blob: 66f25ead96b01e79696dd61d3ac4b7a79e668e99 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
34#define mbedtls_calloc calloc
35#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010036#endif
37
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000038#include "mbedtls/debug.h"
39#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020040#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia84914062018-04-24 08:40:46 -050041#include "mbedtls/platform_util.h"
Rich Evans00ab4702015-02-06 13:43:58 +000042
43#include <string.h>
44
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020045#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/ecp.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010047#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_HAVE_TIME)
Simon Butcherb5b6af22016-07-13 14:46:18 +010050#include "mbedtls/platform_time.h"
Paul Bakkerfa9b1002013-07-03 15:31:03 +020051#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020053#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
54int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020055 const unsigned char *info,
56 size_t ilen )
57{
Hanno Becker2d9623f2019-06-13 12:07:05 +010058 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020060
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020061 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020062
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020063 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020064 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020065
66 memcpy( ssl->cli_id, info, ilen );
67 ssl->cli_id_len = ilen;
68
69 return( 0 );
70}
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020071
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020072void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073 mbedtls_ssl_cookie_write_t *f_cookie_write,
74 mbedtls_ssl_cookie_check_t *f_cookie_check,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020075 void *p_cookie )
76{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020077 conf->f_cookie_write = f_cookie_write;
78 conf->f_cookie_check = f_cookie_check;
79 conf->p_cookie = p_cookie;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020080}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020081#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020084static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +000085 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +000086 size_t len )
87{
88 int ret;
89 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +000090 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +000091
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020092 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +010093
Philippe Antoine747fd532018-05-30 09:13:21 +020094 if( len < 2 )
95 {
96 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
97 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
98 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
99 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
100 }
Paul Bakker5701cdc2012-09-27 21:49:42 +0000101 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
102 if( servername_list_size + 2 != len )
103 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200104 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200105 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
106 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000108 }
109
110 p = buf + 2;
Philippe Antoine747fd532018-05-30 09:13:21 +0200111 while( servername_list_size > 2 )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000112 {
113 hostname_len = ( ( p[1] << 8 ) | p[2] );
114 if( hostname_len + 3 > servername_list_size )
115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200116 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200117 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
118 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000120 }
121
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200122 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000123 {
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +0200124 ret = ssl->conf->f_sni( ssl->conf->p_sni,
125 ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000126 if( ret != 0 )
127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
129 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
130 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
131 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000132 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000133 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000134 }
135
136 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000137 p += hostname_len + 3;
138 }
139
140 if( servername_list_size != 0 )
141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200143 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
144 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000146 }
147
148 return( 0 );
149}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200150#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000153 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000154 size_t len )
155{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200156#if defined(MBEDTLS_SSL_RENEGOTIATION)
157 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100158 {
159 /* Check verify-data in constant-time. The length OTOH is no secret */
160 if( len != 1 + ssl->verify_data_len ||
161 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100163 ssl->verify_data_len ) != 0 )
164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200166 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
167 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200168 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100169 }
170 }
171 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +0000173 {
174 if( len != 1 || buf[0] != 0x0 )
175 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200177 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
178 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200179 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +0000180 }
181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200182 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +0000183 }
Paul Bakker48916f92012-09-16 19:57:18 +0000184
185 return( 0 );
186}
187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
189 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100190
191/*
192 * Status of the implementation of signature-algorithms extension:
193 *
194 * Currently, we are only considering the signature-algorithm extension
195 * to pick a ciphersuite which allows us to send the ServerKeyExchange
196 * message with a signature-hash combination that the user allows.
197 *
198 * We do *not* check whether all certificates in our certificate
199 * chain are signed with an allowed signature-hash pair.
200 * This needs to be done at a later stage.
201 *
202 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000204 const unsigned char *buf,
205 size_t len )
206{
207 size_t sig_alg_list_size;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100208
Paul Bakker23f36802012-09-28 14:15:14 +0000209 const unsigned char *p;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200210 const unsigned char *end = buf + len;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200211
Hanno Becker7e5437a2017-04-28 17:15:26 +0100212 mbedtls_md_type_t md_cur;
213 mbedtls_pk_type_t sig_cur;
Paul Bakker23f36802012-09-28 14:15:14 +0000214
Philippe Antoine747fd532018-05-30 09:13:21 +0200215 if ( len < 2 ) {
216 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
217 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
218 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
219 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
220 }
Paul Bakker23f36802012-09-28 14:15:14 +0000221 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
222 if( sig_alg_list_size + 2 != len ||
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200223 sig_alg_list_size % 2 != 0 )
Paul Bakker23f36802012-09-28 14:15:14 +0000224 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200225 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200226 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
227 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200228 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker23f36802012-09-28 14:15:14 +0000229 }
230
Hanno Becker7e5437a2017-04-28 17:15:26 +0100231 /* Currently we only guarantee signing the ServerKeyExchange message according
232 * to the constraints specified in this extension (see above), so it suffices
233 * to remember only one suitable hash for each possible signature algorithm.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200234 *
Hanno Becker7e5437a2017-04-28 17:15:26 +0100235 * This will change when we also consider certificate signatures,
236 * in which case we will need to remember the whole signature-hash
237 * pair list from the extension.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200238 */
Hanno Becker7e5437a2017-04-28 17:15:26 +0100239
240 for( p = buf + 2; p < end; p += 2 )
241 {
242 /* Silently ignore unknown signature or hash algorithms. */
243
244 if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
245 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100246 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext"
247 " unknown sig alg encoding %d", p[1] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100248 continue;
249 }
250
251 /* Check if we support the hash the user proposes */
252 md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
253 if( md_cur == MBEDTLS_MD_NONE )
254 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100255 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
256 " unknown hash alg encoding %d", p[0] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100257 continue;
258 }
259
260 if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
261 {
262 mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
264 " match sig %d and hash %d",
Hanno Becker7e5437a2017-04-28 17:15:26 +0100265 sig_cur, md_cur ) );
266 }
267 else
268 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100269 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: "
270 "hash alg %d not supported", md_cur ) );
Paul Bakker23f36802012-09-28 14:15:14 +0000271 }
Paul Bakker23f36802012-09-28 14:15:14 +0000272 }
273
Paul Bakker23f36802012-09-28 14:15:14 +0000274 return( 0 );
275}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200276#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
277 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker23f36802012-09-28 14:15:14 +0000278
Robert Cragie136884c2015-10-02 13:34:31 +0100279#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +0100280 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200281static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200282 const unsigned char *buf,
283 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100284{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200285 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100286 const unsigned char *p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200287 const mbedtls_ecp_curve_info *curve_info, **curves;
Paul Bakker41c83d32013-03-20 14:39:14 +0100288
Philippe Antoine747fd532018-05-30 09:13:21 +0200289 if ( len < 2 ) {
290 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
291 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
292 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
293 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
294 }
Paul Bakker41c83d32013-03-20 14:39:14 +0100295 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
296 if( list_size + 2 != len ||
297 list_size % 2 != 0 )
298 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200299 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200300 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
301 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200302 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100303 }
304
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200305 /* Should never happen unless client duplicates the extension */
306 if( ssl->handshake->curves != NULL )
307 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200308 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200309 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
310 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200311 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200312 }
313
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +0100314 /* Don't allow our peer to make us allocate too much memory,
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200315 * and leave room for a final 0 */
316 our_size = list_size / 2 + 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200317 if( our_size > MBEDTLS_ECP_DP_MAX )
318 our_size = MBEDTLS_ECP_DP_MAX;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200319
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200320 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200321 {
322 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
323 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200324 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200325 }
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200326
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200327 ssl->handshake->curves = curves;
328
Paul Bakker41c83d32013-03-20 14:39:14 +0100329 p = buf + 2;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200330 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200332 curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200333
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200334 if( curve_info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100335 {
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200336 *curves++ = curve_info;
337 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100338 }
339
340 list_size -= 2;
341 p += 2;
342 }
343
344 return( 0 );
345}
346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200347static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200348 const unsigned char *buf,
349 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100350{
351 size_t list_size;
352 const unsigned char *p;
353
Philippe Antoine747fd532018-05-30 09:13:21 +0200354 if( len == 0 || (size_t)( buf[0] + 1 ) != len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100355 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200356 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200357 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
358 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100360 }
Philippe Antoine747fd532018-05-30 09:13:21 +0200361 list_size = buf[0];
Paul Bakker41c83d32013-03-20 14:39:14 +0100362
Manuel Pégourié-Gonnardc1b46d02015-09-16 11:18:32 +0200363 p = buf + 1;
Paul Bakker41c83d32013-03-20 14:39:14 +0100364 while( list_size > 0 )
365 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200366 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
367 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Paul Bakker41c83d32013-03-20 14:39:14 +0100368 {
Robert Cragie136884c2015-10-02 13:34:31 +0100369#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200370 ssl->handshake->ecdh_ctx.point_format = p[0];
Robert Cragie136884c2015-10-02 13:34:31 +0100371#endif
Robert Cragieae8535d2015-10-06 17:11:18 +0100372#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Robert Cragie136884c2015-10-02 13:34:31 +0100373 ssl->handshake->ecjpake_ctx.point_format = p[0];
374#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200375 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100376 return( 0 );
377 }
378
379 list_size--;
380 p++;
381 }
382
383 return( 0 );
384}
Robert Cragieae8535d2015-10-06 17:11:18 +0100385#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
386 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +0100387
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200388#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
389static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
390 const unsigned char *buf,
391 size_t len )
392{
393 int ret;
394
395 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
396 {
397 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
398 return( 0 );
399 }
400
401 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
402 buf, len ) ) != 0 )
403 {
404 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200405 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
406 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200407 return( ret );
408 }
409
410 /* Only mark the extension as OK when we're sure it is */
411 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
412
413 return( 0 );
414}
415#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
416
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200417#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
418static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200419 const unsigned char *buf,
420 size_t len )
421{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200423 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200424 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200425 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
426 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200427 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200428 }
429
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200430 ssl->session_negotiate->mfl_code = buf[0];
431
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200432 return( 0 );
433}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200434#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200435
Hanno Beckera5a2b082019-05-15 14:03:01 +0100436#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc403b262019-04-26 13:56:39 +0100437static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl,
438 const unsigned char *buf,
439 size_t len )
440{
441 size_t peer_cid_len;
442
443 /* CID extension only makes sense in DTLS */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200444 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Beckerc403b262019-04-26 13:56:39 +0100445 {
446 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
447 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
448 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
449 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
450 }
451
452 /*
Hanno Becker3cdf8fe2019-05-15 10:26:32 +0100453 * Quoting draft-ietf-tls-dtls-connection-id-05
454 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Beckerc403b262019-04-26 13:56:39 +0100455 *
456 * struct {
457 * opaque cid<0..2^8-1>;
458 * } ConnectionId;
459 */
460
461 if( len < 1 )
462 {
463 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
464 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
465 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
466 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
467 }
468
469 peer_cid_len = *buf++;
470 len--;
471
472 if( len != peer_cid_len )
473 {
474 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
475 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
476 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
477 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
478 }
479
480 /* Ignore CID if the user has disabled its use. */
481 if( ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
482 {
483 /* Leave ssl->handshake->cid_in_use in its default
484 * value of MBEDTLS_SSL_CID_DISABLED. */
485 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Client sent CID extension, but CID disabled" ) );
486 return( 0 );
487 }
488
489 if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
490 {
491 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
492 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
493 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
494 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
495 }
496
Hanno Becker19976b52019-05-03 12:43:44 +0100497 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
Hanno Beckerc403b262019-04-26 13:56:39 +0100498 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
499 memcpy( ssl->handshake->peer_cid, buf, peer_cid_len );
500
501 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
502 MBEDTLS_SSL_DEBUG_BUF( 3, "Client CID", buf, peer_cid_len );
503
Hanno Beckerc403b262019-04-26 13:56:39 +0100504 return( 0 );
505}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100506#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc403b262019-04-26 13:56:39 +0100507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200508#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
509static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200510 const unsigned char *buf,
511 size_t len )
512{
513 if( len != 0 )
514 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200515 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200516 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
517 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200518 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200519 }
520
521 ((void) buf);
522
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200523 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200524 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200525
526 return( 0 );
527}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200528#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200530#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
531static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100532 const unsigned char *buf,
533 size_t len )
534{
535 if( len != 0 )
536 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200537 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200538 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
539 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200540 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100541 }
542
543 ((void) buf);
544
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200545 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200546 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100547 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100549 }
550
551 return( 0 );
552}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200553#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100554
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
556static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200557 const unsigned char *buf,
558 size_t len )
559{
560 if( len != 0 )
561 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200562 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200563 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
564 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200566 }
567
568 ((void) buf);
569
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200570 return( 0 );
571}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200572#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200574#if defined(MBEDTLS_SSL_SESSION_TICKETS)
575static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200576 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200577 size_t len )
578{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200579 int ret;
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200580 mbedtls_ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200581
Manuel Pégourié-Gonnardbae389b2015-06-24 10:45:58 +0200582 mbedtls_ssl_session_init( &session );
583
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200584 if( ssl->conf->f_ticket_parse == NULL ||
585 ssl->conf->f_ticket_write == NULL )
586 {
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200587 return( 0 );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200588 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200589
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200590 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200591 ssl->handshake->new_session_ticket = 1;
592
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200593 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200594
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200595 if( len == 0 )
596 return( 0 );
597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200598#if defined(MBEDTLS_SSL_RENEGOTIATION)
599 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200600 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200601 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200602 return( 0 );
603 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200604#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200605
606 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200607 * Failures are ok: just ignore the ticket and proceed.
