blob: 0d6df13ab748c97d497b8ba498641b299cb989ce [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Paul Bakker68884e32013-01-07 18:20:04 +01004 * Copyright (C) 2006-2013, Brainspark B.V.
Paul Bakkerb96f1542010-07-18 20:36:00 +00005 *
6 * This file is part of PolarSSL (http://www.polarssl.org)
Paul Bakker84f12b72010-07-18 10:13:04 +00007 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
Paul Bakkerb96f1542010-07-18 20:36:00 +00008 *
Paul Bakker77b385e2009-07-28 17:23:11 +00009 * All rights reserved.
Paul Bakkere0ccd0a2009-01-04 16:27:10 +000010 *
Paul Bakker5121ce52009-01-03 21:22:43 +000011 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24 */
25
Paul Bakker40e46942009-01-03 21:51:57 +000026#include "polarssl/config.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Paul Bakker40e46942009-01-03 21:51:57 +000028#if defined(POLARSSL_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
Paul Bakker40e46942009-01-03 21:51:57 +000030#include "polarssl/debug.h"
31#include "polarssl/ssl.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010032#if defined(POLARSSL_ECP_C)
33#include "polarssl/ecp.h"
34#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020036#if defined(POLARSSL_MEMORY_C)
37#include "polarssl/memory.h"
38#else
39#define polarssl_malloc malloc
40#define polarssl_free free
41#endif
42
Paul Bakker5121ce52009-01-03 21:22:43 +000043#include <stdlib.h>
44#include <stdio.h>
Paul Bakkerfa9b1002013-07-03 15:31:03 +020045
46#if defined(POLARSSL_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +000047#include <time.h>
Paul Bakkerfa9b1002013-07-03 15:31:03 +020048#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000049
Paul Bakkera503a632013-08-14 13:48:06 +020050#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020051/*
52 * Serialize a session in the following format:
53 * 0 . n-1 session structure, n = sizeof(ssl_session)
54 * n . n+2 peer_cert length = m (0 if no certificate)
55 * n+3 . n+2+m peer cert ASN.1
56 *
57 * Assumes ticket is NULL (always true on server side).
58 */
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020059static int ssl_save_session( const ssl_session *session,
60 unsigned char *buf, size_t buf_len,
61 size_t *olen )
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020062{
63 unsigned char *p = buf;
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020064 size_t left = buf_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020065#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020066 size_t cert_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020067#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020068
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020069 if( left < sizeof( ssl_session ) )
70 return( -1 );
71
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020072 memcpy( p, session, sizeof( ssl_session ) );
73 p += sizeof( ssl_session );
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020074 left -= sizeof( ssl_session );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020075
Paul Bakker7c6b2c32013-09-16 13:49:26 +020076#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020077 if( session->peer_cert == NULL )
78 cert_len = 0;
79 else
80 cert_len = session->peer_cert->raw.len;
81
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020082 if( left < 3 + cert_len )
83 return( -1 );
84
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020085 *p++ = (unsigned char)( cert_len >> 16 & 0xFF );
86 *p++ = (unsigned char)( cert_len >> 8 & 0xFF );
87 *p++ = (unsigned char)( cert_len & 0xFF );
88
89 if( session->peer_cert != NULL )
90 memcpy( p, session->peer_cert->raw.p, cert_len );
91
92 p += cert_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020093#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020094
95 *olen = p - buf;
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020096
97 return( 0 );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020098}
99
100/*
101 * Unserialise session, see ssl_save_session()
102 */
103static int ssl_load_session( ssl_session *session,
104 const unsigned char *buf, size_t len )
105{
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200106 const unsigned char *p = buf;
107 const unsigned char * const end = buf + len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200108#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200109 size_t cert_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200110#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200111
112 if( p + sizeof( ssl_session ) > end )
113 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
114
115 memcpy( session, p, sizeof( ssl_session ) );
116 p += sizeof( ssl_session );
117
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200118#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200119 if( p + 3 > end )
120 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
121
122 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
123 p += 3;
124
125 if( cert_len == 0 )
126 {
127 session->peer_cert = NULL;
128 }
129 else
130 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200131 int ret;
132
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200133 if( p + cert_len > end )
134 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
135
Paul Bakkerc559c7a2013-09-18 14:13:26 +0200136 session->peer_cert = polarssl_malloc( sizeof( x509_crt ) );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200137
138 if( session->peer_cert == NULL )
139 return( POLARSSL_ERR_SSL_MALLOC_FAILED );
140
Paul Bakkerb6b09562013-09-18 14:17:41 +0200141 x509_crt_init( session->peer_cert );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200142
Paul Bakkerddf26b42013-09-18 13:46:23 +0200143 if( ( ret = x509_crt_parse( session->peer_cert, p, cert_len ) ) != 0 )
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200144 {
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200145 x509_crt_free( session->peer_cert );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200146 polarssl_free( session->peer_cert );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200147 session->peer_cert = NULL;
148 return( ret );
149 }
150
151 p += cert_len;
152 }
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200153#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200154
155 if( p != end )
156 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
157
158 return( 0 );
159}
160
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200161/*
162 * Create session ticket, secured as recommended in RFC 5077 section 4:
163 *
164 * struct {
165 * opaque key_name[16];
166 * opaque iv[16];
167 * opaque encrypted_state<0..2^16-1>;
168 * opaque mac[32];
169 * } ticket;
170 *
171 * (the internal state structure differs, however).
