mbedtls ported to mbed-classic
Fork of mbedtls by
source/ssl_srv.c@1:24750b9ad5ef, 2016-01-22 (annotated)
- Committer:
- Christopher Haster
- Date:
- Fri Jan 22 16:44:49 2016 -0600
- Revision:
- 1:24750b9ad5ef
Initial move of mbedtls to mercurial
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
Christopher Haster |
1:24750b9ad5ef | 1 | /* |
Christopher Haster |
1:24750b9ad5ef | 2 | * SSLv3/TLSv1 server-side functions |
Christopher Haster |
1:24750b9ad5ef | 3 | * |
Christopher Haster |
1:24750b9ad5ef | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
Christopher Haster |
1:24750b9ad5ef | 5 | * SPDX-License-Identifier: Apache-2.0 |
Christopher Haster |
1:24750b9ad5ef | 6 | * |
Christopher Haster |
1:24750b9ad5ef | 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
Christopher Haster |
1:24750b9ad5ef | 8 | * not use this file except in compliance with the License. |
Christopher Haster |
1:24750b9ad5ef | 9 | * You may obtain a copy of the License at |
Christopher Haster |
1:24750b9ad5ef | 10 | * |
Christopher Haster |
1:24750b9ad5ef | 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
Christopher Haster |
1:24750b9ad5ef | 12 | * |
Christopher Haster |
1:24750b9ad5ef | 13 | * Unless required by applicable law or agreed to in writing, software |
Christopher Haster |
1:24750b9ad5ef | 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
Christopher Haster |
1:24750b9ad5ef | 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
Christopher Haster |
1:24750b9ad5ef | 16 | * See the License for the specific language governing permissions and |
Christopher Haster |
1:24750b9ad5ef | 17 | * limitations under the License. |
Christopher Haster |
1:24750b9ad5ef | 18 | * |
Christopher Haster |
1:24750b9ad5ef | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
Christopher Haster |
1:24750b9ad5ef | 20 | */ |
Christopher Haster |
1:24750b9ad5ef | 21 | |
Christopher Haster |
1:24750b9ad5ef | 22 | #if !defined(MBEDTLS_CONFIG_FILE) |
Christopher Haster |
1:24750b9ad5ef | 23 | #include "mbedtls/config.h" |
Christopher Haster |
1:24750b9ad5ef | 24 | #else |
Christopher Haster |
1:24750b9ad5ef | 25 | #include MBEDTLS_CONFIG_FILE |
Christopher Haster |
1:24750b9ad5ef | 26 | #endif |
Christopher Haster |
1:24750b9ad5ef | 27 | |
Christopher Haster |
1:24750b9ad5ef | 28 | #if defined(MBEDTLS_SSL_SRV_C) |
Christopher Haster |
1:24750b9ad5ef | 29 | |
Christopher Haster |
1:24750b9ad5ef | 30 | #include "mbedtls/debug.h" |
Christopher Haster |
1:24750b9ad5ef | 31 | #include "mbedtls/ssl.h" |
Christopher Haster |
1:24750b9ad5ef | 32 | #include "mbedtls/ssl_internal.h" |
Christopher Haster |
1:24750b9ad5ef | 33 | |
Christopher Haster |
1:24750b9ad5ef | 34 | #include <string.h> |
Christopher Haster |
1:24750b9ad5ef | 35 | |
Christopher Haster |
1:24750b9ad5ef | 36 | #if defined(MBEDTLS_ECP_C) |
Christopher Haster |
1:24750b9ad5ef | 37 | #include "mbedtls/ecp.h" |
Christopher Haster |
1:24750b9ad5ef | 38 | #endif |
Christopher Haster |
1:24750b9ad5ef | 39 | |
Christopher Haster |
1:24750b9ad5ef | 40 | #if defined(MBEDTLS_PLATFORM_C) |
Christopher Haster |
1:24750b9ad5ef | 41 | #include "mbedtls/platform.h" |
Christopher Haster |
1:24750b9ad5ef | 42 | #else |
Christopher Haster |
1:24750b9ad5ef | 43 | #include <stdlib.h> |
Christopher Haster |
1:24750b9ad5ef | 44 | #define mbedtls_calloc calloc |
Christopher Haster |
1:24750b9ad5ef | 45 | #define mbedtls_free free |
Christopher Haster |
1:24750b9ad5ef | 46 | #endif |
Christopher Haster |
1:24750b9ad5ef | 47 | |
Christopher Haster |
1:24750b9ad5ef | 48 | #if defined(MBEDTLS_HAVE_TIME) |
Christopher Haster |
1:24750b9ad5ef | 49 | #include <time.h> |
Christopher Haster |
1:24750b9ad5ef | 50 | #endif |
Christopher Haster |
1:24750b9ad5ef | 51 | |
Christopher Haster |
1:24750b9ad5ef | 52 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 53 | /* Implementation that should never be optimized out by the compiler */ |
Christopher Haster |
1:24750b9ad5ef | 54 | static void mbedtls_zeroize( void *v, size_t n ) { |
Christopher Haster |
1:24750b9ad5ef | 55 | volatile unsigned char *p = v; while( n-- ) *p++ = 0; |
Christopher Haster |
1:24750b9ad5ef | 56 | } |
Christopher Haster |
1:24750b9ad5ef | 57 | #endif |
Christopher Haster |
1:24750b9ad5ef | 58 | |
Christopher Haster |
1:24750b9ad5ef | 59 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Christopher Haster |
1:24750b9ad5ef | 60 | int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 61 | const unsigned char *info, |
Christopher Haster |
1:24750b9ad5ef | 62 | size_t ilen ) |
Christopher Haster |
1:24750b9ad5ef | 63 | { |
Christopher Haster |
1:24750b9ad5ef | 64 | if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER ) |
Christopher Haster |
1:24750b9ad5ef | 65 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Christopher Haster |
1:24750b9ad5ef | 66 | |
Christopher Haster |
1:24750b9ad5ef | 67 | mbedtls_free( ssl->cli_id ); |
Christopher Haster |
1:24750b9ad5ef | 68 | |
Christopher Haster |
1:24750b9ad5ef | 69 | if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 70 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
Christopher Haster |
1:24750b9ad5ef | 71 | |
Christopher Haster |
1:24750b9ad5ef | 72 | memcpy( ssl->cli_id, info, ilen ); |
Christopher Haster |
1:24750b9ad5ef | 73 | ssl->cli_id_len = ilen; |
Christopher Haster |
1:24750b9ad5ef | 74 | |
Christopher Haster |
1:24750b9ad5ef | 75 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 76 | } |
Christopher Haster |
1:24750b9ad5ef | 77 | |
Christopher Haster |
1:24750b9ad5ef | 78 | void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf, |
Christopher Haster |
1:24750b9ad5ef | 79 | mbedtls_ssl_cookie_write_t *f_cookie_write, |
Christopher Haster |
1:24750b9ad5ef | 80 | mbedtls_ssl_cookie_check_t *f_cookie_check, |
Christopher Haster |
1:24750b9ad5ef | 81 | void *p_cookie ) |
Christopher Haster |
1:24750b9ad5ef | 82 | { |
Christopher Haster |
1:24750b9ad5ef | 83 | conf->f_cookie_write = f_cookie_write; |
Christopher Haster |
1:24750b9ad5ef | 84 | conf->f_cookie_check = f_cookie_check; |
Christopher Haster |
1:24750b9ad5ef | 85 | conf->p_cookie = p_cookie; |
Christopher Haster |
1:24750b9ad5ef | 86 | } |
Christopher Haster |
1:24750b9ad5ef | 87 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Christopher Haster |
1:24750b9ad5ef | 88 | |
Christopher Haster |
1:24750b9ad5ef | 89 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Christopher Haster |
1:24750b9ad5ef | 90 | static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 91 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 92 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 93 | { |
Christopher Haster |
1:24750b9ad5ef | 94 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 95 | size_t servername_list_size, hostname_len; |
Christopher Haster |
1:24750b9ad5ef | 96 | const unsigned char *p; |
Christopher Haster |
1:24750b9ad5ef | 97 | |
Christopher Haster |
1:24750b9ad5ef | 98 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 99 | |
Christopher Haster |
1:24750b9ad5ef | 100 | servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
Christopher Haster |
1:24750b9ad5ef | 101 | if( servername_list_size + 2 != len ) |
Christopher Haster |
1:24750b9ad5ef | 102 | { |
Christopher Haster |
1:24750b9ad5ef | 103 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 104 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 105 | } |
Christopher Haster |
1:24750b9ad5ef | 106 | |
Christopher Haster |
1:24750b9ad5ef | 107 | p = buf + 2; |
Christopher Haster |
1:24750b9ad5ef | 108 | while( servername_list_size > 0 ) |
Christopher Haster |
1:24750b9ad5ef | 109 | { |
Christopher Haster |
1:24750b9ad5ef | 110 | hostname_len = ( ( p[1] << 8 ) | p[2] ); |
Christopher Haster |
1:24750b9ad5ef | 111 | if( hostname_len + 3 > servername_list_size ) |
Christopher Haster |
1:24750b9ad5ef | 112 | { |
Christopher Haster |
1:24750b9ad5ef | 113 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 114 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 115 | } |
Christopher Haster |
1:24750b9ad5ef | 116 | |
Christopher Haster |
1:24750b9ad5ef | 117 | if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) |
Christopher Haster |
1:24750b9ad5ef | 118 | { |
Christopher Haster |
1:24750b9ad5ef | 119 | ret = ssl->conf->f_sni( ssl->conf->p_sni, |
Christopher Haster |
1:24750b9ad5ef | 120 | ssl, p + 3, hostname_len ); |
Christopher Haster |
1:24750b9ad5ef | 121 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 122 | { |
Christopher Haster |
1:24750b9ad5ef | 123 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret ); |
Christopher Haster |
1:24750b9ad5ef | 124 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 125 | MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME ); |
Christopher Haster |
1:24750b9ad5ef | 126 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 127 | } |
Christopher Haster |
1:24750b9ad5ef | 128 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 129 | } |
Christopher Haster |
1:24750b9ad5ef | 130 | |
Christopher Haster |
1:24750b9ad5ef | 131 | servername_list_size -= hostname_len + 3; |
Christopher Haster |
1:24750b9ad5ef | 132 | p += hostname_len + 3; |
Christopher Haster |
1:24750b9ad5ef | 133 | } |
Christopher Haster |
1:24750b9ad5ef | 134 | |
Christopher Haster |
1:24750b9ad5ef | 135 | if( servername_list_size != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 136 | { |
Christopher Haster |
1:24750b9ad5ef | 137 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 138 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 139 | } |
Christopher Haster |
1:24750b9ad5ef | 140 | |
Christopher Haster |
1:24750b9ad5ef | 141 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 142 | } |
Christopher Haster |
1:24750b9ad5ef | 143 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
Christopher Haster |
1:24750b9ad5ef | 144 | |
Christopher Haster |
1:24750b9ad5ef | 145 | static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 146 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 147 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 148 | { |
Christopher Haster |
1:24750b9ad5ef | 149 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 150 | |
Christopher Haster |
1:24750b9ad5ef | 151 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 152 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 153 | { |
Christopher Haster |
1:24750b9ad5ef | 154 | /* Check verify-data in constant-time. The length OTOH is no secret */ |
Christopher Haster |
1:24750b9ad5ef | 155 | if( len != 1 + ssl->verify_data_len || |
Christopher Haster |
1:24750b9ad5ef | 156 | buf[0] != ssl->verify_data_len || |
Christopher Haster |
1:24750b9ad5ef | 157 | mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data, |
Christopher Haster |
1:24750b9ad5ef | 158 | ssl->verify_data_len ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 159 | { |
Christopher Haster |
1:24750b9ad5ef | 160 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) ); |
Christopher Haster |
1:24750b9ad5ef | 161 | |
Christopher Haster |
1:24750b9ad5ef | 162 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 163 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 164 | |
Christopher Haster |
1:24750b9ad5ef | 165 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 166 | } |
Christopher Haster |
1:24750b9ad5ef | 167 | } |
Christopher Haster |
1:24750b9ad5ef | 168 | else |
Christopher Haster |
1:24750b9ad5ef | 169 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Christopher Haster |
1:24750b9ad5ef | 170 | { |
Christopher Haster |
1:24750b9ad5ef | 171 | if( len != 1 || buf[0] != 0x0 ) |
Christopher Haster |
1:24750b9ad5ef | 172 | { |
Christopher Haster |
1:24750b9ad5ef | 173 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) ); |
Christopher Haster |
1:24750b9ad5ef | 174 | |
Christopher Haster |
1:24750b9ad5ef | 175 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 176 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 177 | |
Christopher Haster |
1:24750b9ad5ef | 178 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 179 | } |
Christopher Haster |
1:24750b9ad5ef | 180 | |
Christopher Haster |
1:24750b9ad5ef | 181 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
Christopher Haster |
1:24750b9ad5ef | 182 | } |
Christopher Haster |
1:24750b9ad5ef | 183 | |
Christopher Haster |
1:24750b9ad5ef | 184 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 185 | } |
Christopher Haster |
1:24750b9ad5ef | 186 | |
Christopher Haster |
1:24750b9ad5ef | 187 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
Christopher Haster |
1:24750b9ad5ef | 188 | defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 189 | static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 190 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 191 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 192 | { |
Christopher Haster |
1:24750b9ad5ef | 193 | size_t sig_alg_list_size; |
Christopher Haster |
1:24750b9ad5ef | 194 | const unsigned char *p; |
Christopher Haster |
1:24750b9ad5ef | 195 | const unsigned char *end = buf + len; |
Christopher Haster |
1:24750b9ad5ef | 196 | const int *md_cur; |
Christopher Haster |
1:24750b9ad5ef | 197 | |
Christopher Haster |
1:24750b9ad5ef | 198 | |
Christopher Haster |
1:24750b9ad5ef | 199 | sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
Christopher Haster |
1:24750b9ad5ef | 200 | if( sig_alg_list_size + 2 != len || |
Christopher Haster |
1:24750b9ad5ef | 201 | sig_alg_list_size % 2 != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 202 | { |
Christopher Haster |
1:24750b9ad5ef | 203 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 204 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 205 | } |
Christopher Haster |
1:24750b9ad5ef | 206 | |
Christopher Haster |
1:24750b9ad5ef | 207 | /* |
Christopher Haster |
1:24750b9ad5ef | 208 | * For now, ignore the SignatureAlgorithm part and rely on offered |
Christopher Haster |
1:24750b9ad5ef | 209 | * ciphersuites only for that part. To be fixed later. |
Christopher Haster |
1:24750b9ad5ef | 210 | * |
Christopher Haster |
1:24750b9ad5ef | 211 | * So, just look at the HashAlgorithm part. |
Christopher Haster |
1:24750b9ad5ef | 212 | */ |
Christopher Haster |
1:24750b9ad5ef | 213 | for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) { |
Christopher Haster |
1:24750b9ad5ef | 214 | for( p = buf + 2; p < end; p += 2 ) { |
Christopher Haster |
1:24750b9ad5ef | 215 | if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) { |
Christopher Haster |
1:24750b9ad5ef | 216 | ssl->handshake->sig_alg = p[0]; |
Christopher Haster |
1:24750b9ad5ef | 217 | goto have_sig_alg; |
Christopher Haster |
1:24750b9ad5ef | 218 | } |
Christopher Haster |
1:24750b9ad5ef | 219 | } |
Christopher Haster |
1:24750b9ad5ef | 220 | } |
Christopher Haster |
1:24750b9ad5ef | 221 | |
Christopher Haster |
1:24750b9ad5ef | 222 | /* Some key echanges do not need signatures at all */ |
Christopher Haster |
1:24750b9ad5ef | 223 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) ); |
Christopher Haster |
1:24750b9ad5ef | 224 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 225 | |
Christopher Haster |
1:24750b9ad5ef | 226 | have_sig_alg: |
Christopher Haster |
1:24750b9ad5ef | 227 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d", |
Christopher Haster |
1:24750b9ad5ef | 228 | ssl->handshake->sig_alg ) ); |
Christopher Haster |
1:24750b9ad5ef | 229 | |
Christopher Haster |
1:24750b9ad5ef | 230 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 231 | } |
Christopher Haster |
1:24750b9ad5ef | 232 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
Christopher Haster |
1:24750b9ad5ef | 233 | MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 234 | |
Christopher Haster |
1:24750b9ad5ef | 235 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Christopher Haster |
1:24750b9ad5ef | 236 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 237 | static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 238 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 239 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 240 | { |
Christopher Haster |
1:24750b9ad5ef | 241 | size_t list_size, our_size; |
Christopher Haster |
1:24750b9ad5ef | 242 | const unsigned char *p; |
Christopher Haster |
1:24750b9ad5ef | 243 | const mbedtls_ecp_curve_info *curve_info, **curves; |
Christopher Haster |
1:24750b9ad5ef | 244 | |
Christopher Haster |
1:24750b9ad5ef | 245 | list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
Christopher Haster |
1:24750b9ad5ef | 246 | if( list_size + 2 != len || |
Christopher Haster |
1:24750b9ad5ef | 247 | list_size % 2 != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 248 | { |
Christopher Haster |
1:24750b9ad5ef | 249 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 250 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 251 | } |
Christopher Haster |
1:24750b9ad5ef | 252 | |
Christopher Haster |
1:24750b9ad5ef | 253 | /* Should never happen unless client duplicates the extension */ |
Christopher Haster |
1:24750b9ad5ef | 254 | if( ssl->handshake->curves != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 255 | { |
Christopher Haster |
1:24750b9ad5ef | 256 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 257 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 258 | } |
Christopher Haster |
1:24750b9ad5ef | 259 | |
Christopher Haster |
1:24750b9ad5ef | 260 | /* Don't allow our peer to make us allocate too much memory, |
Christopher Haster |
1:24750b9ad5ef | 261 | * and leave room for a final 0 */ |
Christopher Haster |
1:24750b9ad5ef | 262 | our_size = list_size / 2 + 1; |
Christopher Haster |
1:24750b9ad5ef | 263 | if( our_size > MBEDTLS_ECP_DP_MAX ) |
Christopher Haster |
1:24750b9ad5ef | 264 | our_size = MBEDTLS_ECP_DP_MAX; |
Christopher Haster |
1:24750b9ad5ef | 265 | |
Christopher Haster |
1:24750b9ad5ef | 266 | if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 267 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
Christopher Haster |
1:24750b9ad5ef | 268 | |
Christopher Haster |
1:24750b9ad5ef | 269 | ssl->handshake->curves = curves; |
Christopher Haster |
1:24750b9ad5ef | 270 | |
Christopher Haster |
1:24750b9ad5ef | 271 | p = buf + 2; |
Christopher Haster |
1:24750b9ad5ef | 272 | while( list_size > 0 && our_size > 1 ) |
Christopher Haster |
1:24750b9ad5ef | 273 | { |
Christopher Haster |
1:24750b9ad5ef | 274 | curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] ); |
Christopher Haster |
1:24750b9ad5ef | 275 | |
Christopher Haster |
1:24750b9ad5ef | 276 | if( curve_info != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 277 | { |
Christopher Haster |
1:24750b9ad5ef | 278 | *curves++ = curve_info; |
Christopher Haster |
1:24750b9ad5ef | 279 | our_size--; |
Christopher Haster |
1:24750b9ad5ef | 280 | } |
Christopher Haster |
1:24750b9ad5ef | 281 | |
Christopher Haster |
1:24750b9ad5ef | 282 | list_size -= 2; |
Christopher Haster |
1:24750b9ad5ef | 283 | p += 2; |
Christopher Haster |
1:24750b9ad5ef | 284 | } |
Christopher Haster |
1:24750b9ad5ef | 285 | |
Christopher Haster |
1:24750b9ad5ef | 286 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 287 | } |
Christopher Haster |
1:24750b9ad5ef | 288 | |
Christopher Haster |
1:24750b9ad5ef | 289 | static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 290 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 291 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 292 | { |
Christopher Haster |
1:24750b9ad5ef | 293 | size_t list_size; |
Christopher Haster |
1:24750b9ad5ef | 294 | const unsigned char *p; |
Christopher Haster |
1:24750b9ad5ef | 295 | |
Christopher Haster |
1:24750b9ad5ef | 296 | list_size = buf[0]; |
Christopher Haster |
1:24750b9ad5ef | 297 | if( list_size + 1 != len ) |
Christopher Haster |
1:24750b9ad5ef | 298 | { |
Christopher Haster |
1:24750b9ad5ef | 299 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 300 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 301 | } |
Christopher Haster |
1:24750b9ad5ef | 302 | |
Christopher Haster |
1:24750b9ad5ef | 303 | p = buf + 1; |
Christopher Haster |
1:24750b9ad5ef | 304 | while( list_size > 0 ) |
Christopher Haster |
1:24750b9ad5ef | 305 | { |
Christopher Haster |
1:24750b9ad5ef | 306 | if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || |
Christopher Haster |
1:24750b9ad5ef | 307 | p[0] == MBEDTLS_ECP_PF_COMPRESSED ) |
Christopher Haster |
1:24750b9ad5ef | 308 | { |
Christopher Haster |
1:24750b9ad5ef | 309 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
Christopher Haster |
1:24750b9ad5ef | 310 | ssl->handshake->ecdh_ctx.point_format = p[0]; |
Christopher Haster |
1:24750b9ad5ef | 311 | #endif |
Christopher Haster |
1:24750b9ad5ef | 312 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 313 | ssl->handshake->ecjpake_ctx.point_format = p[0]; |
Christopher Haster |
1:24750b9ad5ef | 314 | #endif |
Christopher Haster |
1:24750b9ad5ef | 315 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) ); |
Christopher Haster |
1:24750b9ad5ef | 316 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 317 | } |
Christopher Haster |
1:24750b9ad5ef | 318 | |
Christopher Haster |
1:24750b9ad5ef | 319 | list_size--; |
Christopher Haster |
1:24750b9ad5ef | 320 | p++; |
Christopher Haster |
1:24750b9ad5ef | 321 | } |
Christopher Haster |
1:24750b9ad5ef | 322 | |
Christopher Haster |
1:24750b9ad5ef | 323 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 324 | } |
Christopher Haster |
1:24750b9ad5ef | 325 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
Christopher Haster |
1:24750b9ad5ef | 326 | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 327 | |
Christopher Haster |
1:24750b9ad5ef | 328 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 329 | static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 330 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 331 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 332 | { |
Christopher Haster |
1:24750b9ad5ef | 333 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 334 | |
Christopher Haster |
1:24750b9ad5ef | 335 | if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 336 | { |
Christopher Haster |
1:24750b9ad5ef | 337 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 338 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 339 | } |
Christopher Haster |
1:24750b9ad5ef | 340 | |
Christopher Haster |
1:24750b9ad5ef | 341 | if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx, |
Christopher Haster |
1:24750b9ad5ef | 342 | buf, len ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 343 | { |
Christopher Haster |
1:24750b9ad5ef | 344 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret ); |
Christopher Haster |
1:24750b9ad5ef | 345 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 346 | } |
Christopher Haster |
1:24750b9ad5ef | 347 | |
Christopher Haster |
1:24750b9ad5ef | 348 | /* Only mark the extension as OK when we're sure it is */ |
Christopher Haster |
1:24750b9ad5ef | 349 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK; |
Christopher Haster |
1:24750b9ad5ef | 350 | |
Christopher Haster |
1:24750b9ad5ef | 351 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 352 | } |
Christopher Haster |
1:24750b9ad5ef | 353 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 354 | |
Christopher Haster |
1:24750b9ad5ef | 355 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Christopher Haster |
1:24750b9ad5ef | 356 | static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 357 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 358 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 359 | { |
Christopher Haster |
1:24750b9ad5ef | 360 | if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ) |
Christopher Haster |
1:24750b9ad5ef | 361 | { |
Christopher Haster |
1:24750b9ad5ef | 362 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 363 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 364 | } |
Christopher Haster |
1:24750b9ad5ef | 365 | |
Christopher Haster |
1:24750b9ad5ef | 366 | ssl->session_negotiate->mfl_code = buf[0]; |
Christopher Haster |
1:24750b9ad5ef | 367 | |
Christopher Haster |
1:24750b9ad5ef | 368 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 369 | } |
Christopher Haster |
1:24750b9ad5ef | 370 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Christopher Haster |
1:24750b9ad5ef | 371 | |
Christopher Haster |
1:24750b9ad5ef | 372 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Christopher Haster |
1:24750b9ad5ef | 373 | static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 374 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 375 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 376 | { |
Christopher Haster |
1:24750b9ad5ef | 377 | if( len != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 378 | { |
Christopher Haster |
1:24750b9ad5ef | 379 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 380 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 381 | } |
Christopher Haster |
1:24750b9ad5ef | 382 | |
Christopher Haster |
1:24750b9ad5ef | 383 | ((void) buf); |
Christopher Haster |
1:24750b9ad5ef | 384 | |
Christopher Haster |
1:24750b9ad5ef | 385 | if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED ) |
Christopher Haster |
1:24750b9ad5ef | 386 | ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; |
Christopher Haster |
1:24750b9ad5ef | 387 | |
Christopher Haster |
1:24750b9ad5ef | 388 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 389 | } |
Christopher Haster |
1:24750b9ad5ef | 390 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
Christopher Haster |
1:24750b9ad5ef | 391 | |
Christopher Haster |
1:24750b9ad5ef | 392 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Christopher Haster |
1:24750b9ad5ef | 393 | static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 394 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 395 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 396 | { |
Christopher Haster |
1:24750b9ad5ef | 397 | if( len != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 398 | { |
Christopher Haster |
1:24750b9ad5ef | 399 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 400 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 401 | } |
Christopher Haster |
1:24750b9ad5ef | 402 | |
Christopher Haster |
1:24750b9ad5ef | 403 | ((void) buf); |
Christopher Haster |
1:24750b9ad5ef | 404 | |
Christopher Haster |
1:24750b9ad5ef | 405 | if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 406 | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
Christopher Haster |
1:24750b9ad5ef | 407 | { |
Christopher Haster |
1:24750b9ad5ef | 408 | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; |
Christopher Haster |
1:24750b9ad5ef | 409 | } |
Christopher Haster |
1:24750b9ad5ef | 410 | |
Christopher Haster |
1:24750b9ad5ef | 411 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 412 | } |
Christopher Haster |
1:24750b9ad5ef | 413 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
Christopher Haster |
1:24750b9ad5ef | 414 | |
Christopher Haster |
1:24750b9ad5ef | 415 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Christopher Haster |
1:24750b9ad5ef | 416 | static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 417 | const unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 418 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 419 | { |
Christopher Haster |
1:24750b9ad5ef | 420 | if( len != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 421 | { |
Christopher Haster |
1:24750b9ad5ef | 422 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 423 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 424 | } |
Christopher Haster |
1:24750b9ad5ef | 425 | |
Christopher Haster |
1:24750b9ad5ef | 426 | ((void) buf); |
Christopher Haster |
1:24750b9ad5ef | 427 | |
Christopher Haster |
1:24750b9ad5ef | 428 | if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 429 | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
Christopher Haster |
1:24750b9ad5ef | 430 | { |
Christopher Haster |
1:24750b9ad5ef | 431 | ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; |
Christopher Haster |
1:24750b9ad5ef | 432 | } |
Christopher Haster |
1:24750b9ad5ef | 433 | |
Christopher Haster |
1:24750b9ad5ef | 434 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 435 | } |
Christopher Haster |
1:24750b9ad5ef | 436 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
Christopher Haster |
1:24750b9ad5ef | 437 | |
Christopher Haster |
1:24750b9ad5ef | 438 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 439 | static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 440 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 441 | size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 442 | { |
Christopher Haster |
1:24750b9ad5ef | 443 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 444 | mbedtls_ssl_session session; |
Christopher Haster |
1:24750b9ad5ef | 445 | |
Christopher Haster |
1:24750b9ad5ef | 446 | mbedtls_ssl_session_init( &session ); |
Christopher Haster |
1:24750b9ad5ef | 447 | |
Christopher Haster |
1:24750b9ad5ef | 448 | if( ssl->conf->f_ticket_parse == NULL || |
Christopher Haster |
1:24750b9ad5ef | 449 | ssl->conf->f_ticket_write == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 450 | { |
Christopher Haster |
1:24750b9ad5ef | 451 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 452 | } |
Christopher Haster |
1:24750b9ad5ef | 453 | |
Christopher Haster |
1:24750b9ad5ef | 454 | /* Remember the client asked us to send a new ticket */ |
Christopher Haster |
1:24750b9ad5ef | 455 | ssl->handshake->new_session_ticket = 1; |
Christopher Haster |
1:24750b9ad5ef | 456 | |
Christopher Haster |
1:24750b9ad5ef | 457 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) ); |
Christopher Haster |
1:24750b9ad5ef | 458 | |
Christopher Haster |
1:24750b9ad5ef | 459 | if( len == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 460 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 461 | |
Christopher Haster |
1:24750b9ad5ef | 462 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 463 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 464 | { |
Christopher Haster |
1:24750b9ad5ef | 465 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) ); |
Christopher Haster |
1:24750b9ad5ef | 466 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 467 | } |
Christopher Haster |
1:24750b9ad5ef | 468 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Christopher Haster |
1:24750b9ad5ef | 469 | |
Christopher Haster |
1:24750b9ad5ef | 470 | /* |
Christopher Haster |
1:24750b9ad5ef | 471 | * Failures are ok: just ignore the ticket and proceed. |
Christopher Haster |
1:24750b9ad5ef | 472 | */ |
Christopher Haster |
1:24750b9ad5ef | 473 | if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session, |
Christopher Haster |
1:24750b9ad5ef | 474 | buf, len ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 475 | { |
Christopher Haster |
1:24750b9ad5ef | 476 | mbedtls_ssl_session_free( &session ); |
Christopher Haster |
1:24750b9ad5ef | 477 | |
Christopher Haster |
1:24750b9ad5ef | 478 | if( ret == MBEDTLS_ERR_SSL_INVALID_MAC ) |
Christopher Haster |
1:24750b9ad5ef | 479 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) ); |
Christopher Haster |
1:24750b9ad5ef | 480 | else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED ) |
Christopher Haster |
1:24750b9ad5ef | 481 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) ); |
Christopher Haster |
1:24750b9ad5ef | 482 | else |
Christopher Haster |
1:24750b9ad5ef | 483 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret ); |
Christopher Haster |
1:24750b9ad5ef | 484 | |
Christopher Haster |
1:24750b9ad5ef | 485 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 486 | } |
Christopher Haster |
1:24750b9ad5ef | 487 | |
Christopher Haster |
1:24750b9ad5ef | 488 | /* |
Christopher Haster |
1:24750b9ad5ef | 489 | * Keep the session ID sent by the client, since we MUST send it back to |
Christopher Haster |
1:24750b9ad5ef | 490 | * inform them we're accepting the ticket (RFC 5077 section 3.4) |
Christopher Haster |
1:24750b9ad5ef | 491 | */ |
Christopher Haster |
1:24750b9ad5ef | 492 | session.id_len = ssl->session_negotiate->id_len; |