608 */
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200609 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
610 buf, len ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200611 {
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200612 mbedtls_ssl_session_free( &session );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200613
614 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
615 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
616 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
617 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
618 else
619 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
620
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200621 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200622 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200623
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200624 /*
625 * Keep the session ID sent by the client, since we MUST send it back to
626 * inform them we're accepting the ticket (RFC 5077 section 3.4)
627 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200628 session.id_len = ssl->session_negotiate->id_len;
629 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200630
631 mbedtls_ssl_session_free( ssl->session_negotiate );
632 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
633
634 /* Zeroize instead of free as we copied the content */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500635 mbedtls_platform_zeroize( &session, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200636
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200637 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200638
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200639 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200640
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200641 /* Don't send a new ticket after all, this one is OK */
642 ssl->handshake->new_session_ticket = 0;
643
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200644 return( 0 );
645}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200646#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200648#if defined(MBEDTLS_SSL_ALPN)
649static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard14beb082014-07-08 13:50:35 +0200650 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200651{
Paul Bakker14b16c62014-05-28 11:33:54 +0200652 size_t list_len, cur_len, ours_len;
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200653 const unsigned char *theirs, *start, *end;
654 const char **ours;
655
656 /* If ALPN not configured, just ignore the extension */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200657 if( ssl->conf->alpn_list == NULL )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200658 return( 0 );
659
660 /*
661 * opaque ProtocolName<1..2^8-1>;
662 *
663 * struct {
664 * ProtocolName protocol_name_list<2..2^16-1>
665 * } ProtocolNameList;
666 */
667
668 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
669 if( len < 4 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200670 {
671 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
672 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200673 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200674 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200675
676 list_len = ( buf[0] << 8 ) | buf[1];
677 if( list_len != len - 2 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200678 {
679 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
680 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200681 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200682 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200683
684 /*
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100685 * Validate peer's list (lengths)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200686 */
687 start = buf + 2;
688 end = buf + len;
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100689 for( theirs = start; theirs != end; theirs += cur_len )
690 {
691 cur_len = *theirs++;
692
693 /* Current identifier must fit in list */
694 if( cur_len > (size_t)( end - theirs ) )
695 {
696 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
697 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
698 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
699 }
700
701 /* Empty strings MUST NOT be included */
702 if( cur_len == 0 )
703 {
704 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
705 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
706 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
707 }
708 }
709
710 /*
711 * Use our order of preference
712 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200713 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200714 {
Paul Bakker14b16c62014-05-28 11:33:54 +0200715 ours_len = strlen( *ours );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200716 for( theirs = start; theirs != end; theirs += cur_len )
717 {
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200718 cur_len = *theirs++;
719
Paul Bakker14b16c62014-05-28 11:33:54 +0200720 if( cur_len == ours_len &&
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200721 memcmp( theirs, *ours, cur_len ) == 0 )
722 {
723 ssl->alpn_chosen = *ours;
724 return( 0 );
725 }
726 }
727 }
728
729 /* If we get there, no match was found */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200730 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
731 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
732 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200733}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200734#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200735
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100736/*
737 * Auxiliary functions for ServerHello parsing and related actions
738 */
739
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200740#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100741/*
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100742 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100743 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200744#if defined(MBEDTLS_ECDSA_C)
745static int ssl_check_key_curve( mbedtls_pk_context *pk,
746 const mbedtls_ecp_curve_info **curves )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100747{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200748 const mbedtls_ecp_curve_info **crv = curves;
749 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100750
751 while( *crv != NULL )
752 {
753 if( (*crv)->grp_id == grp_id )
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100754 return( 0 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100755 crv++;
756 }
757
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100758 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100759}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200760#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100761
762/*
763 * Try picking a certificate for this ciphersuite,
764 * return 0 on success and -1 on failure.
765 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766static int ssl_pick_cert( mbedtls_ssl_context *ssl,
767 const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100768{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200769 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100770 mbedtls_pk_type_t pk_alg =
771 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200772 uint32_t flags;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100773
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200774#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100775 if( ssl->handshake->sni_key_cert != NULL )
776 list = ssl->handshake->sni_key_cert;
777 else
778#endif
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200779 list = ssl->conf->key_cert;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781 if( pk_alg == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100782 return( 0 );
783
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200784 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000785
Manuel Pégourié-Gonnarde540b492015-07-07 12:44:38 +0200786 if( list == NULL )
787 {
788 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
789 return( -1 );
790 }
791
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100792 for( cur = list; cur != NULL; cur = cur->next )
793 {
Hanno Becker30649f72019-02-26 16:49:40 +0000794 int match = 1;
795 mbedtls_pk_context *pk;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000796
Hanno Becker30649f72019-02-26 16:49:40 +0000797 /* WARNING: With the current X.509 caching architecture, this MUST
798 * happen outside of the PK acquire/release block, because it moves
799 * the cached PK context. In a threading-enabled build, this would
800 * rightfully fail, but lead to a use-after-free otherwise. */
801 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
802 cur->cert );
803
Hanno Becker74b89f62019-02-17 21:22:07 +0000804#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
805 /* ASYNC_PRIVATE may use a NULL entry for the opaque private key, so
806 * we have to use the public key context to infer the capabilities
807 * of the key. */
Hanno Becker30649f72019-02-26 16:49:40 +0000808 {
809 int ret;
810 ret = mbedtls_x509_crt_pk_acquire( cur->cert, &pk );
811 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +0100812 {
813 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker30649f72019-02-26 16:49:40 +0000814 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +0100815 }
Hanno Becker30649f72019-02-26 16:49:40 +0000816 }
Hanno Becker74b89f62019-02-17 21:22:07 +0000817#else
818 /* Outside of ASYNC_PRIVATE, use private key context directly
819 * instead of querying for the public key context from the
820 * certificate, so save a few bytes of code. */
Hanno Becker30649f72019-02-26 16:49:40 +0000821 pk = cur->key;
Hanno Becker74b89f62019-02-17 21:22:07 +0000822#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100823
Hanno Becker74b89f62019-02-17 21:22:07 +0000824 if( ! mbedtls_pk_can_do( pk, pk_alg ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000825 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200826 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Hanno Becker30649f72019-02-26 16:49:40 +0000827 match = 0;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000828 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100829
Hanno Becker30649f72019-02-26 16:49:40 +0000830#if defined(MBEDTLS_ECDSA_C)
831 if( pk_alg == MBEDTLS_PK_ECDSA &&
832 ssl_check_key_curve( pk, ssl->handshake->curves ) != 0 )
833 {
834 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
835 match = 0;
836 }
837#endif
838
839#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +0000840 mbedtls_x509_crt_pk_release( cur->cert );
Hanno Becker30649f72019-02-26 16:49:40 +0000841#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
842
843 if( match == 0 )
844 continue;
845
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200846 /*
847 * This avoids sending the client a cert it'll reject based on
848 * keyUsage or other extensions.
849 *
850 * It also allows the user to provision different certificates for
851 * different uses based on keyUsage, eg if they want to avoid signing
852 * and decrypting with the same RSA key.
853 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200854 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +0100855 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200856 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200857 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000858 "(extended) key usage extension" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200859 continue;
860 }
861
Hanno Becker828a8c02019-02-26 16:48:55 +0000862#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
863 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100864 /*
865 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
866 * present them a SHA-higher cert rather than failing if it's the only
867 * one we got that satisfies the other conditions.
868 */
Hanno Becker30649f72019-02-26 16:49:40 +0000869 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100870 {
Hanno Becker30649f72019-02-26 16:49:40 +0000871 mbedtls_md_type_t sig_md;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000872 {
Hanno Becker30649f72019-02-26 16:49:40 +0000873 int ret;
Hanno Becker5f268b32019-05-20 16:26:34 +0100874 mbedtls_x509_crt_frame const *frame;
Hanno Becker30649f72019-02-26 16:49:40 +0000875 ret = mbedtls_x509_crt_frame_acquire( cur->cert, &frame );
876 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +0100877 {
878 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_frame_acquire", ret );
Hanno Becker30649f72019-02-26 16:49:40 +0000879 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +0100880 }
Hanno Becker30649f72019-02-26 16:49:40 +0000881 sig_md = frame->sig_md;
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +0000882 mbedtls_x509_crt_frame_release( cur->cert );
Hanno Becker30649f72019-02-26 16:49:40 +0000883 }
884
885 if( sig_md != MBEDTLS_MD_SHA1 )
886 {
887 if( fallback == NULL )
888 fallback = cur;
889
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200890 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Hanno Becker30649f72019-02-26 16:49:40 +0000891 "sha-2 with pre-TLS 1.2 client" ) );
892 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000893 }
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100894 }
Hanno Becker828a8c02019-02-26 16:48:55 +0000895#endif /* MBEDTLS_SSL_PROTO_TLS1 ||
896 MBEDTLS_SSL_PROTO_TLS1_1 ||
897 MBEDTLS_SSL_PROTO_SSL3 */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100898
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100899 /* If we get there, we got a winner */
900 break;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100901 }
902
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000903 if( cur == NULL )
904 cur = fallback;
905
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200906 /* Do not update ssl->handshake->key_cert unless there is a match */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100907 if( cur != NULL )
908 {
909 ssl->handshake->key_cert = cur;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200910 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000911 ssl->handshake->key_cert->cert );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100912 return( 0 );
913 }
914
915 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100916}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200917#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100918
919/*
920 * Check if a given ciphersuite is suitable for use with our config/keys/etc
921 * Sets ciphersuite_info only if the suite matches.
922 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200923static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
924 const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100925{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200926 const mbedtls_ssl_ciphersuite_t *suite_info;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100927
Hanno Becker7e5437a2017-04-28 17:15:26 +0100928#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Hanno Becker4cb1f4d2017-10-10 15:59:57 +0100929 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100930 mbedtls_pk_type_t sig_type;
931#endif
932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200933 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100934 if( suite_info == NULL )
935 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200936 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
937 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100938 }
939
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200940 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000941
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100942 if( suite_info->min_minor_ver > ssl->minor_ver ||
943 suite_info->max_minor_ver < ssl->minor_ver )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100946 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000947 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200949#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200950 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200951 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +0100952 return( 0 );
953#endif
954
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200955#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200956 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200957 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000958 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200959 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100960 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000961 }
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200962#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100963
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200964#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
965 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200966 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200967 {
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200968 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
969 "not configured or ext missing" ) );
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200970 return( 0 );
971 }
972#endif
973
974
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200975#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
976 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100977 ( ssl->handshake->curves == NULL ||
978 ssl->handshake->curves[0] == NULL ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000979 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200980 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000981 "no common elliptic curve" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100982 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000983 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100984#endif
985
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200986#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100987 /* If the ciphersuite requires a pre-shared key and we don't
988 * have one, skip it now rather than failing later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200989 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200990 ssl->conf->f_psk == NULL &&
991 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
992 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000993 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200994 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100995 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000996 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100997#endif
998
Hanno Becker7e5437a2017-04-28 17:15:26 +0100999#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1000 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1001 /* If the ciphersuite requires signing, check whether
1002 * a suitable hash algorithm is present. */
1003 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1004 {
1005 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg( suite_info );
1006 if( sig_type != MBEDTLS_PK_NONE &&
1007 mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs, sig_type ) == MBEDTLS_MD_NONE )
1008 {
1009 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm "
1010 "for signature algorithm %d", sig_type ) );
1011 return( 0 );
1012 }
1013 }
1014
1015#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1016 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1017
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001018#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001019 /*
1020 * Final check: if ciphersuite requires us to have a
1021 * certificate/key of a particular type:
1022 * - select the appropriate certificate if we have one, or
1023 * - try the next ciphersuite if we don't
1024 * This must be done last since we modify the key_cert list.
1025 */
1026 if( ssl_pick_cert( ssl, suite_info ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001027 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001028 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001029 "no suitable certificate" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001030 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001031 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001032#endif
1033
1034 *ciphersuite_info = suite_info;
1035 return( 0 );
1036}
1037
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1039static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
Paul Bakker78a8c712013-03-06 17:01:52 +01001040{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001041 int ret, got_common_suite;
Paul Bakker78a8c712013-03-06 17:01:52 +01001042 unsigned int i, j;
1043 size_t n;
1044 unsigned int ciph_len, sess_len, chal_len;
1045 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001046 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001047 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +01001048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001049 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001050
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001051#if defined(MBEDTLS_SSL_RENEGOTIATION)
1052 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001053 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001055 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1056 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001057 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001058 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001059#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker78a8c712013-03-06 17:01:52 +01001060
1061 buf = ssl->in_hdr;
1062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001063 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
Paul Bakker78a8c712013-03-06 17:01:52 +01001064
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001065 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001066 buf[2] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001068 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001069 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
Paul Bakker78a8c712013-03-06 17:01:52 +01001070 buf[3], buf[4] ) );
1071
1072 /*
1073 * SSLv2 Client Hello
1074 *
1075 * Record layer:
1076 * 0 . 1 message length
1077 *
1078 * SSL layer:
1079 * 2 . 2 message type
1080 * 3 . 4 protocol version
1081 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001082 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
1083 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001084 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001085 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1086 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001087 }
1088
1089 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
1090
1091 if( n < 17 || n > 512 )
1092 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001093 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1094 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001095 }
1096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001097 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001098 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
1099 ? buf[4] : ssl->conf->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +01001100
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001101 if( ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker78a8c712013-03-06 17:01:52 +01001102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001104 " [%d:%d] < [%d:%d]",
1105 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001106 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001107
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001108 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1109 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1110 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker78a8c712013-03-06 17:01:52 +01001111 }
1112
Paul Bakker2fbefde2013-06-29 16:01:15 +02001113 ssl->handshake->max_major_ver = buf[3];
1114 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +01001115
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001116 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001117 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001118 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Paul Bakker78a8c712013-03-06 17:01:52 +01001119 return( ret );
1120 }
1121
1122 ssl->handshake->update_checksum( ssl, buf + 2, n );
1123
1124 buf = ssl->in_msg;
1125 n = ssl->in_left - 5;
1126
1127 /*
1128 * 0 . 1 ciphersuitelist length
1129 * 2 . 3 session id length
1130 * 4 . 5 challenge length
1131 * 6 . .. ciphersuitelist
1132 * .. . .. session id
1133 * .. . .. challenge
1134 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
Paul Bakker78a8c712013-03-06 17:01:52 +01001136
1137 ciph_len = ( buf[0] << 8 ) | buf[1];
1138 sess_len = ( buf[2] << 8 ) | buf[3];
1139 chal_len = ( buf[4] << 8 ) | buf[5];
1140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001141 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001142 ciph_len, sess_len, chal_len ) );
1143
1144 /*
1145 * Make sure each parameter length is valid
1146 */
1147 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
1148 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001149 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1150 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001151 }
1152
1153 if( sess_len > 32 )
1154 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001155 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1156 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001157 }
1158
1159 if( chal_len < 8 || chal_len > 32 )
1160 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001161 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1162 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001163 }
1164
1165 if( n != 6 + ciph_len + sess_len + chal_len )
1166 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001167 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1168 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001169 }
1170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001171 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Paul Bakker78a8c712013-03-06 17:01:52 +01001172 buf + 6, ciph_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001173 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
Paul Bakker78a8c712013-03-06 17:01:52 +01001174 buf + 6 + ciph_len, sess_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001175 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
Paul Bakker78a8c712013-03-06 17:01:52 +01001176 buf + 6 + ciph_len + sess_len, chal_len );
1177
1178 p = buf + 6 + ciph_len;
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001179 ssl->session_negotiate->id_len = sess_len;
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001180 memset( ssl->session_negotiate->id, 0,
1181 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001182 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
Paul Bakker78a8c712013-03-06 17:01:52 +01001183
1184 p += sess_len;
1185 memset( ssl->handshake->randbytes, 0, 64 );
1186 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
1187
1188 /*
1189 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1190 */
1191 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1192 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001193 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Paul Bakker78a8c712013-03-06 17:01:52 +01001194 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1196#if defined(MBEDTLS_SSL_RENEGOTIATION)
1197 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Paul Bakker78a8c712013-03-06 17:01:52 +01001198 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001199 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001200 "during renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001201
Gilles Peskinec94f7352017-05-10 16:37:56 +02001202 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1203 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001205 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001206#endif /* MBEDTLS_SSL_RENEGOTIATION */
1207 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker78a8c712013-03-06 17:01:52 +01001208 break;
1209 }
1210 }
1211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001212#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001213 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1214 {
1215 if( p[0] == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1217 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001218 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001219 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001220
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001221 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001222 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001223 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001225 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1226 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001227
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001228 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001229 }
1230
1231 break;
1232 }
1233 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001234#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001235
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001236 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001237 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001238 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001239#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001240 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001241 for( i = 0; ciphersuites[i] != 0; i++ )
1242#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001243 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +01001244 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001245#endif
Paul Bakker78a8c712013-03-06 17:01:52 +01001246 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001247 if( p[0] != 0 ||
1248 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1249 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
1250 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +02001251
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001252 got_common_suite = 1;
1253
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001254 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1255 &ciphersuite_info ) ) != 0 )
1256 return( ret );
Paul Bakker59c28a22013-06-29 15:33:42 +02001257
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001258 if( ciphersuite_info != NULL )
Paul Bakker78a8c712013-03-06 17:01:52 +01001259 goto have_ciphersuite_v2;
1260 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001261
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001262 if( got_common_suite )
1263 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001264 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001265 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001266 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001267 }
1268 else
1269 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001270 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1271 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001272 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001273
1274have_ciphersuite_v2:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001275 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001276
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001277 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Becker8759e162017-12-27 21:34:08 +00001278 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +01001279
1280 /*
1281 * SSLv2 Client Hello relevant renegotiation security checks
1282 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001283 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01001284 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
1285 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001286 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001287 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001288 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1289 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001290 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001291 }
1292
1293 ssl->in_left = 0;
1294 ssl->state++;
1295
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001296 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001297
1298 return( 0 );
1299}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001300#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
Paul Bakker78a8c712013-03-06 17:01:52 +01001301
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001302/* This function doesn't alert on errors that happen early during
1303 ClientHello parsing because they might indicate that the client is
1304 not talking SSL/TLS at all and would not understand our alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001305static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001306{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001307 int ret, got_common_suite;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001308 size_t i, j;
1309 size_t ciph_offset, comp_offset, ext_offset;
1310 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001311#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001312 size_t cookie_offset, cookie_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001313#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001314 unsigned char *buf, *p, *ext;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001315#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001316 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001317#endif
Hanno Becker03b64fa2019-06-11 14:39:38 +01001318#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1319 int extended_ms_seen = 0;
1320#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001321 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001322 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001323 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001324 int major, minor;
Paul Bakker5121ce52009-01-03 21:22:43 +00001325
Hanno Becker7e5437a2017-04-28 17:15:26 +01001326 /* If there is no signature-algorithm extension present,
1327 * we need to fall back to the default values for allowed
1328 * signature-hash pairs. */
1329#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1330 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1331 int sig_hash_alg_ext_present = 0;
1332#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1333 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001335 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001336
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001337#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001338read_record_header:
1339#endif
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001340 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001341 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001342 * otherwise read it ourselves manually in order to support SSLv2
1343 * ClientHello, which doesn't use the same record layer format.