172 */
173static int ssl_write_ticket( ssl_context *ssl, size_t *tlen )
174{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200175 int ret;
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200176 unsigned char * const start = ssl->out_msg + 10;
177 unsigned char *p = start;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200178 unsigned char *state;
179 unsigned char iv[16];
180 size_t clear_len, enc_len, pad_len, i;
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200181
Manuel Pégourié-Gonnard0a201712013-08-23 16:25:16 +0200182 *tlen = 0;
183
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +0200184 if( ssl->ticket_keys == NULL )
185 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
186
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200187 /* Write key name */
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +0200188 memcpy( p, ssl->ticket_keys->key_name, 16 );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200189 p += 16;
190
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200191 /* Generate and write IV (with a copy for aes_crypt) */
192 if( ( ret = ssl->f_rng( ssl->p_rng, p, 16 ) ) != 0 )
193 return( ret );
194 memcpy( iv, p, 16 );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200195 p += 16;
196
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +0200197 /*
198 * Dump session state
199 *
200 * After the session state itself, we still need room for 16 bytes of
201 * padding and 32 bytes of MAC, so there's only so much room left
202 */
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200203 state = p + 2;
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +0200204 if( ssl_save_session( ssl->session_negotiate, state,
205 SSL_MAX_CONTENT_LEN - (state - ssl->out_ctr) - 48,
206 &clear_len ) != 0 )
207 {
208 return( POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE );
209 }
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200210 SSL_DEBUG_BUF( 3, "session ticket cleartext", state, clear_len );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200211
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200212 /* Apply PKCS padding */
213 pad_len = 16 - clear_len % 16;
214 enc_len = clear_len + pad_len;
215 for( i = clear_len; i < enc_len; i++ )
216 state[i] = (unsigned char) pad_len;
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200217
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200218 /* Encrypt */
219 if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->enc, AES_ENCRYPT,
220 enc_len, iv, state, state ) ) != 0 )
221 {
222 return( ret );
223 }
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200224
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200225 /* Write length */
226 *p++ = (unsigned char)( ( enc_len >> 8 ) & 0xFF );
227 *p++ = (unsigned char)( ( enc_len ) & 0xFF );
228 p = state + enc_len;
229
Manuel Pégourié-Gonnard56dc9e82013-08-03 17:16:31 +0200230 /* Compute and write MAC( key_name + iv + enc_state_len + enc_state ) */
231 sha256_hmac( ssl->ticket_keys->mac_key, 16, start, p - start, p, 0 );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200232 p += 32;
233
234 *tlen = p - start;
235
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200236 SSL_DEBUG_BUF( 3, "session ticket structure", start, *tlen );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200237
238 return( 0 );
239}
240
241/*
242 * Load session ticket (see ssl_write_ticket for structure)
243 */
244static int ssl_parse_ticket( ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200245 unsigned char *buf,
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200246 size_t len )
247{
248 int ret;
249 ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200250 unsigned char *key_name = buf;
251 unsigned char *iv = buf + 16;
252 unsigned char *enc_len_p = iv + 16;
253 unsigned char *ticket = enc_len_p + 2;
254 unsigned char *mac;
Manuel Pégourié-Gonnard34ced2d2013-09-20 11:37:39 +0200255 unsigned char computed_mac[32];
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200256 size_t enc_len, clear_len, i;
