![](/media/cache/profiles/debfdc81854eac26ec993b55a659c6e1.jpg.50x50_q85.jpg)
mbed client lightswitch demo
Dependencies: mbed Socket lwip-eth lwip-sys lwip
Fork of mbed-client-classic-example-lwip by
mbedtls/source/ssl_srv.c@11:cada08fc8a70, 2016-06-09 (annotated)
- Committer:
- mbedAustin
- Date:
- Thu Jun 09 17:08:36 2016 +0000
- Revision:
- 11:cada08fc8a70
Commit for public Consumption
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
mbedAustin | 11:cada08fc8a70 | 1 | /* |
mbedAustin | 11:cada08fc8a70 | 2 | * SSLv3/TLSv1 server-side functions |
mbedAustin | 11:cada08fc8a70 | 3 | * |
mbedAustin | 11:cada08fc8a70 | 4 | * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved |
mbedAustin | 11:cada08fc8a70 | 5 | * SPDX-License-Identifier: Apache-2.0 |
mbedAustin | 11:cada08fc8a70 | 6 | * |
mbedAustin | 11:cada08fc8a70 | 7 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
mbedAustin | 11:cada08fc8a70 | 8 | * not use this file except in compliance with the License. |
mbedAustin | 11:cada08fc8a70 | 9 | * You may obtain a copy of the License at |
mbedAustin | 11:cada08fc8a70 | 10 | * |
mbedAustin | 11:cada08fc8a70 | 11 | * http://www.apache.org/licenses/LICENSE-2.0 |
mbedAustin | 11:cada08fc8a70 | 12 | * |
mbedAustin | 11:cada08fc8a70 | 13 | * Unless required by applicable law or agreed to in writing, software |
mbedAustin | 11:cada08fc8a70 | 14 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
mbedAustin | 11:cada08fc8a70 | 15 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
mbedAustin | 11:cada08fc8a70 | 16 | * See the License for the specific language governing permissions and |
mbedAustin | 11:cada08fc8a70 | 17 | * limitations under the License. |
mbedAustin | 11:cada08fc8a70 | 18 | * |
mbedAustin | 11:cada08fc8a70 | 19 | * This file is part of mbed TLS (https://tls.mbed.org) |
mbedAustin | 11:cada08fc8a70 | 20 | */ |
mbedAustin | 11:cada08fc8a70 | 21 | |
mbedAustin | 11:cada08fc8a70 | 22 | #if !defined(MBEDTLS_CONFIG_FILE) |
mbedAustin | 11:cada08fc8a70 | 23 | #include "mbedtls/config.h" |
mbedAustin | 11:cada08fc8a70 | 24 | #else |
mbedAustin | 11:cada08fc8a70 | 25 | #include MBEDTLS_CONFIG_FILE |
mbedAustin | 11:cada08fc8a70 | 26 | #endif |
mbedAustin | 11:cada08fc8a70 | 27 | |
mbedAustin | 11:cada08fc8a70 | 28 | #if defined(MBEDTLS_SSL_SRV_C) |
mbedAustin | 11:cada08fc8a70 | 29 | |
mbedAustin | 11:cada08fc8a70 | 30 | #include "mbedtls/debug.h" |
mbedAustin | 11:cada08fc8a70 | 31 | #include "mbedtls/ssl.h" |
mbedAustin | 11:cada08fc8a70 | 32 | #include "mbedtls/ssl_internal.h" |
mbedAustin | 11:cada08fc8a70 | 33 | |
mbedAustin | 11:cada08fc8a70 | 34 | #include <string.h> |
mbedAustin | 11:cada08fc8a70 | 35 | |
mbedAustin | 11:cada08fc8a70 | 36 | #if defined(MBEDTLS_ECP_C) |
mbedAustin | 11:cada08fc8a70 | 37 | #include "mbedtls/ecp.h" |
mbedAustin | 11:cada08fc8a70 | 38 | #endif |
mbedAustin | 11:cada08fc8a70 | 39 | |
mbedAustin | 11:cada08fc8a70 | 40 | #if defined(MBEDTLS_PLATFORM_C) |
mbedAustin | 11:cada08fc8a70 | 41 | #include "mbedtls/platform.h" |
mbedAustin | 11:cada08fc8a70 | 42 | #else |
mbedAustin | 11:cada08fc8a70 | 43 | #include <stdlib.h> |
mbedAustin | 11:cada08fc8a70 | 44 | #define mbedtls_calloc calloc |
mbedAustin | 11:cada08fc8a70 | 45 | #define mbedtls_free free |
mbedAustin | 11:cada08fc8a70 | 46 | #endif |
mbedAustin | 11:cada08fc8a70 | 47 | |
mbedAustin | 11:cada08fc8a70 | 48 | #if defined(MBEDTLS_HAVE_TIME) |
mbedAustin | 11:cada08fc8a70 | 49 | #include <time.h> |
mbedAustin | 11:cada08fc8a70 | 50 | #endif |
mbedAustin | 11:cada08fc8a70 | 51 | |
mbedAustin | 11:cada08fc8a70 | 52 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 53 | /* Implementation that should never be optimized out by the compiler */ |
mbedAustin | 11:cada08fc8a70 | 54 | static void mbedtls_zeroize( void *v, size_t n ) { |
mbedAustin | 11:cada08fc8a70 | 55 | volatile unsigned char *p = v; while( n-- ) *p++ = 0; |
mbedAustin | 11:cada08fc8a70 | 56 | } |
mbedAustin | 11:cada08fc8a70 | 57 | #endif |
mbedAustin | 11:cada08fc8a70 | 58 | |
mbedAustin | 11:cada08fc8a70 | 59 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
mbedAustin | 11:cada08fc8a70 | 60 | int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 61 | const unsigned char *info, |
mbedAustin | 11:cada08fc8a70 | 62 | size_t ilen ) |
mbedAustin | 11:cada08fc8a70 | 63 | { |
mbedAustin | 11:cada08fc8a70 | 64 | if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER ) |
mbedAustin | 11:cada08fc8a70 | 65 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 66 | |
mbedAustin | 11:cada08fc8a70 | 67 | mbedtls_free( ssl->cli_id ); |
mbedAustin | 11:cada08fc8a70 | 68 | |
mbedAustin | 11:cada08fc8a70 | 69 | if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL ) |
mbedAustin | 11:cada08fc8a70 | 70 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
mbedAustin | 11:cada08fc8a70 | 71 | |
mbedAustin | 11:cada08fc8a70 | 72 | memcpy( ssl->cli_id, info, ilen ); |
mbedAustin | 11:cada08fc8a70 | 73 | ssl->cli_id_len = ilen; |
mbedAustin | 11:cada08fc8a70 | 74 | |
mbedAustin | 11:cada08fc8a70 | 75 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 76 | } |
mbedAustin | 11:cada08fc8a70 | 77 | |
mbedAustin | 11:cada08fc8a70 | 78 | void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf, |
mbedAustin | 11:cada08fc8a70 | 79 | mbedtls_ssl_cookie_write_t *f_cookie_write, |
mbedAustin | 11:cada08fc8a70 | 80 | mbedtls_ssl_cookie_check_t *f_cookie_check, |
mbedAustin | 11:cada08fc8a70 | 81 | void *p_cookie ) |
mbedAustin | 11:cada08fc8a70 | 82 | { |
mbedAustin | 11:cada08fc8a70 | 83 | conf->f_cookie_write = f_cookie_write; |
mbedAustin | 11:cada08fc8a70 | 84 | conf->f_cookie_check = f_cookie_check; |
mbedAustin | 11:cada08fc8a70 | 85 | conf->p_cookie = p_cookie; |
mbedAustin | 11:cada08fc8a70 | 86 | } |
mbedAustin | 11:cada08fc8a70 | 87 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
mbedAustin | 11:cada08fc8a70 | 88 | |
mbedAustin | 11:cada08fc8a70 | 89 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
mbedAustin | 11:cada08fc8a70 | 90 | static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 91 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 92 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 93 | { |
mbedAustin | 11:cada08fc8a70 | 94 | int ret; |
mbedAustin | 11:cada08fc8a70 | 95 | size_t servername_list_size, hostname_len; |
mbedAustin | 11:cada08fc8a70 | 96 | const unsigned char *p; |
mbedAustin | 11:cada08fc8a70 | 97 | |
mbedAustin | 11:cada08fc8a70 | 98 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 99 | |
mbedAustin | 11:cada08fc8a70 | 100 | servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
mbedAustin | 11:cada08fc8a70 | 101 | if( servername_list_size + 2 != len ) |
mbedAustin | 11:cada08fc8a70 | 102 | { |
mbedAustin | 11:cada08fc8a70 | 103 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 104 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 105 | } |
mbedAustin | 11:cada08fc8a70 | 106 | |
mbedAustin | 11:cada08fc8a70 | 107 | p = buf + 2; |
mbedAustin | 11:cada08fc8a70 | 108 | while( servername_list_size > 0 ) |
mbedAustin | 11:cada08fc8a70 | 109 | { |
mbedAustin | 11:cada08fc8a70 | 110 | hostname_len = ( ( p[1] << 8 ) | p[2] ); |
mbedAustin | 11:cada08fc8a70 | 111 | if( hostname_len + 3 > servername_list_size ) |
mbedAustin | 11:cada08fc8a70 | 112 | { |
mbedAustin | 11:cada08fc8a70 | 113 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 114 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 115 | } |
mbedAustin | 11:cada08fc8a70 | 116 | |
mbedAustin | 11:cada08fc8a70 | 117 | if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) |
mbedAustin | 11:cada08fc8a70 | 118 | { |
mbedAustin | 11:cada08fc8a70 | 119 | ret = ssl->conf->f_sni( ssl->conf->p_sni, |
mbedAustin | 11:cada08fc8a70 | 120 | ssl, p + 3, hostname_len ); |
mbedAustin | 11:cada08fc8a70 | 121 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 122 | { |
mbedAustin | 11:cada08fc8a70 | 123 | MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret ); |
mbedAustin | 11:cada08fc8a70 | 124 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 125 | MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME ); |
mbedAustin | 11:cada08fc8a70 | 126 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 127 | } |
mbedAustin | 11:cada08fc8a70 | 128 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 129 | } |
mbedAustin | 11:cada08fc8a70 | 130 | |
mbedAustin | 11:cada08fc8a70 | 131 | servername_list_size -= hostname_len + 3; |
mbedAustin | 11:cada08fc8a70 | 132 | p += hostname_len + 3; |
mbedAustin | 11:cada08fc8a70 | 133 | } |
mbedAustin | 11:cada08fc8a70 | 134 | |
mbedAustin | 11:cada08fc8a70 | 135 | if( servername_list_size != 0 ) |
mbedAustin | 11:cada08fc8a70 | 136 | { |
mbedAustin | 11:cada08fc8a70 | 137 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 138 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 139 | } |
mbedAustin | 11:cada08fc8a70 | 140 | |
mbedAustin | 11:cada08fc8a70 | 141 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 142 | } |
mbedAustin | 11:cada08fc8a70 | 143 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
mbedAustin | 11:cada08fc8a70 | 144 | |
mbedAustin | 11:cada08fc8a70 | 145 | static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 146 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 147 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 148 | { |
mbedAustin | 11:cada08fc8a70 | 149 | int ret; |
mbedAustin | 11:cada08fc8a70 | 150 | |
mbedAustin | 11:cada08fc8a70 | 151 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 152 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 153 | { |
mbedAustin | 11:cada08fc8a70 | 154 | /* Check verify-data in constant-time. The length OTOH is no secret */ |
mbedAustin | 11:cada08fc8a70 | 155 | if( len != 1 + ssl->verify_data_len || |
mbedAustin | 11:cada08fc8a70 | 156 | buf[0] != ssl->verify_data_len || |
mbedAustin | 11:cada08fc8a70 | 157 | mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data, |
mbedAustin | 11:cada08fc8a70 | 158 | ssl->verify_data_len ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 159 | { |
mbedAustin | 11:cada08fc8a70 | 160 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) ); |
mbedAustin | 11:cada08fc8a70 | 161 | |
mbedAustin | 11:cada08fc8a70 | 162 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 163 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 164 | |
mbedAustin | 11:cada08fc8a70 | 165 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 166 | } |
mbedAustin | 11:cada08fc8a70 | 167 | } |
mbedAustin | 11:cada08fc8a70 | 168 | else |
mbedAustin | 11:cada08fc8a70 | 169 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
mbedAustin | 11:cada08fc8a70 | 170 | { |
mbedAustin | 11:cada08fc8a70 | 171 | if( len != 1 || buf[0] != 0x0 ) |
mbedAustin | 11:cada08fc8a70 | 172 | { |
mbedAustin | 11:cada08fc8a70 | 173 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) ); |
mbedAustin | 11:cada08fc8a70 | 174 | |
mbedAustin | 11:cada08fc8a70 | 175 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 176 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 177 | |
mbedAustin | 11:cada08fc8a70 | 178 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 179 | } |
mbedAustin | 11:cada08fc8a70 | 180 | |
mbedAustin | 11:cada08fc8a70 | 181 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
mbedAustin | 11:cada08fc8a70 | 182 | } |
mbedAustin | 11:cada08fc8a70 | 183 | |
mbedAustin | 11:cada08fc8a70 | 184 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 185 | } |
mbedAustin | 11:cada08fc8a70 | 186 | |
mbedAustin | 11:cada08fc8a70 | 187 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
mbedAustin | 11:cada08fc8a70 | 188 | defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
mbedAustin | 11:cada08fc8a70 | 189 | static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 190 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 191 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 192 | { |
mbedAustin | 11:cada08fc8a70 | 193 | size_t sig_alg_list_size; |
mbedAustin | 11:cada08fc8a70 | 194 | const unsigned char *p; |
mbedAustin | 11:cada08fc8a70 | 195 | const unsigned char *end = buf + len; |
mbedAustin | 11:cada08fc8a70 | 196 | const int *md_cur; |
mbedAustin | 11:cada08fc8a70 | 197 | |
mbedAustin | 11:cada08fc8a70 | 198 | |
mbedAustin | 11:cada08fc8a70 | 199 | sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
mbedAustin | 11:cada08fc8a70 | 200 | if( sig_alg_list_size + 2 != len || |
mbedAustin | 11:cada08fc8a70 | 201 | sig_alg_list_size % 2 != 0 ) |
mbedAustin | 11:cada08fc8a70 | 202 | { |
mbedAustin | 11:cada08fc8a70 | 203 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 204 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 205 | } |
mbedAustin | 11:cada08fc8a70 | 206 | |
mbedAustin | 11:cada08fc8a70 | 207 | /* |
mbedAustin | 11:cada08fc8a70 | 208 | * For now, ignore the SignatureAlgorithm part and rely on offered |
mbedAustin | 11:cada08fc8a70 | 209 | * ciphersuites only for that part. To be fixed later. |
mbedAustin | 11:cada08fc8a70 | 210 | * |
mbedAustin | 11:cada08fc8a70 | 211 | * So, just look at the HashAlgorithm part. |
mbedAustin | 11:cada08fc8a70 | 212 | */ |
mbedAustin | 11:cada08fc8a70 | 213 | for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) { |
mbedAustin | 11:cada08fc8a70 | 214 | for( p = buf + 2; p < end; p += 2 ) { |
mbedAustin | 11:cada08fc8a70 | 215 | if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) { |
mbedAustin | 11:cada08fc8a70 | 216 | ssl->handshake->sig_alg = p[0]; |
mbedAustin | 11:cada08fc8a70 | 217 | goto have_sig_alg; |
mbedAustin | 11:cada08fc8a70 | 218 | } |
mbedAustin | 11:cada08fc8a70 | 219 | } |
mbedAustin | 11:cada08fc8a70 | 220 | } |
mbedAustin | 11:cada08fc8a70 | 221 | |
mbedAustin | 11:cada08fc8a70 | 222 | /* Some key echanges do not need signatures at all */ |
mbedAustin | 11:cada08fc8a70 | 223 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) ); |
mbedAustin | 11:cada08fc8a70 | 224 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 225 | |
mbedAustin | 11:cada08fc8a70 | 226 | have_sig_alg: |
mbedAustin | 11:cada08fc8a70 | 227 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d", |
mbedAustin | 11:cada08fc8a70 | 228 | ssl->handshake->sig_alg ) ); |
mbedAustin | 11:cada08fc8a70 | 229 | |
mbedAustin | 11:cada08fc8a70 | 230 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 231 | } |
mbedAustin | 11:cada08fc8a70 | 232 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
mbedAustin | 11:cada08fc8a70 | 233 | MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 234 | |
mbedAustin | 11:cada08fc8a70 | 235 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
mbedAustin | 11:cada08fc8a70 | 236 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 237 | static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 238 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 239 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 240 | { |
mbedAustin | 11:cada08fc8a70 | 241 | size_t list_size, our_size; |
mbedAustin | 11:cada08fc8a70 | 242 | const unsigned char *p; |
mbedAustin | 11:cada08fc8a70 | 243 | const mbedtls_ecp_curve_info *curve_info, **curves; |
mbedAustin | 11:cada08fc8a70 | 244 | |
mbedAustin | 11:cada08fc8a70 | 245 | list_size = ( ( buf[0] << 8 ) | ( buf[1] ) ); |
mbedAustin | 11:cada08fc8a70 | 246 | if( list_size + 2 != len || |
mbedAustin | 11:cada08fc8a70 | 247 | list_size % 2 != 0 ) |
mbedAustin | 11:cada08fc8a70 | 248 | { |
mbedAustin | 11:cada08fc8a70 | 249 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 250 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 251 | } |
mbedAustin | 11:cada08fc8a70 | 252 | |
mbedAustin | 11:cada08fc8a70 | 253 | /* Should never happen unless client duplicates the extension */ |
mbedAustin | 11:cada08fc8a70 | 254 | if( ssl->handshake->curves != NULL ) |
mbedAustin | 11:cada08fc8a70 | 255 | { |
mbedAustin | 11:cada08fc8a70 | 256 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 257 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 258 | } |
mbedAustin | 11:cada08fc8a70 | 259 | |
mbedAustin | 11:cada08fc8a70 | 260 | /* Don't allow our peer to make us allocate too much memory, |
mbedAustin | 11:cada08fc8a70 | 261 | * and leave room for a final 0 */ |
mbedAustin | 11:cada08fc8a70 | 262 | our_size = list_size / 2 + 1; |
mbedAustin | 11:cada08fc8a70 | 263 | if( our_size > MBEDTLS_ECP_DP_MAX ) |
mbedAustin | 11:cada08fc8a70 | 264 | our_size = MBEDTLS_ECP_DP_MAX; |
mbedAustin | 11:cada08fc8a70 | 265 | |
mbedAustin | 11:cada08fc8a70 | 266 | if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL ) |
mbedAustin | 11:cada08fc8a70 | 267 | return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); |
mbedAustin | 11:cada08fc8a70 | 268 | |
mbedAustin | 11:cada08fc8a70 | 269 | ssl->handshake->curves = curves; |
mbedAustin | 11:cada08fc8a70 | 270 | |
mbedAustin | 11:cada08fc8a70 | 271 | p = buf + 2; |
mbedAustin | 11:cada08fc8a70 | 272 | while( list_size > 0 && our_size > 1 ) |
mbedAustin | 11:cada08fc8a70 | 273 | { |
mbedAustin | 11:cada08fc8a70 | 274 | curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] ); |
mbedAustin | 11:cada08fc8a70 | 275 | |
mbedAustin | 11:cada08fc8a70 | 276 | if( curve_info != NULL ) |
mbedAustin | 11:cada08fc8a70 | 277 | { |
mbedAustin | 11:cada08fc8a70 | 278 | *curves++ = curve_info; |
mbedAustin | 11:cada08fc8a70 | 279 | our_size--; |
mbedAustin | 11:cada08fc8a70 | 280 | } |
mbedAustin | 11:cada08fc8a70 | 281 | |
mbedAustin | 11:cada08fc8a70 | 282 | list_size -= 2; |
mbedAustin | 11:cada08fc8a70 | 283 | p += 2; |
mbedAustin | 11:cada08fc8a70 | 284 | } |
mbedAustin | 11:cada08fc8a70 | 285 | |
mbedAustin | 11:cada08fc8a70 | 286 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 287 | } |
mbedAustin | 11:cada08fc8a70 | 288 | |
mbedAustin | 11:cada08fc8a70 | 289 | static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 290 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 291 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 292 | { |
mbedAustin | 11:cada08fc8a70 | 293 | size_t list_size; |
mbedAustin | 11:cada08fc8a70 | 294 | const unsigned char *p; |
mbedAustin | 11:cada08fc8a70 | 295 | |
mbedAustin | 11:cada08fc8a70 | 296 | list_size = buf[0]; |
mbedAustin | 11:cada08fc8a70 | 297 | if( list_size + 1 != len ) |
mbedAustin | 11:cada08fc8a70 | 298 | { |
mbedAustin | 11:cada08fc8a70 | 299 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 300 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 301 | } |
mbedAustin | 11:cada08fc8a70 | 302 | |
mbedAustin | 11:cada08fc8a70 | 303 | p = buf + 1; |
mbedAustin | 11:cada08fc8a70 | 304 | while( list_size > 0 ) |
mbedAustin | 11:cada08fc8a70 | 305 | { |
mbedAustin | 11:cada08fc8a70 | 306 | if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || |
mbedAustin | 11:cada08fc8a70 | 307 | p[0] == MBEDTLS_ECP_PF_COMPRESSED ) |
mbedAustin | 11:cada08fc8a70 | 308 | { |
mbedAustin | 11:cada08fc8a70 | 309 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
mbedAustin | 11:cada08fc8a70 | 310 | ssl->handshake->ecdh_ctx.point_format = p[0]; |
mbedAustin | 11:cada08fc8a70 | 311 | #endif |
mbedAustin | 11:cada08fc8a70 | 312 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 313 | ssl->handshake->ecjpake_ctx.point_format = p[0]; |
mbedAustin | 11:cada08fc8a70 | 314 | #endif |
mbedAustin | 11:cada08fc8a70 | 315 | MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) ); |
mbedAustin | 11:cada08fc8a70 | 316 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 317 | } |
mbedAustin | 11:cada08fc8a70 | 318 | |
mbedAustin | 11:cada08fc8a70 | 319 | list_size--; |
mbedAustin | 11:cada08fc8a70 | 320 | p++; |
mbedAustin | 11:cada08fc8a70 | 321 | } |
mbedAustin | 11:cada08fc8a70 | 322 | |
mbedAustin | 11:cada08fc8a70 | 323 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 324 | } |
mbedAustin | 11:cada08fc8a70 | 325 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
mbedAustin | 11:cada08fc8a70 | 326 | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 327 | |
mbedAustin | 11:cada08fc8a70 | 328 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 329 | static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 330 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 331 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 332 | { |
mbedAustin | 11:cada08fc8a70 | 333 | int ret; |
mbedAustin | 11:cada08fc8a70 | 334 | |
mbedAustin | 11:cada08fc8a70 | 335 | if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 336 | { |
mbedAustin | 11:cada08fc8a70 | 337 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 338 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 339 | } |
mbedAustin | 11:cada08fc8a70 | 340 | |
mbedAustin | 11:cada08fc8a70 | 341 | if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx, |
mbedAustin | 11:cada08fc8a70 | 342 | buf, len ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 343 | { |
mbedAustin | 11:cada08fc8a70 | 344 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret ); |
mbedAustin | 11:cada08fc8a70 | 345 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 346 | } |
mbedAustin | 11:cada08fc8a70 | 347 | |
mbedAustin | 11:cada08fc8a70 | 348 | /* Only mark the extension as OK when we're sure it is */ |
mbedAustin | 11:cada08fc8a70 | 349 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK; |
mbedAustin | 11:cada08fc8a70 | 350 | |
mbedAustin | 11:cada08fc8a70 | 351 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 352 | } |
mbedAustin | 11:cada08fc8a70 | 353 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 354 | |
mbedAustin | 11:cada08fc8a70 | 355 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
mbedAustin | 11:cada08fc8a70 | 356 | static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 357 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 358 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 359 | { |
mbedAustin | 11:cada08fc8a70 | 360 | if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID ) |
mbedAustin | 11:cada08fc8a70 | 361 | { |
mbedAustin | 11:cada08fc8a70 | 362 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 363 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 364 | } |
mbedAustin | 11:cada08fc8a70 | 365 | |
mbedAustin | 11:cada08fc8a70 | 366 | ssl->session_negotiate->mfl_code = buf[0]; |
mbedAustin | 11:cada08fc8a70 | 367 | |
mbedAustin | 11:cada08fc8a70 | 368 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 369 | } |
mbedAustin | 11:cada08fc8a70 | 370 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
mbedAustin | 11:cada08fc8a70 | 371 | |
mbedAustin | 11:cada08fc8a70 | 372 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
mbedAustin | 11:cada08fc8a70 | 373 | static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 374 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 375 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 376 | { |
mbedAustin | 11:cada08fc8a70 | 377 | if( len != 0 ) |
mbedAustin | 11:cada08fc8a70 | 378 | { |
mbedAustin | 11:cada08fc8a70 | 379 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 380 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 381 | } |
mbedAustin | 11:cada08fc8a70 | 382 | |
mbedAustin | 11:cada08fc8a70 | 383 | ((void) buf); |
mbedAustin | 11:cada08fc8a70 | 384 | |
mbedAustin | 11:cada08fc8a70 | 385 | if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED ) |
mbedAustin | 11:cada08fc8a70 | 386 | ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; |
mbedAustin | 11:cada08fc8a70 | 387 | |
mbedAustin | 11:cada08fc8a70 | 388 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 389 | } |
mbedAustin | 11:cada08fc8a70 | 390 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
mbedAustin | 11:cada08fc8a70 | 391 | |
mbedAustin | 11:cada08fc8a70 | 392 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
mbedAustin | 11:cada08fc8a70 | 393 | static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 394 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 395 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 396 | { |
mbedAustin | 11:cada08fc8a70 | 397 | if( len != 0 ) |
mbedAustin | 11:cada08fc8a70 | 398 | { |
mbedAustin | 11:cada08fc8a70 | 399 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 400 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 401 | } |
mbedAustin | 11:cada08fc8a70 | 402 | |
mbedAustin | 11:cada08fc8a70 | 403 | ((void) buf); |
mbedAustin | 11:cada08fc8a70 | 404 | |
mbedAustin | 11:cada08fc8a70 | 405 | if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 406 | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
mbedAustin | 11:cada08fc8a70 | 407 | { |
mbedAustin | 11:cada08fc8a70 | 408 | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; |
mbedAustin | 11:cada08fc8a70 | 409 | } |
mbedAustin | 11:cada08fc8a70 | 410 | |
mbedAustin | 11:cada08fc8a70 | 411 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 412 | } |
mbedAustin | 11:cada08fc8a70 | 413 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
mbedAustin | 11:cada08fc8a70 | 414 | |
mbedAustin | 11:cada08fc8a70 | 415 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
mbedAustin | 11:cada08fc8a70 | 416 | static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 417 | const unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 418 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 419 | { |
mbedAustin | 11:cada08fc8a70 | 420 | if( len != 0 ) |
mbedAustin | 11:cada08fc8a70 | 421 | { |
mbedAustin | 11:cada08fc8a70 | 422 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 423 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 424 | } |
mbedAustin | 11:cada08fc8a70 | 425 | |
mbedAustin | 11:cada08fc8a70 | 426 | ((void) buf); |
mbedAustin | 11:cada08fc8a70 | 427 | |
mbedAustin | 11:cada08fc8a70 | 428 | if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 429 | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
mbedAustin | 11:cada08fc8a70 | 430 | { |
mbedAustin | 11:cada08fc8a70 | 431 | ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; |
mbedAustin | 11:cada08fc8a70 | 432 | } |
mbedAustin | 11:cada08fc8a70 | 433 | |
mbedAustin | 11:cada08fc8a70 | 434 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 435 | } |
mbedAustin | 11:cada08fc8a70 | 436 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
mbedAustin | 11:cada08fc8a70 | 437 | |
mbedAustin | 11:cada08fc8a70 | 438 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 439 | static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 440 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 441 | size_t len ) |
mbedAustin | 11:cada08fc8a70 | 442 | { |
mbedAustin | 11:cada08fc8a70 | 443 | int ret; |
mbedAustin | 11:cada08fc8a70 | 444 | mbedtls_ssl_session session; |
mbedAustin | 11:cada08fc8a70 | 445 | |
mbedAustin | 11:cada08fc8a70 | 446 | mbedtls_ssl_session_init( &session ); |
mbedAustin | 11:cada08fc8a70 | 447 | |
mbedAustin | 11:cada08fc8a70 | 448 | if( ssl->conf->f_ticket_parse == NULL || |
mbedAustin | 11:cada08fc8a70 | 449 | ssl->conf->f_ticket_write == NULL ) |
mbedAustin | 11:cada08fc8a70 | 450 | { |
mbedAustin | 11:cada08fc8a70 | 451 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 452 | } |
mbedAustin | 11:cada08fc8a70 | 453 | |
mbedAustin | 11:cada08fc8a70 | 454 | /* Remember the client asked us to send a new ticket */ |
mbedAustin | 11:cada08fc8a70 | 455 | ssl->handshake->new_session_ticket = 1; |
mbedAustin | 11:cada08fc8a70 | 456 | |
mbedAustin | 11:cada08fc8a70 | 457 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) ); |
mbedAustin | 11:cada08fc8a70 | 458 | |
mbedAustin | 11:cada08fc8a70 | 459 | if( len == 0 ) |
mbedAustin | 11:cada08fc8a70 | 460 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 461 | |
mbedAustin | 11:cada08fc8a70 | 462 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 463 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 464 | { |
mbedAustin | 11:cada08fc8a70 | 465 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) ); |
mbedAustin | 11:cada08fc8a70 | 466 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 467 | } |
mbedAustin | 11:cada08fc8a70 | 468 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
mbedAustin | 11:cada08fc8a70 | 469 | |
mbedAustin | 11:cada08fc8a70 | 470 | /* |
mbedAustin | 11:cada08fc8a70 | 471 | * Failures are ok: just ignore the ticket and proceed. |
mbedAustin | 11:cada08fc8a70 | 472 | */ |
mbedAustin | 11:cada08fc8a70 | 473 | if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session, |
mbedAustin | 11:cada08fc8a70 | 474 | buf, len ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 475 | { |
mbedAustin | 11:cada08fc8a70 | 476 | mbedtls_ssl_session_free( &session ); |
mbedAustin | 11:cada08fc8a70 | 477 | |
mbedAustin | 11:cada08fc8a70 | 478 | if( ret == MBEDTLS_ERR_SSL_INVALID_MAC ) |
mbedAustin | 11:cada08fc8a70 | 479 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) ); |
mbedAustin | 11:cada08fc8a70 | 480 | else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED ) |
mbedAustin | 11:cada08fc8a70 | 481 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) ); |
mbedAustin | 11:cada08fc8a70 | 482 | else |
mbedAustin | 11:cada08fc8a70 | 483 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret ); |
mbedAustin | 11:cada08fc8a70 | 484 | |
mbedAustin | 11:cada08fc8a70 | 485 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 486 | } |
mbedAustin | 11:cada08fc8a70 | 487 | |
mbedAustin | 11:cada08fc8a70 | 488 | /* |
mbedAustin | 11:cada08fc8a70 | 489 | * Keep the session ID sent by the client, since we MUST send it back to |
mbedAustin | 11:cada08fc8a70 | 490 | * inform them we're accepting the ticket (RFC 5077 section 3.4) |
mbedAustin | 11:cada08fc8a70 | 491 | */ |
mbedAustin | 11:cada08fc8a70 | 492 | session.id_len = ssl->session_negotiate->id_len; |
mbedAustin | 11:cada08fc8a70 | 493 | memcpy( &session.id, ssl->session_negotiate->id, session.id_len ); |
mbedAustin | 11:cada08fc8a70 | 494 | |
mbedAustin | 11:cada08fc8a70 | 495 | mbedtls_ssl_session_free( ssl->session_negotiate ); |