1344 */
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001345 if( mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
1346 ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001347 {
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001348 /* No alert on a read error. */
1349 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
1350 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001351 }
1352
1353 buf = ssl->in_hdr;
1354
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001355#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) && \
1356 defined(MBEDTLS_SSL_PROTO_TLS)
1357 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) &&
1358 ( buf[0] & 0x80 ) != 0 )
1359 {
1360 return( ssl_parse_client_hello_v2( ssl ) );
1361 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001362#endif
1363
Hanno Becker43395762019-05-03 14:46:38 +01001364 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_in_hdr_len( ssl ) );
Paul Bakkerec636f32012-09-09 19:17:02 +00001365
Paul Bakkerec636f32012-09-09 19:17:02 +00001366 /*
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001367 * SSLv3/TLS Client Hello
Paul Bakkerec636f32012-09-09 19:17:02 +00001368 *
1369 * Record layer:
1370 * 0 . 0 message type
1371 * 1 . 2 protocol version
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001372 * 3 . 11 DTLS: epoch + record sequence number
Paul Bakkerec636f32012-09-09 19:17:02 +00001373 * 3 . 4 message length
1374 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001375 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001376 buf[0] ) );
1377
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001378 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001379 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001380 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1381 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001382 }
1383
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001384 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001385 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
1386
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001387 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001388 buf[1], buf[2] ) );
1389
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001390 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001391
1392 /* According to RFC 5246 Appendix E.1, the version here is typically
1393 * "{03,00}, the lowest version number supported by the client, [or] the
1394 * value of ClientHello.client_version", so the only meaningful check here
1395 * is the major version shouldn't be less than 3 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001396 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001397 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001398 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1399 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001400 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001401
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001402 /* For DTLS if this is the initial handshake, remember the client sequence
1403 * number to use it in our next message (RFC 6347 4.2.1) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001404#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001405 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
1406 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001407 {
1408 /* Epoch should be 0 for initial handshakes */
1409 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
1410 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001411 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1412 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001413 }
1414
Hanno Becker19859472018-08-06 09:40:20 +01001415 memcpy( ssl->cur_out_ctr + 2, ssl->in_ctr + 2, 6 );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001416
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001417#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1418 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001419 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001420 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001421 ssl->next_record_offset = 0;
1422 ssl->in_left = 0;
1423 goto read_record_header;
1424 }
1425
1426 /* No MAC to check yet, so we can update right now */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001428#endif
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001429 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001430#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001431
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001432 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Paul Bakker5121ce52009-01-03 21:22:43 +00001433
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001434#if defined(MBEDTLS_SSL_RENEGOTIATION)
1435 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001436 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437 /* Set by mbedtls_ssl_read_record() */
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001438 msg_len = ssl->in_hslen;
1439 }
1440 else
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001441#endif
Paul Bakkerec636f32012-09-09 19:17:02 +00001442 {
Angus Grattond8213d02016-05-25 20:56:48 +10001443 if( msg_len > MBEDTLS_SSL_IN_CONTENT_LEN )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001444 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001445 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1446 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001447 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001448
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01001449 if( ( ret = mbedtls_ssl_fetch_input( ssl,
Hanno Becker43395762019-05-03 14:46:38 +01001450 mbedtls_ssl_in_hdr_len( ssl ) + msg_len ) ) != 0 )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001451 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001452 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001453 return( ret );
1454 }
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001455
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001456 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001457#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001458 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
1459 {
Hanno Becker43395762019-05-03 14:46:38 +01001460 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len( ssl );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001461 }
1462 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001463#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001464#if defined(MBEDTLS_SSL_PROTO_TLS)
1465 {
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001466 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001467 }
1468#endif
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001469 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001470
1471 buf = ssl->in_msg;
Paul Bakkerec636f32012-09-09 19:17:02 +00001472
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001473 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001474
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001475 ssl->handshake->update_checksum( ssl, buf, msg_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001476
1477 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001478 * Handshake layer:
1479 * 0 . 0 handshake type
1480 * 1 . 3 handshake length
1481 * 4 . 5 DTLS only: message seqence number
1482 * 6 . 8 DTLS only: fragment offset
1483 * 9 . 11 DTLS only: fragment length
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001484 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001485 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001486 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001487 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1488 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001489 }
1490
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001491 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001492
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001493 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001494 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001495 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1496 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001497 }
1498
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001499 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001500 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1501
1502 /* We don't support fragmentation of ClientHello (yet?) */
1503 if( buf[1] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001504 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001505 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001506 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1507 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001508 }
1509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001510#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02001511 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001512 {
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001513 /*
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001514 * Copy the client's handshake message_seq on initial handshakes,
1515 * check sequence number on renego.
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001516 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001517#if defined(MBEDTLS_SSL_RENEGOTIATION)
1518 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001519 {
1520 /* This couldn't be done in ssl_prepare_handshake_record() */
1521 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1522 ssl->in_msg[5];
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001523
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001524 if( cli_msg_seq != ssl->handshake->in_msg_seq )
1525 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001526 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001527 "%d (expected %d)", cli_msg_seq,
1528 ssl->handshake->in_msg_seq ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001529 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001530 }
1531
1532 ssl->handshake->in_msg_seq++;
1533 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001534 else
1535#endif
1536 {
1537 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1538 ssl->in_msg[5];
1539 ssl->handshake->out_msg_seq = cli_msg_seq;
1540 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1541 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001542
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001543 /*
1544 * For now we don't support fragmentation, so make sure
1545 * fragment_offset == 0 and fragment_length == length
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001546 */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001547 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
1548 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
1549 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001550 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
1551 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001552 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001553 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001554#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001555
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001556 buf += mbedtls_ssl_hs_hdr_len( ssl );
1557 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001558
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001559 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001560 * ClientHello layer:
1561 * 0 . 1 protocol version
1562 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1563 * 34 . 35 session id length (1 byte)
1564 * 35 . 34+x session id
1565 * 35+x . 35+x DTLS only: cookie length (1 byte)
1566 * 36+x . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001567 * .. . .. ciphersuite list length (2 bytes)
1568 * .. . .. ciphersuite list
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001569 * .. . .. compression alg. list length (1 byte)
1570 * .. . .. compression alg. list
1571 * .. . .. extensions length (2 bytes, optional)
1572 * .. . .. extensions (optional)
Paul Bakkerec636f32012-09-09 19:17:02 +00001573 */
Paul Bakkerec636f32012-09-09 19:17:02 +00001574
1575 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01001576 * Minimal length (with everything empty and extensions omitted) is
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001577 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1578 * read at least up to session id length without worrying.
Paul Bakkerec636f32012-09-09 19:17:02 +00001579 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001580 if( msg_len < 38 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001581 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001582 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1583 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001584 }
1585
1586 /*
1587 * Check and save the protocol version
1588 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001589 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001591 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001592 ssl->conf->transport, buf );
Paul Bakkerec636f32012-09-09 19:17:02 +00001593
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001594 ssl->handshake->max_major_ver = ssl->major_ver;
1595 ssl->handshake->max_minor_ver = ssl->minor_ver;
1596
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001597 if( ssl->major_ver < ssl->conf->min_major_ver ||
1598 ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00001599 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001600 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001601 " [%d:%d] < [%d:%d]",
1602 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001603 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001604 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1605 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001606 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001607 }
1608
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001609 if( ssl->major_ver > ssl->conf->max_major_ver )
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001610 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001611 ssl->major_ver = ssl->conf->max_major_ver;
1612 ssl->minor_ver = ssl->conf->max_minor_ver;
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001613 }
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001614 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
1615 ssl->minor_ver = ssl->conf->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001616
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001617 /*
1618 * Save client random (inc. Unix time)
1619 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001620 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001621
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001622 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001623
1624 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001625 * Check the session ID length and save session ID
Paul Bakkerec636f32012-09-09 19:17:02 +00001626 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001627 sess_len = buf[34];
Paul Bakkerec636f32012-09-09 19:17:02 +00001628
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001629 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001630 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Paul Bakkerec636f32012-09-09 19:17:02 +00001631 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001632 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001633 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1634 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001635 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001636 }
1637
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001638 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001639
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001640 ssl->session_negotiate->id_len = sess_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001641 memset( ssl->session_negotiate->id, 0,
1642 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001643 memcpy( ssl->session_negotiate->id, buf + 35,
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001644 ssl->session_negotiate->id_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001645
1646 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001647 * Check the cookie length and content
1648 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001649#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001650 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001651 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001652 cookie_offset = 35 + sess_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001653 cookie_len = buf[cookie_offset];
1654
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001655 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001658 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1659 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001660 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001661 }
1662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001663 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001664 buf + cookie_offset + 1, cookie_len );
1665
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001666#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001667 if( ssl->conf->f_cookie_check != NULL &&
1668 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001669 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001670 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001671 buf + cookie_offset + 1, cookie_len,
1672 ssl->cli_id, ssl->cli_id_len ) != 0 )
1673 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001674 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001675 ssl->handshake->verify_cookie_len = 1;
1676 }
1677 else
1678 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001679 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001680 ssl->handshake->verify_cookie_len = 0;
1681 }
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001682 }
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02001683 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001684#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001685 {
1686 /* We know we didn't send a cookie, so it should be empty */
1687 if( cookie_len != 0 )
1688 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001689 /* This may be an attacker's probe, so don't send an alert */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001690 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1691 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001692 }
1693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001695 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001696
1697 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001698 * Check the ciphersuitelist length (will be parsed later)
Paul Bakkerec636f32012-09-09 19:17:02 +00001699 */
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001700 ciph_offset = cookie_offset + 1 + cookie_len;
Manuel Pégourié-Gonnarda06d7fe2015-03-13 10:36:55 +00001701 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001702 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001703#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001704#if defined(MBEDTLS_SSL_PROTO_TLS)
1705 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001706 ciph_offset = 35 + sess_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001707 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02001708#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakkerec636f32012-09-09 19:17:02 +00001709
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001710 ciph_len = ( buf[ciph_offset + 0] << 8 )
1711 | ( buf[ciph_offset + 1] );
1712
1713 if( ciph_len < 2 ||
1714 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1715 ( ciph_len % 2 ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001716 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001717 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001718 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1719 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001720 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001721 }
1722
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001723 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001724 buf + ciph_offset + 2, ciph_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001725
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001726 /*
1727 * Check the compression algorithms length and pick one
1728 */
1729 comp_offset = ciph_offset + 2 + ciph_len;
1730
1731 comp_len = buf[comp_offset];
1732
1733 if( comp_len < 1 ||
1734 comp_len > 16 ||
1735 comp_len + comp_offset + 1 > msg_len )
Paul Bakkerec636f32012-09-09 19:17:02 +00001736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001738 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1739 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001740 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001741 }
1742
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001743 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001744 buf + comp_offset + 1, comp_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001745
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001746 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
1747#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakkerec636f32012-09-09 19:17:02 +00001748 for( i = 0; i < comp_len; ++i )
1749 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001750 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001751 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001752 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001753 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001754 }
1755 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001756#endif
1757
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001758 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001759#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02001760 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001762#endif
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001763
Janos Follathc6dab2b2016-05-23 14:27:02 +01001764 /* Do not parse the extensions if the protocol is SSLv3 */
1765#if defined(MBEDTLS_SSL_PROTO_SSL3)
1766 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
1767 {
1768#endif
Simon Butcher584a5472016-05-23 16:24:52 +01001769 /*
1770 * Check the extension length
1771 */
1772 ext_offset = comp_offset + 1 + comp_len;
1773 if( msg_len > ext_offset )
Paul Bakker48916f92012-09-16 19:57:18 +00001774 {
Simon Butcher584a5472016-05-23 16:24:52 +01001775 if( msg_len < ext_offset + 2 )
1776 {
1777 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001778 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1779 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001780 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1781 }
1782
1783 ext_len = ( buf[ext_offset + 0] << 8 )
1784 | ( buf[ext_offset + 1] );
1785
1786 if( ( ext_len > 0 && ext_len < 4 ) ||
1787 msg_len != ext_offset + 2 + ext_len )
1788 {
1789 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001790 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1791 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001792 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1793 }