Christopher Haster |
1:24750b9ad5ef | 493 | memcpy( &session.id, ssl->session_negotiate->id, session.id_len ); |
Christopher Haster |
1:24750b9ad5ef | 494 | |
Christopher Haster |
1:24750b9ad5ef | 495 | mbedtls_ssl_session_free( ssl->session_negotiate ); |
Christopher Haster |
1:24750b9ad5ef | 496 | memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) ); |
Christopher Haster |
1:24750b9ad5ef | 497 | |
Christopher Haster |
1:24750b9ad5ef | 498 | /* Zeroize instead of free as we copied the content */ |
Christopher Haster |
1:24750b9ad5ef | 499 | mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) ); |
Christopher Haster |
1:24750b9ad5ef | 500 | |
Christopher Haster |
1:24750b9ad5ef | 501 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) ); |
Christopher Haster |
1:24750b9ad5ef | 502 | |
Christopher Haster |
1:24750b9ad5ef | 503 | ssl->handshake->resume = 1; |
Christopher Haster |
1:24750b9ad5ef | 504 | |
Christopher Haster |
1:24750b9ad5ef | 505 | /* Don't send a new ticket after all, this one is OK */ |
Christopher Haster |
1:24750b9ad5ef | 506 | ssl->handshake->new_session_ticket = 0; |
Christopher Haster |
1:24750b9ad5ef | 507 | |
Christopher Haster |
1:24750b9ad5ef | 508 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 509 | } |
Christopher Haster |
1:24750b9ad5ef | 510 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Christopher Haster |
1:24750b9ad5ef | 511 | |
Christopher Haster |
1:24750b9ad5ef | 512 | #if defined(MBEDTLS_SSL_ALPN) |
Christopher Haster |
1:24750b9ad5ef | 513 | static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 514 | const unsigned char *buf, size_t len ) |
Christopher Haster |
1:24750b9ad5ef | 515 | { |
Christopher Haster |
1:24750b9ad5ef | 516 | size_t list_len, cur_len, ours_len; |
Christopher Haster |
1:24750b9ad5ef | 517 | const unsigned char *theirs, *start, *end; |
Christopher Haster |
1:24750b9ad5ef | 518 | const char **ours; |
Christopher Haster |
1:24750b9ad5ef | 519 | |
Christopher Haster |
1:24750b9ad5ef | 520 | /* If ALPN not configured, just ignore the extension */ |
Christopher Haster |
1:24750b9ad5ef | 521 | if( ssl->conf->alpn_list == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 522 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 523 | |
Christopher Haster |
1:24750b9ad5ef | 524 | /* |
Christopher Haster |
1:24750b9ad5ef | 525 | * opaque ProtocolName<1..2^8-1>; |
Christopher Haster |
1:24750b9ad5ef | 526 | * |
Christopher Haster |
1:24750b9ad5ef | 527 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 528 | * ProtocolName protocol_name_list<2..2^16-1> |
Christopher Haster |
1:24750b9ad5ef | 529 | * } ProtocolNameList; |
Christopher Haster |
1:24750b9ad5ef | 530 | */ |
Christopher Haster |
1:24750b9ad5ef | 531 | |
Christopher Haster |
1:24750b9ad5ef | 532 | /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */ |
Christopher Haster |
1:24750b9ad5ef | 533 | if( len < 4 ) |
Christopher Haster |
1:24750b9ad5ef | 534 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 535 | |
Christopher Haster |
1:24750b9ad5ef | 536 | list_len = ( buf[0] << 8 ) | buf[1]; |
Christopher Haster |
1:24750b9ad5ef | 537 | if( list_len != len - 2 ) |
Christopher Haster |
1:24750b9ad5ef | 538 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 539 | |
Christopher Haster |
1:24750b9ad5ef | 540 | /* |
Christopher Haster |
1:24750b9ad5ef | 541 | * Use our order of preference |
Christopher Haster |
1:24750b9ad5ef | 542 | */ |
Christopher Haster |
1:24750b9ad5ef | 543 | start = buf + 2; |
Christopher Haster |
1:24750b9ad5ef | 544 | end = buf + len; |
Christopher Haster |
1:24750b9ad5ef | 545 | for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ ) |
Christopher Haster |
1:24750b9ad5ef | 546 | { |
Christopher Haster |
1:24750b9ad5ef | 547 | ours_len = strlen( *ours ); |
Christopher Haster |
1:24750b9ad5ef | 548 | for( theirs = start; theirs != end; theirs += cur_len ) |
Christopher Haster |
1:24750b9ad5ef | 549 | { |
Christopher Haster |
1:24750b9ad5ef | 550 | /* If the list is well formed, we should get equality first */ |
Christopher Haster |
1:24750b9ad5ef | 551 | if( theirs > end ) |
Christopher Haster |
1:24750b9ad5ef | 552 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 553 | |
Christopher Haster |
1:24750b9ad5ef | 554 | cur_len = *theirs++; |
Christopher Haster |
1:24750b9ad5ef | 555 | |
Christopher Haster |
1:24750b9ad5ef | 556 | /* Empty strings MUST NOT be included */ |
Christopher Haster |
1:24750b9ad5ef | 557 | if( cur_len == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 558 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 559 | |
Christopher Haster |
1:24750b9ad5ef | 560 | if( cur_len == ours_len && |
Christopher Haster |
1:24750b9ad5ef | 561 | memcmp( theirs, *ours, cur_len ) == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 562 | { |
Christopher Haster |
1:24750b9ad5ef | 563 | ssl->alpn_chosen = *ours; |
Christopher Haster |
1:24750b9ad5ef | 564 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 565 | } |
Christopher Haster |
1:24750b9ad5ef | 566 | } |
Christopher Haster |
1:24750b9ad5ef | 567 | } |
Christopher Haster |
1:24750b9ad5ef | 568 | |
Christopher Haster |
1:24750b9ad5ef | 569 | /* If we get there, no match was found */ |
Christopher Haster |
1:24750b9ad5ef | 570 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 571 | MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL ); |
Christopher Haster |
1:24750b9ad5ef | 572 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 573 | } |
Christopher Haster |
1:24750b9ad5ef | 574 | #endif /* MBEDTLS_SSL_ALPN */ |
Christopher Haster |
1:24750b9ad5ef | 575 | |
Christopher Haster |
1:24750b9ad5ef | 576 | /* |
Christopher Haster |
1:24750b9ad5ef | 577 | * Auxiliary functions for ServerHello parsing and related actions |
Christopher Haster |
1:24750b9ad5ef | 578 | */ |
Christopher Haster |
1:24750b9ad5ef | 579 | |
Christopher Haster |
1:24750b9ad5ef | 580 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Christopher Haster |
1:24750b9ad5ef | 581 | /* |
Christopher Haster |
1:24750b9ad5ef | 582 | * Return 0 if the given key uses one of the acceptable curves, -1 otherwise |
Christopher Haster |
1:24750b9ad5ef | 583 | */ |
Christopher Haster |
1:24750b9ad5ef | 584 | #if defined(MBEDTLS_ECDSA_C) |
Christopher Haster |
1:24750b9ad5ef | 585 | static int ssl_check_key_curve( mbedtls_pk_context *pk, |
Christopher Haster |
1:24750b9ad5ef | 586 | const mbedtls_ecp_curve_info **curves ) |
Christopher Haster |
1:24750b9ad5ef | 587 | { |
Christopher Haster |
1:24750b9ad5ef | 588 | const mbedtls_ecp_curve_info **crv = curves; |
Christopher Haster |
1:24750b9ad5ef | 589 | mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id; |
Christopher Haster |
1:24750b9ad5ef | 590 | |
Christopher Haster |
1:24750b9ad5ef | 591 | while( *crv != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 592 | { |
Christopher Haster |
1:24750b9ad5ef | 593 | if( (*crv)->grp_id == grp_id ) |
Christopher Haster |
1:24750b9ad5ef | 594 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 595 | crv++; |
Christopher Haster |
1:24750b9ad5ef | 596 | } |
Christopher Haster |
1:24750b9ad5ef | 597 | |
Christopher Haster |
1:24750b9ad5ef | 598 | return( -1 ); |
Christopher Haster |
1:24750b9ad5ef | 599 | } |
Christopher Haster |
1:24750b9ad5ef | 600 | #endif /* MBEDTLS_ECDSA_C */ |
Christopher Haster |
1:24750b9ad5ef | 601 | |
Christopher Haster |
1:24750b9ad5ef | 602 | /* |
Christopher Haster |
1:24750b9ad5ef | 603 | * Try picking a certificate for this ciphersuite, |
Christopher Haster |
1:24750b9ad5ef | 604 | * return 0 on success and -1 on failure. |
Christopher Haster |
1:24750b9ad5ef | 605 | */ |
Christopher Haster |
1:24750b9ad5ef | 606 | static int ssl_pick_cert( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 607 | const mbedtls_ssl_ciphersuite_t * ciphersuite_info ) |
Christopher Haster |
1:24750b9ad5ef | 608 | { |
Christopher Haster |
1:24750b9ad5ef | 609 | mbedtls_ssl_key_cert *cur, *list, *fallback = NULL; |
Christopher Haster |
1:24750b9ad5ef | 610 | mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ); |
Christopher Haster |
1:24750b9ad5ef | 611 | uint32_t flags; |
Christopher Haster |
1:24750b9ad5ef | 612 | |
Christopher Haster |
1:24750b9ad5ef | 613 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Christopher Haster |
1:24750b9ad5ef | 614 | if( ssl->handshake->sni_key_cert != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 615 | list = ssl->handshake->sni_key_cert; |
Christopher Haster |
1:24750b9ad5ef | 616 | else |
Christopher Haster |
1:24750b9ad5ef | 617 | #endif |
Christopher Haster |
1:24750b9ad5ef | 618 | list = ssl->conf->key_cert; |
Christopher Haster |
1:24750b9ad5ef | 619 | |
Christopher Haster |
1:24750b9ad5ef | 620 | if( pk_alg == MBEDTLS_PK_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 621 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 622 | |
Christopher Haster |
1:24750b9ad5ef | 623 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) ); |
Christopher Haster |
1:24750b9ad5ef | 624 | |
Christopher Haster |
1:24750b9ad5ef | 625 | if( list == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 626 | { |
Christopher Haster |
1:24750b9ad5ef | 627 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) ); |
Christopher Haster |
1:24750b9ad5ef | 628 | return( -1 ); |
Christopher Haster |
1:24750b9ad5ef | 629 | } |
Christopher Haster |
1:24750b9ad5ef | 630 | |
Christopher Haster |
1:24750b9ad5ef | 631 | for( cur = list; cur != NULL; cur = cur->next ) |
Christopher Haster |
1:24750b9ad5ef | 632 | { |
Christopher Haster |
1:24750b9ad5ef | 633 | MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate", |
Christopher Haster |
1:24750b9ad5ef | 634 | cur->cert ); |
Christopher Haster |
1:24750b9ad5ef | 635 | |
Christopher Haster |
1:24750b9ad5ef | 636 | if( ! mbedtls_pk_can_do( cur->key, pk_alg ) ) |
Christopher Haster |
1:24750b9ad5ef | 637 | { |
Christopher Haster |
1:24750b9ad5ef | 638 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) ); |
Christopher Haster |
1:24750b9ad5ef | 639 | continue; |
Christopher Haster |
1:24750b9ad5ef | 640 | } |
Christopher Haster |
1:24750b9ad5ef | 641 | |
Christopher Haster |
1:24750b9ad5ef | 642 | /* |
Christopher Haster |
1:24750b9ad5ef | 643 | * This avoids sending the client a cert it'll reject based on |
Christopher Haster |
1:24750b9ad5ef | 644 | * keyUsage or other extensions. |
Christopher Haster |
1:24750b9ad5ef | 645 | * |
Christopher Haster |
1:24750b9ad5ef | 646 | * It also allows the user to provision different certificates for |
Christopher Haster |
1:24750b9ad5ef | 647 | * different uses based on keyUsage, eg if they want to avoid signing |
Christopher Haster |
1:24750b9ad5ef | 648 | * and decrypting with the same RSA key. |
Christopher Haster |
1:24750b9ad5ef | 649 | */ |
Christopher Haster |
1:24750b9ad5ef | 650 | if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info, |
Christopher Haster |
1:24750b9ad5ef | 651 | MBEDTLS_SSL_IS_SERVER, &flags ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 652 | { |
Christopher Haster |
1:24750b9ad5ef | 653 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: " |
Christopher Haster |
1:24750b9ad5ef | 654 | "(extended) key usage extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 655 | continue; |
Christopher Haster |
1:24750b9ad5ef | 656 | } |
Christopher Haster |
1:24750b9ad5ef | 657 | |
Christopher Haster |
1:24750b9ad5ef | 658 | #if defined(MBEDTLS_ECDSA_C) |
Christopher Haster |
1:24750b9ad5ef | 659 | if( pk_alg == MBEDTLS_PK_ECDSA && |
Christopher Haster |
1:24750b9ad5ef | 660 | ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 661 | { |
Christopher Haster |
1:24750b9ad5ef | 662 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) ); |
Christopher Haster |
1:24750b9ad5ef | 663 | continue; |
Christopher Haster |
1:24750b9ad5ef | 664 | } |
Christopher Haster |
1:24750b9ad5ef | 665 | #endif |
Christopher Haster |
1:24750b9ad5ef | 666 | |
Christopher Haster |
1:24750b9ad5ef | 667 | /* |
Christopher Haster |
1:24750b9ad5ef | 668 | * Try to select a SHA-1 certificate for pre-1.2 clients, but still |
Christopher Haster |
1:24750b9ad5ef | 669 | * present them a SHA-higher cert rather than failing if it's the only |
Christopher Haster |
1:24750b9ad5ef | 670 | * one we got that satisfies the other conditions. |
Christopher Haster |
1:24750b9ad5ef | 671 | */ |
Christopher Haster |
1:24750b9ad5ef | 672 | if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 && |
Christopher Haster |
1:24750b9ad5ef | 673 | cur->cert->sig_md != MBEDTLS_MD_SHA1 ) |
Christopher Haster |
1:24750b9ad5ef | 674 | { |
Christopher Haster |
1:24750b9ad5ef | 675 | if( fallback == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 676 | fallback = cur; |
Christopher Haster |
1:24750b9ad5ef | 677 | { |
Christopher Haster |
1:24750b9ad5ef | 678 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: " |
Christopher Haster |
1:24750b9ad5ef | 679 | "sha-2 with pre-TLS 1.2 client" ) ); |
Christopher Haster |
1:24750b9ad5ef | 680 | continue; |
Christopher Haster |
1:24750b9ad5ef | 681 | } |
Christopher Haster |
1:24750b9ad5ef | 682 | } |
Christopher Haster |
1:24750b9ad5ef | 683 | |
Christopher Haster |
1:24750b9ad5ef | 684 | /* If we get there, we got a winner */ |
Christopher Haster |
1:24750b9ad5ef | 685 | break; |
Christopher Haster |
1:24750b9ad5ef | 686 | } |
Christopher Haster |
1:24750b9ad5ef | 687 | |
Christopher Haster |
1:24750b9ad5ef | 688 | if( cur == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 689 | cur = fallback; |
Christopher Haster |
1:24750b9ad5ef | 690 | |
Christopher Haster |
1:24750b9ad5ef | 691 | /* Do not update ssl->handshake->key_cert unless there is a match */ |
Christopher Haster |
1:24750b9ad5ef | 692 | if( cur != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 693 | { |
Christopher Haster |
1:24750b9ad5ef | 694 | ssl->handshake->key_cert = cur; |
Christopher Haster |
1:24750b9ad5ef | 695 | MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate", |
Christopher Haster |
1:24750b9ad5ef | 696 | ssl->handshake->key_cert->cert ); |
Christopher Haster |
1:24750b9ad5ef | 697 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 698 | } |
Christopher Haster |
1:24750b9ad5ef | 699 | |
Christopher Haster |
1:24750b9ad5ef | 700 | return( -1 ); |
Christopher Haster |
1:24750b9ad5ef | 701 | } |
Christopher Haster |
1:24750b9ad5ef | 702 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
Christopher Haster |
1:24750b9ad5ef | 703 | |
Christopher Haster |
1:24750b9ad5ef | 704 | /* |
Christopher Haster |
1:24750b9ad5ef | 705 | * Check if a given ciphersuite is suitable for use with our config/keys/etc |
Christopher Haster |
1:24750b9ad5ef | 706 | * Sets ciphersuite_info only if the suite matches. |
Christopher Haster |
1:24750b9ad5ef | 707 | */ |
Christopher Haster |
1:24750b9ad5ef | 708 | static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id, |
Christopher Haster |
1:24750b9ad5ef | 709 | const mbedtls_ssl_ciphersuite_t **ciphersuite_info ) |
Christopher Haster |
1:24750b9ad5ef | 710 | { |
Christopher Haster |
1:24750b9ad5ef | 711 | const mbedtls_ssl_ciphersuite_t *suite_info; |
Christopher Haster |
1:24750b9ad5ef | 712 | |
Christopher Haster |
1:24750b9ad5ef | 713 | suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id ); |
Christopher Haster |
1:24750b9ad5ef | 714 | if( suite_info == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 715 | { |
Christopher Haster |
1:24750b9ad5ef | 716 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 717 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 718 | } |
Christopher Haster |
1:24750b9ad5ef | 719 | |
Christopher Haster |
1:24750b9ad5ef | 720 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) ); |
Christopher Haster |
1:24750b9ad5ef | 721 | |
Christopher Haster |
1:24750b9ad5ef | 722 | if( suite_info->min_minor_ver > ssl->minor_ver || |
Christopher Haster |
1:24750b9ad5ef | 723 | suite_info->max_minor_ver < ssl->minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 724 | { |
Christopher Haster |
1:24750b9ad5ef | 725 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) ); |
Christopher Haster |
1:24750b9ad5ef | 726 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 727 | } |
Christopher Haster |
1:24750b9ad5ef | 728 | |
Christopher Haster |
1:24750b9ad5ef | 729 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 730 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
Christopher Haster |
1:24750b9ad5ef | 731 | ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) ) |
Christopher Haster |
1:24750b9ad5ef | 732 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 733 | #endif |
Christopher Haster |
1:24750b9ad5ef | 734 | |
Christopher Haster |
1:24750b9ad5ef | 735 | #if defined(MBEDTLS_ARC4_C) |
Christopher Haster |
1:24750b9ad5ef | 736 | if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED && |
Christopher Haster |
1:24750b9ad5ef | 737 | suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 ) |
Christopher Haster |
1:24750b9ad5ef | 738 | { |
Christopher Haster |
1:24750b9ad5ef | 739 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) ); |
Christopher Haster |
1:24750b9ad5ef | 740 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 741 | } |
Christopher Haster |
1:24750b9ad5ef | 742 | #endif |
Christopher Haster |
1:24750b9ad5ef | 743 | |
Christopher Haster |
1:24750b9ad5ef | 744 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 745 | if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && |
Christopher Haster |
1:24750b9ad5ef | 746 | ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 747 | { |
Christopher Haster |
1:24750b9ad5ef | 748 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake " |
Christopher Haster |
1:24750b9ad5ef | 749 | "not configured or ext missing" ) ); |
Christopher Haster |
1:24750b9ad5ef | 750 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 751 | } |
Christopher Haster |
1:24750b9ad5ef | 752 | #endif |
Christopher Haster |
1:24750b9ad5ef | 753 | |
Christopher Haster |
1:24750b9ad5ef | 754 | |
Christopher Haster |
1:24750b9ad5ef | 755 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
Christopher Haster |
1:24750b9ad5ef | 756 | if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) && |
Christopher Haster |
1:24750b9ad5ef | 757 | ( ssl->handshake->curves == NULL || |
Christopher Haster |
1:24750b9ad5ef | 758 | ssl->handshake->curves[0] == NULL ) ) |
Christopher Haster |
1:24750b9ad5ef | 759 | { |
Christopher Haster |
1:24750b9ad5ef | 760 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: " |
Christopher Haster |
1:24750b9ad5ef | 761 | "no common elliptic curve" ) ); |
Christopher Haster |
1:24750b9ad5ef | 762 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 763 | } |
Christopher Haster |
1:24750b9ad5ef | 764 | #endif |
Christopher Haster |
1:24750b9ad5ef | 765 | |
Christopher Haster |
1:24750b9ad5ef | 766 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 767 | /* If the ciphersuite requires a pre-shared key and we don't |
Christopher Haster |
1:24750b9ad5ef | 768 | * have one, skip it now rather than failing later */ |
Christopher Haster |
1:24750b9ad5ef | 769 | if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) && |
Christopher Haster |
1:24750b9ad5ef | 770 | ssl->conf->f_psk == NULL && |
Christopher Haster |
1:24750b9ad5ef | 771 | ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL || |
Christopher Haster |
1:24750b9ad5ef | 772 | ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) ) |
Christopher Haster |
1:24750b9ad5ef | 773 | { |
Christopher Haster |
1:24750b9ad5ef | 774 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) ); |
Christopher Haster |
1:24750b9ad5ef | 775 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 776 | } |
Christopher Haster |
1:24750b9ad5ef | 777 | #endif |
Christopher Haster |
1:24750b9ad5ef | 778 | |
Christopher Haster |
1:24750b9ad5ef | 779 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
Christopher Haster |
1:24750b9ad5ef | 780 | /* |
Christopher Haster |
1:24750b9ad5ef | 781 | * Final check: if ciphersuite requires us to have a |
Christopher Haster |
1:24750b9ad5ef | 782 | * certificate/key of a particular type: |
Christopher Haster |
1:24750b9ad5ef | 783 | * - select the appropriate certificate if we have one, or |
Christopher Haster |
1:24750b9ad5ef | 784 | * - try the next ciphersuite if we don't |
Christopher Haster |
1:24750b9ad5ef | 785 | * This must be done last since we modify the key_cert list. |
Christopher Haster |
1:24750b9ad5ef | 786 | */ |
Christopher Haster |
1:24750b9ad5ef | 787 | if( ssl_pick_cert( ssl, suite_info ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 788 | { |
Christopher Haster |
1:24750b9ad5ef | 789 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: " |
Christopher Haster |
1:24750b9ad5ef | 790 | "no suitable certificate" ) ); |
Christopher Haster |
1:24750b9ad5ef | 791 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 792 | } |
Christopher Haster |
1:24750b9ad5ef | 793 | #endif |
Christopher Haster |
1:24750b9ad5ef | 794 | |
Christopher Haster |
1:24750b9ad5ef | 795 | *ciphersuite_info = suite_info; |
Christopher Haster |
1:24750b9ad5ef | 796 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 797 | } |
Christopher Haster |
1:24750b9ad5ef | 798 | |
Christopher Haster |
1:24750b9ad5ef | 799 | #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) |
Christopher Haster |
1:24750b9ad5ef | 800 | static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 801 | { |
Christopher Haster |
1:24750b9ad5ef | 802 | int ret, got_common_suite; |
Christopher Haster |
1:24750b9ad5ef | 803 | unsigned int i, j; |
Christopher Haster |
1:24750b9ad5ef | 804 | size_t n; |
Christopher Haster |
1:24750b9ad5ef | 805 | unsigned int ciph_len, sess_len, chal_len; |
Christopher Haster |
1:24750b9ad5ef | 806 | unsigned char *buf, *p; |
Christopher Haster |
1:24750b9ad5ef | 807 | const int *ciphersuites; |
Christopher Haster |
1:24750b9ad5ef | 808 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 809 | |
Christopher Haster |
1:24750b9ad5ef | 810 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) ); |
Christopher Haster |
1:24750b9ad5ef | 811 | |
Christopher Haster |
1:24750b9ad5ef | 812 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 813 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 814 | { |
Christopher Haster |
1:24750b9ad5ef | 815 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) ); |
Christopher Haster |
1:24750b9ad5ef | 816 | |
Christopher Haster |
1:24750b9ad5ef | 817 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 818 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 819 | |
Christopher Haster |
1:24750b9ad5ef | 820 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 821 | } |
Christopher Haster |
1:24750b9ad5ef | 822 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Christopher Haster |
1:24750b9ad5ef | 823 | |
Christopher Haster |
1:24750b9ad5ef | 824 | buf = ssl->in_hdr; |
Christopher Haster |
1:24750b9ad5ef | 825 | |
Christopher Haster |
1:24750b9ad5ef | 826 | MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 ); |
Christopher Haster |
1:24750b9ad5ef | 827 | |
Christopher Haster |
1:24750b9ad5ef | 828 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d", |
Christopher Haster |
1:24750b9ad5ef | 829 | buf[2] ) ); |
Christopher Haster |
1:24750b9ad5ef | 830 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d", |
Christopher Haster |
1:24750b9ad5ef | 831 | ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) ); |
Christopher Haster |
1:24750b9ad5ef | 832 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]", |
Christopher Haster |
1:24750b9ad5ef | 833 | buf[3], buf[4] ) ); |
Christopher Haster |
1:24750b9ad5ef | 834 | |
Christopher Haster |
1:24750b9ad5ef | 835 | /* |
Christopher Haster |
1:24750b9ad5ef | 836 | * SSLv2 Client Hello |
Christopher Haster |
1:24750b9ad5ef | 837 | * |
Christopher Haster |
1:24750b9ad5ef | 838 | * Record layer: |
Christopher Haster |
1:24750b9ad5ef | 839 | * 0 . 1 message length |
Christopher Haster |
1:24750b9ad5ef | 840 | * |
Christopher Haster |
1:24750b9ad5ef | 841 | * SSL layer: |
Christopher Haster |
1:24750b9ad5ef | 842 | * 2 . 2 message type |
Christopher Haster |
1:24750b9ad5ef | 843 | * 3 . 4 protocol version |
Christopher Haster |
1:24750b9ad5ef | 844 | */ |
Christopher Haster |
1:24750b9ad5ef | 845 | if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO || |
Christopher Haster |
1:24750b9ad5ef | 846 | buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 847 | { |
Christopher Haster |
1:24750b9ad5ef | 848 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 849 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 850 | } |
Christopher Haster |
1:24750b9ad5ef | 851 | |
Christopher Haster |
1:24750b9ad5ef | 852 | n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF; |
Christopher Haster |
1:24750b9ad5ef | 853 | |
Christopher Haster |
1:24750b9ad5ef | 854 | if( n < 17 || n > 512 ) |
Christopher Haster |
1:24750b9ad5ef | 855 | { |
Christopher Haster |
1:24750b9ad5ef | 856 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 857 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 858 | } |
Christopher Haster |
1:24750b9ad5ef | 859 | |
Christopher Haster |
1:24750b9ad5ef | 860 | ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; |
Christopher Haster |
1:24750b9ad5ef | 861 | ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 862 | ? buf[4] : ssl->conf->max_minor_ver; |
Christopher Haster |
1:24750b9ad5ef | 863 | |
Christopher Haster |
1:24750b9ad5ef | 864 | if( ssl->minor_ver < ssl->conf->min_minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 865 | { |
Christopher Haster |
1:24750b9ad5ef | 866 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum" |
Christopher Haster |
1:24750b9ad5ef | 867 | " [%d:%d] < [%d:%d]", |
Christopher Haster |
1:24750b9ad5ef | 868 | ssl->major_ver, ssl->minor_ver, |
Christopher Haster |
1:24750b9ad5ef | 869 | ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) ); |
Christopher Haster |
1:24750b9ad5ef | 870 | |
Christopher Haster |
1:24750b9ad5ef | 871 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 872 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); |
Christopher Haster |
1:24750b9ad5ef | 873 | return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION ); |
Christopher Haster |
1:24750b9ad5ef | 874 | } |
Christopher Haster |
1:24750b9ad5ef | 875 | |
Christopher Haster |
1:24750b9ad5ef | 876 | ssl->handshake->max_major_ver = buf[3]; |
Christopher Haster |
1:24750b9ad5ef | 877 | ssl->handshake->max_minor_ver = buf[4]; |
Christopher Haster |
1:24750b9ad5ef | 878 | |
Christopher Haster |
1:24750b9ad5ef | 879 | if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 880 | { |
Christopher Haster |
1:24750b9ad5ef | 881 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
Christopher Haster |
1:24750b9ad5ef | 882 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 883 | } |
Christopher Haster |
1:24750b9ad5ef | 884 | |
Christopher Haster |
1:24750b9ad5ef | 885 | ssl->handshake->update_checksum( ssl, buf + 2, n ); |
Christopher Haster |
1:24750b9ad5ef | 886 | |
Christopher Haster |
1:24750b9ad5ef | 887 | buf = ssl->in_msg; |
Christopher Haster |
1:24750b9ad5ef | 888 | n = ssl->in_left - 5; |
Christopher Haster |
1:24750b9ad5ef | 889 | |
Christopher Haster |
1:24750b9ad5ef | 890 | /* |
Christopher Haster |
1:24750b9ad5ef | 891 | * 0 . 1 ciphersuitelist length |
Christopher Haster |
1:24750b9ad5ef | 892 | * 2 . 3 session id length |
Christopher Haster |
1:24750b9ad5ef | 893 | * 4 . 5 challenge length |
Christopher Haster |
1:24750b9ad5ef | 894 | * 6 . .. ciphersuitelist |
Christopher Haster |
1:24750b9ad5ef | 895 | * .. . .. session id |
Christopher Haster |
1:24750b9ad5ef | 896 | * .. . .. challenge |
Christopher Haster |
1:24750b9ad5ef | 897 | */ |
Christopher Haster |
1:24750b9ad5ef | 898 | MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n ); |
Christopher Haster |
1:24750b9ad5ef | 899 | |
Christopher Haster |
1:24750b9ad5ef | 900 | ciph_len = ( buf[0] << 8 ) | buf[1]; |
Christopher Haster |
1:24750b9ad5ef | 901 | sess_len = ( buf[2] << 8 ) | buf[3]; |
Christopher Haster |
1:24750b9ad5ef | 902 | chal_len = ( buf[4] << 8 ) | buf[5]; |
Christopher Haster |
1:24750b9ad5ef | 903 | |
Christopher Haster |
1:24750b9ad5ef | 904 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d", |
Christopher Haster |
1:24750b9ad5ef | 905 | ciph_len, sess_len, chal_len ) ); |
Christopher Haster |
1:24750b9ad5ef | 906 | |
Christopher Haster |
1:24750b9ad5ef | 907 | /* |
Christopher Haster |
1:24750b9ad5ef | 908 | * Make sure each parameter length is valid |
Christopher Haster |
1:24750b9ad5ef | 909 | */ |
Christopher Haster |
1:24750b9ad5ef | 910 | if( ciph_len < 3 || ( ciph_len % 3 ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 911 | { |
Christopher Haster |
1:24750b9ad5ef | 912 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 913 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 914 | } |
Christopher Haster |
1:24750b9ad5ef | 915 | |
Christopher Haster |
1:24750b9ad5ef | 916 | if( sess_len > 32 ) |
Christopher Haster |
1:24750b9ad5ef | 917 | { |
Christopher Haster |
1:24750b9ad5ef | 918 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 919 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 920 | } |
Christopher Haster |
1:24750b9ad5ef | 921 | |
Christopher Haster |
1:24750b9ad5ef | 922 | if( chal_len < 8 || chal_len > 32 ) |
Christopher Haster |
1:24750b9ad5ef | 923 | { |
Christopher Haster |
1:24750b9ad5ef | 924 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 925 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 926 | } |
Christopher Haster |
1:24750b9ad5ef | 927 | |
Christopher Haster |
1:24750b9ad5ef | 928 | if( n != 6 + ciph_len + sess_len + chal_len ) |
Christopher Haster |
1:24750b9ad5ef | 929 | { |
Christopher Haster |
1:24750b9ad5ef | 930 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 931 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 932 | } |
Christopher Haster |
1:24750b9ad5ef | 933 | |
Christopher Haster |
1:24750b9ad5ef | 934 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist", |
Christopher Haster |
1:24750b9ad5ef | 935 | buf + 6, ciph_len ); |
Christopher Haster |
1:24750b9ad5ef | 936 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", |
Christopher Haster |
1:24750b9ad5ef | 937 | buf + 6 + ciph_len, sess_len ); |
Christopher Haster |
1:24750b9ad5ef | 938 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge", |
Christopher Haster |
1:24750b9ad5ef | 939 | buf + 6 + ciph_len + sess_len, chal_len ); |
Christopher Haster |
1:24750b9ad5ef | 940 | |
Christopher Haster |
1:24750b9ad5ef | 941 | p = buf + 6 + ciph_len; |
Christopher Haster |
1:24750b9ad5ef | 942 | ssl->session_negotiate->id_len = sess_len; |
Christopher Haster |
1:24750b9ad5ef | 943 | memset( ssl->session_negotiate->id, 0, |
Christopher Haster |
1:24750b9ad5ef | 944 | sizeof( ssl->session_negotiate->id ) ); |
Christopher Haster |
1:24750b9ad5ef | 945 | memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len ); |
Christopher Haster |
1:24750b9ad5ef | 946 | |
Christopher Haster |
1:24750b9ad5ef | 947 | p += sess_len; |
Christopher Haster |
1:24750b9ad5ef | 948 | memset( ssl->handshake->randbytes, 0, 64 ); |
Christopher Haster |
1:24750b9ad5ef | 949 | memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len ); |
Christopher Haster |
1:24750b9ad5ef | 950 | |
Christopher Haster |
1:24750b9ad5ef | 951 | /* |
Christopher Haster |
1:24750b9ad5ef | 952 | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
Christopher Haster |
1:24750b9ad5ef | 953 | */ |
Christopher Haster |
1:24750b9ad5ef | 954 | for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 ) |
Christopher Haster |
1:24750b9ad5ef | 955 | { |
Christopher Haster |
1:24750b9ad5ef | 956 | if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO ) |
Christopher Haster |
1:24750b9ad5ef | 957 | { |
Christopher Haster |
1:24750b9ad5ef | 958 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) ); |
Christopher Haster |
1:24750b9ad5ef | 959 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 960 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