mbedAustin | 11:cada08fc8a70 | 496 | memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) ); |
mbedAustin | 11:cada08fc8a70 | 497 | |
mbedAustin | 11:cada08fc8a70 | 498 | /* Zeroize instead of free as we copied the content */ |
mbedAustin | 11:cada08fc8a70 | 499 | mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) ); |
mbedAustin | 11:cada08fc8a70 | 500 | |
mbedAustin | 11:cada08fc8a70 | 501 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) ); |
mbedAustin | 11:cada08fc8a70 | 502 | |
mbedAustin | 11:cada08fc8a70 | 503 | ssl->handshake->resume = 1; |
mbedAustin | 11:cada08fc8a70 | 504 | |
mbedAustin | 11:cada08fc8a70 | 505 | /* Don't send a new ticket after all, this one is OK */ |
mbedAustin | 11:cada08fc8a70 | 506 | ssl->handshake->new_session_ticket = 0; |
mbedAustin | 11:cada08fc8a70 | 507 | |
mbedAustin | 11:cada08fc8a70 | 508 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 509 | } |
mbedAustin | 11:cada08fc8a70 | 510 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
mbedAustin | 11:cada08fc8a70 | 511 | |
mbedAustin | 11:cada08fc8a70 | 512 | #if defined(MBEDTLS_SSL_ALPN) |
mbedAustin | 11:cada08fc8a70 | 513 | static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 514 | const unsigned char *buf, size_t len ) |
mbedAustin | 11:cada08fc8a70 | 515 | { |
mbedAustin | 11:cada08fc8a70 | 516 | size_t list_len, cur_len, ours_len; |
mbedAustin | 11:cada08fc8a70 | 517 | const unsigned char *theirs, *start, *end; |
mbedAustin | 11:cada08fc8a70 | 518 | const char **ours; |
mbedAustin | 11:cada08fc8a70 | 519 | |
mbedAustin | 11:cada08fc8a70 | 520 | /* If ALPN not configured, just ignore the extension */ |
mbedAustin | 11:cada08fc8a70 | 521 | if( ssl->conf->alpn_list == NULL ) |
mbedAustin | 11:cada08fc8a70 | 522 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 523 | |
mbedAustin | 11:cada08fc8a70 | 524 | /* |
mbedAustin | 11:cada08fc8a70 | 525 | * opaque ProtocolName<1..2^8-1>; |
mbedAustin | 11:cada08fc8a70 | 526 | * |
mbedAustin | 11:cada08fc8a70 | 527 | * struct { |
mbedAustin | 11:cada08fc8a70 | 528 | * ProtocolName protocol_name_list<2..2^16-1> |
mbedAustin | 11:cada08fc8a70 | 529 | * } ProtocolNameList; |
mbedAustin | 11:cada08fc8a70 | 530 | */ |
mbedAustin | 11:cada08fc8a70 | 531 | |
mbedAustin | 11:cada08fc8a70 | 532 | /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */ |
mbedAustin | 11:cada08fc8a70 | 533 | if( len < 4 ) |
mbedAustin | 11:cada08fc8a70 | 534 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 535 | |
mbedAustin | 11:cada08fc8a70 | 536 | list_len = ( buf[0] << 8 ) | buf[1]; |
mbedAustin | 11:cada08fc8a70 | 537 | if( list_len != len - 2 ) |
mbedAustin | 11:cada08fc8a70 | 538 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 539 | |
mbedAustin | 11:cada08fc8a70 | 540 | /* |
mbedAustin | 11:cada08fc8a70 | 541 | * Use our order of preference |
mbedAustin | 11:cada08fc8a70 | 542 | */ |
mbedAustin | 11:cada08fc8a70 | 543 | start = buf + 2; |
mbedAustin | 11:cada08fc8a70 | 544 | end = buf + len; |
mbedAustin | 11:cada08fc8a70 | 545 | for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ ) |
mbedAustin | 11:cada08fc8a70 | 546 | { |
mbedAustin | 11:cada08fc8a70 | 547 | ours_len = strlen( *ours ); |
mbedAustin | 11:cada08fc8a70 | 548 | for( theirs = start; theirs != end; theirs += cur_len ) |
mbedAustin | 11:cada08fc8a70 | 549 | { |
mbedAustin | 11:cada08fc8a70 | 550 | /* If the list is well formed, we should get equality first */ |
mbedAustin | 11:cada08fc8a70 | 551 | if( theirs > end ) |
mbedAustin | 11:cada08fc8a70 | 552 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 553 | |
mbedAustin | 11:cada08fc8a70 | 554 | cur_len = *theirs++; |
mbedAustin | 11:cada08fc8a70 | 555 | |
mbedAustin | 11:cada08fc8a70 | 556 | /* Empty strings MUST NOT be included */ |
mbedAustin | 11:cada08fc8a70 | 557 | if( cur_len == 0 ) |
mbedAustin | 11:cada08fc8a70 | 558 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 559 | |
mbedAustin | 11:cada08fc8a70 | 560 | if( cur_len == ours_len && |
mbedAustin | 11:cada08fc8a70 | 561 | memcmp( theirs, *ours, cur_len ) == 0 ) |
mbedAustin | 11:cada08fc8a70 | 562 | { |
mbedAustin | 11:cada08fc8a70 | 563 | ssl->alpn_chosen = *ours; |
mbedAustin | 11:cada08fc8a70 | 564 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 565 | } |
mbedAustin | 11:cada08fc8a70 | 566 | } |
mbedAustin | 11:cada08fc8a70 | 567 | } |
mbedAustin | 11:cada08fc8a70 | 568 | |
mbedAustin | 11:cada08fc8a70 | 569 | /* If we get there, no match was found */ |
mbedAustin | 11:cada08fc8a70 | 570 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 571 | MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL ); |
mbedAustin | 11:cada08fc8a70 | 572 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 573 | } |
mbedAustin | 11:cada08fc8a70 | 574 | #endif /* MBEDTLS_SSL_ALPN */ |
mbedAustin | 11:cada08fc8a70 | 575 | |
mbedAustin | 11:cada08fc8a70 | 576 | /* |
mbedAustin | 11:cada08fc8a70 | 577 | * Auxiliary functions for ServerHello parsing and related actions |
mbedAustin | 11:cada08fc8a70 | 578 | */ |
mbedAustin | 11:cada08fc8a70 | 579 | |
mbedAustin | 11:cada08fc8a70 | 580 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
mbedAustin | 11:cada08fc8a70 | 581 | /* |
mbedAustin | 11:cada08fc8a70 | 582 | * Return 0 if the given key uses one of the acceptable curves, -1 otherwise |
mbedAustin | 11:cada08fc8a70 | 583 | */ |
mbedAustin | 11:cada08fc8a70 | 584 | #if defined(MBEDTLS_ECDSA_C) |
mbedAustin | 11:cada08fc8a70 | 585 | static int ssl_check_key_curve( mbedtls_pk_context *pk, |
mbedAustin | 11:cada08fc8a70 | 586 | const mbedtls_ecp_curve_info **curves ) |
mbedAustin | 11:cada08fc8a70 | 587 | { |
mbedAustin | 11:cada08fc8a70 | 588 | const mbedtls_ecp_curve_info **crv = curves; |
mbedAustin | 11:cada08fc8a70 | 589 | mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id; |
mbedAustin | 11:cada08fc8a70 | 590 | |
mbedAustin | 11:cada08fc8a70 | 591 | while( *crv != NULL ) |
mbedAustin | 11:cada08fc8a70 | 592 | { |
mbedAustin | 11:cada08fc8a70 | 593 | if( (*crv)->grp_id == grp_id ) |
mbedAustin | 11:cada08fc8a70 | 594 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 595 | crv++; |
mbedAustin | 11:cada08fc8a70 | 596 | } |
mbedAustin | 11:cada08fc8a70 | 597 | |
mbedAustin | 11:cada08fc8a70 | 598 | return( -1 ); |
mbedAustin | 11:cada08fc8a70 | 599 | } |
mbedAustin | 11:cada08fc8a70 | 600 | #endif /* MBEDTLS_ECDSA_C */ |
mbedAustin | 11:cada08fc8a70 | 601 | |
mbedAustin | 11:cada08fc8a70 | 602 | /* |
mbedAustin | 11:cada08fc8a70 | 603 | * Try picking a certificate for this ciphersuite, |
mbedAustin | 11:cada08fc8a70 | 604 | * return 0 on success and -1 on failure. |
mbedAustin | 11:cada08fc8a70 | 605 | */ |
mbedAustin | 11:cada08fc8a70 | 606 | static int ssl_pick_cert( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 607 | const mbedtls_ssl_ciphersuite_t * ciphersuite_info ) |
mbedAustin | 11:cada08fc8a70 | 608 | { |
mbedAustin | 11:cada08fc8a70 | 609 | mbedtls_ssl_key_cert *cur, *list, *fallback = NULL; |
mbedAustin | 11:cada08fc8a70 | 610 | mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ); |
mbedAustin | 11:cada08fc8a70 | 611 | uint32_t flags; |
mbedAustin | 11:cada08fc8a70 | 612 | |
mbedAustin | 11:cada08fc8a70 | 613 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
mbedAustin | 11:cada08fc8a70 | 614 | if( ssl->handshake->sni_key_cert != NULL ) |
mbedAustin | 11:cada08fc8a70 | 615 | list = ssl->handshake->sni_key_cert; |
mbedAustin | 11:cada08fc8a70 | 616 | else |
mbedAustin | 11:cada08fc8a70 | 617 | #endif |
mbedAustin | 11:cada08fc8a70 | 618 | list = ssl->conf->key_cert; |
mbedAustin | 11:cada08fc8a70 | 619 | |
mbedAustin | 11:cada08fc8a70 | 620 | if( pk_alg == MBEDTLS_PK_NONE ) |
mbedAustin | 11:cada08fc8a70 | 621 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 622 | |
mbedAustin | 11:cada08fc8a70 | 623 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) ); |
mbedAustin | 11:cada08fc8a70 | 624 | |
mbedAustin | 11:cada08fc8a70 | 625 | if( list == NULL ) |
mbedAustin | 11:cada08fc8a70 | 626 | { |
mbedAustin | 11:cada08fc8a70 | 627 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) ); |
mbedAustin | 11:cada08fc8a70 | 628 | return( -1 ); |
mbedAustin | 11:cada08fc8a70 | 629 | } |
mbedAustin | 11:cada08fc8a70 | 630 | |
mbedAustin | 11:cada08fc8a70 | 631 | for( cur = list; cur != NULL; cur = cur->next ) |
mbedAustin | 11:cada08fc8a70 | 632 | { |
mbedAustin | 11:cada08fc8a70 | 633 | MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate", |
mbedAustin | 11:cada08fc8a70 | 634 | cur->cert ); |
mbedAustin | 11:cada08fc8a70 | 635 | |
mbedAustin | 11:cada08fc8a70 | 636 | if( ! mbedtls_pk_can_do( cur->key, pk_alg ) ) |
mbedAustin | 11:cada08fc8a70 | 637 | { |
mbedAustin | 11:cada08fc8a70 | 638 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) ); |
mbedAustin | 11:cada08fc8a70 | 639 | continue; |
mbedAustin | 11:cada08fc8a70 | 640 | } |
mbedAustin | 11:cada08fc8a70 | 641 | |
mbedAustin | 11:cada08fc8a70 | 642 | /* |
mbedAustin | 11:cada08fc8a70 | 643 | * This avoids sending the client a cert it'll reject based on |
mbedAustin | 11:cada08fc8a70 | 644 | * keyUsage or other extensions. |
mbedAustin | 11:cada08fc8a70 | 645 | * |
mbedAustin | 11:cada08fc8a70 | 646 | * It also allows the user to provision different certificates for |
mbedAustin | 11:cada08fc8a70 | 647 | * different uses based on keyUsage, eg if they want to avoid signing |
mbedAustin | 11:cada08fc8a70 | 648 | * and decrypting with the same RSA key. |
mbedAustin | 11:cada08fc8a70 | 649 | */ |
mbedAustin | 11:cada08fc8a70 | 650 | if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info, |
mbedAustin | 11:cada08fc8a70 | 651 | MBEDTLS_SSL_IS_SERVER, &flags ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 652 | { |
mbedAustin | 11:cada08fc8a70 | 653 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: " |
mbedAustin | 11:cada08fc8a70 | 654 | "(extended) key usage extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 655 | continue; |
mbedAustin | 11:cada08fc8a70 | 656 | } |
mbedAustin | 11:cada08fc8a70 | 657 | |
mbedAustin | 11:cada08fc8a70 | 658 | #if defined(MBEDTLS_ECDSA_C) |
mbedAustin | 11:cada08fc8a70 | 659 | if( pk_alg == MBEDTLS_PK_ECDSA && |
mbedAustin | 11:cada08fc8a70 | 660 | ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 661 | { |
mbedAustin | 11:cada08fc8a70 | 662 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) ); |
mbedAustin | 11:cada08fc8a70 | 663 | continue; |
mbedAustin | 11:cada08fc8a70 | 664 | } |
mbedAustin | 11:cada08fc8a70 | 665 | #endif |
mbedAustin | 11:cada08fc8a70 | 666 | |
mbedAustin | 11:cada08fc8a70 | 667 | /* |
mbedAustin | 11:cada08fc8a70 | 668 | * Try to select a SHA-1 certificate for pre-1.2 clients, but still |
mbedAustin | 11:cada08fc8a70 | 669 | * present them a SHA-higher cert rather than failing if it's the only |
mbedAustin | 11:cada08fc8a70 | 670 | * one we got that satisfies the other conditions. |
mbedAustin | 11:cada08fc8a70 | 671 | */ |
mbedAustin | 11:cada08fc8a70 | 672 | if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 && |
mbedAustin | 11:cada08fc8a70 | 673 | cur->cert->sig_md != MBEDTLS_MD_SHA1 ) |
mbedAustin | 11:cada08fc8a70 | 674 | { |
mbedAustin | 11:cada08fc8a70 | 675 | if( fallback == NULL ) |
mbedAustin | 11:cada08fc8a70 | 676 | fallback = cur; |
mbedAustin | 11:cada08fc8a70 | 677 | { |
mbedAustin | 11:cada08fc8a70 | 678 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: " |
mbedAustin | 11:cada08fc8a70 | 679 | "sha-2 with pre-TLS 1.2 client" ) ); |
mbedAustin | 11:cada08fc8a70 | 680 | continue; |
mbedAustin | 11:cada08fc8a70 | 681 | } |
mbedAustin | 11:cada08fc8a70 | 682 | } |
mbedAustin | 11:cada08fc8a70 | 683 | |
mbedAustin | 11:cada08fc8a70 | 684 | /* If we get there, we got a winner */ |
mbedAustin | 11:cada08fc8a70 | 685 | break; |
mbedAustin | 11:cada08fc8a70 | 686 | } |
mbedAustin | 11:cada08fc8a70 | 687 | |
mbedAustin | 11:cada08fc8a70 | 688 | if( cur == NULL ) |
mbedAustin | 11:cada08fc8a70 | 689 | cur = fallback; |
mbedAustin | 11:cada08fc8a70 | 690 | |
mbedAustin | 11:cada08fc8a70 | 691 | /* Do not update ssl->handshake->key_cert unless there is a match */ |
mbedAustin | 11:cada08fc8a70 | 692 | if( cur != NULL ) |
mbedAustin | 11:cada08fc8a70 | 693 | { |
mbedAustin | 11:cada08fc8a70 | 694 | ssl->handshake->key_cert = cur; |
mbedAustin | 11:cada08fc8a70 | 695 | MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate", |
mbedAustin | 11:cada08fc8a70 | 696 | ssl->handshake->key_cert->cert ); |
mbedAustin | 11:cada08fc8a70 | 697 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 698 | } |
mbedAustin | 11:cada08fc8a70 | 699 | |
mbedAustin | 11:cada08fc8a70 | 700 | return( -1 ); |
mbedAustin | 11:cada08fc8a70 | 701 | } |
mbedAustin | 11:cada08fc8a70 | 702 | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
mbedAustin | 11:cada08fc8a70 | 703 | |
mbedAustin | 11:cada08fc8a70 | 704 | /* |
mbedAustin | 11:cada08fc8a70 | 705 | * Check if a given ciphersuite is suitable for use with our config/keys/etc |
mbedAustin | 11:cada08fc8a70 | 706 | * Sets ciphersuite_info only if the suite matches. |
mbedAustin | 11:cada08fc8a70 | 707 | */ |
mbedAustin | 11:cada08fc8a70 | 708 | static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id, |
mbedAustin | 11:cada08fc8a70 | 709 | const mbedtls_ssl_ciphersuite_t **ciphersuite_info ) |
mbedAustin | 11:cada08fc8a70 | 710 | { |
mbedAustin | 11:cada08fc8a70 | 711 | const mbedtls_ssl_ciphersuite_t *suite_info; |
mbedAustin | 11:cada08fc8a70 | 712 | |
mbedAustin | 11:cada08fc8a70 | 713 | suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id ); |
mbedAustin | 11:cada08fc8a70 | 714 | if( suite_info == NULL ) |
mbedAustin | 11:cada08fc8a70 | 715 | { |
mbedAustin | 11:cada08fc8a70 | 716 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 717 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 718 | } |
mbedAustin | 11:cada08fc8a70 | 719 | |
mbedAustin | 11:cada08fc8a70 | 720 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) ); |
mbedAustin | 11:cada08fc8a70 | 721 | |
mbedAustin | 11:cada08fc8a70 | 722 | if( suite_info->min_minor_ver > ssl->minor_ver || |
mbedAustin | 11:cada08fc8a70 | 723 | suite_info->max_minor_ver < ssl->minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 724 | { |
mbedAustin | 11:cada08fc8a70 | 725 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) ); |
mbedAustin | 11:cada08fc8a70 | 726 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 727 | } |
mbedAustin | 11:cada08fc8a70 | 728 | |
mbedAustin | 11:cada08fc8a70 | 729 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 730 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
mbedAustin | 11:cada08fc8a70 | 731 | ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) ) |
mbedAustin | 11:cada08fc8a70 | 732 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 733 | #endif |
mbedAustin | 11:cada08fc8a70 | 734 | |
mbedAustin | 11:cada08fc8a70 | 735 | #if defined(MBEDTLS_ARC4_C) |
mbedAustin | 11:cada08fc8a70 | 736 | if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED && |
mbedAustin | 11:cada08fc8a70 | 737 | suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 ) |
mbedAustin | 11:cada08fc8a70 | 738 | { |
mbedAustin | 11:cada08fc8a70 | 739 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) ); |
mbedAustin | 11:cada08fc8a70 | 740 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 741 | } |
mbedAustin | 11:cada08fc8a70 | 742 | #endif |
mbedAustin | 11:cada08fc8a70 | 743 | |
mbedAustin | 11:cada08fc8a70 | 744 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 745 | if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && |
mbedAustin | 11:cada08fc8a70 | 746 | ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 ) |
mbedAustin | 11:cada08fc8a70 | 747 | { |
mbedAustin | 11:cada08fc8a70 | 748 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake " |
mbedAustin | 11:cada08fc8a70 | 749 | "not configured or ext missing" ) ); |
mbedAustin | 11:cada08fc8a70 | 750 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 751 | } |
mbedAustin | 11:cada08fc8a70 | 752 | #endif |
mbedAustin | 11:cada08fc8a70 | 753 | |
mbedAustin | 11:cada08fc8a70 | 754 | |
mbedAustin | 11:cada08fc8a70 | 755 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
mbedAustin | 11:cada08fc8a70 | 756 | if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) && |
mbedAustin | 11:cada08fc8a70 | 757 | ( ssl->handshake->curves == NULL || |
mbedAustin | 11:cada08fc8a70 | 758 | ssl->handshake->curves[0] == NULL ) ) |
mbedAustin | 11:cada08fc8a70 | 759 | { |
mbedAustin | 11:cada08fc8a70 | 760 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: " |
mbedAustin | 11:cada08fc8a70 | 761 | "no common elliptic curve" ) ); |
mbedAustin | 11:cada08fc8a70 | 762 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 763 | } |
mbedAustin | 11:cada08fc8a70 | 764 | #endif |
mbedAustin | 11:cada08fc8a70 | 765 | |
mbedAustin | 11:cada08fc8a70 | 766 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 767 | /* If the ciphersuite requires a pre-shared key and we don't |
mbedAustin | 11:cada08fc8a70 | 768 | * have one, skip it now rather than failing later */ |
mbedAustin | 11:cada08fc8a70 | 769 | if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) && |
mbedAustin | 11:cada08fc8a70 | 770 | ssl->conf->f_psk == NULL && |
mbedAustin | 11:cada08fc8a70 | 771 | ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL || |
mbedAustin | 11:cada08fc8a70 | 772 | ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) ) |
mbedAustin | 11:cada08fc8a70 | 773 | { |
mbedAustin | 11:cada08fc8a70 | 774 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) ); |
mbedAustin | 11:cada08fc8a70 | 775 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 776 | } |
mbedAustin | 11:cada08fc8a70 | 777 | #endif |
mbedAustin | 11:cada08fc8a70 | 778 | |
mbedAustin | 11:cada08fc8a70 | 779 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
mbedAustin | 11:cada08fc8a70 | 780 | /* |
mbedAustin | 11:cada08fc8a70 | 781 | * Final check: if ciphersuite requires us to have a |
mbedAustin | 11:cada08fc8a70 | 782 | * certificate/key of a particular type: |
mbedAustin | 11:cada08fc8a70 | 783 | * - select the appropriate certificate if we have one, or |
mbedAustin | 11:cada08fc8a70 | 784 | * - try the next ciphersuite if we don't |
mbedAustin | 11:cada08fc8a70 | 785 | * This must be done last since we modify the key_cert list. |
mbedAustin | 11:cada08fc8a70 | 786 | */ |
mbedAustin | 11:cada08fc8a70 | 787 | if( ssl_pick_cert( ssl, suite_info ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 788 | { |
mbedAustin | 11:cada08fc8a70 | 789 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: " |
mbedAustin | 11:cada08fc8a70 | 790 | "no suitable certificate" ) ); |
mbedAustin | 11:cada08fc8a70 | 791 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 792 | } |
mbedAustin | 11:cada08fc8a70 | 793 | #endif |
mbedAustin | 11:cada08fc8a70 | 794 | |
mbedAustin | 11:cada08fc8a70 | 795 | *ciphersuite_info = suite_info; |
mbedAustin | 11:cada08fc8a70 | 796 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 797 | } |
mbedAustin | 11:cada08fc8a70 | 798 | |
mbedAustin | 11:cada08fc8a70 | 799 | #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) |
mbedAustin | 11:cada08fc8a70 | 800 | static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 801 | { |
mbedAustin | 11:cada08fc8a70 | 802 | int ret, got_common_suite; |
mbedAustin | 11:cada08fc8a70 | 803 | unsigned int i, j; |
mbedAustin | 11:cada08fc8a70 | 804 | size_t n; |
mbedAustin | 11:cada08fc8a70 | 805 | unsigned int ciph_len, sess_len, chal_len; |
mbedAustin | 11:cada08fc8a70 | 806 | unsigned char *buf, *p; |
mbedAustin | 11:cada08fc8a70 | 807 | const int *ciphersuites; |
mbedAustin | 11:cada08fc8a70 | 808 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 809 | |
mbedAustin | 11:cada08fc8a70 | 810 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) ); |
mbedAustin | 11:cada08fc8a70 | 811 | |
mbedAustin | 11:cada08fc8a70 | 812 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 813 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 814 | { |
mbedAustin | 11:cada08fc8a70 | 815 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) ); |
mbedAustin | 11:cada08fc8a70 | 816 | |
mbedAustin | 11:cada08fc8a70 | 817 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 818 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 819 | |
mbedAustin | 11:cada08fc8a70 | 820 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 821 | } |
mbedAustin | 11:cada08fc8a70 | 822 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
mbedAustin | 11:cada08fc8a70 | 823 | |
mbedAustin | 11:cada08fc8a70 | 824 | buf = ssl->in_hdr; |
mbedAustin | 11:cada08fc8a70 | 825 | |
mbedAustin | 11:cada08fc8a70 | 826 | MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 ); |
mbedAustin | 11:cada08fc8a70 | 827 | |
mbedAustin | 11:cada08fc8a70 | 828 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d", |
mbedAustin | 11:cada08fc8a70 | 829 | buf[2] ) ); |
mbedAustin | 11:cada08fc8a70 | 830 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d", |
mbedAustin | 11:cada08fc8a70 | 831 | ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) ); |
mbedAustin | 11:cada08fc8a70 | 832 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]", |
mbedAustin | 11:cada08fc8a70 | 833 | buf[3], buf[4] ) ); |
mbedAustin | 11:cada08fc8a70 | 834 | |
mbedAustin | 11:cada08fc8a70 | 835 | /* |
mbedAustin | 11:cada08fc8a70 | 836 | * SSLv2 Client Hello |
mbedAustin | 11:cada08fc8a70 | 837 | * |
mbedAustin | 11:cada08fc8a70 | 838 | * Record layer: |
mbedAustin | 11:cada08fc8a70 | 839 | * 0 . 1 message length |
mbedAustin | 11:cada08fc8a70 | 840 | * |
mbedAustin | 11:cada08fc8a70 | 841 | * SSL layer: |
mbedAustin | 11:cada08fc8a70 | 842 | * 2 . 2 message type |
mbedAustin | 11:cada08fc8a70 | 843 | * 3 . 4 protocol version |
mbedAustin | 11:cada08fc8a70 | 844 | */ |
mbedAustin | 11:cada08fc8a70 | 845 | if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO || |
mbedAustin | 11:cada08fc8a70 | 846 | buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 847 | { |
mbedAustin | 11:cada08fc8a70 | 848 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 849 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 850 | } |
mbedAustin | 11:cada08fc8a70 | 851 | |
mbedAustin | 11:cada08fc8a70 | 852 | n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF; |
mbedAustin | 11:cada08fc8a70 | 853 | |
mbedAustin | 11:cada08fc8a70 | 854 | if( n < 17 || n > 512 ) |
mbedAustin | 11:cada08fc8a70 | 855 | { |
mbedAustin | 11:cada08fc8a70 | 856 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 857 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 858 | } |
mbedAustin | 11:cada08fc8a70 | 859 | |
mbedAustin | 11:cada08fc8a70 | 860 | ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; |
mbedAustin | 11:cada08fc8a70 | 861 | ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 862 | ? buf[4] : ssl->conf->max_minor_ver; |
mbedAustin | 11:cada08fc8a70 | 863 | |
mbedAustin | 11:cada08fc8a70 | 864 | if( ssl->minor_ver < ssl->conf->min_minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 865 | { |
mbedAustin | 11:cada08fc8a70 | 866 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum" |
mbedAustin | 11:cada08fc8a70 | 867 | " [%d:%d] < [%d:%d]", |
mbedAustin | 11:cada08fc8a70 | 868 | ssl->major_ver, ssl->minor_ver, |
mbedAustin | 11:cada08fc8a70 | 869 | ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) ); |
mbedAustin | 11:cada08fc8a70 | 870 | |
mbedAustin | 11:cada08fc8a70 | 871 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 872 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); |
mbedAustin | 11:cada08fc8a70 | 873 | return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION ); |
mbedAustin | 11:cada08fc8a70 | 874 | } |
mbedAustin | 11:cada08fc8a70 | 875 | |
mbedAustin | 11:cada08fc8a70 | 876 | ssl->handshake->max_major_ver = buf[3]; |
mbedAustin | 11:cada08fc8a70 | 877 | ssl->handshake->max_minor_ver = buf[4]; |
mbedAustin | 11:cada08fc8a70 | 878 | |
mbedAustin | 11:cada08fc8a70 | 879 | if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 880 | { |
mbedAustin | 11:cada08fc8a70 | 881 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
mbedAustin | 11:cada08fc8a70 | 882 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 883 | } |
mbedAustin | 11:cada08fc8a70 | 884 | |
mbedAustin | 11:cada08fc8a70 | 885 | ssl->handshake->update_checksum( ssl, buf + 2, n ); |
mbedAustin | 11:cada08fc8a70 | 886 | |
mbedAustin | 11:cada08fc8a70 | 887 | buf = ssl->in_msg; |
mbedAustin | 11:cada08fc8a70 | 888 | n = ssl->in_left - 5; |
mbedAustin | 11:cada08fc8a70 | 889 | |
mbedAustin | 11:cada08fc8a70 | 890 | /* |
mbedAustin | 11:cada08fc8a70 | 891 | * 0 . 1 ciphersuitelist length |
mbedAustin | 11:cada08fc8a70 | 892 | * 2 . 3 session id length |
mbedAustin | 11:cada08fc8a70 | 893 | * 4 . 5 challenge length |
mbedAustin | 11:cada08fc8a70 | 894 | * 6 . .. ciphersuitelist |
mbedAustin | 11:cada08fc8a70 | 895 | * .. . .. session id |
mbedAustin | 11:cada08fc8a70 | 896 | * .. . .. challenge |
mbedAustin | 11:cada08fc8a70 | 897 | */ |
mbedAustin | 11:cada08fc8a70 | 898 | MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n ); |
mbedAustin | 11:cada08fc8a70 | 899 | |
mbedAustin | 11:cada08fc8a70 | 900 | ciph_len = ( buf[0] << 8 ) | buf[1]; |
mbedAustin | 11:cada08fc8a70 | 901 | sess_len = ( buf[2] << 8 ) | buf[3]; |
mbedAustin | 11:cada08fc8a70 | 902 | chal_len = ( buf[4] << 8 ) | buf[5]; |
mbedAustin | 11:cada08fc8a70 | 903 | |
mbedAustin | 11:cada08fc8a70 | 904 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d", |
mbedAustin | 11:cada08fc8a70 | 905 | ciph_len, sess_len, chal_len ) ); |
mbedAustin | 11:cada08fc8a70 | 906 | |
mbedAustin | 11:cada08fc8a70 | 907 | /* |
mbedAustin | 11:cada08fc8a70 | 908 | * Make sure each parameter length is valid |
mbedAustin | 11:cada08fc8a70 | 909 | */ |
mbedAustin | 11:cada08fc8a70 | 910 | if( ciph_len < 3 || ( ciph_len % 3 ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 911 | { |
mbedAustin | 11:cada08fc8a70 | 912 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 913 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 914 | } |
mbedAustin | 11:cada08fc8a70 | 915 | |
mbedAustin | 11:cada08fc8a70 | 916 | if( sess_len > 32 ) |
mbedAustin | 11:cada08fc8a70 | 917 | { |
mbedAustin | 11:cada08fc8a70 | 918 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 919 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 920 | } |
mbedAustin | 11:cada08fc8a70 | 921 | |
mbedAustin | 11:cada08fc8a70 | 922 | if( chal_len < 8 || chal_len > 32 ) |
mbedAustin | 11:cada08fc8a70 | 923 | { |
mbedAustin | 11:cada08fc8a70 | 924 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 925 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 926 | } |
mbedAustin | 11:cada08fc8a70 | 927 | |
mbedAustin | 11:cada08fc8a70 | 928 | if( n != 6 + ciph_len + sess_len + chal_len ) |
mbedAustin | 11:cada08fc8a70 | 929 | { |
mbedAustin | 11:cada08fc8a70 | 930 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 931 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 932 | } |
mbedAustin | 11:cada08fc8a70 | 933 | |
mbedAustin | 11:cada08fc8a70 | 934 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist", |
mbedAustin | 11:cada08fc8a70 | 935 | buf + 6, ciph_len ); |
mbedAustin | 11:cada08fc8a70 | 936 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", |
mbedAustin | 11:cada08fc8a70 | 937 | buf + 6 + ciph_len, sess_len ); |
mbedAustin | 11:cada08fc8a70 | 938 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge", |
mbedAustin | 11:cada08fc8a70 | 939 | buf + 6 + ciph_len + sess_len, chal_len ); |
mbedAustin | 11:cada08fc8a70 | 940 | |
mbedAustin | 11:cada08fc8a70 | 941 | p = buf + 6 + ciph_len; |
mbedAustin | 11:cada08fc8a70 | 942 | ssl->session_negotiate->id_len = sess_len; |
mbedAustin | 11:cada08fc8a70 | 943 | memset( ssl->session_negotiate->id, 0, |
mbedAustin | 11:cada08fc8a70 | 944 | sizeof( ssl->session_negotiate->id ) ); |
mbedAustin | 11:cada08fc8a70 | 945 | memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len ); |
mbedAustin | 11:cada08fc8a70 | 946 | |
mbedAustin | 11:cada08fc8a70 | 947 | p += sess_len; |
mbedAustin | 11:cada08fc8a70 | 948 | memset( ssl->handshake->randbytes, 0, 64 ); |
mbedAustin | 11:cada08fc8a70 | 949 | memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len ); |
mbedAustin | 11:cada08fc8a70 | 950 | |
mbedAustin | 11:cada08fc8a70 | 951 | /* |
mbedAustin | 11:cada08fc8a70 | 952 | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
mbedAustin | 11:cada08fc8a70 | 953 | */ |
mbedAustin | 11:cada08fc8a70 | 954 | for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 ) |
mbedAustin | 11:cada08fc8a70 | 955 | { |
mbedAustin | 11:cada08fc8a70 | 956 | if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO ) |
mbedAustin | 11:cada08fc8a70 | 957 | { |
mbedAustin | 11:cada08fc8a70 | 958 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) ); |
mbedAustin | 11:cada08fc8a70 | 959 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 960 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
mbedAustin | 11:cada08fc8a70 | 961 | { |
mbedAustin | 11:cada08fc8a70 | 962 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV " |
mbedAustin | 11:cada08fc8a70 | 963 | "during renegotiation" ) ); |
mbedAustin | 11:cada08fc8a70 | 964 | |
mbedAustin | 11:cada08fc8a70 | 965 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 966 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 967 | |
mbedAustin | 11:cada08fc8a70 | 968 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 969 | } |
mbedAustin | 11:cada08fc8a70 | 970 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
mbedAustin | 11:cada08fc8a70 | 971 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
mbedAustin | 11:cada08fc8a70 | 972 | break; |
mbedAustin | 11:cada08fc8a70 | 973 | } |
mbedAustin | 11:cada08fc8a70 | 974 | } |
mbedAustin | 11:cada08fc8a70 | 975 | |
mbedAustin | 11:cada08fc8a70 | 976 | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) |