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001794 }
Simon Butcher584a5472016-05-23 16:24:52 +01001795 else
1796 ext_len = 0;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001797
Simon Butcher584a5472016-05-23 16:24:52 +01001798 ext = buf + ext_offset + 2;
1799 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001800
Simon Butcher584a5472016-05-23 16:24:52 +01001801 while( ext_len != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001802 {
Philippe Antoine747fd532018-05-30 09:13:21 +02001803 unsigned int ext_id;
1804 unsigned int ext_size;
1805 if ( ext_len < 4 ) {
1806 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1807 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1808 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1809 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1810 }
1811 ext_id = ( ( ext[0] << 8 ) | ( ext[1] ) );
1812 ext_size = ( ( ext[2] << 8 ) | ( ext[3] ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001813
Simon Butcher584a5472016-05-23 16:24:52 +01001814 if( ext_size + 4 > ext_len )
1815 {
1816 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001817 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1818 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001819 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1820 }
1821 switch( ext_id )
1822 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001823#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001824 case MBEDTLS_TLS_EXT_SERVERNAME:
1825 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1826 if( ssl->conf->f_sni == NULL )
1827 break;
Paul Bakker5701cdc2012-09-27 21:49:42 +00001828
Simon Butcher584a5472016-05-23 16:24:52 +01001829 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1830 if( ret != 0 )
1831 return( ret );
1832 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001833#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001834
Simon Butcher584a5472016-05-23 16:24:52 +01001835 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1836 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001837#if defined(MBEDTLS_SSL_RENEGOTIATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001838 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001839#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001840
Simon Butcher584a5472016-05-23 16:24:52 +01001841 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1842 if( ret != 0 )
1843 return( ret );
1844 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001845
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001846#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1847 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001848 case MBEDTLS_TLS_EXT_SIG_ALG:
Ron Eldor73a38172017-10-03 15:58:26 +03001849 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1850
Simon Butcher584a5472016-05-23 16:24:52 +01001851 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1852 if( ret != 0 )
1853 return( ret );
Hanno Becker7e5437a2017-04-28 17:15:26 +01001854
1855 sig_hash_alg_ext_present = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001856 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001857#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1858 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001859
Robert Cragie136884c2015-10-02 13:34:31 +01001860#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001861 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001862 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1863 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Paul Bakker41c83d32013-03-20 14:39:14 +01001864
Simon Butcher584a5472016-05-23 16:24:52 +01001865 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1866 if( ret != 0 )
1867 return( ret );
1868 break;
Paul Bakker41c83d32013-03-20 14:39:14 +01001869
Simon Butcher584a5472016-05-23 16:24:52 +01001870 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1871 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1872 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001873
Simon Butcher584a5472016-05-23 16:24:52 +01001874 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1875 if( ret != 0 )
1876 return( ret );
1877 break;
Robert Cragieae8535d2015-10-06 17:11:18 +01001878#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1879 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01001880
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001881#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001882 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1883 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001884
Simon Butcher584a5472016-05-23 16:24:52 +01001885 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
1886 if( ret != 0 )
1887 return( ret );
1888 break;
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001889#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001891#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Simon Butcher584a5472016-05-23 16:24:52 +01001892 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1893 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001894
Simon Butcher584a5472016-05-23 16:24:52 +01001895 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1896 if( ret != 0 )
1897 return( ret );
1898 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001899#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001900
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001901#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001902 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1903 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001904
Simon Butcher584a5472016-05-23 16:24:52 +01001905 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1906 if( ret != 0 )
1907 return( ret );
1908 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001909#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001910
Hanno Beckera5a2b082019-05-15 14:03:01 +01001911#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc403b262019-04-26 13:56:39 +01001912 case MBEDTLS_TLS_EXT_CID:
1913 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) );
1914
1915 ret = ssl_parse_cid_ext( ssl, ext + 4, ext_size );
1916 if( ret != 0 )
1917 return( ret );
1918 break;
1919#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1920
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001921#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001922 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1923 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001924
Simon Butcher584a5472016-05-23 16:24:52 +01001925 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1926 if( ret != 0 )
1927 return( ret );
1928 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001929#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001930
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001931#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Simon Butcher584a5472016-05-23 16:24:52 +01001932 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1933 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001934
Simon Butcher584a5472016-05-23 16:24:52 +01001935 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1936 if( ret != 0 )
1937 return( ret );
Hanno Becker03b64fa2019-06-11 14:39:38 +01001938 extended_ms_seen = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001939 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001940#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001942#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Simon Butcher584a5472016-05-23 16:24:52 +01001943 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1944 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001945
Simon Butcher584a5472016-05-23 16:24:52 +01001946 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1947 if( ret != 0 )
1948 return( ret );
1949 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001950#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001952#if defined(MBEDTLS_SSL_ALPN)
Simon Butcher584a5472016-05-23 16:24:52 +01001953 case MBEDTLS_TLS_EXT_ALPN:
1954 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001955
Simon Butcher584a5472016-05-23 16:24:52 +01001956 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1957 if( ret != 0 )
1958 return( ret );
1959 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001960#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001961
Simon Butcher584a5472016-05-23 16:24:52 +01001962 default:
1963 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1964 ext_id ) );
1965 }
1966
1967 ext_len -= 4 + ext_size;
1968 ext += 4 + ext_size;
1969
1970 if( ext_len > 0 && ext_len < 4 )
1971 {
1972 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001973 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1974 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001975 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1976 }
Paul Bakker48916f92012-09-16 19:57:18 +00001977 }
Janos Follathc6dab2b2016-05-23 14:27:02 +01001978#if defined(MBEDTLS_SSL_PROTO_SSL3)
1979 }
1980#endif
1981
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001982#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Gilles Peskined50177f2017-05-16 17:53:03 +02001983 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001984 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001985 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1986 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001987 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001988 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001989
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001990 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001991 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001992 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001994 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1995 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001996
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001997 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001998 }
1999
2000 break;
2001 }
2002 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002003#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002004
Hanno Becker7e5437a2017-04-28 17:15:26 +01002005#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2006 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
2007
2008 /*
2009 * Try to fall back to default hash SHA1 if the client
2010 * hasn't provided any preferred signature-hash combinations.
2011 */
2012 if( sig_hash_alg_ext_present == 0 )
2013 {
2014 mbedtls_md_type_t md_default = MBEDTLS_MD_SHA1;
2015
2016 if( mbedtls_ssl_check_sig_hash( ssl, md_default ) != 0 )
2017 md_default = MBEDTLS_MD_NONE;
2018
2019 mbedtls_ssl_sig_hash_set_const_hash( &ssl->handshake->hash_algs, md_default );
2020 }
2021
2022#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
2023 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
2024
Paul Bakker48916f92012-09-16 19:57:18 +00002025 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002026 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
2027 */
2028 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
2029 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002030 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002031 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002032 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
2033#if defined(MBEDTLS_SSL_RENEGOTIATION)
2034 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002035 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002036 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
2037 "during renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002038 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2039 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002040 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002041 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00002042#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002043 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002044 break;
2045 }
2046 }
2047
2048 /*
Paul Bakker48916f92012-09-16 19:57:18 +00002049 * Renegotiation security checks
2050 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002051 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01002052 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
2053 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002054 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002055 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002056 handshake_failure = 1;
2057 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002058#if defined(MBEDTLS_SSL_RENEGOTIATION)
2059 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2060 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002061 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00002062 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002063 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002064 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00002065 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002066 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2067 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01002068 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf )
2069 == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00002070 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002072 handshake_failure = 1;
2073 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002074 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2075 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002076 renegotiation_info_seen == 1 )
2077 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002078 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002079 handshake_failure = 1;
2080 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002081#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002082
Jarno Lamsa842be162019-06-10 15:05:33 +03002083 /*
2084 * Check if extended master secret is being enforced
2085 */
2086#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +01002087 if( mbedtls_ssl_conf_get_ems( ssl->conf ) ==
Hanno Becker03b64fa2019-06-11 14:39:38 +01002088 MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Jarno Lamsa842be162019-06-10 15:05:33 +03002089 {
Hanno Becker03b64fa2019-06-11 14:39:38 +01002090 if( extended_ms_seen )
2091 {
Hanno Becker1ab322b2019-06-11 14:50:54 +01002092#if !defined(MBEDTLS_SSL_EXTENDED_MS_ENFORCED)
Hanno Becker03b64fa2019-06-11 14:39:38 +01002093 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Becker1ab322b2019-06-11 14:50:54 +01002094#endif /* !MBEDTLS_SSL_EXTENDED_MS_ENFORCED */
Hanno Becker03b64fa2019-06-11 14:39:38 +01002095 }
2096 else if( mbedtls_ssl_conf_get_ems_enforced( ssl->conf ) ==
2097 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED )
2098 {
2099 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Peer not offering extended master "
2100 "secret, while it is enforced") );
2101 handshake_failure = 1;
2102 }
Jarno Lamsa842be162019-06-10 15:05:33 +03002103 }
2104#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
2105
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002106 if( handshake_failure == 1 )
2107 {
Gilles Peskinec94f7352017-05-10 16:37:56 +02002108 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2109 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002110 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002111 }
Paul Bakker380da532012-04-18 16:10:25 +00002112
Paul Bakker41c83d32013-03-20 14:39:14 +01002113 /*
2114 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02002115 * (At the end because we need information from the EC-based extensions
2116 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01002117 */
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002118 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002119 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01002120 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002121#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002122 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01002123 for( i = 0; ciphersuites[i] != 0; i++ )
2124#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002125 for( i = 0; ciphersuites[i] != 0; i++ )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002126 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01002127#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01002128 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002129 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
2130 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
2131 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01002132
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002133 got_common_suite = 1;
2134
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002135 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
2136 &ciphersuite_info ) ) != 0 )
2137 return( ret );
2138
2139 if( ciphersuite_info != NULL )
2140 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01002141 }
Paul Bakker41c83d32013-03-20 14:39:14 +01002142
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002143 if( got_common_suite )
2144 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002145 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002146 "but none of them usable" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002147 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2148 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002149 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002150 }
2151 else
2152 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002153 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002154 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2155 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002156 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002157 }
Paul Bakker41c83d32013-03-20 14:39:14 +01002158
2159have_ciphersuite:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002160 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00002161
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002162 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Becker8759e162017-12-27 21:34:08 +00002163 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker41c83d32013-03-20 14:39:14 +01002164
Paul Bakker5121ce52009-01-03 21:22:43 +00002165 ssl->state++;
2166
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002167#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002168 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002169 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002170#endif
2171
Hanno Becker7e5437a2017-04-28 17:15:26 +01002172 /* Debugging-only output for testsuite */
2173#if defined(MBEDTLS_DEBUG_C) && \
2174 defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2175 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
2176 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2177 {
2178 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg( ciphersuite_info );
2179 if( sig_alg != MBEDTLS_PK_NONE )
2180 {
2181 mbedtls_md_type_t md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
2182 sig_alg );
2183 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
2184 mbedtls_ssl_hash_from_md_alg( md_alg ) ) );
2185 }
2186 else
2187 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002188 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm "
2189 "%d - should not happen", sig_alg ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +01002190 }
2191 }
2192#endif
2193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002194 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002195
2196 return( 0 );
2197}
2198
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002199#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
2200static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002201 unsigned char *buf,
2202 size_t *olen )
2203{
2204 unsigned char *p = buf;
2205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002206 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002207 {
2208 *olen = 0;
2209 return;
2210 }
2211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002212 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002214 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
2215 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002216
2217 *p++ = 0x00;
2218 *p++ = 0x00;
2219
2220 *olen = 4;
2221}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002222#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002223
Hanno Beckera5a2b082019-05-15 14:03:01 +01002224#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker072d4ec2019-04-26 15:46:55 +01002225static void ssl_write_cid_ext( mbedtls_ssl_context *ssl,
2226 unsigned char *buf,
2227 size_t *olen )
2228{
2229 unsigned char *p = buf;
2230 size_t ext_len;
2231 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
2232
2233 *olen = 0;
2234
2235 /* Skip writing the extension if we don't want to use it or if
2236 * the client hasn't offered it. */
2237 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED )
2238 return;
2239
2240 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
2241 * which is at most 255, so the increment cannot overflow. */
2242 if( end < p || (size_t)( end - p ) < (unsigned)( ssl->own_cid_len + 5 ) )
2243 {
2244 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2245 return;
2246 }
2247
2248 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding CID extension" ) );
2249
2250 /*
Hanno Becker3cdf8fe2019-05-15 10:26:32 +01002251 * Quoting draft-ietf-tls-dtls-connection-id-05
2252 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Becker072d4ec2019-04-26 15:46:55 +01002253 *
2254 * struct {
2255 * opaque cid<0..2^8-1>;
2256 * } ConnectionId;
2257 */
2258
2259 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID >> 8 ) & 0xFF );
2260 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID ) & 0xFF );
2261 ext_len = (size_t) ssl->own_cid_len + 1;
2262 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2263 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2264
2265 *p++ = (uint8_t) ssl->own_cid_len;
2266 memcpy( p, ssl->own_cid, ssl->own_cid_len );
2267
2268 *olen = ssl->own_cid_len + 5;
2269}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002270#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker072d4ec2019-04-26 15:46:55 +01002271
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002272#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2273static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002274 unsigned char *buf,
2275 size_t *olen )
2276{
2277 unsigned char *p = buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002278 const mbedtls_ssl_ciphersuite_t *suite = NULL;
2279 const mbedtls_cipher_info_t *cipher = NULL;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002280
Hanno Becker27b34d52017-10-20 14:24:51 +01002281 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002282 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002283 {
2284 *olen = 0;
2285 return;
2286 }
2287
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002288 /*
2289 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
2290 * from a client and then selects a stream or Authenticated Encryption
2291 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
2292 * encrypt-then-MAC response extension back to the client."
