5ef	2521
Christopher Haster	1:24750b9ad5ef	2522	sa_len = 0;
Christopher Haster	1:24750b9ad5ef	2523	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	2524	/*
Christopher Haster	1:24750b9ad5ef	2525	* Add signature_algorithms for verify (TLS 1.2)
Christopher Haster	1:24750b9ad5ef	2526	*
Christopher Haster	1:24750b9ad5ef	2527	* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
Christopher Haster	1:24750b9ad5ef	2528	*
Christopher Haster	1:24750b9ad5ef	2529	* struct {
Christopher Haster	1:24750b9ad5ef	2530	* HashAlgorithm hash;
Christopher Haster	1:24750b9ad5ef	2531	* SignatureAlgorithm signature;
Christopher Haster	1:24750b9ad5ef	2532	* } SignatureAndHashAlgorithm;
Christopher Haster	1:24750b9ad5ef	2533	*
Christopher Haster	1:24750b9ad5ef	2534	* enum { (255) } HashAlgorithm;
Christopher Haster	1:24750b9ad5ef	2535	* enum { (255) } SignatureAlgorithm;
Christopher Haster	1:24750b9ad5ef	2536	*/
Christopher Haster	1:24750b9ad5ef	2537	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	2538	{
Christopher Haster	1:24750b9ad5ef	2539	/*
Christopher Haster	1:24750b9ad5ef	2540	* Only use current running hash algorithm that is already required
Christopher Haster	1:24750b9ad5ef	2541	* for requested ciphersuite.
Christopher Haster	1:24750b9ad5ef	2542	*/
Christopher Haster	1:24750b9ad5ef	2543	ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256;
Christopher Haster	1:24750b9ad5ef	2544
Christopher Haster	1:24750b9ad5ef	2545	if( ssl->transform_negotiate->ciphersuite_info->mac ==
Christopher Haster	1:24750b9ad5ef	2546	MBEDTLS_MD_SHA384 )
Christopher Haster	1:24750b9ad5ef	2547	{
Christopher Haster	1:24750b9ad5ef	2548	ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384;
Christopher Haster	1:24750b9ad5ef	2549	}
Christopher Haster	1:24750b9ad5ef	2550
Christopher Haster	1:24750b9ad5ef	2551	/*
Christopher Haster	1:24750b9ad5ef	2552	* Supported signature algorithms
Christopher Haster	1:24750b9ad5ef	2553	*/
Christopher Haster	1:24750b9ad5ef	2554	#if defined(MBEDTLS_RSA_C)
Christopher Haster	1:24750b9ad5ef	2555	p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
Christopher Haster	1:24750b9ad5ef	2556	p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Christopher Haster	1:24750b9ad5ef	2557	#endif
Christopher Haster	1:24750b9ad5ef	2558	#if defined(MBEDTLS_ECDSA_C)
Christopher Haster	1:24750b9ad5ef	2559	p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
Christopher Haster	1:24750b9ad5ef	2560	p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Christopher Haster	1:24750b9ad5ef	2561	#endif
Christopher Haster	1:24750b9ad5ef	2562
Christopher Haster	1:24750b9ad5ef	2563	p[0] = (unsigned char)( sa_len >> 8 );
Christopher Haster	1:24750b9ad5ef	2564	p[1] = (unsigned char)( sa_len );
Christopher Haster	1:24750b9ad5ef	2565	sa_len += 2;
Christopher Haster	1:24750b9ad5ef	2566	p += sa_len;
Christopher Haster	1:24750b9ad5ef	2567	}
Christopher Haster	1:24750b9ad5ef	2568	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Christopher Haster	1:24750b9ad5ef	2569
Christopher Haster	1:24750b9ad5ef	2570	/*
Christopher Haster	1:24750b9ad5ef	2571	* DistinguishedName certificate_authorities<0..2^16-1>;
Christopher Haster	1:24750b9ad5ef	2572	* opaque DistinguishedName<1..2^16-1>;
Christopher Haster	1:24750b9ad5ef	2573	*/
Christopher Haster	1:24750b9ad5ef	2574	p += 2;
Christopher Haster	1:24750b9ad5ef	2575	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Christopher Haster	1:24750b9ad5ef	2576	if( ssl->handshake->sni_ca_chain != NULL )
Christopher Haster	1:24750b9ad5ef	2577	crt = ssl->handshake->sni_ca_chain;
Christopher Haster	1:24750b9ad5ef	2578	else
Christopher Haster	1:24750b9ad5ef	2579	#endif
Christopher Haster	1:24750b9ad5ef	2580	crt = ssl->conf->ca_chain;
Christopher Haster	1:24750b9ad5ef	2581
Christopher Haster	1:24750b9ad5ef	2582	total_dn_size = 0;
Christopher Haster	1:24750b9ad5ef	2583	while( crt != NULL && crt->version != 0 )
Christopher Haster	1:24750b9ad5ef	2584	{
Christopher Haster	1:24750b9ad5ef	2585	dn_size = crt->subject_raw.len;
Christopher Haster	1:24750b9ad5ef	2586
Christopher Haster	1:24750b9ad5ef	2587	if( end < p \|\| (size_t)( end - p ) < 2 + dn_size )
Christopher Haster	1:24750b9ad5ef	2588	{
Christopher Haster	1:24750b9ad5ef	2589	MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
Christopher Haster	1:24750b9ad5ef	2590	break;
Christopher Haster	1:24750b9ad5ef	2591	}
Christopher Haster	1:24750b9ad5ef	2592
Christopher Haster	1:24750b9ad5ef	2593	*p++ = (unsigned char)( dn_size >> 8 );
Christopher Haster	1:24750b9ad5ef	2594	*p++ = (unsigned char)( dn_size );
Christopher Haster	1:24750b9ad5ef	2595	memcpy( p, crt->subject_raw.p, dn_size );
Christopher Haster	1:24750b9ad5ef	2596	p += dn_size;
Christopher Haster	1:24750b9ad5ef	2597
Christopher Haster	1:24750b9ad5ef	2598	MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
Christopher Haster	1:24750b9ad5ef	2599
Christopher Haster	1:24750b9ad5ef	2600	total_dn_size += 2 + dn_size;
Christopher Haster	1:24750b9ad5ef	2601	crt = crt->next;
Christopher Haster	1:24750b9ad5ef	2602	}
Christopher Haster	1:24750b9ad5ef	2603
Christopher Haster	1:24750b9ad5ef	2604	ssl->out_msglen = p - buf;
Christopher Haster	1:24750b9ad5ef	2605	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
Christopher Haster	1:24750b9ad5ef	2606	ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Christopher Haster	1:24750b9ad5ef	2607	ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
Christopher Haster	1:24750b9ad5ef	2608	ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Christopher Haster	1:24750b9ad5ef	2609
Christopher Haster	1:24750b9ad5ef	2610	ret = mbedtls_ssl_write_record( ssl );
Christopher Haster	1:24750b9ad5ef	2611
Christopher Haster	1:24750b9ad5ef	2612	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Christopher Haster	1:24750b9ad5ef	2613
Christopher Haster	1:24750b9ad5ef	2614	return( ret );
Christopher Haster	1:24750b9ad5ef	2615	}
Christopher Haster	1:24750b9ad5ef	2616	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
Christopher Haster	1:24750b9ad5ef	2617	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
Christopher Haster	1:24750b9ad5ef	2618	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
Christopher Haster	1:24750b9ad5ef	2619	!MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	2620
Christopher Haster	1:24750b9ad5ef	2621	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2622	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	2623	static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	2624	{
Christopher Haster	1:24750b9ad5ef	2625	int ret;
Christopher Haster	1:24750b9ad5ef	2626
Christopher Haster	1:24750b9ad5ef	2627	if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Christopher Haster	1:24750b9ad5ef	2628	{
Christopher Haster	1:24750b9ad5ef	2629	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
Christopher Haster	1:24750b9ad5ef	2630	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Christopher Haster	1:24750b9ad5ef	2631	}
Christopher Haster	1:24750b9ad5ef	2632
Christopher Haster	1:24750b9ad5ef	2633	if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
Christopher Haster	1:24750b9ad5ef	2634	mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
Christopher Haster	1:24750b9ad5ef	2635	MBEDTLS_ECDH_OURS ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2636	{
Christopher Haster	1:24750b9ad5ef	2637	MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Christopher Haster	1:24750b9ad5ef	2638	return( ret );
Christopher Haster	1:24750b9ad5ef	2639	}
Christopher Haster	1:24750b9ad5ef	2640
Christopher Haster	1:24750b9ad5ef	2641	return( 0 );
Christopher Haster	1:24750b9ad5ef	2642	}
Christopher Haster	1:24750b9ad5ef	2643	#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\|
Christopher Haster	1:24750b9ad5ef	2644	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	2645
Christopher Haster	1:24750b9ad5ef	2646	static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	2647	{
Christopher Haster	1:24750b9ad5ef	2648	int ret;
Christopher Haster	1:24750b9ad5ef	2649	size_t n = 0;
Christopher Haster	1:24750b9ad5ef	2650	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Christopher Haster	1:24750b9ad5ef	2651	ssl->transform_negotiate->ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	2652
Christopher Haster	1:24750b9ad5ef	2653	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2654	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2655	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2656	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2657	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2658	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2659	unsigned char *p = ssl->out_msg + 4;
Christopher Haster	1:24750b9ad5ef	2660	unsigned char *dig_signed = p;
Christopher Haster	1:24750b9ad5ef	2661	size_t dig_signed_len = 0, len;
Christopher Haster	1:24750b9ad5ef	2662	((void) dig_signed);
Christopher Haster	1:24750b9ad5ef	2663	((void) dig_signed_len);
Christopher Haster	1:24750b9ad5ef	2664	((void) len);
Christopher Haster	1:24750b9ad5ef	2665	#endif
Christopher Haster	1:24750b9ad5ef	2666
Christopher Haster	1:24750b9ad5ef	2667	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
Christopher Haster	1:24750b9ad5ef	2668
Christopher Haster	1:24750b9ad5ef	2669	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2670	defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2671	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	2672	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA \|\|
Christopher Haster	1:24750b9ad5ef	2673	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2674	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Christopher Haster	1:24750b9ad5ef	2675	{
Christopher Haster	1:24750b9ad5ef	2676	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
Christopher Haster	1:24750b9ad5ef	2677	ssl->state++;
Christopher Haster	1:24750b9ad5ef	2678	return( 0 );
Christopher Haster	1:24750b9ad5ef	2679	}
Christopher Haster	1:24750b9ad5ef	2680	#endif
Christopher Haster	1:24750b9ad5ef	2681
Christopher Haster	1:24750b9ad5ef	2682	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2683	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	2684	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
