WNCInterface - I added functionality to get the RSSI, BER, and C…

Users » ng977t » Code » WNCInterface

I added functionality to get the RSSI, BER, and Cell Neighbor for reporting connection issues to M2X

mbedtls/source/ssl_srv.c@12:0071cb144c7a, 2016-11-01 (annotated)

Committer:: JMF
Date:: Tue Nov 01 14:22:56 2016 +0000
Revision:: 12:0071cb144c7a

Adding mbedtls files

Who changed what in which revision?

User	Revision	Line number	New contents of line
JMF	12:0071cb144c7a	1	/*
JMF	12:0071cb144c7a	2	* SSLv3/TLSv1 server-side functions
JMF	12:0071cb144c7a	3	*
JMF	12:0071cb144c7a	4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
JMF	12:0071cb144c7a	5	* SPDX-License-Identifier: Apache-2.0
JMF	12:0071cb144c7a	6	*
JMF	12:0071cb144c7a	7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
JMF	12:0071cb144c7a	8	* not use this file except in compliance with the License.
JMF	12:0071cb144c7a	9	* You may obtain a copy of the License at
JMF	12:0071cb144c7a	10	*
JMF	12:0071cb144c7a	11	* http://www.apache.org/licenses/LICENSE-2.0
JMF	12:0071cb144c7a	12	*
JMF	12:0071cb144c7a	13	* Unless required by applicable law or agreed to in writing, software
JMF	12:0071cb144c7a	14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
JMF	12:0071cb144c7a	15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
JMF	12:0071cb144c7a	16	* See the License for the specific language governing permissions and
JMF	12:0071cb144c7a	17	* limitations under the License.
JMF	12:0071cb144c7a	18	*
JMF	12:0071cb144c7a	19	* This file is part of mbed TLS (https://tls.mbed.org)
JMF	12:0071cb144c7a	20	*/
JMF	12:0071cb144c7a	21
JMF	12:0071cb144c7a	22	#if !defined(MBEDTLS_CONFIG_FILE)
JMF	12:0071cb144c7a	23	#include "mbedtls/config.h"
JMF	12:0071cb144c7a	24	#else
JMF	12:0071cb144c7a	25	#include MBEDTLS_CONFIG_FILE
JMF	12:0071cb144c7a	26	#endif
JMF	12:0071cb144c7a	27
JMF	12:0071cb144c7a	28	#if defined(MBEDTLS_SSL_SRV_C)
JMF	12:0071cb144c7a	29
JMF	12:0071cb144c7a	30	#if defined(MBEDTLS_PLATFORM_C)
JMF	12:0071cb144c7a	31	#include "mbedtls/platform.h"
JMF	12:0071cb144c7a	32	#else
JMF	12:0071cb144c7a	33	#include <stdlib.h>
JMF	12:0071cb144c7a	34	#define mbedtls_calloc calloc
JMF	12:0071cb144c7a	35	#define mbedtls_free free
JMF	12:0071cb144c7a	36	#endif
JMF	12:0071cb144c7a	37
JMF	12:0071cb144c7a	38	#include "mbedtls/debug.h"
JMF	12:0071cb144c7a	39	#include "mbedtls/ssl.h"
JMF	12:0071cb144c7a	40	#include "mbedtls/ssl_internal.h"
JMF	12:0071cb144c7a	41
JMF	12:0071cb144c7a	42	#include <string.h>
JMF	12:0071cb144c7a	43
JMF	12:0071cb144c7a	44	#if defined(MBEDTLS_ECP_C)
JMF	12:0071cb144c7a	45	#include "mbedtls/ecp.h"
JMF	12:0071cb144c7a	46	#endif
JMF	12:0071cb144c7a	47
JMF	12:0071cb144c7a	48	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	49	#include "mbedtls/platform_time.h"
JMF	12:0071cb144c7a	50	#endif
JMF	12:0071cb144c7a	51
JMF	12:0071cb144c7a	52	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	53	/* Implementation that should never be optimized out by the compiler */
JMF	12:0071cb144c7a	54	static void mbedtls_zeroize( void *v, size_t n ) {
JMF	12:0071cb144c7a	55	volatile unsigned char p = v; while( n-- ) p++ = 0;
JMF	12:0071cb144c7a	56	}
JMF	12:0071cb144c7a	57	#endif
JMF	12:0071cb144c7a	58
JMF	12:0071cb144c7a	59	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
JMF	12:0071cb144c7a	60	int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	61	const unsigned char *info,
JMF	12:0071cb144c7a	62	size_t ilen )
JMF	12:0071cb144c7a	63	{
JMF	12:0071cb144c7a	64	if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
JMF	12:0071cb144c7a	65	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	66
JMF	12:0071cb144c7a	67	mbedtls_free( ssl->cli_id );
JMF	12:0071cb144c7a	68
JMF	12:0071cb144c7a	69	if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
JMF	12:0071cb144c7a	70	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
JMF	12:0071cb144c7a	71
JMF	12:0071cb144c7a	72	memcpy( ssl->cli_id, info, ilen );
JMF	12:0071cb144c7a	73	ssl->cli_id_len = ilen;
JMF	12:0071cb144c7a	74
JMF	12:0071cb144c7a	75	return( 0 );
JMF	12:0071cb144c7a	76	}
JMF	12:0071cb144c7a	77
JMF	12:0071cb144c7a	78	void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
JMF	12:0071cb144c7a	79	mbedtls_ssl_cookie_write_t *f_cookie_write,
JMF	12:0071cb144c7a	80	mbedtls_ssl_cookie_check_t *f_cookie_check,
JMF	12:0071cb144c7a	81	void *p_cookie )
JMF	12:0071cb144c7a	82	{
JMF	12:0071cb144c7a	83	conf->f_cookie_write = f_cookie_write;
JMF	12:0071cb144c7a	84	conf->f_cookie_check = f_cookie_check;
JMF	12:0071cb144c7a	85	conf->p_cookie = p_cookie;
JMF	12:0071cb144c7a	86	}
JMF	12:0071cb144c7a	87	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
JMF	12:0071cb144c7a	88
JMF	12:0071cb144c7a	89	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	90	static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	91	const unsigned char *buf,
JMF	12:0071cb144c7a	92	size_t len )
JMF	12:0071cb144c7a	93	{
JMF	12:0071cb144c7a	94	int ret;
JMF	12:0071cb144c7a	95	size_t servername_list_size, hostname_len;
JMF	12:0071cb144c7a	96	const unsigned char *p;
JMF	12:0071cb144c7a	97
JMF	12:0071cb144c7a	98	MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
JMF	12:0071cb144c7a	99
JMF	12:0071cb144c7a	100	servername_list_size = ( ( buf[0] << 8 ) \| ( buf[1] ) );
JMF	12:0071cb144c7a	101	if( servername_list_size + 2 != len )
JMF	12:0071cb144c7a	102	{
JMF	12:0071cb144c7a	103	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	104	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	105	}
JMF	12:0071cb144c7a	106
JMF	12:0071cb144c7a	107	p = buf + 2;
JMF	12:0071cb144c7a	108	while( servername_list_size > 0 )
JMF	12:0071cb144c7a	109	{
JMF	12:0071cb144c7a	110	hostname_len = ( ( p[1] << 8 ) \| p[2] );
JMF	12:0071cb144c7a	111	if( hostname_len + 3 > servername_list_size )
JMF	12:0071cb144c7a	112	{
JMF	12:0071cb144c7a	113	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	114	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	115	}
JMF	12:0071cb144c7a	116
JMF	12:0071cb144c7a	117	if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
JMF	12:0071cb144c7a	118	{
JMF	12:0071cb144c7a	119	ret = ssl->conf->f_sni( ssl->conf->p_sni,
JMF	12:0071cb144c7a	120	ssl, p + 3, hostname_len );
JMF	12:0071cb144c7a	121	if( ret != 0 )
JMF	12:0071cb144c7a	122	{
JMF	12:0071cb144c7a	123	MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
JMF	12:0071cb144c7a	124	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	125	MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
JMF	12:0071cb144c7a	126	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	127	}
JMF	12:0071cb144c7a	128	return( 0 );
JMF	12:0071cb144c7a	129	}
JMF	12:0071cb144c7a	130
JMF	12:0071cb144c7a	131	servername_list_size -= hostname_len + 3;
JMF	12:0071cb144c7a	132	p += hostname_len + 3;
JMF	12:0071cb144c7a	133	}
JMF	12:0071cb144c7a	134
JMF	12:0071cb144c7a	135	if( servername_list_size != 0 )
JMF	12:0071cb144c7a	136	{
JMF	12:0071cb144c7a	137	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	138	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	139	}
JMF	12:0071cb144c7a	140
JMF	12:0071cb144c7a	141	return( 0 );
JMF	12:0071cb144c7a	142	}
JMF	12:0071cb144c7a	143	#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
JMF	12:0071cb144c7a	144
JMF	12:0071cb144c7a	145	static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	146	const unsigned char *buf,
JMF	12:0071cb144c7a	147	size_t len )
JMF	12:0071cb144c7a	148	{
JMF	12:0071cb144c7a	149	int ret;
JMF	12:0071cb144c7a	150
JMF	12:0071cb144c7a	151	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	152	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	153	{
JMF	12:0071cb144c7a	154	/* Check verify-data in constant-time. The length OTOH is no secret */
JMF	12:0071cb144c7a	155	if( len != 1 + ssl->verify_data_len \|\|
JMF	12:0071cb144c7a	156	buf[0] != ssl->verify_data_len \|\|
JMF	12:0071cb144c7a	157	mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
JMF	12:0071cb144c7a	158	ssl->verify_data_len ) != 0 )
JMF	12:0071cb144c7a	159	{
JMF	12:0071cb144c7a	160	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
JMF	12:0071cb144c7a	161
JMF	12:0071cb144c7a	162	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	163	return( ret );
JMF	12:0071cb144c7a	164
JMF	12:0071cb144c7a	165	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	166	}
JMF	12:0071cb144c7a	167	}
JMF	12:0071cb144c7a	168	else
JMF	12:0071cb144c7a	169	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	170	{
JMF	12:0071cb144c7a	171	if( len != 1 \|\| buf[0] != 0x0 )
JMF	12:0071cb144c7a	172	{
JMF	12:0071cb144c7a	173	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
JMF	12:0071cb144c7a	174
JMF	12:0071cb144c7a	175	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	176	return( ret );
JMF	12:0071cb144c7a	177
JMF	12:0071cb144c7a	178	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	179	}
JMF	12:0071cb144c7a	180
JMF	12:0071cb144c7a	181	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
JMF	12:0071cb144c7a	182	}
JMF	12:0071cb144c7a	183
JMF	12:0071cb144c7a	184	return( 0 );
JMF	12:0071cb144c7a	185	}
JMF	12:0071cb144c7a	186
JMF	12:0071cb144c7a	187	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
JMF	12:0071cb144c7a	188	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
JMF	12:0071cb144c7a	189	static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	190	const unsigned char *buf,
JMF	12:0071cb144c7a	191	size_t len )
JMF	12:0071cb144c7a	192	{
JMF	12:0071cb144c7a	193	size_t sig_alg_list_size;
JMF	12:0071cb144c7a	194	const unsigned char *p;
JMF	12:0071cb144c7a	195	const unsigned char *end = buf + len;
JMF	12:0071cb144c7a	196	const int *md_cur;
JMF	12:0071cb144c7a	197
JMF	12:0071cb144c7a	198
JMF	12:0071cb144c7a	199	sig_alg_list_size = ( ( buf[0] << 8 ) \| ( buf[1] ) );
JMF	12:0071cb144c7a	200	if( sig_alg_list_size + 2 != len \|\|
JMF	12:0071cb144c7a	201	sig_alg_list_size % 2 != 0 )
JMF	12:0071cb144c7a	202	{
JMF	12:0071cb144c7a	203	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	204	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	205	}
JMF	12:0071cb144c7a	206
JMF	12:0071cb144c7a	207	/*
JMF	12:0071cb144c7a	208	* For now, ignore the SignatureAlgorithm part and rely on offered
JMF	12:0071cb144c7a	209	* ciphersuites only for that part. To be fixed later.
JMF	12:0071cb144c7a	210	*
JMF	12:0071cb144c7a	211	* So, just look at the HashAlgorithm part.
JMF	12:0071cb144c7a	212	*/
JMF	12:0071cb144c7a	213	for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
JMF	12:0071cb144c7a	214	for( p = buf + 2; p < end; p += 2 ) {
JMF	12:0071cb144c7a	215	if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
JMF	12:0071cb144c7a	216	ssl->handshake->sig_alg = p[0];
JMF	12:0071cb144c7a	217	goto have_sig_alg;
JMF	12:0071cb144c7a	218	}
JMF	12:0071cb144c7a	219	}
JMF	12:0071cb144c7a	220	}
JMF	12:0071cb144c7a	221
JMF	12:0071cb144c7a	222	/* Some key echanges do not need signatures at all */
JMF	12:0071cb144c7a	223	MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
JMF	12:0071cb144c7a	224	return( 0 );
JMF	12:0071cb144c7a	225
JMF	12:0071cb144c7a	226	have_sig_alg:
JMF	12:0071cb144c7a	227	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
JMF	12:0071cb144c7a	228	ssl->handshake->sig_alg ) );
JMF	12:0071cb144c7a	229
JMF	12:0071cb144c7a	230	return( 0 );
JMF	12:0071cb144c7a	231	}
JMF	12:0071cb144c7a	232	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
JMF	12:0071cb144c7a	233	MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
JMF	12:0071cb144c7a	234
JMF	12:0071cb144c7a	235	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	236	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	237	static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	238	const unsigned char *buf,
JMF	12:0071cb144c7a	239	size_t len )
JMF	12:0071cb144c7a	240	{
JMF	12:0071cb144c7a	241	size_t list_size, our_size;
JMF	12:0071cb144c7a	242	const unsigned char *p;
JMF	12:0071cb144c7a	243	const mbedtls_ecp_curve_info curve_info, *curves;
JMF	12:0071cb144c7a	244
JMF	12:0071cb144c7a	245	list_size = ( ( buf[0] << 8 ) \| ( buf[1] ) );
JMF	12:0071cb144c7a	246	if( list_size + 2 != len \|\|
JMF	12:0071cb144c7a	247	list_size % 2 != 0 )
JMF	12:0071cb144c7a	248	{
JMF	12:0071cb144c7a	249	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	250	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	251	}
JMF	12:0071cb144c7a	252
JMF	12:0071cb144c7a	253	/* Should never happen unless client duplicates the extension */
JMF	12:0071cb144c7a	254	if( ssl->handshake->curves != NULL )
JMF	12:0071cb144c7a	255	{
JMF	12:0071cb144c7a	256	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	257	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	258	}
JMF	12:0071cb144c7a	259
JMF	12:0071cb144c7a	260	/* Don't allow our peer to make us allocate too much memory,
JMF	12:0071cb144c7a	261	* and leave room for a final 0 */
JMF	12:0071cb144c7a	262	our_size = list_size / 2 + 1;
JMF	12:0071cb144c7a	263	if( our_size > MBEDTLS_ECP_DP_MAX )
JMF	12:0071cb144c7a	264	our_size = MBEDTLS_ECP_DP_MAX;
JMF	12:0071cb144c7a	265
JMF	12:0071cb144c7a	266	if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
JMF	12:0071cb144c7a	267	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
JMF	12:0071cb144c7a	268
JMF	12:0071cb144c7a	269	ssl->handshake->curves = curves;
JMF	12:0071cb144c7a	270
JMF	12:0071cb144c7a	271	p = buf + 2;
JMF	12:0071cb144c7a	272	while( list_size > 0 && our_size > 1 )
JMF	12:0071cb144c7a	273	{
JMF	12:0071cb144c7a	274	curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) \| p[1] );
JMF	12:0071cb144c7a	275
JMF	12:0071cb144c7a	276	if( curve_info != NULL )
JMF	12:0071cb144c7a	277	{
JMF	12:0071cb144c7a	278	*curves++ = curve_info;
JMF	12:0071cb144c7a	279	our_size--;
JMF	12:0071cb144c7a	280	}
JMF	12:0071cb144c7a	281
JMF	12:0071cb144c7a	282	list_size -= 2;
JMF	12:0071cb144c7a	283	p += 2;
JMF	12:0071cb144c7a	284	}
JMF	12:0071cb144c7a	285
JMF	12:0071cb144c7a	286	return( 0 );
JMF	12:0071cb144c7a	287	}
JMF	12:0071cb144c7a	288
JMF	12:0071cb144c7a	289	static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	290	const unsigned char *buf,
JMF	12:0071cb144c7a	291	size_t len )
JMF	12:0071cb144c7a	292	{
JMF	12:0071cb144c7a	293	size_t list_size;
JMF	12:0071cb144c7a	294	const unsigned char *p;
JMF	12:0071cb144c7a	295
JMF	12:0071cb144c7a	296	list_size = buf[0];
JMF	12:0071cb144c7a	297	if( list_size + 1 != len )
JMF	12:0071cb144c7a	298	{
JMF	12:0071cb144c7a	299	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	300	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	301	}
JMF	12:0071cb144c7a	302
JMF	12:0071cb144c7a	303	p = buf + 1;
JMF	12:0071cb144c7a	304	while( list_size > 0 )
JMF	12:0071cb144c7a	305	{
JMF	12:0071cb144c7a	306	if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED \|\|
JMF	12:0071cb144c7a	307	p[0] == MBEDTLS_ECP_PF_COMPRESSED )
JMF	12:0071cb144c7a	308	{
JMF	12:0071cb144c7a	309	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	310	ssl->handshake->ecdh_ctx.point_format = p[0];
JMF	12:0071cb144c7a	311	#endif
JMF	12:0071cb144c7a	312	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	313	ssl->handshake->ecjpake_ctx.point_format = p[0];
JMF	12:0071cb144c7a	314	#endif
JMF	12:0071cb144c7a	315	MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
JMF	12:0071cb144c7a	316	return( 0 );
JMF	12:0071cb144c7a	317	}
JMF	12:0071cb144c7a	318
JMF	12:0071cb144c7a	319	list_size--;
JMF	12:0071cb144c7a	320	p++;
JMF	12:0071cb144c7a	321	}
JMF	12:0071cb144c7a	322
JMF	12:0071cb144c7a	323	return( 0 );
JMF	12:0071cb144c7a	324	}
JMF	12:0071cb144c7a	325	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
JMF	12:0071cb144c7a	326	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	327
JMF	12:0071cb144c7a	328	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	329	static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	330	const unsigned char *buf,
JMF	12:0071cb144c7a	331	size_t len )
JMF	12:0071cb144c7a	332	{
JMF	12:0071cb144c7a	333	int ret;
JMF	12:0071cb144c7a	334
JMF	12:0071cb144c7a	335	if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
JMF	12:0071cb144c7a	336	{
JMF	12:0071cb144c7a	337	MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
JMF	12:0071cb144c7a	338	return( 0 );
JMF	12:0071cb144c7a	339	}
JMF	12:0071cb144c7a	340
JMF	12:0071cb144c7a	341	if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	342	buf, len ) ) != 0 )
JMF	12:0071cb144c7a	343	{
JMF	12:0071cb144c7a	344	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
JMF	12:0071cb144c7a	345	return( ret );
JMF	12:0071cb144c7a	346	}
JMF	12:0071cb144c7a	347
JMF	12:0071cb144c7a	348	/* Only mark the extension as OK when we're sure it is */
JMF	12:0071cb144c7a	349	ssl->handshake->cli_exts \|= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
JMF	12:0071cb144c7a	350
JMF	12:0071cb144c7a	351	return( 0 );
JMF	12:0071cb144c7a	352	}
JMF	12:0071cb144c7a	353	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	354
JMF	12:0071cb144c7a	355	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	356	static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	357	const unsigned char *buf,
JMF	12:0071cb144c7a	358	size_t len )
JMF	12:0071cb144c7a	359	{
JMF	12:0071cb144c7a	360	if( len != 1 \|\| buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
JMF	12:0071cb144c7a	361	{
JMF	12:0071cb144c7a	362	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	363	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	364	}
JMF	12:0071cb144c7a	365
JMF	12:0071cb144c7a	366	ssl->session_negotiate->mfl_code = buf[0];
JMF	12:0071cb144c7a	367
JMF	12:0071cb144c7a	368	return( 0 );
JMF	12:0071cb144c7a	369	}
JMF	12:0071cb144c7a	370	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
JMF	12:0071cb144c7a	371
JMF	12:0071cb144c7a	372	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	373	static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	374	const unsigned char *buf,
JMF	12:0071cb144c7a	375	size_t len )
JMF	12:0071cb144c7a	376	{
JMF	12:0071cb144c7a	377	if( len != 0 )
JMF	12:0071cb144c7a	378	{
JMF	12:0071cb144c7a	379	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	380	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	381	}
JMF	12:0071cb144c7a	382
JMF	12:0071cb144c7a	383	((void) buf);
JMF	12:0071cb144c7a	384
JMF	12:0071cb144c7a	385	if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
JMF	12:0071cb144c7a	386	ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
JMF	12:0071cb144c7a	387
JMF	12:0071cb144c7a	388	return( 0 );
JMF	12:0071cb144c7a	389	}
JMF	12:0071cb144c7a	390	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
JMF	12:0071cb144c7a	391
JMF	12:0071cb144c7a	392	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	393	static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	394	const unsigned char *buf,
JMF	12:0071cb144c7a	395	size_t len )
JMF	12:0071cb144c7a	396	{
JMF	12:0071cb144c7a	397	if( len != 0 )
JMF	12:0071cb144c7a	398	{
JMF	12:0071cb144c7a	399	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	400	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	401	}
JMF	12:0071cb144c7a	402
JMF	12:0071cb144c7a	403	((void) buf);
JMF	12:0071cb144c7a	404
JMF	12:0071cb144c7a	405	if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
JMF	12:0071cb144c7a	406	ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	407	{
JMF	12:0071cb144c7a	408	ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
JMF	12:0071cb144c7a	409	}
JMF	12:0071cb144c7a	410
JMF	12:0071cb144c7a	411	return( 0 );
JMF	12:0071cb144c7a	412	}
JMF	12:0071cb144c7a	413	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
JMF	12:0071cb144c7a	414
JMF	12:0071cb144c7a	415	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	416	static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	417	const unsigned char *buf,
JMF	12:0071cb144c7a	418	size_t len )
JMF	12:0071cb144c7a	419	{
JMF	12:0071cb144c7a	420	if( len != 0 )
JMF	12:0071cb144c7a	421	{
JMF	12:0071cb144c7a	422	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	423	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	424	}
JMF	12:0071cb144c7a	425
JMF	12:0071cb144c7a	426	((void) buf);
JMF	12:0071cb144c7a	427
JMF	12:0071cb144c7a	428	if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
JMF	12:0071cb144c7a	429	ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	430	{
JMF	12:0071cb144c7a	431	ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
JMF	12:0071cb144c7a	432	}
JMF	12:0071cb144c7a	433
JMF	12:0071cb144c7a	434	return( 0 );
JMF	12:0071cb144c7a	435	}
JMF	12:0071cb144c7a	436	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
JMF	12:0071cb144c7a	437
JMF	12:0071cb144c7a	438	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	439	static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	440	unsigned char *buf,
JMF	12:0071cb144c7a	441	size_t len )
JMF	12:0071cb144c7a	442	{
JMF	12:0071cb144c7a	443	int ret;
JMF	12:0071cb144c7a	444	mbedtls_ssl_session session;
JMF	12:0071cb144c7a	445
JMF	12:0071cb144c7a	446	mbedtls_ssl_session_init( &session );
JMF	12:0071cb144c7a	447
JMF	12:0071cb144c7a	448	if( ssl->conf->f_ticket_parse == NULL \|\|
JMF	12:0071cb144c7a	449	ssl->conf->f_ticket_write == NULL )
JMF	12:0071cb144c7a	450	{
JMF	12:0071cb144c7a	451	return( 0 );
JMF	12:0071cb144c7a	452	}
JMF	12:0071cb144c7a	453
JMF	12:0071cb144c7a	454	/* Remember the client asked us to send a new ticket */
JMF	12:0071cb144c7a	455	ssl->handshake->new_session_ticket = 1;
JMF	12:0071cb144c7a	456
JMF	12:0071cb144c7a	457	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
JMF	12:0071cb144c7a	458
JMF	12:0071cb144c7a	459	if( len == 0 )
JMF	12:0071cb144c7a	460	return( 0 );
JMF	12:0071cb144c7a	461
JMF	12:0071cb144c7a	462	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	463	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	464	{
JMF	12:0071cb144c7a	465	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
JMF	12:0071cb144c7a	466	return( 0 );
JMF	12:0071cb144c7a	467	}
JMF	12:0071cb144c7a	468	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	469
JMF	12:0071cb144c7a	470	/*
JMF	12:0071cb144c7a	471	* Failures are ok: just ignore the ticket and proceed.
JMF	12:0071cb144c7a	472	*/
JMF	12:0071cb144c7a	473	if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
JMF	12:0071cb144c7a	474	buf, len ) ) != 0 )
JMF	12:0071cb144c7a	475	{
JMF	12:0071cb144c7a	476	mbedtls_ssl_session_free( &session );
JMF	12:0071cb144c7a	477
JMF	12:0071cb144c7a	478	if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
JMF	12:0071cb144c7a	479	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
JMF	12:0071cb144c7a	480	else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
JMF	12:0071cb144c7a	481	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
JMF	12:0071cb144c7a	482	else
JMF	12:0071cb144c7a	483	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
JMF	12:0071cb144c7a	484
JMF	12:0071cb144c7a	485	return( 0 );
JMF	12:0071cb144c7a	486	}
JMF	12:0071cb144c7a	487
JMF	12:0071cb144c7a	488	/*
JMF	12:0071cb144c7a	489	* Keep the session ID sent by the client, since we MUST send it back to
JMF	12:0071cb144c7a	490	* inform them we're accepting the ticket (RFC 5077 section 3.4)
JMF	12:0071cb144c7a	491	*/
JMF	12:0071cb144c7a	492	session.id_len = ssl->session_negotiate->id_len;
JMF	12:0071cb144c7a	493	memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
JMF	12:0071cb144c7a	494
JMF	12:0071cb144c7a	495	mbedtls_ssl_session_free( ssl->session_negotiate );
JMF	12:0071cb144c7a	496	memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
JMF	12:0071cb144c7a	497
JMF	12:0071cb144c7a	498	/* Zeroize instead of free as we copied the content */
JMF	12:0071cb144c7a	499	mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
JMF	12:0071cb144c7a	500
JMF	12:0071cb144c7a	501	MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
JMF	12:0071cb144c7a	502
JMF	12:0071cb144c7a	503	ssl->handshake->resume = 1;
JMF	12:0071cb144c7a	504
JMF	12:0071cb144c7a	505	/* Don't send a new ticket after all, this one is OK */