2293 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002294 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002295 ssl->session_negotiate->ciphersuite ) ) == NULL ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002296 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
2297 cipher->mode != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002298 {
2299 *olen = 0;
2300 return;
2301 }
2302
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002303 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002304
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002305 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
2306 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002307
2308 *p++ = 0x00;
2309 *p++ = 0x00;
2310
2311 *olen = 4;
2312}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002313#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002314
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002315#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2316static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002317 unsigned char *buf,
2318 size_t *olen )
2319{
2320 unsigned char *p = buf;
2321
Hanno Beckera49ec562019-06-11 14:47:55 +01002322 if( mbedtls_ssl_hs_get_extended_ms( ssl->handshake )
2323 == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002324 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002325 {
2326 *olen = 0;
2327 return;
2328 }
2329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002330 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002331 "extension" ) );
2332
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002333 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
2334 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002335
2336 *p++ = 0x00;
2337 *p++ = 0x00;
2338
2339 *olen = 4;
2340}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002341#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002342
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002343#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2344static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002345 unsigned char *buf,
2346 size_t *olen )
2347{
2348 unsigned char *p = buf;
2349
2350 if( ssl->handshake->new_session_ticket == 0 )
2351 {
2352 *olen = 0;
2353 return;
2354 }
2355
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002356 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
2359 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002360
2361 *p++ = 0x00;
2362 *p++ = 0x00;
2363
2364 *olen = 4;
2365}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002366#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002368static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002369 unsigned char *buf,
2370 size_t *olen )
2371{
2372 unsigned char *p = buf;
2373
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002374 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002375 {
2376 *olen = 0;
2377 return;
2378 }
2379
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002380 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002381
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002382 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
2383 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002384
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002385#if defined(MBEDTLS_SSL_RENEGOTIATION)
2386 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002387 {
2388 *p++ = 0x00;
2389 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
2390 *p++ = ssl->verify_data_len * 2 & 0xFF;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002391
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002392 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
2393 p += ssl->verify_data_len;
2394 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
2395 p += ssl->verify_data_len;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002396 }
2397 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002398#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002399 {
2400 *p++ = 0x00;
2401 *p++ = 0x01;
2402 *p++ = 0x00;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002403 }
Manuel Pégourié-Gonnard19389752015-06-23 13:46:44 +02002404
2405 *olen = p - buf;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002406}
2407
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002408#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2409static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002410 unsigned char *buf,
2411 size_t *olen )
2412{
2413 unsigned char *p = buf;
2414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002415 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02002416 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002417 *olen = 0;
2418 return;
2419 }
2420
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002421 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002423 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
2424 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002425
2426 *p++ = 0x00;
2427 *p++ = 1;
2428
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02002429 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002430
2431 *olen = 5;
2432}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002433#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002434
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002435#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002436 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002437static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002438 unsigned char *buf,
2439 size_t *olen )
2440{
2441 unsigned char *p = buf;
2442 ((void) ssl);
2443
Paul Bakker677377f2013-10-28 12:54:26 +01002444 if( ( ssl->handshake->cli_exts &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Paul Bakker677377f2013-10-28 12:54:26 +01002446 {
2447 *olen = 0;
2448 return;
2449 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002450
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002452
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002453 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
2454 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002455
2456 *p++ = 0x00;
2457 *p++ = 2;
2458
2459 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002460 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002461
2462 *olen = 6;
2463}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002464#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002465
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002466#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2467static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
2468 unsigned char *buf,
2469 size_t *olen )
2470{
2471 int ret;
2472 unsigned char *p = buf;
Angus Grattond8213d02016-05-25 20:56:48 +10002473 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002474 size_t kkpp_len;
2475
2476 *olen = 0;
2477
2478 /* Skip costly computation if not needed */
Hanno Becker8759e162017-12-27 21:34:08 +00002479 if( ssl->handshake->ciphersuite_info->key_exchange !=
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002480 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2481 return;
2482
2483 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
2484
2485 if( end - p < 4 )
2486 {
2487 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2488 return;
2489 }
2490
2491 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
2492 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
2493
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02002494 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
2495 p + 2, end - p - 2, &kkpp_len,
2496 ssl->conf->f_rng, ssl->conf->p_rng );
2497 if( ret != 0 )
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002498 {
2499 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
2500 return;
2501 }
2502
2503 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
2504 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
2505
2506 *olen = kkpp_len + 4;
2507}
2508#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2509
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002510#if defined(MBEDTLS_SSL_ALPN )
2511static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002512 unsigned char *buf, size_t *olen )
2513{
2514 if( ssl->alpn_chosen == NULL )
2515 {
2516 *olen = 0;
2517 return;
2518 }
2519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002520 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002521
2522 /*
2523 * 0 . 1 ext identifier
2524 * 2 . 3 ext length
2525 * 4 . 5 protocol list length
2526 * 6 . 6 protocol name length
2527 * 7 . 7+n protocol name
2528 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002529 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
2530 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002531
2532 *olen = 7 + strlen( ssl->alpn_chosen );
2533
2534 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2535 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2536
2537 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2538 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2539
2540 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2541
2542 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2543}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002544#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002545
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002546#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2547static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002548{
2549 int ret;
2550 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002551 unsigned char *cookie_len_byte;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002553 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002554
2555 /*
2556 * struct {
2557 * ProtocolVersion server_version;
2558 * opaque cookie<0..2^8-1>;
2559 * } HelloVerifyRequest;
2560 */
2561
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02002562 /* The RFC is not clear on this point, but sending the actual negotiated
2563 * version looks like the most interoperable thing to do. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002564 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002565 ssl->conf->transport, p );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002566 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002567 p += 2;
2568
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002569 /* If we get here, f_cookie_check is not null */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002570 if( ssl->conf->f_cookie_write == NULL )
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002571 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002572 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
2573 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002574 }
2575
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002576 /* Skip length byte until we know the length */
2577 cookie_len_byte = p++;
2578
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002579 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Angus Grattond8213d02016-05-25 20:56:48 +10002580 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002581 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002582 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002583 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002584 return( ret );
2585 }
2586
2587 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
2588
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002589 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002590
2591 ssl->out_msglen = p - ssl->out_msg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002592 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2593 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002594
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002595 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002596
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002597 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002598 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002599 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002600 return( ret );
2601 }
2602
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002603#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002604 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002605 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2606 {
2607 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2608 return( ret );
2609 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01002610#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002611
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002612 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002613
2614 return( 0 );
2615}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002616#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002617
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002618static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002619{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002620#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002621 mbedtls_time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002622#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002623 int ret;
2624 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002625 unsigned char *buf, *p;
2626
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002627 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002628
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002629#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002630 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002631 ssl->handshake->verify_cookie_len != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002632 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002633 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
2634 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002635
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002636 return( ssl_write_hello_verify_request( ssl ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002637 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002638#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002639
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002640 if( ssl->conf->f_rng == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +01002641 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002642 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2643 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +01002644 }
2645
Paul Bakker5121ce52009-01-03 21:22:43 +00002646 /*
2647 * 0 . 0 handshake type
2648 * 1 . 3 handshake length
2649 * 4 . 5 protocol version
2650 * 6 . 9 UNIX time()
2651 * 10 . 37 random bytes
2652 */
2653 buf = ssl->out_msg;
2654 p = buf + 4;
2655
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002656 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002657 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002658 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002661 buf[4], buf[5] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002662
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002663#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002664 t = mbedtls_time( NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +00002665 *p++ = (unsigned char)( t >> 24 );
2666 *p++ = (unsigned char)( t >> 16 );
2667 *p++ = (unsigned char)( t >> 8 );
2668 *p++ = (unsigned char)( t );
2669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002670 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002671#else
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002672 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002673 return( ret );
2674
2675 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002676#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker5121ce52009-01-03 21:22:43 +00002677
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002678 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Paul Bakkera3d195c2011-11-27 21:07:34 +00002679 return( ret );
2680
2681 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00002682
Paul Bakker48916f92012-09-16 19:57:18 +00002683 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002684
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002686
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002687#if !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker5121ce52009-01-03 21:22:43 +00002688 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002689 * Resume is 0 by default, see ssl_handshake_init().
2690 * It may be already set to 1 by ssl_parse_session_ticket_ext().
2691 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00002692 */
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002693 if( mbedtls_ssl_handshake_get_resume( ssl->handshake ) == 0 &&
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02002694 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002695 ssl->session_negotiate->id_len != 0 &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002696 ssl->conf->f_get_cache != NULL &&
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01002697 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002698 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002699 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002700 ssl->handshake->resume = 1;
2701 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002702#endif /* !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00002703
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002704#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002705 if( mbedtls_ssl_handshake_get_resume( ssl->handshake ) == 1 )
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002706 {
2707 /*
2708 * Resuming a session
2709 */
2710 n = ssl->session_negotiate->id_len;
2711 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
2712
2713 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
2714 {
2715 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
2716 return( ret );
2717 }
2718 }
2719 else
2720#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002721 {
2722 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002723 * New session, create a new session id,
2724 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00002725 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002726 ssl->state++;
2727
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002728#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002729 ssl->session_negotiate->start = mbedtls_time( NULL );
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002730#endif
2731
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002732#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002733 if( ssl->handshake->new_session_ticket != 0 )
2734 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002735 ssl->session_negotiate->id_len = n = 0;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002736 memset( ssl->session_negotiate->id, 0, 32 );
2737 }
2738 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002739#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002740 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002741 ssl->session_negotiate->id_len = n = 32;
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002742 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02002743 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002744 return( ret );
2745 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002746 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002747
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002748 /*
2749 * 38 . 38 session id length
2750 * 39 . 38+n session id
2751 * 39+n . 40+n chosen ciphersuite
2752 * 41+n . 41+n chosen compression alg.
2753 * 42+n . 43+n extensions length
2754 * 44+n . 43+n+m extensions
2755 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002756 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2757 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
2758 p += ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002759
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002760 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2761 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2762 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002763 mbedtls_ssl_handshake_get_resume( ssl->handshake ) ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002764
Paul Bakker48916f92012-09-16 19:57:18 +00002765 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2766 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2767 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00002768
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002769 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2770 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2771 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00002772 ssl->session_negotiate->compression ) );
2773
Janos Follathc6dab2b2016-05-23 14:27:02 +01002774 /* Do not write the extensions if the protocol is SSLv3 */
2775#if defined(MBEDTLS_SSL_PROTO_SSL3)
2776 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
2777 {
2778#endif
2779
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002780 /*
2781 * First write extensions, then the total length
2782 */
2783 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2784 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00002785
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002786#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002787 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2788 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02002789#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002791#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002792 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
2793 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02002794#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002795
Hanno Beckera5a2b082019-05-15 14:03:01 +01002796#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker072d4ec2019-04-26 15:46:55 +01002797 ssl_write_cid_ext( ssl, p + 2 + ext_len, &olen );
2798 ext_len += olen;
2799#endif
2800
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002801#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002802 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2803 ext_len += olen;
2804#endif
2805
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002806#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002807 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2808 ext_len += olen;
2809#endif
2810
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002811#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002812 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2813 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02002814#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002815
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002816#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01002817 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Ron Eldor755bb6a2018-02-14 19:30:48 +02002818 if ( mbedtls_ssl_ciphersuite_uses_ec(
2819 mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite ) ) )
2820 {
2821 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2822 ext_len += olen;
2823 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002824#endif
2825
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002826#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2827 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
2828 ext_len += olen;
2829#endif
2830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002831#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002832 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2833 ext_len += olen;
2834#endif
2835
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002836 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002837
Paul Bakkera7036632014-04-30 10:15:38 +02002838 if( ext_len > 0 )
2839 {
2840 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2841 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2842 p += ext_len;
2843 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002844
Janos Follathc6dab2b2016-05-23 14:27:02 +01002845#if defined(MBEDTLS_SSL_PROTO_SSL3)
2846 }
2847#endif
2848
Paul Bakker5121ce52009-01-03 21:22:43 +00002849 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002850 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2851 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002852
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002853 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002854
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002855 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002856
2857 return( ret );
2858}
2859
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002860#if !defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002861static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002862{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002863 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00002864 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002865
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002866 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002867
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002868 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002869 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002871 ssl->state++;
2872 return( 0 );
2873 }
2874
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002875 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2876 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002877}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002878#else /* !MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002879static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002880{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002881 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002882 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00002883 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002884 size_t dn_size, total_dn_size; /* excluding length bytes */
2885 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00002886 unsigned char *buf, *p;
Angus Grattond8213d02016-05-25 20:56:48 +10002887 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002888 const mbedtls_x509_crt *crt;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002889 int authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00002890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002891 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002892
2893 ssl->state++;
2894
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002895#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2896 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
2897 authmode = ssl->handshake->sni_authmode;
2898 else
2899#endif
Hanno Beckeracd4fc02019-06-12 16:40:50 +01002900 authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002901
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002902 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ||
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002903 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002904 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002905 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002906 return( 0 );
2907 }
2908
2909 /*
2910 * 0 . 0 handshake type
2911 * 1 . 3 handshake length
2912 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01002913 * 5 .. m-1 cert types
2914 * m .. m+1 sig alg length (TLS 1.2 only)
Paul Bakker9af723c2014-05-01 13:03:14 +02002915 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00002916 * n .. n+1 length of all DNs
2917 * n+2 .. n+3 length of DN 1
2918 * n+4 .. ... Distinguished Name #1
2919 * ... .. ... length of DN 2, etc.