Christopher Haster |
1:24750b9ad5ef | 961 | { |
Christopher Haster |
1:24750b9ad5ef | 962 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV " |
Christopher Haster |
1:24750b9ad5ef | 963 | "during renegotiation" ) ); |
Christopher Haster |
1:24750b9ad5ef | 964 | |
Christopher Haster |
1:24750b9ad5ef | 965 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 966 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 967 | |
Christopher Haster |
1:24750b9ad5ef | 968 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 969 | } |
Christopher Haster |
1:24750b9ad5ef | 970 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Christopher Haster |
1:24750b9ad5ef | 971 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
Christopher Haster |
1:24750b9ad5ef | 972 | break; |
Christopher Haster |
1:24750b9ad5ef | 973 | } |
Christopher Haster |
1:24750b9ad5ef | 974 | } |
Christopher Haster |
1:24750b9ad5ef | 975 | |
Christopher Haster |
1:24750b9ad5ef | 976 | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) |
Christopher Haster |
1:24750b9ad5ef | 977 | for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 ) |
Christopher Haster |
1:24750b9ad5ef | 978 | { |
Christopher Haster |
1:24750b9ad5ef | 979 | if( p[0] == 0 && |
Christopher Haster |
1:24750b9ad5ef | 980 | p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) && |
Christopher Haster |
1:24750b9ad5ef | 981 | p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) ) |
Christopher Haster |
1:24750b9ad5ef | 982 | { |
Christopher Haster |
1:24750b9ad5ef | 983 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) ); |
Christopher Haster |
1:24750b9ad5ef | 984 | |
Christopher Haster |
1:24750b9ad5ef | 985 | if( ssl->minor_ver < ssl->conf->max_minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 986 | { |
Christopher Haster |
1:24750b9ad5ef | 987 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) ); |
Christopher Haster |
1:24750b9ad5ef | 988 | |
Christopher Haster |
1:24750b9ad5ef | 989 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 990 | MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK ); |
Christopher Haster |
1:24750b9ad5ef | 991 | |
Christopher Haster |
1:24750b9ad5ef | 992 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 993 | } |
Christopher Haster |
1:24750b9ad5ef | 994 | |
Christopher Haster |
1:24750b9ad5ef | 995 | break; |
Christopher Haster |
1:24750b9ad5ef | 996 | } |
Christopher Haster |
1:24750b9ad5ef | 997 | } |
Christopher Haster |
1:24750b9ad5ef | 998 | #endif /* MBEDTLS_SSL_FALLBACK_SCSV */ |
Christopher Haster |
1:24750b9ad5ef | 999 | |
Christopher Haster |
1:24750b9ad5ef | 1000 | got_common_suite = 0; |
Christopher Haster |
1:24750b9ad5ef | 1001 | ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; |
Christopher Haster |
1:24750b9ad5ef | 1002 | ciphersuite_info = NULL; |
Christopher Haster |
1:24750b9ad5ef | 1003 | #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE) |
Christopher Haster |
1:24750b9ad5ef | 1004 | for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 ) |
Christopher Haster |
1:24750b9ad5ef | 1005 | { |
Christopher Haster |
1:24750b9ad5ef | 1006 | for( i = 0; ciphersuites[i] != 0; i++ ) |
Christopher Haster |
1:24750b9ad5ef | 1007 | #else |
Christopher Haster |
1:24750b9ad5ef | 1008 | for( i = 0; ciphersuites[i] != 0; i++ ) |
Christopher Haster |
1:24750b9ad5ef | 1009 | { |
Christopher Haster |
1:24750b9ad5ef | 1010 | for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 ) |
Christopher Haster |
1:24750b9ad5ef | 1011 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1012 | { |
Christopher Haster |
1:24750b9ad5ef | 1013 | if( p[0] != 0 || |
Christopher Haster |
1:24750b9ad5ef | 1014 | p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || |
Christopher Haster |
1:24750b9ad5ef | 1015 | p[2] != ( ( ciphersuites[i] ) & 0xFF ) ) |
Christopher Haster |
1:24750b9ad5ef | 1016 | continue; |
Christopher Haster |
1:24750b9ad5ef | 1017 | |
Christopher Haster |
1:24750b9ad5ef | 1018 | got_common_suite = 1; |
Christopher Haster |
1:24750b9ad5ef | 1019 | |
Christopher Haster |
1:24750b9ad5ef | 1020 | if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i], |
Christopher Haster |
1:24750b9ad5ef | 1021 | &ciphersuite_info ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1022 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1023 | |
Christopher Haster |
1:24750b9ad5ef | 1024 | if( ciphersuite_info != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 1025 | goto have_ciphersuite_v2; |
Christopher Haster |
1:24750b9ad5ef | 1026 | } |
Christopher Haster |
1:24750b9ad5ef | 1027 | } |
Christopher Haster |
1:24750b9ad5ef | 1028 | |
Christopher Haster |
1:24750b9ad5ef | 1029 | if( got_common_suite ) |
Christopher Haster |
1:24750b9ad5ef | 1030 | { |
Christopher Haster |
1:24750b9ad5ef | 1031 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, " |
Christopher Haster |
1:24750b9ad5ef | 1032 | "but none of them usable" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1033 | return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE ); |
Christopher Haster |
1:24750b9ad5ef | 1034 | } |
Christopher Haster |
1:24750b9ad5ef | 1035 | else |
Christopher Haster |
1:24750b9ad5ef | 1036 | { |
Christopher Haster |
1:24750b9ad5ef | 1037 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1038 | return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN ); |
Christopher Haster |
1:24750b9ad5ef | 1039 | } |
Christopher Haster |
1:24750b9ad5ef | 1040 | |
Christopher Haster |
1:24750b9ad5ef | 1041 | have_ciphersuite_v2: |
Christopher Haster |
1:24750b9ad5ef | 1042 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) ); |
Christopher Haster |
1:24750b9ad5ef | 1043 | |
Christopher Haster |
1:24750b9ad5ef | 1044 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
Christopher Haster |
1:24750b9ad5ef | 1045 | ssl->transform_negotiate->ciphersuite_info = ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 1046 | mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info ); |
Christopher Haster |
1:24750b9ad5ef | 1047 | |
Christopher Haster |
1:24750b9ad5ef | 1048 | /* |
Christopher Haster |
1:24750b9ad5ef | 1049 | * SSLv2 Client Hello relevant renegotiation security checks |
Christopher Haster |
1:24750b9ad5ef | 1050 | */ |
Christopher Haster |
1:24750b9ad5ef | 1051 | if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
Christopher Haster |
1:24750b9ad5ef | 1052 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 1053 | { |
Christopher Haster |
1:24750b9ad5ef | 1054 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1055 | |
Christopher Haster |
1:24750b9ad5ef | 1056 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1057 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1058 | |
Christopher Haster |
1:24750b9ad5ef | 1059 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1060 | } |
Christopher Haster |
1:24750b9ad5ef | 1061 | |
Christopher Haster |
1:24750b9ad5ef | 1062 | ssl->in_left = 0; |
Christopher Haster |
1:24750b9ad5ef | 1063 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 1064 | |
Christopher Haster |
1:24750b9ad5ef | 1065 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1066 | |
Christopher Haster |
1:24750b9ad5ef | 1067 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 1068 | } |
Christopher Haster |
1:24750b9ad5ef | 1069 | #endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */ |
Christopher Haster |
1:24750b9ad5ef | 1070 | |
Christopher Haster |
1:24750b9ad5ef | 1071 | static int ssl_parse_client_hello( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 1072 | { |
Christopher Haster |
1:24750b9ad5ef | 1073 | int ret, got_common_suite; |
Christopher Haster |
1:24750b9ad5ef | 1074 | size_t i, j; |
Christopher Haster |
1:24750b9ad5ef | 1075 | size_t ciph_offset, comp_offset, ext_offset; |
Christopher Haster |
1:24750b9ad5ef | 1076 | size_t msg_len, ciph_len, sess_len, comp_len, ext_len; |
Christopher Haster |
1:24750b9ad5ef | 1077 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1078 | size_t cookie_offset, cookie_len; |
Christopher Haster |
1:24750b9ad5ef | 1079 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1080 | unsigned char *buf, *p, *ext; |
Christopher Haster |
1:24750b9ad5ef | 1081 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1082 | int renegotiation_info_seen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1083 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1084 | int handshake_failure = 0; |
Christopher Haster |
1:24750b9ad5ef | 1085 | const int *ciphersuites; |
Christopher Haster |
1:24750b9ad5ef | 1086 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 1087 | int major, minor; |
Christopher Haster |
1:24750b9ad5ef | 1088 | |
Christopher Haster |
1:24750b9ad5ef | 1089 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1090 | |
Christopher Haster |
1:24750b9ad5ef | 1091 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Christopher Haster |
1:24750b9ad5ef | 1092 | read_record_header: |
Christopher Haster |
1:24750b9ad5ef | 1093 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1094 | /* |
Christopher Haster |
1:24750b9ad5ef | 1095 | * If renegotiating, then the input was read with mbedtls_ssl_read_record(), |
Christopher Haster |
1:24750b9ad5ef | 1096 | * otherwise read it ourselves manually in order to support SSLv2 |
Christopher Haster |
1:24750b9ad5ef | 1097 | * ClientHello, which doesn't use the same record layer format. |
Christopher Haster |
1:24750b9ad5ef | 1098 | */ |
Christopher Haster |
1:24750b9ad5ef | 1099 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1100 | if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 1101 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1102 | { |
Christopher Haster |
1:24750b9ad5ef | 1103 | if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1104 | { |
Christopher Haster |
1:24750b9ad5ef | 1105 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
Christopher Haster |
1:24750b9ad5ef | 1106 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1107 | } |
Christopher Haster |
1:24750b9ad5ef | 1108 | } |
Christopher Haster |
1:24750b9ad5ef | 1109 | |
Christopher Haster |
1:24750b9ad5ef | 1110 | buf = ssl->in_hdr; |
Christopher Haster |
1:24750b9ad5ef | 1111 | |
Christopher Haster |
1:24750b9ad5ef | 1112 | #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) |
Christopher Haster |
1:24750b9ad5ef | 1113 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1114 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
Christopher Haster |
1:24750b9ad5ef | 1115 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1116 | if( ( buf[0] & 0x80 ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1117 | return ssl_parse_client_hello_v2( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1118 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1119 | |
Christopher Haster |
1:24750b9ad5ef | 1120 | MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) ); |
Christopher Haster |
1:24750b9ad5ef | 1121 | |
Christopher Haster |
1:24750b9ad5ef | 1122 | /* |
Christopher Haster |
1:24750b9ad5ef | 1123 | * SSLv3/TLS Client Hello |
Christopher Haster |
1:24750b9ad5ef | 1124 | * |
Christopher Haster |
1:24750b9ad5ef | 1125 | * Record layer: |
Christopher Haster |
1:24750b9ad5ef | 1126 | * 0 . 0 message type |
Christopher Haster |
1:24750b9ad5ef | 1127 | * 1 . 2 protocol version |
Christopher Haster |
1:24750b9ad5ef | 1128 | * 3 . 11 DTLS: epoch + record sequence number |
Christopher Haster |
1:24750b9ad5ef | 1129 | * 3 . 4 message length |
Christopher Haster |
1:24750b9ad5ef | 1130 | */ |
Christopher Haster |
1:24750b9ad5ef | 1131 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d", |
Christopher Haster |
1:24750b9ad5ef | 1132 | buf[0] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1133 | |
Christopher Haster |
1:24750b9ad5ef | 1134 | if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 1135 | { |
Christopher Haster |
1:24750b9ad5ef | 1136 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1137 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1138 | } |
Christopher Haster |
1:24750b9ad5ef | 1139 | |
Christopher Haster |
1:24750b9ad5ef | 1140 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d", |
Christopher Haster |
1:24750b9ad5ef | 1141 | ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1142 | |
Christopher Haster |
1:24750b9ad5ef | 1143 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]", |
Christopher Haster |
1:24750b9ad5ef | 1144 | buf[1], buf[2] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1145 | |
Christopher Haster |
1:24750b9ad5ef | 1146 | mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 ); |
Christopher Haster |
1:24750b9ad5ef | 1147 | |
Christopher Haster |
1:24750b9ad5ef | 1148 | /* According to RFC 5246 Appendix E.1, the version here is typically |
Christopher Haster |
1:24750b9ad5ef | 1149 | * "{03,00}, the lowest version number supported by the client, [or] the |
Christopher Haster |
1:24750b9ad5ef | 1150 | * value of ClientHello.client_version", so the only meaningful check here |
Christopher Haster |
1:24750b9ad5ef | 1151 | * is the major version shouldn't be less than 3 */ |
Christopher Haster |
1:24750b9ad5ef | 1152 | if( major < MBEDTLS_SSL_MAJOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 1153 | { |
Christopher Haster |
1:24750b9ad5ef | 1154 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1155 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1156 | } |
Christopher Haster |
1:24750b9ad5ef | 1157 | |
Christopher Haster |
1:24750b9ad5ef | 1158 | /* For DTLS if this is the initial handshake, remember the client sequence |
Christopher Haster |
1:24750b9ad5ef | 1159 | * number to use it in our next message (RFC 6347 4.2.1) */ |
Christopher Haster |
1:24750b9ad5ef | 1160 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1161 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM |
Christopher Haster |
1:24750b9ad5ef | 1162 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1163 | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
Christopher Haster |
1:24750b9ad5ef | 1164 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1165 | ) |
Christopher Haster |
1:24750b9ad5ef | 1166 | { |
Christopher Haster |
1:24750b9ad5ef | 1167 | /* Epoch should be 0 for initial handshakes */ |
Christopher Haster |
1:24750b9ad5ef | 1168 | if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1169 | { |
Christopher Haster |
1:24750b9ad5ef | 1170 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1171 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1172 | } |
Christopher Haster |
1:24750b9ad5ef | 1173 | |
Christopher Haster |
1:24750b9ad5ef | 1174 | memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 ); |
Christopher Haster |
1:24750b9ad5ef | 1175 | |
Christopher Haster |
1:24750b9ad5ef | 1176 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
Christopher Haster |
1:24750b9ad5ef | 1177 | if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1178 | { |
Christopher Haster |
1:24750b9ad5ef | 1179 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1180 | ssl->next_record_offset = 0; |
Christopher Haster |
1:24750b9ad5ef | 1181 | ssl->in_left = 0; |
Christopher Haster |
1:24750b9ad5ef | 1182 | goto read_record_header; |
Christopher Haster |
1:24750b9ad5ef | 1183 | } |
Christopher Haster |
1:24750b9ad5ef | 1184 | |
Christopher Haster |
1:24750b9ad5ef | 1185 | /* No MAC to check yet, so we can update right now */ |
Christopher Haster |
1:24750b9ad5ef | 1186 | mbedtls_ssl_dtls_replay_update( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1187 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1188 | } |
Christopher Haster |
1:24750b9ad5ef | 1189 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Christopher Haster |
1:24750b9ad5ef | 1190 | |
Christopher Haster |
1:24750b9ad5ef | 1191 | msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1]; |
Christopher Haster |
1:24750b9ad5ef | 1192 | |
Christopher Haster |
1:24750b9ad5ef | 1193 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1194 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 1195 | { |
Christopher Haster |
1:24750b9ad5ef | 1196 | /* Set by mbedtls_ssl_read_record() */ |
Christopher Haster |
1:24750b9ad5ef | 1197 | msg_len = ssl->in_hslen; |
Christopher Haster |
1:24750b9ad5ef | 1198 | } |
Christopher Haster |
1:24750b9ad5ef | 1199 | else |
Christopher Haster |
1:24750b9ad5ef | 1200 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1201 | { |
Christopher Haster |
1:24750b9ad5ef | 1202 | if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
Christopher Haster |
1:24750b9ad5ef | 1203 | { |
Christopher Haster |
1:24750b9ad5ef | 1204 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1205 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1206 | } |
Christopher Haster |
1:24750b9ad5ef | 1207 | |
Christopher Haster |
1:24750b9ad5ef | 1208 | if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1209 | { |
Christopher Haster |
1:24750b9ad5ef | 1210 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
Christopher Haster |
1:24750b9ad5ef | 1211 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1212 | } |
Christopher Haster |
1:24750b9ad5ef | 1213 | |
Christopher Haster |
1:24750b9ad5ef | 1214 | /* Done reading this record, get ready for the next one */ |
Christopher Haster |
1:24750b9ad5ef | 1215 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1216 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Christopher Haster |
1:24750b9ad5ef | 1217 | ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1218 | else |
Christopher Haster |
1:24750b9ad5ef | 1219 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1220 | ssl->in_left = 0; |
Christopher Haster |
1:24750b9ad5ef | 1221 | } |
Christopher Haster |
1:24750b9ad5ef | 1222 | |
Christopher Haster |
1:24750b9ad5ef | 1223 | buf = ssl->in_msg; |
Christopher Haster |
1:24750b9ad5ef | 1224 | |
Christopher Haster |
1:24750b9ad5ef | 1225 | MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len ); |
Christopher Haster |
1:24750b9ad5ef | 1226 | |
Christopher Haster |
1:24750b9ad5ef | 1227 | ssl->handshake->update_checksum( ssl, buf, msg_len ); |
Christopher Haster |
1:24750b9ad5ef | 1228 | |
Christopher Haster |
1:24750b9ad5ef | 1229 | /* |
Christopher Haster |
1:24750b9ad5ef | 1230 | * Handshake layer: |
Christopher Haster |
1:24750b9ad5ef | 1231 | * 0 . 0 handshake type |
Christopher Haster |
1:24750b9ad5ef | 1232 | * 1 . 3 handshake length |
Christopher Haster |
1:24750b9ad5ef | 1233 | * 4 . 5 DTLS only: message seqence number |
Christopher Haster |
1:24750b9ad5ef | 1234 | * 6 . 8 DTLS only: fragment offset |
Christopher Haster |
1:24750b9ad5ef | 1235 | * 9 . 11 DTLS only: fragment length |
Christopher Haster |
1:24750b9ad5ef | 1236 | */ |
Christopher Haster |
1:24750b9ad5ef | 1237 | if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) ) |
Christopher Haster |
1:24750b9ad5ef | 1238 | { |
Christopher Haster |
1:24750b9ad5ef | 1239 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1240 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1241 | } |
Christopher Haster |
1:24750b9ad5ef | 1242 | |
Christopher Haster |
1:24750b9ad5ef | 1243 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1244 | |
Christopher Haster |
1:24750b9ad5ef | 1245 | if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) |
Christopher Haster |
1:24750b9ad5ef | 1246 | { |
Christopher Haster |
1:24750b9ad5ef | 1247 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1248 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1249 | } |
Christopher Haster |
1:24750b9ad5ef | 1250 | |
Christopher Haster |
1:24750b9ad5ef | 1251 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d", |
Christopher Haster |
1:24750b9ad5ef | 1252 | ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1253 | |
Christopher Haster |
1:24750b9ad5ef | 1254 | /* We don't support fragmentation of ClientHello (yet?) */ |
Christopher Haster |
1:24750b9ad5ef | 1255 | if( buf[1] != 0 || |
Christopher Haster |
1:24750b9ad5ef | 1256 | msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) ) |
Christopher Haster |
1:24750b9ad5ef | 1257 | { |
Christopher Haster |
1:24750b9ad5ef | 1258 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1259 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1260 | } |
Christopher Haster |
1:24750b9ad5ef | 1261 | |
Christopher Haster |
1:24750b9ad5ef | 1262 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1263 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Christopher Haster |
1:24750b9ad5ef | 1264 | { |
Christopher Haster |
1:24750b9ad5ef | 1265 | /* |
Christopher Haster |
1:24750b9ad5ef | 1266 | * Copy the client's handshake message_seq on initial handshakes, |
Christopher Haster |
1:24750b9ad5ef | 1267 | * check sequence number on renego. |
Christopher Haster |
1:24750b9ad5ef | 1268 | */ |
Christopher Haster |
1:24750b9ad5ef | 1269 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1270 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
Christopher Haster |
1:24750b9ad5ef | 1271 | { |
Christopher Haster |
1:24750b9ad5ef | 1272 | /* This couldn't be done in ssl_prepare_handshake_record() */ |
Christopher Haster |
1:24750b9ad5ef | 1273 | unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) | |
Christopher Haster |
1:24750b9ad5ef | 1274 | ssl->in_msg[5]; |
Christopher Haster |
1:24750b9ad5ef | 1275 | |
Christopher Haster |
1:24750b9ad5ef | 1276 | if( cli_msg_seq != ssl->handshake->in_msg_seq ) |
Christopher Haster |
1:24750b9ad5ef | 1277 | { |
Christopher Haster |
1:24750b9ad5ef | 1278 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: " |
Christopher Haster |
1:24750b9ad5ef | 1279 | "%d (expected %d)", cli_msg_seq, |
Christopher Haster |
1:24750b9ad5ef | 1280 | ssl->handshake->in_msg_seq ) ); |
Christopher Haster |
1:24750b9ad5ef | 1281 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1282 | } |
Christopher Haster |
1:24750b9ad5ef | 1283 | |
Christopher Haster |
1:24750b9ad5ef | 1284 | ssl->handshake->in_msg_seq++; |
Christopher Haster |
1:24750b9ad5ef | 1285 | } |
Christopher Haster |
1:24750b9ad5ef | 1286 | else |
Christopher Haster |
1:24750b9ad5ef | 1287 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1288 | { |
Christopher Haster |
1:24750b9ad5ef | 1289 | unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) | |
Christopher Haster |
1:24750b9ad5ef | 1290 | ssl->in_msg[5]; |
Christopher Haster |
1:24750b9ad5ef | 1291 | ssl->handshake->out_msg_seq = cli_msg_seq; |
Christopher Haster |
1:24750b9ad5ef | 1292 | ssl->handshake->in_msg_seq = cli_msg_seq + 1; |
Christopher Haster |
1:24750b9ad5ef | 1293 | } |
Christopher Haster |
1:24750b9ad5ef | 1294 | |
Christopher Haster |
1:24750b9ad5ef | 1295 | /* |
Christopher Haster |
1:24750b9ad5ef | 1296 | * For now we don't support fragmentation, so make sure |
Christopher Haster |
1:24750b9ad5ef | 1297 | * fragment_offset == 0 and fragment_length == length |
Christopher Haster |
1:24750b9ad5ef | 1298 | */ |
Christopher Haster |
1:24750b9ad5ef | 1299 | if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 || |
Christopher Haster |
1:24750b9ad5ef | 1300 | memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1301 | { |
Christopher Haster |
1:24750b9ad5ef | 1302 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1303 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
Christopher Haster |
1:24750b9ad5ef | 1304 | } |
Christopher Haster |
1:24750b9ad5ef | 1305 | } |
Christopher Haster |
1:24750b9ad5ef | 1306 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Christopher Haster |
1:24750b9ad5ef | 1307 | |
Christopher Haster |
1:24750b9ad5ef | 1308 | buf += mbedtls_ssl_hs_hdr_len( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1309 | msg_len -= mbedtls_ssl_hs_hdr_len( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1310 | |
Christopher Haster |
1:24750b9ad5ef | 1311 | /* |
Christopher Haster |
1:24750b9ad5ef | 1312 | * ClientHello layer: |
Christopher Haster |
1:24750b9ad5ef | 1313 | * 0 . 1 protocol version |
Christopher Haster |
1:24750b9ad5ef | 1314 | * 2 . 33 random bytes (starting with 4 bytes of Unix time) |
Christopher Haster |
1:24750b9ad5ef | 1315 | * 34 . 35 session id length (1 byte) |
Christopher Haster |
1:24750b9ad5ef | 1316 | * 35 . 34+x session id |
Christopher Haster |
1:24750b9ad5ef | 1317 | * 35+x . 35+x DTLS only: cookie length (1 byte) |
Christopher Haster |
1:24750b9ad5ef | 1318 | * 36+x . .. DTLS only: cookie |
Christopher Haster |
1:24750b9ad5ef | 1319 | * .. . .. ciphersuite list length (2 bytes) |
Christopher Haster |
1:24750b9ad5ef | 1320 | * .. . .. ciphersuite list |
Christopher Haster |
1:24750b9ad5ef | 1321 | * .. . .. compression alg. list length (1 byte) |
Christopher Haster |
1:24750b9ad5ef | 1322 | * .. . .. compression alg. list |
Christopher Haster |
1:24750b9ad5ef | 1323 | * .. . .. extensions length (2 bytes, optional) |
Christopher Haster |
1:24750b9ad5ef | 1324 | * .. . .. extensions (optional) |
Christopher Haster |
1:24750b9ad5ef | 1325 | */ |
Christopher Haster |
1:24750b9ad5ef | 1326 | |
Christopher Haster |
1:24750b9ad5ef | 1327 | /* |
Christopher Haster |
1:24750b9ad5ef | 1328 | * Minimal length (with everything empty and extensions ommitted) is |
Christopher Haster |
1:24750b9ad5ef | 1329 | * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can |
Christopher Haster |
1:24750b9ad5ef | 1330 | * read at least up to session id length without worrying. |
Christopher Haster |
1:24750b9ad5ef | 1331 | */ |
Christopher Haster |
1:24750b9ad5ef | 1332 | if( msg_len < 38 ) |
Christopher Haster |
1:24750b9ad5ef | 1333 | { |
Christopher Haster |
1:24750b9ad5ef | 1334 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1335 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1336 | } |
Christopher Haster |
1:24750b9ad5ef | 1337 | |
Christopher Haster |
1:24750b9ad5ef | 1338 | /* |
Christopher Haster |
1:24750b9ad5ef | 1339 | * Check and save the protocol version |
Christopher Haster |
1:24750b9ad5ef | 1340 | */ |
Christopher Haster |
1:24750b9ad5ef | 1341 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 ); |
Christopher Haster |
1:24750b9ad5ef | 1342 | |
Christopher Haster |
1:24750b9ad5ef | 1343 | mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver, |
Christopher Haster |
1:24750b9ad5ef | 1344 | ssl->conf->transport, buf ); |
Christopher Haster |
1:24750b9ad5ef | 1345 | |
Christopher Haster |
1:24750b9ad5ef | 1346 | ssl->handshake->max_major_ver = ssl->major_ver; |
Christopher Haster |
1:24750b9ad5ef | 1347 | ssl->handshake->max_minor_ver = ssl->minor_ver; |
Christopher Haster |
1:24750b9ad5ef | 1348 | |
Christopher Haster |
1:24750b9ad5ef | 1349 | if( ssl->major_ver < ssl->conf->min_major_ver || |
Christopher Haster |
1:24750b9ad5ef | 1350 | ssl->minor_ver < ssl->conf->min_minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 1351 | { |
Christopher Haster |
1:24750b9ad5ef | 1352 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum" |
Christopher Haster |
1:24750b9ad5ef | 1353 | " [%d:%d] < [%d:%d]", |
Christopher Haster |
1:24750b9ad5ef | 1354 | ssl->major_ver, ssl->minor_ver, |
Christopher Haster |
1:24750b9ad5ef | 1355 | ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) ); |
Christopher Haster |
1:24750b9ad5ef | 1356 | |
Christopher Haster |
1:24750b9ad5ef | 1357 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 1358 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); |
Christopher Haster |
1:24750b9ad5ef | 1359 | |
Christopher Haster |
1:24750b9ad5ef | 1360 | return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION ); |
Christopher Haster |
1:24750b9ad5ef | 1361 | } |
Christopher Haster |
1:24750b9ad5ef | 1362 | |
Christopher Haster |
1:24750b9ad5ef | 1363 | if( ssl->major_ver > ssl->conf->max_major_ver ) |
Christopher Haster |
1:24750b9ad5ef | 1364 | { |
Christopher Haster |
1:24750b9ad5ef | 1365 | ssl->major_ver = ssl->conf->max_major_ver; |
Christopher Haster |
1:24750b9ad5ef | 1366 | ssl->minor_ver = ssl->conf->max_minor_ver; |
Christopher Haster |
1:24750b9ad5ef | 1367 | } |
Christopher Haster |
1:24750b9ad5ef | 1368 | else if( ssl->minor_ver > ssl->conf->max_minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 1369 | ssl->minor_ver = ssl->conf->max_minor_ver; |
Christopher Haster |
1:24750b9ad5ef | 1370 | |
Christopher Haster |
1:24750b9ad5ef | 1371 | /* |
Christopher Haster |
1:24750b9ad5ef | 1372 | * Save client random (inc. Unix time) |
Christopher Haster |
1:24750b9ad5ef | 1373 | */ |
Christopher Haster |
1:24750b9ad5ef | 1374 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 ); |
Christopher Haster |
1:24750b9ad5ef | 1375 | |
Christopher Haster |
1:24750b9ad5ef | 1376 | memcpy( ssl->handshake->randbytes, buf + 2, 32 ); |
Christopher Haster |
1:24750b9ad5ef | 1377 | |
Christopher Haster |
1:24750b9ad5ef | 1378 | /* |
Christopher Haster |
1:24750b9ad5ef | 1379 | * Check the session ID length and save session ID |
Christopher Haster |
1:24750b9ad5ef | 1380 | */ |
Christopher Haster |
1:24750b9ad5ef | 1381 | sess_len = buf[34]; |
Christopher Haster |
1:24750b9ad5ef | 1382 | |
Christopher Haster |
1:24750b9ad5ef | 1383 | if( sess_len > sizeof( ssl->session_negotiate->id ) || |
Christopher Haster |
1:24750b9ad5ef | 1384 | sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */ |
Christopher Haster |
1:24750b9ad5ef | 1385 | { |
Christopher Haster |
1:24750b9ad5ef | 1386 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1387 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1388 | } |
Christopher Haster |
1:24750b9ad5ef | 1389 | |
Christopher Haster |
1:24750b9ad5ef | 1390 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len ); |
Christopher Haster |
1:24750b9ad5ef | 1391 | |
Christopher Haster |
1:24750b9ad5ef | 1392 | ssl->session_negotiate->id_len = sess_len; |
Christopher Haster |
1:24750b9ad5ef | 1393 | memset( ssl->session_negotiate->id, 0, |
Christopher Haster |
1:24750b9ad5ef | 1394 | sizeof( ssl->session_negotiate->id ) ); |
Christopher Haster |
1:24750b9ad5ef | 1395 | memcpy( ssl->session_negotiate->id, buf + 35, |
Christopher Haster |
1:24750b9ad5ef | 1396 | ssl->session_negotiate->id_len ); |
Christopher Haster |
1:24750b9ad5ef | 1397 | |
Christopher Haster |
1:24750b9ad5ef | 1398 | /* |
Christopher Haster |
1:24750b9ad5ef | 1399 | * Check the cookie length and content |
Christopher Haster |
1:24750b9ad5ef | 1400 | */ |
Christopher Haster |
1:24750b9ad5ef | 1401 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1402 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Christopher Haster |
1:24750b9ad5ef | 1403 | { |
Christopher Haster |
1:24750b9ad5ef | 1404 | cookie_offset = 35 + sess_len; |
Christopher Haster |
1:24750b9ad5ef | 1405 | cookie_len = buf[cookie_offset]; |
Christopher Haster |
1:24750b9ad5ef | 1406 | |
Christopher Haster |
1:24750b9ad5ef | 1407 | if( cookie_offset + 1 + cookie_len + 2 > msg_len ) |
Christopher Haster |
1:24750b9ad5ef | 1408 | { |
Christopher Haster |
1:24750b9ad5ef | 1409 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1410 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1411 | } |
Christopher Haster |
1:24750b9ad5ef | 1412 | |
Christopher Haster |
1:24750b9ad5ef | 1413 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie", |
Christopher Haster |
1:24750b9ad5ef | 1414 | buf + cookie_offset + 1, cookie_len ); |
Christopher Haster |
1:24750b9ad5ef | 1415 | |
Christopher Haster |
1:24750b9ad5ef | 1416 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Christopher Haster |
1:24750b9ad5ef | 1417 | if( ssl->conf->f_cookie_check != NULL |
Christopher Haster |
1:24750b9ad5ef | 1418 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1419 | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
Christopher Haster |
1:24750b9ad5ef | 1420 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1421 | ) |
Christopher Haster |
1:24750b9ad5ef | 1422 | { |
Christopher Haster |
1:24750b9ad5ef | 1423 | if( ssl->conf->f_cookie_check( ssl->conf->p_cookie, |
Christopher Haster |
1:24750b9ad5ef | 1424 | buf + cookie_offset + 1, cookie_len, |
Christopher Haster |
1:24750b9ad5ef | 1425 | ssl->cli_id, ssl->cli_id_len ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1426 | { |