JMF	12:0071cb144c7a	506	ssl->handshake->new_session_ticket = 0;
JMF	12:0071cb144c7a	507
JMF	12:0071cb144c7a	508	return( 0 );
JMF	12:0071cb144c7a	509	}
JMF	12:0071cb144c7a	510	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	511
JMF	12:0071cb144c7a	512	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	513	static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	514	const unsigned char *buf, size_t len )
JMF	12:0071cb144c7a	515	{
JMF	12:0071cb144c7a	516	size_t list_len, cur_len, ours_len;
JMF	12:0071cb144c7a	517	const unsigned char theirs, start, *end;
JMF	12:0071cb144c7a	518	const char **ours;
JMF	12:0071cb144c7a	519
JMF	12:0071cb144c7a	520	/* If ALPN not configured, just ignore the extension */
JMF	12:0071cb144c7a	521	if( ssl->conf->alpn_list == NULL )
JMF	12:0071cb144c7a	522	return( 0 );
JMF	12:0071cb144c7a	523
JMF	12:0071cb144c7a	524	/*
JMF	12:0071cb144c7a	525	* opaque ProtocolName<1..2^8-1>;
JMF	12:0071cb144c7a	526	*
JMF	12:0071cb144c7a	527	* struct {
JMF	12:0071cb144c7a	528	* ProtocolName protocol_name_list<2..2^16-1>
JMF	12:0071cb144c7a	529	* } ProtocolNameList;
JMF	12:0071cb144c7a	530	*/
JMF	12:0071cb144c7a	531
JMF	12:0071cb144c7a	532	/* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
JMF	12:0071cb144c7a	533	if( len < 4 )
JMF	12:0071cb144c7a	534	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	535
JMF	12:0071cb144c7a	536	list_len = ( buf[0] << 8 ) \| buf[1];
JMF	12:0071cb144c7a	537	if( list_len != len - 2 )
JMF	12:0071cb144c7a	538	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	539
JMF	12:0071cb144c7a	540	/*
JMF	12:0071cb144c7a	541	* Use our order of preference
JMF	12:0071cb144c7a	542	*/
JMF	12:0071cb144c7a	543	start = buf + 2;
JMF	12:0071cb144c7a	544	end = buf + len;
JMF	12:0071cb144c7a	545	for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
JMF	12:0071cb144c7a	546	{
JMF	12:0071cb144c7a	547	ours_len = strlen( *ours );
JMF	12:0071cb144c7a	548	for( theirs = start; theirs != end; theirs += cur_len )
JMF	12:0071cb144c7a	549	{
JMF	12:0071cb144c7a	550	/* If the list is well formed, we should get equality first */
JMF	12:0071cb144c7a	551	if( theirs > end )
JMF	12:0071cb144c7a	552	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	553
JMF	12:0071cb144c7a	554	cur_len = *theirs++;
JMF	12:0071cb144c7a	555
JMF	12:0071cb144c7a	556	/* Empty strings MUST NOT be included */
JMF	12:0071cb144c7a	557	if( cur_len == 0 )
JMF	12:0071cb144c7a	558	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	559
JMF	12:0071cb144c7a	560	if( cur_len == ours_len &&
JMF	12:0071cb144c7a	561	memcmp( theirs, *ours, cur_len ) == 0 )
JMF	12:0071cb144c7a	562	{
JMF	12:0071cb144c7a	563	ssl->alpn_chosen = *ours;
JMF	12:0071cb144c7a	564	return( 0 );
JMF	12:0071cb144c7a	565	}
JMF	12:0071cb144c7a	566	}
JMF	12:0071cb144c7a	567	}
JMF	12:0071cb144c7a	568
JMF	12:0071cb144c7a	569	/* If we get there, no match was found */
JMF	12:0071cb144c7a	570	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	571	MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
JMF	12:0071cb144c7a	572	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	573	}
JMF	12:0071cb144c7a	574	#endif /* MBEDTLS_SSL_ALPN */
JMF	12:0071cb144c7a	575
JMF	12:0071cb144c7a	576	/*
JMF	12:0071cb144c7a	577	* Auxiliary functions for ServerHello parsing and related actions
JMF	12:0071cb144c7a	578	*/
JMF	12:0071cb144c7a	579
JMF	12:0071cb144c7a	580	#if defined(MBEDTLS_X509_CRT_PARSE_C)
JMF	12:0071cb144c7a	581	/*
JMF	12:0071cb144c7a	582	* Return 0 if the given key uses one of the acceptable curves, -1 otherwise
JMF	12:0071cb144c7a	583	*/
JMF	12:0071cb144c7a	584	#if defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	585	static int ssl_check_key_curve( mbedtls_pk_context *pk,
JMF	12:0071cb144c7a	586	const mbedtls_ecp_curve_info **curves )
JMF	12:0071cb144c7a	587	{
JMF	12:0071cb144c7a	588	const mbedtls_ecp_curve_info **crv = curves;
JMF	12:0071cb144c7a	589	mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
JMF	12:0071cb144c7a	590
JMF	12:0071cb144c7a	591	while( *crv != NULL )
JMF	12:0071cb144c7a	592	{
JMF	12:0071cb144c7a	593	if( (*crv)->grp_id == grp_id )
JMF	12:0071cb144c7a	594	return( 0 );
JMF	12:0071cb144c7a	595	crv++;
JMF	12:0071cb144c7a	596	}
JMF	12:0071cb144c7a	597
JMF	12:0071cb144c7a	598	return( -1 );
JMF	12:0071cb144c7a	599	}
JMF	12:0071cb144c7a	600	#endif /* MBEDTLS_ECDSA_C */
JMF	12:0071cb144c7a	601
JMF	12:0071cb144c7a	602	/*
JMF	12:0071cb144c7a	603	* Try picking a certificate for this ciphersuite,
JMF	12:0071cb144c7a	604	* return 0 on success and -1 on failure.
JMF	12:0071cb144c7a	605	*/
JMF	12:0071cb144c7a	606	static int ssl_pick_cert( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	607	const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
JMF	12:0071cb144c7a	608	{
JMF	12:0071cb144c7a	609	mbedtls_ssl_key_cert cur, list, *fallback = NULL;
JMF	12:0071cb144c7a	610	mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
JMF	12:0071cb144c7a	611	uint32_t flags;
JMF	12:0071cb144c7a	612
JMF	12:0071cb144c7a	613	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	614	if( ssl->handshake->sni_key_cert != NULL )
JMF	12:0071cb144c7a	615	list = ssl->handshake->sni_key_cert;
JMF	12:0071cb144c7a	616	else
JMF	12:0071cb144c7a	617	#endif
JMF	12:0071cb144c7a	618	list = ssl->conf->key_cert;
JMF	12:0071cb144c7a	619
JMF	12:0071cb144c7a	620	if( pk_alg == MBEDTLS_PK_NONE )
JMF	12:0071cb144c7a	621	return( 0 );
JMF	12:0071cb144c7a	622
JMF	12:0071cb144c7a	623	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
JMF	12:0071cb144c7a	624
JMF	12:0071cb144c7a	625	if( list == NULL )
JMF	12:0071cb144c7a	626	{
JMF	12:0071cb144c7a	627	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
JMF	12:0071cb144c7a	628	return( -1 );
JMF	12:0071cb144c7a	629	}
JMF	12:0071cb144c7a	630
JMF	12:0071cb144c7a	631	for( cur = list; cur != NULL; cur = cur->next )
JMF	12:0071cb144c7a	632	{
JMF	12:0071cb144c7a	633	MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
JMF	12:0071cb144c7a	634	cur->cert );
JMF	12:0071cb144c7a	635
JMF	12:0071cb144c7a	636	if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
JMF	12:0071cb144c7a	637	{
JMF	12:0071cb144c7a	638	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
JMF	12:0071cb144c7a	639	continue;
JMF	12:0071cb144c7a	640	}
JMF	12:0071cb144c7a	641
JMF	12:0071cb144c7a	642	/*
JMF	12:0071cb144c7a	643	* This avoids sending the client a cert it'll reject based on
JMF	12:0071cb144c7a	644	* keyUsage or other extensions.
JMF	12:0071cb144c7a	645	*
JMF	12:0071cb144c7a	646	* It also allows the user to provision different certificates for
JMF	12:0071cb144c7a	647	* different uses based on keyUsage, eg if they want to avoid signing
JMF	12:0071cb144c7a	648	* and decrypting with the same RSA key.
JMF	12:0071cb144c7a	649	*/
JMF	12:0071cb144c7a	650	if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
JMF	12:0071cb144c7a	651	MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
JMF	12:0071cb144c7a	652	{
JMF	12:0071cb144c7a	653	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
JMF	12:0071cb144c7a	654	"(extended) key usage extension" ) );
JMF	12:0071cb144c7a	655	continue;
JMF	12:0071cb144c7a	656	}
JMF	12:0071cb144c7a	657
JMF	12:0071cb144c7a	658	#if defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	659	if( pk_alg == MBEDTLS_PK_ECDSA &&
JMF	12:0071cb144c7a	660	ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
JMF	12:0071cb144c7a	661	{
JMF	12:0071cb144c7a	662	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
JMF	12:0071cb144c7a	663	continue;
JMF	12:0071cb144c7a	664	}
JMF	12:0071cb144c7a	665	#endif
JMF	12:0071cb144c7a	666
JMF	12:0071cb144c7a	667	/*
JMF	12:0071cb144c7a	668	* Try to select a SHA-1 certificate for pre-1.2 clients, but still
JMF	12:0071cb144c7a	669	* present them a SHA-higher cert rather than failing if it's the only
JMF	12:0071cb144c7a	670	* one we got that satisfies the other conditions.
JMF	12:0071cb144c7a	671	*/
JMF	12:0071cb144c7a	672	if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
JMF	12:0071cb144c7a	673	cur->cert->sig_md != MBEDTLS_MD_SHA1 )
JMF	12:0071cb144c7a	674	{
JMF	12:0071cb144c7a	675	if( fallback == NULL )
JMF	12:0071cb144c7a	676	fallback = cur;
JMF	12:0071cb144c7a	677	{
JMF	12:0071cb144c7a	678	MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
JMF	12:0071cb144c7a	679	"sha-2 with pre-TLS 1.2 client" ) );
JMF	12:0071cb144c7a	680	continue;
JMF	12:0071cb144c7a	681	}
JMF	12:0071cb144c7a	682	}
JMF	12:0071cb144c7a	683
JMF	12:0071cb144c7a	684	/* If we get there, we got a winner */
JMF	12:0071cb144c7a	685	break;
JMF	12:0071cb144c7a	686	}
JMF	12:0071cb144c7a	687
JMF	12:0071cb144c7a	688	if( cur == NULL )
JMF	12:0071cb144c7a	689	cur = fallback;
JMF	12:0071cb144c7a	690
JMF	12:0071cb144c7a	691	/* Do not update ssl->handshake->key_cert unless there is a match */
JMF	12:0071cb144c7a	692	if( cur != NULL )
JMF	12:0071cb144c7a	693	{
JMF	12:0071cb144c7a	694	ssl->handshake->key_cert = cur;
JMF	12:0071cb144c7a	695	MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
JMF	12:0071cb144c7a	696	ssl->handshake->key_cert->cert );
JMF	12:0071cb144c7a	697	return( 0 );
JMF	12:0071cb144c7a	698	}
JMF	12:0071cb144c7a	699
JMF	12:0071cb144c7a	700	return( -1 );
JMF	12:0071cb144c7a	701	}
JMF	12:0071cb144c7a	702	#endif /* MBEDTLS_X509_CRT_PARSE_C */
JMF	12:0071cb144c7a	703
JMF	12:0071cb144c7a	704	/*
JMF	12:0071cb144c7a	705	* Check if a given ciphersuite is suitable for use with our config/keys/etc
JMF	12:0071cb144c7a	706	* Sets ciphersuite_info only if the suite matches.
JMF	12:0071cb144c7a	707	*/
JMF	12:0071cb144c7a	708	static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
JMF	12:0071cb144c7a	709	const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
JMF	12:0071cb144c7a	710	{
JMF	12:0071cb144c7a	711	const mbedtls_ssl_ciphersuite_t *suite_info;
JMF	12:0071cb144c7a	712
JMF	12:0071cb144c7a	713	suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
JMF	12:0071cb144c7a	714	if( suite_info == NULL )
JMF	12:0071cb144c7a	715	{
JMF	12:0071cb144c7a	716	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	717	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	718	}
JMF	12:0071cb144c7a	719
JMF	12:0071cb144c7a	720	MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
JMF	12:0071cb144c7a	721
JMF	12:0071cb144c7a	722	if( suite_info->min_minor_ver > ssl->minor_ver \|\|
JMF	12:0071cb144c7a	723	suite_info->max_minor_ver < ssl->minor_ver )
JMF	12:0071cb144c7a	724	{
JMF	12:0071cb144c7a	725	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
JMF	12:0071cb144c7a	726	return( 0 );
JMF	12:0071cb144c7a	727	}
JMF	12:0071cb144c7a	728
JMF	12:0071cb144c7a	729	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	730	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
JMF	12:0071cb144c7a	731	( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
JMF	12:0071cb144c7a	732	return( 0 );
JMF	12:0071cb144c7a	733	#endif
JMF	12:0071cb144c7a	734
JMF	12:0071cb144c7a	735	#if defined(MBEDTLS_ARC4_C)
JMF	12:0071cb144c7a	736	if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
JMF	12:0071cb144c7a	737	suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
JMF	12:0071cb144c7a	738	{
JMF	12:0071cb144c7a	739	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
JMF	12:0071cb144c7a	740	return( 0 );
JMF	12:0071cb144c7a	741	}
JMF	12:0071cb144c7a	742	#endif
JMF	12:0071cb144c7a	743
JMF	12:0071cb144c7a	744	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	745	if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
JMF	12:0071cb144c7a	746	( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
JMF	12:0071cb144c7a	747	{
JMF	12:0071cb144c7a	748	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
JMF	12:0071cb144c7a	749	"not configured or ext missing" ) );
JMF	12:0071cb144c7a	750	return( 0 );
JMF	12:0071cb144c7a	751	}
JMF	12:0071cb144c7a	752	#endif
JMF	12:0071cb144c7a	753
JMF	12:0071cb144c7a	754
JMF	12:0071cb144c7a	755	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	756	if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
JMF	12:0071cb144c7a	757	( ssl->handshake->curves == NULL \|\|
JMF	12:0071cb144c7a	758	ssl->handshake->curves[0] == NULL ) )
JMF	12:0071cb144c7a	759	{
JMF	12:0071cb144c7a	760	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
JMF	12:0071cb144c7a	761	"no common elliptic curve" ) );
JMF	12:0071cb144c7a	762	return( 0 );
JMF	12:0071cb144c7a	763	}
JMF	12:0071cb144c7a	764	#endif
JMF	12:0071cb144c7a	765
JMF	12:0071cb144c7a	766	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
JMF	12:0071cb144c7a	767	/* If the ciphersuite requires a pre-shared key and we don't
JMF	12:0071cb144c7a	768	* have one, skip it now rather than failing later */
JMF	12:0071cb144c7a	769	if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
JMF	12:0071cb144c7a	770	ssl->conf->f_psk == NULL &&
JMF	12:0071cb144c7a	771	( ssl->conf->psk == NULL \|\| ssl->conf->psk_identity == NULL \|\|
JMF	12:0071cb144c7a	772	ssl->conf->psk_identity_len == 0 \|\| ssl->conf->psk_len == 0 ) )
JMF	12:0071cb144c7a	773	{
JMF	12:0071cb144c7a	774	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
JMF	12:0071cb144c7a	775	return( 0 );
JMF	12:0071cb144c7a	776	}
JMF	12:0071cb144c7a	777	#endif
JMF	12:0071cb144c7a	778
JMF	12:0071cb144c7a	779	#if defined(MBEDTLS_X509_CRT_PARSE_C)
JMF	12:0071cb144c7a	780	/*
JMF	12:0071cb144c7a	781	* Final check: if ciphersuite requires us to have a
JMF	12:0071cb144c7a	782	* certificate/key of a particular type:
JMF	12:0071cb144c7a	783	* - select the appropriate certificate if we have one, or
JMF	12:0071cb144c7a	784	* - try the next ciphersuite if we don't
JMF	12:0071cb144c7a	785	* This must be done last since we modify the key_cert list.
JMF	12:0071cb144c7a	786	*/
JMF	12:0071cb144c7a	787	if( ssl_pick_cert( ssl, suite_info ) != 0 )
JMF	12:0071cb144c7a	788	{
JMF	12:0071cb144c7a	789	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
JMF	12:0071cb144c7a	790	"no suitable certificate" ) );
JMF	12:0071cb144c7a	791	return( 0 );
JMF	12:0071cb144c7a	792	}
JMF	12:0071cb144c7a	793	#endif
JMF	12:0071cb144c7a	794
JMF	12:0071cb144c7a	795	*ciphersuite_info = suite_info;
JMF	12:0071cb144c7a	796	return( 0 );
JMF	12:0071cb144c7a	797	}
JMF	12:0071cb144c7a	798
JMF	12:0071cb144c7a	799	#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
JMF	12:0071cb144c7a	800	static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	801	{
JMF	12:0071cb144c7a	802	int ret, got_common_suite;
JMF	12:0071cb144c7a	803	unsigned int i, j;
JMF	12:0071cb144c7a	804	size_t n;
JMF	12:0071cb144c7a	805	unsigned int ciph_len, sess_len, chal_len;
JMF	12:0071cb144c7a	806	unsigned char buf, p;
JMF	12:0071cb144c7a	807	const int *ciphersuites;
JMF	12:0071cb144c7a	808	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
JMF	12:0071cb144c7a	809
JMF	12:0071cb144c7a	810	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
JMF	12:0071cb144c7a	811
JMF	12:0071cb144c7a	812	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	813	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	814	{
JMF	12:0071cb144c7a	815	MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
JMF	12:0071cb144c7a	816
JMF	12:0071cb144c7a	817	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	818	return( ret );
JMF	12:0071cb144c7a	819
JMF	12:0071cb144c7a	820	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	821	}
JMF	12:0071cb144c7a	822	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	823
JMF	12:0071cb144c7a	824	buf = ssl->in_hdr;
JMF	12:0071cb144c7a	825
JMF	12:0071cb144c7a	826	MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
JMF	12:0071cb144c7a	827
JMF	12:0071cb144c7a	828	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
JMF	12:0071cb144c7a	829	buf[2] ) );
JMF	12:0071cb144c7a	830	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
JMF	12:0071cb144c7a	831	( ( buf[0] & 0x7F ) << 8 ) \| buf[1] ) );
JMF	12:0071cb144c7a	832	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
JMF	12:0071cb144c7a	833	buf[3], buf[4] ) );
JMF	12:0071cb144c7a	834
JMF	12:0071cb144c7a	835	/*
JMF	12:0071cb144c7a	836	* SSLv2 Client Hello
JMF	12:0071cb144c7a	837	*
JMF	12:0071cb144c7a	838	* Record layer:
JMF	12:0071cb144c7a	839	* 0 . 1 message length
JMF	12:0071cb144c7a	840	*
JMF	12:0071cb144c7a	841	* SSL layer:
JMF	12:0071cb144c7a	842	* 2 . 2 message type
JMF	12:0071cb144c7a	843	* 3 . 4 protocol version
JMF	12:0071cb144c7a	844	*/
JMF	12:0071cb144c7a	845	if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO \|\|
JMF	12:0071cb144c7a	846	buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
JMF	12:0071cb144c7a	847	{
JMF	12:0071cb144c7a	848	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	849	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	850	}
JMF	12:0071cb144c7a	851
JMF	12:0071cb144c7a	852	n = ( ( buf[0] << 8 ) \| buf[1] ) & 0x7FFF;
JMF	12:0071cb144c7a	853
JMF	12:0071cb144c7a	854	if( n < 17 \|\| n > 512 )
JMF	12:0071cb144c7a	855	{
JMF	12:0071cb144c7a	856	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	857	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	858	}
JMF	12:0071cb144c7a	859
JMF	12:0071cb144c7a	860	ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
JMF	12:0071cb144c7a	861	ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
JMF	12:0071cb144c7a	862	? buf[4] : ssl->conf->max_minor_ver;
JMF	12:0071cb144c7a	863
JMF	12:0071cb144c7a	864	if( ssl->minor_ver < ssl->conf->min_minor_ver )
JMF	12:0071cb144c7a	865	{
JMF	12:0071cb144c7a	866	MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
JMF	12:0071cb144c7a	867	" [%d:%d] < [%d:%d]",
JMF	12:0071cb144c7a	868	ssl->major_ver, ssl->minor_ver,
JMF	12:0071cb144c7a	869	ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
JMF	12:0071cb144c7a	870
JMF	12:0071cb144c7a	871	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	872	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	873	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	874	}
JMF	12:0071cb144c7a	875
JMF	12:0071cb144c7a	876	ssl->handshake->max_major_ver = buf[3];
JMF	12:0071cb144c7a	877	ssl->handshake->max_minor_ver = buf[4];
JMF	12:0071cb144c7a	878
JMF	12:0071cb144c7a	879	if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
JMF	12:0071cb144c7a	880	{
JMF	12:0071cb144c7a	881	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
JMF	12:0071cb144c7a	882	return( ret );
JMF	12:0071cb144c7a	883	}
JMF	12:0071cb144c7a	884
JMF	12:0071cb144c7a	885	ssl->handshake->update_checksum( ssl, buf + 2, n );
JMF	12:0071cb144c7a	886
JMF	12:0071cb144c7a	887	buf = ssl->in_msg;
JMF	12:0071cb144c7a	888	n = ssl->in_left - 5;
JMF	12:0071cb144c7a	889
JMF	12:0071cb144c7a	890	/*
JMF	12:0071cb144c7a	891	* 0 . 1 ciphersuitelist length
JMF	12:0071cb144c7a	892	* 2 . 3 session id length
JMF	12:0071cb144c7a	893	* 4 . 5 challenge length
JMF	12:0071cb144c7a	894	* 6 . .. ciphersuitelist
JMF	12:0071cb144c7a	895	* .. . .. session id
JMF	12:0071cb144c7a	896	* .. . .. challenge
JMF	12:0071cb144c7a	897	*/
JMF	12:0071cb144c7a	898	MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
JMF	12:0071cb144c7a	899
JMF	12:0071cb144c7a	900	ciph_len = ( buf[0] << 8 ) \| buf[1];
JMF	12:0071cb144c7a	901	sess_len = ( buf[2] << 8 ) \| buf[3];
JMF	12:0071cb144c7a	902	chal_len = ( buf[4] << 8 ) \| buf[5];
JMF	12:0071cb144c7a	903
JMF	12:0071cb144c7a	904	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
JMF	12:0071cb144c7a	905	ciph_len, sess_len, chal_len ) );
JMF	12:0071cb144c7a	906
JMF	12:0071cb144c7a	907	/*
JMF	12:0071cb144c7a	908	* Make sure each parameter length is valid
JMF	12:0071cb144c7a	909	*/
JMF	12:0071cb144c7a	910	if( ciph_len < 3 \|\| ( ciph_len % 3 ) != 0 )
JMF	12:0071cb144c7a	911	{
JMF	12:0071cb144c7a	912	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	913	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	914	}
JMF	12:0071cb144c7a	915
JMF	12:0071cb144c7a	916	if( sess_len > 32 )
JMF	12:0071cb144c7a	917	{
JMF	12:0071cb144c7a	918	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	919	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	920	}
JMF	12:0071cb144c7a	921
JMF	12:0071cb144c7a	922	if( chal_len < 8 \|\| chal_len > 32 )
JMF	12:0071cb144c7a	923	{
JMF	12:0071cb144c7a	924	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	925	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	926	}
JMF	12:0071cb144c7a	927
JMF	12:0071cb144c7a	928	if( n != 6 + ciph_len + sess_len + chal_len )
JMF	12:0071cb144c7a	929	{
JMF	12:0071cb144c7a	930	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	931	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	932	}
JMF	12:0071cb144c7a	933
JMF	12:0071cb144c7a	934	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
JMF	12:0071cb144c7a	935	buf + 6, ciph_len );
JMF	12:0071cb144c7a	936	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
JMF	12:0071cb144c7a	937	buf + 6 + ciph_len, sess_len );
JMF	12:0071cb144c7a	938	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
JMF	12:0071cb144c7a	939	buf + 6 + ciph_len + sess_len, chal_len );
JMF	12:0071cb144c7a	940
JMF	12:0071cb144c7a	941	p = buf + 6 + ciph_len;
JMF	12:0071cb144c7a	942	ssl->session_negotiate->id_len = sess_len;
JMF	12:0071cb144c7a	943	memset( ssl->session_negotiate->id, 0,
JMF	12:0071cb144c7a	944	sizeof( ssl->session_negotiate->id ) );
JMF	12:0071cb144c7a	945	memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
JMF	12:0071cb144c7a	946
JMF	12:0071cb144c7a	947	p += sess_len;
JMF	12:0071cb144c7a	948	memset( ssl->handshake->randbytes, 0, 64 );
JMF	12:0071cb144c7a	949	memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
JMF	12:0071cb144c7a	950
JMF	12:0071cb144c7a	951	/*
JMF	12:0071cb144c7a	952	* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
JMF	12:0071cb144c7a	953	*/
JMF	12:0071cb144c7a	954	for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
JMF	12:0071cb144c7a	955	{
JMF	12:0071cb144c7a	956	if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
JMF	12:0071cb144c7a	957	{
JMF	12:0071cb144c7a	958	MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
JMF	12:0071cb144c7a	959	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	960	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
JMF	12:0071cb144c7a	961	{
JMF	12:0071cb144c7a	962	MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
JMF	12:0071cb144c7a	963	"during renegotiation" ) );
JMF	12:0071cb144c7a	964
JMF	12:0071cb144c7a	965	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	966	return( ret );
JMF	12:0071cb144c7a	967
JMF	12:0071cb144c7a	968	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	969	}
JMF	12:0071cb144c7a	970	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	971	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
JMF	12:0071cb144c7a	972	break;
JMF	12:0071cb144c7a	973	}
JMF	12:0071cb144c7a	974	}
JMF	12:0071cb144c7a	975
JMF	12:0071cb144c7a	976	#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
JMF	12:0071cb144c7a	977	for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
JMF	12:0071cb144c7a	978	{
JMF	12:0071cb144c7a	979	if( p[0] == 0 &&
JMF	12:0071cb144c7a	980	p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
JMF	12:0071cb144c7a	981	p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
JMF	12:0071cb144c7a	982	{
JMF	12:0071cb144c7a	983	MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
JMF	12:0071cb144c7a	984
JMF	12:0071cb144c7a	985	if( ssl->minor_ver < ssl->conf->max_minor_ver )
JMF	12:0071cb144c7a	986	{
JMF	12:0071cb144c7a	987	MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
JMF	12:0071cb144c7a	988
JMF	12:0071cb144c7a	989	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	990	MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
JMF	12:0071cb144c7a	991
JMF	12:0071cb144c7a	992	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	993	}
JMF	12:0071cb144c7a	994
JMF	12:0071cb144c7a	995	break;
JMF	12:0071cb144c7a	996	}
JMF	12:0071cb144c7a	997	}
JMF	12:0071cb144c7a	998	#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
JMF	12:0071cb144c7a	999