Christopher Haster	1:24750b9ad5ef	2685	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Christopher Haster	1:24750b9ad5ef	2686	{
Christopher Haster	1:24750b9ad5ef	2687	ssl_get_ecdh_params_from_cert( ssl );
Christopher Haster	1:24750b9ad5ef	2688
Christopher Haster	1:24750b9ad5ef	2689	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
Christopher Haster	1:24750b9ad5ef	2690	ssl->state++;
Christopher Haster	1:24750b9ad5ef	2691	return( 0 );
Christopher Haster	1:24750b9ad5ef	2692	}
Christopher Haster	1:24750b9ad5ef	2693	#endif
Christopher Haster	1:24750b9ad5ef	2694
Christopher Haster	1:24750b9ad5ef	2695	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2696	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Christopher Haster	1:24750b9ad5ef	2697	{
Christopher Haster	1:24750b9ad5ef	2698	size_t jlen;
Christopher Haster	1:24750b9ad5ef	2699	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
Christopher Haster	1:24750b9ad5ef	2700
Christopher Haster	1:24750b9ad5ef	2701	ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
Christopher Haster	1:24750b9ad5ef	2702	p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng );
Christopher Haster	1:24750b9ad5ef	2703	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	2704	{
Christopher Haster	1:24750b9ad5ef	2705	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
Christopher Haster	1:24750b9ad5ef	2706	return( ret );
Christopher Haster	1:24750b9ad5ef	2707	}
Christopher Haster	1:24750b9ad5ef	2708
Christopher Haster	1:24750b9ad5ef	2709	p += jlen;
Christopher Haster	1:24750b9ad5ef	2710	n += jlen;
Christopher Haster	1:24750b9ad5ef	2711	}
Christopher Haster	1:24750b9ad5ef	2712	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	2713
Christopher Haster	1:24750b9ad5ef	2714	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2715	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	2716	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	2717	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Christopher Haster	1:24750b9ad5ef	2718	{
Christopher Haster	1:24750b9ad5ef	2719	/* TODO: Support identity hints */
Christopher Haster	1:24750b9ad5ef	2720	*(p++) = 0x00;
Christopher Haster	1:24750b9ad5ef	2721	*(p++) = 0x00;
Christopher Haster	1:24750b9ad5ef	2722
Christopher Haster	1:24750b9ad5ef	2723	n += 2;
Christopher Haster	1:24750b9ad5ef	2724	}
Christopher Haster	1:24750b9ad5ef	2725	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	2726	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	2727
Christopher Haster	1:24750b9ad5ef	2728	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2729	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	2730	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
Christopher Haster	1:24750b9ad5ef	2731	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Christopher Haster	1:24750b9ad5ef	2732	{
Christopher Haster	1:24750b9ad5ef	2733	if( ssl->conf->dhm_P.p == NULL \|\| ssl->conf->dhm_G.p == NULL )
Christopher Haster	1:24750b9ad5ef	2734	{
Christopher Haster	1:24750b9ad5ef	2735	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
Christopher Haster	1:24750b9ad5ef	2736	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Christopher Haster	1:24750b9ad5ef	2737	}
Christopher Haster	1:24750b9ad5ef	2738
Christopher Haster	1:24750b9ad5ef	2739	/*
Christopher Haster	1:24750b9ad5ef	2740	* Ephemeral DH parameters:
Christopher Haster	1:24750b9ad5ef	2741	*
Christopher Haster	1:24750b9ad5ef	2742	* struct {
Christopher Haster	1:24750b9ad5ef	2743	* opaque dh_p<1..2^16-1>;
Christopher Haster	1:24750b9ad5ef	2744	* opaque dh_g<1..2^16-1>;
Christopher Haster	1:24750b9ad5ef	2745	* opaque dh_Ys<1..2^16-1>;
Christopher Haster	1:24750b9ad5ef	2746	* } ServerDHParams;
Christopher Haster	1:24750b9ad5ef	2747	*/
Christopher Haster	1:24750b9ad5ef	2748	if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 \|\|
Christopher Haster	1:24750b9ad5ef	2749	( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2750	{
Christopher Haster	1:24750b9ad5ef	2751	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
Christopher Haster	1:24750b9ad5ef	2752	return( ret );
Christopher Haster	1:24750b9ad5ef	2753	}
Christopher Haster	1:24750b9ad5ef	2754
Christopher Haster	1:24750b9ad5ef	2755	if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
Christopher Haster	1:24750b9ad5ef	2756	(int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
Christopher Haster	1:24750b9ad5ef	2757	p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2758	{
Christopher Haster	1:24750b9ad5ef	2759	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Christopher Haster	1:24750b9ad5ef	2760	return( ret );
Christopher Haster	1:24750b9ad5ef	2761	}
Christopher Haster	1:24750b9ad5ef	2762
Christopher Haster	1:24750b9ad5ef	2763	dig_signed = p;
Christopher Haster	1:24750b9ad5ef	2764	dig_signed_len = len;
Christopher Haster	1:24750b9ad5ef	2765
Christopher Haster	1:24750b9ad5ef	2766	p += len;
Christopher Haster	1:24750b9ad5ef	2767	n += len;
Christopher Haster	1:24750b9ad5ef	2768
Christopher Haster	1:24750b9ad5ef	2769	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
Christopher Haster	1:24750b9ad5ef	2770	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
Christopher Haster	1:24750b9ad5ef	2771	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
Christopher Haster	1:24750b9ad5ef	2772	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Christopher Haster	1:24750b9ad5ef	2773	}
Christopher Haster	1:24750b9ad5ef	2774	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	2775	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	2776
Christopher Haster	1:24750b9ad5ef	2777	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
Christopher Haster	1:24750b9ad5ef	2778	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
Christopher Haster	1:24750b9ad5ef	2779	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA \|\|
Christopher Haster	1:24750b9ad5ef	2780	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Christopher Haster	1:24750b9ad5ef	2781	{
Christopher Haster	1:24750b9ad5ef	2782	/*
Christopher Haster	1:24750b9ad5ef	2783	* Ephemeral ECDH parameters:
Christopher Haster	1:24750b9ad5ef	2784	*
Christopher Haster	1:24750b9ad5ef	2785	* struct {
Christopher Haster	1:24750b9ad5ef	2786	* ECParameters curve_params;
Christopher Haster	1:24750b9ad5ef	2787	* ECPoint public;
Christopher Haster	1:24750b9ad5ef	2788	* } ServerECDHParams;
Christopher Haster	1:24750b9ad5ef	2789	*/
Christopher Haster	1:24750b9ad5ef	2790	const mbedtls_ecp_curve_info **curve = NULL;
Christopher Haster	1:24750b9ad5ef	2791	const mbedtls_ecp_group_id *gid;
Christopher Haster	1:24750b9ad5ef	2792
Christopher Haster	1:24750b9ad5ef	2793	/* Match our preference list against the offered curves */
Christopher Haster	1:24750b9ad5ef	2794	for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Christopher Haster	1:24750b9ad5ef	2795	for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
Christopher Haster	1:24750b9ad5ef	2796	if( (curve)->grp_id == gid )
Christopher Haster	1:24750b9ad5ef	2797	goto curve_matching_done;
Christopher Haster	1:24750b9ad5ef	2798
Christopher Haster	1:24750b9ad5ef	2799	curve_matching_done:
Christopher Haster	1:24750b9ad5ef	2800	if( curve == NULL \|\| *curve == NULL )
Christopher Haster	1:24750b9ad5ef	2801	{
Christopher Haster	1:24750b9ad5ef	2802	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
Christopher Haster	1:24750b9ad5ef	2803	return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Christopher Haster	1:24750b9ad5ef	2804	}
Christopher Haster	1:24750b9ad5ef	2805
Christopher Haster	1:24750b9ad5ef	2806	MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
Christopher Haster	1:24750b9ad5ef	2807
Christopher Haster	1:24750b9ad5ef	2808	if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
Christopher Haster	1:24750b9ad5ef	2809	(*curve)->grp_id ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2810	{
Christopher Haster	1:24750b9ad5ef	2811	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Christopher Haster	1:24750b9ad5ef	2812	return( ret );
Christopher Haster	1:24750b9ad5ef	2813	}
Christopher Haster	1:24750b9ad5ef	2814
Christopher Haster	1:24750b9ad5ef	2815	if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
Christopher Haster	1:24750b9ad5ef	2816	p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
Christopher Haster	1:24750b9ad5ef	2817	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2818	{
Christopher Haster	1:24750b9ad5ef	2819	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Christopher Haster	1:24750b9ad5ef	2820	return( ret );
Christopher Haster	1:24750b9ad5ef	2821	}
Christopher Haster	1:24750b9ad5ef	2822
Christopher Haster	1:24750b9ad5ef	2823	dig_signed = p;
Christopher Haster	1:24750b9ad5ef	2824	dig_signed_len = len;
Christopher Haster	1:24750b9ad5ef	2825
Christopher Haster	1:24750b9ad5ef	2826	p += len;
Christopher Haster	1:24750b9ad5ef	2827	n += len;
Christopher Haster	1:24750b9ad5ef	2828
Christopher Haster	1:24750b9ad5ef	2829	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
Christopher Haster	1:24750b9ad5ef	2830	}
Christopher Haster	1:24750b9ad5ef	2831	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Christopher Haster	1:24750b9ad5ef	2832
Christopher Haster	1:24750b9ad5ef	2833	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2834	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	2835	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	2836	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
Christopher Haster	1:24750b9ad5ef	2837	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
Christopher Haster	1:24750b9ad5ef	2838	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Christopher Haster	1:24750b9ad5ef	2839	{
Christopher Haster	1:24750b9ad5ef	2840	size_t signature_len = 0;
Christopher Haster	1:24750b9ad5ef	2841	unsigned int hashlen = 0;
Christopher Haster	1:24750b9ad5ef	2842	unsigned char hash[64];
Christopher Haster	1:24750b9ad5ef	2843	mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
Christopher Haster	1:24750b9ad5ef	2844
Christopher Haster	1:24750b9ad5ef	2845	/*
Christopher Haster	1:24750b9ad5ef	2846	* Choose hash algorithm. NONE means MD5 + SHA1 here.