Christopher Haster |
1:24750b9ad5ef | 1427 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1428 | ssl->handshake->verify_cookie_len = 1; |
Christopher Haster |
1:24750b9ad5ef | 1429 | } |
Christopher Haster |
1:24750b9ad5ef | 1430 | else |
Christopher Haster |
1:24750b9ad5ef | 1431 | { |
Christopher Haster |
1:24750b9ad5ef | 1432 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1433 | ssl->handshake->verify_cookie_len = 0; |
Christopher Haster |
1:24750b9ad5ef | 1434 | } |
Christopher Haster |
1:24750b9ad5ef | 1435 | } |
Christopher Haster |
1:24750b9ad5ef | 1436 | else |
Christopher Haster |
1:24750b9ad5ef | 1437 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Christopher Haster |
1:24750b9ad5ef | 1438 | { |
Christopher Haster |
1:24750b9ad5ef | 1439 | /* We know we didn't send a cookie, so it should be empty */ |
Christopher Haster |
1:24750b9ad5ef | 1440 | if( cookie_len != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1441 | { |
Christopher Haster |
1:24750b9ad5ef | 1442 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1443 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1444 | } |
Christopher Haster |
1:24750b9ad5ef | 1445 | |
Christopher Haster |
1:24750b9ad5ef | 1446 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1447 | } |
Christopher Haster |
1:24750b9ad5ef | 1448 | |
Christopher Haster |
1:24750b9ad5ef | 1449 | /* |
Christopher Haster |
1:24750b9ad5ef | 1450 | * Check the ciphersuitelist length (will be parsed later) |
Christopher Haster |
1:24750b9ad5ef | 1451 | */ |
Christopher Haster |
1:24750b9ad5ef | 1452 | ciph_offset = cookie_offset + 1 + cookie_len; |
Christopher Haster |
1:24750b9ad5ef | 1453 | } |
Christopher Haster |
1:24750b9ad5ef | 1454 | else |
Christopher Haster |
1:24750b9ad5ef | 1455 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
Christopher Haster |
1:24750b9ad5ef | 1456 | ciph_offset = 35 + sess_len; |
Christopher Haster |
1:24750b9ad5ef | 1457 | |
Christopher Haster |
1:24750b9ad5ef | 1458 | ciph_len = ( buf[ciph_offset + 0] << 8 ) |
Christopher Haster |
1:24750b9ad5ef | 1459 | | ( buf[ciph_offset + 1] ); |
Christopher Haster |
1:24750b9ad5ef | 1460 | |
Christopher Haster |
1:24750b9ad5ef | 1461 | if( ciph_len < 2 || |
Christopher Haster |
1:24750b9ad5ef | 1462 | ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */ |
Christopher Haster |
1:24750b9ad5ef | 1463 | ( ciph_len % 2 ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1464 | { |
Christopher Haster |
1:24750b9ad5ef | 1465 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1466 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1467 | } |
Christopher Haster |
1:24750b9ad5ef | 1468 | |
Christopher Haster |
1:24750b9ad5ef | 1469 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist", |
Christopher Haster |
1:24750b9ad5ef | 1470 | buf + ciph_offset + 2, ciph_len ); |
Christopher Haster |
1:24750b9ad5ef | 1471 | |
Christopher Haster |
1:24750b9ad5ef | 1472 | /* |
Christopher Haster |
1:24750b9ad5ef | 1473 | * Check the compression algorithms length and pick one |
Christopher Haster |
1:24750b9ad5ef | 1474 | */ |
Christopher Haster |
1:24750b9ad5ef | 1475 | comp_offset = ciph_offset + 2 + ciph_len; |
Christopher Haster |
1:24750b9ad5ef | 1476 | |
Christopher Haster |
1:24750b9ad5ef | 1477 | comp_len = buf[comp_offset]; |
Christopher Haster |
1:24750b9ad5ef | 1478 | |
Christopher Haster |
1:24750b9ad5ef | 1479 | if( comp_len < 1 || |
Christopher Haster |
1:24750b9ad5ef | 1480 | comp_len > 16 || |
Christopher Haster |
1:24750b9ad5ef | 1481 | comp_len + comp_offset + 1 > msg_len ) |
Christopher Haster |
1:24750b9ad5ef | 1482 | { |
Christopher Haster |
1:24750b9ad5ef | 1483 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1484 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1485 | } |
Christopher Haster |
1:24750b9ad5ef | 1486 | |
Christopher Haster |
1:24750b9ad5ef | 1487 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression", |
Christopher Haster |
1:24750b9ad5ef | 1488 | buf + comp_offset + 1, comp_len ); |
Christopher Haster |
1:24750b9ad5ef | 1489 | |
Christopher Haster |
1:24750b9ad5ef | 1490 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL; |
Christopher Haster |
1:24750b9ad5ef | 1491 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
Christopher Haster |
1:24750b9ad5ef | 1492 | for( i = 0; i < comp_len; ++i ) |
Christopher Haster |
1:24750b9ad5ef | 1493 | { |
Christopher Haster |
1:24750b9ad5ef | 1494 | if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE ) |
Christopher Haster |
1:24750b9ad5ef | 1495 | { |
Christopher Haster |
1:24750b9ad5ef | 1496 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE; |
Christopher Haster |
1:24750b9ad5ef | 1497 | break; |
Christopher Haster |
1:24750b9ad5ef | 1498 | } |
Christopher Haster |
1:24750b9ad5ef | 1499 | } |
Christopher Haster |
1:24750b9ad5ef | 1500 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1501 | |
Christopher Haster |
1:24750b9ad5ef | 1502 | /* See comments in ssl_write_client_hello() */ |
Christopher Haster |
1:24750b9ad5ef | 1503 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1504 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Christopher Haster |
1:24750b9ad5ef | 1505 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL; |
Christopher Haster |
1:24750b9ad5ef | 1506 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1507 | |
Christopher Haster |
1:24750b9ad5ef | 1508 | /* |
Christopher Haster |
1:24750b9ad5ef | 1509 | * Check the extension length |
Christopher Haster |
1:24750b9ad5ef | 1510 | */ |
Christopher Haster |
1:24750b9ad5ef | 1511 | ext_offset = comp_offset + 1 + comp_len; |
Christopher Haster |
1:24750b9ad5ef | 1512 | if( msg_len > ext_offset ) |
Christopher Haster |
1:24750b9ad5ef | 1513 | { |
Christopher Haster |
1:24750b9ad5ef | 1514 | if( msg_len < ext_offset + 2 ) |
Christopher Haster |
1:24750b9ad5ef | 1515 | { |
Christopher Haster |
1:24750b9ad5ef | 1516 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1517 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1518 | } |
Christopher Haster |
1:24750b9ad5ef | 1519 | |
Christopher Haster |
1:24750b9ad5ef | 1520 | ext_len = ( buf[ext_offset + 0] << 8 ) |
Christopher Haster |
1:24750b9ad5ef | 1521 | | ( buf[ext_offset + 1] ); |
Christopher Haster |
1:24750b9ad5ef | 1522 | |
Christopher Haster |
1:24750b9ad5ef | 1523 | if( ( ext_len > 0 && ext_len < 4 ) || |
Christopher Haster |
1:24750b9ad5ef | 1524 | msg_len != ext_offset + 2 + ext_len ) |
Christopher Haster |
1:24750b9ad5ef | 1525 | { |
Christopher Haster |
1:24750b9ad5ef | 1526 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1527 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1528 | } |
Christopher Haster |
1:24750b9ad5ef | 1529 | } |
Christopher Haster |
1:24750b9ad5ef | 1530 | else |
Christopher Haster |
1:24750b9ad5ef | 1531 | ext_len = 0; |
Christopher Haster |
1:24750b9ad5ef | 1532 | |
Christopher Haster |
1:24750b9ad5ef | 1533 | ext = buf + ext_offset + 2; |
Christopher Haster |
1:24750b9ad5ef | 1534 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len ); |
Christopher Haster |
1:24750b9ad5ef | 1535 | |
Christopher Haster |
1:24750b9ad5ef | 1536 | while( ext_len != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1537 | { |
Christopher Haster |
1:24750b9ad5ef | 1538 | unsigned int ext_id = ( ( ext[0] << 8 ) |
Christopher Haster |
1:24750b9ad5ef | 1539 | | ( ext[1] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1540 | unsigned int ext_size = ( ( ext[2] << 8 ) |
Christopher Haster |
1:24750b9ad5ef | 1541 | | ( ext[3] ) ); |
Christopher Haster |
1:24750b9ad5ef | 1542 | |
Christopher Haster |
1:24750b9ad5ef | 1543 | if( ext_size + 4 > ext_len ) |
Christopher Haster |
1:24750b9ad5ef | 1544 | { |
Christopher Haster |
1:24750b9ad5ef | 1545 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1546 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1547 | } |
Christopher Haster |
1:24750b9ad5ef | 1548 | switch( ext_id ) |
Christopher Haster |
1:24750b9ad5ef | 1549 | { |
Christopher Haster |
1:24750b9ad5ef | 1550 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Christopher Haster |
1:24750b9ad5ef | 1551 | case MBEDTLS_TLS_EXT_SERVERNAME: |
Christopher Haster |
1:24750b9ad5ef | 1552 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1553 | if( ssl->conf->f_sni == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 1554 | break; |
Christopher Haster |
1:24750b9ad5ef | 1555 | |
Christopher Haster |
1:24750b9ad5ef | 1556 | ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1557 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1558 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1559 | break; |
Christopher Haster |
1:24750b9ad5ef | 1560 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
Christopher Haster |
1:24750b9ad5ef | 1561 | |
Christopher Haster |
1:24750b9ad5ef | 1562 | case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: |
Christopher Haster |
1:24750b9ad5ef | 1563 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1564 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1565 | renegotiation_info_seen = 1; |
Christopher Haster |
1:24750b9ad5ef | 1566 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1567 | |
Christopher Haster |
1:24750b9ad5ef | 1568 | ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1569 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1570 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1571 | break; |
Christopher Haster |
1:24750b9ad5ef | 1572 | |
Christopher Haster |
1:24750b9ad5ef | 1573 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
Christopher Haster |
1:24750b9ad5ef | 1574 | defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 1575 | case MBEDTLS_TLS_EXT_SIG_ALG: |
Christopher Haster |
1:24750b9ad5ef | 1576 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1577 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1578 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
Christopher Haster |
1:24750b9ad5ef | 1579 | break; |
Christopher Haster |
1:24750b9ad5ef | 1580 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1581 | |
Christopher Haster |
1:24750b9ad5ef | 1582 | ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1583 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1584 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1585 | break; |
Christopher Haster |
1:24750b9ad5ef | 1586 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
Christopher Haster |
1:24750b9ad5ef | 1587 | MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 1588 | |
Christopher Haster |
1:24750b9ad5ef | 1589 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Christopher Haster |
1:24750b9ad5ef | 1590 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 1591 | case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES: |
Christopher Haster |
1:24750b9ad5ef | 1592 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1593 | |
Christopher Haster |
1:24750b9ad5ef | 1594 | ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1595 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1596 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1597 | break; |
Christopher Haster |
1:24750b9ad5ef | 1598 | |
Christopher Haster |
1:24750b9ad5ef | 1599 | case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: |
Christopher Haster |
1:24750b9ad5ef | 1600 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1601 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT; |
Christopher Haster |
1:24750b9ad5ef | 1602 | |
Christopher Haster |
1:24750b9ad5ef | 1603 | ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1604 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1605 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1606 | break; |
Christopher Haster |
1:24750b9ad5ef | 1607 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
Christopher Haster |
1:24750b9ad5ef | 1608 | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 1609 | |
Christopher Haster |
1:24750b9ad5ef | 1610 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 1611 | case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: |
Christopher Haster |
1:24750b9ad5ef | 1612 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1613 | |
Christopher Haster |
1:24750b9ad5ef | 1614 | ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1615 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1616 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1617 | break; |
Christopher Haster |
1:24750b9ad5ef | 1618 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 1619 | |
Christopher Haster |
1:24750b9ad5ef | 1620 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Christopher Haster |
1:24750b9ad5ef | 1621 | case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: |
Christopher Haster |
1:24750b9ad5ef | 1622 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1623 | |
Christopher Haster |
1:24750b9ad5ef | 1624 | ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1625 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1626 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1627 | break; |
Christopher Haster |
1:24750b9ad5ef | 1628 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Christopher Haster |
1:24750b9ad5ef | 1629 | |
Christopher Haster |
1:24750b9ad5ef | 1630 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Christopher Haster |
1:24750b9ad5ef | 1631 | case MBEDTLS_TLS_EXT_TRUNCATED_HMAC: |
Christopher Haster |
1:24750b9ad5ef | 1632 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1633 | |
Christopher Haster |
1:24750b9ad5ef | 1634 | ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1635 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1636 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1637 | break; |
Christopher Haster |
1:24750b9ad5ef | 1638 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
Christopher Haster |
1:24750b9ad5ef | 1639 | |
Christopher Haster |
1:24750b9ad5ef | 1640 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Christopher Haster |
1:24750b9ad5ef | 1641 | case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: |
Christopher Haster |
1:24750b9ad5ef | 1642 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1643 | |
Christopher Haster |
1:24750b9ad5ef | 1644 | ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1645 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1646 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1647 | break; |
Christopher Haster |
1:24750b9ad5ef | 1648 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
Christopher Haster |
1:24750b9ad5ef | 1649 | |
Christopher Haster |
1:24750b9ad5ef | 1650 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Christopher Haster |
1:24750b9ad5ef | 1651 | case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: |
Christopher Haster |
1:24750b9ad5ef | 1652 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1653 | |
Christopher Haster |
1:24750b9ad5ef | 1654 | ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1655 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1656 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1657 | break; |
Christopher Haster |
1:24750b9ad5ef | 1658 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
Christopher Haster |
1:24750b9ad5ef | 1659 | |
Christopher Haster |
1:24750b9ad5ef | 1660 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 1661 | case MBEDTLS_TLS_EXT_SESSION_TICKET: |
Christopher Haster |
1:24750b9ad5ef | 1662 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1663 | |
Christopher Haster |
1:24750b9ad5ef | 1664 | ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1665 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1666 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1667 | break; |
Christopher Haster |
1:24750b9ad5ef | 1668 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Christopher Haster |
1:24750b9ad5ef | 1669 | |
Christopher Haster |
1:24750b9ad5ef | 1670 | #if defined(MBEDTLS_SSL_ALPN) |
Christopher Haster |
1:24750b9ad5ef | 1671 | case MBEDTLS_TLS_EXT_ALPN: |
Christopher Haster |
1:24750b9ad5ef | 1672 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1673 | |
Christopher Haster |
1:24750b9ad5ef | 1674 | ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ); |
Christopher Haster |
1:24750b9ad5ef | 1675 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1676 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1677 | break; |
Christopher Haster |
1:24750b9ad5ef | 1678 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Christopher Haster |
1:24750b9ad5ef | 1679 | |
Christopher Haster |
1:24750b9ad5ef | 1680 | default: |
Christopher Haster |
1:24750b9ad5ef | 1681 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)", |
Christopher Haster |
1:24750b9ad5ef | 1682 | ext_id ) ); |
Christopher Haster |
1:24750b9ad5ef | 1683 | } |
Christopher Haster |
1:24750b9ad5ef | 1684 | |
Christopher Haster |
1:24750b9ad5ef | 1685 | ext_len -= 4 + ext_size; |
Christopher Haster |
1:24750b9ad5ef | 1686 | ext += 4 + ext_size; |
Christopher Haster |
1:24750b9ad5ef | 1687 | |
Christopher Haster |
1:24750b9ad5ef | 1688 | if( ext_len > 0 && ext_len < 4 ) |
Christopher Haster |
1:24750b9ad5ef | 1689 | { |
Christopher Haster |
1:24750b9ad5ef | 1690 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1691 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1692 | } |
Christopher Haster |
1:24750b9ad5ef | 1693 | } |
Christopher Haster |
1:24750b9ad5ef | 1694 | |
Christopher Haster |
1:24750b9ad5ef | 1695 | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) |
Christopher Haster |
1:24750b9ad5ef | 1696 | for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 ) |
Christopher Haster |
1:24750b9ad5ef | 1697 | { |
Christopher Haster |
1:24750b9ad5ef | 1698 | if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) && |
Christopher Haster |
1:24750b9ad5ef | 1699 | p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) ) |
Christopher Haster |
1:24750b9ad5ef | 1700 | { |
Christopher Haster |
1:24750b9ad5ef | 1701 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1702 | |
Christopher Haster |
1:24750b9ad5ef | 1703 | if( ssl->minor_ver < ssl->conf->max_minor_ver ) |
Christopher Haster |
1:24750b9ad5ef | 1704 | { |
Christopher Haster |
1:24750b9ad5ef | 1705 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1706 | |
Christopher Haster |
1:24750b9ad5ef | 1707 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 1708 | MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK ); |
Christopher Haster |
1:24750b9ad5ef | 1709 | |
Christopher Haster |
1:24750b9ad5ef | 1710 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1711 | } |
Christopher Haster |
1:24750b9ad5ef | 1712 | |
Christopher Haster |
1:24750b9ad5ef | 1713 | break; |
Christopher Haster |
1:24750b9ad5ef | 1714 | } |
Christopher Haster |
1:24750b9ad5ef | 1715 | } |
Christopher Haster |
1:24750b9ad5ef | 1716 | #endif /* MBEDTLS_SSL_FALLBACK_SCSV */ |
Christopher Haster |
1:24750b9ad5ef | 1717 | |
Christopher Haster |
1:24750b9ad5ef | 1718 | /* |
Christopher Haster |
1:24750b9ad5ef | 1719 | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
Christopher Haster |
1:24750b9ad5ef | 1720 | */ |
Christopher Haster |
1:24750b9ad5ef | 1721 | for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 ) |
Christopher Haster |
1:24750b9ad5ef | 1722 | { |
Christopher Haster |
1:24750b9ad5ef | 1723 | if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO ) |
Christopher Haster |
1:24750b9ad5ef | 1724 | { |
Christopher Haster |
1:24750b9ad5ef | 1725 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) ); |
Christopher Haster |
1:24750b9ad5ef | 1726 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1727 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
Christopher Haster |
1:24750b9ad5ef | 1728 | { |
Christopher Haster |
1:24750b9ad5ef | 1729 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1730 | |
Christopher Haster |
1:24750b9ad5ef | 1731 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1732 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1733 | |
Christopher Haster |
1:24750b9ad5ef | 1734 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1735 | } |
Christopher Haster |
1:24750b9ad5ef | 1736 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1737 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
Christopher Haster |
1:24750b9ad5ef | 1738 | break; |
Christopher Haster |
1:24750b9ad5ef | 1739 | } |
Christopher Haster |
1:24750b9ad5ef | 1740 | } |
Christopher Haster |
1:24750b9ad5ef | 1741 | |
Christopher Haster |
1:24750b9ad5ef | 1742 | /* |
Christopher Haster |
1:24750b9ad5ef | 1743 | * Renegotiation security checks |
Christopher Haster |
1:24750b9ad5ef | 1744 | */ |
Christopher Haster |
1:24750b9ad5ef | 1745 | if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION && |
Christopher Haster |
1:24750b9ad5ef | 1746 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 1747 | { |
Christopher Haster |
1:24750b9ad5ef | 1748 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1749 | handshake_failure = 1; |
Christopher Haster |
1:24750b9ad5ef | 1750 | } |
Christopher Haster |
1:24750b9ad5ef | 1751 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1752 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
Christopher Haster |
1:24750b9ad5ef | 1753 | ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && |
Christopher Haster |
1:24750b9ad5ef | 1754 | renegotiation_info_seen == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1755 | { |
Christopher Haster |
1:24750b9ad5ef | 1756 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1757 | handshake_failure = 1; |
Christopher Haster |
1:24750b9ad5ef | 1758 | } |
Christopher Haster |
1:24750b9ad5ef | 1759 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
Christopher Haster |
1:24750b9ad5ef | 1760 | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
Christopher Haster |
1:24750b9ad5ef | 1761 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) |
Christopher Haster |
1:24750b9ad5ef | 1762 | { |
Christopher Haster |
1:24750b9ad5ef | 1763 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1764 | handshake_failure = 1; |
Christopher Haster |
1:24750b9ad5ef | 1765 | } |
Christopher Haster |
1:24750b9ad5ef | 1766 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
Christopher Haster |
1:24750b9ad5ef | 1767 | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
Christopher Haster |
1:24750b9ad5ef | 1768 | renegotiation_info_seen == 1 ) |
Christopher Haster |
1:24750b9ad5ef | 1769 | { |
Christopher Haster |
1:24750b9ad5ef | 1770 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1771 | handshake_failure = 1; |
Christopher Haster |
1:24750b9ad5ef | 1772 | } |
Christopher Haster |
1:24750b9ad5ef | 1773 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Christopher Haster |
1:24750b9ad5ef | 1774 | |
Christopher Haster |
1:24750b9ad5ef | 1775 | if( handshake_failure == 1 ) |
Christopher Haster |
1:24750b9ad5ef | 1776 | { |
Christopher Haster |
1:24750b9ad5ef | 1777 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1778 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1779 | |
Christopher Haster |
1:24750b9ad5ef | 1780 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
Christopher Haster |
1:24750b9ad5ef | 1781 | } |
Christopher Haster |
1:24750b9ad5ef | 1782 | |
Christopher Haster |
1:24750b9ad5ef | 1783 | /* |
Christopher Haster |
1:24750b9ad5ef | 1784 | * Search for a matching ciphersuite |
Christopher Haster |
1:24750b9ad5ef | 1785 | * (At the end because we need information from the EC-based extensions |
Christopher Haster |
1:24750b9ad5ef | 1786 | * and certificate from the SNI callback triggered by the SNI extension.) |
Christopher Haster |
1:24750b9ad5ef | 1787 | */ |
Christopher Haster |
1:24750b9ad5ef | 1788 | got_common_suite = 0; |
Christopher Haster |
1:24750b9ad5ef | 1789 | ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; |
Christopher Haster |
1:24750b9ad5ef | 1790 | ciphersuite_info = NULL; |
Christopher Haster |
1:24750b9ad5ef | 1791 | #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE) |
Christopher Haster |
1:24750b9ad5ef | 1792 | for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 ) |
Christopher Haster |
1:24750b9ad5ef | 1793 | { |
Christopher Haster |
1:24750b9ad5ef | 1794 | for( i = 0; ciphersuites[i] != 0; i++ ) |
Christopher Haster |
1:24750b9ad5ef | 1795 | #else |
Christopher Haster |
1:24750b9ad5ef | 1796 | for( i = 0; ciphersuites[i] != 0; i++ ) |
Christopher Haster |
1:24750b9ad5ef | 1797 | { |
Christopher Haster |
1:24750b9ad5ef | 1798 | for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 ) |
Christopher Haster |
1:24750b9ad5ef | 1799 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1800 | { |
Christopher Haster |
1:24750b9ad5ef | 1801 | if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || |
Christopher Haster |
1:24750b9ad5ef | 1802 | p[1] != ( ( ciphersuites[i] ) & 0xFF ) ) |
Christopher Haster |
1:24750b9ad5ef | 1803 | continue; |
Christopher Haster |
1:24750b9ad5ef | 1804 | |
Christopher Haster |
1:24750b9ad5ef | 1805 | got_common_suite = 1; |
Christopher Haster |
1:24750b9ad5ef | 1806 | |
Christopher Haster |
1:24750b9ad5ef | 1807 | if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i], |
Christopher Haster |
1:24750b9ad5ef | 1808 | &ciphersuite_info ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1809 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 1810 | |
Christopher Haster |
1:24750b9ad5ef | 1811 | if( ciphersuite_info != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 1812 | goto have_ciphersuite; |
Christopher Haster |
1:24750b9ad5ef | 1813 | } |
Christopher Haster |
1:24750b9ad5ef | 1814 | } |
Christopher Haster |
1:24750b9ad5ef | 1815 | |
Christopher Haster |
1:24750b9ad5ef | 1816 | if( got_common_suite ) |
Christopher Haster |
1:24750b9ad5ef | 1817 | { |
Christopher Haster |
1:24750b9ad5ef | 1818 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, " |
Christopher Haster |
1:24750b9ad5ef | 1819 | "but none of them usable" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1820 | mbedtls_ssl_send_fatal_handshake_failure( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1821 | return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE ); |
Christopher Haster |
1:24750b9ad5ef | 1822 | } |
Christopher Haster |
1:24750b9ad5ef | 1823 | else |
Christopher Haster |
1:24750b9ad5ef | 1824 | { |
Christopher Haster |
1:24750b9ad5ef | 1825 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1826 | mbedtls_ssl_send_fatal_handshake_failure( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1827 | return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN ); |
Christopher Haster |
1:24750b9ad5ef | 1828 | } |
Christopher Haster |
1:24750b9ad5ef | 1829 | |
Christopher Haster |
1:24750b9ad5ef | 1830 | have_ciphersuite: |
Christopher Haster |
1:24750b9ad5ef | 1831 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) ); |
Christopher Haster |
1:24750b9ad5ef | 1832 | |
Christopher Haster |
1:24750b9ad5ef | 1833 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
Christopher Haster |
1:24750b9ad5ef | 1834 | ssl->transform_negotiate->ciphersuite_info = ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 1835 | mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info ); |
Christopher Haster |
1:24750b9ad5ef | 1836 | |
Christopher Haster |
1:24750b9ad5ef | 1837 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 1838 | |
Christopher Haster |
1:24750b9ad5ef | 1839 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 1840 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Christopher Haster |
1:24750b9ad5ef | 1841 | mbedtls_ssl_recv_flight_completed( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 1842 | #endif |
Christopher Haster |
1:24750b9ad5ef | 1843 | |
Christopher Haster |
1:24750b9ad5ef | 1844 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1845 | |
Christopher Haster |
1:24750b9ad5ef | 1846 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 1847 | } |
Christopher Haster |
1:24750b9ad5ef | 1848 | |
Christopher Haster |
1:24750b9ad5ef | 1849 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Christopher Haster |
1:24750b9ad5ef | 1850 | static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 1851 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 1852 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 1853 | { |
Christopher Haster |
1:24750b9ad5ef | 1854 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 1855 | |
Christopher Haster |
1:24750b9ad5ef | 1856 | if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ) |
Christopher Haster |
1:24750b9ad5ef | 1857 | { |
Christopher Haster |
1:24750b9ad5ef | 1858 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1859 | return; |
Christopher Haster |
1:24750b9ad5ef | 1860 | } |
Christopher Haster |
1:24750b9ad5ef | 1861 | |
Christopher Haster |
1:24750b9ad5ef | 1862 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1863 | |
Christopher Haster |
1:24750b9ad5ef | 1864 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1865 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1866 | |
Christopher Haster |
1:24750b9ad5ef | 1867 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1868 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1869 | |
Christopher Haster |
1:24750b9ad5ef | 1870 | *olen = 4; |
Christopher Haster |
1:24750b9ad5ef | 1871 | } |
Christopher Haster |
1:24750b9ad5ef | 1872 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
Christopher Haster |
1:24750b9ad5ef | 1873 | |
Christopher Haster |
1:24750b9ad5ef | 1874 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Christopher Haster |
1:24750b9ad5ef | 1875 | static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 1876 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 1877 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 1878 | { |
Christopher Haster |
1:24750b9ad5ef | 1879 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 1880 | const mbedtls_ssl_ciphersuite_t *suite = NULL; |
Christopher Haster |
1:24750b9ad5ef | 1881 | const mbedtls_cipher_info_t *cipher = NULL; |
Christopher Haster |
1:24750b9ad5ef | 1882 | |
Christopher Haster |
1:24750b9ad5ef | 1883 | if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED || |
Christopher Haster |
1:24750b9ad5ef | 1884 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
Christopher Haster |
1:24750b9ad5ef | 1885 | { |
Christopher Haster |
1:24750b9ad5ef | 1886 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1887 | return; |
Christopher Haster |
1:24750b9ad5ef | 1888 | } |
Christopher Haster |
1:24750b9ad5ef | 1889 | |
Christopher Haster |
1:24750b9ad5ef | 1890 | /* |
Christopher Haster |
1:24750b9ad5ef | 1891 | * RFC 7366: "If a server receives an encrypt-then-MAC request extension |
Christopher Haster |
1:24750b9ad5ef | 1892 | * from a client and then selects a stream or Authenticated Encryption |
Christopher Haster |
1:24750b9ad5ef | 1893 | * with Associated Data (AEAD) ciphersuite, it MUST NOT send an |
Christopher Haster |
1:24750b9ad5ef | 1894 | * encrypt-then-MAC response extension back to the client." |
Christopher Haster |
1:24750b9ad5ef | 1895 | */ |
Christopher Haster |
1:24750b9ad5ef | 1896 | if( ( suite = mbedtls_ssl_ciphersuite_from_id( |
Christopher Haster |
1:24750b9ad5ef | 1897 | ssl->session_negotiate->ciphersuite ) ) == NULL || |
Christopher Haster |
1:24750b9ad5ef | 1898 | ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL || |
Christopher Haster |
1:24750b9ad5ef | 1899 | cipher->mode != MBEDTLS_MODE_CBC ) |
Christopher Haster |
1:24750b9ad5ef | 1900 | { |
Christopher Haster |
1:24750b9ad5ef | 1901 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1902 | return; |
Christopher Haster |
1:24750b9ad5ef | 1903 | } |
Christopher Haster |
1:24750b9ad5ef | 1904 | |
Christopher Haster |
1:24750b9ad5ef | 1905 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1906 | |
Christopher Haster |
1:24750b9ad5ef | 1907 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1908 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1909 | |
Christopher Haster |
1:24750b9ad5ef | 1910 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1911 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1912 | |