JMF	12:0071cb144c7a	1000	got_common_suite = 0;
JMF	12:0071cb144c7a	1001	ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
JMF	12:0071cb144c7a	1002	ciphersuite_info = NULL;
JMF	12:0071cb144c7a	1003	#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
JMF	12:0071cb144c7a	1004	for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
JMF	12:0071cb144c7a	1005	{
JMF	12:0071cb144c7a	1006	for( i = 0; ciphersuites[i] != 0; i++ )
JMF	12:0071cb144c7a	1007	#else
JMF	12:0071cb144c7a	1008	for( i = 0; ciphersuites[i] != 0; i++ )
JMF	12:0071cb144c7a	1009	{
JMF	12:0071cb144c7a	1010	for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
JMF	12:0071cb144c7a	1011	#endif
JMF	12:0071cb144c7a	1012	{
JMF	12:0071cb144c7a	1013	if( p[0] != 0 \|\|
JMF	12:0071cb144c7a	1014	p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) \|\|
JMF	12:0071cb144c7a	1015	p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
JMF	12:0071cb144c7a	1016	continue;
JMF	12:0071cb144c7a	1017
JMF	12:0071cb144c7a	1018	got_common_suite = 1;
JMF	12:0071cb144c7a	1019
JMF	12:0071cb144c7a	1020	if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
JMF	12:0071cb144c7a	1021	&ciphersuite_info ) ) != 0 )
JMF	12:0071cb144c7a	1022	return( ret );
JMF	12:0071cb144c7a	1023
JMF	12:0071cb144c7a	1024	if( ciphersuite_info != NULL )
JMF	12:0071cb144c7a	1025	goto have_ciphersuite_v2;
JMF	12:0071cb144c7a	1026	}
JMF	12:0071cb144c7a	1027	}
JMF	12:0071cb144c7a	1028
JMF	12:0071cb144c7a	1029	if( got_common_suite )
JMF	12:0071cb144c7a	1030	{
JMF	12:0071cb144c7a	1031	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
JMF	12:0071cb144c7a	1032	"but none of them usable" ) );
JMF	12:0071cb144c7a	1033	return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
JMF	12:0071cb144c7a	1034	}
JMF	12:0071cb144c7a	1035	else
JMF	12:0071cb144c7a	1036	{
JMF	12:0071cb144c7a	1037	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
JMF	12:0071cb144c7a	1038	return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
JMF	12:0071cb144c7a	1039	}
JMF	12:0071cb144c7a	1040
JMF	12:0071cb144c7a	1041	have_ciphersuite_v2:
JMF	12:0071cb144c7a	1042	MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
JMF	12:0071cb144c7a	1043
JMF	12:0071cb144c7a	1044	ssl->session_negotiate->ciphersuite = ciphersuites[i];
JMF	12:0071cb144c7a	1045	ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
JMF	12:0071cb144c7a	1046	mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
JMF	12:0071cb144c7a	1047
JMF	12:0071cb144c7a	1048	/*
JMF	12:0071cb144c7a	1049	* SSLv2 Client Hello relevant renegotiation security checks
JMF	12:0071cb144c7a	1050	*/
JMF	12:0071cb144c7a	1051	if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
JMF	12:0071cb144c7a	1052	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
JMF	12:0071cb144c7a	1053	{
JMF	12:0071cb144c7a	1054	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
JMF	12:0071cb144c7a	1055
JMF	12:0071cb144c7a	1056	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1057	return( ret );
JMF	12:0071cb144c7a	1058
JMF	12:0071cb144c7a	1059	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1060	}
JMF	12:0071cb144c7a	1061
JMF	12:0071cb144c7a	1062	ssl->in_left = 0;
JMF	12:0071cb144c7a	1063	ssl->state++;
JMF	12:0071cb144c7a	1064
JMF	12:0071cb144c7a	1065	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
JMF	12:0071cb144c7a	1066
JMF	12:0071cb144c7a	1067	return( 0 );
JMF	12:0071cb144c7a	1068	}
JMF	12:0071cb144c7a	1069	#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
JMF	12:0071cb144c7a	1070
JMF	12:0071cb144c7a	1071	static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	1072	{
JMF	12:0071cb144c7a	1073	int ret, got_common_suite;
JMF	12:0071cb144c7a	1074	size_t i, j;
JMF	12:0071cb144c7a	1075	size_t ciph_offset, comp_offset, ext_offset;
JMF	12:0071cb144c7a	1076	size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
JMF	12:0071cb144c7a	1077	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1078	size_t cookie_offset, cookie_len;
JMF	12:0071cb144c7a	1079	#endif
JMF	12:0071cb144c7a	1080	unsigned char buf, p, *ext;
JMF	12:0071cb144c7a	1081	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1082	int renegotiation_info_seen = 0;
JMF	12:0071cb144c7a	1083	#endif
JMF	12:0071cb144c7a	1084	int handshake_failure = 0;
JMF	12:0071cb144c7a	1085	const int *ciphersuites;
JMF	12:0071cb144c7a	1086	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
JMF	12:0071cb144c7a	1087	int major, minor;
JMF	12:0071cb144c7a	1088
JMF	12:0071cb144c7a	1089	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
JMF	12:0071cb144c7a	1090
JMF	12:0071cb144c7a	1091	#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
JMF	12:0071cb144c7a	1092	read_record_header:
JMF	12:0071cb144c7a	1093	#endif
JMF	12:0071cb144c7a	1094	/*
JMF	12:0071cb144c7a	1095	* If renegotiating, then the input was read with mbedtls_ssl_read_record(),
JMF	12:0071cb144c7a	1096	* otherwise read it ourselves manually in order to support SSLv2
JMF	12:0071cb144c7a	1097	* ClientHello, which doesn't use the same record layer format.
JMF	12:0071cb144c7a	1098	*/
JMF	12:0071cb144c7a	1099	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1100	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	1101	#endif
JMF	12:0071cb144c7a	1102	{
JMF	12:0071cb144c7a	1103	if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
JMF	12:0071cb144c7a	1104	{
JMF	12:0071cb144c7a	1105	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
JMF	12:0071cb144c7a	1106	return( ret );
JMF	12:0071cb144c7a	1107	}
JMF	12:0071cb144c7a	1108	}
JMF	12:0071cb144c7a	1109
JMF	12:0071cb144c7a	1110	buf = ssl->in_hdr;
JMF	12:0071cb144c7a	1111
JMF	12:0071cb144c7a	1112	#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
JMF	12:0071cb144c7a	1113	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1114	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
JMF	12:0071cb144c7a	1115	#endif
JMF	12:0071cb144c7a	1116	if( ( buf[0] & 0x80 ) != 0 )
JMF	12:0071cb144c7a	1117	return ssl_parse_client_hello_v2( ssl );
JMF	12:0071cb144c7a	1118	#endif
JMF	12:0071cb144c7a	1119
JMF	12:0071cb144c7a	1120	MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
JMF	12:0071cb144c7a	1121
JMF	12:0071cb144c7a	1122	/*
JMF	12:0071cb144c7a	1123	* SSLv3/TLS Client Hello
JMF	12:0071cb144c7a	1124	*
JMF	12:0071cb144c7a	1125	* Record layer:
JMF	12:0071cb144c7a	1126	* 0 . 0 message type
JMF	12:0071cb144c7a	1127	* 1 . 2 protocol version
JMF	12:0071cb144c7a	1128	* 3 . 11 DTLS: epoch + record sequence number
JMF	12:0071cb144c7a	1129	* 3 . 4 message length
JMF	12:0071cb144c7a	1130	*/
JMF	12:0071cb144c7a	1131	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
JMF	12:0071cb144c7a	1132	buf[0] ) );
JMF	12:0071cb144c7a	1133
JMF	12:0071cb144c7a	1134	if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	1135	{
JMF	12:0071cb144c7a	1136	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1137	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1138	}
JMF	12:0071cb144c7a	1139
JMF	12:0071cb144c7a	1140	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
JMF	12:0071cb144c7a	1141	( ssl->in_len[0] << 8 ) \| ssl->in_len[1] ) );
JMF	12:0071cb144c7a	1142
JMF	12:0071cb144c7a	1143	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
JMF	12:0071cb144c7a	1144	buf[1], buf[2] ) );
JMF	12:0071cb144c7a	1145
JMF	12:0071cb144c7a	1146	mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
JMF	12:0071cb144c7a	1147
JMF	12:0071cb144c7a	1148	/* According to RFC 5246 Appendix E.1, the version here is typically
JMF	12:0071cb144c7a	1149	* "{03,00}, the lowest version number supported by the client, [or] the
JMF	12:0071cb144c7a	1150	* value of ClientHello.client_version", so the only meaningful check here
JMF	12:0071cb144c7a	1151	* is the major version shouldn't be less than 3 */
JMF	12:0071cb144c7a	1152	if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
JMF	12:0071cb144c7a	1153	{
JMF	12:0071cb144c7a	1154	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1155	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1156	}
JMF	12:0071cb144c7a	1157
JMF	12:0071cb144c7a	1158	/* For DTLS if this is the initial handshake, remember the client sequence
JMF	12:0071cb144c7a	1159	* number to use it in our next message (RFC 6347 4.2.1) */
JMF	12:0071cb144c7a	1160	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1161	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
JMF	12:0071cb144c7a	1162	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1163	&& ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
JMF	12:0071cb144c7a	1164	#endif
JMF	12:0071cb144c7a	1165	)
JMF	12:0071cb144c7a	1166	{
JMF	12:0071cb144c7a	1167	/* Epoch should be 0 for initial handshakes */
JMF	12:0071cb144c7a	1168	if( ssl->in_ctr[0] != 0 \|\| ssl->in_ctr[1] != 0 )
JMF	12:0071cb144c7a	1169	{
JMF	12:0071cb144c7a	1170	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1171	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1172	}
JMF	12:0071cb144c7a	1173
JMF	12:0071cb144c7a	1174	memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
JMF	12:0071cb144c7a	1175
JMF	12:0071cb144c7a	1176	#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
JMF	12:0071cb144c7a	1177	if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
JMF	12:0071cb144c7a	1178	{
JMF	12:0071cb144c7a	1179	MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
JMF	12:0071cb144c7a	1180	ssl->next_record_offset = 0;
JMF	12:0071cb144c7a	1181	ssl->in_left = 0;
JMF	12:0071cb144c7a	1182	goto read_record_header;
JMF	12:0071cb144c7a	1183	}
JMF	12:0071cb144c7a	1184
JMF	12:0071cb144c7a	1185	/* No MAC to check yet, so we can update right now */
JMF	12:0071cb144c7a	1186	mbedtls_ssl_dtls_replay_update( ssl );
JMF	12:0071cb144c7a	1187	#endif
JMF	12:0071cb144c7a	1188	}
JMF	12:0071cb144c7a	1189	#endif /* MBEDTLS_SSL_PROTO_DTLS */
JMF	12:0071cb144c7a	1190
JMF	12:0071cb144c7a	1191	msg_len = ( ssl->in_len[0] << 8 ) \| ssl->in_len[1];
JMF	12:0071cb144c7a	1192
JMF	12:0071cb144c7a	1193	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1194	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	1195	{
JMF	12:0071cb144c7a	1196	/* Set by mbedtls_ssl_read_record() */
JMF	12:0071cb144c7a	1197	msg_len = ssl->in_hslen;
JMF	12:0071cb144c7a	1198	}
JMF	12:0071cb144c7a	1199	else
JMF	12:0071cb144c7a	1200	#endif
JMF	12:0071cb144c7a	1201	{
JMF	12:0071cb144c7a	1202	if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
JMF	12:0071cb144c7a	1203	{
JMF	12:0071cb144c7a	1204	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1205	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1206	}
JMF	12:0071cb144c7a	1207
JMF	12:0071cb144c7a	1208	if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
JMF	12:0071cb144c7a	1209	{
JMF	12:0071cb144c7a	1210	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
JMF	12:0071cb144c7a	1211	return( ret );
JMF	12:0071cb144c7a	1212	}
JMF	12:0071cb144c7a	1213
JMF	12:0071cb144c7a	1214	/* Done reading this record, get ready for the next one */
JMF	12:0071cb144c7a	1215	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1216	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1217	ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
JMF	12:0071cb144c7a	1218	else
JMF	12:0071cb144c7a	1219	#endif
JMF	12:0071cb144c7a	1220	ssl->in_left = 0;
JMF	12:0071cb144c7a	1221	}
JMF	12:0071cb144c7a	1222
JMF	12:0071cb144c7a	1223	buf = ssl->in_msg;
JMF	12:0071cb144c7a	1224
JMF	12:0071cb144c7a	1225	MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
JMF	12:0071cb144c7a	1226
JMF	12:0071cb144c7a	1227	ssl->handshake->update_checksum( ssl, buf, msg_len );
JMF	12:0071cb144c7a	1228
JMF	12:0071cb144c7a	1229	/*
JMF	12:0071cb144c7a	1230	* Handshake layer:
JMF	12:0071cb144c7a	1231	* 0 . 0 handshake type
JMF	12:0071cb144c7a	1232	* 1 . 3 handshake length
JMF	12:0071cb144c7a	1233	* 4 . 5 DTLS only: message seqence number
JMF	12:0071cb144c7a	1234	* 6 . 8 DTLS only: fragment offset
JMF	12:0071cb144c7a	1235	* 9 . 11 DTLS only: fragment length
JMF	12:0071cb144c7a	1236	*/
JMF	12:0071cb144c7a	1237	if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
JMF	12:0071cb144c7a	1238	{
JMF	12:0071cb144c7a	1239	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1240	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1241	}
JMF	12:0071cb144c7a	1242
JMF	12:0071cb144c7a	1243	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
JMF	12:0071cb144c7a	1244
JMF	12:0071cb144c7a	1245	if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
JMF	12:0071cb144c7a	1246	{
JMF	12:0071cb144c7a	1247	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1248	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1249	}
JMF	12:0071cb144c7a	1250
JMF	12:0071cb144c7a	1251	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
JMF	12:0071cb144c7a	1252	( buf[1] << 16 ) \| ( buf[2] << 8 ) \| buf[3] ) );
JMF	12:0071cb144c7a	1253
JMF	12:0071cb144c7a	1254	/* We don't support fragmentation of ClientHello (yet?) */
JMF	12:0071cb144c7a	1255	if( buf[1] != 0 \|\|
JMF	12:0071cb144c7a	1256	msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) \| buf[3] ) )
JMF	12:0071cb144c7a	1257	{
JMF	12:0071cb144c7a	1258	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1259	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1260	}
JMF	12:0071cb144c7a	1261
JMF	12:0071cb144c7a	1262	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1263	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1264	{
JMF	12:0071cb144c7a	1265	/*
JMF	12:0071cb144c7a	1266	* Copy the client's handshake message_seq on initial handshakes,
JMF	12:0071cb144c7a	1267	* check sequence number on renego.
JMF	12:0071cb144c7a	1268	*/
JMF	12:0071cb144c7a	1269	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1270	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
JMF	12:0071cb144c7a	1271	{
JMF	12:0071cb144c7a	1272	/* This couldn't be done in ssl_prepare_handshake_record() */
JMF	12:0071cb144c7a	1273	unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) \|
JMF	12:0071cb144c7a	1274	ssl->in_msg[5];
JMF	12:0071cb144c7a	1275
JMF	12:0071cb144c7a	1276	if( cli_msg_seq != ssl->handshake->in_msg_seq )
JMF	12:0071cb144c7a	1277	{
JMF	12:0071cb144c7a	1278	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
JMF	12:0071cb144c7a	1279	"%d (expected %d)", cli_msg_seq,
JMF	12:0071cb144c7a	1280	ssl->handshake->in_msg_seq ) );
JMF	12:0071cb144c7a	1281	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1282	}
JMF	12:0071cb144c7a	1283
JMF	12:0071cb144c7a	1284	ssl->handshake->in_msg_seq++;
JMF	12:0071cb144c7a	1285	}
JMF	12:0071cb144c7a	1286	else
JMF	12:0071cb144c7a	1287	#endif
JMF	12:0071cb144c7a	1288	{
JMF	12:0071cb144c7a	1289	unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) \|
JMF	12:0071cb144c7a	1290	ssl->in_msg[5];
JMF	12:0071cb144c7a	1291	ssl->handshake->out_msg_seq = cli_msg_seq;
JMF	12:0071cb144c7a	1292	ssl->handshake->in_msg_seq = cli_msg_seq + 1;
JMF	12:0071cb144c7a	1293	}
JMF	12:0071cb144c7a	1294
JMF	12:0071cb144c7a	1295	/*
JMF	12:0071cb144c7a	1296	* For now we don't support fragmentation, so make sure
JMF	12:0071cb144c7a	1297	* fragment_offset == 0 and fragment_length == length
JMF	12:0071cb144c7a	1298	*/
JMF	12:0071cb144c7a	1299	if( ssl->in_msg[6] != 0 \|\| ssl->in_msg[7] != 0 \|\| ssl->in_msg[8] != 0 \|\|
JMF	12:0071cb144c7a	1300	memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
JMF	12:0071cb144c7a	1301	{
JMF	12:0071cb144c7a	1302	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
JMF	12:0071cb144c7a	1303	return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
JMF	12:0071cb144c7a	1304	}
JMF	12:0071cb144c7a	1305	}
JMF	12:0071cb144c7a	1306	#endif /* MBEDTLS_SSL_PROTO_DTLS */
JMF	12:0071cb144c7a	1307
JMF	12:0071cb144c7a	1308	buf += mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	1309	msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	1310
JMF	12:0071cb144c7a	1311	/*
JMF	12:0071cb144c7a	1312	* ClientHello layer:
JMF	12:0071cb144c7a	1313	* 0 . 1 protocol version
JMF	12:0071cb144c7a	1314	* 2 . 33 random bytes (starting with 4 bytes of Unix time)
JMF	12:0071cb144c7a	1315	* 34 . 35 session id length (1 byte)
JMF	12:0071cb144c7a	1316	* 35 . 34+x session id
JMF	12:0071cb144c7a	1317	* 35+x . 35+x DTLS only: cookie length (1 byte)
JMF	12:0071cb144c7a	1318	* 36+x . .. DTLS only: cookie
JMF	12:0071cb144c7a	1319	* .. . .. ciphersuite list length (2 bytes)
JMF	12:0071cb144c7a	1320	* .. . .. ciphersuite list
JMF	12:0071cb144c7a	1321	* .. . .. compression alg. list length (1 byte)
JMF	12:0071cb144c7a	1322	* .. . .. compression alg. list
JMF	12:0071cb144c7a	1323	* .. . .. extensions length (2 bytes, optional)
JMF	12:0071cb144c7a	1324	* .. . .. extensions (optional)
JMF	12:0071cb144c7a	1325	*/
JMF	12:0071cb144c7a	1326
JMF	12:0071cb144c7a	1327	/*
JMF	12:0071cb144c7a	1328	* Minimal length (with everything empty and extensions ommitted) is
JMF	12:0071cb144c7a	1329	* 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
JMF	12:0071cb144c7a	1330	* read at least up to session id length without worrying.
JMF	12:0071cb144c7a	1331	*/
JMF	12:0071cb144c7a	1332	if( msg_len < 38 )
JMF	12:0071cb144c7a	1333	{
JMF	12:0071cb144c7a	1334	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1335	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1336	}
JMF	12:0071cb144c7a	1337
JMF	12:0071cb144c7a	1338	/*
JMF	12:0071cb144c7a	1339	* Check and save the protocol version
JMF	12:0071cb144c7a	1340	*/
JMF	12:0071cb144c7a	1341	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
JMF	12:0071cb144c7a	1342
JMF	12:0071cb144c7a	1343	mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
JMF	12:0071cb144c7a	1344	ssl->conf->transport, buf );
JMF	12:0071cb144c7a	1345
JMF	12:0071cb144c7a	1346	ssl->handshake->max_major_ver = ssl->major_ver;
JMF	12:0071cb144c7a	1347	ssl->handshake->max_minor_ver = ssl->minor_ver;
JMF	12:0071cb144c7a	1348
JMF	12:0071cb144c7a	1349	if( ssl->major_ver < ssl->conf->min_major_ver \|\|
JMF	12:0071cb144c7a	1350	ssl->minor_ver < ssl->conf->min_minor_ver )
JMF	12:0071cb144c7a	1351	{
JMF	12:0071cb144c7a	1352	MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
JMF	12:0071cb144c7a	1353	" [%d:%d] < [%d:%d]",
JMF	12:0071cb144c7a	1354	ssl->major_ver, ssl->minor_ver,
JMF	12:0071cb144c7a	1355	ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
JMF	12:0071cb144c7a	1356
JMF	12:0071cb144c7a	1357	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	1358	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	1359
JMF	12:0071cb144c7a	1360	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
JMF	12:0071cb144c7a	1361	}
JMF	12:0071cb144c7a	1362
JMF	12:0071cb144c7a	1363	if( ssl->major_ver > ssl->conf->max_major_ver )
JMF	12:0071cb144c7a	1364	{
JMF	12:0071cb144c7a	1365	ssl->major_ver = ssl->conf->max_major_ver;
JMF	12:0071cb144c7a	1366	ssl->minor_ver = ssl->conf->max_minor_ver;
JMF	12:0071cb144c7a	1367	}
JMF	12:0071cb144c7a	1368	else if( ssl->minor_ver > ssl->conf->max_minor_ver )
JMF	12:0071cb144c7a	1369	ssl->minor_ver = ssl->conf->max_minor_ver;
JMF	12:0071cb144c7a	1370
JMF	12:0071cb144c7a	1371	/*
JMF	12:0071cb144c7a	1372	* Save client random (inc. Unix time)
JMF	12:0071cb144c7a	1373	*/
JMF	12:0071cb144c7a	1374	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
JMF	12:0071cb144c7a	1375
JMF	12:0071cb144c7a	1376	memcpy( ssl->handshake->randbytes, buf + 2, 32 );
JMF	12:0071cb144c7a	1377
JMF	12:0071cb144c7a	1378	/*
JMF	12:0071cb144c7a	1379	* Check the session ID length and save session ID
JMF	12:0071cb144c7a	1380	*/
JMF	12:0071cb144c7a	1381	sess_len = buf[34];
JMF	12:0071cb144c7a	1382
JMF	12:0071cb144c7a	1383	if( sess_len > sizeof( ssl->session_negotiate->id ) \|\|
JMF	12:0071cb144c7a	1384	sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
JMF	12:0071cb144c7a	1385	{
JMF	12:0071cb144c7a	1386	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1387	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1388	}
JMF	12:0071cb144c7a	1389
JMF	12:0071cb144c7a	1390	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
JMF	12:0071cb144c7a	1391
JMF	12:0071cb144c7a	1392	ssl->session_negotiate->id_len = sess_len;
JMF	12:0071cb144c7a	1393	memset( ssl->session_negotiate->id, 0,
JMF	12:0071cb144c7a	1394	sizeof( ssl->session_negotiate->id ) );
JMF	12:0071cb144c7a	1395	memcpy( ssl->session_negotiate->id, buf + 35,
JMF	12:0071cb144c7a	1396	ssl->session_negotiate->id_len );
JMF	12:0071cb144c7a	1397
JMF	12:0071cb144c7a	1398	/*
JMF	12:0071cb144c7a	1399	* Check the cookie length and content
JMF	12:0071cb144c7a	1400	*/
JMF	12:0071cb144c7a	1401	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1402	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1403	{
JMF	12:0071cb144c7a	1404	cookie_offset = 35 + sess_len;
JMF	12:0071cb144c7a	1405	cookie_len = buf[cookie_offset];
JMF	12:0071cb144c7a	1406
JMF	12:0071cb144c7a	1407	if( cookie_offset + 1 + cookie_len + 2 > msg_len )
JMF	12:0071cb144c7a	1408	{
JMF	12:0071cb144c7a	1409	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1410	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1411	}
JMF	12:0071cb144c7a	1412
JMF	12:0071cb144c7a	1413	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
JMF	12:0071cb144c7a	1414	buf + cookie_offset + 1, cookie_len );
JMF	12:0071cb144c7a	1415
JMF	12:0071cb144c7a	1416	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
JMF	12:0071cb144c7a	1417	if( ssl->conf->f_cookie_check != NULL
JMF	12:0071cb144c7a	1418	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1419	&& ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
JMF	12:0071cb144c7a	1420	#endif
JMF	12:0071cb144c7a	1421	)
JMF	12:0071cb144c7a	1422	{
JMF	12:0071cb144c7a	1423	if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
JMF	12:0071cb144c7a	1424	buf + cookie_offset + 1, cookie_len,
JMF	12:0071cb144c7a	1425	ssl->cli_id, ssl->cli_id_len ) != 0 )
JMF	12:0071cb144c7a	1426	{
JMF	12:0071cb144c7a	1427	MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
JMF	12:0071cb144c7a	1428	ssl->handshake->verify_cookie_len = 1;
JMF	12:0071cb144c7a	1429	}
JMF	12:0071cb144c7a	1430	else
JMF	12:0071cb144c7a	1431	{
JMF	12:0071cb144c7a	1432	MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
JMF	12:0071cb144c7a	1433	ssl->handshake->verify_cookie_len = 0;
JMF	12:0071cb144c7a	1434	}
JMF	12:0071cb144c7a	1435	}
JMF	12:0071cb144c7a	1436	else
JMF	12:0071cb144c7a	1437	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
JMF	12:0071cb144c7a	1438	{
JMF	12:0071cb144c7a	1439	/* We know we didn't send a cookie, so it should be empty */
JMF	12:0071cb144c7a	1440	if( cookie_len != 0 )
JMF	12:0071cb144c7a	1441	{
JMF	12:0071cb144c7a	1442	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1443	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1444	}
JMF	12:0071cb144c7a	1445
JMF	12:0071cb144c7a	1446	MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
JMF	12:0071cb144c7a	1447	}
JMF	12:0071cb144c7a	1448
JMF	12:0071cb144c7a	1449	/*
JMF	12:0071cb144c7a	1450	* Check the ciphersuitelist length (will be parsed later)
JMF	12:0071cb144c7a	1451	*/
JMF	12:0071cb144c7a	1452	ciph_offset = cookie_offset + 1 + cookie_len;
JMF	12:0071cb144c7a	1453	}
JMF	12:0071cb144c7a	1454	else
JMF	12:0071cb144c7a	1455	#endif /* MBEDTLS_SSL_PROTO_DTLS */
JMF	12:0071cb144c7a	1456	ciph_offset = 35 + sess_len;
JMF	12:0071cb144c7a	1457
JMF	12:0071cb144c7a	1458	ciph_len = ( buf[ciph_offset + 0] << 8 )
JMF	12:0071cb144c7a	1459	\| ( buf[ciph_offset + 1] );
JMF	12:0071cb144c7a	1460
JMF	12:0071cb144c7a	1461	if( ciph_len < 2 \|\|
JMF	12:0071cb144c7a	1462	ciph_len + 2 + ciph_offset + 1 > msg_len \|\| /* 1 for comp. alg. len */
JMF	12:0071cb144c7a	1463	( ciph_len % 2 ) != 0 )
JMF	12:0071cb144c7a	1464	{
JMF	12:0071cb144c7a	1465	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1466	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1467	}
JMF	12:0071cb144c7a	1468
JMF	12:0071cb144c7a	1469	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
JMF	12:0071cb144c7a	1470	buf + ciph_offset + 2, ciph_len );
JMF	12:0071cb144c7a	1471
JMF	12:0071cb144c7a	1472	/*
