blob: 6919b1f286024730d0ce9505ec1f6d8aaf72d794 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000030#include "mbedtls/debug.h"
31#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020032#include "mbedtls/ssl_internal.h"
Rich Evans00ab4702015-02-06 13:43:58 +000033
34#include <string.h>
35
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020036#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000037#include "mbedtls/ecp.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010038#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000039
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020040#if defined(MBEDTLS_PLATFORM_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000041#include "mbedtls/platform.h"
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020042#else
Rich Evans00ab4702015-02-06 13:43:58 +000043#include <stdlib.h>
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020044#define mbedtls_calloc calloc
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020045#define mbedtls_free free
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020046#endif
47
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020048#if defined(MBEDTLS_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +000049#include <time.h>
Paul Bakkerfa9b1002013-07-03 15:31:03 +020050#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020052#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +020053/* Implementation that should never be optimized out by the compiler */
54static void mbedtls_zeroize( void *v, size_t n ) {
55 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
56}
Paul Bakker606b4ba2013-08-14 16:52:14 +020057#endif
58
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
60int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020061 const unsigned char *info,
62 size_t ilen )
63{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020064 if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020065 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020067 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020068
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020069 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020070 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020071
72 memcpy( ssl->cli_id, info, ilen );
73 ssl->cli_id_len = ilen;
74
75 return( 0 );
76}
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020077
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020078void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020079 mbedtls_ssl_cookie_write_t *f_cookie_write,
80 mbedtls_ssl_cookie_check_t *f_cookie_check,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020081 void *p_cookie )
82{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020083 conf->f_cookie_write = f_cookie_write;
84 conf->f_cookie_check = f_cookie_check;
85 conf->p_cookie = p_cookie;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020086}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020087#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020089#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020090static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +000091 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +000092 size_t len )
93{
94 int ret;
95 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +000096 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +000097
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +010099
Paul Bakker5701cdc2012-09-27 21:49:42 +0000100 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
101 if( servername_list_size + 2 != len )
102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
104 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000105 }
106
107 p = buf + 2;
108 while( servername_list_size > 0 )
109 {
110 hostname_len = ( ( p[1] << 8 ) | p[2] );
111 if( hostname_len + 3 > servername_list_size )
112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200113 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
114 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000115 }
116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200117 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000118 {
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +0200119 ret = ssl->conf->f_sni( ssl->conf->p_sni,
120 ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000121 if( ret != 0 )
122 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200123 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
124 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
125 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
126 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000127 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000128 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000129 }
130
131 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000132 p += hostname_len + 3;
133 }
134
135 if( servername_list_size != 0 )
136 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200137 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
138 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000139 }
140
141 return( 0 );
142}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200143#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000146 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000147 size_t len )
148{
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000149 int ret;
150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200151#if defined(MBEDTLS_SSL_RENEGOTIATION)
152 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100153 {
154 /* Check verify-data in constant-time. The length OTOH is no secret */
155 if( len != 1 + ssl->verify_data_len ||
156 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200157 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100158 ssl->verify_data_len ) != 0 )
159 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100163 return( ret );
164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100166 }
167 }
168 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200169#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +0000170 {
171 if( len != 1 || buf[0] != 0x0 )
172 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200175 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000176 return( ret );
177
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200178 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +0000179 }
180
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200181 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +0000182 }
Paul Bakker48916f92012-09-16 19:57:18 +0000183
184 return( 0 );
185}
186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200187#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
188 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
189static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000190 const unsigned char *buf,
191 size_t len )
192{
193 size_t sig_alg_list_size;
194 const unsigned char *p;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200195 const unsigned char *end = buf + len;
196 const int *md_cur;
197
Paul Bakker23f36802012-09-28 14:15:14 +0000198
199 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
200 if( sig_alg_list_size + 2 != len ||
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200201 sig_alg_list_size % 2 != 0 )
Paul Bakker23f36802012-09-28 14:15:14 +0000202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
204 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker23f36802012-09-28 14:15:14 +0000205 }
206
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200207 /*
208 * For now, ignore the SignatureAlgorithm part and rely on offered
209 * ciphersuites only for that part. To be fixed later.
210 *
211 * So, just look at the HashAlgorithm part.
212 */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200213 for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200214 for( p = buf + 2; p < end; p += 2 ) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215 if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200216 ssl->handshake->sig_alg = p[0];
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200217 goto have_sig_alg;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200218 }
Paul Bakker23f36802012-09-28 14:15:14 +0000219 }
Paul Bakker23f36802012-09-28 14:15:14 +0000220 }
221
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200222 /* Some key echanges do not need signatures at all */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200224 return( 0 );
225
226have_sig_alg:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
Paul Bakker23f36802012-09-28 14:15:14 +0000228 ssl->handshake->sig_alg ) );
229
230 return( 0 );
231}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200232#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
233 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker23f36802012-09-28 14:15:14 +0000234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200235#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
236static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200237 const unsigned char *buf,
238 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100239{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200240 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100241 const unsigned char *p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200242 const mbedtls_ecp_curve_info *curve_info, **curves;
Paul Bakker41c83d32013-03-20 14:39:14 +0100243
244 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
245 if( list_size + 2 != len ||
246 list_size % 2 != 0 )
247 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200248 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
249 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100250 }
251
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200252 /* Should never happen unless client duplicates the extension */
253 if( ssl->handshake->curves != NULL )
254 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200255 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
256 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200257 }
258
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +0100259 /* Don't allow our peer to make us allocate too much memory,
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200260 * and leave room for a final 0 */
261 our_size = list_size / 2 + 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200262 if( our_size > MBEDTLS_ECP_DP_MAX )
263 our_size = MBEDTLS_ECP_DP_MAX;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200264
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200265 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +0200266 return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); // LCOV_EXCL_LINE
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200267
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200268 ssl->handshake->curves = curves;
269
Paul Bakker41c83d32013-03-20 14:39:14 +0100270 p = buf + 2;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200271 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100272 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200273 curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200274
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200275 if( curve_info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100276 {
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200277 *curves++ = curve_info;
278 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100279 }
280
281 list_size -= 2;
282 p += 2;
283 }
284
285 return( 0 );
286}
287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200288static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200289 const unsigned char *buf,
290 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100291{
292 size_t list_size;
293 const unsigned char *p;
294
295 list_size = buf[0];
296 if( list_size + 1 != len )
297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
299 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100300 }
301
Manuel Pégourié-Gonnardf7022d12015-09-16 11:32:18 +0200302 p = buf + 1;
Paul Bakker41c83d32013-03-20 14:39:14 +0100303 while( list_size > 0 )
304 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200305 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
306 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Paul Bakker41c83d32013-03-20 14:39:14 +0100307 {
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200308 ssl->handshake->ecdh_ctx.point_format = p[0];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200309 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100310 return( 0 );
311 }
312
313 list_size--;
314 p++;
315 }
316
317 return( 0 );
318}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200319#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Paul Bakker41c83d32013-03-20 14:39:14 +0100320
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200321#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
322static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200323 const unsigned char *buf,
324 size_t len )
325{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200326 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200327 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200328 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
329 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200330 }
331
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200332 ssl->session_negotiate->mfl_code = buf[0];
333
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200334 return( 0 );
335}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200336#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200337
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200338#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
339static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200340 const unsigned char *buf,
341 size_t len )
342{
343 if( len != 0 )
344 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200345 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
346 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200347 }
348
349 ((void) buf);
350
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200351 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200353
354 return( 0 );
355}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200356#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200358#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
359static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100360 const unsigned char *buf,
361 size_t len )
362{
363 if( len != 0 )
364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
366 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100367 }
368
369 ((void) buf);
370
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200371 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200372 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100373 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200374 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100375 }
376
377 return( 0 );
378}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200379#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100380
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200381#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
382static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200383 const unsigned char *buf,
384 size_t len )
385{
386 if( len != 0 )
387 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
389 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200390 }
391
392 ((void) buf);
393
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200394 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200395 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200396 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200397 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200398 }
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200399
400 return( 0 );
401}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200402#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200403
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200404#if defined(MBEDTLS_SSL_SESSION_TICKETS)
405static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200406 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200407 size_t len )
408{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200409 int ret;
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200410 mbedtls_ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200411
Manuel Pégourié-Gonnardbae389b2015-06-24 10:45:58 +0200412 mbedtls_ssl_session_init( &session );
413
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200414 if( ssl->conf->f_ticket_parse == NULL ||
415 ssl->conf->f_ticket_write == NULL )
416 {
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200417 return( 0 );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200418 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200419
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200420 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200421 ssl->handshake->new_session_ticket = 1;
422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200423 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200424
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200425 if( len == 0 )
426 return( 0 );
427
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200428#if defined(MBEDTLS_SSL_RENEGOTIATION)
429 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200431 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200432 return( 0 );
433 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200434#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200435
436 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200437 * Failures are ok: just ignore the ticket and proceed.