Christopher Haster |
1:24750b9ad5ef | 1913 | *olen = 4; |
Christopher Haster |
1:24750b9ad5ef | 1914 | } |
Christopher Haster |
1:24750b9ad5ef | 1915 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
Christopher Haster |
1:24750b9ad5ef | 1916 | |
Christopher Haster |
1:24750b9ad5ef | 1917 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Christopher Haster |
1:24750b9ad5ef | 1918 | static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 1919 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 1920 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 1921 | { |
Christopher Haster |
1:24750b9ad5ef | 1922 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 1923 | |
Christopher Haster |
1:24750b9ad5ef | 1924 | if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED || |
Christopher Haster |
1:24750b9ad5ef | 1925 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
Christopher Haster |
1:24750b9ad5ef | 1926 | { |
Christopher Haster |
1:24750b9ad5ef | 1927 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1928 | return; |
Christopher Haster |
1:24750b9ad5ef | 1929 | } |
Christopher Haster |
1:24750b9ad5ef | 1930 | |
Christopher Haster |
1:24750b9ad5ef | 1931 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret " |
Christopher Haster |
1:24750b9ad5ef | 1932 | "extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1933 | |
Christopher Haster |
1:24750b9ad5ef | 1934 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1935 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1936 | |
Christopher Haster |
1:24750b9ad5ef | 1937 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1938 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1939 | |
Christopher Haster |
1:24750b9ad5ef | 1940 | *olen = 4; |
Christopher Haster |
1:24750b9ad5ef | 1941 | } |
Christopher Haster |
1:24750b9ad5ef | 1942 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
Christopher Haster |
1:24750b9ad5ef | 1943 | |
Christopher Haster |
1:24750b9ad5ef | 1944 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 1945 | static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 1946 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 1947 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 1948 | { |
Christopher Haster |
1:24750b9ad5ef | 1949 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 1950 | |
Christopher Haster |
1:24750b9ad5ef | 1951 | if( ssl->handshake->new_session_ticket == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 1952 | { |
Christopher Haster |
1:24750b9ad5ef | 1953 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1954 | return; |
Christopher Haster |
1:24750b9ad5ef | 1955 | } |
Christopher Haster |
1:24750b9ad5ef | 1956 | |
Christopher Haster |
1:24750b9ad5ef | 1957 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1958 | |
Christopher Haster |
1:24750b9ad5ef | 1959 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1960 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1961 | |
Christopher Haster |
1:24750b9ad5ef | 1962 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1963 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1964 | |
Christopher Haster |
1:24750b9ad5ef | 1965 | *olen = 4; |
Christopher Haster |
1:24750b9ad5ef | 1966 | } |
Christopher Haster |
1:24750b9ad5ef | 1967 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Christopher Haster |
1:24750b9ad5ef | 1968 | |
Christopher Haster |
1:24750b9ad5ef | 1969 | static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 1970 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 1971 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 1972 | { |
Christopher Haster |
1:24750b9ad5ef | 1973 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 1974 | |
Christopher Haster |
1:24750b9ad5ef | 1975 | if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION ) |
Christopher Haster |
1:24750b9ad5ef | 1976 | { |
Christopher Haster |
1:24750b9ad5ef | 1977 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 1978 | return; |
Christopher Haster |
1:24750b9ad5ef | 1979 | } |
Christopher Haster |
1:24750b9ad5ef | 1980 | |
Christopher Haster |
1:24750b9ad5ef | 1981 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 1982 | |
Christopher Haster |
1:24750b9ad5ef | 1983 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1984 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 1985 | |
Christopher Haster |
1:24750b9ad5ef | 1986 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 1987 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 1988 | { |
Christopher Haster |
1:24750b9ad5ef | 1989 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 1990 | *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF; |
Christopher Haster |
1:24750b9ad5ef | 1991 | *p++ = ssl->verify_data_len * 2 & 0xFF; |
Christopher Haster |
1:24750b9ad5ef | 1992 | |
Christopher Haster |
1:24750b9ad5ef | 1993 | memcpy( p, ssl->peer_verify_data, ssl->verify_data_len ); |
Christopher Haster |
1:24750b9ad5ef | 1994 | p += ssl->verify_data_len; |
Christopher Haster |
1:24750b9ad5ef | 1995 | memcpy( p, ssl->own_verify_data, ssl->verify_data_len ); |
Christopher Haster |
1:24750b9ad5ef | 1996 | p += ssl->verify_data_len; |
Christopher Haster |
1:24750b9ad5ef | 1997 | } |
Christopher Haster |
1:24750b9ad5ef | 1998 | else |
Christopher Haster |
1:24750b9ad5ef | 1999 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
Christopher Haster |
1:24750b9ad5ef | 2000 | { |
Christopher Haster |
1:24750b9ad5ef | 2001 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 2002 | *p++ = 0x01; |
Christopher Haster |
1:24750b9ad5ef | 2003 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 2004 | } |
Christopher Haster |
1:24750b9ad5ef | 2005 | |
Christopher Haster |
1:24750b9ad5ef | 2006 | *olen = p - buf; |
Christopher Haster |
1:24750b9ad5ef | 2007 | } |
Christopher Haster |
1:24750b9ad5ef | 2008 | |
Christopher Haster |
1:24750b9ad5ef | 2009 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Christopher Haster |
1:24750b9ad5ef | 2010 | static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 2011 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 2012 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 2013 | { |
Christopher Haster |
1:24750b9ad5ef | 2014 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 2015 | |
Christopher Haster |
1:24750b9ad5ef | 2016 | if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 2017 | { |
Christopher Haster |
1:24750b9ad5ef | 2018 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 2019 | return; |
Christopher Haster |
1:24750b9ad5ef | 2020 | } |
Christopher Haster |
1:24750b9ad5ef | 2021 | |
Christopher Haster |
1:24750b9ad5ef | 2022 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2023 | |
Christopher Haster |
1:24750b9ad5ef | 2024 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2025 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2026 | |
Christopher Haster |
1:24750b9ad5ef | 2027 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 2028 | *p++ = 1; |
Christopher Haster |
1:24750b9ad5ef | 2029 | |
Christopher Haster |
1:24750b9ad5ef | 2030 | *p++ = ssl->session_negotiate->mfl_code; |
Christopher Haster |
1:24750b9ad5ef | 2031 | |
Christopher Haster |
1:24750b9ad5ef | 2032 | *olen = 5; |
Christopher Haster |
1:24750b9ad5ef | 2033 | } |
Christopher Haster |
1:24750b9ad5ef | 2034 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
Christopher Haster |
1:24750b9ad5ef | 2035 | |
Christopher Haster |
1:24750b9ad5ef | 2036 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Christopher Haster |
1:24750b9ad5ef | 2037 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2038 | static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 2039 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 2040 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 2041 | { |
Christopher Haster |
1:24750b9ad5ef | 2042 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 2043 | ((void) ssl); |
Christopher Haster |
1:24750b9ad5ef | 2044 | |
Christopher Haster |
1:24750b9ad5ef | 2045 | if( ( ssl->handshake->cli_exts & |
Christopher Haster |
1:24750b9ad5ef | 2046 | MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2047 | { |
Christopher Haster |
1:24750b9ad5ef | 2048 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 2049 | return; |
Christopher Haster |
1:24750b9ad5ef | 2050 | } |
Christopher Haster |
1:24750b9ad5ef | 2051 | |
Christopher Haster |
1:24750b9ad5ef | 2052 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2053 | |
Christopher Haster |
1:24750b9ad5ef | 2054 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2055 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2056 | |
Christopher Haster |
1:24750b9ad5ef | 2057 | *p++ = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 2058 | *p++ = 2; |
Christopher Haster |
1:24750b9ad5ef | 2059 | |
Christopher Haster |
1:24750b9ad5ef | 2060 | *p++ = 1; |
Christopher Haster |
1:24750b9ad5ef | 2061 | *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; |
Christopher Haster |
1:24750b9ad5ef | 2062 | |
Christopher Haster |
1:24750b9ad5ef | 2063 | *olen = 6; |
Christopher Haster |
1:24750b9ad5ef | 2064 | } |
Christopher Haster |
1:24750b9ad5ef | 2065 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2066 | |
Christopher Haster |
1:24750b9ad5ef | 2067 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2068 | static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 2069 | unsigned char *buf, |
Christopher Haster |
1:24750b9ad5ef | 2070 | size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 2071 | { |
Christopher Haster |
1:24750b9ad5ef | 2072 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 2073 | unsigned char *p = buf; |
Christopher Haster |
1:24750b9ad5ef | 2074 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; |
Christopher Haster |
1:24750b9ad5ef | 2075 | size_t kkpp_len; |
Christopher Haster |
1:24750b9ad5ef | 2076 | |
Christopher Haster |
1:24750b9ad5ef | 2077 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 2078 | |
Christopher Haster |
1:24750b9ad5ef | 2079 | /* Skip costly computation if not needed */ |
Christopher Haster |
1:24750b9ad5ef | 2080 | if( ssl->transform_negotiate->ciphersuite_info->key_exchange != |
Christopher Haster |
1:24750b9ad5ef | 2081 | MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
Christopher Haster |
1:24750b9ad5ef | 2082 | return; |
Christopher Haster |
1:24750b9ad5ef | 2083 | |
Christopher Haster |
1:24750b9ad5ef | 2084 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2085 | |
Christopher Haster |
1:24750b9ad5ef | 2086 | if( end - p < 4 ) |
Christopher Haster |
1:24750b9ad5ef | 2087 | { |
Christopher Haster |
1:24750b9ad5ef | 2088 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2089 | return; |
Christopher Haster |
1:24750b9ad5ef | 2090 | } |
Christopher Haster |
1:24750b9ad5ef | 2091 | |
Christopher Haster |
1:24750b9ad5ef | 2092 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2093 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2094 | |
Christopher Haster |
1:24750b9ad5ef | 2095 | ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx, |
Christopher Haster |
1:24750b9ad5ef | 2096 | p + 2, end - p - 2, &kkpp_len, |
Christopher Haster |
1:24750b9ad5ef | 2097 | ssl->conf->f_rng, ssl->conf->p_rng ); |
Christopher Haster |
1:24750b9ad5ef | 2098 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2099 | { |
Christopher Haster |
1:24750b9ad5ef | 2100 | MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2101 | return; |
Christopher Haster |
1:24750b9ad5ef | 2102 | } |
Christopher Haster |
1:24750b9ad5ef | 2103 | |
Christopher Haster |
1:24750b9ad5ef | 2104 | *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2105 | *p++ = (unsigned char)( ( kkpp_len ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2106 | |
Christopher Haster |
1:24750b9ad5ef | 2107 | *olen = kkpp_len + 4; |
Christopher Haster |
1:24750b9ad5ef | 2108 | } |
Christopher Haster |
1:24750b9ad5ef | 2109 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2110 | |
Christopher Haster |
1:24750b9ad5ef | 2111 | #if defined(MBEDTLS_SSL_ALPN ) |
Christopher Haster |
1:24750b9ad5ef | 2112 | static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 2113 | unsigned char *buf, size_t *olen ) |
Christopher Haster |
1:24750b9ad5ef | 2114 | { |
Christopher Haster |
1:24750b9ad5ef | 2115 | if( ssl->alpn_chosen == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2116 | { |
Christopher Haster |
1:24750b9ad5ef | 2117 | *olen = 0; |
Christopher Haster |
1:24750b9ad5ef | 2118 | return; |
Christopher Haster |
1:24750b9ad5ef | 2119 | } |
Christopher Haster |
1:24750b9ad5ef | 2120 | |
Christopher Haster |
1:24750b9ad5ef | 2121 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2122 | |
Christopher Haster |
1:24750b9ad5ef | 2123 | /* |
Christopher Haster |
1:24750b9ad5ef | 2124 | * 0 . 1 ext identifier |
Christopher Haster |
1:24750b9ad5ef | 2125 | * 2 . 3 ext length |
Christopher Haster |
1:24750b9ad5ef | 2126 | * 4 . 5 protocol list length |
Christopher Haster |
1:24750b9ad5ef | 2127 | * 6 . 6 protocol name length |
Christopher Haster |
1:24750b9ad5ef | 2128 | * 7 . 7+n protocol name |
Christopher Haster |
1:24750b9ad5ef | 2129 | */ |
Christopher Haster |
1:24750b9ad5ef | 2130 | buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2131 | buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2132 | |
Christopher Haster |
1:24750b9ad5ef | 2133 | *olen = 7 + strlen( ssl->alpn_chosen ); |
Christopher Haster |
1:24750b9ad5ef | 2134 | |
Christopher Haster |
1:24750b9ad5ef | 2135 | buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2136 | buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2137 | |
Christopher Haster |
1:24750b9ad5ef | 2138 | buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2139 | buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2140 | |
Christopher Haster |
1:24750b9ad5ef | 2141 | buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2142 | |
Christopher Haster |
1:24750b9ad5ef | 2143 | memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 ); |
Christopher Haster |
1:24750b9ad5ef | 2144 | } |
Christopher Haster |
1:24750b9ad5ef | 2145 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ |
Christopher Haster |
1:24750b9ad5ef | 2146 | |
Christopher Haster |
1:24750b9ad5ef | 2147 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Christopher Haster |
1:24750b9ad5ef | 2148 | static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 2149 | { |
Christopher Haster |
1:24750b9ad5ef | 2150 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 2151 | unsigned char *p = ssl->out_msg + 4; |
Christopher Haster |
1:24750b9ad5ef | 2152 | unsigned char *cookie_len_byte; |
Christopher Haster |
1:24750b9ad5ef | 2153 | |
Christopher Haster |
1:24750b9ad5ef | 2154 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2155 | |
Christopher Haster |
1:24750b9ad5ef | 2156 | /* |
Christopher Haster |
1:24750b9ad5ef | 2157 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 2158 | * ProtocolVersion server_version; |
Christopher Haster |
1:24750b9ad5ef | 2159 | * opaque cookie<0..2^8-1>; |
Christopher Haster |
1:24750b9ad5ef | 2160 | * } HelloVerifyRequest; |
Christopher Haster |
1:24750b9ad5ef | 2161 | */ |
Christopher Haster |
1:24750b9ad5ef | 2162 | |
Christopher Haster |
1:24750b9ad5ef | 2163 | /* The RFC is not clear on this point, but sending the actual negotiated |
Christopher Haster |
1:24750b9ad5ef | 2164 | * version looks like the most interoperable thing to do. */ |
Christopher Haster |
1:24750b9ad5ef | 2165 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
Christopher Haster |
1:24750b9ad5ef | 2166 | ssl->conf->transport, p ); |
Christopher Haster |
1:24750b9ad5ef | 2167 | MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 ); |
Christopher Haster |
1:24750b9ad5ef | 2168 | p += 2; |
Christopher Haster |
1:24750b9ad5ef | 2169 | |
Christopher Haster |
1:24750b9ad5ef | 2170 | /* If we get here, f_cookie_check is not null */ |
Christopher Haster |
1:24750b9ad5ef | 2171 | if( ssl->conf->f_cookie_write == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2172 | { |
Christopher Haster |
1:24750b9ad5ef | 2173 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2174 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 2175 | } |
Christopher Haster |
1:24750b9ad5ef | 2176 | |
Christopher Haster |
1:24750b9ad5ef | 2177 | /* Skip length byte until we know the length */ |
Christopher Haster |
1:24750b9ad5ef | 2178 | cookie_len_byte = p++; |
Christopher Haster |
1:24750b9ad5ef | 2179 | |
Christopher Haster |
1:24750b9ad5ef | 2180 | if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie, |
Christopher Haster |
1:24750b9ad5ef | 2181 | &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN, |
Christopher Haster |
1:24750b9ad5ef | 2182 | ssl->cli_id, ssl->cli_id_len ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2183 | { |
Christopher Haster |
1:24750b9ad5ef | 2184 | MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2185 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2186 | } |
Christopher Haster |
1:24750b9ad5ef | 2187 | |
Christopher Haster |
1:24750b9ad5ef | 2188 | *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) ); |
Christopher Haster |
1:24750b9ad5ef | 2189 | |
Christopher Haster |
1:24750b9ad5ef | 2190 | MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte ); |
Christopher Haster |
1:24750b9ad5ef | 2191 | |
Christopher Haster |
1:24750b9ad5ef | 2192 | ssl->out_msglen = p - ssl->out_msg; |
Christopher Haster |
1:24750b9ad5ef | 2193 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
Christopher Haster |
1:24750b9ad5ef | 2194 | ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; |
Christopher Haster |
1:24750b9ad5ef | 2195 | |
Christopher Haster |
1:24750b9ad5ef | 2196 | ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT; |
Christopher Haster |
1:24750b9ad5ef | 2197 | |
Christopher Haster |
1:24750b9ad5ef | 2198 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2199 | { |
Christopher Haster |
1:24750b9ad5ef | 2200 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2201 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2202 | } |
Christopher Haster |
1:24750b9ad5ef | 2203 | |
Christopher Haster |
1:24750b9ad5ef | 2204 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2205 | |
Christopher Haster |
1:24750b9ad5ef | 2206 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 2207 | } |
Christopher Haster |
1:24750b9ad5ef | 2208 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Christopher Haster |
1:24750b9ad5ef | 2209 | |
Christopher Haster |
1:24750b9ad5ef | 2210 | static int ssl_write_server_hello( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 2211 | { |
Christopher Haster |
1:24750b9ad5ef | 2212 | #if defined(MBEDTLS_HAVE_TIME) |
Christopher Haster |
1:24750b9ad5ef | 2213 | time_t t; |
Christopher Haster |
1:24750b9ad5ef | 2214 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2215 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 2216 | size_t olen, ext_len = 0, n; |
Christopher Haster |
1:24750b9ad5ef | 2217 | unsigned char *buf, *p; |
Christopher Haster |
1:24750b9ad5ef | 2218 | |
Christopher Haster |
1:24750b9ad5ef | 2219 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2220 | |
Christopher Haster |
1:24750b9ad5ef | 2221 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
Christopher Haster |
1:24750b9ad5ef | 2222 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
Christopher Haster |
1:24750b9ad5ef | 2223 | ssl->handshake->verify_cookie_len != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2224 | { |
Christopher Haster |
1:24750b9ad5ef | 2225 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2226 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2227 | |
Christopher Haster |
1:24750b9ad5ef | 2228 | return( ssl_write_hello_verify_request( ssl ) ); |
Christopher Haster |
1:24750b9ad5ef | 2229 | } |
Christopher Haster |
1:24750b9ad5ef | 2230 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
Christopher Haster |
1:24750b9ad5ef | 2231 | |
Christopher Haster |
1:24750b9ad5ef | 2232 | if( ssl->conf->f_rng == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2233 | { |
Christopher Haster |
1:24750b9ad5ef | 2234 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") ); |
Christopher Haster |
1:24750b9ad5ef | 2235 | return( MBEDTLS_ERR_SSL_NO_RNG ); |
Christopher Haster |
1:24750b9ad5ef | 2236 | } |
Christopher Haster |
1:24750b9ad5ef | 2237 | |
Christopher Haster |
1:24750b9ad5ef | 2238 | /* |
Christopher Haster |
1:24750b9ad5ef | 2239 | * 0 . 0 handshake type |
Christopher Haster |
1:24750b9ad5ef | 2240 | * 1 . 3 handshake length |
Christopher Haster |
1:24750b9ad5ef | 2241 | * 4 . 5 protocol version |
Christopher Haster |
1:24750b9ad5ef | 2242 | * 6 . 9 UNIX time() |
Christopher Haster |
1:24750b9ad5ef | 2243 | * 10 . 37 random bytes |
Christopher Haster |
1:24750b9ad5ef | 2244 | */ |
Christopher Haster |
1:24750b9ad5ef | 2245 | buf = ssl->out_msg; |
Christopher Haster |
1:24750b9ad5ef | 2246 | p = buf + 4; |
Christopher Haster |
1:24750b9ad5ef | 2247 | |
Christopher Haster |
1:24750b9ad5ef | 2248 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
Christopher Haster |
1:24750b9ad5ef | 2249 | ssl->conf->transport, p ); |
Christopher Haster |
1:24750b9ad5ef | 2250 | p += 2; |
Christopher Haster |
1:24750b9ad5ef | 2251 | |
Christopher Haster |
1:24750b9ad5ef | 2252 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]", |
Christopher Haster |
1:24750b9ad5ef | 2253 | buf[4], buf[5] ) ); |
Christopher Haster |
1:24750b9ad5ef | 2254 | |
Christopher Haster |
1:24750b9ad5ef | 2255 | #if defined(MBEDTLS_HAVE_TIME) |
Christopher Haster |
1:24750b9ad5ef | 2256 | t = time( NULL ); |
Christopher Haster |
1:24750b9ad5ef | 2257 | *p++ = (unsigned char)( t >> 24 ); |
Christopher Haster |
1:24750b9ad5ef | 2258 | *p++ = (unsigned char)( t >> 16 ); |
Christopher Haster |
1:24750b9ad5ef | 2259 | *p++ = (unsigned char)( t >> 8 ); |
Christopher Haster |
1:24750b9ad5ef | 2260 | *p++ = (unsigned char)( t ); |
Christopher Haster |
1:24750b9ad5ef | 2261 | |
Christopher Haster |
1:24750b9ad5ef | 2262 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) ); |
Christopher Haster |
1:24750b9ad5ef | 2263 | #else |
Christopher Haster |
1:24750b9ad5ef | 2264 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2265 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2266 | |
Christopher Haster |
1:24750b9ad5ef | 2267 | p += 4; |
Christopher Haster |
1:24750b9ad5ef | 2268 | #endif /* MBEDTLS_HAVE_TIME */ |
Christopher Haster |
1:24750b9ad5ef | 2269 | |
Christopher Haster |
1:24750b9ad5ef | 2270 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2271 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2272 | |
Christopher Haster |
1:24750b9ad5ef | 2273 | p += 28; |
Christopher Haster |
1:24750b9ad5ef | 2274 | |
Christopher Haster |
1:24750b9ad5ef | 2275 | memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 ); |
Christopher Haster |
1:24750b9ad5ef | 2276 | |
Christopher Haster |
1:24750b9ad5ef | 2277 | MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 ); |
Christopher Haster |
1:24750b9ad5ef | 2278 | |
Christopher Haster |
1:24750b9ad5ef | 2279 | /* |
Christopher Haster |
1:24750b9ad5ef | 2280 | * Resume is 0 by default, see ssl_handshake_init(). |
Christopher Haster |
1:24750b9ad5ef | 2281 | * It may be already set to 1 by ssl_parse_session_ticket_ext(). |
Christopher Haster |
1:24750b9ad5ef | 2282 | * If not, try looking up session ID in our cache. |
Christopher Haster |
1:24750b9ad5ef | 2283 | */ |
Christopher Haster |
1:24750b9ad5ef | 2284 | if( ssl->handshake->resume == 0 && |
Christopher Haster |
1:24750b9ad5ef | 2285 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
Christopher Haster |
1:24750b9ad5ef | 2286 | ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE && |
Christopher Haster |
1:24750b9ad5ef | 2287 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2288 | ssl->session_negotiate->id_len != 0 && |
Christopher Haster |
1:24750b9ad5ef | 2289 | ssl->conf->f_get_cache != NULL && |
Christopher Haster |
1:24750b9ad5ef | 2290 | ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2291 | { |
Christopher Haster |
1:24750b9ad5ef | 2292 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2293 | ssl->handshake->resume = 1; |
Christopher Haster |
1:24750b9ad5ef | 2294 | } |
Christopher Haster |
1:24750b9ad5ef | 2295 | |
Christopher Haster |
1:24750b9ad5ef | 2296 | if( ssl->handshake->resume == 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2297 | { |
Christopher Haster |
1:24750b9ad5ef | 2298 | /* |
Christopher Haster |
1:24750b9ad5ef | 2299 | * New session, create a new session id, |
Christopher Haster |
1:24750b9ad5ef | 2300 | * unless we're about to issue a session ticket |
Christopher Haster |
1:24750b9ad5ef | 2301 | */ |
Christopher Haster |
1:24750b9ad5ef | 2302 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 2303 | |
Christopher Haster |
1:24750b9ad5ef | 2304 | #if defined(MBEDTLS_HAVE_TIME) |
Christopher Haster |
1:24750b9ad5ef | 2305 | ssl->session_negotiate->start = time( NULL ); |
Christopher Haster |
1:24750b9ad5ef | 2306 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2307 | |
Christopher Haster |
1:24750b9ad5ef | 2308 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 2309 | if( ssl->handshake->new_session_ticket != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2310 | { |
Christopher Haster |
1:24750b9ad5ef | 2311 | ssl->session_negotiate->id_len = n = 0; |
Christopher Haster |
1:24750b9ad5ef | 2312 | memset( ssl->session_negotiate->id, 0, 32 ); |
Christopher Haster |
1:24750b9ad5ef | 2313 | } |
Christopher Haster |
1:24750b9ad5ef | 2314 | else |
Christopher Haster |
1:24750b9ad5ef | 2315 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Christopher Haster |
1:24750b9ad5ef | 2316 | { |
Christopher Haster |
1:24750b9ad5ef | 2317 | ssl->session_negotiate->id_len = n = 32; |
Christopher Haster |
1:24750b9ad5ef | 2318 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, |
Christopher Haster |
1:24750b9ad5ef | 2319 | n ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2320 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2321 | } |
Christopher Haster |
1:24750b9ad5ef | 2322 | } |
Christopher Haster |
1:24750b9ad5ef | 2323 | else |
Christopher Haster |
1:24750b9ad5ef | 2324 | { |
Christopher Haster |
1:24750b9ad5ef | 2325 | /* |
Christopher Haster |
1:24750b9ad5ef | 2326 | * Resuming a session |
Christopher Haster |
1:24750b9ad5ef | 2327 | */ |
Christopher Haster |
1:24750b9ad5ef | 2328 | n = ssl->session_negotiate->id_len; |
Christopher Haster |
1:24750b9ad5ef | 2329 | ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; |
Christopher Haster |
1:24750b9ad5ef | 2330 | |
Christopher Haster |
1:24750b9ad5ef | 2331 | if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2332 | { |
Christopher Haster |
1:24750b9ad5ef | 2333 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2334 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2335 | } |
Christopher Haster |
1:24750b9ad5ef | 2336 | } |
Christopher Haster |
1:24750b9ad5ef | 2337 | |
Christopher Haster |
1:24750b9ad5ef | 2338 | /* |
Christopher Haster |
1:24750b9ad5ef | 2339 | * 38 . 38 session id length |
Christopher Haster |
1:24750b9ad5ef | 2340 | * 39 . 38+n session id |
Christopher Haster |
1:24750b9ad5ef | 2341 | * 39+n . 40+n chosen ciphersuite |
Christopher Haster |
1:24750b9ad5ef | 2342 | * 41+n . 41+n chosen compression alg. |
Christopher Haster |
1:24750b9ad5ef | 2343 | * 42+n . 43+n extensions length |
Christopher Haster |
1:24750b9ad5ef | 2344 | * 44+n . 43+n+m extensions |
Christopher Haster |
1:24750b9ad5ef | 2345 | */ |
Christopher Haster |
1:24750b9ad5ef | 2346 | *p++ = (unsigned char) ssl->session_negotiate->id_len; |
Christopher Haster |
1:24750b9ad5ef | 2347 | memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len ); |
Christopher Haster |
1:24750b9ad5ef | 2348 | p += ssl->session_negotiate->id_len; |
Christopher Haster |
1:24750b9ad5ef | 2349 | |
Christopher Haster |
1:24750b9ad5ef | 2350 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) ); |
Christopher Haster |
1:24750b9ad5ef | 2351 | MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n ); |
Christopher Haster |
1:24750b9ad5ef | 2352 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed", |
Christopher Haster |
1:24750b9ad5ef | 2353 | ssl->handshake->resume ? "a" : "no" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2354 | |
Christopher Haster |
1:24750b9ad5ef | 2355 | *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 ); |
Christopher Haster |
1:24750b9ad5ef | 2356 | *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite ); |
Christopher Haster |
1:24750b9ad5ef | 2357 | *p++ = (unsigned char)( ssl->session_negotiate->compression ); |
Christopher Haster |
1:24750b9ad5ef | 2358 | |
Christopher Haster |
1:24750b9ad5ef | 2359 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", |
Christopher Haster |
1:24750b9ad5ef | 2360 | mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) ); |
Christopher Haster |
1:24750b9ad5ef | 2361 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X", |
Christopher Haster |
1:24750b9ad5ef | 2362 | ssl->session_negotiate->compression ) ); |
Christopher Haster |
1:24750b9ad5ef | 2363 | |
Christopher Haster |
1:24750b9ad5ef | 2364 | /* |
Christopher Haster |
1:24750b9ad5ef | 2365 | * First write extensions, then the total length |
Christopher Haster |
1:24750b9ad5ef | 2366 | */ |
Christopher Haster |
1:24750b9ad5ef | 2367 | ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2368 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2369 | |
Christopher Haster |
1:24750b9ad5ef | 2370 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
Christopher Haster |
1:24750b9ad5ef | 2371 | ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2372 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2373 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2374 | |
Christopher Haster |
1:24750b9ad5ef | 2375 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
Christopher Haster |
1:24750b9ad5ef | 2376 | ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2377 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2378 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2379 | |
Christopher Haster |
1:24750b9ad5ef | 2380 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
Christopher Haster |
1:24750b9ad5ef | 2381 | ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2382 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2383 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2384 | |
Christopher Haster |
1:24750b9ad5ef | 2385 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
Christopher Haster |
1:24750b9ad5ef | 2386 | ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2387 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2388 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2389 | |
Christopher Haster |
1:24750b9ad5ef | 2390 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 2391 | ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2392 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2393 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2394 | |
Christopher Haster |
1:24750b9ad5ef | 2395 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
Christopher Haster |
1:24750b9ad5ef | 2396 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2397 | ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2398 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2399 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2400 | |
Christopher Haster |
1:24750b9ad5ef | 2401 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2402 | ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2403 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2404 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2405 | |
Christopher Haster |
1:24750b9ad5ef | 2406 | #if defined(MBEDTLS_SSL_ALPN) |
Christopher Haster |
1:24750b9ad5ef | 2407 | ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen ); |
Christopher Haster |
1:24750b9ad5ef | 2408 | ext_len += olen; |
Christopher Haster |
1:24750b9ad5ef | 2409 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2410 | |