Christopher Haster	1:24750b9ad5ef	2847	*/
Christopher Haster	1:24750b9ad5ef	2848	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	2849	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	2850	{
Christopher Haster	1:24750b9ad5ef	2851	md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
Christopher Haster	1:24750b9ad5ef	2852
Christopher Haster	1:24750b9ad5ef	2853	if( md_alg == MBEDTLS_MD_NONE )
Christopher Haster	1:24750b9ad5ef	2854	{
Christopher Haster	1:24750b9ad5ef	2855	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	2856	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	2857	}
Christopher Haster	1:24750b9ad5ef	2858	}
Christopher Haster	1:24750b9ad5ef	2859	else
Christopher Haster	1:24750b9ad5ef	2860	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Christopher Haster	1:24750b9ad5ef	2861	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
Christopher Haster	1:24750b9ad5ef	2862	defined(MBEDTLS_SSL_PROTO_TLS1_1)
Christopher Haster	1:24750b9ad5ef	2863	if( ciphersuite_info->key_exchange ==
Christopher Haster	1:24750b9ad5ef	2864	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Christopher Haster	1:24750b9ad5ef	2865	{
Christopher Haster	1:24750b9ad5ef	2866	md_alg = MBEDTLS_MD_SHA1;
Christopher Haster	1:24750b9ad5ef	2867	}
Christopher Haster	1:24750b9ad5ef	2868	else
Christopher Haster	1:24750b9ad5ef	2869	#endif
Christopher Haster	1:24750b9ad5ef	2870	{
Christopher Haster	1:24750b9ad5ef	2871	md_alg = MBEDTLS_MD_NONE;
Christopher Haster	1:24750b9ad5ef	2872	}
Christopher Haster	1:24750b9ad5ef	2873
Christopher Haster	1:24750b9ad5ef	2874	/*
Christopher Haster	1:24750b9ad5ef	2875	* Compute the hash to be signed
Christopher Haster	1:24750b9ad5ef	2876	*/
Christopher Haster	1:24750b9ad5ef	2877	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
Christopher Haster	1:24750b9ad5ef	2878	defined(MBEDTLS_SSL_PROTO_TLS1_1)
Christopher Haster	1:24750b9ad5ef	2879	if( md_alg == MBEDTLS_MD_NONE )
Christopher Haster	1:24750b9ad5ef	2880	{
Christopher Haster	1:24750b9ad5ef	2881	mbedtls_md5_context mbedtls_md5;
Christopher Haster	1:24750b9ad5ef	2882	mbedtls_sha1_context mbedtls_sha1;
Christopher Haster	1:24750b9ad5ef	2883
Christopher Haster	1:24750b9ad5ef	2884	mbedtls_md5_init( &mbedtls_md5 );
Christopher Haster	1:24750b9ad5ef	2885	mbedtls_sha1_init( &mbedtls_sha1 );
Christopher Haster	1:24750b9ad5ef	2886
Christopher Haster	1:24750b9ad5ef	2887	/*
Christopher Haster	1:24750b9ad5ef	2888	* digitally-signed struct {
Christopher Haster	1:24750b9ad5ef	2889	* opaque md5_hash[16];
Christopher Haster	1:24750b9ad5ef	2890	* opaque sha_hash[20];
Christopher Haster	1:24750b9ad5ef	2891	* };
Christopher Haster	1:24750b9ad5ef	2892	*
Christopher Haster	1:24750b9ad5ef	2893	* md5_hash
Christopher Haster	1:24750b9ad5ef	2894	* MD5(ClientHello.random + ServerHello.random
Christopher Haster	1:24750b9ad5ef	2895	* + ServerParams);
Christopher Haster	1:24750b9ad5ef	2896	* sha_hash
Christopher Haster	1:24750b9ad5ef	2897	* SHA(ClientHello.random + ServerHello.random
Christopher Haster	1:24750b9ad5ef	2898	* + ServerParams);
Christopher Haster	1:24750b9ad5ef	2899	*/
Christopher Haster	1:24750b9ad5ef	2900	mbedtls_md5_starts( &mbedtls_md5 );
Christopher Haster	1:24750b9ad5ef	2901	mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
Christopher Haster	1:24750b9ad5ef	2902	mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
Christopher Haster	1:24750b9ad5ef	2903	mbedtls_md5_finish( &mbedtls_md5, hash );
Christopher Haster	1:24750b9ad5ef	2904
Christopher Haster	1:24750b9ad5ef	2905	mbedtls_sha1_starts( &mbedtls_sha1 );
Christopher Haster	1:24750b9ad5ef	2906	mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
Christopher Haster	1:24750b9ad5ef	2907	mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
Christopher Haster	1:24750b9ad5ef	2908	mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
Christopher Haster	1:24750b9ad5ef	2909
Christopher Haster	1:24750b9ad5ef	2910	hashlen = 36;
Christopher Haster	1:24750b9ad5ef	2911
Christopher Haster	1:24750b9ad5ef	2912	mbedtls_md5_free( &mbedtls_md5 );
Christopher Haster	1:24750b9ad5ef	2913	mbedtls_sha1_free( &mbedtls_sha1 );
Christopher Haster	1:24750b9ad5ef	2914	}
Christopher Haster	1:24750b9ad5ef	2915	else
Christopher Haster	1:24750b9ad5ef	2916	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\| \
Christopher Haster	1:24750b9ad5ef	2917	MBEDTLS_SSL_PROTO_TLS1_1 */
Christopher Haster	1:24750b9ad5ef	2918	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
Christopher Haster	1:24750b9ad5ef	2919	defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	2920	if( md_alg != MBEDTLS_MD_NONE )
Christopher Haster	1:24750b9ad5ef	2921	{
Christopher Haster	1:24750b9ad5ef	2922	mbedtls_md_context_t ctx;
Christopher Haster	1:24750b9ad5ef	2923	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Christopher Haster	1:24750b9ad5ef	2924
Christopher Haster	1:24750b9ad5ef	2925	mbedtls_md_init( &ctx );
Christopher Haster	1:24750b9ad5ef	2926
Christopher Haster	1:24750b9ad5ef	2927	/* Info from md_alg will be used instead */
Christopher Haster	1:24750b9ad5ef	2928	hashlen = 0;
Christopher Haster	1:24750b9ad5ef	2929
Christopher Haster	1:24750b9ad5ef	2930	/*
Christopher Haster	1:24750b9ad5ef	2931	* digitally-signed struct {
Christopher Haster	1:24750b9ad5ef	2932	* opaque client_random[32];
Christopher Haster	1:24750b9ad5ef	2933	* opaque server_random[32];
Christopher Haster	1:24750b9ad5ef	2934	* ServerDHParams params;
Christopher Haster	1:24750b9ad5ef	2935	* };
Christopher Haster	1:24750b9ad5ef	2936	*/
Christopher Haster	1:24750b9ad5ef	2937	if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2938	{
Christopher Haster	1:24750b9ad5ef	2939	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Christopher Haster	1:24750b9ad5ef	2940	return( ret );
Christopher Haster	1:24750b9ad5ef	2941	}
Christopher Haster	1:24750b9ad5ef	2942
Christopher Haster	1:24750b9ad5ef	2943	mbedtls_md_starts( &ctx );
Christopher Haster	1:24750b9ad5ef	2944	mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
Christopher Haster	1:24750b9ad5ef	2945	mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
Christopher Haster	1:24750b9ad5ef	2946	mbedtls_md_finish( &ctx, hash );
Christopher Haster	1:24750b9ad5ef	2947	mbedtls_md_free( &ctx );
Christopher Haster	1:24750b9ad5ef	2948	}
Christopher Haster	1:24750b9ad5ef	2949	else
Christopher Haster	1:24750b9ad5ef	2950	#endif /* MBEDTLS_SSL_PROTO_TLS1 \|\| MBEDTLS_SSL_PROTO_TLS1_1 \|\| \
Christopher Haster	1:24750b9ad5ef	2951	MBEDTLS_SSL_PROTO_TLS1_2 */
Christopher Haster	1:24750b9ad5ef	2952	{
Christopher Haster	1:24750b9ad5ef	2953	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	2954	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	2955	}
Christopher Haster	1:24750b9ad5ef	2956
Christopher Haster	1:24750b9ad5ef	2957	MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
Christopher Haster	1:24750b9ad5ef	2958	(unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
Christopher Haster	1:24750b9ad5ef	2959
Christopher Haster	1:24750b9ad5ef	2960	/*
Christopher Haster	1:24750b9ad5ef	2961	* Make the signature
Christopher Haster	1:24750b9ad5ef	2962	*/
Christopher Haster	1:24750b9ad5ef	2963	if( mbedtls_ssl_own_key( ssl ) == NULL )
Christopher Haster	1:24750b9ad5ef	2964	{
Christopher Haster	1:24750b9ad5ef	2965	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
Christopher Haster	1:24750b9ad5ef	2966	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Christopher Haster	1:24750b9ad5ef	2967	}
Christopher Haster	1:24750b9ad5ef	2968
Christopher Haster	1:24750b9ad5ef	2969	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	2970	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	2971	{
Christopher Haster	1:24750b9ad5ef	2972	*(p++) = ssl->handshake->sig_alg;
Christopher Haster	1:24750b9ad5ef	2973	*(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
Christopher Haster	1:24750b9ad5ef	2974
Christopher Haster	1:24750b9ad5ef	2975	n += 2;
Christopher Haster	1:24750b9ad5ef	2976	}
Christopher Haster	1:24750b9ad5ef	2977	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Christopher Haster	1:24750b9ad5ef	2978
Christopher Haster	1:24750b9ad5ef	2979	if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
Christopher Haster	1:24750b9ad5ef	2980	p + 2 , &signature_len,
Christopher Haster	1:24750b9ad5ef	2981	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	2982	{
Christopher Haster	1:24750b9ad5ef	2983	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Christopher Haster	1:24750b9ad5ef	2984	return( ret );
Christopher Haster	1:24750b9ad5ef	2985	}
Christopher Haster	1:24750b9ad5ef	2986
Christopher Haster	1:24750b9ad5ef	2987	*(p++) = (unsigned char)( signature_len >> 8 );
Christopher Haster	1:24750b9ad5ef	2988	*(p++) = (unsigned char)( signature_len );
Christopher Haster	1:24750b9ad5ef	2989	n += 2;
Christopher Haster	1:24750b9ad5ef	2990
Christopher Haster	1:24750b9ad5ef	2991	MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
Christopher Haster	1:24750b9ad5ef	2992
Christopher Haster	1:24750b9ad5ef	2993	n += signature_len;
Christopher Haster	1:24750b9ad5ef	2994	}
Christopher Haster	1:24750b9ad5ef	2995	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\|
Christopher Haster	1:24750b9ad5ef	2996	MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	2997	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	2998
Christopher Haster	1:24750b9ad5ef	2999	ssl->out_msglen = 4 + n;
Christopher Haster	1:24750b9ad5ef	3000	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
Christopher Haster	1:24750b9ad5ef	3001	ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Christopher Haster	1:24750b9ad5ef	3002
Christopher Haster	1:24750b9ad5ef	3003	ssl->state++;
Christopher Haster	1:24750b9ad5ef	3004
Christopher Haster	1:24750b9ad5ef	3005	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3006	{
Christopher Haster	1:24750b9ad5ef	3007	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Christopher Haster	1:24750b9ad5ef	3008	return( ret );
Christopher Haster	1:24750b9ad5ef	3009	}
Christopher Haster	1:24750b9ad5ef	3010
Christopher Haster	1:24750b9ad5ef	3011	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Christopher Haster	1:24750b9ad5ef	3012
Christopher Haster	1:24750b9ad5ef	3013	return( 0 );
Christopher Haster	1:24750b9ad5ef	3014	}
Christopher Haster	1:24750b9ad5ef	3015
Christopher Haster	1:24750b9ad5ef	3016	static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	3017	{
Christopher Haster	1:24750b9ad5ef	3018	int ret;
Christopher Haster	1:24750b9ad5ef	3019
Christopher Haster	1:24750b9ad5ef	3020	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Christopher Haster	1:24750b9ad5ef	3021
Christopher Haster	1:24750b9ad5ef	3022	ssl->out_msglen = 4;
Christopher Haster	1:24750b9ad5ef	3023	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