438 */
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200439 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
440 buf, len ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200441 {
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200442 mbedtls_ssl_session_free( &session );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200443
444 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
445 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
446 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
447 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
448 else
449 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
450
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200451 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200452 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200453
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200454 /*
455 * Keep the session ID sent by the client, since we MUST send it back to
456 * inform them we're accepting the ticket (RFC 5077 section 3.4)
457 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200458 session.id_len = ssl->session_negotiate->id_len;
459 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200460
461 mbedtls_ssl_session_free( ssl->session_negotiate );
462 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
463
464 /* Zeroize instead of free as we copied the content */
465 mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
466
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200467 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200468
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200469 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200470
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200471 /* Don't send a new ticket after all, this one is OK */
472 ssl->handshake->new_session_ticket = 0;
473
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200474 return( 0 );
475}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200476#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200477
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200478#if defined(MBEDTLS_SSL_ALPN)
479static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard14beb082014-07-08 13:50:35 +0200480 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200481{
Paul Bakker14b16c62014-05-28 11:33:54 +0200482 size_t list_len, cur_len, ours_len;
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200483 const unsigned char *theirs, *start, *end;
484 const char **ours;
485
486 /* If ALPN not configured, just ignore the extension */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200487 if( ssl->conf->alpn_list == NULL )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200488 return( 0 );
489
490 /*
491 * opaque ProtocolName<1..2^8-1>;
492 *
493 * struct {
494 * ProtocolName protocol_name_list<2..2^16-1>
495 * } ProtocolNameList;
496 */
497
498 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
499 if( len < 4 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200500 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200501
502 list_len = ( buf[0] << 8 ) | buf[1];
503 if( list_len != len - 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200504 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200505
506 /*
507 * Use our order of preference
508 */
509 start = buf + 2;
510 end = buf + len;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200511 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200512 {
Paul Bakker14b16c62014-05-28 11:33:54 +0200513 ours_len = strlen( *ours );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200514 for( theirs = start; theirs != end; theirs += cur_len )
515 {
516 /* If the list is well formed, we should get equality first */
517 if( theirs > end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200518 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200519
520 cur_len = *theirs++;
521
522 /* Empty strings MUST NOT be included */
523 if( cur_len == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200525
Paul Bakker14b16c62014-05-28 11:33:54 +0200526 if( cur_len == ours_len &&
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200527 memcmp( theirs, *ours, cur_len ) == 0 )
528 {
529 ssl->alpn_chosen = *ours;
530 return( 0 );
531 }
532 }
533 }
534
535 /* If we get there, no match was found */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200536 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
537 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
538 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200539}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200541
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100542/*
543 * Auxiliary functions for ServerHello parsing and related actions
544 */
545
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200546#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100547/*
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100548 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100549 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200550#if defined(MBEDTLS_ECDSA_C)
551static int ssl_check_key_curve( mbedtls_pk_context *pk,
552 const mbedtls_ecp_curve_info **curves )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100553{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200554 const mbedtls_ecp_curve_info **crv = curves;
555 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100556
557 while( *crv != NULL )
558 {
559 if( (*crv)->grp_id == grp_id )
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100560 return( 0 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100561 crv++;
562 }
563
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100564 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100565}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200566#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100567
568/*
569 * Try picking a certificate for this ciphersuite,
570 * return 0 on success and -1 on failure.
571 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200572static int ssl_pick_cert( mbedtls_ssl_context *ssl,
573 const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100574{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200575 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
576 mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200577 uint32_t flags;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100578
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200579#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100580 if( ssl->handshake->sni_key_cert != NULL )
581 list = ssl->handshake->sni_key_cert;
582 else
583#endif
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200584 list = ssl->conf->key_cert;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586 if( pk_alg == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100587 return( 0 );
588
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200589 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000590
Manuel Pégourié-Gonnarde540b492015-07-07 12:44:38 +0200591 if( list == NULL )
592 {
593 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
594 return( -1 );
595 }
596
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100597 for( cur = list; cur != NULL; cur = cur->next )
598 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200599 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000600 cur->cert );
601
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200602 if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000603 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200604 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100605 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000606 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100607
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200608 /*
609 * This avoids sending the client a cert it'll reject based on
610 * keyUsage or other extensions.
611 *
612 * It also allows the user to provision different certificates for
613 * different uses based on keyUsage, eg if they want to avoid signing
614 * and decrypting with the same RSA key.
615 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200616 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +0100617 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200619 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000620 "(extended) key usage extension" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200621 continue;
622 }
623
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200624#if defined(MBEDTLS_ECDSA_C)
625 if( pk_alg == MBEDTLS_PK_ECDSA &&
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100626 ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000627 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200628 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100629 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000630 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100631#endif
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100632
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100633 /*
634 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
635 * present them a SHA-higher cert rather than failing if it's the only
636 * one we got that satisfies the other conditions.
637 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200638 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
639 cur->cert->sig_md != MBEDTLS_MD_SHA1 )
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100640 {
641 if( fallback == NULL )
642 fallback = cur;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000643 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200644 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000645 "sha-2 with pre-TLS 1.2 client" ) );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100646 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000647 }
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100648 }
649
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100650 /* If we get there, we got a winner */
651 break;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100652 }
653
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000654 if( cur == NULL )
655 cur = fallback;
656
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200657 /* Do not update ssl->handshake->key_cert unless there is a match */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100658 if( cur != NULL )
659 {
660 ssl->handshake->key_cert = cur;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200661 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000662 ssl->handshake->key_cert->cert );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100663 return( 0 );
664 }
665
666 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100667}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200668#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100669
670/*
671 * Check if a given ciphersuite is suitable for use with our config/keys/etc
672 * Sets ciphersuite_info only if the suite matches.
673 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
675 const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100676{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200677 const mbedtls_ssl_ciphersuite_t *suite_info;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100678
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200679 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100680 if( suite_info == NULL )
681 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200682 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
683 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100684 }
685
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200686 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000687
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100688 if( suite_info->min_minor_ver > ssl->minor_ver ||
689 suite_info->max_minor_ver < ssl->minor_ver )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000690 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200691 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100692 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000693 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200695#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200696 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200697 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +0100698 return( 0 );
699#endif
700
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200701#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200702 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200703 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000704 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200705 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100706 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000707 }
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200708#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100709
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200710#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
711 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100712 ( ssl->handshake->curves == NULL ||
713 ssl->handshake->curves[0] == NULL ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000714 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200715 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000716 "no common elliptic curve" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100717 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000718 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100719#endif
720
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200721#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100722 /* If the ciphersuite requires a pre-shared key and we don't
723 * have one, skip it now rather than failing later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200724 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200725 ssl->conf->f_psk == NULL &&
726 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
727 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000728 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200729 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100730 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000731 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100732#endif
733
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100735 /*
736 * Final check: if ciphersuite requires us to have a
737 * certificate/key of a particular type:
738 * - select the appropriate certificate if we have one, or
739 * - try the next ciphersuite if we don't
740 * This must be done last since we modify the key_cert list.
741 */
742 if( ssl_pick_cert( ssl, suite_info ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000743 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200744 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000745 "no suitable certificate" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100746 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000747 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100748#endif
749
750 *ciphersuite_info = suite_info;
751 return( 0 );
752}
753
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200754#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
755static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
Paul Bakker78a8c712013-03-06 17:01:52 +0100756{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100757 int ret, got_common_suite;
Paul Bakker78a8c712013-03-06 17:01:52 +0100758 unsigned int i, j;
759 size_t n;
760 unsigned int ciph_len, sess_len, chal_len;
761 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200762 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200763 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +0100764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200765 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200767#if defined(MBEDTLS_SSL_RENEGOTIATION)
768 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +0100769 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200770 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100771
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200772 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100773 return( ret );
774
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200775 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100776 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200777#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker78a8c712013-03-06 17:01:52 +0100778
779 buf = ssl->in_hdr;
780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
Paul Bakker78a8c712013-03-06 17:01:52 +0100782
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200783 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +0100784 buf[2] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200785 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +0100786 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200787 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
Paul Bakker78a8c712013-03-06 17:01:52 +0100788 buf[3], buf[4] ) );
789
790 /*
791 * SSLv2 Client Hello
792 *
793 * Record layer:
794 * 0 . 1 message length
795 *
796 * SSL layer:
797 * 2 . 2 message type
798 * 3 . 4 protocol version
799 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200800 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
801 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100802 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200803 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
804 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100805 }
806
807 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
808
809 if( n < 17 || n > 512 )
810 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200811 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
812 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100813 }
814
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200815 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200816 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
817 ? buf[4] : ssl->conf->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +0100818
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200819 if( ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker78a8c712013-03-06 17:01:52 +0100820 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200821 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200822 " [%d:%d] < [%d:%d]",
823 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200824 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200826 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
827 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
828 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker78a8c712013-03-06 17:01:52 +0100829 }
830
Paul Bakker2fbefde2013-06-29 16:01:15 +0200831 ssl->handshake->max_major_ver = buf[3];
832 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +0100833
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200834 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100835 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200836 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Paul Bakker78a8c712013-03-06 17:01:52 +0100837 return( ret );
838 }
839
840 ssl->handshake->update_checksum( ssl, buf + 2, n );
841
842 buf = ssl->in_msg;
843 n = ssl->in_left - 5;
844
845 /*
846 * 0 . 1 ciphersuitelist length
847 * 2 . 3 session id length
848 * 4 . 5 challenge length
849 * 6 . .. ciphersuitelist
850 * .. . .. session id
851 * .. . .. challenge
852 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200853 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
Paul Bakker78a8c712013-03-06 17:01:52 +0100854
855 ciph_len = ( buf[0] << 8 ) | buf[1];
856 sess_len = ( buf[2] << 8 ) | buf[3];
857 chal_len = ( buf[4] << 8 ) | buf[5];
858
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200859 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +0100860 ciph_len, sess_len, chal_len ) );
861
862 /*
863 * Make sure each parameter length is valid
864 */
865 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
866 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200867 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
868 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100869 }
870
871 if( sess_len > 32 )
872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200873 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
874 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100875 }
876
877 if( chal_len < 8 || chal_len > 32 )
878 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200879 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
880 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100881 }
882
883 if( n != 6 + ciph_len + sess_len + chal_len )
884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
886 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100887 }
888
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200889 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Paul Bakker78a8c712013-03-06 17:01:52 +0100890 buf + 6, ciph_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200891 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
Paul Bakker78a8c712013-03-06 17:01:52 +0100892 buf + 6 + ciph_len, sess_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200893 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
Paul Bakker78a8c712013-03-06 17:01:52 +0100894 buf + 6 + ciph_len + sess_len, chal_len );
895
896 p = buf + 6 + ciph_len;
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200897 ssl->session_negotiate->id_len = sess_len;
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200898 memset( ssl->session_negotiate->id, 0,
899 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200900 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
Paul Bakker78a8c712013-03-06 17:01:52 +0100901
902 p += sess_len;
903 memset( ssl->handshake->randbytes, 0, 64 );
904 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
905
906 /*
907 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
908 */
909 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
910 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200911 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Paul Bakker78a8c712013-03-06 17:01:52 +0100912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200913 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
914#if defined(MBEDTLS_SSL_RENEGOTIATION)
915 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Paul Bakker78a8c712013-03-06 17:01:52 +0100916 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200917 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100918 "during renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100919
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200920 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100921 return( ret );
922
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200923 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100924 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200925#endif /* MBEDTLS_SSL_RENEGOTIATION */
926 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker78a8c712013-03-06 17:01:52 +0100927 break;
928 }
929 }
930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200931#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200932 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
933 {
934 if( p[0] == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200935 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
936 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200938 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200939
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200940 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200941 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200942 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200944 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
945 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200947 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200948 }
949
950 break;
951 }
952 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200953#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200954
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100955 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200956 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100957 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200958#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100959 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
960 {
961 for( i = 0; ciphersuites[i] != 0; i++ )
962#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200963 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +0100964 {
965 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100966#endif
Paul Bakker78a8c712013-03-06 17:01:52 +0100967 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100968 if( p[0] != 0 ||
969 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
970 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
971 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +0200972
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100973 got_common_suite = 1;
974
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100975 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
976 &ciphersuite_info ) ) != 0 )
977 return( ret );
Paul Bakker59c28a22013-06-29 15:33:42 +0200978
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100979 if( ciphersuite_info != NULL )
Paul Bakker78a8c712013-03-06 17:01:52 +0100980 goto have_ciphersuite_v2;
981 }
982 }
983
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100984 if( got_common_suite )
985 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200986 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100987 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200988 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100989 }
990 else
991 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
993 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100994 }
Paul Bakker78a8c712013-03-06 17:01:52 +0100995
996have_ciphersuite_v2:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200997 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000998
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200999 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker59c28a22013-06-29 15:33:42 +02001000 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001001 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Paul Bakker78a8c712013-03-06 17:01:52 +01001002
1003 /*
1004 * SSLv2 Client Hello relevant renegotiation security checks
1005 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001006 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001007 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001008 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001009 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001010
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001011 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001012 return( ret );
1013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001014 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001015 }
1016
1017 ssl->in_left = 0;
1018 ssl->state++;
1019
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001020 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001021
1022 return( 0 );
1023}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001024#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
Paul Bakker78a8c712013-03-06 17:01:52 +01001025
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001026static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001027{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001028 int ret, got_common_suite;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001029 size_t i, j;
1030 size_t ciph_offset, comp_offset, ext_offset;
1031 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001032#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001033 size_t cookie_offset, cookie_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001034#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001035 unsigned char *buf, *p, *ext;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001036#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001037 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001038#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001039 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001040 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001041 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001042 int major, minor;
Paul Bakker5121ce52009-01-03 21:22:43 +00001043
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001044 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001045
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001047read_record_header:
1048#endif
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001049 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001050 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001051 * otherwise read it ourselves manually in order to support SSLv2
1052 * ClientHello, which doesn't use the same record layer format.