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100257 unsigned char pad_len, diff;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200258
259 SSL_DEBUG_BUF( 3, "session ticket structure", buf, len );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200260
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +0200261 if( len < 34 || ssl->ticket_keys == NULL )
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200262 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
263
264 enc_len = ( enc_len_p[0] << 8 ) | enc_len_p[1];
265 mac = ticket + enc_len;
266
267 if( len != enc_len + 66 )
268 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
269
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100270 /* Check name, in constant time though it's not a big secret */
271 diff = 0;
272 for( i = 0; i < 16; i++ )
273 diff |= key_name[i] ^ ssl->ticket_keys->key_name[i];
274 /* don't return yet, check the MAC anyway */
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200275
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100276 /* Check mac, with constant-time buffer comparison */
Manuel Pégourié-Gonnard56dc9e82013-08-03 17:16:31 +0200277 sha256_hmac( ssl->ticket_keys->mac_key, 16, buf, len - 32,
278 computed_mac, 0 );
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100279
Manuel Pégourié-Gonnard56dc9e82013-08-03 17:16:31 +0200280 for( i = 0; i < 32; i++ )
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100281 diff |= mac[i] ^ computed_mac[i];
282
283 /* Now return if ticket is not authentic, since we want to avoid
284 * decrypting arbitrary attacker-chosen data */
285 if( diff != 0 )
286 return( POLARSSL_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200287
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200288 /* Decrypt */
289 if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->dec, AES_DECRYPT,
290 enc_len, iv, ticket, ticket ) ) != 0 )
291 {
292 return( ret );
293 }
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200294
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200295 /* Check PKCS padding */
296 pad_len = ticket[enc_len - 1];
297
298 ret = 0;
299 for( i = 2; i < pad_len; i++ )
300 if( ticket[enc_len - i] != pad_len )
301 ret = POLARSSL_ERR_SSL_BAD_INPUT_DATA;
302 if( ret != 0 )
303 return( ret );
304
305 clear_len = enc_len - pad_len;
306
307 SSL_DEBUG_BUF( 3, "session ticket cleartext", ticket, clear_len );
308
309 /* Actually load session */
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200310 if( ( ret = ssl_load_session( &session, ticket, clear_len ) ) != 0 )
311 {
312 SSL_DEBUG_MSG( 1, ( "failed to parse ticket content" ) );
313 memset( &session, 0, sizeof( ssl_session ) );
314 return( ret );
315 }
316
Paul Bakker606b4ba2013-08-14 16:52:14 +0200317#if defined(POLARSSL_HAVE_TIME)
318 /* Check if still valid */
319 if( (int) ( time( NULL) - session.start ) > ssl->ticket_lifetime )
320 {
321 SSL_DEBUG_MSG( 1, ( "session ticket expired" ) );
322 memset( &session, 0, sizeof( ssl_session ) );
323 return( POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED );
324 }
325#endif
326
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200327 /*
328 * Keep the session ID sent by the client, since we MUST send it back to
329 * inform him we're accepting the ticket (RFC 5077 section 3.4)
330 */
331 session.length = ssl->session_negotiate->length;
332 memcpy( &session.id, ssl->session_negotiate->id, session.length );
333
334 ssl_session_free( ssl->session_negotiate );
335 memcpy( ssl->session_negotiate, &session, sizeof( ssl_session ) );
336 memset( &session, 0, sizeof( ssl_session ) );
337
338 return( 0 );
339}
Paul Bakkera503a632013-08-14 13:48:06 +0200340#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200341
Paul Bakker0be444a2013-08-27 21:55:01 +0200342#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200343/*
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +0200344 * Wrapper around f_sni, allowing use of ssl_set_own_cert() but
345 * making it act on ssl->hanshake->sni_key_cert instead.