Christopher Haster |
1:24750b9ad5ef | 2411 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) ); |
Christopher Haster |
1:24750b9ad5ef | 2412 | |
Christopher Haster |
1:24750b9ad5ef | 2413 | if( ext_len > 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2414 | { |
Christopher Haster |
1:24750b9ad5ef | 2415 | *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2416 | *p++ = (unsigned char)( ( ext_len ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 2417 | p += ext_len; |
Christopher Haster |
1:24750b9ad5ef | 2418 | } |
Christopher Haster |
1:24750b9ad5ef | 2419 | |
Christopher Haster |
1:24750b9ad5ef | 2420 | ssl->out_msglen = p - buf; |
Christopher Haster |
1:24750b9ad5ef | 2421 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
Christopher Haster |
1:24750b9ad5ef | 2422 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO; |
Christopher Haster |
1:24750b9ad5ef | 2423 | |
Christopher Haster |
1:24750b9ad5ef | 2424 | ret = mbedtls_ssl_write_record( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 2425 | |
Christopher Haster |
1:24750b9ad5ef | 2426 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2427 | |
Christopher Haster |
1:24750b9ad5ef | 2428 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2429 | } |
Christopher Haster |
1:24750b9ad5ef | 2430 | |
Christopher Haster |
1:24750b9ad5ef | 2431 | #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ |
Christopher Haster |
1:24750b9ad5ef | 2432 | !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ |
Christopher Haster |
1:24750b9ad5ef | 2433 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ |
Christopher Haster |
1:24750b9ad5ef | 2434 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2435 | static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 2436 | { |
Christopher Haster |
1:24750b9ad5ef | 2437 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 2438 | |
Christopher Haster |
1:24750b9ad5ef | 2439 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2440 | |
Christopher Haster |
1:24750b9ad5ef | 2441 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2442 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2443 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2444 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2445 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
Christopher Haster |
1:24750b9ad5ef | 2446 | { |
Christopher Haster |
1:24750b9ad5ef | 2447 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2448 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 2449 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 2450 | } |
Christopher Haster |
1:24750b9ad5ef | 2451 | |
Christopher Haster |
1:24750b9ad5ef | 2452 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2453 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 2454 | } |
Christopher Haster |
1:24750b9ad5ef | 2455 | #else |
Christopher Haster |
1:24750b9ad5ef | 2456 | static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 2457 | { |
Christopher Haster |
1:24750b9ad5ef | 2458 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Christopher Haster |
1:24750b9ad5ef | 2459 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 2460 | size_t dn_size, total_dn_size; /* excluding length bytes */ |
Christopher Haster |
1:24750b9ad5ef | 2461 | size_t ct_len, sa_len; /* including length bytes */ |
Christopher Haster |
1:24750b9ad5ef | 2462 | unsigned char *buf, *p; |
Christopher Haster |
1:24750b9ad5ef | 2463 | const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; |
Christopher Haster |
1:24750b9ad5ef | 2464 | const mbedtls_x509_crt *crt; |
Christopher Haster |
1:24750b9ad5ef | 2465 | int authmode; |
Christopher Haster |
1:24750b9ad5ef | 2466 | |
Christopher Haster |
1:24750b9ad5ef | 2467 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2468 | |
Christopher Haster |
1:24750b9ad5ef | 2469 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 2470 | |
Christopher Haster |
1:24750b9ad5ef | 2471 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Christopher Haster |
1:24750b9ad5ef | 2472 | if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET ) |
Christopher Haster |
1:24750b9ad5ef | 2473 | authmode = ssl->handshake->sni_authmode; |
Christopher Haster |
1:24750b9ad5ef | 2474 | else |
Christopher Haster |
1:24750b9ad5ef | 2475 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2476 | authmode = ssl->conf->authmode; |
Christopher Haster |
1:24750b9ad5ef | 2477 | |
Christopher Haster |
1:24750b9ad5ef | 2478 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2479 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2480 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2481 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2482 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE || |
Christopher Haster |
1:24750b9ad5ef | 2483 | authmode == MBEDTLS_SSL_VERIFY_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 2484 | { |
Christopher Haster |
1:24750b9ad5ef | 2485 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2486 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 2487 | } |
Christopher Haster |
1:24750b9ad5ef | 2488 | |
Christopher Haster |
1:24750b9ad5ef | 2489 | /* |
Christopher Haster |
1:24750b9ad5ef | 2490 | * 0 . 0 handshake type |
Christopher Haster |
1:24750b9ad5ef | 2491 | * 1 . 3 handshake length |
Christopher Haster |
1:24750b9ad5ef | 2492 | * 4 . 4 cert type count |
Christopher Haster |
1:24750b9ad5ef | 2493 | * 5 .. m-1 cert types |
Christopher Haster |
1:24750b9ad5ef | 2494 | * m .. m+1 sig alg length (TLS 1.2 only) |
Christopher Haster |
1:24750b9ad5ef | 2495 | * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only) |
Christopher Haster |
1:24750b9ad5ef | 2496 | * n .. n+1 length of all DNs |
Christopher Haster |
1:24750b9ad5ef | 2497 | * n+2 .. n+3 length of DN 1 |
Christopher Haster |
1:24750b9ad5ef | 2498 | * n+4 .. ... Distinguished Name #1 |
Christopher Haster |
1:24750b9ad5ef | 2499 | * ... .. ... length of DN 2, etc. |
Christopher Haster |
1:24750b9ad5ef | 2500 | */ |
Christopher Haster |
1:24750b9ad5ef | 2501 | buf = ssl->out_msg; |
Christopher Haster |
1:24750b9ad5ef | 2502 | p = buf + 4; |
Christopher Haster |
1:24750b9ad5ef | 2503 | |
Christopher Haster |
1:24750b9ad5ef | 2504 | /* |
Christopher Haster |
1:24750b9ad5ef | 2505 | * Supported certificate types |
Christopher Haster |
1:24750b9ad5ef | 2506 | * |
Christopher Haster |
1:24750b9ad5ef | 2507 | * ClientCertificateType certificate_types<1..2^8-1>; |
Christopher Haster |
1:24750b9ad5ef | 2508 | * enum { (255) } ClientCertificateType; |
Christopher Haster |
1:24750b9ad5ef | 2509 | */ |
Christopher Haster |
1:24750b9ad5ef | 2510 | ct_len = 0; |
Christopher Haster |
1:24750b9ad5ef | 2511 | |
Christopher Haster |
1:24750b9ad5ef | 2512 | #if defined(MBEDTLS_RSA_C) |
Christopher Haster |
1:24750b9ad5ef | 2513 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN; |
Christopher Haster |
1:24750b9ad5ef | 2514 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2515 | #if defined(MBEDTLS_ECDSA_C) |
Christopher Haster |
1:24750b9ad5ef | 2516 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN; |
Christopher Haster |
1:24750b9ad5ef | 2517 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2518 | |
Christopher Haster |
1:24750b9ad5ef | 2519 | p[0] = (unsigned char) ct_len++; |
Christopher Haster |
1:24750b9ad5ef | 2520 | p += ct_len; |
Christopher Haster |
1:24750b9ad5ef | 2521 | |
Christopher Haster |
1:24750b9ad5ef | 2522 | sa_len = 0; |
Christopher Haster |
1:24750b9ad5ef | 2523 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 2524 | /* |
Christopher Haster |
1:24750b9ad5ef | 2525 | * Add signature_algorithms for verify (TLS 1.2) |
Christopher Haster |
1:24750b9ad5ef | 2526 | * |
Christopher Haster |
1:24750b9ad5ef | 2527 | * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; |
Christopher Haster |
1:24750b9ad5ef | 2528 | * |
Christopher Haster |
1:24750b9ad5ef | 2529 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 2530 | * HashAlgorithm hash; |
Christopher Haster |
1:24750b9ad5ef | 2531 | * SignatureAlgorithm signature; |
Christopher Haster |
1:24750b9ad5ef | 2532 | * } SignatureAndHashAlgorithm; |
Christopher Haster |
1:24750b9ad5ef | 2533 | * |
Christopher Haster |
1:24750b9ad5ef | 2534 | * enum { (255) } HashAlgorithm; |
Christopher Haster |
1:24750b9ad5ef | 2535 | * enum { (255) } SignatureAlgorithm; |
Christopher Haster |
1:24750b9ad5ef | 2536 | */ |
Christopher Haster |
1:24750b9ad5ef | 2537 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 2538 | { |
Christopher Haster |
1:24750b9ad5ef | 2539 | /* |
Christopher Haster |
1:24750b9ad5ef | 2540 | * Only use current running hash algorithm that is already required |
Christopher Haster |
1:24750b9ad5ef | 2541 | * for requested ciphersuite. |
Christopher Haster |
1:24750b9ad5ef | 2542 | */ |
Christopher Haster |
1:24750b9ad5ef | 2543 | ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256; |
Christopher Haster |
1:24750b9ad5ef | 2544 | |
Christopher Haster |
1:24750b9ad5ef | 2545 | if( ssl->transform_negotiate->ciphersuite_info->mac == |
Christopher Haster |
1:24750b9ad5ef | 2546 | MBEDTLS_MD_SHA384 ) |
Christopher Haster |
1:24750b9ad5ef | 2547 | { |
Christopher Haster |
1:24750b9ad5ef | 2548 | ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384; |
Christopher Haster |
1:24750b9ad5ef | 2549 | } |
Christopher Haster |
1:24750b9ad5ef | 2550 | |
Christopher Haster |
1:24750b9ad5ef | 2551 | /* |
Christopher Haster |
1:24750b9ad5ef | 2552 | * Supported signature algorithms |
Christopher Haster |
1:24750b9ad5ef | 2553 | */ |
Christopher Haster |
1:24750b9ad5ef | 2554 | #if defined(MBEDTLS_RSA_C) |
Christopher Haster |
1:24750b9ad5ef | 2555 | p[2 + sa_len++] = ssl->handshake->verify_sig_alg; |
Christopher Haster |
1:24750b9ad5ef | 2556 | p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA; |
Christopher Haster |
1:24750b9ad5ef | 2557 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2558 | #if defined(MBEDTLS_ECDSA_C) |
Christopher Haster |
1:24750b9ad5ef | 2559 | p[2 + sa_len++] = ssl->handshake->verify_sig_alg; |
Christopher Haster |
1:24750b9ad5ef | 2560 | p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA; |
Christopher Haster |
1:24750b9ad5ef | 2561 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2562 | |
Christopher Haster |
1:24750b9ad5ef | 2563 | p[0] = (unsigned char)( sa_len >> 8 ); |
Christopher Haster |
1:24750b9ad5ef | 2564 | p[1] = (unsigned char)( sa_len ); |
Christopher Haster |
1:24750b9ad5ef | 2565 | sa_len += 2; |
Christopher Haster |
1:24750b9ad5ef | 2566 | p += sa_len; |
Christopher Haster |
1:24750b9ad5ef | 2567 | } |
Christopher Haster |
1:24750b9ad5ef | 2568 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Christopher Haster |
1:24750b9ad5ef | 2569 | |
Christopher Haster |
1:24750b9ad5ef | 2570 | /* |
Christopher Haster |
1:24750b9ad5ef | 2571 | * DistinguishedName certificate_authorities<0..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 2572 | * opaque DistinguishedName<1..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 2573 | */ |
Christopher Haster |
1:24750b9ad5ef | 2574 | p += 2; |
Christopher Haster |
1:24750b9ad5ef | 2575 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
Christopher Haster |
1:24750b9ad5ef | 2576 | if( ssl->handshake->sni_ca_chain != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2577 | crt = ssl->handshake->sni_ca_chain; |
Christopher Haster |
1:24750b9ad5ef | 2578 | else |
Christopher Haster |
1:24750b9ad5ef | 2579 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2580 | crt = ssl->conf->ca_chain; |
Christopher Haster |
1:24750b9ad5ef | 2581 | |
Christopher Haster |
1:24750b9ad5ef | 2582 | total_dn_size = 0; |
Christopher Haster |
1:24750b9ad5ef | 2583 | while( crt != NULL && crt->version != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2584 | { |
Christopher Haster |
1:24750b9ad5ef | 2585 | dn_size = crt->subject_raw.len; |
Christopher Haster |
1:24750b9ad5ef | 2586 | |
Christopher Haster |
1:24750b9ad5ef | 2587 | if( end < p || (size_t)( end - p ) < 2 + dn_size ) |
Christopher Haster |
1:24750b9ad5ef | 2588 | { |
Christopher Haster |
1:24750b9ad5ef | 2589 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2590 | break; |
Christopher Haster |
1:24750b9ad5ef | 2591 | } |
Christopher Haster |
1:24750b9ad5ef | 2592 | |
Christopher Haster |
1:24750b9ad5ef | 2593 | *p++ = (unsigned char)( dn_size >> 8 ); |
Christopher Haster |
1:24750b9ad5ef | 2594 | *p++ = (unsigned char)( dn_size ); |
Christopher Haster |
1:24750b9ad5ef | 2595 | memcpy( p, crt->subject_raw.p, dn_size ); |
Christopher Haster |
1:24750b9ad5ef | 2596 | p += dn_size; |
Christopher Haster |
1:24750b9ad5ef | 2597 | |
Christopher Haster |
1:24750b9ad5ef | 2598 | MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size ); |
Christopher Haster |
1:24750b9ad5ef | 2599 | |
Christopher Haster |
1:24750b9ad5ef | 2600 | total_dn_size += 2 + dn_size; |
Christopher Haster |
1:24750b9ad5ef | 2601 | crt = crt->next; |
Christopher Haster |
1:24750b9ad5ef | 2602 | } |
Christopher Haster |
1:24750b9ad5ef | 2603 | |
Christopher Haster |
1:24750b9ad5ef | 2604 | ssl->out_msglen = p - buf; |
Christopher Haster |
1:24750b9ad5ef | 2605 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
Christopher Haster |
1:24750b9ad5ef | 2606 | ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST; |
Christopher Haster |
1:24750b9ad5ef | 2607 | ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 ); |
Christopher Haster |
1:24750b9ad5ef | 2608 | ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size ); |
Christopher Haster |
1:24750b9ad5ef | 2609 | |
Christopher Haster |
1:24750b9ad5ef | 2610 | ret = mbedtls_ssl_write_record( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 2611 | |
Christopher Haster |
1:24750b9ad5ef | 2612 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2613 | |
Christopher Haster |
1:24750b9ad5ef | 2614 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2615 | } |
Christopher Haster |
1:24750b9ad5ef | 2616 | #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 2617 | !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 2618 | !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 2619 | !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2620 | |
Christopher Haster |
1:24750b9ad5ef | 2621 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2622 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2623 | static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 2624 | { |
Christopher Haster |
1:24750b9ad5ef | 2625 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 2626 | |
Christopher Haster |
1:24750b9ad5ef | 2627 | if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) ) |
Christopher Haster |
1:24750b9ad5ef | 2628 | { |
Christopher Haster |
1:24750b9ad5ef | 2629 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2630 | return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); |
Christopher Haster |
1:24750b9ad5ef | 2631 | } |
Christopher Haster |
1:24750b9ad5ef | 2632 | |
Christopher Haster |
1:24750b9ad5ef | 2633 | if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, |
Christopher Haster |
1:24750b9ad5ef | 2634 | mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ), |
Christopher Haster |
1:24750b9ad5ef | 2635 | MBEDTLS_ECDH_OURS ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2636 | { |
Christopher Haster |
1:24750b9ad5ef | 2637 | MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 2638 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2639 | } |
Christopher Haster |
1:24750b9ad5ef | 2640 | |
Christopher Haster |
1:24750b9ad5ef | 2641 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 2642 | } |
Christopher Haster |
1:24750b9ad5ef | 2643 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || |
Christopher Haster |
1:24750b9ad5ef | 2644 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2645 | |
Christopher Haster |
1:24750b9ad5ef | 2646 | static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 2647 | { |
Christopher Haster |
1:24750b9ad5ef | 2648 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 2649 | size_t n = 0; |
Christopher Haster |
1:24750b9ad5ef | 2650 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
Christopher Haster |
1:24750b9ad5ef | 2651 | ssl->transform_negotiate->ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 2652 | |
Christopher Haster |
1:24750b9ad5ef | 2653 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2654 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2655 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2656 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2657 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2658 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2659 | unsigned char *p = ssl->out_msg + 4; |
Christopher Haster |
1:24750b9ad5ef | 2660 | unsigned char *dig_signed = p; |
Christopher Haster |
1:24750b9ad5ef | 2661 | size_t dig_signed_len = 0, len; |
Christopher Haster |
1:24750b9ad5ef | 2662 | ((void) dig_signed); |
Christopher Haster |
1:24750b9ad5ef | 2663 | ((void) dig_signed_len); |
Christopher Haster |
1:24750b9ad5ef | 2664 | ((void) len); |
Christopher Haster |
1:24750b9ad5ef | 2665 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2666 | |
Christopher Haster |
1:24750b9ad5ef | 2667 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2668 | |
Christopher Haster |
1:24750b9ad5ef | 2669 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2670 | defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2671 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2672 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA || |
Christopher Haster |
1:24750b9ad5ef | 2673 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2674 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 2675 | { |
Christopher Haster |
1:24750b9ad5ef | 2676 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2677 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 2678 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 2679 | } |
Christopher Haster |
1:24750b9ad5ef | 2680 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2681 | |
Christopher Haster |
1:24750b9ad5ef | 2682 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2683 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2684 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || |
Christopher Haster |
1:24750b9ad5ef | 2685 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) |
Christopher Haster |
1:24750b9ad5ef | 2686 | { |
Christopher Haster |
1:24750b9ad5ef | 2687 | ssl_get_ecdh_params_from_cert( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 2688 | |
Christopher Haster |
1:24750b9ad5ef | 2689 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2690 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 2691 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 2692 | } |
Christopher Haster |
1:24750b9ad5ef | 2693 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2694 | |
Christopher Haster |
1:24750b9ad5ef | 2695 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2696 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
Christopher Haster |
1:24750b9ad5ef | 2697 | { |
Christopher Haster |
1:24750b9ad5ef | 2698 | size_t jlen; |
Christopher Haster |
1:24750b9ad5ef | 2699 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; |
Christopher Haster |
1:24750b9ad5ef | 2700 | |
Christopher Haster |
1:24750b9ad5ef | 2701 | ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx, |
Christopher Haster |
1:24750b9ad5ef | 2702 | p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng ); |
Christopher Haster |
1:24750b9ad5ef | 2703 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2704 | { |
Christopher Haster |
1:24750b9ad5ef | 2705 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2706 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2707 | } |
Christopher Haster |
1:24750b9ad5ef | 2708 | |
Christopher Haster |
1:24750b9ad5ef | 2709 | p += jlen; |
Christopher Haster |
1:24750b9ad5ef | 2710 | n += jlen; |
Christopher Haster |
1:24750b9ad5ef | 2711 | } |
Christopher Haster |
1:24750b9ad5ef | 2712 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2713 | |
Christopher Haster |
1:24750b9ad5ef | 2714 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2715 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2716 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 2717 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 2718 | { |
Christopher Haster |
1:24750b9ad5ef | 2719 | /* TODO: Support identity hints */ |
Christopher Haster |
1:24750b9ad5ef | 2720 | *(p++) = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 2721 | *(p++) = 0x00; |
Christopher Haster |
1:24750b9ad5ef | 2722 | |
Christopher Haster |
1:24750b9ad5ef | 2723 | n += 2; |
Christopher Haster |
1:24750b9ad5ef | 2724 | } |
Christopher Haster |
1:24750b9ad5ef | 2725 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 2726 | MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2727 | |
Christopher Haster |
1:24750b9ad5ef | 2728 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2729 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2730 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA || |
Christopher Haster |
1:24750b9ad5ef | 2731 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 2732 | { |
Christopher Haster |
1:24750b9ad5ef | 2733 | if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2734 | { |
Christopher Haster |
1:24750b9ad5ef | 2735 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2736 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Christopher Haster |
1:24750b9ad5ef | 2737 | } |
Christopher Haster |
1:24750b9ad5ef | 2738 | |
Christopher Haster |
1:24750b9ad5ef | 2739 | /* |
Christopher Haster |
1:24750b9ad5ef | 2740 | * Ephemeral DH parameters: |
Christopher Haster |
1:24750b9ad5ef | 2741 | * |
Christopher Haster |
1:24750b9ad5ef | 2742 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 2743 | * opaque dh_p<1..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 2744 | * opaque dh_g<1..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 2745 | * opaque dh_Ys<1..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 2746 | * } ServerDHParams; |
Christopher Haster |
1:24750b9ad5ef | 2747 | */ |
Christopher Haster |
1:24750b9ad5ef | 2748 | if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 || |
Christopher Haster |
1:24750b9ad5ef | 2749 | ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2750 | { |
Christopher Haster |
1:24750b9ad5ef | 2751 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2752 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2753 | } |
Christopher Haster |
1:24750b9ad5ef | 2754 | |
Christopher Haster |
1:24750b9ad5ef | 2755 | if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx, |
Christopher Haster |
1:24750b9ad5ef | 2756 | (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ), |
Christopher Haster |
1:24750b9ad5ef | 2757 | p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2758 | { |
Christopher Haster |
1:24750b9ad5ef | 2759 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2760 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2761 | } |
Christopher Haster |
1:24750b9ad5ef | 2762 | |
Christopher Haster |
1:24750b9ad5ef | 2763 | dig_signed = p; |
Christopher Haster |
1:24750b9ad5ef | 2764 | dig_signed_len = len; |
Christopher Haster |
1:24750b9ad5ef | 2765 | |
Christopher Haster |
1:24750b9ad5ef | 2766 | p += len; |
Christopher Haster |
1:24750b9ad5ef | 2767 | n += len; |
Christopher Haster |
1:24750b9ad5ef | 2768 | |
Christopher Haster |
1:24750b9ad5ef | 2769 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X ); |
Christopher Haster |
1:24750b9ad5ef | 2770 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P ); |
Christopher Haster |
1:24750b9ad5ef | 2771 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G ); |
Christopher Haster |
1:24750b9ad5ef | 2772 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX ); |
Christopher Haster |
1:24750b9ad5ef | 2773 | } |
Christopher Haster |
1:24750b9ad5ef | 2774 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 2775 | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2776 | |
Christopher Haster |
1:24750b9ad5ef | 2777 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2778 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
Christopher Haster |
1:24750b9ad5ef | 2779 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || |
Christopher Haster |
1:24750b9ad5ef | 2780 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 2781 | { |
Christopher Haster |
1:24750b9ad5ef | 2782 | /* |
Christopher Haster |
1:24750b9ad5ef | 2783 | * Ephemeral ECDH parameters: |
Christopher Haster |
1:24750b9ad5ef | 2784 | * |
Christopher Haster |
1:24750b9ad5ef | 2785 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 2786 | * ECParameters curve_params; |
Christopher Haster |
1:24750b9ad5ef | 2787 | * ECPoint public; |
Christopher Haster |
1:24750b9ad5ef | 2788 | * } ServerECDHParams; |
Christopher Haster |
1:24750b9ad5ef | 2789 | */ |
Christopher Haster |
1:24750b9ad5ef | 2790 | const mbedtls_ecp_curve_info **curve = NULL; |
Christopher Haster |
1:24750b9ad5ef | 2791 | const mbedtls_ecp_group_id *gid; |
Christopher Haster |
1:24750b9ad5ef | 2792 | |
Christopher Haster |
1:24750b9ad5ef | 2793 | /* Match our preference list against the offered curves */ |
Christopher Haster |
1:24750b9ad5ef | 2794 | for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ ) |
Christopher Haster |
1:24750b9ad5ef | 2795 | for( curve = ssl->handshake->curves; *curve != NULL; curve++ ) |
Christopher Haster |
1:24750b9ad5ef | 2796 | if( (*curve)->grp_id == *gid ) |
Christopher Haster |
1:24750b9ad5ef | 2797 | goto curve_matching_done; |
Christopher Haster |
1:24750b9ad5ef | 2798 | |
Christopher Haster |
1:24750b9ad5ef | 2799 | curve_matching_done: |
Christopher Haster |
1:24750b9ad5ef | 2800 | if( curve == NULL || *curve == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2801 | { |
Christopher Haster |
1:24750b9ad5ef | 2802 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2803 | return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN ); |
Christopher Haster |
1:24750b9ad5ef | 2804 | } |
Christopher Haster |
1:24750b9ad5ef | 2805 | |
Christopher Haster |
1:24750b9ad5ef | 2806 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) ); |
Christopher Haster |
1:24750b9ad5ef | 2807 | |
Christopher Haster |
1:24750b9ad5ef | 2808 | if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp, |
Christopher Haster |
1:24750b9ad5ef | 2809 | (*curve)->grp_id ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2810 | { |
Christopher Haster |
1:24750b9ad5ef | 2811 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2812 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2813 | } |
Christopher Haster |
1:24750b9ad5ef | 2814 | |
Christopher Haster |
1:24750b9ad5ef | 2815 | if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len, |
Christopher Haster |
1:24750b9ad5ef | 2816 | p, MBEDTLS_SSL_MAX_CONTENT_LEN - n, |
Christopher Haster |
1:24750b9ad5ef | 2817 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2818 | { |
Christopher Haster |
1:24750b9ad5ef | 2819 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2820 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2821 | } |
Christopher Haster |
1:24750b9ad5ef | 2822 | |
Christopher Haster |
1:24750b9ad5ef | 2823 | dig_signed = p; |
Christopher Haster |
1:24750b9ad5ef | 2824 | dig_signed_len = len; |
Christopher Haster |
1:24750b9ad5ef | 2825 | |
Christopher Haster |
1:24750b9ad5ef | 2826 | p += len; |
Christopher Haster |
1:24750b9ad5ef | 2827 | n += len; |
Christopher Haster |
1:24750b9ad5ef | 2828 | |
Christopher Haster |
1:24750b9ad5ef | 2829 | MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q ); |
Christopher Haster |
1:24750b9ad5ef | 2830 | } |
Christopher Haster |
1:24750b9ad5ef | 2831 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2832 | |
Christopher Haster |
1:24750b9ad5ef | 2833 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2834 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 2835 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 2836 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA || |
Christopher Haster |
1:24750b9ad5ef | 2837 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
Christopher Haster |
1:24750b9ad5ef | 2838 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ) |
Christopher Haster |
1:24750b9ad5ef | 2839 | { |
Christopher Haster |
1:24750b9ad5ef | 2840 | size_t signature_len = 0; |
Christopher Haster |
1:24750b9ad5ef | 2841 | unsigned int hashlen = 0; |
Christopher Haster |
1:24750b9ad5ef | 2842 | unsigned char hash[64]; |
Christopher Haster |
1:24750b9ad5ef | 2843 | mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE; |
Christopher Haster |
1:24750b9ad5ef | 2844 | |
Christopher Haster |
1:24750b9ad5ef | 2845 | /* |
Christopher Haster |
1:24750b9ad5ef | 2846 | * Choose hash algorithm. NONE means MD5 + SHA1 here. |
Christopher Haster |
1:24750b9ad5ef | 2847 | */ |
Christopher Haster |
1:24750b9ad5ef | 2848 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 2849 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 2850 | { |
Christopher Haster |
1:24750b9ad5ef | 2851 | md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg ); |
Christopher Haster |
1:24750b9ad5ef | 2852 | |
Christopher Haster |
1:24750b9ad5ef | 2853 | if( md_alg == MBEDTLS_MD_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 2854 | { |
Christopher Haster |
1:24750b9ad5ef | 2855 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2856 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 2857 | } |
Christopher Haster |
1:24750b9ad5ef | 2858 | } |
Christopher Haster |
1:24750b9ad5ef | 2859 | else |
Christopher Haster |
1:24750b9ad5ef | 2860 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Christopher Haster |
1:24750b9ad5ef | 2861 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
Christopher Haster |
1:24750b9ad5ef | 2862 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
Christopher Haster |
1:24750b9ad5ef | 2863 | if( ciphersuite_info->key_exchange == |
Christopher Haster |
1:24750b9ad5ef | 2864 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ) |
Christopher Haster |
1:24750b9ad5ef | 2865 | { |
Christopher Haster |
1:24750b9ad5ef | 2866 | md_alg = MBEDTLS_MD_SHA1; |
Christopher Haster |
1:24750b9ad5ef | 2867 | } |
Christopher Haster |
1:24750b9ad5ef | 2868 | else |
Christopher Haster |
1:24750b9ad5ef | 2869 | #endif |
Christopher Haster |
1:24750b9ad5ef | 2870 | { |
Christopher Haster |
1:24750b9ad5ef | 2871 | md_alg = MBEDTLS_MD_NONE; |
Christopher Haster |
1:24750b9ad5ef | 2872 | } |
Christopher Haster |
1:24750b9ad5ef | 2873 | |
Christopher Haster |
1:24750b9ad5ef | 2874 | /* |
Christopher Haster |
1:24750b9ad5ef | 2875 | * Compute the hash to be signed |
Christopher Haster |
1:24750b9ad5ef | 2876 | */ |
Christopher Haster |
1:24750b9ad5ef | 2877 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
Christopher Haster |
1:24750b9ad5ef | 2878 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
Christopher Haster |
1:24750b9ad5ef | 2879 | if( md_alg == MBEDTLS_MD_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 2880 | { |
Christopher Haster |
1:24750b9ad5ef | 2881 | mbedtls_md5_context mbedtls_md5; |
Christopher Haster |
1:24750b9ad5ef | 2882 | mbedtls_sha1_context mbedtls_sha1; |
Christopher Haster |
1:24750b9ad5ef | 2883 | |
Christopher Haster |
1:24750b9ad5ef | 2884 | mbedtls_md5_init( &mbedtls_md5 ); |
Christopher Haster |
1:24750b9ad5ef | 2885 | mbedtls_sha1_init( &mbedtls_sha1 ); |
Christopher Haster |
1:24750b9ad5ef | 2886 | |
Christopher Haster |
1:24750b9ad5ef | 2887 | /* |
Christopher Haster |
1:24750b9ad5ef | 2888 | * digitally-signed struct { |
Christopher Haster |
1:24750b9ad5ef | 2889 | * opaque md5_hash[16]; |
Christopher Haster |
1:24750b9ad5ef | 2890 | * opaque sha_hash[20]; |
Christopher Haster |
1:24750b9ad5ef | 2891 | * }; |
Christopher Haster |
1:24750b9ad5ef | 2892 | * |
Christopher Haster |
1:24750b9ad5ef | 2893 | * md5_hash |
Christopher Haster |
1:24750b9ad5ef | 2894 | * MD5(ClientHello.random + ServerHello.random |