1053 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054#if defined(MBEDTLS_SSL_RENEGOTIATION)
1055 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001056#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001057 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058 if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001059 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001060 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001061 return( ret );
1062 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001063 }
1064
1065 buf = ssl->in_hdr;
1066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1068#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001069 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Manuel Pégourié-Gonnard8a7cf252014-10-09 17:35:53 +02001070#endif
1071 if( ( buf[0] & 0x80 ) != 0 )
1072 return ssl_parse_client_hello_v2( ssl );
Paul Bakker78a8c712013-03-06 17:01:52 +01001073#endif
1074
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001075 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
Paul Bakkerec636f32012-09-09 19:17:02 +00001076
Paul Bakkerec636f32012-09-09 19:17:02 +00001077 /*
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001078 * SSLv3/TLS Client Hello
Paul Bakkerec636f32012-09-09 19:17:02 +00001079 *
1080 * Record layer:
1081 * 0 . 0 message type
1082 * 1 . 2 protocol version
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001083 * 3 . 11 DTLS: epoch + record sequence number
Paul Bakkerec636f32012-09-09 19:17:02 +00001084 * 3 . 4 message length
1085 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001086 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001087 buf[0] ) );
1088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001089 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001090 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001091 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1092 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001093 }
1094
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001096 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
1097
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001098 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001099 buf[1], buf[2] ) );
1100
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001101 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001102
1103 /* According to RFC 5246 Appendix E.1, the version here is typically
1104 * "{03,00}, the lowest version number supported by the client, [or] the
1105 * value of ClientHello.client_version", so the only meaningful check here
1106 * is the major version shouldn't be less than 3 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001107 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001108 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001109 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1110 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001111 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001112
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001113 /* For DTLS if this is the initial handshake, remember the client sequence
1114 * number to use it in our next message (RFC 6347 4.2.1) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001115#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001116 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001117#if defined(MBEDTLS_SSL_RENEGOTIATION)
1118 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Manuel Pégourié-Gonnard3a173f42015-01-22 13:30:33 +00001119#endif
1120 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001121 {
1122 /* Epoch should be 0 for initial handshakes */
1123 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
1124 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001125 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1126 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001127 }
1128
1129 memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001130
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001131#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1132 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001133 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001134 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001135 ssl->next_record_offset = 0;
1136 ssl->in_left = 0;
1137 goto read_record_header;
1138 }
1139
1140 /* No MAC to check yet, so we can update right now */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001141 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001142#endif
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001143 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001144#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001145
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001146 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Paul Bakker5121ce52009-01-03 21:22:43 +00001147
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001148#if defined(MBEDTLS_SSL_RENEGOTIATION)
1149 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001150 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001151 /* Set by mbedtls_ssl_read_record() */
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001152 msg_len = ssl->in_hslen;
1153 }
1154 else
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001155#endif
Paul Bakkerec636f32012-09-09 19:17:02 +00001156 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001157 if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001158 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001159 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1160 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001161 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001162
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001163 if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001165 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001166 return( ret );
1167 }
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001168
1169 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001170#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001171 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001172 ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001173 else
1174#endif
1175 ssl->in_left = 0;
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001176 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001177
1178 buf = ssl->in_msg;
Paul Bakkerec636f32012-09-09 19:17:02 +00001179
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001180 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001181
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001182 ssl->handshake->update_checksum( ssl, buf, msg_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001183
1184 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001185 * Handshake layer:
1186 * 0 . 0 handshake type
1187 * 1 . 3 handshake length
1188 * 4 . 5 DTLS only: message seqence number
1189 * 6 . 8 DTLS only: fragment offset
1190 * 9 . 11 DTLS only: fragment length
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001191 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001192 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001193 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001194 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1195 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001196 }
1197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001198 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001200 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001201 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001202 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1203 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001204 }
1205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001206 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001207 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1208
1209 /* We don't support fragmentation of ClientHello (yet?) */
1210 if( buf[1] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001211 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001212 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001213 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1214 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001215 }
1216
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001217#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001218 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001219 {
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001220 /*
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001221 * Copy the client's handshake message_seq on initial handshakes,
1222 * check sequence number on renego.
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001223 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001224#if defined(MBEDTLS_SSL_RENEGOTIATION)
1225 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001226 {
1227 /* This couldn't be done in ssl_prepare_handshake_record() */
1228 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1229 ssl->in_msg[5];
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001230
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001231 if( cli_msg_seq != ssl->handshake->in_msg_seq )
1232 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001233 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001234 "%d (expected %d)", cli_msg_seq,
1235 ssl->handshake->in_msg_seq ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001236 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001237 }
1238
1239 ssl->handshake->in_msg_seq++;
1240 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001241 else
1242#endif
1243 {
1244 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1245 ssl->in_msg[5];
1246 ssl->handshake->out_msg_seq = cli_msg_seq;
1247 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1248 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001249
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001250 /*
1251 * For now we don't support fragmentation, so make sure
1252 * fragment_offset == 0 and fragment_length == length
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001253 */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001254 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
1255 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
1256 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001257 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
1258 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001259 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001260 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001261#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001263 buf += mbedtls_ssl_hs_hdr_len( ssl );
1264 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001265
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001266 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001267 * ClientHello layer:
1268 * 0 . 1 protocol version
1269 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1270 * 34 . 35 session id length (1 byte)
1271 * 35 . 34+x session id
1272 * 35+x . 35+x DTLS only: cookie length (1 byte)
1273 * 36+x . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001274 * .. . .. ciphersuite list length (2 bytes)
1275 * .. . .. ciphersuite list
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001276 * .. . .. compression alg. list length (1 byte)
1277 * .. . .. compression alg. list
1278 * .. . .. extensions length (2 bytes, optional)
1279 * .. . .. extensions (optional)
Paul Bakkerec636f32012-09-09 19:17:02 +00001280 */
Paul Bakkerec636f32012-09-09 19:17:02 +00001281
1282 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001283 * Minimal length (with everything empty and extensions ommitted) is
1284 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1285 * read at least up to session id length without worrying.