2920 */
2921 buf = ssl->out_msg;
2922 p = buf + 4;
2923
2924 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002925 * Supported certificate types
2926 *
2927 * ClientCertificateType certificate_types<1..2^8-1>;
2928 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00002929 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002930 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01002931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002932#if defined(MBEDTLS_RSA_C)
2933 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002934#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002935#if defined(MBEDTLS_ECDSA_C)
2936 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002937#endif
2938
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002939 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002940 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01002941
Paul Bakker577e0062013-08-28 11:57:20 +02002942 sa_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002943#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01002944 /*
2945 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01002946 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002947 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2948 *
2949 * struct {
2950 * HashAlgorithm hash;
2951 * SignatureAlgorithm signature;
2952 * } SignatureAndHashAlgorithm;
2953 *
2954 * enum { (255) } HashAlgorithm;
2955 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01002956 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002957 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002958 {
Simon Butcher99000142016-10-13 17:21:01 +01002959 const int *cur;
Paul Bakkerf7abd422013-04-16 13:15:56 +02002960
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002961 /*
2962 * Supported signature algorithms
2963 */
Simon Butcher99000142016-10-13 17:21:01 +01002964 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
2965 {
2966 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *cur );
2967
2968 if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
2969 continue;
2970
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002971#if defined(MBEDTLS_RSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01002972 p[2 + sa_len++] = hash;
2973 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002974#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002975#if defined(MBEDTLS_ECDSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01002976 p[2 + sa_len++] = hash;
2977 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002978#endif
Simon Butcher99000142016-10-13 17:21:01 +01002979 }
Paul Bakker926af752012-11-23 13:38:07 +01002980
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002981 p[0] = (unsigned char)( sa_len >> 8 );
2982 p[1] = (unsigned char)( sa_len );
2983 sa_len += 2;
2984 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01002985 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002986#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002987
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002988 /*
2989 * DistinguishedName certificate_authorities<0..2^16-1>;
2990 * opaque DistinguishedName<1..2^16-1>;
2991 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002992 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002993
Paul Bakkerbc3d9842012-11-26 16:12:02 +01002994 total_dn_size = 0;
Janos Follath088ce432017-04-10 12:42:31 +01002995
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01002996 if( mbedtls_ssl_conf_get_cert_req_ca_list( ssl->conf )
2997 == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED )
Paul Bakker5121ce52009-01-03 21:22:43 +00002998 {
Janos Follath088ce432017-04-10 12:42:31 +01002999#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3000 if( ssl->handshake->sni_ca_chain != NULL )
3001 crt = ssl->handshake->sni_ca_chain;
3002 else
3003#endif
3004 crt = ssl->conf->ca_chain;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003005
Hanno Becker371e0e42019-02-25 18:08:59 +00003006 while( crt != NULL && crt->raw.p != NULL )
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003007 {
Hanno Becker5f268b32019-05-20 16:26:34 +01003008 mbedtls_x509_crt_frame const *frame;
Hanno Becker232f8fa2019-02-26 16:49:57 +00003009 ret = mbedtls_x509_crt_frame_acquire( crt, &frame );
3010 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01003011 {
3012 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_frame_acquire", ret );
Hanno Becker232f8fa2019-02-26 16:49:57 +00003013 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01003014 }
Hanno Becker232f8fa2019-02-26 16:49:57 +00003015
Hanno Becker1e11f212019-03-04 14:43:43 +00003016 dn_size = frame->subject_raw.len;
Janos Follath088ce432017-04-10 12:42:31 +01003017
3018 if( end < p ||
3019 (size_t)( end - p ) < dn_size ||
3020 (size_t)( end - p ) < 2 + dn_size )
3021 {
3022 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00003023 mbedtls_x509_crt_frame_release( crt );
Janos Follath088ce432017-04-10 12:42:31 +01003024 break;
3025 }
3026
3027 *p++ = (unsigned char)( dn_size >> 8 );
3028 *p++ = (unsigned char)( dn_size );
Hanno Becker1e11f212019-03-04 14:43:43 +00003029 memcpy( p, frame->subject_raw.p, dn_size );
Janos Follath088ce432017-04-10 12:42:31 +01003030 p += dn_size;
3031
3032 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
3033
3034 total_dn_size += 2 + dn_size;
Hanno Becker232f8fa2019-02-26 16:49:57 +00003035
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00003036 mbedtls_x509_crt_frame_release( crt );
Hanno Becker232f8fa2019-02-26 16:49:57 +00003037
Janos Follath088ce432017-04-10 12:42:31 +01003038 crt = crt->next;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003039 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003040 }
3041
Paul Bakker926af752012-11-23 13:38:07 +01003042 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003043 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3044 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003045 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
3046 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00003047
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003048 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003049
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003050 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003051
3052 return( ret );
3053}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00003054#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003055
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003056#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3057 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3058static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003059{
3060 int ret;
3061
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003062 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003063 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003064 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
3065 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003066 }
3067
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003068 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
3069 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
3070 MBEDTLS_ECDH_OURS ) ) != 0 )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003071 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003072 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003073 return( ret );
3074 }
3075
3076 return( 0 );
3077}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003078#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
3079 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003080
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003081#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003082 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003083static int ssl_resume_server_key_exchange( mbedtls_ssl_context *ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003084 size_t *signature_len )
Paul Bakker41c83d32013-03-20 14:39:14 +01003085{
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003086 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3087 * signature length which will be added in ssl_write_server_key_exchange
3088 * after the call to ssl_prepare_server_key_exchange.
3089 * ssl_write_server_key_exchange also takes care of incrementing
3090 * ssl->out_msglen. */
3091 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2;
Angus Grattond8213d02016-05-25 20:56:48 +10003092 size_t sig_max_len = ( ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003093 - sig_start );
Gilles Peskine8f97af72018-04-26 11:46:10 +02003094 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003095 sig_start, signature_len, sig_max_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003096 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3097 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003098 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003099 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003100 }
Gilles Peskined3eb0612018-01-08 17:07:44 +01003101 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_resume_server_key_exchange", ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003102 return( ret );
3103}
3104#endif /* defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003105 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003106
Gilles Peskined3eb0612018-01-08 17:07:44 +01003107/* Prepare the ServerKeyExchange message, up to and including
Gilles Peskine168dae82018-04-25 23:35:42 +02003108 * calculating the signature if any, but excluding formatting the
3109 * signature and sending the message. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003110static int ssl_prepare_server_key_exchange( mbedtls_ssl_context *ssl,
3111 size_t *signature_len )
Paul Bakker5690efc2011-05-26 13:16:06 +00003112{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003113 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00003114 ssl->handshake->ciphersuite_info;
3115
Hanno Becker1aa267c2017-04-28 17:08:27 +01003116#if defined(MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED)
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003117#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskine3ce9b902018-01-06 01:34:21 +01003118 unsigned char *dig_signed = NULL;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003119#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
3120#endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003121
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003122 (void) ciphersuite_info; /* unused in some configurations */
Gilles Peskine22e695f2018-04-26 00:22:50 +02003123#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3124 (void) signature_len;
3125#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003126
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003127 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */
Paul Bakker5121ce52009-01-03 21:22:43 +00003128
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003129 /*
3130 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003131 * Part 1: Provide key exchange parameters for chosen ciphersuite.
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003132 *
3133 */
3134
3135 /*
3136 * - ECJPAKE key exchanges
3137 */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003138#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3139 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3140 {
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003141 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003142 size_t len = 0;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003143
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003144 ret = mbedtls_ecjpake_write_round_two(
3145 &ssl->handshake->ecjpake_ctx,
3146 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003147 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003148 ssl->conf->f_rng, ssl->conf->p_rng );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003149 if( ret != 0 )
3150 {
3151 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
3152 return( ret );
3153 }
3154
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003155 ssl->out_msglen += len;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003156 }
3157#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
3158
Hanno Becker1aa267c2017-04-28 17:08:27 +01003159 /*
3160 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
3161 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
3162 * we use empty support identity hints here.
3163 **/
3164#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003165 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3166 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3167 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003168 {
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003169 ssl->out_msg[ssl->out_msglen++] = 0x00;
3170 ssl->out_msg[ssl->out_msglen++] = 0x00;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003171 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003172#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
3173 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003174
Hanno Becker7e5437a2017-04-28 17:15:26 +01003175 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003176 * - DHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003177 */
3178#if defined(MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED)
3179 if( mbedtls_ssl_ciphersuite_uses_dhe( ciphersuite_info ) )
Paul Bakker48916f92012-09-16 19:57:18 +00003180 {
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003181 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003182 size_t len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003183
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01003184 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
3185 {
3186 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
3187 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3188 }
3189
Paul Bakker41c83d32013-03-20 14:39:14 +01003190 /*
3191 * Ephemeral DH parameters:
3192 *
3193 * struct {
3194 * opaque dh_p<1..2^16-1>;
3195 * opaque dh_g<1..2^16-1>;
3196 * opaque dh_Ys<1..2^16-1>;
3197 * } ServerDHParams;
3198 */
Hanno Beckerab740562017-10-04 13:15:37 +01003199 if( ( ret = mbedtls_dhm_set_group( &ssl->handshake->dhm_ctx,
3200 &ssl->conf->dhm_P,
3201 &ssl->conf->dhm_G ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003202 {
Hanno Beckerab740562017-10-04 13:15:37 +01003203 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_set_group", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003204 return( ret );
3205 }
Paul Bakker48916f92012-09-16 19:57:18 +00003206
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003207 if( ( ret = mbedtls_dhm_make_params(
3208 &ssl->handshake->dhm_ctx,
3209 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3210 ssl->out_msg + ssl->out_msglen, &len,
3211 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003212 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003213 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003214 return( ret );
3215 }
3216
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003217#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003218 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003219#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003220
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003221 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003222
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003223 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
3224 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
3225 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
3226 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker41c83d32013-03-20 14:39:14 +01003227 }
Hanno Becker1aa267c2017-04-28 17:08:27 +01003228#endif /* MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003229
Hanno Becker1aa267c2017-04-28 17:08:27 +01003230 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003231 * - ECDHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003232 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003233#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003234 if( mbedtls_ssl_ciphersuite_uses_ecdhe( ciphersuite_info ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003235 {
Paul Bakker41c83d32013-03-20 14:39:14 +01003236 /*
3237 * Ephemeral ECDH parameters:
3238 *
3239 * struct {
3240 * ECParameters curve_params;
3241 * ECPoint public;
3242 * } ServerECDHParams;
3243 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003244 const mbedtls_ecp_curve_info **curve = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003245 const mbedtls_ecp_group_id *gid;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003246 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003247 size_t len = 0;
Gergely Budai987bfb52014-01-19 21:48:42 +01003248
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01003249 /* Match our preference list against the offered curves */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003250 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01003251 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
3252 if( (*curve)->grp_id == *gid )
3253 goto curve_matching_done;
3254
3255curve_matching_done:
Manuel Pégourié-Gonnardb86145e2015-06-23 14:11:39 +02003256 if( curve == NULL || *curve == NULL )
Gergely Budai987bfb52014-01-19 21:48:42 +01003257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003258 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
3259 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Gergely Budai987bfb52014-01-19 21:48:42 +01003260 }
Manuel Pégourié-Gonnardde053902014-02-04 13:58:39 +01003261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003262 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
Gergely Budai987bfb52014-01-19 21:48:42 +01003263
Janos Follath3fbdada2018-08-15 10:26:53 +01003264 if( ( ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx,
3265 (*curve)->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003266 {
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003267 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003268 return( ret );
3269 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003270
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003271 if( ( ret = mbedtls_ecdh_make_params(
3272 &ssl->handshake->ecdh_ctx, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003273 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003274 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen,
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003275 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003276 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003277 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003278 return( ret );
3279 }
3280
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003281#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003282 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003283#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003284
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003285 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003286
Janos Follath3fbdada2018-08-15 10:26:53 +01003287 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3288 MBEDTLS_DEBUG_ECDH_Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01003289 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003290#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003291
Hanno Becker1aa267c2017-04-28 17:08:27 +01003292 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003293 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003294 * Part 2: For key exchanges involving the server signing the
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003295 * exchange parameters, compute and add the signature here.
3296 *
Hanno Becker1aa267c2017-04-28 17:08:27 +01003297 */
3298#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3299 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003300 {
Gilles Peskine1004c192018-01-08 16:59:14 +01003301 size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed;
Gilles Peskineca1d7422018-04-24 11:53:22 +02003302 size_t hashlen = 0;
Gilles Peskinee1efdf92018-01-05 21:18:37 +01003303 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003304 int ret;
Paul Bakker23f36802012-09-28 14:15:14 +00003305
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003306 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003307 * 2.1: Choose hash algorithm:
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003308 * A: For TLS 1.2, obey signature-hash-algorithm extension
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003309 * to choose appropriate hash.
3310 * B: For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1
3311 * (RFC 4492, Sec. 5.4)
3312 * C: Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003313 */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003314
3315 mbedtls_md_type_t md_alg;
3316
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003317#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003318 mbedtls_pk_type_t sig_alg =
3319 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003320 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003321 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003322 /* A: For TLS 1.2, obey signature-hash-algorithm extension
3323 * (RFC 5246, Sec. 7.4.1.4.1). */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003324 if( sig_alg == MBEDTLS_PK_NONE ||
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003325 ( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
3326 sig_alg ) ) == MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003327 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003328 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003329 /* (... because we choose a cipher suite
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003330 * only if there is a matching hash.) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003331 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003332 }
3333 }
Paul Bakker577e0062013-08-28 11:57:20 +02003334 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003335#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3336#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3337 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003338 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003339 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003340 /* B: Default hash SHA1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003341 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003342 }
3343 else
Hanno Becker1aa267c2017-04-28 17:08:27 +01003344#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3345 MBEDTLS_SSL_PROTO_TLS1_1 */
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003346 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003347 /* C: MD5 + SHA1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003348 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003349 }
3350
Hanno Becker7e5437a2017-04-28 17:15:26 +01003351 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pick hash algorithm %d for signing", md_alg ) );
3352
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003353 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003354 * 2.2: Compute the hash to be signed
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003355 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003356#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3357 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3358 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00003359 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003360 hashlen = 36;
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003361 ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash,
3362 dig_signed,
3363 dig_signed_len );
3364 if( ret != 0 )
3365 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003366 }
3367 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003368#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3369 MBEDTLS_SSL_PROTO_TLS1_1 */
3370#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3371 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3372 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003373 {
Gilles Peskineca1d7422018-04-24 11:53:22 +02003374 ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003375 dig_signed,
3376 dig_signed_len,
3377 md_alg );
3378 if( ret != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003379 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003380 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003381 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003382#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3383 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003384 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003385 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3386 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003387 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02003388
Gilles Peskineebd652f2018-01-05 21:18:59 +01003389 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003390
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003391 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003392 * 2.3: Compute and add the signature
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003393 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003394#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3395 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker23f36802012-09-28 14:15:14 +00003396 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003397 /*
3398 * For TLS 1.2, we need to specify signature and hash algorithm
Hanno Becker7e5437a2017-04-28 17:15:26 +01003399 * explicitly through a prefix to the signature.
3400 *
3401 * struct {
3402 * HashAlgorithm hash;
3403 * SignatureAlgorithm signature;
3404 * } SignatureAndHashAlgorithm;
3405 *
3406 * struct {
3407 * SignatureAndHashAlgorithm algorithm;
3408 * opaque signature<0..2^16-1>;
3409 * } DigitallySigned;
3410 *
3411 */
3412
Gilles Peskine1004c192018-01-08 16:59:14 +01003413 ssl->out_msg[ssl->out_msglen++] =
3414 mbedtls_ssl_hash_from_md_alg( md_alg );
3415 ssl->out_msg[ssl->out_msglen++] =
3416 mbedtls_ssl_sig_from_pk_alg( sig_alg );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003417 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003418#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003419
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003420#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003421 if( ssl->conf->f_async_sign_start != NULL )
3422 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003423 ret = ssl->conf->f_async_sign_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003424 mbedtls_ssl_own_cert( ssl ),
3425 md_alg, hash, hashlen );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003426 switch( ret )
3427 {
3428 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3429 /* act as if f_async_sign was null */
3430 break;
3431 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003432 ssl->handshake->async_in_progress = 1;
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003433 return( ssl_resume_server_key_exchange( ssl, signature_len ) );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003434 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003435 ssl->handshake->async_in_progress = 1;
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003436 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3437 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003438 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_sign_start", ret );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003439 return( ret );
3440 }
3441 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003442#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003443
3444 if( mbedtls_ssl_own_key( ssl ) == NULL )
3445 {
3446 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
3447 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3448 }
3449
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003450 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3451 * signature length which will be added in ssl_write_server_key_exchange
3452 * after the call to ssl_prepare_server_key_exchange.