Christopher Haster	1:24750b9ad5ef	3024	ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Christopher Haster	1:24750b9ad5ef	3025
Christopher Haster	1:24750b9ad5ef	3026	ssl->state++;
Christopher Haster	1:24750b9ad5ef	3027
Christopher Haster	1:24750b9ad5ef	3028	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	3029	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Christopher Haster	1:24750b9ad5ef	3030	mbedtls_ssl_send_flight_completed( ssl );
Christopher Haster	1:24750b9ad5ef	3031	#endif
Christopher Haster	1:24750b9ad5ef	3032
Christopher Haster	1:24750b9ad5ef	3033	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3034	{
Christopher Haster	1:24750b9ad5ef	3035	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Christopher Haster	1:24750b9ad5ef	3036	return( ret );
Christopher Haster	1:24750b9ad5ef	3037	}
Christopher Haster	1:24750b9ad5ef	3038
Christopher Haster	1:24750b9ad5ef	3039	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Christopher Haster	1:24750b9ad5ef	3040
Christopher Haster	1:24750b9ad5ef	3041	return( 0 );
Christopher Haster	1:24750b9ad5ef	3042	}
Christopher Haster	1:24750b9ad5ef	3043
Christopher Haster	1:24750b9ad5ef	3044	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	3045	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3046	static int ssl_parse_client_dh_public( mbedtls_ssl_context ssl, unsigned char *p,
Christopher Haster	1:24750b9ad5ef	3047	const unsigned char *end )
Christopher Haster	1:24750b9ad5ef	3048	{
Christopher Haster	1:24750b9ad5ef	3049	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Christopher Haster	1:24750b9ad5ef	3050	size_t n;
Christopher Haster	1:24750b9ad5ef	3051
Christopher Haster	1:24750b9ad5ef	3052	/*
Christopher Haster	1:24750b9ad5ef	3053	* Receive G^Y mod P, premaster = (G^Y)^X mod P
Christopher Haster	1:24750b9ad5ef	3054	*/
Christopher Haster	1:24750b9ad5ef	3055	if( *p + 2 > end )
Christopher Haster	1:24750b9ad5ef	3056	{
Christopher Haster	1:24750b9ad5ef	3057	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3058	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3059	}
Christopher Haster	1:24750b9ad5ef	3060
Christopher Haster	1:24750b9ad5ef	3061	n = ( (p)[0] << 8 ) \| (p)[1];
Christopher Haster	1:24750b9ad5ef	3062	*p += 2;
Christopher Haster	1:24750b9ad5ef	3063
Christopher Haster	1:24750b9ad5ef	3064	if( *p + n > end )
Christopher Haster	1:24750b9ad5ef	3065	{
Christopher Haster	1:24750b9ad5ef	3066	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3067	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3068	}
Christopher Haster	1:24750b9ad5ef	3069
Christopher Haster	1:24750b9ad5ef	3070	if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3071	{
Christopher Haster	1:24750b9ad5ef	3072	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
Christopher Haster	1:24750b9ad5ef	3073	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Christopher Haster	1:24750b9ad5ef	3074	}
Christopher Haster	1:24750b9ad5ef	3075
Christopher Haster	1:24750b9ad5ef	3076	*p += n;
Christopher Haster	1:24750b9ad5ef	3077
Christopher Haster	1:24750b9ad5ef	3078	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Christopher Haster	1:24750b9ad5ef	3079
Christopher Haster	1:24750b9ad5ef	3080	return( ret );
Christopher Haster	1:24750b9ad5ef	3081	}
Christopher Haster	1:24750b9ad5ef	3082	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	3083	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3084
Christopher Haster	1:24750b9ad5ef	3085	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	3086	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3087	static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
Christopher Haster	1:24750b9ad5ef	3088	const unsigned char *p,
Christopher Haster	1:24750b9ad5ef	3089	const unsigned char *end,
Christopher Haster	1:24750b9ad5ef	3090	size_t pms_offset )
Christopher Haster	1:24750b9ad5ef	3091	{
Christopher Haster	1:24750b9ad5ef	3092	int ret;
Christopher Haster	1:24750b9ad5ef	3093	size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
Christopher Haster	1:24750b9ad5ef	3094	unsigned char *pms = ssl->handshake->premaster + pms_offset;
Christopher Haster	1:24750b9ad5ef	3095	unsigned char ver[2];
Christopher Haster	1:24750b9ad5ef	3096	unsigned char fake_pms[48], peer_pms[48];
Christopher Haster	1:24750b9ad5ef	3097	unsigned char mask;
Christopher Haster	1:24750b9ad5ef	3098	size_t i, peer_pmslen;
Christopher Haster	1:24750b9ad5ef	3099	unsigned int diff;
Christopher Haster	1:24750b9ad5ef	3100
Christopher Haster	1:24750b9ad5ef	3101	if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
Christopher Haster	1:24750b9ad5ef	3102	{
Christopher Haster	1:24750b9ad5ef	3103	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
Christopher Haster	1:24750b9ad5ef	3104	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Christopher Haster	1:24750b9ad5ef	3105	}
Christopher Haster	1:24750b9ad5ef	3106
Christopher Haster	1:24750b9ad5ef	3107	/*
Christopher Haster	1:24750b9ad5ef	3108	* Decrypt the premaster using own private RSA key
Christopher Haster	1:24750b9ad5ef	3109	*/
Christopher Haster	1:24750b9ad5ef	3110	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
Christopher Haster	1:24750b9ad5ef	3111	defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	3112	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Christopher Haster	1:24750b9ad5ef	3113	{
Christopher Haster	1:24750b9ad5ef	3114	if( *p++ != ( ( len >> 8 ) & 0xFF ) \|\|
Christopher Haster	1:24750b9ad5ef	3115	*p++ != ( ( len ) & 0xFF ) )
Christopher Haster	1:24750b9ad5ef	3116	{
Christopher Haster	1:24750b9ad5ef	3117	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3118	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3119	}
Christopher Haster	1:24750b9ad5ef	3120	}
Christopher Haster	1:24750b9ad5ef	3121	#endif
Christopher Haster	1:24750b9ad5ef	3122
Christopher Haster	1:24750b9ad5ef	3123	if( p + len != end )
Christopher Haster	1:24750b9ad5ef	3124	{
Christopher Haster	1:24750b9ad5ef	3125	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3126	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3127	}
Christopher Haster	1:24750b9ad5ef	3128
Christopher Haster	1:24750b9ad5ef	3129	mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Christopher Haster	1:24750b9ad5ef	3130	ssl->handshake->max_minor_ver,
Christopher Haster	1:24750b9ad5ef	3131	ssl->conf->transport, ver );
Christopher Haster	1:24750b9ad5ef	3132
Christopher Haster	1:24750b9ad5ef	3133	/*
Christopher Haster	1:24750b9ad5ef	3134	* Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
Christopher Haster	1:24750b9ad5ef	3135	* must not cause the connection to end immediately; instead, send a
Christopher Haster	1:24750b9ad5ef	3136	* bad_record_mac later in the handshake.
Christopher Haster	1:24750b9ad5ef	3137	* Also, avoid data-dependant branches here to protect against
Christopher Haster	1:24750b9ad5ef	3138	* timing-based variants.
Christopher Haster	1:24750b9ad5ef	3139	*/
Christopher Haster	1:24750b9ad5ef	3140	ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Christopher Haster	1:24750b9ad5ef	3141	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	3142	return( ret );
Christopher Haster	1:24750b9ad5ef	3143
Christopher Haster	1:24750b9ad5ef	3144	ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
Christopher Haster	1:24750b9ad5ef	3145	peer_pms, &peer_pmslen,
Christopher Haster	1:24750b9ad5ef	3146	sizeof( peer_pms ),
Christopher Haster	1:24750b9ad5ef	3147	ssl->conf->f_rng, ssl->conf->p_rng );
Christopher Haster	1:24750b9ad5ef	3148
Christopher Haster	1:24750b9ad5ef	3149	diff = (unsigned int) ret;
Christopher Haster	1:24750b9ad5ef	3150	diff \|= peer_pmslen ^ 48;
Christopher Haster	1:24750b9ad5ef	3151	diff \|= peer_pms[0] ^ ver[0];
Christopher Haster	1:24750b9ad5ef	3152	diff \|= peer_pms[1] ^ ver[1];
Christopher Haster	1:24750b9ad5ef	3153
Christopher Haster	1:24750b9ad5ef	3154	#if defined(MBEDTLS_SSL_DEBUG_ALL)
Christopher Haster	1:24750b9ad5ef	3155	if( diff != 0 )
Christopher Haster	1:24750b9ad5ef	3156	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3157	#endif
Christopher Haster	1:24750b9ad5ef	3158
Christopher Haster	1:24750b9ad5ef	3159	if( sizeof( ssl->handshake->premaster ) < pms_offset \|\|
Christopher Haster	1:24750b9ad5ef	3160	sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
Christopher Haster	1:24750b9ad5ef	3161	{
Christopher Haster	1:24750b9ad5ef	3162	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	3163	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	3164	}
Christopher Haster	1:24750b9ad5ef	3165	ssl->handshake->pmslen = 48;
Christopher Haster	1:24750b9ad5ef	3166
Christopher Haster	1:24750b9ad5ef	3167	/* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
Christopher Haster	1:24750b9ad5ef	3168	/* MSVC has a warning about unary minus on unsigned, but this is
Christopher Haster	1:24750b9ad5ef	3169	* well-defined and precisely what we want to do here */
Christopher Haster	1:24750b9ad5ef	3170	#if defined(_MSC_VER)
Christopher Haster	1:24750b9ad5ef	3171	#pragma warning( push )
Christopher Haster	1:24750b9ad5ef	3172	#pragma warning( disable : 4146 )
Christopher Haster	1:24750b9ad5ef	3173	#endif
Christopher Haster	1:24750b9ad5ef	3174	mask = - ( ( diff \| - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
Christopher Haster	1:24750b9ad5ef	3175	#if defined(_MSC_VER)
Christopher Haster	1:24750b9ad5ef	3176	#pragma warning( pop )
Christopher Haster	1:24750b9ad5ef	3177	#endif
Christopher Haster	1:24750b9ad5ef	3178
Christopher Haster	1:24750b9ad5ef	3179	for( i = 0; i < ssl->handshake->pmslen; i++ )
Christopher Haster	1:24750b9ad5ef	3180	pms[i] = ( mask & fake_pms[i] ) \| ( (~mask) & peer_pms[i] );
Christopher Haster	1:24750b9ad5ef	3181
Christopher Haster	1:24750b9ad5ef	3182	return( 0 );
Christopher Haster	1:24750b9ad5ef	3183	}
Christopher Haster	1:24750b9ad5ef	3184	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	3185	MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3186
Christopher Haster	1:24750b9ad5ef	3187	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3188	static int ssl_parse_client_psk_identity( mbedtls_ssl_context ssl, unsigned char *p,
Christopher Haster	1:24750b9ad5ef	3189	const unsigned char *end )
Christopher Haster	1:24750b9ad5ef	3190	{
Christopher Haster	1:24750b9ad5ef	3191	int ret = 0;
Christopher Haster	1:24750b9ad5ef	3192	size_t n;
Christopher Haster	1:24750b9ad5ef	3193
Christopher Haster	1:24750b9ad5ef	3194	if( ssl->conf->f_psk == NULL &&
Christopher Haster	1:24750b9ad5ef	3195	( ssl->conf->psk == NULL \|\| ssl->conf->psk_identity == NULL \|\|
Christopher Haster	1:24750b9ad5ef	3196	ssl->conf->psk_identity_len == 0 \|\| ssl->conf->psk_len == 0 ) )
Christopher Haster	1:24750b9ad5ef	3197	{
Christopher Haster	1:24750b9ad5ef	3198	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
Christopher Haster	1:24750b9ad5ef	3199	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Christopher Haster	1:24750b9ad5ef	3200	}
