Marco Zecchini
Rtos API example
Embed:
(wiki syntax)
Show/hide line numbers
ssl_cli.c
00001 /* 00002 * SSLv3/TLSv1 client-side functions 00003 * 00004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 00005 * SPDX-License-Identifier: Apache-2.0 00006 * 00007 * Licensed under the Apache License, Version 2.0 (the "License"); you may 00008 * not use this file except in compliance with the License. 00009 * You may obtain a copy of the License at 00010 * 00011 * http://www.apache.org/licenses/LICENSE-2.0 00012 * 00013 * Unless required by applicable law or agreed to in writing, software 00014 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 00015 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 00016 * See the License for the specific language governing permissions and 00017 * limitations under the License. 00018 * 00019 * This file is part of mbed TLS (https://tls.mbed.org) 00020 */ 00021 00022 #if !defined(MBEDTLS_CONFIG_FILE) 00023 #include "mbedtls/config.h" 00024 #else 00025 #include MBEDTLS_CONFIG_FILE 00026 #endif 00027 00028 #if defined(MBEDTLS_SSL_CLI_C) 00029 00030 #if defined(MBEDTLS_PLATFORM_C) 00031 #include "mbedtls/platform.h" 00032 #else 00033 #include <stdlib.h> 00034 #define mbedtls_calloc calloc 00035 #define mbedtls_free free 00036 #endif 00037 00038 #include "mbedtls/debug.h" 00039 #include "mbedtls/ssl.h" 00040 #include "mbedtls/ssl_internal.h" 00041 00042 #include <string.h> 00043 00044 #include <stdint.h> 00045 00046 #if defined(MBEDTLS_HAVE_TIME) 00047 #include "mbedtls/platform_time.h" 00048 #endif 00049 00050 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 00051 /* Implementation that should never be optimized out by the compiler */ 00052 static void mbedtls_zeroize( void *v, size_t n ) { 00053 volatile unsigned char *p = v; while( n-- ) *p++ = 0; 00054 } 00055 #endif 00056 00057 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 00058 static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl, 00059 unsigned char *buf, 00060 size_t *olen ) 00061 { 00062 unsigned char *p = buf; 00063 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00064 size_t hostname_len; 00065 00066 *olen = 0; 00067 00068 if( ssl->hostname == NULL ) 00069 return; 00070 00071 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s", 00072 ssl->hostname ) ); 00073 00074 hostname_len = strlen( ssl->hostname ); 00075 00076 if( end < p || (size_t)( end - p ) < hostname_len + 9 ) 00077 { 00078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00079 return; 00080 } 00081 00082 /* 00083 * struct { 00084 * NameType name_type; 00085 * select (name_type) { 00086 * case host_name: HostName; 00087 * } name; 00088 * } ServerName; 00089 * 00090 * enum { 00091 * host_name(0), (255) 00092 * } NameType; 00093 * 00094 * opaque HostName<1..2^16-1>; 00095 * 00096 * struct { 00097 * ServerName server_name_list<1..2^16-1> 00098 * } ServerNameList; 00099 */ 00100 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF ); 00101 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF ); 00102 00103 *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF ); 00104 *p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF ); 00105 00106 *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF ); 00107 *p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF ); 00108 00109 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF ); 00110 *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF ); 00111 *p++ = (unsigned char)( ( hostname_len ) & 0xFF ); 00112 00113 memcpy( p, ssl->hostname, hostname_len ); 00114 00115 *olen = hostname_len + 9; 00116 } 00117 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ 00118 00119 #if defined(MBEDTLS_SSL_RENEGOTIATION) 00120 static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl, 00121 unsigned char *buf, 00122 size_t *olen ) 00123 { 00124 unsigned char *p = buf; 00125 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00126 00127 *olen = 0; 00128 00129 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) 00130 return; 00131 00132 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) ); 00133 00134 if( end < p || (size_t)( end - p ) < 5 + ssl->verify_data_len ) 00135 { 00136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00137 return; 00138 } 00139 00140 /* 00141 * Secure renegotiation 00142 */ 00143 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF ); 00144 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF ); 00145 00146 *p++ = 0x00; 00147 *p++ = ( ssl->verify_data_len + 1 ) & 0xFF; 00148 *p++ = ssl->verify_data_len & 0xFF; 00149 00150 memcpy( p, ssl->own_verify_data, ssl->verify_data_len ); 00151 00152 *olen = 5 + ssl->verify_data_len; 00153 } 00154 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 00155 00156 /* 00157 * Only if we handle at least one key exchange that needs signatures. 00158 */ 00159 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ 00160 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) 00161 static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl, 00162 unsigned char *buf, 00163 size_t *olen ) 00164 { 00165 unsigned char *p = buf; 00166 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00167 size_t sig_alg_len = 0; 00168 const int *md; 00169 #if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C) 00170 unsigned char *sig_alg_list = buf + 6; 00171 #endif 00172 00173 *olen = 0; 00174 00175 if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) 00176 return; 00177 00178 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) ); 00179 00180 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ ) 00181 { 00182 #if defined(MBEDTLS_ECDSA_C) 00183 sig_alg_len += 2; 00184 #endif 00185 #if defined(MBEDTLS_RSA_C) 00186 sig_alg_len += 2; 00187 #endif 00188 } 00189 00190 if( end < p || (size_t)( end - p ) < sig_alg_len + 6 ) 00191 { 00192 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00193 return; 00194 } 00195 00196 /* 00197 * Prepare signature_algorithms extension (TLS 1.2) 00198 */ 00199 sig_alg_len = 0; 00200 00201 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ ) 00202 { 00203 #if defined(MBEDTLS_ECDSA_C) 00204 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md ); 00205 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA; 00206 #endif 00207 #if defined(MBEDTLS_RSA_C) 00208 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md ); 00209 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA; 00210 #endif 00211 } 00212 00213 /* 00214 * enum { 00215 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5), 00216 * sha512(6), (255) 00217 * } HashAlgorithm; 00218 * 00219 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) } 00220 * SignatureAlgorithm; 00221 * 00222 * struct { 00223 * HashAlgorithm hash; 00224 * SignatureAlgorithm signature; 00225 * } SignatureAndHashAlgorithm; 00226 * 00227 * SignatureAndHashAlgorithm 00228 * supported_signature_algorithms<2..2^16-2>; 00229 */ 00230 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF ); 00231 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF ); 00232 00233 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF ); 00234 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF ); 00235 00236 *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF ); 00237 *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF ); 00238 00239 *olen = 6 + sig_alg_len; 00240 } 00241 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && 00242 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */ 00243 00244 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 00245 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 00246 static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl, 00247 unsigned char *buf, 00248 size_t *olen ) 00249 { 00250 unsigned char *p = buf; 00251 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00252 unsigned char *elliptic_curve_list = p + 6; 00253 size_t elliptic_curve_len = 0; 00254 const mbedtls_ecp_curve_info *info; 00255 #if defined(MBEDTLS_ECP_C) 00256 const mbedtls_ecp_group_id *grp_id; 00257 #else 00258 ((void) ssl); 00259 #endif 00260 00261 *olen = 0; 00262 00263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) ); 00264 00265 #if defined(MBEDTLS_ECP_C) 00266 for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ ) 00267 #else 00268 for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ ) 00269 #endif 00270 { 00271 #if defined(MBEDTLS_ECP_C) 00272 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id ); 00273 #endif 00274 if( info == NULL ) 00275 { 00276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) ); 00277 return; 00278 } 00279 00280 elliptic_curve_len += 2; 00281 } 00282 00283 if( end < p || (size_t)( end - p ) < 6 + elliptic_curve_len ) 00284 { 00285 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00286 return; 00287 } 00288 00289 elliptic_curve_len = 0; 00290 00291 #if defined(MBEDTLS_ECP_C) 00292 for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ ) 00293 #else 00294 for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ ) 00295 #endif 00296 { 00297 #if defined(MBEDTLS_ECP_C) 00298 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id ); 00299 #endif 00300 elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8; 00301 elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF; 00302 } 00303 00304 if( elliptic_curve_len == 0 ) 00305 return; 00306 00307 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF ); 00308 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES ) & 0xFF ); 00309 00310 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF ); 00311 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF ); 00312 00313 *p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF ); 00314 *p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF ); 00315 00316 *olen = 6 + elliptic_curve_len; 00317 } 00318 00319 static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl, 00320 unsigned char *buf, 00321 size_t *olen ) 00322 { 00323 unsigned char *p = buf; 00324 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00325 00326 *olen = 0; 00327 00328 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) ); 00329 00330 if( end < p || (size_t)( end - p ) < 6 ) 00331 { 00332 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00333 return; 00334 } 00335 00336 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF ); 00337 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF ); 00338 00339 *p++ = 0x00; 00340 *p++ = 2; 00341 00342 *p++ = 1; 00343 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; 00344 00345 *olen = 6; 00346 } 00347 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || 00348 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 00349 00350 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 00351 static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl, 00352 unsigned char *buf, 00353 size_t *olen ) 00354 { 00355 int ret; 00356 unsigned char *p = buf; 00357 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00358 size_t kkpp_len; 00359 00360 *olen = 0; 00361 00362 /* Skip costly extension if we can't use EC J-PAKE anyway */ 00363 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 ) 00364 return; 00365 00366 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) ); 00367 00368 if( end - p < 4 ) 00369 { 00370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00371 return; 00372 } 00373 00374 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF ); 00375 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF ); 00376 00377 /* 00378 * We may need to send ClientHello multiple times for Hello verification. 00379 * We don't want to compute fresh values every time (both for performance 00380 * and consistency reasons), so cache the extension content. 00381 */ 00382 if( ssl->handshake->ecjpake_cache == NULL || 00383 ssl->handshake->ecjpake_cache_len == 0 ) 00384 { 00385 MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) ); 00386 00387 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx, 00388 p + 2, end - p - 2, &kkpp_len, 00389 ssl->conf->f_rng, ssl->conf->p_rng ); 00390 if( ret != 0 ) 00391 { 00392 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret ); 00393 return; 00394 } 00395 00396 ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len ); 00397 if( ssl->handshake->ecjpake_cache == NULL ) 00398 { 00399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) ); 00400 return; 00401 } 00402 00403 memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len ); 00404 ssl->handshake->ecjpake_cache_len = kkpp_len; 00405 } 00406 else 00407 { 00408 MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) ); 00409 00410 kkpp_len = ssl->handshake->ecjpake_cache_len; 00411 00412 if( (size_t)( end - p - 2 ) < kkpp_len ) 00413 { 00414 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00415 return; 00416 } 00417 00418 memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len ); 00419 } 00420 00421 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF ); 00422 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF ); 00423 00424 *olen = kkpp_len + 4; 00425 } 00426 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 00427 00428 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 00429 static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl, 00430 unsigned char *buf, 00431 size_t *olen ) 00432 { 00433 unsigned char *p = buf; 00434 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00435 00436 *olen = 0; 00437 00438 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) { 00439 return; 00440 } 00441 00442 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) ); 00443 00444 if( end < p || (size_t)( end - p ) < 5 ) 00445 { 00446 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00447 return; 00448 } 00449 00450 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF ); 00451 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF ); 00452 00453 *p++ = 0x00; 00454 *p++ = 1; 00455 00456 *p++ = ssl->conf->mfl_code; 00457 00458 *olen = 5; 00459 } 00460 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 00461 00462 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 00463 static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl, 00464 unsigned char *buf, size_t *olen ) 00465 { 00466 unsigned