mbedAustin | 11:cada08fc8a70 | 977 | for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 ) |
mbedAustin | 11:cada08fc8a70 | 978 | { |
mbedAustin | 11:cada08fc8a70 | 979 | if( p[0] == 0 && |
mbedAustin | 11:cada08fc8a70 | 980 | p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) && |
mbedAustin | 11:cada08fc8a70 | 981 | p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) ) |
mbedAustin | 11:cada08fc8a70 | 982 | { |
mbedAustin | 11:cada08fc8a70 | 983 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) ); |
mbedAustin | 11:cada08fc8a70 | 984 | |
mbedAustin | 11:cada08fc8a70 | 985 | if( ssl->minor_ver < ssl->conf->max_minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 986 | { |
mbedAustin | 11:cada08fc8a70 | 987 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) ); |
mbedAustin | 11:cada08fc8a70 | 988 | |
mbedAustin | 11:cada08fc8a70 | 989 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 990 | MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK ); |
mbedAustin | 11:cada08fc8a70 | 991 | |
mbedAustin | 11:cada08fc8a70 | 992 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 993 | } |
mbedAustin | 11:cada08fc8a70 | 994 | |
mbedAustin | 11:cada08fc8a70 | 995 | break; |
mbedAustin | 11:cada08fc8a70 | 996 | } |
mbedAustin | 11:cada08fc8a70 | 997 | } |
mbedAustin | 11:cada08fc8a70 | 998 | #endif /* MBEDTLS_SSL_FALLBACK_SCSV */ |
mbedAustin | 11:cada08fc8a70 | 999 | |
mbedAustin | 11:cada08fc8a70 | 1000 | got_common_suite = 0; |
mbedAustin | 11:cada08fc8a70 | 1001 | ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; |
mbedAustin | 11:cada08fc8a70 | 1002 | ciphersuite_info = NULL; |
mbedAustin | 11:cada08fc8a70 | 1003 | #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE) |
mbedAustin | 11:cada08fc8a70 | 1004 | for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 ) |
mbedAustin | 11:cada08fc8a70 | 1005 | { |
mbedAustin | 11:cada08fc8a70 | 1006 | for( i = 0; ciphersuites[i] != 0; i++ ) |
mbedAustin | 11:cada08fc8a70 | 1007 | #else |
mbedAustin | 11:cada08fc8a70 | 1008 | for( i = 0; ciphersuites[i] != 0; i++ ) |
mbedAustin | 11:cada08fc8a70 | 1009 | { |
mbedAustin | 11:cada08fc8a70 | 1010 | for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 ) |
mbedAustin | 11:cada08fc8a70 | 1011 | #endif |
mbedAustin | 11:cada08fc8a70 | 1012 | { |
mbedAustin | 11:cada08fc8a70 | 1013 | if( p[0] != 0 || |
mbedAustin | 11:cada08fc8a70 | 1014 | p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || |
mbedAustin | 11:cada08fc8a70 | 1015 | p[2] != ( ( ciphersuites[i] ) & 0xFF ) ) |
mbedAustin | 11:cada08fc8a70 | 1016 | continue; |
mbedAustin | 11:cada08fc8a70 | 1017 | |
mbedAustin | 11:cada08fc8a70 | 1018 | got_common_suite = 1; |
mbedAustin | 11:cada08fc8a70 | 1019 | |
mbedAustin | 11:cada08fc8a70 | 1020 | if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i], |
mbedAustin | 11:cada08fc8a70 | 1021 | &ciphersuite_info ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1022 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1023 | |
mbedAustin | 11:cada08fc8a70 | 1024 | if( ciphersuite_info != NULL ) |
mbedAustin | 11:cada08fc8a70 | 1025 | goto have_ciphersuite_v2; |
mbedAustin | 11:cada08fc8a70 | 1026 | } |
mbedAustin | 11:cada08fc8a70 | 1027 | } |
mbedAustin | 11:cada08fc8a70 | 1028 | |
mbedAustin | 11:cada08fc8a70 | 1029 | if( got_common_suite ) |
mbedAustin | 11:cada08fc8a70 | 1030 | { |
mbedAustin | 11:cada08fc8a70 | 1031 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, " |
mbedAustin | 11:cada08fc8a70 | 1032 | "but none of them usable" ) ); |
mbedAustin | 11:cada08fc8a70 | 1033 | return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE ); |
mbedAustin | 11:cada08fc8a70 | 1034 | } |
mbedAustin | 11:cada08fc8a70 | 1035 | else |
mbedAustin | 11:cada08fc8a70 | 1036 | { |
mbedAustin | 11:cada08fc8a70 | 1037 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) ); |
mbedAustin | 11:cada08fc8a70 | 1038 | return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN ); |
mbedAustin | 11:cada08fc8a70 | 1039 | } |
mbedAustin | 11:cada08fc8a70 | 1040 | |
mbedAustin | 11:cada08fc8a70 | 1041 | have_ciphersuite_v2: |
mbedAustin | 11:cada08fc8a70 | 1042 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) ); |
mbedAustin | 11:cada08fc8a70 | 1043 | |
mbedAustin | 11:cada08fc8a70 | 1044 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
mbedAustin | 11:cada08fc8a70 | 1045 | ssl->transform_negotiate->ciphersuite_info = ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 1046 | mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info ); |
mbedAustin | 11:cada08fc8a70 | 1047 | |
mbedAustin | 11:cada08fc8a70 | 1048 | /* |
mbedAustin | 11:cada08fc8a70 | 1049 | * SSLv2 Client Hello relevant renegotiation security checks |
mbedAustin | 11:cada08fc8a70 | 1050 | */ |
mbedAustin | 11:cada08fc8a70 | 1051 | if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
mbedAustin | 11:cada08fc8a70 | 1052 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 1053 | { |
mbedAustin | 11:cada08fc8a70 | 1054 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) ); |
mbedAustin | 11:cada08fc8a70 | 1055 | |
mbedAustin | 11:cada08fc8a70 | 1056 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1057 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1058 | |
mbedAustin | 11:cada08fc8a70 | 1059 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1060 | } |
mbedAustin | 11:cada08fc8a70 | 1061 | |
mbedAustin | 11:cada08fc8a70 | 1062 | ssl->in_left = 0; |
mbedAustin | 11:cada08fc8a70 | 1063 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 1064 | |
mbedAustin | 11:cada08fc8a70 | 1065 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) ); |
mbedAustin | 11:cada08fc8a70 | 1066 | |
mbedAustin | 11:cada08fc8a70 | 1067 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 1068 | } |
mbedAustin | 11:cada08fc8a70 | 1069 | #endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */ |
mbedAustin | 11:cada08fc8a70 | 1070 | |
mbedAustin | 11:cada08fc8a70 | 1071 | static int ssl_parse_client_hello( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 1072 | { |
mbedAustin | 11:cada08fc8a70 | 1073 | int ret, got_common_suite; |
mbedAustin | 11:cada08fc8a70 | 1074 | size_t i, j; |
mbedAustin | 11:cada08fc8a70 | 1075 | size_t ciph_offset, comp_offset, ext_offset; |
mbedAustin | 11:cada08fc8a70 | 1076 | size_t msg_len, ciph_len, sess_len, comp_len, ext_len; |
mbedAustin | 11:cada08fc8a70 | 1077 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1078 | size_t cookie_offset, cookie_len; |
mbedAustin | 11:cada08fc8a70 | 1079 | #endif |
mbedAustin | 11:cada08fc8a70 | 1080 | unsigned char *buf, *p, *ext; |
mbedAustin | 11:cada08fc8a70 | 1081 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1082 | int renegotiation_info_seen = 0; |
mbedAustin | 11:cada08fc8a70 | 1083 | #endif |
mbedAustin | 11:cada08fc8a70 | 1084 | int handshake_failure = 0; |
mbedAustin | 11:cada08fc8a70 | 1085 | const int *ciphersuites; |
mbedAustin | 11:cada08fc8a70 | 1086 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 1087 | int major, minor; |
mbedAustin | 11:cada08fc8a70 | 1088 | |
mbedAustin | 11:cada08fc8a70 | 1089 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) ); |
mbedAustin | 11:cada08fc8a70 | 1090 | |
mbedAustin | 11:cada08fc8a70 | 1091 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
mbedAustin | 11:cada08fc8a70 | 1092 | read_record_header: |
mbedAustin | 11:cada08fc8a70 | 1093 | #endif |
mbedAustin | 11:cada08fc8a70 | 1094 | /* |
mbedAustin | 11:cada08fc8a70 | 1095 | * If renegotiating, then the input was read with mbedtls_ssl_read_record(), |
mbedAustin | 11:cada08fc8a70 | 1096 | * otherwise read it ourselves manually in order to support SSLv2 |
mbedAustin | 11:cada08fc8a70 | 1097 | * ClientHello, which doesn't use the same record layer format. |
mbedAustin | 11:cada08fc8a70 | 1098 | */ |
mbedAustin | 11:cada08fc8a70 | 1099 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1100 | if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 1101 | #endif |
mbedAustin | 11:cada08fc8a70 | 1102 | { |
mbedAustin | 11:cada08fc8a70 | 1103 | if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1104 | { |
mbedAustin | 11:cada08fc8a70 | 1105 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
mbedAustin | 11:cada08fc8a70 | 1106 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1107 | } |
mbedAustin | 11:cada08fc8a70 | 1108 | } |
mbedAustin | 11:cada08fc8a70 | 1109 | |
mbedAustin | 11:cada08fc8a70 | 1110 | buf = ssl->in_hdr; |
mbedAustin | 11:cada08fc8a70 | 1111 | |
mbedAustin | 11:cada08fc8a70 | 1112 | #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) |
mbedAustin | 11:cada08fc8a70 | 1113 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1114 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM ) |
mbedAustin | 11:cada08fc8a70 | 1115 | #endif |
mbedAustin | 11:cada08fc8a70 | 1116 | if( ( buf[0] & 0x80 ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1117 | return ssl_parse_client_hello_v2( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1118 | #endif |
mbedAustin | 11:cada08fc8a70 | 1119 | |
mbedAustin | 11:cada08fc8a70 | 1120 | MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) ); |
mbedAustin | 11:cada08fc8a70 | 1121 | |
mbedAustin | 11:cada08fc8a70 | 1122 | /* |
mbedAustin | 11:cada08fc8a70 | 1123 | * SSLv3/TLS Client Hello |
mbedAustin | 11:cada08fc8a70 | 1124 | * |
mbedAustin | 11:cada08fc8a70 | 1125 | * Record layer: |
mbedAustin | 11:cada08fc8a70 | 1126 | * 0 . 0 message type |
mbedAustin | 11:cada08fc8a70 | 1127 | * 1 . 2 protocol version |
mbedAustin | 11:cada08fc8a70 | 1128 | * 3 . 11 DTLS: epoch + record sequence number |
mbedAustin | 11:cada08fc8a70 | 1129 | * 3 . 4 message length |
mbedAustin | 11:cada08fc8a70 | 1130 | */ |
mbedAustin | 11:cada08fc8a70 | 1131 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d", |
mbedAustin | 11:cada08fc8a70 | 1132 | buf[0] ) ); |
mbedAustin | 11:cada08fc8a70 | 1133 | |
mbedAustin | 11:cada08fc8a70 | 1134 | if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 1135 | { |
mbedAustin | 11:cada08fc8a70 | 1136 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1137 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1138 | } |
mbedAustin | 11:cada08fc8a70 | 1139 | |
mbedAustin | 11:cada08fc8a70 | 1140 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d", |
mbedAustin | 11:cada08fc8a70 | 1141 | ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) ); |
mbedAustin | 11:cada08fc8a70 | 1142 | |
mbedAustin | 11:cada08fc8a70 | 1143 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]", |
mbedAustin | 11:cada08fc8a70 | 1144 | buf[1], buf[2] ) ); |
mbedAustin | 11:cada08fc8a70 | 1145 | |
mbedAustin | 11:cada08fc8a70 | 1146 | mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 ); |
mbedAustin | 11:cada08fc8a70 | 1147 | |
mbedAustin | 11:cada08fc8a70 | 1148 | /* According to RFC 5246 Appendix E.1, the version here is typically |
mbedAustin | 11:cada08fc8a70 | 1149 | * "{03,00}, the lowest version number supported by the client, [or] the |
mbedAustin | 11:cada08fc8a70 | 1150 | * value of ClientHello.client_version", so the only meaningful check here |
mbedAustin | 11:cada08fc8a70 | 1151 | * is the major version shouldn't be less than 3 */ |
mbedAustin | 11:cada08fc8a70 | 1152 | if( major < MBEDTLS_SSL_MAJOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 1153 | { |
mbedAustin | 11:cada08fc8a70 | 1154 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1155 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1156 | } |
mbedAustin | 11:cada08fc8a70 | 1157 | |
mbedAustin | 11:cada08fc8a70 | 1158 | /* For DTLS if this is the initial handshake, remember the client sequence |
mbedAustin | 11:cada08fc8a70 | 1159 | * number to use it in our next message (RFC 6347 4.2.1) */ |
mbedAustin | 11:cada08fc8a70 | 1160 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1161 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM |
mbedAustin | 11:cada08fc8a70 | 1162 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1163 | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
mbedAustin | 11:cada08fc8a70 | 1164 | #endif |
mbedAustin | 11:cada08fc8a70 | 1165 | ) |
mbedAustin | 11:cada08fc8a70 | 1166 | { |
mbedAustin | 11:cada08fc8a70 | 1167 | /* Epoch should be 0 for initial handshakes */ |
mbedAustin | 11:cada08fc8a70 | 1168 | if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1169 | { |
mbedAustin | 11:cada08fc8a70 | 1170 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1171 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1172 | } |
mbedAustin | 11:cada08fc8a70 | 1173 | |
mbedAustin | 11:cada08fc8a70 | 1174 | memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 ); |
mbedAustin | 11:cada08fc8a70 | 1175 | |
mbedAustin | 11:cada08fc8a70 | 1176 | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
mbedAustin | 11:cada08fc8a70 | 1177 | if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1178 | { |
mbedAustin | 11:cada08fc8a70 | 1179 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) ); |
mbedAustin | 11:cada08fc8a70 | 1180 | ssl->next_record_offset = 0; |
mbedAustin | 11:cada08fc8a70 | 1181 | ssl->in_left = 0; |
mbedAustin | 11:cada08fc8a70 | 1182 | goto read_record_header; |
mbedAustin | 11:cada08fc8a70 | 1183 | } |
mbedAustin | 11:cada08fc8a70 | 1184 | |
mbedAustin | 11:cada08fc8a70 | 1185 | /* No MAC to check yet, so we can update right now */ |
mbedAustin | 11:cada08fc8a70 | 1186 | mbedtls_ssl_dtls_replay_update( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1187 | #endif |
mbedAustin | 11:cada08fc8a70 | 1188 | } |
mbedAustin | 11:cada08fc8a70 | 1189 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
mbedAustin | 11:cada08fc8a70 | 1190 | |
mbedAustin | 11:cada08fc8a70 | 1191 | msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1]; |
mbedAustin | 11:cada08fc8a70 | 1192 | |
mbedAustin | 11:cada08fc8a70 | 1193 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1194 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 1195 | { |
mbedAustin | 11:cada08fc8a70 | 1196 | /* Set by mbedtls_ssl_read_record() */ |
mbedAustin | 11:cada08fc8a70 | 1197 | msg_len = ssl->in_hslen; |
mbedAustin | 11:cada08fc8a70 | 1198 | } |
mbedAustin | 11:cada08fc8a70 | 1199 | else |
mbedAustin | 11:cada08fc8a70 | 1200 | #endif |
mbedAustin | 11:cada08fc8a70 | 1201 | { |
mbedAustin | 11:cada08fc8a70 | 1202 | if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN ) |
mbedAustin | 11:cada08fc8a70 | 1203 | { |
mbedAustin | 11:cada08fc8a70 | 1204 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1205 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1206 | } |
mbedAustin | 11:cada08fc8a70 | 1207 | |
mbedAustin | 11:cada08fc8a70 | 1208 | if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1209 | { |
mbedAustin | 11:cada08fc8a70 | 1210 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret ); |
mbedAustin | 11:cada08fc8a70 | 1211 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1212 | } |
mbedAustin | 11:cada08fc8a70 | 1213 | |
mbedAustin | 11:cada08fc8a70 | 1214 | /* Done reading this record, get ready for the next one */ |
mbedAustin | 11:cada08fc8a70 | 1215 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1216 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
mbedAustin | 11:cada08fc8a70 | 1217 | ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1218 | else |
mbedAustin | 11:cada08fc8a70 | 1219 | #endif |
mbedAustin | 11:cada08fc8a70 | 1220 | ssl->in_left = 0; |
mbedAustin | 11:cada08fc8a70 | 1221 | } |
mbedAustin | 11:cada08fc8a70 | 1222 | |
mbedAustin | 11:cada08fc8a70 | 1223 | buf = ssl->in_msg; |
mbedAustin | 11:cada08fc8a70 | 1224 | |
mbedAustin | 11:cada08fc8a70 | 1225 | MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len ); |
mbedAustin | 11:cada08fc8a70 | 1226 | |
mbedAustin | 11:cada08fc8a70 | 1227 | ssl->handshake->update_checksum( ssl, buf, msg_len ); |
mbedAustin | 11:cada08fc8a70 | 1228 | |
mbedAustin | 11:cada08fc8a70 | 1229 | /* |
mbedAustin | 11:cada08fc8a70 | 1230 | * Handshake layer: |
mbedAustin | 11:cada08fc8a70 | 1231 | * 0 . 0 handshake type |
mbedAustin | 11:cada08fc8a70 | 1232 | * 1 . 3 handshake length |
mbedAustin | 11:cada08fc8a70 | 1233 | * 4 . 5 DTLS only: message seqence number |
mbedAustin | 11:cada08fc8a70 | 1234 | * 6 . 8 DTLS only: fragment offset |
mbedAustin | 11:cada08fc8a70 | 1235 | * 9 . 11 DTLS only: fragment length |
mbedAustin | 11:cada08fc8a70 | 1236 | */ |
mbedAustin | 11:cada08fc8a70 | 1237 | if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) ) |
mbedAustin | 11:cada08fc8a70 | 1238 | { |
mbedAustin | 11:cada08fc8a70 | 1239 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1240 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1241 | } |
mbedAustin | 11:cada08fc8a70 | 1242 | |
mbedAustin | 11:cada08fc8a70 | 1243 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) ); |
mbedAustin | 11:cada08fc8a70 | 1244 | |
mbedAustin | 11:cada08fc8a70 | 1245 | if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO ) |
mbedAustin | 11:cada08fc8a70 | 1246 | { |
mbedAustin | 11:cada08fc8a70 | 1247 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1248 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1249 | } |
mbedAustin | 11:cada08fc8a70 | 1250 | |
mbedAustin | 11:cada08fc8a70 | 1251 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d", |
mbedAustin | 11:cada08fc8a70 | 1252 | ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) ); |
mbedAustin | 11:cada08fc8a70 | 1253 | |
mbedAustin | 11:cada08fc8a70 | 1254 | /* We don't support fragmentation of ClientHello (yet?) */ |
mbedAustin | 11:cada08fc8a70 | 1255 | if( buf[1] != 0 || |
mbedAustin | 11:cada08fc8a70 | 1256 | msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) ) |
mbedAustin | 11:cada08fc8a70 | 1257 | { |
mbedAustin | 11:cada08fc8a70 | 1258 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1259 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1260 | } |
mbedAustin | 11:cada08fc8a70 | 1261 | |
mbedAustin | 11:cada08fc8a70 | 1262 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1263 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
mbedAustin | 11:cada08fc8a70 | 1264 | { |
mbedAustin | 11:cada08fc8a70 | 1265 | /* |
mbedAustin | 11:cada08fc8a70 | 1266 | * Copy the client's handshake message_seq on initial handshakes, |
mbedAustin | 11:cada08fc8a70 | 1267 | * check sequence number on renego. |
mbedAustin | 11:cada08fc8a70 | 1268 | */ |
mbedAustin | 11:cada08fc8a70 | 1269 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1270 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
mbedAustin | 11:cada08fc8a70 | 1271 | { |
mbedAustin | 11:cada08fc8a70 | 1272 | /* This couldn't be done in ssl_prepare_handshake_record() */ |
mbedAustin | 11:cada08fc8a70 | 1273 | unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) | |
mbedAustin | 11:cada08fc8a70 | 1274 | ssl->in_msg[5]; |
mbedAustin | 11:cada08fc8a70 | 1275 | |
mbedAustin | 11:cada08fc8a70 | 1276 | if( cli_msg_seq != ssl->handshake->in_msg_seq ) |
mbedAustin | 11:cada08fc8a70 | 1277 | { |
mbedAustin | 11:cada08fc8a70 | 1278 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: " |
mbedAustin | 11:cada08fc8a70 | 1279 | "%d (expected %d)", cli_msg_seq, |
mbedAustin | 11:cada08fc8a70 | 1280 | ssl->handshake->in_msg_seq ) ); |
mbedAustin | 11:cada08fc8a70 | 1281 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1282 | } |
mbedAustin | 11:cada08fc8a70 | 1283 | |
mbedAustin | 11:cada08fc8a70 | 1284 | ssl->handshake->in_msg_seq++; |
mbedAustin | 11:cada08fc8a70 | 1285 | } |
mbedAustin | 11:cada08fc8a70 | 1286 | else |
mbedAustin | 11:cada08fc8a70 | 1287 | #endif |
mbedAustin | 11:cada08fc8a70 | 1288 | { |
mbedAustin | 11:cada08fc8a70 | 1289 | unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) | |
mbedAustin | 11:cada08fc8a70 | 1290 | ssl->in_msg[5]; |
mbedAustin | 11:cada08fc8a70 | 1291 | ssl->handshake->out_msg_seq = cli_msg_seq; |
mbedAustin | 11:cada08fc8a70 | 1292 | ssl->handshake->in_msg_seq = cli_msg_seq + 1; |
mbedAustin | 11:cada08fc8a70 | 1293 | } |
mbedAustin | 11:cada08fc8a70 | 1294 | |
mbedAustin | 11:cada08fc8a70 | 1295 | /* |
mbedAustin | 11:cada08fc8a70 | 1296 | * For now we don't support fragmentation, so make sure |
mbedAustin | 11:cada08fc8a70 | 1297 | * fragment_offset == 0 and fragment_length == length |
mbedAustin | 11:cada08fc8a70 | 1298 | */ |
mbedAustin | 11:cada08fc8a70 | 1299 | if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 || |
mbedAustin | 11:cada08fc8a70 | 1300 | memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1301 | { |
mbedAustin | 11:cada08fc8a70 | 1302 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) ); |
mbedAustin | 11:cada08fc8a70 | 1303 | return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); |
mbedAustin | 11:cada08fc8a70 | 1304 | } |
mbedAustin | 11:cada08fc8a70 | 1305 | } |
mbedAustin | 11:cada08fc8a70 | 1306 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
mbedAustin | 11:cada08fc8a70 | 1307 | |
mbedAustin | 11:cada08fc8a70 | 1308 | buf += mbedtls_ssl_hs_hdr_len( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1309 | msg_len -= mbedtls_ssl_hs_hdr_len( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1310 | |
mbedAustin | 11:cada08fc8a70 | 1311 | /* |
mbedAustin | 11:cada08fc8a70 | 1312 | * ClientHello layer: |
mbedAustin | 11:cada08fc8a70 | 1313 | * 0 . 1 protocol version |
mbedAustin | 11:cada08fc8a70 | 1314 | * 2 . 33 random bytes (starting with 4 bytes of Unix time) |
mbedAustin | 11:cada08fc8a70 | 1315 | * 34 . 35 session id length (1 byte) |
mbedAustin | 11:cada08fc8a70 | 1316 | * 35 . 34+x session id |
mbedAustin | 11:cada08fc8a70 | 1317 | * 35+x . 35+x DTLS only: cookie length (1 byte) |
mbedAustin | 11:cada08fc8a70 | 1318 | * 36+x . .. DTLS only: cookie |
mbedAustin | 11:cada08fc8a70 | 1319 | * .. . .. ciphersuite list length (2 bytes) |
mbedAustin | 11:cada08fc8a70 | 1320 | * .. . .. ciphersuite list |
mbedAustin | 11:cada08fc8a70 | 1321 | * .. . .. compression alg. list length (1 byte) |
mbedAustin | 11:cada08fc8a70 | 1322 | * .. . .. compression alg. list |
mbedAustin | 11:cada08fc8a70 | 1323 | * .. . .. extensions length (2 bytes, optional) |
mbedAustin | 11:cada08fc8a70 | 1324 | * .. . .. extensions (optional) |
mbedAustin | 11:cada08fc8a70 | 1325 | */ |
mbedAustin | 11:cada08fc8a70 | 1326 | |
mbedAustin | 11:cada08fc8a70 | 1327 | /* |
mbedAustin | 11:cada08fc8a70 | 1328 | * Minimal length (with everything empty and extensions ommitted) is |
mbedAustin | 11:cada08fc8a70 | 1329 | * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can |
mbedAustin | 11:cada08fc8a70 | 1330 | * read at least up to session id length without worrying. |
mbedAustin | 11:cada08fc8a70 | 1331 | */ |
mbedAustin | 11:cada08fc8a70 | 1332 | if( msg_len < 38 ) |
mbedAustin | 11:cada08fc8a70 | 1333 | { |
mbedAustin | 11:cada08fc8a70 | 1334 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1335 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1336 | } |
mbedAustin | 11:cada08fc8a70 | 1337 | |
mbedAustin | 11:cada08fc8a70 | 1338 | /* |
mbedAustin | 11:cada08fc8a70 | 1339 | * Check and save the protocol version |
mbedAustin | 11:cada08fc8a70 | 1340 | */ |
mbedAustin | 11:cada08fc8a70 | 1341 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 ); |
mbedAustin | 11:cada08fc8a70 | 1342 | |
mbedAustin | 11:cada08fc8a70 | 1343 | mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver, |
mbedAustin | 11:cada08fc8a70 | 1344 | ssl->conf->transport, buf ); |
mbedAustin | 11:cada08fc8a70 | 1345 | |
mbedAustin | 11:cada08fc8a70 | 1346 | ssl->handshake->max_major_ver = ssl->major_ver; |
mbedAustin | 11:cada08fc8a70 | 1347 | ssl->handshake->max_minor_ver = ssl->minor_ver; |
mbedAustin | 11:cada08fc8a70 | 1348 | |
mbedAustin | 11:cada08fc8a70 | 1349 | if( ssl->major_ver < ssl->conf->min_major_ver || |
mbedAustin | 11:cada08fc8a70 | 1350 | ssl->minor_ver < ssl->conf->min_minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 1351 | { |
mbedAustin | 11:cada08fc8a70 | 1352 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum" |
mbedAustin | 11:cada08fc8a70 | 1353 | " [%d:%d] < [%d:%d]", |
mbedAustin | 11:cada08fc8a70 | 1354 | ssl->major_ver, ssl->minor_ver, |
mbedAustin | 11:cada08fc8a70 | 1355 | ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) ); |
mbedAustin | 11:cada08fc8a70 | 1356 | |
mbedAustin | 11:cada08fc8a70 | 1357 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 1358 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION ); |
mbedAustin | 11:cada08fc8a70 | 1359 | |
mbedAustin | 11:cada08fc8a70 | 1360 | return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION ); |
mbedAustin | 11:cada08fc8a70 | 1361 | } |
mbedAustin | 11:cada08fc8a70 | 1362 | |
mbedAustin | 11:cada08fc8a70 | 1363 | if( ssl->major_ver > ssl->conf->max_major_ver ) |
mbedAustin | 11:cada08fc8a70 | 1364 | { |
mbedAustin | 11:cada08fc8a70 | 1365 | ssl->major_ver = ssl->conf->max_major_ver; |
mbedAustin | 11:cada08fc8a70 | 1366 | ssl->minor_ver = ssl->conf->max_minor_ver; |
mbedAustin | 11:cada08fc8a70 | 1367 | } |
mbedAustin | 11:cada08fc8a70 | 1368 | else if( ssl->minor_ver > ssl->conf->max_minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 1369 | ssl->minor_ver = ssl->conf->max_minor_ver; |
mbedAustin | 11:cada08fc8a70 | 1370 | |
mbedAustin | 11:cada08fc8a70 | 1371 | /* |
mbedAustin | 11:cada08fc8a70 | 1372 | * Save client random (inc. Unix time) |
mbedAustin | 11:cada08fc8a70 | 1373 | */ |
mbedAustin | 11:cada08fc8a70 | 1374 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 ); |
mbedAustin | 11:cada08fc8a70 | 1375 | |
mbedAustin | 11:cada08fc8a70 | 1376 | memcpy( ssl->handshake->randbytes, buf + 2, 32 ); |
mbedAustin | 11:cada08fc8a70 | 1377 | |
mbedAustin | 11:cada08fc8a70 | 1378 | /* |
mbedAustin | 11:cada08fc8a70 | 1379 | * Check the session ID length and save session ID |
mbedAustin | 11:cada08fc8a70 | 1380 | */ |
mbedAustin | 11:cada08fc8a70 | 1381 | sess_len = buf[34]; |
mbedAustin | 11:cada08fc8a70 | 1382 | |
mbedAustin | 11:cada08fc8a70 | 1383 | if( sess_len > sizeof( ssl->session_negotiate->id ) || |
mbedAustin | 11:cada08fc8a70 | 1384 | sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */ |
mbedAustin | 11:cada08fc8a70 | 1385 | { |
mbedAustin | 11:cada08fc8a70 | 1386 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1387 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1388 | } |
mbedAustin | 11:cada08fc8a70 | 1389 | |
mbedAustin | 11:cada08fc8a70 | 1390 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len ); |
mbedAustin | 11:cada08fc8a70 | 1391 | |
mbedAustin | 11:cada08fc8a70 | 1392 | ssl->session_negotiate->id_len = sess_len; |
mbedAustin | 11:cada08fc8a70 | 1393 | memset( ssl->session_negotiate->id, 0, |
mbedAustin | 11:cada08fc8a70 | 1394 | sizeof( ssl->session_negotiate->id ) ); |
mbedAustin | 11:cada08fc8a70 | 1395 | memcpy( ssl->session_negotiate->id, buf + 35, |
mbedAustin | 11:cada08fc8a70 | 1396 | ssl->session_negotiate->id_len ); |
mbedAustin | 11:cada08fc8a70 | 1397 | |
mbedAustin | 11:cada08fc8a70 | 1398 | /* |
mbedAustin | 11:cada08fc8a70 | 1399 | * Check the cookie length and content |
mbedAustin | 11:cada08fc8a70 | 1400 | */ |
mbedAustin | 11:cada08fc8a70 | 1401 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1402 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
mbedAustin | 11:cada08fc8a70 | 1403 | { |
mbedAustin | 11:cada08fc8a70 | 1404 | cookie_offset = 35 + sess_len; |
mbedAustin | 11:cada08fc8a70 | 1405 | cookie_len = buf[cookie_offset]; |
mbedAustin | 11:cada08fc8a70 | 1406 | |
mbedAustin | 11:cada08fc8a70 | 1407 | if( cookie_offset + 1 + cookie_len + 2 > msg_len ) |
mbedAustin | 11:cada08fc8a70 | 1408 | { |
mbedAustin | 11:cada08fc8a70 | 1409 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1410 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1411 | } |
mbedAustin | 11:cada08fc8a70 | 1412 | |
mbedAustin | 11:cada08fc8a70 | 1413 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie", |
mbedAustin | 11:cada08fc8a70 | 1414 | buf + cookie_offset + 1, cookie_len ); |
mbedAustin | 11:cada08fc8a70 | 1415 | |
mbedAustin | 11:cada08fc8a70 | 1416 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
mbedAustin | 11:cada08fc8a70 | 1417 | if( ssl->conf->f_cookie_check != NULL |
mbedAustin | 11:cada08fc8a70 | 1418 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1419 | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
mbedAustin | 11:cada08fc8a70 | 1420 | #endif |
mbedAustin | 11:cada08fc8a70 | 1421 | ) |
mbedAustin | 11:cada08fc8a70 | 1422 | { |
mbedAustin | 11:cada08fc8a70 | 1423 | if( ssl->conf->f_cookie_check( ssl->conf->p_cookie, |
mbedAustin | 11:cada08fc8a70 | 1424 | buf + cookie_offset + 1, cookie_len, |
mbedAustin | 11:cada08fc8a70 | 1425 | ssl->cli_id, ssl->cli_id_len ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1426 | { |
mbedAustin | 11:cada08fc8a70 | 1427 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) ); |
mbedAustin | 11:cada08fc8a70 | 1428 | ssl->handshake->verify_cookie_len = 1; |
mbedAustin | 11:cada08fc8a70 | 1429 | } |
mbedAustin | 11:cada08fc8a70 | 1430 | else |
mbedAustin | 11:cada08fc8a70 | 1431 | { |
mbedAustin | 11:cada08fc8a70 | 1432 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) ); |
mbedAustin | 11:cada08fc8a70 | 1433 | ssl->handshake->verify_cookie_len = 0; |
mbedAustin | 11:cada08fc8a70 | 1434 | } |
mbedAustin | 11:cada08fc8a70 | 1435 | } |
mbedAustin | 11:cada08fc8a70 | 1436 | else |
mbedAustin | 11:cada08fc8a70 | 1437 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
mbedAustin | 11:cada08fc8a70 | 1438 | { |
mbedAustin | 11:cada08fc8a70 | 1439 | /* We know we didn't send a cookie, so it should be empty */ |
mbedAustin | 11:cada08fc8a70 | 1440 | if( cookie_len != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1441 | { |
mbedAustin | 11:cada08fc8a70 | 1442 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1443 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1444 | } |
mbedAustin | 11:cada08fc8a70 | 1445 | |