Christopher Haster	1:24750b9ad5ef	3201
Christopher Haster	1:24750b9ad5ef	3202	/*
Christopher Haster	1:24750b9ad5ef	3203	* Receive client pre-shared key identity name
Christopher Haster	1:24750b9ad5ef	3204	*/
Christopher Haster	1:24750b9ad5ef	3205	if( *p + 2 > end )
Christopher Haster	1:24750b9ad5ef	3206	{
Christopher Haster	1:24750b9ad5ef	3207	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3208	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3209	}
Christopher Haster	1:24750b9ad5ef	3210
Christopher Haster	1:24750b9ad5ef	3211	n = ( (p)[0] << 8 ) \| (p)[1];
Christopher Haster	1:24750b9ad5ef	3212	*p += 2;
Christopher Haster	1:24750b9ad5ef	3213
Christopher Haster	1:24750b9ad5ef	3214	if( n < 1 \|\| n > 65535 \|\| *p + n > end )
Christopher Haster	1:24750b9ad5ef	3215	{
Christopher Haster	1:24750b9ad5ef	3216	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3217	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3218	}
Christopher Haster	1:24750b9ad5ef	3219
Christopher Haster	1:24750b9ad5ef	3220	if( ssl->conf->f_psk != NULL )
Christopher Haster	1:24750b9ad5ef	3221	{
Christopher Haster	1:24750b9ad5ef	3222	if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Christopher Haster	1:24750b9ad5ef	3223	ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Christopher Haster	1:24750b9ad5ef	3224	}
Christopher Haster	1:24750b9ad5ef	3225	else
Christopher Haster	1:24750b9ad5ef	3226	{
Christopher Haster	1:24750b9ad5ef	3227	/* Identity is not a big secret since clients send it in the clear,
Christopher Haster	1:24750b9ad5ef	3228	* but treat it carefully anyway, just in case */
Christopher Haster	1:24750b9ad5ef	3229	if( n != ssl->conf->psk_identity_len \|\|
Christopher Haster	1:24750b9ad5ef	3230	mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Christopher Haster	1:24750b9ad5ef	3231	{
Christopher Haster	1:24750b9ad5ef	3232	ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Christopher Haster	1:24750b9ad5ef	3233	}
Christopher Haster	1:24750b9ad5ef	3234	}
Christopher Haster	1:24750b9ad5ef	3235
Christopher Haster	1:24750b9ad5ef	3236	if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Christopher Haster	1:24750b9ad5ef	3237	{
Christopher Haster	1:24750b9ad5ef	3238	MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Christopher Haster	1:24750b9ad5ef	3239	if( ( ret = mbedtls_ssl_send_alert_message( ssl,
Christopher Haster	1:24750b9ad5ef	3240	MBEDTLS_SSL_ALERT_LEVEL_FATAL,
Christopher Haster	1:24750b9ad5ef	3241	MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3242	{
Christopher Haster	1:24750b9ad5ef	3243	return( ret );
Christopher Haster	1:24750b9ad5ef	3244	}
Christopher Haster	1:24750b9ad5ef	3245
Christopher Haster	1:24750b9ad5ef	3246	return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Christopher Haster	1:24750b9ad5ef	3247	}
Christopher Haster	1:24750b9ad5ef	3248
Christopher Haster	1:24750b9ad5ef	3249	*p += n;
Christopher Haster	1:24750b9ad5ef	3250
Christopher Haster	1:24750b9ad5ef	3251	return( 0 );
Christopher Haster	1:24750b9ad5ef	3252	}
Christopher Haster	1:24750b9ad5ef	3253	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3254
Christopher Haster	1:24750b9ad5ef	3255	static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	3256	{
Christopher Haster	1:24750b9ad5ef	3257	int ret;
Christopher Haster	1:24750b9ad5ef	3258	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	3259	unsigned char p, end;
Christopher Haster	1:24750b9ad5ef	3260
Christopher Haster	1:24750b9ad5ef	3261	ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	3262
Christopher Haster	1:24750b9ad5ef	3263	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Christopher Haster	1:24750b9ad5ef	3264
Christopher Haster	1:24750b9ad5ef	3265	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3266	{
Christopher Haster	1:24750b9ad5ef	3267	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Christopher Haster	1:24750b9ad5ef	3268	return( ret );
Christopher Haster	1:24750b9ad5ef	3269	}
Christopher Haster	1:24750b9ad5ef	3270
Christopher Haster	1:24750b9ad5ef	3271	p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Christopher Haster	1:24750b9ad5ef	3272	end = ssl->in_msg + ssl->in_hslen;
Christopher Haster	1:24750b9ad5ef	3273
Christopher Haster	1:24750b9ad5ef	3274	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Christopher Haster	1:24750b9ad5ef	3275	{
Christopher Haster	1:24750b9ad5ef	3276	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3277	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3278	}
Christopher Haster	1:24750b9ad5ef	3279
Christopher Haster	1:24750b9ad5ef	3280	if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Christopher Haster	1:24750b9ad5ef	3281	{
Christopher Haster	1:24750b9ad5ef	3282	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Christopher Haster	1:24750b9ad5ef	3283	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3284	}
Christopher Haster	1:24750b9ad5ef	3285
Christopher Haster	1:24750b9ad5ef	3286	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	3287	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Christopher Haster	1:24750b9ad5ef	3288	{
Christopher Haster	1:24750b9ad5ef	3289	if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3290	{
Christopher Haster	1:24750b9ad5ef	3291	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Christopher Haster	1:24750b9ad5ef	3292	return( ret );
Christopher Haster	1:24750b9ad5ef	3293	}
Christopher Haster	1:24750b9ad5ef	3294
Christopher Haster	1:24750b9ad5ef	3295	if( p != end )
Christopher Haster	1:24750b9ad5ef	3296	{
Christopher Haster	1:24750b9ad5ef	3297	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
Christopher Haster	1:24750b9ad5ef	3298	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3299	}
Christopher Haster	1:24750b9ad5ef	3300
Christopher Haster	1:24750b9ad5ef	3301	if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Christopher Haster	1:24750b9ad5ef	3302	ssl->handshake->premaster,
Christopher Haster	1:24750b9ad5ef	3303	MBEDTLS_PREMASTER_SIZE,
Christopher Haster	1:24750b9ad5ef	3304	&ssl->handshake->pmslen,
Christopher Haster	1:24750b9ad5ef	3305	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3306	{
Christopher Haster	1:24750b9ad5ef	3307	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
Christopher Haster	1:24750b9ad5ef	3308	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Christopher Haster	1:24750b9ad5ef	3309	}
Christopher Haster	1:24750b9ad5ef	3310
Christopher Haster	1:24750b9ad5ef	3311	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Christopher Haster	1:24750b9ad5ef	3312	}
Christopher Haster	1:24750b9ad5ef	3313	else
Christopher Haster	1:24750b9ad5ef	3314	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	3315	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	3316	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	3317	defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
Christopher Haster	1:24750b9ad5ef	3318	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	3319	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
Christopher Haster	1:24750b9ad5ef	3320	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA \|\|
Christopher Haster	1:24750b9ad5ef	3321	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
Christopher Haster	1:24750b9ad5ef	3322	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Christopher Haster	1:24750b9ad5ef	3323	{
Christopher Haster	1:24750b9ad5ef	3324	if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Christopher Haster	1:24750b9ad5ef	3325	p, end - p) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3326	{
Christopher Haster	1:24750b9ad5ef	3327	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
Christopher Haster	1:24750b9ad5ef	3328	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Christopher Haster	1:24750b9ad5ef	3329	}
Christopher Haster	1:24750b9ad5ef	3330
Christopher Haster	1:24750b9ad5ef	3331	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
Christopher Haster	1:24750b9ad5ef	3332
Christopher Haster	1:24750b9ad5ef	3333	if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Christopher Haster	1:24750b9ad5ef	3334	&ssl->handshake->pmslen,
Christopher Haster	1:24750b9ad5ef	3335	ssl->handshake->premaster,
Christopher Haster	1:24750b9ad5ef	3336	MBEDTLS_MPI_MAX_SIZE,
Christopher Haster	1:24750b9ad5ef	3337	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3338	{
Christopher Haster	1:24750b9ad5ef	3339	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
Christopher Haster	1:24750b9ad5ef	3340	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Christopher Haster	1:24750b9ad5ef	3341	}
Christopher Haster	1:24750b9ad5ef	3342
Christopher Haster	1:24750b9ad5ef	3343	MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
Christopher Haster	1:24750b9ad5ef	3344	}
Christopher Haster	1:24750b9ad5ef	3345	else
Christopher Haster	1:24750b9ad5ef	3346	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	3347	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	3348	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
Christopher Haster	1:24750b9ad5ef	3349	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	3350	#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3351	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Christopher Haster	1:24750b9ad5ef	3352	{
Christopher Haster	1:24750b9ad5ef	3353	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3354	{
Christopher Haster	1:24750b9ad5ef	3355	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Christopher Haster	1:24750b9ad5ef	3356	return( ret );
Christopher Haster	1:24750b9ad5ef	3357	}
Christopher Haster	1:24750b9ad5ef	3358
Christopher Haster	1:24750b9ad5ef	3359	if( p != end )
Christopher Haster	1:24750b9ad5ef	3360	{
Christopher Haster	1:24750b9ad5ef	3361	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
Christopher Haster	1:24750b9ad5ef	3362	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3363	}
Christopher Haster	1:24750b9ad5ef	3364
Christopher Haster	1:24750b9ad5ef	3365	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Christopher Haster	1:24750b9ad5ef	3366	ciphersuite_info->key_exchange ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3367	{
Christopher Haster	1:24750b9ad5ef	3368	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Christopher Haster	1:24750b9ad5ef	3369	return( ret );
Christopher Haster	1:24750b9ad5ef	3370	}
Christopher Haster	1:24750b9ad5ef	3371	}
Christopher Haster	1:24750b9ad5ef	3372	else
Christopher Haster	1:24750b9ad5ef	3373	#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3374	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3375	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Christopher Haster	1:24750b9ad5ef	3376	{
Christopher Haster	1:24750b9ad5ef	3377	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3378	{
Christopher Haster	1:24750b9ad5ef	3379	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Christopher Haster	1:24750b9ad5ef	3380	return( ret );