JMF	12:0071cb144c7a	1473	* Check the compression algorithms length and pick one
JMF	12:0071cb144c7a	1474	*/
JMF	12:0071cb144c7a	1475	comp_offset = ciph_offset + 2 + ciph_len;
JMF	12:0071cb144c7a	1476
JMF	12:0071cb144c7a	1477	comp_len = buf[comp_offset];
JMF	12:0071cb144c7a	1478
JMF	12:0071cb144c7a	1479	if( comp_len < 1 \|\|
JMF	12:0071cb144c7a	1480	comp_len > 16 \|\|
JMF	12:0071cb144c7a	1481	comp_len + comp_offset + 1 > msg_len )
JMF	12:0071cb144c7a	1482	{
JMF	12:0071cb144c7a	1483	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1484	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1485	}
JMF	12:0071cb144c7a	1486
JMF	12:0071cb144c7a	1487	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
JMF	12:0071cb144c7a	1488	buf + comp_offset + 1, comp_len );
JMF	12:0071cb144c7a	1489
JMF	12:0071cb144c7a	1490	ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
JMF	12:0071cb144c7a	1491	#if defined(MBEDTLS_ZLIB_SUPPORT)
JMF	12:0071cb144c7a	1492	for( i = 0; i < comp_len; ++i )
JMF	12:0071cb144c7a	1493	{
JMF	12:0071cb144c7a	1494	if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
JMF	12:0071cb144c7a	1495	{
JMF	12:0071cb144c7a	1496	ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
JMF	12:0071cb144c7a	1497	break;
JMF	12:0071cb144c7a	1498	}
JMF	12:0071cb144c7a	1499	}
JMF	12:0071cb144c7a	1500	#endif
JMF	12:0071cb144c7a	1501
JMF	12:0071cb144c7a	1502	/* See comments in ssl_write_client_hello() */
JMF	12:0071cb144c7a	1503	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1504	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1505	ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
JMF	12:0071cb144c7a	1506	#endif
JMF	12:0071cb144c7a	1507
JMF	12:0071cb144c7a	1508	/* Do not parse the extensions if the protocol is SSLv3 */
JMF	12:0071cb144c7a	1509	#if defined(MBEDTLS_SSL_PROTO_SSL3)
JMF	12:0071cb144c7a	1510	if( ( ssl->major_ver != 3 ) \|\| ( ssl->minor_ver != 0 ) )
JMF	12:0071cb144c7a	1511	{
JMF	12:0071cb144c7a	1512	#endif
JMF	12:0071cb144c7a	1513	/*
JMF	12:0071cb144c7a	1514	* Check the extension length
JMF	12:0071cb144c7a	1515	*/
JMF	12:0071cb144c7a	1516	ext_offset = comp_offset + 1 + comp_len;
JMF	12:0071cb144c7a	1517	if( msg_len > ext_offset )
JMF	12:0071cb144c7a	1518	{
JMF	12:0071cb144c7a	1519	if( msg_len < ext_offset + 2 )
JMF	12:0071cb144c7a	1520	{
JMF	12:0071cb144c7a	1521	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1522	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1523	}
JMF	12:0071cb144c7a	1524
JMF	12:0071cb144c7a	1525	ext_len = ( buf[ext_offset + 0] << 8 )
JMF	12:0071cb144c7a	1526	\| ( buf[ext_offset + 1] );
JMF	12:0071cb144c7a	1527
JMF	12:0071cb144c7a	1528	if( ( ext_len > 0 && ext_len < 4 ) \|\|
JMF	12:0071cb144c7a	1529	msg_len != ext_offset + 2 + ext_len )
JMF	12:0071cb144c7a	1530	{
JMF	12:0071cb144c7a	1531	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1532	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1533	}
JMF	12:0071cb144c7a	1534	}
JMF	12:0071cb144c7a	1535	else
JMF	12:0071cb144c7a	1536	ext_len = 0;
JMF	12:0071cb144c7a	1537
JMF	12:0071cb144c7a	1538	ext = buf + ext_offset + 2;
JMF	12:0071cb144c7a	1539	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
JMF	12:0071cb144c7a	1540
JMF	12:0071cb144c7a	1541	while( ext_len != 0 )
JMF	12:0071cb144c7a	1542	{
JMF	12:0071cb144c7a	1543	unsigned int ext_id = ( ( ext[0] << 8 )
JMF	12:0071cb144c7a	1544	\| ( ext[1] ) );
JMF	12:0071cb144c7a	1545	unsigned int ext_size = ( ( ext[2] << 8 )
JMF	12:0071cb144c7a	1546	\| ( ext[3] ) );
JMF	12:0071cb144c7a	1547
JMF	12:0071cb144c7a	1548	if( ext_size + 4 > ext_len )
JMF	12:0071cb144c7a	1549	{
JMF	12:0071cb144c7a	1550	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1551	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1552	}
JMF	12:0071cb144c7a	1553	switch( ext_id )
JMF	12:0071cb144c7a	1554	{
JMF	12:0071cb144c7a	1555	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	1556	case MBEDTLS_TLS_EXT_SERVERNAME:
JMF	12:0071cb144c7a	1557	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
JMF	12:0071cb144c7a	1558	if( ssl->conf->f_sni == NULL )
JMF	12:0071cb144c7a	1559	break;
JMF	12:0071cb144c7a	1560
JMF	12:0071cb144c7a	1561	ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1562	if( ret != 0 )
JMF	12:0071cb144c7a	1563	return( ret );
JMF	12:0071cb144c7a	1564	break;
JMF	12:0071cb144c7a	1565	#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
JMF	12:0071cb144c7a	1566
JMF	12:0071cb144c7a	1567	case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
JMF	12:0071cb144c7a	1568	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
JMF	12:0071cb144c7a	1569	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1570	renegotiation_info_seen = 1;
JMF	12:0071cb144c7a	1571	#endif
JMF	12:0071cb144c7a	1572
JMF	12:0071cb144c7a	1573	ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1574	if( ret != 0 )
JMF	12:0071cb144c7a	1575	return( ret );
JMF	12:0071cb144c7a	1576	break;
JMF	12:0071cb144c7a	1577
JMF	12:0071cb144c7a	1578	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
JMF	12:0071cb144c7a	1579	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
JMF	12:0071cb144c7a	1580	case MBEDTLS_TLS_EXT_SIG_ALG:
JMF	12:0071cb144c7a	1581	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
JMF	12:0071cb144c7a	1582	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1583	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
JMF	12:0071cb144c7a	1584	break;
JMF	12:0071cb144c7a	1585	#endif
JMF	12:0071cb144c7a	1586
JMF	12:0071cb144c7a	1587	ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1588	if( ret != 0 )
JMF	12:0071cb144c7a	1589	return( ret );
JMF	12:0071cb144c7a	1590	break;
JMF	12:0071cb144c7a	1591	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
JMF	12:0071cb144c7a	1592	MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
JMF	12:0071cb144c7a	1593
JMF	12:0071cb144c7a	1594	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	1595	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1596	case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
JMF	12:0071cb144c7a	1597	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
JMF	12:0071cb144c7a	1598
JMF	12:0071cb144c7a	1599	ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1600	if( ret != 0 )
JMF	12:0071cb144c7a	1601	return( ret );
JMF	12:0071cb144c7a	1602	break;
JMF	12:0071cb144c7a	1603
JMF	12:0071cb144c7a	1604	case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
JMF	12:0071cb144c7a	1605	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
JMF	12:0071cb144c7a	1606	ssl->handshake->cli_exts \|= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
JMF	12:0071cb144c7a	1607
JMF	12:0071cb144c7a	1608	ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1609	if( ret != 0 )
JMF	12:0071cb144c7a	1610	return( ret );
JMF	12:0071cb144c7a	1611	break;
JMF	12:0071cb144c7a	1612	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
JMF	12:0071cb144c7a	1613	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	1614
JMF	12:0071cb144c7a	1615	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	1616	case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
JMF	12:0071cb144c7a	1617	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
JMF	12:0071cb144c7a	1618
JMF	12:0071cb144c7a	1619	ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1620	if( ret != 0 )
JMF	12:0071cb144c7a	1621	return( ret );
JMF	12:0071cb144c7a	1622	break;
JMF	12:0071cb144c7a	1623	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	1624
JMF	12:0071cb144c7a	1625	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	1626	case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
JMF	12:0071cb144c7a	1627	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
JMF	12:0071cb144c7a	1628
JMF	12:0071cb144c7a	1629	ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1630	if( ret != 0 )
JMF	12:0071cb144c7a	1631	return( ret );
JMF	12:0071cb144c7a	1632	break;
JMF	12:0071cb144c7a	1633	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
JMF	12:0071cb144c7a	1634
JMF	12:0071cb144c7a	1635	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	1636	case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
JMF	12:0071cb144c7a	1637	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
JMF	12:0071cb144c7a	1638
JMF	12:0071cb144c7a	1639	ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1640	if( ret != 0 )
JMF	12:0071cb144c7a	1641	return( ret );
JMF	12:0071cb144c7a	1642	break;
JMF	12:0071cb144c7a	1643	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
JMF	12:0071cb144c7a	1644
JMF	12:0071cb144c7a	1645	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	1646	case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
JMF	12:0071cb144c7a	1647	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
JMF	12:0071cb144c7a	1648
JMF	12:0071cb144c7a	1649	ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1650	if( ret != 0 )
JMF	12:0071cb144c7a	1651	return( ret );
JMF	12:0071cb144c7a	1652	break;
JMF	12:0071cb144c7a	1653	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
JMF	12:0071cb144c7a	1654
JMF	12:0071cb144c7a	1655	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	1656	case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
JMF	12:0071cb144c7a	1657	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
JMF	12:0071cb144c7a	1658
JMF	12:0071cb144c7a	1659	ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1660	if( ret != 0 )
JMF	12:0071cb144c7a	1661	return( ret );
JMF	12:0071cb144c7a	1662	break;
JMF	12:0071cb144c7a	1663	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
JMF	12:0071cb144c7a	1664
JMF	12:0071cb144c7a	1665	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	1666	case MBEDTLS_TLS_EXT_SESSION_TICKET:
JMF	12:0071cb144c7a	1667	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
JMF	12:0071cb144c7a	1668
JMF	12:0071cb144c7a	1669	ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1670	if( ret != 0 )
JMF	12:0071cb144c7a	1671	return( ret );
JMF	12:0071cb144c7a	1672	break;
JMF	12:0071cb144c7a	1673	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	1674
JMF	12:0071cb144c7a	1675	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	1676	case MBEDTLS_TLS_EXT_ALPN:
JMF	12:0071cb144c7a	1677	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
JMF	12:0071cb144c7a	1678
JMF	12:0071cb144c7a	1679	ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
JMF	12:0071cb144c7a	1680	if( ret != 0 )
JMF	12:0071cb144c7a	1681	return( ret );
JMF	12:0071cb144c7a	1682	break;
JMF	12:0071cb144c7a	1683	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	1684
JMF	12:0071cb144c7a	1685	default:
JMF	12:0071cb144c7a	1686	MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
JMF	12:0071cb144c7a	1687	ext_id ) );
JMF	12:0071cb144c7a	1688	}
JMF	12:0071cb144c7a	1689
JMF	12:0071cb144c7a	1690	ext_len -= 4 + ext_size;
JMF	12:0071cb144c7a	1691	ext += 4 + ext_size;
JMF	12:0071cb144c7a	1692
JMF	12:0071cb144c7a	1693	if( ext_len > 0 && ext_len < 4 )
JMF	12:0071cb144c7a	1694	{
JMF	12:0071cb144c7a	1695	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
JMF	12:0071cb144c7a	1696	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1697	}
JMF	12:0071cb144c7a	1698	}
JMF	12:0071cb144c7a	1699	#if defined(MBEDTLS_SSL_PROTO_SSL3)
JMF	12:0071cb144c7a	1700	}
JMF	12:0071cb144c7a	1701	#endif
JMF	12:0071cb144c7a	1702
JMF	12:0071cb144c7a	1703	#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
JMF	12:0071cb144c7a	1704	for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
JMF	12:0071cb144c7a	1705	{
JMF	12:0071cb144c7a	1706	if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
JMF	12:0071cb144c7a	1707	p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
JMF	12:0071cb144c7a	1708	{
JMF	12:0071cb144c7a	1709	MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
JMF	12:0071cb144c7a	1710
JMF	12:0071cb144c7a	1711	if( ssl->minor_ver < ssl->conf->max_minor_ver )
JMF	12:0071cb144c7a	1712	{
JMF	12:0071cb144c7a	1713	MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
JMF	12:0071cb144c7a	1714
JMF	12:0071cb144c7a	1715	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	1716	MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
JMF	12:0071cb144c7a	1717
JMF	12:0071cb144c7a	1718	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1719	}
JMF	12:0071cb144c7a	1720
JMF	12:0071cb144c7a	1721	break;
JMF	12:0071cb144c7a	1722	}
JMF	12:0071cb144c7a	1723	}
JMF	12:0071cb144c7a	1724	#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
JMF	12:0071cb144c7a	1725
JMF	12:0071cb144c7a	1726	/*
JMF	12:0071cb144c7a	1727	* Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
JMF	12:0071cb144c7a	1728	*/
JMF	12:0071cb144c7a	1729	for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
JMF	12:0071cb144c7a	1730	{
JMF	12:0071cb144c7a	1731	if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
JMF	12:0071cb144c7a	1732	{
JMF	12:0071cb144c7a	1733	MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
JMF	12:0071cb144c7a	1734	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1735	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
JMF	12:0071cb144c7a	1736	{
JMF	12:0071cb144c7a	1737	MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
JMF	12:0071cb144c7a	1738
JMF	12:0071cb144c7a	1739	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1740	return( ret );
JMF	12:0071cb144c7a	1741
JMF	12:0071cb144c7a	1742	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1743	}
JMF	12:0071cb144c7a	1744	#endif
JMF	12:0071cb144c7a	1745	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
JMF	12:0071cb144c7a	1746	break;
JMF	12:0071cb144c7a	1747	}
JMF	12:0071cb144c7a	1748	}
JMF	12:0071cb144c7a	1749
JMF	12:0071cb144c7a	1750	/*
JMF	12:0071cb144c7a	1751	* Renegotiation security checks
JMF	12:0071cb144c7a	1752	*/
JMF	12:0071cb144c7a	1753	if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
JMF	12:0071cb144c7a	1754	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
JMF	12:0071cb144c7a	1755	{
JMF	12:0071cb144c7a	1756	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
JMF	12:0071cb144c7a	1757	handshake_failure = 1;
JMF	12:0071cb144c7a	1758	}
JMF	12:0071cb144c7a	1759	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1760	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
JMF	12:0071cb144c7a	1761	ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
JMF	12:0071cb144c7a	1762	renegotiation_info_seen == 0 )
JMF	12:0071cb144c7a	1763	{
JMF	12:0071cb144c7a	1764	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
JMF	12:0071cb144c7a	1765	handshake_failure = 1;
JMF	12:0071cb144c7a	1766	}
JMF	12:0071cb144c7a	1767	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
JMF	12:0071cb144c7a	1768	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
JMF	12:0071cb144c7a	1769	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
JMF	12:0071cb144c7a	1770	{
JMF	12:0071cb144c7a	1771	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
JMF	12:0071cb144c7a	1772	handshake_failure = 1;
JMF	12:0071cb144c7a	1773	}
JMF	12:0071cb144c7a	1774	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
JMF	12:0071cb144c7a	1775	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
JMF	12:0071cb144c7a	1776	renegotiation_info_seen == 1 )
JMF	12:0071cb144c7a	1777	{
JMF	12:0071cb144c7a	1778	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
JMF	12:0071cb144c7a	1779	handshake_failure = 1;
JMF	12:0071cb144c7a	1780	}
JMF	12:0071cb144c7a	1781	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	1782
JMF	12:0071cb144c7a	1783	if( handshake_failure == 1 )
JMF	12:0071cb144c7a	1784	{
JMF	12:0071cb144c7a	1785	if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
JMF	12:0071cb144c7a	1786	return( ret );
JMF	12:0071cb144c7a	1787
JMF	12:0071cb144c7a	1788	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
JMF	12:0071cb144c7a	1789	}
JMF	12:0071cb144c7a	1790
JMF	12:0071cb144c7a	1791	/*
JMF	12:0071cb144c7a	1792	* Search for a matching ciphersuite
JMF	12:0071cb144c7a	1793	* (At the end because we need information from the EC-based extensions
JMF	12:0071cb144c7a	1794	* and certificate from the SNI callback triggered by the SNI extension.)
JMF	12:0071cb144c7a	1795	*/
JMF	12:0071cb144c7a	1796	got_common_suite = 0;
JMF	12:0071cb144c7a	1797	ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
JMF	12:0071cb144c7a	1798	ciphersuite_info = NULL;
JMF	12:0071cb144c7a	1799	#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
JMF	12:0071cb144c7a	1800	for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
JMF	12:0071cb144c7a	1801	{
JMF	12:0071cb144c7a	1802	for( i = 0; ciphersuites[i] != 0; i++ )
JMF	12:0071cb144c7a	1803	#else
JMF	12:0071cb144c7a	1804	for( i = 0; ciphersuites[i] != 0; i++ )
JMF	12:0071cb144c7a	1805	{
JMF	12:0071cb144c7a	1806	for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
JMF	12:0071cb144c7a	1807	#endif
JMF	12:0071cb144c7a	1808	{
JMF	12:0071cb144c7a	1809	if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) \|\|
JMF	12:0071cb144c7a	1810	p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
JMF	12:0071cb144c7a	1811	continue;
JMF	12:0071cb144c7a	1812
JMF	12:0071cb144c7a	1813	got_common_suite = 1;
JMF	12:0071cb144c7a	1814
JMF	12:0071cb144c7a	1815	if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
JMF	12:0071cb144c7a	1816	&ciphersuite_info ) ) != 0 )
JMF	12:0071cb144c7a	1817	return( ret );
JMF	12:0071cb144c7a	1818
JMF	12:0071cb144c7a	1819	if( ciphersuite_info != NULL )
JMF	12:0071cb144c7a	1820	goto have_ciphersuite;
JMF	12:0071cb144c7a	1821	}
JMF	12:0071cb144c7a	1822	}
JMF	12:0071cb144c7a	1823
JMF	12:0071cb144c7a	1824	if( got_common_suite )
JMF	12:0071cb144c7a	1825	{
JMF	12:0071cb144c7a	1826	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
JMF	12:0071cb144c7a	1827	"but none of them usable" ) );
JMF	12:0071cb144c7a	1828	mbedtls_ssl_send_fatal_handshake_failure( ssl );
JMF	12:0071cb144c7a	1829	return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
JMF	12:0071cb144c7a	1830	}
JMF	12:0071cb144c7a	1831	else
JMF	12:0071cb144c7a	1832	{
JMF	12:0071cb144c7a	1833	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
JMF	12:0071cb144c7a	1834	mbedtls_ssl_send_fatal_handshake_failure( ssl );
JMF	12:0071cb144c7a	1835	return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
JMF	12:0071cb144c7a	1836	}
JMF	12:0071cb144c7a	1837
JMF	12:0071cb144c7a	1838	have_ciphersuite:
JMF	12:0071cb144c7a	1839	MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
JMF	12:0071cb144c7a	1840
JMF	12:0071cb144c7a	1841	ssl->session_negotiate->ciphersuite = ciphersuites[i];
JMF	12:0071cb144c7a	1842	ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
JMF	12:0071cb144c7a	1843	mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
JMF	12:0071cb144c7a	1844
JMF	12:0071cb144c7a	1845	ssl->state++;
JMF	12:0071cb144c7a	1846
JMF	12:0071cb144c7a	1847	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	1848	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	1849	mbedtls_ssl_recv_flight_completed( ssl );
JMF	12:0071cb144c7a	1850	#endif
JMF	12:0071cb144c7a	1851
JMF	12:0071cb144c7a	1852	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
JMF	12:0071cb144c7a	1853
JMF	12:0071cb144c7a	1854	return( 0 );
JMF	12:0071cb144c7a	1855	}
JMF	12:0071cb144c7a	1856
JMF	12:0071cb144c7a	1857	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	1858	static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1859	unsigned char *buf,
JMF	12:0071cb144c7a	1860	size_t *olen )
JMF	12:0071cb144c7a	1861	{
JMF	12:0071cb144c7a	1862	unsigned char *p = buf;
JMF	12:0071cb144c7a	1863
JMF	12:0071cb144c7a	1864	if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
JMF	12:0071cb144c7a	1865	{
JMF	12:0071cb144c7a	1866	*olen = 0;
JMF	12:0071cb144c7a	1867	return;
JMF	12:0071cb144c7a	1868	}
JMF	12:0071cb144c7a	1869
JMF	12:0071cb144c7a	1870	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
JMF	12:0071cb144c7a	1871
JMF	12:0071cb144c7a	1872	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	1873	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
JMF	12:0071cb144c7a	1874
JMF	12:0071cb144c7a	1875	*p++ = 0x00;
JMF	12:0071cb144c7a	1876	*p++ = 0x00;
JMF	12:0071cb144c7a	1877
JMF	12:0071cb144c7a	1878	*olen = 4;
JMF	12:0071cb144c7a	1879	}
JMF	12:0071cb144c7a	1880	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
JMF	12:0071cb144c7a	1881
JMF	12:0071cb144c7a	1882	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	1883	static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1884	unsigned char *buf,
JMF	12:0071cb144c7a	1885	size_t *olen )
JMF	12:0071cb144c7a	1886	{
JMF	12:0071cb144c7a	1887	unsigned char *p = buf;
JMF	12:0071cb144c7a	1888	const mbedtls_ssl_ciphersuite_t *suite = NULL;
JMF	12:0071cb144c7a	1889	const mbedtls_cipher_info_t *cipher = NULL;
JMF	12:0071cb144c7a	1890
JMF	12:0071cb144c7a	1891	if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
JMF	12:0071cb144c7a	1892	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	1893	{
JMF	12:0071cb144c7a	1894	*olen = 0;
JMF	12:0071cb144c7a	1895	return;
JMF	12:0071cb144c7a	1896	}
JMF	12:0071cb144c7a	1897
JMF	12:0071cb144c7a	1898	/*
JMF	12:0071cb144c7a	1899	* RFC 7366: "If a server receives an encrypt-then-MAC request extension
JMF	12:0071cb144c7a	1900	* from a client and then selects a stream or Authenticated Encryption
JMF	12:0071cb144c7a	1901	* with Associated Data (AEAD) ciphersuite, it MUST NOT send an
JMF	12:0071cb144c7a	1902	* encrypt-then-MAC response extension back to the client."
JMF	12:0071cb144c7a	1903	*/
JMF	12:0071cb144c7a	1904	if( ( suite = mbedtls_ssl_ciphersuite_from_id(
JMF	12:0071cb144c7a	1905	ssl->session_negotiate->ciphersuite ) ) == NULL \|\|
JMF	12:0071cb144c7a	1906	( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL \|\|
JMF	12:0071cb144c7a	1907	cipher->mode != MBEDTLS_MODE_CBC )
JMF	12:0071cb144c7a	1908	{
JMF	12:0071cb144c7a	1909	*olen = 0;
JMF	12:0071cb144c7a	1910	return;
JMF	12:0071cb144c7a	1911	}
JMF	12:0071cb144c7a	1912
JMF	12:0071cb144c7a	1913	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
JMF	12:0071cb144c7a	1914
JMF	12:0071cb144c7a	1915	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	1916	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
JMF	12:0071cb144c7a	1917
JMF	12:0071cb144c7a	1918	*p++ = 0x00;
JMF	12:0071cb144c7a	1919	*p++ = 0x00;
JMF	12:0071cb144c7a	1920
JMF	12:0071cb144c7a	1921	*olen = 4;
JMF	12:0071cb144c7a	1922	}
JMF	12:0071cb144c7a	1923	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
JMF	12:0071cb144c7a	1924
JMF	12:0071cb144c7a	1925	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	1926	static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1927	unsigned char *buf,
JMF	12:0071cb144c7a	1928	size_t *olen )
JMF	12:0071cb144c7a	1929	{
JMF	12:0071cb144c7a	1930	unsigned char *p = buf;
JMF	12:0071cb144c7a	1931
JMF	12:0071cb144c7a	1932	if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
JMF	12:0071cb144c7a	1933	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	1934	{
JMF	12:0071cb144c7a	1935	*olen = 0;
JMF	12:0071cb144c7a	1936	return;
JMF	12:0071cb144c7a	1937	}
JMF	12:0071cb144c7a	1938
JMF	12:0071cb144c7a	1939	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
JMF	12:0071cb144c7a	1940	"extension" ) );
JMF	12:0071cb144c7a	1941
JMF	12:0071cb144c7a	1942	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	1943	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
JMF	12:0071cb144c7a	1944
JMF	12:0071cb144c7a	1945	*p++ = 0x00;
JMF	12:0071cb144c7a	1946	*p++ = 0x00;
JMF	12:0071cb144c7a	1947
JMF	12:0071cb144c7a	1948	*olen = 4;
JMF	12:0071cb144c7a	1949	}
JMF	12:0071cb144c7a	1950	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
JMF	12:0071cb144c7a	1951
JMF	12:0071cb144c7a	1952	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	1953	static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1954	unsigned char *buf,
JMF	12:0071cb144c7a	1955	size_t *olen )
JMF	12:0071cb144c7a	1956	{
JMF	12:0071cb144c7a	1957	unsigned char *p = buf;
JMF	12:0071cb144c7a	1958