mbedAustin | 11:cada08fc8a70 | 1446 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) ); |
mbedAustin | 11:cada08fc8a70 | 1447 | } |
mbedAustin | 11:cada08fc8a70 | 1448 | |
mbedAustin | 11:cada08fc8a70 | 1449 | /* |
mbedAustin | 11:cada08fc8a70 | 1450 | * Check the ciphersuitelist length (will be parsed later) |
mbedAustin | 11:cada08fc8a70 | 1451 | */ |
mbedAustin | 11:cada08fc8a70 | 1452 | ciph_offset = cookie_offset + 1 + cookie_len; |
mbedAustin | 11:cada08fc8a70 | 1453 | } |
mbedAustin | 11:cada08fc8a70 | 1454 | else |
mbedAustin | 11:cada08fc8a70 | 1455 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
mbedAustin | 11:cada08fc8a70 | 1456 | ciph_offset = 35 + sess_len; |
mbedAustin | 11:cada08fc8a70 | 1457 | |
mbedAustin | 11:cada08fc8a70 | 1458 | ciph_len = ( buf[ciph_offset + 0] << 8 ) |
mbedAustin | 11:cada08fc8a70 | 1459 | | ( buf[ciph_offset + 1] ); |
mbedAustin | 11:cada08fc8a70 | 1460 | |
mbedAustin | 11:cada08fc8a70 | 1461 | if( ciph_len < 2 || |
mbedAustin | 11:cada08fc8a70 | 1462 | ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */ |
mbedAustin | 11:cada08fc8a70 | 1463 | ( ciph_len % 2 ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1464 | { |
mbedAustin | 11:cada08fc8a70 | 1465 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1466 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1467 | } |
mbedAustin | 11:cada08fc8a70 | 1468 | |
mbedAustin | 11:cada08fc8a70 | 1469 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist", |
mbedAustin | 11:cada08fc8a70 | 1470 | buf + ciph_offset + 2, ciph_len ); |
mbedAustin | 11:cada08fc8a70 | 1471 | |
mbedAustin | 11:cada08fc8a70 | 1472 | /* |
mbedAustin | 11:cada08fc8a70 | 1473 | * Check the compression algorithms length and pick one |
mbedAustin | 11:cada08fc8a70 | 1474 | */ |
mbedAustin | 11:cada08fc8a70 | 1475 | comp_offset = ciph_offset + 2 + ciph_len; |
mbedAustin | 11:cada08fc8a70 | 1476 | |
mbedAustin | 11:cada08fc8a70 | 1477 | comp_len = buf[comp_offset]; |
mbedAustin | 11:cada08fc8a70 | 1478 | |
mbedAustin | 11:cada08fc8a70 | 1479 | if( comp_len < 1 || |
mbedAustin | 11:cada08fc8a70 | 1480 | comp_len > 16 || |
mbedAustin | 11:cada08fc8a70 | 1481 | comp_len + comp_offset + 1 > msg_len ) |
mbedAustin | 11:cada08fc8a70 | 1482 | { |
mbedAustin | 11:cada08fc8a70 | 1483 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1484 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1485 | } |
mbedAustin | 11:cada08fc8a70 | 1486 | |
mbedAustin | 11:cada08fc8a70 | 1487 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression", |
mbedAustin | 11:cada08fc8a70 | 1488 | buf + comp_offset + 1, comp_len ); |
mbedAustin | 11:cada08fc8a70 | 1489 | |
mbedAustin | 11:cada08fc8a70 | 1490 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL; |
mbedAustin | 11:cada08fc8a70 | 1491 | #if defined(MBEDTLS_ZLIB_SUPPORT) |
mbedAustin | 11:cada08fc8a70 | 1492 | for( i = 0; i < comp_len; ++i ) |
mbedAustin | 11:cada08fc8a70 | 1493 | { |
mbedAustin | 11:cada08fc8a70 | 1494 | if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE ) |
mbedAustin | 11:cada08fc8a70 | 1495 | { |
mbedAustin | 11:cada08fc8a70 | 1496 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE; |
mbedAustin | 11:cada08fc8a70 | 1497 | break; |
mbedAustin | 11:cada08fc8a70 | 1498 | } |
mbedAustin | 11:cada08fc8a70 | 1499 | } |
mbedAustin | 11:cada08fc8a70 | 1500 | #endif |
mbedAustin | 11:cada08fc8a70 | 1501 | |
mbedAustin | 11:cada08fc8a70 | 1502 | /* See comments in ssl_write_client_hello() */ |
mbedAustin | 11:cada08fc8a70 | 1503 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1504 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
mbedAustin | 11:cada08fc8a70 | 1505 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL; |
mbedAustin | 11:cada08fc8a70 | 1506 | #endif |
mbedAustin | 11:cada08fc8a70 | 1507 | |
mbedAustin | 11:cada08fc8a70 | 1508 | /* |
mbedAustin | 11:cada08fc8a70 | 1509 | * Check the extension length |
mbedAustin | 11:cada08fc8a70 | 1510 | */ |
mbedAustin | 11:cada08fc8a70 | 1511 | ext_offset = comp_offset + 1 + comp_len; |
mbedAustin | 11:cada08fc8a70 | 1512 | if( msg_len > ext_offset ) |
mbedAustin | 11:cada08fc8a70 | 1513 | { |
mbedAustin | 11:cada08fc8a70 | 1514 | if( msg_len < ext_offset + 2 ) |
mbedAustin | 11:cada08fc8a70 | 1515 | { |
mbedAustin | 11:cada08fc8a70 | 1516 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1517 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1518 | } |
mbedAustin | 11:cada08fc8a70 | 1519 | |
mbedAustin | 11:cada08fc8a70 | 1520 | ext_len = ( buf[ext_offset + 0] << 8 ) |
mbedAustin | 11:cada08fc8a70 | 1521 | | ( buf[ext_offset + 1] ); |
mbedAustin | 11:cada08fc8a70 | 1522 | |
mbedAustin | 11:cada08fc8a70 | 1523 | if( ( ext_len > 0 && ext_len < 4 ) || |
mbedAustin | 11:cada08fc8a70 | 1524 | msg_len != ext_offset + 2 + ext_len ) |
mbedAustin | 11:cada08fc8a70 | 1525 | { |
mbedAustin | 11:cada08fc8a70 | 1526 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1527 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1528 | } |
mbedAustin | 11:cada08fc8a70 | 1529 | } |
mbedAustin | 11:cada08fc8a70 | 1530 | else |
mbedAustin | 11:cada08fc8a70 | 1531 | ext_len = 0; |
mbedAustin | 11:cada08fc8a70 | 1532 | |
mbedAustin | 11:cada08fc8a70 | 1533 | ext = buf + ext_offset + 2; |
mbedAustin | 11:cada08fc8a70 | 1534 | MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len ); |
mbedAustin | 11:cada08fc8a70 | 1535 | |
mbedAustin | 11:cada08fc8a70 | 1536 | while( ext_len != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1537 | { |
mbedAustin | 11:cada08fc8a70 | 1538 | unsigned int ext_id = ( ( ext[0] << 8 ) |
mbedAustin | 11:cada08fc8a70 | 1539 | | ( ext[1] ) ); |
mbedAustin | 11:cada08fc8a70 | 1540 | unsigned int ext_size = ( ( ext[2] << 8 ) |
mbedAustin | 11:cada08fc8a70 | 1541 | | ( ext[3] ) ); |
mbedAustin | 11:cada08fc8a70 | 1542 | |
mbedAustin | 11:cada08fc8a70 | 1543 | if( ext_size + 4 > ext_len ) |
mbedAustin | 11:cada08fc8a70 | 1544 | { |
mbedAustin | 11:cada08fc8a70 | 1545 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1546 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1547 | } |
mbedAustin | 11:cada08fc8a70 | 1548 | switch( ext_id ) |
mbedAustin | 11:cada08fc8a70 | 1549 | { |
mbedAustin | 11:cada08fc8a70 | 1550 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
mbedAustin | 11:cada08fc8a70 | 1551 | case MBEDTLS_TLS_EXT_SERVERNAME: |
mbedAustin | 11:cada08fc8a70 | 1552 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1553 | if( ssl->conf->f_sni == NULL ) |
mbedAustin | 11:cada08fc8a70 | 1554 | break; |
mbedAustin | 11:cada08fc8a70 | 1555 | |
mbedAustin | 11:cada08fc8a70 | 1556 | ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1557 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1558 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1559 | break; |
mbedAustin | 11:cada08fc8a70 | 1560 | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
mbedAustin | 11:cada08fc8a70 | 1561 | |
mbedAustin | 11:cada08fc8a70 | 1562 | case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: |
mbedAustin | 11:cada08fc8a70 | 1563 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1564 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1565 | renegotiation_info_seen = 1; |
mbedAustin | 11:cada08fc8a70 | 1566 | #endif |
mbedAustin | 11:cada08fc8a70 | 1567 | |
mbedAustin | 11:cada08fc8a70 | 1568 | ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1569 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1570 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1571 | break; |
mbedAustin | 11:cada08fc8a70 | 1572 | |
mbedAustin | 11:cada08fc8a70 | 1573 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
mbedAustin | 11:cada08fc8a70 | 1574 | defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED) |
mbedAustin | 11:cada08fc8a70 | 1575 | case MBEDTLS_TLS_EXT_SIG_ALG: |
mbedAustin | 11:cada08fc8a70 | 1576 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1577 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1578 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
mbedAustin | 11:cada08fc8a70 | 1579 | break; |
mbedAustin | 11:cada08fc8a70 | 1580 | #endif |
mbedAustin | 11:cada08fc8a70 | 1581 | |
mbedAustin | 11:cada08fc8a70 | 1582 | ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1583 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1584 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1585 | break; |
mbedAustin | 11:cada08fc8a70 | 1586 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
mbedAustin | 11:cada08fc8a70 | 1587 | MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 1588 | |
mbedAustin | 11:cada08fc8a70 | 1589 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
mbedAustin | 11:cada08fc8a70 | 1590 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 1591 | case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES: |
mbedAustin | 11:cada08fc8a70 | 1592 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1593 | |
mbedAustin | 11:cada08fc8a70 | 1594 | ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1595 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1596 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1597 | break; |
mbedAustin | 11:cada08fc8a70 | 1598 | |
mbedAustin | 11:cada08fc8a70 | 1599 | case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: |
mbedAustin | 11:cada08fc8a70 | 1600 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1601 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT; |
mbedAustin | 11:cada08fc8a70 | 1602 | |
mbedAustin | 11:cada08fc8a70 | 1603 | ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1604 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1605 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1606 | break; |
mbedAustin | 11:cada08fc8a70 | 1607 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
mbedAustin | 11:cada08fc8a70 | 1608 | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 1609 | |
mbedAustin | 11:cada08fc8a70 | 1610 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 1611 | case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: |
mbedAustin | 11:cada08fc8a70 | 1612 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1613 | |
mbedAustin | 11:cada08fc8a70 | 1614 | ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1615 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1616 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1617 | break; |
mbedAustin | 11:cada08fc8a70 | 1618 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 1619 | |
mbedAustin | 11:cada08fc8a70 | 1620 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
mbedAustin | 11:cada08fc8a70 | 1621 | case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: |
mbedAustin | 11:cada08fc8a70 | 1622 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1623 | |
mbedAustin | 11:cada08fc8a70 | 1624 | ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1625 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1626 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1627 | break; |
mbedAustin | 11:cada08fc8a70 | 1628 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
mbedAustin | 11:cada08fc8a70 | 1629 | |
mbedAustin | 11:cada08fc8a70 | 1630 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
mbedAustin | 11:cada08fc8a70 | 1631 | case MBEDTLS_TLS_EXT_TRUNCATED_HMAC: |
mbedAustin | 11:cada08fc8a70 | 1632 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1633 | |
mbedAustin | 11:cada08fc8a70 | 1634 | ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1635 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1636 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1637 | break; |
mbedAustin | 11:cada08fc8a70 | 1638 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
mbedAustin | 11:cada08fc8a70 | 1639 | |
mbedAustin | 11:cada08fc8a70 | 1640 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
mbedAustin | 11:cada08fc8a70 | 1641 | case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: |
mbedAustin | 11:cada08fc8a70 | 1642 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1643 | |
mbedAustin | 11:cada08fc8a70 | 1644 | ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1645 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1646 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1647 | break; |
mbedAustin | 11:cada08fc8a70 | 1648 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
mbedAustin | 11:cada08fc8a70 | 1649 | |
mbedAustin | 11:cada08fc8a70 | 1650 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
mbedAustin | 11:cada08fc8a70 | 1651 | case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: |
mbedAustin | 11:cada08fc8a70 | 1652 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1653 | |
mbedAustin | 11:cada08fc8a70 | 1654 | ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1655 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1656 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1657 | break; |
mbedAustin | 11:cada08fc8a70 | 1658 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
mbedAustin | 11:cada08fc8a70 | 1659 | |
mbedAustin | 11:cada08fc8a70 | 1660 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 1661 | case MBEDTLS_TLS_EXT_SESSION_TICKET: |
mbedAustin | 11:cada08fc8a70 | 1662 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1663 | |
mbedAustin | 11:cada08fc8a70 | 1664 | ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1665 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1666 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1667 | break; |
mbedAustin | 11:cada08fc8a70 | 1668 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
mbedAustin | 11:cada08fc8a70 | 1669 | |
mbedAustin | 11:cada08fc8a70 | 1670 | #if defined(MBEDTLS_SSL_ALPN) |
mbedAustin | 11:cada08fc8a70 | 1671 | case MBEDTLS_TLS_EXT_ALPN: |
mbedAustin | 11:cada08fc8a70 | 1672 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1673 | |
mbedAustin | 11:cada08fc8a70 | 1674 | ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ); |
mbedAustin | 11:cada08fc8a70 | 1675 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1676 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1677 | break; |
mbedAustin | 11:cada08fc8a70 | 1678 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
mbedAustin | 11:cada08fc8a70 | 1679 | |
mbedAustin | 11:cada08fc8a70 | 1680 | default: |
mbedAustin | 11:cada08fc8a70 | 1681 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)", |
mbedAustin | 11:cada08fc8a70 | 1682 | ext_id ) ); |
mbedAustin | 11:cada08fc8a70 | 1683 | } |
mbedAustin | 11:cada08fc8a70 | 1684 | |
mbedAustin | 11:cada08fc8a70 | 1685 | ext_len -= 4 + ext_size; |
mbedAustin | 11:cada08fc8a70 | 1686 | ext += 4 + ext_size; |
mbedAustin | 11:cada08fc8a70 | 1687 | |
mbedAustin | 11:cada08fc8a70 | 1688 | if( ext_len > 0 && ext_len < 4 ) |
mbedAustin | 11:cada08fc8a70 | 1689 | { |
mbedAustin | 11:cada08fc8a70 | 1690 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) ); |
mbedAustin | 11:cada08fc8a70 | 1691 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1692 | } |
mbedAustin | 11:cada08fc8a70 | 1693 | } |
mbedAustin | 11:cada08fc8a70 | 1694 | |
mbedAustin | 11:cada08fc8a70 | 1695 | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) |
mbedAustin | 11:cada08fc8a70 | 1696 | for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 ) |
mbedAustin | 11:cada08fc8a70 | 1697 | { |
mbedAustin | 11:cada08fc8a70 | 1698 | if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) && |
mbedAustin | 11:cada08fc8a70 | 1699 | p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) ) |
mbedAustin | 11:cada08fc8a70 | 1700 | { |
mbedAustin | 11:cada08fc8a70 | 1701 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) ); |
mbedAustin | 11:cada08fc8a70 | 1702 | |
mbedAustin | 11:cada08fc8a70 | 1703 | if( ssl->minor_ver < ssl->conf->max_minor_ver ) |
mbedAustin | 11:cada08fc8a70 | 1704 | { |
mbedAustin | 11:cada08fc8a70 | 1705 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) ); |
mbedAustin | 11:cada08fc8a70 | 1706 | |
mbedAustin | 11:cada08fc8a70 | 1707 | mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 1708 | MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK ); |
mbedAustin | 11:cada08fc8a70 | 1709 | |
mbedAustin | 11:cada08fc8a70 | 1710 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1711 | } |
mbedAustin | 11:cada08fc8a70 | 1712 | |
mbedAustin | 11:cada08fc8a70 | 1713 | break; |
mbedAustin | 11:cada08fc8a70 | 1714 | } |
mbedAustin | 11:cada08fc8a70 | 1715 | } |
mbedAustin | 11:cada08fc8a70 | 1716 | #endif /* MBEDTLS_SSL_FALLBACK_SCSV */ |
mbedAustin | 11:cada08fc8a70 | 1717 | |
mbedAustin | 11:cada08fc8a70 | 1718 | /* |
mbedAustin | 11:cada08fc8a70 | 1719 | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
mbedAustin | 11:cada08fc8a70 | 1720 | */ |
mbedAustin | 11:cada08fc8a70 | 1721 | for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 ) |
mbedAustin | 11:cada08fc8a70 | 1722 | { |
mbedAustin | 11:cada08fc8a70 | 1723 | if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO ) |
mbedAustin | 11:cada08fc8a70 | 1724 | { |
mbedAustin | 11:cada08fc8a70 | 1725 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) ); |
mbedAustin | 11:cada08fc8a70 | 1726 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1727 | if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS ) |
mbedAustin | 11:cada08fc8a70 | 1728 | { |
mbedAustin | 11:cada08fc8a70 | 1729 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) ); |
mbedAustin | 11:cada08fc8a70 | 1730 | |
mbedAustin | 11:cada08fc8a70 | 1731 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1732 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1733 | |
mbedAustin | 11:cada08fc8a70 | 1734 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1735 | } |
mbedAustin | 11:cada08fc8a70 | 1736 | #endif |
mbedAustin | 11:cada08fc8a70 | 1737 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
mbedAustin | 11:cada08fc8a70 | 1738 | break; |
mbedAustin | 11:cada08fc8a70 | 1739 | } |
mbedAustin | 11:cada08fc8a70 | 1740 | } |
mbedAustin | 11:cada08fc8a70 | 1741 | |
mbedAustin | 11:cada08fc8a70 | 1742 | /* |
mbedAustin | 11:cada08fc8a70 | 1743 | * Renegotiation security checks |
mbedAustin | 11:cada08fc8a70 | 1744 | */ |
mbedAustin | 11:cada08fc8a70 | 1745 | if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION && |
mbedAustin | 11:cada08fc8a70 | 1746 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 1747 | { |
mbedAustin | 11:cada08fc8a70 | 1748 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) ); |
mbedAustin | 11:cada08fc8a70 | 1749 | handshake_failure = 1; |
mbedAustin | 11:cada08fc8a70 | 1750 | } |
mbedAustin | 11:cada08fc8a70 | 1751 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1752 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
mbedAustin | 11:cada08fc8a70 | 1753 | ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && |
mbedAustin | 11:cada08fc8a70 | 1754 | renegotiation_info_seen == 0 ) |
mbedAustin | 11:cada08fc8a70 | 1755 | { |
mbedAustin | 11:cada08fc8a70 | 1756 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) ); |
mbedAustin | 11:cada08fc8a70 | 1757 | handshake_failure = 1; |
mbedAustin | 11:cada08fc8a70 | 1758 | } |
mbedAustin | 11:cada08fc8a70 | 1759 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
mbedAustin | 11:cada08fc8a70 | 1760 | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
mbedAustin | 11:cada08fc8a70 | 1761 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) |
mbedAustin | 11:cada08fc8a70 | 1762 | { |
mbedAustin | 11:cada08fc8a70 | 1763 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) ); |
mbedAustin | 11:cada08fc8a70 | 1764 | handshake_failure = 1; |
mbedAustin | 11:cada08fc8a70 | 1765 | } |
mbedAustin | 11:cada08fc8a70 | 1766 | else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
mbedAustin | 11:cada08fc8a70 | 1767 | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
mbedAustin | 11:cada08fc8a70 | 1768 | renegotiation_info_seen == 1 ) |
mbedAustin | 11:cada08fc8a70 | 1769 | { |
mbedAustin | 11:cada08fc8a70 | 1770 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) ); |
mbedAustin | 11:cada08fc8a70 | 1771 | handshake_failure = 1; |
mbedAustin | 11:cada08fc8a70 | 1772 | } |
mbedAustin | 11:cada08fc8a70 | 1773 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
mbedAustin | 11:cada08fc8a70 | 1774 | |
mbedAustin | 11:cada08fc8a70 | 1775 | if( handshake_failure == 1 ) |
mbedAustin | 11:cada08fc8a70 | 1776 | { |
mbedAustin | 11:cada08fc8a70 | 1777 | if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1778 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1779 | |
mbedAustin | 11:cada08fc8a70 | 1780 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO ); |
mbedAustin | 11:cada08fc8a70 | 1781 | } |
mbedAustin | 11:cada08fc8a70 | 1782 | |
mbedAustin | 11:cada08fc8a70 | 1783 | /* |
mbedAustin | 11:cada08fc8a70 | 1784 | * Search for a matching ciphersuite |
mbedAustin | 11:cada08fc8a70 | 1785 | * (At the end because we need information from the EC-based extensions |
mbedAustin | 11:cada08fc8a70 | 1786 | * and certificate from the SNI callback triggered by the SNI extension.) |
mbedAustin | 11:cada08fc8a70 | 1787 | */ |
mbedAustin | 11:cada08fc8a70 | 1788 | got_common_suite = 0; |
mbedAustin | 11:cada08fc8a70 | 1789 | ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; |
mbedAustin | 11:cada08fc8a70 | 1790 | ciphersuite_info = NULL; |
mbedAustin | 11:cada08fc8a70 | 1791 | #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE) |
mbedAustin | 11:cada08fc8a70 | 1792 | for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 ) |
mbedAustin | 11:cada08fc8a70 | 1793 | { |
mbedAustin | 11:cada08fc8a70 | 1794 | for( i = 0; ciphersuites[i] != 0; i++ ) |
mbedAustin | 11:cada08fc8a70 | 1795 | #else |
mbedAustin | 11:cada08fc8a70 | 1796 | for( i = 0; ciphersuites[i] != 0; i++ ) |
mbedAustin | 11:cada08fc8a70 | 1797 | { |
mbedAustin | 11:cada08fc8a70 | 1798 | for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 ) |
mbedAustin | 11:cada08fc8a70 | 1799 | #endif |
mbedAustin | 11:cada08fc8a70 | 1800 | { |
mbedAustin | 11:cada08fc8a70 | 1801 | if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) || |
mbedAustin | 11:cada08fc8a70 | 1802 | p[1] != ( ( ciphersuites[i] ) & 0xFF ) ) |
mbedAustin | 11:cada08fc8a70 | 1803 | continue; |
mbedAustin | 11:cada08fc8a70 | 1804 | |
mbedAustin | 11:cada08fc8a70 | 1805 | got_common_suite = 1; |
mbedAustin | 11:cada08fc8a70 | 1806 | |
mbedAustin | 11:cada08fc8a70 | 1807 | if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i], |
mbedAustin | 11:cada08fc8a70 | 1808 | &ciphersuite_info ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 1809 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 1810 | |
mbedAustin | 11:cada08fc8a70 | 1811 | if( ciphersuite_info != NULL ) |
mbedAustin | 11:cada08fc8a70 | 1812 | goto have_ciphersuite; |
mbedAustin | 11:cada08fc8a70 | 1813 | } |
mbedAustin | 11:cada08fc8a70 | 1814 | } |
mbedAustin | 11:cada08fc8a70 | 1815 | |
mbedAustin | 11:cada08fc8a70 | 1816 | if( got_common_suite ) |
mbedAustin | 11:cada08fc8a70 | 1817 | { |
mbedAustin | 11:cada08fc8a70 | 1818 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, " |
mbedAustin | 11:cada08fc8a70 | 1819 | "but none of them usable" ) ); |
mbedAustin | 11:cada08fc8a70 | 1820 | mbedtls_ssl_send_fatal_handshake_failure( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1821 | return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE ); |
mbedAustin | 11:cada08fc8a70 | 1822 | } |
mbedAustin | 11:cada08fc8a70 | 1823 | else |
mbedAustin | 11:cada08fc8a70 | 1824 | { |
mbedAustin | 11:cada08fc8a70 | 1825 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) ); |
mbedAustin | 11:cada08fc8a70 | 1826 | mbedtls_ssl_send_fatal_handshake_failure( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1827 | return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN ); |
mbedAustin | 11:cada08fc8a70 | 1828 | } |
mbedAustin | 11:cada08fc8a70 | 1829 | |
mbedAustin | 11:cada08fc8a70 | 1830 | have_ciphersuite: |
mbedAustin | 11:cada08fc8a70 | 1831 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) ); |
mbedAustin | 11:cada08fc8a70 | 1832 | |
mbedAustin | 11:cada08fc8a70 | 1833 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
mbedAustin | 11:cada08fc8a70 | 1834 | ssl->transform_negotiate->ciphersuite_info = ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 1835 | mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info ); |
mbedAustin | 11:cada08fc8a70 | 1836 | |
mbedAustin | 11:cada08fc8a70 | 1837 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 1838 | |
mbedAustin | 11:cada08fc8a70 | 1839 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 1840 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
mbedAustin | 11:cada08fc8a70 | 1841 | mbedtls_ssl_recv_flight_completed( ssl ); |
mbedAustin | 11:cada08fc8a70 | 1842 | #endif |
mbedAustin | 11:cada08fc8a70 | 1843 | |
mbedAustin | 11:cada08fc8a70 | 1844 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) ); |
mbedAustin | 11:cada08fc8a70 | 1845 | |
mbedAustin | 11:cada08fc8a70 | 1846 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 1847 | } |
mbedAustin | 11:cada08fc8a70 | 1848 | |
mbedAustin | 11:cada08fc8a70 | 1849 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
mbedAustin | 11:cada08fc8a70 | 1850 | static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 1851 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 1852 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 1853 | { |
mbedAustin | 11:cada08fc8a70 | 1854 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 1855 | |
mbedAustin | 11:cada08fc8a70 | 1856 | if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ) |
mbedAustin | 11:cada08fc8a70 | 1857 | { |
mbedAustin | 11:cada08fc8a70 | 1858 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 1859 | return; |
mbedAustin | 11:cada08fc8a70 | 1860 | } |
mbedAustin | 11:cada08fc8a70 | 1861 | |
mbedAustin | 11:cada08fc8a70 | 1862 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1863 | |
mbedAustin | 11:cada08fc8a70 | 1864 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1865 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1866 | |
mbedAustin | 11:cada08fc8a70 | 1867 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1868 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1869 | |
mbedAustin | 11:cada08fc8a70 | 1870 | *olen = 4; |
mbedAustin | 11:cada08fc8a70 | 1871 | } |
mbedAustin | 11:cada08fc8a70 | 1872 | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
mbedAustin | 11:cada08fc8a70 | 1873 | |
mbedAustin | 11:cada08fc8a70 | 1874 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
mbedAustin | 11:cada08fc8a70 | 1875 | static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 1876 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 1877 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 1878 | { |
mbedAustin | 11:cada08fc8a70 | 1879 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 1880 | const mbedtls_ssl_ciphersuite_t *suite = NULL; |
mbedAustin | 11:cada08fc8a70 | 1881 | const mbedtls_cipher_info_t *cipher = NULL; |
mbedAustin | 11:cada08fc8a70 | 1882 | |
mbedAustin | 11:cada08fc8a70 | 1883 | if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED || |
mbedAustin | 11:cada08fc8a70 | 1884 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
mbedAustin | 11:cada08fc8a70 | 1885 | { |
mbedAustin | 11:cada08fc8a70 | 1886 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 1887 | return; |
mbedAustin | 11:cada08fc8a70 | 1888 | } |
mbedAustin | 11:cada08fc8a70 | 1889 | |
mbedAustin | 11:cada08fc8a70 | 1890 | /* |
mbedAustin | 11:cada08fc8a70 | 1891 | * RFC 7366: "If a server receives an encrypt-then-MAC request extension |
mbedAustin | 11:cada08fc8a70 | 1892 | * from a client and then selects a stream or Authenticated Encryption |
mbedAustin | 11:cada08fc8a70 | 1893 | * with Associated Data (AEAD) ciphersuite, it MUST NOT send an |
mbedAustin | 11:cada08fc8a70 | 1894 | * encrypt-then-MAC response extension back to the client." |
mbedAustin | 11:cada08fc8a70 | 1895 | */ |
mbedAustin | 11:cada08fc8a70 | 1896 | if( ( suite = mbedtls_ssl_ciphersuite_from_id( |
mbedAustin | 11:cada08fc8a70 | 1897 | ssl->session_negotiate->ciphersuite ) ) == NULL || |
mbedAustin | 11:cada08fc8a70 | 1898 | ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL || |
mbedAustin | 11:cada08fc8a70 | 1899 | cipher->mode != MBEDTLS_MODE_CBC ) |
mbedAustin | 11:cada08fc8a70 | 1900 | { |
mbedAustin | 11:cada08fc8a70 | 1901 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 1902 | return; |
mbedAustin | 11:cada08fc8a70 | 1903 | } |
mbedAustin | 11:cada08fc8a70 | 1904 | |
mbedAustin | 11:cada08fc8a70 | 1905 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1906 | |
mbedAustin | 11:cada08fc8a70 | 1907 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1908 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1909 | |
mbedAustin | 11:cada08fc8a70 | 1910 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1911 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1912 | |
mbedAustin | 11:cada08fc8a70 | 1913 | *olen = 4; |
mbedAustin | 11:cada08fc8a70 | 1914 | } |
mbedAustin | 11:cada08fc8a70 | 1915 | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
mbedAustin | 11:cada08fc8a70 | 1916 | |
mbedAustin | 11:cada08fc8a70 | 1917 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
mbedAustin | 11:cada08fc8a70 | 1918 | static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 1919 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 1920 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 1921 | { |
mbedAustin | 11:cada08fc8a70 | 1922 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 1923 | |
mbedAustin | 11:cada08fc8a70 | 1924 | if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED || |
mbedAustin | 11:cada08fc8a70 | 1925 | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) |
mbedAustin | 11:cada08fc8a70 | 1926 | { |
mbedAustin | 11:cada08fc8a70 | 1927 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 1928 | return; |
mbedAustin | 11:cada08fc8a70 | 1929 | } |