Christopher Haster	1:24750b9ad5ef	3381	}
Christopher Haster	1:24750b9ad5ef	3382
Christopher Haster	1:24750b9ad5ef	3383	if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3384	{
Christopher Haster	1:24750b9ad5ef	3385	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Christopher Haster	1:24750b9ad5ef	3386	return( ret );
Christopher Haster	1:24750b9ad5ef	3387	}
Christopher Haster	1:24750b9ad5ef	3388
Christopher Haster	1:24750b9ad5ef	3389	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Christopher Haster	1:24750b9ad5ef	3390	ciphersuite_info->key_exchange ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3391	{
Christopher Haster	1:24750b9ad5ef	3392	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Christopher Haster	1:24750b9ad5ef	3393	return( ret );
Christopher Haster	1:24750b9ad5ef	3394	}
Christopher Haster	1:24750b9ad5ef	3395	}
Christopher Haster	1:24750b9ad5ef	3396	else
Christopher Haster	1:24750b9ad5ef	3397	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3398	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3399	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Christopher Haster	1:24750b9ad5ef	3400	{
Christopher Haster	1:24750b9ad5ef	3401	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3402	{
Christopher Haster	1:24750b9ad5ef	3403	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Christopher Haster	1:24750b9ad5ef	3404	return( ret );
Christopher Haster	1:24750b9ad5ef	3405	}
Christopher Haster	1:24750b9ad5ef	3406	if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3407	{
Christopher Haster	1:24750b9ad5ef	3408	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Christopher Haster	1:24750b9ad5ef	3409	return( ret );
Christopher Haster	1:24750b9ad5ef	3410	}
Christopher Haster	1:24750b9ad5ef	3411
Christopher Haster	1:24750b9ad5ef	3412	if( p != end )
Christopher Haster	1:24750b9ad5ef	3413	{
Christopher Haster	1:24750b9ad5ef	3414	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
Christopher Haster	1:24750b9ad5ef	3415	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3416	}
Christopher Haster	1:24750b9ad5ef	3417
Christopher Haster	1:24750b9ad5ef	3418	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Christopher Haster	1:24750b9ad5ef	3419	ciphersuite_info->key_exchange ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3420	{
Christopher Haster	1:24750b9ad5ef	3421	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Christopher Haster	1:24750b9ad5ef	3422	return( ret );
Christopher Haster	1:24750b9ad5ef	3423	}
Christopher Haster	1:24750b9ad5ef	3424	}
Christopher Haster	1:24750b9ad5ef	3425	else
Christopher Haster	1:24750b9ad5ef	3426	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3427	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Christopher Haster	1:24750b9ad5ef	3428	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Christopher Haster	1:24750b9ad5ef	3429	{
Christopher Haster	1:24750b9ad5ef	3430	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3431	{
Christopher Haster	1:24750b9ad5ef	3432	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Christopher Haster	1:24750b9ad5ef	3433	return( ret );
Christopher Haster	1:24750b9ad5ef	3434	}
Christopher Haster	1:24750b9ad5ef	3435
Christopher Haster	1:24750b9ad5ef	3436	if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Christopher Haster	1:24750b9ad5ef	3437	p, end - p ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3438	{
Christopher Haster	1:24750b9ad5ef	3439	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
Christopher Haster	1:24750b9ad5ef	3440	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Christopher Haster	1:24750b9ad5ef	3441	}
Christopher Haster	1:24750b9ad5ef	3442
Christopher Haster	1:24750b9ad5ef	3443	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
Christopher Haster	1:24750b9ad5ef	3444
Christopher Haster	1:24750b9ad5ef	3445	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Christopher Haster	1:24750b9ad5ef	3446	ciphersuite_info->key_exchange ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3447	{
Christopher Haster	1:24750b9ad5ef	3448	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Christopher Haster	1:24750b9ad5ef	3449	return( ret );
Christopher Haster	1:24750b9ad5ef	3450	}
Christopher Haster	1:24750b9ad5ef	3451	}
Christopher Haster	1:24750b9ad5ef	3452	else
Christopher Haster	1:24750b9ad5ef	3453	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Christopher Haster	1:24750b9ad5ef	3454	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	3455	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Christopher Haster	1:24750b9ad5ef	3456	{
Christopher Haster	1:24750b9ad5ef	3457	if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3458	{
Christopher Haster	1:24750b9ad5ef	3459	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Christopher Haster	1:24750b9ad5ef	3460	return( ret );
Christopher Haster	1:24750b9ad5ef	3461	}
Christopher Haster	1:24750b9ad5ef	3462	}
Christopher Haster	1:24750b9ad5ef	3463	else
Christopher Haster	1:24750b9ad5ef	3464	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	3465	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Christopher Haster	1:24750b9ad5ef	3466	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Christopher Haster	1:24750b9ad5ef	3467	{
Christopher Haster	1:24750b9ad5ef	3468	ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
Christopher Haster	1:24750b9ad5ef	3469	p, end - p );
Christopher Haster	1:24750b9ad5ef	3470	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	3471	{
Christopher Haster	1:24750b9ad5ef	3472	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
Christopher Haster	1:24750b9ad5ef	3473	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
Christopher Haster	1:24750b9ad5ef	3474	}
Christopher Haster	1:24750b9ad5ef	3475
Christopher Haster	1:24750b9ad5ef	3476	ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
Christopher Haster	1:24750b9ad5ef	3477	ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
Christopher Haster	1:24750b9ad5ef	3478	ssl->conf->f_rng, ssl->conf->p_rng );
Christopher Haster	1:24750b9ad5ef	3479	if( ret != 0 )
Christopher Haster	1:24750b9ad5ef	3480	{
Christopher Haster	1:24750b9ad5ef	3481	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
Christopher Haster	1:24750b9ad5ef	3482	return( ret );
Christopher Haster	1:24750b9ad5ef	3483	}
Christopher Haster	1:24750b9ad5ef	3484	}
Christopher Haster	1:24750b9ad5ef	3485	else
Christopher Haster	1:24750b9ad5ef	3486	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Christopher Haster	1:24750b9ad5ef	3487	{
Christopher Haster	1:24750b9ad5ef	3488	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	3489	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	3490	}
Christopher Haster	1:24750b9ad5ef	3491
Christopher Haster	1:24750b9ad5ef	3492	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3493	{
Christopher Haster	1:24750b9ad5ef	3494	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Christopher Haster	1:24750b9ad5ef	3495	return( ret );
Christopher Haster	1:24750b9ad5ef	3496	}
Christopher Haster	1:24750b9ad5ef	3497
Christopher Haster	1:24750b9ad5ef	3498	ssl->state++;
Christopher Haster	1:24750b9ad5ef	3499
Christopher Haster	1:24750b9ad5ef	3500	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Christopher Haster	1:24750b9ad5ef	3501
Christopher Haster	1:24750b9ad5ef	3502	return( 0 );
Christopher Haster	1:24750b9ad5ef	3503	}
Christopher Haster	1:24750b9ad5ef	3504
Christopher Haster	1:24750b9ad5ef	3505	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
Christopher Haster	1:24750b9ad5ef	3506	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Christopher Haster	1:24750b9ad5ef	3507	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
Christopher Haster	1:24750b9ad5ef	3508	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Christopher Haster	1:24750b9ad5ef	3509	static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	3510	{
Christopher Haster	1:24750b9ad5ef	3511	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	3512
Christopher Haster	1:24750b9ad5ef	3513	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Christopher Haster	1:24750b9ad5ef	3514
Christopher Haster	1:24750b9ad5ef	3515	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3516	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3517	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3518	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3519	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Christopher Haster	1:24750b9ad5ef	3520	{
Christopher Haster	1:24750b9ad5ef	3521	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Christopher Haster	1:24750b9ad5ef	3522	ssl->state++;
Christopher Haster	1:24750b9ad5ef	3523	return( 0 );
Christopher Haster	1:24750b9ad5ef	3524	}
Christopher Haster	1:24750b9ad5ef	3525
Christopher Haster	1:24750b9ad5ef	3526	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	3527	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	3528	}
Christopher Haster	1:24750b9ad5ef	3529	#else
Christopher Haster	1:24750b9ad5ef	3530	static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	3531	{
Christopher Haster	1:24750b9ad5ef	3532	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Christopher Haster	1:24750b9ad5ef	3533	size_t i, sig_len;
Christopher Haster	1:24750b9ad5ef	3534	unsigned char hash[48];
Christopher Haster	1:24750b9ad5ef	3535	unsigned char *hash_start = hash;
Christopher Haster	1:24750b9ad5ef	3536	size_t hashlen;
Christopher Haster	1:24750b9ad5ef	3537	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	3538	mbedtls_pk_type_t pk_alg;
Christopher Haster	1:24750b9ad5ef	3539	#endif
Christopher Haster	1:24750b9ad5ef	3540	mbedtls_md_type_t md_alg;
Christopher Haster	1:24750b9ad5ef	3541	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Christopher Haster	1:24750b9ad5ef	3542
Christopher Haster	1:24750b9ad5ef	3543	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Christopher Haster	1:24750b9ad5ef	3544
Christopher Haster	1:24750b9ad5ef	3545	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3546	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3547	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3548	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
Christopher Haster	1:24750b9ad5ef	3549	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE \|\|
Christopher Haster	1:24750b9ad5ef	3550	ssl->session_negotiate->peer_cert == NULL )
Christopher Haster	1:24750b9ad5ef	3551	{
Christopher Haster	1:24750b9ad5ef	3552	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Christopher Haster	1:24750b9ad5ef	3553	ssl->state++;
Christopher Haster	1:24750b9ad5ef	3554	return( 0 );
Christopher Haster	1:24750b9ad5ef	3555	}
Christopher Haster	1:24750b9ad5ef	3556
Christopher Haster	1:24750b9ad5ef	3557	/* Needs to be done before read_record() to exclude current message */