JMF	12:0071cb144c7a	1959	if( ssl->handshake->new_session_ticket == 0 )
JMF	12:0071cb144c7a	1960	{
JMF	12:0071cb144c7a	1961	*olen = 0;
JMF	12:0071cb144c7a	1962	return;
JMF	12:0071cb144c7a	1963	}
JMF	12:0071cb144c7a	1964
JMF	12:0071cb144c7a	1965	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
JMF	12:0071cb144c7a	1966
JMF	12:0071cb144c7a	1967	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	1968	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
JMF	12:0071cb144c7a	1969
JMF	12:0071cb144c7a	1970	*p++ = 0x00;
JMF	12:0071cb144c7a	1971	*p++ = 0x00;
JMF	12:0071cb144c7a	1972
JMF	12:0071cb144c7a	1973	*olen = 4;
JMF	12:0071cb144c7a	1974	}
JMF	12:0071cb144c7a	1975	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	1976
JMF	12:0071cb144c7a	1977	static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	1978	unsigned char *buf,
JMF	12:0071cb144c7a	1979	size_t *olen )
JMF	12:0071cb144c7a	1980	{
JMF	12:0071cb144c7a	1981	unsigned char *p = buf;
JMF	12:0071cb144c7a	1982
JMF	12:0071cb144c7a	1983	if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
JMF	12:0071cb144c7a	1984	{
JMF	12:0071cb144c7a	1985	*olen = 0;
JMF	12:0071cb144c7a	1986	return;
JMF	12:0071cb144c7a	1987	}
JMF	12:0071cb144c7a	1988
JMF	12:0071cb144c7a	1989	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
JMF	12:0071cb144c7a	1990
JMF	12:0071cb144c7a	1991	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	1992	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
JMF	12:0071cb144c7a	1993
JMF	12:0071cb144c7a	1994	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	1995	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
JMF	12:0071cb144c7a	1996	{
JMF	12:0071cb144c7a	1997	*p++ = 0x00;
JMF	12:0071cb144c7a	1998	p++ = ( ssl->verify_data_len 2 + 1 ) & 0xFF;
JMF	12:0071cb144c7a	1999	p++ = ssl->verify_data_len 2 & 0xFF;
JMF	12:0071cb144c7a	2000
JMF	12:0071cb144c7a	2001	memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
JMF	12:0071cb144c7a	2002	p += ssl->verify_data_len;
JMF	12:0071cb144c7a	2003	memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
JMF	12:0071cb144c7a	2004	p += ssl->verify_data_len;
JMF	12:0071cb144c7a	2005	}
JMF	12:0071cb144c7a	2006	else
JMF	12:0071cb144c7a	2007	#endif /* MBEDTLS_SSL_RENEGOTIATION */
JMF	12:0071cb144c7a	2008	{
JMF	12:0071cb144c7a	2009	*p++ = 0x00;
JMF	12:0071cb144c7a	2010	*p++ = 0x01;
JMF	12:0071cb144c7a	2011	*p++ = 0x00;
JMF	12:0071cb144c7a	2012	}
JMF	12:0071cb144c7a	2013
JMF	12:0071cb144c7a	2014	*olen = p - buf;
JMF	12:0071cb144c7a	2015	}
JMF	12:0071cb144c7a	2016
JMF	12:0071cb144c7a	2017	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	2018	static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	2019	unsigned char *buf,
JMF	12:0071cb144c7a	2020	size_t *olen )
JMF	12:0071cb144c7a	2021	{
JMF	12:0071cb144c7a	2022	unsigned char *p = buf;
JMF	12:0071cb144c7a	2023
JMF	12:0071cb144c7a	2024	if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
JMF	12:0071cb144c7a	2025	{
JMF	12:0071cb144c7a	2026	*olen = 0;
JMF	12:0071cb144c7a	2027	return;
JMF	12:0071cb144c7a	2028	}
JMF	12:0071cb144c7a	2029
JMF	12:0071cb144c7a	2030	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
JMF	12:0071cb144c7a	2031
JMF	12:0071cb144c7a	2032	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2033	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
JMF	12:0071cb144c7a	2034
JMF	12:0071cb144c7a	2035	*p++ = 0x00;
JMF	12:0071cb144c7a	2036	*p++ = 1;
JMF	12:0071cb144c7a	2037
JMF	12:0071cb144c7a	2038	*p++ = ssl->session_negotiate->mfl_code;
JMF	12:0071cb144c7a	2039
JMF	12:0071cb144c7a	2040	*olen = 5;
JMF	12:0071cb144c7a	2041	}
JMF	12:0071cb144c7a	2042	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
JMF	12:0071cb144c7a	2043
JMF	12:0071cb144c7a	2044	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	2045	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2046	static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	2047	unsigned char *buf,
JMF	12:0071cb144c7a	2048	size_t *olen )
JMF	12:0071cb144c7a	2049	{
JMF	12:0071cb144c7a	2050	unsigned char *p = buf;
JMF	12:0071cb144c7a	2051	((void) ssl);
JMF	12:0071cb144c7a	2052
JMF	12:0071cb144c7a	2053	if( ( ssl->handshake->cli_exts &
JMF	12:0071cb144c7a	2054	MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
JMF	12:0071cb144c7a	2055	{
JMF	12:0071cb144c7a	2056	*olen = 0;
JMF	12:0071cb144c7a	2057	return;
JMF	12:0071cb144c7a	2058	}
JMF	12:0071cb144c7a	2059
JMF	12:0071cb144c7a	2060	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
JMF	12:0071cb144c7a	2061
JMF	12:0071cb144c7a	2062	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2063	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
JMF	12:0071cb144c7a	2064
JMF	12:0071cb144c7a	2065	*p++ = 0x00;
JMF	12:0071cb144c7a	2066	*p++ = 2;
JMF	12:0071cb144c7a	2067
JMF	12:0071cb144c7a	2068	*p++ = 1;
JMF	12:0071cb144c7a	2069	*p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
JMF	12:0071cb144c7a	2070
JMF	12:0071cb144c7a	2071	*olen = 6;
JMF	12:0071cb144c7a	2072	}
JMF	12:0071cb144c7a	2073	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\| MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	2074
JMF	12:0071cb144c7a	2075	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2076	static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	2077	unsigned char *buf,
JMF	12:0071cb144c7a	2078	size_t *olen )
JMF	12:0071cb144c7a	2079	{
JMF	12:0071cb144c7a	2080	int ret;
JMF	12:0071cb144c7a	2081	unsigned char *p = buf;
JMF	12:0071cb144c7a	2082	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	2083	size_t kkpp_len;
JMF	12:0071cb144c7a	2084
JMF	12:0071cb144c7a	2085	*olen = 0;
JMF	12:0071cb144c7a	2086
JMF	12:0071cb144c7a	2087	/* Skip costly computation if not needed */
JMF	12:0071cb144c7a	2088	if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
JMF	12:0071cb144c7a	2089	MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2090	return;
JMF	12:0071cb144c7a	2091
JMF	12:0071cb144c7a	2092	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
JMF	12:0071cb144c7a	2093
JMF	12:0071cb144c7a	2094	if( end - p < 4 )
JMF	12:0071cb144c7a	2095	{
JMF	12:0071cb144c7a	2096	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
JMF	12:0071cb144c7a	2097	return;
JMF	12:0071cb144c7a	2098	}
JMF	12:0071cb144c7a	2099
JMF	12:0071cb144c7a	2100	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2101	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
JMF	12:0071cb144c7a	2102
JMF	12:0071cb144c7a	2103	ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	2104	p + 2, end - p - 2, &kkpp_len,
JMF	12:0071cb144c7a	2105	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2106	if( ret != 0 )
JMF	12:0071cb144c7a	2107	{
JMF	12:0071cb144c7a	2108	MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
JMF	12:0071cb144c7a	2109	return;
JMF	12:0071cb144c7a	2110	}
JMF	12:0071cb144c7a	2111
JMF	12:0071cb144c7a	2112	*p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2113	*p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
JMF	12:0071cb144c7a	2114
JMF	12:0071cb144c7a	2115	*olen = kkpp_len + 4;
JMF	12:0071cb144c7a	2116	}
JMF	12:0071cb144c7a	2117	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	2118
JMF	12:0071cb144c7a	2119	#if defined(MBEDTLS_SSL_ALPN )
JMF	12:0071cb144c7a	2120	static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	2121	unsigned char buf, size_t olen )
JMF	12:0071cb144c7a	2122	{
JMF	12:0071cb144c7a	2123	if( ssl->alpn_chosen == NULL )
JMF	12:0071cb144c7a	2124	{
JMF	12:0071cb144c7a	2125	*olen = 0;
JMF	12:0071cb144c7a	2126	return;
JMF	12:0071cb144c7a	2127	}
JMF	12:0071cb144c7a	2128
JMF	12:0071cb144c7a	2129	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
JMF	12:0071cb144c7a	2130
JMF	12:0071cb144c7a	2131	/*
JMF	12:0071cb144c7a	2132	* 0 . 1 ext identifier
JMF	12:0071cb144c7a	2133	* 2 . 3 ext length
JMF	12:0071cb144c7a	2134	* 4 . 5 protocol list length
JMF	12:0071cb144c7a	2135	* 6 . 6 protocol name length
JMF	12:0071cb144c7a	2136	* 7 . 7+n protocol name
JMF	12:0071cb144c7a	2137	*/
JMF	12:0071cb144c7a	2138	buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2139	buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
JMF	12:0071cb144c7a	2140
JMF	12:0071cb144c7a	2141	*olen = 7 + strlen( ssl->alpn_chosen );
JMF	12:0071cb144c7a	2142
JMF	12:0071cb144c7a	2143	buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2144	buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
JMF	12:0071cb144c7a	2145
JMF	12:0071cb144c7a	2146	buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2147	buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
JMF	12:0071cb144c7a	2148
JMF	12:0071cb144c7a	2149	buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
JMF	12:0071cb144c7a	2150
JMF	12:0071cb144c7a	2151	memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
JMF	12:0071cb144c7a	2152	}
JMF	12:0071cb144c7a	2153	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C */
JMF	12:0071cb144c7a	2154
JMF	12:0071cb144c7a	2155	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
JMF	12:0071cb144c7a	2156	static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2157	{
JMF	12:0071cb144c7a	2158	int ret;
JMF	12:0071cb144c7a	2159	unsigned char *p = ssl->out_msg + 4;
JMF	12:0071cb144c7a	2160	unsigned char *cookie_len_byte;
JMF	12:0071cb144c7a	2161
JMF	12:0071cb144c7a	2162	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
JMF	12:0071cb144c7a	2163
JMF	12:0071cb144c7a	2164	/*
JMF	12:0071cb144c7a	2165	* struct {
JMF	12:0071cb144c7a	2166	* ProtocolVersion server_version;
JMF	12:0071cb144c7a	2167	* opaque cookie<0..2^8-1>;
JMF	12:0071cb144c7a	2168	* } HelloVerifyRequest;
JMF	12:0071cb144c7a	2169	*/
JMF	12:0071cb144c7a	2170
JMF	12:0071cb144c7a	2171	/* The RFC is not clear on this point, but sending the actual negotiated
JMF	12:0071cb144c7a	2172	* version looks like the most interoperable thing to do. */
JMF	12:0071cb144c7a	2173	mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
JMF	12:0071cb144c7a	2174	ssl->conf->transport, p );
JMF	12:0071cb144c7a	2175	MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
JMF	12:0071cb144c7a	2176	p += 2;
JMF	12:0071cb144c7a	2177
JMF	12:0071cb144c7a	2178	/* If we get here, f_cookie_check is not null */
JMF	12:0071cb144c7a	2179	if( ssl->conf->f_cookie_write == NULL )
JMF	12:0071cb144c7a	2180	{
JMF	12:0071cb144c7a	2181	MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
JMF	12:0071cb144c7a	2182	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2183	}
JMF	12:0071cb144c7a	2184
JMF	12:0071cb144c7a	2185	/* Skip length byte until we know the length */
JMF	12:0071cb144c7a	2186	cookie_len_byte = p++;
JMF	12:0071cb144c7a	2187
JMF	12:0071cb144c7a	2188	if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
JMF	12:0071cb144c7a	2189	&p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
JMF	12:0071cb144c7a	2190	ssl->cli_id, ssl->cli_id_len ) ) != 0 )
JMF	12:0071cb144c7a	2191	{
JMF	12:0071cb144c7a	2192	MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
JMF	12:0071cb144c7a	2193	return( ret );
JMF	12:0071cb144c7a	2194	}
JMF	12:0071cb144c7a	2195
JMF	12:0071cb144c7a	2196	*cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
JMF	12:0071cb144c7a	2197
JMF	12:0071cb144c7a	2198	MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
JMF	12:0071cb144c7a	2199
JMF	12:0071cb144c7a	2200	ssl->out_msglen = p - ssl->out_msg;
JMF	12:0071cb144c7a	2201	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	2202	ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
JMF	12:0071cb144c7a	2203
JMF	12:0071cb144c7a	2204	ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
JMF	12:0071cb144c7a	2205
JMF	12:0071cb144c7a	2206	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2207	{
JMF	12:0071cb144c7a	2208	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	2209	return( ret );
JMF	12:0071cb144c7a	2210	}
JMF	12:0071cb144c7a	2211
JMF	12:0071cb144c7a	2212	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
JMF	12:0071cb144c7a	2213
JMF	12:0071cb144c7a	2214	return( 0 );
JMF	12:0071cb144c7a	2215	}
JMF	12:0071cb144c7a	2216	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
JMF	12:0071cb144c7a	2217
JMF	12:0071cb144c7a	2218	static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2219	{
JMF	12:0071cb144c7a	2220	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	2221	mbedtls_time_t t;
JMF	12:0071cb144c7a	2222	#endif
JMF	12:0071cb144c7a	2223	int ret;
JMF	12:0071cb144c7a	2224	size_t olen, ext_len = 0, n;
JMF	12:0071cb144c7a	2225	unsigned char buf, p;
JMF	12:0071cb144c7a	2226
JMF	12:0071cb144c7a	2227	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
JMF	12:0071cb144c7a	2228
JMF	12:0071cb144c7a	2229	#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
JMF	12:0071cb144c7a	2230	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
JMF	12:0071cb144c7a	2231	ssl->handshake->verify_cookie_len != 0 )
JMF	12:0071cb144c7a	2232	{
JMF	12:0071cb144c7a	2233	MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
JMF	12:0071cb144c7a	2234	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
JMF	12:0071cb144c7a	2235
JMF	12:0071cb144c7a	2236	return( ssl_write_hello_verify_request( ssl ) );
JMF	12:0071cb144c7a	2237	}
JMF	12:0071cb144c7a	2238	#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
JMF	12:0071cb144c7a	2239
JMF	12:0071cb144c7a	2240	if( ssl->conf->f_rng == NULL )
JMF	12:0071cb144c7a	2241	{
JMF	12:0071cb144c7a	2242	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
JMF	12:0071cb144c7a	2243	return( MBEDTLS_ERR_SSL_NO_RNG );
JMF	12:0071cb144c7a	2244	}
JMF	12:0071cb144c7a	2245
JMF	12:0071cb144c7a	2246	/*
JMF	12:0071cb144c7a	2247	* 0 . 0 handshake type
JMF	12:0071cb144c7a	2248	* 1 . 3 handshake length
JMF	12:0071cb144c7a	2249	* 4 . 5 protocol version
JMF	12:0071cb144c7a	2250	* 6 . 9 UNIX time()
JMF	12:0071cb144c7a	2251	* 10 . 37 random bytes
JMF	12:0071cb144c7a	2252	*/
JMF	12:0071cb144c7a	2253	buf = ssl->out_msg;
JMF	12:0071cb144c7a	2254	p = buf + 4;
JMF	12:0071cb144c7a	2255
JMF	12:0071cb144c7a	2256	mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
JMF	12:0071cb144c7a	2257	ssl->conf->transport, p );
JMF	12:0071cb144c7a	2258	p += 2;
JMF	12:0071cb144c7a	2259
JMF	12:0071cb144c7a	2260	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
JMF	12:0071cb144c7a	2261	buf[4], buf[5] ) );
JMF	12:0071cb144c7a	2262
JMF	12:0071cb144c7a	2263	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	2264	t = mbedtls_time( NULL );
JMF	12:0071cb144c7a	2265	*p++ = (unsigned char)( t >> 24 );
JMF	12:0071cb144c7a	2266	*p++ = (unsigned char)( t >> 16 );
JMF	12:0071cb144c7a	2267	*p++ = (unsigned char)( t >> 8 );
JMF	12:0071cb144c7a	2268	*p++ = (unsigned char)( t );
JMF	12:0071cb144c7a	2269
JMF	12:0071cb144c7a	2270	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
JMF	12:0071cb144c7a	2271	#else
JMF	12:0071cb144c7a	2272	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
JMF	12:0071cb144c7a	2273	return( ret );
JMF	12:0071cb144c7a	2274
JMF	12:0071cb144c7a	2275	p += 4;
JMF	12:0071cb144c7a	2276	#endif /* MBEDTLS_HAVE_TIME */
JMF	12:0071cb144c7a	2277
JMF	12:0071cb144c7a	2278	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
JMF	12:0071cb144c7a	2279	return( ret );
JMF	12:0071cb144c7a	2280
JMF	12:0071cb144c7a	2281	p += 28;
JMF	12:0071cb144c7a	2282
JMF	12:0071cb144c7a	2283	memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
JMF	12:0071cb144c7a	2284
JMF	12:0071cb144c7a	2285	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
JMF	12:0071cb144c7a	2286
JMF	12:0071cb144c7a	2287	/*
JMF	12:0071cb144c7a	2288	* Resume is 0 by default, see ssl_handshake_init().
JMF	12:0071cb144c7a	2289	* It may be already set to 1 by ssl_parse_session_ticket_ext().
JMF	12:0071cb144c7a	2290	* If not, try looking up session ID in our cache.
JMF	12:0071cb144c7a	2291	*/
JMF	12:0071cb144c7a	2292	if( ssl->handshake->resume == 0 &&
JMF	12:0071cb144c7a	2293	#if defined(MBEDTLS_SSL_RENEGOTIATION)
JMF	12:0071cb144c7a	2294	ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
JMF	12:0071cb144c7a	2295	#endif
JMF	12:0071cb144c7a	2296	ssl->session_negotiate->id_len != 0 &&
JMF	12:0071cb144c7a	2297	ssl->conf->f_get_cache != NULL &&
JMF	12:0071cb144c7a	2298	ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
JMF	12:0071cb144c7a	2299	{
JMF	12:0071cb144c7a	2300	MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
JMF	12:0071cb144c7a	2301	ssl->handshake->resume = 1;
JMF	12:0071cb144c7a	2302	}
JMF	12:0071cb144c7a	2303
JMF	12:0071cb144c7a	2304	if( ssl->handshake->resume == 0 )
JMF	12:0071cb144c7a	2305	{
JMF	12:0071cb144c7a	2306	/*
JMF	12:0071cb144c7a	2307	* New session, create a new session id,
JMF	12:0071cb144c7a	2308	* unless we're about to issue a session ticket
JMF	12:0071cb144c7a	2309	*/
JMF	12:0071cb144c7a	2310	ssl->state++;
JMF	12:0071cb144c7a	2311
JMF	12:0071cb144c7a	2312	#if defined(MBEDTLS_HAVE_TIME)
JMF	12:0071cb144c7a	2313	ssl->session_negotiate->start = mbedtls_time( NULL );
JMF	12:0071cb144c7a	2314	#endif
JMF	12:0071cb144c7a	2315
JMF	12:0071cb144c7a	2316	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	2317	if( ssl->handshake->new_session_ticket != 0 )
JMF	12:0071cb144c7a	2318	{
JMF	12:0071cb144c7a	2319	ssl->session_negotiate->id_len = n = 0;
JMF	12:0071cb144c7a	2320	memset( ssl->session_negotiate->id, 0, 32 );
JMF	12:0071cb144c7a	2321	}
JMF	12:0071cb144c7a	2322	else
JMF	12:0071cb144c7a	2323	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	2324	{
JMF	12:0071cb144c7a	2325	ssl->session_negotiate->id_len = n = 32;
JMF	12:0071cb144c7a	2326	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
JMF	12:0071cb144c7a	2327	n ) ) != 0 )
JMF	12:0071cb144c7a	2328	return( ret );
JMF	12:0071cb144c7a	2329	}
JMF	12:0071cb144c7a	2330	}
JMF	12:0071cb144c7a	2331	else
JMF	12:0071cb144c7a	2332	{
JMF	12:0071cb144c7a	2333	/*
JMF	12:0071cb144c7a	2334	* Resuming a session
JMF	12:0071cb144c7a	2335	*/
JMF	12:0071cb144c7a	2336	n = ssl->session_negotiate->id_len;
JMF	12:0071cb144c7a	2337	ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
JMF	12:0071cb144c7a	2338
JMF	12:0071cb144c7a	2339	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
JMF	12:0071cb144c7a	2340	{
JMF	12:0071cb144c7a	2341	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
JMF	12:0071cb144c7a	2342	return( ret );
JMF	12:0071cb144c7a	2343	}
JMF	12:0071cb144c7a	2344	}
JMF	12:0071cb144c7a	2345
JMF	12:0071cb144c7a	2346	/*
JMF	12:0071cb144c7a	2347	* 38 . 38 session id length
JMF	12:0071cb144c7a	2348	* 39 . 38+n session id
JMF	12:0071cb144c7a	2349	* 39+n . 40+n chosen ciphersuite
JMF	12:0071cb144c7a	2350	* 41+n . 41+n chosen compression alg.
JMF	12:0071cb144c7a	2351	* 42+n . 43+n extensions length
JMF	12:0071cb144c7a	2352	* 44+n . 43+n+m extensions
JMF	12:0071cb144c7a	2353	*/
JMF	12:0071cb144c7a	2354	*p++ = (unsigned char) ssl->session_negotiate->id_len;
JMF	12:0071cb144c7a	2355	memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
JMF	12:0071cb144c7a	2356	p += ssl->session_negotiate->id_len;
JMF	12:0071cb144c7a	2357
JMF	12:0071cb144c7a	2358	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
JMF	12:0071cb144c7a	2359	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
JMF	12:0071cb144c7a	2360	MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
JMF	12:0071cb144c7a	2361	ssl->handshake->resume ? "a" : "no" ) );
JMF	12:0071cb144c7a	2362
JMF	12:0071cb144c7a	2363	*p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
JMF	12:0071cb144c7a	2364	*p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
JMF	12:0071cb144c7a	2365	*p++ = (unsigned char)( ssl->session_negotiate->compression );
JMF	12:0071cb144c7a	2366
JMF	12:0071cb144c7a	2367	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
JMF	12:0071cb144c7a	2368	mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
JMF	12:0071cb144c7a	2369	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
JMF	12:0071cb144c7a	2370	ssl->session_negotiate->compression ) );
JMF	12:0071cb144c7a	2371
JMF	12:0071cb144c7a	2372	/* Do not write the extensions if the protocol is SSLv3 */
JMF	12:0071cb144c7a	2373	#if defined(MBEDTLS_SSL_PROTO_SSL3)
JMF	12:0071cb144c7a	2374	if( ( ssl->major_ver != 3 ) \|\| ( ssl->minor_ver != 0 ) )
JMF	12:0071cb144c7a	2375	{
JMF	12:0071cb144c7a	2376	#endif
JMF	12:0071cb144c7a	2377
JMF	12:0071cb144c7a	2378	/*
JMF	12:0071cb144c7a	2379	* First write extensions, then the total length
JMF	12:0071cb144c7a	2380	*/
JMF	12:0071cb144c7a	2381	ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2382	ext_len += olen;
JMF	12:0071cb144c7a	2383
JMF	12:0071cb144c7a	2384	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
JMF	12:0071cb144c7a	2385	ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2386	ext_len += olen;
JMF	12:0071cb144c7a	2387	#endif
JMF	12:0071cb144c7a	2388
JMF	12:0071cb144c7a	2389	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
JMF	12:0071cb144c7a	2390	ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2391	ext_len += olen;
JMF	12:0071cb144c7a	2392	#endif
JMF	12:0071cb144c7a	2393
JMF	12:0071cb144c7a	2394	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
JMF	12:0071cb144c7a	2395	ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2396	ext_len += olen;
JMF	12:0071cb144c7a	2397	#endif
JMF	12:0071cb144c7a	2398
JMF	12:0071cb144c7a	2399	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
JMF	12:0071cb144c7a	2400	ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2401	ext_len += olen;
JMF	12:0071cb144c7a	2402	#endif
JMF	12:0071cb144c7a	2403
JMF	12:0071cb144c7a	2404	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	2405	ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2406	ext_len += olen;
JMF	12:0071cb144c7a	2407	#endif
JMF	12:0071cb144c7a	2408
JMF	12:0071cb144c7a	2409	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
JMF	12:0071cb144c7a	2410	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2411	ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2412	ext_len += olen;
JMF	12:0071cb144c7a	2413	#endif
JMF	12:0071cb144c7a	2414
JMF	12:0071cb144c7a	2415	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2416	ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2417	ext_len += olen;
JMF	12:0071cb144c7a	2418	#endif
JMF	12:0071cb144c7a	2419
JMF	12:0071cb144c7a	2420	#if defined(MBEDTLS_SSL_ALPN)
JMF	12:0071cb144c7a	2421	ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
JMF	12:0071cb144c7a	2422	ext_len += olen;
JMF	12:0071cb144c7a	2423	#endif
JMF	12:0071cb144c7a	2424
JMF	12:0071cb144c7a	2425	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
JMF	12:0071cb144c7a	2426
JMF	12:0071cb144c7a	2427	if( ext_len > 0 )
JMF	12:0071cb144c7a	2428	{
JMF	12:0071cb144c7a	2429	*p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	2430	*p++ = (unsigned char)( ( ext_len ) & 0xFF );
JMF	12:0071cb144c7a	2431	p += ext_len;
JMF	12:0071cb144c7a	2432	}
JMF	12:0071cb144c7a	2433
JMF	12:0071cb144c7a	2434	#if defined(MBEDTLS_SSL_PROTO_SSL3)
JMF	12:0071cb144c7a	2435	}
JMF	12:0071cb144c7a	2436	#endif
JMF	12:0071cb144c7a	2437
JMF	12:0071cb144c7a	2438	ssl->out_msglen = p - buf;
JMF	12:0071cb144c7a	2439	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	2440	ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
JMF	12:0071cb144c7a	2441
JMF	12:0071cb144c7a	2442	ret = mbedtls_ssl_write_record( ssl );
JMF	12:0071cb144c7a	2443
JMF	12:0071cb144c7a	2444	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
JMF	12:0071cb144c7a	2445
JMF	12:0071cb144c7a	2446	return( ret );
JMF	12:0071cb144c7a	2447	}
JMF	12:0071cb144c7a	2448
JMF	12:0071cb144c7a	2449	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2450	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2451	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	2452	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2453	static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2454	{
JMF	12:0071cb144c7a	2455	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2456
JMF	12:0071cb144c7a	2457	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
JMF	12:0071cb144c7a	2458
