TrustedFirmware Git Browser
Code Review Sign In
review.trustedfirmware.org / OP-TEE / optee_os / 8bfc3de4e3aa12fed64575b37b5d0d9108b56e20 / . / lib / libmbedtls / mbedtls / library / ssl_cli.c
blob: 9fc312664d3a7814dc451e4dd646a473d17894b8 [file] [log] [blame]
Edison Aic6672fd2018-02-28 15:01:47 +0800[diff] [blame]1// SPDX-License-Identifier: Apache-2.0
Jens Wiklander817466c2018-05-22 13:49:31 +0200[diff] [blame]2/*
3 * SSLv3/TLSv1 client-side functions
4 *
5 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Jens Wiklander817466c2018-05-22 13:49:31 +0200[diff] [blame]6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 *
19 * This file is part of mbed TLS (https://tls.mbed.org)
20 */
21
22#if !defined(MBEDTLS_CONFIG_FILE)
23#include "mbedtls/config.h"
24#else
25#include MBEDTLS_CONFIG_FILE
26#endif
27
28#if defined(MBEDTLS_SSL_CLI_C)
29
30#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
34#define mbedtls_calloc calloc
35#define mbedtls_free free
36#endif
37
38#include "mbedtls/debug.h"
39#include "mbedtls/ssl.h"
40#include "mbedtls/ssl_internal.h"
41
42#include <string.h>
43
44#include <stdint.h>
45
46#if defined(MBEDTLS_HAVE_TIME)
47#include "mbedtls/platform_time.h"
48#endif
49
50#if defined(MBEDTLS_SSL_SESSION_TICKETS)
51/* Implementation that should never be optimized out by the compiler */
52static void mbedtls_zeroize( void *v, size_t n ) {
53 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
54}
55#endif
56
57#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
58static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
59 unsigned char *buf,
60 size_t *olen )
61{
62 unsigned char *p = buf;
63 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
64 size_t hostname_len;
65
66 *olen = 0;
67
68 if( ssl->hostname == NULL )
69 return;
70
71 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
72 ssl->hostname ) );
73
74 hostname_len = strlen( ssl->hostname );
75
76 if( end < p || (size_t)( end - p ) < hostname_len + 9 )
77 {
78 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
79 return;
80 }
81
82 /*
83 * struct {
84 * NameType name_type;
85 * select (name_type) {
86 * case host_name: HostName;
87 * } name;
88 * } ServerName;
89 *
90 * enum {
91 * host_name(0), (255)
92 * } NameType;
93 *
94 * opaque HostName<1..2^16-1>;
95 *
96 * struct {
97 * ServerName server_name_list<1..2^16-1>
98 * } ServerNameList;
99 */
100 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
101 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
102
103 *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
104 *p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
105
106 *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
107 *p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
108
109 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
110 *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
111 *p++ = (unsigned char)( ( hostname_len ) & 0xFF );
112
113 memcpy( p, ssl->hostname, hostname_len );
114
115 *olen = hostname_len + 9;
116}
117#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
118
119#if defined(MBEDTLS_SSL_RENEGOTIATION)
120static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
121 unsigned char *buf,
122 size_t *olen )
123{
124 unsigned char *p = buf;
125 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
126
127 *olen = 0;
128
129 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
130 return;
131
132 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
133
134 if( end < p || (size_t)( end - p ) < 5 + ssl->verify_data_len )
135 {
136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
137 return;
138 }
139
140 /*
141 * Secure renegotiation
142 */
143 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
144 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
145
146 *p++ = 0x00;
147 *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
148 *p++ = ssl->verify_data_len & 0xFF;
149
150 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
151
152 *olen = 5 + ssl->verify_data_len;
153}
154#endif /* MBEDTLS_SSL_RENEGOTIATION */
155
156/*
157 * Only if we handle at least one key exchange that needs signatures.
158 */
159#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
160 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
161static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
162 unsigned char *buf,
163 size_t *olen )
164{
165 unsigned char *p = buf;
166 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
167 size_t sig_alg_len = 0;
168 const int *md;
169#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C)
170 unsigned char *sig_alg_list = buf + 6;
171#endif
172
173 *olen = 0;
174
175 if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
176 return;
177
178 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
179
180 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
181 {
182#if defined(MBEDTLS_ECDSA_C)
183 sig_alg_len += 2;
184#endif
185#if defined(MBEDTLS_RSA_C)
186 sig_alg_len += 2;
187#endif
188 }
189
190 if( end < p || (size_t)( end - p ) < sig_alg_len + 6 )
191 {
192 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
193 return;
194 }
195
196 /*
197 * Prepare signature_algorithms extension (TLS 1.2)
198 */
199 sig_alg_len = 0;
200
201 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
202 {
203#if defined(MBEDTLS_ECDSA_C)
204 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
205 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
206#endif
207#if defined(MBEDTLS_RSA_C)
208 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
209 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
210#endif
211 }
212
213 /*
214 * enum {
215 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
216 * sha512(6), (255)
217 * } HashAlgorithm;
218 *
219 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
220 * SignatureAlgorithm;
221 *
222 * struct {
223 * HashAlgorithm hash;
224 * SignatureAlgorithm signature;
225 * } SignatureAndHashAlgorithm;
226 *
227 * SignatureAndHashAlgorithm
228 * supported_signature_algorithms<2..2^16-2>;
229 */
230 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
231 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
232
233 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
234 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
235
236 *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
237 *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
238
239 *olen = 6 + sig_alg_len;
240}
241#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
242 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
243
244#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
245 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
246static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
247 unsigned char *buf,
248 size_t *olen )
249{
250 unsigned char *p = buf;
251 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
252 unsigned char *elliptic_curve_list = p + 6;
253 size_t elliptic_curve_len = 0;
254 const mbedtls_ecp_curve_info *info;
255#if defined(MBEDTLS_ECP_C)
256 const mbedtls_ecp_group_id *grp_id;
257#else
258 ((void) ssl);
259#endif
260
261 *olen = 0;
262
263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) );
264
265#if defined(MBEDTLS_ECP_C)
266 for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
267#else
268 for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
269#endif
270 {
271#if defined(MBEDTLS_ECP_C)
272 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
273#endif
274 if( info == NULL )
275 {
276 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
277 return;
278 }
279
280 elliptic_curve_len += 2;
281 }
282
283 if( end < p || (size_t)( end - p ) < 6 + elliptic_curve_len )
284 {
285 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
286 return;
287 }
288
289 elliptic_curve_len = 0;
290
291#if defined(MBEDTLS_ECP_C)
292 for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
293#else
294 for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
295#endif
296 {
297#if defined(MBEDTLS_ECP_C)
298 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
299#endif
300 elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
301 elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
302 }
303
304 if( elliptic_curve_len == 0 )
305 return;
306
307 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF );
308 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES ) & 0xFF );
309
310 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
311 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
312
313 *p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
314 *p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
315
316 *olen = 6 + elliptic_curve_len;
317}
318
319static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
320 unsigned char *buf,
321 size_t *olen )
322{
323 unsigned char *p = buf;
324 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
325
326 *olen = 0;
327
328 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) );
329
330 if( end < p || (size_t)( end - p ) < 6 )
331 {
332 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
333 return;
334 }
335
336 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
337 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
338
339 *p++ = 0x00;
340 *p++ = 2;
341
342 *p++ = 1;
343 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
344
345 *olen = 6;
346}
347#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
348 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
349
350#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
351static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
352 unsigned char *buf,
353 size_t *olen )
354{
355 int ret;
356 unsigned char *p = buf;
357 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
358 size_t kkpp_len;
359
360 *olen = 0;
361
362 /* Skip costly extension if we can't use EC J-PAKE anyway */
363 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
364 return;
365
366 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) );
367
368 if( end - p < 4 )
369 {
370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
371 return;
372 }
373
374 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
375 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
376
377 /*
378 * We may need to send ClientHello multiple times for Hello verification.
379 * We don't want to compute fresh values every time (both for performance
380 * and consistency reasons), so cache the extension content.