Christopher Haster	1:24750b9ad5ef	3558	ssl->handshake->calc_verify( ssl, hash );
Christopher Haster	1:24750b9ad5ef	3559
Christopher Haster	1:24750b9ad5ef	3560	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3561	{
Christopher Haster	1:24750b9ad5ef	3562	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Christopher Haster	1:24750b9ad5ef	3563	return( ret );
Christopher Haster	1:24750b9ad5ef	3564	}
Christopher Haster	1:24750b9ad5ef	3565
Christopher Haster	1:24750b9ad5ef	3566	ssl->state++;
Christopher Haster	1:24750b9ad5ef	3567
Christopher Haster	1:24750b9ad5ef	3568	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE \|\|
Christopher Haster	1:24750b9ad5ef	3569	ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Christopher Haster	1:24750b9ad5ef	3570	{
Christopher Haster	1:24750b9ad5ef	3571	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Christopher Haster	1:24750b9ad5ef	3572	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3573	}
Christopher Haster	1:24750b9ad5ef	3574
Christopher Haster	1:24750b9ad5ef	3575	i = mbedtls_ssl_hs_hdr_len( ssl );
Christopher Haster	1:24750b9ad5ef	3576
Christopher Haster	1:24750b9ad5ef	3577	/*
Christopher Haster	1:24750b9ad5ef	3578	* struct {
Christopher Haster	1:24750b9ad5ef	3579	* SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
Christopher Haster	1:24750b9ad5ef	3580	* opaque signature<0..2^16-1>;
Christopher Haster	1:24750b9ad5ef	3581	* } DigitallySigned;
Christopher Haster	1:24750b9ad5ef	3582	*/
Christopher Haster	1:24750b9ad5ef	3583	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
Christopher Haster	1:24750b9ad5ef	3584	defined(MBEDTLS_SSL_PROTO_TLS1_1)
Christopher Haster	1:24750b9ad5ef	3585	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	3586	{
Christopher Haster	1:24750b9ad5ef	3587	md_alg = MBEDTLS_MD_NONE;
Christopher Haster	1:24750b9ad5ef	3588	hashlen = 36;
Christopher Haster	1:24750b9ad5ef	3589
Christopher Haster	1:24750b9ad5ef	3590	/* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
Christopher Haster	1:24750b9ad5ef	3591	if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
Christopher Haster	1:24750b9ad5ef	3592	MBEDTLS_PK_ECDSA ) )
Christopher Haster	1:24750b9ad5ef	3593	{
Christopher Haster	1:24750b9ad5ef	3594	hash_start += 16;
Christopher Haster	1:24750b9ad5ef	3595	hashlen -= 16;
Christopher Haster	1:24750b9ad5ef	3596	md_alg = MBEDTLS_MD_SHA1;
Christopher Haster	1:24750b9ad5ef	3597	}
Christopher Haster	1:24750b9ad5ef	3598	}
Christopher Haster	1:24750b9ad5ef	3599	else
Christopher Haster	1:24750b9ad5ef	3600	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\|
Christopher Haster	1:24750b9ad5ef	3601	MBEDTLS_SSL_PROTO_TLS1_1 */
Christopher Haster	1:24750b9ad5ef	3602	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Christopher Haster	1:24750b9ad5ef	3603	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Christopher Haster	1:24750b9ad5ef	3604	{
Christopher Haster	1:24750b9ad5ef	3605	if( i + 2 > ssl->in_hslen )
Christopher Haster	1:24750b9ad5ef	3606	{
Christopher Haster	1:24750b9ad5ef	3607	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Christopher Haster	1:24750b9ad5ef	3608	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3609	}
Christopher Haster	1:24750b9ad5ef	3610
Christopher Haster	1:24750b9ad5ef	3611	/*
Christopher Haster	1:24750b9ad5ef	3612	* Hash
Christopher Haster	1:24750b9ad5ef	3613	*/
Christopher Haster	1:24750b9ad5ef	3614	if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
Christopher Haster	1:24750b9ad5ef	3615	{
Christopher Haster	1:24750b9ad5ef	3616	MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Christopher Haster	1:24750b9ad5ef	3617	" for verify message" ) );
Christopher Haster	1:24750b9ad5ef	3618	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3619	}
Christopher Haster	1:24750b9ad5ef	3620
Christopher Haster	1:24750b9ad5ef	3621	md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
Christopher Haster	1:24750b9ad5ef	3622
Christopher Haster	1:24750b9ad5ef	3623	/* Info from md_alg will be used instead */
Christopher Haster	1:24750b9ad5ef	3624	hashlen = 0;
Christopher Haster	1:24750b9ad5ef	3625
Christopher Haster	1:24750b9ad5ef	3626	i++;
Christopher Haster	1:24750b9ad5ef	3627
Christopher Haster	1:24750b9ad5ef	3628	/*
Christopher Haster	1:24750b9ad5ef	3629	* Signature
Christopher Haster	1:24750b9ad5ef	3630	*/
Christopher Haster	1:24750b9ad5ef	3631	if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
Christopher Haster	1:24750b9ad5ef	3632	== MBEDTLS_PK_NONE )
Christopher Haster	1:24750b9ad5ef	3633	{
Christopher Haster	1:24750b9ad5ef	3634	MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Christopher Haster	1:24750b9ad5ef	3635	" for verify message" ) );
Christopher Haster	1:24750b9ad5ef	3636	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3637	}
Christopher Haster	1:24750b9ad5ef	3638
Christopher Haster	1:24750b9ad5ef	3639	/*
Christopher Haster	1:24750b9ad5ef	3640	* Check the certificate's key type matches the signature alg
Christopher Haster	1:24750b9ad5ef	3641	*/
Christopher Haster	1:24750b9ad5ef	3642	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
Christopher Haster	1:24750b9ad5ef	3643	{
Christopher Haster	1:24750b9ad5ef	3644	MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
Christopher Haster	1:24750b9ad5ef	3645	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3646	}
Christopher Haster	1:24750b9ad5ef	3647
Christopher Haster	1:24750b9ad5ef	3648	i++;
Christopher Haster	1:24750b9ad5ef	3649	}
Christopher Haster	1:24750b9ad5ef	3650	else
Christopher Haster	1:24750b9ad5ef	3651	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Christopher Haster	1:24750b9ad5ef	3652	{
Christopher Haster	1:24750b9ad5ef	3653	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Christopher Haster	1:24750b9ad5ef	3654	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Christopher Haster	1:24750b9ad5ef	3655	}
Christopher Haster	1:24750b9ad5ef	3656
Christopher Haster	1:24750b9ad5ef	3657	if( i + 2 > ssl->in_hslen )
Christopher Haster	1:24750b9ad5ef	3658	{
Christopher Haster	1:24750b9ad5ef	3659	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Christopher Haster	1:24750b9ad5ef	3660	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3661	}
Christopher Haster	1:24750b9ad5ef	3662
Christopher Haster	1:24750b9ad5ef	3663	sig_len = ( ssl->in_msg[i] << 8 ) \| ssl->in_msg[i+1];
Christopher Haster	1:24750b9ad5ef	3664	i += 2;
Christopher Haster	1:24750b9ad5ef	3665
Christopher Haster	1:24750b9ad5ef	3666	if( i + sig_len != ssl->in_hslen )
Christopher Haster	1:24750b9ad5ef	3667	{
Christopher Haster	1:24750b9ad5ef	3668	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Christopher Haster	1:24750b9ad5ef	3669	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Christopher Haster	1:24750b9ad5ef	3670	}
Christopher Haster	1:24750b9ad5ef	3671
Christopher Haster	1:24750b9ad5ef	3672	if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
Christopher Haster	1:24750b9ad5ef	3673	md_alg, hash_start, hashlen,
Christopher Haster	1:24750b9ad5ef	3674	ssl->in_msg + i, sig_len ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3675	{
Christopher Haster	1:24750b9ad5ef	3676	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Christopher Haster	1:24750b9ad5ef	3677	return( ret );
Christopher Haster	1:24750b9ad5ef	3678	}
Christopher Haster	1:24750b9ad5ef	3679
Christopher Haster	1:24750b9ad5ef	3680	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Christopher Haster	1:24750b9ad5ef	3681
Christopher Haster	1:24750b9ad5ef	3682	return( ret );
Christopher Haster	1:24750b9ad5ef	3683	}
Christopher Haster	1:24750b9ad5ef	3684	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
Christopher Haster	1:24750b9ad5ef	3685	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
Christopher Haster	1:24750b9ad5ef	3686	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
Christopher Haster	1:24750b9ad5ef	3687
Christopher Haster	1:24750b9ad5ef	3688	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	3689	static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	3690	{
Christopher Haster	1:24750b9ad5ef	3691	int ret;
Christopher Haster	1:24750b9ad5ef	3692	size_t tlen;
Christopher Haster	1:24750b9ad5ef	3693	uint32_t lifetime;
Christopher Haster	1:24750b9ad5ef	3694
Christopher Haster	1:24750b9ad5ef	3695	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Christopher Haster	1:24750b9ad5ef	3696
Christopher Haster	1:24750b9ad5ef	3697	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
Christopher Haster	1:24750b9ad5ef	3698	ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Christopher Haster	1:24750b9ad5ef	3699
Christopher Haster	1:24750b9ad5ef	3700	/*
Christopher Haster	1:24750b9ad5ef	3701	* struct {
Christopher Haster	1:24750b9ad5ef	3702	* uint32 ticket_lifetime_hint;
Christopher Haster	1:24750b9ad5ef	3703	* opaque ticket<0..2^16-1>;
Christopher Haster	1:24750b9ad5ef	3704	* } NewSessionTicket;
Christopher Haster	1:24750b9ad5ef	3705	*
Christopher Haster	1:24750b9ad5ef	3706	* 4 . 7 ticket_lifetime_hint (0 = unspecified)
Christopher Haster	1:24750b9ad5ef	3707	* 8 . 9 ticket_len (n)
Christopher Haster	1:24750b9ad5ef	3708	* 10 . 9+n ticket content
Christopher Haster	1:24750b9ad5ef	3709	*/
Christopher Haster	1:24750b9ad5ef	3710
Christopher Haster	1:24750b9ad5ef	3711	if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Christopher Haster	1:24750b9ad5ef	3712	ssl->session_negotiate,
Christopher Haster	1:24750b9ad5ef	3713	ssl->out_msg + 10,
Christopher Haster	1:24750b9ad5ef	3714	ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
Christopher Haster	1:24750b9ad5ef	3715	&tlen, &lifetime ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3716	{
Christopher Haster	1:24750b9ad5ef	3717	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Christopher Haster	1:24750b9ad5ef	3718	tlen = 0;
Christopher Haster	1:24750b9ad5ef	3719	}
Christopher Haster	1:24750b9ad5ef	3720
Christopher Haster	1:24750b9ad5ef	3721	ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
Christopher Haster	1:24750b9ad5ef	3722	ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
Christopher Haster	1:24750b9ad5ef	3723	ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
Christopher Haster	1:24750b9ad5ef	3724	ssl->out_msg[7] = ( lifetime ) & 0xFF;
Christopher Haster	1:24750b9ad5ef	3725
Christopher Haster	1:24750b9ad5ef	3726	ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	3727	ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Christopher Haster	1:24750b9ad5ef	3728
Christopher Haster	1:24750b9ad5ef	3729	ssl->out_msglen = 10 + tlen;
Christopher Haster	1:24750b9ad5ef	3730
Christopher Haster	1:24750b9ad5ef	3731	/*
Christopher Haster	1:24750b9ad5ef	3732	* Morally equivalent to updating ssl->state, but NewSessionTicket and
Christopher Haster	1:24750b9ad5ef	3733	* ChangeCipherSpec share the same state.