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200346 */
347static int ssl_sni_wrapper( ssl_context *ssl,
348 const unsigned char* name, size_t len )
349{
350 int ret;
351 ssl_key_cert *key_cert_ori = ssl->key_cert;
352
353 ssl->key_cert = NULL;
354 ret = ssl->f_sni( ssl->p_sni, ssl, name, len );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +0200355 ssl->handshake->sni_key_cert = ssl->key_cert;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200356
357 ssl->key_cert = key_cert_ori;
358
359 return( ret );
360}
361
Paul Bakker5701cdc2012-09-27 21:49:42 +0000362static int ssl_parse_servername_ext( ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000363 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +0000364 size_t len )
365{
366 int ret;
367 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +0000368 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +0000369
370 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
371 if( servername_list_size + 2 != len )
372 {
373 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
374 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
375 }
376
377 p = buf + 2;
378 while( servername_list_size > 0 )
379 {
380 hostname_len = ( ( p[1] << 8 ) | p[2] );
381 if( hostname_len + 3 > servername_list_size )
382 {
383 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
384 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
385 }
386
387 if( p[0] == TLS_EXT_SERVERNAME_HOSTNAME )
388 {
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200389 ret = ssl_sni_wrapper( ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000390 if( ret != 0 )
391 {
392 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
393 SSL_ALERT_MSG_UNRECOGNIZED_NAME );
394 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
395 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000396 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000397 }
398
399 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000400 p += hostname_len + 3;
401 }
402
403 if( servername_list_size != 0 )
404 {
405 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
406 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000407 }
408
409 return( 0 );
410}
Paul Bakker0be444a2013-08-27 21:55:01 +0200411#endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000412
Paul Bakker48916f92012-09-16 19:57:18 +0000413static int ssl_parse_renegotiation_info( ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000414 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000415 size_t len )
416{
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000417 int ret;
418
Paul Bakker48916f92012-09-16 19:57:18 +0000419 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
420 {
421 if( len != 1 || buf[0] != 0x0 )
422 {
423 SSL_DEBUG_MSG( 1, ( "non-zero length renegotiated connection field" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000424
425 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
426 return( ret );
427
Paul Bakker48916f92012-09-16 19:57:18 +0000428 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
429 }
430
431 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
432 }
433 else
434 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100435 /* Check verify-data in constant-time. The length OTOH is no secret */
Paul Bakker48916f92012-09-16 19:57:18 +0000436 if( len != 1 + ssl->verify_data_len ||
437 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100438 safer_memcmp( buf + 1, ssl->peer_verify_data,
439 ssl->verify_data_len ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +0000440 {
441 SSL_DEBUG_MSG( 1, ( "non-matching renegotiated connection field" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000442
443 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
444 return( ret );
445
Paul Bakker48916f92012-09-16 19:57:18 +0000446 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
447 }
448 }
449
450 return( 0 );
451}
452
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200453#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker23f36802012-09-28 14:15:14 +0000454static int ssl_parse_signature_algorithms_ext( ssl_context *ssl,
455 const unsigned char *buf,
456 size_t len )
457{
458 size_t sig_alg_list_size;
459 const unsigned char *p;
460
461 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
462 if( sig_alg_list_size + 2 != len ||
463 sig_alg_list_size %2 != 0 )
464 {
465 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
466 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
467 }
468
469 p = buf + 2;
470 while( sig_alg_list_size > 0 )
471 {
Manuel Pégourié-Gonnardd11eb7c2013-08-22 15:57:15 +0200472 /*
473 * For now, just ignore signature algorithm and rely on offered
474 * ciphersuites only. To be fixed later.
475 */
Paul Bakker9e36f042013-06-30 14:34:05 +0200476#if defined(POLARSSL_SHA512_C)
Paul Bakker23f36802012-09-28 14:15:14 +0000477 if( p[0] == SSL_HASH_SHA512 )
478 {
479 ssl->handshake->sig_alg = SSL_HASH_SHA512;
480 break;
481 }
482 if( p[0] == SSL_HASH_SHA384 )
483 {
484 ssl->handshake->sig_alg = SSL_HASH_SHA384;
485 break;
486 }
487#endif
Paul Bakker9e36f042013-06-30 14:34:05 +0200488#if defined(POLARSSL_SHA256_C)
Paul Bakker23f36802012-09-28 14:15:14 +0000489 if( p[0] == SSL_HASH_SHA256 )
490 {
491 ssl->handshake->sig_alg = SSL_HASH_SHA256;
492 break;
493 }
494 if( p[0] == SSL_HASH_SHA224 )
495 {
496 ssl->handshake->sig_alg = SSL_HASH_SHA224;
497 break;
498 }
499#endif
500 if( p[0] == SSL_HASH_SHA1 )
501 {
502 ssl->handshake->sig_alg = SSL_HASH_SHA1;
503 break;
504 }
505 if( p[0] == SSL_HASH_MD5 )
506 {
507 ssl->handshake->sig_alg = SSL_HASH_MD5;
508 break;
509 }
510
511 sig_alg_list_size -= 2;
512 p += 2;
513 }
514
515 SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
516 ssl->handshake->sig_alg ) );
517
518 return( 0 );
519}
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200520#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker23f36802012-09-28 14:15:14 +0000521