Paul Bakkerec636f32012-09-09 19:17:02 +00001286 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001287 if( msg_len < 38 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001288 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1290 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001291 }
1292
1293 /*
1294 * Check and save the protocol version
1295 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001296 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001297
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001298 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001299 ssl->conf->transport, buf );
Paul Bakkerec636f32012-09-09 19:17:02 +00001300
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001301 ssl->handshake->max_major_ver = ssl->major_ver;
1302 ssl->handshake->max_minor_ver = ssl->minor_ver;
1303
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001304 if( ssl->major_ver < ssl->conf->min_major_ver ||
1305 ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00001306 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001307 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001308 " [%d:%d] < [%d:%d]",
1309 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001310 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001312 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1313 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001315 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001316 }
1317
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001318 if( ssl->major_ver > ssl->conf->max_major_ver )
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001319 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001320 ssl->major_ver = ssl->conf->max_major_ver;
1321 ssl->minor_ver = ssl->conf->max_minor_ver;
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001322 }
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001323 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
1324 ssl->minor_ver = ssl->conf->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001325
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001326 /*
1327 * Save client random (inc. Unix time)
1328 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001329 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001330
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001331 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001332
1333 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001334 * Check the session ID length and save session ID
Paul Bakkerec636f32012-09-09 19:17:02 +00001335 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001336 sess_len = buf[34];
Paul Bakkerec636f32012-09-09 19:17:02 +00001337
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001338 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001339 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Paul Bakkerec636f32012-09-09 19:17:02 +00001340 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001341 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1342 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001343 }
1344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001345 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001346
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001347 ssl->session_negotiate->id_len = sess_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001348 memset( ssl->session_negotiate->id, 0,
1349 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001350 memcpy( ssl->session_negotiate->id, buf + 35,
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001351 ssl->session_negotiate->id_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001352
1353 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001354 * Check the cookie length and content
1355 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001356#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001357 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001358 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001359 cookie_offset = 35 + sess_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001360 cookie_len = buf[cookie_offset];
1361
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001362 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001363 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001364 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1365 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001366 }
1367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001368 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001369 buf + cookie_offset + 1, cookie_len );
1370
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001371#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001372 if( ssl->conf->f_cookie_check != NULL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001373#if defined(MBEDTLS_SSL_RENEGOTIATION)
1374 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001375#endif
1376 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001377 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001378 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001379 buf + cookie_offset + 1, cookie_len,
1380 ssl->cli_id, ssl->cli_id_len ) != 0 )
1381 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001382 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001383 ssl->handshake->verify_cookie_len = 1;
1384 }
1385 else
1386 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001387 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001388 ssl->handshake->verify_cookie_len = 0;
1389 }
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001390 }
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02001391 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001392#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001393 {
1394 /* We know we didn't send a cookie, so it should be empty */
1395 if( cookie_len != 0 )
1396 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001397 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1398 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001399 }
1400
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001401 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001402 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001403
1404 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001405 * Check the ciphersuitelist length (will be parsed later)
Paul Bakkerec636f32012-09-09 19:17:02 +00001406 */
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001407 ciph_offset = cookie_offset + 1 + cookie_len;
Manuel Pégourié-Gonnarda06d7fe2015-03-13 10:36:55 +00001408 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001409 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001410#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001411 ciph_offset = 35 + sess_len;
Paul Bakkerec636f32012-09-09 19:17:02 +00001412
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001413 ciph_len = ( buf[ciph_offset + 0] << 8 )
1414 | ( buf[ciph_offset + 1] );
1415
1416 if( ciph_len < 2 ||
1417 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1418 ( ciph_len % 2 ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001419 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001420 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1421 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001422 }
1423
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001424 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001425 buf + ciph_offset + 2, ciph_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001426
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001427 /*
1428 * Check the compression algorithms length and pick one
1429 */
1430 comp_offset = ciph_offset + 2 + ciph_len;
1431
1432 comp_len = buf[comp_offset];
1433
1434 if( comp_len < 1 ||
1435 comp_len > 16 ||
1436 comp_len + comp_offset + 1 > msg_len )
Paul Bakkerec636f32012-09-09 19:17:02 +00001437 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001438 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1439 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001440 }
1441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001442 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001443 buf + comp_offset + 1, comp_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001444
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001445 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
1446#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakkerec636f32012-09-09 19:17:02 +00001447 for( i = 0; i < comp_len; ++i )
1448 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001449 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001450 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001451 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001452 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001453 }
1454 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001455#endif
1456
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001457 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001458#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001459 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001460 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001461#endif
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001462
Paul Bakkerec636f32012-09-09 19:17:02 +00001463 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001464 * Check the extension length
Paul Bakker48916f92012-09-16 19:57:18 +00001465 */
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001466 ext_offset = comp_offset + 1 + comp_len;
1467 if( msg_len > ext_offset )
Paul Bakker48916f92012-09-16 19:57:18 +00001468 {
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001469 if( msg_len < ext_offset + 2 )
Paul Bakker48916f92012-09-16 19:57:18 +00001470 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001471 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1472 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001473 }
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001474
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001475 ext_len = ( buf[ext_offset + 0] << 8 )
1476 | ( buf[ext_offset + 1] );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001477
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001478 if( ( ext_len > 0 && ext_len < 4 ) ||
1479 msg_len != ext_offset + 2 + ext_len )
1480 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001481 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001482 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00001483 }
1484 }
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001485 else
1486 ext_len = 0;
Paul Bakker48916f92012-09-16 19:57:18 +00001487
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001488 ext = buf + ext_offset + 2;
Manuel Pégourié-Gonnard4cc8c632015-07-23 12:24:03 +02001489 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001490
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001491 while( ext_len != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001492 {
1493 unsigned int ext_id = ( ( ext[0] << 8 )
1494 | ( ext[1] ) );
1495 unsigned int ext_size = ( ( ext[2] << 8 )
1496 | ( ext[3] ) );
1497
1498 if( ext_size + 4 > ext_len )
1499 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001500 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1501 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00001502 }
1503 switch( ext_id )
1504 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001505#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1506 case MBEDTLS_TLS_EXT_SERVERNAME:
1507 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001508 if( ssl->conf->f_sni == NULL )
Paul Bakker5701cdc2012-09-27 21:49:42 +00001509 break;
1510
1511 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1512 if( ret != 0 )
1513 return( ret );
1514 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001515#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001517 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1518 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
1519#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakker48916f92012-09-16 19:57:18 +00001520 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001521#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001522
Paul Bakker23f36802012-09-28 14:15:14 +00001523 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1524 if( ret != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001525 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00001526 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001527
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001528#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1529 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1530 case MBEDTLS_TLS_EXT_SIG_ALG:
1531 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1532#if defined(MBEDTLS_SSL_RENEGOTIATION)
1533 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Paul Bakker23f36802012-09-28 14:15:14 +00001534 break;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001535#endif
Paul Bakker23f36802012-09-28 14:15:14 +00001536
1537 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1538 if( ret != 0 )
1539 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00001540 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1542 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001543
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001544#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
1545 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1546 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Paul Bakker41c83d32013-03-20 14:39:14 +01001547
1548 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1549 if( ret != 0 )
1550 return( ret );
1551 break;
1552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001553 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1554 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1555 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001556
1557 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1558 if( ret != 0 )
1559 return( ret );
1560 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001561#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Paul Bakker41c83d32013-03-20 14:39:14 +01001562
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001563#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1564 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1565 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001566
1567 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1568 if( ret != 0 )
1569 return( ret );
1570 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001571#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001572
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001573#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1574 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1575 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001576
1577 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1578 if( ret != 0 )
1579 return( ret );
1580 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001581#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001582
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001583#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1584 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1585 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001586
1587 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1588 if( ret != 0 )
1589 return( ret );
1590 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001591#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001592
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001593#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1594 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1595 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001596
1597 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1598 if( ret != 0 )
1599 return( ret );
1600 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001601#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001602
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001603#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1604 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1605 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001606
1607 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1608 if( ret != 0 )
1609 return( ret );
1610 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001611#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001613#if defined(MBEDTLS_SSL_ALPN)
1614 case MBEDTLS_TLS_EXT_ALPN:
1615 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001616
1617 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1618 if( ret != 0 )
1619 return( ret );
1620 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001621#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001622
Paul Bakker48916f92012-09-16 19:57:18 +00001623 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001624 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
Paul Bakker48916f92012-09-16 19:57:18 +00001625 ext_id ) );
1626 }
1627
1628 ext_len -= 4 + ext_size;
1629 ext += 4 + ext_size;
1630
1631 if( ext_len > 0 && ext_len < 4 )
1632 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001633 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1634 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00001635 }
1636 }
1637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001638#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001639 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
1640 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001641 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1642 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001643 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001644 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001645
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001646 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001647 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001648 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001649
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001650 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1651 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001652
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001654 }
1655
1656 break;
1657 }
1658 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001659#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001660
Paul Bakker48916f92012-09-16 19:57:18 +00001661 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001662 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1663 */
1664 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
1665 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001666 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001667 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001668 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1669#if defined(MBEDTLS_SSL_RENEGOTIATION)
1670 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001671 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001672 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001673
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001674 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001675 return( ret );
1676
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001677 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001678 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001679#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001680 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001681 break;
1682 }
1683 }
1684
1685 /*
Paul Bakker48916f92012-09-16 19:57:18 +00001686 * Renegotiation security checks
1687 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001688 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001689 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001690 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001691 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001692 handshake_failure = 1;
1693 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001694#if defined(MBEDTLS_SSL_RENEGOTIATION)
1695 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1696 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001697 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001698 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001699 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001700 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00001701 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001702 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1703 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001704 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00001705 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001706 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001707 handshake_failure = 1;
1708 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001709 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1710 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001711 renegotiation_info_seen == 1 )
1712 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001713 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001714 handshake_failure = 1;
1715 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001716#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001717
1718 if( handshake_failure == 1 )
1719 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001720 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001721 return( ret );
1722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001723 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00001724 }
Paul Bakker380da532012-04-18 16:10:25 +00001725
Paul Bakker41c83d32013-03-20 14:39:14 +01001726 /*
1727 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02001728 * (At the end because we need information from the EC-based extensions
1729 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01001730 */
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001731 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001732 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01001733 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001734#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001735 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001736 {
1737 for( i = 0; ciphersuites[i] != 0; i++ )
1738#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001739 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker41c83d32013-03-20 14:39:14 +01001740 {
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001741 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001742#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01001743 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001744 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1745 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1746 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01001747
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001748 got_common_suite = 1;
1749
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001750 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1751 &ciphersuite_info ) ) != 0 )
1752 return( ret );
1753
1754 if( ciphersuite_info != NULL )
1755 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01001756 }
1757 }
1758
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001759 if( got_common_suite )
1760 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001762 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001763 mbedtls_ssl_send_fatal_handshake_failure( ssl );
1764 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001765 }
1766 else
1767 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001768 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1769 mbedtls_ssl_send_fatal_handshake_failure( ssl );
1770 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001771 }
Paul Bakker41c83d32013-03-20 14:39:14 +01001772
1773have_ciphersuite:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001774 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001775
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001776 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker41c83d32013-03-20 14:39:14 +01001777 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001778 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Paul Bakker41c83d32013-03-20 14:39:14 +01001779
Paul Bakker5121ce52009-01-03 21:22:43 +00001780 ssl->state++;
1781
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001782#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001783 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001784 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001785#endif
1786
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001787 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001788
1789 return( 0 );
1790}
1791
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001792#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1793static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001794 unsigned char *buf,
1795 size_t *olen )
1796{
1797 unsigned char *p = buf;
1798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001799 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001800 {
1801 *olen = 0;
1802 return;
1803 }
1804
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001805 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001806
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001807 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
1808 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001809
1810 *p++ = 0x00;
1811 *p++ = 0x00;
1812
1813 *olen = 4;
1814}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001815#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001816
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001817#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1818static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001819 unsigned char *buf,
1820 size_t *olen )
1821{
1822 unsigned char *p = buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001823 const mbedtls_ssl_ciphersuite_t *suite = NULL;
1824 const mbedtls_cipher_info_t *cipher = NULL;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001826 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
1827 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001828 {
1829 *olen = 0;
1830 return;
1831 }
1832
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01001833 /*
1834 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
1835 * from a client and then selects a stream or Authenticated Encryption
1836 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
1837 * encrypt-then-MAC response extension back to the client."