Christopher Haster |
1:24750b9ad5ef | 2895 | * + ServerParams); |
Christopher Haster |
1:24750b9ad5ef | 2896 | * sha_hash |
Christopher Haster |
1:24750b9ad5ef | 2897 | * SHA(ClientHello.random + ServerHello.random |
Christopher Haster |
1:24750b9ad5ef | 2898 | * + ServerParams); |
Christopher Haster |
1:24750b9ad5ef | 2899 | */ |
Christopher Haster |
1:24750b9ad5ef | 2900 | mbedtls_md5_starts( &mbedtls_md5 ); |
Christopher Haster |
1:24750b9ad5ef | 2901 | mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 ); |
Christopher Haster |
1:24750b9ad5ef | 2902 | mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len ); |
Christopher Haster |
1:24750b9ad5ef | 2903 | mbedtls_md5_finish( &mbedtls_md5, hash ); |
Christopher Haster |
1:24750b9ad5ef | 2904 | |
Christopher Haster |
1:24750b9ad5ef | 2905 | mbedtls_sha1_starts( &mbedtls_sha1 ); |
Christopher Haster |
1:24750b9ad5ef | 2906 | mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 ); |
Christopher Haster |
1:24750b9ad5ef | 2907 | mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len ); |
Christopher Haster |
1:24750b9ad5ef | 2908 | mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 ); |
Christopher Haster |
1:24750b9ad5ef | 2909 | |
Christopher Haster |
1:24750b9ad5ef | 2910 | hashlen = 36; |
Christopher Haster |
1:24750b9ad5ef | 2911 | |
Christopher Haster |
1:24750b9ad5ef | 2912 | mbedtls_md5_free( &mbedtls_md5 ); |
Christopher Haster |
1:24750b9ad5ef | 2913 | mbedtls_sha1_free( &mbedtls_sha1 ); |
Christopher Haster |
1:24750b9ad5ef | 2914 | } |
Christopher Haster |
1:24750b9ad5ef | 2915 | else |
Christopher Haster |
1:24750b9ad5ef | 2916 | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ |
Christopher Haster |
1:24750b9ad5ef | 2917 | MBEDTLS_SSL_PROTO_TLS1_1 */ |
Christopher Haster |
1:24750b9ad5ef | 2918 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
Christopher Haster |
1:24750b9ad5ef | 2919 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 2920 | if( md_alg != MBEDTLS_MD_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 2921 | { |
Christopher Haster |
1:24750b9ad5ef | 2922 | mbedtls_md_context_t ctx; |
Christopher Haster |
1:24750b9ad5ef | 2923 | const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg ); |
Christopher Haster |
1:24750b9ad5ef | 2924 | |
Christopher Haster |
1:24750b9ad5ef | 2925 | mbedtls_md_init( &ctx ); |
Christopher Haster |
1:24750b9ad5ef | 2926 | |
Christopher Haster |
1:24750b9ad5ef | 2927 | /* Info from md_alg will be used instead */ |
Christopher Haster |
1:24750b9ad5ef | 2928 | hashlen = 0; |
Christopher Haster |
1:24750b9ad5ef | 2929 | |
Christopher Haster |
1:24750b9ad5ef | 2930 | /* |
Christopher Haster |
1:24750b9ad5ef | 2931 | * digitally-signed struct { |
Christopher Haster |
1:24750b9ad5ef | 2932 | * opaque client_random[32]; |
Christopher Haster |
1:24750b9ad5ef | 2933 | * opaque server_random[32]; |
Christopher Haster |
1:24750b9ad5ef | 2934 | * ServerDHParams params; |
Christopher Haster |
1:24750b9ad5ef | 2935 | * }; |
Christopher Haster |
1:24750b9ad5ef | 2936 | */ |
Christopher Haster |
1:24750b9ad5ef | 2937 | if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2938 | { |
Christopher Haster |
1:24750b9ad5ef | 2939 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2940 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2941 | } |
Christopher Haster |
1:24750b9ad5ef | 2942 | |
Christopher Haster |
1:24750b9ad5ef | 2943 | mbedtls_md_starts( &ctx ); |
Christopher Haster |
1:24750b9ad5ef | 2944 | mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ); |
Christopher Haster |
1:24750b9ad5ef | 2945 | mbedtls_md_update( &ctx, dig_signed, dig_signed_len ); |
Christopher Haster |
1:24750b9ad5ef | 2946 | mbedtls_md_finish( &ctx, hash ); |
Christopher Haster |
1:24750b9ad5ef | 2947 | mbedtls_md_free( &ctx ); |
Christopher Haster |
1:24750b9ad5ef | 2948 | } |
Christopher Haster |
1:24750b9ad5ef | 2949 | else |
Christopher Haster |
1:24750b9ad5ef | 2950 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ |
Christopher Haster |
1:24750b9ad5ef | 2951 | MBEDTLS_SSL_PROTO_TLS1_2 */ |
Christopher Haster |
1:24750b9ad5ef | 2952 | { |
Christopher Haster |
1:24750b9ad5ef | 2953 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2954 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 2955 | } |
Christopher Haster |
1:24750b9ad5ef | 2956 | |
Christopher Haster |
1:24750b9ad5ef | 2957 | MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen : |
Christopher Haster |
1:24750b9ad5ef | 2958 | (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) ); |
Christopher Haster |
1:24750b9ad5ef | 2959 | |
Christopher Haster |
1:24750b9ad5ef | 2960 | /* |
Christopher Haster |
1:24750b9ad5ef | 2961 | * Make the signature |
Christopher Haster |
1:24750b9ad5ef | 2962 | */ |
Christopher Haster |
1:24750b9ad5ef | 2963 | if( mbedtls_ssl_own_key( ssl ) == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 2964 | { |
Christopher Haster |
1:24750b9ad5ef | 2965 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) ); |
Christopher Haster |
1:24750b9ad5ef | 2966 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
Christopher Haster |
1:24750b9ad5ef | 2967 | } |
Christopher Haster |
1:24750b9ad5ef | 2968 | |
Christopher Haster |
1:24750b9ad5ef | 2969 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 2970 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 2971 | { |
Christopher Haster |
1:24750b9ad5ef | 2972 | *(p++) = ssl->handshake->sig_alg; |
Christopher Haster |
1:24750b9ad5ef | 2973 | *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) ); |
Christopher Haster |
1:24750b9ad5ef | 2974 | |
Christopher Haster |
1:24750b9ad5ef | 2975 | n += 2; |
Christopher Haster |
1:24750b9ad5ef | 2976 | } |
Christopher Haster |
1:24750b9ad5ef | 2977 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Christopher Haster |
1:24750b9ad5ef | 2978 | |
Christopher Haster |
1:24750b9ad5ef | 2979 | if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen, |
Christopher Haster |
1:24750b9ad5ef | 2980 | p + 2 , &signature_len, |
Christopher Haster |
1:24750b9ad5ef | 2981 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 2982 | { |
Christopher Haster |
1:24750b9ad5ef | 2983 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret ); |
Christopher Haster |
1:24750b9ad5ef | 2984 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 2985 | } |
Christopher Haster |
1:24750b9ad5ef | 2986 | |
Christopher Haster |
1:24750b9ad5ef | 2987 | *(p++) = (unsigned char)( signature_len >> 8 ); |
Christopher Haster |
1:24750b9ad5ef | 2988 | *(p++) = (unsigned char)( signature_len ); |
Christopher Haster |
1:24750b9ad5ef | 2989 | n += 2; |
Christopher Haster |
1:24750b9ad5ef | 2990 | |
Christopher Haster |
1:24750b9ad5ef | 2991 | MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len ); |
Christopher Haster |
1:24750b9ad5ef | 2992 | |
Christopher Haster |
1:24750b9ad5ef | 2993 | n += signature_len; |
Christopher Haster |
1:24750b9ad5ef | 2994 | } |
Christopher Haster |
1:24750b9ad5ef | 2995 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || |
Christopher Haster |
1:24750b9ad5ef | 2996 | MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 2997 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 2998 | |
Christopher Haster |
1:24750b9ad5ef | 2999 | ssl->out_msglen = 4 + n; |
Christopher Haster |
1:24750b9ad5ef | 3000 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
Christopher Haster |
1:24750b9ad5ef | 3001 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE; |
Christopher Haster |
1:24750b9ad5ef | 3002 | |
Christopher Haster |
1:24750b9ad5ef | 3003 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 3004 | |
Christopher Haster |
1:24750b9ad5ef | 3005 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3006 | { |
Christopher Haster |
1:24750b9ad5ef | 3007 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3008 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3009 | } |
Christopher Haster |
1:24750b9ad5ef | 3010 | |
Christopher Haster |
1:24750b9ad5ef | 3011 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3012 | |
Christopher Haster |
1:24750b9ad5ef | 3013 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3014 | } |
Christopher Haster |
1:24750b9ad5ef | 3015 | |
Christopher Haster |
1:24750b9ad5ef | 3016 | static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 3017 | { |
Christopher Haster |
1:24750b9ad5ef | 3018 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 3019 | |
Christopher Haster |
1:24750b9ad5ef | 3020 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3021 | |
Christopher Haster |
1:24750b9ad5ef | 3022 | ssl->out_msglen = 4; |
Christopher Haster |
1:24750b9ad5ef | 3023 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
Christopher Haster |
1:24750b9ad5ef | 3024 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE; |
Christopher Haster |
1:24750b9ad5ef | 3025 | |
Christopher Haster |
1:24750b9ad5ef | 3026 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 3027 | |
Christopher Haster |
1:24750b9ad5ef | 3028 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 3029 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
Christopher Haster |
1:24750b9ad5ef | 3030 | mbedtls_ssl_send_flight_completed( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3031 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3032 | |
Christopher Haster |
1:24750b9ad5ef | 3033 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3034 | { |
Christopher Haster |
1:24750b9ad5ef | 3035 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3036 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3037 | } |
Christopher Haster |
1:24750b9ad5ef | 3038 | |
Christopher Haster |
1:24750b9ad5ef | 3039 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3040 | |
Christopher Haster |
1:24750b9ad5ef | 3041 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3042 | } |
Christopher Haster |
1:24750b9ad5ef | 3043 | |
Christopher Haster |
1:24750b9ad5ef | 3044 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 3045 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3046 | static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p, |
Christopher Haster |
1:24750b9ad5ef | 3047 | const unsigned char *end ) |
Christopher Haster |
1:24750b9ad5ef | 3048 | { |
Christopher Haster |
1:24750b9ad5ef | 3049 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Christopher Haster |
1:24750b9ad5ef | 3050 | size_t n; |
Christopher Haster |
1:24750b9ad5ef | 3051 | |
Christopher Haster |
1:24750b9ad5ef | 3052 | /* |
Christopher Haster |
1:24750b9ad5ef | 3053 | * Receive G^Y mod P, premaster = (G^Y)^X mod P |
Christopher Haster |
1:24750b9ad5ef | 3054 | */ |
Christopher Haster |
1:24750b9ad5ef | 3055 | if( *p + 2 > end ) |
Christopher Haster |
1:24750b9ad5ef | 3056 | { |
Christopher Haster |
1:24750b9ad5ef | 3057 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3058 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3059 | } |
Christopher Haster |
1:24750b9ad5ef | 3060 | |
Christopher Haster |
1:24750b9ad5ef | 3061 | n = ( (*p)[0] << 8 ) | (*p)[1]; |
Christopher Haster |
1:24750b9ad5ef | 3062 | *p += 2; |
Christopher Haster |
1:24750b9ad5ef | 3063 | |
Christopher Haster |
1:24750b9ad5ef | 3064 | if( *p + n > end ) |
Christopher Haster |
1:24750b9ad5ef | 3065 | { |
Christopher Haster |
1:24750b9ad5ef | 3066 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3067 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3068 | } |
Christopher Haster |
1:24750b9ad5ef | 3069 | |
Christopher Haster |
1:24750b9ad5ef | 3070 | if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3071 | { |
Christopher Haster |
1:24750b9ad5ef | 3072 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3073 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); |
Christopher Haster |
1:24750b9ad5ef | 3074 | } |
Christopher Haster |
1:24750b9ad5ef | 3075 | |
Christopher Haster |
1:24750b9ad5ef | 3076 | *p += n; |
Christopher Haster |
1:24750b9ad5ef | 3077 | |
Christopher Haster |
1:24750b9ad5ef | 3078 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY ); |
Christopher Haster |
1:24750b9ad5ef | 3079 | |
Christopher Haster |
1:24750b9ad5ef | 3080 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3081 | } |
Christopher Haster |
1:24750b9ad5ef | 3082 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 3083 | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3084 | |
Christopher Haster |
1:24750b9ad5ef | 3085 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 3086 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3087 | static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl, |
Christopher Haster |
1:24750b9ad5ef | 3088 | const unsigned char *p, |
Christopher Haster |
1:24750b9ad5ef | 3089 | const unsigned char *end, |
Christopher Haster |
1:24750b9ad5ef | 3090 | size_t pms_offset ) |
Christopher Haster |
1:24750b9ad5ef | 3091 | { |
Christopher Haster |
1:24750b9ad5ef | 3092 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 3093 | size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) ); |
Christopher Haster |
1:24750b9ad5ef | 3094 | unsigned char *pms = ssl->handshake->premaster + pms_offset; |
Christopher Haster |
1:24750b9ad5ef | 3095 | unsigned char ver[2]; |
Christopher Haster |
1:24750b9ad5ef | 3096 | unsigned char fake_pms[48], peer_pms[48]; |
Christopher Haster |
1:24750b9ad5ef | 3097 | unsigned char mask; |
Christopher Haster |
1:24750b9ad5ef | 3098 | size_t i, peer_pmslen; |
Christopher Haster |
1:24750b9ad5ef | 3099 | unsigned int diff; |
Christopher Haster |
1:24750b9ad5ef | 3100 | |
Christopher Haster |
1:24750b9ad5ef | 3101 | if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) ) |
Christopher Haster |
1:24750b9ad5ef | 3102 | { |
Christopher Haster |
1:24750b9ad5ef | 3103 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3104 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
Christopher Haster |
1:24750b9ad5ef | 3105 | } |
Christopher Haster |
1:24750b9ad5ef | 3106 | |
Christopher Haster |
1:24750b9ad5ef | 3107 | /* |
Christopher Haster |
1:24750b9ad5ef | 3108 | * Decrypt the premaster using own private RSA key |
Christopher Haster |
1:24750b9ad5ef | 3109 | */ |
Christopher Haster |
1:24750b9ad5ef | 3110 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
Christopher Haster |
1:24750b9ad5ef | 3111 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 3112 | if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
Christopher Haster |
1:24750b9ad5ef | 3113 | { |
Christopher Haster |
1:24750b9ad5ef | 3114 | if( *p++ != ( ( len >> 8 ) & 0xFF ) || |
Christopher Haster |
1:24750b9ad5ef | 3115 | *p++ != ( ( len ) & 0xFF ) ) |
Christopher Haster |
1:24750b9ad5ef | 3116 | { |
Christopher Haster |
1:24750b9ad5ef | 3117 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3118 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3119 | } |
Christopher Haster |
1:24750b9ad5ef | 3120 | } |
Christopher Haster |
1:24750b9ad5ef | 3121 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3122 | |
Christopher Haster |
1:24750b9ad5ef | 3123 | if( p + len != end ) |
Christopher Haster |
1:24750b9ad5ef | 3124 | { |
Christopher Haster |
1:24750b9ad5ef | 3125 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3126 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3127 | } |
Christopher Haster |
1:24750b9ad5ef | 3128 | |
Christopher Haster |
1:24750b9ad5ef | 3129 | mbedtls_ssl_write_version( ssl->handshake->max_major_ver, |
Christopher Haster |
1:24750b9ad5ef | 3130 | ssl->handshake->max_minor_ver, |
Christopher Haster |
1:24750b9ad5ef | 3131 | ssl->conf->transport, ver ); |
Christopher Haster |
1:24750b9ad5ef | 3132 | |
Christopher Haster |
1:24750b9ad5ef | 3133 | /* |
Christopher Haster |
1:24750b9ad5ef | 3134 | * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding |
Christopher Haster |
1:24750b9ad5ef | 3135 | * must not cause the connection to end immediately; instead, send a |
Christopher Haster |
1:24750b9ad5ef | 3136 | * bad_record_mac later in the handshake. |
Christopher Haster |
1:24750b9ad5ef | 3137 | * Also, avoid data-dependant branches here to protect against |
Christopher Haster |
1:24750b9ad5ef | 3138 | * timing-based variants. |
Christopher Haster |
1:24750b9ad5ef | 3139 | */ |
Christopher Haster |
1:24750b9ad5ef | 3140 | ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) ); |
Christopher Haster |
1:24750b9ad5ef | 3141 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3142 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3143 | |
Christopher Haster |
1:24750b9ad5ef | 3144 | ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len, |
Christopher Haster |
1:24750b9ad5ef | 3145 | peer_pms, &peer_pmslen, |
Christopher Haster |
1:24750b9ad5ef | 3146 | sizeof( peer_pms ), |
Christopher Haster |
1:24750b9ad5ef | 3147 | ssl->conf->f_rng, ssl->conf->p_rng ); |
Christopher Haster |
1:24750b9ad5ef | 3148 | |
Christopher Haster |
1:24750b9ad5ef | 3149 | diff = (unsigned int) ret; |
Christopher Haster |
1:24750b9ad5ef | 3150 | diff |= peer_pmslen ^ 48; |
Christopher Haster |
1:24750b9ad5ef | 3151 | diff |= peer_pms[0] ^ ver[0]; |
Christopher Haster |
1:24750b9ad5ef | 3152 | diff |= peer_pms[1] ^ ver[1]; |
Christopher Haster |
1:24750b9ad5ef | 3153 | |
Christopher Haster |
1:24750b9ad5ef | 3154 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
Christopher Haster |
1:24750b9ad5ef | 3155 | if( diff != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3156 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3157 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3158 | |
Christopher Haster |
1:24750b9ad5ef | 3159 | if( sizeof( ssl->handshake->premaster ) < pms_offset || |
Christopher Haster |
1:24750b9ad5ef | 3160 | sizeof( ssl->handshake->premaster ) - pms_offset < 48 ) |
Christopher Haster |
1:24750b9ad5ef | 3161 | { |
Christopher Haster |
1:24750b9ad5ef | 3162 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3163 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 3164 | } |
Christopher Haster |
1:24750b9ad5ef | 3165 | ssl->handshake->pmslen = 48; |
Christopher Haster |
1:24750b9ad5ef | 3166 | |
Christopher Haster |
1:24750b9ad5ef | 3167 | /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */ |
Christopher Haster |
1:24750b9ad5ef | 3168 | /* MSVC has a warning about unary minus on unsigned, but this is |
Christopher Haster |
1:24750b9ad5ef | 3169 | * well-defined and precisely what we want to do here */ |
Christopher Haster |
1:24750b9ad5ef | 3170 | #if defined(_MSC_VER) |
Christopher Haster |
1:24750b9ad5ef | 3171 | #pragma warning( push ) |
Christopher Haster |
1:24750b9ad5ef | 3172 | #pragma warning( disable : 4146 ) |
Christopher Haster |
1:24750b9ad5ef | 3173 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3174 | mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) ); |
Christopher Haster |
1:24750b9ad5ef | 3175 | #if defined(_MSC_VER) |
Christopher Haster |
1:24750b9ad5ef | 3176 | #pragma warning( pop ) |
Christopher Haster |
1:24750b9ad5ef | 3177 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3178 | |
Christopher Haster |
1:24750b9ad5ef | 3179 | for( i = 0; i < ssl->handshake->pmslen; i++ ) |
Christopher Haster |
1:24750b9ad5ef | 3180 | pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] ); |
Christopher Haster |
1:24750b9ad5ef | 3181 | |
Christopher Haster |
1:24750b9ad5ef | 3182 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3183 | } |
Christopher Haster |
1:24750b9ad5ef | 3184 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 3185 | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3186 | |
Christopher Haster |
1:24750b9ad5ef | 3187 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3188 | static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p, |
Christopher Haster |
1:24750b9ad5ef | 3189 | const unsigned char *end ) |
Christopher Haster |
1:24750b9ad5ef | 3190 | { |
Christopher Haster |
1:24750b9ad5ef | 3191 | int ret = 0; |
Christopher Haster |
1:24750b9ad5ef | 3192 | size_t n; |
Christopher Haster |
1:24750b9ad5ef | 3193 | |
Christopher Haster |
1:24750b9ad5ef | 3194 | if( ssl->conf->f_psk == NULL && |
Christopher Haster |
1:24750b9ad5ef | 3195 | ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL || |
Christopher Haster |
1:24750b9ad5ef | 3196 | ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) ) |
Christopher Haster |
1:24750b9ad5ef | 3197 | { |
Christopher Haster |
1:24750b9ad5ef | 3198 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3199 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
Christopher Haster |
1:24750b9ad5ef | 3200 | } |
Christopher Haster |
1:24750b9ad5ef | 3201 | |
Christopher Haster |
1:24750b9ad5ef | 3202 | /* |
Christopher Haster |
1:24750b9ad5ef | 3203 | * Receive client pre-shared key identity name |
Christopher Haster |
1:24750b9ad5ef | 3204 | */ |
Christopher Haster |
1:24750b9ad5ef | 3205 | if( *p + 2 > end ) |
Christopher Haster |
1:24750b9ad5ef | 3206 | { |
Christopher Haster |
1:24750b9ad5ef | 3207 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3208 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3209 | } |
Christopher Haster |
1:24750b9ad5ef | 3210 | |
Christopher Haster |
1:24750b9ad5ef | 3211 | n = ( (*p)[0] << 8 ) | (*p)[1]; |
Christopher Haster |
1:24750b9ad5ef | 3212 | *p += 2; |
Christopher Haster |
1:24750b9ad5ef | 3213 | |
Christopher Haster |
1:24750b9ad5ef | 3214 | if( n < 1 || n > 65535 || *p + n > end ) |
Christopher Haster |
1:24750b9ad5ef | 3215 | { |
Christopher Haster |
1:24750b9ad5ef | 3216 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3217 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3218 | } |
Christopher Haster |
1:24750b9ad5ef | 3219 | |
Christopher Haster |
1:24750b9ad5ef | 3220 | if( ssl->conf->f_psk != NULL ) |
Christopher Haster |
1:24750b9ad5ef | 3221 | { |
Christopher Haster |
1:24750b9ad5ef | 3222 | if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3223 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
Christopher Haster |
1:24750b9ad5ef | 3224 | } |
Christopher Haster |
1:24750b9ad5ef | 3225 | else |
Christopher Haster |
1:24750b9ad5ef | 3226 | { |
Christopher Haster |
1:24750b9ad5ef | 3227 | /* Identity is not a big secret since clients send it in the clear, |
Christopher Haster |
1:24750b9ad5ef | 3228 | * but treat it carefully anyway, just in case */ |
Christopher Haster |
1:24750b9ad5ef | 3229 | if( n != ssl->conf->psk_identity_len || |
Christopher Haster |
1:24750b9ad5ef | 3230 | mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3231 | { |
Christopher Haster |
1:24750b9ad5ef | 3232 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
Christopher Haster |
1:24750b9ad5ef | 3233 | } |
Christopher Haster |
1:24750b9ad5ef | 3234 | } |
Christopher Haster |
1:24750b9ad5ef | 3235 | |
Christopher Haster |
1:24750b9ad5ef | 3236 | if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ) |
Christopher Haster |
1:24750b9ad5ef | 3237 | { |
Christopher Haster |
1:24750b9ad5ef | 3238 | MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n ); |
Christopher Haster |
1:24750b9ad5ef | 3239 | if( ( ret = mbedtls_ssl_send_alert_message( ssl, |
Christopher Haster |
1:24750b9ad5ef | 3240 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
Christopher Haster |
1:24750b9ad5ef | 3241 | MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3242 | { |
Christopher Haster |
1:24750b9ad5ef | 3243 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3244 | } |
Christopher Haster |
1:24750b9ad5ef | 3245 | |
Christopher Haster |
1:24750b9ad5ef | 3246 | return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ); |
Christopher Haster |
1:24750b9ad5ef | 3247 | } |
Christopher Haster |
1:24750b9ad5ef | 3248 | |
Christopher Haster |
1:24750b9ad5ef | 3249 | *p += n; |
Christopher Haster |
1:24750b9ad5ef | 3250 | |
Christopher Haster |
1:24750b9ad5ef | 3251 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3252 | } |
Christopher Haster |
1:24750b9ad5ef | 3253 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3254 | |
Christopher Haster |
1:24750b9ad5ef | 3255 | static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 3256 | { |
Christopher Haster |
1:24750b9ad5ef | 3257 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 3258 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 3259 | unsigned char *p, *end; |
Christopher Haster |
1:24750b9ad5ef | 3260 | |
Christopher Haster |
1:24750b9ad5ef | 3261 | ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 3262 | |
Christopher Haster |
1:24750b9ad5ef | 3263 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3264 | |
Christopher Haster |
1:24750b9ad5ef | 3265 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3266 | { |
Christopher Haster |
1:24750b9ad5ef | 3267 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3268 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3269 | } |
Christopher Haster |
1:24750b9ad5ef | 3270 | |
Christopher Haster |
1:24750b9ad5ef | 3271 | p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3272 | end = ssl->in_msg + ssl->in_hslen; |
Christopher Haster |
1:24750b9ad5ef | 3273 | |
Christopher Haster |
1:24750b9ad5ef | 3274 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) |
Christopher Haster |
1:24750b9ad5ef | 3275 | { |
Christopher Haster |
1:24750b9ad5ef | 3276 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3277 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3278 | } |
Christopher Haster |
1:24750b9ad5ef | 3279 | |
Christopher Haster |
1:24750b9ad5ef | 3280 | if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE ) |
Christopher Haster |
1:24750b9ad5ef | 3281 | { |
Christopher Haster |
1:24750b9ad5ef | 3282 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3283 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3284 | } |
Christopher Haster |
1:24750b9ad5ef | 3285 | |
Christopher Haster |
1:24750b9ad5ef | 3286 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3287 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ) |
Christopher Haster |
1:24750b9ad5ef | 3288 | { |
Christopher Haster |
1:24750b9ad5ef | 3289 | if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3290 | { |
Christopher Haster |
1:24750b9ad5ef | 3291 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3292 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3293 | } |
Christopher Haster |
1:24750b9ad5ef | 3294 | |
Christopher Haster |
1:24750b9ad5ef | 3295 | if( p != end ) |
Christopher Haster |
1:24750b9ad5ef | 3296 | { |
Christopher Haster |
1:24750b9ad5ef | 3297 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3298 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3299 | } |
Christopher Haster |
1:24750b9ad5ef | 3300 | |
Christopher Haster |
1:24750b9ad5ef | 3301 | if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, |
Christopher Haster |
1:24750b9ad5ef | 3302 | ssl->handshake->premaster, |
Christopher Haster |
1:24750b9ad5ef | 3303 | MBEDTLS_PREMASTER_SIZE, |
Christopher Haster |
1:24750b9ad5ef | 3304 | &ssl->handshake->pmslen, |
Christopher Haster |
1:24750b9ad5ef | 3305 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3306 | { |
Christopher Haster |
1:24750b9ad5ef | 3307 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3308 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS ); |
Christopher Haster |
1:24750b9ad5ef | 3309 | } |
Christopher Haster |
1:24750b9ad5ef | 3310 | |
Christopher Haster |
1:24750b9ad5ef | 3311 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); |
Christopher Haster |
1:24750b9ad5ef | 3312 | } |
Christopher Haster |
1:24750b9ad5ef | 3313 | else |
Christopher Haster |
1:24750b9ad5ef | 3314 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3315 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 3316 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 3317 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
Christopher Haster |
1:24750b9ad5ef | 3318 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3319 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
Christopher Haster |
1:24750b9ad5ef | 3320 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || |
Christopher Haster |
1:24750b9ad5ef | 3321 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || |
Christopher Haster |
1:24750b9ad5ef | 3322 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) |
Christopher Haster |
1:24750b9ad5ef | 3323 | { |
Christopher Haster |
1:24750b9ad5ef | 3324 | if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, |
Christopher Haster |
1:24750b9ad5ef | 3325 | p, end - p) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3326 | { |
Christopher Haster |
1:24750b9ad5ef | 3327 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3328 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); |
Christopher Haster |
1:24750b9ad5ef | 3329 | } |
Christopher Haster |
1:24750b9ad5ef | 3330 | |
Christopher Haster |
1:24750b9ad5ef | 3331 | MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp ); |
Christopher Haster |
1:24750b9ad5ef | 3332 | |
Christopher Haster |
1:24750b9ad5ef | 3333 | if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, |
Christopher Haster |
1:24750b9ad5ef | 3334 | &ssl->handshake->pmslen, |
Christopher Haster |
1:24750b9ad5ef | 3335 | ssl->handshake->premaster, |
Christopher Haster |
1:24750b9ad5ef | 3336 | MBEDTLS_MPI_MAX_SIZE, |
Christopher Haster |
1:24750b9ad5ef | 3337 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3338 | { |
Christopher Haster |
1:24750b9ad5ef | 3339 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3340 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS ); |
Christopher Haster |
1:24750b9ad5ef | 3341 | } |
Christopher Haster |
1:24750b9ad5ef | 3342 | |
Christopher Haster |
1:24750b9ad5ef | 3343 | MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z ); |
Christopher Haster |
1:24750b9ad5ef | 3344 | } |
Christopher Haster |
1:24750b9ad5ef | 3345 | else |
Christopher Haster |
1:24750b9ad5ef | 3346 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 3347 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 3348 | MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || |
Christopher Haster |
1:24750b9ad5ef | 3349 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3350 | #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3351 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 3352 | { |
Christopher Haster |
1:24750b9ad5ef | 3353 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3354 | { |
Christopher Haster |
1:24750b9ad5ef | 3355 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3356 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3357 | } |
Christopher Haster |
1:24750b9ad5ef | 3358 | |
Christopher Haster |
1:24750b9ad5ef | 3359 | if( p != end ) |
Christopher Haster |
1:24750b9ad5ef | 3360 | { |
Christopher Haster |
1:24750b9ad5ef | 3361 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3362 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3363 | } |
Christopher Haster |
1:24750b9ad5ef | 3364 | |
Christopher Haster |
1:24750b9ad5ef | 3365 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Christopher Haster |
1:24750b9ad5ef | 3366 | ciphersuite_info->key_exchange ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3367 | { |
Christopher Haster |
1:24750b9ad5ef | 3368 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3369 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3370 | } |
Christopher Haster |
1:24750b9ad5ef | 3371 | } |
Christopher Haster |
1:24750b9ad5ef | 3372 | else |
Christopher Haster |
1:24750b9ad5ef | 3373 | #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3374 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3375 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 3376 | { |
Christopher Haster |
1:24750b9ad5ef | 3377 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3378 | { |
Christopher Haster |
1:24750b9ad5ef | 3379 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3380 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3381 | } |
Christopher Haster |
1:24750b9ad5ef | 3382 | |
Christopher Haster |
1:24750b9ad5ef | 3383 | if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3384 | { |
Christopher Haster |
1:24750b9ad5ef | 3385 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3386 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3387 | } |