char *p = buf; 00467 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00468 00469 *olen = 0; 00470 00471 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ) 00472 { 00473 return; 00474 } 00475 00476 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) ); 00477 00478 if( end < p || (size_t)( end - p ) < 4 ) 00479 { 00480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00481 return; 00482 } 00483 00484 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF ); 00485 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF ); 00486 00487 *p++ = 0x00; 00488 *p++ = 0x00; 00489 00490 *olen = 4; 00491 } 00492 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 00493 00494 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 00495 static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, 00496 unsigned char *buf, size_t *olen ) 00497 { 00498 unsigned char *p = buf; 00499 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00500 00501 *olen = 0; 00502 00503 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED || 00504 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 00505 { 00506 return; 00507 } 00508 00509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac " 00510 "extension" ) ); 00511 00512 if( end < p || (size_t)( end - p ) < 4 ) 00513 { 00514 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00515 return; 00516 } 00517 00518 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF ); 00519 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF ); 00520 00521 *p++ = 0x00; 00522 *p++ = 0x00; 00523 00524 *olen = 4; 00525 } 00526 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 00527 00528 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 00529 static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl, 00530 unsigned char *buf, size_t *olen ) 00531 { 00532 unsigned char *p = buf; 00533 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00534 00535 *olen = 0; 00536 00537 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED || 00538 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) 00539 { 00540 return; 00541 } 00542 00543 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret " 00544 "extension" ) ); 00545 00546 if( end < p || (size_t)( end - p ) < 4 ) 00547 { 00548 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00549 return; 00550 } 00551 00552 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF ); 00553 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF ); 00554 00555 *p++ = 0x00; 00556 *p++ = 0x00; 00557 00558 *olen = 4; 00559 } 00560 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 00561 00562 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 00563 static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl, 00564 unsigned char *buf, size_t *olen ) 00565 { 00566 unsigned char *p = buf; 00567 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00568 size_t tlen = ssl->session_negotiate->ticket_len; 00569 00570 *olen = 0; 00571 00572 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ) 00573 { 00574 return; 00575 } 00576 00577 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) ); 00578 00579 if( end < p || (size_t)( end - p ) < 4 + tlen ) 00580 { 00581 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00582 return; 00583 } 00584 00585 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF ); 00586 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF ); 00587 00588 *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF ); 00589 *p++ = (unsigned char)( ( tlen ) & 0xFF ); 00590 00591 *olen = 4; 00592 00593 if( ssl->session_negotiate->ticket == NULL || tlen == 0 ) 00594 { 00595 return; 00596 } 00597 00598 MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) ); 00599 00600 memcpy( p, ssl->session_negotiate->ticket, tlen ); 00601 00602 *olen += tlen; 00603 } 00604 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 00605 00606 #if defined(MBEDTLS_SSL_ALPN) 00607 static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl, 00608 unsigned char *buf, size_t *olen ) 00609 { 00610 unsigned char *p = buf; 00611 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; 00612 size_t alpnlen = 0; 00613 const char **cur; 00614 00615 *olen = 0; 00616 00617 if( ssl->conf->alpn_list == NULL ) 00618 { 00619 return; 00620 } 00621 00622 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) ); 00623 00624 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ ) 00625 alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1; 00626 00627 if( end < p || (size_t)( end - p ) < 6 + alpnlen ) 00628 { 00629 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); 00630 return; 00631 } 00632 00633 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF ); 00634 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF ); 00635 00636 /* 00637 * opaque ProtocolName<1..2^8-1>; 00638 * 00639 * struct { 00640 * ProtocolName protocol_name_list<2..2^16-1> 00641 * } ProtocolNameList; 00642 */ 00643 00644 /* Skip writing extension and list length for now */ 00645 p += 4; 00646 00647 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ ) 00648 { 00649 *p = (unsigned char)( strlen( *cur ) & 0xFF ); 00650 memcpy( p + 1, *cur, *p ); 00651 p += 1 + *p; 00652 } 00653 00654 *olen = p - buf; 00655 00656 /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */ 00657 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF ); 00658 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF ); 00659 00660 /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */ 00661 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF ); 00662 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF ); 00663 } 00664 #endif /* MBEDTLS_SSL_ALPN */ 00665 00666 /* 00667 * Generate random bytes for ClientHello 00668 */ 00669 static int ssl_generate_random( mbedtls_ssl_context *ssl ) 00670 { 00671 int ret; 00672 unsigned char *p = ssl->handshake->randbytes; 00673 #if defined(MBEDTLS_HAVE_TIME) 00674 mbedtls_time_t t; 00675 #endif 00676 00677 /* 00678 * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1) 00679 */ 00680 #if defined(MBEDTLS_SSL_PROTO_DTLS) 00681 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 00682 ssl->handshake->verify_cookie != NULL ) 00683 { 00684 return( 0 ); 00685 } 00686 #endif 00687 00688 #if defined(MBEDTLS_HAVE_TIME) 00689 t = mbedtls_time( NULL ); 00690 *p++ = (unsigned char)( t >> 24 ); 00691 *p++ = (unsigned char)( t >> 16 ); 00692 *p++ = (unsigned char)( t >> 8 ); 00693 *p++ = (unsigned char)( t ); 00694 00695 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) ); 00696 #else 00697 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 ) 00698 return( ret ); 00699 00700 p += 4; 00701 #endif /* MBEDTLS_HAVE_TIME */ 00702 00703 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 ) 00704 return( ret ); 00705 00706 return( 0 ); 00707 } 00708 00709 static int ssl_write_client_hello( mbedtls_ssl_context *ssl ) 00710 { 00711 int ret; 00712 size_t i, n, olen, ext_len = 0; 00713 unsigned char *buf; 00714 unsigned char *p, *q; 00715 unsigned char offer_compress; 00716 const int *ciphersuites; 00717 const mbedtls_ssl_ciphersuite_t *ciphersuite_info; 00718 00719 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) ); 00720 00721 if( ssl->conf->f_rng == NULL ) 00722 { 00723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") ); 00724 return( MBEDTLS_ERR_SSL_NO_RNG ); 00725 } 00726 00727 #if defined(MBEDTLS_SSL_RENEGOTIATION) 00728 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ) 00729 #endif 00730 { 00731 ssl->major_ver = ssl->conf->min_major_ver; 00732 ssl->minor_ver = ssl->conf->min_minor_ver; 00733 } 00734 00735 if( ssl->conf->max_major_ver == 0 ) 00736 { 00737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, " 00738 "consider using mbedtls_ssl_config_defaults()" ) ); 00739 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 00740 } 00741 00742 /* 00743 * 0 . 0 handshake type 00744 * 1 . 3 handshake length 00745 * 4 . 5 highest version supported 00746 * 6 . 9 current UNIX time 00747 * 10 . 37 random bytes 00748 */ 00749 buf = ssl->out_msg; 00750 p = buf + 4; 00751 00752 mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver, 00753 ssl->conf->transport, p ); 00754 p += 2; 00755 00756 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]", 00757 buf[4], buf[5] ) ); 00758 00759 if( ( ret = ssl_generate_random( ssl ) ) != 0 ) 00760 { 00761 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret ); 00762 return( ret ); 00763 } 00764 00765 memcpy( p, ssl->handshake->randbytes, 32 ); 00766 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 ); 00767 p += 32; 00768 00769 /* 00770 * 38 . 38 session id length 00771 * 39 . 39+n session id 00772 * 39+n . 39+n DTLS only: cookie length (1 byte) 00773 * 40+n . .. DTSL only: cookie 00774 * .. . .. ciphersuitelist length (2 bytes) 00775 * .. . .. ciphersuitelist 00776 * .. . .. compression methods length (1 byte) 00777 * .. . .. compression methods 00778 * .. . .. extensions length (2 bytes) 00779 * .. . .. extensions 00780 */ 00781 n = ssl->session_negotiate->id_len; 00782 00783 if( n < 16 || n > 32 || 00784 #if defined(MBEDTLS_SSL_RENEGOTIATION) 00785 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE || 00786 #endif 00787 ssl->handshake->resume == 0 ) 00788 { 00789 n = 0; 00790 } 00791 00792 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 00793 /* 00794 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY 00795 * generate and include a Session ID in the TLS ClientHello." 00796 */ 00797 #if defined(MBEDTLS_SSL_RENEGOTIATION) 00798 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ) 00799 #endif 00800 { 00801 if( ssl->session_negotiate->ticket != NULL && 00802 ssl->session_negotiate->ticket_len != 0 ) 00803 { 00804 ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 ); 00805 00806 if( ret != 0 ) 00807 return( ret ); 00808 00809 ssl->session_negotiate->id_len = n = 32; 00810 } 00811 } 00812 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 00813 00814 *p++ = (unsigned char) n; 00815 00816 for( i = 0; i < n; i++ ) 00817 *p++ = ssl->session_negotiate->id[i]; 00818 00819 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) ); 00820 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n ); 00821 00822 /* 00823 * DTLS cookie 00824 */ 00825 #if defined(MBEDTLS_SSL_PROTO_DTLS) 00826 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 00827 { 00828 if( ssl->handshake->verify_cookie == NULL ) 00829 { 00830 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) ); 00831 *p++ = 0; 00832 } 00833 else 00834 { 00835 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie", 00836 ssl->handshake->verify_cookie, 00837 ssl->handshake->verify_cookie_len ); 00838 00839 *p++ = ssl->handshake->verify_cookie_len; 00840 memcpy( p, ssl->handshake->verify_cookie, 00841 ssl->handshake->verify_cookie_len ); 00842 p += ssl->handshake->verify_cookie_len; 00843 } 00844 } 00845 #endif 00846 00847 /* 00848 * Ciphersuite list 00849 */ 00850 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; 00851 00852 /* Skip writing ciphersuite length for now */ 00853 n = 0; 00854 q = p; 00855 p += 2; 00856 00857 for( i = 0; ciphersuites[i] != 0; i++ ) 00858 { 00859 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] ); 00860 00861 if( ciphersuite_info == NULL ) 00862 continue; 00863 00864 if( ciphersuite_info->min_minor_ver > ssl->conf->max_minor_ver || 00865 ciphersuite_info->max_minor_ver < ssl->conf->min_minor_ver ) 00866 continue; 00867 00868 #if defined(MBEDTLS_SSL_PROTO_DTLS) 00869 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 00870 ( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) ) 00871 continue; 00872 #endif 00873 00874 #if defined(MBEDTLS_ARC4_C) 00875 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED && 00876 ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 ) 00877 continue; 00878 #endif 00879 00880 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 00881 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && 00882 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 ) 00883 continue; 00884 #endif 00885 00886 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x", 00887 ciphersuites[i] ) ); 00888 00889 n++; 00890 *p++ = (unsigned char)( ciphersuites[i] >> 8 ); 00891 *p++ = (unsigned char)( ciphersuites[i] ); 00892 } 00893 00894 /* 00895 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV 00896 */ 00897 #if defined(MBEDTLS_SSL_RENEGOTIATION) 00898 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ) 00899 #endif 00900 { 00901 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 ); 00902 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO ); 00903 n++; 00904 } 00905 00906 /* Some versions of OpenSSL don't handle it correctly if not at end */ 00907 #if defined(MBEDTLS_SSL_FALLBACK_SCSV) 00908 if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK ) 00909 { 00910 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) ); 00911 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ); 00912 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ); 00913 n++; 00914 } 00915 #endif 00916 00917 *q++ = (unsigned char)( n >> 7 ); 00918 *q++ = (unsigned char)( n << 1 ); 00919 00920 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) ); 00921 00922 #if defined(MBEDTLS_ZLIB_SUPPORT) 00923 offer_compress = 1; 00924 #else 00925 offer_compress = 0; 00926 #endif 00927 00928 /* 00929 * We don't support compression with DTLS right now: is many records come 00930 * in the same datagram, uncompressing one could overwrite the next one. 00931 * We don't want to add complexity for handling that case unless there is 00932 * an actual need for it. 00933 */ 00934 #if defined(MBEDTLS_SSL_PROTO_DTLS) 00935 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 00936 offer_compress = 0; 00937 #endif 00938 00939 if( offer_compress ) 00940 { 00941 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) ); 00942 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d", 00943 MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) ); 00944 00945 *p++ = 2; 00946 *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE; 00947 *p++ = MBEDTLS_SSL_COMPRESS_NULL; 00948 } 00949 else 00950 { 00951 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) ); 00952 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d", 00953 MBEDTLS_SSL_COMPRESS_NULL ) ); 00954 00955 *p++ = 1; 00956 *p++ = MBEDTLS_SSL_COMPRESS_NULL; 00957 } 00958 00959 // First write extensions, then the total length 00960 // 00961 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) 00962 ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen ); 00963 ext_len += olen; 00964 #endif 00965 00966 #if defined(MBEDTLS_SSL_RENEGOTIATION) 00967 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen ); 00968 ext_len += olen; 00969 #endif 00970 00971 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ 00972 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) 00973 ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen ); 00974 ext_len += olen; 00975 #endif 00976 00977 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 00978 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 00979 ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen ); 00980 ext_len += olen; 00981 00982 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen ); 00983 ext_len += olen; 00984 #endif 00985 00986 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 00987 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen ); 00988 ext_len += olen; 00989 #endif 00990 00991 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 00992 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen ); 00993 ext_len += olen; 00994 #endif 00995 00996 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 00997 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen ); 00998 ext_len += olen; 00999 #endif 01000 01001 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 01002 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen ); 01003 ext_len += olen; 01004 #endif 01005 01006 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 01007 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen ); 01008 ext_len += olen; 01009 #endif 01010 01011 #if defined(MBEDTLS_SSL_ALPN) 01012 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen ); 01013 ext_len += olen; 01014 #endif 01015 01016 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 01017 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen ); 01018 ext_len += olen; 01019 #endif 01020 01021 /* olen unused if all extensions are disabled */ 01022 ((void) olen); 01023 01024 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d", 01025 ext_len ) ); 01026 01027 if( ext_len > 0 ) 01028 { 01029 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF ); 01030 *p++ = (unsigned char)( ( ext_len ) & 0xFF ); 01031 p += ext_len; 01032 } 01033 01034 ssl->out_msglen = p - buf; 01035 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 01036 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO; 01037 01038 ssl->state++; 01039 01040 #if defined(MBEDTLS_SSL_PROTO_DTLS) 01041 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 01042 mbedtls_ssl_send_flight_completed( ssl ); 01043 #endif 01044 01045 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) 01046 { 01047 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); 01048 return( ret ); 01049 } 01050 01051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) ); 01052 01053 return( 0 ); 01054 } 01055 01056 static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl, 01057 const unsigned char *buf, 01058 size_t len ) 01059 { 01060 #if defined(MBEDTLS_SSL_RENEGOTIATION) 01061 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) 01062 { 01063 /* Check verify-data in constant-time. The length OTOH is no secret */ 01064 if( len != 1 + ssl->verify_data_len * 2 || 01065 buf[0] != ssl->verify_data_len * 2 || 01066 mbedtls_ssl_safer_memcmp( buf + 1, 01067 ssl->own_verify_data, ssl->verify_data_len ) != 0 || 01068 mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len, 01069 ssl->peer_verify_data, ssl->verify_data_len ) != 0 ) 01070 { 01071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) ); 01072 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01073 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01074 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01075 } 01076 } 01077 else 01078 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 01079 { 01080 if( len != 1 || buf[0] != 0x00 ) 01081 { 01082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) ); 01083 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01084 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01085 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01086 } 01087 01088 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; 01089 } 01090 01091 return( 0 ); 01092 } 01093 01094 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 01095 static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl, 01096 const unsigned char *buf, 01097 size_t len ) 01098 { 01099 /* 01100 * server should use the extension only if we did, 01101 * and if so the server's value should match ours (and len is always 1) 01102 */ 01103 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE || 01104 len != 1 || 01105 buf[0] != ssl->conf->mfl_code ) 01106 { 01107 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching max fragment length extension" ) ); 01108 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01109 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01110 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01111 } 01112 01113 return( 0 ); 01114 } 01115 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 01116 01117 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 01118 static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl, 01119 const unsigned char *buf, 01120 size_t len ) 01121 { 01122 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED || 01123 len != 0 ) 01124 { 01125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching truncated HMAC extension" ) ); 01126 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01127 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01128 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01129 } 01130 01131 ((void) buf); 01132 01133 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; 01134 01135 return( 0 ); 01136 } 01137 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 01138 01139 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 01140 static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, 01141 const unsigned char *buf, 01142 size_t len ) 01143 { 01144 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED || 01145 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 || 01146 len != 0 ) 01147 { 01148 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching encrypt-then-MAC extension" ) ); 01149 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01150 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01151 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01152 } 01153 01154 ((void) buf); 01155 01156 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; 01157 01158 return( 0 ); 01159 } 01160 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 01161 01162 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 01163 static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl, 01164 const unsigned char *buf, 01165 size_t len ) 01166 { 01167 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED || 01168 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 || 01169 len != 0 ) 01170 { 01171 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching extended master secret extension" ) ); 01172 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01173 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01174 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01175 } 01176 01177 ((void) buf); 01178 01179 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; 01180 01181 return( 0 ); 01182 } 01183 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 01184 01185 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 01186 static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl, 01187 const unsigned char *buf, 01188 size_t len ) 01189 { 01190 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED || 01191 len != 0 ) 01192 { 01193 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching session ticket extension" ) ); 01194 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01195 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01196 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01197 } 01198 01199 ((void) buf); 01200 01201 ssl->handshake->new_session_ticket = 1; 01202 01203 return( 0 ); 01204 } 01205 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 01206 01207 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 01208 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 01209 static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl, 01210 const unsigned char *buf, 01211 size_t len ) 01212 { 01213 size_t list_size; 01214 const unsigned char *p; 01215 01216 list_size = buf[0]; 01217 if( list_size + 1 != len ) 01218 { 01219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01220 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01221 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01222 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01223 } 01224 01225 p = buf + 1; 01226 while( list_size > 0 ) 01227 { 01228 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || 01229 p[0] == MBEDTLS_ECP_PF_COMPRESSED ) 01230 { 01231 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) 01232 ssl->handshake->ecdh_ctx.point_format = p[0]; 01233 #endif 01234 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 01235 ssl->handshake->ecjpake_ctx.point_format = p[0]; 01236 #endif 01237 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) ); 01238 return( 0 ); 01239 } 01240 01241 list_size--; 01242 p++; 01243 } 01244 01245 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) ); 01246 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01247 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01248 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01249 } 01250 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || 01251 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 01252 01253 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 01254 static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl, 01255 const unsigned char *buf, 01256 size_t len ) 01257 { 01258 int ret; 01259 01260 if( ssl->transform_negotiate->ciphersuite_info->key_exchange != 01261 MBEDTLS_KEY_EXCHANGE_ECJPAKE ) 01262 { 01263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) ); 01264 return( 0 ); 01265 } 01266 01267 /* If we got here, we no longer need our cached extension */ 01268 mbedtls_free( ssl->handshake->ecjpake_cache ); 01269 ssl->handshake->ecjpake_cache = NULL; 01270 ssl->handshake->ecjpake_cache_len = 0; 01271 01272 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx, 01273 buf, len ) ) != 0 ) 01274 { 01275 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret ); 01276 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01277 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01278 return( ret ); 01279 } 01280 01281 return( 0 ); 01282 } 01283 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 01284 01285 #if defined(MBEDTLS_SSL_ALPN) 01286 static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl, 01287 const unsigned char *buf, size_t len ) 01288 { 01289 size_t list_len, name_len; 01290 const char **p; 01291 01292 /* If we didn't send it, the server shouldn't send it */ 01293 if( ssl->conf->alpn_list == NULL ) 01294 { 01295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) ); 01296 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01297 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01298 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01299 } 01300 01301 /* 01302 * opaque ProtocolName<1..2^8-1>; 01303 * 01304 * struct { 01305 * ProtocolName protocol_name_list<2..2^16-1> 01306 * } ProtocolNameList; 01307 * 01308 * the "ProtocolNameList" MUST contain exactly one "ProtocolName" 01309 */ 01310 01311 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */ 01312 if( len < 4 ) 01313 { 01314 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01315 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01316 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01317 } 01318 01319 list_len = ( buf[0] << 8 ) | buf[1]; 01320 if( list_len != len - 2 ) 01321 { 01322 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01323 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01324 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01325 } 01326 01327 name_len = buf[2]; 01328 if( name_len != list_len - 1 ) 01329 { 01330 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01331 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01332 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01333 } 01334 01335 /* Check that the server chosen protocol was in our list and save it */ 01336 for( p = ssl->conf->alpn_list; *p != NULL; p++ ) 01337 { 01338 if( name_len == strlen( *p ) && 01339 memcmp( buf + 3, *p, name_len ) == 0 ) 01340 { 01341 ssl->alpn_chosen = *p; 01342 return( 0 ); 01343 } 01344 } 01345 01346 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) ); 01347 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01348 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01349 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01350 } 01351 #endif /* MBEDTLS_SSL_ALPN */ 01352 01353 /* 01354 * Parse HelloVerifyRequest. Only called after verifying the HS type. 01355 */ 01356 #if defined(MBEDTLS_SSL_PROTO_DTLS) 01357 static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl ) 01358 { 01359 const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); 01360 int major_ver, minor_ver; 01361 unsigned char cookie_len; 01362 01363 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) ); 01364 01365 /* 01366 * struct { 01367 * ProtocolVersion server_version; 01368 * opaque cookie<0..2^8-1>; 01369 * } HelloVerifyRequest; 01370 */ 01371 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 ); 01372 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p ); 01373 p += 2; 01374 01375 /* 01376 * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1) 01377 * even is lower than our min version. 01378 */ 01379 if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 || 01380 minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 || 01381 major_ver > ssl->conf->max_major_ver || 01382 minor_ver > ssl->conf->max_minor_ver ) 01383 { 01384 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) ); 01385 01386 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01387 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); 01388 01389 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION ); 01390 } 01391 01392 cookie_len = *p++; 01393 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len ); 01394 01395 if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len ) 01396 { 01397 MBEDTLS_SSL_DEBUG_MSG( 1, 01398 ( "cookie length does not match incoming message size" ) ); 01399 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01400 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01401 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01402 } 01403 01404 mbedtls_free( ssl->handshake->verify_cookie ); 01405 01406 ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len ); 01407 if( ssl->handshake->verify_cookie == NULL ) 01408 { 01409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) ); 01410 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 01411 } 01412 01413 memcpy( ssl->handshake->verify_cookie, p, cookie_len ); 01414 ssl->handshake->verify_cookie_len = cookie_len; 01415 01416 /* Start over at ClientHello */ 01417 ssl->state = MBEDTLS_SSL_CLIENT_HELLO; 01418 mbedtls_ssl_reset_checksum( ssl ); 01419 01420 mbedtls_ssl_recv_flight_completed( ssl ); 01421 01422 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) ); 01423 01424 return( 0 ); 01425 } 01426 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 01427 01428 static int ssl_parse_server_hello( mbedtls_ssl_context *ssl ) 01429 { 01430 int ret, i; 01431 size_t n; 01432 size_t ext_len; 01433 unsigned char *buf, *ext; 01434 unsigned char comp; 01435 #if defined(MBEDTLS_ZLIB_SUPPORT) 01436 int accept_comp; 01437 #endif 01438 #if defined(MBEDTLS_SSL_RENEGOTIATION) 01439 int renegotiation_info_seen = 0; 01440 #endif 01441 int handshake_failure = 0; 01442 const mbedtls_ssl_ciphersuite_t *suite_info; 01443 #if defined(MBEDTLS_DEBUG_C) 01444 uint32_t t; 01445 #endif 01446 01447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) ); 01448 01449 buf = ssl->in_msg; 01450 01451 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) 01452 { 01453 /* No alert on a read error. */ 01454 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 01455 return( ret ); 01456 } 01457 01458 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 01459 { 01460 #if defined(MBEDTLS_SSL_RENEGOTIATION) 01461 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) 01462 { 01463 ssl->renego_records_seen++; 01464 01465 if( ssl->conf->renego_max_records >= 0 && 01466 ssl->renego_records_seen > ssl->conf->renego_max_records ) 01467 { 01468 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, " 01469 "but not honored by server" ) ); 01470 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 01471 } 01472 01473 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) ); 01474 01475 ssl->keep_current_message = 1; 01476 return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO ); 01477 } 01478 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 01479 01480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01481 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01482 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 01483 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 01484 } 01485 01486 #if defined(MBEDTLS_SSL_PROTO_DTLS) 01487 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 01488 { 01489 if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST ) 01490 { 01491 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) ); 01492 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) ); 01493 return( ssl_parse_hello_verify_request( ssl ) ); 01494 } 01495 else 01496 { 01497 /* We made it through the verification process */ 01498 mbedtls_free( ssl->handshake->verify_cookie ); 01499 ssl->handshake->verify_cookie = NULL; 01500 ssl->handshake->verify_cookie_len = 0; 01501 } 01502 } 01503 #endif /* MBEDTLS_SSL_PROTO_DTLS */ 01504 01505 if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) || 01506 buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO ) 01507 { 01508 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01509 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01510 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01511 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01512 } 01513 01514 /* 01515 * 0 . 1 server_version 01516 * 2 . 33 random (maybe including 4 bytes of Unix time) 01517 * 34 . 34 session_id length = n 01518 * 35 . 34+n session_id 01519 * 35+n . 36+n cipher_suite 01520 * 37+n . 37+n compression_method 01521 * 01522 * 38+n . 39+n extensions length (optional) 01523 * 40+n . .. extensions 01524 */ 01525 buf += mbedtls_ssl_hs_hdr_len( ssl ); 01526 01527 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 ); 01528 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver, 01529 ssl->conf->transport, buf + 0 ); 01530 01531 if( ssl->major_ver < ssl->conf->min_major_ver || 01532 ssl->minor_ver < ssl->conf->min_minor_ver || 01533 ssl->major_ver > ssl->conf->max_major_ver || 01534 ssl->minor_ver > ssl->conf->max_minor_ver ) 01535 { 01536 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - " 01537 " min: [%d:%d], server: [%d:%d], max: [%d:%d]", 01538 ssl->conf->min_major_ver, ssl->conf->min_minor_ver, 01539 ssl->major_ver, ssl->minor_ver, 01540 ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) ); 01541 01542 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01543 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); 01544 01545 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION ); 01546 } 01547 01548 #if defined(MBEDTLS_DEBUG_C) 01549 t = ( (uint32_t) buf[2] << 24 ) 01550 | ( (uint32_t) buf[3] << 16 ) 01551 | ( (uint32_t) buf[4] << 8 ) 01552 | ( (uint32_t) buf[5] ); 01553 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) ); 01554 #endif 01555 01556 memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 ); 01557 01558 n = buf[34]; 01559 01560 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 ); 01561 01562 if( n > 32 ) 01563 { 01564 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01565 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01566 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01567 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01568 } 01569 01570 if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n ) 01571 { 01572 ext_len = ( ( buf[38 + n] << 8 ) 01573 | ( buf[39 + n] ) ); 01574 01575 if( ( ext_len > 0 && ext_len < 4 ) || 01576 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len ) 01577 { 01578 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01579 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01580 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01581 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01582 } 01583 } 01584 else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n ) 01585 { 01586 ext_len = 0; 01587 } 01588 else 01589 { 01590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01591 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01592 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01593 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01594 } 01595 01596 /* ciphersuite (used later) */ 01597 i = ( buf[35 + n] << 8 ) | buf[36 + n]; 01598 01599 /* 01600 * Read and check compression 01601 */ 01602 comp = buf[37 + n]; 01603 01604 #if defined(MBEDTLS_ZLIB_SUPPORT) 01605 /* See comments in ssl_write_client_hello() */ 01606 #if defined(MBEDTLS_SSL_PROTO_DTLS) 01607 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 01608 accept_comp = 0; 01609 else 01610 #endif 01611 accept_comp = 1; 01612 01613 if( comp != MBEDTLS_SSL_COMPRESS_NULL && 01614 ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) ) 01615 #else /* MBEDTLS_ZLIB_SUPPORT */ 01616 if( comp != MBEDTLS_SSL_COMPRESS_NULL ) 01617 #endif/* MBEDTLS_ZLIB_SUPPORT */ 01618 { 01619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) ); 01620 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01621 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 01622 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); 01623 } 01624 01625 /* 01626 * Initialize update checksum functions 01627 */ 01628 ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i ); 01629 01630 if( ssl->transform_negotiate->ciphersuite_info == NULL ) 01631 { 01632 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) ); 01633 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01634 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 01635 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 01636 } 01637 01638 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info ); 01639 01640 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) ); 01641 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n ); 01642 01643 /* 01644 * Check if the session can be resumed 01645 */ 01646 if( ssl->handshake->resume == 0 || n == 0 || 01647 #if defined(MBEDTLS_SSL_RENEGOTIATION) 01648 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE || 01649 #endif 01650 ssl->session_negotiate->ciphersuite != i || 01651 ssl->session_negotiate->compression != comp || 01652 ssl->session_negotiate->id_len != n || 01653 memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 ) 01654 { 01655 ssl->state++; 01656 ssl->handshake->resume = 0; 01657 #if defined(MBEDTLS_HAVE_TIME) 01658 ssl->session_negotiate->start = mbedtls_time( NULL ); 01659 #endif 01660 ssl->session_negotiate->ciphersuite = i; 01661 ssl->session_negotiate->compression = comp; 01662 ssl->session_negotiate->id_len = n; 01663 memcpy( ssl->session_negotiate->id, buf + 35, n ); 01664 } 01665 else 01666 { 01667 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; 01668 01669 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) 01670 { 01671 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); 01672 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01673 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 01674 return( ret ); 01675 } 01676 } 01677 01678 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed", 01679 ssl->handshake->resume ? "a" : "no" ) ); 01680 01681 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) ); 01682 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) ); 01683 01684 suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite ); 01685 if( suite_info == NULL 01686 #if defined(MBEDTLS_ARC4_C) 01687 || ( ssl->conf->arc4_disabled && 01688 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 ) 01689 #endif 01690 ) 01691 { 01692 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01693 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01694 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 01695 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01696 } 01697 01698 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) ); 01699 01700 i = 0; 01701 while( 1 ) 01702 { 01703 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 ) 01704 { 01705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01706 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01707 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 01708 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01709 } 01710 01711 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] == 01712 ssl->session_negotiate->ciphersuite ) 01713 { 01714 break; 01715 } 01716 } 01717 01718 if( comp != MBEDTLS_SSL_COMPRESS_NULL 01719 #if defined(MBEDTLS_ZLIB_SUPPORT) 01720 && comp != MBEDTLS_SSL_COMPRESS_DEFLATE 01721 #endif 01722 ) 01723 { 01724 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01725 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01726 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 01727 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01728 } 01729 ssl->session_negotiate->compression = comp; 01730 01731 ext = buf + 40 + n; 01732 01733 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) ); 01734 01735 while( ext_len ) 01736 { 01737 unsigned int ext_id = ( ( ext[0] << 8 ) 01738 | ( ext[1] ) ); 01739 unsigned int ext_size = ( ( ext[2] << 8 ) 01740 | ( ext[3] ) ); 01741 01742 if( ext_size + 4 > ext_len ) 01743 { 01744 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01745 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01746 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 01747 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01748 } 01749 01750 switch( ext_id ) 01751 { 01752 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: 01753 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) ); 01754 #if defined(MBEDTLS_SSL_RENEGOTIATION) 01755 renegotiation_info_seen = 1; 01756 #endif 01757 01758 if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4, 01759 ext_size ) ) != 0 ) 01760 return( ret ); 01761 01762 break; 01763 01764 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) 01765 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: 01766 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) ); 01767 01768 if( ( ret = ssl_parse_max_fragment_length_ext( ssl, 01769 ext + 4, ext_size ) ) != 0 ) 01770 { 01771 return( ret ); 01772 } 01773 01774 break; 01775 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ 01776 01777 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) 01778 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC: 01779 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) ); 01780 01781 if( ( ret = ssl_parse_truncated_hmac_ext( ssl, 01782 ext + 4, ext_size ) ) != 0 ) 01783 { 01784 return( ret ); 01785 } 01786 01787 break; 01788 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ 01789 01790 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) 01791 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: 01792 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) ); 01793 01794 if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl, 01795 ext + 4, ext_size ) ) != 0 ) 01796 { 01797 return( ret ); 01798 } 01799 01800 break; 01801 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ 01802 01803 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) 01804 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: 01805 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) ); 01806 01807 if( ( ret = ssl_parse_extended_ms_ext( ssl, 01808 ext + 4, ext_size ) ) != 0 ) 01809 { 01810 return( ret ); 01811 } 01812 01813 break; 01814 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ 01815 01816 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 01817 case MBEDTLS_TLS_EXT_SESSION_TICKET: 01818 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) ); 01819 01820 if( ( ret = ssl_parse_session_ticket_ext( ssl, 01821 ext + 4, ext_size ) ) != 0 ) 01822 { 01823 return( ret ); 01824 } 01825 01826 break; 01827 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 01828 01829 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ 01830 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 01831 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: 01832 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) ); 01833 01834 if( ( ret = ssl_parse_supported_point_formats_ext( ssl, 01835 ext + 4, ext_size ) ) != 0 ) 01836 { 01837 return( ret ); 01838 } 01839 01840 break; 01841 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || 01842 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 01843 01844 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 01845 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: 01846 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) ); 01847 01848 if( ( ret = ssl_parse_ecjpake_kkpp( ssl, 01849 ext + 4, ext_size ) ) != 0 ) 01850 { 01851 return( ret ); 01852 } 01853 01854 break; 01855 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 01856 01857 #if defined(MBEDTLS_SSL_ALPN) 01858 case MBEDTLS_TLS_EXT_ALPN: 01859 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) ); 01860 01861 if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 ) 01862 return( ret ); 01863 01864 break; 01865 #endif /* MBEDTLS_SSL_ALPN */ 01866 01867 default: 01868 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)", 01869 ext_id ) ); 01870 } 01871 01872 ext_len -= 4 + ext_size; 01873 ext += 4 + ext_size; 01874 01875 if( ext_len > 0 && ext_len < 4 ) 01876 { 01877 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) ); 01878 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01879 } 01880 } 01881 01882 /* 01883 * Renegotiation security checks 01884 */ 01885 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 01886 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE ) 01887 { 01888 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) ); 01889 handshake_failure = 1; 01890 } 01891 #if defined(MBEDTLS_SSL_RENEGOTIATION) 01892 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 01893 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && 01894 renegotiation_info_seen == 0 ) 01895 { 01896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) ); 01897 handshake_failure = 1; 01898 } 01899 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 01900 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 01901 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) 01902 { 01903 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) ); 01904 handshake_failure = 1; 01905 } 01906 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && 01907 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && 01908 renegotiation_info_seen == 1 ) 01909 { 01910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) ); 01911 handshake_failure = 1; 01912 } 01913 #endif /* MBEDTLS_SSL_RENEGOTIATION */ 01914 01915 if( handshake_failure == 1 ) 01916 { 01917 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 01918 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 01919 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO ); 01920 } 01921 01922 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) ); 01923 01924 return( 0 ); 01925 } 01926 01927 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ 01928 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 01929 static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl, unsigned char **p, 01930 unsigned char *end ) 01931 { 01932 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 01933 01934 /* 01935 * Ephemeral DH parameters: 01936 * 01937 * struct { 01938 * opaque dh_p<1..2^16-1>; 01939 * opaque dh_g<1..2^16-1>; 01940 * opaque dh_Ys<1..2^16-1>; 01941 * } ServerDHParams; 01942 */ 01943 if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 ) 01944 { 01945 MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret ); 01946 return( ret ); 01947 } 01948 01949 if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen ) 01950 { 01951 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d", 01952 ssl->handshake->dhm_ctx.len * 8, 01953 ssl->conf->dhm_min_bitlen ) ); 01954 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 01955 } 01956 01957 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P ); 01958 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G ); 01959 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY ); 01960 01961 return( ret ); 01962 } 01963 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || 01964 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 01965 01966 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 01967 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ 01968 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ 01969 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 01970 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) 01971 static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl ) 01972 { 01973 const mbedtls_ecp_curve_info *curve_info; 01974 01975 curve_info = mbedtls_ecp_curve_info_from_grp_id( ssl->handshake->ecdh_ctx.grp.id ); 01976 if( curve_info == NULL ) 01977 { 01978 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 01979 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 01980 } 01981 01982 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) ); 01983 01984 #if defined(MBEDTLS_ECP_C) 01985 if( mbedtls_ssl_check_curve( ssl, ssl->handshake->ecdh_ctx.grp.id ) != 0 ) 01986 #else 01987 if( ssl->handshake->ecdh_ctx.grp.nbits < 163 || 01988 ssl->handshake->ecdh_ctx.grp.nbits > 521 ) 01989 #endif 01990 return( -1 ); 01991 01992 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp", &ssl->handshake->ecdh_ctx.Qp ); 01993 01994 return( 0 ); 01995 } 01996 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 01997 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || 01998 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED || 01999 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || 02000 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 02001 02002 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 02003 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ 02004 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 02005 static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl, 02006 unsigned char **p, 02007 unsigned char *end ) 02008 { 02009 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 02010 02011 /* 02012 * Ephemeral ECDH parameters: 02013 * 02014 * struct { 02015 * ECParameters curve_params; 02016 * ECPoint public; 02017 * } ServerECDHParams; 02018 */ 02019 if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx, 02020 (const unsigned char **) p, end ) ) != 0 ) 02021 { 02022 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret ); 02023 return( ret ); 02024 } 02025 02026 if( ssl_check_server_ecdh_params( ssl ) != 0 ) 02027 { 02028 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) ); 02029 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02030 } 02031 02032 return( ret ); 02033 } 02034 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 02035 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || 02036 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 02037 02038 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) 02039 static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl, 02040 unsigned char **p, 02041 unsigned char *end ) 02042 { 02043 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 02044 size_t len; 02045 ((void) ssl); 02046 02047 /* 02048 * PSK parameters: 02049 * 02050 * opaque psk_identity_hint<0..2^16-1>; 02051 */ 02052 len = (*p)[0] << 8 | (*p)[1]; 02053 *p += 2; 02054 02055 if( (*p) + len > end ) 02056 { 02057 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message " 02058 "(psk_identity_hint length)" ) ); 02059 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02060 } 02061 02062 /* 02063 * Note: we currently ignore the PKS identity hint, as we only allow one 02064 * PSK to be provisionned on the client. This could be changed later if 02065 * someone needs that feature. 02066 */ 02067 *p += len; 02068 ret = 0; 02069 02070 return( ret ); 02071 } 02072 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ 02073 02074 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ 02075 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 02076 /* 02077 * Generate a pre-master secret and encrypt it with the server's RSA key 02078 */ 02079 static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl, 02080 size_t offset, size_t *olen, 02081 size_t pms_offset ) 02082 { 02083 int ret; 02084 size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2; 02085 unsigned char *p = ssl->handshake->premaster + pms_offset; 02086 02087 if( offset + len_bytes > MBEDTLS_SSL_MAX_CONTENT_LEN ) 02088 { 02089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) ); 02090 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); 02091 } 02092 02093 /* 02094 * Generate (part of) the pre-master as 02095 * struct { 02096 * ProtocolVersion client_version; 02097 * opaque random[46]; 02098 * } PreMasterSecret; 02099 */ 02100 mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver, 02101 ssl->conf->transport, p ); 02102 02103 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 ) 02104 { 02105 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret ); 02106 return( ret ); 02107 } 02108 02109 ssl->handshake->pmslen = 48; 02110 02111 if( ssl->session_negotiate->peer_cert == NULL ) 02112 { 02113 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) ); 02114 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02115 } 02116 02117 /* 02118 * Now write it out, encrypted 02119 */ 02120 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, 02121 MBEDTLS_PK_RSA ) ) 02122 { 02123 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) ); 02124 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); 02125 } 02126 02127 if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk, 02128 p, ssl->handshake->pmslen, 02129 ssl->out_msg + offset + len_bytes, olen, 02130 MBEDTLS_SSL_MAX_CONTENT_LEN - offset - len_bytes, 02131 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) 02132 { 02133 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret ); 02134 return( ret ); 02135 } 02136 02137 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ 02138 defined(MBEDTLS_SSL_PROTO_TLS1_2) 02139 if( len_bytes == 2 ) 02140 { 02141 ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 ); 02142 ssl->out_msg[offset+1] = (unsigned char)( *olen ); 02143 *olen += 2; 02144 } 02145 #endif 02146 02147 return( 0 ); 02148 } 02149 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || 02150 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 02151 02152 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 02153 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ 02154 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 02155 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) 02156 static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl, 02157 unsigned char **p, 02158 unsigned char *end, 02159 mbedtls_md_type_t *md_alg, 02160 mbedtls_pk_type_t *pk_alg ) 02161 { 02162 ((void) ssl); 02163 *md_alg = MBEDTLS_MD_NONE; 02164 *pk_alg = MBEDTLS_PK_NONE; 02165 02166 /* Only in TLS 1.2 */ 02167 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) 02168 { 02169 return( 0 ); 02170 } 02171 02172 if( (*p) + 2 > end ) 02173 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02174 02175 /* 02176 * Get hash algorithm 02177 */ 02178 if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) ) == MBEDTLS_MD_NONE ) 02179 { 02180 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported " 02181 "HashAlgorithm %d", *(p)[0] ) ); 02182 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02183 } 02184 02185 /* 02186 * Get signature algorithm 02187 */ 02188 if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) ) == MBEDTLS_PK_NONE ) 02189 { 02190 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported " 02191 "SignatureAlgorithm %d", (*p)[1] ) ); 02192 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02193 } 02194 02195 /* 02196 * Check if the hash is acceptable 02197 */ 02198 if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 ) 02199 { 02200 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm %d that was not offered", 02201 *(p)[0] ) ); 02202 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02203 } 02204 02205 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) ); 02206 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) ); 02207 *p += 2; 02208 02209 return( 0 ); 02210 } 02211 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || 02212 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 02213 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ 02214 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 02215 02216 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 02217 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) 02218 static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl ) 02219 { 02220 int ret; 02221 const mbedtls_ecp_keypair *peer_key; 02222 02223 if( ssl->session_negotiate->peer_cert == NULL ) 02224 { 02225 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) ); 02226 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02227 } 02228 02229 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, 02230 MBEDTLS_PK_ECKEY ) ) 02231 { 02232 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) ); 02233 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); 02234 } 02235 02236 peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk ); 02237 02238 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key, 02239 MBEDTLS_ECDH_THEIRS ) ) != 0 ) 02240 { 02241 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret ); 02242 return( ret ); 02243 } 02244 02245 if( ssl_check_server_ecdh_params( ssl ) != 0 ) 02246 { 02247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) ); 02248 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE ); 02249 } 02250 02251 return( ret ); 02252 } 02253 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || 02254 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 02255 02256 static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl ) 02257 { 02258 int ret; 02259 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 02260 ssl->transform_negotiate->ciphersuite_info; 02261 unsigned char *p, *end; 02262 02263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) ); 02264 02265 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) 02266 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) 02267 { 02268 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) ); 02269 ssl->state++; 02270 return( 0 ); 02271 } 02272 ((void) p); 02273 ((void) end); 02274 #endif 02275 02276 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 02277 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) 02278 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || 02279 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) 02280 { 02281 if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 ) 02282 { 02283 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret ); 02284 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02285 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 02286 return( ret ); 02287 } 02288 02289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) ); 02290 ssl->state++; 02291 return( 0 ); 02292 } 02293 ((void) p); 02294 ((void) end); 02295 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || 02296 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 02297 02298 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) 02299 { 02300 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 02301 return( ret ); 02302 } 02303 02304 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 02305 { 02306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02307 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02308 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 02309 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02310 } 02311 02312 /* 02313 * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server 02314 * doesn't use a psk_identity_hint 02315 */ 02316 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE ) 02317 { 02318 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || 02319 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) 02320 { 02321 /* Current message is probably either 02322 * CertificateRequest or ServerHelloDone */ 02323 ssl->keep_current_message = 1; 02324 goto exit; 02325 } 02326 02327 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key exchange message must " 02328 "not be skipped" ) ); 02329 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02330 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 02331 02332 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02333 } 02334 02335 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); 02336 end = ssl->in_msg + ssl->in_hslen; 02337 MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p ); 02338 02339 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) 02340 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || 02341 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || 02342 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || 02343 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) 02344 { 02345 if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 ) 02346 { 02347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02348 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02349 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 02350 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02351 } 02352 } /* FALLTROUGH */ 02353 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ 02354 02355 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ 02356 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 02357 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || 02358 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) 02359 ; /* nothing more to do */ 02360 else 02361 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED || 02362 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ 02363 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ 02364 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 02365 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA || 02366 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) 02367 { 02368 if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 ) 02369 { 02370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02371 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02372 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 02373 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02374 } 02375 } 02376 else 02377 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || 02378 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 02379 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 02380 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ 02381 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) 02382 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || 02383 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || 02384 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ) 02385 { 02386 if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 ) 02387 { 02388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02389 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02390 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 02391 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02392 } 02393 } 02394 else 02395 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 02396 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED || 02397 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ 02398 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 02399 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) 02400 { 02401 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx, 02402 p, end - p ); 02403 if( ret != 0 ) 02404 { 02405 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret ); 02406 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02407 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 02408 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02409 } 02410 } 02411 else 02412 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ 02413 { 02414 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 02415 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 02416 } 02417 02418 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) 02419 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) ) 02420 { 02421 size_t sig_len, hashlen; 02422 unsigned char hash[64]; 02423 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE; 02424 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE; 02425 unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); 02426 size_t params_len = p - params; 02427 02428 /* 02429 * Handle the digitally-signed structure 02430 */ 02431 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 02432 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 02433 { 02434 if( ssl_parse_signature_algorithm( ssl, &p, end, 02435 &md_alg, &pk_alg ) != 0 ) 02436 { 02437 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02438 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02439 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 02440 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02441 } 02442 02443 if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) ) 02444 { 02445 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02446 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02447 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER ); 02448 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02449 } 02450 } 02451 else 02452 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 02453 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 02454 defined(MBEDTLS_SSL_PROTO_TLS1_1) 02455 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 ) 02456 { 02457 pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ); 02458 02459 /* Default hash for ECDSA is SHA-1 */ 02460 if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE ) 02461 md_alg = MBEDTLS_MD_SHA1; 02462 } 02463 else 02464 #endif 02465 { 02466 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 02467 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 02468 } 02469 02470 /* 02471 * Read signature 02472 */ 02473 sig_len = ( p[0] << 8 ) | p[1]; 02474 p += 2; 02475 02476 if( end != p + sig_len ) 02477 { 02478 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02479 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02480 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 02481 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); 02482 } 02483 02484 MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len ); 02485 02486 /* 02487 * Compute the hash that has been signed 02488 */ 02489 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 02490 defined(MBEDTLS_SSL_PROTO_TLS1_1) 02491 if( md_alg == MBEDTLS_MD_NONE ) 02492 { 02493 mbedtls_md5_context mbedtls_md5; 02494 mbedtls_sha1_context mbedtls_sha1; 02495 02496 mbedtls_md5_init( &mbedtls_md5 ); 02497 mbedtls_sha1_init( &mbedtls_sha1 ); 02498 02499 hashlen = 36; 02500 02501 /* 02502 * digitally-signed struct { 02503 * opaque md5_hash[16]; 02504 * opaque sha_hash[20]; 02505 * }; 02506 * 02507 * md5_hash 02508 * MD5(ClientHello.random + ServerHello.random 02509 * + ServerParams); 02510 * sha_hash 02511 * SHA(ClientHello.random + ServerHello.random 02512 * + ServerParams); 02513 */ 02514 mbedtls_md5_starts( &mbedtls_md5 ); 02515 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 ); 02516 mbedtls_md5_update( &mbedtls_md5, params, params_len ); 02517 mbedtls_md5_finish( &mbedtls_md5, hash ); 02518 02519 mbedtls_sha1_starts( &mbedtls_sha1 ); 02520 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 ); 02521 mbedtls_sha1_update( &mbedtls_sha1, params, params_len ); 02522 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 ); 02523 02524 mbedtls_md5_free( &mbedtls_md5 ); 02525 mbedtls_sha1_free( &mbedtls_sha1 ); 02526 } 02527 else 02528 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ 02529 MBEDTLS_SSL_PROTO_TLS1_1 */ 02530 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ 02531 defined(MBEDTLS_SSL_PROTO_TLS1_2) 02532 if( md_alg != MBEDTLS_MD_NONE ) 02533 { 02534 mbedtls_md_context_t ctx; 02535 02536 mbedtls_md_init( &ctx ); 02537 02538 /* Info from md_alg will be used instead */ 02539 hashlen = 0; 02540 02541 /* 02542 * digitally-signed struct { 02543 * opaque client_random[32]; 02544 * opaque server_random[32]; 02545 * ServerDHParams params; 02546 * }; 02547 */ 02548 if( ( ret = mbedtls_md_setup( &ctx, 02549 mbedtls_md_info_from_type( md_alg ), 0 ) ) != 0 ) 02550 { 02551 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret ); 02552 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02553 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 02554 return( ret ); 02555 } 02556 02557 mbedtls_md_starts( &ctx ); 02558 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ); 02559 mbedtls_md_update( &ctx, params, params_len ); 02560 mbedtls_md_finish( &ctx, hash ); 02561 mbedtls_md_free( &ctx ); 02562 } 02563 else 02564 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ 02565 MBEDTLS_SSL_PROTO_TLS1_2 */ 02566 { 02567 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 02568 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 02569 } 02570 02571 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen : 02572 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) ); 02573 02574 if( ssl->session_negotiate->peer_cert == NULL ) 02575 { 02576 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) ); 02577 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02578 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 02579 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02580 } 02581 02582 /* 02583 * Verify signature 02584 */ 02585 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) ) 02586 { 02587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) ); 02588 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02589 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE ); 02590 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); 02591 } 02592 02593 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk, 02594 md_alg, hash, hashlen, p, sig_len ) ) != 0 ) 02595 { 02596 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02597 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR ); 02598 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret ); 02599 return( ret ); 02600 } 02601 } 02602 #endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */ 02603 02604 exit: 02605 ssl->state++; 02606 02607 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) ); 02608 02609 return( 0 ); 02610 } 02611 02612 #if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED) 02613 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl ) 02614 { 02615 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 02616 ssl->transform_negotiate->ciphersuite_info; 02617 02618 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) ); 02619 02620 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ) 02621 { 02622 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) ); 02623 ssl->state++; 02624 return( 0 ); 02625 } 02626 02627 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 02628 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 02629 } 02630 #else /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */ 02631 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl ) 02632 { 02633 int ret; 02634 unsigned char *buf; 02635 size_t n = 0; 02636 size_t cert_type_len = 0, dn_len = 0; 02637 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 02638 ssl->transform_negotiate->ciphersuite_info; 02639 02640 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) ); 02641 02642 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ) 02643 { 02644 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) ); 02645 ssl->state++; 02646 return( 0 ); 02647 } 02648 02649 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) 02650 { 02651 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 02652 return( ret ); 02653 } 02654 02655 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 02656 { 02657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) ); 02658 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02659 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 02660 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02661 } 02662 02663 ssl->state++; 02664 ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST ); 02665 02666 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request", 02667 ssl->client_auth ? "a" : "no" ) ); 02668 02669 if( ssl->client_auth == 0 ) 02670 { 02671 /* Current message is probably the ServerHelloDone */ 02672 ssl->keep_current_message = 1; 02673 goto exit; 02674 } 02675 02676 /* 02677 * struct { 02678 * ClientCertificateType certificate_types<1..2^8-1>; 02679 * SignatureAndHashAlgorithm 02680 * supported_signature_algorithms<2^16-1>; -- TLS 1.2 only 02681 * DistinguishedName certificate_authorities<0..2^16-1>; 02682 * } CertificateRequest; 02683 * 02684 * Since we only support a single certificate on clients, let's just 02685 * ignore all the information that's supposed to help us pick a 02686 * certificate. 02687 * 02688 * We could check that our certificate matches the request, and bail out 02689 * if it doesn't, but it's simpler to just send the certificate anyway, 02690 * and give the server the opportunity to decide if it should terminate 02691 * the connection when it doesn't like our certificate. 02692 * 02693 * Same goes for the hash in TLS 1.2's signature_algorithms: at this 02694 * point we only have one hash available (see comments in 02695 * write_certificate_verify), so let's just use what we have. 02696 * 02697 * However, we still minimally parse the message to check it is at least 02698 * superficially sane. 02699 */ 02700 buf = ssl->in_msg; 02701 02702 /* certificate_types */ 02703 cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )]; 02704 n = cert_type_len; 02705 02706 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n ) 02707 { 02708 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) ); 02709 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02710 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 02711 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST ); 02712 } 02713 02714 /* supported_signature_algorithms */ 02715 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 02716 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 02717 { 02718 size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 ) 02719 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) ); 02720 #if defined(MBEDTLS_DEBUG_C) 02721 unsigned char* sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n; 02722 size_t i; 02723 02724 for( i = 0; i < sig_alg_len; i += 2 ) 02725 { 02726 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d" 02727 ",%d", sig_alg[i], sig_alg[i + 1] ) ); 02728 } 02729 #endif 02730 02731 n += 2 + sig_alg_len; 02732 02733 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n ) 02734 { 02735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) ); 02736 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02737 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 02738 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST ); 02739 } 02740 } 02741 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 02742 02743 /* certificate_authorities */ 02744 dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 ) 02745 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) ); 02746 02747 n += dn_len; 02748 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n ) 02749 { 02750 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) ); 02751 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02752 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 02753 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST ); 02754 } 02755 02756 exit: 02757 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) ); 02758 02759 return( 0 ); 02760 } 02761 #endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */ 02762 02763 static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl ) 02764 { 02765 int ret; 02766 02767 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) ); 02768 02769 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) 02770 { 02771 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 02772 return( ret ); 02773 } 02774 02775 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 02776 { 02777 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) ); 02778 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 02779 } 02780 02781 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) || 02782 ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE ) 02783 { 02784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) ); 02785 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 02786 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 02787 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE ); 02788 } 02789 02790 ssl->state++; 02791 02792 #if defined(MBEDTLS_SSL_PROTO_DTLS) 02793 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) 02794 mbedtls_ssl_recv_flight_completed( ssl ); 02795 #endif 02796 02797 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) ); 02798 02799 return( 0 ); 02800 } 02801 02802 static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl ) 02803 { 02804 int ret; 02805 size_t i, n; 02806 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 02807 ssl->transform_negotiate->ciphersuite_info; 02808 02809 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) ); 02810 02811 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) 02812 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ) 02813 { 02814 /* 02815 * DHM key exchange -- send G^X mod P 02816 */ 02817 n = ssl->handshake->dhm_ctx.len; 02818 02819 ssl->out_msg[4] = (unsigned char)( n >> 8 ); 02820 ssl->out_msg[5] = (unsigned char)( n ); 02821 i = 6; 02822 02823 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx, 02824 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ), 02825 &ssl->out_msg[i], n, 02826 ssl->conf->f_rng, ssl->conf->p_rng ); 02827 if( ret != 0 ) 02828 { 02829 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret ); 02830 return( ret ); 02831 } 02832 02833 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X ); 02834 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX ); 02835 02836 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, 02837 ssl->handshake->premaster, 02838 MBEDTLS_PREMASTER_SIZE, 02839 &ssl->handshake->pmslen, 02840 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) 02841 { 02842 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); 02843 return( ret ); 02844 } 02845 02846 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); 02847 } 02848 else 02849 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ 02850 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ 02851 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ 02852 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ 02853 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) 02854 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || 02855 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || 02856 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || 02857 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) 02858 { 02859 /* 02860 * ECDH key exchange -- send client public value 02861 */ 02862 i = 4; 02863 02864 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, 02865 &n, 02866 &ssl->out_msg[i], 1000, 02867 ssl->conf->f_rng, ssl->conf->p_rng ); 02868 if( ret != 0 ) 02869 { 02870 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret ); 02871 return( ret ); 02872 } 02873 02874 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q ); 02875 02876 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, 02877 &ssl->handshake->pmslen, 02878 ssl->handshake->premaster, 02879 MBEDTLS_MPI_MAX_SIZE, 02880 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) 02881 { 02882 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); 02883 return( ret ); 02884 } 02885 02886 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z ); 02887 } 02888 else 02889 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || 02890 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || 02891 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || 02892 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ 02893 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) 02894 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) ) 02895 { 02896 /* 02897 * opaque psk_identity<0..2^16-1>; 02898 */ 02899 if( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ) 02900 { 02901 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) ); 02902 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); 02903 } 02904 02905 i = 4; 02906 n = ssl->conf->psk_identity_len; 02907 02908 if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN ) 02909 { 02910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or " 02911 "SSL buffer too short" ) ); 02912 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); 02913 } 02914 02915 ssl->out_msg[i++] = (unsigned char)( n >> 8 ); 02916 ssl->out_msg[i++] = (unsigned char)( n ); 02917 02918 memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len ); 02919 i += ssl->conf->psk_identity_len; 02920 02921 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) 02922 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ) 02923 { 02924 n = 0; 02925 } 02926 else 02927 #endif 02928 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) 02929 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) 02930 { 02931 if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 ) 02932 return( ret ); 02933 } 02934 else 02935 #endif 02936 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) 02937 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) 02938 { 02939 /* 02940 * ClientDiffieHellmanPublic public (DHM send G^X mod P) 02941 */ 02942 n = ssl->handshake->dhm_ctx.len; 02943 02944 if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN ) 02945 { 02946 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long" 02947 " or SSL buffer too short" ) ); 02948 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL ); 02949 } 02950 02951 ssl->out_msg[i++] = (unsigned char)( n >> 8 ); 02952 ssl->out_msg[i++] = (unsigned char)( n ); 02953 02954 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx, 02955 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ), 02956 &ssl->out_msg[i], n, 02957 ssl->conf->f_rng, ssl->conf->p_rng ); 02958 if( ret != 0 ) 02959 { 02960 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret ); 02961 return( ret ); 02962 } 02963 } 02964 else 02965 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ 02966 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) 02967 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) 02968 { 02969 /* 02970 * ClientECDiffieHellmanPublic public; 02971 */ 02972 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n, 02973 &ssl->out_msg[i], MBEDTLS_SSL_MAX_CONTENT_LEN - i, 02974 ssl->conf->f_rng, ssl->conf->p_rng ); 02975 if( ret != 0 ) 02976 { 02977 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret ); 02978 return( ret ); 02979 } 02980 02981 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q ); 02982 } 02983 else 02984 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ 02985 { 02986 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 02987 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 02988 } 02989 02990 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, 02991 ciphersuite_info->key_exchange ) ) != 0 ) 02992 { 02993 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); 02994 return( ret ); 02995 } 02996 } 02997 else 02998 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ 02999 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) 03000 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) 03001 { 03002 i = 4; 03003 if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 ) 03004 return( ret ); 03005 } 03006 else 03007 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ 03008 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) 03009 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) 03010 { 03011 i = 4; 03012 03013 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx, 03014 ssl->out_msg + i, MBEDTLS_SSL_MAX_CONTENT_LEN - i, &n, 03015 ssl->conf->f_rng, ssl->conf->p_rng ); 03016 if( ret != 0 ) 03017 { 03018 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret ); 03019 return( ret ); 03020 } 03021 03022 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx, 03023 ssl->handshake->premaster, 32, &ssl->handshake->pmslen, 03024 ssl->conf->f_rng, ssl->conf->p_rng ); 03025 if( ret != 0 ) 03026 { 03027 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret ); 03028 return( ret ); 03029 } 03030 } 03031 else 03032 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ 03033 { 03034 ((void) ciphersuite_info); 03035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 03036 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 03037 } 03038 03039 ssl->out_msglen = i + n; 03040 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 03041 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE; 03042 03043 ssl->state++; 03044 03045 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) 03046 { 03047 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); 03048 return( ret ); 03049 } 03050 03051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) ); 03052 03053 return( 0 ); 03054 } 03055 03056 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ 03057 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ 03058 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \ 03059 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ 03060 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \ 03061 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) 03062 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl ) 03063 { 03064 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 03065 ssl->transform_negotiate->ciphersuite_info; 03066 int ret; 03067 03068 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) ); 03069 03070 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) 03071 { 03072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); 03073 return( ret ); 03074 } 03075 03076 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || 03077 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || 03078 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || 03079 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || 03080 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) 03081 { 03082 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) ); 03083 ssl->state++; 03084 return( 0 ); 03085 } 03086 03087 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 03088 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 03089 } 03090 #else 03091 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl ) 03092 { 03093 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; 03094 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = 03095 ssl->transform_negotiate->ciphersuite_info; 03096 size_t n = 0, offset = 0; 03097 unsigned char hash[48]; 03098 unsigned char *hash_start = hash; 03099 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE; 03100 unsigned int hashlen; 03101 03102 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) ); 03103 03104 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) 03105 { 03106 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); 03107 return( ret ); 03108 } 03109 03110 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || 03111 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || 03112 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || 03113 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || 03114 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) 03115 { 03116 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) ); 03117 ssl->state++; 03118 return( 0 ); 03119 } 03120 03121 if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL ) 03122 { 03123 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) ); 03124 ssl->state++; 03125 return( 0 ); 03126 } 03127 03128 if( mbedtls_ssl_own_key( ssl ) == NULL ) 03129 { 03130 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) ); 03131 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); 03132 } 03133 03134 /* 03135 * Make an RSA signature of the handshake digests 03136 */ 03137 ssl->handshake->calc_verify( ssl, hash ); 03138 03139 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ 03140 defined(MBEDTLS_SSL_PROTO_TLS1_1) 03141 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) 03142 { 03143 /* 03144 * digitally-signed struct { 03145 * opaque md5_hash[16]; 03146 * opaque sha_hash[20]; 03147 * }; 03148 * 03149 * md5_hash 03150 * MD5(handshake_messages); 03151 * 03152 * sha_hash 03153 * SHA(handshake_messages); 03154 */ 03155 hashlen = 36; 03156 md_alg = MBEDTLS_MD_NONE; 03157 03158 /* 03159 * For ECDSA, default hash is SHA-1 only 03160 */ 03161 if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) ) 03162 { 03163 hash_start += 16; 03164 hashlen -= 16; 03165 md_alg = MBEDTLS_MD_SHA1; 03166 } 03167 } 03168 else 03169 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ 03170 MBEDTLS_SSL_PROTO_TLS1_1 */ 03171 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) 03172 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) 03173 { 03174 /* 03175 * digitally-signed struct { 03176 * opaque handshake_messages[handshake_messages_length]; 03177 * }; 03178 * 03179 * Taking shortcut here. We assume that the server always allows the 03180 * PRF Hash function and has sent it in the allowed signature 03181 * algorithms list received in the Certificate Request message. 03182 * 03183 * Until we encounter a server that does not, we will take this 03184 * shortcut. 03185 * 03186 * Reason: Otherwise we should have running hashes for SHA512 and SHA224 03187 * in order to satisfy 'weird' needs from the server side. 03188 */ 03189 if( ssl->transform_negotiate->ciphersuite_info->mac == 03190 MBEDTLS_MD_SHA384 ) 03191 { 03192 md_alg = MBEDTLS_MD_SHA384; 03193 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384; 03194 } 03195 else 03196 { 03197 md_alg = MBEDTLS_MD_SHA256; 03198 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256; 03199 } 03200 ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) ); 03201 03202 /* Info from md_alg will be used instead */ 03203 hashlen = 0; 03204 offset = 2; 03205 } 03206 else 03207 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ 03208 { 03209 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); 03210 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); 03211 } 03212 03213 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash_start, hashlen, 03214 ssl->out_msg + 6 + offset, &n, 03215 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) 03216 { 03217 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret ); 03218 return( ret ); 03219 } 03220 03221 ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 ); 03222 ssl->out_msg[5 + offset] = (unsigned char)( n ); 03223 03224 ssl->out_msglen = 6 + n + offset; 03225 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; 03226 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY; 03227 03228 ssl->state++; 03229 03230 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) 03231 { 03232 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); 03233 return( ret ); 03234 } 03235 03236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) ); 03237 03238 return( ret ); 03239 } 03240 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED && 03241 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED && 03242 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED && 03243 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED && 03244 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED && 03245 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ 03246 03247 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 03248 static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl ) 03249 { 03250 int ret; 03251 uint32_t lifetime; 03252 size_t ticket_len; 03253 unsigned char *ticket; 03254 const unsigned char *msg; 03255 03256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) ); 03257 03258 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) 03259 { 03260 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); 03261 return( ret ); 03262 } 03263 03264 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) 03265 { 03266 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) ); 03267 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 03268 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE ); 03269 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE ); 03270 } 03271 03272 /* 03273 * struct { 03274 * uint32 ticket_lifetime_hint; 03275 * opaque ticket<0..2^16-1>; 03276 * } NewSessionTicket; 03277 * 03278 * 0 . 3 ticket_lifetime_hint 03279 * 4 . 5 ticket_len (n) 03280 * 6 . 5+n ticket content 03281 */ 03282 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET || 03283 ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) ) 03284 { 03285 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) ); 03286 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 03287 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 03288 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET ); 03289 } 03290 03291 msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); 03292 03293 lifetime = ( msg[0] << 24 ) | ( msg[1] << 16 ) | 03294 ( msg[2] << 8 ) | ( msg[3] ); 03295 03296 ticket_len = ( msg[4] << 8 ) | ( msg[5] ); 03297 03298 if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen ) 03299 { 03300 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) ); 03301 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 03302 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR ); 03303 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET ); 03304 } 03305 03306 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) ); 03307 03308 /* We're not waiting for a NewSessionTicket message any more */ 03309 ssl->handshake->new_session_ticket = 0; 03310 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; 03311 03312 /* 03313 * Zero-length ticket means the server changed his mind and doesn't want 03314 * to send a ticket after all, so just forget it 03315 */ 03316 if( ticket_len == 0 ) 03317 return( 0 ); 03318 03319 mbedtls_zeroize( ssl->session_negotiate->ticket, 03320 ssl->session_negotiate->ticket_len ); 03321 mbedtls_free( ssl->session_negotiate->ticket ); 03322 ssl->session_negotiate->ticket = NULL; 03323 ssl->session_negotiate->ticket_len = 0; 03324 03325 if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL ) 03326 { 03327 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) ); 03328 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, 03329 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR ); 03330 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); 03331 } 03332 03333 memcpy( ticket, msg + 6, ticket_len ); 03334 03335 ssl->session_negotiate->ticket = ticket; 03336 ssl->session_negotiate->ticket_len = ticket_len; 03337 ssl->session_negotiate->ticket_lifetime = lifetime; 03338 03339 /* 03340 * RFC 5077 section 3.4: 03341 * "If the client receives a session ticket from the server, then it 03342 * discards any Session ID that was sent in the ServerHello." 03343 */ 03344 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) ); 03345 ssl->session_negotiate->id_len = 0; 03346 03347 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) ); 03348 03349 return( 0 ); 03350 } 03351 #endif /* MBEDTLS_SSL_SESSION_TICKETS */ 03352 03353 /* 03354 * SSL handshake -- client side -- single step 03355 */ 03356 int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl ) 03357 { 03358 int ret = 0; 03359 03360 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL ) 03361 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 03362 03363 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) ); 03364 03365 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) 03366 return( ret ); 03367 03368 #if defined(MBEDTLS_SSL_PROTO_DTLS) 03369 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && 03370 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING ) 03371 { 03372 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) 03373 return( ret ); 03374 } 03375 #endif 03376 03377 /* Change state now, so that it is right in mbedtls_ssl_read_record(), used 03378 * by DTLS for dropping out-of-sequence ChangeCipherSpec records */ 03379 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 03380 if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC && 03381 ssl->handshake->new_session_ticket != 0 ) 03382 { 03383 ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET; 03384 } 03385 #endif 03386 03387 switch( ssl->state ) 03388 { 03389 case MBEDTLS_SSL_HELLO_REQUEST: 03390 ssl->state = MBEDTLS_SSL_CLIENT_HELLO; 03391 break; 03392 03393 /* 03394 * ==> ClientHello 03395 */ 03396 case MBEDTLS_SSL_CLIENT_HELLO: 03397 ret = ssl_write_client_hello( ssl ); 03398 break; 03399 03400 /* 03401 * <== ServerHello 03402 * Certificate 03403 * ( ServerKeyExchange ) 03404 * ( CertificateRequest ) 03405 * ServerHelloDone 03406 */ 03407 case MBEDTLS_SSL_SERVER_HELLO: 03408 ret = ssl_parse_server_hello( ssl ); 03409 break; 03410 03411 case MBEDTLS_SSL_SERVER_CERTIFICATE: 03412 ret = mbedtls_ssl_parse_certificate( ssl ); 03413 break; 03414 03415 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: 03416 ret = ssl_parse_server_key_exchange( ssl ); 03417 break; 03418 03419 case MBEDTLS_SSL_CERTIFICATE_REQUEST: 03420 ret = ssl_parse_certificate_request( ssl ); 03421 break; 03422 03423 case MBEDTLS_SSL_SERVER_HELLO_DONE: 03424 ret = ssl_parse_server_hello_done( ssl ); 03425 break; 03426 03427 /* 03428 * ==> ( Certificate/Alert ) 03429 * ClientKeyExchange 03430 * ( CertificateVerify ) 03431 * ChangeCipherSpec 03432 * Finished 03433 */ 03434 case MBEDTLS_SSL_CLIENT_CERTIFICATE: 03435 ret = mbedtls_ssl_write_certificate( ssl ); 03436 break; 03437 03438 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: 03439 ret = ssl_write_client_key_exchange( ssl ); 03440 break; 03441 03442 case MBEDTLS_SSL_CERTIFICATE_VERIFY: 03443 ret = ssl_write_certificate_verify( ssl ); 03444 break; 03445 03446 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: 03447 ret = mbedtls_ssl_write_change_cipher_spec( ssl ); 03448 break; 03449 03450 case MBEDTLS_SSL_CLIENT_FINISHED: 03451 ret = mbedtls_ssl_write_finished( ssl ); 03452 break; 03453 03454 /* 03455 * <== ( NewSessionTicket ) 03456 * ChangeCipherSpec 03457 * Finished 03458 */ 03459 #if defined(MBEDTLS_SSL_SESSION_TICKETS) 03460 case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET: 03461 ret = ssl_parse_new_session_ticket( ssl ); 03462 break; 03463 #endif 03464 03465 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: 03466 ret = mbedtls_ssl_parse_change_cipher_spec( ssl ); 03467 break; 03468 03469 case MBEDTLS_SSL_SERVER_FINISHED: 03470 ret = mbedtls_ssl_parse_finished( ssl ); 03471 break; 03472 03473 case MBEDTLS_SSL_FLUSH_BUFFERS: 03474 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) ); 03475 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; 03476 break; 03477 03478 case MBEDTLS_SSL_HANDSHAKE_WRAPUP: 03479 mbedtls_ssl_handshake_wrapup( ssl ); 03480 break; 03481 03482 default: 03483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) ); 03484 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); 03485 } 03486 03487 return( ret ); 03488 } 03489 #endif /* MBEDTLS_SSL_CLI_C */
Generated on Sun Jul 17 2022 08:25:31 by
1.7.2