3453 * ssl_write_server_key_exchange also takes care of incrementing
3454 * ssl->out_msglen. */
Gilles Peskine1004c192018-01-08 16:59:14 +01003455 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ),
3456 md_alg, hash, hashlen,
3457 ssl->out_msg + ssl->out_msglen + 2,
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003458 signature_len,
Gilles Peskine1004c192018-01-08 16:59:14 +01003459 ssl->conf->f_rng,
3460 ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003462 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02003463 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003464 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003465 }
Hanno Becker1aa267c2017-04-28 17:08:27 +01003466#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00003467
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003468 return( 0 );
3469}
Paul Bakker1ef83d62012-04-11 12:09:53 +00003470
Gilles Peskined3eb0612018-01-08 17:07:44 +01003471/* Prepare the ServerKeyExchange message and send it. For ciphersuites
Gilles Peskine168dae82018-04-25 23:35:42 +02003472 * that do not include a ServerKeyExchange message, do nothing. Either
3473 * way, if successful, move on to the next step in the SSL state
3474 * machine. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003475static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
3476{
3477 int ret;
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003478 size_t signature_len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003479#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
3480 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00003481 ssl->handshake->ciphersuite_info;
Gilles Peskinef1127252018-04-24 13:05:39 +02003482#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003483
Gilles Peskined3eb0612018-01-08 17:07:44 +01003484 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
3485
3486#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
3487 /* Extract static ECDH parameters and abort if ServerKeyExchange
3488 * is not needed. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003489 if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
3490 {
3491 /* For suites involving ECDH, extract DH parameters
3492 * from certificate at this point. */
3493#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
3494 if( mbedtls_ssl_ciphersuite_uses_ecdh( ciphersuite_info ) )
3495 {
3496 ssl_get_ecdh_params_from_cert( ssl );
3497 }
3498#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
3499
3500 /* Key exchanges not involving ephemeral keys don't use
3501 * ServerKeyExchange, so end here. */
3502 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
3503 ssl->state++;
3504 return( 0 );
3505 }
Gilles Peskinef1127252018-04-24 13:05:39 +02003506#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003507
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003508#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003509 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskined3eb0612018-01-08 17:07:44 +01003510 /* If we have already prepared the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003511 * signature operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003512 if( ssl->handshake->async_in_progress != 0 )
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003513 {
3514 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming signature operation" ) );
3515 ret = ssl_resume_server_key_exchange( ssl, &signature_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003516 }
3517 else
3518#endif /* defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003519 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003520 {
3521 /* ServerKeyExchange is needed. Prepare the message. */
3522 ret = ssl_prepare_server_key_exchange( ssl, &signature_len );
Gilles Peskined3eb0612018-01-08 17:07:44 +01003523 }
3524
3525 if( ret != 0 )
3526 {
Gilles Peskinead28bf02018-04-26 00:19:16 +02003527 /* If we're starting to write a new message, set ssl->out_msglen
3528 * to 0. But if we're resuming after an asynchronous message,
3529 * out_msglen is the amount of data written so far and mst be
3530 * preserved. */
Gilles Peskined3eb0612018-01-08 17:07:44 +01003531 if( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3532 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange (pending)" ) );
3533 else
3534 ssl->out_msglen = 0;
3535 return( ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003536 }
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003537
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003538 /* If there is a signature, write its length.
Gilles Peskine168dae82018-04-25 23:35:42 +02003539 * ssl_prepare_server_key_exchange already wrote the signature
3540 * itself at its proper place in the output buffer. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003541#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3542 if( signature_len != 0 )
3543 {
3544 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len >> 8 );
3545 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len );
3546
3547 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature",
3548 ssl->out_msg + ssl->out_msglen,
3549 signature_len );
3550
3551 /* Skip over the already-written signature */
3552 ssl->out_msglen += signature_len;
3553 }
3554#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
3555
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003556 /* Add header and send. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003557 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3558 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003559
3560 ssl->state++;
3561
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003562 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003563 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003564 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003565 return( ret );
3566 }
3567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003568 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003569 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003570}
3571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003572static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003573{
3574 int ret;
3575
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003576 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003577
3578 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003579 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3580 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003581
3582 ssl->state++;
3583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003584#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02003585 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003586 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003587#endif
3588
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003589 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003590 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003591 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003592 return( ret );
3593 }
3594
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003595#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02003596 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003597 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3598 {
3599 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
3600 return( ret );
3601 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01003602#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003604 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003605
3606 return( 0 );
3607}
3608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003609#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3610 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3611static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003612 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003613{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003614 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003615 size_t n;
3616
3617 /*
3618 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3619 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003620 if( *p + 2 > end )
3621 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003622 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3623 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003624 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02003625
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003626 n = ( (*p)[0] << 8 ) | (*p)[1];
3627 *p += 2;
3628
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003629 if( *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003630 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003631 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3632 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003633 }
3634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003635 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003636 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003637 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
3638 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003639 }
3640
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003641 *p += n;
3642
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003643 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003644
Paul Bakker70df2fb2013-04-17 17:19:09 +02003645 return( ret );
3646}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003647#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3648 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003649
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003650#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3651 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003652
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003653#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003654static int ssl_resume_decrypt_pms( mbedtls_ssl_context *ssl,
3655 unsigned char *peer_pms,
3656 size_t *peer_pmslen,
3657 size_t peer_pmssize )
3658{
Gilles Peskine8f97af72018-04-26 11:46:10 +02003659 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003660 peer_pms, peer_pmslen, peer_pmssize );
3661 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3662 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003663 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003664 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003665 }
3666 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_decrypt_encrypted_pms", ret );
3667 return( ret );
3668}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003669#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003670
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003671static int ssl_decrypt_encrypted_pms( mbedtls_ssl_context *ssl,
3672 const unsigned char *p,
3673 const unsigned char *end,
3674 unsigned char *peer_pms,
3675 size_t *peer_pmslen,
3676 size_t peer_pmssize )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003677{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003678 int ret;
Hanno Becker81bb4d02019-02-16 11:03:48 +00003679 size_t len = (size_t)( end - p ); /* Cast is safe because p <= end. */
Gilles Peskine422ccab2018-01-11 18:29:01 +01003680 mbedtls_pk_context *private_key = mbedtls_ssl_own_key( ssl );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003681
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003682#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003683 /* If we have already started decoding the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003684 * decryption operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003685 if( ssl->handshake->async_in_progress != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003686 {
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003687 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming decryption operation" ) );
3688 return( ssl_resume_decrypt_pms( ssl,
3689 peer_pms, peer_pmslen, peer_pmssize ) );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003690 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003691#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003692
3693 /*
Gilles Peskine422ccab2018-01-11 18:29:01 +01003694 * Prepare to decrypt the premaster using own private RSA key
Paul Bakker70df2fb2013-04-17 17:19:09 +02003695 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003696#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3697 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker81bb4d02019-02-16 11:03:48 +00003698#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003699 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker81bb4d02019-02-16 11:03:48 +00003700#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003701 {
Hanno Becker81bb4d02019-02-16 11:03:48 +00003702 if( len < 2 )
3703 {
Philippe Antoine747fd532018-05-30 09:13:21 +02003704 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3705 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3706 }
Hanno Becker81bb4d02019-02-16 11:03:48 +00003707 len -= 2;
3708
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003709 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
3710 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003711 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003712 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3713 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003714 }
3715 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003716#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003717
Gilles Peskine422ccab2018-01-11 18:29:01 +01003718 /*
3719 * Decrypt the premaster secret
3720 */
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003721#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003722 if( ssl->conf->f_async_decrypt_start != NULL )
3723 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003724 ret = ssl->conf->f_async_decrypt_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003725 mbedtls_ssl_own_cert( ssl ),
3726 p, len );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003727 switch( ret )
3728 {
3729 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3730 /* act as if f_async_decrypt_start was null */
3731 break;
3732 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003733 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003734 return( ssl_resume_decrypt_pms( ssl,
3735 peer_pms,
3736 peer_pmslen,
3737 peer_pmssize ) );
3738 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003739 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003740 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3741 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003742 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_decrypt_start", ret );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003743 return( ret );
3744 }
3745 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003746#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003747
Gilles Peskine422ccab2018-01-11 18:29:01 +01003748 if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_RSA ) )
3749 {
Gilles Peskine422ccab2018-01-11 18:29:01 +01003750 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
3751 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3752 }
3753
3754 ret = mbedtls_pk_decrypt( private_key, p, len,
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003755 peer_pms, peer_pmslen, peer_pmssize,
3756 ssl->conf->f_rng, ssl->conf->p_rng );
3757 return( ret );
3758}
3759
3760static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
3761 const unsigned char *p,
3762 const unsigned char *end,
3763 size_t pms_offset )
3764{
3765 int ret;
3766 unsigned char *pms = ssl->handshake->premaster + pms_offset;
3767 unsigned char ver[2];
3768 unsigned char fake_pms[48], peer_pms[48];
3769 unsigned char mask;
3770 size_t i, peer_pmslen;
3771 unsigned int diff;
3772
Gilles Peskine0a8352b2018-06-13 18:16:41 +02003773 /* In case of a failure in decryption, the decryption may write less than
3774 * 2 bytes of output, but we always read the first two bytes. It doesn't
3775 * matter in the end because diff will be nonzero in that case due to
3776 * peer_pmslen being less than 48, and we only care whether diff is 0.
3777 * But do initialize peer_pms for robustness anyway. This also makes
3778 * memory analyzers happy (don't access uninitialized memory, even
3779 * if it's an unsigned char). */
3780 peer_pms[0] = peer_pms[1] = ~0;
3781
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003782 ret = ssl_decrypt_encrypted_pms( ssl, p, end,
3783 peer_pms,
3784 &peer_pmslen,
3785 sizeof( peer_pms ) );
3786
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003787#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003788 if ( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3789 return( ret );
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003790#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003791
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003792 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Gilles Peskine2e333372018-04-24 13:22:10 +02003793 ssl->handshake->max_minor_ver,
3794 ssl->conf->transport, ver );
3795
3796 /* Avoid data-dependent branches while checking for invalid
3797 * padding, to protect against timing-based Bleichenbacher-type
3798 * attacks. */
3799 diff = (unsigned int) ret;
3800 diff |= peer_pmslen ^ 48;
3801 diff |= peer_pms[0] ^ ver[0];
3802 diff |= peer_pms[1] ^ ver[1];
3803
3804 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
3805 /* MSVC has a warning about unary minus on unsigned, but this is
3806 * well-defined and precisely what we want to do here */
3807#if defined(_MSC_VER)
3808#pragma warning( push )
3809#pragma warning( disable : 4146 )
3810#endif
3811 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
3812#if defined(_MSC_VER)
3813#pragma warning( pop )
3814#endif
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003815
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003816 /*
3817 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3818 * must not cause the connection to end immediately; instead, send a
3819 * bad_record_mac later in the handshake.
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003820 * To protect against timing-based variants of the attack, we must
3821 * not have any branch that depends on whether the decryption was
3822 * successful. In particular, always generate the fake premaster secret,
3823 * regardless of whether it will ultimately influence the output or not.
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003824 */
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003825 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003826 if( ret != 0 )
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003827 {
Gilles Peskinee1416382018-04-26 10:23:21 +02003828 /* It's ok to abort on an RNG failure, since this does not reveal
3829 * anything about the RSA decryption. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003830 return( ret );
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003831 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003832
Manuel Pégourié-Gonnard331ba572015-04-20 12:33:57 +01003833#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003834 if( diff != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003835 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003836#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003837
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003838 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
3839 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
3840 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003841 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3842 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003843 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003844 ssl->handshake->pmslen = 48;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003845
Gilles Peskine422ccab2018-01-11 18:29:01 +01003846 /* Set pms to either the true or the fake PMS, without
3847 * data-dependent branches. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003848 for( i = 0; i < ssl->handshake->pmslen; i++ )
3849 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
3850
3851 return( 0 );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003852}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003853#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3854 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003856#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
3857static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003858 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003859{
Paul Bakker6db455e2013-09-18 17:29:31 +02003860 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003861 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003862
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003863 if( ssl->conf->f_psk == NULL &&
3864 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
3865 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003866 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003867 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
3868 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003869 }
3870
3871 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003872 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02003873 */
Hanno Becker83c9f492017-06-26 13:52:14 +01003874 if( end - *p < 2 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003876 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3877 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003878 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003879
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003880 n = ( (*p)[0] << 8 ) | (*p)[1];
3881 *p += 2;
3882
Hanno Becker83c9f492017-06-26 13:52:14 +01003883 if( n < 1 || n > 65535 || n > (size_t) ( end - *p ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003885 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3886 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003887 }
3888
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003889 if( ssl->conf->f_psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02003890 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003891 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003892 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003893 }
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003894 else
Paul Bakker6db455e2013-09-18 17:29:31 +02003895 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01003896 /* Identity is not a big secret since clients send it in the clear,
3897 * but treat it carefully anyway, just in case */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003898 if( n != ssl->conf->psk_identity_len ||
3899 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003900 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003901 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003902 }
3903 }
3904
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003905 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003906 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003907 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Gilles Peskinec94f7352017-05-10 16:37:56 +02003908 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3909 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003910 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003911 }
3912
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003913 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003914
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003915 return( 0 );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003916}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003917#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02003918
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003919static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003920{
Paul Bakker23986e52011-04-24 08:57:21 +00003921 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003922 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003923 unsigned char *p, *end;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003924
Hanno Becker8759e162017-12-27 21:34:08 +00003925 ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003926
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003927 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003928
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003929#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003930 ( defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3931 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) )
3932 if( ( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3933 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) &&
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003934 ( ssl->handshake->async_in_progress != 0 ) )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003935 {
3936 /* We've already read a record and there is an asynchronous
3937 * operation in progress to decrypt it. So skip reading the
Gilles Peskine168dae82018-04-25 23:35:42 +02003938 * record. */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003939 MBEDTLS_SSL_DEBUG_MSG( 3, ( "will resume decryption of previously-read record" ) );
3940 }
3941 else
3942#endif
Hanno Becker327c93b2018-08-15 13:56:18 +01003943 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003945 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003946 return( ret );
3947 }
3948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003949 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003950 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnardf8995832014-09-10 08:25:12 +00003951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003952 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003953 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003954 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3955 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003956 }
3957
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003958 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003959 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003960 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3961 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003962 }
3963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003964#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3965 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003966 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003967 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003968 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003969 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003970 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003971 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003972
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003973 if( p != end )
3974 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003975 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3976 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003977 }
3978
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003979 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003980 ssl->handshake->premaster,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01003981 MBEDTLS_PREMASTER_SIZE,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02003982 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003983 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003984 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003985 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
3986 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003987 }
3988
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003989 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003990 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003991 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003992#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3993#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3994 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3995 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3996 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3997 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3998 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3999 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
4000 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02004001 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004002 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00004003 p, end - p) ) != 0 )
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004004 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004005 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
4006 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004007 }
4008
Janos Follath3fbdada2018-08-15 10:26:53 +01004009 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4010 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004011
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004012 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004013 &ssl->handshake->pmslen,
4014 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004015 MBEDTLS_MPI_MAX_SIZE,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01004016 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004017 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004018 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
4019 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004020 }
4021
Janos Follath3fbdada2018-08-15 10:26:53 +01004022 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4023 MBEDTLS_DEBUG_ECDH_Z );
Paul Bakker5121ce52009-01-03 21:22:43 +00004024 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004025 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004026#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
4027 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
4028 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
4029 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
4030#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
4031 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02004032 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004033 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02004034 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004035 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakkerfbb17802013-04-17 19:10:21 +02004036 return( ret );
4037 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004038
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004039 if( p != end )
4040 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004041 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4042 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004043 }
4044
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004045 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004046 ciphersuite_info->key_exchange ) ) != 0 )
4047 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004048 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004049 return( ret );
4050 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02004051 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004052 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004053#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
4054#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
4055 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004056 {
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004057#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004058 if ( ssl->handshake->async_in_progress != 0 )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01004059 {
4060 /* There is an asynchronous operation in progress to
4061 * decrypt the encrypted premaster secret, so skip
4062 * directly to resuming this operation. */
4063 MBEDTLS_SSL_DEBUG_MSG( 3, ( "PSK identity already parsed" ) );
4064 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms
4065 * won't actually use it, but maintain p anyway for robustness. */
4066 p += ssl->conf->psk_identity_len + 2;
4067 }
4068 else
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004069#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004070 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4071 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004072 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004073 return( ret );
4074 }
4075
4076 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
4077 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004078 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004079 return( ret );
4080 }
4081
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004082 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004083 ciphersuite_info->key_exchange ) ) != 0 )
4084 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004085 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004086 return( ret );
4087 }
4088 }
4089 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004090#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
4091#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
4092 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004093 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004094 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4095 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004096 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004097 return( ret );
4098 }
4099 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
4100 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004101 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004102 return( ret );
4103 }
4104
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004105 if( p != end )
4106 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004107 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4108 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004109 }
4110
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004111 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004112 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004113 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004114 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004115 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004116 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004117 }
4118 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004119#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
4120#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
4121 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004122 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004123 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4124 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004125 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004126 return( ret );
4127 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004129 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004130 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004131 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004132 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
4133 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004134 }
4135
Janos Follath3fbdada2018-08-15 10:26:53 +01004136 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4137 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004138
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004139 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004140 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004142 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004143 return( ret );
4144 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004145 }
4146 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004147#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
4148#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
4149 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01004150 {
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00004151 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01004152 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004153 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02004154 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004155 }
4156 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004157 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004158#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004159#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4160 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
4161 {
4162 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
4163 p, end - p );
4164 if( ret != 0 )
4165 {
4166 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
4167 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
4168 }
4169
4170 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
4171 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
4172 ssl->conf->f_rng, ssl->conf->p_rng );
4173 if( ret != 0 )
4174 {
4175 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
4176 return( ret );
4177 }
4178 }
4179 else
4180#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004181 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004182 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4183 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004184 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004185
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004186 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00004187 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004188 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00004189 return( ret );
4190 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004191
Paul Bakker5121ce52009-01-03 21:22:43 +00004192 ssl->state++;
4193
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004194 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004195
4196 return( 0 );
4197}
4198
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004199#if !defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004200static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004201{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004202 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00004203 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00004204
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004205 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004206
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004207 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakkered27a042013-04-18 22:46:23 +02004208 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004209 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02004210 ssl->state++;
4211 return( 0 );
4212 }
4213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004214 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4215 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004216}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004217#else /* !MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004218static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004219{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004220 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004221 size_t i, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004222 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004223 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004224 size_t hashlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004225#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4226 mbedtls_pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02004227#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004228 mbedtls_md_type_t md_alg;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004229 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00004230 ssl->handshake->ciphersuite_info;
Hanno Becker5882dd02019-06-06 16:25:57 +01004231 mbedtls_pk_context *peer_pk = NULL;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004233 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004234
Hanno Beckercd901262019-02-07 13:17:25 +00004235 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004236 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004237 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004238 ssl->state++;
4239 return( 0 );
4240 }
4241
Hanno Becker5882dd02019-06-06 16:25:57 +01004242 /* Skip if we haven't received a certificate from the client.
4243 * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is set, this can be
4244 * inferred from the setting of mbedtls_ssl_session::peer_cert.
4245 * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is not set, it can
4246 * be inferred from whether we've held back the peer CRT's
4247 * public key in mbedtls_ssl_handshake_params::peer_pubkey. */
4248#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4249 /* Because the peer CRT pubkey is embedded into the handshake
4250 * params currently, and there's no 'is_init' functions for PK
4251 * contexts, we need to break the abstraction and peek into
4252 * the PK context to see if it has been initialized. */
4253 if( ssl->handshake->peer_pubkey.pk_info != NULL )
4254 peer_pk = &ssl->handshake->peer_pubkey;
4255#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4256 if( ssl->session_negotiate->peer_cert != NULL )
Hanno Becker73cd8d82019-02-28 14:04:16 +00004257 {
4258 ret = mbedtls_x509_crt_pk_acquire( ssl->session_negotiate->peer_cert,
4259 &peer_pk );
4260 if( ret != 0 )
4261 {
Hanno Becker2224ccf2019-06-28 10:52:45 +01004262 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
4263 return( ret );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004264 }
4265 }
Hanno Becker5882dd02019-06-06 16:25:57 +01004266#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4267
4268 if( peer_pk == NULL )
Hanno Beckercd901262019-02-07 13:17:25 +00004269 {
4270 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
4271 ssl->state++;
4272 return( 0 );
4273 }
Hanno Beckercd901262019-02-07 13:17:25 +00004274
Simon Butcher99000142016-10-13 17:21:01 +01004275 /* Read the message without adding it to the checksum */
Hanno Becker327c93b2018-08-15 13:56:18 +01004276 ret = mbedtls_ssl_read_record( ssl, 0 /* no checksum update */ );
Simon Butcher99000142016-10-13 17:21:01 +01004277 if( 0 != ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00004278 {
Hanno Becker327c93b2018-08-15 13:56:18 +01004279 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret );
Hanno Beckerbc6b5982019-07-02 15:36:44 +01004280 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004281 }
4282
4283 ssl->state++;
4284
Simon Butcher99000142016-10-13 17:21:01 +01004285 /* Process the message contents */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004286 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
4287 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00004288 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerbc6b5982019-07-02 15:36:44 +01004290 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4291 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004292 }
4293
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004294 i = mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004295
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004296 /*
4297 * struct {
4298 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
4299 * opaque signature<0..2^16-1>;
4300 * } DigitallySigned;
4301 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004302#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
4303 defined(MBEDTLS_SSL_PROTO_TLS1_1)
4304 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01004305 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004306 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004307 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004308
4309 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
Hanno Becker0833c102019-02-06 18:31:04 +00004310 if( mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECDSA ) )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004311 {
4312 hash_start += 16;
4313 hashlen -= 16;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004314 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004315 }
Paul Bakker926af752012-11-23 13:38:07 +01004316 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02004317 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004318#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
4319 MBEDTLS_SSL_PROTO_TLS1_1 */
4320#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4321 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004322 {
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004323 if( i + 2 > ssl->in_hslen )
4324 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004325 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004326 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4327 goto exit;
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004328 }
4329
Paul Bakker5121ce52009-01-03 21:22:43 +00004330 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004331 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00004332 */
Simon Butcher99000142016-10-13 17:21:01 +01004333 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] );
4334
4335 if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004336 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004337 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004338 " for verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004339 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4340 goto exit;
Paul Bakker926af752012-11-23 13:38:07 +01004341 }
4342
Simon Butcher99000142016-10-13 17:21:01 +01004343#if !defined(MBEDTLS_MD_SHA1)
4344 if( MBEDTLS_MD_SHA1 == md_alg )
4345 hash_start += 16;
4346#endif
Paul Bakker926af752012-11-23 13:38:07 +01004347
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02004348 /* Info from md_alg will be used instead */
4349 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004350
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004351 i++;
4352
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004353 /*
4354 * Signature
4355 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004356 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
4357 == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004358 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004359 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004360 " for verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004361 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4362 goto exit;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004363 }
4364
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004365 /*
4366 * Check the certificate's key type matches the signature alg
4367 */
Hanno Becker0833c102019-02-06 18:31:04 +00004368 if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004369 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004370 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004371 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4372 goto exit;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004373 }
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004374
4375 i++;
Paul Bakker577e0062013-08-28 11:57:20 +02004376 }
4377 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004378#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02004379 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004380 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4381 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004382 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02004383
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004384 if( i + 2 > ssl->in_hslen )
4385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004387 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4388 goto exit;
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004389 }
4390
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004391 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
4392 i += 2;
Paul Bakker926af752012-11-23 13:38:07 +01004393
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004394 if( i + sig_len != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00004395 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004396 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004397 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4398 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004399 }
4400
Simon Butcher99000142016-10-13 17:21:01 +01004401 /* Calculate hash and verify signature */
Manuel Pégourié-Gonnarda5759752019-05-03 11:43:28 +02004402 {
4403 size_t dummy_hlen;
4404 ssl->handshake->calc_verify( ssl, hash, &dummy_hlen );
4405 }
Simon Butcher99000142016-10-13 17:21:01 +01004406
Hanno Becker0833c102019-02-06 18:31:04 +00004407 if( ( ret = mbedtls_pk_verify( peer_pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004408 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004409 ssl->in_msg + i, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004410 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004411 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004412 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004413 }
4414
Simon Butcher99000142016-10-13 17:21:01 +01004415 mbedtls_ssl_update_handshake_status( ssl );
4416
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004417 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004418
Hanno Becker73cd8d82019-02-28 14:04:16 +00004419exit:
4420
4421#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00004422 mbedtls_x509_crt_pk_release( ssl->session_negotiate->peer_cert );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004423#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4424
Paul Bakkered27a042013-04-18 22:46:23 +02004425 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004426}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004427#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00004428
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004429#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4430static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004431{
4432 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004433 size_t tlen;
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004434 uint32_t lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004436 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004438 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4439 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004440
4441 /*
4442 * struct {
4443 * uint32 ticket_lifetime_hint;
4444 * opaque ticket<0..2^16-1>;
4445 * } NewSessionTicket;
4446 *
4447 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
4448 * 8 . 9 ticket_len (n)
4449 * 10 . 9+n ticket content
4450 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02004451
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004452 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +02004453 ssl->session_negotiate,
4454 ssl->out_msg + 10,
Angus Grattond8213d02016-05-25 20:56:48 +10004455 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004456 &tlen, &lifetime ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004457 {
Manuel Pégourié-Gonnarda4a47352015-05-15 15:14:54 +02004458 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004459 tlen = 0;
4460 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004461
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004462 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
4463 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
4464 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
4465 ssl->out_msg[7] = ( lifetime ) & 0xFF;
4466
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004467 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
4468 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004469
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004470 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004471
Manuel Pégourié-Gonnard145dfcb2014-02-26 14:23:33 +01004472 /*
4473 * Morally equivalent to updating ssl->state, but NewSessionTicket and
4474 * ChangeCipherSpec share the same state.
4475 */
4476 ssl->handshake->new_session_ticket = 0;
4477
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004478 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004479 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004480 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004481 return( ret );
4482 }
4483
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004484 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004485
4486 return( 0 );
4487}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004488#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004489
Paul Bakker5121ce52009-01-03 21:22:43 +00004490/*
Paul Bakker1961b702013-01-25 14:49:24 +01004491 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00004492 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004493int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004494{
4495 int ret = 0;
4496
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02004497 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004498 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004499
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004500 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01004501
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004502 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01004503 return( ret );
4504
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004505#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004506 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004507 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004508 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004509 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004510 return( ret );
4511 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01004512#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004513
Paul Bakker1961b702013-01-25 14:49:24 +01004514 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00004515 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004516 case MBEDTLS_SSL_HELLO_REQUEST:
4517 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00004518 break;
4519
Paul Bakker1961b702013-01-25 14:49:24 +01004520 /*
4521 * <== ClientHello
4522 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004523 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004524 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004525 break;
Paul Bakker1961b702013-01-25 14:49:24 +01004526
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004527#if defined(MBEDTLS_SSL_PROTO_DTLS)
4528 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
4529 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02004530#endif
4531
Paul Bakker1961b702013-01-25 14:49:24 +01004532 /*
4533 * ==> ServerHello
4534 * Certificate
4535 * ( ServerKeyExchange )
4536 * ( CertificateRequest )
4537 * ServerHelloDone
4538 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004539 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004540 ret = ssl_write_server_hello( ssl );
4541 break;
4542
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004543 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4544 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004545 break;
4546
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004547 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004548 ret = ssl_write_server_key_exchange( ssl );
4549 break;
4550
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004551 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01004552 ret = ssl_write_certificate_request( ssl );
4553 break;
4554
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004555 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01004556 ret = ssl_write_server_hello_done( ssl );
4557 break;
4558
4559 /*
4560 * <== ( Certificate/Alert )
4561 * ClientKeyExchange
4562 * ( CertificateVerify )
4563 * ChangeCipherSpec
4564 * Finished
4565 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004566 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4567 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004568 break;
4569
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004570 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004571 ret = ssl_parse_client_key_exchange( ssl );
4572 break;
4573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004574 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01004575 ret = ssl_parse_certificate_verify( ssl );
4576 break;
4577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004578 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4579 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004580 break;
4581
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004582 case MBEDTLS_SSL_CLIENT_FINISHED:
4583 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004584 break;
4585
4586 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004587 * ==> ( NewSessionTicket )
4588 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01004589 * Finished
4590 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004591 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4592#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02004593 if( ssl->handshake->new_session_ticket != 0 )
4594 ret = ssl_write_new_session_ticket( ssl );
4595 else
Paul Bakkera503a632013-08-14 13:48:06 +02004596#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004597 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004598 break;
4599
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004600 case MBEDTLS_SSL_SERVER_FINISHED:
4601 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004602 break;
4603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004604 case MBEDTLS_SSL_FLUSH_BUFFERS:
4605 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
4606 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01004607 break;
4608
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004609 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4610 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004611 break;
4612
4613 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004614 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
4615 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004616 }
4617
Paul Bakker5121ce52009-01-03 21:22:43 +00004618 return( ret );
4619}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004620#endif /* MBEDTLS_SSL_SRV_C */