Christopher Haster |
1:24750b9ad5ef | 3388 | |
Christopher Haster |
1:24750b9ad5ef | 3389 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Christopher Haster |
1:24750b9ad5ef | 3390 | ciphersuite_info->key_exchange ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3391 | { |
Christopher Haster |
1:24750b9ad5ef | 3392 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3393 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3394 | } |
Christopher Haster |
1:24750b9ad5ef | 3395 | } |
Christopher Haster |
1:24750b9ad5ef | 3396 | else |
Christopher Haster |
1:24750b9ad5ef | 3397 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3398 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3399 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 3400 | { |
Christopher Haster |
1:24750b9ad5ef | 3401 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3402 | { |
Christopher Haster |
1:24750b9ad5ef | 3403 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3404 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3405 | } |
Christopher Haster |
1:24750b9ad5ef | 3406 | if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3407 | { |
Christopher Haster |
1:24750b9ad5ef | 3408 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3409 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3410 | } |
Christopher Haster |
1:24750b9ad5ef | 3411 | |
Christopher Haster |
1:24750b9ad5ef | 3412 | if( p != end ) |
Christopher Haster |
1:24750b9ad5ef | 3413 | { |
Christopher Haster |
1:24750b9ad5ef | 3414 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3415 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3416 | } |
Christopher Haster |
1:24750b9ad5ef | 3417 | |
Christopher Haster |
1:24750b9ad5ef | 3418 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Christopher Haster |
1:24750b9ad5ef | 3419 | ciphersuite_info->key_exchange ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3420 | { |
Christopher Haster |
1:24750b9ad5ef | 3421 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3422 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3423 | } |
Christopher Haster |
1:24750b9ad5ef | 3424 | } |
Christopher Haster |
1:24750b9ad5ef | 3425 | else |
Christopher Haster |
1:24750b9ad5ef | 3426 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3427 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3428 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
Christopher Haster |
1:24750b9ad5ef | 3429 | { |
Christopher Haster |
1:24750b9ad5ef | 3430 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3431 | { |
Christopher Haster |
1:24750b9ad5ef | 3432 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3433 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3434 | } |
Christopher Haster |
1:24750b9ad5ef | 3435 | |
Christopher Haster |
1:24750b9ad5ef | 3436 | if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, |
Christopher Haster |
1:24750b9ad5ef | 3437 | p, end - p ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3438 | { |
Christopher Haster |
1:24750b9ad5ef | 3439 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3440 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); |
Christopher Haster |
1:24750b9ad5ef | 3441 | } |
Christopher Haster |
1:24750b9ad5ef | 3442 | |
Christopher Haster |
1:24750b9ad5ef | 3443 | MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp ); |
Christopher Haster |
1:24750b9ad5ef | 3444 | |
Christopher Haster |
1:24750b9ad5ef | 3445 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
Christopher Haster |
1:24750b9ad5ef | 3446 | ciphersuite_info->key_exchange ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3447 | { |
Christopher Haster |
1:24750b9ad5ef | 3448 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3449 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3450 | } |
Christopher Haster |
1:24750b9ad5ef | 3451 | } |
Christopher Haster |
1:24750b9ad5ef | 3452 | else |
Christopher Haster |
1:24750b9ad5ef | 3453 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3454 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3455 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) |
Christopher Haster |
1:24750b9ad5ef | 3456 | { |
Christopher Haster |
1:24750b9ad5ef | 3457 | if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3458 | { |
Christopher Haster |
1:24750b9ad5ef | 3459 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret ); |
Christopher Haster |
1:24750b9ad5ef | 3460 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3461 | } |
Christopher Haster |
1:24750b9ad5ef | 3462 | } |
Christopher Haster |
1:24750b9ad5ef | 3463 | else |
Christopher Haster |
1:24750b9ad5ef | 3464 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3465 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3466 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
Christopher Haster |
1:24750b9ad5ef | 3467 | { |
Christopher Haster |
1:24750b9ad5ef | 3468 | ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx, |
Christopher Haster |
1:24750b9ad5ef | 3469 | p, end - p ); |
Christopher Haster |
1:24750b9ad5ef | 3470 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3471 | { |
Christopher Haster |
1:24750b9ad5ef | 3472 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3473 | return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); |
Christopher Haster |
1:24750b9ad5ef | 3474 | } |
Christopher Haster |
1:24750b9ad5ef | 3475 | |
Christopher Haster |
1:24750b9ad5ef | 3476 | ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx, |
Christopher Haster |
1:24750b9ad5ef | 3477 | ssl->handshake->premaster, 32, &ssl->handshake->pmslen, |
Christopher Haster |
1:24750b9ad5ef | 3478 | ssl->conf->f_rng, ssl->conf->p_rng ); |
Christopher Haster |
1:24750b9ad5ef | 3479 | if( ret != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3480 | { |
Christopher Haster |
1:24750b9ad5ef | 3481 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3482 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3483 | } |
Christopher Haster |
1:24750b9ad5ef | 3484 | } |
Christopher Haster |
1:24750b9ad5ef | 3485 | else |
Christopher Haster |
1:24750b9ad5ef | 3486 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3487 | { |
Christopher Haster |
1:24750b9ad5ef | 3488 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3489 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 3490 | } |
Christopher Haster |
1:24750b9ad5ef | 3491 | |
Christopher Haster |
1:24750b9ad5ef | 3492 | if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3493 | { |
Christopher Haster |
1:24750b9ad5ef | 3494 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3495 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3496 | } |
Christopher Haster |
1:24750b9ad5ef | 3497 | |
Christopher Haster |
1:24750b9ad5ef | 3498 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 3499 | |
Christopher Haster |
1:24750b9ad5ef | 3500 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3501 | |
Christopher Haster |
1:24750b9ad5ef | 3502 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3503 | } |
Christopher Haster |
1:24750b9ad5ef | 3504 | |
Christopher Haster |
1:24750b9ad5ef | 3505 | #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ |
Christopher Haster |
1:24750b9ad5ef | 3506 | !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ |
Christopher Haster |
1:24750b9ad5ef | 3507 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ |
Christopher Haster |
1:24750b9ad5ef | 3508 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
Christopher Haster |
1:24750b9ad5ef | 3509 | static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 3510 | { |
Christopher Haster |
1:24750b9ad5ef | 3511 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 3512 | |
Christopher Haster |
1:24750b9ad5ef | 3513 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3514 | |
Christopher Haster |
1:24750b9ad5ef | 3515 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3516 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3517 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3518 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3519 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
Christopher Haster |
1:24750b9ad5ef | 3520 | { |
Christopher Haster |
1:24750b9ad5ef | 3521 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3522 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 3523 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3524 | } |
Christopher Haster |
1:24750b9ad5ef | 3525 | |
Christopher Haster |
1:24750b9ad5ef | 3526 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3527 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 3528 | } |
Christopher Haster |
1:24750b9ad5ef | 3529 | #else |
Christopher Haster |
1:24750b9ad5ef | 3530 | static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 3531 | { |
Christopher Haster |
1:24750b9ad5ef | 3532 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
Christopher Haster |
1:24750b9ad5ef | 3533 | size_t i, sig_len; |
Christopher Haster |
1:24750b9ad5ef | 3534 | unsigned char hash[48]; |
Christopher Haster |
1:24750b9ad5ef | 3535 | unsigned char *hash_start = hash; |
Christopher Haster |
1:24750b9ad5ef | 3536 | size_t hashlen; |
Christopher Haster |
1:24750b9ad5ef | 3537 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 3538 | mbedtls_pk_type_t pk_alg; |
Christopher Haster |
1:24750b9ad5ef | 3539 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3540 | mbedtls_md_type_t md_alg; |
Christopher Haster |
1:24750b9ad5ef | 3541 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
Christopher Haster |
1:24750b9ad5ef | 3542 | |
Christopher Haster |
1:24750b9ad5ef | 3543 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3544 | |
Christopher Haster |
1:24750b9ad5ef | 3545 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3546 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3547 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3548 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
Christopher Haster |
1:24750b9ad5ef | 3549 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE || |
Christopher Haster |
1:24750b9ad5ef | 3550 | ssl->session_negotiate->peer_cert == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 3551 | { |
Christopher Haster |
1:24750b9ad5ef | 3552 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3553 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 3554 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3555 | } |
Christopher Haster |
1:24750b9ad5ef | 3556 | |
Christopher Haster |
1:24750b9ad5ef | 3557 | /* Needs to be done before read_record() to exclude current message */ |
Christopher Haster |
1:24750b9ad5ef | 3558 | ssl->handshake->calc_verify( ssl, hash ); |
Christopher Haster |
1:24750b9ad5ef | 3559 | |
Christopher Haster |
1:24750b9ad5ef | 3560 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3561 | { |
Christopher Haster |
1:24750b9ad5ef | 3562 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3563 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3564 | } |
Christopher Haster |
1:24750b9ad5ef | 3565 | |
Christopher Haster |
1:24750b9ad5ef | 3566 | ssl->state++; |
Christopher Haster |
1:24750b9ad5ef | 3567 | |
Christopher Haster |
1:24750b9ad5ef | 3568 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || |
Christopher Haster |
1:24750b9ad5ef | 3569 | ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY ) |
Christopher Haster |
1:24750b9ad5ef | 3570 | { |
Christopher Haster |
1:24750b9ad5ef | 3571 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3572 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3573 | } |
Christopher Haster |
1:24750b9ad5ef | 3574 | |
Christopher Haster |
1:24750b9ad5ef | 3575 | i = mbedtls_ssl_hs_hdr_len( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3576 | |
Christopher Haster |
1:24750b9ad5ef | 3577 | /* |
Christopher Haster |
1:24750b9ad5ef | 3578 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 3579 | * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only |
Christopher Haster |
1:24750b9ad5ef | 3580 | * opaque signature<0..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 3581 | * } DigitallySigned; |
Christopher Haster |
1:24750b9ad5ef | 3582 | */ |
Christopher Haster |
1:24750b9ad5ef | 3583 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
Christopher Haster |
1:24750b9ad5ef | 3584 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
Christopher Haster |
1:24750b9ad5ef | 3585 | if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 3586 | { |
Christopher Haster |
1:24750b9ad5ef | 3587 | md_alg = MBEDTLS_MD_NONE; |
Christopher Haster |
1:24750b9ad5ef | 3588 | hashlen = 36; |
Christopher Haster |
1:24750b9ad5ef | 3589 | |
Christopher Haster |
1:24750b9ad5ef | 3590 | /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */ |
Christopher Haster |
1:24750b9ad5ef | 3591 | if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, |
Christopher Haster |
1:24750b9ad5ef | 3592 | MBEDTLS_PK_ECDSA ) ) |
Christopher Haster |
1:24750b9ad5ef | 3593 | { |
Christopher Haster |
1:24750b9ad5ef | 3594 | hash_start += 16; |
Christopher Haster |
1:24750b9ad5ef | 3595 | hashlen -= 16; |
Christopher Haster |
1:24750b9ad5ef | 3596 | md_alg = MBEDTLS_MD_SHA1; |
Christopher Haster |
1:24750b9ad5ef | 3597 | } |
Christopher Haster |
1:24750b9ad5ef | 3598 | } |
Christopher Haster |
1:24750b9ad5ef | 3599 | else |
Christopher Haster |
1:24750b9ad5ef | 3600 | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || |
Christopher Haster |
1:24750b9ad5ef | 3601 | MBEDTLS_SSL_PROTO_TLS1_1 */ |
Christopher Haster |
1:24750b9ad5ef | 3602 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
Christopher Haster |
1:24750b9ad5ef | 3603 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
Christopher Haster |
1:24750b9ad5ef | 3604 | { |
Christopher Haster |
1:24750b9ad5ef | 3605 | if( i + 2 > ssl->in_hslen ) |
Christopher Haster |
1:24750b9ad5ef | 3606 | { |
Christopher Haster |
1:24750b9ad5ef | 3607 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3608 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3609 | } |
Christopher Haster |
1:24750b9ad5ef | 3610 | |
Christopher Haster |
1:24750b9ad5ef | 3611 | /* |
Christopher Haster |
1:24750b9ad5ef | 3612 | * Hash |
Christopher Haster |
1:24750b9ad5ef | 3613 | */ |
Christopher Haster |
1:24750b9ad5ef | 3614 | if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg ) |
Christopher Haster |
1:24750b9ad5ef | 3615 | { |
Christopher Haster |
1:24750b9ad5ef | 3616 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg" |
Christopher Haster |
1:24750b9ad5ef | 3617 | " for verify message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3618 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3619 | } |
Christopher Haster |
1:24750b9ad5ef | 3620 | |
Christopher Haster |
1:24750b9ad5ef | 3621 | md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg ); |
Christopher Haster |
1:24750b9ad5ef | 3622 | |
Christopher Haster |
1:24750b9ad5ef | 3623 | /* Info from md_alg will be used instead */ |
Christopher Haster |
1:24750b9ad5ef | 3624 | hashlen = 0; |
Christopher Haster |
1:24750b9ad5ef | 3625 | |
Christopher Haster |
1:24750b9ad5ef | 3626 | i++; |
Christopher Haster |
1:24750b9ad5ef | 3627 | |
Christopher Haster |
1:24750b9ad5ef | 3628 | /* |
Christopher Haster |
1:24750b9ad5ef | 3629 | * Signature |
Christopher Haster |
1:24750b9ad5ef | 3630 | */ |
Christopher Haster |
1:24750b9ad5ef | 3631 | if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) ) |
Christopher Haster |
1:24750b9ad5ef | 3632 | == MBEDTLS_PK_NONE ) |
Christopher Haster |
1:24750b9ad5ef | 3633 | { |
Christopher Haster |
1:24750b9ad5ef | 3634 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg" |
Christopher Haster |
1:24750b9ad5ef | 3635 | " for verify message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3636 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3637 | } |
Christopher Haster |
1:24750b9ad5ef | 3638 | |
Christopher Haster |
1:24750b9ad5ef | 3639 | /* |
Christopher Haster |
1:24750b9ad5ef | 3640 | * Check the certificate's key type matches the signature alg |
Christopher Haster |
1:24750b9ad5ef | 3641 | */ |
Christopher Haster |
1:24750b9ad5ef | 3642 | if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) ) |
Christopher Haster |
1:24750b9ad5ef | 3643 | { |
Christopher Haster |
1:24750b9ad5ef | 3644 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3645 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3646 | } |
Christopher Haster |
1:24750b9ad5ef | 3647 | |
Christopher Haster |
1:24750b9ad5ef | 3648 | i++; |
Christopher Haster |
1:24750b9ad5ef | 3649 | } |
Christopher Haster |
1:24750b9ad5ef | 3650 | else |
Christopher Haster |
1:24750b9ad5ef | 3651 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
Christopher Haster |
1:24750b9ad5ef | 3652 | { |
Christopher Haster |
1:24750b9ad5ef | 3653 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3654 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
Christopher Haster |
1:24750b9ad5ef | 3655 | } |
Christopher Haster |
1:24750b9ad5ef | 3656 | |
Christopher Haster |
1:24750b9ad5ef | 3657 | if( i + 2 > ssl->in_hslen ) |
Christopher Haster |
1:24750b9ad5ef | 3658 | { |
Christopher Haster |
1:24750b9ad5ef | 3659 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3660 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3661 | } |
Christopher Haster |
1:24750b9ad5ef | 3662 | |
Christopher Haster |
1:24750b9ad5ef | 3663 | sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1]; |
Christopher Haster |
1:24750b9ad5ef | 3664 | i += 2; |
Christopher Haster |
1:24750b9ad5ef | 3665 | |
Christopher Haster |
1:24750b9ad5ef | 3666 | if( i + sig_len != ssl->in_hslen ) |
Christopher Haster |
1:24750b9ad5ef | 3667 | { |
Christopher Haster |
1:24750b9ad5ef | 3668 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3669 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
Christopher Haster |
1:24750b9ad5ef | 3670 | } |
Christopher Haster |
1:24750b9ad5ef | 3671 | |
Christopher Haster |
1:24750b9ad5ef | 3672 | if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk, |
Christopher Haster |
1:24750b9ad5ef | 3673 | md_alg, hash_start, hashlen, |
Christopher Haster |
1:24750b9ad5ef | 3674 | ssl->in_msg + i, sig_len ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3675 | { |
Christopher Haster |
1:24750b9ad5ef | 3676 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3677 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3678 | } |
Christopher Haster |
1:24750b9ad5ef | 3679 | |
Christopher Haster |
1:24750b9ad5ef | 3680 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3681 | |
Christopher Haster |
1:24750b9ad5ef | 3682 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3683 | } |
Christopher Haster |
1:24750b9ad5ef | 3684 | #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 3685 | !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED && |
Christopher Haster |
1:24750b9ad5ef | 3686 | !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */ |
Christopher Haster |
1:24750b9ad5ef | 3687 | |
Christopher Haster |
1:24750b9ad5ef | 3688 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 3689 | static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 3690 | { |
Christopher Haster |
1:24750b9ad5ef | 3691 | int ret; |
Christopher Haster |
1:24750b9ad5ef | 3692 | size_t tlen; |
Christopher Haster |
1:24750b9ad5ef | 3693 | uint32_t lifetime; |
Christopher Haster |
1:24750b9ad5ef | 3694 | |
Christopher Haster |
1:24750b9ad5ef | 3695 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3696 | |
Christopher Haster |
1:24750b9ad5ef | 3697 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
Christopher Haster |
1:24750b9ad5ef | 3698 | ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET; |
Christopher Haster |
1:24750b9ad5ef | 3699 | |
Christopher Haster |
1:24750b9ad5ef | 3700 | /* |
Christopher Haster |
1:24750b9ad5ef | 3701 | * struct { |
Christopher Haster |
1:24750b9ad5ef | 3702 | * uint32 ticket_lifetime_hint; |
Christopher Haster |
1:24750b9ad5ef | 3703 | * opaque ticket<0..2^16-1>; |
Christopher Haster |
1:24750b9ad5ef | 3704 | * } NewSessionTicket; |
Christopher Haster |
1:24750b9ad5ef | 3705 | * |
Christopher Haster |
1:24750b9ad5ef | 3706 | * 4 . 7 ticket_lifetime_hint (0 = unspecified) |
Christopher Haster |
1:24750b9ad5ef | 3707 | * 8 . 9 ticket_len (n) |
Christopher Haster |
1:24750b9ad5ef | 3708 | * 10 . 9+n ticket content |
Christopher Haster |
1:24750b9ad5ef | 3709 | */ |
Christopher Haster |
1:24750b9ad5ef | 3710 | |
Christopher Haster |
1:24750b9ad5ef | 3711 | if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket, |
Christopher Haster |
1:24750b9ad5ef | 3712 | ssl->session_negotiate, |
Christopher Haster |
1:24750b9ad5ef | 3713 | ssl->out_msg + 10, |
Christopher Haster |
1:24750b9ad5ef | 3714 | ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN, |
Christopher Haster |
1:24750b9ad5ef | 3715 | &tlen, &lifetime ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3716 | { |
Christopher Haster |
1:24750b9ad5ef | 3717 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3718 | tlen = 0; |
Christopher Haster |
1:24750b9ad5ef | 3719 | } |
Christopher Haster |
1:24750b9ad5ef | 3720 | |
Christopher Haster |
1:24750b9ad5ef | 3721 | ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF; |
Christopher Haster |
1:24750b9ad5ef | 3722 | ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF; |
Christopher Haster |
1:24750b9ad5ef | 3723 | ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF; |
Christopher Haster |
1:24750b9ad5ef | 3724 | ssl->out_msg[7] = ( lifetime ) & 0xFF; |
Christopher Haster |
1:24750b9ad5ef | 3725 | |
Christopher Haster |
1:24750b9ad5ef | 3726 | ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 3727 | ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF ); |
Christopher Haster |
1:24750b9ad5ef | 3728 | |
Christopher Haster |
1:24750b9ad5ef | 3729 | ssl->out_msglen = 10 + tlen; |
Christopher Haster |
1:24750b9ad5ef | 3730 | |
Christopher Haster |
1:24750b9ad5ef | 3731 | /* |
Christopher Haster |
1:24750b9ad5ef | 3732 | * Morally equivalent to updating ssl->state, but NewSessionTicket and |
Christopher Haster |
1:24750b9ad5ef | 3733 | * ChangeCipherSpec share the same state. |
Christopher Haster |
1:24750b9ad5ef | 3734 | */ |
Christopher Haster |
1:24750b9ad5ef | 3735 | ssl->handshake->new_session_ticket = 0; |
Christopher Haster |
1:24750b9ad5ef | 3736 | |
Christopher Haster |
1:24750b9ad5ef | 3737 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3738 | { |
Christopher Haster |
1:24750b9ad5ef | 3739 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
Christopher Haster |
1:24750b9ad5ef | 3740 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3741 | } |
Christopher Haster |
1:24750b9ad5ef | 3742 | |
Christopher Haster |
1:24750b9ad5ef | 3743 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3744 | |
Christopher Haster |
1:24750b9ad5ef | 3745 | return( 0 ); |
Christopher Haster |
1:24750b9ad5ef | 3746 | } |
Christopher Haster |
1:24750b9ad5ef | 3747 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
Christopher Haster |
1:24750b9ad5ef | 3748 | |
Christopher Haster |
1:24750b9ad5ef | 3749 | /* |
Christopher Haster |
1:24750b9ad5ef | 3750 | * SSL handshake -- server side -- single step |
Christopher Haster |
1:24750b9ad5ef | 3751 | */ |
Christopher Haster |
1:24750b9ad5ef | 3752 | int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ) |
Christopher Haster |
1:24750b9ad5ef | 3753 | { |
Christopher Haster |
1:24750b9ad5ef | 3754 | int ret = 0; |
Christopher Haster |
1:24750b9ad5ef | 3755 | |
Christopher Haster |
1:24750b9ad5ef | 3756 | if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL ) |
Christopher Haster |
1:24750b9ad5ef | 3757 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Christopher Haster |
1:24750b9ad5ef | 3758 | |
Christopher Haster |
1:24750b9ad5ef | 3759 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) ); |
Christopher Haster |
1:24750b9ad5ef | 3760 | |
Christopher Haster |
1:24750b9ad5ef | 3761 | if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3762 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3763 | |
Christopher Haster |
1:24750b9ad5ef | 3764 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 3765 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
Christopher Haster |
1:24750b9ad5ef | 3766 | ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING ) |
Christopher Haster |
1:24750b9ad5ef | 3767 | { |
Christopher Haster |
1:24750b9ad5ef | 3768 | if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3769 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3770 | } |
Christopher Haster |
1:24750b9ad5ef | 3771 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3772 | |
Christopher Haster |
1:24750b9ad5ef | 3773 | switch( ssl->state ) |
Christopher Haster |
1:24750b9ad5ef | 3774 | { |
Christopher Haster |
1:24750b9ad5ef | 3775 | case MBEDTLS_SSL_HELLO_REQUEST: |
Christopher Haster |
1:24750b9ad5ef | 3776 | ssl->state = MBEDTLS_SSL_CLIENT_HELLO; |
Christopher Haster |
1:24750b9ad5ef | 3777 | break; |
Christopher Haster |
1:24750b9ad5ef | 3778 | |
Christopher Haster |
1:24750b9ad5ef | 3779 | /* |
Christopher Haster |
1:24750b9ad5ef | 3780 | * <== ClientHello |
Christopher Haster |
1:24750b9ad5ef | 3781 | */ |
Christopher Haster |
1:24750b9ad5ef | 3782 | case MBEDTLS_SSL_CLIENT_HELLO: |
Christopher Haster |
1:24750b9ad5ef | 3783 | ret = ssl_parse_client_hello( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3784 | break; |
Christopher Haster |
1:24750b9ad5ef | 3785 | |
Christopher Haster |
1:24750b9ad5ef | 3786 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
Christopher Haster |
1:24750b9ad5ef | 3787 | case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: |
Christopher Haster |
1:24750b9ad5ef | 3788 | return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ); |
Christopher Haster |
1:24750b9ad5ef | 3789 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3790 | |
Christopher Haster |
1:24750b9ad5ef | 3791 | /* |
Christopher Haster |
1:24750b9ad5ef | 3792 | * ==> ServerHello |
Christopher Haster |
1:24750b9ad5ef | 3793 | * Certificate |
Christopher Haster |
1:24750b9ad5ef | 3794 | * ( ServerKeyExchange ) |
Christopher Haster |
1:24750b9ad5ef | 3795 | * ( CertificateRequest ) |
Christopher Haster |
1:24750b9ad5ef | 3796 | * ServerHelloDone |
Christopher Haster |
1:24750b9ad5ef | 3797 | */ |
Christopher Haster |
1:24750b9ad5ef | 3798 | case MBEDTLS_SSL_SERVER_HELLO: |
Christopher Haster |
1:24750b9ad5ef | 3799 | ret = ssl_write_server_hello( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3800 | break; |
Christopher Haster |
1:24750b9ad5ef | 3801 | |
Christopher Haster |
1:24750b9ad5ef | 3802 | case MBEDTLS_SSL_SERVER_CERTIFICATE: |
Christopher Haster |
1:24750b9ad5ef | 3803 | ret = mbedtls_ssl_write_certificate( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3804 | break; |
Christopher Haster |
1:24750b9ad5ef | 3805 | |
Christopher Haster |
1:24750b9ad5ef | 3806 | case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: |
Christopher Haster |
1:24750b9ad5ef | 3807 | ret = ssl_write_server_key_exchange( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3808 | break; |
Christopher Haster |
1:24750b9ad5ef | 3809 | |
Christopher Haster |
1:24750b9ad5ef | 3810 | case MBEDTLS_SSL_CERTIFICATE_REQUEST: |
Christopher Haster |
1:24750b9ad5ef | 3811 | ret = ssl_write_certificate_request( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3812 | break; |
Christopher Haster |
1:24750b9ad5ef | 3813 | |
Christopher Haster |
1:24750b9ad5ef | 3814 | case MBEDTLS_SSL_SERVER_HELLO_DONE: |
Christopher Haster |
1:24750b9ad5ef | 3815 | ret = ssl_write_server_hello_done( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3816 | break; |
Christopher Haster |
1:24750b9ad5ef | 3817 | |
Christopher Haster |
1:24750b9ad5ef | 3818 | /* |
Christopher Haster |
1:24750b9ad5ef | 3819 | * <== ( Certificate/Alert ) |
Christopher Haster |
1:24750b9ad5ef | 3820 | * ClientKeyExchange |
Christopher Haster |
1:24750b9ad5ef | 3821 | * ( CertificateVerify ) |
Christopher Haster |
1:24750b9ad5ef | 3822 | * ChangeCipherSpec |
Christopher Haster |
1:24750b9ad5ef | 3823 | * Finished |
Christopher Haster |
1:24750b9ad5ef | 3824 | */ |
Christopher Haster |
1:24750b9ad5ef | 3825 | case MBEDTLS_SSL_CLIENT_CERTIFICATE: |
Christopher Haster |
1:24750b9ad5ef | 3826 | ret = mbedtls_ssl_parse_certificate( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3827 | break; |
Christopher Haster |
1:24750b9ad5ef | 3828 | |
Christopher Haster |
1:24750b9ad5ef | 3829 | case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: |
Christopher Haster |
1:24750b9ad5ef | 3830 | ret = ssl_parse_client_key_exchange( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3831 | break; |
Christopher Haster |
1:24750b9ad5ef | 3832 | |
Christopher Haster |
1:24750b9ad5ef | 3833 | case MBEDTLS_SSL_CERTIFICATE_VERIFY: |
Christopher Haster |
1:24750b9ad5ef | 3834 | ret = ssl_parse_certificate_verify( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3835 | break; |
Christopher Haster |
1:24750b9ad5ef | 3836 | |
Christopher Haster |
1:24750b9ad5ef | 3837 | case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: |
Christopher Haster |
1:24750b9ad5ef | 3838 | ret = mbedtls_ssl_parse_change_cipher_spec( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3839 | break; |
Christopher Haster |
1:24750b9ad5ef | 3840 | |
Christopher Haster |
1:24750b9ad5ef | 3841 | case MBEDTLS_SSL_CLIENT_FINISHED: |
Christopher Haster |
1:24750b9ad5ef | 3842 | ret = mbedtls_ssl_parse_finished( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3843 | break; |
Christopher Haster |
1:24750b9ad5ef | 3844 | |
Christopher Haster |
1:24750b9ad5ef | 3845 | /* |
Christopher Haster |
1:24750b9ad5ef | 3846 | * ==> ( NewSessionTicket ) |
Christopher Haster |
1:24750b9ad5ef | 3847 | * ChangeCipherSpec |
Christopher Haster |
1:24750b9ad5ef | 3848 | * Finished |
Christopher Haster |
1:24750b9ad5ef | 3849 | */ |
Christopher Haster |
1:24750b9ad5ef | 3850 | case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: |
Christopher Haster |
1:24750b9ad5ef | 3851 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
Christopher Haster |
1:24750b9ad5ef | 3852 | if( ssl->handshake->new_session_ticket != 0 ) |
Christopher Haster |
1:24750b9ad5ef | 3853 | ret = ssl_write_new_session_ticket( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3854 | else |
Christopher Haster |
1:24750b9ad5ef | 3855 | #endif |
Christopher Haster |
1:24750b9ad5ef | 3856 | ret = mbedtls_ssl_write_change_cipher_spec( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3857 | break; |
Christopher Haster |
1:24750b9ad5ef | 3858 | |
Christopher Haster |
1:24750b9ad5ef | 3859 | case MBEDTLS_SSL_SERVER_FINISHED: |
Christopher Haster |
1:24750b9ad5ef | 3860 | ret = mbedtls_ssl_write_finished( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3861 | break; |
Christopher Haster |
1:24750b9ad5ef | 3862 | |
Christopher Haster |
1:24750b9ad5ef | 3863 | case MBEDTLS_SSL_FLUSH_BUFFERS: |
Christopher Haster |
1:24750b9ad5ef | 3864 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) ); |
Christopher Haster |
1:24750b9ad5ef | 3865 | ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; |
Christopher Haster |
1:24750b9ad5ef | 3866 | break; |
Christopher Haster |
1:24750b9ad5ef | 3867 | |
Christopher Haster |
1:24750b9ad5ef | 3868 | case MBEDTLS_SSL_HANDSHAKE_WRAPUP: |
Christopher Haster |
1:24750b9ad5ef | 3869 | mbedtls_ssl_handshake_wrapup( ssl ); |
Christopher Haster |
1:24750b9ad5ef | 3870 | break; |
Christopher Haster |
1:24750b9ad5ef | 3871 | |
Christopher Haster |
1:24750b9ad5ef | 3872 | default: |
Christopher Haster |
1:24750b9ad5ef | 3873 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) ); |
Christopher Haster |
1:24750b9ad5ef | 3874 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
Christopher Haster |
1:24750b9ad5ef | 3875 | } |
Christopher Haster |
1:24750b9ad5ef | 3876 | |
Christopher Haster |
1:24750b9ad5ef | 3877 | return( ret ); |
Christopher Haster |
1:24750b9ad5ef | 3878 | } |
Christopher Haster |
1:24750b9ad5ef | 3879 | #endif /* MBEDTLS_SSL_SRV_C */ |