Christopher Haster	1:24750b9ad5ef	3734	*/
Christopher Haster	1:24750b9ad5ef	3735	ssl->handshake->new_session_ticket = 0;
Christopher Haster	1:24750b9ad5ef	3736
Christopher Haster	1:24750b9ad5ef	3737	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3738	{
Christopher Haster	1:24750b9ad5ef	3739	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Christopher Haster	1:24750b9ad5ef	3740	return( ret );
Christopher Haster	1:24750b9ad5ef	3741	}
Christopher Haster	1:24750b9ad5ef	3742
Christopher Haster	1:24750b9ad5ef	3743	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Christopher Haster	1:24750b9ad5ef	3744
Christopher Haster	1:24750b9ad5ef	3745	return( 0 );
Christopher Haster	1:24750b9ad5ef	3746	}
Christopher Haster	1:24750b9ad5ef	3747	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Christopher Haster	1:24750b9ad5ef	3748
Christopher Haster	1:24750b9ad5ef	3749	/*
Christopher Haster	1:24750b9ad5ef	3750	* SSL handshake -- server side -- single step
Christopher Haster	1:24750b9ad5ef	3751	*/
Christopher Haster	1:24750b9ad5ef	3752	int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Christopher Haster	1:24750b9ad5ef	3753	{
Christopher Haster	1:24750b9ad5ef	3754	int ret = 0;
Christopher Haster	1:24750b9ad5ef	3755
Christopher Haster	1:24750b9ad5ef	3756	if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER \|\| ssl->handshake == NULL )
Christopher Haster	1:24750b9ad5ef	3757	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Christopher Haster	1:24750b9ad5ef	3758
Christopher Haster	1:24750b9ad5ef	3759	MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Christopher Haster	1:24750b9ad5ef	3760
Christopher Haster	1:24750b9ad5ef	3761	if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3762	return( ret );
Christopher Haster	1:24750b9ad5ef	3763
Christopher Haster	1:24750b9ad5ef	3764	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	3765	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Christopher Haster	1:24750b9ad5ef	3766	ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Christopher Haster	1:24750b9ad5ef	3767	{
Christopher Haster	1:24750b9ad5ef	3768	if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Christopher Haster	1:24750b9ad5ef	3769	return( ret );
Christopher Haster	1:24750b9ad5ef	3770	}
Christopher Haster	1:24750b9ad5ef	3771	#endif
Christopher Haster	1:24750b9ad5ef	3772
Christopher Haster	1:24750b9ad5ef	3773	switch( ssl->state )
Christopher Haster	1:24750b9ad5ef	3774	{
Christopher Haster	1:24750b9ad5ef	3775	case MBEDTLS_SSL_HELLO_REQUEST:
Christopher Haster	1:24750b9ad5ef	3776	ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Christopher Haster	1:24750b9ad5ef	3777	break;
Christopher Haster	1:24750b9ad5ef	3778
Christopher Haster	1:24750b9ad5ef	3779	/*
Christopher Haster	1:24750b9ad5ef	3780	* <== ClientHello
Christopher Haster	1:24750b9ad5ef	3781	*/
Christopher Haster	1:24750b9ad5ef	3782	case MBEDTLS_SSL_CLIENT_HELLO:
Christopher Haster	1:24750b9ad5ef	3783	ret = ssl_parse_client_hello( ssl );
Christopher Haster	1:24750b9ad5ef	3784	break;
Christopher Haster	1:24750b9ad5ef	3785
Christopher Haster	1:24750b9ad5ef	3786	#if defined(MBEDTLS_SSL_PROTO_DTLS)
Christopher Haster	1:24750b9ad5ef	3787	case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
Christopher Haster	1:24750b9ad5ef	3788	return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Christopher Haster	1:24750b9ad5ef	3789	#endif
Christopher Haster	1:24750b9ad5ef	3790
Christopher Haster	1:24750b9ad5ef	3791	/*
Christopher Haster	1:24750b9ad5ef	3792	* ==> ServerHello
Christopher Haster	1:24750b9ad5ef	3793	* Certificate
Christopher Haster	1:24750b9ad5ef	3794	* ( ServerKeyExchange )
Christopher Haster	1:24750b9ad5ef	3795	* ( CertificateRequest )
Christopher Haster	1:24750b9ad5ef	3796	* ServerHelloDone
Christopher Haster	1:24750b9ad5ef	3797	*/
Christopher Haster	1:24750b9ad5ef	3798	case MBEDTLS_SSL_SERVER_HELLO:
Christopher Haster	1:24750b9ad5ef	3799	ret = ssl_write_server_hello( ssl );
Christopher Haster	1:24750b9ad5ef	3800	break;
Christopher Haster	1:24750b9ad5ef	3801
Christopher Haster	1:24750b9ad5ef	3802	case MBEDTLS_SSL_SERVER_CERTIFICATE:
Christopher Haster	1:24750b9ad5ef	3803	ret = mbedtls_ssl_write_certificate( ssl );
Christopher Haster	1:24750b9ad5ef	3804	break;
Christopher Haster	1:24750b9ad5ef	3805
Christopher Haster	1:24750b9ad5ef	3806	case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Christopher Haster	1:24750b9ad5ef	3807	ret = ssl_write_server_key_exchange( ssl );
Christopher Haster	1:24750b9ad5ef	3808	break;
Christopher Haster	1:24750b9ad5ef	3809
Christopher Haster	1:24750b9ad5ef	3810	case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Christopher Haster	1:24750b9ad5ef	3811	ret = ssl_write_certificate_request( ssl );
Christopher Haster	1:24750b9ad5ef	3812	break;
Christopher Haster	1:24750b9ad5ef	3813
Christopher Haster	1:24750b9ad5ef	3814	case MBEDTLS_SSL_SERVER_HELLO_DONE:
Christopher Haster	1:24750b9ad5ef	3815	ret = ssl_write_server_hello_done( ssl );
Christopher Haster	1:24750b9ad5ef	3816	break;
Christopher Haster	1:24750b9ad5ef	3817
Christopher Haster	1:24750b9ad5ef	3818	/*
Christopher Haster	1:24750b9ad5ef	3819	* <== ( Certificate/Alert )
Christopher Haster	1:24750b9ad5ef	3820	* ClientKeyExchange
Christopher Haster	1:24750b9ad5ef	3821	* ( CertificateVerify )
Christopher Haster	1:24750b9ad5ef	3822	* ChangeCipherSpec
Christopher Haster	1:24750b9ad5ef	3823	* Finished
Christopher Haster	1:24750b9ad5ef	3824	*/
Christopher Haster	1:24750b9ad5ef	3825	case MBEDTLS_SSL_CLIENT_CERTIFICATE:
Christopher Haster	1:24750b9ad5ef	3826	ret = mbedtls_ssl_parse_certificate( ssl );
Christopher Haster	1:24750b9ad5ef	3827	break;
Christopher Haster	1:24750b9ad5ef	3828
Christopher Haster	1:24750b9ad5ef	3829	case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Christopher Haster	1:24750b9ad5ef	3830	ret = ssl_parse_client_key_exchange( ssl );
Christopher Haster	1:24750b9ad5ef	3831	break;
Christopher Haster	1:24750b9ad5ef	3832
Christopher Haster	1:24750b9ad5ef	3833	case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Christopher Haster	1:24750b9ad5ef	3834	ret = ssl_parse_certificate_verify( ssl );
Christopher Haster	1:24750b9ad5ef	3835	break;
Christopher Haster	1:24750b9ad5ef	3836
Christopher Haster	1:24750b9ad5ef	3837	case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
Christopher Haster	1:24750b9ad5ef	3838	ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Christopher Haster	1:24750b9ad5ef	3839	break;
Christopher Haster	1:24750b9ad5ef	3840
Christopher Haster	1:24750b9ad5ef	3841	case MBEDTLS_SSL_CLIENT_FINISHED:
Christopher Haster	1:24750b9ad5ef	3842	ret = mbedtls_ssl_parse_finished( ssl );
Christopher Haster	1:24750b9ad5ef	3843	break;
Christopher Haster	1:24750b9ad5ef	3844
Christopher Haster	1:24750b9ad5ef	3845	/*
Christopher Haster	1:24750b9ad5ef	3846	* ==> ( NewSessionTicket )
Christopher Haster	1:24750b9ad5ef	3847	* ChangeCipherSpec
Christopher Haster	1:24750b9ad5ef	3848	* Finished
Christopher Haster	1:24750b9ad5ef	3849	*/
Christopher Haster	1:24750b9ad5ef	3850	case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
Christopher Haster	1:24750b9ad5ef	3851	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Christopher Haster	1:24750b9ad5ef	3852	if( ssl->handshake->new_session_ticket != 0 )
Christopher Haster	1:24750b9ad5ef	3853	ret = ssl_write_new_session_ticket( ssl );
Christopher Haster	1:24750b9ad5ef	3854	else
Christopher Haster	1:24750b9ad5ef	3855	#endif
Christopher Haster	1:24750b9ad5ef	3856	ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Christopher Haster	1:24750b9ad5ef	3857	break;
Christopher Haster	1:24750b9ad5ef	3858
Christopher Haster	1:24750b9ad5ef	3859	case MBEDTLS_SSL_SERVER_FINISHED:
Christopher Haster	1:24750b9ad5ef	3860	ret = mbedtls_ssl_write_finished( ssl );
Christopher Haster	1:24750b9ad5ef	3861	break;
Christopher Haster	1:24750b9ad5ef	3862
Christopher Haster	1:24750b9ad5ef	3863	case MBEDTLS_SSL_FLUSH_BUFFERS:
Christopher Haster	1:24750b9ad5ef	3864	MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
Christopher Haster	1:24750b9ad5ef	3865	ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Christopher Haster	1:24750b9ad5ef	3866	break;
Christopher Haster	1:24750b9ad5ef	3867
Christopher Haster	1:24750b9ad5ef	3868	case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
Christopher Haster	1:24750b9ad5ef	3869	mbedtls_ssl_handshake_wrapup( ssl );
Christopher Haster	1:24750b9ad5ef	3870	break;
Christopher Haster	1:24750b9ad5ef	3871
Christopher Haster	1:24750b9ad5ef	3872	default:
Christopher Haster	1:24750b9ad5ef	3873	MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
Christopher Haster	1:24750b9ad5ef	3874	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Christopher Haster	1:24750b9ad5ef	3875	}
Christopher Haster	1:24750b9ad5ef	3876
Christopher Haster	1:24750b9ad5ef	3877	return( ret );
Christopher Haster	1:24750b9ad5ef	3878	}
Christopher Haster	1:24750b9ad5ef	3879	#endif /* MBEDTLS_SSL_SRV_C */

Repository toolbox

Export to desktop IDE

Repository details

Type:	Library
Created:	28 Jan 2016
Imports:	47
Forks:	1
Commits:	5
Dependents:	0
Dependencies:	0
Followers:	36

This repository is Public (Unlisted).

The code in this repository is Apache licensed.

source/ssl_srv.c@1:24750b9ad5ef, 2016-01-22 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning