Austin Blackstone / Mbed 2 deprecated client-lwip-lightswitch-demo-expanded

mbed client lightswitch demo

Dependencies:   mbed Socket lwip-eth lwip-sys lwip

Fork of mbed-client-classic-example-lwip by Austin Blackstone

mbedtls/source/ssl_srv.c@11:cada08fc8a70, 2016-06-09 (annotated)

Committer:
mbedAustin
Date:
Thu Jun 09 17:08:36 2016 +0000
Revision:
11:cada08fc8a70
Commit for public Consumption

Who changed what in which revision?

UserRevisionLine numberNew contents of line
mbedAustin 11:cada08fc8a70 1 /*
mbedAustin 11:cada08fc8a70 2 * SSLv3/TLSv1 server-side functions
mbedAustin 11:cada08fc8a70 3 *
mbedAustin 11:cada08fc8a70 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
mbedAustin 11:cada08fc8a70 5 * SPDX-License-Identifier: Apache-2.0
mbedAustin 11:cada08fc8a70 6 *
mbedAustin 11:cada08fc8a70 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
mbedAustin 11:cada08fc8a70 8 * not use this file except in compliance with the License.
mbedAustin 11:cada08fc8a70 9 * You may obtain a copy of the License at
mbedAustin 11:cada08fc8a70 10 *
mbedAustin 11:cada08fc8a70 11 * http://www.apache.org/licenses/LICENSE-2.0
mbedAustin 11:cada08fc8a70 12 *
mbedAustin 11:cada08fc8a70 13 * Unless required by applicable law or agreed to in writing, software
mbedAustin 11:cada08fc8a70 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
mbedAustin 11:cada08fc8a70 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
mbedAustin 11:cada08fc8a70 16 * See the License for the specific language governing permissions and
mbedAustin 11:cada08fc8a70 17 * limitations under the License.
mbedAustin 11:cada08fc8a70 18 *
mbedAustin 11:cada08fc8a70 19 * This file is part of mbed TLS (https://tls.mbed.org)
mbedAustin 11:cada08fc8a70 20 */
mbedAustin 11:cada08fc8a70 21
mbedAustin 11:cada08fc8a70 22 #if !defined(MBEDTLS_CONFIG_FILE)
mbedAustin 11:cada08fc8a70 23 #include "mbedtls/config.h"
mbedAustin 11:cada08fc8a70 24 #else
mbedAustin 11:cada08fc8a70 25 #include MBEDTLS_CONFIG_FILE
mbedAustin 11:cada08fc8a70 26 #endif
mbedAustin 11:cada08fc8a70 27
mbedAustin 11:cada08fc8a70 28 #if defined(MBEDTLS_SSL_SRV_C)
mbedAustin 11:cada08fc8a70 29
mbedAustin 11:cada08fc8a70 30 #include "mbedtls/debug.h"
mbedAustin 11:cada08fc8a70 31 #include "mbedtls/ssl.h"
mbedAustin 11:cada08fc8a70 32 #include "mbedtls/ssl_internal.h"
mbedAustin 11:cada08fc8a70 33
mbedAustin 11:cada08fc8a70 34 #include <string.h>
mbedAustin 11:cada08fc8a70 35
mbedAustin 11:cada08fc8a70 36 #if defined(MBEDTLS_ECP_C)
mbedAustin 11:cada08fc8a70 37 #include "mbedtls/ecp.h"
mbedAustin 11:cada08fc8a70 38 #endif
mbedAustin 11:cada08fc8a70 39
mbedAustin 11:cada08fc8a70 40 #if defined(MBEDTLS_PLATFORM_C)
mbedAustin 11:cada08fc8a70 41 #include "mbedtls/platform.h"
mbedAustin 11:cada08fc8a70 42 #else
mbedAustin 11:cada08fc8a70 43 #include <stdlib.h>
mbedAustin 11:cada08fc8a70 44 #define mbedtls_calloc calloc
mbedAustin 11:cada08fc8a70 45 #define mbedtls_free free
mbedAustin 11:cada08fc8a70 46 #endif
mbedAustin 11:cada08fc8a70 47
mbedAustin 11:cada08fc8a70 48 #if defined(MBEDTLS_HAVE_TIME)
mbedAustin 11:cada08fc8a70 49 #include <time.h>
mbedAustin 11:cada08fc8a70 50 #endif
mbedAustin 11:cada08fc8a70 51
mbedAustin 11:cada08fc8a70 52 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 53 /* Implementation that should never be optimized out by the compiler */
mbedAustin 11:cada08fc8a70 54 static void mbedtls_zeroize( void *v, size_t n ) {
mbedAustin 11:cada08fc8a70 55 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
mbedAustin 11:cada08fc8a70 56 }
mbedAustin 11:cada08fc8a70 57 #endif
mbedAustin 11:cada08fc8a70 58
mbedAustin 11:cada08fc8a70 59 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
mbedAustin 11:cada08fc8a70 60 int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 61 const unsigned char *info,
mbedAustin 11:cada08fc8a70 62 size_t ilen )
mbedAustin 11:cada08fc8a70 63 {
mbedAustin 11:cada08fc8a70 64 if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
mbedAustin 11:cada08fc8a70 65 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 66
mbedAustin 11:cada08fc8a70 67 mbedtls_free( ssl->cli_id );
mbedAustin 11:cada08fc8a70 68
mbedAustin 11:cada08fc8a70 69 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
mbedAustin 11:cada08fc8a70 70 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
mbedAustin 11:cada08fc8a70 71
mbedAustin 11:cada08fc8a70 72 memcpy( ssl->cli_id, info, ilen );
mbedAustin 11:cada08fc8a70 73 ssl->cli_id_len = ilen;
mbedAustin 11:cada08fc8a70 74
mbedAustin 11:cada08fc8a70 75 return( 0 );
mbedAustin 11:cada08fc8a70 76 }
mbedAustin 11:cada08fc8a70 77
mbedAustin 11:cada08fc8a70 78 void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
mbedAustin 11:cada08fc8a70 79 mbedtls_ssl_cookie_write_t *f_cookie_write,
mbedAustin 11:cada08fc8a70 80 mbedtls_ssl_cookie_check_t *f_cookie_check,
mbedAustin 11:cada08fc8a70 81 void *p_cookie )
mbedAustin 11:cada08fc8a70 82 {
mbedAustin 11:cada08fc8a70 83 conf->f_cookie_write = f_cookie_write;
mbedAustin 11:cada08fc8a70 84 conf->f_cookie_check = f_cookie_check;
mbedAustin 11:cada08fc8a70 85 conf->p_cookie = p_cookie;
mbedAustin 11:cada08fc8a70 86 }
mbedAustin 11:cada08fc8a70 87 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
mbedAustin 11:cada08fc8a70 88
mbedAustin 11:cada08fc8a70 89 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedAustin 11:cada08fc8a70 90 static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 91 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 92 size_t len )
mbedAustin 11:cada08fc8a70 93 {
mbedAustin 11:cada08fc8a70 94 int ret;
mbedAustin 11:cada08fc8a70 95 size_t servername_list_size, hostname_len;
mbedAustin 11:cada08fc8a70 96 const unsigned char *p;
mbedAustin 11:cada08fc8a70 97
mbedAustin 11:cada08fc8a70 98 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
mbedAustin 11:cada08fc8a70 99
mbedAustin 11:cada08fc8a70 100 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
mbedAustin 11:cada08fc8a70 101 if( servername_list_size + 2 != len )
mbedAustin 11:cada08fc8a70 102 {
mbedAustin 11:cada08fc8a70 103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 104 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 105 }
mbedAustin 11:cada08fc8a70 106
mbedAustin 11:cada08fc8a70 107 p = buf + 2;
mbedAustin 11:cada08fc8a70 108 while( servername_list_size > 0 )
mbedAustin 11:cada08fc8a70 109 {
mbedAustin 11:cada08fc8a70 110 hostname_len = ( ( p[1] << 8 ) | p[2] );
mbedAustin 11:cada08fc8a70 111 if( hostname_len + 3 > servername_list_size )
mbedAustin 11:cada08fc8a70 112 {
mbedAustin 11:cada08fc8a70 113 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 114 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 115 }
mbedAustin 11:cada08fc8a70 116
mbedAustin 11:cada08fc8a70 117 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
mbedAustin 11:cada08fc8a70 118 {
mbedAustin 11:cada08fc8a70 119 ret = ssl->conf->f_sni( ssl->conf->p_sni,
mbedAustin 11:cada08fc8a70 120 ssl, p + 3, hostname_len );
mbedAustin 11:cada08fc8a70 121 if( ret != 0 )
mbedAustin 11:cada08fc8a70 122 {
mbedAustin 11:cada08fc8a70 123 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
mbedAustin 11:cada08fc8a70 124 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 125 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
mbedAustin 11:cada08fc8a70 126 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 127 }
mbedAustin 11:cada08fc8a70 128 return( 0 );
mbedAustin 11:cada08fc8a70 129 }
mbedAustin 11:cada08fc8a70 130
mbedAustin 11:cada08fc8a70 131 servername_list_size -= hostname_len + 3;
mbedAustin 11:cada08fc8a70 132 p += hostname_len + 3;
mbedAustin 11:cada08fc8a70 133 }
mbedAustin 11:cada08fc8a70 134
mbedAustin 11:cada08fc8a70 135 if( servername_list_size != 0 )
mbedAustin 11:cada08fc8a70 136 {
mbedAustin 11:cada08fc8a70 137 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 138 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 139 }
mbedAustin 11:cada08fc8a70 140
mbedAustin 11:cada08fc8a70 141 return( 0 );
mbedAustin 11:cada08fc8a70 142 }
mbedAustin 11:cada08fc8a70 143 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
mbedAustin 11:cada08fc8a70 144
mbedAustin 11:cada08fc8a70 145 static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 146 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 147 size_t len )
mbedAustin 11:cada08fc8a70 148 {
mbedAustin 11:cada08fc8a70 149 int ret;
mbedAustin 11:cada08fc8a70 150
mbedAustin 11:cada08fc8a70 151 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 152 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
mbedAustin 11:cada08fc8a70 153 {
mbedAustin 11:cada08fc8a70 154 /* Check verify-data in constant-time. The length OTOH is no secret */
mbedAustin 11:cada08fc8a70 155 if( len != 1 + ssl->verify_data_len ||
mbedAustin 11:cada08fc8a70 156 buf[0] != ssl->verify_data_len ||
mbedAustin 11:cada08fc8a70 157 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
mbedAustin 11:cada08fc8a70 158 ssl->verify_data_len ) != 0 )
mbedAustin 11:cada08fc8a70 159 {
mbedAustin 11:cada08fc8a70 160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
mbedAustin 11:cada08fc8a70 161
mbedAustin 11:cada08fc8a70 162 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 163 return( ret );
mbedAustin 11:cada08fc8a70 164
mbedAustin 11:cada08fc8a70 165 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 166 }
mbedAustin 11:cada08fc8a70 167 }
mbedAustin 11:cada08fc8a70 168 else
mbedAustin 11:cada08fc8a70 169 #endif /* MBEDTLS_SSL_RENEGOTIATION */
mbedAustin 11:cada08fc8a70 170 {
mbedAustin 11:cada08fc8a70 171 if( len != 1 || buf[0] != 0x0 )
mbedAustin 11:cada08fc8a70 172 {
mbedAustin 11:cada08fc8a70 173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
mbedAustin 11:cada08fc8a70 174
mbedAustin 11:cada08fc8a70 175 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 176 return( ret );
mbedAustin 11:cada08fc8a70 177
mbedAustin 11:cada08fc8a70 178 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 179 }
mbedAustin 11:cada08fc8a70 180
mbedAustin 11:cada08fc8a70 181 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
mbedAustin 11:cada08fc8a70 182 }
mbedAustin 11:cada08fc8a70 183
mbedAustin 11:cada08fc8a70 184 return( 0 );
mbedAustin 11:cada08fc8a70 185 }
mbedAustin 11:cada08fc8a70 186
mbedAustin 11:cada08fc8a70 187 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
mbedAustin 11:cada08fc8a70 188 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
mbedAustin 11:cada08fc8a70 189 static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 190 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 191 size_t len )
mbedAustin 11:cada08fc8a70 192 {
mbedAustin 11:cada08fc8a70 193 size_t sig_alg_list_size;
mbedAustin 11:cada08fc8a70 194 const unsigned char *p;
mbedAustin 11:cada08fc8a70 195 const unsigned char *end = buf + len;
mbedAustin 11:cada08fc8a70 196 const int *md_cur;
mbedAustin 11:cada08fc8a70 197
mbedAustin 11:cada08fc8a70 198
mbedAustin 11:cada08fc8a70 199 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
mbedAustin 11:cada08fc8a70 200 if( sig_alg_list_size + 2 != len ||
mbedAustin 11:cada08fc8a70 201 sig_alg_list_size % 2 != 0 )
mbedAustin 11:cada08fc8a70 202 {
mbedAustin 11:cada08fc8a70 203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 204 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 205 }
mbedAustin 11:cada08fc8a70 206
mbedAustin 11:cada08fc8a70 207 /*
mbedAustin 11:cada08fc8a70 208 * For now, ignore the SignatureAlgorithm part and rely on offered
mbedAustin 11:cada08fc8a70 209 * ciphersuites only for that part. To be fixed later.
mbedAustin 11:cada08fc8a70 210 *
mbedAustin 11:cada08fc8a70 211 * So, just look at the HashAlgorithm part.
mbedAustin 11:cada08fc8a70 212 */
mbedAustin 11:cada08fc8a70 213 for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
mbedAustin 11:cada08fc8a70 214 for( p = buf + 2; p < end; p += 2 ) {
mbedAustin 11:cada08fc8a70 215 if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
mbedAustin 11:cada08fc8a70 216 ssl->handshake->sig_alg = p[0];
mbedAustin 11:cada08fc8a70 217 goto have_sig_alg;
mbedAustin 11:cada08fc8a70 218 }
mbedAustin 11:cada08fc8a70 219 }
mbedAustin 11:cada08fc8a70 220 }
mbedAustin 11:cada08fc8a70 221
mbedAustin 11:cada08fc8a70 222 /* Some key echanges do not need signatures at all */
mbedAustin 11:cada08fc8a70 223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
mbedAustin 11:cada08fc8a70 224 return( 0 );
mbedAustin 11:cada08fc8a70 225
mbedAustin 11:cada08fc8a70 226 have_sig_alg:
mbedAustin 11:cada08fc8a70 227 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
mbedAustin 11:cada08fc8a70 228 ssl->handshake->sig_alg ) );
mbedAustin 11:cada08fc8a70 229
mbedAustin 11:cada08fc8a70 230 return( 0 );
mbedAustin 11:cada08fc8a70 231 }
mbedAustin 11:cada08fc8a70 232 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
mbedAustin 11:cada08fc8a70 233 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
mbedAustin 11:cada08fc8a70 234
mbedAustin 11:cada08fc8a70 235 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
mbedAustin 11:cada08fc8a70 236 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 237 static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 238 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 239 size_t len )
mbedAustin 11:cada08fc8a70 240 {
mbedAustin 11:cada08fc8a70 241 size_t list_size, our_size;
mbedAustin 11:cada08fc8a70 242 const unsigned char *p;
mbedAustin 11:cada08fc8a70 243 const mbedtls_ecp_curve_info *curve_info, **curves;
mbedAustin 11:cada08fc8a70 244
mbedAustin 11:cada08fc8a70 245 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
mbedAustin 11:cada08fc8a70 246 if( list_size + 2 != len ||
mbedAustin 11:cada08fc8a70 247 list_size % 2 != 0 )
mbedAustin 11:cada08fc8a70 248 {
mbedAustin 11:cada08fc8a70 249 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 250 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 251 }
mbedAustin 11:cada08fc8a70 252
mbedAustin 11:cada08fc8a70 253 /* Should never happen unless client duplicates the extension */
mbedAustin 11:cada08fc8a70 254 if( ssl->handshake->curves != NULL )
mbedAustin 11:cada08fc8a70 255 {
mbedAustin 11:cada08fc8a70 256 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 257 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 258 }
mbedAustin 11:cada08fc8a70 259
mbedAustin 11:cada08fc8a70 260 /* Don't allow our peer to make us allocate too much memory,
mbedAustin 11:cada08fc8a70 261 * and leave room for a final 0 */
mbedAustin 11:cada08fc8a70 262 our_size = list_size / 2 + 1;
mbedAustin 11:cada08fc8a70 263 if( our_size > MBEDTLS_ECP_DP_MAX )
mbedAustin 11:cada08fc8a70 264 our_size = MBEDTLS_ECP_DP_MAX;
mbedAustin 11:cada08fc8a70 265
mbedAustin 11:cada08fc8a70 266 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
mbedAustin 11:cada08fc8a70 267 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
mbedAustin 11:cada08fc8a70 268
mbedAustin 11:cada08fc8a70 269 ssl->handshake->curves = curves;
mbedAustin 11:cada08fc8a70 270
mbedAustin 11:cada08fc8a70 271 p = buf + 2;
mbedAustin 11:cada08fc8a70 272 while( list_size > 0 && our_size > 1 )
mbedAustin 11:cada08fc8a70 273 {
mbedAustin 11:cada08fc8a70 274 curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
mbedAustin 11:cada08fc8a70 275
mbedAustin 11:cada08fc8a70 276 if( curve_info != NULL )
mbedAustin 11:cada08fc8a70 277 {
mbedAustin 11:cada08fc8a70 278 *curves++ = curve_info;
mbedAustin 11:cada08fc8a70 279 our_size--;
mbedAustin 11:cada08fc8a70 280 }
mbedAustin 11:cada08fc8a70 281
mbedAustin 11:cada08fc8a70 282 list_size -= 2;
mbedAustin 11:cada08fc8a70 283 p += 2;
mbedAustin 11:cada08fc8a70 284 }
mbedAustin 11:cada08fc8a70 285
mbedAustin 11:cada08fc8a70 286 return( 0 );
mbedAustin 11:cada08fc8a70 287 }
mbedAustin 11:cada08fc8a70 288
mbedAustin 11:cada08fc8a70 289 static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 290 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 291 size_t len )
mbedAustin 11:cada08fc8a70 292 {
mbedAustin 11:cada08fc8a70 293 size_t list_size;
mbedAustin 11:cada08fc8a70 294 const unsigned char *p;
mbedAustin 11:cada08fc8a70 295
mbedAustin 11:cada08fc8a70 296 list_size = buf[0];
mbedAustin 11:cada08fc8a70 297 if( list_size + 1 != len )
mbedAustin 11:cada08fc8a70 298 {
mbedAustin 11:cada08fc8a70 299 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 300 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 301 }
mbedAustin 11:cada08fc8a70 302
mbedAustin 11:cada08fc8a70 303 p = buf + 1;
mbedAustin 11:cada08fc8a70 304 while( list_size > 0 )
mbedAustin 11:cada08fc8a70 305 {
mbedAustin 11:cada08fc8a70 306 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
mbedAustin 11:cada08fc8a70 307 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
mbedAustin 11:cada08fc8a70 308 {
mbedAustin 11:cada08fc8a70 309 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
mbedAustin 11:cada08fc8a70 310 ssl->handshake->ecdh_ctx.point_format = p[0];
mbedAustin 11:cada08fc8a70 311 #endif
mbedAustin 11:cada08fc8a70 312 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 313 ssl->handshake->ecjpake_ctx.point_format = p[0];
mbedAustin 11:cada08fc8a70 314 #endif
mbedAustin 11:cada08fc8a70 315 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
mbedAustin 11:cada08fc8a70 316 return( 0 );
mbedAustin 11:cada08fc8a70 317 }
mbedAustin 11:cada08fc8a70 318
mbedAustin 11:cada08fc8a70 319 list_size--;
mbedAustin 11:cada08fc8a70 320 p++;
mbedAustin 11:cada08fc8a70 321 }
mbedAustin 11:cada08fc8a70 322
mbedAustin 11:cada08fc8a70 323 return( 0 );
mbedAustin 11:cada08fc8a70 324 }
mbedAustin 11:cada08fc8a70 325 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
mbedAustin 11:cada08fc8a70 326 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 327
mbedAustin 11:cada08fc8a70 328 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 329 static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 330 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 331 size_t len )
mbedAustin 11:cada08fc8a70 332 {
mbedAustin 11:cada08fc8a70 333 int ret;
mbedAustin 11:cada08fc8a70 334
mbedAustin 11:cada08fc8a70 335 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
mbedAustin 11:cada08fc8a70 336 {
mbedAustin 11:cada08fc8a70 337 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
mbedAustin 11:cada08fc8a70 338 return( 0 );
mbedAustin 11:cada08fc8a70 339 }
mbedAustin 11:cada08fc8a70 340
mbedAustin 11:cada08fc8a70 341 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
mbedAustin 11:cada08fc8a70 342 buf, len ) ) != 0 )
mbedAustin 11:cada08fc8a70 343 {
mbedAustin 11:cada08fc8a70 344 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
mbedAustin 11:cada08fc8a70 345 return( ret );
mbedAustin 11:cada08fc8a70 346 }
mbedAustin 11:cada08fc8a70 347
mbedAustin 11:cada08fc8a70 348 /* Only mark the extension as OK when we're sure it is */
mbedAustin 11:cada08fc8a70 349 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
mbedAustin 11:cada08fc8a70 350
mbedAustin 11:cada08fc8a70 351 return( 0 );
mbedAustin 11:cada08fc8a70 352 }
mbedAustin 11:cada08fc8a70 353 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 354
mbedAustin 11:cada08fc8a70 355 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedAustin 11:cada08fc8a70 356 static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 357 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 358 size_t len )
mbedAustin 11:cada08fc8a70 359 {
mbedAustin 11:cada08fc8a70 360 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
mbedAustin 11:cada08fc8a70 361 {
mbedAustin 11:cada08fc8a70 362 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 363 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 364 }
mbedAustin 11:cada08fc8a70 365
mbedAustin 11:cada08fc8a70 366 ssl->session_negotiate->mfl_code = buf[0];
mbedAustin 11:cada08fc8a70 367
mbedAustin 11:cada08fc8a70 368 return( 0 );
mbedAustin 11:cada08fc8a70 369 }
mbedAustin 11:cada08fc8a70 370 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
mbedAustin 11:cada08fc8a70 371
mbedAustin 11:cada08fc8a70 372 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
mbedAustin 11:cada08fc8a70 373 static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 374 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 375 size_t len )
mbedAustin 11:cada08fc8a70 376 {
mbedAustin 11:cada08fc8a70 377 if( len != 0 )
mbedAustin 11:cada08fc8a70 378 {
mbedAustin 11:cada08fc8a70 379 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 380 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 381 }
mbedAustin 11:cada08fc8a70 382
mbedAustin 11:cada08fc8a70 383 ((void) buf);
mbedAustin 11:cada08fc8a70 384
mbedAustin 11:cada08fc8a70 385 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
mbedAustin 11:cada08fc8a70 386 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
mbedAustin 11:cada08fc8a70 387
mbedAustin 11:cada08fc8a70 388 return( 0 );
mbedAustin 11:cada08fc8a70 389 }
mbedAustin 11:cada08fc8a70 390 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
mbedAustin 11:cada08fc8a70 391
mbedAustin 11:cada08fc8a70 392 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedAustin 11:cada08fc8a70 393 static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 394 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 395 size_t len )
mbedAustin 11:cada08fc8a70 396 {
mbedAustin 11:cada08fc8a70 397 if( len != 0 )
mbedAustin 11:cada08fc8a70 398 {
mbedAustin 11:cada08fc8a70 399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 400 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 401 }
mbedAustin 11:cada08fc8a70 402
mbedAustin 11:cada08fc8a70 403 ((void) buf);
mbedAustin 11:cada08fc8a70 404
mbedAustin 11:cada08fc8a70 405 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
mbedAustin 11:cada08fc8a70 406 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
mbedAustin 11:cada08fc8a70 407 {
mbedAustin 11:cada08fc8a70 408 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
mbedAustin 11:cada08fc8a70 409 }
mbedAustin 11:cada08fc8a70 410
mbedAustin 11:cada08fc8a70 411 return( 0 );
mbedAustin 11:cada08fc8a70 412 }
mbedAustin 11:cada08fc8a70 413 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
mbedAustin 11:cada08fc8a70 414
mbedAustin 11:cada08fc8a70 415 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedAustin 11:cada08fc8a70 416 static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 417 const unsigned char *buf,
mbedAustin 11:cada08fc8a70 418 size_t len )
mbedAustin 11:cada08fc8a70 419 {
mbedAustin 11:cada08fc8a70 420 if( len != 0 )
mbedAustin 11:cada08fc8a70 421 {
mbedAustin 11:cada08fc8a70 422 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 423 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 424 }
mbedAustin 11:cada08fc8a70 425
mbedAustin 11:cada08fc8a70 426 ((void) buf);
mbedAustin 11:cada08fc8a70 427
mbedAustin 11:cada08fc8a70 428 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
mbedAustin 11:cada08fc8a70 429 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
mbedAustin 11:cada08fc8a70 430 {
mbedAustin 11:cada08fc8a70 431 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
mbedAustin 11:cada08fc8a70 432 }
mbedAustin 11:cada08fc8a70 433
mbedAustin 11:cada08fc8a70 434 return( 0 );
mbedAustin 11:cada08fc8a70 435 }
mbedAustin 11:cada08fc8a70 436 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
mbedAustin 11:cada08fc8a70 437
mbedAustin 11:cada08fc8a70 438 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 439 static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 440 unsigned char *buf,
mbedAustin 11:cada08fc8a70 441 size_t len )
mbedAustin 11:cada08fc8a70 442 {
mbedAustin 11:cada08fc8a70 443 int ret;
mbedAustin 11:cada08fc8a70 444 mbedtls_ssl_session session;
mbedAustin 11:cada08fc8a70 445
mbedAustin 11:cada08fc8a70 446 mbedtls_ssl_session_init( &session );
mbedAustin 11:cada08fc8a70 447
mbedAustin 11:cada08fc8a70 448 if( ssl->conf->f_ticket_parse == NULL ||
mbedAustin 11:cada08fc8a70 449 ssl->conf->f_ticket_write == NULL )
mbedAustin 11:cada08fc8a70 450 {
mbedAustin 11:cada08fc8a70 451 return( 0 );
mbedAustin 11:cada08fc8a70 452 }
mbedAustin 11:cada08fc8a70 453
mbedAustin 11:cada08fc8a70 454 /* Remember the client asked us to send a new ticket */
mbedAustin 11:cada08fc8a70 455 ssl->handshake->new_session_ticket = 1;
mbedAustin 11:cada08fc8a70 456
mbedAustin 11:cada08fc8a70 457 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
mbedAustin 11:cada08fc8a70 458
mbedAustin 11:cada08fc8a70 459 if( len == 0 )
mbedAustin 11:cada08fc8a70 460 return( 0 );
mbedAustin 11:cada08fc8a70 461
mbedAustin 11:cada08fc8a70 462 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 463 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
mbedAustin 11:cada08fc8a70 464 {
mbedAustin 11:cada08fc8a70 465 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
mbedAustin 11:cada08fc8a70 466 return( 0 );
mbedAustin 11:cada08fc8a70 467 }
mbedAustin 11:cada08fc8a70 468 #endif /* MBEDTLS_SSL_RENEGOTIATION */
mbedAustin 11:cada08fc8a70 469
mbedAustin 11:cada08fc8a70 470 /*
mbedAustin 11:cada08fc8a70 471 * Failures are ok: just ignore the ticket and proceed.
mbedAustin 11:cada08fc8a70 472 */
mbedAustin 11:cada08fc8a70 473 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
mbedAustin 11:cada08fc8a70 474 buf, len ) ) != 0 )
mbedAustin 11:cada08fc8a70 475 {
mbedAustin 11:cada08fc8a70 476 mbedtls_ssl_session_free( &session );
mbedAustin 11:cada08fc8a70 477
mbedAustin 11:cada08fc8a70 478 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
mbedAustin 11:cada08fc8a70 479 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
mbedAustin 11:cada08fc8a70 480 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
mbedAustin 11:cada08fc8a70 481 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
mbedAustin 11:cada08fc8a70 482 else
mbedAustin 11:cada08fc8a70 483 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
mbedAustin 11:cada08fc8a70 484
mbedAustin 11:cada08fc8a70 485 return( 0 );
mbedAustin 11:cada08fc8a70 486 }
mbedAustin 11:cada08fc8a70 487
mbedAustin 11:cada08fc8a70 488 /*
mbedAustin 11:cada08fc8a70 489 * Keep the session ID sent by the client, since we MUST send it back to
mbedAustin 11:cada08fc8a70 490 * inform them we're accepting the ticket (RFC 5077 section 3.4)
mbedAustin 11:cada08fc8a70 491 */
mbedAustin 11:cada08fc8a70 492 session.id_len = ssl->session_negotiate->id_len;
mbedAustin 11:cada08fc8a70 493 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
mbedAustin 11:cada08fc8a70 494
mbedAustin 11:cada08fc8a70 495 mbedtls_ssl_session_free( ssl->session_negotiate );
mbedAustin 11:cada08fc8a70 496 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
mbedAustin 11:cada08fc8a70 497
mbedAustin 11:cada08fc8a70 498 /* Zeroize instead of free as we copied the content */
mbedAustin 11:cada08fc8a70 499 mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
mbedAustin 11:cada08fc8a70 500
mbedAustin 11:cada08fc8a70 501 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
mbedAustin 11:cada08fc8a70 502
mbedAustin 11:cada08fc8a70 503 ssl->handshake->resume = 1;
mbedAustin 11:cada08fc8a70 504
mbedAustin 11:cada08fc8a70 505 /* Don't send a new ticket after all, this one is OK */
mbedAustin 11:cada08fc8a70 506 ssl->handshake->new_session_ticket = 0;
mbedAustin 11:cada08fc8a70 507
mbedAustin 11:cada08fc8a70 508 return( 0 );
mbedAustin 11:cada08fc8a70 509 }
mbedAustin 11:cada08fc8a70 510 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
mbedAustin 11:cada08fc8a70 511
mbedAustin 11:cada08fc8a70 512 #if defined(MBEDTLS_SSL_ALPN)
mbedAustin 11:cada08fc8a70 513 static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 514 const unsigned char *buf, size_t len )
mbedAustin 11:cada08fc8a70 515 {
mbedAustin 11:cada08fc8a70 516 size_t list_len, cur_len, ours_len;
mbedAustin 11:cada08fc8a70 517 const unsigned char *theirs, *start, *end;
mbedAustin 11:cada08fc8a70 518 const char **ours;
mbedAustin 11:cada08fc8a70 519
mbedAustin 11:cada08fc8a70 520 /* If ALPN not configured, just ignore the extension */
mbedAustin 11:cada08fc8a70 521 if( ssl->conf->alpn_list == NULL )
mbedAustin 11:cada08fc8a70 522 return( 0 );
mbedAustin 11:cada08fc8a70 523
mbedAustin 11:cada08fc8a70 524 /*
mbedAustin 11:cada08fc8a70 525 * opaque ProtocolName<1..2^8-1>;
mbedAustin 11:cada08fc8a70 526 *
mbedAustin 11:cada08fc8a70 527 * struct {
mbedAustin 11:cada08fc8a70 528 * ProtocolName protocol_name_list<2..2^16-1>
mbedAustin 11:cada08fc8a70 529 * } ProtocolNameList;
mbedAustin 11:cada08fc8a70 530 */
mbedAustin 11:cada08fc8a70 531
mbedAustin 11:cada08fc8a70 532 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
mbedAustin 11:cada08fc8a70 533 if( len < 4 )
mbedAustin 11:cada08fc8a70 534 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 535
mbedAustin 11:cada08fc8a70 536 list_len = ( buf[0] << 8 ) | buf[1];
mbedAustin 11:cada08fc8a70 537 if( list_len != len - 2 )
mbedAustin 11:cada08fc8a70 538 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 539
mbedAustin 11:cada08fc8a70 540 /*
mbedAustin 11:cada08fc8a70 541 * Use our order of preference
mbedAustin 11:cada08fc8a70 542 */
mbedAustin 11:cada08fc8a70 543 start = buf + 2;
mbedAustin 11:cada08fc8a70 544 end = buf + len;
mbedAustin 11:cada08fc8a70 545 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
mbedAustin 11:cada08fc8a70 546 {
mbedAustin 11:cada08fc8a70 547 ours_len = strlen( *ours );
mbedAustin 11:cada08fc8a70 548 for( theirs = start; theirs != end; theirs += cur_len )
mbedAustin 11:cada08fc8a70 549 {
mbedAustin 11:cada08fc8a70 550 /* If the list is well formed, we should get equality first */
mbedAustin 11:cada08fc8a70 551 if( theirs > end )
mbedAustin 11:cada08fc8a70 552 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 553
mbedAustin 11:cada08fc8a70 554 cur_len = *theirs++;
mbedAustin 11:cada08fc8a70 555
mbedAustin 11:cada08fc8a70 556 /* Empty strings MUST NOT be included */
mbedAustin 11:cada08fc8a70 557 if( cur_len == 0 )
mbedAustin 11:cada08fc8a70 558 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 559
mbedAustin 11:cada08fc8a70 560 if( cur_len == ours_len &&
mbedAustin 11:cada08fc8a70 561 memcmp( theirs, *ours, cur_len ) == 0 )
mbedAustin 11:cada08fc8a70 562 {
mbedAustin 11:cada08fc8a70 563 ssl->alpn_chosen = *ours;
mbedAustin 11:cada08fc8a70 564 return( 0 );
mbedAustin 11:cada08fc8a70 565 }
mbedAustin 11:cada08fc8a70 566 }
mbedAustin 11:cada08fc8a70 567 }
mbedAustin 11:cada08fc8a70 568
mbedAustin 11:cada08fc8a70 569 /* If we get there, no match was found */
mbedAustin 11:cada08fc8a70 570 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 571 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
mbedAustin 11:cada08fc8a70 572 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 573 }
mbedAustin 11:cada08fc8a70 574 #endif /* MBEDTLS_SSL_ALPN */
mbedAustin 11:cada08fc8a70 575
mbedAustin 11:cada08fc8a70 576 /*
mbedAustin 11:cada08fc8a70 577 * Auxiliary functions for ServerHello parsing and related actions
mbedAustin 11:cada08fc8a70 578 */
mbedAustin 11:cada08fc8a70 579
mbedAustin 11:cada08fc8a70 580 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedAustin 11:cada08fc8a70 581 /*
mbedAustin 11:cada08fc8a70 582 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
mbedAustin 11:cada08fc8a70 583 */
mbedAustin 11:cada08fc8a70 584 #if defined(MBEDTLS_ECDSA_C)
mbedAustin 11:cada08fc8a70 585 static int ssl_check_key_curve( mbedtls_pk_context *pk,
mbedAustin 11:cada08fc8a70 586 const mbedtls_ecp_curve_info **curves )
mbedAustin 11:cada08fc8a70 587 {
mbedAustin 11:cada08fc8a70 588 const mbedtls_ecp_curve_info **crv = curves;
mbedAustin 11:cada08fc8a70 589 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
mbedAustin 11:cada08fc8a70 590
mbedAustin 11:cada08fc8a70 591 while( *crv != NULL )
mbedAustin 11:cada08fc8a70 592 {
mbedAustin 11:cada08fc8a70 593 if( (*crv)->grp_id == grp_id )
mbedAustin 11:cada08fc8a70 594 return( 0 );
mbedAustin 11:cada08fc8a70 595 crv++;
mbedAustin 11:cada08fc8a70 596 }
mbedAustin 11:cada08fc8a70 597
mbedAustin 11:cada08fc8a70 598 return( -1 );
mbedAustin 11:cada08fc8a70 599 }
mbedAustin 11:cada08fc8a70 600 #endif /* MBEDTLS_ECDSA_C */
mbedAustin 11:cada08fc8a70 601
mbedAustin 11:cada08fc8a70 602 /*
mbedAustin 11:cada08fc8a70 603 * Try picking a certificate for this ciphersuite,
mbedAustin 11:cada08fc8a70 604 * return 0 on success and -1 on failure.
mbedAustin 11:cada08fc8a70 605 */
mbedAustin 11:cada08fc8a70 606 static int ssl_pick_cert( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 607 const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
mbedAustin 11:cada08fc8a70 608 {
mbedAustin 11:cada08fc8a70 609 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
mbedAustin 11:cada08fc8a70 610 mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
mbedAustin 11:cada08fc8a70 611 uint32_t flags;
mbedAustin 11:cada08fc8a70 612
mbedAustin 11:cada08fc8a70 613 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedAustin 11:cada08fc8a70 614 if( ssl->handshake->sni_key_cert != NULL )
mbedAustin 11:cada08fc8a70 615 list = ssl->handshake->sni_key_cert;
mbedAustin 11:cada08fc8a70 616 else
mbedAustin 11:cada08fc8a70 617 #endif
mbedAustin 11:cada08fc8a70 618 list = ssl->conf->key_cert;
mbedAustin 11:cada08fc8a70 619
mbedAustin 11:cada08fc8a70 620 if( pk_alg == MBEDTLS_PK_NONE )
mbedAustin 11:cada08fc8a70 621 return( 0 );
mbedAustin 11:cada08fc8a70 622
mbedAustin 11:cada08fc8a70 623 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
mbedAustin 11:cada08fc8a70 624
mbedAustin 11:cada08fc8a70 625 if( list == NULL )
mbedAustin 11:cada08fc8a70 626 {
mbedAustin 11:cada08fc8a70 627 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
mbedAustin 11:cada08fc8a70 628 return( -1 );
mbedAustin 11:cada08fc8a70 629 }
mbedAustin 11:cada08fc8a70 630
mbedAustin 11:cada08fc8a70 631 for( cur = list; cur != NULL; cur = cur->next )
mbedAustin 11:cada08fc8a70 632 {
mbedAustin 11:cada08fc8a70 633 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
mbedAustin 11:cada08fc8a70 634 cur->cert );
mbedAustin 11:cada08fc8a70 635
mbedAustin 11:cada08fc8a70 636 if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
mbedAustin 11:cada08fc8a70 637 {
mbedAustin 11:cada08fc8a70 638 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
mbedAustin 11:cada08fc8a70 639 continue;
mbedAustin 11:cada08fc8a70 640 }
mbedAustin 11:cada08fc8a70 641
mbedAustin 11:cada08fc8a70 642 /*
mbedAustin 11:cada08fc8a70 643 * This avoids sending the client a cert it'll reject based on
mbedAustin 11:cada08fc8a70 644 * keyUsage or other extensions.
mbedAustin 11:cada08fc8a70 645 *
mbedAustin 11:cada08fc8a70 646 * It also allows the user to provision different certificates for
mbedAustin 11:cada08fc8a70 647 * different uses based on keyUsage, eg if they want to avoid signing
mbedAustin 11:cada08fc8a70 648 * and decrypting with the same RSA key.
mbedAustin 11:cada08fc8a70 649 */
mbedAustin 11:cada08fc8a70 650 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
mbedAustin 11:cada08fc8a70 651 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
mbedAustin 11:cada08fc8a70 652 {
mbedAustin 11:cada08fc8a70 653 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
mbedAustin 11:cada08fc8a70 654 "(extended) key usage extension" ) );
mbedAustin 11:cada08fc8a70 655 continue;
mbedAustin 11:cada08fc8a70 656 }
mbedAustin 11:cada08fc8a70 657
mbedAustin 11:cada08fc8a70 658 #if defined(MBEDTLS_ECDSA_C)
mbedAustin 11:cada08fc8a70 659 if( pk_alg == MBEDTLS_PK_ECDSA &&
mbedAustin 11:cada08fc8a70 660 ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
mbedAustin 11:cada08fc8a70 661 {
mbedAustin 11:cada08fc8a70 662 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
mbedAustin 11:cada08fc8a70 663 continue;
mbedAustin 11:cada08fc8a70 664 }
mbedAustin 11:cada08fc8a70 665 #endif
mbedAustin 11:cada08fc8a70 666
mbedAustin 11:cada08fc8a70 667 /*
mbedAustin 11:cada08fc8a70 668 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
mbedAustin 11:cada08fc8a70 669 * present them a SHA-higher cert rather than failing if it's the only
mbedAustin 11:cada08fc8a70 670 * one we got that satisfies the other conditions.
mbedAustin 11:cada08fc8a70 671 */
mbedAustin 11:cada08fc8a70 672 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
mbedAustin 11:cada08fc8a70 673 cur->cert->sig_md != MBEDTLS_MD_SHA1 )
mbedAustin 11:cada08fc8a70 674 {
mbedAustin 11:cada08fc8a70 675 if( fallback == NULL )
mbedAustin 11:cada08fc8a70 676 fallback = cur;
mbedAustin 11:cada08fc8a70 677 {
mbedAustin 11:cada08fc8a70 678 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
mbedAustin 11:cada08fc8a70 679 "sha-2 with pre-TLS 1.2 client" ) );
mbedAustin 11:cada08fc8a70 680 continue;
mbedAustin 11:cada08fc8a70 681 }
mbedAustin 11:cada08fc8a70 682 }
mbedAustin 11:cada08fc8a70 683
mbedAustin 11:cada08fc8a70 684 /* If we get there, we got a winner */
mbedAustin 11:cada08fc8a70 685 break;
mbedAustin 11:cada08fc8a70 686 }
mbedAustin 11:cada08fc8a70 687
mbedAustin 11:cada08fc8a70 688 if( cur == NULL )
mbedAustin 11:cada08fc8a70 689 cur = fallback;
mbedAustin 11:cada08fc8a70 690
mbedAustin 11:cada08fc8a70 691 /* Do not update ssl->handshake->key_cert unless there is a match */
mbedAustin 11:cada08fc8a70 692 if( cur != NULL )
mbedAustin 11:cada08fc8a70 693 {
mbedAustin 11:cada08fc8a70 694 ssl->handshake->key_cert = cur;
mbedAustin 11:cada08fc8a70 695 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
mbedAustin 11:cada08fc8a70 696 ssl->handshake->key_cert->cert );
mbedAustin 11:cada08fc8a70 697 return( 0 );
mbedAustin 11:cada08fc8a70 698 }
mbedAustin 11:cada08fc8a70 699
mbedAustin 11:cada08fc8a70 700 return( -1 );
mbedAustin 11:cada08fc8a70 701 }
mbedAustin 11:cada08fc8a70 702 #endif /* MBEDTLS_X509_CRT_PARSE_C */
mbedAustin 11:cada08fc8a70 703
mbedAustin 11:cada08fc8a70 704 /*
mbedAustin 11:cada08fc8a70 705 * Check if a given ciphersuite is suitable for use with our config/keys/etc
mbedAustin 11:cada08fc8a70 706 * Sets ciphersuite_info only if the suite matches.
mbedAustin 11:cada08fc8a70 707 */
mbedAustin 11:cada08fc8a70 708 static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
mbedAustin 11:cada08fc8a70 709 const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
mbedAustin 11:cada08fc8a70 710 {
mbedAustin 11:cada08fc8a70 711 const mbedtls_ssl_ciphersuite_t *suite_info;
mbedAustin 11:cada08fc8a70 712
mbedAustin 11:cada08fc8a70 713 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
mbedAustin 11:cada08fc8a70 714 if( suite_info == NULL )
mbedAustin 11:cada08fc8a70 715 {
mbedAustin 11:cada08fc8a70 716 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 717 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 718 }
mbedAustin 11:cada08fc8a70 719
mbedAustin 11:cada08fc8a70 720 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
mbedAustin 11:cada08fc8a70 721
mbedAustin 11:cada08fc8a70 722 if( suite_info->min_minor_ver > ssl->minor_ver ||
mbedAustin 11:cada08fc8a70 723 suite_info->max_minor_ver < ssl->minor_ver )
mbedAustin 11:cada08fc8a70 724 {
mbedAustin 11:cada08fc8a70 725 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
mbedAustin 11:cada08fc8a70 726 return( 0 );
mbedAustin 11:cada08fc8a70 727 }
mbedAustin 11:cada08fc8a70 728
mbedAustin 11:cada08fc8a70 729 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 730 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
mbedAustin 11:cada08fc8a70 731 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
mbedAustin 11:cada08fc8a70 732 return( 0 );
mbedAustin 11:cada08fc8a70 733 #endif
mbedAustin 11:cada08fc8a70 734
mbedAustin 11:cada08fc8a70 735 #if defined(MBEDTLS_ARC4_C)
mbedAustin 11:cada08fc8a70 736 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
mbedAustin 11:cada08fc8a70 737 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
mbedAustin 11:cada08fc8a70 738 {
mbedAustin 11:cada08fc8a70 739 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
mbedAustin 11:cada08fc8a70 740 return( 0 );
mbedAustin 11:cada08fc8a70 741 }
mbedAustin 11:cada08fc8a70 742 #endif
mbedAustin 11:cada08fc8a70 743
mbedAustin 11:cada08fc8a70 744 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 745 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
mbedAustin 11:cada08fc8a70 746 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
mbedAustin 11:cada08fc8a70 747 {
mbedAustin 11:cada08fc8a70 748 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
mbedAustin 11:cada08fc8a70 749 "not configured or ext missing" ) );
mbedAustin 11:cada08fc8a70 750 return( 0 );
mbedAustin 11:cada08fc8a70 751 }
mbedAustin 11:cada08fc8a70 752 #endif
mbedAustin 11:cada08fc8a70 753
mbedAustin 11:cada08fc8a70 754
mbedAustin 11:cada08fc8a70 755 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
mbedAustin 11:cada08fc8a70 756 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
mbedAustin 11:cada08fc8a70 757 ( ssl->handshake->curves == NULL ||
mbedAustin 11:cada08fc8a70 758 ssl->handshake->curves[0] == NULL ) )
mbedAustin 11:cada08fc8a70 759 {
mbedAustin 11:cada08fc8a70 760 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
mbedAustin 11:cada08fc8a70 761 "no common elliptic curve" ) );
mbedAustin 11:cada08fc8a70 762 return( 0 );
mbedAustin 11:cada08fc8a70 763 }
mbedAustin 11:cada08fc8a70 764 #endif
mbedAustin 11:cada08fc8a70 765
mbedAustin 11:cada08fc8a70 766 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
mbedAustin 11:cada08fc8a70 767 /* If the ciphersuite requires a pre-shared key and we don't
mbedAustin 11:cada08fc8a70 768 * have one, skip it now rather than failing later */
mbedAustin 11:cada08fc8a70 769 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
mbedAustin 11:cada08fc8a70 770 ssl->conf->f_psk == NULL &&
mbedAustin 11:cada08fc8a70 771 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
mbedAustin 11:cada08fc8a70 772 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
mbedAustin 11:cada08fc8a70 773 {
mbedAustin 11:cada08fc8a70 774 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
mbedAustin 11:cada08fc8a70 775 return( 0 );
mbedAustin 11:cada08fc8a70 776 }
mbedAustin 11:cada08fc8a70 777 #endif
mbedAustin 11:cada08fc8a70 778
mbedAustin 11:cada08fc8a70 779 #if defined(MBEDTLS_X509_CRT_PARSE_C)
mbedAustin 11:cada08fc8a70 780 /*
mbedAustin 11:cada08fc8a70 781 * Final check: if ciphersuite requires us to have a
mbedAustin 11:cada08fc8a70 782 * certificate/key of a particular type:
mbedAustin 11:cada08fc8a70 783 * - select the appropriate certificate if we have one, or
mbedAustin 11:cada08fc8a70 784 * - try the next ciphersuite if we don't
mbedAustin 11:cada08fc8a70 785 * This must be done last since we modify the key_cert list.
mbedAustin 11:cada08fc8a70 786 */
mbedAustin 11:cada08fc8a70 787 if( ssl_pick_cert( ssl, suite_info ) != 0 )
mbedAustin 11:cada08fc8a70 788 {
mbedAustin 11:cada08fc8a70 789 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
mbedAustin 11:cada08fc8a70 790 "no suitable certificate" ) );
mbedAustin 11:cada08fc8a70 791 return( 0 );
mbedAustin 11:cada08fc8a70 792 }
mbedAustin 11:cada08fc8a70 793 #endif
mbedAustin 11:cada08fc8a70 794
mbedAustin 11:cada08fc8a70 795 *ciphersuite_info = suite_info;
mbedAustin 11:cada08fc8a70 796 return( 0 );
mbedAustin 11:cada08fc8a70 797 }
mbedAustin 11:cada08fc8a70 798
mbedAustin 11:cada08fc8a70 799 #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
mbedAustin 11:cada08fc8a70 800 static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 801 {
mbedAustin 11:cada08fc8a70 802 int ret, got_common_suite;
mbedAustin 11:cada08fc8a70 803 unsigned int i, j;
mbedAustin 11:cada08fc8a70 804 size_t n;
mbedAustin 11:cada08fc8a70 805 unsigned int ciph_len, sess_len, chal_len;
mbedAustin 11:cada08fc8a70 806 unsigned char *buf, *p;
mbedAustin 11:cada08fc8a70 807 const int *ciphersuites;
mbedAustin 11:cada08fc8a70 808 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
mbedAustin 11:cada08fc8a70 809
mbedAustin 11:cada08fc8a70 810 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
mbedAustin 11:cada08fc8a70 811
mbedAustin 11:cada08fc8a70 812 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 813 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
mbedAustin 11:cada08fc8a70 814 {
mbedAustin 11:cada08fc8a70 815 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
mbedAustin 11:cada08fc8a70 816
mbedAustin 11:cada08fc8a70 817 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 818 return( ret );
mbedAustin 11:cada08fc8a70 819
mbedAustin 11:cada08fc8a70 820 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 821 }
mbedAustin 11:cada08fc8a70 822 #endif /* MBEDTLS_SSL_RENEGOTIATION */
mbedAustin 11:cada08fc8a70 823
mbedAustin 11:cada08fc8a70 824 buf = ssl->in_hdr;
mbedAustin 11:cada08fc8a70 825
mbedAustin 11:cada08fc8a70 826 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
mbedAustin 11:cada08fc8a70 827
mbedAustin 11:cada08fc8a70 828 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
mbedAustin 11:cada08fc8a70 829 buf[2] ) );
mbedAustin 11:cada08fc8a70 830 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
mbedAustin 11:cada08fc8a70 831 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
mbedAustin 11:cada08fc8a70 832 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
mbedAustin 11:cada08fc8a70 833 buf[3], buf[4] ) );
mbedAustin 11:cada08fc8a70 834
mbedAustin 11:cada08fc8a70 835 /*
mbedAustin 11:cada08fc8a70 836 * SSLv2 Client Hello
mbedAustin 11:cada08fc8a70 837 *
mbedAustin 11:cada08fc8a70 838 * Record layer:
mbedAustin 11:cada08fc8a70 839 * 0 . 1 message length
mbedAustin 11:cada08fc8a70 840 *
mbedAustin 11:cada08fc8a70 841 * SSL layer:
mbedAustin 11:cada08fc8a70 842 * 2 . 2 message type
mbedAustin 11:cada08fc8a70 843 * 3 . 4 protocol version
mbedAustin 11:cada08fc8a70 844 */
mbedAustin 11:cada08fc8a70 845 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
mbedAustin 11:cada08fc8a70 846 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 847 {
mbedAustin 11:cada08fc8a70 848 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 849 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 850 }
mbedAustin 11:cada08fc8a70 851
mbedAustin 11:cada08fc8a70 852 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
mbedAustin 11:cada08fc8a70 853
mbedAustin 11:cada08fc8a70 854 if( n < 17 || n > 512 )
mbedAustin 11:cada08fc8a70 855 {
mbedAustin 11:cada08fc8a70 856 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 857 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 858 }
mbedAustin 11:cada08fc8a70 859
mbedAustin 11:cada08fc8a70 860 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
mbedAustin 11:cada08fc8a70 861 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
mbedAustin 11:cada08fc8a70 862 ? buf[4] : ssl->conf->max_minor_ver;
mbedAustin 11:cada08fc8a70 863
mbedAustin 11:cada08fc8a70 864 if( ssl->minor_ver < ssl->conf->min_minor_ver )
mbedAustin 11:cada08fc8a70 865 {
mbedAustin 11:cada08fc8a70 866 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
mbedAustin 11:cada08fc8a70 867 " [%d:%d] < [%d:%d]",
mbedAustin 11:cada08fc8a70 868 ssl->major_ver, ssl->minor_ver,
mbedAustin 11:cada08fc8a70 869 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
mbedAustin 11:cada08fc8a70 870
mbedAustin 11:cada08fc8a70 871 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 872 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
mbedAustin 11:cada08fc8a70 873 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
mbedAustin 11:cada08fc8a70 874 }
mbedAustin 11:cada08fc8a70 875
mbedAustin 11:cada08fc8a70 876 ssl->handshake->max_major_ver = buf[3];
mbedAustin 11:cada08fc8a70 877 ssl->handshake->max_minor_ver = buf[4];
mbedAustin 11:cada08fc8a70 878
mbedAustin 11:cada08fc8a70 879 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
mbedAustin 11:cada08fc8a70 880 {
mbedAustin 11:cada08fc8a70 881 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
mbedAustin 11:cada08fc8a70 882 return( ret );
mbedAustin 11:cada08fc8a70 883 }
mbedAustin 11:cada08fc8a70 884
mbedAustin 11:cada08fc8a70 885 ssl->handshake->update_checksum( ssl, buf + 2, n );
mbedAustin 11:cada08fc8a70 886
mbedAustin 11:cada08fc8a70 887 buf = ssl->in_msg;
mbedAustin 11:cada08fc8a70 888 n = ssl->in_left - 5;
mbedAustin 11:cada08fc8a70 889
mbedAustin 11:cada08fc8a70 890 /*
mbedAustin 11:cada08fc8a70 891 * 0 . 1 ciphersuitelist length
mbedAustin 11:cada08fc8a70 892 * 2 . 3 session id length
mbedAustin 11:cada08fc8a70 893 * 4 . 5 challenge length
mbedAustin 11:cada08fc8a70 894 * 6 . .. ciphersuitelist
mbedAustin 11:cada08fc8a70 895 * .. . .. session id
mbedAustin 11:cada08fc8a70 896 * .. . .. challenge
mbedAustin 11:cada08fc8a70 897 */
mbedAustin 11:cada08fc8a70 898 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
mbedAustin 11:cada08fc8a70 899
mbedAustin 11:cada08fc8a70 900 ciph_len = ( buf[0] << 8 ) | buf[1];
mbedAustin 11:cada08fc8a70 901 sess_len = ( buf[2] << 8 ) | buf[3];
mbedAustin 11:cada08fc8a70 902 chal_len = ( buf[4] << 8 ) | buf[5];
mbedAustin 11:cada08fc8a70 903
mbedAustin 11:cada08fc8a70 904 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
mbedAustin 11:cada08fc8a70 905 ciph_len, sess_len, chal_len ) );
mbedAustin 11:cada08fc8a70 906
mbedAustin 11:cada08fc8a70 907 /*
mbedAustin 11:cada08fc8a70 908 * Make sure each parameter length is valid
mbedAustin 11:cada08fc8a70 909 */
mbedAustin 11:cada08fc8a70 910 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
mbedAustin 11:cada08fc8a70 911 {
mbedAustin 11:cada08fc8a70 912 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 913 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 914 }
mbedAustin 11:cada08fc8a70 915
mbedAustin 11:cada08fc8a70 916 if( sess_len > 32 )
mbedAustin 11:cada08fc8a70 917 {
mbedAustin 11:cada08fc8a70 918 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 919 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 920 }
mbedAustin 11:cada08fc8a70 921
mbedAustin 11:cada08fc8a70 922 if( chal_len < 8 || chal_len > 32 )
mbedAustin 11:cada08fc8a70 923 {
mbedAustin 11:cada08fc8a70 924 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 925 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 926 }
mbedAustin 11:cada08fc8a70 927
mbedAustin 11:cada08fc8a70 928 if( n != 6 + ciph_len + sess_len + chal_len )
mbedAustin 11:cada08fc8a70 929 {
mbedAustin 11:cada08fc8a70 930 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 931 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 932 }
mbedAustin 11:cada08fc8a70 933
mbedAustin 11:cada08fc8a70 934 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
mbedAustin 11:cada08fc8a70 935 buf + 6, ciph_len );
mbedAustin 11:cada08fc8a70 936 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
mbedAustin 11:cada08fc8a70 937 buf + 6 + ciph_len, sess_len );
mbedAustin 11:cada08fc8a70 938 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
mbedAustin 11:cada08fc8a70 939 buf + 6 + ciph_len + sess_len, chal_len );
mbedAustin 11:cada08fc8a70 940
mbedAustin 11:cada08fc8a70 941 p = buf + 6 + ciph_len;
mbedAustin 11:cada08fc8a70 942 ssl->session_negotiate->id_len = sess_len;
mbedAustin 11:cada08fc8a70 943 memset( ssl->session_negotiate->id, 0,
mbedAustin 11:cada08fc8a70 944 sizeof( ssl->session_negotiate->id ) );
mbedAustin 11:cada08fc8a70 945 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
mbedAustin 11:cada08fc8a70 946
mbedAustin 11:cada08fc8a70 947 p += sess_len;
mbedAustin 11:cada08fc8a70 948 memset( ssl->handshake->randbytes, 0, 64 );
mbedAustin 11:cada08fc8a70 949 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
mbedAustin 11:cada08fc8a70 950
mbedAustin 11:cada08fc8a70 951 /*
mbedAustin 11:cada08fc8a70 952 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
mbedAustin 11:cada08fc8a70 953 */
mbedAustin 11:cada08fc8a70 954 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
mbedAustin 11:cada08fc8a70 955 {
mbedAustin 11:cada08fc8a70 956 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
mbedAustin 11:cada08fc8a70 957 {
mbedAustin 11:cada08fc8a70 958 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
mbedAustin 11:cada08fc8a70 959 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 960 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
mbedAustin 11:cada08fc8a70 961 {
mbedAustin 11:cada08fc8a70 962 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
mbedAustin 11:cada08fc8a70 963 "during renegotiation" ) );
mbedAustin 11:cada08fc8a70 964
mbedAustin 11:cada08fc8a70 965 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 966 return( ret );
mbedAustin 11:cada08fc8a70 967
mbedAustin 11:cada08fc8a70 968 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 969 }
mbedAustin 11:cada08fc8a70 970 #endif /* MBEDTLS_SSL_RENEGOTIATION */
mbedAustin 11:cada08fc8a70 971 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
mbedAustin 11:cada08fc8a70 972 break;
mbedAustin 11:cada08fc8a70 973 }
mbedAustin 11:cada08fc8a70 974 }
mbedAustin 11:cada08fc8a70 975
mbedAustin 11:cada08fc8a70 976 #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
mbedAustin 11:cada08fc8a70 977 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
mbedAustin 11:cada08fc8a70 978 {
mbedAustin 11:cada08fc8a70 979 if( p[0] == 0 &&
mbedAustin 11:cada08fc8a70 980 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
mbedAustin 11:cada08fc8a70 981 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
mbedAustin 11:cada08fc8a70 982 {
mbedAustin 11:cada08fc8a70 983 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
mbedAustin 11:cada08fc8a70 984
mbedAustin 11:cada08fc8a70 985 if( ssl->minor_ver < ssl->conf->max_minor_ver )
mbedAustin 11:cada08fc8a70 986 {
mbedAustin 11:cada08fc8a70 987 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
mbedAustin 11:cada08fc8a70 988
mbedAustin 11:cada08fc8a70 989 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 990 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
mbedAustin 11:cada08fc8a70 991
mbedAustin 11:cada08fc8a70 992 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 993 }
mbedAustin 11:cada08fc8a70 994
mbedAustin 11:cada08fc8a70 995 break;
mbedAustin 11:cada08fc8a70 996 }
mbedAustin 11:cada08fc8a70 997 }
mbedAustin 11:cada08fc8a70 998 #endif /* MBEDTLS_SSL_FALLBACK_SCSV */
mbedAustin 11:cada08fc8a70 999
mbedAustin 11:cada08fc8a70 1000 got_common_suite = 0;
mbedAustin 11:cada08fc8a70 1001 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
mbedAustin 11:cada08fc8a70 1002 ciphersuite_info = NULL;
mbedAustin 11:cada08fc8a70 1003 #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
mbedAustin 11:cada08fc8a70 1004 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
mbedAustin 11:cada08fc8a70 1005 {
mbedAustin 11:cada08fc8a70 1006 for( i = 0; ciphersuites[i] != 0; i++ )
mbedAustin 11:cada08fc8a70 1007 #else
mbedAustin 11:cada08fc8a70 1008 for( i = 0; ciphersuites[i] != 0; i++ )
mbedAustin 11:cada08fc8a70 1009 {
mbedAustin 11:cada08fc8a70 1010 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
mbedAustin 11:cada08fc8a70 1011 #endif
mbedAustin 11:cada08fc8a70 1012 {
mbedAustin 11:cada08fc8a70 1013 if( p[0] != 0 ||
mbedAustin 11:cada08fc8a70 1014 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
mbedAustin 11:cada08fc8a70 1015 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
mbedAustin 11:cada08fc8a70 1016 continue;
mbedAustin 11:cada08fc8a70 1017
mbedAustin 11:cada08fc8a70 1018 got_common_suite = 1;
mbedAustin 11:cada08fc8a70 1019
mbedAustin 11:cada08fc8a70 1020 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
mbedAustin 11:cada08fc8a70 1021 &ciphersuite_info ) ) != 0 )
mbedAustin 11:cada08fc8a70 1022 return( ret );
mbedAustin 11:cada08fc8a70 1023
mbedAustin 11:cada08fc8a70 1024 if( ciphersuite_info != NULL )
mbedAustin 11:cada08fc8a70 1025 goto have_ciphersuite_v2;
mbedAustin 11:cada08fc8a70 1026 }
mbedAustin 11:cada08fc8a70 1027 }
mbedAustin 11:cada08fc8a70 1028
mbedAustin 11:cada08fc8a70 1029 if( got_common_suite )
mbedAustin 11:cada08fc8a70 1030 {
mbedAustin 11:cada08fc8a70 1031 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
mbedAustin 11:cada08fc8a70 1032 "but none of them usable" ) );
mbedAustin 11:cada08fc8a70 1033 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
mbedAustin 11:cada08fc8a70 1034 }
mbedAustin 11:cada08fc8a70 1035 else
mbedAustin 11:cada08fc8a70 1036 {
mbedAustin 11:cada08fc8a70 1037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
mbedAustin 11:cada08fc8a70 1038 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
mbedAustin 11:cada08fc8a70 1039 }
mbedAustin 11:cada08fc8a70 1040
mbedAustin 11:cada08fc8a70 1041 have_ciphersuite_v2:
mbedAustin 11:cada08fc8a70 1042 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
mbedAustin 11:cada08fc8a70 1043
mbedAustin 11:cada08fc8a70 1044 ssl->session_negotiate->ciphersuite = ciphersuites[i];
mbedAustin 11:cada08fc8a70 1045 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
mbedAustin 11:cada08fc8a70 1046 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
mbedAustin 11:cada08fc8a70 1047
mbedAustin 11:cada08fc8a70 1048 /*
mbedAustin 11:cada08fc8a70 1049 * SSLv2 Client Hello relevant renegotiation security checks
mbedAustin 11:cada08fc8a70 1050 */
mbedAustin 11:cada08fc8a70 1051 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
mbedAustin 11:cada08fc8a70 1052 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
mbedAustin 11:cada08fc8a70 1053 {
mbedAustin 11:cada08fc8a70 1054 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
mbedAustin 11:cada08fc8a70 1055
mbedAustin 11:cada08fc8a70 1056 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 1057 return( ret );
mbedAustin 11:cada08fc8a70 1058
mbedAustin 11:cada08fc8a70 1059 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1060 }
mbedAustin 11:cada08fc8a70 1061
mbedAustin 11:cada08fc8a70 1062 ssl->in_left = 0;
mbedAustin 11:cada08fc8a70 1063 ssl->state++;
mbedAustin 11:cada08fc8a70 1064
mbedAustin 11:cada08fc8a70 1065 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
mbedAustin 11:cada08fc8a70 1066
mbedAustin 11:cada08fc8a70 1067 return( 0 );
mbedAustin 11:cada08fc8a70 1068 }
mbedAustin 11:cada08fc8a70 1069 #endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
mbedAustin 11:cada08fc8a70 1070
mbedAustin 11:cada08fc8a70 1071 static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 1072 {
mbedAustin 11:cada08fc8a70 1073 int ret, got_common_suite;
mbedAustin 11:cada08fc8a70 1074 size_t i, j;
mbedAustin 11:cada08fc8a70 1075 size_t ciph_offset, comp_offset, ext_offset;
mbedAustin 11:cada08fc8a70 1076 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
mbedAustin 11:cada08fc8a70 1077 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1078 size_t cookie_offset, cookie_len;
mbedAustin 11:cada08fc8a70 1079 #endif
mbedAustin 11:cada08fc8a70 1080 unsigned char *buf, *p, *ext;
mbedAustin 11:cada08fc8a70 1081 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1082 int renegotiation_info_seen = 0;
mbedAustin 11:cada08fc8a70 1083 #endif
mbedAustin 11:cada08fc8a70 1084 int handshake_failure = 0;
mbedAustin 11:cada08fc8a70 1085 const int *ciphersuites;
mbedAustin 11:cada08fc8a70 1086 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
mbedAustin 11:cada08fc8a70 1087 int major, minor;
mbedAustin 11:cada08fc8a70 1088
mbedAustin 11:cada08fc8a70 1089 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
mbedAustin 11:cada08fc8a70 1090
mbedAustin 11:cada08fc8a70 1091 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
mbedAustin 11:cada08fc8a70 1092 read_record_header:
mbedAustin 11:cada08fc8a70 1093 #endif
mbedAustin 11:cada08fc8a70 1094 /*
mbedAustin 11:cada08fc8a70 1095 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
mbedAustin 11:cada08fc8a70 1096 * otherwise read it ourselves manually in order to support SSLv2
mbedAustin 11:cada08fc8a70 1097 * ClientHello, which doesn't use the same record layer format.
mbedAustin 11:cada08fc8a70 1098 */
mbedAustin 11:cada08fc8a70 1099 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1100 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
mbedAustin 11:cada08fc8a70 1101 #endif
mbedAustin 11:cada08fc8a70 1102 {
mbedAustin 11:cada08fc8a70 1103 if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
mbedAustin 11:cada08fc8a70 1104 {
mbedAustin 11:cada08fc8a70 1105 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
mbedAustin 11:cada08fc8a70 1106 return( ret );
mbedAustin 11:cada08fc8a70 1107 }
mbedAustin 11:cada08fc8a70 1108 }
mbedAustin 11:cada08fc8a70 1109
mbedAustin 11:cada08fc8a70 1110 buf = ssl->in_hdr;
mbedAustin 11:cada08fc8a70 1111
mbedAustin 11:cada08fc8a70 1112 #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
mbedAustin 11:cada08fc8a70 1113 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1114 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
mbedAustin 11:cada08fc8a70 1115 #endif
mbedAustin 11:cada08fc8a70 1116 if( ( buf[0] & 0x80 ) != 0 )
mbedAustin 11:cada08fc8a70 1117 return ssl_parse_client_hello_v2( ssl );
mbedAustin 11:cada08fc8a70 1118 #endif
mbedAustin 11:cada08fc8a70 1119
mbedAustin 11:cada08fc8a70 1120 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
mbedAustin 11:cada08fc8a70 1121
mbedAustin 11:cada08fc8a70 1122 /*
mbedAustin 11:cada08fc8a70 1123 * SSLv3/TLS Client Hello
mbedAustin 11:cada08fc8a70 1124 *
mbedAustin 11:cada08fc8a70 1125 * Record layer:
mbedAustin 11:cada08fc8a70 1126 * 0 . 0 message type
mbedAustin 11:cada08fc8a70 1127 * 1 . 2 protocol version
mbedAustin 11:cada08fc8a70 1128 * 3 . 11 DTLS: epoch + record sequence number
mbedAustin 11:cada08fc8a70 1129 * 3 . 4 message length
mbedAustin 11:cada08fc8a70 1130 */
mbedAustin 11:cada08fc8a70 1131 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
mbedAustin 11:cada08fc8a70 1132 buf[0] ) );
mbedAustin 11:cada08fc8a70 1133
mbedAustin 11:cada08fc8a70 1134 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
mbedAustin 11:cada08fc8a70 1135 {
mbedAustin 11:cada08fc8a70 1136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1137 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1138 }
mbedAustin 11:cada08fc8a70 1139
mbedAustin 11:cada08fc8a70 1140 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
mbedAustin 11:cada08fc8a70 1141 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
mbedAustin 11:cada08fc8a70 1142
mbedAustin 11:cada08fc8a70 1143 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
mbedAustin 11:cada08fc8a70 1144 buf[1], buf[2] ) );
mbedAustin 11:cada08fc8a70 1145
mbedAustin 11:cada08fc8a70 1146 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
mbedAustin 11:cada08fc8a70 1147
mbedAustin 11:cada08fc8a70 1148 /* According to RFC 5246 Appendix E.1, the version here is typically
mbedAustin 11:cada08fc8a70 1149 * "{03,00}, the lowest version number supported by the client, [or] the
mbedAustin 11:cada08fc8a70 1150 * value of ClientHello.client_version", so the only meaningful check here
mbedAustin 11:cada08fc8a70 1151 * is the major version shouldn't be less than 3 */
mbedAustin 11:cada08fc8a70 1152 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 1153 {
mbedAustin 11:cada08fc8a70 1154 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1155 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1156 }
mbedAustin 11:cada08fc8a70 1157
mbedAustin 11:cada08fc8a70 1158 /* For DTLS if this is the initial handshake, remember the client sequence
mbedAustin 11:cada08fc8a70 1159 * number to use it in our next message (RFC 6347 4.2.1) */
mbedAustin 11:cada08fc8a70 1160 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1161 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
mbedAustin 11:cada08fc8a70 1162 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1163 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
mbedAustin 11:cada08fc8a70 1164 #endif
mbedAustin 11:cada08fc8a70 1165 )
mbedAustin 11:cada08fc8a70 1166 {
mbedAustin 11:cada08fc8a70 1167 /* Epoch should be 0 for initial handshakes */
mbedAustin 11:cada08fc8a70 1168 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
mbedAustin 11:cada08fc8a70 1169 {
mbedAustin 11:cada08fc8a70 1170 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1171 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1172 }
mbedAustin 11:cada08fc8a70 1173
mbedAustin 11:cada08fc8a70 1174 memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
mbedAustin 11:cada08fc8a70 1175
mbedAustin 11:cada08fc8a70 1176 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
mbedAustin 11:cada08fc8a70 1177 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
mbedAustin 11:cada08fc8a70 1178 {
mbedAustin 11:cada08fc8a70 1179 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
mbedAustin 11:cada08fc8a70 1180 ssl->next_record_offset = 0;
mbedAustin 11:cada08fc8a70 1181 ssl->in_left = 0;
mbedAustin 11:cada08fc8a70 1182 goto read_record_header;
mbedAustin 11:cada08fc8a70 1183 }
mbedAustin 11:cada08fc8a70 1184
mbedAustin 11:cada08fc8a70 1185 /* No MAC to check yet, so we can update right now */
mbedAustin 11:cada08fc8a70 1186 mbedtls_ssl_dtls_replay_update( ssl );
mbedAustin 11:cada08fc8a70 1187 #endif
mbedAustin 11:cada08fc8a70 1188 }
mbedAustin 11:cada08fc8a70 1189 #endif /* MBEDTLS_SSL_PROTO_DTLS */
mbedAustin 11:cada08fc8a70 1190
mbedAustin 11:cada08fc8a70 1191 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
mbedAustin 11:cada08fc8a70 1192
mbedAustin 11:cada08fc8a70 1193 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1194 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
mbedAustin 11:cada08fc8a70 1195 {
mbedAustin 11:cada08fc8a70 1196 /* Set by mbedtls_ssl_read_record() */
mbedAustin 11:cada08fc8a70 1197 msg_len = ssl->in_hslen;
mbedAustin 11:cada08fc8a70 1198 }
mbedAustin 11:cada08fc8a70 1199 else
mbedAustin 11:cada08fc8a70 1200 #endif
mbedAustin 11:cada08fc8a70 1201 {
mbedAustin 11:cada08fc8a70 1202 if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
mbedAustin 11:cada08fc8a70 1203 {
mbedAustin 11:cada08fc8a70 1204 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1205 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1206 }
mbedAustin 11:cada08fc8a70 1207
mbedAustin 11:cada08fc8a70 1208 if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
mbedAustin 11:cada08fc8a70 1209 {
mbedAustin 11:cada08fc8a70 1210 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
mbedAustin 11:cada08fc8a70 1211 return( ret );
mbedAustin 11:cada08fc8a70 1212 }
mbedAustin 11:cada08fc8a70 1213
mbedAustin 11:cada08fc8a70 1214 /* Done reading this record, get ready for the next one */
mbedAustin 11:cada08fc8a70 1215 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1216 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedAustin 11:cada08fc8a70 1217 ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
mbedAustin 11:cada08fc8a70 1218 else
mbedAustin 11:cada08fc8a70 1219 #endif
mbedAustin 11:cada08fc8a70 1220 ssl->in_left = 0;
mbedAustin 11:cada08fc8a70 1221 }
mbedAustin 11:cada08fc8a70 1222
mbedAustin 11:cada08fc8a70 1223 buf = ssl->in_msg;
mbedAustin 11:cada08fc8a70 1224
mbedAustin 11:cada08fc8a70 1225 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
mbedAustin 11:cada08fc8a70 1226
mbedAustin 11:cada08fc8a70 1227 ssl->handshake->update_checksum( ssl, buf, msg_len );
mbedAustin 11:cada08fc8a70 1228
mbedAustin 11:cada08fc8a70 1229 /*
mbedAustin 11:cada08fc8a70 1230 * Handshake layer:
mbedAustin 11:cada08fc8a70 1231 * 0 . 0 handshake type
mbedAustin 11:cada08fc8a70 1232 * 1 . 3 handshake length
mbedAustin 11:cada08fc8a70 1233 * 4 . 5 DTLS only: message seqence number
mbedAustin 11:cada08fc8a70 1234 * 6 . 8 DTLS only: fragment offset
mbedAustin 11:cada08fc8a70 1235 * 9 . 11 DTLS only: fragment length
mbedAustin 11:cada08fc8a70 1236 */
mbedAustin 11:cada08fc8a70 1237 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
mbedAustin 11:cada08fc8a70 1238 {
mbedAustin 11:cada08fc8a70 1239 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1240 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1241 }
mbedAustin 11:cada08fc8a70 1242
mbedAustin 11:cada08fc8a70 1243 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
mbedAustin 11:cada08fc8a70 1244
mbedAustin 11:cada08fc8a70 1245 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
mbedAustin 11:cada08fc8a70 1246 {
mbedAustin 11:cada08fc8a70 1247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1248 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1249 }
mbedAustin 11:cada08fc8a70 1250
mbedAustin 11:cada08fc8a70 1251 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
mbedAustin 11:cada08fc8a70 1252 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
mbedAustin 11:cada08fc8a70 1253
mbedAustin 11:cada08fc8a70 1254 /* We don't support fragmentation of ClientHello (yet?) */
mbedAustin 11:cada08fc8a70 1255 if( buf[1] != 0 ||
mbedAustin 11:cada08fc8a70 1256 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
mbedAustin 11:cada08fc8a70 1257 {
mbedAustin 11:cada08fc8a70 1258 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1259 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1260 }
mbedAustin 11:cada08fc8a70 1261
mbedAustin 11:cada08fc8a70 1262 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1263 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedAustin 11:cada08fc8a70 1264 {
mbedAustin 11:cada08fc8a70 1265 /*
mbedAustin 11:cada08fc8a70 1266 * Copy the client's handshake message_seq on initial handshakes,
mbedAustin 11:cada08fc8a70 1267 * check sequence number on renego.
mbedAustin 11:cada08fc8a70 1268 */
mbedAustin 11:cada08fc8a70 1269 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1270 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
mbedAustin 11:cada08fc8a70 1271 {
mbedAustin 11:cada08fc8a70 1272 /* This couldn't be done in ssl_prepare_handshake_record() */
mbedAustin 11:cada08fc8a70 1273 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
mbedAustin 11:cada08fc8a70 1274 ssl->in_msg[5];
mbedAustin 11:cada08fc8a70 1275
mbedAustin 11:cada08fc8a70 1276 if( cli_msg_seq != ssl->handshake->in_msg_seq )
mbedAustin 11:cada08fc8a70 1277 {
mbedAustin 11:cada08fc8a70 1278 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
mbedAustin 11:cada08fc8a70 1279 "%d (expected %d)", cli_msg_seq,
mbedAustin 11:cada08fc8a70 1280 ssl->handshake->in_msg_seq ) );
mbedAustin 11:cada08fc8a70 1281 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1282 }
mbedAustin 11:cada08fc8a70 1283
mbedAustin 11:cada08fc8a70 1284 ssl->handshake->in_msg_seq++;
mbedAustin 11:cada08fc8a70 1285 }
mbedAustin 11:cada08fc8a70 1286 else
mbedAustin 11:cada08fc8a70 1287 #endif
mbedAustin 11:cada08fc8a70 1288 {
mbedAustin 11:cada08fc8a70 1289 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
mbedAustin 11:cada08fc8a70 1290 ssl->in_msg[5];
mbedAustin 11:cada08fc8a70 1291 ssl->handshake->out_msg_seq = cli_msg_seq;
mbedAustin 11:cada08fc8a70 1292 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
mbedAustin 11:cada08fc8a70 1293 }
mbedAustin 11:cada08fc8a70 1294
mbedAustin 11:cada08fc8a70 1295 /*
mbedAustin 11:cada08fc8a70 1296 * For now we don't support fragmentation, so make sure
mbedAustin 11:cada08fc8a70 1297 * fragment_offset == 0 and fragment_length == length
mbedAustin 11:cada08fc8a70 1298 */
mbedAustin 11:cada08fc8a70 1299 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
mbedAustin 11:cada08fc8a70 1300 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
mbedAustin 11:cada08fc8a70 1301 {
mbedAustin 11:cada08fc8a70 1302 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
mbedAustin 11:cada08fc8a70 1303 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
mbedAustin 11:cada08fc8a70 1304 }
mbedAustin 11:cada08fc8a70 1305 }
mbedAustin 11:cada08fc8a70 1306 #endif /* MBEDTLS_SSL_PROTO_DTLS */
mbedAustin 11:cada08fc8a70 1307
mbedAustin 11:cada08fc8a70 1308 buf += mbedtls_ssl_hs_hdr_len( ssl );
mbedAustin 11:cada08fc8a70 1309 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
mbedAustin 11:cada08fc8a70 1310
mbedAustin 11:cada08fc8a70 1311 /*
mbedAustin 11:cada08fc8a70 1312 * ClientHello layer:
mbedAustin 11:cada08fc8a70 1313 * 0 . 1 protocol version
mbedAustin 11:cada08fc8a70 1314 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
mbedAustin 11:cada08fc8a70 1315 * 34 . 35 session id length (1 byte)
mbedAustin 11:cada08fc8a70 1316 * 35 . 34+x session id
mbedAustin 11:cada08fc8a70 1317 * 35+x . 35+x DTLS only: cookie length (1 byte)
mbedAustin 11:cada08fc8a70 1318 * 36+x . .. DTLS only: cookie
mbedAustin 11:cada08fc8a70 1319 * .. . .. ciphersuite list length (2 bytes)
mbedAustin 11:cada08fc8a70 1320 * .. . .. ciphersuite list
mbedAustin 11:cada08fc8a70 1321 * .. . .. compression alg. list length (1 byte)
mbedAustin 11:cada08fc8a70 1322 * .. . .. compression alg. list
mbedAustin 11:cada08fc8a70 1323 * .. . .. extensions length (2 bytes, optional)
mbedAustin 11:cada08fc8a70 1324 * .. . .. extensions (optional)
mbedAustin 11:cada08fc8a70 1325 */
mbedAustin 11:cada08fc8a70 1326
mbedAustin 11:cada08fc8a70 1327 /*
mbedAustin 11:cada08fc8a70 1328 * Minimal length (with everything empty and extensions ommitted) is
mbedAustin 11:cada08fc8a70 1329 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
mbedAustin 11:cada08fc8a70 1330 * read at least up to session id length without worrying.
mbedAustin 11:cada08fc8a70 1331 */
mbedAustin 11:cada08fc8a70 1332 if( msg_len < 38 )
mbedAustin 11:cada08fc8a70 1333 {
mbedAustin 11:cada08fc8a70 1334 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1335 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1336 }
mbedAustin 11:cada08fc8a70 1337
mbedAustin 11:cada08fc8a70 1338 /*
mbedAustin 11:cada08fc8a70 1339 * Check and save the protocol version
mbedAustin 11:cada08fc8a70 1340 */
mbedAustin 11:cada08fc8a70 1341 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
mbedAustin 11:cada08fc8a70 1342
mbedAustin 11:cada08fc8a70 1343 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
mbedAustin 11:cada08fc8a70 1344 ssl->conf->transport, buf );
mbedAustin 11:cada08fc8a70 1345
mbedAustin 11:cada08fc8a70 1346 ssl->handshake->max_major_ver = ssl->major_ver;
mbedAustin 11:cada08fc8a70 1347 ssl->handshake->max_minor_ver = ssl->minor_ver;
mbedAustin 11:cada08fc8a70 1348
mbedAustin 11:cada08fc8a70 1349 if( ssl->major_ver < ssl->conf->min_major_ver ||
mbedAustin 11:cada08fc8a70 1350 ssl->minor_ver < ssl->conf->min_minor_ver )
mbedAustin 11:cada08fc8a70 1351 {
mbedAustin 11:cada08fc8a70 1352 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
mbedAustin 11:cada08fc8a70 1353 " [%d:%d] < [%d:%d]",
mbedAustin 11:cada08fc8a70 1354 ssl->major_ver, ssl->minor_ver,
mbedAustin 11:cada08fc8a70 1355 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
mbedAustin 11:cada08fc8a70 1356
mbedAustin 11:cada08fc8a70 1357 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 1358 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
mbedAustin 11:cada08fc8a70 1359
mbedAustin 11:cada08fc8a70 1360 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
mbedAustin 11:cada08fc8a70 1361 }
mbedAustin 11:cada08fc8a70 1362
mbedAustin 11:cada08fc8a70 1363 if( ssl->major_ver > ssl->conf->max_major_ver )
mbedAustin 11:cada08fc8a70 1364 {
mbedAustin 11:cada08fc8a70 1365 ssl->major_ver = ssl->conf->max_major_ver;
mbedAustin 11:cada08fc8a70 1366 ssl->minor_ver = ssl->conf->max_minor_ver;
mbedAustin 11:cada08fc8a70 1367 }
mbedAustin 11:cada08fc8a70 1368 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
mbedAustin 11:cada08fc8a70 1369 ssl->minor_ver = ssl->conf->max_minor_ver;
mbedAustin 11:cada08fc8a70 1370
mbedAustin 11:cada08fc8a70 1371 /*
mbedAustin 11:cada08fc8a70 1372 * Save client random (inc. Unix time)
mbedAustin 11:cada08fc8a70 1373 */
mbedAustin 11:cada08fc8a70 1374 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
mbedAustin 11:cada08fc8a70 1375
mbedAustin 11:cada08fc8a70 1376 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
mbedAustin 11:cada08fc8a70 1377
mbedAustin 11:cada08fc8a70 1378 /*
mbedAustin 11:cada08fc8a70 1379 * Check the session ID length and save session ID
mbedAustin 11:cada08fc8a70 1380 */
mbedAustin 11:cada08fc8a70 1381 sess_len = buf[34];
mbedAustin 11:cada08fc8a70 1382
mbedAustin 11:cada08fc8a70 1383 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
mbedAustin 11:cada08fc8a70 1384 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
mbedAustin 11:cada08fc8a70 1385 {
mbedAustin 11:cada08fc8a70 1386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1387 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1388 }
mbedAustin 11:cada08fc8a70 1389
mbedAustin 11:cada08fc8a70 1390 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
mbedAustin 11:cada08fc8a70 1391
mbedAustin 11:cada08fc8a70 1392 ssl->session_negotiate->id_len = sess_len;
mbedAustin 11:cada08fc8a70 1393 memset( ssl->session_negotiate->id, 0,
mbedAustin 11:cada08fc8a70 1394 sizeof( ssl->session_negotiate->id ) );
mbedAustin 11:cada08fc8a70 1395 memcpy( ssl->session_negotiate->id, buf + 35,
mbedAustin 11:cada08fc8a70 1396 ssl->session_negotiate->id_len );
mbedAustin 11:cada08fc8a70 1397
mbedAustin 11:cada08fc8a70 1398 /*
mbedAustin 11:cada08fc8a70 1399 * Check the cookie length and content
mbedAustin 11:cada08fc8a70 1400 */
mbedAustin 11:cada08fc8a70 1401 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1402 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedAustin 11:cada08fc8a70 1403 {
mbedAustin 11:cada08fc8a70 1404 cookie_offset = 35 + sess_len;
mbedAustin 11:cada08fc8a70 1405 cookie_len = buf[cookie_offset];
mbedAustin 11:cada08fc8a70 1406
mbedAustin 11:cada08fc8a70 1407 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
mbedAustin 11:cada08fc8a70 1408 {
mbedAustin 11:cada08fc8a70 1409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1410 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1411 }
mbedAustin 11:cada08fc8a70 1412
mbedAustin 11:cada08fc8a70 1413 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
mbedAustin 11:cada08fc8a70 1414 buf + cookie_offset + 1, cookie_len );
mbedAustin 11:cada08fc8a70 1415
mbedAustin 11:cada08fc8a70 1416 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
mbedAustin 11:cada08fc8a70 1417 if( ssl->conf->f_cookie_check != NULL
mbedAustin 11:cada08fc8a70 1418 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1419 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
mbedAustin 11:cada08fc8a70 1420 #endif
mbedAustin 11:cada08fc8a70 1421 )
mbedAustin 11:cada08fc8a70 1422 {
mbedAustin 11:cada08fc8a70 1423 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
mbedAustin 11:cada08fc8a70 1424 buf + cookie_offset + 1, cookie_len,
mbedAustin 11:cada08fc8a70 1425 ssl->cli_id, ssl->cli_id_len ) != 0 )
mbedAustin 11:cada08fc8a70 1426 {
mbedAustin 11:cada08fc8a70 1427 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
mbedAustin 11:cada08fc8a70 1428 ssl->handshake->verify_cookie_len = 1;
mbedAustin 11:cada08fc8a70 1429 }
mbedAustin 11:cada08fc8a70 1430 else
mbedAustin 11:cada08fc8a70 1431 {
mbedAustin 11:cada08fc8a70 1432 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
mbedAustin 11:cada08fc8a70 1433 ssl->handshake->verify_cookie_len = 0;
mbedAustin 11:cada08fc8a70 1434 }
mbedAustin 11:cada08fc8a70 1435 }
mbedAustin 11:cada08fc8a70 1436 else
mbedAustin 11:cada08fc8a70 1437 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
mbedAustin 11:cada08fc8a70 1438 {
mbedAustin 11:cada08fc8a70 1439 /* We know we didn't send a cookie, so it should be empty */
mbedAustin 11:cada08fc8a70 1440 if( cookie_len != 0 )
mbedAustin 11:cada08fc8a70 1441 {
mbedAustin 11:cada08fc8a70 1442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1443 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1444 }
mbedAustin 11:cada08fc8a70 1445
mbedAustin 11:cada08fc8a70 1446 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
mbedAustin 11:cada08fc8a70 1447 }
mbedAustin 11:cada08fc8a70 1448
mbedAustin 11:cada08fc8a70 1449 /*
mbedAustin 11:cada08fc8a70 1450 * Check the ciphersuitelist length (will be parsed later)
mbedAustin 11:cada08fc8a70 1451 */
mbedAustin 11:cada08fc8a70 1452 ciph_offset = cookie_offset + 1 + cookie_len;
mbedAustin 11:cada08fc8a70 1453 }
mbedAustin 11:cada08fc8a70 1454 else
mbedAustin 11:cada08fc8a70 1455 #endif /* MBEDTLS_SSL_PROTO_DTLS */
mbedAustin 11:cada08fc8a70 1456 ciph_offset = 35 + sess_len;
mbedAustin 11:cada08fc8a70 1457
mbedAustin 11:cada08fc8a70 1458 ciph_len = ( buf[ciph_offset + 0] << 8 )
mbedAustin 11:cada08fc8a70 1459 | ( buf[ciph_offset + 1] );
mbedAustin 11:cada08fc8a70 1460
mbedAustin 11:cada08fc8a70 1461 if( ciph_len < 2 ||
mbedAustin 11:cada08fc8a70 1462 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
mbedAustin 11:cada08fc8a70 1463 ( ciph_len % 2 ) != 0 )
mbedAustin 11:cada08fc8a70 1464 {
mbedAustin 11:cada08fc8a70 1465 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1466 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1467 }
mbedAustin 11:cada08fc8a70 1468
mbedAustin 11:cada08fc8a70 1469 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
mbedAustin 11:cada08fc8a70 1470 buf + ciph_offset + 2, ciph_len );
mbedAustin 11:cada08fc8a70 1471
mbedAustin 11:cada08fc8a70 1472 /*
mbedAustin 11:cada08fc8a70 1473 * Check the compression algorithms length and pick one
mbedAustin 11:cada08fc8a70 1474 */
mbedAustin 11:cada08fc8a70 1475 comp_offset = ciph_offset + 2 + ciph_len;
mbedAustin 11:cada08fc8a70 1476
mbedAustin 11:cada08fc8a70 1477 comp_len = buf[comp_offset];
mbedAustin 11:cada08fc8a70 1478
mbedAustin 11:cada08fc8a70 1479 if( comp_len < 1 ||
mbedAustin 11:cada08fc8a70 1480 comp_len > 16 ||
mbedAustin 11:cada08fc8a70 1481 comp_len + comp_offset + 1 > msg_len )
mbedAustin 11:cada08fc8a70 1482 {
mbedAustin 11:cada08fc8a70 1483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1484 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1485 }
mbedAustin 11:cada08fc8a70 1486
mbedAustin 11:cada08fc8a70 1487 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
mbedAustin 11:cada08fc8a70 1488 buf + comp_offset + 1, comp_len );
mbedAustin 11:cada08fc8a70 1489
mbedAustin 11:cada08fc8a70 1490 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
mbedAustin 11:cada08fc8a70 1491 #if defined(MBEDTLS_ZLIB_SUPPORT)
mbedAustin 11:cada08fc8a70 1492 for( i = 0; i < comp_len; ++i )
mbedAustin 11:cada08fc8a70 1493 {
mbedAustin 11:cada08fc8a70 1494 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
mbedAustin 11:cada08fc8a70 1495 {
mbedAustin 11:cada08fc8a70 1496 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
mbedAustin 11:cada08fc8a70 1497 break;
mbedAustin 11:cada08fc8a70 1498 }
mbedAustin 11:cada08fc8a70 1499 }
mbedAustin 11:cada08fc8a70 1500 #endif
mbedAustin 11:cada08fc8a70 1501
mbedAustin 11:cada08fc8a70 1502 /* See comments in ssl_write_client_hello() */
mbedAustin 11:cada08fc8a70 1503 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1504 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedAustin 11:cada08fc8a70 1505 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
mbedAustin 11:cada08fc8a70 1506 #endif
mbedAustin 11:cada08fc8a70 1507
mbedAustin 11:cada08fc8a70 1508 /*
mbedAustin 11:cada08fc8a70 1509 * Check the extension length
mbedAustin 11:cada08fc8a70 1510 */
mbedAustin 11:cada08fc8a70 1511 ext_offset = comp_offset + 1 + comp_len;
mbedAustin 11:cada08fc8a70 1512 if( msg_len > ext_offset )
mbedAustin 11:cada08fc8a70 1513 {
mbedAustin 11:cada08fc8a70 1514 if( msg_len < ext_offset + 2 )
mbedAustin 11:cada08fc8a70 1515 {
mbedAustin 11:cada08fc8a70 1516 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1517 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1518 }
mbedAustin 11:cada08fc8a70 1519
mbedAustin 11:cada08fc8a70 1520 ext_len = ( buf[ext_offset + 0] << 8 )
mbedAustin 11:cada08fc8a70 1521 | ( buf[ext_offset + 1] );
mbedAustin 11:cada08fc8a70 1522
mbedAustin 11:cada08fc8a70 1523 if( ( ext_len > 0 && ext_len < 4 ) ||
mbedAustin 11:cada08fc8a70 1524 msg_len != ext_offset + 2 + ext_len )
mbedAustin 11:cada08fc8a70 1525 {
mbedAustin 11:cada08fc8a70 1526 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1527 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1528 }
mbedAustin 11:cada08fc8a70 1529 }
mbedAustin 11:cada08fc8a70 1530 else
mbedAustin 11:cada08fc8a70 1531 ext_len = 0;
mbedAustin 11:cada08fc8a70 1532
mbedAustin 11:cada08fc8a70 1533 ext = buf + ext_offset + 2;
mbedAustin 11:cada08fc8a70 1534 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
mbedAustin 11:cada08fc8a70 1535
mbedAustin 11:cada08fc8a70 1536 while( ext_len != 0 )
mbedAustin 11:cada08fc8a70 1537 {
mbedAustin 11:cada08fc8a70 1538 unsigned int ext_id = ( ( ext[0] << 8 )
mbedAustin 11:cada08fc8a70 1539 | ( ext[1] ) );
mbedAustin 11:cada08fc8a70 1540 unsigned int ext_size = ( ( ext[2] << 8 )
mbedAustin 11:cada08fc8a70 1541 | ( ext[3] ) );
mbedAustin 11:cada08fc8a70 1542
mbedAustin 11:cada08fc8a70 1543 if( ext_size + 4 > ext_len )
mbedAustin 11:cada08fc8a70 1544 {
mbedAustin 11:cada08fc8a70 1545 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1546 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1547 }
mbedAustin 11:cada08fc8a70 1548 switch( ext_id )
mbedAustin 11:cada08fc8a70 1549 {
mbedAustin 11:cada08fc8a70 1550 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedAustin 11:cada08fc8a70 1551 case MBEDTLS_TLS_EXT_SERVERNAME:
mbedAustin 11:cada08fc8a70 1552 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
mbedAustin 11:cada08fc8a70 1553 if( ssl->conf->f_sni == NULL )
mbedAustin 11:cada08fc8a70 1554 break;
mbedAustin 11:cada08fc8a70 1555
mbedAustin 11:cada08fc8a70 1556 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1557 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1558 return( ret );
mbedAustin 11:cada08fc8a70 1559 break;
mbedAustin 11:cada08fc8a70 1560 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
mbedAustin 11:cada08fc8a70 1561
mbedAustin 11:cada08fc8a70 1562 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
mbedAustin 11:cada08fc8a70 1563 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
mbedAustin 11:cada08fc8a70 1564 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1565 renegotiation_info_seen = 1;
mbedAustin 11:cada08fc8a70 1566 #endif
mbedAustin 11:cada08fc8a70 1567
mbedAustin 11:cada08fc8a70 1568 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1569 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1570 return( ret );
mbedAustin 11:cada08fc8a70 1571 break;
mbedAustin 11:cada08fc8a70 1572
mbedAustin 11:cada08fc8a70 1573 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
mbedAustin 11:cada08fc8a70 1574 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
mbedAustin 11:cada08fc8a70 1575 case MBEDTLS_TLS_EXT_SIG_ALG:
mbedAustin 11:cada08fc8a70 1576 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
mbedAustin 11:cada08fc8a70 1577 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1578 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
mbedAustin 11:cada08fc8a70 1579 break;
mbedAustin 11:cada08fc8a70 1580 #endif
mbedAustin 11:cada08fc8a70 1581
mbedAustin 11:cada08fc8a70 1582 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1583 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1584 return( ret );
mbedAustin 11:cada08fc8a70 1585 break;
mbedAustin 11:cada08fc8a70 1586 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
mbedAustin 11:cada08fc8a70 1587 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
mbedAustin 11:cada08fc8a70 1588
mbedAustin 11:cada08fc8a70 1589 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
mbedAustin 11:cada08fc8a70 1590 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 1591 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
mbedAustin 11:cada08fc8a70 1592 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
mbedAustin 11:cada08fc8a70 1593
mbedAustin 11:cada08fc8a70 1594 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1595 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1596 return( ret );
mbedAustin 11:cada08fc8a70 1597 break;
mbedAustin 11:cada08fc8a70 1598
mbedAustin 11:cada08fc8a70 1599 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
mbedAustin 11:cada08fc8a70 1600 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
mbedAustin 11:cada08fc8a70 1601 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
mbedAustin 11:cada08fc8a70 1602
mbedAustin 11:cada08fc8a70 1603 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1604 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1605 return( ret );
mbedAustin 11:cada08fc8a70 1606 break;
mbedAustin 11:cada08fc8a70 1607 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
mbedAustin 11:cada08fc8a70 1608 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 1609
mbedAustin 11:cada08fc8a70 1610 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 1611 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
mbedAustin 11:cada08fc8a70 1612 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
mbedAustin 11:cada08fc8a70 1613
mbedAustin 11:cada08fc8a70 1614 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1615 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1616 return( ret );
mbedAustin 11:cada08fc8a70 1617 break;
mbedAustin 11:cada08fc8a70 1618 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 1619
mbedAustin 11:cada08fc8a70 1620 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedAustin 11:cada08fc8a70 1621 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
mbedAustin 11:cada08fc8a70 1622 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
mbedAustin 11:cada08fc8a70 1623
mbedAustin 11:cada08fc8a70 1624 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1625 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1626 return( ret );
mbedAustin 11:cada08fc8a70 1627 break;
mbedAustin 11:cada08fc8a70 1628 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
mbedAustin 11:cada08fc8a70 1629
mbedAustin 11:cada08fc8a70 1630 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
mbedAustin 11:cada08fc8a70 1631 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
mbedAustin 11:cada08fc8a70 1632 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
mbedAustin 11:cada08fc8a70 1633
mbedAustin 11:cada08fc8a70 1634 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1635 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1636 return( ret );
mbedAustin 11:cada08fc8a70 1637 break;
mbedAustin 11:cada08fc8a70 1638 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
mbedAustin 11:cada08fc8a70 1639
mbedAustin 11:cada08fc8a70 1640 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedAustin 11:cada08fc8a70 1641 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
mbedAustin 11:cada08fc8a70 1642 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
mbedAustin 11:cada08fc8a70 1643
mbedAustin 11:cada08fc8a70 1644 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1645 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1646 return( ret );
mbedAustin 11:cada08fc8a70 1647 break;
mbedAustin 11:cada08fc8a70 1648 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
mbedAustin 11:cada08fc8a70 1649
mbedAustin 11:cada08fc8a70 1650 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedAustin 11:cada08fc8a70 1651 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
mbedAustin 11:cada08fc8a70 1652 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
mbedAustin 11:cada08fc8a70 1653
mbedAustin 11:cada08fc8a70 1654 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1655 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1656 return( ret );
mbedAustin 11:cada08fc8a70 1657 break;
mbedAustin 11:cada08fc8a70 1658 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
mbedAustin 11:cada08fc8a70 1659
mbedAustin 11:cada08fc8a70 1660 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 1661 case MBEDTLS_TLS_EXT_SESSION_TICKET:
mbedAustin 11:cada08fc8a70 1662 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
mbedAustin 11:cada08fc8a70 1663
mbedAustin 11:cada08fc8a70 1664 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1665 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1666 return( ret );
mbedAustin 11:cada08fc8a70 1667 break;
mbedAustin 11:cada08fc8a70 1668 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
mbedAustin 11:cada08fc8a70 1669
mbedAustin 11:cada08fc8a70 1670 #if defined(MBEDTLS_SSL_ALPN)
mbedAustin 11:cada08fc8a70 1671 case MBEDTLS_TLS_EXT_ALPN:
mbedAustin 11:cada08fc8a70 1672 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
mbedAustin 11:cada08fc8a70 1673
mbedAustin 11:cada08fc8a70 1674 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
mbedAustin 11:cada08fc8a70 1675 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1676 return( ret );
mbedAustin 11:cada08fc8a70 1677 break;
mbedAustin 11:cada08fc8a70 1678 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
mbedAustin 11:cada08fc8a70 1679
mbedAustin 11:cada08fc8a70 1680 default:
mbedAustin 11:cada08fc8a70 1681 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
mbedAustin 11:cada08fc8a70 1682 ext_id ) );
mbedAustin 11:cada08fc8a70 1683 }
mbedAustin 11:cada08fc8a70 1684
mbedAustin 11:cada08fc8a70 1685 ext_len -= 4 + ext_size;
mbedAustin 11:cada08fc8a70 1686 ext += 4 + ext_size;
mbedAustin 11:cada08fc8a70 1687
mbedAustin 11:cada08fc8a70 1688 if( ext_len > 0 && ext_len < 4 )
mbedAustin 11:cada08fc8a70 1689 {
mbedAustin 11:cada08fc8a70 1690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
mbedAustin 11:cada08fc8a70 1691 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1692 }
mbedAustin 11:cada08fc8a70 1693 }
mbedAustin 11:cada08fc8a70 1694
mbedAustin 11:cada08fc8a70 1695 #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
mbedAustin 11:cada08fc8a70 1696 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
mbedAustin 11:cada08fc8a70 1697 {
mbedAustin 11:cada08fc8a70 1698 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
mbedAustin 11:cada08fc8a70 1699 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
mbedAustin 11:cada08fc8a70 1700 {
mbedAustin 11:cada08fc8a70 1701 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
mbedAustin 11:cada08fc8a70 1702
mbedAustin 11:cada08fc8a70 1703 if( ssl->minor_ver < ssl->conf->max_minor_ver )
mbedAustin 11:cada08fc8a70 1704 {
mbedAustin 11:cada08fc8a70 1705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
mbedAustin 11:cada08fc8a70 1706
mbedAustin 11:cada08fc8a70 1707 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 1708 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
mbedAustin 11:cada08fc8a70 1709
mbedAustin 11:cada08fc8a70 1710 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1711 }
mbedAustin 11:cada08fc8a70 1712
mbedAustin 11:cada08fc8a70 1713 break;
mbedAustin 11:cada08fc8a70 1714 }
mbedAustin 11:cada08fc8a70 1715 }
mbedAustin 11:cada08fc8a70 1716 #endif /* MBEDTLS_SSL_FALLBACK_SCSV */
mbedAustin 11:cada08fc8a70 1717
mbedAustin 11:cada08fc8a70 1718 /*
mbedAustin 11:cada08fc8a70 1719 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
mbedAustin 11:cada08fc8a70 1720 */
mbedAustin 11:cada08fc8a70 1721 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
mbedAustin 11:cada08fc8a70 1722 {
mbedAustin 11:cada08fc8a70 1723 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
mbedAustin 11:cada08fc8a70 1724 {
mbedAustin 11:cada08fc8a70 1725 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
mbedAustin 11:cada08fc8a70 1726 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1727 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
mbedAustin 11:cada08fc8a70 1728 {
mbedAustin 11:cada08fc8a70 1729 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
mbedAustin 11:cada08fc8a70 1730
mbedAustin 11:cada08fc8a70 1731 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 1732 return( ret );
mbedAustin 11:cada08fc8a70 1733
mbedAustin 11:cada08fc8a70 1734 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1735 }
mbedAustin 11:cada08fc8a70 1736 #endif
mbedAustin 11:cada08fc8a70 1737 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
mbedAustin 11:cada08fc8a70 1738 break;
mbedAustin 11:cada08fc8a70 1739 }
mbedAustin 11:cada08fc8a70 1740 }
mbedAustin 11:cada08fc8a70 1741
mbedAustin 11:cada08fc8a70 1742 /*
mbedAustin 11:cada08fc8a70 1743 * Renegotiation security checks
mbedAustin 11:cada08fc8a70 1744 */
mbedAustin 11:cada08fc8a70 1745 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
mbedAustin 11:cada08fc8a70 1746 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
mbedAustin 11:cada08fc8a70 1747 {
mbedAustin 11:cada08fc8a70 1748 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
mbedAustin 11:cada08fc8a70 1749 handshake_failure = 1;
mbedAustin 11:cada08fc8a70 1750 }
mbedAustin 11:cada08fc8a70 1751 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1752 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
mbedAustin 11:cada08fc8a70 1753 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
mbedAustin 11:cada08fc8a70 1754 renegotiation_info_seen == 0 )
mbedAustin 11:cada08fc8a70 1755 {
mbedAustin 11:cada08fc8a70 1756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
mbedAustin 11:cada08fc8a70 1757 handshake_failure = 1;
mbedAustin 11:cada08fc8a70 1758 }
mbedAustin 11:cada08fc8a70 1759 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
mbedAustin 11:cada08fc8a70 1760 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
mbedAustin 11:cada08fc8a70 1761 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
mbedAustin 11:cada08fc8a70 1762 {
mbedAustin 11:cada08fc8a70 1763 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
mbedAustin 11:cada08fc8a70 1764 handshake_failure = 1;
mbedAustin 11:cada08fc8a70 1765 }
mbedAustin 11:cada08fc8a70 1766 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
mbedAustin 11:cada08fc8a70 1767 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
mbedAustin 11:cada08fc8a70 1768 renegotiation_info_seen == 1 )
mbedAustin 11:cada08fc8a70 1769 {
mbedAustin 11:cada08fc8a70 1770 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
mbedAustin 11:cada08fc8a70 1771 handshake_failure = 1;
mbedAustin 11:cada08fc8a70 1772 }
mbedAustin 11:cada08fc8a70 1773 #endif /* MBEDTLS_SSL_RENEGOTIATION */
mbedAustin 11:cada08fc8a70 1774
mbedAustin 11:cada08fc8a70 1775 if( handshake_failure == 1 )
mbedAustin 11:cada08fc8a70 1776 {
mbedAustin 11:cada08fc8a70 1777 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 1778 return( ret );
mbedAustin 11:cada08fc8a70 1779
mbedAustin 11:cada08fc8a70 1780 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
mbedAustin 11:cada08fc8a70 1781 }
mbedAustin 11:cada08fc8a70 1782
mbedAustin 11:cada08fc8a70 1783 /*
mbedAustin 11:cada08fc8a70 1784 * Search for a matching ciphersuite
mbedAustin 11:cada08fc8a70 1785 * (At the end because we need information from the EC-based extensions
mbedAustin 11:cada08fc8a70 1786 * and certificate from the SNI callback triggered by the SNI extension.)
mbedAustin 11:cada08fc8a70 1787 */
mbedAustin 11:cada08fc8a70 1788 got_common_suite = 0;
mbedAustin 11:cada08fc8a70 1789 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
mbedAustin 11:cada08fc8a70 1790 ciphersuite_info = NULL;
mbedAustin 11:cada08fc8a70 1791 #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
mbedAustin 11:cada08fc8a70 1792 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
mbedAustin 11:cada08fc8a70 1793 {
mbedAustin 11:cada08fc8a70 1794 for( i = 0; ciphersuites[i] != 0; i++ )
mbedAustin 11:cada08fc8a70 1795 #else
mbedAustin 11:cada08fc8a70 1796 for( i = 0; ciphersuites[i] != 0; i++ )
mbedAustin 11:cada08fc8a70 1797 {
mbedAustin 11:cada08fc8a70 1798 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
mbedAustin 11:cada08fc8a70 1799 #endif
mbedAustin 11:cada08fc8a70 1800 {
mbedAustin 11:cada08fc8a70 1801 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
mbedAustin 11:cada08fc8a70 1802 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
mbedAustin 11:cada08fc8a70 1803 continue;
mbedAustin 11:cada08fc8a70 1804
mbedAustin 11:cada08fc8a70 1805 got_common_suite = 1;
mbedAustin 11:cada08fc8a70 1806
mbedAustin 11:cada08fc8a70 1807 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
mbedAustin 11:cada08fc8a70 1808 &ciphersuite_info ) ) != 0 )
mbedAustin 11:cada08fc8a70 1809 return( ret );
mbedAustin 11:cada08fc8a70 1810
mbedAustin 11:cada08fc8a70 1811 if( ciphersuite_info != NULL )
mbedAustin 11:cada08fc8a70 1812 goto have_ciphersuite;
mbedAustin 11:cada08fc8a70 1813 }
mbedAustin 11:cada08fc8a70 1814 }
mbedAustin 11:cada08fc8a70 1815
mbedAustin 11:cada08fc8a70 1816 if( got_common_suite )
mbedAustin 11:cada08fc8a70 1817 {
mbedAustin 11:cada08fc8a70 1818 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
mbedAustin 11:cada08fc8a70 1819 "but none of them usable" ) );
mbedAustin 11:cada08fc8a70 1820 mbedtls_ssl_send_fatal_handshake_failure( ssl );
mbedAustin 11:cada08fc8a70 1821 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
mbedAustin 11:cada08fc8a70 1822 }
mbedAustin 11:cada08fc8a70 1823 else
mbedAustin 11:cada08fc8a70 1824 {
mbedAustin 11:cada08fc8a70 1825 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
mbedAustin 11:cada08fc8a70 1826 mbedtls_ssl_send_fatal_handshake_failure( ssl );
mbedAustin 11:cada08fc8a70 1827 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
mbedAustin 11:cada08fc8a70 1828 }
mbedAustin 11:cada08fc8a70 1829
mbedAustin 11:cada08fc8a70 1830 have_ciphersuite:
mbedAustin 11:cada08fc8a70 1831 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
mbedAustin 11:cada08fc8a70 1832
mbedAustin 11:cada08fc8a70 1833 ssl->session_negotiate->ciphersuite = ciphersuites[i];
mbedAustin 11:cada08fc8a70 1834 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
mbedAustin 11:cada08fc8a70 1835 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
mbedAustin 11:cada08fc8a70 1836
mbedAustin 11:cada08fc8a70 1837 ssl->state++;
mbedAustin 11:cada08fc8a70 1838
mbedAustin 11:cada08fc8a70 1839 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 1840 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedAustin 11:cada08fc8a70 1841 mbedtls_ssl_recv_flight_completed( ssl );
mbedAustin 11:cada08fc8a70 1842 #endif
mbedAustin 11:cada08fc8a70 1843
mbedAustin 11:cada08fc8a70 1844 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
mbedAustin 11:cada08fc8a70 1845
mbedAustin 11:cada08fc8a70 1846 return( 0 );
mbedAustin 11:cada08fc8a70 1847 }
mbedAustin 11:cada08fc8a70 1848
mbedAustin 11:cada08fc8a70 1849 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
mbedAustin 11:cada08fc8a70 1850 static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 1851 unsigned char *buf,
mbedAustin 11:cada08fc8a70 1852 size_t *olen )
mbedAustin 11:cada08fc8a70 1853 {
mbedAustin 11:cada08fc8a70 1854 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 1855
mbedAustin 11:cada08fc8a70 1856 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
mbedAustin 11:cada08fc8a70 1857 {
mbedAustin 11:cada08fc8a70 1858 *olen = 0;
mbedAustin 11:cada08fc8a70 1859 return;
mbedAustin 11:cada08fc8a70 1860 }
mbedAustin 11:cada08fc8a70 1861
mbedAustin 11:cada08fc8a70 1862 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
mbedAustin 11:cada08fc8a70 1863
mbedAustin 11:cada08fc8a70 1864 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 1865 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
mbedAustin 11:cada08fc8a70 1866
mbedAustin 11:cada08fc8a70 1867 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1868 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1869
mbedAustin 11:cada08fc8a70 1870 *olen = 4;
mbedAustin 11:cada08fc8a70 1871 }
mbedAustin 11:cada08fc8a70 1872 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
mbedAustin 11:cada08fc8a70 1873
mbedAustin 11:cada08fc8a70 1874 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedAustin 11:cada08fc8a70 1875 static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 1876 unsigned char *buf,
mbedAustin 11:cada08fc8a70 1877 size_t *olen )
mbedAustin 11:cada08fc8a70 1878 {
mbedAustin 11:cada08fc8a70 1879 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 1880 const mbedtls_ssl_ciphersuite_t *suite = NULL;
mbedAustin 11:cada08fc8a70 1881 const mbedtls_cipher_info_t *cipher = NULL;
mbedAustin 11:cada08fc8a70 1882
mbedAustin 11:cada08fc8a70 1883 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
mbedAustin 11:cada08fc8a70 1884 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
mbedAustin 11:cada08fc8a70 1885 {
mbedAustin 11:cada08fc8a70 1886 *olen = 0;
mbedAustin 11:cada08fc8a70 1887 return;
mbedAustin 11:cada08fc8a70 1888 }
mbedAustin 11:cada08fc8a70 1889
mbedAustin 11:cada08fc8a70 1890 /*
mbedAustin 11:cada08fc8a70 1891 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
mbedAustin 11:cada08fc8a70 1892 * from a client and then selects a stream or Authenticated Encryption
mbedAustin 11:cada08fc8a70 1893 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
mbedAustin 11:cada08fc8a70 1894 * encrypt-then-MAC response extension back to the client."
mbedAustin 11:cada08fc8a70 1895 */
mbedAustin 11:cada08fc8a70 1896 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
mbedAustin 11:cada08fc8a70 1897 ssl->session_negotiate->ciphersuite ) ) == NULL ||
mbedAustin 11:cada08fc8a70 1898 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
mbedAustin 11:cada08fc8a70 1899 cipher->mode != MBEDTLS_MODE_CBC )
mbedAustin 11:cada08fc8a70 1900 {
mbedAustin 11:cada08fc8a70 1901 *olen = 0;
mbedAustin 11:cada08fc8a70 1902 return;
mbedAustin 11:cada08fc8a70 1903 }
mbedAustin 11:cada08fc8a70 1904
mbedAustin 11:cada08fc8a70 1905 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
mbedAustin 11:cada08fc8a70 1906
mbedAustin 11:cada08fc8a70 1907 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 1908 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
mbedAustin 11:cada08fc8a70 1909
mbedAustin 11:cada08fc8a70 1910 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1911 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1912
mbedAustin 11:cada08fc8a70 1913 *olen = 4;
mbedAustin 11:cada08fc8a70 1914 }
mbedAustin 11:cada08fc8a70 1915 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
mbedAustin 11:cada08fc8a70 1916
mbedAustin 11:cada08fc8a70 1917 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedAustin 11:cada08fc8a70 1918 static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 1919 unsigned char *buf,
mbedAustin 11:cada08fc8a70 1920 size_t *olen )
mbedAustin 11:cada08fc8a70 1921 {
mbedAustin 11:cada08fc8a70 1922 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 1923
mbedAustin 11:cada08fc8a70 1924 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
mbedAustin 11:cada08fc8a70 1925 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
mbedAustin 11:cada08fc8a70 1926 {
mbedAustin 11:cada08fc8a70 1927 *olen = 0;
mbedAustin 11:cada08fc8a70 1928 return;
mbedAustin 11:cada08fc8a70 1929 }
mbedAustin 11:cada08fc8a70 1930
mbedAustin 11:cada08fc8a70 1931 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
mbedAustin 11:cada08fc8a70 1932 "extension" ) );
mbedAustin 11:cada08fc8a70 1933
mbedAustin 11:cada08fc8a70 1934 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 1935 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
mbedAustin 11:cada08fc8a70 1936
mbedAustin 11:cada08fc8a70 1937 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1938 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1939
mbedAustin 11:cada08fc8a70 1940 *olen = 4;
mbedAustin 11:cada08fc8a70 1941 }
mbedAustin 11:cada08fc8a70 1942 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
mbedAustin 11:cada08fc8a70 1943
mbedAustin 11:cada08fc8a70 1944 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 1945 static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 1946 unsigned char *buf,
mbedAustin 11:cada08fc8a70 1947 size_t *olen )
mbedAustin 11:cada08fc8a70 1948 {
mbedAustin 11:cada08fc8a70 1949 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 1950
mbedAustin 11:cada08fc8a70 1951 if( ssl->handshake->new_session_ticket == 0 )
mbedAustin 11:cada08fc8a70 1952 {
mbedAustin 11:cada08fc8a70 1953 *olen = 0;
mbedAustin 11:cada08fc8a70 1954 return;
mbedAustin 11:cada08fc8a70 1955 }
mbedAustin 11:cada08fc8a70 1956
mbedAustin 11:cada08fc8a70 1957 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
mbedAustin 11:cada08fc8a70 1958
mbedAustin 11:cada08fc8a70 1959 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 1960 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
mbedAustin 11:cada08fc8a70 1961
mbedAustin 11:cada08fc8a70 1962 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1963 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1964
mbedAustin 11:cada08fc8a70 1965 *olen = 4;
mbedAustin 11:cada08fc8a70 1966 }
mbedAustin 11:cada08fc8a70 1967 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
mbedAustin 11:cada08fc8a70 1968
mbedAustin 11:cada08fc8a70 1969 static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 1970 unsigned char *buf,
mbedAustin 11:cada08fc8a70 1971 size_t *olen )
mbedAustin 11:cada08fc8a70 1972 {
mbedAustin 11:cada08fc8a70 1973 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 1974
mbedAustin 11:cada08fc8a70 1975 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
mbedAustin 11:cada08fc8a70 1976 {
mbedAustin 11:cada08fc8a70 1977 *olen = 0;
mbedAustin 11:cada08fc8a70 1978 return;
mbedAustin 11:cada08fc8a70 1979 }
mbedAustin 11:cada08fc8a70 1980
mbedAustin 11:cada08fc8a70 1981 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
mbedAustin 11:cada08fc8a70 1982
mbedAustin 11:cada08fc8a70 1983 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 1984 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
mbedAustin 11:cada08fc8a70 1985
mbedAustin 11:cada08fc8a70 1986 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 1987 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
mbedAustin 11:cada08fc8a70 1988 {
mbedAustin 11:cada08fc8a70 1989 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1990 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
mbedAustin 11:cada08fc8a70 1991 *p++ = ssl->verify_data_len * 2 & 0xFF;
mbedAustin 11:cada08fc8a70 1992
mbedAustin 11:cada08fc8a70 1993 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
mbedAustin 11:cada08fc8a70 1994 p += ssl->verify_data_len;
mbedAustin 11:cada08fc8a70 1995 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
mbedAustin 11:cada08fc8a70 1996 p += ssl->verify_data_len;
mbedAustin 11:cada08fc8a70 1997 }
mbedAustin 11:cada08fc8a70 1998 else
mbedAustin 11:cada08fc8a70 1999 #endif /* MBEDTLS_SSL_RENEGOTIATION */
mbedAustin 11:cada08fc8a70 2000 {
mbedAustin 11:cada08fc8a70 2001 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 2002 *p++ = 0x01;
mbedAustin 11:cada08fc8a70 2003 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 2004 }
mbedAustin 11:cada08fc8a70 2005
mbedAustin 11:cada08fc8a70 2006 *olen = p - buf;
mbedAustin 11:cada08fc8a70 2007 }
mbedAustin 11:cada08fc8a70 2008
mbedAustin 11:cada08fc8a70 2009 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedAustin 11:cada08fc8a70 2010 static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 2011 unsigned char *buf,
mbedAustin 11:cada08fc8a70 2012 size_t *olen )
mbedAustin 11:cada08fc8a70 2013 {
mbedAustin 11:cada08fc8a70 2014 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 2015
mbedAustin 11:cada08fc8a70 2016 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
mbedAustin 11:cada08fc8a70 2017 {
mbedAustin 11:cada08fc8a70 2018 *olen = 0;
mbedAustin 11:cada08fc8a70 2019 return;
mbedAustin 11:cada08fc8a70 2020 }
mbedAustin 11:cada08fc8a70 2021
mbedAustin 11:cada08fc8a70 2022 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
mbedAustin 11:cada08fc8a70 2023
mbedAustin 11:cada08fc8a70 2024 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2025 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
mbedAustin 11:cada08fc8a70 2026
mbedAustin 11:cada08fc8a70 2027 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 2028 *p++ = 1;
mbedAustin 11:cada08fc8a70 2029
mbedAustin 11:cada08fc8a70 2030 *p++ = ssl->session_negotiate->mfl_code;
mbedAustin 11:cada08fc8a70 2031
mbedAustin 11:cada08fc8a70 2032 *olen = 5;
mbedAustin 11:cada08fc8a70 2033 }
mbedAustin 11:cada08fc8a70 2034 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
mbedAustin 11:cada08fc8a70 2035
mbedAustin 11:cada08fc8a70 2036 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
mbedAustin 11:cada08fc8a70 2037 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 2038 static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 2039 unsigned char *buf,
mbedAustin 11:cada08fc8a70 2040 size_t *olen )
mbedAustin 11:cada08fc8a70 2041 {
mbedAustin 11:cada08fc8a70 2042 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 2043 ((void) ssl);
mbedAustin 11:cada08fc8a70 2044
mbedAustin 11:cada08fc8a70 2045 if( ( ssl->handshake->cli_exts &
mbedAustin 11:cada08fc8a70 2046 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
mbedAustin 11:cada08fc8a70 2047 {
mbedAustin 11:cada08fc8a70 2048 *olen = 0;
mbedAustin 11:cada08fc8a70 2049 return;
mbedAustin 11:cada08fc8a70 2050 }
mbedAustin 11:cada08fc8a70 2051
mbedAustin 11:cada08fc8a70 2052 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
mbedAustin 11:cada08fc8a70 2053
mbedAustin 11:cada08fc8a70 2054 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2055 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
mbedAustin 11:cada08fc8a70 2056
mbedAustin 11:cada08fc8a70 2057 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 2058 *p++ = 2;
mbedAustin 11:cada08fc8a70 2059
mbedAustin 11:cada08fc8a70 2060 *p++ = 1;
mbedAustin 11:cada08fc8a70 2061 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
mbedAustin 11:cada08fc8a70 2062
mbedAustin 11:cada08fc8a70 2063 *olen = 6;
mbedAustin 11:cada08fc8a70 2064 }
mbedAustin 11:cada08fc8a70 2065 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 2066
mbedAustin 11:cada08fc8a70 2067 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 2068 static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 2069 unsigned char *buf,
mbedAustin 11:cada08fc8a70 2070 size_t *olen )
mbedAustin 11:cada08fc8a70 2071 {
mbedAustin 11:cada08fc8a70 2072 int ret;
mbedAustin 11:cada08fc8a70 2073 unsigned char *p = buf;
mbedAustin 11:cada08fc8a70 2074 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
mbedAustin 11:cada08fc8a70 2075 size_t kkpp_len;
mbedAustin 11:cada08fc8a70 2076
mbedAustin 11:cada08fc8a70 2077 *olen = 0;
mbedAustin 11:cada08fc8a70 2078
mbedAustin 11:cada08fc8a70 2079 /* Skip costly computation if not needed */
mbedAustin 11:cada08fc8a70 2080 if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
mbedAustin 11:cada08fc8a70 2081 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
mbedAustin 11:cada08fc8a70 2082 return;
mbedAustin 11:cada08fc8a70 2083
mbedAustin 11:cada08fc8a70 2084 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
mbedAustin 11:cada08fc8a70 2085
mbedAustin 11:cada08fc8a70 2086 if( end - p < 4 )
mbedAustin 11:cada08fc8a70 2087 {
mbedAustin 11:cada08fc8a70 2088 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
mbedAustin 11:cada08fc8a70 2089 return;
mbedAustin 11:cada08fc8a70 2090 }
mbedAustin 11:cada08fc8a70 2091
mbedAustin 11:cada08fc8a70 2092 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2093 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
mbedAustin 11:cada08fc8a70 2094
mbedAustin 11:cada08fc8a70 2095 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
mbedAustin 11:cada08fc8a70 2096 p + 2, end - p - 2, &kkpp_len,
mbedAustin 11:cada08fc8a70 2097 ssl->conf->f_rng, ssl->conf->p_rng );
mbedAustin 11:cada08fc8a70 2098 if( ret != 0 )
mbedAustin 11:cada08fc8a70 2099 {
mbedAustin 11:cada08fc8a70 2100 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
mbedAustin 11:cada08fc8a70 2101 return;
mbedAustin 11:cada08fc8a70 2102 }
mbedAustin 11:cada08fc8a70 2103
mbedAustin 11:cada08fc8a70 2104 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2105 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
mbedAustin 11:cada08fc8a70 2106
mbedAustin 11:cada08fc8a70 2107 *olen = kkpp_len + 4;
mbedAustin 11:cada08fc8a70 2108 }
mbedAustin 11:cada08fc8a70 2109 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 2110
mbedAustin 11:cada08fc8a70 2111 #if defined(MBEDTLS_SSL_ALPN )
mbedAustin 11:cada08fc8a70 2112 static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 2113 unsigned char *buf, size_t *olen )
mbedAustin 11:cada08fc8a70 2114 {
mbedAustin 11:cada08fc8a70 2115 if( ssl->alpn_chosen == NULL )
mbedAustin 11:cada08fc8a70 2116 {
mbedAustin 11:cada08fc8a70 2117 *olen = 0;
mbedAustin 11:cada08fc8a70 2118 return;
mbedAustin 11:cada08fc8a70 2119 }
mbedAustin 11:cada08fc8a70 2120
mbedAustin 11:cada08fc8a70 2121 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
mbedAustin 11:cada08fc8a70 2122
mbedAustin 11:cada08fc8a70 2123 /*
mbedAustin 11:cada08fc8a70 2124 * 0 . 1 ext identifier
mbedAustin 11:cada08fc8a70 2125 * 2 . 3 ext length
mbedAustin 11:cada08fc8a70 2126 * 4 . 5 protocol list length
mbedAustin 11:cada08fc8a70 2127 * 6 . 6 protocol name length
mbedAustin 11:cada08fc8a70 2128 * 7 . 7+n protocol name
mbedAustin 11:cada08fc8a70 2129 */
mbedAustin 11:cada08fc8a70 2130 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2131 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
mbedAustin 11:cada08fc8a70 2132
mbedAustin 11:cada08fc8a70 2133 *olen = 7 + strlen( ssl->alpn_chosen );
mbedAustin 11:cada08fc8a70 2134
mbedAustin 11:cada08fc8a70 2135 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2136 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
mbedAustin 11:cada08fc8a70 2137
mbedAustin 11:cada08fc8a70 2138 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2139 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
mbedAustin 11:cada08fc8a70 2140
mbedAustin 11:cada08fc8a70 2141 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
mbedAustin 11:cada08fc8a70 2142
mbedAustin 11:cada08fc8a70 2143 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
mbedAustin 11:cada08fc8a70 2144 }
mbedAustin 11:cada08fc8a70 2145 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
mbedAustin 11:cada08fc8a70 2146
mbedAustin 11:cada08fc8a70 2147 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
mbedAustin 11:cada08fc8a70 2148 static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 2149 {
mbedAustin 11:cada08fc8a70 2150 int ret;
mbedAustin 11:cada08fc8a70 2151 unsigned char *p = ssl->out_msg + 4;
mbedAustin 11:cada08fc8a70 2152 unsigned char *cookie_len_byte;
mbedAustin 11:cada08fc8a70 2153
mbedAustin 11:cada08fc8a70 2154 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
mbedAustin 11:cada08fc8a70 2155
mbedAustin 11:cada08fc8a70 2156 /*
mbedAustin 11:cada08fc8a70 2157 * struct {
mbedAustin 11:cada08fc8a70 2158 * ProtocolVersion server_version;
mbedAustin 11:cada08fc8a70 2159 * opaque cookie<0..2^8-1>;
mbedAustin 11:cada08fc8a70 2160 * } HelloVerifyRequest;
mbedAustin 11:cada08fc8a70 2161 */
mbedAustin 11:cada08fc8a70 2162
mbedAustin 11:cada08fc8a70 2163 /* The RFC is not clear on this point, but sending the actual negotiated
mbedAustin 11:cada08fc8a70 2164 * version looks like the most interoperable thing to do. */
mbedAustin 11:cada08fc8a70 2165 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
mbedAustin 11:cada08fc8a70 2166 ssl->conf->transport, p );
mbedAustin 11:cada08fc8a70 2167 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
mbedAustin 11:cada08fc8a70 2168 p += 2;
mbedAustin 11:cada08fc8a70 2169
mbedAustin 11:cada08fc8a70 2170 /* If we get here, f_cookie_check is not null */
mbedAustin 11:cada08fc8a70 2171 if( ssl->conf->f_cookie_write == NULL )
mbedAustin 11:cada08fc8a70 2172 {
mbedAustin 11:cada08fc8a70 2173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
mbedAustin 11:cada08fc8a70 2174 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 2175 }
mbedAustin 11:cada08fc8a70 2176
mbedAustin 11:cada08fc8a70 2177 /* Skip length byte until we know the length */
mbedAustin 11:cada08fc8a70 2178 cookie_len_byte = p++;
mbedAustin 11:cada08fc8a70 2179
mbedAustin 11:cada08fc8a70 2180 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
mbedAustin 11:cada08fc8a70 2181 &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
mbedAustin 11:cada08fc8a70 2182 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
mbedAustin 11:cada08fc8a70 2183 {
mbedAustin 11:cada08fc8a70 2184 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
mbedAustin 11:cada08fc8a70 2185 return( ret );
mbedAustin 11:cada08fc8a70 2186 }
mbedAustin 11:cada08fc8a70 2187
mbedAustin 11:cada08fc8a70 2188 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
mbedAustin 11:cada08fc8a70 2189
mbedAustin 11:cada08fc8a70 2190 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
mbedAustin 11:cada08fc8a70 2191
mbedAustin 11:cada08fc8a70 2192 ssl->out_msglen = p - ssl->out_msg;
mbedAustin 11:cada08fc8a70 2193 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
mbedAustin 11:cada08fc8a70 2194 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
mbedAustin 11:cada08fc8a70 2195
mbedAustin 11:cada08fc8a70 2196 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
mbedAustin 11:cada08fc8a70 2197
mbedAustin 11:cada08fc8a70 2198 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 2199 {
mbedAustin 11:cada08fc8a70 2200 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
mbedAustin 11:cada08fc8a70 2201 return( ret );
mbedAustin 11:cada08fc8a70 2202 }
mbedAustin 11:cada08fc8a70 2203
mbedAustin 11:cada08fc8a70 2204 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
mbedAustin 11:cada08fc8a70 2205
mbedAustin 11:cada08fc8a70 2206 return( 0 );
mbedAustin 11:cada08fc8a70 2207 }
mbedAustin 11:cada08fc8a70 2208 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
mbedAustin 11:cada08fc8a70 2209
mbedAustin 11:cada08fc8a70 2210 static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 2211 {
mbedAustin 11:cada08fc8a70 2212 #if defined(MBEDTLS_HAVE_TIME)
mbedAustin 11:cada08fc8a70 2213 time_t t;
mbedAustin 11:cada08fc8a70 2214 #endif
mbedAustin 11:cada08fc8a70 2215 int ret;
mbedAustin 11:cada08fc8a70 2216 size_t olen, ext_len = 0, n;
mbedAustin 11:cada08fc8a70 2217 unsigned char *buf, *p;
mbedAustin 11:cada08fc8a70 2218
mbedAustin 11:cada08fc8a70 2219 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
mbedAustin 11:cada08fc8a70 2220
mbedAustin 11:cada08fc8a70 2221 #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
mbedAustin 11:cada08fc8a70 2222 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
mbedAustin 11:cada08fc8a70 2223 ssl->handshake->verify_cookie_len != 0 )
mbedAustin 11:cada08fc8a70 2224 {
mbedAustin 11:cada08fc8a70 2225 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
mbedAustin 11:cada08fc8a70 2226 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
mbedAustin 11:cada08fc8a70 2227
mbedAustin 11:cada08fc8a70 2228 return( ssl_write_hello_verify_request( ssl ) );
mbedAustin 11:cada08fc8a70 2229 }
mbedAustin 11:cada08fc8a70 2230 #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
mbedAustin 11:cada08fc8a70 2231
mbedAustin 11:cada08fc8a70 2232 if( ssl->conf->f_rng == NULL )
mbedAustin 11:cada08fc8a70 2233 {
mbedAustin 11:cada08fc8a70 2234 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
mbedAustin 11:cada08fc8a70 2235 return( MBEDTLS_ERR_SSL_NO_RNG );
mbedAustin 11:cada08fc8a70 2236 }
mbedAustin 11:cada08fc8a70 2237
mbedAustin 11:cada08fc8a70 2238 /*
mbedAustin 11:cada08fc8a70 2239 * 0 . 0 handshake type
mbedAustin 11:cada08fc8a70 2240 * 1 . 3 handshake length
mbedAustin 11:cada08fc8a70 2241 * 4 . 5 protocol version
mbedAustin 11:cada08fc8a70 2242 * 6 . 9 UNIX time()
mbedAustin 11:cada08fc8a70 2243 * 10 . 37 random bytes
mbedAustin 11:cada08fc8a70 2244 */
mbedAustin 11:cada08fc8a70 2245 buf = ssl->out_msg;
mbedAustin 11:cada08fc8a70 2246 p = buf + 4;
mbedAustin 11:cada08fc8a70 2247
mbedAustin 11:cada08fc8a70 2248 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
mbedAustin 11:cada08fc8a70 2249 ssl->conf->transport, p );
mbedAustin 11:cada08fc8a70 2250 p += 2;
mbedAustin 11:cada08fc8a70 2251
mbedAustin 11:cada08fc8a70 2252 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
mbedAustin 11:cada08fc8a70 2253 buf[4], buf[5] ) );
mbedAustin 11:cada08fc8a70 2254
mbedAustin 11:cada08fc8a70 2255 #if defined(MBEDTLS_HAVE_TIME)
mbedAustin 11:cada08fc8a70 2256 t = time( NULL );
mbedAustin 11:cada08fc8a70 2257 *p++ = (unsigned char)( t >> 24 );
mbedAustin 11:cada08fc8a70 2258 *p++ = (unsigned char)( t >> 16 );
mbedAustin 11:cada08fc8a70 2259 *p++ = (unsigned char)( t >> 8 );
mbedAustin 11:cada08fc8a70 2260 *p++ = (unsigned char)( t );
mbedAustin 11:cada08fc8a70 2261
mbedAustin 11:cada08fc8a70 2262 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
mbedAustin 11:cada08fc8a70 2263 #else
mbedAustin 11:cada08fc8a70 2264 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
mbedAustin 11:cada08fc8a70 2265 return( ret );
mbedAustin 11:cada08fc8a70 2266
mbedAustin 11:cada08fc8a70 2267 p += 4;
mbedAustin 11:cada08fc8a70 2268 #endif /* MBEDTLS_HAVE_TIME */
mbedAustin 11:cada08fc8a70 2269
mbedAustin 11:cada08fc8a70 2270 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
mbedAustin 11:cada08fc8a70 2271 return( ret );
mbedAustin 11:cada08fc8a70 2272
mbedAustin 11:cada08fc8a70 2273 p += 28;
mbedAustin 11:cada08fc8a70 2274
mbedAustin 11:cada08fc8a70 2275 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
mbedAustin 11:cada08fc8a70 2276
mbedAustin 11:cada08fc8a70 2277 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
mbedAustin 11:cada08fc8a70 2278
mbedAustin 11:cada08fc8a70 2279 /*
mbedAustin 11:cada08fc8a70 2280 * Resume is 0 by default, see ssl_handshake_init().
mbedAustin 11:cada08fc8a70 2281 * It may be already set to 1 by ssl_parse_session_ticket_ext().
mbedAustin 11:cada08fc8a70 2282 * If not, try looking up session ID in our cache.
mbedAustin 11:cada08fc8a70 2283 */
mbedAustin 11:cada08fc8a70 2284 if( ssl->handshake->resume == 0 &&
mbedAustin 11:cada08fc8a70 2285 #if defined(MBEDTLS_SSL_RENEGOTIATION)
mbedAustin 11:cada08fc8a70 2286 ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
mbedAustin 11:cada08fc8a70 2287 #endif
mbedAustin 11:cada08fc8a70 2288 ssl->session_negotiate->id_len != 0 &&
mbedAustin 11:cada08fc8a70 2289 ssl->conf->f_get_cache != NULL &&
mbedAustin 11:cada08fc8a70 2290 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
mbedAustin 11:cada08fc8a70 2291 {
mbedAustin 11:cada08fc8a70 2292 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
mbedAustin 11:cada08fc8a70 2293 ssl->handshake->resume = 1;
mbedAustin 11:cada08fc8a70 2294 }
mbedAustin 11:cada08fc8a70 2295
mbedAustin 11:cada08fc8a70 2296 if( ssl->handshake->resume == 0 )
mbedAustin 11:cada08fc8a70 2297 {
mbedAustin 11:cada08fc8a70 2298 /*
mbedAustin 11:cada08fc8a70 2299 * New session, create a new session id,
mbedAustin 11:cada08fc8a70 2300 * unless we're about to issue a session ticket
mbedAustin 11:cada08fc8a70 2301 */
mbedAustin 11:cada08fc8a70 2302 ssl->state++;
mbedAustin 11:cada08fc8a70 2303
mbedAustin 11:cada08fc8a70 2304 #if defined(MBEDTLS_HAVE_TIME)
mbedAustin 11:cada08fc8a70 2305 ssl->session_negotiate->start = time( NULL );
mbedAustin 11:cada08fc8a70 2306 #endif
mbedAustin 11:cada08fc8a70 2307
mbedAustin 11:cada08fc8a70 2308 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 2309 if( ssl->handshake->new_session_ticket != 0 )
mbedAustin 11:cada08fc8a70 2310 {
mbedAustin 11:cada08fc8a70 2311 ssl->session_negotiate->id_len = n = 0;
mbedAustin 11:cada08fc8a70 2312 memset( ssl->session_negotiate->id, 0, 32 );
mbedAustin 11:cada08fc8a70 2313 }
mbedAustin 11:cada08fc8a70 2314 else
mbedAustin 11:cada08fc8a70 2315 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
mbedAustin 11:cada08fc8a70 2316 {
mbedAustin 11:cada08fc8a70 2317 ssl->session_negotiate->id_len = n = 32;
mbedAustin 11:cada08fc8a70 2318 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
mbedAustin 11:cada08fc8a70 2319 n ) ) != 0 )
mbedAustin 11:cada08fc8a70 2320 return( ret );
mbedAustin 11:cada08fc8a70 2321 }
mbedAustin 11:cada08fc8a70 2322 }
mbedAustin 11:cada08fc8a70 2323 else
mbedAustin 11:cada08fc8a70 2324 {
mbedAustin 11:cada08fc8a70 2325 /*
mbedAustin 11:cada08fc8a70 2326 * Resuming a session
mbedAustin 11:cada08fc8a70 2327 */
mbedAustin 11:cada08fc8a70 2328 n = ssl->session_negotiate->id_len;
mbedAustin 11:cada08fc8a70 2329 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
mbedAustin 11:cada08fc8a70 2330
mbedAustin 11:cada08fc8a70 2331 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 2332 {
mbedAustin 11:cada08fc8a70 2333 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
mbedAustin 11:cada08fc8a70 2334 return( ret );
mbedAustin 11:cada08fc8a70 2335 }
mbedAustin 11:cada08fc8a70 2336 }
mbedAustin 11:cada08fc8a70 2337
mbedAustin 11:cada08fc8a70 2338 /*
mbedAustin 11:cada08fc8a70 2339 * 38 . 38 session id length
mbedAustin 11:cada08fc8a70 2340 * 39 . 38+n session id
mbedAustin 11:cada08fc8a70 2341 * 39+n . 40+n chosen ciphersuite
mbedAustin 11:cada08fc8a70 2342 * 41+n . 41+n chosen compression alg.
mbedAustin 11:cada08fc8a70 2343 * 42+n . 43+n extensions length
mbedAustin 11:cada08fc8a70 2344 * 44+n . 43+n+m extensions
mbedAustin 11:cada08fc8a70 2345 */
mbedAustin 11:cada08fc8a70 2346 *p++ = (unsigned char) ssl->session_negotiate->id_len;
mbedAustin 11:cada08fc8a70 2347 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
mbedAustin 11:cada08fc8a70 2348 p += ssl->session_negotiate->id_len;
mbedAustin 11:cada08fc8a70 2349
mbedAustin 11:cada08fc8a70 2350 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
mbedAustin 11:cada08fc8a70 2351 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
mbedAustin 11:cada08fc8a70 2352 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
mbedAustin 11:cada08fc8a70 2353 ssl->handshake->resume ? "a" : "no" ) );
mbedAustin 11:cada08fc8a70 2354
mbedAustin 11:cada08fc8a70 2355 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
mbedAustin 11:cada08fc8a70 2356 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
mbedAustin 11:cada08fc8a70 2357 *p++ = (unsigned char)( ssl->session_negotiate->compression );
mbedAustin 11:cada08fc8a70 2358
mbedAustin 11:cada08fc8a70 2359 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
mbedAustin 11:cada08fc8a70 2360 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
mbedAustin 11:cada08fc8a70 2361 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
mbedAustin 11:cada08fc8a70 2362 ssl->session_negotiate->compression ) );
mbedAustin 11:cada08fc8a70 2363
mbedAustin 11:cada08fc8a70 2364 /*
mbedAustin 11:cada08fc8a70 2365 * First write extensions, then the total length
mbedAustin 11:cada08fc8a70 2366 */
mbedAustin 11:cada08fc8a70 2367 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2368 ext_len += olen;
mbedAustin 11:cada08fc8a70 2369
mbedAustin 11:cada08fc8a70 2370 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
mbedAustin 11:cada08fc8a70 2371 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2372 ext_len += olen;
mbedAustin 11:cada08fc8a70 2373 #endif
mbedAustin 11:cada08fc8a70 2374
mbedAustin 11:cada08fc8a70 2375 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
mbedAustin 11:cada08fc8a70 2376 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2377 ext_len += olen;
mbedAustin 11:cada08fc8a70 2378 #endif
mbedAustin 11:cada08fc8a70 2379
mbedAustin 11:cada08fc8a70 2380 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
mbedAustin 11:cada08fc8a70 2381 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2382 ext_len += olen;
mbedAustin 11:cada08fc8a70 2383 #endif
mbedAustin 11:cada08fc8a70 2384
mbedAustin 11:cada08fc8a70 2385 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
mbedAustin 11:cada08fc8a70 2386 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2387 ext_len += olen;
mbedAustin 11:cada08fc8a70 2388 #endif
mbedAustin 11:cada08fc8a70 2389
mbedAustin 11:cada08fc8a70 2390 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 2391 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2392 ext_len += olen;
mbedAustin 11:cada08fc8a70 2393 #endif
mbedAustin 11:cada08fc8a70 2394
mbedAustin 11:cada08fc8a70 2395 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
mbedAustin 11:cada08fc8a70 2396 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 2397 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2398 ext_len += olen;
mbedAustin 11:cada08fc8a70 2399 #endif
mbedAustin 11:cada08fc8a70 2400
mbedAustin 11:cada08fc8a70 2401 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 2402 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2403 ext_len += olen;
mbedAustin 11:cada08fc8a70 2404 #endif
mbedAustin 11:cada08fc8a70 2405
mbedAustin 11:cada08fc8a70 2406 #if defined(MBEDTLS_SSL_ALPN)
mbedAustin 11:cada08fc8a70 2407 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
mbedAustin 11:cada08fc8a70 2408 ext_len += olen;
mbedAustin 11:cada08fc8a70 2409 #endif
mbedAustin 11:cada08fc8a70 2410
mbedAustin 11:cada08fc8a70 2411 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
mbedAustin 11:cada08fc8a70 2412
mbedAustin 11:cada08fc8a70 2413 if( ext_len > 0 )
mbedAustin 11:cada08fc8a70 2414 {
mbedAustin 11:cada08fc8a70 2415 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 2416 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
mbedAustin 11:cada08fc8a70 2417 p += ext_len;
mbedAustin 11:cada08fc8a70 2418 }
mbedAustin 11:cada08fc8a70 2419
mbedAustin 11:cada08fc8a70 2420 ssl->out_msglen = p - buf;
mbedAustin 11:cada08fc8a70 2421 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
mbedAustin 11:cada08fc8a70 2422 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
mbedAustin 11:cada08fc8a70 2423
mbedAustin 11:cada08fc8a70 2424 ret = mbedtls_ssl_write_record( ssl );
mbedAustin 11:cada08fc8a70 2425
mbedAustin 11:cada08fc8a70 2426 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
mbedAustin 11:cada08fc8a70 2427
mbedAustin 11:cada08fc8a70 2428 return( ret );
mbedAustin 11:cada08fc8a70 2429 }
mbedAustin 11:cada08fc8a70 2430
mbedAustin 11:cada08fc8a70 2431 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
mbedAustin 11:cada08fc8a70 2432 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
mbedAustin 11:cada08fc8a70 2433 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
mbedAustin 11:cada08fc8a70 2434 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
mbedAustin 11:cada08fc8a70 2435 static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 2436 {
mbedAustin 11:cada08fc8a70 2437 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
mbedAustin 11:cada08fc8a70 2438
mbedAustin 11:cada08fc8a70 2439 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
mbedAustin 11:cada08fc8a70 2440
mbedAustin 11:cada08fc8a70 2441 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
mbedAustin 11:cada08fc8a70 2442 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
mbedAustin 11:cada08fc8a70 2443 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
mbedAustin 11:cada08fc8a70 2444 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
mbedAustin 11:cada08fc8a70 2445 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
mbedAustin 11:cada08fc8a70 2446 {
mbedAustin 11:cada08fc8a70 2447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
mbedAustin 11:cada08fc8a70 2448 ssl->state++;
mbedAustin 11:cada08fc8a70 2449 return( 0 );
mbedAustin 11:cada08fc8a70 2450 }
mbedAustin 11:cada08fc8a70 2451
mbedAustin 11:cada08fc8a70 2452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 2453 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 2454 }
mbedAustin 11:cada08fc8a70 2455 #else
mbedAustin 11:cada08fc8a70 2456 static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 2457 {
mbedAustin 11:cada08fc8a70 2458 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
mbedAustin 11:cada08fc8a70 2459 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
mbedAustin 11:cada08fc8a70 2460 size_t dn_size, total_dn_size; /* excluding length bytes */
mbedAustin 11:cada08fc8a70 2461 size_t ct_len, sa_len; /* including length bytes */
mbedAustin 11:cada08fc8a70 2462 unsigned char *buf, *p;
mbedAustin 11:cada08fc8a70 2463 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
mbedAustin 11:cada08fc8a70 2464 const mbedtls_x509_crt *crt;
mbedAustin 11:cada08fc8a70 2465 int authmode;
mbedAustin 11:cada08fc8a70 2466
mbedAustin 11:cada08fc8a70 2467 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
mbedAustin 11:cada08fc8a70 2468
mbedAustin 11:cada08fc8a70 2469 ssl->state++;
mbedAustin 11:cada08fc8a70 2470
mbedAustin 11:cada08fc8a70 2471 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedAustin 11:cada08fc8a70 2472 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
mbedAustin 11:cada08fc8a70 2473 authmode = ssl->handshake->sni_authmode;
mbedAustin 11:cada08fc8a70 2474 else
mbedAustin 11:cada08fc8a70 2475 #endif
mbedAustin 11:cada08fc8a70 2476 authmode = ssl->conf->authmode;
mbedAustin 11:cada08fc8a70 2477
mbedAustin 11:cada08fc8a70 2478 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
mbedAustin 11:cada08fc8a70 2479 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
mbedAustin 11:cada08fc8a70 2480 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
mbedAustin 11:cada08fc8a70 2481 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
mbedAustin 11:cada08fc8a70 2482 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
mbedAustin 11:cada08fc8a70 2483 authmode == MBEDTLS_SSL_VERIFY_NONE )
mbedAustin 11:cada08fc8a70 2484 {
mbedAustin 11:cada08fc8a70 2485 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
mbedAustin 11:cada08fc8a70 2486 return( 0 );
mbedAustin 11:cada08fc8a70 2487 }
mbedAustin 11:cada08fc8a70 2488
mbedAustin 11:cada08fc8a70 2489 /*
mbedAustin 11:cada08fc8a70 2490 * 0 . 0 handshake type
mbedAustin 11:cada08fc8a70 2491 * 1 . 3 handshake length
mbedAustin 11:cada08fc8a70 2492 * 4 . 4 cert type count
mbedAustin 11:cada08fc8a70 2493 * 5 .. m-1 cert types
mbedAustin 11:cada08fc8a70 2494 * m .. m+1 sig alg length (TLS 1.2 only)
mbedAustin 11:cada08fc8a70 2495 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
mbedAustin 11:cada08fc8a70 2496 * n .. n+1 length of all DNs
mbedAustin 11:cada08fc8a70 2497 * n+2 .. n+3 length of DN 1
mbedAustin 11:cada08fc8a70 2498 * n+4 .. ... Distinguished Name #1
mbedAustin 11:cada08fc8a70 2499 * ... .. ... length of DN 2, etc.
mbedAustin 11:cada08fc8a70 2500 */
mbedAustin 11:cada08fc8a70 2501 buf = ssl->out_msg;
mbedAustin 11:cada08fc8a70 2502 p = buf + 4;
mbedAustin 11:cada08fc8a70 2503
mbedAustin 11:cada08fc8a70 2504 /*
mbedAustin 11:cada08fc8a70 2505 * Supported certificate types
mbedAustin 11:cada08fc8a70 2506 *
mbedAustin 11:cada08fc8a70 2507 * ClientCertificateType certificate_types<1..2^8-1>;
mbedAustin 11:cada08fc8a70 2508 * enum { (255) } ClientCertificateType;
mbedAustin 11:cada08fc8a70 2509 */
mbedAustin 11:cada08fc8a70 2510 ct_len = 0;
mbedAustin 11:cada08fc8a70 2511
mbedAustin 11:cada08fc8a70 2512 #if defined(MBEDTLS_RSA_C)
mbedAustin 11:cada08fc8a70 2513 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
mbedAustin 11:cada08fc8a70 2514 #endif
mbedAustin 11:cada08fc8a70 2515 #if defined(MBEDTLS_ECDSA_C)
mbedAustin 11:cada08fc8a70 2516 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
mbedAustin 11:cada08fc8a70 2517 #endif
mbedAustin 11:cada08fc8a70 2518
mbedAustin 11:cada08fc8a70 2519 p[0] = (unsigned char) ct_len++;
mbedAustin 11:cada08fc8a70 2520 p += ct_len;
mbedAustin 11:cada08fc8a70 2521
mbedAustin 11:cada08fc8a70 2522 sa_len = 0;
mbedAustin 11:cada08fc8a70 2523 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 2524 /*
mbedAustin 11:cada08fc8a70 2525 * Add signature_algorithms for verify (TLS 1.2)
mbedAustin 11:cada08fc8a70 2526 *
mbedAustin 11:cada08fc8a70 2527 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
mbedAustin 11:cada08fc8a70 2528 *
mbedAustin 11:cada08fc8a70 2529 * struct {
mbedAustin 11:cada08fc8a70 2530 * HashAlgorithm hash;
mbedAustin 11:cada08fc8a70 2531 * SignatureAlgorithm signature;
mbedAustin 11:cada08fc8a70 2532 * } SignatureAndHashAlgorithm;
mbedAustin 11:cada08fc8a70 2533 *
mbedAustin 11:cada08fc8a70 2534 * enum { (255) } HashAlgorithm;
mbedAustin 11:cada08fc8a70 2535 * enum { (255) } SignatureAlgorithm;
mbedAustin 11:cada08fc8a70 2536 */
mbedAustin 11:cada08fc8a70 2537 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 2538 {
mbedAustin 11:cada08fc8a70 2539 /*
mbedAustin 11:cada08fc8a70 2540 * Only use current running hash algorithm that is already required
mbedAustin 11:cada08fc8a70 2541 * for requested ciphersuite.
mbedAustin 11:cada08fc8a70 2542 */
mbedAustin 11:cada08fc8a70 2543 ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256;
mbedAustin 11:cada08fc8a70 2544
mbedAustin 11:cada08fc8a70 2545 if( ssl->transform_negotiate->ciphersuite_info->mac ==
mbedAustin 11:cada08fc8a70 2546 MBEDTLS_MD_SHA384 )
mbedAustin 11:cada08fc8a70 2547 {
mbedAustin 11:cada08fc8a70 2548 ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384;
mbedAustin 11:cada08fc8a70 2549 }
mbedAustin 11:cada08fc8a70 2550
mbedAustin 11:cada08fc8a70 2551 /*
mbedAustin 11:cada08fc8a70 2552 * Supported signature algorithms
mbedAustin 11:cada08fc8a70 2553 */
mbedAustin 11:cada08fc8a70 2554 #if defined(MBEDTLS_RSA_C)
mbedAustin 11:cada08fc8a70 2555 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
mbedAustin 11:cada08fc8a70 2556 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
mbedAustin 11:cada08fc8a70 2557 #endif
mbedAustin 11:cada08fc8a70 2558 #if defined(MBEDTLS_ECDSA_C)
mbedAustin 11:cada08fc8a70 2559 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
mbedAustin 11:cada08fc8a70 2560 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
mbedAustin 11:cada08fc8a70 2561 #endif
mbedAustin 11:cada08fc8a70 2562
mbedAustin 11:cada08fc8a70 2563 p[0] = (unsigned char)( sa_len >> 8 );
mbedAustin 11:cada08fc8a70 2564 p[1] = (unsigned char)( sa_len );
mbedAustin 11:cada08fc8a70 2565 sa_len += 2;
mbedAustin 11:cada08fc8a70 2566 p += sa_len;
mbedAustin 11:cada08fc8a70 2567 }
mbedAustin 11:cada08fc8a70 2568 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
mbedAustin 11:cada08fc8a70 2569
mbedAustin 11:cada08fc8a70 2570 /*
mbedAustin 11:cada08fc8a70 2571 * DistinguishedName certificate_authorities<0..2^16-1>;
mbedAustin 11:cada08fc8a70 2572 * opaque DistinguishedName<1..2^16-1>;
mbedAustin 11:cada08fc8a70 2573 */
mbedAustin 11:cada08fc8a70 2574 p += 2;
mbedAustin 11:cada08fc8a70 2575 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
mbedAustin 11:cada08fc8a70 2576 if( ssl->handshake->sni_ca_chain != NULL )
mbedAustin 11:cada08fc8a70 2577 crt = ssl->handshake->sni_ca_chain;
mbedAustin 11:cada08fc8a70 2578 else
mbedAustin 11:cada08fc8a70 2579 #endif
mbedAustin 11:cada08fc8a70 2580 crt = ssl->conf->ca_chain;
mbedAustin 11:cada08fc8a70 2581
mbedAustin 11:cada08fc8a70 2582 total_dn_size = 0;
mbedAustin 11:cada08fc8a70 2583 while( crt != NULL && crt->version != 0 )
mbedAustin 11:cada08fc8a70 2584 {
mbedAustin 11:cada08fc8a70 2585 dn_size = crt->subject_raw.len;
mbedAustin 11:cada08fc8a70 2586
mbedAustin 11:cada08fc8a70 2587 if( end < p || (size_t)( end - p ) < 2 + dn_size )
mbedAustin 11:cada08fc8a70 2588 {
mbedAustin 11:cada08fc8a70 2589 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
mbedAustin 11:cada08fc8a70 2590 break;
mbedAustin 11:cada08fc8a70 2591 }
mbedAustin 11:cada08fc8a70 2592
mbedAustin 11:cada08fc8a70 2593 *p++ = (unsigned char)( dn_size >> 8 );
mbedAustin 11:cada08fc8a70 2594 *p++ = (unsigned char)( dn_size );
mbedAustin 11:cada08fc8a70 2595 memcpy( p, crt->subject_raw.p, dn_size );
mbedAustin 11:cada08fc8a70 2596 p += dn_size;
mbedAustin 11:cada08fc8a70 2597
mbedAustin 11:cada08fc8a70 2598 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
mbedAustin 11:cada08fc8a70 2599
mbedAustin 11:cada08fc8a70 2600 total_dn_size += 2 + dn_size;
mbedAustin 11:cada08fc8a70 2601 crt = crt->next;
mbedAustin 11:cada08fc8a70 2602 }
mbedAustin 11:cada08fc8a70 2603
mbedAustin 11:cada08fc8a70 2604 ssl->out_msglen = p - buf;
mbedAustin 11:cada08fc8a70 2605 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
mbedAustin 11:cada08fc8a70 2606 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
mbedAustin 11:cada08fc8a70 2607 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
mbedAustin 11:cada08fc8a70 2608 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
mbedAustin 11:cada08fc8a70 2609
mbedAustin 11:cada08fc8a70 2610 ret = mbedtls_ssl_write_record( ssl );
mbedAustin 11:cada08fc8a70 2611
mbedAustin 11:cada08fc8a70 2612 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
mbedAustin 11:cada08fc8a70 2613
mbedAustin 11:cada08fc8a70 2614 return( ret );
mbedAustin 11:cada08fc8a70 2615 }
mbedAustin 11:cada08fc8a70 2616 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
mbedAustin 11:cada08fc8a70 2617 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
mbedAustin 11:cada08fc8a70 2618 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
mbedAustin 11:cada08fc8a70 2619 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
mbedAustin 11:cada08fc8a70 2620
mbedAustin 11:cada08fc8a70 2621 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2622 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
mbedAustin 11:cada08fc8a70 2623 static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 2624 {
mbedAustin 11:cada08fc8a70 2625 int ret;
mbedAustin 11:cada08fc8a70 2626
mbedAustin 11:cada08fc8a70 2627 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
mbedAustin 11:cada08fc8a70 2628 {
mbedAustin 11:cada08fc8a70 2629 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
mbedAustin 11:cada08fc8a70 2630 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
mbedAustin 11:cada08fc8a70 2631 }
mbedAustin 11:cada08fc8a70 2632
mbedAustin 11:cada08fc8a70 2633 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
mbedAustin 11:cada08fc8a70 2634 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
mbedAustin 11:cada08fc8a70 2635 MBEDTLS_ECDH_OURS ) ) != 0 )
mbedAustin 11:cada08fc8a70 2636 {
mbedAustin 11:cada08fc8a70 2637 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
mbedAustin 11:cada08fc8a70 2638 return( ret );
mbedAustin 11:cada08fc8a70 2639 }
mbedAustin 11:cada08fc8a70 2640
mbedAustin 11:cada08fc8a70 2641 return( 0 );
mbedAustin 11:cada08fc8a70 2642 }
mbedAustin 11:cada08fc8a70 2643 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
mbedAustin 11:cada08fc8a70 2644 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
mbedAustin 11:cada08fc8a70 2645
mbedAustin 11:cada08fc8a70 2646 static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 2647 {
mbedAustin 11:cada08fc8a70 2648 int ret;
mbedAustin 11:cada08fc8a70 2649 size_t n = 0;
mbedAustin 11:cada08fc8a70 2650 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
mbedAustin 11:cada08fc8a70 2651 ssl->transform_negotiate->ciphersuite_info;
mbedAustin 11:cada08fc8a70 2652
mbedAustin 11:cada08fc8a70 2653 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2654 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
mbedAustin 11:cada08fc8a70 2655 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2656 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
mbedAustin 11:cada08fc8a70 2657 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2658 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 2659 unsigned char *p = ssl->out_msg + 4;
mbedAustin 11:cada08fc8a70 2660 unsigned char *dig_signed = p;
mbedAustin 11:cada08fc8a70 2661 size_t dig_signed_len = 0, len;
mbedAustin 11:cada08fc8a70 2662 ((void) dig_signed);
mbedAustin 11:cada08fc8a70 2663 ((void) dig_signed_len);
mbedAustin 11:cada08fc8a70 2664 ((void) len);
mbedAustin 11:cada08fc8a70 2665 #endif
mbedAustin 11:cada08fc8a70 2666
mbedAustin 11:cada08fc8a70 2667 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
mbedAustin 11:cada08fc8a70 2668
mbedAustin 11:cada08fc8a70 2669 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2670 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
mbedAustin 11:cada08fc8a70 2671 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 2672 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ||
mbedAustin 11:cada08fc8a70 2673 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
mbedAustin 11:cada08fc8a70 2674 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
mbedAustin 11:cada08fc8a70 2675 {
mbedAustin 11:cada08fc8a70 2676 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
mbedAustin 11:cada08fc8a70 2677 ssl->state++;
mbedAustin 11:cada08fc8a70 2678 return( 0 );
mbedAustin 11:cada08fc8a70 2679 }
mbedAustin 11:cada08fc8a70 2680 #endif
mbedAustin 11:cada08fc8a70 2681
mbedAustin 11:cada08fc8a70 2682 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2683 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
mbedAustin 11:cada08fc8a70 2684 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
mbedAustin 11:cada08fc8a70 2685 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
mbedAustin 11:cada08fc8a70 2686 {
mbedAustin 11:cada08fc8a70 2687 ssl_get_ecdh_params_from_cert( ssl );
mbedAustin 11:cada08fc8a70 2688
mbedAustin 11:cada08fc8a70 2689 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
mbedAustin 11:cada08fc8a70 2690 ssl->state++;
mbedAustin 11:cada08fc8a70 2691 return( 0 );
mbedAustin 11:cada08fc8a70 2692 }
mbedAustin 11:cada08fc8a70 2693 #endif
mbedAustin 11:cada08fc8a70 2694
mbedAustin 11:cada08fc8a70 2695 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 2696 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
mbedAustin 11:cada08fc8a70 2697 {
mbedAustin 11:cada08fc8a70 2698 size_t jlen;
mbedAustin 11:cada08fc8a70 2699 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
mbedAustin 11:cada08fc8a70 2700
mbedAustin 11:cada08fc8a70 2701 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
mbedAustin 11:cada08fc8a70 2702 p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng );
mbedAustin 11:cada08fc8a70 2703 if( ret != 0 )
mbedAustin 11:cada08fc8a70 2704 {
mbedAustin 11:cada08fc8a70 2705 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
mbedAustin 11:cada08fc8a70 2706 return( ret );
mbedAustin 11:cada08fc8a70 2707 }
mbedAustin 11:cada08fc8a70 2708
mbedAustin 11:cada08fc8a70 2709 p += jlen;
mbedAustin 11:cada08fc8a70 2710 n += jlen;
mbedAustin 11:cada08fc8a70 2711 }
mbedAustin 11:cada08fc8a70 2712 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 2713
mbedAustin 11:cada08fc8a70 2714 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
mbedAustin 11:cada08fc8a70 2715 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 2716 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
mbedAustin 11:cada08fc8a70 2717 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
mbedAustin 11:cada08fc8a70 2718 {
mbedAustin 11:cada08fc8a70 2719 /* TODO: Support identity hints */
mbedAustin 11:cada08fc8a70 2720 *(p++) = 0x00;
mbedAustin 11:cada08fc8a70 2721 *(p++) = 0x00;
mbedAustin 11:cada08fc8a70 2722
mbedAustin 11:cada08fc8a70 2723 n += 2;
mbedAustin 11:cada08fc8a70 2724 }
mbedAustin 11:cada08fc8a70 2725 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
mbedAustin 11:cada08fc8a70 2726 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 2727
mbedAustin 11:cada08fc8a70 2728 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2729 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 2730 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
mbedAustin 11:cada08fc8a70 2731 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
mbedAustin 11:cada08fc8a70 2732 {
mbedAustin 11:cada08fc8a70 2733 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
mbedAustin 11:cada08fc8a70 2734 {
mbedAustin 11:cada08fc8a70 2735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
mbedAustin 11:cada08fc8a70 2736 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 2737 }
mbedAustin 11:cada08fc8a70 2738
mbedAustin 11:cada08fc8a70 2739 /*
mbedAustin 11:cada08fc8a70 2740 * Ephemeral DH parameters:
mbedAustin 11:cada08fc8a70 2741 *
mbedAustin 11:cada08fc8a70 2742 * struct {
mbedAustin 11:cada08fc8a70 2743 * opaque dh_p<1..2^16-1>;
mbedAustin 11:cada08fc8a70 2744 * opaque dh_g<1..2^16-1>;
mbedAustin 11:cada08fc8a70 2745 * opaque dh_Ys<1..2^16-1>;
mbedAustin 11:cada08fc8a70 2746 * } ServerDHParams;
mbedAustin 11:cada08fc8a70 2747 */
mbedAustin 11:cada08fc8a70 2748 if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 ||
mbedAustin 11:cada08fc8a70 2749 ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
mbedAustin 11:cada08fc8a70 2750 {
mbedAustin 11:cada08fc8a70 2751 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
mbedAustin 11:cada08fc8a70 2752 return( ret );
mbedAustin 11:cada08fc8a70 2753 }
mbedAustin 11:cada08fc8a70 2754
mbedAustin 11:cada08fc8a70 2755 if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
mbedAustin 11:cada08fc8a70 2756 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
mbedAustin 11:cada08fc8a70 2757 p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
mbedAustin 11:cada08fc8a70 2758 {
mbedAustin 11:cada08fc8a70 2759 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
mbedAustin 11:cada08fc8a70 2760 return( ret );
mbedAustin 11:cada08fc8a70 2761 }
mbedAustin 11:cada08fc8a70 2762
mbedAustin 11:cada08fc8a70 2763 dig_signed = p;
mbedAustin 11:cada08fc8a70 2764 dig_signed_len = len;
mbedAustin 11:cada08fc8a70 2765
mbedAustin 11:cada08fc8a70 2766 p += len;
mbedAustin 11:cada08fc8a70 2767 n += len;
mbedAustin 11:cada08fc8a70 2768
mbedAustin 11:cada08fc8a70 2769 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
mbedAustin 11:cada08fc8a70 2770 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
mbedAustin 11:cada08fc8a70 2771 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
mbedAustin 11:cada08fc8a70 2772 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
mbedAustin 11:cada08fc8a70 2773 }
mbedAustin 11:cada08fc8a70 2774 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
mbedAustin 11:cada08fc8a70 2775 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 2776
mbedAustin 11:cada08fc8a70 2777 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
mbedAustin 11:cada08fc8a70 2778 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
mbedAustin 11:cada08fc8a70 2779 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
mbedAustin 11:cada08fc8a70 2780 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
mbedAustin 11:cada08fc8a70 2781 {
mbedAustin 11:cada08fc8a70 2782 /*
mbedAustin 11:cada08fc8a70 2783 * Ephemeral ECDH parameters:
mbedAustin 11:cada08fc8a70 2784 *
mbedAustin 11:cada08fc8a70 2785 * struct {
mbedAustin 11:cada08fc8a70 2786 * ECParameters curve_params;
mbedAustin 11:cada08fc8a70 2787 * ECPoint public;
mbedAustin 11:cada08fc8a70 2788 * } ServerECDHParams;
mbedAustin 11:cada08fc8a70 2789 */
mbedAustin 11:cada08fc8a70 2790 const mbedtls_ecp_curve_info **curve = NULL;
mbedAustin 11:cada08fc8a70 2791 const mbedtls_ecp_group_id *gid;
mbedAustin 11:cada08fc8a70 2792
mbedAustin 11:cada08fc8a70 2793 /* Match our preference list against the offered curves */
mbedAustin 11:cada08fc8a70 2794 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
mbedAustin 11:cada08fc8a70 2795 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
mbedAustin 11:cada08fc8a70 2796 if( (*curve)->grp_id == *gid )
mbedAustin 11:cada08fc8a70 2797 goto curve_matching_done;
mbedAustin 11:cada08fc8a70 2798
mbedAustin 11:cada08fc8a70 2799 curve_matching_done:
mbedAustin 11:cada08fc8a70 2800 if( curve == NULL || *curve == NULL )
mbedAustin 11:cada08fc8a70 2801 {
mbedAustin 11:cada08fc8a70 2802 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
mbedAustin 11:cada08fc8a70 2803 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
mbedAustin 11:cada08fc8a70 2804 }
mbedAustin 11:cada08fc8a70 2805
mbedAustin 11:cada08fc8a70 2806 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
mbedAustin 11:cada08fc8a70 2807
mbedAustin 11:cada08fc8a70 2808 if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
mbedAustin 11:cada08fc8a70 2809 (*curve)->grp_id ) ) != 0 )
mbedAustin 11:cada08fc8a70 2810 {
mbedAustin 11:cada08fc8a70 2811 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
mbedAustin 11:cada08fc8a70 2812 return( ret );
mbedAustin 11:cada08fc8a70 2813 }
mbedAustin 11:cada08fc8a70 2814
mbedAustin 11:cada08fc8a70 2815 if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
mbedAustin 11:cada08fc8a70 2816 p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
mbedAustin 11:cada08fc8a70 2817 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
mbedAustin 11:cada08fc8a70 2818 {
mbedAustin 11:cada08fc8a70 2819 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
mbedAustin 11:cada08fc8a70 2820 return( ret );
mbedAustin 11:cada08fc8a70 2821 }
mbedAustin 11:cada08fc8a70 2822
mbedAustin 11:cada08fc8a70 2823 dig_signed = p;
mbedAustin 11:cada08fc8a70 2824 dig_signed_len = len;
mbedAustin 11:cada08fc8a70 2825
mbedAustin 11:cada08fc8a70 2826 p += len;
mbedAustin 11:cada08fc8a70 2827 n += len;
mbedAustin 11:cada08fc8a70 2828
mbedAustin 11:cada08fc8a70 2829 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
mbedAustin 11:cada08fc8a70 2830 }
mbedAustin 11:cada08fc8a70 2831 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
mbedAustin 11:cada08fc8a70 2832
mbedAustin 11:cada08fc8a70 2833 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2834 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 2835 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
mbedAustin 11:cada08fc8a70 2836 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
mbedAustin 11:cada08fc8a70 2837 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
mbedAustin 11:cada08fc8a70 2838 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
mbedAustin 11:cada08fc8a70 2839 {
mbedAustin 11:cada08fc8a70 2840 size_t signature_len = 0;
mbedAustin 11:cada08fc8a70 2841 unsigned int hashlen = 0;
mbedAustin 11:cada08fc8a70 2842 unsigned char hash[64];
mbedAustin 11:cada08fc8a70 2843 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
mbedAustin 11:cada08fc8a70 2844
mbedAustin 11:cada08fc8a70 2845 /*
mbedAustin 11:cada08fc8a70 2846 * Choose hash algorithm. NONE means MD5 + SHA1 here.
mbedAustin 11:cada08fc8a70 2847 */
mbedAustin 11:cada08fc8a70 2848 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 2849 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 2850 {
mbedAustin 11:cada08fc8a70 2851 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
mbedAustin 11:cada08fc8a70 2852
mbedAustin 11:cada08fc8a70 2853 if( md_alg == MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 2854 {
mbedAustin 11:cada08fc8a70 2855 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 2856 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 2857 }
mbedAustin 11:cada08fc8a70 2858 }
mbedAustin 11:cada08fc8a70 2859 else
mbedAustin 11:cada08fc8a70 2860 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
mbedAustin 11:cada08fc8a70 2861 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
mbedAustin 11:cada08fc8a70 2862 defined(MBEDTLS_SSL_PROTO_TLS1_1)
mbedAustin 11:cada08fc8a70 2863 if( ciphersuite_info->key_exchange ==
mbedAustin 11:cada08fc8a70 2864 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
mbedAustin 11:cada08fc8a70 2865 {
mbedAustin 11:cada08fc8a70 2866 md_alg = MBEDTLS_MD_SHA1;
mbedAustin 11:cada08fc8a70 2867 }
mbedAustin 11:cada08fc8a70 2868 else
mbedAustin 11:cada08fc8a70 2869 #endif
mbedAustin 11:cada08fc8a70 2870 {
mbedAustin 11:cada08fc8a70 2871 md_alg = MBEDTLS_MD_NONE;
mbedAustin 11:cada08fc8a70 2872 }
mbedAustin 11:cada08fc8a70 2873
mbedAustin 11:cada08fc8a70 2874 /*
mbedAustin 11:cada08fc8a70 2875 * Compute the hash to be signed
mbedAustin 11:cada08fc8a70 2876 */
mbedAustin 11:cada08fc8a70 2877 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
mbedAustin 11:cada08fc8a70 2878 defined(MBEDTLS_SSL_PROTO_TLS1_1)
mbedAustin 11:cada08fc8a70 2879 if( md_alg == MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 2880 {
mbedAustin 11:cada08fc8a70 2881 mbedtls_md5_context mbedtls_md5;
mbedAustin 11:cada08fc8a70 2882 mbedtls_sha1_context mbedtls_sha1;
mbedAustin 11:cada08fc8a70 2883
mbedAustin 11:cada08fc8a70 2884 mbedtls_md5_init( &mbedtls_md5 );
mbedAustin 11:cada08fc8a70 2885 mbedtls_sha1_init( &mbedtls_sha1 );
mbedAustin 11:cada08fc8a70 2886
mbedAustin 11:cada08fc8a70 2887 /*
mbedAustin 11:cada08fc8a70 2888 * digitally-signed struct {
mbedAustin 11:cada08fc8a70 2889 * opaque md5_hash[16];
mbedAustin 11:cada08fc8a70 2890 * opaque sha_hash[20];
mbedAustin 11:cada08fc8a70 2891 * };
mbedAustin 11:cada08fc8a70 2892 *
mbedAustin 11:cada08fc8a70 2893 * md5_hash
mbedAustin 11:cada08fc8a70 2894 * MD5(ClientHello.random + ServerHello.random
mbedAustin 11:cada08fc8a70 2895 * + ServerParams);
mbedAustin 11:cada08fc8a70 2896 * sha_hash
mbedAustin 11:cada08fc8a70 2897 * SHA(ClientHello.random + ServerHello.random
mbedAustin 11:cada08fc8a70 2898 * + ServerParams);
mbedAustin 11:cada08fc8a70 2899 */
mbedAustin 11:cada08fc8a70 2900 mbedtls_md5_starts( &mbedtls_md5 );
mbedAustin 11:cada08fc8a70 2901 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
mbedAustin 11:cada08fc8a70 2902 mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
mbedAustin 11:cada08fc8a70 2903 mbedtls_md5_finish( &mbedtls_md5, hash );
mbedAustin 11:cada08fc8a70 2904
mbedAustin 11:cada08fc8a70 2905 mbedtls_sha1_starts( &mbedtls_sha1 );
mbedAustin 11:cada08fc8a70 2906 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
mbedAustin 11:cada08fc8a70 2907 mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
mbedAustin 11:cada08fc8a70 2908 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
mbedAustin 11:cada08fc8a70 2909
mbedAustin 11:cada08fc8a70 2910 hashlen = 36;
mbedAustin 11:cada08fc8a70 2911
mbedAustin 11:cada08fc8a70 2912 mbedtls_md5_free( &mbedtls_md5 );
mbedAustin 11:cada08fc8a70 2913 mbedtls_sha1_free( &mbedtls_sha1 );
mbedAustin 11:cada08fc8a70 2914 }
mbedAustin 11:cada08fc8a70 2915 else
mbedAustin 11:cada08fc8a70 2916 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
mbedAustin 11:cada08fc8a70 2917 MBEDTLS_SSL_PROTO_TLS1_1 */
mbedAustin 11:cada08fc8a70 2918 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
mbedAustin 11:cada08fc8a70 2919 defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 2920 if( md_alg != MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 2921 {
mbedAustin 11:cada08fc8a70 2922 mbedtls_md_context_t ctx;
mbedAustin 11:cada08fc8a70 2923 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
mbedAustin 11:cada08fc8a70 2924
mbedAustin 11:cada08fc8a70 2925 mbedtls_md_init( &ctx );
mbedAustin 11:cada08fc8a70 2926
mbedAustin 11:cada08fc8a70 2927 /* Info from md_alg will be used instead */
mbedAustin 11:cada08fc8a70 2928 hashlen = 0;
mbedAustin 11:cada08fc8a70 2929
mbedAustin 11:cada08fc8a70 2930 /*
mbedAustin 11:cada08fc8a70 2931 * digitally-signed struct {
mbedAustin 11:cada08fc8a70 2932 * opaque client_random[32];
mbedAustin 11:cada08fc8a70 2933 * opaque server_random[32];
mbedAustin 11:cada08fc8a70 2934 * ServerDHParams params;
mbedAustin 11:cada08fc8a70 2935 * };
mbedAustin 11:cada08fc8a70 2936 */
mbedAustin 11:cada08fc8a70 2937 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
mbedAustin 11:cada08fc8a70 2938 {
mbedAustin 11:cada08fc8a70 2939 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
mbedAustin 11:cada08fc8a70 2940 return( ret );
mbedAustin 11:cada08fc8a70 2941 }
mbedAustin 11:cada08fc8a70 2942
mbedAustin 11:cada08fc8a70 2943 mbedtls_md_starts( &ctx );
mbedAustin 11:cada08fc8a70 2944 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
mbedAustin 11:cada08fc8a70 2945 mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
mbedAustin 11:cada08fc8a70 2946 mbedtls_md_finish( &ctx, hash );
mbedAustin 11:cada08fc8a70 2947 mbedtls_md_free( &ctx );
mbedAustin 11:cada08fc8a70 2948 }
mbedAustin 11:cada08fc8a70 2949 else
mbedAustin 11:cada08fc8a70 2950 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
mbedAustin 11:cada08fc8a70 2951 MBEDTLS_SSL_PROTO_TLS1_2 */
mbedAustin 11:cada08fc8a70 2952 {
mbedAustin 11:cada08fc8a70 2953 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 2954 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 2955 }
mbedAustin 11:cada08fc8a70 2956
mbedAustin 11:cada08fc8a70 2957 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
mbedAustin 11:cada08fc8a70 2958 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
mbedAustin 11:cada08fc8a70 2959
mbedAustin 11:cada08fc8a70 2960 /*
mbedAustin 11:cada08fc8a70 2961 * Make the signature
mbedAustin 11:cada08fc8a70 2962 */
mbedAustin 11:cada08fc8a70 2963 if( mbedtls_ssl_own_key( ssl ) == NULL )
mbedAustin 11:cada08fc8a70 2964 {
mbedAustin 11:cada08fc8a70 2965 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
mbedAustin 11:cada08fc8a70 2966 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
mbedAustin 11:cada08fc8a70 2967 }
mbedAustin 11:cada08fc8a70 2968
mbedAustin 11:cada08fc8a70 2969 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 2970 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 2971 {
mbedAustin 11:cada08fc8a70 2972 *(p++) = ssl->handshake->sig_alg;
mbedAustin 11:cada08fc8a70 2973 *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
mbedAustin 11:cada08fc8a70 2974
mbedAustin 11:cada08fc8a70 2975 n += 2;
mbedAustin 11:cada08fc8a70 2976 }
mbedAustin 11:cada08fc8a70 2977 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
mbedAustin 11:cada08fc8a70 2978
mbedAustin 11:cada08fc8a70 2979 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
mbedAustin 11:cada08fc8a70 2980 p + 2 , &signature_len,
mbedAustin 11:cada08fc8a70 2981 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
mbedAustin 11:cada08fc8a70 2982 {
mbedAustin 11:cada08fc8a70 2983 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
mbedAustin 11:cada08fc8a70 2984 return( ret );
mbedAustin 11:cada08fc8a70 2985 }
mbedAustin 11:cada08fc8a70 2986
mbedAustin 11:cada08fc8a70 2987 *(p++) = (unsigned char)( signature_len >> 8 );
mbedAustin 11:cada08fc8a70 2988 *(p++) = (unsigned char)( signature_len );
mbedAustin 11:cada08fc8a70 2989 n += 2;
mbedAustin 11:cada08fc8a70 2990
mbedAustin 11:cada08fc8a70 2991 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
mbedAustin 11:cada08fc8a70 2992
mbedAustin 11:cada08fc8a70 2993 n += signature_len;
mbedAustin 11:cada08fc8a70 2994 }
mbedAustin 11:cada08fc8a70 2995 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
mbedAustin 11:cada08fc8a70 2996 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
mbedAustin 11:cada08fc8a70 2997 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
mbedAustin 11:cada08fc8a70 2998
mbedAustin 11:cada08fc8a70 2999 ssl->out_msglen = 4 + n;
mbedAustin 11:cada08fc8a70 3000 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
mbedAustin 11:cada08fc8a70 3001 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
mbedAustin 11:cada08fc8a70 3002
mbedAustin 11:cada08fc8a70 3003 ssl->state++;
mbedAustin 11:cada08fc8a70 3004
mbedAustin 11:cada08fc8a70 3005 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3006 {
mbedAustin 11:cada08fc8a70 3007 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
mbedAustin 11:cada08fc8a70 3008 return( ret );
mbedAustin 11:cada08fc8a70 3009 }
mbedAustin 11:cada08fc8a70 3010
mbedAustin 11:cada08fc8a70 3011 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
mbedAustin 11:cada08fc8a70 3012
mbedAustin 11:cada08fc8a70 3013 return( 0 );
mbedAustin 11:cada08fc8a70 3014 }
mbedAustin 11:cada08fc8a70 3015
mbedAustin 11:cada08fc8a70 3016 static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 3017 {
mbedAustin 11:cada08fc8a70 3018 int ret;
mbedAustin 11:cada08fc8a70 3019
mbedAustin 11:cada08fc8a70 3020 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
mbedAustin 11:cada08fc8a70 3021
mbedAustin 11:cada08fc8a70 3022 ssl->out_msglen = 4;
mbedAustin 11:cada08fc8a70 3023 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
mbedAustin 11:cada08fc8a70 3024 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
mbedAustin 11:cada08fc8a70 3025
mbedAustin 11:cada08fc8a70 3026 ssl->state++;
mbedAustin 11:cada08fc8a70 3027
mbedAustin 11:cada08fc8a70 3028 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 3029 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedAustin 11:cada08fc8a70 3030 mbedtls_ssl_send_flight_completed( ssl );
mbedAustin 11:cada08fc8a70 3031 #endif
mbedAustin 11:cada08fc8a70 3032
mbedAustin 11:cada08fc8a70 3033 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3034 {
mbedAustin 11:cada08fc8a70 3035 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
mbedAustin 11:cada08fc8a70 3036 return( ret );
mbedAustin 11:cada08fc8a70 3037 }
mbedAustin 11:cada08fc8a70 3038
mbedAustin 11:cada08fc8a70 3039 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
mbedAustin 11:cada08fc8a70 3040
mbedAustin 11:cada08fc8a70 3041 return( 0 );
mbedAustin 11:cada08fc8a70 3042 }
mbedAustin 11:cada08fc8a70 3043
mbedAustin 11:cada08fc8a70 3044 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 3045 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3046 static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
mbedAustin 11:cada08fc8a70 3047 const unsigned char *end )
mbedAustin 11:cada08fc8a70 3048 {
mbedAustin 11:cada08fc8a70 3049 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
mbedAustin 11:cada08fc8a70 3050 size_t n;
mbedAustin 11:cada08fc8a70 3051
mbedAustin 11:cada08fc8a70 3052 /*
mbedAustin 11:cada08fc8a70 3053 * Receive G^Y mod P, premaster = (G^Y)^X mod P
mbedAustin 11:cada08fc8a70 3054 */
mbedAustin 11:cada08fc8a70 3055 if( *p + 2 > end )
mbedAustin 11:cada08fc8a70 3056 {
mbedAustin 11:cada08fc8a70 3057 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3058 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3059 }
mbedAustin 11:cada08fc8a70 3060
mbedAustin 11:cada08fc8a70 3061 n = ( (*p)[0] << 8 ) | (*p)[1];
mbedAustin 11:cada08fc8a70 3062 *p += 2;
mbedAustin 11:cada08fc8a70 3063
mbedAustin 11:cada08fc8a70 3064 if( *p + n > end )
mbedAustin 11:cada08fc8a70 3065 {
mbedAustin 11:cada08fc8a70 3066 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3067 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3068 }
mbedAustin 11:cada08fc8a70 3069
mbedAustin 11:cada08fc8a70 3070 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
mbedAustin 11:cada08fc8a70 3071 {
mbedAustin 11:cada08fc8a70 3072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
mbedAustin 11:cada08fc8a70 3073 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
mbedAustin 11:cada08fc8a70 3074 }
mbedAustin 11:cada08fc8a70 3075
mbedAustin 11:cada08fc8a70 3076 *p += n;
mbedAustin 11:cada08fc8a70 3077
mbedAustin 11:cada08fc8a70 3078 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
mbedAustin 11:cada08fc8a70 3079
mbedAustin 11:cada08fc8a70 3080 return( ret );
mbedAustin 11:cada08fc8a70 3081 }
mbedAustin 11:cada08fc8a70 3082 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
mbedAustin 11:cada08fc8a70 3083 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3084
mbedAustin 11:cada08fc8a70 3085 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 3086 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3087 static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
mbedAustin 11:cada08fc8a70 3088 const unsigned char *p,
mbedAustin 11:cada08fc8a70 3089 const unsigned char *end,
mbedAustin 11:cada08fc8a70 3090 size_t pms_offset )
mbedAustin 11:cada08fc8a70 3091 {
mbedAustin 11:cada08fc8a70 3092 int ret;
mbedAustin 11:cada08fc8a70 3093 size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
mbedAustin 11:cada08fc8a70 3094 unsigned char *pms = ssl->handshake->premaster + pms_offset;
mbedAustin 11:cada08fc8a70 3095 unsigned char ver[2];
mbedAustin 11:cada08fc8a70 3096 unsigned char fake_pms[48], peer_pms[48];
mbedAustin 11:cada08fc8a70 3097 unsigned char mask;
mbedAustin 11:cada08fc8a70 3098 size_t i, peer_pmslen;
mbedAustin 11:cada08fc8a70 3099 unsigned int diff;
mbedAustin 11:cada08fc8a70 3100
mbedAustin 11:cada08fc8a70 3101 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
mbedAustin 11:cada08fc8a70 3102 {
mbedAustin 11:cada08fc8a70 3103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
mbedAustin 11:cada08fc8a70 3104 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
mbedAustin 11:cada08fc8a70 3105 }
mbedAustin 11:cada08fc8a70 3106
mbedAustin 11:cada08fc8a70 3107 /*
mbedAustin 11:cada08fc8a70 3108 * Decrypt the premaster using own private RSA key
mbedAustin 11:cada08fc8a70 3109 */
mbedAustin 11:cada08fc8a70 3110 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
mbedAustin 11:cada08fc8a70 3111 defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 3112 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
mbedAustin 11:cada08fc8a70 3113 {
mbedAustin 11:cada08fc8a70 3114 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
mbedAustin 11:cada08fc8a70 3115 *p++ != ( ( len ) & 0xFF ) )
mbedAustin 11:cada08fc8a70 3116 {
mbedAustin 11:cada08fc8a70 3117 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3118 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3119 }
mbedAustin 11:cada08fc8a70 3120 }
mbedAustin 11:cada08fc8a70 3121 #endif
mbedAustin 11:cada08fc8a70 3122
mbedAustin 11:cada08fc8a70 3123 if( p + len != end )
mbedAustin 11:cada08fc8a70 3124 {
mbedAustin 11:cada08fc8a70 3125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3126 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3127 }
mbedAustin 11:cada08fc8a70 3128
mbedAustin 11:cada08fc8a70 3129 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
mbedAustin 11:cada08fc8a70 3130 ssl->handshake->max_minor_ver,
mbedAustin 11:cada08fc8a70 3131 ssl->conf->transport, ver );
mbedAustin 11:cada08fc8a70 3132
mbedAustin 11:cada08fc8a70 3133 /*
mbedAustin 11:cada08fc8a70 3134 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
mbedAustin 11:cada08fc8a70 3135 * must not cause the connection to end immediately; instead, send a
mbedAustin 11:cada08fc8a70 3136 * bad_record_mac later in the handshake.
mbedAustin 11:cada08fc8a70 3137 * Also, avoid data-dependant branches here to protect against
mbedAustin 11:cada08fc8a70 3138 * timing-based variants.
mbedAustin 11:cada08fc8a70 3139 */
mbedAustin 11:cada08fc8a70 3140 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
mbedAustin 11:cada08fc8a70 3141 if( ret != 0 )
mbedAustin 11:cada08fc8a70 3142 return( ret );
mbedAustin 11:cada08fc8a70 3143
mbedAustin 11:cada08fc8a70 3144 ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
mbedAustin 11:cada08fc8a70 3145 peer_pms, &peer_pmslen,
mbedAustin 11:cada08fc8a70 3146 sizeof( peer_pms ),
mbedAustin 11:cada08fc8a70 3147 ssl->conf->f_rng, ssl->conf->p_rng );
mbedAustin 11:cada08fc8a70 3148
mbedAustin 11:cada08fc8a70 3149 diff = (unsigned int) ret;
mbedAustin 11:cada08fc8a70 3150 diff |= peer_pmslen ^ 48;
mbedAustin 11:cada08fc8a70 3151 diff |= peer_pms[0] ^ ver[0];
mbedAustin 11:cada08fc8a70 3152 diff |= peer_pms[1] ^ ver[1];
mbedAustin 11:cada08fc8a70 3153
mbedAustin 11:cada08fc8a70 3154 #if defined(MBEDTLS_SSL_DEBUG_ALL)
mbedAustin 11:cada08fc8a70 3155 if( diff != 0 )
mbedAustin 11:cada08fc8a70 3156 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3157 #endif
mbedAustin 11:cada08fc8a70 3158
mbedAustin 11:cada08fc8a70 3159 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
mbedAustin 11:cada08fc8a70 3160 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
mbedAustin 11:cada08fc8a70 3161 {
mbedAustin 11:cada08fc8a70 3162 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 3163 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 3164 }
mbedAustin 11:cada08fc8a70 3165 ssl->handshake->pmslen = 48;
mbedAustin 11:cada08fc8a70 3166
mbedAustin 11:cada08fc8a70 3167 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
mbedAustin 11:cada08fc8a70 3168 /* MSVC has a warning about unary minus on unsigned, but this is
mbedAustin 11:cada08fc8a70 3169 * well-defined and precisely what we want to do here */
mbedAustin 11:cada08fc8a70 3170 #if defined(_MSC_VER)
mbedAustin 11:cada08fc8a70 3171 #pragma warning( push )
mbedAustin 11:cada08fc8a70 3172 #pragma warning( disable : 4146 )
mbedAustin 11:cada08fc8a70 3173 #endif
mbedAustin 11:cada08fc8a70 3174 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
mbedAustin 11:cada08fc8a70 3175 #if defined(_MSC_VER)
mbedAustin 11:cada08fc8a70 3176 #pragma warning( pop )
mbedAustin 11:cada08fc8a70 3177 #endif
mbedAustin 11:cada08fc8a70 3178
mbedAustin 11:cada08fc8a70 3179 for( i = 0; i < ssl->handshake->pmslen; i++ )
mbedAustin 11:cada08fc8a70 3180 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
mbedAustin 11:cada08fc8a70 3181
mbedAustin 11:cada08fc8a70 3182 return( 0 );
mbedAustin 11:cada08fc8a70 3183 }
mbedAustin 11:cada08fc8a70 3184 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
mbedAustin 11:cada08fc8a70 3185 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3186
mbedAustin 11:cada08fc8a70 3187 #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3188 static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
mbedAustin 11:cada08fc8a70 3189 const unsigned char *end )
mbedAustin 11:cada08fc8a70 3190 {
mbedAustin 11:cada08fc8a70 3191 int ret = 0;
mbedAustin 11:cada08fc8a70 3192 size_t n;
mbedAustin 11:cada08fc8a70 3193
mbedAustin 11:cada08fc8a70 3194 if( ssl->conf->f_psk == NULL &&
mbedAustin 11:cada08fc8a70 3195 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
mbedAustin 11:cada08fc8a70 3196 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
mbedAustin 11:cada08fc8a70 3197 {
mbedAustin 11:cada08fc8a70 3198 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
mbedAustin 11:cada08fc8a70 3199 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
mbedAustin 11:cada08fc8a70 3200 }
mbedAustin 11:cada08fc8a70 3201
mbedAustin 11:cada08fc8a70 3202 /*
mbedAustin 11:cada08fc8a70 3203 * Receive client pre-shared key identity name
mbedAustin 11:cada08fc8a70 3204 */
mbedAustin 11:cada08fc8a70 3205 if( *p + 2 > end )
mbedAustin 11:cada08fc8a70 3206 {
mbedAustin 11:cada08fc8a70 3207 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3208 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3209 }
mbedAustin 11:cada08fc8a70 3210
mbedAustin 11:cada08fc8a70 3211 n = ( (*p)[0] << 8 ) | (*p)[1];
mbedAustin 11:cada08fc8a70 3212 *p += 2;
mbedAustin 11:cada08fc8a70 3213
mbedAustin 11:cada08fc8a70 3214 if( n < 1 || n > 65535 || *p + n > end )
mbedAustin 11:cada08fc8a70 3215 {
mbedAustin 11:cada08fc8a70 3216 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3217 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3218 }
mbedAustin 11:cada08fc8a70 3219
mbedAustin 11:cada08fc8a70 3220 if( ssl->conf->f_psk != NULL )
mbedAustin 11:cada08fc8a70 3221 {
mbedAustin 11:cada08fc8a70 3222 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
mbedAustin 11:cada08fc8a70 3223 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
mbedAustin 11:cada08fc8a70 3224 }
mbedAustin 11:cada08fc8a70 3225 else
mbedAustin 11:cada08fc8a70 3226 {
mbedAustin 11:cada08fc8a70 3227 /* Identity is not a big secret since clients send it in the clear,
mbedAustin 11:cada08fc8a70 3228 * but treat it carefully anyway, just in case */
mbedAustin 11:cada08fc8a70 3229 if( n != ssl->conf->psk_identity_len ||
mbedAustin 11:cada08fc8a70 3230 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
mbedAustin 11:cada08fc8a70 3231 {
mbedAustin 11:cada08fc8a70 3232 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
mbedAustin 11:cada08fc8a70 3233 }
mbedAustin 11:cada08fc8a70 3234 }
mbedAustin 11:cada08fc8a70 3235
mbedAustin 11:cada08fc8a70 3236 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
mbedAustin 11:cada08fc8a70 3237 {
mbedAustin 11:cada08fc8a70 3238 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
mbedAustin 11:cada08fc8a70 3239 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
mbedAustin 11:cada08fc8a70 3240 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
mbedAustin 11:cada08fc8a70 3241 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
mbedAustin 11:cada08fc8a70 3242 {
mbedAustin 11:cada08fc8a70 3243 return( ret );
mbedAustin 11:cada08fc8a70 3244 }
mbedAustin 11:cada08fc8a70 3245
mbedAustin 11:cada08fc8a70 3246 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
mbedAustin 11:cada08fc8a70 3247 }
mbedAustin 11:cada08fc8a70 3248
mbedAustin 11:cada08fc8a70 3249 *p += n;
mbedAustin 11:cada08fc8a70 3250
mbedAustin 11:cada08fc8a70 3251 return( 0 );
mbedAustin 11:cada08fc8a70 3252 }
mbedAustin 11:cada08fc8a70 3253 #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3254
mbedAustin 11:cada08fc8a70 3255 static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 3256 {
mbedAustin 11:cada08fc8a70 3257 int ret;
mbedAustin 11:cada08fc8a70 3258 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
mbedAustin 11:cada08fc8a70 3259 unsigned char *p, *end;
mbedAustin 11:cada08fc8a70 3260
mbedAustin 11:cada08fc8a70 3261 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
mbedAustin 11:cada08fc8a70 3262
mbedAustin 11:cada08fc8a70 3263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
mbedAustin 11:cada08fc8a70 3264
mbedAustin 11:cada08fc8a70 3265 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3266 {
mbedAustin 11:cada08fc8a70 3267 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
mbedAustin 11:cada08fc8a70 3268 return( ret );
mbedAustin 11:cada08fc8a70 3269 }
mbedAustin 11:cada08fc8a70 3270
mbedAustin 11:cada08fc8a70 3271 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
mbedAustin 11:cada08fc8a70 3272 end = ssl->in_msg + ssl->in_hslen;
mbedAustin 11:cada08fc8a70 3273
mbedAustin 11:cada08fc8a70 3274 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
mbedAustin 11:cada08fc8a70 3275 {
mbedAustin 11:cada08fc8a70 3276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3277 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3278 }
mbedAustin 11:cada08fc8a70 3279
mbedAustin 11:cada08fc8a70 3280 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
mbedAustin 11:cada08fc8a70 3281 {
mbedAustin 11:cada08fc8a70 3282 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
mbedAustin 11:cada08fc8a70 3283 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3284 }
mbedAustin 11:cada08fc8a70 3285
mbedAustin 11:cada08fc8a70 3286 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
mbedAustin 11:cada08fc8a70 3287 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
mbedAustin 11:cada08fc8a70 3288 {
mbedAustin 11:cada08fc8a70 3289 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
mbedAustin 11:cada08fc8a70 3290 {
mbedAustin 11:cada08fc8a70 3291 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
mbedAustin 11:cada08fc8a70 3292 return( ret );
mbedAustin 11:cada08fc8a70 3293 }
mbedAustin 11:cada08fc8a70 3294
mbedAustin 11:cada08fc8a70 3295 if( p != end )
mbedAustin 11:cada08fc8a70 3296 {
mbedAustin 11:cada08fc8a70 3297 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
mbedAustin 11:cada08fc8a70 3298 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3299 }
mbedAustin 11:cada08fc8a70 3300
mbedAustin 11:cada08fc8a70 3301 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
mbedAustin 11:cada08fc8a70 3302 ssl->handshake->premaster,
mbedAustin 11:cada08fc8a70 3303 MBEDTLS_PREMASTER_SIZE,
mbedAustin 11:cada08fc8a70 3304 &ssl->handshake->pmslen,
mbedAustin 11:cada08fc8a70 3305 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
mbedAustin 11:cada08fc8a70 3306 {
mbedAustin 11:cada08fc8a70 3307 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
mbedAustin 11:cada08fc8a70 3308 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
mbedAustin 11:cada08fc8a70 3309 }
mbedAustin 11:cada08fc8a70 3310
mbedAustin 11:cada08fc8a70 3311 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
mbedAustin 11:cada08fc8a70 3312 }
mbedAustin 11:cada08fc8a70 3313 else
mbedAustin 11:cada08fc8a70 3314 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
mbedAustin 11:cada08fc8a70 3315 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 3316 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 3317 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
mbedAustin 11:cada08fc8a70 3318 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
mbedAustin 11:cada08fc8a70 3319 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
mbedAustin 11:cada08fc8a70 3320 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
mbedAustin 11:cada08fc8a70 3321 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
mbedAustin 11:cada08fc8a70 3322 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
mbedAustin 11:cada08fc8a70 3323 {
mbedAustin 11:cada08fc8a70 3324 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
mbedAustin 11:cada08fc8a70 3325 p, end - p) ) != 0 )
mbedAustin 11:cada08fc8a70 3326 {
mbedAustin 11:cada08fc8a70 3327 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
mbedAustin 11:cada08fc8a70 3328 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
mbedAustin 11:cada08fc8a70 3329 }
mbedAustin 11:cada08fc8a70 3330
mbedAustin 11:cada08fc8a70 3331 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
mbedAustin 11:cada08fc8a70 3332
mbedAustin 11:cada08fc8a70 3333 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
mbedAustin 11:cada08fc8a70 3334 &ssl->handshake->pmslen,
mbedAustin 11:cada08fc8a70 3335 ssl->handshake->premaster,
mbedAustin 11:cada08fc8a70 3336 MBEDTLS_MPI_MAX_SIZE,
mbedAustin 11:cada08fc8a70 3337 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
mbedAustin 11:cada08fc8a70 3338 {
mbedAustin 11:cada08fc8a70 3339 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
mbedAustin 11:cada08fc8a70 3340 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
mbedAustin 11:cada08fc8a70 3341 }
mbedAustin 11:cada08fc8a70 3342
mbedAustin 11:cada08fc8a70 3343 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
mbedAustin 11:cada08fc8a70 3344 }
mbedAustin 11:cada08fc8a70 3345 else
mbedAustin 11:cada08fc8a70 3346 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
mbedAustin 11:cada08fc8a70 3347 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
mbedAustin 11:cada08fc8a70 3348 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
mbedAustin 11:cada08fc8a70 3349 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
mbedAustin 11:cada08fc8a70 3350 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3351 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
mbedAustin 11:cada08fc8a70 3352 {
mbedAustin 11:cada08fc8a70 3353 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
mbedAustin 11:cada08fc8a70 3354 {
mbedAustin 11:cada08fc8a70 3355 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
mbedAustin 11:cada08fc8a70 3356 return( ret );
mbedAustin 11:cada08fc8a70 3357 }
mbedAustin 11:cada08fc8a70 3358
mbedAustin 11:cada08fc8a70 3359 if( p != end )
mbedAustin 11:cada08fc8a70 3360 {
mbedAustin 11:cada08fc8a70 3361 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
mbedAustin 11:cada08fc8a70 3362 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3363 }
mbedAustin 11:cada08fc8a70 3364
mbedAustin 11:cada08fc8a70 3365 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
mbedAustin 11:cada08fc8a70 3366 ciphersuite_info->key_exchange ) ) != 0 )
mbedAustin 11:cada08fc8a70 3367 {
mbedAustin 11:cada08fc8a70 3368 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
mbedAustin 11:cada08fc8a70 3369 return( ret );
mbedAustin 11:cada08fc8a70 3370 }
mbedAustin 11:cada08fc8a70 3371 }
mbedAustin 11:cada08fc8a70 3372 else
mbedAustin 11:cada08fc8a70 3373 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3374 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3375 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
mbedAustin 11:cada08fc8a70 3376 {
mbedAustin 11:cada08fc8a70 3377 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
mbedAustin 11:cada08fc8a70 3378 {
mbedAustin 11:cada08fc8a70 3379 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
mbedAustin 11:cada08fc8a70 3380 return( ret );
mbedAustin 11:cada08fc8a70 3381 }
mbedAustin 11:cada08fc8a70 3382
mbedAustin 11:cada08fc8a70 3383 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
mbedAustin 11:cada08fc8a70 3384 {
mbedAustin 11:cada08fc8a70 3385 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
mbedAustin 11:cada08fc8a70 3386 return( ret );
mbedAustin 11:cada08fc8a70 3387 }
mbedAustin 11:cada08fc8a70 3388
mbedAustin 11:cada08fc8a70 3389 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
mbedAustin 11:cada08fc8a70 3390 ciphersuite_info->key_exchange ) ) != 0 )
mbedAustin 11:cada08fc8a70 3391 {
mbedAustin 11:cada08fc8a70 3392 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
mbedAustin 11:cada08fc8a70 3393 return( ret );
mbedAustin 11:cada08fc8a70 3394 }
mbedAustin 11:cada08fc8a70 3395 }
mbedAustin 11:cada08fc8a70 3396 else
mbedAustin 11:cada08fc8a70 3397 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3398 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3399 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
mbedAustin 11:cada08fc8a70 3400 {
mbedAustin 11:cada08fc8a70 3401 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
mbedAustin 11:cada08fc8a70 3402 {
mbedAustin 11:cada08fc8a70 3403 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
mbedAustin 11:cada08fc8a70 3404 return( ret );
mbedAustin 11:cada08fc8a70 3405 }
mbedAustin 11:cada08fc8a70 3406 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
mbedAustin 11:cada08fc8a70 3407 {
mbedAustin 11:cada08fc8a70 3408 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
mbedAustin 11:cada08fc8a70 3409 return( ret );
mbedAustin 11:cada08fc8a70 3410 }
mbedAustin 11:cada08fc8a70 3411
mbedAustin 11:cada08fc8a70 3412 if( p != end )
mbedAustin 11:cada08fc8a70 3413 {
mbedAustin 11:cada08fc8a70 3414 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
mbedAustin 11:cada08fc8a70 3415 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3416 }
mbedAustin 11:cada08fc8a70 3417
mbedAustin 11:cada08fc8a70 3418 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
mbedAustin 11:cada08fc8a70 3419 ciphersuite_info->key_exchange ) ) != 0 )
mbedAustin 11:cada08fc8a70 3420 {
mbedAustin 11:cada08fc8a70 3421 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
mbedAustin 11:cada08fc8a70 3422 return( ret );
mbedAustin 11:cada08fc8a70 3423 }
mbedAustin 11:cada08fc8a70 3424 }
mbedAustin 11:cada08fc8a70 3425 else
mbedAustin 11:cada08fc8a70 3426 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3427 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
mbedAustin 11:cada08fc8a70 3428 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
mbedAustin 11:cada08fc8a70 3429 {
mbedAustin 11:cada08fc8a70 3430 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
mbedAustin 11:cada08fc8a70 3431 {
mbedAustin 11:cada08fc8a70 3432 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
mbedAustin 11:cada08fc8a70 3433 return( ret );
mbedAustin 11:cada08fc8a70 3434 }
mbedAustin 11:cada08fc8a70 3435
mbedAustin 11:cada08fc8a70 3436 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
mbedAustin 11:cada08fc8a70 3437 p, end - p ) ) != 0 )
mbedAustin 11:cada08fc8a70 3438 {
mbedAustin 11:cada08fc8a70 3439 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
mbedAustin 11:cada08fc8a70 3440 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
mbedAustin 11:cada08fc8a70 3441 }
mbedAustin 11:cada08fc8a70 3442
mbedAustin 11:cada08fc8a70 3443 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
mbedAustin 11:cada08fc8a70 3444
mbedAustin 11:cada08fc8a70 3445 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
mbedAustin 11:cada08fc8a70 3446 ciphersuite_info->key_exchange ) ) != 0 )
mbedAustin 11:cada08fc8a70 3447 {
mbedAustin 11:cada08fc8a70 3448 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
mbedAustin 11:cada08fc8a70 3449 return( ret );
mbedAustin 11:cada08fc8a70 3450 }
mbedAustin 11:cada08fc8a70 3451 }
mbedAustin 11:cada08fc8a70 3452 else
mbedAustin 11:cada08fc8a70 3453 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
mbedAustin 11:cada08fc8a70 3454 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
mbedAustin 11:cada08fc8a70 3455 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
mbedAustin 11:cada08fc8a70 3456 {
mbedAustin 11:cada08fc8a70 3457 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
mbedAustin 11:cada08fc8a70 3458 {
mbedAustin 11:cada08fc8a70 3459 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
mbedAustin 11:cada08fc8a70 3460 return( ret );
mbedAustin 11:cada08fc8a70 3461 }
mbedAustin 11:cada08fc8a70 3462 }
mbedAustin 11:cada08fc8a70 3463 else
mbedAustin 11:cada08fc8a70 3464 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
mbedAustin 11:cada08fc8a70 3465 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
mbedAustin 11:cada08fc8a70 3466 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
mbedAustin 11:cada08fc8a70 3467 {
mbedAustin 11:cada08fc8a70 3468 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
mbedAustin 11:cada08fc8a70 3469 p, end - p );
mbedAustin 11:cada08fc8a70 3470 if( ret != 0 )
mbedAustin 11:cada08fc8a70 3471 {
mbedAustin 11:cada08fc8a70 3472 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
mbedAustin 11:cada08fc8a70 3473 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
mbedAustin 11:cada08fc8a70 3474 }
mbedAustin 11:cada08fc8a70 3475
mbedAustin 11:cada08fc8a70 3476 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
mbedAustin 11:cada08fc8a70 3477 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
mbedAustin 11:cada08fc8a70 3478 ssl->conf->f_rng, ssl->conf->p_rng );
mbedAustin 11:cada08fc8a70 3479 if( ret != 0 )
mbedAustin 11:cada08fc8a70 3480 {
mbedAustin 11:cada08fc8a70 3481 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
mbedAustin 11:cada08fc8a70 3482 return( ret );
mbedAustin 11:cada08fc8a70 3483 }
mbedAustin 11:cada08fc8a70 3484 }
mbedAustin 11:cada08fc8a70 3485 else
mbedAustin 11:cada08fc8a70 3486 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
mbedAustin 11:cada08fc8a70 3487 {
mbedAustin 11:cada08fc8a70 3488 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 3489 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 3490 }
mbedAustin 11:cada08fc8a70 3491
mbedAustin 11:cada08fc8a70 3492 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3493 {
mbedAustin 11:cada08fc8a70 3494 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
mbedAustin 11:cada08fc8a70 3495 return( ret );
mbedAustin 11:cada08fc8a70 3496 }
mbedAustin 11:cada08fc8a70 3497
mbedAustin 11:cada08fc8a70 3498 ssl->state++;
mbedAustin 11:cada08fc8a70 3499
mbedAustin 11:cada08fc8a70 3500 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
mbedAustin 11:cada08fc8a70 3501
mbedAustin 11:cada08fc8a70 3502 return( 0 );
mbedAustin 11:cada08fc8a70 3503 }
mbedAustin 11:cada08fc8a70 3504
mbedAustin 11:cada08fc8a70 3505 #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
mbedAustin 11:cada08fc8a70 3506 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
mbedAustin 11:cada08fc8a70 3507 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
mbedAustin 11:cada08fc8a70 3508 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
mbedAustin 11:cada08fc8a70 3509 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 3510 {
mbedAustin 11:cada08fc8a70 3511 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
mbedAustin 11:cada08fc8a70 3512
mbedAustin 11:cada08fc8a70 3513 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
mbedAustin 11:cada08fc8a70 3514
mbedAustin 11:cada08fc8a70 3515 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
mbedAustin 11:cada08fc8a70 3516 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
mbedAustin 11:cada08fc8a70 3517 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
mbedAustin 11:cada08fc8a70 3518 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
mbedAustin 11:cada08fc8a70 3519 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
mbedAustin 11:cada08fc8a70 3520 {
mbedAustin 11:cada08fc8a70 3521 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
mbedAustin 11:cada08fc8a70 3522 ssl->state++;
mbedAustin 11:cada08fc8a70 3523 return( 0 );
mbedAustin 11:cada08fc8a70 3524 }
mbedAustin 11:cada08fc8a70 3525
mbedAustin 11:cada08fc8a70 3526 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 3527 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 3528 }
mbedAustin 11:cada08fc8a70 3529 #else
mbedAustin 11:cada08fc8a70 3530 static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 3531 {
mbedAustin 11:cada08fc8a70 3532 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
mbedAustin 11:cada08fc8a70 3533 size_t i, sig_len;
mbedAustin 11:cada08fc8a70 3534 unsigned char hash[48];
mbedAustin 11:cada08fc8a70 3535 unsigned char *hash_start = hash;
mbedAustin 11:cada08fc8a70 3536 size_t hashlen;
mbedAustin 11:cada08fc8a70 3537 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 3538 mbedtls_pk_type_t pk_alg;
mbedAustin 11:cada08fc8a70 3539 #endif
mbedAustin 11:cada08fc8a70 3540 mbedtls_md_type_t md_alg;
mbedAustin 11:cada08fc8a70 3541 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
mbedAustin 11:cada08fc8a70 3542
mbedAustin 11:cada08fc8a70 3543 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
mbedAustin 11:cada08fc8a70 3544
mbedAustin 11:cada08fc8a70 3545 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
mbedAustin 11:cada08fc8a70 3546 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
mbedAustin 11:cada08fc8a70 3547 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
mbedAustin 11:cada08fc8a70 3548 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
mbedAustin 11:cada08fc8a70 3549 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
mbedAustin 11:cada08fc8a70 3550 ssl->session_negotiate->peer_cert == NULL )
mbedAustin 11:cada08fc8a70 3551 {
mbedAustin 11:cada08fc8a70 3552 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
mbedAustin 11:cada08fc8a70 3553 ssl->state++;
mbedAustin 11:cada08fc8a70 3554 return( 0 );
mbedAustin 11:cada08fc8a70 3555 }
mbedAustin 11:cada08fc8a70 3556
mbedAustin 11:cada08fc8a70 3557 /* Needs to be done before read_record() to exclude current message */
mbedAustin 11:cada08fc8a70 3558 ssl->handshake->calc_verify( ssl, hash );
mbedAustin 11:cada08fc8a70 3559
mbedAustin 11:cada08fc8a70 3560 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3561 {
mbedAustin 11:cada08fc8a70 3562 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
mbedAustin 11:cada08fc8a70 3563 return( ret );
mbedAustin 11:cada08fc8a70 3564 }
mbedAustin 11:cada08fc8a70 3565
mbedAustin 11:cada08fc8a70 3566 ssl->state++;
mbedAustin 11:cada08fc8a70 3567
mbedAustin 11:cada08fc8a70 3568 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
mbedAustin 11:cada08fc8a70 3569 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
mbedAustin 11:cada08fc8a70 3570 {
mbedAustin 11:cada08fc8a70 3571 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
mbedAustin 11:cada08fc8a70 3572 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3573 }
mbedAustin 11:cada08fc8a70 3574
mbedAustin 11:cada08fc8a70 3575 i = mbedtls_ssl_hs_hdr_len( ssl );
mbedAustin 11:cada08fc8a70 3576
mbedAustin 11:cada08fc8a70 3577 /*
mbedAustin 11:cada08fc8a70 3578 * struct {
mbedAustin 11:cada08fc8a70 3579 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
mbedAustin 11:cada08fc8a70 3580 * opaque signature<0..2^16-1>;
mbedAustin 11:cada08fc8a70 3581 * } DigitallySigned;
mbedAustin 11:cada08fc8a70 3582 */
mbedAustin 11:cada08fc8a70 3583 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
mbedAustin 11:cada08fc8a70 3584 defined(MBEDTLS_SSL_PROTO_TLS1_1)
mbedAustin 11:cada08fc8a70 3585 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 3586 {
mbedAustin 11:cada08fc8a70 3587 md_alg = MBEDTLS_MD_NONE;
mbedAustin 11:cada08fc8a70 3588 hashlen = 36;
mbedAustin 11:cada08fc8a70 3589
mbedAustin 11:cada08fc8a70 3590 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
mbedAustin 11:cada08fc8a70 3591 if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
mbedAustin 11:cada08fc8a70 3592 MBEDTLS_PK_ECDSA ) )
mbedAustin 11:cada08fc8a70 3593 {
mbedAustin 11:cada08fc8a70 3594 hash_start += 16;
mbedAustin 11:cada08fc8a70 3595 hashlen -= 16;
mbedAustin 11:cada08fc8a70 3596 md_alg = MBEDTLS_MD_SHA1;
mbedAustin 11:cada08fc8a70 3597 }
mbedAustin 11:cada08fc8a70 3598 }
mbedAustin 11:cada08fc8a70 3599 else
mbedAustin 11:cada08fc8a70 3600 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
mbedAustin 11:cada08fc8a70 3601 MBEDTLS_SSL_PROTO_TLS1_1 */
mbedAustin 11:cada08fc8a70 3602 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
mbedAustin 11:cada08fc8a70 3603 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
mbedAustin 11:cada08fc8a70 3604 {
mbedAustin 11:cada08fc8a70 3605 if( i + 2 > ssl->in_hslen )
mbedAustin 11:cada08fc8a70 3606 {
mbedAustin 11:cada08fc8a70 3607 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
mbedAustin 11:cada08fc8a70 3608 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3609 }
mbedAustin 11:cada08fc8a70 3610
mbedAustin 11:cada08fc8a70 3611 /*
mbedAustin 11:cada08fc8a70 3612 * Hash
mbedAustin 11:cada08fc8a70 3613 */
mbedAustin 11:cada08fc8a70 3614 if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
mbedAustin 11:cada08fc8a70 3615 {
mbedAustin 11:cada08fc8a70 3616 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
mbedAustin 11:cada08fc8a70 3617 " for verify message" ) );
mbedAustin 11:cada08fc8a70 3618 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3619 }
mbedAustin 11:cada08fc8a70 3620
mbedAustin 11:cada08fc8a70 3621 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
mbedAustin 11:cada08fc8a70 3622
mbedAustin 11:cada08fc8a70 3623 /* Info from md_alg will be used instead */
mbedAustin 11:cada08fc8a70 3624 hashlen = 0;
mbedAustin 11:cada08fc8a70 3625
mbedAustin 11:cada08fc8a70 3626 i++;
mbedAustin 11:cada08fc8a70 3627
mbedAustin 11:cada08fc8a70 3628 /*
mbedAustin 11:cada08fc8a70 3629 * Signature
mbedAustin 11:cada08fc8a70 3630 */
mbedAustin 11:cada08fc8a70 3631 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
mbedAustin 11:cada08fc8a70 3632 == MBEDTLS_PK_NONE )
mbedAustin 11:cada08fc8a70 3633 {
mbedAustin 11:cada08fc8a70 3634 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
mbedAustin 11:cada08fc8a70 3635 " for verify message" ) );
mbedAustin 11:cada08fc8a70 3636 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3637 }
mbedAustin 11:cada08fc8a70 3638
mbedAustin 11:cada08fc8a70 3639 /*
mbedAustin 11:cada08fc8a70 3640 * Check the certificate's key type matches the signature alg
mbedAustin 11:cada08fc8a70 3641 */
mbedAustin 11:cada08fc8a70 3642 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
mbedAustin 11:cada08fc8a70 3643 {
mbedAustin 11:cada08fc8a70 3644 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
mbedAustin 11:cada08fc8a70 3645 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3646 }
mbedAustin 11:cada08fc8a70 3647
mbedAustin 11:cada08fc8a70 3648 i++;
mbedAustin 11:cada08fc8a70 3649 }
mbedAustin 11:cada08fc8a70 3650 else
mbedAustin 11:cada08fc8a70 3651 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
mbedAustin 11:cada08fc8a70 3652 {
mbedAustin 11:cada08fc8a70 3653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
mbedAustin 11:cada08fc8a70 3654 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedAustin 11:cada08fc8a70 3655 }
mbedAustin 11:cada08fc8a70 3656
mbedAustin 11:cada08fc8a70 3657 if( i + 2 > ssl->in_hslen )
mbedAustin 11:cada08fc8a70 3658 {
mbedAustin 11:cada08fc8a70 3659 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
mbedAustin 11:cada08fc8a70 3660 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3661 }
mbedAustin 11:cada08fc8a70 3662
mbedAustin 11:cada08fc8a70 3663 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
mbedAustin 11:cada08fc8a70 3664 i += 2;
mbedAustin 11:cada08fc8a70 3665
mbedAustin 11:cada08fc8a70 3666 if( i + sig_len != ssl->in_hslen )
mbedAustin 11:cada08fc8a70 3667 {
mbedAustin 11:cada08fc8a70 3668 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
mbedAustin 11:cada08fc8a70 3669 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
mbedAustin 11:cada08fc8a70 3670 }
mbedAustin 11:cada08fc8a70 3671
mbedAustin 11:cada08fc8a70 3672 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
mbedAustin 11:cada08fc8a70 3673 md_alg, hash_start, hashlen,
mbedAustin 11:cada08fc8a70 3674 ssl->in_msg + i, sig_len ) ) != 0 )
mbedAustin 11:cada08fc8a70 3675 {
mbedAustin 11:cada08fc8a70 3676 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
mbedAustin 11:cada08fc8a70 3677 return( ret );
mbedAustin 11:cada08fc8a70 3678 }
mbedAustin 11:cada08fc8a70 3679
mbedAustin 11:cada08fc8a70 3680 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
mbedAustin 11:cada08fc8a70 3681
mbedAustin 11:cada08fc8a70 3682 return( ret );
mbedAustin 11:cada08fc8a70 3683 }
mbedAustin 11:cada08fc8a70 3684 #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
mbedAustin 11:cada08fc8a70 3685 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
mbedAustin 11:cada08fc8a70 3686 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
mbedAustin 11:cada08fc8a70 3687
mbedAustin 11:cada08fc8a70 3688 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 3689 static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 3690 {
mbedAustin 11:cada08fc8a70 3691 int ret;
mbedAustin 11:cada08fc8a70 3692 size_t tlen;
mbedAustin 11:cada08fc8a70 3693 uint32_t lifetime;
mbedAustin 11:cada08fc8a70 3694
mbedAustin 11:cada08fc8a70 3695 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
mbedAustin 11:cada08fc8a70 3696
mbedAustin 11:cada08fc8a70 3697 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
mbedAustin 11:cada08fc8a70 3698 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
mbedAustin 11:cada08fc8a70 3699
mbedAustin 11:cada08fc8a70 3700 /*
mbedAustin 11:cada08fc8a70 3701 * struct {
mbedAustin 11:cada08fc8a70 3702 * uint32 ticket_lifetime_hint;
mbedAustin 11:cada08fc8a70 3703 * opaque ticket<0..2^16-1>;
mbedAustin 11:cada08fc8a70 3704 * } NewSessionTicket;
mbedAustin 11:cada08fc8a70 3705 *
mbedAustin 11:cada08fc8a70 3706 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
mbedAustin 11:cada08fc8a70 3707 * 8 . 9 ticket_len (n)
mbedAustin 11:cada08fc8a70 3708 * 10 . 9+n ticket content
mbedAustin 11:cada08fc8a70 3709 */
mbedAustin 11:cada08fc8a70 3710
mbedAustin 11:cada08fc8a70 3711 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
mbedAustin 11:cada08fc8a70 3712 ssl->session_negotiate,
mbedAustin 11:cada08fc8a70 3713 ssl->out_msg + 10,
mbedAustin 11:cada08fc8a70 3714 ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
mbedAustin 11:cada08fc8a70 3715 &tlen, &lifetime ) ) != 0 )
mbedAustin 11:cada08fc8a70 3716 {
mbedAustin 11:cada08fc8a70 3717 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
mbedAustin 11:cada08fc8a70 3718 tlen = 0;
mbedAustin 11:cada08fc8a70 3719 }
mbedAustin 11:cada08fc8a70 3720
mbedAustin 11:cada08fc8a70 3721 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
mbedAustin 11:cada08fc8a70 3722 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
mbedAustin 11:cada08fc8a70 3723 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
mbedAustin 11:cada08fc8a70 3724 ssl->out_msg[7] = ( lifetime ) & 0xFF;
mbedAustin 11:cada08fc8a70 3725
mbedAustin 11:cada08fc8a70 3726 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
mbedAustin 11:cada08fc8a70 3727 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
mbedAustin 11:cada08fc8a70 3728
mbedAustin 11:cada08fc8a70 3729 ssl->out_msglen = 10 + tlen;
mbedAustin 11:cada08fc8a70 3730
mbedAustin 11:cada08fc8a70 3731 /*
mbedAustin 11:cada08fc8a70 3732 * Morally equivalent to updating ssl->state, but NewSessionTicket and
mbedAustin 11:cada08fc8a70 3733 * ChangeCipherSpec share the same state.
mbedAustin 11:cada08fc8a70 3734 */
mbedAustin 11:cada08fc8a70 3735 ssl->handshake->new_session_ticket = 0;
mbedAustin 11:cada08fc8a70 3736
mbedAustin 11:cada08fc8a70 3737 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3738 {
mbedAustin 11:cada08fc8a70 3739 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
mbedAustin 11:cada08fc8a70 3740 return( ret );
mbedAustin 11:cada08fc8a70 3741 }
mbedAustin 11:cada08fc8a70 3742
mbedAustin 11:cada08fc8a70 3743 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
mbedAustin 11:cada08fc8a70 3744
mbedAustin 11:cada08fc8a70 3745 return( 0 );
mbedAustin 11:cada08fc8a70 3746 }
mbedAustin 11:cada08fc8a70 3747 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
mbedAustin 11:cada08fc8a70 3748
mbedAustin 11:cada08fc8a70 3749 /*
mbedAustin 11:cada08fc8a70 3750 * SSL handshake -- server side -- single step
mbedAustin 11:cada08fc8a70 3751 */
mbedAustin 11:cada08fc8a70 3752 int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
mbedAustin 11:cada08fc8a70 3753 {
mbedAustin 11:cada08fc8a70 3754 int ret = 0;
mbedAustin 11:cada08fc8a70 3755
mbedAustin 11:cada08fc8a70 3756 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
mbedAustin 11:cada08fc8a70 3757 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 3758
mbedAustin 11:cada08fc8a70 3759 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
mbedAustin 11:cada08fc8a70 3760
mbedAustin 11:cada08fc8a70 3761 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3762 return( ret );
mbedAustin 11:cada08fc8a70 3763
mbedAustin 11:cada08fc8a70 3764 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 3765 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
mbedAustin 11:cada08fc8a70 3766 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
mbedAustin 11:cada08fc8a70 3767 {
mbedAustin 11:cada08fc8a70 3768 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
mbedAustin 11:cada08fc8a70 3769 return( ret );
mbedAustin 11:cada08fc8a70 3770 }
mbedAustin 11:cada08fc8a70 3771 #endif
mbedAustin 11:cada08fc8a70 3772
mbedAustin 11:cada08fc8a70 3773 switch( ssl->state )
mbedAustin 11:cada08fc8a70 3774 {
mbedAustin 11:cada08fc8a70 3775 case MBEDTLS_SSL_HELLO_REQUEST:
mbedAustin 11:cada08fc8a70 3776 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
mbedAustin 11:cada08fc8a70 3777 break;
mbedAustin 11:cada08fc8a70 3778
mbedAustin 11:cada08fc8a70 3779 /*
mbedAustin 11:cada08fc8a70 3780 * <== ClientHello
mbedAustin 11:cada08fc8a70 3781 */
mbedAustin 11:cada08fc8a70 3782 case MBEDTLS_SSL_CLIENT_HELLO:
mbedAustin 11:cada08fc8a70 3783 ret = ssl_parse_client_hello( ssl );
mbedAustin 11:cada08fc8a70 3784 break;
mbedAustin 11:cada08fc8a70 3785
mbedAustin 11:cada08fc8a70 3786 #if defined(MBEDTLS_SSL_PROTO_DTLS)
mbedAustin 11:cada08fc8a70 3787 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
mbedAustin 11:cada08fc8a70 3788 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
mbedAustin 11:cada08fc8a70 3789 #endif
mbedAustin 11:cada08fc8a70 3790
mbedAustin 11:cada08fc8a70 3791 /*
mbedAustin 11:cada08fc8a70 3792 * ==> ServerHello
mbedAustin 11:cada08fc8a70 3793 * Certificate
mbedAustin 11:cada08fc8a70 3794 * ( ServerKeyExchange )
mbedAustin 11:cada08fc8a70 3795 * ( CertificateRequest )
mbedAustin 11:cada08fc8a70 3796 * ServerHelloDone
mbedAustin 11:cada08fc8a70 3797 */
mbedAustin 11:cada08fc8a70 3798 case MBEDTLS_SSL_SERVER_HELLO:
mbedAustin 11:cada08fc8a70 3799 ret = ssl_write_server_hello( ssl );
mbedAustin 11:cada08fc8a70 3800 break;
mbedAustin 11:cada08fc8a70 3801
mbedAustin 11:cada08fc8a70 3802 case MBEDTLS_SSL_SERVER_CERTIFICATE:
mbedAustin 11:cada08fc8a70 3803 ret = mbedtls_ssl_write_certificate( ssl );
mbedAustin 11:cada08fc8a70 3804 break;
mbedAustin 11:cada08fc8a70 3805
mbedAustin 11:cada08fc8a70 3806 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
mbedAustin 11:cada08fc8a70 3807 ret = ssl_write_server_key_exchange( ssl );
mbedAustin 11:cada08fc8a70 3808 break;
mbedAustin 11:cada08fc8a70 3809
mbedAustin 11:cada08fc8a70 3810 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
mbedAustin 11:cada08fc8a70 3811 ret = ssl_write_certificate_request( ssl );
mbedAustin 11:cada08fc8a70 3812 break;
mbedAustin 11:cada08fc8a70 3813
mbedAustin 11:cada08fc8a70 3814 case MBEDTLS_SSL_SERVER_HELLO_DONE:
mbedAustin 11:cada08fc8a70 3815 ret = ssl_write_server_hello_done( ssl );
mbedAustin 11:cada08fc8a70 3816 break;
mbedAustin 11:cada08fc8a70 3817
mbedAustin 11:cada08fc8a70 3818 /*
mbedAustin 11:cada08fc8a70 3819 * <== ( Certificate/Alert )
mbedAustin 11:cada08fc8a70 3820 * ClientKeyExchange
mbedAustin 11:cada08fc8a70 3821 * ( CertificateVerify )
mbedAustin 11:cada08fc8a70 3822 * ChangeCipherSpec
mbedAustin 11:cada08fc8a70 3823 * Finished
mbedAustin 11:cada08fc8a70 3824 */
mbedAustin 11:cada08fc8a70 3825 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
mbedAustin 11:cada08fc8a70 3826 ret = mbedtls_ssl_parse_certificate( ssl );
mbedAustin 11:cada08fc8a70 3827 break;
mbedAustin 11:cada08fc8a70 3828
mbedAustin 11:cada08fc8a70 3829 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
mbedAustin 11:cada08fc8a70 3830 ret = ssl_parse_client_key_exchange( ssl );
mbedAustin 11:cada08fc8a70 3831 break;
mbedAustin 11:cada08fc8a70 3832
mbedAustin 11:cada08fc8a70 3833 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
mbedAustin 11:cada08fc8a70 3834 ret = ssl_parse_certificate_verify( ssl );
mbedAustin 11:cada08fc8a70 3835 break;
mbedAustin 11:cada08fc8a70 3836
mbedAustin 11:cada08fc8a70 3837 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
mbedAustin 11:cada08fc8a70 3838 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
mbedAustin 11:cada08fc8a70 3839 break;
mbedAustin 11:cada08fc8a70 3840
mbedAustin 11:cada08fc8a70 3841 case MBEDTLS_SSL_CLIENT_FINISHED:
mbedAustin 11:cada08fc8a70 3842 ret = mbedtls_ssl_parse_finished( ssl );
mbedAustin 11:cada08fc8a70 3843 break;
mbedAustin 11:cada08fc8a70 3844
mbedAustin 11:cada08fc8a70 3845 /*
mbedAustin 11:cada08fc8a70 3846 * ==> ( NewSessionTicket )
mbedAustin 11:cada08fc8a70 3847 * ChangeCipherSpec
mbedAustin 11:cada08fc8a70 3848 * Finished
mbedAustin 11:cada08fc8a70 3849 */
mbedAustin 11:cada08fc8a70 3850 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
mbedAustin 11:cada08fc8a70 3851 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
mbedAustin 11:cada08fc8a70 3852 if( ssl->handshake->new_session_ticket != 0 )
mbedAustin 11:cada08fc8a70 3853 ret = ssl_write_new_session_ticket( ssl );
mbedAustin 11:cada08fc8a70 3854 else
mbedAustin 11:cada08fc8a70 3855 #endif
mbedAustin 11:cada08fc8a70 3856 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
mbedAustin 11:cada08fc8a70 3857 break;
mbedAustin 11:cada08fc8a70 3858
mbedAustin 11:cada08fc8a70 3859 case MBEDTLS_SSL_SERVER_FINISHED:
mbedAustin 11:cada08fc8a70 3860 ret = mbedtls_ssl_write_finished( ssl );
mbedAustin 11:cada08fc8a70 3861 break;
mbedAustin 11:cada08fc8a70 3862
mbedAustin 11:cada08fc8a70 3863 case MBEDTLS_SSL_FLUSH_BUFFERS:
mbedAustin 11:cada08fc8a70 3864 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
mbedAustin 11:cada08fc8a70 3865 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
mbedAustin 11:cada08fc8a70 3866 break;
mbedAustin 11:cada08fc8a70 3867
mbedAustin 11:cada08fc8a70 3868 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
mbedAustin 11:cada08fc8a70 3869 mbedtls_ssl_handshake_wrapup( ssl );
mbedAustin 11:cada08fc8a70 3870 break;
mbedAustin 11:cada08fc8a70 3871
mbedAustin 11:cada08fc8a70 3872 default:
mbedAustin 11:cada08fc8a70 3873 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
mbedAustin 11:cada08fc8a70 3874 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 3875 }
mbedAustin 11:cada08fc8a70 3876
mbedAustin 11:cada08fc8a70 3877 return( ret );
mbedAustin 11:cada08fc8a70 3878 }
mbedAustin 11:cada08fc8a70 3879 #endif /* MBEDTLS_SSL_SRV_C */