1838 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001839 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01001840 ssl->session_negotiate->ciphersuite ) ) == NULL ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001841 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
1842 cipher->mode != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01001843 {
1844 *olen = 0;
1845 return;
1846 }
1847
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001848 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001850 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
1851 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001852
1853 *p++ = 0x00;
1854 *p++ = 0x00;
1855
1856 *olen = 4;
1857}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001858#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001859
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001860#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1861static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001862 unsigned char *buf,
1863 size_t *olen )
1864{
1865 unsigned char *p = buf;
1866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
1868 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001869 {
1870 *olen = 0;
1871 return;
1872 }
1873
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001874 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001875 "extension" ) );
1876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001877 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
1878 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001879
1880 *p++ = 0x00;
1881 *p++ = 0x00;
1882
1883 *olen = 4;
1884}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001885#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001886
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001887#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1888static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001889 unsigned char *buf,
1890 size_t *olen )
1891{
1892 unsigned char *p = buf;
1893
1894 if( ssl->handshake->new_session_ticket == 0 )
1895 {
1896 *olen = 0;
1897 return;
1898 }
1899
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001900 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001901
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001902 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
1903 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001904
1905 *p++ = 0x00;
1906 *p++ = 0x00;
1907
1908 *olen = 4;
1909}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001910#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001911
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001912static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001913 unsigned char *buf,
1914 size_t *olen )
1915{
1916 unsigned char *p = buf;
1917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001918 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001919 {
1920 *olen = 0;
1921 return;
1922 }
1923
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001924 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001925
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001926 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
1927 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001928
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001929#if defined(MBEDTLS_SSL_RENEGOTIATION)
1930 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001931 {
1932 *p++ = 0x00;
1933 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
1934 *p++ = ssl->verify_data_len * 2 & 0xFF;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001935
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001936 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
1937 p += ssl->verify_data_len;
1938 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
1939 p += ssl->verify_data_len;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001940 }
1941 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001942#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001943 {
1944 *p++ = 0x00;
1945 *p++ = 0x01;
1946 *p++ = 0x00;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001947 }
Manuel Pégourié-Gonnard19389752015-06-23 13:46:44 +02001948
1949 *olen = p - buf;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001950}
1951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001952#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1953static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001954 unsigned char *buf,
1955 size_t *olen )
1956{
1957 unsigned char *p = buf;
1958
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001959 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02001960 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001961 *olen = 0;
1962 return;
1963 }
1964
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001965 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001967 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
1968 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001969
1970 *p++ = 0x00;
1971 *p++ = 1;
1972
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02001973 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001974
1975 *olen = 5;
1976}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001977#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001978
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001979#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
1980static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001981 unsigned char *buf,
1982 size_t *olen )
1983{
1984 unsigned char *p = buf;
1985 ((void) ssl);
1986
Paul Bakker677377f2013-10-28 12:54:26 +01001987 if( ( ssl->handshake->cli_exts &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001988 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Paul Bakker677377f2013-10-28 12:54:26 +01001989 {
1990 *olen = 0;
1991 return;
1992 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001994 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001995
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001996 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
1997 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001998
1999 *p++ = 0x00;
2000 *p++ = 2;
2001
2002 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002003 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002004
2005 *olen = 6;
2006}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002007#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002008
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002009#if defined(MBEDTLS_SSL_ALPN )
2010static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002011 unsigned char *buf, size_t *olen )
2012{
2013 if( ssl->alpn_chosen == NULL )
2014 {
2015 *olen = 0;
2016 return;
2017 }
2018
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002019 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002020
2021 /*
2022 * 0 . 1 ext identifier
2023 * 2 . 3 ext length
2024 * 4 . 5 protocol list length
2025 * 6 . 6 protocol name length
2026 * 7 . 7+n protocol name
2027 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002028 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
2029 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002030
2031 *olen = 7 + strlen( ssl->alpn_chosen );
2032
2033 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2034 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2035
2036 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2037 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2038
2039 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2040
2041 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2042}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002043#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002044
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002045#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2046static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002047{
2048 int ret;
2049 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002050 unsigned char *cookie_len_byte;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002052 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002053
2054 /*
2055 * struct {
2056 * ProtocolVersion server_version;
2057 * opaque cookie<0..2^8-1>;
2058 * } HelloVerifyRequest;
2059 */
2060
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02002061 /* The RFC is not clear on this point, but sending the actual negotiated
2062 * version looks like the most interoperable thing to do. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002063 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002064 ssl->conf->transport, p );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002065 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002066 p += 2;
2067
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002068 /* If we get here, f_cookie_check is not null */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002069 if( ssl->conf->f_cookie_write == NULL )
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002070 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
2072 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002073 }
2074
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002075 /* Skip length byte until we know the length */
2076 cookie_len_byte = p++;
2077
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002078 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002079 &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002080 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002081 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002082 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002083 return( ret );
2084 }
2085
2086 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
2087
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002088 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002089
2090 ssl->out_msglen = p - ssl->out_msg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002091 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2092 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002093
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002094 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002095
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002096 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002097 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002098 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002099 return( ret );
2100 }
2101
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002102 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002103
2104 return( 0 );
2105}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002106#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002107
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002108static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002109{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002110#if defined(MBEDTLS_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +00002111 time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002112#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002113 int ret;
2114 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002115 unsigned char *buf, *p;
2116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002117 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002119#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002120 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002121 ssl->handshake->verify_cookie_len != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002122 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002123 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
2124 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002125
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002126 return( ssl_write_hello_verify_request( ssl ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002127 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002128#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002129
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002130 if( ssl->conf->f_rng == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +01002131 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002132 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2133 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +01002134 }
2135
Paul Bakker5121ce52009-01-03 21:22:43 +00002136 /*
2137 * 0 . 0 handshake type
2138 * 1 . 3 handshake length
2139 * 4 . 5 protocol version
2140 * 6 . 9 UNIX time()
2141 * 10 . 37 random bytes
2142 */
2143 buf = ssl->out_msg;
2144 p = buf + 4;
2145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002146 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002147 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002148 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002149
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002150 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002151 buf[4], buf[5] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002152
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002153#if defined(MBEDTLS_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +00002154 t = time( NULL );
2155 *p++ = (unsigned char)( t >> 24 );
2156 *p++ = (unsigned char)( t >> 16 );
2157 *p++ = (unsigned char)( t >> 8 );
2158 *p++ = (unsigned char)( t );
2159
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002160 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002161#else
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002162 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002163 return( ret );
2164
2165 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002166#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker5121ce52009-01-03 21:22:43 +00002167
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002168 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Paul Bakkera3d195c2011-11-27 21:07:34 +00002169 return( ret );
2170
2171 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00002172
Paul Bakker48916f92012-09-16 19:57:18 +00002173 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002175 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002176
2177 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002178 * Resume is 0 by default, see ssl_handshake_init().
2179 * It may be already set to 1 by ssl_parse_session_ticket_ext().
2180 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00002181 */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002182 if( ssl->handshake->resume == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002183#if defined(MBEDTLS_SSL_RENEGOTIATION)
2184 ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002185#endif
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002186 ssl->session_negotiate->id_len != 0 &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002187 ssl->conf->f_get_cache != NULL &&
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01002188 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002189 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002190 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002191 ssl->handshake->resume = 1;
2192 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002193
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002194 if( ssl->handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002195 {
2196 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002197 * New session, create a new session id,
2198 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00002199 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002200 ssl->state++;
2201
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002202#if defined(MBEDTLS_HAVE_TIME)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002203 ssl->session_negotiate->start = time( NULL );
2204#endif
2205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002206#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002207 if( ssl->handshake->new_session_ticket != 0 )
2208 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002209 ssl->session_negotiate->id_len = n = 0;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002210 memset( ssl->session_negotiate->id, 0, 32 );
2211 }
2212 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002213#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002214 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002215 ssl->session_negotiate->id_len = n = 32;
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002216 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02002217 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002218 return( ret );
2219 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002220 }
2221 else
2222 {
2223 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002224 * Resuming a session
Paul Bakker5121ce52009-01-03 21:22:43 +00002225 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002226 n = ssl->session_negotiate->id_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002227 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
Paul Bakkerff60ee62010-03-16 21:09:09 +00002228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002229 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00002230 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002231 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00002232 return( ret );
2233 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002234 }
2235
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002236 /*
2237 * 38 . 38 session id length
2238 * 39 . 38+n session id
2239 * 39+n . 40+n chosen ciphersuite
2240 * 41+n . 41+n chosen compression alg.