381 */
382 if( ssl->handshake->ecjpake_cache == NULL ||
383 ssl->handshake->ecjpake_cache_len == 0 )
384 {
385 MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
386
387 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
388 p + 2, end - p - 2, &kkpp_len,
389 ssl->conf->f_rng, ssl->conf->p_rng );
390 if( ret != 0 )
391 {
392 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
393 return;
394 }
395
396 ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
397 if( ssl->handshake->ecjpake_cache == NULL )
398 {
399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
400 return;
401 }
402
403 memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
404 ssl->handshake->ecjpake_cache_len = kkpp_len;
405 }
406 else
407 {
408 MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
409
410 kkpp_len = ssl->handshake->ecjpake_cache_len;
411
412 if( (size_t)( end - p - 2 ) < kkpp_len )
413 {
414 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
415 return;
416 }
417
418 memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
419 }
420
421 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
422 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
423
424 *olen = kkpp_len + 4;
425}
426#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
427
428#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
429static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
430 unsigned char *buf,
431 size_t *olen )
432{
433 unsigned char *p = buf;
434 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
435
436 *olen = 0;
437
438 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) {
439 return;
440 }
441
442 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) );
443
444 if( end < p || (size_t)( end - p ) < 5 )
445 {
446 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
447 return;
448 }
449
450 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
451 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
452
453 *p++ = 0x00;
454 *p++ = 1;
455
456 *p++ = ssl->conf->mfl_code;
457
458 *olen = 5;
459}
460#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
461
462#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
463static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
464 unsigned char *buf, size_t *olen )
465{
466 unsigned char *p = buf;
467 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
468
469 *olen = 0;
470
471 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
472 {
473 return;
474 }
475
476 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) );
477
478 if( end < p || (size_t)( end - p ) < 4 )
479 {
480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
481 return;
482 }
483
484 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
485 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
486
487 *p++ = 0x00;
488 *p++ = 0x00;
489
490 *olen = 4;
491}
492#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
493
494#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
495static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
496 unsigned char *buf, size_t *olen )
497{
498 unsigned char *p = buf;
499 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
500
501 *olen = 0;
502
503 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
504 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
505 {
506 return;
507 }
508
509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac "
510 "extension" ) );
511
512 if( end < p || (size_t)( end - p ) < 4 )
513 {
514 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
515 return;
516 }
517
518 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
519 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
520
521 *p++ = 0x00;
522 *p++ = 0x00;
523
524 *olen = 4;
525}
526#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
527
528#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
529static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
530 unsigned char *buf, size_t *olen )
531{
532 unsigned char *p = buf;
533 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
534
535 *olen = 0;
536
537 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
538 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
539 {
540 return;
541 }
542
543 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret "
544 "extension" ) );
545
546 if( end < p || (size_t)( end - p ) < 4 )
547 {
548 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
549 return;
550 }
551
552 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
553 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
554
555 *p++ = 0x00;
556 *p++ = 0x00;
557
558 *olen = 4;
559}
560#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
561
562#if defined(MBEDTLS_SSL_SESSION_TICKETS)
563static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
564 unsigned char *buf, size_t *olen )
565{
566 unsigned char *p = buf;
567 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
568 size_t tlen = ssl->session_negotiate->ticket_len;
569
570 *olen = 0;
571
572 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
573 {
574 return;
575 }
576
577 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) );
578
579 if( end < p || (size_t)( end - p ) < 4 + tlen )
580 {
581 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
582 return;
583 }
584
585 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
586 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
587
588 *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
589 *p++ = (unsigned char)( ( tlen ) & 0xFF );
590
591 *olen = 4;
592
593 if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
594 {
595 return;
596 }
597
598 MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) );
599
600 memcpy( p, ssl->session_negotiate->ticket, tlen );
601
602 *olen += tlen;
603}
604#endif /* MBEDTLS_SSL_SESSION_TICKETS */
605
606#if defined(MBEDTLS_SSL_ALPN)
607static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
608 unsigned char *buf, size_t *olen )
609{
610 unsigned char *p = buf;
611 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
612 size_t alpnlen = 0;
613 const char **cur;
614
615 *olen = 0;
616
617 if( ssl->conf->alpn_list == NULL )
618 {
619 return;
620 }
621
622 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
623
624 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
625 alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1;
626
627 if( end < p || (size_t)( end - p ) < 6 + alpnlen )
628 {
629 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
630 return;
631 }
632
633 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
634 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
635
636 /*
637 * opaque ProtocolName<1..2^8-1>;
638 *
639 * struct {
640 * ProtocolName protocol_name_list<2..2^16-1>
641 * } ProtocolNameList;
642 */
643
644 /* Skip writing extension and list length for now */
645 p += 4;
646
647 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
648 {
649 *p = (unsigned char)( strlen( *cur ) & 0xFF );
650 memcpy( p + 1, *cur, *p );
651 p += 1 + *p;
652 }
653
654 *olen = p - buf;
655
656 /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
657 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
658 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
659
660 /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
661 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
662 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
663}
664#endif /* MBEDTLS_SSL_ALPN */
665
666/*
667 * Generate random bytes for ClientHello
668 */
669static int ssl_generate_random( mbedtls_ssl_context *ssl )
670{
671 int ret;
672 unsigned char *p = ssl->handshake->randbytes;
673#if defined(MBEDTLS_HAVE_TIME)
674 mbedtls_time_t t;
675#endif
676
677 /*
678 * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
679 */
680#if defined(MBEDTLS_SSL_PROTO_DTLS)
681 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
682 ssl->handshake->verify_cookie != NULL )
683 {
684 return( 0 );
685 }
686#endif
687
688#if defined(MBEDTLS_HAVE_TIME)
689 t = mbedtls_time( NULL );
690 *p++ = (unsigned char)( t >> 24 );
691 *p++ = (unsigned char)( t >> 16 );
692 *p++ = (unsigned char)( t >> 8 );
693 *p++ = (unsigned char)( t );
694
695 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
696#else
697 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
698 return( ret );
699
700 p += 4;
701#endif /* MBEDTLS_HAVE_TIME */
702
703 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
704 return( ret );
705
706 return( 0 );
707}
708
709static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
710{
711 int ret;
712 size_t i, n, olen, ext_len = 0;
713 unsigned char *buf;
714 unsigned char *p, *q;
715 unsigned char offer_compress;
716 const int *ciphersuites;
717 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
718
719 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
720
721 if( ssl->conf->f_rng == NULL )
722 {
723 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
724 return( MBEDTLS_ERR_SSL_NO_RNG );
725 }
726
727#if defined(MBEDTLS_SSL_RENEGOTIATION)
728 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
729#endif
730 {
731 ssl->major_ver = ssl->conf->min_major_ver;
732 ssl->minor_ver = ssl->conf->min_minor_ver;
733 }
734
735 if( ssl->conf->max_major_ver == 0 )
736 {
737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, "
738 "consider using mbedtls_ssl_config_defaults()" ) );
739 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
740 }
741
742 /*
743 * 0 . 0 handshake type
744 * 1 . 3 handshake length
745 * 4 . 5 highest version supported
746 * 6 . 9 current UNIX time
747 * 10 . 37 random bytes
748 */
749 buf = ssl->out_msg;
750 p = buf + 4;
751
752 mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
753 ssl->conf->transport, p );
754 p += 2;
755
756 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
757 buf[4], buf[5] ) );
758
759 if( ( ret = ssl_generate_random( ssl ) ) != 0 )
760 {
761 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
762 return( ret );
763 }
764
765 memcpy( p, ssl->handshake->randbytes, 32 );
766 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
767 p += 32;
768
769 /*
770 * 38 . 38 session id length
771 * 39 . 39+n session id
772 * 39+n . 39+n DTLS only: cookie length (1 byte)
773 * 40+n . .. DTSL only: cookie
774 * .. . .. ciphersuitelist length (2 bytes)
775 * .. . .. ciphersuitelist
776 * .. . .. compression methods length (1 byte)
777 * .. . .. compression methods
778 * .. . .. extensions length (2 bytes)
779 * .. . .. extensions
780 */
781 n = ssl->session_negotiate->id_len;
782
783 if( n < 16 || n > 32 ||
784#if defined(MBEDTLS_SSL_RENEGOTIATION)
785 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
786#endif
787 ssl->handshake->resume == 0 )
788 {
789 n = 0;
790 }
791
792#if defined(MBEDTLS_SSL_SESSION_TICKETS)
793 /*
794 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
795 * generate and include a Session ID in the TLS ClientHello."
796 */
797#if defined(MBEDTLS_SSL_RENEGOTIATION)
798 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
799#endif
800 {
801 if( ssl->session_negotiate->ticket != NULL &&
802 ssl->session_negotiate->ticket_len != 0 )
803 {
804 ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 );
805
806 if( ret != 0 )
807 return( ret );
808
809 ssl->session_negotiate->id_len = n = 32;
810 }
811 }
812#endif /* MBEDTLS_SSL_SESSION_TICKETS */
813
814 *p++ = (unsigned char) n;
815
816 for( i = 0; i < n; i++ )
817 *p++ = ssl->session_negotiate->id[i];
818
819 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
820 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
821
822 /*
823 * DTLS cookie
824 */
825#if defined(MBEDTLS_SSL_PROTO_DTLS)
826 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
827 {
828 if( ssl->handshake->verify_cookie == NULL )
829 {
830 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
831 *p++ = 0;
832 }
833 else
834 {
835 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
836 ssl->handshake->verify_cookie,
837 ssl->handshake->verify_cookie_len );
838
839 *p++ = ssl->handshake->verify_cookie_len;
840 memcpy( p, ssl->handshake->verify_cookie,
841 ssl->handshake->verify_cookie_len );
842 p += ssl->handshake->verify_cookie_len;
843 }
844 }
845#endif
846
847 /*
848 * Ciphersuite list
849 */
850 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
851
852 /* Skip writing ciphersuite length for now */
853 n = 0;
854 q = p;
855 p += 2;
856
857 for( i = 0; ciphersuites[i] != 0; i++ )
858 {
859 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
860
861 if( ciphersuite_info == NULL )
862 continue;
863
864 if( ciphersuite_info->min_minor_ver > ssl->conf->max_minor_ver ||
865 ciphersuite_info->max_minor_ver < ssl->conf->min_minor_ver )
866 continue;
867
868#if defined(MBEDTLS_SSL_PROTO_DTLS)
869 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
870 ( ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
871 continue;
872#endif
873
874#if defined(MBEDTLS_ARC4_C)
875 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
876 ciphersuite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
877 continue;
878#endif
879
880#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
881 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
882 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
883 continue;
884#endif
885
886 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
887 ciphersuites[i] ) );
888
889 n++;
890 *p++ = (unsigned char)( ciphersuites[i] >> 8 );
891 *p++ = (unsigned char)( ciphersuites[i] );
892 }
893
894 /*
895 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
896 */
897#if defined(MBEDTLS_SSL_RENEGOTIATION)
898 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
899#endif
900 {
901 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
902 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
903 n++;
904 }
905
906 /* Some versions of OpenSSL don't handle it correctly if not at end */
907#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
908 if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
909 {
910 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
911 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
912 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
913 n++;
914 }
915#endif
916
917 *q++ = (unsigned char)( n >> 7 );
918 *q++ = (unsigned char)( n << 1 );
919
920 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
921
922#if defined(MBEDTLS_ZLIB_SUPPORT)
923 offer_compress = 1;
924#else
925 offer_compress = 0;
926#endif
927
928 /*
929 * We don't support compression with DTLS right now: is many records come
930 * in the same datagram, uncompressing one could overwrite the next one.
931 * We don't want to add complexity for handling that case unless there is
932 * an actual need for it.
933 */
934#if defined(MBEDTLS_SSL_PROTO_DTLS)
935 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
936 offer_compress = 0;
937#endif
938
939 if( offer_compress )
940 {
941 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
942 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
943 MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) );
944
945 *p++ = 2;
946 *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
947 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
948 }
949 else
950 {
951 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
952 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
953 MBEDTLS_SSL_COMPRESS_NULL ) );
954
955 *p++ = 1;
956 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
957 }
958
959 // First write extensions, then the total length
960 //
961#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
962 ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen );
963 ext_len += olen;
964#endif
965
966#if defined(MBEDTLS_SSL_RENEGOTIATION)
967 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
968 ext_len += olen;
969#endif
970
971#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
972 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
973 ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen );
974 ext_len += olen;
975#endif
976
977#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
978 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
979 ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen );
980 ext_len += olen;
981
982 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
983 ext_len += olen;
984#endif
985
986#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
987 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
988 ext_len += olen;
989#endif
990
991#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
992 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
993 ext_len += olen;
994#endif
995
996#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
997 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
998 ext_len += olen;
999#endif
1000
1001#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1002 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
1003 ext_len += olen;
1004#endif
1005
1006#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1007 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
1008 ext_len += olen;
1009#endif
1010
1011#if defined(MBEDTLS_SSL_ALPN)
1012 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
1013 ext_len += olen;
1014#endif
1015
1016#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1017 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
1018 ext_len += olen;
1019#endif
1020
1021 /* olen unused if all extensions are disabled */
1022 ((void) olen);
1023
1024 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
1025 ext_len ) );
1026
1027 if( ext_len > 0 )
1028 {
1029 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1030 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
1031 p += ext_len;
1032 }
1033
1034 ssl->out_msglen = p - buf;
1035 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1036 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
1037
1038 ssl->state++;
1039
1040#if defined(MBEDTLS_SSL_PROTO_DTLS)
1041 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1042 mbedtls_ssl_send_flight_completed( ssl );
1043#endif
1044
1045 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
1046 {
1047 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
1048 return( ret );
1049 }
1050
1051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
1052
1053 return( 0 );
1054}
1055
1056static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
1057 const unsigned char *buf,
1058 size_t len )
1059{
1060#if defined(MBEDTLS_SSL_RENEGOTIATION)
1061 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
1062 {
1063 /* Check verify-data in constant-time. The length OTOH is no secret */
1064 if( len != 1 + ssl->verify_data_len * 2 ||
1065 buf[0] != ssl->verify_data_len * 2 ||
1066 mbedtls_ssl_safer_memcmp( buf + 1,
1067 ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
1068 mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
1069 ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
1070 {
1071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
1072 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1073 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1074 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1075 }
1076 }
1077 else
1078#endif /* MBEDTLS_SSL_RENEGOTIATION */
1079 {
1080 if( len != 1 || buf[0] != 0x00 )
1081 {
1082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
1083 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1084 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1085 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1086 }
1087
1088 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
1089 }
1090
1091 return( 0 );
1092}
1093
1094#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1095static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
1096 const unsigned char *buf,
1097 size_t len )
1098{
1099 /*
1100 * server should use the extension only if we did,
1101 * and if so the server's value should match ours (and len is always 1)
1102 */
1103 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ||
1104 len != 1 ||
1105 buf[0] != ssl->conf->mfl_code )
1106 {
1107 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching max fragment length extension" ) );
1108 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1109 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1110 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1111 }
1112
1113 return( 0 );
1114}
1115#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1116
1117#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1118static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
1119 const unsigned char *buf,
1120 size_t len )
1121{
1122 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ||
1123 len != 0 )
1124 {
1125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching truncated HMAC extension" ) );
1126 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1127 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1128 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1129 }
1130
1131 ((void) buf);
1132
1133 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
1134
1135 return( 0 );
1136}
1137#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1138
1139#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1140static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
1141 const unsigned char *buf,
1142 size_t len )
1143{
1144 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
1145 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1146 len != 0 )
1147 {
1148 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching encrypt-then-MAC extension" ) );
1149 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1150 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1151 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1152 }
1153
1154 ((void) buf);
1155
1156 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
1157
1158 return( 0 );
1159}
1160#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1161
1162#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1163static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
1164 const unsigned char *buf,
1165 size_t len )
1166{
1167 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
1168 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1169 len != 0 )
1170 {
1171 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching extended master secret extension" ) );
1172 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1173 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1174 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1175 }
1176
1177 ((void) buf);
1178
1179 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
1180
1181 return( 0 );
1182}
1183#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1184
1185#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1186static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
1187 const unsigned char *buf,
1188 size_t len )
1189{
1190 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ||
1191 len != 0 )
1192 {
1193 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching session ticket extension" ) );
1194 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1195 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1196 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1197 }
1198
1199 ((void) buf);
1200
1201 ssl->handshake->new_session_ticket = 1;
1202
1203 return( 0 );
1204}
1205#endif /* MBEDTLS_SSL_SESSION_TICKETS */
1206
1207#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1208 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1209static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
1210 const unsigned char *buf,
1211 size_t len )
1212{
1213 size_t list_size;
1214 const unsigned char *p;
1215
1216 list_size = buf[0];
1217 if( list_size + 1 != len )
1218 {
1219 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1220 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1221 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1222 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1223 }
1224
1225 p = buf + 1;
1226 while( list_size > 0 )
1227 {
1228 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
1229 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
1230 {
1231#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
1232 ssl->handshake->ecdh_ctx.point_format = p[0];
1233#endif
1234#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1235 ssl->handshake->ecjpake_ctx.point_format = p[0];
1236#endif
1237 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
1238 return( 0 );
1239 }
1240
1241 list_size--;
1242 p++;
1243 }
1244
1245 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
1246 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1247 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1248 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1249}
1250#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1251 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1252
1253#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1254static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
1255 const unsigned char *buf,
1256 size_t len )
1257{
1258 int ret;
1259
1260 if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
1261 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
1262 {
1263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
1264 return( 0 );
1265 }
1266
1267 /* If we got here, we no longer need our cached extension */
1268 mbedtls_free( ssl->handshake->ecjpake_cache );
1269 ssl->handshake->ecjpake_cache = NULL;
1270 ssl->handshake->ecjpake_cache_len = 0;
1271
1272 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
1273 buf, len ) ) != 0 )
1274 {
1275 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
1276 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1277 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1278 return( ret );
1279 }
1280
1281 return( 0 );
1282}
1283#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1284
1285#if defined(MBEDTLS_SSL_ALPN)
1286static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
1287 const unsigned char *buf, size_t len )
1288{
1289 size_t list_len, name_len;
1290 const char **p;
1291
1292 /* If we didn't send it, the server shouldn't send it */
1293 if( ssl->conf->alpn_list == NULL )
1294 {
1295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) );
1296 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1297 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1298 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1299 }
1300
1301 /*
1302 * opaque ProtocolName<1..2^8-1>;
1303 *
1304 * struct {
1305 * ProtocolName protocol_name_list<2..2^16-1>
1306 * } ProtocolNameList;
1307 *
1308 * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
1309 */
1310
1311 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
1312 if( len < 4 )
1313 {
1314 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1315 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1316 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1317 }
1318
1319 list_len = ( buf[0] << 8 ) | buf[1];
1320 if( list_len != len - 2 )
1321 {
1322 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1323 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1324 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1325 }
1326
1327 name_len = buf[2];
1328 if( name_len != list_len - 1 )
1329 {
1330 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1331 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1332 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1333 }
1334
1335 /* Check that the server chosen protocol was in our list and save it */
1336 for( p = ssl->conf->alpn_list; *p != NULL; p++ )
1337 {
1338 if( name_len == strlen( *p ) &&
1339 memcmp( buf + 3, *p, name_len ) == 0 )
1340 {
1341 ssl->alpn_chosen = *p;
1342 return( 0 );
1343 }
1344 }
1345
1346 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
1347 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1348 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1349 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1350}
1351#endif /* MBEDTLS_SSL_ALPN */
1352
1353/*
1354 * Parse HelloVerifyRequest. Only called after verifying the HS type.
1355 */
1356#if defined(MBEDTLS_SSL_PROTO_DTLS)
1357static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
1358{
1359 const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
1360 int major_ver, minor_ver;
1361 unsigned char cookie_len;
1362
1363 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
1364
1365 /*
1366 * struct {
1367 * ProtocolVersion server_version;
1368 * opaque cookie<0..2^8-1>;
1369 * } HelloVerifyRequest;
1370 */
1371 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
1372 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
1373 p += 2;
1374
1375 /*
1376 * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
1377 * even is lower than our min version.
1378 */
1379 if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
1380 minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ||
1381 major_ver > ssl->conf->max_major_ver ||
1382 minor_ver > ssl->conf->max_minor_ver )
1383 {
1384 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
1385
1386 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1387 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1388
1389 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1390 }
1391
1392 cookie_len = *p++;
1393 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
1394
1395 if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
1396 {
1397 MBEDTLS_SSL_DEBUG_MSG( 1,
1398 ( "cookie length does not match incoming message size" ) );
1399 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1400 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1401 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1402 }
1403
1404 mbedtls_free( ssl->handshake->verify_cookie );
1405
1406 ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
1407 if( ssl->handshake->verify_cookie == NULL )
1408 {
1409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
1410 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1411 }
1412
1413 memcpy( ssl->handshake->verify_cookie, p, cookie_len );
1414 ssl->handshake->verify_cookie_len = cookie_len;
1415
1416 /* Start over at ClientHello */
1417 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
1418 mbedtls_ssl_reset_checksum( ssl );
1419
1420 mbedtls_ssl_recv_flight_completed( ssl );
1421
1422 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
1423
1424 return( 0 );
1425}
1426#endif /* MBEDTLS_SSL_PROTO_DTLS */
1427
1428static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
1429{
1430 int ret, i;
1431 size_t n;
1432 size_t ext_len;
1433 unsigned char *buf, *ext;
1434 unsigned char comp;
1435#if defined(MBEDTLS_ZLIB_SUPPORT)
1436 int accept_comp;
1437#endif
1438#if defined(MBEDTLS_SSL_RENEGOTIATION)
1439 int renegotiation_info_seen = 0;
1440#endif
1441 int handshake_failure = 0;
1442 const mbedtls_ssl_ciphersuite_t *suite_info;
1443#if defined(MBEDTLS_DEBUG_C)
1444 uint32_t t;
1445#endif
1446
1447 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
1448
1449 buf = ssl->in_msg;
1450
1451 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
1452 {
1453 /* No alert on a read error. */
1454 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1455 return( ret );
1456 }
1457
1458 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
1459 {
1460#if defined(MBEDTLS_SSL_RENEGOTIATION)
1461 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
1462 {
1463 ssl->renego_records_seen++;
1464
1465 if( ssl->conf->renego_max_records >= 0 &&
1466 ssl->renego_records_seen > ssl->conf->renego_max_records )
1467 {
1468 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
1469 "but not honored by server" ) );
1470 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1471 }
1472
1473 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
1474
1475 ssl->keep_current_message = 1;
1476 return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
1477 }
1478#endif /* MBEDTLS_SSL_RENEGOTIATION */
1479
1480 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1481 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1482 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1483 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1484 }
1485
1486#if defined(MBEDTLS_SSL_PROTO_DTLS)
1487 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1488 {
1489 if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
1490 {
1491 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
1492 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
1493 return( ssl_parse_hello_verify_request( ssl ) );
1494 }
1495 else
1496 {
1497 /* We made it through the verification process */
1498 mbedtls_free( ssl->handshake->verify_cookie );
1499 ssl->handshake->verify_cookie = NULL;
1500 ssl->handshake->verify_cookie_len = 0;
1501 }
1502 }
1503#endif /* MBEDTLS_SSL_PROTO_DTLS */
1504
1505 if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) ||
1506 buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
1507 {
1508 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1509 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1510 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1511 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1512 }
1513
1514 /*
1515 * 0 . 1 server_version
1516 * 2 . 33 random (maybe including 4 bytes of Unix time)
1517 * 34 . 34 session_id length = n
1518 * 35 . 34+n session_id
1519 * 35+n . 36+n cipher_suite
1520 * 37+n . 37+n compression_method
1521 *
1522 * 38+n . 39+n extensions length (optional)
1523 * 40+n . .. extensions
1524 */
1525 buf += mbedtls_ssl_hs_hdr_len( ssl );
1526
1527 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
1528 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
1529 ssl->conf->transport, buf + 0 );
1530
1531 if( ssl->major_ver < ssl->conf->min_major_ver ||
1532 ssl->minor_ver < ssl->conf->min_minor_ver ||
1533 ssl->major_ver > ssl->conf->max_major_ver ||
1534 ssl->minor_ver > ssl->conf->max_minor_ver )
1535 {
1536 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
1537 " min: [%d:%d], server: [%d:%d], max: [%d:%d]",
1538 ssl->conf->min_major_ver, ssl->conf->min_minor_ver,
1539 ssl->major_ver, ssl->minor_ver,
1540 ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) );
1541
1542 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1543 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1544
1545 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1546 }
1547
1548#if defined(MBEDTLS_DEBUG_C)
1549 t = ( (uint32_t) buf[2] << 24 )
1550 | ( (uint32_t) buf[3] << 16 )
1551 | ( (uint32_t) buf[4] << 8 )
1552 | ( (uint32_t) buf[5] );
1553 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
1554#endif
1555
1556 memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
1557
1558 n = buf[34];
1559
1560 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
1561
1562 if( n > 32 )
1563 {
1564 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1565 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1566 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1567 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1568 }
1569
1570 if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
1571 {
1572 ext_len = ( ( buf[38 + n] << 8 )
1573 | ( buf[39 + n] ) );
1574
1575 if( ( ext_len > 0 && ext_len < 4 ) ||
1576 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
1577 {
1578 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1579 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1580 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1581 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1582 }
1583 }
1584 else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
1585 {
1586 ext_len = 0;
1587 }
1588 else
1589 {
1590 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1591 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1592 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1593 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1594 }
1595
1596 /* ciphersuite (used later) */
1597 i = ( buf[35 + n] << 8 ) | buf[36 + n];
1598
1599 /*
1600 * Read and check compression
1601 */
1602 comp = buf[37 + n];
1603
1604#if defined(MBEDTLS_ZLIB_SUPPORT)
1605 /* See comments in ssl_write_client_hello() */
1606#if defined(MBEDTLS_SSL_PROTO_DTLS)
1607 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1608 accept_comp = 0;
1609 else
1610#endif
1611 accept_comp = 1;
1612
1613 if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
1614 ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) )
1615#else /* MBEDTLS_ZLIB_SUPPORT */
1616 if( comp != MBEDTLS_SSL_COMPRESS_NULL )
1617#endif/* MBEDTLS_ZLIB_SUPPORT */
1618 {
1619 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
1620 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1621 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1622 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1623 }
1624
1625 /*
1626 * Initialize update checksum functions
1627 */
1628 ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
1629
1630 if( ssl->transform_negotiate->ciphersuite_info == NULL )
1631 {
1632 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) );
1633 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1634 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
1635 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1636 }
1637
1638 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
1639
1640 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
1641 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
1642
1643 /*
1644 * Check if the session can be resumed
1645 */
1646 if( ssl->handshake->resume == 0 || n == 0 ||
1647#if defined(MBEDTLS_SSL_RENEGOTIATION)
1648 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
1649#endif
1650 ssl->session_negotiate->ciphersuite != i ||
1651 ssl->session_negotiate->compression != comp ||
1652 ssl->session_negotiate->id_len != n ||
1653 memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
1654 {
1655 ssl->state++;
1656 ssl->handshake->resume = 0;
1657#if defined(MBEDTLS_HAVE_TIME)
1658 ssl->session_negotiate->start = mbedtls_time( NULL );
1659#endif
1660 ssl->session_negotiate->ciphersuite = i;
1661 ssl->session_negotiate->compression = comp;
1662 ssl->session_negotiate->id_len = n;
1663 memcpy( ssl->session_negotiate->id, buf + 35, n );
1664 }
1665 else
1666 {
1667 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
1668
1669 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
1670 {
1671 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
1672 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1673 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
1674 return( ret );
1675 }
1676 }
1677
1678 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
1679 ssl->handshake->resume ? "a" : "no" ) );
1680
1681 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
1682 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
1683
1684 suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
1685 if( suite_info == NULL
1686#if defined(MBEDTLS_ARC4_C)
1687 || ( ssl->conf->arc4_disabled &&
1688 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
1689#endif
1690 )
1691 {
1692 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1693 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1694 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1695 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1696 }
1697
1698 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
1699
1700 i = 0;
1701 while( 1 )
1702 {
1703 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
1704 {
1705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1706 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1707 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1708 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1709 }
1710
1711 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
1712 ssl->session_negotiate->ciphersuite )
1713 {
1714 break;
1715 }
1716 }
1717
1718 if( comp != MBEDTLS_SSL_COMPRESS_NULL
1719#if defined(MBEDTLS_ZLIB_SUPPORT)
1720 && comp != MBEDTLS_SSL_COMPRESS_DEFLATE
1721#endif
1722 )
1723 {
1724 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1725 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1726 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1727 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1728 }
1729 ssl->session_negotiate->compression = comp;
1730
1731 ext = buf + 40 + n;
1732
1733 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
1734
1735 while( ext_len )
1736 {
1737 unsigned int ext_id = ( ( ext[0] << 8 )
1738 | ( ext[1] ) );
1739 unsigned int ext_size = ( ( ext[2] << 8 )
1740 | ( ext[3] ) );
1741
1742 if( ext_size + 4 > ext_len )
1743 {
1744 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1745 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1746 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1747 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1748 }
1749
1750 switch( ext_id )
1751 {
1752 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1753 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
1754#if defined(MBEDTLS_SSL_RENEGOTIATION)
1755 renegotiation_info_seen = 1;
1756#endif
1757
1758 if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
1759 ext_size ) ) != 0 )
1760 return( ret );
1761
1762 break;
1763
1764#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1765 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1766 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
1767
1768 if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
1769 ext + 4, ext_size ) ) != 0 )
1770 {
1771 return( ret );
1772 }
1773
1774 break;
1775#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1776
1777#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1778 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1779 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
1780
1781 if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
1782 ext + 4, ext_size ) ) != 0 )
1783 {
1784 return( ret );
1785 }
1786
1787 break;
1788#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1789
1790#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1791 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1792 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
1793
1794 if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
1795 ext + 4, ext_size ) ) != 0 )
1796 {
1797 return( ret );
1798 }
1799
1800 break;
1801#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1802
1803#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1804 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1805 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) );
1806
1807 if( ( ret = ssl_parse_extended_ms_ext( ssl,
1808 ext + 4, ext_size ) ) != 0 )
1809 {
1810 return( ret );
1811 }
1812
1813 break;
1814#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1815
1816#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1817 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1818 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
1819
1820 if( ( ret = ssl_parse_session_ticket_ext( ssl,
1821 ext + 4, ext_size ) ) != 0 )
1822 {
1823 return( ret );
1824 }
1825
1826 break;
1827#endif /* MBEDTLS_SSL_SESSION_TICKETS */
1828
1829#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1830 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1831 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1832 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) );
1833
1834 if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
1835 ext + 4, ext_size ) ) != 0 )
1836 {
1837 return( ret );
1838 }
1839
1840 break;
1841#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1842 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1843
1844#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1845 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1846 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
1847
1848 if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
1849 ext + 4, ext_size ) ) != 0 )
1850 {
1851 return( ret );
1852 }
1853
1854 break;
1855#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1856
1857#if defined(MBEDTLS_SSL_ALPN)
1858 case MBEDTLS_TLS_EXT_ALPN:
1859 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
1860
1861 if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
1862 return( ret );
1863
1864 break;
1865#endif /* MBEDTLS_SSL_ALPN */
1866
1867 default:
1868 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1869 ext_id ) );
1870 }
1871
1872 ext_len -= 4 + ext_size;
1873 ext += 4 + ext_size;
1874
1875 if( ext_len > 0 && ext_len < 4 )
1876 {
1877 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1878 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1879 }
1880 }
1881
1882 /*
1883 * Renegotiation security checks
1884 */
1885 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1886 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
1887 {
1888 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1889 handshake_failure = 1;
1890 }
1891#if defined(MBEDTLS_SSL_RENEGOTIATION)
1892 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1893 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
1894 renegotiation_info_seen == 0 )
1895 {
1896 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
1897 handshake_failure = 1;
1898 }
1899 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1900 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1901 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
1902 {
1903 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
1904 handshake_failure = 1;
1905 }
1906 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1907 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1908 renegotiation_info_seen == 1 )
1909 {
1910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
1911 handshake_failure = 1;
1912 }
1913#endif /* MBEDTLS_SSL_RENEGOTIATION */
1914
1915 if( handshake_failure == 1 )
1916 {
1917 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1918 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1919 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1920 }
1921
1922 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
1923
1924 return( 0 );
1925}
1926
1927#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
1928 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1929static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl, unsigned char **p,
1930 unsigned char *end )
1931{
1932 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1933
1934 /*
1935 * Ephemeral DH parameters:
1936 *
1937 * struct {
1938 * opaque dh_p<1..2^16-1>;
1939 * opaque dh_g<1..2^16-1>;
1940 * opaque dh_Ys<1..2^16-1>;
1941 * } ServerDHParams;
1942 */
1943 if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 )
1944 {
1945 MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
1946 return( ret );
1947 }
1948
1949 if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
1950 {
1951 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
1952 ssl->handshake->dhm_ctx.len * 8,
1953 ssl->conf->dhm_min_bitlen ) );
1954 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
1955 }
1956
1957 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
1958 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
1959 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
1960
1961 return( ret );
1962}
1963#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
1964 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
1965
1966#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
1967 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
1968 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
1969 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
1970 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
1971static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
1972{
1973 const mbedtls_ecp_curve_info *curve_info;
1974
1975 curve_info = mbedtls_ecp_curve_info_from_grp_id( ssl->handshake->ecdh_ctx.grp.id );
1976 if( curve_info == NULL )
1977 {
1978 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
1979 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
1980 }
1981
1982 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
1983
1984#if defined(MBEDTLS_ECP_C)
1985 if( mbedtls_ssl_check_curve( ssl, ssl->handshake->ecdh_ctx.grp.id ) != 0 )
1986#else
1987 if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
1988 ssl->handshake->ecdh_ctx.grp.nbits > 521 )
1989#endif
1990 return( -1 );
1991
1992 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp", &ssl->handshake->ecdh_ctx.Qp );
1993
1994 return( 0 );
1995}
1996#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
1997 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
1998 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
1999 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2000 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2001
2002#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2003 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2004 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2005static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
2006 unsigned char **p,
2007 unsigned char *end )
2008{
2009 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2010
2011 /*
2012 * Ephemeral ECDH parameters:
2013 *
2014 * struct {
2015 * ECParameters curve_params;
2016 * ECPoint public;
2017 * } ServerECDHParams;
2018 */
2019 if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
2020 (const unsigned char **) p, end ) ) != 0 )
2021 {
2022 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
2023 return( ret );
2024 }
2025
2026 if( ssl_check_server_ecdh_params( ssl ) != 0 )
2027 {
2028 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) );
2029 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2030 }
2031
2032 return( ret );
2033}
2034#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2035 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2036 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2037
2038#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2039static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
2040 unsigned char **p,
2041 unsigned char *end )
2042{
2043 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2044 size_t len;
2045 ((void) ssl);
2046
2047 /*
2048 * PSK parameters:
2049 *
2050 * opaque psk_identity_hint<0..2^16-1>;
2051 */
2052 len = (*p)[0] << 8 | (*p)[1];
2053 *p += 2;
2054
2055 if( (*p) + len > end )
2056 {
2057 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
2058 "(psk_identity_hint length)" ) );
2059 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2060 }
2061
2062 /*
2063 * Note: we currently ignore the PKS identity hint, as we only allow one
2064 * PSK to be provisionned on the client. This could be changed later if
2065 * someone needs that feature.
2066 */
2067 *p += len;
2068 ret = 0;
2069
2070 return( ret );
2071}
2072#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2073
2074#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
2075 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2076/*
2077 * Generate a pre-master secret and encrypt it with the server's RSA key
2078 */
2079static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
2080 size_t offset, size_t *olen,
2081 size_t pms_offset )
2082{
2083 int ret;
2084 size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
2085 unsigned char *p = ssl->handshake->premaster + pms_offset;
2086
2087 if( offset + len_bytes > MBEDTLS_SSL_MAX_CONTENT_LEN )
2088 {
2089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
2090 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2091 }
2092
2093 /*
2094 * Generate (part of) the pre-master as
2095 * struct {
2096 * ProtocolVersion client_version;
2097 * opaque random[46];
2098 * } PreMasterSecret;
2099 */
2100 mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
2101 ssl->conf->transport, p );
2102
2103 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
2104 {
2105 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
2106 return( ret );
2107 }
2108
2109 ssl->handshake->pmslen = 48;
2110
2111 if( ssl->session_negotiate->peer_cert == NULL )
2112 {
2113 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
2114 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2115 }
2116
2117 /*
2118 * Now write it out, encrypted
2119 */
2120 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
2121 MBEDTLS_PK_RSA ) )
2122 {
2123 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
2124 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2125 }
2126
2127 if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk,
2128 p, ssl->handshake->pmslen,
2129 ssl->out_msg + offset + len_bytes, olen,
2130 MBEDTLS_SSL_MAX_CONTENT_LEN - offset - len_bytes,
2131 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2132 {
2133 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
2134 return( ret );
2135 }
2136
2137#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2138 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2139 if( len_bytes == 2 )
2140 {
2141 ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
2142 ssl->out_msg[offset+1] = (unsigned char)( *olen );
2143 *olen += 2;
2144 }
2145#endif
2146
2147 return( 0 );
2148}
2149#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
2150 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2151
2152#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2153#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2154 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2155 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2156static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
2157 unsigned char **p,
2158 unsigned char *end,
2159 mbedtls_md_type_t *md_alg,
2160 mbedtls_pk_type_t *pk_alg )
2161{
2162 ((void) ssl);
2163 *md_alg = MBEDTLS_MD_NONE;
2164 *pk_alg = MBEDTLS_PK_NONE;
2165
2166 /* Only in TLS 1.2 */
2167 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
2168 {
2169 return( 0 );
2170 }
2171
2172 if( (*p) + 2 > end )
2173 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2174
2175 /*
2176 * Get hash algorithm
2177 */
2178 if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) ) == MBEDTLS_MD_NONE )
2179 {
2180 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
2181 "HashAlgorithm %d", *(p)[0] ) );
2182 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2183 }
2184
2185 /*
2186 * Get signature algorithm
2187 */
2188 if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) ) == MBEDTLS_PK_NONE )
2189 {
2190 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
2191 "SignatureAlgorithm %d", (*p)[1] ) );
2192 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2193 }
2194
2195 /*
2196 * Check if the hash is acceptable
2197 */
2198 if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
2199 {
2200 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm %d that was not offered",
2201 *(p)[0] ) );
2202 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2203 }
2204
2205 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) );
2206 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) );
2207 *p += 2;
2208
2209 return( 0 );
2210}
2211#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2212 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2213 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2214#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2215
2216#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2217 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2218static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
2219{
2220 int ret;
2221 const mbedtls_ecp_keypair *peer_key;
2222
2223 if( ssl->session_negotiate->peer_cert == NULL )
2224 {
2225 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
2226 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2227 }
2228
2229 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
2230 MBEDTLS_PK_ECKEY ) )
2231 {
2232 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
2233 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2234 }
2235
2236 peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk );
2237
2238 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
2239 MBEDTLS_ECDH_THEIRS ) ) != 0 )
2240 {
2241 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
2242 return( ret );
2243 }
2244
2245 if( ssl_check_server_ecdh_params( ssl ) != 0 )
2246 {
2247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
2248 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2249 }
2250
2251 return( ret );
2252}
2253#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2254 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2255
2256static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
2257{
2258 int ret;
2259 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2260 ssl->transform_negotiate->ciphersuite_info;
2261 unsigned char *p, *end;
2262
2263 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
2264
2265#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2266 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
2267 {
2268 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
2269 ssl->state++;
2270 return( 0 );
2271 }
2272 ((void) p);
2273 ((void) end);
2274#endif
2275
2276#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2277 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2278 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2279 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2280 {
2281 if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
2282 {
2283 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
2284 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2285 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2286 return( ret );
2287 }
2288
2289 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
2290 ssl->state++;
2291 return( 0 );
2292 }
2293 ((void) p);
2294 ((void) end);
2295#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2296 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2297
2298 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
2299 {
2300 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2301 return( ret );
2302 }
2303
2304 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2305 {
2306 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2307 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2308 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2309 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2310 }
2311
2312 /*
2313 * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
2314 * doesn't use a psk_identity_hint
2315 */
2316 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
2317 {
2318 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2319 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2320 {
2321 /* Current message is probably either
2322 * CertificateRequest or ServerHelloDone */
2323 ssl->keep_current_message = 1;
2324 goto exit;
2325 }
2326
2327 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key exchange message must "
2328 "not be skipped" ) );
2329 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2330 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2331
2332 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2333 }
2334
2335 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
2336 end = ssl->in_msg + ssl->in_hslen;
2337 MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
2338
2339#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2340 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2341 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
2342 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2343 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
2344 {
2345 if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
2346 {
2347 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2348 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2349 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2350 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2351 }
2352 } /* FALLTROUGH */
2353#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2354
2355#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
2356 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2357 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2358 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2359 ; /* nothing more to do */
2360 else
2361#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
2362 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2363#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2364 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2365 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
2366 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
2367 {
2368 if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
2369 {
2370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2371 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2372 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2373 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2374 }
2375 }
2376 else
2377#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2378 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2379#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2380 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
2381 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2382 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2383 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
2384 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
2385 {
2386 if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
2387 {
2388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2389 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2390 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2391 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2392 }
2393 }
2394 else
2395#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2396 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
2397 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2398#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2399 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2400 {
2401 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
2402 p, end - p );
2403 if( ret != 0 )
2404 {
2405 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
2406 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2407 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2408 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2409 }
2410 }
2411 else
2412#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2413 {
2414 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2415 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2416 }
2417
2418#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
2419 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
2420 {
2421 size_t sig_len, hashlen;
2422 unsigned char hash[64];
2423 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
2424 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
2425 unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
2426 size_t params_len = p - params;
2427
2428 /*
2429 * Handle the digitally-signed structure
2430 */
2431#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2432 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2433 {
2434 if( ssl_parse_signature_algorithm( ssl, &p, end,
2435 &md_alg, &pk_alg ) != 0 )
2436 {
2437 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2438 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2439 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2440 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2441 }
2442
2443 if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
2444 {
2445 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2446 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2447 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2448 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2449 }
2450 }
2451 else
2452#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2453#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2454 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2455 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
2456 {
2457 pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
2458
2459 /* Default hash for ECDSA is SHA-1 */
2460 if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
2461 md_alg = MBEDTLS_MD_SHA1;
2462 }
2463 else
2464#endif
2465 {
2466 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2467 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2468 }
2469
2470 /*
2471 * Read signature
2472 */
2473 sig_len = ( p[0] << 8 ) | p[1];
2474 p += 2;
2475
2476 if( end != p + sig_len )
2477 {
2478 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2479 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2480 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2481 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2482 }
2483
2484 MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
2485
2486 /*
2487 * Compute the hash that has been signed
2488 */
2489#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2490 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2491 if( md_alg == MBEDTLS_MD_NONE )
2492 {
2493 mbedtls_md5_context mbedtls_md5;
2494 mbedtls_sha1_context mbedtls_sha1;
2495
2496 mbedtls_md5_init( &mbedtls_md5 );
2497 mbedtls_sha1_init( &mbedtls_sha1 );
2498
2499 hashlen = 36;
2500
2501 /*
2502 * digitally-signed struct {
2503 * opaque md5_hash[16];
2504 * opaque sha_hash[20];
2505 * };
2506 *
2507 * md5_hash
2508 * MD5(ClientHello.random + ServerHello.random
2509 * + ServerParams);
2510 * sha_hash
2511 * SHA(ClientHello.random + ServerHello.random
2512 * + ServerParams);
2513 */
2514 mbedtls_md5_starts( &mbedtls_md5 );
2515 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
2516 mbedtls_md5_update( &mbedtls_md5, params, params_len );
2517 mbedtls_md5_finish( &mbedtls_md5, hash );
2518
2519 mbedtls_sha1_starts( &mbedtls_sha1 );
2520 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
2521 mbedtls_sha1_update( &mbedtls_sha1, params, params_len );
2522 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
2523
2524 mbedtls_md5_free( &mbedtls_md5 );
2525 mbedtls_sha1_free( &mbedtls_sha1 );
2526 }
2527 else
2528#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
2529 MBEDTLS_SSL_PROTO_TLS1_1 */
2530#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2531 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2532 if( md_alg != MBEDTLS_MD_NONE )
2533 {
2534 mbedtls_md_context_t ctx;
2535
2536 mbedtls_md_init( &ctx );
2537
2538 /* Info from md_alg will be used instead */
2539 hashlen = 0;
2540
2541 /*
2542 * digitally-signed struct {
2543 * opaque client_random[32];
2544 * opaque server_random[32];
2545 * ServerDHParams params;
2546 * };
2547 */
2548 if( ( ret = mbedtls_md_setup( &ctx,
2549 mbedtls_md_info_from_type( md_alg ), 0 ) ) != 0 )
2550 {
2551 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
2552 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2553 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2554 return( ret );
2555 }
2556
2557 mbedtls_md_starts( &ctx );
2558 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
2559 mbedtls_md_update( &ctx, params, params_len );
2560 mbedtls_md_finish( &ctx, hash );
2561 mbedtls_md_free( &ctx );
2562 }
2563 else
2564#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2565 MBEDTLS_SSL_PROTO_TLS1_2 */
2566 {
2567 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2568 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2569 }
2570
2571 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
2572 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
2573
2574 if( ssl->session_negotiate->peer_cert == NULL )
2575 {
2576 MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
2577 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2578 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2579 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2580 }
2581
2582 /*
2583 * Verify signature
2584 */
2585 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
2586 {
2587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2588 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2589 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2590 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2591 }
2592
2593 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
2594 md_alg, hash, hashlen, p, sig_len ) ) != 0 )
2595 {
2596 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2597 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
2598 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
2599 return( ret );
2600 }
2601 }
2602#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
2603
2604exit:
2605 ssl->state++;
2606
2607 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
2608
2609 return( 0 );
2610}
2611
2612#if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
2613static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
2614{
2615 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2616 ssl->transform_negotiate->ciphersuite_info;
2617
2618 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
2619
2620 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
2621 {
2622 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
2623 ssl->state++;
2624 return( 0 );
2625 }
2626
2627 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2628 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2629}
2630#else /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
2631static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
2632{
2633 int ret;
2634 unsigned char *buf;
2635 size_t n = 0;
2636 size_t cert_type_len = 0, dn_len = 0;
2637 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2638 ssl->transform_negotiate->ciphersuite_info;
2639
2640 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
2641
2642 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
2643 {
2644 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
2645 ssl->state++;
2646 return( 0 );
2647 }
2648
2649 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
2650 {
2651 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2652 return( ret );
2653 }
2654
2655 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2656 {
2657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2658 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2659 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2660 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2661 }
2662
2663 ssl->state++;
2664 ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST );
2665
2666 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
2667 ssl->client_auth ? "a" : "no" ) );
2668
2669 if( ssl->client_auth == 0 )
2670 {
2671 /* Current message is probably the ServerHelloDone */
2672 ssl->keep_current_message = 1;
2673 goto exit;
2674 }
2675
2676 /*
2677 * struct {
2678 * ClientCertificateType certificate_types<1..2^8-1>;
2679 * SignatureAndHashAlgorithm
2680 * supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
2681 * DistinguishedName certificate_authorities<0..2^16-1>;
2682 * } CertificateRequest;
2683 *
2684 * Since we only support a single certificate on clients, let's just
2685 * ignore all the information that's supposed to help us pick a
2686 * certificate.
2687 *
2688 * We could check that our certificate matches the request, and bail out
2689 * if it doesn't, but it's simpler to just send the certificate anyway,
2690 * and give the server the opportunity to decide if it should terminate
2691 * the connection when it doesn't like our certificate.
2692 *
2693 * Same goes for the hash in TLS 1.2's signature_algorithms: at this
2694 * point we only have one hash available (see comments in
2695 * write_certificate_verify), so let's just use what we have.
2696 *
2697 * However, we still minimally parse the message to check it is at least
2698 * superficially sane.
2699 */
2700 buf = ssl->in_msg;
2701
2702 /* certificate_types */
2703 cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
2704 n = cert_type_len;
2705
2706 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
2707 {
2708 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2709 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2710 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2711 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2712 }
2713
2714 /* supported_signature_algorithms */
2715#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2716 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2717 {
2718 size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
2719 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
2720#if defined(MBEDTLS_DEBUG_C)
2721 unsigned char* sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
2722 size_t i;
2723
2724 for( i = 0; i < sig_alg_len; i += 2 )
2725 {
2726 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d"
2727 ",%d", sig_alg[i], sig_alg[i + 1] ) );
2728 }
2729#endif
2730
2731 n += 2 + sig_alg_len;
2732
2733 if( ssl->in_hslen < mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
2734 {
2735 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2736 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2737 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2738 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2739 }
2740 }
2741#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2742
2743 /* certificate_authorities */
2744 dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
2745 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
2746
2747 n += dn_len;
2748 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
2749 {
2750 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2751 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2752 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2753 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2754 }
2755
2756exit:
2757 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
2758
2759 return( 0 );
2760}
2761#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
2762
2763static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
2764{
2765 int ret;
2766
2767 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
2768
2769 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
2770 {
2771 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2772 return( ret );
2773 }
2774
2775 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2776 {
2777 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
2778 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2779 }
2780
2781 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ||
2782 ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
2783 {
2784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
2785 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2786 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2787 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
2788 }
2789
2790 ssl->state++;
2791
2792#if defined(MBEDTLS_SSL_PROTO_DTLS)
2793 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2794 mbedtls_ssl_recv_flight_completed( ssl );
2795#endif
2796
2797 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
2798
2799 return( 0 );
2800}
2801
2802static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
2803{
2804 int ret;
2805 size_t i, n;
2806 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2807 ssl->transform_negotiate->ciphersuite_info;
2808
2809 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
2810
2811#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2812 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2813 {
2814 /*
2815 * DHM key exchange -- send G^X mod P
2816 */
2817 n = ssl->handshake->dhm_ctx.len;
2818
2819 ssl->out_msg[4] = (unsigned char)( n >> 8 );
2820 ssl->out_msg[5] = (unsigned char)( n );
2821 i = 6;
2822
2823 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
2824 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
2825 &ssl->out_msg[i], n,
2826 ssl->conf->f_rng, ssl->conf->p_rng );
2827 if( ret != 0 )
2828 {
2829 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
2830 return( ret );
2831 }
2832
2833 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2834 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
2835
2836 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
2837 ssl->handshake->premaster,
2838 MBEDTLS_PREMASTER_SIZE,
2839 &ssl->handshake->pmslen,
2840 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2841 {
2842 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2843 return( ret );
2844 }
2845
2846 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2847 }
2848 else
2849#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
2850#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2851 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2852 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2853 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2854 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2855 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2856 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2857 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2858 {
2859 /*
2860 * ECDH key exchange -- send client public value
2861 */
2862 i = 4;
2863
2864 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
2865 &n,
2866 &ssl->out_msg[i], 1000,
2867 ssl->conf->f_rng, ssl->conf->p_rng );
2868 if( ret != 0 )
2869 {
2870 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
2871 return( ret );
2872 }
2873
2874 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
2875
2876 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
2877 &ssl->handshake->pmslen,
2878 ssl->handshake->premaster,
2879 MBEDTLS_MPI_MAX_SIZE,
2880 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2881 {
2882 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2883 return( ret );
2884 }
2885
2886 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
2887 }
2888 else
2889#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2890 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2891 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2892 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2893#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2894 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
2895 {
2896 /*
2897 * opaque psk_identity<0..2^16-1>;
2898 */
2899 if( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL )
2900 {
2901 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) );
2902 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
2903 }
2904
2905 i = 4;
2906 n = ssl->conf->psk_identity_len;
2907
2908 if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
2909 {
2910 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or "
2911 "SSL buffer too short" ) );
2912 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2913 }
2914
2915 ssl->out_msg[i++] = (unsigned char)( n >> 8 );
2916 ssl->out_msg[i++] = (unsigned char)( n );
2917
2918 memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len );
2919 i += ssl->conf->psk_identity_len;
2920
2921#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
2922 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
2923 {
2924 n = 0;
2925 }
2926 else
2927#endif
2928#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2929 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2930 {
2931 if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 )
2932 return( ret );
2933 }
2934 else
2935#endif
2936#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2937 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
2938 {
2939 /*
2940 * ClientDiffieHellmanPublic public (DHM send G^X mod P)
2941 */
2942 n = ssl->handshake->dhm_ctx.len;
2943
2944 if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
2945 {
2946 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long"
2947 " or SSL buffer too short" ) );
2948 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2949 }
2950
2951 ssl->out_msg[i++] = (unsigned char)( n >> 8 );
2952 ssl->out_msg[i++] = (unsigned char)( n );
2953
2954 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
2955 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
2956 &ssl->out_msg[i], n,
2957 ssl->conf->f_rng, ssl->conf->p_rng );
2958 if( ret != 0 )
2959 {
2960 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
2961 return( ret );
2962 }
2963 }
2964 else
2965#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2966#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2967 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
2968 {
2969 /*
2970 * ClientECDiffieHellmanPublic public;
2971 */
2972 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n,
2973 &ssl->out_msg[i], MBEDTLS_SSL_MAX_CONTENT_LEN - i,
2974 ssl->conf->f_rng, ssl->conf->p_rng );
2975 if( ret != 0 )
2976 {
2977 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
2978 return( ret );
2979 }
2980
2981 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
2982 }
2983 else
2984#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2985 {
2986 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2987 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2988 }
2989
2990 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
2991 ciphersuite_info->key_exchange ) ) != 0 )
2992 {
2993 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
2994 return( ret );
2995 }
2996 }
2997 else
2998#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2999#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3000 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
3001 {
3002 i = 4;
3003 if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 )
3004 return( ret );
3005 }
3006 else
3007#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
3008#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3009 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3010 {
3011 i = 4;
3012
3013 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
3014 ssl->out_msg + i, MBEDTLS_SSL_MAX_CONTENT_LEN - i, &n,
3015 ssl->conf->f_rng, ssl->conf->p_rng );
3016 if( ret != 0 )
3017 {
3018 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
3019 return( ret );
3020 }
3021
3022 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
3023 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
3024 ssl->conf->f_rng, ssl->conf->p_rng );
3025 if( ret != 0 )
3026 {
3027 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
3028 return( ret );
3029 }
3030 }
3031 else
3032#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
3033 {
3034 ((void) ciphersuite_info);
3035 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3036 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3037 }
3038
3039 ssl->out_msglen = i + n;
3040 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3041 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
3042
3043 ssl->state++;
3044
3045 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
3046 {
3047 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
3048 return( ret );
3049 }
3050
3051 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
3052
3053 return( 0 );
3054}
3055
3056#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
3057 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
3058 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
3059 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
3060 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
3061 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3062static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
3063{
3064 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3065 ssl->transform_negotiate->ciphersuite_info;
3066 int ret;
3067
3068 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
3069
3070 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
3071 {
3072 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
3073 return( ret );
3074 }
3075
3076 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3077 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3078 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3079 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3080 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3081 {
3082 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
3083 ssl->state++;
3084 return( 0 );
3085 }
3086
3087 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3088 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3089}
3090#else
3091static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
3092{
3093 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3094 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3095 ssl->transform_negotiate->ciphersuite_info;
3096 size_t n = 0, offset = 0;
3097 unsigned char hash[48];
3098 unsigned char *hash_start = hash;
3099 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
3100 unsigned int hashlen;
3101
3102 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
3103
3104 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
3105 {
3106 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
3107 return( ret );
3108 }
3109
3110 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3111 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3112 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3113 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3114 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3115 {
3116 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
3117 ssl->state++;
3118 return( 0 );
3119 }
3120
3121 if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
3122 {
3123 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
3124 ssl->state++;
3125 return( 0 );
3126 }
3127
3128 if( mbedtls_ssl_own_key( ssl ) == NULL )
3129 {
3130 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
3131 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3132 }
3133
3134 /*
3135 * Make an RSA signature of the handshake digests
3136 */
3137 ssl->handshake->calc_verify( ssl, hash );
3138
3139#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3140 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3141 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
3142 {
3143 /*
3144 * digitally-signed struct {
3145 * opaque md5_hash[16];
3146 * opaque sha_hash[20];
3147 * };
3148 *
3149 * md5_hash
3150 * MD5(handshake_messages);
3151 *
3152 * sha_hash
3153 * SHA(handshake_messages);
3154 */
3155 hashlen = 36;
3156 md_alg = MBEDTLS_MD_NONE;
3157
3158 /*
3159 * For ECDSA, default hash is SHA-1 only
3160 */
3161 if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
3162 {
3163 hash_start += 16;
3164 hashlen -= 16;
3165 md_alg = MBEDTLS_MD_SHA1;
3166 }
3167 }
3168 else
3169#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3170 MBEDTLS_SSL_PROTO_TLS1_1 */
3171#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3172 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
3173 {
3174 /*
3175 * digitally-signed struct {
3176 * opaque handshake_messages[handshake_messages_length];
3177 * };
3178 *
3179 * Taking shortcut here. We assume that the server always allows the
3180 * PRF Hash function and has sent it in the allowed signature
3181 * algorithms list received in the Certificate Request message.
3182 *
3183 * Until we encounter a server that does not, we will take this
3184 * shortcut.
3185 *
3186 * Reason: Otherwise we should have running hashes for SHA512 and SHA224
3187 * in order to satisfy 'weird' needs from the server side.
3188 */
3189 if( ssl->transform_negotiate->ciphersuite_info->mac ==
3190 MBEDTLS_MD_SHA384 )
3191 {
3192 md_alg = MBEDTLS_MD_SHA384;
3193 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
3194 }
3195 else
3196 {
3197 md_alg = MBEDTLS_MD_SHA256;
3198 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
3199 }
3200 ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
3201
3202 /* Info from md_alg will be used instead */
3203 hashlen = 0;
3204 offset = 2;
3205 }
3206 else
3207#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3208 {
3209 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3210 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3211 }
3212
3213 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash_start, hashlen,
3214 ssl->out_msg + 6 + offset, &n,
3215 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
3216 {
3217 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
3218 return( ret );
3219 }
3220
3221 ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
3222 ssl->out_msg[5 + offset] = (unsigned char)( n );
3223
3224 ssl->out_msglen = 6 + n + offset;
3225 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3226 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
3227
3228 ssl->state++;
3229
3230 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
3231 {
3232 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
3233 return( ret );
3234 }
3235
3236 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
3237
3238 return( ret );
3239}
3240#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
3241 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
3242 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
3243 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
3244 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
3245 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
3246
3247#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3248static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
3249{
3250 int ret;
3251 uint32_t lifetime;
3252 size_t ticket_len;
3253 unsigned char *ticket;
3254 const unsigned char *msg;
3255
3256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
3257
3258 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
3259 {
3260 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3261 return( ret );
3262 }
3263
3264 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3265 {
3266 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
3267 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3268 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3269 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3270 }
3271
3272 /*
3273 * struct {
3274 * uint32 ticket_lifetime_hint;
3275 * opaque ticket<0..2^16-1>;
3276 * } NewSessionTicket;
3277 *
3278 * 0 . 3 ticket_lifetime_hint
3279 * 4 . 5 ticket_len (n)
3280 * 6 . 5+n ticket content
3281 */
3282 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ||
3283 ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
3284 {
3285 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
3286 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3287 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3288 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
3289 }
3290
3291 msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
3292
3293 lifetime = ( msg[0] << 24 ) | ( msg[1] << 16 ) |
3294 ( msg[2] << 8 ) | ( msg[3] );
3295
3296 ticket_len = ( msg[4] << 8 ) | ( msg[5] );
3297
3298 if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
3299 {
3300 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
3301 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3302 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3303 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
3304 }
3305
3306 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
3307
3308 /* We're not waiting for a NewSessionTicket message any more */
3309 ssl->handshake->new_session_ticket = 0;
3310 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
3311
3312 /*
3313 * Zero-length ticket means the server changed his mind and doesn't want
3314 * to send a ticket after all, so just forget it
3315 */
3316 if( ticket_len == 0 )
3317 return( 0 );
3318
3319 mbedtls_zeroize( ssl->session_negotiate->ticket,
3320 ssl->session_negotiate->ticket_len );
3321 mbedtls_free( ssl->session_negotiate->ticket );
3322 ssl->session_negotiate->ticket = NULL;
3323 ssl->session_negotiate->ticket_len = 0;
3324
3325 if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
3326 {
3327 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
3328 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3329 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
3330 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3331 }
3332
3333 memcpy( ticket, msg + 6, ticket_len );
3334
3335 ssl->session_negotiate->ticket = ticket;
3336 ssl->session_negotiate->ticket_len = ticket_len;
3337 ssl->session_negotiate->ticket_lifetime = lifetime;
3338
3339 /*
3340 * RFC 5077 section 3.4:
3341 * "If the client receives a session ticket from the server, then it
3342 * discards any Session ID that was sent in the ServerHello."
3343 */
3344 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
3345 ssl->session_negotiate->id_len = 0;
3346
3347 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
3348
3349 return( 0 );
3350}
3351#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3352
3353/*
3354 * SSL handshake -- client side -- single step
3355 */
3356int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
3357{
3358 int ret = 0;
3359
3360 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
3361 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3362
3363 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
3364
3365 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3366 return( ret );
3367
3368#if defined(MBEDTLS_SSL_PROTO_DTLS)
3369 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3370 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
3371 {
3372 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
3373 return( ret );
3374 }
3375#endif
3376
3377 /* Change state now, so that it is right in mbedtls_ssl_read_record(), used
3378 * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
3379#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3380 if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
3381 ssl->handshake->new_session_ticket != 0 )
3382 {
3383 ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
3384 }
3385#endif
3386
3387 switch( ssl->state )
3388 {
3389 case MBEDTLS_SSL_HELLO_REQUEST:
3390 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
3391 break;
3392
3393 /*
3394 * ==> ClientHello
3395 */
3396 case MBEDTLS_SSL_CLIENT_HELLO:
3397 ret = ssl_write_client_hello( ssl );
3398 break;
3399
3400 /*
3401 * <== ServerHello
3402 * Certificate
3403 * ( ServerKeyExchange )
3404 * ( CertificateRequest )
3405 * ServerHelloDone
3406 */
3407 case MBEDTLS_SSL_SERVER_HELLO:
3408 ret = ssl_parse_server_hello( ssl );
3409 break;
3410
3411 case MBEDTLS_SSL_SERVER_CERTIFICATE:
3412 ret = mbedtls_ssl_parse_certificate( ssl );
3413 break;
3414
3415 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
3416 ret = ssl_parse_server_key_exchange( ssl );
3417 break;
3418
3419 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
3420 ret = ssl_parse_certificate_request( ssl );
3421 break;
3422
3423 case MBEDTLS_SSL_SERVER_HELLO_DONE:
3424 ret = ssl_parse_server_hello_done( ssl );
3425 break;
3426
3427 /*
3428 * ==> ( Certificate/Alert )
3429 * ClientKeyExchange
3430 * ( CertificateVerify )
3431 * ChangeCipherSpec
3432 * Finished
3433 */
3434 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
3435 ret = mbedtls_ssl_write_certificate( ssl );
3436 break;
3437
3438 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
3439 ret = ssl_write_client_key_exchange( ssl );
3440 break;
3441
3442 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
3443 ret = ssl_write_certificate_verify( ssl );
3444 break;
3445
3446 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
3447 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
3448 break;
3449
3450 case MBEDTLS_SSL_CLIENT_FINISHED:
3451 ret = mbedtls_ssl_write_finished( ssl );
3452 break;
3453
3454 /*
3455 * <== ( NewSessionTicket )
3456 * ChangeCipherSpec
3457 * Finished
3458 */
3459#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3460 case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
3461 ret = ssl_parse_new_session_ticket( ssl );
3462 break;
3463#endif
3464
3465 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
3466 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
3467 break;
3468
3469 case MBEDTLS_SSL_SERVER_FINISHED:
3470 ret = mbedtls_ssl_parse_finished( ssl );
3471 break;
3472
3473 case MBEDTLS_SSL_FLUSH_BUFFERS:
3474 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3475 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
3476 break;
3477
3478 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
3479 mbedtls_ssl_handshake_wrapup( ssl );
3480 break;
3481
3482 default:
3483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3484 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3485 }
3486
3487 return( ret );
3488}
3489#endif /* MBEDTLS_SSL_CLI_C */