JMF	12:0071cb144c7a	2459	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2460	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2461	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2462	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	2463	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2464	{
JMF	12:0071cb144c7a	2465	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
JMF	12:0071cb144c7a	2466	ssl->state++;
JMF	12:0071cb144c7a	2467	return( 0 );
JMF	12:0071cb144c7a	2468	}
JMF	12:0071cb144c7a	2469
JMF	12:0071cb144c7a	2470	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2471	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2472	}
JMF	12:0071cb144c7a	2473	#else
JMF	12:0071cb144c7a	2474	static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2475	{
JMF	12:0071cb144c7a	2476	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	2477	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2478	size_t dn_size, total_dn_size; /* excluding length bytes */
JMF	12:0071cb144c7a	2479	size_t ct_len, sa_len; /* including length bytes */
JMF	12:0071cb144c7a	2480	unsigned char buf, p;
JMF	12:0071cb144c7a	2481	const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	2482	const mbedtls_x509_crt *crt;
JMF	12:0071cb144c7a	2483	int authmode;
JMF	12:0071cb144c7a	2484
JMF	12:0071cb144c7a	2485	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
JMF	12:0071cb144c7a	2486
JMF	12:0071cb144c7a	2487	ssl->state++;
JMF	12:0071cb144c7a	2488
JMF	12:0071cb144c7a	2489	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	2490	if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
JMF	12:0071cb144c7a	2491	authmode = ssl->handshake->sni_authmode;
JMF	12:0071cb144c7a	2492	else
JMF	12:0071cb144c7a	2493	#endif
JMF	12:0071cb144c7a	2494	authmode = ssl->conf->authmode;
JMF	12:0071cb144c7a	2495
JMF	12:0071cb144c7a	2496	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2497	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	2498	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2499	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	2500	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE \|\|
JMF	12:0071cb144c7a	2501	authmode == MBEDTLS_SSL_VERIFY_NONE )
JMF	12:0071cb144c7a	2502	{
JMF	12:0071cb144c7a	2503	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
JMF	12:0071cb144c7a	2504	return( 0 );
JMF	12:0071cb144c7a	2505	}
JMF	12:0071cb144c7a	2506
JMF	12:0071cb144c7a	2507	/*
JMF	12:0071cb144c7a	2508	* 0 . 0 handshake type
JMF	12:0071cb144c7a	2509	* 1 . 3 handshake length
JMF	12:0071cb144c7a	2510	* 4 . 4 cert type count
JMF	12:0071cb144c7a	2511	* 5 .. m-1 cert types
JMF	12:0071cb144c7a	2512	* m .. m+1 sig alg length (TLS 1.2 only)
JMF	12:0071cb144c7a	2513	* m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
JMF	12:0071cb144c7a	2514	* n .. n+1 length of all DNs
JMF	12:0071cb144c7a	2515	* n+2 .. n+3 length of DN 1
JMF	12:0071cb144c7a	2516	* n+4 .. ... Distinguished Name #1
JMF	12:0071cb144c7a	2517	* ... .. ... length of DN 2, etc.
JMF	12:0071cb144c7a	2518	*/
JMF	12:0071cb144c7a	2519	buf = ssl->out_msg;
JMF	12:0071cb144c7a	2520	p = buf + 4;
JMF	12:0071cb144c7a	2521
JMF	12:0071cb144c7a	2522	/*
JMF	12:0071cb144c7a	2523	* Supported certificate types
JMF	12:0071cb144c7a	2524	*
JMF	12:0071cb144c7a	2525	* ClientCertificateType certificate_types<1..2^8-1>;
JMF	12:0071cb144c7a	2526	* enum { (255) } ClientCertificateType;
JMF	12:0071cb144c7a	2527	*/
JMF	12:0071cb144c7a	2528	ct_len = 0;
JMF	12:0071cb144c7a	2529
JMF	12:0071cb144c7a	2530	#if defined(MBEDTLS_RSA_C)
JMF	12:0071cb144c7a	2531	p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
JMF	12:0071cb144c7a	2532	#endif
JMF	12:0071cb144c7a	2533	#if defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	2534	p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
JMF	12:0071cb144c7a	2535	#endif
JMF	12:0071cb144c7a	2536
JMF	12:0071cb144c7a	2537	p[0] = (unsigned char) ct_len++;
JMF	12:0071cb144c7a	2538	p += ct_len;
JMF	12:0071cb144c7a	2539
JMF	12:0071cb144c7a	2540	sa_len = 0;
JMF	12:0071cb144c7a	2541	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2542	/*
JMF	12:0071cb144c7a	2543	* Add signature_algorithms for verify (TLS 1.2)
JMF	12:0071cb144c7a	2544	*
JMF	12:0071cb144c7a	2545	* SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
JMF	12:0071cb144c7a	2546	*
JMF	12:0071cb144c7a	2547	* struct {
JMF	12:0071cb144c7a	2548	* HashAlgorithm hash;
JMF	12:0071cb144c7a	2549	* SignatureAlgorithm signature;
JMF	12:0071cb144c7a	2550	* } SignatureAndHashAlgorithm;
JMF	12:0071cb144c7a	2551	*
JMF	12:0071cb144c7a	2552	* enum { (255) } HashAlgorithm;
JMF	12:0071cb144c7a	2553	* enum { (255) } SignatureAlgorithm;
JMF	12:0071cb144c7a	2554	*/
JMF	12:0071cb144c7a	2555	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2556	{
JMF	12:0071cb144c7a	2557	/*
JMF	12:0071cb144c7a	2558	* Only use current running hash algorithm that is already required
JMF	12:0071cb144c7a	2559	* for requested ciphersuite.
JMF	12:0071cb144c7a	2560	*/
JMF	12:0071cb144c7a	2561	ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256;
JMF	12:0071cb144c7a	2562
JMF	12:0071cb144c7a	2563	if( ssl->transform_negotiate->ciphersuite_info->mac ==
JMF	12:0071cb144c7a	2564	MBEDTLS_MD_SHA384 )
JMF	12:0071cb144c7a	2565	{
JMF	12:0071cb144c7a	2566	ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384;
JMF	12:0071cb144c7a	2567	}
JMF	12:0071cb144c7a	2568
JMF	12:0071cb144c7a	2569	/*
JMF	12:0071cb144c7a	2570	* Supported signature algorithms
JMF	12:0071cb144c7a	2571	*/
JMF	12:0071cb144c7a	2572	#if defined(MBEDTLS_RSA_C)
JMF	12:0071cb144c7a	2573	p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
JMF	12:0071cb144c7a	2574	p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
JMF	12:0071cb144c7a	2575	#endif
JMF	12:0071cb144c7a	2576	#if defined(MBEDTLS_ECDSA_C)
JMF	12:0071cb144c7a	2577	p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
JMF	12:0071cb144c7a	2578	p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
JMF	12:0071cb144c7a	2579	#endif
JMF	12:0071cb144c7a	2580
JMF	12:0071cb144c7a	2581	p[0] = (unsigned char)( sa_len >> 8 );
JMF	12:0071cb144c7a	2582	p[1] = (unsigned char)( sa_len );
JMF	12:0071cb144c7a	2583	sa_len += 2;
JMF	12:0071cb144c7a	2584	p += sa_len;
JMF	12:0071cb144c7a	2585	}
JMF	12:0071cb144c7a	2586	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2587
JMF	12:0071cb144c7a	2588	/*
JMF	12:0071cb144c7a	2589	* DistinguishedName certificate_authorities<0..2^16-1>;
JMF	12:0071cb144c7a	2590	* opaque DistinguishedName<1..2^16-1>;
JMF	12:0071cb144c7a	2591	*/
JMF	12:0071cb144c7a	2592	p += 2;
JMF	12:0071cb144c7a	2593	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
JMF	12:0071cb144c7a	2594	if( ssl->handshake->sni_ca_chain != NULL )
JMF	12:0071cb144c7a	2595	crt = ssl->handshake->sni_ca_chain;
JMF	12:0071cb144c7a	2596	else
JMF	12:0071cb144c7a	2597	#endif
JMF	12:0071cb144c7a	2598	crt = ssl->conf->ca_chain;
JMF	12:0071cb144c7a	2599
JMF	12:0071cb144c7a	2600	total_dn_size = 0;
JMF	12:0071cb144c7a	2601	while( crt != NULL && crt->version != 0 )
JMF	12:0071cb144c7a	2602	{
JMF	12:0071cb144c7a	2603	dn_size = crt->subject_raw.len;
JMF	12:0071cb144c7a	2604
JMF	12:0071cb144c7a	2605	if( end < p \|\|
JMF	12:0071cb144c7a	2606	(size_t)( end - p ) < dn_size \|\|
JMF	12:0071cb144c7a	2607	(size_t)( end - p ) < 2 + dn_size )
JMF	12:0071cb144c7a	2608	{
JMF	12:0071cb144c7a	2609	MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
JMF	12:0071cb144c7a	2610	break;
JMF	12:0071cb144c7a	2611	}
JMF	12:0071cb144c7a	2612
JMF	12:0071cb144c7a	2613	*p++ = (unsigned char)( dn_size >> 8 );
JMF	12:0071cb144c7a	2614	*p++ = (unsigned char)( dn_size );
JMF	12:0071cb144c7a	2615	memcpy( p, crt->subject_raw.p, dn_size );
JMF	12:0071cb144c7a	2616	p += dn_size;
JMF	12:0071cb144c7a	2617
JMF	12:0071cb144c7a	2618	MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
JMF	12:0071cb144c7a	2619
JMF	12:0071cb144c7a	2620	total_dn_size += 2 + dn_size;
JMF	12:0071cb144c7a	2621	crt = crt->next;
JMF	12:0071cb144c7a	2622	}
JMF	12:0071cb144c7a	2623
JMF	12:0071cb144c7a	2624	ssl->out_msglen = p - buf;
JMF	12:0071cb144c7a	2625	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	2626	ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
JMF	12:0071cb144c7a	2627	ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
JMF	12:0071cb144c7a	2628	ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
JMF	12:0071cb144c7a	2629
JMF	12:0071cb144c7a	2630	ret = mbedtls_ssl_write_record( ssl );
JMF	12:0071cb144c7a	2631
JMF	12:0071cb144c7a	2632	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
JMF	12:0071cb144c7a	2633
JMF	12:0071cb144c7a	2634	return( ret );
JMF	12:0071cb144c7a	2635	}
JMF	12:0071cb144c7a	2636	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
JMF	12:0071cb144c7a	2637	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
JMF	12:0071cb144c7a	2638	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
JMF	12:0071cb144c7a	2639	!MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2640
JMF	12:0071cb144c7a	2641	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2642	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2643	static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2644	{
JMF	12:0071cb144c7a	2645	int ret;
JMF	12:0071cb144c7a	2646
JMF	12:0071cb144c7a	2647	if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
JMF	12:0071cb144c7a	2648	{
JMF	12:0071cb144c7a	2649	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
JMF	12:0071cb144c7a	2650	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
JMF	12:0071cb144c7a	2651	}
JMF	12:0071cb144c7a	2652
JMF	12:0071cb144c7a	2653	if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	2654	mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
JMF	12:0071cb144c7a	2655	MBEDTLS_ECDH_OURS ) ) != 0 )
JMF	12:0071cb144c7a	2656	{
JMF	12:0071cb144c7a	2657	MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
JMF	12:0071cb144c7a	2658	return( ret );
JMF	12:0071cb144c7a	2659	}
JMF	12:0071cb144c7a	2660
JMF	12:0071cb144c7a	2661	return( 0 );
JMF	12:0071cb144c7a	2662	}
JMF	12:0071cb144c7a	2663	#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\|
JMF	12:0071cb144c7a	2664	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
JMF	12:0071cb144c7a	2665
JMF	12:0071cb144c7a	2666	static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	2667	{
JMF	12:0071cb144c7a	2668	int ret;
JMF	12:0071cb144c7a	2669	size_t n = 0;
JMF	12:0071cb144c7a	2670	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
JMF	12:0071cb144c7a	2671	ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	2672
JMF	12:0071cb144c7a	2673	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2674	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	2675	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2676	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	2677	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2678	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2679	unsigned char *p = ssl->out_msg + 4;
JMF	12:0071cb144c7a	2680	unsigned char *dig_signed = p;
JMF	12:0071cb144c7a	2681	size_t dig_signed_len = 0, len;
JMF	12:0071cb144c7a	2682	((void) dig_signed);
JMF	12:0071cb144c7a	2683	((void) dig_signed_len);
JMF	12:0071cb144c7a	2684	((void) len);
JMF	12:0071cb144c7a	2685	#endif
JMF	12:0071cb144c7a	2686
JMF	12:0071cb144c7a	2687	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
JMF	12:0071cb144c7a	2688
JMF	12:0071cb144c7a	2689	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2690	defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	2691	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
JMF	12:0071cb144c7a	2692	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA \|\|
JMF	12:0071cb144c7a	2693	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	2694	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
JMF	12:0071cb144c7a	2695	{
JMF	12:0071cb144c7a	2696	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
JMF	12:0071cb144c7a	2697	ssl->state++;
JMF	12:0071cb144c7a	2698	return( 0 );
JMF	12:0071cb144c7a	2699	}
JMF	12:0071cb144c7a	2700	#endif
JMF	12:0071cb144c7a	2701
JMF	12:0071cb144c7a	2702	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2703	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2704	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
JMF	12:0071cb144c7a	2705	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
JMF	12:0071cb144c7a	2706	{
JMF	12:0071cb144c7a	2707	ssl_get_ecdh_params_from_cert( ssl );
JMF	12:0071cb144c7a	2708
JMF	12:0071cb144c7a	2709	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
JMF	12:0071cb144c7a	2710	ssl->state++;
JMF	12:0071cb144c7a	2711	return( 0 );
JMF	12:0071cb144c7a	2712	}
JMF	12:0071cb144c7a	2713	#endif
JMF	12:0071cb144c7a	2714
JMF	12:0071cb144c7a	2715	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	2716	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	2717	{
JMF	12:0071cb144c7a	2718	size_t jlen;
JMF	12:0071cb144c7a	2719	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
JMF	12:0071cb144c7a	2720
JMF	12:0071cb144c7a	2721	ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	2722	p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	2723	if( ret != 0 )
JMF	12:0071cb144c7a	2724	{
JMF	12:0071cb144c7a	2725	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
JMF	12:0071cb144c7a	2726	return( ret );
JMF	12:0071cb144c7a	2727	}
JMF	12:0071cb144c7a	2728
JMF	12:0071cb144c7a	2729	p += jlen;
JMF	12:0071cb144c7a	2730	n += jlen;
JMF	12:0071cb144c7a	2731	}
JMF	12:0071cb144c7a	2732	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	2733
JMF	12:0071cb144c7a	2734	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) \|\| \
JMF	12:0071cb144c7a	2735	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
JMF	12:0071cb144c7a	2736	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	2737	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
JMF	12:0071cb144c7a	2738	{
JMF	12:0071cb144c7a	2739	/* Note: we don't support identity hints, until someone asks
JMF	12:0071cb144c7a	2740	* for them. */
JMF	12:0071cb144c7a	2741	*(p++) = 0x00;
JMF	12:0071cb144c7a	2742	*(p++) = 0x00;
JMF	12:0071cb144c7a	2743
JMF	12:0071cb144c7a	2744	n += 2;
JMF	12:0071cb144c7a	2745	}
JMF	12:0071cb144c7a	2746	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED \|\|
JMF	12:0071cb144c7a	2747	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
JMF	12:0071cb144c7a	2748
JMF	12:0071cb144c7a	2749	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2750	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
JMF	12:0071cb144c7a	2751	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
JMF	12:0071cb144c7a	2752	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
JMF	12:0071cb144c7a	2753	{
JMF	12:0071cb144c7a	2754	if( ssl->conf->dhm_P.p == NULL \|\| ssl->conf->dhm_G.p == NULL )
JMF	12:0071cb144c7a	2755	{
JMF	12:0071cb144c7a	2756	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
JMF	12:0071cb144c7a	2757	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	2758	}
JMF	12:0071cb144c7a	2759
JMF	12:0071cb144c7a	2760	/*
JMF	12:0071cb144c7a	2761	* Ephemeral DH parameters:
JMF	12:0071cb144c7a	2762	*
JMF	12:0071cb144c7a	2763	* struct {
JMF	12:0071cb144c7a	2764	* opaque dh_p<1..2^16-1>;
JMF	12:0071cb144c7a	2765	* opaque dh_g<1..2^16-1>;
JMF	12:0071cb144c7a	2766	* opaque dh_Ys<1..2^16-1>;
JMF	12:0071cb144c7a	2767	* } ServerDHParams;
JMF	12:0071cb144c7a	2768	*/
JMF	12:0071cb144c7a	2769	if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 \|\|
JMF	12:0071cb144c7a	2770	( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
JMF	12:0071cb144c7a	2771	{
JMF	12:0071cb144c7a	2772	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
JMF	12:0071cb144c7a	2773	return( ret );
JMF	12:0071cb144c7a	2774	}
JMF	12:0071cb144c7a	2775
JMF	12:0071cb144c7a	2776	if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
JMF	12:0071cb144c7a	2777	(int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
JMF	12:0071cb144c7a	2778	p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	2779	{
JMF	12:0071cb144c7a	2780	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
JMF	12:0071cb144c7a	2781	return( ret );
JMF	12:0071cb144c7a	2782	}
JMF	12:0071cb144c7a	2783
JMF	12:0071cb144c7a	2784	dig_signed = p;
JMF	12:0071cb144c7a	2785	dig_signed_len = len;
JMF	12:0071cb144c7a	2786
JMF	12:0071cb144c7a	2787	p += len;
JMF	12:0071cb144c7a	2788	n += len;
JMF	12:0071cb144c7a	2789
JMF	12:0071cb144c7a	2790	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
JMF	12:0071cb144c7a	2791	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
JMF	12:0071cb144c7a	2792	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
JMF	12:0071cb144c7a	2793	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
JMF	12:0071cb144c7a	2794	}
JMF	12:0071cb144c7a	2795	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	2796	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
JMF	12:0071cb144c7a	2797
JMF	12:0071cb144c7a	2798	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
JMF	12:0071cb144c7a	2799	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
JMF	12:0071cb144c7a	2800	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA \|\|
JMF	12:0071cb144c7a	2801	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
JMF	12:0071cb144c7a	2802	{
JMF	12:0071cb144c7a	2803	/*
JMF	12:0071cb144c7a	2804	* Ephemeral ECDH parameters:
JMF	12:0071cb144c7a	2805	*
JMF	12:0071cb144c7a	2806	* struct {
JMF	12:0071cb144c7a	2807	* ECParameters curve_params;
JMF	12:0071cb144c7a	2808	* ECPoint public;
JMF	12:0071cb144c7a	2809	* } ServerECDHParams;
JMF	12:0071cb144c7a	2810	*/
JMF	12:0071cb144c7a	2811	const mbedtls_ecp_curve_info **curve = NULL;
JMF	12:0071cb144c7a	2812	const mbedtls_ecp_group_id *gid;
JMF	12:0071cb144c7a	2813
JMF	12:0071cb144c7a	2814	/* Match our preference list against the offered curves */
JMF	12:0071cb144c7a	2815	for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
JMF	12:0071cb144c7a	2816	for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
JMF	12:0071cb144c7a	2817	if( (curve)->grp_id == gid )
JMF	12:0071cb144c7a	2818	goto curve_matching_done;
JMF	12:0071cb144c7a	2819
JMF	12:0071cb144c7a	2820	curve_matching_done:
JMF	12:0071cb144c7a	2821	if( curve == NULL \|\| *curve == NULL )
JMF	12:0071cb144c7a	2822	{
JMF	12:0071cb144c7a	2823	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
JMF	12:0071cb144c7a	2824	return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
JMF	12:0071cb144c7a	2825	}
JMF	12:0071cb144c7a	2826
JMF	12:0071cb144c7a	2827	MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
JMF	12:0071cb144c7a	2828
JMF	12:0071cb144c7a	2829	if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
JMF	12:0071cb144c7a	2830	(*curve)->grp_id ) ) != 0 )
JMF	12:0071cb144c7a	2831	{
JMF	12:0071cb144c7a	2832	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
JMF	12:0071cb144c7a	2833	return( ret );
JMF	12:0071cb144c7a	2834	}
JMF	12:0071cb144c7a	2835
JMF	12:0071cb144c7a	2836	if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
JMF	12:0071cb144c7a	2837	p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
JMF	12:0071cb144c7a	2838	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	2839	{
JMF	12:0071cb144c7a	2840	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
JMF	12:0071cb144c7a	2841	return( ret );
JMF	12:0071cb144c7a	2842	}
JMF	12:0071cb144c7a	2843
JMF	12:0071cb144c7a	2844	dig_signed = p;
JMF	12:0071cb144c7a	2845	dig_signed_len = len;
JMF	12:0071cb144c7a	2846
JMF	12:0071cb144c7a	2847	p += len;
JMF	12:0071cb144c7a	2848	n += len;
JMF	12:0071cb144c7a	2849
JMF	12:0071cb144c7a	2850	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
JMF	12:0071cb144c7a	2851	}
JMF	12:0071cb144c7a	2852	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
JMF	12:0071cb144c7a	2853
JMF	12:0071cb144c7a	2854	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2855	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	2856	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	2857	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
JMF	12:0071cb144c7a	2858	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
JMF	12:0071cb144c7a	2859	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
JMF	12:0071cb144c7a	2860	{
JMF	12:0071cb144c7a	2861	size_t signature_len = 0;
JMF	12:0071cb144c7a	2862	unsigned int hashlen = 0;
JMF	12:0071cb144c7a	2863	unsigned char hash[64];
JMF	12:0071cb144c7a	2864	mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	2865
JMF	12:0071cb144c7a	2866	/*
JMF	12:0071cb144c7a	2867	* Choose hash algorithm. NONE means MD5 + SHA1 here.
JMF	12:0071cb144c7a	2868	*/
JMF	12:0071cb144c7a	2869	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2870	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2871	{
JMF	12:0071cb144c7a	2872	md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
JMF	12:0071cb144c7a	2873
JMF	12:0071cb144c7a	2874	if( md_alg == MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2875	{
JMF	12:0071cb144c7a	2876	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2877	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2878	}
JMF	12:0071cb144c7a	2879	}
JMF	12:0071cb144c7a	2880	else
JMF	12:0071cb144c7a	2881	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2882	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
JMF	12:0071cb144c7a	2883	defined(MBEDTLS_SSL_PROTO_TLS1_1)
JMF	12:0071cb144c7a	2884	if( ciphersuite_info->key_exchange ==
JMF	12:0071cb144c7a	2885	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
JMF	12:0071cb144c7a	2886	{
JMF	12:0071cb144c7a	2887	md_alg = MBEDTLS_MD_SHA1;
JMF	12:0071cb144c7a	2888	}
JMF	12:0071cb144c7a	2889	else
JMF	12:0071cb144c7a	2890	#endif
JMF	12:0071cb144c7a	2891	{
JMF	12:0071cb144c7a	2892	md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	2893	}
JMF	12:0071cb144c7a	2894
JMF	12:0071cb144c7a	2895	/*
JMF	12:0071cb144c7a	2896	* Compute the hash to be signed
JMF	12:0071cb144c7a	2897	*/
JMF	12:0071cb144c7a	2898	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
JMF	12:0071cb144c7a	2899	defined(MBEDTLS_SSL_PROTO_TLS1_1)
JMF	12:0071cb144c7a	2900	if( md_alg == MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2901	{
JMF	12:0071cb144c7a	2902	mbedtls_md5_context mbedtls_md5;
JMF	12:0071cb144c7a	2903	mbedtls_sha1_context mbedtls_sha1;
JMF	12:0071cb144c7a	2904
JMF	12:0071cb144c7a	2905	mbedtls_md5_init( &mbedtls_md5 );
JMF	12:0071cb144c7a	2906	mbedtls_sha1_init( &mbedtls_sha1 );
JMF	12:0071cb144c7a	2907
JMF	12:0071cb144c7a	2908	/*
JMF	12:0071cb144c7a	2909	* digitally-signed struct {
JMF	12:0071cb144c7a	2910	* opaque md5_hash[16];
JMF	12:0071cb144c7a	2911	* opaque sha_hash[20];
JMF	12:0071cb144c7a	2912	* };
JMF	12:0071cb144c7a	2913	*
JMF	12:0071cb144c7a	2914	* md5_hash
JMF	12:0071cb144c7a	2915	* MD5(ClientHello.random + ServerHello.random
JMF	12:0071cb144c7a	2916	* + ServerParams);
JMF	12:0071cb144c7a	2917	* sha_hash
JMF	12:0071cb144c7a	2918	* SHA(ClientHello.random + ServerHello.random
JMF	12:0071cb144c7a	2919	* + ServerParams);
JMF	12:0071cb144c7a	2920	*/
JMF	12:0071cb144c7a	2921	mbedtls_md5_starts( &mbedtls_md5 );
JMF	12:0071cb144c7a	2922	mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
JMF	12:0071cb144c7a	2923	mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
JMF	12:0071cb144c7a	2924	mbedtls_md5_finish( &mbedtls_md5, hash );
JMF	12:0071cb144c7a	2925
JMF	12:0071cb144c7a	2926	mbedtls_sha1_starts( &mbedtls_sha1 );
JMF	12:0071cb144c7a	2927	mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
JMF	12:0071cb144c7a	2928	mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
JMF	12:0071cb144c7a	2929	mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
JMF	12:0071cb144c7a	2930
JMF	12:0071cb144c7a	2931	hashlen = 36;
JMF	12:0071cb144c7a	2932
JMF	12:0071cb144c7a	2933	mbedtls_md5_free( &mbedtls_md5 );
JMF	12:0071cb144c7a	2934	mbedtls_sha1_free( &mbedtls_sha1 );
JMF	12:0071cb144c7a	2935	}
JMF	12:0071cb144c7a	2936	else
JMF	12:0071cb144c7a	2937	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\| \