2241 * 42+n . 43+n extensions length
2242 * 44+n . 43+n+m extensions
2243 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002244 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2245 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
2246 p += ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002247
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002248 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2249 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2250 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Paul Bakker0a597072012-09-25 21:55:46 +00002251 ssl->handshake->resume ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002252
Paul Bakker48916f92012-09-16 19:57:18 +00002253 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2254 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2255 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00002256
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002257 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2258 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2259 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00002260 ssl->session_negotiate->compression ) );
2261
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002262 /*
2263 * First write extensions, then the total length
2264 */
2265 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2266 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00002267
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002268#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002269 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2270 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02002271#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002272
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002273#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002274 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
2275 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02002276#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002277
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002278#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002279 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2280 ext_len += olen;
2281#endif
2282
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002283#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002284 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2285 ext_len += olen;
2286#endif
2287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002288#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002289 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2290 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02002291#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002293#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002294 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2295 ext_len += olen;
2296#endif
2297
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002298#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002299 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2300 ext_len += olen;
2301#endif
2302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002303 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002304
Paul Bakkera7036632014-04-30 10:15:38 +02002305 if( ext_len > 0 )
2306 {
2307 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2308 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2309 p += ext_len;
2310 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002311
2312 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002313 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2314 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002316 ret = mbedtls_ssl_write_record( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002317
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002318 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002319
2320 return( ret );
2321}
2322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002323#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
2324 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
2325 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
2326 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2327static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002328{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002329 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002330
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002331 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002332
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002333 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2334 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
2335 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2336 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002337 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002338 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002339 ssl->state++;
2340 return( 0 );
2341 }
2342
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02002343 // LCOV_EXCL_START
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002344 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2345 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02002346 // LCOV_EXCL_STOP
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002347}
2348#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002349static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002350{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002351 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2352 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002353 size_t dn_size, total_dn_size; /* excluding length bytes */
2354 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00002355 unsigned char *buf, *p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002356 const mbedtls_x509_crt *crt;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002357 int authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00002358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002359 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002360
2361 ssl->state++;
2362
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002363#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2364 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
2365 authmode = ssl->handshake->sni_authmode;
2366 else
2367#endif
2368 authmode = ssl->conf->authmode;
2369
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002370 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2371 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
2372 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2373 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002374 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002376 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002377 return( 0 );
2378 }
2379
2380 /*
2381 * 0 . 0 handshake type
2382 * 1 . 3 handshake length
2383 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01002384 * 5 .. m-1 cert types
2385 * m .. m+1 sig alg length (TLS 1.2 only)
Paul Bakker9af723c2014-05-01 13:03:14 +02002386 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00002387 * n .. n+1 length of all DNs
2388 * n+2 .. n+3 length of DN 1
2389 * n+4 .. ... Distinguished Name #1
2390 * ... .. ... length of DN 2, etc.
2391 */
2392 buf = ssl->out_msg;
2393 p = buf + 4;
2394
2395 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002396 * Supported certificate types
2397 *
2398 * ClientCertificateType certificate_types<1..2^8-1>;
2399 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00002400 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002401 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01002402
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002403#if defined(MBEDTLS_RSA_C)
2404 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002405#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002406#if defined(MBEDTLS_ECDSA_C)
2407 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002408#endif
2409
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002410 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002411 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01002412
Paul Bakker577e0062013-08-28 11:57:20 +02002413 sa_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002414#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01002415 /*
2416 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01002417 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002418 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2419 *
2420 * struct {
2421 * HashAlgorithm hash;
2422 * SignatureAlgorithm signature;
2423 * } SignatureAndHashAlgorithm;
2424 *
2425 * enum { (255) } HashAlgorithm;
2426 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01002427 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002428 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002429 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002430 /*
2431 * Only use current running hash algorithm that is already required
2432 * for requested ciphersuite.
2433 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002434 ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256;
Paul Bakker926af752012-11-23 13:38:07 +01002435
Paul Bakkerb7149bc2013-03-20 15:30:09 +01002436 if( ssl->transform_negotiate->ciphersuite_info->mac ==
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002437 MBEDTLS_MD_SHA384 )
Paul Bakker926af752012-11-23 13:38:07 +01002438 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002439 ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384;
Paul Bakker926af752012-11-23 13:38:07 +01002440 }
Paul Bakkerf7abd422013-04-16 13:15:56 +02002441
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002442 /*
2443 * Supported signature algorithms
2444 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002446 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002447 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002448#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002449#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002450 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002452#endif
Paul Bakker926af752012-11-23 13:38:07 +01002453
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002454 p[0] = (unsigned char)( sa_len >> 8 );
2455 p[1] = (unsigned char)( sa_len );
2456 sa_len += 2;
2457 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01002458 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002459#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002460
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002461 /*
2462 * DistinguishedName certificate_authorities<0..2^16-1>;
2463 * opaque DistinguishedName<1..2^16-1>;
2464 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002465 p += 2;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02002466#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2467 if( ssl->handshake->sni_ca_chain != NULL )
2468 crt = ssl->handshake->sni_ca_chain;
2469 else
2470#endif
2471 crt = ssl->conf->ca_chain;
Paul Bakker5121ce52009-01-03 21:22:43 +00002472
Paul Bakkerbc3d9842012-11-26 16:12:02 +01002473 total_dn_size = 0;
Paul Bakkerc70e4252014-04-18 13:47:38 +02002474 while( crt != NULL && crt->version != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002475 {
2476 if( p - buf > 4096 )
2477 break;
2478
Paul Bakker926af752012-11-23 13:38:07 +01002479 dn_size = crt->subject_raw.len;
2480 *p++ = (unsigned char)( dn_size >> 8 );
2481 *p++ = (unsigned char)( dn_size );
2482 memcpy( p, crt->subject_raw.p, dn_size );
2483 p += dn_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00002484
Manuel Pégourié-Gonnardb0761162015-07-22 11:39:23 +02002485 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
Paul Bakker926af752012-11-23 13:38:07 +01002486
Paul Bakkerbc3d9842012-11-26 16:12:02 +01002487 total_dn_size += 2 + dn_size;
Paul Bakker926af752012-11-23 13:38:07 +01002488 crt = crt->next;
Paul Bakker5121ce52009-01-03 21:22:43 +00002489 }
2490
Paul Bakker926af752012-11-23 13:38:07 +01002491 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002492 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2493 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002494 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
2495 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00002496
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002497 ret = mbedtls_ssl_write_record( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002498
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002499 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002500
2501 return( ret );
2502}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002503#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
2504 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
2505 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
2506 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002508#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2509 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2510static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002511{
2512 int ret;
2513
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002514 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002515 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002516 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
2517 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002518 }
2519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002520 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
2521 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
2522 MBEDTLS_ECDH_OURS ) ) != 0 )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002523 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002524 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002525 return( ret );
2526 }
2527
2528 return( 0 );
2529}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002530#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2531 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002533static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker41c83d32013-03-20 14:39:14 +01002534{
Paul Bakker23986e52011-04-24 08:57:21 +00002535 int ret;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002536 size_t n = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002537 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02002538 ssl->transform_negotiate->ciphersuite_info;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002539
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002540#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2541 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2542 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2543 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
2544 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002545 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002546 unsigned char *dig_signed = p;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002547 size_t dig_signed_len = 0, len;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002548 ((void) dig_signed);
2549 ((void) dig_signed_len);
2550#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01002551
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002552 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002553
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002554#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
2555 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
2556 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2557 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ||
2558 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2559 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002560 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002561 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002562 ssl->state++;
2563 return( 0 );
2564 }
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002565#endif
2566
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002567#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2568 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2569 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2570 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002571 {
2572 ssl_get_ecdh_params_from_cert( ssl );
2573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002574 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002575 ssl->state++;
2576 return( 0 );
2577 }
2578#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002579
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002580#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2581 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2582 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2583 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002584 {
2585 /* TODO: Support identity hints */
2586 *(p++) = 0x00;
2587 *(p++) = 0x00;
2588
2589 n += 2;
2590 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002591#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2592 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002594#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2595 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2596 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
2597 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48916f92012-09-16 19:57:18 +00002598 {
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002599 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
2600 {
2601 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
2602 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2603 }
2604
Paul Bakker41c83d32013-03-20 14:39:14 +01002605 /*
2606 * Ephemeral DH parameters:
2607 *
2608 * struct {
2609 * opaque dh_p<1..2^16-1>;
2610 * opaque dh_g<1..2^16-1>;
2611 * opaque dh_Ys<1..2^16-1>;
2612 * } ServerDHParams;
2613 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002614 if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 ||
2615 ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002616 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002617 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002618 return( ret );
2619 }
Paul Bakker48916f92012-09-16 19:57:18 +00002620
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002621 if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
2622 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002623 p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002624 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002625 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002626 return( ret );
2627 }
2628
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002629 dig_signed = p;
2630 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002631
2632 p += len;
2633 n += len;
2634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002635 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2636 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2637 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2638 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker41c83d32013-03-20 14:39:14 +01002639 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002640#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2641 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01002642
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002643#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
2644 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2645 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2646 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002647 {
Paul Bakker41c83d32013-03-20 14:39:14 +01002648 /*
2649 * Ephemeral ECDH parameters:
2650 *
2651 * struct {
2652 * ECParameters curve_params;
2653 * ECPoint public;
2654 * } ServerECDHParams;
2655 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002656 const mbedtls_ecp_curve_info **curve = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002657 const mbedtls_ecp_group_id *gid;
Gergely Budai987bfb52014-01-19 21:48:42 +01002658
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002659 /* Match our preference list against the offered curves */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002660 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002661 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
2662 if( (*curve)->grp_id == *gid )
2663 goto curve_matching_done;
2664
2665curve_matching_done:
Manuel Pégourié-Gonnardb86145e2015-06-23 14:11:39 +02002666 if( curve == NULL || *curve == NULL )
Gergely Budai987bfb52014-01-19 21:48:42 +01002667 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002668 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
2669 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Gergely Budai987bfb52014-01-19 21:48:42 +01002670 }
Manuel Pégourié-Gonnardde053902014-02-04 13:58:39 +01002671
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002672 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
Gergely Budai987bfb52014-01-19 21:48:42 +01002673
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02002674 if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002675 (*curve)->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002676 {
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02002677 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002678 return( ret );
2679 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002681 if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
2682 p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002683 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002684 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002686 return( ret );
2687 }
2688
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002689 dig_signed = p;
2690 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002691
2692 p += len;
2693 n += len;
2694
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002695 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01002696 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002697#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002698
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002699#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2700 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2701 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2702 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
2703 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2704 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002705 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002706 size_t signature_len = 0;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002707 unsigned int hashlen = 0;
2708 unsigned char hash[64];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002709 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
Paul Bakker23f36802012-09-28 14:15:14 +00002710
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002711 /*
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002712 * Choose hash algorithm. NONE means MD5 + SHA1 here.
2713 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002714#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2715 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002717 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002718
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002719 if( md_alg == MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02002720 { // LCOV_EXCL_START
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002721 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2722 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02002723 } // LCOV_EXCL_STOP
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002724 }
Paul Bakker577e0062013-08-28 11:57:20 +02002725 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002726#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2727#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2728 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakker66d5d072014-06-17 16:39:18 +02002729 if( ciphersuite_info->key_exchange ==
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002730 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002731 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002732 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002733 }
2734 else
Paul Bakker577e0062013-08-28 11:57:20 +02002735#endif
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002737 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002738 }
2739
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002740 /*
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002741 * Compute the hash to be signed
2742 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002743#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2744 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2745 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00002746 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002747 mbedtls_md5_context mbedtls_md5;
2748 mbedtls_sha1_context mbedtls_sha1;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002749
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002750 mbedtls_md5_init( &mbedtls_md5 );
2751 mbedtls_sha1_init( &mbedtls_sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02002752
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002753 /*
2754 * digitally-signed struct {
2755 * opaque md5_hash[16];
2756 * opaque sha_hash[20];
2757 * };
2758 *
2759 * md5_hash
2760 * MD5(ClientHello.random + ServerHello.random
2761 * + ServerParams);
2762 * sha_hash
2763 * SHA(ClientHello.random + ServerHello.random
2764 * + ServerParams);
2765 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002766 mbedtls_md5_starts( &mbedtls_md5 );
2767 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
2768 mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
2769 mbedtls_md5_finish( &mbedtls_md5, hash );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002770
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002771 mbedtls_sha1_starts( &mbedtls_sha1 );
2772 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
2773 mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
2774 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002775
2776 hashlen = 36;
Paul Bakker5b4af392014-06-26 12:09:34 +02002777
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002778 mbedtls_md5_free( &mbedtls_md5 );
2779 mbedtls_sha1_free( &mbedtls_sha1 );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002780 }
2781 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002782#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
2783 MBEDTLS_SSL_PROTO_TLS1_1 */
2784#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2785 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2786 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002787 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002788 mbedtls_md_context_t ctx;
2789 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002791 mbedtls_md_init( &ctx );
Paul Bakker84bbeb52014-07-01 14:53:22 +02002792
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002793 /* Info from md_alg will be used instead */
2794 hashlen = 0;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002795
2796 /*
2797 * digitally-signed struct {
2798 * opaque client_random[32];
2799 * opaque server_random[32];
2800 * ServerDHParams params;
2801 * };
2802 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002803 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002804 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002805 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002806 return( ret );
2807 }
2808
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002809 mbedtls_md_starts( &ctx );
2810 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
2811 mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
2812 mbedtls_md_finish( &ctx, hash );
2813 mbedtls_md_free( &ctx );
Paul Bakker23f36802012-09-28 14:15:14 +00002814 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002815 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002816#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2817 MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02002818 { // LCOV_EXCL_START
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002819 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2820 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02002821 } // LCOV_EXCL_STOP
Paul Bakkerc70b9822013-04-07 22:00:46 +02002822
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002823 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
2824 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002825
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002826 /*
2827 * Make the signature
2828 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002829 if( mbedtls_ssl_own_key( ssl ) == NULL )
Paul Bakker23f36802012-09-28 14:15:14 +00002830 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002831 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
2832 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002833 }
Paul Bakker23f36802012-09-28 14:15:14 +00002834
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002835#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2836 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker23f36802012-09-28 14:15:14 +00002837 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002838 *(p++) = ssl->handshake->sig_alg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002839 *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002840
2841 n += 2;
2842 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002843#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002845 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02002846 p + 2 , &signature_len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002847 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002848 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002849 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002850 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00002851 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002852
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002853 *(p++) = (unsigned char)( signature_len >> 8 );
2854 *(p++) = (unsigned char)( signature_len );
Paul Bakkerbf63b362012-04-12 20:44:34 +00002855 n += 2;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002857 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
Paul Bakker48916f92012-09-16 19:57:18 +00002858
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002859 n += signature_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002860 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002861#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
2862 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2863 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002864
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002865 ssl->out_msglen = 4 + n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002866 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2867 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00002868
2869 ssl->state++;
2870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002871 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002873 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002874 return( ret );
2875 }
2876
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002877 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002878
2879 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002880}
2881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002882static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002883{
2884 int ret;
2885
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002886 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002887
2888 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002889 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2890 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Paul Bakker5121ce52009-01-03 21:22:43 +00002891
2892 ssl->state++;
2893
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002894#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002895 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002896 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02002897#endif
2898
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002899 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002900 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002901 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002902 return( ret );
2903 }
2904
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002905 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002906
2907 return( 0 );
2908}
2909
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002910#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2911 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2912static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002913 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002914{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002915 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002916 size_t n;
2917
2918 /*
2919 * Receive G^Y mod P, premaster = (G^Y)^X mod P
2920 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002921 if( *p + 2 > end )
2922 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002923 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2924 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002925 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02002926
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002927 n = ( (*p)[0] << 8 ) | (*p)[1];
2928 *p += 2;
2929
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01002930 if( *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002931 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002932 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2933 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002934 }
2935
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002936 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002938 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
2939 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002940 }
2941
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01002942 *p += n;
2943
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002944 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002945
Paul Bakker70df2fb2013-04-17 17:19:09 +02002946 return( ret );
2947}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002948#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2949 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02002950
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002951#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
2952 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2953static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002954 const unsigned char *p,
2955 const unsigned char *end,
2956 size_t pms_offset )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002957{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002958 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002959 size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002960 unsigned char *pms = ssl->handshake->premaster + pms_offset;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002961 unsigned char ver[2];
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00002962 unsigned char fake_pms[48], peer_pms[48];
2963 unsigned char mask;
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02002964 size_t i, peer_pmslen;
2965 unsigned int diff;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002967 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002968 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002969 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
2970 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002971 }
2972
2973 /*
2974 * Decrypt the premaster using own private RSA key
2975 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002976#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2977 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2978 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002979 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002980 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
2981 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002982 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002983 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2984 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002985 }
2986 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002987#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02002988
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002989 if( p + len != end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002990 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002991 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2992 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002993 }
2994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002995 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002996 ssl->handshake->max_minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002997 ssl->conf->transport, ver );
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02002998
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00002999 /*
3000 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3001 * must not cause the connection to end immediately; instead, send a
3002 * bad_record_mac later in the handshake.
3003 * Also, avoid data-dependant branches here to protect against
3004 * timing-based variants.
3005 */
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003006 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003007 if( ret != 0 )
3008 return( ret );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003009
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003010 ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003011 peer_pms, &peer_pmslen,
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003012 sizeof( peer_pms ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003013 ssl->conf->f_rng, ssl->conf->p_rng );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003014
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003015 diff = (unsigned int) ret;
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003016 diff |= peer_pmslen ^ 48;
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003017 diff |= peer_pms[0] ^ ver[0];
3018 diff |= peer_pms[1] ^ ver[1];
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003019
Manuel Pégourié-Gonnard331ba572015-04-20 12:33:57 +01003020#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003021 if( diff != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003023#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003024
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003025 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
3026 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
3027 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003028 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3029 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003030 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003031 ssl->handshake->pmslen = 48;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003032
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02003033 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
3034 /* MSVC has a warning about unary minus on unsigned, but this is
3035 * well-defined and precisely what we want to do here */
3036#if defined(_MSC_VER)
3037#pragma warning( push )
3038#pragma warning( disable : 4146 )
3039#endif
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003040 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02003041#if defined(_MSC_VER)
3042#pragma warning( pop )
3043#endif
3044
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003045 for( i = 0; i < ssl->handshake->pmslen; i++ )
3046 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
3047
3048 return( 0 );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003049}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003050#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3051 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003053#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
3054static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003055 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003056{
Paul Bakker6db455e2013-09-18 17:29:31 +02003057 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003058 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003059
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003060 if( ssl->conf->f_psk == NULL &&
3061 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
3062 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003063 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003064 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
3065 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003066 }
3067
3068 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003069 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02003070 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003071 if( *p + 2 > end )
3072 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003073 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3074 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003075 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003076
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003077 n = ( (*p)[0] << 8 ) | (*p)[1];
3078 *p += 2;
3079
3080 if( n < 1 || n > 65535 || *p + n > end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003081 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3083 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003084 }
3085
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003086 if( ssl->conf->f_psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02003087 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003088 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003089 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003090 }
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003091 else
Paul Bakker6db455e2013-09-18 17:29:31 +02003092 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01003093 /* Identity is not a big secret since clients send it in the clear,
3094 * but treat it carefully anyway, just in case */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003095 if( n != ssl->conf->psk_identity_len ||
3096 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003097 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003098 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003099 }
3100 }
3101
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003102 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003103 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003104 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
3105 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
3106 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3107 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003108 {
3109 return( ret );
3110 }
3111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003112 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003113 }
3114
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003115 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003116
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003117 return( 0 );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003118}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003119#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02003120
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003121static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003122{
Paul Bakker23986e52011-04-24 08:57:21 +00003123 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003124 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003125 unsigned char *p, *end;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003126
Paul Bakker41c83d32013-03-20 14:39:14 +01003127 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003129 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003130
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003131 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003132 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003133 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003134 return( ret );
3135 }
3136
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003137 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003138 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnardf8995832014-09-10 08:25:12 +00003139
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003140 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3143 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003144 }
3145
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003146 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003147 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003148 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3149 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003150 }
3151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003152#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3153 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003154 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003155 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003156 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003157 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003158 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003159 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003160
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003161 if( p != end )
3162 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003163 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3164 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003165 }
3166
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003167 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003168 ssl->handshake->premaster,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01003169 MBEDTLS_PREMASTER_SIZE,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02003170 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003171 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003172 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003173 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
3174 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003175 }
3176
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003177 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003178 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003179 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003180#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3181#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3182 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3183 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3184 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3185 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3186 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3187 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3188 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003189 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003190 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003191 p, end - p) ) != 0 )
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003192 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003193 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
3194 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003195 }
3196
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003197 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003198
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003199 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003200 &ssl->handshake->pmslen,
3201 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003202 MBEDTLS_MPI_MAX_SIZE,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003203 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003204 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003205 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