mbedAustin | 11:cada08fc8a70 | 1930 | |
mbedAustin | 11:cada08fc8a70 | 1931 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret " |
mbedAustin | 11:cada08fc8a70 | 1932 | "extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1933 | |
mbedAustin | 11:cada08fc8a70 | 1934 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1935 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1936 | |
mbedAustin | 11:cada08fc8a70 | 1937 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1938 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1939 | |
mbedAustin | 11:cada08fc8a70 | 1940 | *olen = 4; |
mbedAustin | 11:cada08fc8a70 | 1941 | } |
mbedAustin | 11:cada08fc8a70 | 1942 | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
mbedAustin | 11:cada08fc8a70 | 1943 | |
mbedAustin | 11:cada08fc8a70 | 1944 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 1945 | static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 1946 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 1947 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 1948 | { |
mbedAustin | 11:cada08fc8a70 | 1949 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 1950 | |
mbedAustin | 11:cada08fc8a70 | 1951 | if( ssl->handshake->new_session_ticket == 0 ) |
mbedAustin | 11:cada08fc8a70 | 1952 | { |
mbedAustin | 11:cada08fc8a70 | 1953 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 1954 | return; |
mbedAustin | 11:cada08fc8a70 | 1955 | } |
mbedAustin | 11:cada08fc8a70 | 1956 | |
mbedAustin | 11:cada08fc8a70 | 1957 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1958 | |
mbedAustin | 11:cada08fc8a70 | 1959 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1960 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1961 | |
mbedAustin | 11:cada08fc8a70 | 1962 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1963 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1964 | |
mbedAustin | 11:cada08fc8a70 | 1965 | *olen = 4; |
mbedAustin | 11:cada08fc8a70 | 1966 | } |
mbedAustin | 11:cada08fc8a70 | 1967 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
mbedAustin | 11:cada08fc8a70 | 1968 | |
mbedAustin | 11:cada08fc8a70 | 1969 | static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 1970 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 1971 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 1972 | { |
mbedAustin | 11:cada08fc8a70 | 1973 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 1974 | |
mbedAustin | 11:cada08fc8a70 | 1975 | if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION ) |
mbedAustin | 11:cada08fc8a70 | 1976 | { |
mbedAustin | 11:cada08fc8a70 | 1977 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 1978 | return; |
mbedAustin | 11:cada08fc8a70 | 1979 | } |
mbedAustin | 11:cada08fc8a70 | 1980 | |
mbedAustin | 11:cada08fc8a70 | 1981 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 1982 | |
mbedAustin | 11:cada08fc8a70 | 1983 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1984 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 1985 | |
mbedAustin | 11:cada08fc8a70 | 1986 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 1987 | if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 1988 | { |
mbedAustin | 11:cada08fc8a70 | 1989 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 1990 | *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF; |
mbedAustin | 11:cada08fc8a70 | 1991 | *p++ = ssl->verify_data_len * 2 & 0xFF; |
mbedAustin | 11:cada08fc8a70 | 1992 | |
mbedAustin | 11:cada08fc8a70 | 1993 | memcpy( p, ssl->peer_verify_data, ssl->verify_data_len ); |
mbedAustin | 11:cada08fc8a70 | 1994 | p += ssl->verify_data_len; |
mbedAustin | 11:cada08fc8a70 | 1995 | memcpy( p, ssl->own_verify_data, ssl->verify_data_len ); |
mbedAustin | 11:cada08fc8a70 | 1996 | p += ssl->verify_data_len; |
mbedAustin | 11:cada08fc8a70 | 1997 | } |
mbedAustin | 11:cada08fc8a70 | 1998 | else |
mbedAustin | 11:cada08fc8a70 | 1999 | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
mbedAustin | 11:cada08fc8a70 | 2000 | { |
mbedAustin | 11:cada08fc8a70 | 2001 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 2002 | *p++ = 0x01; |
mbedAustin | 11:cada08fc8a70 | 2003 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 2004 | } |
mbedAustin | 11:cada08fc8a70 | 2005 | |
mbedAustin | 11:cada08fc8a70 | 2006 | *olen = p - buf; |
mbedAustin | 11:cada08fc8a70 | 2007 | } |
mbedAustin | 11:cada08fc8a70 | 2008 | |
mbedAustin | 11:cada08fc8a70 | 2009 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
mbedAustin | 11:cada08fc8a70 | 2010 | static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 2011 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 2012 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 2013 | { |
mbedAustin | 11:cada08fc8a70 | 2014 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 2015 | |
mbedAustin | 11:cada08fc8a70 | 2016 | if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) |
mbedAustin | 11:cada08fc8a70 | 2017 | { |
mbedAustin | 11:cada08fc8a70 | 2018 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 2019 | return; |
mbedAustin | 11:cada08fc8a70 | 2020 | } |
mbedAustin | 11:cada08fc8a70 | 2021 | |
mbedAustin | 11:cada08fc8a70 | 2022 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 2023 | |
mbedAustin | 11:cada08fc8a70 | 2024 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2025 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2026 | |
mbedAustin | 11:cada08fc8a70 | 2027 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 2028 | *p++ = 1; |
mbedAustin | 11:cada08fc8a70 | 2029 | |
mbedAustin | 11:cada08fc8a70 | 2030 | *p++ = ssl->session_negotiate->mfl_code; |
mbedAustin | 11:cada08fc8a70 | 2031 | |
mbedAustin | 11:cada08fc8a70 | 2032 | *olen = 5; |
mbedAustin | 11:cada08fc8a70 | 2033 | } |
mbedAustin | 11:cada08fc8a70 | 2034 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
mbedAustin | 11:cada08fc8a70 | 2035 | |
mbedAustin | 11:cada08fc8a70 | 2036 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
mbedAustin | 11:cada08fc8a70 | 2037 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2038 | static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 2039 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 2040 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 2041 | { |
mbedAustin | 11:cada08fc8a70 | 2042 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 2043 | ((void) ssl); |
mbedAustin | 11:cada08fc8a70 | 2044 | |
mbedAustin | 11:cada08fc8a70 | 2045 | if( ( ssl->handshake->cli_exts & |
mbedAustin | 11:cada08fc8a70 | 2046 | MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 ) |
mbedAustin | 11:cada08fc8a70 | 2047 | { |
mbedAustin | 11:cada08fc8a70 | 2048 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 2049 | return; |
mbedAustin | 11:cada08fc8a70 | 2050 | } |
mbedAustin | 11:cada08fc8a70 | 2051 | |
mbedAustin | 11:cada08fc8a70 | 2052 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 2053 | |
mbedAustin | 11:cada08fc8a70 | 2054 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2055 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2056 | |
mbedAustin | 11:cada08fc8a70 | 2057 | *p++ = 0x00; |
mbedAustin | 11:cada08fc8a70 | 2058 | *p++ = 2; |
mbedAustin | 11:cada08fc8a70 | 2059 | |
mbedAustin | 11:cada08fc8a70 | 2060 | *p++ = 1; |
mbedAustin | 11:cada08fc8a70 | 2061 | *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; |
mbedAustin | 11:cada08fc8a70 | 2062 | |
mbedAustin | 11:cada08fc8a70 | 2063 | *olen = 6; |
mbedAustin | 11:cada08fc8a70 | 2064 | } |
mbedAustin | 11:cada08fc8a70 | 2065 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2066 | |
mbedAustin | 11:cada08fc8a70 | 2067 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2068 | static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 2069 | unsigned char *buf, |
mbedAustin | 11:cada08fc8a70 | 2070 | size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 2071 | { |
mbedAustin | 11:cada08fc8a70 | 2072 | int ret; |
mbedAustin | 11:cada08fc8a70 | 2073 | unsigned char *p = buf; |
mbedAustin | 11:cada08fc8a70 | 2074 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; |
mbedAustin | 11:cada08fc8a70 | 2075 | size_t kkpp_len; |
mbedAustin | 11:cada08fc8a70 | 2076 | |
mbedAustin | 11:cada08fc8a70 | 2077 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 2078 | |
mbedAustin | 11:cada08fc8a70 | 2079 | /* Skip costly computation if not needed */ |
mbedAustin | 11:cada08fc8a70 | 2080 | if( ssl->transform_negotiate->ciphersuite_info->key_exchange != |
mbedAustin | 11:cada08fc8a70 | 2081 | MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
mbedAustin | 11:cada08fc8a70 | 2082 | return; |
mbedAustin | 11:cada08fc8a70 | 2083 | |
mbedAustin | 11:cada08fc8a70 | 2084 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 2085 | |
mbedAustin | 11:cada08fc8a70 | 2086 | if( end - p < 4 ) |
mbedAustin | 11:cada08fc8a70 | 2087 | { |
mbedAustin | 11:cada08fc8a70 | 2088 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) ); |
mbedAustin | 11:cada08fc8a70 | 2089 | return; |
mbedAustin | 11:cada08fc8a70 | 2090 | } |
mbedAustin | 11:cada08fc8a70 | 2091 | |
mbedAustin | 11:cada08fc8a70 | 2092 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2093 | *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2094 | |
mbedAustin | 11:cada08fc8a70 | 2095 | ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx, |
mbedAustin | 11:cada08fc8a70 | 2096 | p + 2, end - p - 2, &kkpp_len, |
mbedAustin | 11:cada08fc8a70 | 2097 | ssl->conf->f_rng, ssl->conf->p_rng ); |
mbedAustin | 11:cada08fc8a70 | 2098 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2099 | { |
mbedAustin | 11:cada08fc8a70 | 2100 | MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret ); |
mbedAustin | 11:cada08fc8a70 | 2101 | return; |
mbedAustin | 11:cada08fc8a70 | 2102 | } |
mbedAustin | 11:cada08fc8a70 | 2103 | |
mbedAustin | 11:cada08fc8a70 | 2104 | *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2105 | *p++ = (unsigned char)( ( kkpp_len ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2106 | |
mbedAustin | 11:cada08fc8a70 | 2107 | *olen = kkpp_len + 4; |
mbedAustin | 11:cada08fc8a70 | 2108 | } |
mbedAustin | 11:cada08fc8a70 | 2109 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2110 | |
mbedAustin | 11:cada08fc8a70 | 2111 | #if defined(MBEDTLS_SSL_ALPN ) |
mbedAustin | 11:cada08fc8a70 | 2112 | static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 2113 | unsigned char *buf, size_t *olen ) |
mbedAustin | 11:cada08fc8a70 | 2114 | { |
mbedAustin | 11:cada08fc8a70 | 2115 | if( ssl->alpn_chosen == NULL ) |
mbedAustin | 11:cada08fc8a70 | 2116 | { |
mbedAustin | 11:cada08fc8a70 | 2117 | *olen = 0; |
mbedAustin | 11:cada08fc8a70 | 2118 | return; |
mbedAustin | 11:cada08fc8a70 | 2119 | } |
mbedAustin | 11:cada08fc8a70 | 2120 | |
mbedAustin | 11:cada08fc8a70 | 2121 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) ); |
mbedAustin | 11:cada08fc8a70 | 2122 | |
mbedAustin | 11:cada08fc8a70 | 2123 | /* |
mbedAustin | 11:cada08fc8a70 | 2124 | * 0 . 1 ext identifier |
mbedAustin | 11:cada08fc8a70 | 2125 | * 2 . 3 ext length |
mbedAustin | 11:cada08fc8a70 | 2126 | * 4 . 5 protocol list length |
mbedAustin | 11:cada08fc8a70 | 2127 | * 6 . 6 protocol name length |
mbedAustin | 11:cada08fc8a70 | 2128 | * 7 . 7+n protocol name |
mbedAustin | 11:cada08fc8a70 | 2129 | */ |
mbedAustin | 11:cada08fc8a70 | 2130 | buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2131 | buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2132 | |
mbedAustin | 11:cada08fc8a70 | 2133 | *olen = 7 + strlen( ssl->alpn_chosen ); |
mbedAustin | 11:cada08fc8a70 | 2134 | |
mbedAustin | 11:cada08fc8a70 | 2135 | buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2136 | buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2137 | |
mbedAustin | 11:cada08fc8a70 | 2138 | buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2139 | buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2140 | |
mbedAustin | 11:cada08fc8a70 | 2141 | buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2142 | |
mbedAustin | 11:cada08fc8a70 | 2143 | memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 ); |
mbedAustin | 11:cada08fc8a70 | 2144 | } |
mbedAustin | 11:cada08fc8a70 | 2145 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ |
mbedAustin | 11:cada08fc8a70 | 2146 | |
mbedAustin | 11:cada08fc8a70 | 2147 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
mbedAustin | 11:cada08fc8a70 | 2148 | static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 2149 | { |
mbedAustin | 11:cada08fc8a70 | 2150 | int ret; |
mbedAustin | 11:cada08fc8a70 | 2151 | unsigned char *p = ssl->out_msg + 4; |
mbedAustin | 11:cada08fc8a70 | 2152 | unsigned char *cookie_len_byte; |
mbedAustin | 11:cada08fc8a70 | 2153 | |
mbedAustin | 11:cada08fc8a70 | 2154 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2155 | |
mbedAustin | 11:cada08fc8a70 | 2156 | /* |
mbedAustin | 11:cada08fc8a70 | 2157 | * struct { |
mbedAustin | 11:cada08fc8a70 | 2158 | * ProtocolVersion server_version; |
mbedAustin | 11:cada08fc8a70 | 2159 | * opaque cookie<0..2^8-1>; |
mbedAustin | 11:cada08fc8a70 | 2160 | * } HelloVerifyRequest; |
mbedAustin | 11:cada08fc8a70 | 2161 | */ |
mbedAustin | 11:cada08fc8a70 | 2162 | |
mbedAustin | 11:cada08fc8a70 | 2163 | /* The RFC is not clear on this point, but sending the actual negotiated |
mbedAustin | 11:cada08fc8a70 | 2164 | * version looks like the most interoperable thing to do. */ |
mbedAustin | 11:cada08fc8a70 | 2165 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
mbedAustin | 11:cada08fc8a70 | 2166 | ssl->conf->transport, p ); |
mbedAustin | 11:cada08fc8a70 | 2167 | MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 ); |
mbedAustin | 11:cada08fc8a70 | 2168 | p += 2; |
mbedAustin | 11:cada08fc8a70 | 2169 | |
mbedAustin | 11:cada08fc8a70 | 2170 | /* If we get here, f_cookie_check is not null */ |
mbedAustin | 11:cada08fc8a70 | 2171 | if( ssl->conf->f_cookie_write == NULL ) |
mbedAustin | 11:cada08fc8a70 | 2172 | { |
mbedAustin | 11:cada08fc8a70 | 2173 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) ); |
mbedAustin | 11:cada08fc8a70 | 2174 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 2175 | } |
mbedAustin | 11:cada08fc8a70 | 2176 | |
mbedAustin | 11:cada08fc8a70 | 2177 | /* Skip length byte until we know the length */ |
mbedAustin | 11:cada08fc8a70 | 2178 | cookie_len_byte = p++; |
mbedAustin | 11:cada08fc8a70 | 2179 | |
mbedAustin | 11:cada08fc8a70 | 2180 | if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie, |
mbedAustin | 11:cada08fc8a70 | 2181 | &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN, |
mbedAustin | 11:cada08fc8a70 | 2182 | ssl->cli_id, ssl->cli_id_len ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2183 | { |
mbedAustin | 11:cada08fc8a70 | 2184 | MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret ); |
mbedAustin | 11:cada08fc8a70 | 2185 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2186 | } |
mbedAustin | 11:cada08fc8a70 | 2187 | |
mbedAustin | 11:cada08fc8a70 | 2188 | *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) ); |
mbedAustin | 11:cada08fc8a70 | 2189 | |
mbedAustin | 11:cada08fc8a70 | 2190 | MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte ); |
mbedAustin | 11:cada08fc8a70 | 2191 | |
mbedAustin | 11:cada08fc8a70 | 2192 | ssl->out_msglen = p - ssl->out_msg; |
mbedAustin | 11:cada08fc8a70 | 2193 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
mbedAustin | 11:cada08fc8a70 | 2194 | ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; |
mbedAustin | 11:cada08fc8a70 | 2195 | |
mbedAustin | 11:cada08fc8a70 | 2196 | ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT; |
mbedAustin | 11:cada08fc8a70 | 2197 | |
mbedAustin | 11:cada08fc8a70 | 2198 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2199 | { |
mbedAustin | 11:cada08fc8a70 | 2200 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
mbedAustin | 11:cada08fc8a70 | 2201 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2202 | } |
mbedAustin | 11:cada08fc8a70 | 2203 | |
mbedAustin | 11:cada08fc8a70 | 2204 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2205 | |
mbedAustin | 11:cada08fc8a70 | 2206 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 2207 | } |
mbedAustin | 11:cada08fc8a70 | 2208 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
mbedAustin | 11:cada08fc8a70 | 2209 | |
mbedAustin | 11:cada08fc8a70 | 2210 | static int ssl_write_server_hello( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 2211 | { |
mbedAustin | 11:cada08fc8a70 | 2212 | #if defined(MBEDTLS_HAVE_TIME) |
mbedAustin | 11:cada08fc8a70 | 2213 | time_t t; |
mbedAustin | 11:cada08fc8a70 | 2214 | #endif |
mbedAustin | 11:cada08fc8a70 | 2215 | int ret; |
mbedAustin | 11:cada08fc8a70 | 2216 | size_t olen, ext_len = 0, n; |
mbedAustin | 11:cada08fc8a70 | 2217 | unsigned char *buf, *p; |
mbedAustin | 11:cada08fc8a70 | 2218 | |
mbedAustin | 11:cada08fc8a70 | 2219 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) ); |
mbedAustin | 11:cada08fc8a70 | 2220 | |
mbedAustin | 11:cada08fc8a70 | 2221 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
mbedAustin | 11:cada08fc8a70 | 2222 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
mbedAustin | 11:cada08fc8a70 | 2223 | ssl->handshake->verify_cookie_len != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2224 | { |
mbedAustin | 11:cada08fc8a70 | 2225 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) ); |
mbedAustin | 11:cada08fc8a70 | 2226 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) ); |
mbedAustin | 11:cada08fc8a70 | 2227 | |
mbedAustin | 11:cada08fc8a70 | 2228 | return( ssl_write_hello_verify_request( ssl ) ); |
mbedAustin | 11:cada08fc8a70 | 2229 | } |
mbedAustin | 11:cada08fc8a70 | 2230 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
mbedAustin | 11:cada08fc8a70 | 2231 | |
mbedAustin | 11:cada08fc8a70 | 2232 | if( ssl->conf->f_rng == NULL ) |
mbedAustin | 11:cada08fc8a70 | 2233 | { |
mbedAustin | 11:cada08fc8a70 | 2234 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") ); |
mbedAustin | 11:cada08fc8a70 | 2235 | return( MBEDTLS_ERR_SSL_NO_RNG ); |
mbedAustin | 11:cada08fc8a70 | 2236 | } |
mbedAustin | 11:cada08fc8a70 | 2237 | |
mbedAustin | 11:cada08fc8a70 | 2238 | /* |
mbedAustin | 11:cada08fc8a70 | 2239 | * 0 . 0 handshake type |
mbedAustin | 11:cada08fc8a70 | 2240 | * 1 . 3 handshake length |
mbedAustin | 11:cada08fc8a70 | 2241 | * 4 . 5 protocol version |
mbedAustin | 11:cada08fc8a70 | 2242 | * 6 . 9 UNIX time() |
mbedAustin | 11:cada08fc8a70 | 2243 | * 10 . 37 random bytes |
mbedAustin | 11:cada08fc8a70 | 2244 | */ |
mbedAustin | 11:cada08fc8a70 | 2245 | buf = ssl->out_msg; |
mbedAustin | 11:cada08fc8a70 | 2246 | p = buf + 4; |
mbedAustin | 11:cada08fc8a70 | 2247 | |
mbedAustin | 11:cada08fc8a70 | 2248 | mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver, |
mbedAustin | 11:cada08fc8a70 | 2249 | ssl->conf->transport, p ); |
mbedAustin | 11:cada08fc8a70 | 2250 | p += 2; |
mbedAustin | 11:cada08fc8a70 | 2251 | |
mbedAustin | 11:cada08fc8a70 | 2252 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]", |
mbedAustin | 11:cada08fc8a70 | 2253 | buf[4], buf[5] ) ); |
mbedAustin | 11:cada08fc8a70 | 2254 | |
mbedAustin | 11:cada08fc8a70 | 2255 | #if defined(MBEDTLS_HAVE_TIME) |
mbedAustin | 11:cada08fc8a70 | 2256 | t = time( NULL ); |
mbedAustin | 11:cada08fc8a70 | 2257 | *p++ = (unsigned char)( t >> 24 ); |
mbedAustin | 11:cada08fc8a70 | 2258 | *p++ = (unsigned char)( t >> 16 ); |
mbedAustin | 11:cada08fc8a70 | 2259 | *p++ = (unsigned char)( t >> 8 ); |
mbedAustin | 11:cada08fc8a70 | 2260 | *p++ = (unsigned char)( t ); |
mbedAustin | 11:cada08fc8a70 | 2261 | |
mbedAustin | 11:cada08fc8a70 | 2262 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) ); |
mbedAustin | 11:cada08fc8a70 | 2263 | #else |
mbedAustin | 11:cada08fc8a70 | 2264 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2265 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2266 | |
mbedAustin | 11:cada08fc8a70 | 2267 | p += 4; |
mbedAustin | 11:cada08fc8a70 | 2268 | #endif /* MBEDTLS_HAVE_TIME */ |
mbedAustin | 11:cada08fc8a70 | 2269 | |
mbedAustin | 11:cada08fc8a70 | 2270 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2271 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2272 | |
mbedAustin | 11:cada08fc8a70 | 2273 | p += 28; |
mbedAustin | 11:cada08fc8a70 | 2274 | |
mbedAustin | 11:cada08fc8a70 | 2275 | memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 ); |
mbedAustin | 11:cada08fc8a70 | 2276 | |
mbedAustin | 11:cada08fc8a70 | 2277 | MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 ); |
mbedAustin | 11:cada08fc8a70 | 2278 | |
mbedAustin | 11:cada08fc8a70 | 2279 | /* |
mbedAustin | 11:cada08fc8a70 | 2280 | * Resume is 0 by default, see ssl_handshake_init(). |
mbedAustin | 11:cada08fc8a70 | 2281 | * It may be already set to 1 by ssl_parse_session_ticket_ext(). |
mbedAustin | 11:cada08fc8a70 | 2282 | * If not, try looking up session ID in our cache. |
mbedAustin | 11:cada08fc8a70 | 2283 | */ |
mbedAustin | 11:cada08fc8a70 | 2284 | if( ssl->handshake->resume == 0 && |
mbedAustin | 11:cada08fc8a70 | 2285 | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
mbedAustin | 11:cada08fc8a70 | 2286 | ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE && |
mbedAustin | 11:cada08fc8a70 | 2287 | #endif |
mbedAustin | 11:cada08fc8a70 | 2288 | ssl->session_negotiate->id_len != 0 && |
mbedAustin | 11:cada08fc8a70 | 2289 | ssl->conf->f_get_cache != NULL && |
mbedAustin | 11:cada08fc8a70 | 2290 | ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 ) |
mbedAustin | 11:cada08fc8a70 | 2291 | { |
mbedAustin | 11:cada08fc8a70 | 2292 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) ); |
mbedAustin | 11:cada08fc8a70 | 2293 | ssl->handshake->resume = 1; |
mbedAustin | 11:cada08fc8a70 | 2294 | } |
mbedAustin | 11:cada08fc8a70 | 2295 | |
mbedAustin | 11:cada08fc8a70 | 2296 | if( ssl->handshake->resume == 0 ) |
mbedAustin | 11:cada08fc8a70 | 2297 | { |
mbedAustin | 11:cada08fc8a70 | 2298 | /* |
mbedAustin | 11:cada08fc8a70 | 2299 | * New session, create a new session id, |
mbedAustin | 11:cada08fc8a70 | 2300 | * unless we're about to issue a session ticket |
mbedAustin | 11:cada08fc8a70 | 2301 | */ |
mbedAustin | 11:cada08fc8a70 | 2302 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 2303 | |
mbedAustin | 11:cada08fc8a70 | 2304 | #if defined(MBEDTLS_HAVE_TIME) |
mbedAustin | 11:cada08fc8a70 | 2305 | ssl->session_negotiate->start = time( NULL ); |
mbedAustin | 11:cada08fc8a70 | 2306 | #endif |
mbedAustin | 11:cada08fc8a70 | 2307 | |
mbedAustin | 11:cada08fc8a70 | 2308 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 2309 | if( ssl->handshake->new_session_ticket != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2310 | { |
mbedAustin | 11:cada08fc8a70 | 2311 | ssl->session_negotiate->id_len = n = 0; |
mbedAustin | 11:cada08fc8a70 | 2312 | memset( ssl->session_negotiate->id, 0, 32 ); |
mbedAustin | 11:cada08fc8a70 | 2313 | } |
mbedAustin | 11:cada08fc8a70 | 2314 | else |
mbedAustin | 11:cada08fc8a70 | 2315 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
mbedAustin | 11:cada08fc8a70 | 2316 | { |
mbedAustin | 11:cada08fc8a70 | 2317 | ssl->session_negotiate->id_len = n = 32; |
mbedAustin | 11:cada08fc8a70 | 2318 | if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, |
mbedAustin | 11:cada08fc8a70 | 2319 | n ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2320 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2321 | } |
mbedAustin | 11:cada08fc8a70 | 2322 | } |
mbedAustin | 11:cada08fc8a70 | 2323 | else |
mbedAustin | 11:cada08fc8a70 | 2324 | { |
mbedAustin | 11:cada08fc8a70 | 2325 | /* |
mbedAustin | 11:cada08fc8a70 | 2326 | * Resuming a session |
mbedAustin | 11:cada08fc8a70 | 2327 | */ |
mbedAustin | 11:cada08fc8a70 | 2328 | n = ssl->session_negotiate->id_len; |
mbedAustin | 11:cada08fc8a70 | 2329 | ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; |
mbedAustin | 11:cada08fc8a70 | 2330 | |
mbedAustin | 11:cada08fc8a70 | 2331 | if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2332 | { |
mbedAustin | 11:cada08fc8a70 | 2333 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); |
mbedAustin | 11:cada08fc8a70 | 2334 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2335 | } |
mbedAustin | 11:cada08fc8a70 | 2336 | } |
mbedAustin | 11:cada08fc8a70 | 2337 | |
mbedAustin | 11:cada08fc8a70 | 2338 | /* |
mbedAustin | 11:cada08fc8a70 | 2339 | * 38 . 38 session id length |
mbedAustin | 11:cada08fc8a70 | 2340 | * 39 . 38+n session id |
mbedAustin | 11:cada08fc8a70 | 2341 | * 39+n . 40+n chosen ciphersuite |
mbedAustin | 11:cada08fc8a70 | 2342 | * 41+n . 41+n chosen compression alg. |
mbedAustin | 11:cada08fc8a70 | 2343 | * 42+n . 43+n extensions length |
mbedAustin | 11:cada08fc8a70 | 2344 | * 44+n . 43+n+m extensions |
mbedAustin | 11:cada08fc8a70 | 2345 | */ |
mbedAustin | 11:cada08fc8a70 | 2346 | *p++ = (unsigned char) ssl->session_negotiate->id_len; |
mbedAustin | 11:cada08fc8a70 | 2347 | memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len ); |
mbedAustin | 11:cada08fc8a70 | 2348 | p += ssl->session_negotiate->id_len; |
mbedAustin | 11:cada08fc8a70 | 2349 | |
mbedAustin | 11:cada08fc8a70 | 2350 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) ); |
mbedAustin | 11:cada08fc8a70 | 2351 | MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n ); |
mbedAustin | 11:cada08fc8a70 | 2352 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed", |
mbedAustin | 11:cada08fc8a70 | 2353 | ssl->handshake->resume ? "a" : "no" ) ); |
mbedAustin | 11:cada08fc8a70 | 2354 | |
mbedAustin | 11:cada08fc8a70 | 2355 | *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 ); |
mbedAustin | 11:cada08fc8a70 | 2356 | *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite ); |
mbedAustin | 11:cada08fc8a70 | 2357 | *p++ = (unsigned char)( ssl->session_negotiate->compression ); |
mbedAustin | 11:cada08fc8a70 | 2358 | |
mbedAustin | 11:cada08fc8a70 | 2359 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", |
mbedAustin | 11:cada08fc8a70 | 2360 | mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) ); |
mbedAustin | 11:cada08fc8a70 | 2361 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X", |
mbedAustin | 11:cada08fc8a70 | 2362 | ssl->session_negotiate->compression ) ); |
mbedAustin | 11:cada08fc8a70 | 2363 | |
mbedAustin | 11:cada08fc8a70 | 2364 | /* |
mbedAustin | 11:cada08fc8a70 | 2365 | * First write extensions, then the total length |
mbedAustin | 11:cada08fc8a70 | 2366 | */ |
mbedAustin | 11:cada08fc8a70 | 2367 | ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2368 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2369 | |
mbedAustin | 11:cada08fc8a70 | 2370 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
mbedAustin | 11:cada08fc8a70 | 2371 | ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2372 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2373 | #endif |
mbedAustin | 11:cada08fc8a70 | 2374 | |
mbedAustin | 11:cada08fc8a70 | 2375 | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
mbedAustin | 11:cada08fc8a70 | 2376 | ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2377 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2378 | #endif |
mbedAustin | 11:cada08fc8a70 | 2379 | |
mbedAustin | 11:cada08fc8a70 | 2380 | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
mbedAustin | 11:cada08fc8a70 | 2381 | ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2382 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2383 | #endif |
mbedAustin | 11:cada08fc8a70 | 2384 | |
mbedAustin | 11:cada08fc8a70 | 2385 | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
mbedAustin | 11:cada08fc8a70 | 2386 | ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2387 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2388 | #endif |
mbedAustin | 11:cada08fc8a70 | 2389 | |
mbedAustin | 11:cada08fc8a70 | 2390 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 2391 | ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2392 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2393 | #endif |
mbedAustin | 11:cada08fc8a70 | 2394 | |
mbedAustin | 11:cada08fc8a70 | 2395 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
mbedAustin | 11:cada08fc8a70 | 2396 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2397 | ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2398 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2399 | #endif |
mbedAustin | 11:cada08fc8a70 | 2400 | |
mbedAustin | 11:cada08fc8a70 | 2401 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2402 | ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2403 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2404 | #endif |
mbedAustin | 11:cada08fc8a70 | 2405 | |
mbedAustin | 11:cada08fc8a70 | 2406 | #if defined(MBEDTLS_SSL_ALPN) |
mbedAustin | 11:cada08fc8a70 | 2407 | ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen ); |
mbedAustin | 11:cada08fc8a70 | 2408 | ext_len += olen; |
mbedAustin | 11:cada08fc8a70 | 2409 | #endif |
mbedAustin | 11:cada08fc8a70 | 2410 | |
mbedAustin | 11:cada08fc8a70 | 2411 | MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) ); |
mbedAustin | 11:cada08fc8a70 | 2412 | |
mbedAustin | 11:cada08fc8a70 | 2413 | if( ext_len > 0 ) |
mbedAustin | 11:cada08fc8a70 | 2414 | { |
mbedAustin | 11:cada08fc8a70 | 2415 | *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2416 | *p++ = (unsigned char)( ( ext_len ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 2417 | p += ext_len; |
mbedAustin | 11:cada08fc8a70 | 2418 | } |
mbedAustin | 11:cada08fc8a70 | 2419 | |
mbedAustin | 11:cada08fc8a70 | 2420 | ssl->out_msglen = p - buf; |
mbedAustin | 11:cada08fc8a70 | 2421 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
mbedAustin | 11:cada08fc8a70 | 2422 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO; |
mbedAustin | 11:cada08fc8a70 | 2423 | |
mbedAustin | 11:cada08fc8a70 | 2424 | ret = mbedtls_ssl_write_record( ssl ); |
mbedAustin | 11:cada08fc8a70 | 2425 | |
mbedAustin | 11:cada08fc8a70 | 2426 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) ); |
mbedAustin | 11:cada08fc8a70 | 2427 | |
mbedAustin | 11:cada08fc8a70 | 2428 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2429 | } |
mbedAustin | 11:cada08fc8a70 | 2430 | |
mbedAustin | 11:cada08fc8a70 | 2431 | #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ |
mbedAustin | 11:cada08fc8a70 | 2432 | !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ |
mbedAustin | 11:cada08fc8a70 | 2433 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ |
mbedAustin | 11:cada08fc8a70 | 2434 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2435 | static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 2436 | { |
mbedAustin | 11:cada08fc8a70 | 2437 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 2438 | |
mbedAustin | 11:cada08fc8a70 | 2439 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2440 | |
mbedAustin | 11:cada08fc8a70 | 2441 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2442 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
mbedAustin | 11:cada08fc8a70 | 2443 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2444 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2445 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
mbedAustin | 11:cada08fc8a70 | 2446 | { |
mbedAustin | 11:cada08fc8a70 | 2447 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2448 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 2449 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 2450 | } |
mbedAustin | 11:cada08fc8a70 | 2451 | |
mbedAustin | 11:cada08fc8a70 | 2452 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 2453 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 2454 | } |
mbedAustin | 11:cada08fc8a70 | 2455 | #else |
mbedAustin | 11:cada08fc8a70 | 2456 | static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 2457 | { |
mbedAustin | 11:cada08fc8a70 | 2458 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
mbedAustin | 11:cada08fc8a70 | 2459 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 2460 | size_t dn_size, total_dn_size; /* excluding length bytes */ |
mbedAustin | 11:cada08fc8a70 | 2461 | size_t ct_len, sa_len; /* including length bytes */ |
mbedAustin | 11:cada08fc8a70 | 2462 | unsigned char *buf, *p; |
mbedAustin | 11:cada08fc8a70 | 2463 | const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; |
mbedAustin | 11:cada08fc8a70 | 2464 | const mbedtls_x509_crt *crt; |
mbedAustin | 11:cada08fc8a70 | 2465 | int authmode; |
mbedAustin | 11:cada08fc8a70 | 2466 | |
mbedAustin | 11:cada08fc8a70 | 2467 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2468 | |
mbedAustin | 11:cada08fc8a70 | 2469 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 2470 | |
mbedAustin | 11:cada08fc8a70 | 2471 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
mbedAustin | 11:cada08fc8a70 | 2472 | if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET ) |
mbedAustin | 11:cada08fc8a70 | 2473 | authmode = ssl->handshake->sni_authmode; |
mbedAustin | 11:cada08fc8a70 | 2474 | else |
mbedAustin | 11:cada08fc8a70 | 2475 | #endif |
mbedAustin | 11:cada08fc8a70 | 2476 | authmode = ssl->conf->authmode; |
mbedAustin | 11:cada08fc8a70 | 2477 | |
mbedAustin | 11:cada08fc8a70 | 2478 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2479 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
mbedAustin | 11:cada08fc8a70 | 2480 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2481 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2482 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE || |
mbedAustin | 11:cada08fc8a70 | 2483 | authmode == MBEDTLS_SSL_VERIFY_NONE ) |
mbedAustin | 11:cada08fc8a70 | 2484 | { |
mbedAustin | 11:cada08fc8a70 | 2485 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2486 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 2487 | } |
mbedAustin | 11:cada08fc8a70 | 2488 | |
mbedAustin | 11:cada08fc8a70 | 2489 | /* |
mbedAustin | 11:cada08fc8a70 | 2490 | * 0 . 0 handshake type |
mbedAustin | 11:cada08fc8a70 | 2491 | * 1 . 3 handshake length |
mbedAustin | 11:cada08fc8a70 | 2492 | * 4 . 4 cert type count |
mbedAustin | 11:cada08fc8a70 | 2493 | * 5 .. m-1 cert types |
mbedAustin | 11:cada08fc8a70 | 2494 | * m .. m+1 sig alg length (TLS 1.2 only) |
mbedAustin | 11:cada08fc8a70 | 2495 | * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only) |
mbedAustin | 11:cada08fc8a70 | 2496 | * n .. n+1 length of all DNs |
mbedAustin | 11:cada08fc8a70 | 2497 | * n+2 .. n+3 length of DN 1 |
mbedAustin | 11:cada08fc8a70 | 2498 | * n+4 .. ... Distinguished Name #1 |
mbedAustin | 11:cada08fc8a70 | 2499 | * ... .. ... length of DN 2, etc. |
mbedAustin | 11:cada08fc8a70 | 2500 | */ |
mbedAustin | 11:cada08fc8a70 | 2501 | buf = ssl->out_msg; |
mbedAustin | 11:cada08fc8a70 | 2502 | p = buf + 4; |
mbedAustin | 11:cada08fc8a70 | 2503 | |
mbedAustin | 11:cada08fc8a70 | 2504 | /* |
mbedAustin | 11:cada08fc8a70 | 2505 | * Supported certificate types |
mbedAustin | 11:cada08fc8a70 | 2506 | * |
mbedAustin | 11:cada08fc8a70 | 2507 | * ClientCertificateType certificate_types<1..2^8-1>; |
mbedAustin | 11:cada08fc8a70 | 2508 | * enum { (255) } ClientCertificateType; |
mbedAustin | 11:cada08fc8a70 | 2509 | */ |
mbedAustin | 11:cada08fc8a70 | 2510 | ct_len = 0; |
mbedAustin | 11:cada08fc8a70 | 2511 | |
mbedAustin | 11:cada08fc8a70 | 2512 | #if defined(MBEDTLS_RSA_C) |
mbedAustin | 11:cada08fc8a70 | 2513 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN; |
mbedAustin | 11:cada08fc8a70 | 2514 | #endif |
mbedAustin | 11:cada08fc8a70 | 2515 | #if defined(MBEDTLS_ECDSA_C) |
mbedAustin | 11:cada08fc8a70 | 2516 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN; |
mbedAustin | 11:cada08fc8a70 | 2517 | #endif |
mbedAustin | 11:cada08fc8a70 | 2518 | |
mbedAustin | 11:cada08fc8a70 | 2519 | p[0] = (unsigned char) ct_len++; |
mbedAustin | 11:cada08fc8a70 | 2520 | p += ct_len; |
mbedAustin | 11:cada08fc8a70 | 2521 | |
mbedAustin | 11:cada08fc8a70 | 2522 | sa_len = 0; |
mbedAustin | 11:cada08fc8a70 | 2523 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 2524 | /* |
mbedAustin | 11:cada08fc8a70 | 2525 | * Add signature_algorithms for verify (TLS 1.2) |
mbedAustin | 11:cada08fc8a70 | 2526 | * |
mbedAustin | 11:cada08fc8a70 | 2527 | * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; |
mbedAustin | 11:cada08fc8a70 | 2528 | * |
mbedAustin | 11:cada08fc8a70 | 2529 | * struct { |
mbedAustin | 11:cada08fc8a70 | 2530 | * HashAlgorithm hash; |
mbedAustin | 11:cada08fc8a70 | 2531 | * SignatureAlgorithm signature; |
mbedAustin | 11:cada08fc8a70 | 2532 | * } SignatureAndHashAlgorithm; |
mbedAustin | 11:cada08fc8a70 | 2533 | * |
mbedAustin | 11:cada08fc8a70 | 2534 | * enum { (255) } HashAlgorithm; |
mbedAustin | 11:cada08fc8a70 | 2535 | * enum { (255) } SignatureAlgorithm; |
mbedAustin | 11:cada08fc8a70 | 2536 | */ |
mbedAustin | 11:cada08fc8a70 | 2537 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 2538 | { |
mbedAustin | 11:cada08fc8a70 | 2539 | /* |
mbedAustin | 11:cada08fc8a70 | 2540 | * Only use current running hash algorithm that is already required |
mbedAustin | 11:cada08fc8a70 | 2541 | * for requested ciphersuite. |
mbedAustin | 11:cada08fc8a70 | 2542 | */ |
mbedAustin | 11:cada08fc8a70 | 2543 | ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256; |
mbedAustin | 11:cada08fc8a70 | 2544 | |
mbedAustin | 11:cada08fc8a70 | 2545 | if( ssl->transform_negotiate->ciphersuite_info->mac == |
mbedAustin | 11:cada08fc8a70 | 2546 | MBEDTLS_MD_SHA384 ) |
mbedAustin | 11:cada08fc8a70 | 2547 | { |
mbedAustin | 11:cada08fc8a70 | 2548 | ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384; |
mbedAustin | 11:cada08fc8a70 | 2549 | } |
mbedAustin | 11:cada08fc8a70 | 2550 | |
mbedAustin | 11:cada08fc8a70 | 2551 | /* |
mbedAustin | 11:cada08fc8a70 | 2552 | * Supported signature algorithms |
mbedAustin | 11:cada08fc8a70 | 2553 | */ |
mbedAustin | 11:cada08fc8a70 | 2554 | #if defined(MBEDTLS_RSA_C) |
mbedAustin | 11:cada08fc8a70 | 2555 | p[2 + sa_len++] = ssl->handshake->verify_sig_alg; |
mbedAustin | 11:cada08fc8a70 | 2556 | p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA; |
mbedAustin | 11:cada08fc8a70 | 2557 | #endif |
mbedAustin | 11:cada08fc8a70 | 2558 | #if defined(MBEDTLS_ECDSA_C) |
mbedAustin | 11:cada08fc8a70 | 2559 | p[2 + sa_len++] = ssl->handshake->verify_sig_alg; |
mbedAustin | 11:cada08fc8a70 | 2560 | p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA; |
mbedAustin | 11:cada08fc8a70 | 2561 | #endif |
mbedAustin | 11:cada08fc8a70 | 2562 | |
mbedAustin | 11:cada08fc8a70 | 2563 | p[0] = (unsigned char)( sa_len >> 8 ); |
mbedAustin | 11:cada08fc8a70 | 2564 | p[1] = (unsigned char)( sa_len ); |
mbedAustin | 11:cada08fc8a70 | 2565 | sa_len += 2; |
mbedAustin | 11:cada08fc8a70 | 2566 | p += sa_len; |
mbedAustin | 11:cada08fc8a70 | 2567 | } |
mbedAustin | 11:cada08fc8a70 | 2568 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
mbedAustin | 11:cada08fc8a70 | 2569 | |
mbedAustin | 11:cada08fc8a70 | 2570 | /* |
mbedAustin | 11:cada08fc8a70 | 2571 | * DistinguishedName certificate_authorities<0..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 2572 | * opaque DistinguishedName<1..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 2573 | */ |
mbedAustin | 11:cada08fc8a70 | 2574 | p += 2; |
mbedAustin | 11:cada08fc8a70 | 2575 | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
mbedAustin | 11:cada08fc8a70 | 2576 | if( ssl->handshake->sni_ca_chain != NULL ) |
mbedAustin | 11:cada08fc8a70 | 2577 | crt = ssl->handshake->sni_ca_chain; |
mbedAustin | 11:cada08fc8a70 | 2578 | else |
mbedAustin | 11:cada08fc8a70 | 2579 | #endif |
mbedAustin | 11:cada08fc8a70 | 2580 | crt = ssl->conf->ca_chain; |
mbedAustin | 11:cada08fc8a70 | 2581 | |
mbedAustin | 11:cada08fc8a70 | 2582 | total_dn_size = 0; |
mbedAustin | 11:cada08fc8a70 | 2583 | while( crt != NULL && crt->version != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2584 | { |
mbedAustin | 11:cada08fc8a70 | 2585 | dn_size = crt->subject_raw.len; |
mbedAustin | 11:cada08fc8a70 | 2586 | |
mbedAustin | 11:cada08fc8a70 | 2587 | if( end < p || (size_t)( end - p ) < 2 + dn_size ) |
mbedAustin | 11:cada08fc8a70 | 2588 | { |
mbedAustin | 11:cada08fc8a70 | 2589 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) ); |
mbedAustin | 11:cada08fc8a70 | 2590 | break; |
mbedAustin | 11:cada08fc8a70 | 2591 | } |
mbedAustin | 11:cada08fc8a70 | 2592 | |
mbedAustin | 11:cada08fc8a70 | 2593 | *p++ = (unsigned char)( dn_size >> 8 ); |
mbedAustin | 11:cada08fc8a70 | 2594 | *p++ = (unsigned char)( dn_size ); |
mbedAustin | 11:cada08fc8a70 | 2595 | memcpy( p, crt->subject_raw.p, dn_size ); |
mbedAustin | 11:cada08fc8a70 | 2596 | p += dn_size; |
mbedAustin | 11:cada08fc8a70 | 2597 | |
mbedAustin | 11:cada08fc8a70 | 2598 | MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size ); |
mbedAustin | 11:cada08fc8a70 | 2599 | |
mbedAustin | 11:cada08fc8a70 | 2600 | total_dn_size += 2 + dn_size; |
mbedAustin | 11:cada08fc8a70 | 2601 | crt = crt->next; |
mbedAustin | 11:cada08fc8a70 | 2602 | } |
mbedAustin | 11:cada08fc8a70 | 2603 | |
mbedAustin | 11:cada08fc8a70 | 2604 | ssl->out_msglen = p - buf; |
mbedAustin | 11:cada08fc8a70 | 2605 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
mbedAustin | 11:cada08fc8a70 | 2606 | ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST; |
mbedAustin | 11:cada08fc8a70 | 2607 | ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 ); |
mbedAustin | 11:cada08fc8a70 | 2608 | ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size ); |
mbedAustin | 11:cada08fc8a70 | 2609 | |
mbedAustin | 11:cada08fc8a70 | 2610 | ret = mbedtls_ssl_write_record( ssl ); |
mbedAustin | 11:cada08fc8a70 | 2611 | |
mbedAustin | 11:cada08fc8a70 | 2612 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) ); |
mbedAustin | 11:cada08fc8a70 | 2613 | |
mbedAustin | 11:cada08fc8a70 | 2614 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2615 | } |
mbedAustin | 11:cada08fc8a70 | 2616 | #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 2617 | !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 2618 | !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 2619 | !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2620 | |
mbedAustin | 11:cada08fc8a70 | 2621 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2622 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2623 | static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 2624 | { |
mbedAustin | 11:cada08fc8a70 | 2625 | int ret; |
mbedAustin | 11:cada08fc8a70 | 2626 | |
mbedAustin | 11:cada08fc8a70 | 2627 | if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) ) |
mbedAustin | 11:cada08fc8a70 | 2628 | { |
mbedAustin | 11:cada08fc8a70 | 2629 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) ); |
mbedAustin | 11:cada08fc8a70 | 2630 | return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); |
mbedAustin | 11:cada08fc8a70 | 2631 | } |
mbedAustin | 11:cada08fc8a70 | 2632 | |
mbedAustin | 11:cada08fc8a70 | 2633 | if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, |
mbedAustin | 11:cada08fc8a70 | 2634 | mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ), |
mbedAustin | 11:cada08fc8a70 | 2635 | MBEDTLS_ECDH_OURS ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2636 | { |
mbedAustin | 11:cada08fc8a70 | 2637 | MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 2638 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2639 | } |
mbedAustin | 11:cada08fc8a70 | 2640 | |
mbedAustin | 11:cada08fc8a70 | 2641 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 2642 | } |
mbedAustin | 11:cada08fc8a70 | 2643 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || |
mbedAustin | 11:cada08fc8a70 | 2644 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2645 | |
mbedAustin | 11:cada08fc8a70 | 2646 | static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 2647 | { |
mbedAustin | 11:cada08fc8a70 | 2648 | int ret; |
mbedAustin | 11:cada08fc8a70 | 2649 | size_t n = 0; |
mbedAustin | 11:cada08fc8a70 | 2650 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
mbedAustin | 11:cada08fc8a70 | 2651 | ssl->transform_negotiate->ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 2652 | |
mbedAustin | 11:cada08fc8a70 | 2653 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2654 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2655 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2656 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2657 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2658 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2659 | unsigned char *p = ssl->out_msg + 4; |
mbedAustin | 11:cada08fc8a70 | 2660 | unsigned char *dig_signed = p; |
mbedAustin | 11:cada08fc8a70 | 2661 | size_t dig_signed_len = 0, len; |
mbedAustin | 11:cada08fc8a70 | 2662 | ((void) dig_signed); |
mbedAustin | 11:cada08fc8a70 | 2663 | ((void) dig_signed_len); |
mbedAustin | 11:cada08fc8a70 | 2664 | ((void) len); |
mbedAustin | 11:cada08fc8a70 | 2665 | #endif |
mbedAustin | 11:cada08fc8a70 | 2666 | |
mbedAustin | 11:cada08fc8a70 | 2667 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 2668 | |
mbedAustin | 11:cada08fc8a70 | 2669 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2670 | defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2671 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2672 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA || |
mbedAustin | 11:cada08fc8a70 | 2673 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2674 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
mbedAustin | 11:cada08fc8a70 | 2675 | { |
mbedAustin | 11:cada08fc8a70 | 2676 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 2677 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 2678 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 2679 | } |
mbedAustin | 11:cada08fc8a70 | 2680 | #endif |
mbedAustin | 11:cada08fc8a70 | 2681 | |
mbedAustin | 11:cada08fc8a70 | 2682 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2683 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2684 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || |
mbedAustin | 11:cada08fc8a70 | 2685 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) |
mbedAustin | 11:cada08fc8a70 | 2686 | { |
mbedAustin | 11:cada08fc8a70 | 2687 | ssl_get_ecdh_params_from_cert( ssl ); |
mbedAustin | 11:cada08fc8a70 | 2688 | |
mbedAustin | 11:cada08fc8a70 | 2689 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 2690 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 2691 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 2692 | } |
mbedAustin | 11:cada08fc8a70 | 2693 | #endif |
mbedAustin | 11:cada08fc8a70 | 2694 | |
mbedAustin | 11:cada08fc8a70 | 2695 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2696 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
mbedAustin | 11:cada08fc8a70 | 2697 | { |
mbedAustin | 11:cada08fc8a70 | 2698 | size_t jlen; |
mbedAustin | 11:cada08fc8a70 | 2699 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN; |
mbedAustin | 11:cada08fc8a70 | 2700 | |
mbedAustin | 11:cada08fc8a70 | 2701 | ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx, |
mbedAustin | 11:cada08fc8a70 | 2702 | p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng ); |
mbedAustin | 11:cada08fc8a70 | 2703 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2704 | { |
mbedAustin | 11:cada08fc8a70 | 2705 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret ); |
mbedAustin | 11:cada08fc8a70 | 2706 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2707 | } |
mbedAustin | 11:cada08fc8a70 | 2708 | |
mbedAustin | 11:cada08fc8a70 | 2709 | p += jlen; |
mbedAustin | 11:cada08fc8a70 | 2710 | n += jlen; |
mbedAustin | 11:cada08fc8a70 | 2711 | } |
mbedAustin | 11:cada08fc8a70 | 2712 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2713 | |
mbedAustin | 11:cada08fc8a70 | 2714 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2715 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2716 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 2717 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
mbedAustin | 11:cada08fc8a70 | 2718 | { |
mbedAustin | 11:cada08fc8a70 | 2719 | /* TODO: Support identity hints */ |
mbedAustin | 11:cada08fc8a70 | 2720 | *(p++) = 0x00; |
mbedAustin | 11:cada08fc8a70 | 2721 | *(p++) = 0x00; |
mbedAustin | 11:cada08fc8a70 | 2722 | |
mbedAustin | 11:cada08fc8a70 | 2723 | n += 2; |
mbedAustin | 11:cada08fc8a70 | 2724 | } |
mbedAustin | 11:cada08fc8a70 | 2725 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 2726 | MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2727 | |
mbedAustin | 11:cada08fc8a70 | 2728 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2729 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2730 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA || |
mbedAustin | 11:cada08fc8a70 | 2731 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) |
mbedAustin | 11:cada08fc8a70 | 2732 | { |
mbedAustin | 11:cada08fc8a70 | 2733 | if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL ) |
mbedAustin | 11:cada08fc8a70 | 2734 | { |
mbedAustin | 11:cada08fc8a70 | 2735 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) ); |
mbedAustin | 11:cada08fc8a70 | 2736 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 2737 | } |
mbedAustin | 11:cada08fc8a70 | 2738 | |
mbedAustin | 11:cada08fc8a70 | 2739 | /* |
mbedAustin | 11:cada08fc8a70 | 2740 | * Ephemeral DH parameters: |
mbedAustin | 11:cada08fc8a70 | 2741 | * |
mbedAustin | 11:cada08fc8a70 | 2742 | * struct { |
mbedAustin | 11:cada08fc8a70 | 2743 | * opaque dh_p<1..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 2744 | * opaque dh_g<1..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 2745 | * opaque dh_Ys<1..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 2746 | * } ServerDHParams; |
mbedAustin | 11:cada08fc8a70 | 2747 | */ |
mbedAustin | 11:cada08fc8a70 | 2748 | if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 || |
mbedAustin | 11:cada08fc8a70 | 2749 | ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2750 | { |
mbedAustin | 11:cada08fc8a70 | 2751 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret ); |
mbedAustin | 11:cada08fc8a70 | 2752 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2753 | } |
mbedAustin | 11:cada08fc8a70 | 2754 | |
mbedAustin | 11:cada08fc8a70 | 2755 | if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx, |
mbedAustin | 11:cada08fc8a70 | 2756 | (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ), |
mbedAustin | 11:cada08fc8a70 | 2757 | p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2758 | { |
mbedAustin | 11:cada08fc8a70 | 2759 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret ); |
mbedAustin | 11:cada08fc8a70 | 2760 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2761 | } |
mbedAustin | 11:cada08fc8a70 | 2762 | |
mbedAustin | 11:cada08fc8a70 | 2763 | dig_signed = p; |
mbedAustin | 11:cada08fc8a70 | 2764 | dig_signed_len = len; |
mbedAustin | 11:cada08fc8a70 | 2765 | |
mbedAustin | 11:cada08fc8a70 | 2766 | p += len; |
mbedAustin | 11:cada08fc8a70 | 2767 | n += len; |
mbedAustin | 11:cada08fc8a70 | 2768 | |
mbedAustin | 11:cada08fc8a70 | 2769 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X ); |
mbedAustin | 11:cada08fc8a70 | 2770 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P ); |
mbedAustin | 11:cada08fc8a70 | 2771 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G ); |
mbedAustin | 11:cada08fc8a70 | 2772 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX ); |
mbedAustin | 11:cada08fc8a70 | 2773 | } |
mbedAustin | 11:cada08fc8a70 | 2774 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 2775 | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2776 | |
mbedAustin | 11:cada08fc8a70 | 2777 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2778 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
mbedAustin | 11:cada08fc8a70 | 2779 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || |
mbedAustin | 11:cada08fc8a70 | 2780 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
mbedAustin | 11:cada08fc8a70 | 2781 | { |
mbedAustin | 11:cada08fc8a70 | 2782 | /* |
mbedAustin | 11:cada08fc8a70 | 2783 | * Ephemeral ECDH parameters: |
mbedAustin | 11:cada08fc8a70 | 2784 | * |
mbedAustin | 11:cada08fc8a70 | 2785 | * struct { |
mbedAustin | 11:cada08fc8a70 | 2786 | * ECParameters curve_params; |
mbedAustin | 11:cada08fc8a70 | 2787 | * ECPoint public; |
mbedAustin | 11:cada08fc8a70 | 2788 | * } ServerECDHParams; |
mbedAustin | 11:cada08fc8a70 | 2789 | */ |
mbedAustin | 11:cada08fc8a70 | 2790 | const mbedtls_ecp_curve_info **curve = NULL; |
mbedAustin | 11:cada08fc8a70 | 2791 | const mbedtls_ecp_group_id *gid; |
mbedAustin | 11:cada08fc8a70 | 2792 | |
mbedAustin | 11:cada08fc8a70 | 2793 | /* Match our preference list against the offered curves */ |
mbedAustin | 11:cada08fc8a70 | 2794 | for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ ) |
mbedAustin | 11:cada08fc8a70 | 2795 | for( curve = ssl->handshake->curves; *curve != NULL; curve++ ) |
mbedAustin | 11:cada08fc8a70 | 2796 | if( (*curve)->grp_id == *gid ) |
mbedAustin | 11:cada08fc8a70 | 2797 | goto curve_matching_done; |
mbedAustin | 11:cada08fc8a70 | 2798 | |
mbedAustin | 11:cada08fc8a70 | 2799 | curve_matching_done: |
mbedAustin | 11:cada08fc8a70 | 2800 | if( curve == NULL || *curve == NULL ) |
mbedAustin | 11:cada08fc8a70 | 2801 | { |
mbedAustin | 11:cada08fc8a70 | 2802 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) ); |
mbedAustin | 11:cada08fc8a70 | 2803 | return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN ); |
mbedAustin | 11:cada08fc8a70 | 2804 | } |
mbedAustin | 11:cada08fc8a70 | 2805 | |
mbedAustin | 11:cada08fc8a70 | 2806 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) ); |
mbedAustin | 11:cada08fc8a70 | 2807 | |
mbedAustin | 11:cada08fc8a70 | 2808 | if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp, |
mbedAustin | 11:cada08fc8a70 | 2809 | (*curve)->grp_id ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2810 | { |
mbedAustin | 11:cada08fc8a70 | 2811 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret ); |
mbedAustin | 11:cada08fc8a70 | 2812 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2813 | } |
mbedAustin | 11:cada08fc8a70 | 2814 | |
mbedAustin | 11:cada08fc8a70 | 2815 | if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len, |
mbedAustin | 11:cada08fc8a70 | 2816 | p, MBEDTLS_SSL_MAX_CONTENT_LEN - n, |
mbedAustin | 11:cada08fc8a70 | 2817 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2818 | { |
mbedAustin | 11:cada08fc8a70 | 2819 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret ); |
mbedAustin | 11:cada08fc8a70 | 2820 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2821 | } |
mbedAustin | 11:cada08fc8a70 | 2822 | |
mbedAustin | 11:cada08fc8a70 | 2823 | dig_signed = p; |
mbedAustin | 11:cada08fc8a70 | 2824 | dig_signed_len = len; |
mbedAustin | 11:cada08fc8a70 | 2825 | |
mbedAustin | 11:cada08fc8a70 | 2826 | p += len; |
mbedAustin | 11:cada08fc8a70 | 2827 | n += len; |
mbedAustin | 11:cada08fc8a70 | 2828 | |
mbedAustin | 11:cada08fc8a70 | 2829 | MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q ); |
mbedAustin | 11:cada08fc8a70 | 2830 | } |
mbedAustin | 11:cada08fc8a70 | 2831 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2832 | |
mbedAustin | 11:cada08fc8a70 | 2833 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2834 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 2835 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 2836 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA || |
mbedAustin | 11:cada08fc8a70 | 2837 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
mbedAustin | 11:cada08fc8a70 | 2838 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ) |
mbedAustin | 11:cada08fc8a70 | 2839 | { |
mbedAustin | 11:cada08fc8a70 | 2840 | size_t signature_len = 0; |
mbedAustin | 11:cada08fc8a70 | 2841 | unsigned int hashlen = 0; |
mbedAustin | 11:cada08fc8a70 | 2842 | unsigned char hash[64]; |
mbedAustin | 11:cada08fc8a70 | 2843 | mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE; |
mbedAustin | 11:cada08fc8a70 | 2844 | |
mbedAustin | 11:cada08fc8a70 | 2845 | /* |
mbedAustin | 11:cada08fc8a70 | 2846 | * Choose hash algorithm. NONE means MD5 + SHA1 here. |
mbedAustin | 11:cada08fc8a70 | 2847 | */ |
mbedAustin | 11:cada08fc8a70 | 2848 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 2849 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 2850 | { |
mbedAustin | 11:cada08fc8a70 | 2851 | md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg ); |
mbedAustin | 11:cada08fc8a70 | 2852 | |
mbedAustin | 11:cada08fc8a70 | 2853 | if( md_alg == MBEDTLS_MD_NONE ) |
mbedAustin | 11:cada08fc8a70 | 2854 | { |
mbedAustin | 11:cada08fc8a70 | 2855 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 2856 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 2857 | } |
mbedAustin | 11:cada08fc8a70 | 2858 | } |
mbedAustin | 11:cada08fc8a70 | 2859 | else |
mbedAustin | 11:cada08fc8a70 | 2860 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
mbedAustin | 11:cada08fc8a70 | 2861 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
mbedAustin | 11:cada08fc8a70 | 2862 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
mbedAustin | 11:cada08fc8a70 | 2863 | if( ciphersuite_info->key_exchange == |
mbedAustin | 11:cada08fc8a70 | 2864 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ) |
mbedAustin | 11:cada08fc8a70 | 2865 | { |
mbedAustin | 11:cada08fc8a70 | 2866 | md_alg = MBEDTLS_MD_SHA1; |
mbedAustin | 11:cada08fc8a70 | 2867 | } |
mbedAustin | 11:cada08fc8a70 | 2868 | else |
mbedAustin | 11:cada08fc8a70 | 2869 | #endif |
mbedAustin | 11:cada08fc8a70 | 2870 | { |
mbedAustin | 11:cada08fc8a70 | 2871 | md_alg = MBEDTLS_MD_NONE; |
mbedAustin | 11:cada08fc8a70 | 2872 | } |
mbedAustin | 11:cada08fc8a70 | 2873 | |
mbedAustin | 11:cada08fc8a70 | 2874 | /* |
mbedAustin | 11:cada08fc8a70 | 2875 | * Compute the hash to be signed |
mbedAustin | 11:cada08fc8a70 | 2876 | */ |
mbedAustin | 11:cada08fc8a70 | 2877 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
mbedAustin | 11:cada08fc8a70 | 2878 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
mbedAustin | 11:cada08fc8a70 | 2879 | if( md_alg == MBEDTLS_MD_NONE ) |
mbedAustin | 11:cada08fc8a70 | 2880 | { |
mbedAustin | 11:cada08fc8a70 | 2881 | mbedtls_md5_context mbedtls_md5; |
mbedAustin | 11:cada08fc8a70 | 2882 | mbedtls_sha1_context mbedtls_sha1; |
mbedAustin | 11:cada08fc8a70 | 2883 | |
mbedAustin | 11:cada08fc8a70 | 2884 | mbedtls_md5_init( &mbedtls_md5 ); |
mbedAustin | 11:cada08fc8a70 | 2885 | mbedtls_sha1_init( &mbedtls_sha1 ); |
mbedAustin | 11:cada08fc8a70 | 2886 | |
mbedAustin | 11:cada08fc8a70 | 2887 | /* |
mbedAustin | 11:cada08fc8a70 | 2888 | * digitally-signed struct { |
mbedAustin | 11:cada08fc8a70 | 2889 | * opaque md5_hash[16]; |
mbedAustin | 11:cada08fc8a70 | 2890 | * opaque sha_hash[20]; |
mbedAustin | 11:cada08fc8a70 | 2891 | * }; |
mbedAustin | 11:cada08fc8a70 | 2892 | * |
mbedAustin | 11:cada08fc8a70 | 2893 | * md5_hash |
mbedAustin | 11:cada08fc8a70 | 2894 | * MD5(ClientHello.random + ServerHello.random |
mbedAustin | 11:cada08fc8a70 | 2895 | * + ServerParams); |
mbedAustin | 11:cada08fc8a70 | 2896 | * sha_hash |
mbedAustin | 11:cada08fc8a70 | 2897 | * SHA(ClientHello.random + ServerHello.random |
mbedAustin | 11:cada08fc8a70 | 2898 | * + ServerParams); |
mbedAustin | 11:cada08fc8a70 | 2899 | */ |
mbedAustin | 11:cada08fc8a70 | 2900 | mbedtls_md5_starts( &mbedtls_md5 ); |
mbedAustin | 11:cada08fc8a70 | 2901 | mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 ); |
mbedAustin | 11:cada08fc8a70 | 2902 | mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len ); |
mbedAustin | 11:cada08fc8a70 | 2903 | mbedtls_md5_finish( &mbedtls_md5, hash ); |
mbedAustin | 11:cada08fc8a70 | 2904 | |
mbedAustin | 11:cada08fc8a70 | 2905 | mbedtls_sha1_starts( &mbedtls_sha1 ); |
mbedAustin | 11:cada08fc8a70 | 2906 | mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 ); |
mbedAustin | 11:cada08fc8a70 | 2907 | mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len ); |
mbedAustin | 11:cada08fc8a70 | 2908 | mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 ); |
mbedAustin | 11:cada08fc8a70 | 2909 | |
mbedAustin | 11:cada08fc8a70 | 2910 | hashlen = 36; |
mbedAustin | 11:cada08fc8a70 | 2911 | |
mbedAustin | 11:cada08fc8a70 | 2912 | mbedtls_md5_free( &mbedtls_md5 ); |
mbedAustin | 11:cada08fc8a70 | 2913 | mbedtls_sha1_free( &mbedtls_sha1 ); |
mbedAustin | 11:cada08fc8a70 | 2914 | } |
mbedAustin | 11:cada08fc8a70 | 2915 | else |
mbedAustin | 11:cada08fc8a70 | 2916 | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ |
mbedAustin | 11:cada08fc8a70 | 2917 | MBEDTLS_SSL_PROTO_TLS1_1 */ |
mbedAustin | 11:cada08fc8a70 | 2918 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
mbedAustin | 11:cada08fc8a70 | 2919 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 2920 | if( md_alg != MBEDTLS_MD_NONE ) |
mbedAustin | 11:cada08fc8a70 | 2921 | { |
mbedAustin | 11:cada08fc8a70 | 2922 | mbedtls_md_context_t ctx; |
mbedAustin | 11:cada08fc8a70 | 2923 | const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg ); |
mbedAustin | 11:cada08fc8a70 | 2924 | |
mbedAustin | 11:cada08fc8a70 | 2925 | mbedtls_md_init( &ctx ); |
mbedAustin | 11:cada08fc8a70 | 2926 | |
mbedAustin | 11:cada08fc8a70 | 2927 | /* Info from md_alg will be used instead */ |
mbedAustin | 11:cada08fc8a70 | 2928 | hashlen = 0; |
mbedAustin | 11:cada08fc8a70 | 2929 | |
mbedAustin | 11:cada08fc8a70 | 2930 | /* |
mbedAustin | 11:cada08fc8a70 | 2931 | * digitally-signed struct { |
mbedAustin | 11:cada08fc8a70 | 2932 | * opaque client_random[32]; |
mbedAustin | 11:cada08fc8a70 | 2933 | * opaque server_random[32]; |
mbedAustin | 11:cada08fc8a70 | 2934 | * ServerDHParams params; |
mbedAustin | 11:cada08fc8a70 | 2935 | * }; |
mbedAustin | 11:cada08fc8a70 | 2936 | */ |
mbedAustin | 11:cada08fc8a70 | 2937 | if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2938 | { |
mbedAustin | 11:cada08fc8a70 | 2939 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret ); |
mbedAustin | 11:cada08fc8a70 | 2940 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2941 | } |
mbedAustin | 11:cada08fc8a70 | 2942 | |
mbedAustin | 11:cada08fc8a70 | 2943 | mbedtls_md_starts( &ctx ); |
mbedAustin | 11:cada08fc8a70 | 2944 | mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 ); |
mbedAustin | 11:cada08fc8a70 | 2945 | mbedtls_md_update( &ctx, dig_signed, dig_signed_len ); |
mbedAustin | 11:cada08fc8a70 | 2946 | mbedtls_md_finish( &ctx, hash ); |
mbedAustin | 11:cada08fc8a70 | 2947 | mbedtls_md_free( &ctx ); |
mbedAustin | 11:cada08fc8a70 | 2948 | } |
mbedAustin | 11:cada08fc8a70 | 2949 | else |
mbedAustin | 11:cada08fc8a70 | 2950 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ |
mbedAustin | 11:cada08fc8a70 | 2951 | MBEDTLS_SSL_PROTO_TLS1_2 */ |
mbedAustin | 11:cada08fc8a70 | 2952 | { |
mbedAustin | 11:cada08fc8a70 | 2953 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 2954 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 2955 | } |
mbedAustin | 11:cada08fc8a70 | 2956 | |
mbedAustin | 11:cada08fc8a70 | 2957 | MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen : |
mbedAustin | 11:cada08fc8a70 | 2958 | (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) ); |
mbedAustin | 11:cada08fc8a70 | 2959 | |
mbedAustin | 11:cada08fc8a70 | 2960 | /* |
mbedAustin | 11:cada08fc8a70 | 2961 | * Make the signature |
mbedAustin | 11:cada08fc8a70 | 2962 | */ |
mbedAustin | 11:cada08fc8a70 | 2963 | if( mbedtls_ssl_own_key( ssl ) == NULL ) |
mbedAustin | 11:cada08fc8a70 | 2964 | { |
mbedAustin | 11:cada08fc8a70 | 2965 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) ); |
mbedAustin | 11:cada08fc8a70 | 2966 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
mbedAustin | 11:cada08fc8a70 | 2967 | } |
mbedAustin | 11:cada08fc8a70 | 2968 | |
mbedAustin | 11:cada08fc8a70 | 2969 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 2970 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 2971 | { |
mbedAustin | 11:cada08fc8a70 | 2972 | *(p++) = ssl->handshake->sig_alg; |
mbedAustin | 11:cada08fc8a70 | 2973 | *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) ); |
mbedAustin | 11:cada08fc8a70 | 2974 | |
mbedAustin | 11:cada08fc8a70 | 2975 | n += 2; |
mbedAustin | 11:cada08fc8a70 | 2976 | } |
mbedAustin | 11:cada08fc8a70 | 2977 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
mbedAustin | 11:cada08fc8a70 | 2978 | |
mbedAustin | 11:cada08fc8a70 | 2979 | if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen, |
mbedAustin | 11:cada08fc8a70 | 2980 | p + 2 , &signature_len, |
mbedAustin | 11:cada08fc8a70 | 2981 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 2982 | { |
mbedAustin | 11:cada08fc8a70 | 2983 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret ); |
mbedAustin | 11:cada08fc8a70 | 2984 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 2985 | } |
mbedAustin | 11:cada08fc8a70 | 2986 | |
mbedAustin | 11:cada08fc8a70 | 2987 | *(p++) = (unsigned char)( signature_len >> 8 ); |
mbedAustin | 11:cada08fc8a70 | 2988 | *(p++) = (unsigned char)( signature_len ); |
mbedAustin | 11:cada08fc8a70 | 2989 | n += 2; |
mbedAustin | 11:cada08fc8a70 | 2990 | |
mbedAustin | 11:cada08fc8a70 | 2991 | MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len ); |
mbedAustin | 11:cada08fc8a70 | 2992 | |
mbedAustin | 11:cada08fc8a70 | 2993 | n += signature_len; |
mbedAustin | 11:cada08fc8a70 | 2994 | } |
mbedAustin | 11:cada08fc8a70 | 2995 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || |
mbedAustin | 11:cada08fc8a70 | 2996 | MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 2997 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 2998 | |
mbedAustin | 11:cada08fc8a70 | 2999 | ssl->out_msglen = 4 + n; |
mbedAustin | 11:cada08fc8a70 | 3000 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
mbedAustin | 11:cada08fc8a70 | 3001 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE; |
mbedAustin | 11:cada08fc8a70 | 3002 | |
mbedAustin | 11:cada08fc8a70 | 3003 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 3004 | |
mbedAustin | 11:cada08fc8a70 | 3005 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3006 | { |
mbedAustin | 11:cada08fc8a70 | 3007 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
mbedAustin | 11:cada08fc8a70 | 3008 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3009 | } |
mbedAustin | 11:cada08fc8a70 | 3010 | |
mbedAustin | 11:cada08fc8a70 | 3011 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 3012 | |
mbedAustin | 11:cada08fc8a70 | 3013 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3014 | } |
mbedAustin | 11:cada08fc8a70 | 3015 | |
mbedAustin | 11:cada08fc8a70 | 3016 | static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 3017 | { |
mbedAustin | 11:cada08fc8a70 | 3018 | int ret; |
mbedAustin | 11:cada08fc8a70 | 3019 | |
mbedAustin | 11:cada08fc8a70 | 3020 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) ); |
mbedAustin | 11:cada08fc8a70 | 3021 | |
mbedAustin | 11:cada08fc8a70 | 3022 | ssl->out_msglen = 4; |
mbedAustin | 11:cada08fc8a70 | 3023 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
mbedAustin | 11:cada08fc8a70 | 3024 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE; |
mbedAustin | 11:cada08fc8a70 | 3025 | |
mbedAustin | 11:cada08fc8a70 | 3026 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 3027 | |
mbedAustin | 11:cada08fc8a70 | 3028 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 3029 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM ) |
mbedAustin | 11:cada08fc8a70 | 3030 | mbedtls_ssl_send_flight_completed( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3031 | #endif |
mbedAustin | 11:cada08fc8a70 | 3032 | |
mbedAustin | 11:cada08fc8a70 | 3033 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3034 | { |
mbedAustin | 11:cada08fc8a70 | 3035 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
mbedAustin | 11:cada08fc8a70 | 3036 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3037 | } |
mbedAustin | 11:cada08fc8a70 | 3038 | |
mbedAustin | 11:cada08fc8a70 | 3039 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) ); |
mbedAustin | 11:cada08fc8a70 | 3040 | |
mbedAustin | 11:cada08fc8a70 | 3041 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3042 | } |
mbedAustin | 11:cada08fc8a70 | 3043 | |
mbedAustin | 11:cada08fc8a70 | 3044 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 3045 | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3046 | static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 3047 | const unsigned char *end ) |
mbedAustin | 11:cada08fc8a70 | 3048 | { |
mbedAustin | 11:cada08fc8a70 | 3049 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
mbedAustin | 11:cada08fc8a70 | 3050 | size_t n; |
mbedAustin | 11:cada08fc8a70 | 3051 | |
mbedAustin | 11:cada08fc8a70 | 3052 | /* |
mbedAustin | 11:cada08fc8a70 | 3053 | * Receive G^Y mod P, premaster = (G^Y)^X mod P |
mbedAustin | 11:cada08fc8a70 | 3054 | */ |
mbedAustin | 11:cada08fc8a70 | 3055 | if( *p + 2 > end ) |
mbedAustin | 11:cada08fc8a70 | 3056 | { |
mbedAustin | 11:cada08fc8a70 | 3057 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3058 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3059 | } |
mbedAustin | 11:cada08fc8a70 | 3060 | |
mbedAustin | 11:cada08fc8a70 | 3061 | n = ( (*p)[0] << 8 ) | (*p)[1]; |
mbedAustin | 11:cada08fc8a70 | 3062 | *p += 2; |
mbedAustin | 11:cada08fc8a70 | 3063 | |
mbedAustin | 11:cada08fc8a70 | 3064 | if( *p + n > end ) |
mbedAustin | 11:cada08fc8a70 | 3065 | { |
mbedAustin | 11:cada08fc8a70 | 3066 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3067 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3068 | } |
mbedAustin | 11:cada08fc8a70 | 3069 | |
mbedAustin | 11:cada08fc8a70 | 3070 | if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3071 | { |
mbedAustin | 11:cada08fc8a70 | 3072 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret ); |
mbedAustin | 11:cada08fc8a70 | 3073 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); |
mbedAustin | 11:cada08fc8a70 | 3074 | } |
mbedAustin | 11:cada08fc8a70 | 3075 | |
mbedAustin | 11:cada08fc8a70 | 3076 | *p += n; |
mbedAustin | 11:cada08fc8a70 | 3077 | |
mbedAustin | 11:cada08fc8a70 | 3078 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY ); |
mbedAustin | 11:cada08fc8a70 | 3079 | |
mbedAustin | 11:cada08fc8a70 | 3080 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3081 | } |
mbedAustin | 11:cada08fc8a70 | 3082 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 3083 | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3084 | |
mbedAustin | 11:cada08fc8a70 | 3085 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 3086 | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3087 | static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl, |
mbedAustin | 11:cada08fc8a70 | 3088 | const unsigned char *p, |
mbedAustin | 11:cada08fc8a70 | 3089 | const unsigned char *end, |
mbedAustin | 11:cada08fc8a70 | 3090 | size_t pms_offset ) |
mbedAustin | 11:cada08fc8a70 | 3091 | { |
mbedAustin | 11:cada08fc8a70 | 3092 | int ret; |
mbedAustin | 11:cada08fc8a70 | 3093 | size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) ); |
mbedAustin | 11:cada08fc8a70 | 3094 | unsigned char *pms = ssl->handshake->premaster + pms_offset; |
mbedAustin | 11:cada08fc8a70 | 3095 | unsigned char ver[2]; |
mbedAustin | 11:cada08fc8a70 | 3096 | unsigned char fake_pms[48], peer_pms[48]; |
mbedAustin | 11:cada08fc8a70 | 3097 | unsigned char mask; |
mbedAustin | 11:cada08fc8a70 | 3098 | size_t i, peer_pmslen; |
mbedAustin | 11:cada08fc8a70 | 3099 | unsigned int diff; |
mbedAustin | 11:cada08fc8a70 | 3100 | |
mbedAustin | 11:cada08fc8a70 | 3101 | if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) ) |
mbedAustin | 11:cada08fc8a70 | 3102 | { |
mbedAustin | 11:cada08fc8a70 | 3103 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) ); |
mbedAustin | 11:cada08fc8a70 | 3104 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
mbedAustin | 11:cada08fc8a70 | 3105 | } |
mbedAustin | 11:cada08fc8a70 | 3106 | |
mbedAustin | 11:cada08fc8a70 | 3107 | /* |
mbedAustin | 11:cada08fc8a70 | 3108 | * Decrypt the premaster using own private RSA key |
mbedAustin | 11:cada08fc8a70 | 3109 | */ |
mbedAustin | 11:cada08fc8a70 | 3110 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
mbedAustin | 11:cada08fc8a70 | 3111 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 3112 | if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 ) |
mbedAustin | 11:cada08fc8a70 | 3113 | { |
mbedAustin | 11:cada08fc8a70 | 3114 | if( *p++ != ( ( len >> 8 ) & 0xFF ) || |
mbedAustin | 11:cada08fc8a70 | 3115 | *p++ != ( ( len ) & 0xFF ) ) |
mbedAustin | 11:cada08fc8a70 | 3116 | { |
mbedAustin | 11:cada08fc8a70 | 3117 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3118 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3119 | } |
mbedAustin | 11:cada08fc8a70 | 3120 | } |
mbedAustin | 11:cada08fc8a70 | 3121 | #endif |
mbedAustin | 11:cada08fc8a70 | 3122 | |
mbedAustin | 11:cada08fc8a70 | 3123 | if( p + len != end ) |
mbedAustin | 11:cada08fc8a70 | 3124 | { |
mbedAustin | 11:cada08fc8a70 | 3125 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3126 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3127 | } |
mbedAustin | 11:cada08fc8a70 | 3128 | |
mbedAustin | 11:cada08fc8a70 | 3129 | mbedtls_ssl_write_version( ssl->handshake->max_major_ver, |
mbedAustin | 11:cada08fc8a70 | 3130 | ssl->handshake->max_minor_ver, |
mbedAustin | 11:cada08fc8a70 | 3131 | ssl->conf->transport, ver ); |
mbedAustin | 11:cada08fc8a70 | 3132 | |
mbedAustin | 11:cada08fc8a70 | 3133 | /* |
mbedAustin | 11:cada08fc8a70 | 3134 | * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding |
mbedAustin | 11:cada08fc8a70 | 3135 | * must not cause the connection to end immediately; instead, send a |
mbedAustin | 11:cada08fc8a70 | 3136 | * bad_record_mac later in the handshake. |
mbedAustin | 11:cada08fc8a70 | 3137 | * Also, avoid data-dependant branches here to protect against |
mbedAustin | 11:cada08fc8a70 | 3138 | * timing-based variants. |
mbedAustin | 11:cada08fc8a70 | 3139 | */ |
mbedAustin | 11:cada08fc8a70 | 3140 | ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) ); |
mbedAustin | 11:cada08fc8a70 | 3141 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3142 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3143 | |
mbedAustin | 11:cada08fc8a70 | 3144 | ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len, |
mbedAustin | 11:cada08fc8a70 | 3145 | peer_pms, &peer_pmslen, |
mbedAustin | 11:cada08fc8a70 | 3146 | sizeof( peer_pms ), |
mbedAustin | 11:cada08fc8a70 | 3147 | ssl->conf->f_rng, ssl->conf->p_rng ); |
mbedAustin | 11:cada08fc8a70 | 3148 | |
mbedAustin | 11:cada08fc8a70 | 3149 | diff = (unsigned int) ret; |
mbedAustin | 11:cada08fc8a70 | 3150 | diff |= peer_pmslen ^ 48; |
mbedAustin | 11:cada08fc8a70 | 3151 | diff |= peer_pms[0] ^ ver[0]; |
mbedAustin | 11:cada08fc8a70 | 3152 | diff |= peer_pms[1] ^ ver[1]; |
mbedAustin | 11:cada08fc8a70 | 3153 | |
mbedAustin | 11:cada08fc8a70 | 3154 | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
mbedAustin | 11:cada08fc8a70 | 3155 | if( diff != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3156 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3157 | #endif |
mbedAustin | 11:cada08fc8a70 | 3158 | |
mbedAustin | 11:cada08fc8a70 | 3159 | if( sizeof( ssl->handshake->premaster ) < pms_offset || |
mbedAustin | 11:cada08fc8a70 | 3160 | sizeof( ssl->handshake->premaster ) - pms_offset < 48 ) |
mbedAustin | 11:cada08fc8a70 | 3161 | { |
mbedAustin | 11:cada08fc8a70 | 3162 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 3163 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 3164 | } |
mbedAustin | 11:cada08fc8a70 | 3165 | ssl->handshake->pmslen = 48; |
mbedAustin | 11:cada08fc8a70 | 3166 | |
mbedAustin | 11:cada08fc8a70 | 3167 | /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */ |
mbedAustin | 11:cada08fc8a70 | 3168 | /* MSVC has a warning about unary minus on unsigned, but this is |
mbedAustin | 11:cada08fc8a70 | 3169 | * well-defined and precisely what we want to do here */ |
mbedAustin | 11:cada08fc8a70 | 3170 | #if defined(_MSC_VER) |
mbedAustin | 11:cada08fc8a70 | 3171 | #pragma warning( push ) |
mbedAustin | 11:cada08fc8a70 | 3172 | #pragma warning( disable : 4146 ) |
mbedAustin | 11:cada08fc8a70 | 3173 | #endif |
mbedAustin | 11:cada08fc8a70 | 3174 | mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) ); |
mbedAustin | 11:cada08fc8a70 | 3175 | #if defined(_MSC_VER) |
mbedAustin | 11:cada08fc8a70 | 3176 | #pragma warning( pop ) |
mbedAustin | 11:cada08fc8a70 | 3177 | #endif |
mbedAustin | 11:cada08fc8a70 | 3178 | |
mbedAustin | 11:cada08fc8a70 | 3179 | for( i = 0; i < ssl->handshake->pmslen; i++ ) |
mbedAustin | 11:cada08fc8a70 | 3180 | pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] ); |
mbedAustin | 11:cada08fc8a70 | 3181 | |
mbedAustin | 11:cada08fc8a70 | 3182 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3183 | } |
mbedAustin | 11:cada08fc8a70 | 3184 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 3185 | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3186 | |
mbedAustin | 11:cada08fc8a70 | 3187 | #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3188 | static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p, |
mbedAustin | 11:cada08fc8a70 | 3189 | const unsigned char *end ) |
mbedAustin | 11:cada08fc8a70 | 3190 | { |
mbedAustin | 11:cada08fc8a70 | 3191 | int ret = 0; |
mbedAustin | 11:cada08fc8a70 | 3192 | size_t n; |
mbedAustin | 11:cada08fc8a70 | 3193 | |
mbedAustin | 11:cada08fc8a70 | 3194 | if( ssl->conf->f_psk == NULL && |
mbedAustin | 11:cada08fc8a70 | 3195 | ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL || |
mbedAustin | 11:cada08fc8a70 | 3196 | ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) ) |
mbedAustin | 11:cada08fc8a70 | 3197 | { |
mbedAustin | 11:cada08fc8a70 | 3198 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) ); |
mbedAustin | 11:cada08fc8a70 | 3199 | return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED ); |
mbedAustin | 11:cada08fc8a70 | 3200 | } |
mbedAustin | 11:cada08fc8a70 | 3201 | |
mbedAustin | 11:cada08fc8a70 | 3202 | /* |
mbedAustin | 11:cada08fc8a70 | 3203 | * Receive client pre-shared key identity name |
mbedAustin | 11:cada08fc8a70 | 3204 | */ |
mbedAustin | 11:cada08fc8a70 | 3205 | if( *p + 2 > end ) |
mbedAustin | 11:cada08fc8a70 | 3206 | { |
mbedAustin | 11:cada08fc8a70 | 3207 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3208 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3209 | } |
mbedAustin | 11:cada08fc8a70 | 3210 | |
mbedAustin | 11:cada08fc8a70 | 3211 | n = ( (*p)[0] << 8 ) | (*p)[1]; |
mbedAustin | 11:cada08fc8a70 | 3212 | *p += 2; |
mbedAustin | 11:cada08fc8a70 | 3213 | |
mbedAustin | 11:cada08fc8a70 | 3214 | if( n < 1 || n > 65535 || *p + n > end ) |
mbedAustin | 11:cada08fc8a70 | 3215 | { |
mbedAustin | 11:cada08fc8a70 | 3216 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3217 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3218 | } |
mbedAustin | 11:cada08fc8a70 | 3219 | |
mbedAustin | 11:cada08fc8a70 | 3220 | if( ssl->conf->f_psk != NULL ) |
mbedAustin | 11:cada08fc8a70 | 3221 | { |
mbedAustin | 11:cada08fc8a70 | 3222 | if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3223 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
mbedAustin | 11:cada08fc8a70 | 3224 | } |
mbedAustin | 11:cada08fc8a70 | 3225 | else |
mbedAustin | 11:cada08fc8a70 | 3226 | { |
mbedAustin | 11:cada08fc8a70 | 3227 | /* Identity is not a big secret since clients send it in the clear, |
mbedAustin | 11:cada08fc8a70 | 3228 | * but treat it carefully anyway, just in case */ |
mbedAustin | 11:cada08fc8a70 | 3229 | if( n != ssl->conf->psk_identity_len || |
mbedAustin | 11:cada08fc8a70 | 3230 | mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3231 | { |
mbedAustin | 11:cada08fc8a70 | 3232 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
mbedAustin | 11:cada08fc8a70 | 3233 | } |
mbedAustin | 11:cada08fc8a70 | 3234 | } |
mbedAustin | 11:cada08fc8a70 | 3235 | |
mbedAustin | 11:cada08fc8a70 | 3236 | if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ) |
mbedAustin | 11:cada08fc8a70 | 3237 | { |
mbedAustin | 11:cada08fc8a70 | 3238 | MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n ); |
mbedAustin | 11:cada08fc8a70 | 3239 | if( ( ret = mbedtls_ssl_send_alert_message( ssl, |
mbedAustin | 11:cada08fc8a70 | 3240 | MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
mbedAustin | 11:cada08fc8a70 | 3241 | MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3242 | { |
mbedAustin | 11:cada08fc8a70 | 3243 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3244 | } |
mbedAustin | 11:cada08fc8a70 | 3245 | |
mbedAustin | 11:cada08fc8a70 | 3246 | return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY ); |
mbedAustin | 11:cada08fc8a70 | 3247 | } |
mbedAustin | 11:cada08fc8a70 | 3248 | |
mbedAustin | 11:cada08fc8a70 | 3249 | *p += n; |
mbedAustin | 11:cada08fc8a70 | 3250 | |
mbedAustin | 11:cada08fc8a70 | 3251 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3252 | } |
mbedAustin | 11:cada08fc8a70 | 3253 | #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3254 | |
mbedAustin | 11:cada08fc8a70 | 3255 | static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 3256 | { |
mbedAustin | 11:cada08fc8a70 | 3257 | int ret; |
mbedAustin | 11:cada08fc8a70 | 3258 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 3259 | unsigned char *p, *end; |
mbedAustin | 11:cada08fc8a70 | 3260 | |
mbedAustin | 11:cada08fc8a70 | 3261 | ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 3262 | |
mbedAustin | 11:cada08fc8a70 | 3263 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 3264 | |
mbedAustin | 11:cada08fc8a70 | 3265 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3266 | { |
mbedAustin | 11:cada08fc8a70 | 3267 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
mbedAustin | 11:cada08fc8a70 | 3268 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3269 | } |
mbedAustin | 11:cada08fc8a70 | 3270 | |
mbedAustin | 11:cada08fc8a70 | 3271 | p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3272 | end = ssl->in_msg + ssl->in_hslen; |
mbedAustin | 11:cada08fc8a70 | 3273 | |
mbedAustin | 11:cada08fc8a70 | 3274 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ) |
mbedAustin | 11:cada08fc8a70 | 3275 | { |
mbedAustin | 11:cada08fc8a70 | 3276 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3277 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3278 | } |
mbedAustin | 11:cada08fc8a70 | 3279 | |
mbedAustin | 11:cada08fc8a70 | 3280 | if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE ) |
mbedAustin | 11:cada08fc8a70 | 3281 | { |
mbedAustin | 11:cada08fc8a70 | 3282 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3283 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3284 | } |
mbedAustin | 11:cada08fc8a70 | 3285 | |
mbedAustin | 11:cada08fc8a70 | 3286 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3287 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ) |
mbedAustin | 11:cada08fc8a70 | 3288 | { |
mbedAustin | 11:cada08fc8a70 | 3289 | if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3290 | { |
mbedAustin | 11:cada08fc8a70 | 3291 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3292 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3293 | } |
mbedAustin | 11:cada08fc8a70 | 3294 | |
mbedAustin | 11:cada08fc8a70 | 3295 | if( p != end ) |
mbedAustin | 11:cada08fc8a70 | 3296 | { |
mbedAustin | 11:cada08fc8a70 | 3297 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 3298 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3299 | } |
mbedAustin | 11:cada08fc8a70 | 3300 | |
mbedAustin | 11:cada08fc8a70 | 3301 | if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx, |
mbedAustin | 11:cada08fc8a70 | 3302 | ssl->handshake->premaster, |
mbedAustin | 11:cada08fc8a70 | 3303 | MBEDTLS_PREMASTER_SIZE, |
mbedAustin | 11:cada08fc8a70 | 3304 | &ssl->handshake->pmslen, |
mbedAustin | 11:cada08fc8a70 | 3305 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3306 | { |
mbedAustin | 11:cada08fc8a70 | 3307 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret ); |
mbedAustin | 11:cada08fc8a70 | 3308 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS ); |
mbedAustin | 11:cada08fc8a70 | 3309 | } |
mbedAustin | 11:cada08fc8a70 | 3310 | |
mbedAustin | 11:cada08fc8a70 | 3311 | MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K ); |
mbedAustin | 11:cada08fc8a70 | 3312 | } |
mbedAustin | 11:cada08fc8a70 | 3313 | else |
mbedAustin | 11:cada08fc8a70 | 3314 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3315 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 3316 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 3317 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
mbedAustin | 11:cada08fc8a70 | 3318 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3319 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
mbedAustin | 11:cada08fc8a70 | 3320 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || |
mbedAustin | 11:cada08fc8a70 | 3321 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || |
mbedAustin | 11:cada08fc8a70 | 3322 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) |
mbedAustin | 11:cada08fc8a70 | 3323 | { |
mbedAustin | 11:cada08fc8a70 | 3324 | if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, |
mbedAustin | 11:cada08fc8a70 | 3325 | p, end - p) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3326 | { |
mbedAustin | 11:cada08fc8a70 | 3327 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); |
mbedAustin | 11:cada08fc8a70 | 3328 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); |
mbedAustin | 11:cada08fc8a70 | 3329 | } |
mbedAustin | 11:cada08fc8a70 | 3330 | |
mbedAustin | 11:cada08fc8a70 | 3331 | MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp ); |
mbedAustin | 11:cada08fc8a70 | 3332 | |
mbedAustin | 11:cada08fc8a70 | 3333 | if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx, |
mbedAustin | 11:cada08fc8a70 | 3334 | &ssl->handshake->pmslen, |
mbedAustin | 11:cada08fc8a70 | 3335 | ssl->handshake->premaster, |
mbedAustin | 11:cada08fc8a70 | 3336 | MBEDTLS_MPI_MAX_SIZE, |
mbedAustin | 11:cada08fc8a70 | 3337 | ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3338 | { |
mbedAustin | 11:cada08fc8a70 | 3339 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret ); |
mbedAustin | 11:cada08fc8a70 | 3340 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS ); |
mbedAustin | 11:cada08fc8a70 | 3341 | } |
mbedAustin | 11:cada08fc8a70 | 3342 | |
mbedAustin | 11:cada08fc8a70 | 3343 | MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z ); |
mbedAustin | 11:cada08fc8a70 | 3344 | } |
mbedAustin | 11:cada08fc8a70 | 3345 | else |
mbedAustin | 11:cada08fc8a70 | 3346 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 3347 | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 3348 | MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || |
mbedAustin | 11:cada08fc8a70 | 3349 | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3350 | #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3351 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ) |
mbedAustin | 11:cada08fc8a70 | 3352 | { |
mbedAustin | 11:cada08fc8a70 | 3353 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3354 | { |
mbedAustin | 11:cada08fc8a70 | 3355 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3356 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3357 | } |
mbedAustin | 11:cada08fc8a70 | 3358 | |
mbedAustin | 11:cada08fc8a70 | 3359 | if( p != end ) |
mbedAustin | 11:cada08fc8a70 | 3360 | { |
mbedAustin | 11:cada08fc8a70 | 3361 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 3362 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3363 | } |
mbedAustin | 11:cada08fc8a70 | 3364 | |
mbedAustin | 11:cada08fc8a70 | 3365 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
mbedAustin | 11:cada08fc8a70 | 3366 | ciphersuite_info->key_exchange ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3367 | { |
mbedAustin | 11:cada08fc8a70 | 3368 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
mbedAustin | 11:cada08fc8a70 | 3369 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3370 | } |
mbedAustin | 11:cada08fc8a70 | 3371 | } |
mbedAustin | 11:cada08fc8a70 | 3372 | else |
mbedAustin | 11:cada08fc8a70 | 3373 | #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3374 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3375 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) |
mbedAustin | 11:cada08fc8a70 | 3376 | { |
mbedAustin | 11:cada08fc8a70 | 3377 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3378 | { |
mbedAustin | 11:cada08fc8a70 | 3379 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3380 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3381 | } |
mbedAustin | 11:cada08fc8a70 | 3382 | |
mbedAustin | 11:cada08fc8a70 | 3383 | if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3384 | { |
mbedAustin | 11:cada08fc8a70 | 3385 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3386 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3387 | } |
mbedAustin | 11:cada08fc8a70 | 3388 | |
mbedAustin | 11:cada08fc8a70 | 3389 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
mbedAustin | 11:cada08fc8a70 | 3390 | ciphersuite_info->key_exchange ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3391 | { |
mbedAustin | 11:cada08fc8a70 | 3392 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
mbedAustin | 11:cada08fc8a70 | 3393 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3394 | } |
mbedAustin | 11:cada08fc8a70 | 3395 | } |
mbedAustin | 11:cada08fc8a70 | 3396 | else |
mbedAustin | 11:cada08fc8a70 | 3397 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3398 | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3399 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ) |
mbedAustin | 11:cada08fc8a70 | 3400 | { |
mbedAustin | 11:cada08fc8a70 | 3401 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3402 | { |
mbedAustin | 11:cada08fc8a70 | 3403 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3404 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3405 | } |
mbedAustin | 11:cada08fc8a70 | 3406 | if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3407 | { |
mbedAustin | 11:cada08fc8a70 | 3408 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3409 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3410 | } |
mbedAustin | 11:cada08fc8a70 | 3411 | |
mbedAustin | 11:cada08fc8a70 | 3412 | if( p != end ) |
mbedAustin | 11:cada08fc8a70 | 3413 | { |
mbedAustin | 11:cada08fc8a70 | 3414 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 3415 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3416 | } |
mbedAustin | 11:cada08fc8a70 | 3417 | |
mbedAustin | 11:cada08fc8a70 | 3418 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
mbedAustin | 11:cada08fc8a70 | 3419 | ciphersuite_info->key_exchange ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3420 | { |
mbedAustin | 11:cada08fc8a70 | 3421 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
mbedAustin | 11:cada08fc8a70 | 3422 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3423 | } |
mbedAustin | 11:cada08fc8a70 | 3424 | } |
mbedAustin | 11:cada08fc8a70 | 3425 | else |
mbedAustin | 11:cada08fc8a70 | 3426 | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3427 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3428 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ) |
mbedAustin | 11:cada08fc8a70 | 3429 | { |
mbedAustin | 11:cada08fc8a70 | 3430 | if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3431 | { |
mbedAustin | 11:cada08fc8a70 | 3432 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3433 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3434 | } |
mbedAustin | 11:cada08fc8a70 | 3435 | |
mbedAustin | 11:cada08fc8a70 | 3436 | if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, |
mbedAustin | 11:cada08fc8a70 | 3437 | p, end - p ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3438 | { |
mbedAustin | 11:cada08fc8a70 | 3439 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); |
mbedAustin | 11:cada08fc8a70 | 3440 | return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); |
mbedAustin | 11:cada08fc8a70 | 3441 | } |
mbedAustin | 11:cada08fc8a70 | 3442 | |
mbedAustin | 11:cada08fc8a70 | 3443 | MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp ); |
mbedAustin | 11:cada08fc8a70 | 3444 | |
mbedAustin | 11:cada08fc8a70 | 3445 | if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, |
mbedAustin | 11:cada08fc8a70 | 3446 | ciphersuite_info->key_exchange ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3447 | { |
mbedAustin | 11:cada08fc8a70 | 3448 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); |
mbedAustin | 11:cada08fc8a70 | 3449 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3450 | } |
mbedAustin | 11:cada08fc8a70 | 3451 | } |
mbedAustin | 11:cada08fc8a70 | 3452 | else |
mbedAustin | 11:cada08fc8a70 | 3453 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3454 | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3455 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) |
mbedAustin | 11:cada08fc8a70 | 3456 | { |
mbedAustin | 11:cada08fc8a70 | 3457 | if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3458 | { |
mbedAustin | 11:cada08fc8a70 | 3459 | MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret ); |
mbedAustin | 11:cada08fc8a70 | 3460 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3461 | } |
mbedAustin | 11:cada08fc8a70 | 3462 | } |
mbedAustin | 11:cada08fc8a70 | 3463 | else |
mbedAustin | 11:cada08fc8a70 | 3464 | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3465 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3466 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
mbedAustin | 11:cada08fc8a70 | 3467 | { |
mbedAustin | 11:cada08fc8a70 | 3468 | ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx, |
mbedAustin | 11:cada08fc8a70 | 3469 | p, end - p ); |
mbedAustin | 11:cada08fc8a70 | 3470 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3471 | { |
mbedAustin | 11:cada08fc8a70 | 3472 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret ); |
mbedAustin | 11:cada08fc8a70 | 3473 | return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE ); |
mbedAustin | 11:cada08fc8a70 | 3474 | } |
mbedAustin | 11:cada08fc8a70 | 3475 | |
mbedAustin | 11:cada08fc8a70 | 3476 | ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx, |
mbedAustin | 11:cada08fc8a70 | 3477 | ssl->handshake->premaster, 32, &ssl->handshake->pmslen, |
mbedAustin | 11:cada08fc8a70 | 3478 | ssl->conf->f_rng, ssl->conf->p_rng ); |
mbedAustin | 11:cada08fc8a70 | 3479 | if( ret != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3480 | { |
mbedAustin | 11:cada08fc8a70 | 3481 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret ); |
mbedAustin | 11:cada08fc8a70 | 3482 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3483 | } |
mbedAustin | 11:cada08fc8a70 | 3484 | } |
mbedAustin | 11:cada08fc8a70 | 3485 | else |
mbedAustin | 11:cada08fc8a70 | 3486 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3487 | { |
mbedAustin | 11:cada08fc8a70 | 3488 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 3489 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 3490 | } |
mbedAustin | 11:cada08fc8a70 | 3491 | |
mbedAustin | 11:cada08fc8a70 | 3492 | if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3493 | { |
mbedAustin | 11:cada08fc8a70 | 3494 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret ); |
mbedAustin | 11:cada08fc8a70 | 3495 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3496 | } |
mbedAustin | 11:cada08fc8a70 | 3497 | |
mbedAustin | 11:cada08fc8a70 | 3498 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 3499 | |
mbedAustin | 11:cada08fc8a70 | 3500 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) ); |
mbedAustin | 11:cada08fc8a70 | 3501 | |
mbedAustin | 11:cada08fc8a70 | 3502 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3503 | } |
mbedAustin | 11:cada08fc8a70 | 3504 | |
mbedAustin | 11:cada08fc8a70 | 3505 | #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \ |
mbedAustin | 11:cada08fc8a70 | 3506 | !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \ |
mbedAustin | 11:cada08fc8a70 | 3507 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ |
mbedAustin | 11:cada08fc8a70 | 3508 | !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) |
mbedAustin | 11:cada08fc8a70 | 3509 | static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 3510 | { |
mbedAustin | 11:cada08fc8a70 | 3511 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 3512 | |
mbedAustin | 11:cada08fc8a70 | 3513 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) ); |
mbedAustin | 11:cada08fc8a70 | 3514 | |
mbedAustin | 11:cada08fc8a70 | 3515 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
mbedAustin | 11:cada08fc8a70 | 3516 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
mbedAustin | 11:cada08fc8a70 | 3517 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 3518 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 3519 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ) |
mbedAustin | 11:cada08fc8a70 | 3520 | { |
mbedAustin | 11:cada08fc8a70 | 3521 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
mbedAustin | 11:cada08fc8a70 | 3522 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 3523 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3524 | } |
mbedAustin | 11:cada08fc8a70 | 3525 | |
mbedAustin | 11:cada08fc8a70 | 3526 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 3527 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 3528 | } |
mbedAustin | 11:cada08fc8a70 | 3529 | #else |
mbedAustin | 11:cada08fc8a70 | 3530 | static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 3531 | { |
mbedAustin | 11:cada08fc8a70 | 3532 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
mbedAustin | 11:cada08fc8a70 | 3533 | size_t i, sig_len; |
mbedAustin | 11:cada08fc8a70 | 3534 | unsigned char hash[48]; |
mbedAustin | 11:cada08fc8a70 | 3535 | unsigned char *hash_start = hash; |
mbedAustin | 11:cada08fc8a70 | 3536 | size_t hashlen; |
mbedAustin | 11:cada08fc8a70 | 3537 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 3538 | mbedtls_pk_type_t pk_alg; |
mbedAustin | 11:cada08fc8a70 | 3539 | #endif |
mbedAustin | 11:cada08fc8a70 | 3540 | mbedtls_md_type_t md_alg; |
mbedAustin | 11:cada08fc8a70 | 3541 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info; |
mbedAustin | 11:cada08fc8a70 | 3542 | |
mbedAustin | 11:cada08fc8a70 | 3543 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) ); |
mbedAustin | 11:cada08fc8a70 | 3544 | |
mbedAustin | 11:cada08fc8a70 | 3545 | if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK || |
mbedAustin | 11:cada08fc8a70 | 3546 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
mbedAustin | 11:cada08fc8a70 | 3547 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 3548 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
mbedAustin | 11:cada08fc8a70 | 3549 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE || |
mbedAustin | 11:cada08fc8a70 | 3550 | ssl->session_negotiate->peer_cert == NULL ) |
mbedAustin | 11:cada08fc8a70 | 3551 | { |
mbedAustin | 11:cada08fc8a70 | 3552 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) ); |
mbedAustin | 11:cada08fc8a70 | 3553 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 3554 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3555 | } |
mbedAustin | 11:cada08fc8a70 | 3556 | |
mbedAustin | 11:cada08fc8a70 | 3557 | /* Needs to be done before read_record() to exclude current message */ |
mbedAustin | 11:cada08fc8a70 | 3558 | ssl->handshake->calc_verify( ssl, hash ); |
mbedAustin | 11:cada08fc8a70 | 3559 | |
mbedAustin | 11:cada08fc8a70 | 3560 | if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3561 | { |
mbedAustin | 11:cada08fc8a70 | 3562 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret ); |
mbedAustin | 11:cada08fc8a70 | 3563 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3564 | } |
mbedAustin | 11:cada08fc8a70 | 3565 | |
mbedAustin | 11:cada08fc8a70 | 3566 | ssl->state++; |
mbedAustin | 11:cada08fc8a70 | 3567 | |
mbedAustin | 11:cada08fc8a70 | 3568 | if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || |
mbedAustin | 11:cada08fc8a70 | 3569 | ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY ) |
mbedAustin | 11:cada08fc8a70 | 3570 | { |
mbedAustin | 11:cada08fc8a70 | 3571 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3572 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3573 | } |
mbedAustin | 11:cada08fc8a70 | 3574 | |
mbedAustin | 11:cada08fc8a70 | 3575 | i = mbedtls_ssl_hs_hdr_len( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3576 | |
mbedAustin | 11:cada08fc8a70 | 3577 | /* |
mbedAustin | 11:cada08fc8a70 | 3578 | * struct { |
mbedAustin | 11:cada08fc8a70 | 3579 | * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only |
mbedAustin | 11:cada08fc8a70 | 3580 | * opaque signature<0..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 3581 | * } DigitallySigned; |
mbedAustin | 11:cada08fc8a70 | 3582 | */ |
mbedAustin | 11:cada08fc8a70 | 3583 | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
mbedAustin | 11:cada08fc8a70 | 3584 | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
mbedAustin | 11:cada08fc8a70 | 3585 | if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 3586 | { |
mbedAustin | 11:cada08fc8a70 | 3587 | md_alg = MBEDTLS_MD_NONE; |
mbedAustin | 11:cada08fc8a70 | 3588 | hashlen = 36; |
mbedAustin | 11:cada08fc8a70 | 3589 | |
mbedAustin | 11:cada08fc8a70 | 3590 | /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */ |
mbedAustin | 11:cada08fc8a70 | 3591 | if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, |
mbedAustin | 11:cada08fc8a70 | 3592 | MBEDTLS_PK_ECDSA ) ) |
mbedAustin | 11:cada08fc8a70 | 3593 | { |
mbedAustin | 11:cada08fc8a70 | 3594 | hash_start += 16; |
mbedAustin | 11:cada08fc8a70 | 3595 | hashlen -= 16; |
mbedAustin | 11:cada08fc8a70 | 3596 | md_alg = MBEDTLS_MD_SHA1; |
mbedAustin | 11:cada08fc8a70 | 3597 | } |
mbedAustin | 11:cada08fc8a70 | 3598 | } |
mbedAustin | 11:cada08fc8a70 | 3599 | else |
mbedAustin | 11:cada08fc8a70 | 3600 | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || |
mbedAustin | 11:cada08fc8a70 | 3601 | MBEDTLS_SSL_PROTO_TLS1_1 */ |
mbedAustin | 11:cada08fc8a70 | 3602 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
mbedAustin | 11:cada08fc8a70 | 3603 | if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 ) |
mbedAustin | 11:cada08fc8a70 | 3604 | { |
mbedAustin | 11:cada08fc8a70 | 3605 | if( i + 2 > ssl->in_hslen ) |
mbedAustin | 11:cada08fc8a70 | 3606 | { |
mbedAustin | 11:cada08fc8a70 | 3607 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3608 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3609 | } |
mbedAustin | 11:cada08fc8a70 | 3610 | |
mbedAustin | 11:cada08fc8a70 | 3611 | /* |
mbedAustin | 11:cada08fc8a70 | 3612 | * Hash |
mbedAustin | 11:cada08fc8a70 | 3613 | */ |
mbedAustin | 11:cada08fc8a70 | 3614 | if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg ) |
mbedAustin | 11:cada08fc8a70 | 3615 | { |
mbedAustin | 11:cada08fc8a70 | 3616 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg" |
mbedAustin | 11:cada08fc8a70 | 3617 | " for verify message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3618 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3619 | } |
mbedAustin | 11:cada08fc8a70 | 3620 | |
mbedAustin | 11:cada08fc8a70 | 3621 | md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg ); |
mbedAustin | 11:cada08fc8a70 | 3622 | |
mbedAustin | 11:cada08fc8a70 | 3623 | /* Info from md_alg will be used instead */ |
mbedAustin | 11:cada08fc8a70 | 3624 | hashlen = 0; |
mbedAustin | 11:cada08fc8a70 | 3625 | |
mbedAustin | 11:cada08fc8a70 | 3626 | i++; |
mbedAustin | 11:cada08fc8a70 | 3627 | |
mbedAustin | 11:cada08fc8a70 | 3628 | /* |
mbedAustin | 11:cada08fc8a70 | 3629 | * Signature |
mbedAustin | 11:cada08fc8a70 | 3630 | */ |
mbedAustin | 11:cada08fc8a70 | 3631 | if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) ) |
mbedAustin | 11:cada08fc8a70 | 3632 | == MBEDTLS_PK_NONE ) |
mbedAustin | 11:cada08fc8a70 | 3633 | { |
mbedAustin | 11:cada08fc8a70 | 3634 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg" |
mbedAustin | 11:cada08fc8a70 | 3635 | " for verify message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3636 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3637 | } |
mbedAustin | 11:cada08fc8a70 | 3638 | |
mbedAustin | 11:cada08fc8a70 | 3639 | /* |
mbedAustin | 11:cada08fc8a70 | 3640 | * Check the certificate's key type matches the signature alg |
mbedAustin | 11:cada08fc8a70 | 3641 | */ |
mbedAustin | 11:cada08fc8a70 | 3642 | if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) ) |
mbedAustin | 11:cada08fc8a70 | 3643 | { |
mbedAustin | 11:cada08fc8a70 | 3644 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) ); |
mbedAustin | 11:cada08fc8a70 | 3645 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3646 | } |
mbedAustin | 11:cada08fc8a70 | 3647 | |
mbedAustin | 11:cada08fc8a70 | 3648 | i++; |
mbedAustin | 11:cada08fc8a70 | 3649 | } |
mbedAustin | 11:cada08fc8a70 | 3650 | else |
mbedAustin | 11:cada08fc8a70 | 3651 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
mbedAustin | 11:cada08fc8a70 | 3652 | { |
mbedAustin | 11:cada08fc8a70 | 3653 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); |
mbedAustin | 11:cada08fc8a70 | 3654 | return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); |
mbedAustin | 11:cada08fc8a70 | 3655 | } |
mbedAustin | 11:cada08fc8a70 | 3656 | |
mbedAustin | 11:cada08fc8a70 | 3657 | if( i + 2 > ssl->in_hslen ) |
mbedAustin | 11:cada08fc8a70 | 3658 | { |
mbedAustin | 11:cada08fc8a70 | 3659 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3660 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3661 | } |
mbedAustin | 11:cada08fc8a70 | 3662 | |
mbedAustin | 11:cada08fc8a70 | 3663 | sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1]; |
mbedAustin | 11:cada08fc8a70 | 3664 | i += 2; |
mbedAustin | 11:cada08fc8a70 | 3665 | |
mbedAustin | 11:cada08fc8a70 | 3666 | if( i + sig_len != ssl->in_hslen ) |
mbedAustin | 11:cada08fc8a70 | 3667 | { |
mbedAustin | 11:cada08fc8a70 | 3668 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) ); |
mbedAustin | 11:cada08fc8a70 | 3669 | return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY ); |
mbedAustin | 11:cada08fc8a70 | 3670 | } |
mbedAustin | 11:cada08fc8a70 | 3671 | |
mbedAustin | 11:cada08fc8a70 | 3672 | if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk, |
mbedAustin | 11:cada08fc8a70 | 3673 | md_alg, hash_start, hashlen, |
mbedAustin | 11:cada08fc8a70 | 3674 | ssl->in_msg + i, sig_len ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3675 | { |
mbedAustin | 11:cada08fc8a70 | 3676 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret ); |
mbedAustin | 11:cada08fc8a70 | 3677 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3678 | } |
mbedAustin | 11:cada08fc8a70 | 3679 | |
mbedAustin | 11:cada08fc8a70 | 3680 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) ); |
mbedAustin | 11:cada08fc8a70 | 3681 | |
mbedAustin | 11:cada08fc8a70 | 3682 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3683 | } |
mbedAustin | 11:cada08fc8a70 | 3684 | #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 3685 | !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED && |
mbedAustin | 11:cada08fc8a70 | 3686 | !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */ |
mbedAustin | 11:cada08fc8a70 | 3687 | |
mbedAustin | 11:cada08fc8a70 | 3688 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 3689 | static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 3690 | { |
mbedAustin | 11:cada08fc8a70 | 3691 | int ret; |
mbedAustin | 11:cada08fc8a70 | 3692 | size_t tlen; |
mbedAustin | 11:cada08fc8a70 | 3693 | uint32_t lifetime; |
mbedAustin | 11:cada08fc8a70 | 3694 | |
mbedAustin | 11:cada08fc8a70 | 3695 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) ); |
mbedAustin | 11:cada08fc8a70 | 3696 | |
mbedAustin | 11:cada08fc8a70 | 3697 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
mbedAustin | 11:cada08fc8a70 | 3698 | ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET; |
mbedAustin | 11:cada08fc8a70 | 3699 | |
mbedAustin | 11:cada08fc8a70 | 3700 | /* |
mbedAustin | 11:cada08fc8a70 | 3701 | * struct { |
mbedAustin | 11:cada08fc8a70 | 3702 | * uint32 ticket_lifetime_hint; |
mbedAustin | 11:cada08fc8a70 | 3703 | * opaque ticket<0..2^16-1>; |
mbedAustin | 11:cada08fc8a70 | 3704 | * } NewSessionTicket; |
mbedAustin | 11:cada08fc8a70 | 3705 | * |
mbedAustin | 11:cada08fc8a70 | 3706 | * 4 . 7 ticket_lifetime_hint (0 = unspecified) |
mbedAustin | 11:cada08fc8a70 | 3707 | * 8 . 9 ticket_len (n) |
mbedAustin | 11:cada08fc8a70 | 3708 | * 10 . 9+n ticket content |
mbedAustin | 11:cada08fc8a70 | 3709 | */ |
mbedAustin | 11:cada08fc8a70 | 3710 | |
mbedAustin | 11:cada08fc8a70 | 3711 | if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket, |
mbedAustin | 11:cada08fc8a70 | 3712 | ssl->session_negotiate, |
mbedAustin | 11:cada08fc8a70 | 3713 | ssl->out_msg + 10, |
mbedAustin | 11:cada08fc8a70 | 3714 | ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN, |
mbedAustin | 11:cada08fc8a70 | 3715 | &tlen, &lifetime ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3716 | { |
mbedAustin | 11:cada08fc8a70 | 3717 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret ); |
mbedAustin | 11:cada08fc8a70 | 3718 | tlen = 0; |
mbedAustin | 11:cada08fc8a70 | 3719 | } |
mbedAustin | 11:cada08fc8a70 | 3720 | |
mbedAustin | 11:cada08fc8a70 | 3721 | ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF; |
mbedAustin | 11:cada08fc8a70 | 3722 | ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF; |
mbedAustin | 11:cada08fc8a70 | 3723 | ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF; |
mbedAustin | 11:cada08fc8a70 | 3724 | ssl->out_msg[7] = ( lifetime ) & 0xFF; |
mbedAustin | 11:cada08fc8a70 | 3725 | |
mbedAustin | 11:cada08fc8a70 | 3726 | ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 3727 | ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF ); |
mbedAustin | 11:cada08fc8a70 | 3728 | |
mbedAustin | 11:cada08fc8a70 | 3729 | ssl->out_msglen = 10 + tlen; |
mbedAustin | 11:cada08fc8a70 | 3730 | |
mbedAustin | 11:cada08fc8a70 | 3731 | /* |
mbedAustin | 11:cada08fc8a70 | 3732 | * Morally equivalent to updating ssl->state, but NewSessionTicket and |
mbedAustin | 11:cada08fc8a70 | 3733 | * ChangeCipherSpec share the same state. |
mbedAustin | 11:cada08fc8a70 | 3734 | */ |
mbedAustin | 11:cada08fc8a70 | 3735 | ssl->handshake->new_session_ticket = 0; |
mbedAustin | 11:cada08fc8a70 | 3736 | |
mbedAustin | 11:cada08fc8a70 | 3737 | if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3738 | { |
mbedAustin | 11:cada08fc8a70 | 3739 | MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret ); |
mbedAustin | 11:cada08fc8a70 | 3740 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3741 | } |
mbedAustin | 11:cada08fc8a70 | 3742 | |
mbedAustin | 11:cada08fc8a70 | 3743 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) ); |
mbedAustin | 11:cada08fc8a70 | 3744 | |
mbedAustin | 11:cada08fc8a70 | 3745 | return( 0 ); |
mbedAustin | 11:cada08fc8a70 | 3746 | } |
mbedAustin | 11:cada08fc8a70 | 3747 | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
mbedAustin | 11:cada08fc8a70 | 3748 | |
mbedAustin | 11:cada08fc8a70 | 3749 | /* |
mbedAustin | 11:cada08fc8a70 | 3750 | * SSL handshake -- server side -- single step |
mbedAustin | 11:cada08fc8a70 | 3751 | */ |
mbedAustin | 11:cada08fc8a70 | 3752 | int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ) |
mbedAustin | 11:cada08fc8a70 | 3753 | { |
mbedAustin | 11:cada08fc8a70 | 3754 | int ret = 0; |
mbedAustin | 11:cada08fc8a70 | 3755 | |
mbedAustin | 11:cada08fc8a70 | 3756 | if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL ) |
mbedAustin | 11:cada08fc8a70 | 3757 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 3758 | |
mbedAustin | 11:cada08fc8a70 | 3759 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) ); |
mbedAustin | 11:cada08fc8a70 | 3760 | |
mbedAustin | 11:cada08fc8a70 | 3761 | if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3762 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3763 | |
mbedAustin | 11:cada08fc8a70 | 3764 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 3765 | if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
mbedAustin | 11:cada08fc8a70 | 3766 | ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING ) |
mbedAustin | 11:cada08fc8a70 | 3767 | { |
mbedAustin | 11:cada08fc8a70 | 3768 | if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3769 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3770 | } |
mbedAustin | 11:cada08fc8a70 | 3771 | #endif |
mbedAustin | 11:cada08fc8a70 | 3772 | |
mbedAustin | 11:cada08fc8a70 | 3773 | switch( ssl->state ) |
mbedAustin | 11:cada08fc8a70 | 3774 | { |
mbedAustin | 11:cada08fc8a70 | 3775 | case MBEDTLS_SSL_HELLO_REQUEST: |
mbedAustin | 11:cada08fc8a70 | 3776 | ssl->state = MBEDTLS_SSL_CLIENT_HELLO; |
mbedAustin | 11:cada08fc8a70 | 3777 | break; |
mbedAustin | 11:cada08fc8a70 | 3778 | |
mbedAustin | 11:cada08fc8a70 | 3779 | /* |
mbedAustin | 11:cada08fc8a70 | 3780 | * <== ClientHello |
mbedAustin | 11:cada08fc8a70 | 3781 | */ |
mbedAustin | 11:cada08fc8a70 | 3782 | case MBEDTLS_SSL_CLIENT_HELLO: |
mbedAustin | 11:cada08fc8a70 | 3783 | ret = ssl_parse_client_hello( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3784 | break; |
mbedAustin | 11:cada08fc8a70 | 3785 | |
mbedAustin | 11:cada08fc8a70 | 3786 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
mbedAustin | 11:cada08fc8a70 | 3787 | case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: |
mbedAustin | 11:cada08fc8a70 | 3788 | return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED ); |
mbedAustin | 11:cada08fc8a70 | 3789 | #endif |
mbedAustin | 11:cada08fc8a70 | 3790 | |
mbedAustin | 11:cada08fc8a70 | 3791 | /* |
mbedAustin | 11:cada08fc8a70 | 3792 | * ==> ServerHello |
mbedAustin | 11:cada08fc8a70 | 3793 | * Certificate |
mbedAustin | 11:cada08fc8a70 | 3794 | * ( ServerKeyExchange ) |
mbedAustin | 11:cada08fc8a70 | 3795 | * ( CertificateRequest ) |
mbedAustin | 11:cada08fc8a70 | 3796 | * ServerHelloDone |
mbedAustin | 11:cada08fc8a70 | 3797 | */ |
mbedAustin | 11:cada08fc8a70 | 3798 | case MBEDTLS_SSL_SERVER_HELLO: |
mbedAustin | 11:cada08fc8a70 | 3799 | ret = ssl_write_server_hello( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3800 | break; |
mbedAustin | 11:cada08fc8a70 | 3801 | |
mbedAustin | 11:cada08fc8a70 | 3802 | case MBEDTLS_SSL_SERVER_CERTIFICATE: |
mbedAustin | 11:cada08fc8a70 | 3803 | ret = mbedtls_ssl_write_certificate( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3804 | break; |
mbedAustin | 11:cada08fc8a70 | 3805 | |
mbedAustin | 11:cada08fc8a70 | 3806 | case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: |
mbedAustin | 11:cada08fc8a70 | 3807 | ret = ssl_write_server_key_exchange( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3808 | break; |
mbedAustin | 11:cada08fc8a70 | 3809 | |
mbedAustin | 11:cada08fc8a70 | 3810 | case MBEDTLS_SSL_CERTIFICATE_REQUEST: |
mbedAustin | 11:cada08fc8a70 | 3811 | ret = ssl_write_certificate_request( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3812 | break; |
mbedAustin | 11:cada08fc8a70 | 3813 | |
mbedAustin | 11:cada08fc8a70 | 3814 | case MBEDTLS_SSL_SERVER_HELLO_DONE: |
mbedAustin | 11:cada08fc8a70 | 3815 | ret = ssl_write_server_hello_done( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3816 | break; |
mbedAustin | 11:cada08fc8a70 | 3817 | |
mbedAustin | 11:cada08fc8a70 | 3818 | /* |
mbedAustin | 11:cada08fc8a70 | 3819 | * <== ( Certificate/Alert ) |
mbedAustin | 11:cada08fc8a70 | 3820 | * ClientKeyExchange |
mbedAustin | 11:cada08fc8a70 | 3821 | * ( CertificateVerify ) |
mbedAustin | 11:cada08fc8a70 | 3822 | * ChangeCipherSpec |
mbedAustin | 11:cada08fc8a70 | 3823 | * Finished |
mbedAustin | 11:cada08fc8a70 | 3824 | */ |
mbedAustin | 11:cada08fc8a70 | 3825 | case MBEDTLS_SSL_CLIENT_CERTIFICATE: |
mbedAustin | 11:cada08fc8a70 | 3826 | ret = mbedtls_ssl_parse_certificate( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3827 | break; |
mbedAustin | 11:cada08fc8a70 | 3828 | |
mbedAustin | 11:cada08fc8a70 | 3829 | case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: |
mbedAustin | 11:cada08fc8a70 | 3830 | ret = ssl_parse_client_key_exchange( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3831 | break; |
mbedAustin | 11:cada08fc8a70 | 3832 | |
mbedAustin | 11:cada08fc8a70 | 3833 | case MBEDTLS_SSL_CERTIFICATE_VERIFY: |
mbedAustin | 11:cada08fc8a70 | 3834 | ret = ssl_parse_certificate_verify( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3835 | break; |
mbedAustin | 11:cada08fc8a70 | 3836 | |
mbedAustin | 11:cada08fc8a70 | 3837 | case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: |
mbedAustin | 11:cada08fc8a70 | 3838 | ret = mbedtls_ssl_parse_change_cipher_spec( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3839 | break; |
mbedAustin | 11:cada08fc8a70 | 3840 | |
mbedAustin | 11:cada08fc8a70 | 3841 | case MBEDTLS_SSL_CLIENT_FINISHED: |
mbedAustin | 11:cada08fc8a70 | 3842 | ret = mbedtls_ssl_parse_finished( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3843 | break; |
mbedAustin | 11:cada08fc8a70 | 3844 | |
mbedAustin | 11:cada08fc8a70 | 3845 | /* |
mbedAustin | 11:cada08fc8a70 | 3846 | * ==> ( NewSessionTicket ) |
mbedAustin | 11:cada08fc8a70 | 3847 | * ChangeCipherSpec |
mbedAustin | 11:cada08fc8a70 | 3848 | * Finished |
mbedAustin | 11:cada08fc8a70 | 3849 | */ |
mbedAustin | 11:cada08fc8a70 | 3850 | case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: |
mbedAustin | 11:cada08fc8a70 | 3851 | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
mbedAustin | 11:cada08fc8a70 | 3852 | if( ssl->handshake->new_session_ticket != 0 ) |
mbedAustin | 11:cada08fc8a70 | 3853 | ret = ssl_write_new_session_ticket( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3854 | else |
mbedAustin | 11:cada08fc8a70 | 3855 | #endif |
mbedAustin | 11:cada08fc8a70 | 3856 | ret = mbedtls_ssl_write_change_cipher_spec( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3857 | break; |
mbedAustin | 11:cada08fc8a70 | 3858 | |
mbedAustin | 11:cada08fc8a70 | 3859 | case MBEDTLS_SSL_SERVER_FINISHED: |
mbedAustin | 11:cada08fc8a70 | 3860 | ret = mbedtls_ssl_write_finished( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3861 | break; |
mbedAustin | 11:cada08fc8a70 | 3862 | |
mbedAustin | 11:cada08fc8a70 | 3863 | case MBEDTLS_SSL_FLUSH_BUFFERS: |
mbedAustin | 11:cada08fc8a70 | 3864 | MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) ); |
mbedAustin | 11:cada08fc8a70 | 3865 | ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; |
mbedAustin | 11:cada08fc8a70 | 3866 | break; |
mbedAustin | 11:cada08fc8a70 | 3867 | |
mbedAustin | 11:cada08fc8a70 | 3868 | case MBEDTLS_SSL_HANDSHAKE_WRAPUP: |
mbedAustin | 11:cada08fc8a70 | 3869 | mbedtls_ssl_handshake_wrapup( ssl ); |
mbedAustin | 11:cada08fc8a70 | 3870 | break; |
mbedAustin | 11:cada08fc8a70 | 3871 | |
mbedAustin | 11:cada08fc8a70 | 3872 | default: |
mbedAustin | 11:cada08fc8a70 | 3873 | MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) ); |
mbedAustin | 11:cada08fc8a70 | 3874 | return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); |
mbedAustin | 11:cada08fc8a70 | 3875 | } |
mbedAustin | 11:cada08fc8a70 | 3876 | |
mbedAustin | 11:cada08fc8a70 | 3877 | return( ret ); |
mbedAustin | 11:cada08fc8a70 | 3878 | } |
mbedAustin | 11:cada08fc8a70 | 3879 | #endif /* MBEDTLS_SSL_SRV_C */ |