JMF	12:0071cb144c7a	2938	MBEDTLS_SSL_PROTO_TLS1_1 */
JMF	12:0071cb144c7a	2939	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
JMF	12:0071cb144c7a	2940	defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2941	if( md_alg != MBEDTLS_MD_NONE )
JMF	12:0071cb144c7a	2942	{
JMF	12:0071cb144c7a	2943	mbedtls_md_context_t ctx;
JMF	12:0071cb144c7a	2944	const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
JMF	12:0071cb144c7a	2945
JMF	12:0071cb144c7a	2946	mbedtls_md_init( &ctx );
JMF	12:0071cb144c7a	2947
JMF	12:0071cb144c7a	2948	/* Info from md_alg will be used instead */
JMF	12:0071cb144c7a	2949	hashlen = 0;
JMF	12:0071cb144c7a	2950
JMF	12:0071cb144c7a	2951	/*
JMF	12:0071cb144c7a	2952	* digitally-signed struct {
JMF	12:0071cb144c7a	2953	* opaque client_random[32];
JMF	12:0071cb144c7a	2954	* opaque server_random[32];
JMF	12:0071cb144c7a	2955	* ServerDHParams params;
JMF	12:0071cb144c7a	2956	* };
JMF	12:0071cb144c7a	2957	*/
JMF	12:0071cb144c7a	2958	if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
JMF	12:0071cb144c7a	2959	{
JMF	12:0071cb144c7a	2960	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
JMF	12:0071cb144c7a	2961	return( ret );
JMF	12:0071cb144c7a	2962	}
JMF	12:0071cb144c7a	2963
JMF	12:0071cb144c7a	2964	mbedtls_md_starts( &ctx );
JMF	12:0071cb144c7a	2965	mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
JMF	12:0071cb144c7a	2966	mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
JMF	12:0071cb144c7a	2967	mbedtls_md_finish( &ctx, hash );
JMF	12:0071cb144c7a	2968	mbedtls_md_free( &ctx );
JMF	12:0071cb144c7a	2969	}
JMF	12:0071cb144c7a	2970	else
JMF	12:0071cb144c7a	2971	#endif /* MBEDTLS_SSL_PROTO_TLS1 \|\| MBEDTLS_SSL_PROTO_TLS1_1 \|\| \
JMF	12:0071cb144c7a	2972	MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2973	{
JMF	12:0071cb144c7a	2974	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	2975	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	2976	}
JMF	12:0071cb144c7a	2977
JMF	12:0071cb144c7a	2978	MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
JMF	12:0071cb144c7a	2979	(unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
JMF	12:0071cb144c7a	2980
JMF	12:0071cb144c7a	2981	/*
JMF	12:0071cb144c7a	2982	* Make the signature
JMF	12:0071cb144c7a	2983	*/
JMF	12:0071cb144c7a	2984	if( mbedtls_ssl_own_key( ssl ) == NULL )
JMF	12:0071cb144c7a	2985	{
JMF	12:0071cb144c7a	2986	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
JMF	12:0071cb144c7a	2987	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
JMF	12:0071cb144c7a	2988	}
JMF	12:0071cb144c7a	2989
JMF	12:0071cb144c7a	2990	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	2991	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	2992	{
JMF	12:0071cb144c7a	2993	*(p++) = ssl->handshake->sig_alg;
JMF	12:0071cb144c7a	2994	*(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
JMF	12:0071cb144c7a	2995
JMF	12:0071cb144c7a	2996	n += 2;
JMF	12:0071cb144c7a	2997	}
JMF	12:0071cb144c7a	2998	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	2999
JMF	12:0071cb144c7a	3000	if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
JMF	12:0071cb144c7a	3001	p + 2 , &signature_len,
JMF	12:0071cb144c7a	3002	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	3003	{
JMF	12:0071cb144c7a	3004	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
JMF	12:0071cb144c7a	3005	return( ret );
JMF	12:0071cb144c7a	3006	}
JMF	12:0071cb144c7a	3007
JMF	12:0071cb144c7a	3008	*(p++) = (unsigned char)( signature_len >> 8 );
JMF	12:0071cb144c7a	3009	*(p++) = (unsigned char)( signature_len );
JMF	12:0071cb144c7a	3010	n += 2;
JMF	12:0071cb144c7a	3011
JMF	12:0071cb144c7a	3012	MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
JMF	12:0071cb144c7a	3013
JMF	12:0071cb144c7a	3014	n += signature_len;
JMF	12:0071cb144c7a	3015	}
JMF	12:0071cb144c7a	3016	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\|
JMF	12:0071cb144c7a	3017	MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	3018	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
JMF	12:0071cb144c7a	3019
JMF	12:0071cb144c7a	3020	ssl->out_msglen = 4 + n;
JMF	12:0071cb144c7a	3021	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	3022	ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
JMF	12:0071cb144c7a	3023
JMF	12:0071cb144c7a	3024	ssl->state++;
JMF	12:0071cb144c7a	3025
JMF	12:0071cb144c7a	3026	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3027	{
JMF	12:0071cb144c7a	3028	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	3029	return( ret );
JMF	12:0071cb144c7a	3030	}
JMF	12:0071cb144c7a	3031
JMF	12:0071cb144c7a	3032	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
JMF	12:0071cb144c7a	3033
JMF	12:0071cb144c7a	3034	return( 0 );
JMF	12:0071cb144c7a	3035	}
JMF	12:0071cb144c7a	3036
JMF	12:0071cb144c7a	3037	static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3038	{
JMF	12:0071cb144c7a	3039	int ret;
JMF	12:0071cb144c7a	3040
JMF	12:0071cb144c7a	3041	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
JMF	12:0071cb144c7a	3042
JMF	12:0071cb144c7a	3043	ssl->out_msglen = 4;
JMF	12:0071cb144c7a	3044	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	3045	ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
JMF	12:0071cb144c7a	3046
JMF	12:0071cb144c7a	3047	ssl->state++;
JMF	12:0071cb144c7a	3048
JMF	12:0071cb144c7a	3049	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	3050	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
JMF	12:0071cb144c7a	3051	mbedtls_ssl_send_flight_completed( ssl );
JMF	12:0071cb144c7a	3052	#endif
JMF	12:0071cb144c7a	3053
JMF	12:0071cb144c7a	3054	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3055	{
JMF	12:0071cb144c7a	3056	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	3057	return( ret );
JMF	12:0071cb144c7a	3058	}
JMF	12:0071cb144c7a	3059
JMF	12:0071cb144c7a	3060	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
JMF	12:0071cb144c7a	3061
JMF	12:0071cb144c7a	3062	return( 0 );
JMF	12:0071cb144c7a	3063	}
JMF	12:0071cb144c7a	3064
JMF	12:0071cb144c7a	3065	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	3066	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
JMF	12:0071cb144c7a	3067	static int ssl_parse_client_dh_public( mbedtls_ssl_context ssl, unsigned char *p,
JMF	12:0071cb144c7a	3068	const unsigned char *end )
JMF	12:0071cb144c7a	3069	{
JMF	12:0071cb144c7a	3070	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	3071	size_t n;
JMF	12:0071cb144c7a	3072
JMF	12:0071cb144c7a	3073	/*
JMF	12:0071cb144c7a	3074	* Receive G^Y mod P, premaster = (G^Y)^X mod P
JMF	12:0071cb144c7a	3075	*/
JMF	12:0071cb144c7a	3076	if( *p + 2 > end )
JMF	12:0071cb144c7a	3077	{
JMF	12:0071cb144c7a	3078	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3079	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3080	}
JMF	12:0071cb144c7a	3081
JMF	12:0071cb144c7a	3082	n = ( (p)[0] << 8 ) \| (p)[1];
JMF	12:0071cb144c7a	3083	*p += 2;
JMF	12:0071cb144c7a	3084
JMF	12:0071cb144c7a	3085	if( *p + n > end )
JMF	12:0071cb144c7a	3086	{
JMF	12:0071cb144c7a	3087	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3088	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3089	}
JMF	12:0071cb144c7a	3090
JMF	12:0071cb144c7a	3091	if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
JMF	12:0071cb144c7a	3092	{
JMF	12:0071cb144c7a	3093	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
JMF	12:0071cb144c7a	3094	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
JMF	12:0071cb144c7a	3095	}
JMF	12:0071cb144c7a	3096
JMF	12:0071cb144c7a	3097	*p += n;
JMF	12:0071cb144c7a	3098
JMF	12:0071cb144c7a	3099	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
JMF	12:0071cb144c7a	3100
JMF	12:0071cb144c7a	3101	return( ret );
JMF	12:0071cb144c7a	3102	}
JMF	12:0071cb144c7a	3103	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	3104	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
JMF	12:0071cb144c7a	3105
JMF	12:0071cb144c7a	3106	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	3107	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
JMF	12:0071cb144c7a	3108	static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
JMF	12:0071cb144c7a	3109	const unsigned char *p,
JMF	12:0071cb144c7a	3110	const unsigned char *end,
JMF	12:0071cb144c7a	3111	size_t pms_offset )
JMF	12:0071cb144c7a	3112	{
JMF	12:0071cb144c7a	3113	int ret;
JMF	12:0071cb144c7a	3114	size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
JMF	12:0071cb144c7a	3115	unsigned char *pms = ssl->handshake->premaster + pms_offset;
JMF	12:0071cb144c7a	3116	unsigned char ver[2];
JMF	12:0071cb144c7a	3117	unsigned char fake_pms[48], peer_pms[48];
JMF	12:0071cb144c7a	3118	unsigned char mask;
JMF	12:0071cb144c7a	3119	size_t i, peer_pmslen;
JMF	12:0071cb144c7a	3120	unsigned int diff;
JMF	12:0071cb144c7a	3121
JMF	12:0071cb144c7a	3122	if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
JMF	12:0071cb144c7a	3123	{
JMF	12:0071cb144c7a	3124	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
JMF	12:0071cb144c7a	3125	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
JMF	12:0071cb144c7a	3126	}
JMF	12:0071cb144c7a	3127
JMF	12:0071cb144c7a	3128	/*
JMF	12:0071cb144c7a	3129	* Decrypt the premaster using own private RSA key
JMF	12:0071cb144c7a	3130	*/
JMF	12:0071cb144c7a	3131	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
JMF	12:0071cb144c7a	3132	defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	3133	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
JMF	12:0071cb144c7a	3134	{
JMF	12:0071cb144c7a	3135	if( *p++ != ( ( len >> 8 ) & 0xFF ) \|\|
JMF	12:0071cb144c7a	3136	*p++ != ( ( len ) & 0xFF ) )
JMF	12:0071cb144c7a	3137	{
JMF	12:0071cb144c7a	3138	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3139	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3140	}
JMF	12:0071cb144c7a	3141	}
JMF	12:0071cb144c7a	3142	#endif
JMF	12:0071cb144c7a	3143
JMF	12:0071cb144c7a	3144	if( p + len != end )
JMF	12:0071cb144c7a	3145	{
JMF	12:0071cb144c7a	3146	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3147	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3148	}
JMF	12:0071cb144c7a	3149
JMF	12:0071cb144c7a	3150	mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
JMF	12:0071cb144c7a	3151	ssl->handshake->max_minor_ver,
JMF	12:0071cb144c7a	3152	ssl->conf->transport, ver );
JMF	12:0071cb144c7a	3153
JMF	12:0071cb144c7a	3154	/*
JMF	12:0071cb144c7a	3155	* Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
JMF	12:0071cb144c7a	3156	* must not cause the connection to end immediately; instead, send a
JMF	12:0071cb144c7a	3157	* bad_record_mac later in the handshake.
JMF	12:0071cb144c7a	3158	* Also, avoid data-dependant branches here to protect against
JMF	12:0071cb144c7a	3159	* timing-based variants.
JMF	12:0071cb144c7a	3160	*/
JMF	12:0071cb144c7a	3161	ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
JMF	12:0071cb144c7a	3162	if( ret != 0 )
JMF	12:0071cb144c7a	3163	return( ret );
JMF	12:0071cb144c7a	3164
JMF	12:0071cb144c7a	3165	ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
JMF	12:0071cb144c7a	3166	peer_pms, &peer_pmslen,
JMF	12:0071cb144c7a	3167	sizeof( peer_pms ),
JMF	12:0071cb144c7a	3168	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	3169
JMF	12:0071cb144c7a	3170	diff = (unsigned int) ret;
JMF	12:0071cb144c7a	3171	diff \|= peer_pmslen ^ 48;
JMF	12:0071cb144c7a	3172	diff \|= peer_pms[0] ^ ver[0];
JMF	12:0071cb144c7a	3173	diff \|= peer_pms[1] ^ ver[1];
JMF	12:0071cb144c7a	3174
JMF	12:0071cb144c7a	3175	#if defined(MBEDTLS_SSL_DEBUG_ALL)
JMF	12:0071cb144c7a	3176	if( diff != 0 )
JMF	12:0071cb144c7a	3177	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3178	#endif
JMF	12:0071cb144c7a	3179
JMF	12:0071cb144c7a	3180	if( sizeof( ssl->handshake->premaster ) < pms_offset \|\|
JMF	12:0071cb144c7a	3181	sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
JMF	12:0071cb144c7a	3182	{
JMF	12:0071cb144c7a	3183	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	3184	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	3185	}
JMF	12:0071cb144c7a	3186	ssl->handshake->pmslen = 48;
JMF	12:0071cb144c7a	3187
JMF	12:0071cb144c7a	3188	/* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
JMF	12:0071cb144c7a	3189	/* MSVC has a warning about unary minus on unsigned, but this is
JMF	12:0071cb144c7a	3190	* well-defined and precisely what we want to do here */
JMF	12:0071cb144c7a	3191	#if defined(_MSC_VER)
JMF	12:0071cb144c7a	3192	#pragma warning( push )
JMF	12:0071cb144c7a	3193	#pragma warning( disable : 4146 )
JMF	12:0071cb144c7a	3194	#endif
JMF	12:0071cb144c7a	3195	mask = - ( ( diff \| - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
JMF	12:0071cb144c7a	3196	#if defined(_MSC_VER)
JMF	12:0071cb144c7a	3197	#pragma warning( pop )
JMF	12:0071cb144c7a	3198	#endif
JMF	12:0071cb144c7a	3199
JMF	12:0071cb144c7a	3200	for( i = 0; i < ssl->handshake->pmslen; i++ )
JMF	12:0071cb144c7a	3201	pms[i] = ( mask & fake_pms[i] ) \| ( (~mask) & peer_pms[i] );
JMF	12:0071cb144c7a	3202
JMF	12:0071cb144c7a	3203	return( 0 );
JMF	12:0071cb144c7a	3204	}
JMF	12:0071cb144c7a	3205	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	3206	MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
JMF	12:0071cb144c7a	3207
JMF	12:0071cb144c7a	3208	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
JMF	12:0071cb144c7a	3209	static int ssl_parse_client_psk_identity( mbedtls_ssl_context ssl, unsigned char *p,
JMF	12:0071cb144c7a	3210	const unsigned char *end )
JMF	12:0071cb144c7a	3211	{
JMF	12:0071cb144c7a	3212	int ret = 0;
JMF	12:0071cb144c7a	3213	size_t n;
JMF	12:0071cb144c7a	3214
JMF	12:0071cb144c7a	3215	if( ssl->conf->f_psk == NULL &&
JMF	12:0071cb144c7a	3216	( ssl->conf->psk == NULL \|\| ssl->conf->psk_identity == NULL \|\|
JMF	12:0071cb144c7a	3217	ssl->conf->psk_identity_len == 0 \|\| ssl->conf->psk_len == 0 ) )
JMF	12:0071cb144c7a	3218	{
JMF	12:0071cb144c7a	3219	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
JMF	12:0071cb144c7a	3220	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
JMF	12:0071cb144c7a	3221	}
JMF	12:0071cb144c7a	3222
JMF	12:0071cb144c7a	3223	/*
JMF	12:0071cb144c7a	3224	* Receive client pre-shared key identity name
JMF	12:0071cb144c7a	3225	*/
JMF	12:0071cb144c7a	3226	if( *p + 2 > end )
JMF	12:0071cb144c7a	3227	{
JMF	12:0071cb144c7a	3228	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3229	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3230	}
JMF	12:0071cb144c7a	3231
JMF	12:0071cb144c7a	3232	n = ( (p)[0] << 8 ) \| (p)[1];
JMF	12:0071cb144c7a	3233	*p += 2;
JMF	12:0071cb144c7a	3234
JMF	12:0071cb144c7a	3235	if( n < 1 \|\| n > 65535 \|\| *p + n > end )
JMF	12:0071cb144c7a	3236	{
JMF	12:0071cb144c7a	3237	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3238	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3239	}
JMF	12:0071cb144c7a	3240
JMF	12:0071cb144c7a	3241	if( ssl->conf->f_psk != NULL )
JMF	12:0071cb144c7a	3242	{
JMF	12:0071cb144c7a	3243	if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
JMF	12:0071cb144c7a	3244	ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
JMF	12:0071cb144c7a	3245	}
JMF	12:0071cb144c7a	3246	else
JMF	12:0071cb144c7a	3247	{
JMF	12:0071cb144c7a	3248	/* Identity is not a big secret since clients send it in the clear,
JMF	12:0071cb144c7a	3249	* but treat it carefully anyway, just in case */
JMF	12:0071cb144c7a	3250	if( n != ssl->conf->psk_identity_len \|\|
JMF	12:0071cb144c7a	3251	mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
JMF	12:0071cb144c7a	3252	{
JMF	12:0071cb144c7a	3253	ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
JMF	12:0071cb144c7a	3254	}
JMF	12:0071cb144c7a	3255	}
JMF	12:0071cb144c7a	3256
JMF	12:0071cb144c7a	3257	if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
JMF	12:0071cb144c7a	3258	{
JMF	12:0071cb144c7a	3259	MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
JMF	12:0071cb144c7a	3260	if( ( ret = mbedtls_ssl_send_alert_message( ssl,
JMF	12:0071cb144c7a	3261	MBEDTLS_SSL_ALERT_LEVEL_FATAL,
JMF	12:0071cb144c7a	3262	MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
JMF	12:0071cb144c7a	3263	{
JMF	12:0071cb144c7a	3264	return( ret );
JMF	12:0071cb144c7a	3265	}
JMF	12:0071cb144c7a	3266
JMF	12:0071cb144c7a	3267	return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
JMF	12:0071cb144c7a	3268	}
JMF	12:0071cb144c7a	3269
JMF	12:0071cb144c7a	3270	*p += n;
JMF	12:0071cb144c7a	3271
JMF	12:0071cb144c7a	3272	return( 0 );
JMF	12:0071cb144c7a	3273	}
JMF	12:0071cb144c7a	3274	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
JMF	12:0071cb144c7a	3275
JMF	12:0071cb144c7a	3276	static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3277	{
JMF	12:0071cb144c7a	3278	int ret;
JMF	12:0071cb144c7a	3279	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
JMF	12:0071cb144c7a	3280	unsigned char p, end;
JMF	12:0071cb144c7a	3281
JMF	12:0071cb144c7a	3282	ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	3283
JMF	12:0071cb144c7a	3284	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
JMF	12:0071cb144c7a	3285
JMF	12:0071cb144c7a	3286	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3287	{
JMF	12:0071cb144c7a	3288	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	3289	return( ret );
JMF	12:0071cb144c7a	3290	}
JMF	12:0071cb144c7a	3291
JMF	12:0071cb144c7a	3292	p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	3293	end = ssl->in_msg + ssl->in_hslen;
JMF	12:0071cb144c7a	3294
JMF	12:0071cb144c7a	3295	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
JMF	12:0071cb144c7a	3296	{
JMF	12:0071cb144c7a	3297	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3298	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3299	}
JMF	12:0071cb144c7a	3300
JMF	12:0071cb144c7a	3301	if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
JMF	12:0071cb144c7a	3302	{
JMF	12:0071cb144c7a	3303	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
JMF	12:0071cb144c7a	3304	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3305	}
JMF	12:0071cb144c7a	3306
JMF	12:0071cb144c7a	3307	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
JMF	12:0071cb144c7a	3308	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
JMF	12:0071cb144c7a	3309	{
JMF	12:0071cb144c7a	3310	if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
JMF	12:0071cb144c7a	3311	{
JMF	12:0071cb144c7a	3312	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
JMF	12:0071cb144c7a	3313	return( ret );
JMF	12:0071cb144c7a	3314	}
JMF	12:0071cb144c7a	3315
JMF	12:0071cb144c7a	3316	if( p != end )
JMF	12:0071cb144c7a	3317	{
JMF	12:0071cb144c7a	3318	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
JMF	12:0071cb144c7a	3319	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3320	}
JMF	12:0071cb144c7a	3321
JMF	12:0071cb144c7a	3322	if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
JMF	12:0071cb144c7a	3323	ssl->handshake->premaster,
JMF	12:0071cb144c7a	3324	MBEDTLS_PREMASTER_SIZE,
JMF	12:0071cb144c7a	3325	&ssl->handshake->pmslen,
JMF	12:0071cb144c7a	3326	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	3327	{
JMF	12:0071cb144c7a	3328	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
JMF	12:0071cb144c7a	3329	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
JMF	12:0071cb144c7a	3330	}
JMF	12:0071cb144c7a	3331
JMF	12:0071cb144c7a	3332	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
JMF	12:0071cb144c7a	3333	}
JMF	12:0071cb144c7a	3334	else
JMF	12:0071cb144c7a	3335	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
JMF	12:0071cb144c7a	3336	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	3337	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	3338	defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
JMF	12:0071cb144c7a	3339	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
JMF	12:0071cb144c7a	3340	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
JMF	12:0071cb144c7a	3341	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA \|\|
JMF	12:0071cb144c7a	3342	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
JMF	12:0071cb144c7a	3343	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
JMF	12:0071cb144c7a	3344	{
JMF	12:0071cb144c7a	3345	if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	3346	p, end - p) ) != 0 )
JMF	12:0071cb144c7a	3347	{
JMF	12:0071cb144c7a	3348	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
JMF	12:0071cb144c7a	3349	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
JMF	12:0071cb144c7a	3350	}
JMF	12:0071cb144c7a	3351
JMF	12:0071cb144c7a	3352	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
JMF	12:0071cb144c7a	3353
JMF	12:0071cb144c7a	3354	if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	3355	&ssl->handshake->pmslen,
JMF	12:0071cb144c7a	3356	ssl->handshake->premaster,
JMF	12:0071cb144c7a	3357	MBEDTLS_MPI_MAX_SIZE,
JMF	12:0071cb144c7a	3358	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
JMF	12:0071cb144c7a	3359	{
JMF	12:0071cb144c7a	3360	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
JMF	12:0071cb144c7a	3361	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
JMF	12:0071cb144c7a	3362	}
JMF	12:0071cb144c7a	3363
JMF	12:0071cb144c7a	3364	MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
JMF	12:0071cb144c7a	3365	}
JMF	12:0071cb144c7a	3366	else
JMF	12:0071cb144c7a	3367	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	3368	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
JMF	12:0071cb144c7a	3369	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
JMF	12:0071cb144c7a	3370	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
JMF	12:0071cb144c7a	3371	#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
JMF	12:0071cb144c7a	3372	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
JMF	12:0071cb144c7a	3373	{
JMF	12:0071cb144c7a	3374	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
JMF	12:0071cb144c7a	3375	{
JMF	12:0071cb144c7a	3376	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
JMF	12:0071cb144c7a	3377	return( ret );
JMF	12:0071cb144c7a	3378	}
JMF	12:0071cb144c7a	3379
JMF	12:0071cb144c7a	3380	if( p != end )
JMF	12:0071cb144c7a	3381	{
JMF	12:0071cb144c7a	3382	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
JMF	12:0071cb144c7a	3383	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3384	}
JMF	12:0071cb144c7a	3385
JMF	12:0071cb144c7a	3386	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
JMF	12:0071cb144c7a	3387	ciphersuite_info->key_exchange ) ) != 0 )
JMF	12:0071cb144c7a	3388	{
JMF	12:0071cb144c7a	3389	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
JMF	12:0071cb144c7a	3390	return( ret );
JMF	12:0071cb144c7a	3391	}
JMF	12:0071cb144c7a	3392	}
JMF	12:0071cb144c7a	3393	else
JMF	12:0071cb144c7a	3394	#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
JMF	12:0071cb144c7a	3395	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
JMF	12:0071cb144c7a	3396	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
JMF	12:0071cb144c7a	3397	{
JMF	12:0071cb144c7a	3398	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
JMF	12:0071cb144c7a	3399	{
JMF	12:0071cb144c7a	3400	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
JMF	12:0071cb144c7a	3401	return( ret );
JMF	12:0071cb144c7a	3402	}
JMF	12:0071cb144c7a	3403
JMF	12:0071cb144c7a	3404	if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
JMF	12:0071cb144c7a	3405	{
JMF	12:0071cb144c7a	3406	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
JMF	12:0071cb144c7a	3407	return( ret );
JMF	12:0071cb144c7a	3408	}
JMF	12:0071cb144c7a	3409
JMF	12:0071cb144c7a	3410	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
JMF	12:0071cb144c7a	3411	ciphersuite_info->key_exchange ) ) != 0 )
JMF	12:0071cb144c7a	3412	{
JMF	12:0071cb144c7a	3413	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
JMF	12:0071cb144c7a	3414	return( ret );
JMF	12:0071cb144c7a	3415	}
JMF	12:0071cb144c7a	3416	}
JMF	12:0071cb144c7a	3417	else
JMF	12:0071cb144c7a	3418	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
JMF	12:0071cb144c7a	3419	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
JMF	12:0071cb144c7a	3420	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
JMF	12:0071cb144c7a	3421	{
JMF	12:0071cb144c7a	3422	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
JMF	12:0071cb144c7a	3423	{
JMF	12:0071cb144c7a	3424	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
JMF	12:0071cb144c7a	3425	return( ret );
JMF	12:0071cb144c7a	3426	}
JMF	12:0071cb144c7a	3427	if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
JMF	12:0071cb144c7a	3428	{
JMF	12:0071cb144c7a	3429	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
JMF	12:0071cb144c7a	3430	return( ret );
JMF	12:0071cb144c7a	3431	}
JMF	12:0071cb144c7a	3432
JMF	12:0071cb144c7a	3433	if( p != end )
JMF	12:0071cb144c7a	3434	{
JMF	12:0071cb144c7a	3435	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
JMF	12:0071cb144c7a	3436	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3437	}
JMF	12:0071cb144c7a	3438
JMF	12:0071cb144c7a	3439	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
JMF	12:0071cb144c7a	3440	ciphersuite_info->key_exchange ) ) != 0 )
JMF	12:0071cb144c7a	3441	{
JMF	12:0071cb144c7a	3442	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
JMF	12:0071cb144c7a	3443	return( ret );
JMF	12:0071cb144c7a	3444	}
JMF	12:0071cb144c7a	3445	}
JMF	12:0071cb144c7a	3446	else
JMF	12:0071cb144c7a	3447	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
JMF	12:0071cb144c7a	3448	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
JMF	12:0071cb144c7a	3449	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
JMF	12:0071cb144c7a	3450	{
JMF	12:0071cb144c7a	3451	if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
JMF	12:0071cb144c7a	3452	{
JMF	12:0071cb144c7a	3453	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
JMF	12:0071cb144c7a	3454	return( ret );
JMF	12:0071cb144c7a	3455	}
JMF	12:0071cb144c7a	3456
JMF	12:0071cb144c7a	3457	if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
JMF	12:0071cb144c7a	3458	p, end - p ) ) != 0 )
JMF	12:0071cb144c7a	3459	{
JMF	12:0071cb144c7a	3460	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
JMF	12:0071cb144c7a	3461	return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
JMF	12:0071cb144c7a	3462	}
JMF	12:0071cb144c7a	3463
JMF	12:0071cb144c7a	3464	MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
JMF	12:0071cb144c7a	3465
JMF	12:0071cb144c7a	3466	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
JMF	12:0071cb144c7a	3467	ciphersuite_info->key_exchange ) ) != 0 )
JMF	12:0071cb144c7a	3468	{
JMF	12:0071cb144c7a	3469	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
JMF	12:0071cb144c7a	3470	return( ret );
JMF	12:0071cb144c7a	3471	}
JMF	12:0071cb144c7a	3472	}
JMF	12:0071cb144c7a	3473	else
JMF	12:0071cb144c7a	3474	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
JMF	12:0071cb144c7a	3475	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
JMF	12:0071cb144c7a	3476	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
JMF	12:0071cb144c7a	3477	{
JMF	12:0071cb144c7a	3478	if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
JMF	12:0071cb144c7a	3479	{
JMF	12:0071cb144c7a	3480	MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
JMF	12:0071cb144c7a	3481	return( ret );
JMF	12:0071cb144c7a	3482	}
JMF	12:0071cb144c7a	3483	}
JMF	12:0071cb144c7a	3484	else
JMF	12:0071cb144c7a	3485	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
JMF	12:0071cb144c7a	3486	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
JMF	12:0071cb144c7a	3487	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	3488	{
JMF	12:0071cb144c7a	3489	ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	3490	p, end - p );
JMF	12:0071cb144c7a	3491	if( ret != 0 )
JMF	12:0071cb144c7a	3492	{
JMF	12:0071cb144c7a	3493	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
JMF	12:0071cb144c7a	3494	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
JMF	12:0071cb144c7a	3495	}
JMF	12:0071cb144c7a	3496
JMF	12:0071cb144c7a	3497	ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
JMF	12:0071cb144c7a	3498	ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
JMF	12:0071cb144c7a	3499	ssl->conf->f_rng, ssl->conf->p_rng );
JMF	12:0071cb144c7a	3500	if( ret != 0 )
JMF	12:0071cb144c7a	3501	{
JMF	12:0071cb144c7a	3502	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
JMF	12:0071cb144c7a	3503	return( ret );
JMF	12:0071cb144c7a	3504	}
JMF	12:0071cb144c7a	3505	}
JMF	12:0071cb144c7a	3506	else
JMF	12:0071cb144c7a	3507	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
JMF	12:0071cb144c7a	3508	{
JMF	12:0071cb144c7a	3509	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	3510	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	3511	}
JMF	12:0071cb144c7a	3512
JMF	12:0071cb144c7a	3513	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3514	{
JMF	12:0071cb144c7a	3515	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
JMF	12:0071cb144c7a	3516	return( ret );
JMF	12:0071cb144c7a	3517	}
JMF	12:0071cb144c7a	3518
JMF	12:0071cb144c7a	3519	ssl->state++;
JMF	12:0071cb144c7a	3520
JMF	12:0071cb144c7a	3521	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
JMF	12:0071cb144c7a	3522
JMF	12:0071cb144c7a	3523	return( 0 );
JMF	12:0071cb144c7a	3524	}
JMF	12:0071cb144c7a	3525
JMF	12:0071cb144c7a	3526	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	3527	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	3528	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
JMF	12:0071cb144c7a	3529	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
JMF	12:0071cb144c7a	3530	static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3531	{
JMF	12:0071cb144c7a	3532	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	3533
JMF	12:0071cb144c7a	3534	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
JMF	12:0071cb144c7a	3535
JMF	12:0071cb144c7a	3536	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	3537	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	3538	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	3539	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	3540	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
JMF	12:0071cb144c7a	3541	{
JMF	12:0071cb144c7a	3542	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
JMF	12:0071cb144c7a	3543	ssl->state++;
JMF	12:0071cb144c7a	3544	return( 0 );
JMF	12:0071cb144c7a	3545	}
JMF	12:0071cb144c7a	3546
JMF	12:0071cb144c7a	3547	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	3548	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	3549	}
JMF	12:0071cb144c7a	3550	#else
JMF	12:0071cb144c7a	3551	static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3552	{
JMF	12:0071cb144c7a	3553	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
JMF	12:0071cb144c7a	3554	size_t i, sig_len;
JMF	12:0071cb144c7a	3555	unsigned char hash[48];
JMF	12:0071cb144c7a	3556	unsigned char *hash_start = hash;
JMF	12:0071cb144c7a	3557	size_t hashlen;
JMF	12:0071cb144c7a	3558	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	3559	mbedtls_pk_type_t pk_alg;
JMF	12:0071cb144c7a	3560	#endif
JMF	12:0071cb144c7a	3561	mbedtls_md_type_t md_alg;
JMF	12:0071cb144c7a	3562	const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
JMF	12:0071cb144c7a	3563
JMF	12:0071cb144c7a	3564	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
JMF	12:0071cb144c7a	3565
JMF	12:0071cb144c7a	3566	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
JMF	12:0071cb144c7a	3567	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
JMF	12:0071cb144c7a	3568	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
JMF	12:0071cb144c7a	3569	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
JMF	12:0071cb144c7a	3570	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE \|\|
JMF	12:0071cb144c7a	3571	ssl->session_negotiate->peer_cert == NULL )
JMF	12:0071cb144c7a	3572	{
JMF	12:0071cb144c7a	3573	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
JMF	12:0071cb144c7a	3574	ssl->state++;
JMF	12:0071cb144c7a	3575	return( 0 );
JMF	12:0071cb144c7a	3576	}
JMF	12:0071cb144c7a	3577
JMF	12:0071cb144c7a	3578	/* Needs to be done before read_record() to exclude current message */
JMF	12:0071cb144c7a	3579	ssl->handshake->calc_verify( ssl, hash );
JMF	12:0071cb144c7a	3580
JMF	12:0071cb144c7a	3581	if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3582	{
JMF	12:0071cb144c7a	3583	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
JMF	12:0071cb144c7a	3584	return( ret );
JMF	12:0071cb144c7a	3585	}
JMF	12:0071cb144c7a	3586
JMF	12:0071cb144c7a	3587	ssl->state++;
JMF	12:0071cb144c7a	3588
JMF	12:0071cb144c7a	3589	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE \|\|
JMF	12:0071cb144c7a	3590	ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
JMF	12:0071cb144c7a	3591	{
JMF	12:0071cb144c7a	3592	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
JMF	12:0071cb144c7a	3593	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3594	}
JMF	12:0071cb144c7a	3595
JMF	12:0071cb144c7a	3596	i = mbedtls_ssl_hs_hdr_len( ssl );
JMF	12:0071cb144c7a	3597
JMF	12:0071cb144c7a	3598	/*
JMF	12:0071cb144c7a	3599	* struct {
JMF	12:0071cb144c7a	3600	* SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
JMF	12:0071cb144c7a	3601	* opaque signature<0..2^16-1>;
JMF	12:0071cb144c7a	3602	* } DigitallySigned;
JMF	12:0071cb144c7a	3603	*/
JMF	12:0071cb144c7a	3604	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
JMF	12:0071cb144c7a	3605	defined(MBEDTLS_SSL_PROTO_TLS1_1)
JMF	12:0071cb144c7a	3606	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	3607	{
JMF	12:0071cb144c7a	3608	md_alg = MBEDTLS_MD_NONE;
JMF	12:0071cb144c7a	3609	hashlen = 36;
JMF	12:0071cb144c7a	3610
JMF	12:0071cb144c7a	3611	/* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
JMF	12:0071cb144c7a	3612	if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
JMF	12:0071cb144c7a	3613	MBEDTLS_PK_ECDSA ) )
JMF	12:0071cb144c7a	3614	{
JMF	12:0071cb144c7a	3615	hash_start += 16;
JMF	12:0071cb144c7a	3616	hashlen -= 16;
JMF	12:0071cb144c7a	3617	md_alg = MBEDTLS_MD_SHA1;
JMF	12:0071cb144c7a	3618	}
JMF	12:0071cb144c7a	3619	}
JMF	12:0071cb144c7a	3620	else
JMF	12:0071cb144c7a	3621	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\|
JMF	12:0071cb144c7a	3622	MBEDTLS_SSL_PROTO_TLS1_1 */
JMF	12:0071cb144c7a	3623	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
JMF	12:0071cb144c7a	3624	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
JMF	12:0071cb144c7a	3625	{
JMF	12:0071cb144c7a	3626	if( i + 2 > ssl->in_hslen )
JMF	12:0071cb144c7a	3627	{
JMF	12:0071cb144c7a	3628	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
JMF	12:0071cb144c7a	3629	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3630	}
JMF	12:0071cb144c7a	3631
JMF	12:0071cb144c7a	3632	/*
JMF	12:0071cb144c7a	3633	* Hash
JMF	12:0071cb144c7a	3634	*/
JMF	12:0071cb144c7a	3635	if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
JMF	12:0071cb144c7a	3636	{
JMF	12:0071cb144c7a	3637	MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
JMF	12:0071cb144c7a	3638	" for verify message" ) );
JMF	12:0071cb144c7a	3639	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3640	}
JMF	12:0071cb144c7a	3641
JMF	12:0071cb144c7a	3642	md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
JMF	12:0071cb144c7a	3643
JMF	12:0071cb144c7a	3644	/* Info from md_alg will be used instead */
JMF	12:0071cb144c7a	3645	hashlen = 0;
JMF	12:0071cb144c7a	3646
JMF	12:0071cb144c7a	3647	i++;
JMF	12:0071cb144c7a	3648
JMF	12:0071cb144c7a	3649	/*
JMF	12:0071cb144c7a	3650	* Signature
JMF	12:0071cb144c7a	3651	*/
JMF	12:0071cb144c7a	3652	if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
JMF	12:0071cb144c7a	3653	== MBEDTLS_PK_NONE )
JMF	12:0071cb144c7a	3654	{
JMF	12:0071cb144c7a	3655	MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
JMF	12:0071cb144c7a	3656	" for verify message" ) );
JMF	12:0071cb144c7a	3657	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3658	}
JMF	12:0071cb144c7a	3659
JMF	12:0071cb144c7a	3660	/*
JMF	12:0071cb144c7a	3661	* Check the certificate's key type matches the signature alg
JMF	12:0071cb144c7a	3662	*/
JMF	12:0071cb144c7a	3663	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
JMF	12:0071cb144c7a	3664	{
JMF	12:0071cb144c7a	3665	MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
JMF	12:0071cb144c7a	3666	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3667	}
JMF	12:0071cb144c7a	3668
JMF	12:0071cb144c7a	3669	i++;
JMF	12:0071cb144c7a	3670	}
JMF	12:0071cb144c7a	3671	else
JMF	12:0071cb144c7a	3672	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
JMF	12:0071cb144c7a	3673	{
JMF	12:0071cb144c7a	3674	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
JMF	12:0071cb144c7a	3675	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
JMF	12:0071cb144c7a	3676	}
JMF	12:0071cb144c7a	3677
JMF	12:0071cb144c7a	3678	if( i + 2 > ssl->in_hslen )
JMF	12:0071cb144c7a	3679	{
JMF	12:0071cb144c7a	3680	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
JMF	12:0071cb144c7a	3681	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3682	}
JMF	12:0071cb144c7a	3683
JMF	12:0071cb144c7a	3684	sig_len = ( ssl->in_msg[i] << 8 ) \| ssl->in_msg[i+1];
JMF	12:0071cb144c7a	3685	i += 2;
JMF	12:0071cb144c7a	3686
JMF	12:0071cb144c7a	3687	if( i + sig_len != ssl->in_hslen )
JMF	12:0071cb144c7a	3688	{
JMF	12:0071cb144c7a	3689	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
JMF	12:0071cb144c7a	3690	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
JMF	12:0071cb144c7a	3691	}
JMF	12:0071cb144c7a	3692
JMF	12:0071cb144c7a	3693	if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
JMF	12:0071cb144c7a	3694	md_alg, hash_start, hashlen,
JMF	12:0071cb144c7a	3695	ssl->in_msg + i, sig_len ) ) != 0 )
JMF	12:0071cb144c7a	3696	{
JMF	12:0071cb144c7a	3697	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
JMF	12:0071cb144c7a	3698	return( ret );
JMF	12:0071cb144c7a	3699	}
JMF	12:0071cb144c7a	3700
JMF	12:0071cb144c7a	3701	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
JMF	12:0071cb144c7a	3702
JMF	12:0071cb144c7a	3703	return( ret );
JMF	12:0071cb144c7a	3704	}
JMF	12:0071cb144c7a	3705	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
JMF	12:0071cb144c7a	3706	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
JMF	12:0071cb144c7a	3707	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
JMF	12:0071cb144c7a	3708
JMF	12:0071cb144c7a	3709	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	3710	static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3711	{
JMF	12:0071cb144c7a	3712	int ret;
JMF	12:0071cb144c7a	3713	size_t tlen;
JMF	12:0071cb144c7a	3714	uint32_t lifetime;
JMF	12:0071cb144c7a	3715
JMF	12:0071cb144c7a	3716	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
JMF	12:0071cb144c7a	3717
JMF	12:0071cb144c7a	3718	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
JMF	12:0071cb144c7a	3719	ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
JMF	12:0071cb144c7a	3720
JMF	12:0071cb144c7a	3721	/*
JMF	12:0071cb144c7a	3722	* struct {
JMF	12:0071cb144c7a	3723	* uint32 ticket_lifetime_hint;
JMF	12:0071cb144c7a	3724	* opaque ticket<0..2^16-1>;
JMF	12:0071cb144c7a	3725	* } NewSessionTicket;
JMF	12:0071cb144c7a	3726	*
JMF	12:0071cb144c7a	3727	* 4 . 7 ticket_lifetime_hint (0 = unspecified)
JMF	12:0071cb144c7a	3728	* 8 . 9 ticket_len (n)
JMF	12:0071cb144c7a	3729	* 10 . 9+n ticket content
JMF	12:0071cb144c7a	3730	*/
JMF	12:0071cb144c7a	3731
JMF	12:0071cb144c7a	3732	if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
JMF	12:0071cb144c7a	3733	ssl->session_negotiate,
JMF	12:0071cb144c7a	3734	ssl->out_msg + 10,
JMF	12:0071cb144c7a	3735	ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
JMF	12:0071cb144c7a	3736	&tlen, &lifetime ) ) != 0 )
JMF	12:0071cb144c7a	3737	{
JMF	12:0071cb144c7a	3738	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
JMF	12:0071cb144c7a	3739	tlen = 0;
JMF	12:0071cb144c7a	3740	}
JMF	12:0071cb144c7a	3741
JMF	12:0071cb144c7a	3742	ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
JMF	12:0071cb144c7a	3743	ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
JMF	12:0071cb144c7a	3744	ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
JMF	12:0071cb144c7a	3745	ssl->out_msg[7] = ( lifetime ) & 0xFF;
JMF	12:0071cb144c7a	3746
JMF	12:0071cb144c7a	3747	ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
JMF	12:0071cb144c7a	3748	ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
JMF	12:0071cb144c7a	3749
JMF	12:0071cb144c7a	3750	ssl->out_msglen = 10 + tlen;
JMF	12:0071cb144c7a	3751
JMF	12:0071cb144c7a	3752	/*
JMF	12:0071cb144c7a	3753	* Morally equivalent to updating ssl->state, but NewSessionTicket and
JMF	12:0071cb144c7a	3754	* ChangeCipherSpec share the same state.
JMF	12:0071cb144c7a	3755	*/
JMF	12:0071cb144c7a	3756	ssl->handshake->new_session_ticket = 0;
JMF	12:0071cb144c7a	3757
JMF	12:0071cb144c7a	3758	if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3759	{
JMF	12:0071cb144c7a	3760	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
JMF	12:0071cb144c7a	3761	return( ret );
JMF	12:0071cb144c7a	3762	}
JMF	12:0071cb144c7a	3763
JMF	12:0071cb144c7a	3764	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
JMF	12:0071cb144c7a	3765
JMF	12:0071cb144c7a	3766	return( 0 );
JMF	12:0071cb144c7a	3767	}
JMF	12:0071cb144c7a	3768	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
JMF	12:0071cb144c7a	3769
JMF	12:0071cb144c7a	3770	/*
JMF	12:0071cb144c7a	3771	* SSL handshake -- server side -- single step
JMF	12:0071cb144c7a	3772	*/
JMF	12:0071cb144c7a	3773	int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
JMF	12:0071cb144c7a	3774	{
JMF	12:0071cb144c7a	3775	int ret = 0;
JMF	12:0071cb144c7a	3776
JMF	12:0071cb144c7a	3777	if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER \|\| ssl->handshake == NULL )
JMF	12:0071cb144c7a	3778	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	3779
JMF	12:0071cb144c7a	3780	MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
JMF	12:0071cb144c7a	3781
JMF	12:0071cb144c7a	3782	if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3783	return( ret );
JMF	12:0071cb144c7a	3784
JMF	12:0071cb144c7a	3785	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	3786	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
JMF	12:0071cb144c7a	3787	ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
JMF	12:0071cb144c7a	3788	{
JMF	12:0071cb144c7a	3789	if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
JMF	12:0071cb144c7a	3790	return( ret );
JMF	12:0071cb144c7a	3791	}
JMF	12:0071cb144c7a	3792	#endif
JMF	12:0071cb144c7a	3793
JMF	12:0071cb144c7a	3794	switch( ssl->state )
JMF	12:0071cb144c7a	3795	{
JMF	12:0071cb144c7a	3796	case MBEDTLS_SSL_HELLO_REQUEST:
JMF	12:0071cb144c7a	3797	ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
JMF	12:0071cb144c7a	3798	break;
JMF	12:0071cb144c7a	3799
JMF	12:0071cb144c7a	3800	/*
JMF	12:0071cb144c7a	3801	* <== ClientHello
JMF	12:0071cb144c7a	3802	*/
JMF	12:0071cb144c7a	3803	case MBEDTLS_SSL_CLIENT_HELLO:
JMF	12:0071cb144c7a	3804	ret = ssl_parse_client_hello( ssl );
JMF	12:0071cb144c7a	3805	break;
JMF	12:0071cb144c7a	3806
JMF	12:0071cb144c7a	3807	#if defined(MBEDTLS_SSL_PROTO_DTLS)
JMF	12:0071cb144c7a	3808	case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
JMF	12:0071cb144c7a	3809	return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
JMF	12:0071cb144c7a	3810	#endif
JMF	12:0071cb144c7a	3811
JMF	12:0071cb144c7a	3812	/*
JMF	12:0071cb144c7a	3813	* ==> ServerHello
JMF	12:0071cb144c7a	3814	* Certificate
JMF	12:0071cb144c7a	3815	* ( ServerKeyExchange )
JMF	12:0071cb144c7a	3816	* ( CertificateRequest )
JMF	12:0071cb144c7a	3817	* ServerHelloDone
JMF	12:0071cb144c7a	3818	*/
JMF	12:0071cb144c7a	3819	case MBEDTLS_SSL_SERVER_HELLO:
JMF	12:0071cb144c7a	3820	ret = ssl_write_server_hello( ssl );
JMF	12:0071cb144c7a	3821	break;
JMF	12:0071cb144c7a	3822
JMF	12:0071cb144c7a	3823	case MBEDTLS_SSL_SERVER_CERTIFICATE:
JMF	12:0071cb144c7a	3824	ret = mbedtls_ssl_write_certificate( ssl );
JMF	12:0071cb144c7a	3825	break;
JMF	12:0071cb144c7a	3826
JMF	12:0071cb144c7a	3827	case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
JMF	12:0071cb144c7a	3828	ret = ssl_write_server_key_exchange( ssl );
JMF	12:0071cb144c7a	3829	break;
JMF	12:0071cb144c7a	3830
JMF	12:0071cb144c7a	3831	case MBEDTLS_SSL_CERTIFICATE_REQUEST:
JMF	12:0071cb144c7a	3832	ret = ssl_write_certificate_request( ssl );
JMF	12:0071cb144c7a	3833	break;
JMF	12:0071cb144c7a	3834
JMF	12:0071cb144c7a	3835	case MBEDTLS_SSL_SERVER_HELLO_DONE:
JMF	12:0071cb144c7a	3836	ret = ssl_write_server_hello_done( ssl );
JMF	12:0071cb144c7a	3837	break;
JMF	12:0071cb144c7a	3838
JMF	12:0071cb144c7a	3839	/*
JMF	12:0071cb144c7a	3840	* <== ( Certificate/Alert )
JMF	12:0071cb144c7a	3841	* ClientKeyExchange
JMF	12:0071cb144c7a	3842	* ( CertificateVerify )
JMF	12:0071cb144c7a	3843	* ChangeCipherSpec
JMF	12:0071cb144c7a	3844	* Finished
JMF	12:0071cb144c7a	3845	*/
JMF	12:0071cb144c7a	3846	case MBEDTLS_SSL_CLIENT_CERTIFICATE:
JMF	12:0071cb144c7a	3847	ret = mbedtls_ssl_parse_certificate( ssl );
JMF	12:0071cb144c7a	3848	break;
JMF	12:0071cb144c7a	3849
JMF	12:0071cb144c7a	3850	case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
JMF	12:0071cb144c7a	3851	ret = ssl_parse_client_key_exchange( ssl );
JMF	12:0071cb144c7a	3852	break;
JMF	12:0071cb144c7a	3853
JMF	12:0071cb144c7a	3854	case MBEDTLS_SSL_CERTIFICATE_VERIFY:
JMF	12:0071cb144c7a	3855	ret = ssl_parse_certificate_verify( ssl );
JMF	12:0071cb144c7a	3856	break;
JMF	12:0071cb144c7a	3857
JMF	12:0071cb144c7a	3858	case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
JMF	12:0071cb144c7a	3859	ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
JMF	12:0071cb144c7a	3860	break;
JMF	12:0071cb144c7a	3861
JMF	12:0071cb144c7a	3862	case MBEDTLS_SSL_CLIENT_FINISHED:
JMF	12:0071cb144c7a	3863	ret = mbedtls_ssl_parse_finished( ssl );
JMF	12:0071cb144c7a	3864	break;
JMF	12:0071cb144c7a	3865
JMF	12:0071cb144c7a	3866	/*
JMF	12:0071cb144c7a	3867	* ==> ( NewSessionTicket )
JMF	12:0071cb144c7a	3868	* ChangeCipherSpec
JMF	12:0071cb144c7a	3869	* Finished
JMF	12:0071cb144c7a	3870	*/
JMF	12:0071cb144c7a	3871	case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
JMF	12:0071cb144c7a	3872	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
JMF	12:0071cb144c7a	3873	if( ssl->handshake->new_session_ticket != 0 )
JMF	12:0071cb144c7a	3874	ret = ssl_write_new_session_ticket( ssl );
JMF	12:0071cb144c7a	3875	else
JMF	12:0071cb144c7a	3876	#endif
JMF	12:0071cb144c7a	3877	ret = mbedtls_ssl_write_change_cipher_spec( ssl );
JMF	12:0071cb144c7a	3878	break;
JMF	12:0071cb144c7a	3879
JMF	12:0071cb144c7a	3880	case MBEDTLS_SSL_SERVER_FINISHED:
JMF	12:0071cb144c7a	3881	ret = mbedtls_ssl_write_finished( ssl );
JMF	12:0071cb144c7a	3882	break;
JMF	12:0071cb144c7a	3883
JMF	12:0071cb144c7a	3884	case MBEDTLS_SSL_FLUSH_BUFFERS:
JMF	12:0071cb144c7a	3885	MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
JMF	12:0071cb144c7a	3886	ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
JMF	12:0071cb144c7a	3887	break;
JMF	12:0071cb144c7a	3888
JMF	12:0071cb144c7a	3889	case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
JMF	12:0071cb144c7a	3890	mbedtls_ssl_handshake_wrapup( ssl );
JMF	12:0071cb144c7a	3891	break;
JMF	12:0071cb144c7a	3892
JMF	12:0071cb144c7a	3893	default:
JMF	12:0071cb144c7a	3894	MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
JMF	12:0071cb144c7a	3895	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
JMF	12:0071cb144c7a	3896	}
JMF	12:0071cb144c7a	3897
JMF	12:0071cb144c7a	3898	return( ret );
JMF	12:0071cb144c7a	3899	}
JMF	12:0071cb144c7a	3900	#endif /* MBEDTLS_SSL_SRV_C */

Repository toolbox

Export to desktop IDE

Build repository

Repository details

Type:	Program
Created:	18 Apr 2019
Imports:	0
Forks:	0
Commits:	32
Dependents:	0
Dependencies:	1
Followers:	1

mbedtls/source/ssl_srv.c@12:0071cb144c7a, 2016-11-01 (annotated)

Who changed what in which revision?

Repository toolbox

Repository details

Important Information for this Arm website

Access Warning