3206 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003207 }
3208
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003209 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
Paul Bakker5121ce52009-01-03 21:22:43 +00003210 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003211 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003212#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3213 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3214 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3215 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3216#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3217 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003218 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003219 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003220 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003221 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003222 return( ret );
3223 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003224
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003225 if( p != end )
3226 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003227 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3228 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003229 }
3230
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003231 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003232 ciphersuite_info->key_exchange ) ) != 0 )
3233 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003234 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003235 return( ret );
3236 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003237 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003238 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003239#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
3240#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3241 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003242 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003243 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3244 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003245 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003246 return( ret );
3247 }
3248
3249 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
3250 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003251 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003252 return( ret );
3253 }
3254
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003255 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003256 ciphersuite_info->key_exchange ) ) != 0 )
3257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003258 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003259 return( ret );
3260 }
3261 }
3262 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003263#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3264#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3265 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003266 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003267 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3268 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003269 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003270 return( ret );
3271 }
3272 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
3273 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003274 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003275 return( ret );
3276 }
3277
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003278 if( p != end )
3279 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003280 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3281 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003282 }
3283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003284 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003285 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003286 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003287 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003288 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003289 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003290 }
3291 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003292#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3293#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3294 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003295 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003296 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003298 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003299 return( ret );
3300 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003301
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003302 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003303 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003304 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003305 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
3306 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003307 }
3308
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003309 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003311 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003312 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003313 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003314 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003315 return( ret );
3316 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003317 }
3318 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003319#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
3320#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3321 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01003322 {
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003323 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003324 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003325 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003326 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003327 }
3328 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003329 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003330#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02003331 { // LCOV_EXCL_START
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003332 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3333 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02003334 } // LCOV_EXCL_STOP
Paul Bakker5121ce52009-01-03 21:22:43 +00003335
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003336 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00003337 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003338 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00003339 return( ret );
3340 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003341
Paul Bakker5121ce52009-01-03 21:22:43 +00003342 ssl->state++;
3343
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003344 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003345
3346 return( 0 );
3347}
3348
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003349#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
3350 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
3351 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
3352 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3353static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003354{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003355 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003357 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003358
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003359 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3360 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3361 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3362 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakkered27a042013-04-18 22:46:23 +02003363 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003364 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02003365 ssl->state++;
3366 return( 0 );
3367 }
3368
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02003369 // LCOV_EXCL_START
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3371 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02003372 // LCOV_EXCL_STOP
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003373}
3374#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003375static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003376{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003377 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003378 size_t i, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003379 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003380 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003381 size_t hashlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003382#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3383 mbedtls_pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02003384#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003385 mbedtls_md_type_t md_alg;
3386 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003387
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003388 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003390 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3391 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3392 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3393 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard72226212014-09-10 14:23:38 +00003394 ssl->session_negotiate->peer_cert == NULL )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003395 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003396 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003397 ssl->state++;
3398 return( 0 );
3399 }
3400
Manuel Pégourié-Gonnard72226212014-09-10 14:23:38 +00003401 /* Needs to be done before read_record() to exclude current message */
Paul Bakker48916f92012-09-16 19:57:18 +00003402 ssl->handshake->calc_verify( ssl, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00003403
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003404 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003405 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003406 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003407 return( ret );
3408 }
3409
3410 ssl->state++;
3411
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003412 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
3413 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00003414 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003415 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3416 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00003417 }
3418
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003419 i = mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003420
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003421 /*
3422 * struct {
3423 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
3424 * opaque signature<0..2^16-1>;
3425 * } DigitallySigned;
3426 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003427#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3428 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3429 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01003430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003431 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003432 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003433
3434 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003435 if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
3436 MBEDTLS_PK_ECDSA ) )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003437 {
3438 hash_start += 16;
3439 hashlen -= 16;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003440 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003441 }
Paul Bakker926af752012-11-23 13:38:07 +01003442 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003443 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003444#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
3445 MBEDTLS_SSL_PROTO_TLS1_1 */
3446#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3447 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02003448 {
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003449 if( i + 2 > ssl->in_hslen )
3450 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003451 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3452 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003453 }
3454
Paul Bakker5121ce52009-01-03 21:22:43 +00003455 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02003456 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00003457 */
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003458 if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
Paul Bakker5121ce52009-01-03 21:22:43 +00003459 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003460 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003461 " for verify message" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003462 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker926af752012-11-23 13:38:07 +01003463 }
3464
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003465 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
Paul Bakker926af752012-11-23 13:38:07 +01003466
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02003467 /* Info from md_alg will be used instead */
3468 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003469
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003470 i++;
3471
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003472 /*
3473 * Signature
3474 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003475 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
3476 == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003477 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003478 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02003479 " for verify message" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003480 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003481 }
3482
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003483 /*
3484 * Check the certificate's key type matches the signature alg
3485 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003486 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003487 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003488 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
3489 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003490 }
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003491
3492 i++;
Paul Bakker577e0062013-08-28 11:57:20 +02003493 }
3494 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003495#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02003496 { // LCOV_EXCL_START
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003497 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3498 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnarda0d3a262014-04-11 15:31:02 +02003499 } // LCOV_EXCL_STOP
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02003500
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003501 if( i + 2 > ssl->in_hslen )
3502 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003503 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3504 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003505 }
3506
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003507 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
3508 i += 2;
Paul Bakker926af752012-11-23 13:38:07 +01003509
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003510 if( i + sig_len != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003511 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003512 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3513 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00003514 }
3515
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003516 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003517 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003518 ssl->in_msg + i, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003519 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003520 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003521 return( ret );
3522 }
3523
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003524 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003525
Paul Bakkered27a042013-04-18 22:46:23 +02003526 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003527}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003528#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
3529 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
3530 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003531
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003532#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3533static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003534{
3535 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003536 size_t tlen;
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02003537 uint32_t lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003538
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003539 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003540
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003541 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3542 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003543
3544 /*
3545 * struct {
3546 * uint32 ticket_lifetime_hint;
3547 * opaque ticket<0..2^16-1>;
3548 * } NewSessionTicket;
3549 *
3550 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
3551 * 8 . 9 ticket_len (n)
3552 * 10 . 9+n ticket content
3553 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02003554
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003555 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +02003556 ssl->session_negotiate,
3557 ssl->out_msg + 10,
3558 ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02003559 &tlen, &lifetime ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02003560 {
Manuel Pégourié-Gonnarda4a47352015-05-15 15:14:54 +02003561 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02003562 tlen = 0;
3563 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003564
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02003565 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
3566 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
3567 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
3568 ssl->out_msg[7] = ( lifetime ) & 0xFF;
3569
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003570 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
3571 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003572
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003573 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003574
Manuel Pégourié-Gonnard145dfcb2014-02-26 14:23:33 +01003575 /*
3576 * Morally equivalent to updating ssl->state, but NewSessionTicket and
3577 * ChangeCipherSpec share the same state.
3578 */
3579 ssl->handshake->new_session_ticket = 0;
3580
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003581 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003582 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003583 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003584 return( ret );
3585 }
3586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003587 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003588
3589 return( 0 );
3590}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003591#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003592
Paul Bakker5121ce52009-01-03 21:22:43 +00003593/*
Paul Bakker1961b702013-01-25 14:49:24 +01003594 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00003595 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003596int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003597{
3598 int ret = 0;
3599
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02003600 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003601 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003602
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003603 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01003604
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003605 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01003606 return( ret );
3607
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003608#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003609 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003610 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003611 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003612 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003613 return( ret );
3614 }
3615#endif
3616
Paul Bakker1961b702013-01-25 14:49:24 +01003617 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00003618 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003619 case MBEDTLS_SSL_HELLO_REQUEST:
3620 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00003621 break;
3622
Paul Bakker1961b702013-01-25 14:49:24 +01003623 /*
3624 * <== ClientHello
3625 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003626 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01003627 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003628 break;
Paul Bakker1961b702013-01-25 14:49:24 +01003629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003630#if defined(MBEDTLS_SSL_PROTO_DTLS)
3631 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
3632 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02003633#endif
3634
Paul Bakker1961b702013-01-25 14:49:24 +01003635 /*
3636 * ==> ServerHello
3637 * Certificate
3638 * ( ServerKeyExchange )
3639 * ( CertificateRequest )
3640 * ServerHelloDone
3641 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003642 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01003643 ret = ssl_write_server_hello( ssl );
3644 break;
3645
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003646 case MBEDTLS_SSL_SERVER_CERTIFICATE:
3647 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003648 break;
3649
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003650 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01003651 ret = ssl_write_server_key_exchange( ssl );
3652 break;
3653
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003654 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01003655 ret = ssl_write_certificate_request( ssl );
3656 break;
3657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003658 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01003659 ret = ssl_write_server_hello_done( ssl );
3660 break;
3661
3662 /*
3663 * <== ( Certificate/Alert )
3664 * ClientKeyExchange
3665 * ( CertificateVerify )
3666 * ChangeCipherSpec
3667 * Finished
3668 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003669 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
3670 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003671 break;
3672
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003673 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01003674 ret = ssl_parse_client_key_exchange( ssl );
3675 break;
3676
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003677 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01003678 ret = ssl_parse_certificate_verify( ssl );
3679 break;
3680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003681 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
3682 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003683 break;
3684
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003685 case MBEDTLS_SSL_CLIENT_FINISHED:
3686 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003687 break;
3688
3689 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003690 * ==> ( NewSessionTicket )
3691 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01003692 * Finished
3693 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003694 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
3695#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003696 if( ssl->handshake->new_session_ticket != 0 )
3697 ret = ssl_write_new_session_ticket( ssl );
3698 else
Paul Bakkera503a632013-08-14 13:48:06 +02003699#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003700 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003701 break;
3702
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003703 case MBEDTLS_SSL_SERVER_FINISHED:
3704 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003705 break;
3706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003707 case MBEDTLS_SSL_FLUSH_BUFFERS:
3708 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3709 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01003710 break;
3711
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003712 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
3713 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003714 break;
3715
3716 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3718 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003719 }
3720
Paul Bakker5121ce52009-01-03 21:22:43 +00003721 return( ret );
3722}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003723#endif /* MBEDTLS_SSL_SRV_C */