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +0200522#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200523static int ssl_parse_supported_elliptic_curves( ssl_context *ssl,
524 const unsigned char *buf,
525 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100526{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200527 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100528 const unsigned char *p;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200529 const ecp_curve_info *curve_info, **curves;
Paul Bakker41c83d32013-03-20 14:39:14 +0100530
531 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
532 if( list_size + 2 != len ||
533 list_size % 2 != 0 )
534 {
535 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
536 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
537 }
538
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200539 /* Don't allow our peer to make use allocated too much memory,
540 * and leave room for a final 0 */
541 our_size = list_size / 2 + 1;
542 if( our_size > POLARSSL_ECP_DP_MAX )
543 our_size = POLARSSL_ECP_DP_MAX;
544
545 if( ( curves = polarssl_malloc( our_size * sizeof( *curves ) ) ) == NULL )
546 return( POLARSSL_ERR_SSL_MALLOC_FAILED );
547
Paul Bakkerbeccd9f2013-10-11 15:20:27 +0200548 /* explicit void pointer cast for buggy MS compiler */
549 memset( (void *) curves, 0, our_size * sizeof( *curves ) );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200550 ssl->handshake->curves = curves;
551
Paul Bakker41c83d32013-03-20 14:39:14 +0100552 p = buf + 2;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200553 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100554 {
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200555 curve_info = ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200556
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200557 if( curve_info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100558 {
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200559 *curves++ = curve_info;
560 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100561 }
562
563 list_size -= 2;
564 p += 2;
565 }
566
567 return( 0 );
568}
569
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200570static int ssl_parse_supported_point_formats( ssl_context *ssl,
571 const unsigned char *buf,
572 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100573{
574 size_t list_size;
575 const unsigned char *p;
576
577 list_size = buf[0];
578 if( list_size + 1 != len )
579 {
580 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
581 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
582 }
583
584 p = buf + 2;
585 while( list_size > 0 )
586 {
587 if( p[0] == POLARSSL_ECP_PF_UNCOMPRESSED ||
588 p[0] == POLARSSL_ECP_PF_COMPRESSED )
589 {
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200590 ssl->handshake->ecdh_ctx.point_format = p[0];
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +0200591 SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100592 return( 0 );
593 }
594
595 list_size--;
596 p++;
597 }
598
599 return( 0 );
600}
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +0200601#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
Paul Bakker41c83d32013-03-20 14:39:14 +0100602
Paul Bakker05decb22013-08-15 13:33:48 +0200603#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200604static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
605 const unsigned char *buf,
606 size_t len )
607{
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200608 if( len != 1 || buf[0] >= SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200609 {
610 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
611 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
612 }
613
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200614 ssl->session_negotiate->mfl_code = buf[0];
615
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200616 return( 0 );
617}
Paul Bakker05decb22013-08-15 13:33:48 +0200618#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200619
Paul Bakker1f2bc622013-08-15 13:45:55 +0200620#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200621static int ssl_parse_truncated_hmac_ext( ssl_context *ssl,
622 const unsigned char *buf,
623 size_t len )
624{
625 if( len != 0 )
626 {
627 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
628 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
629 }
630
631 ((void) buf);
632
633 ssl->session_negotiate->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
634
635 return( 0 );
636}
Paul Bakker1f2bc622013-08-15 13:45:55 +0200637#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200638
Paul Bakkera503a632013-08-14 13:48:06 +0200639#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200640static int ssl_parse_session_ticket_ext( ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200641 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200642 size_t len )
643{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200644 int ret;
645
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200646 if( ssl->session_tickets == SSL_SESSION_TICKETS_DISABLED )
647 return( 0 );
648
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200649 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200650 ssl->handshake->new_session_ticket = 1;
651
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200652 SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
653
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200654 if( len == 0 )
655 return( 0 );
656
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200657 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
658 {
659 SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
660 return( 0 );
661 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200662
663 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200664 * Failures are ok: just ignore the ticket and proceed.
665 */
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200666 if( ( ret = ssl_parse_ticket( ssl, buf, len ) ) != 0 )
667 {
668 SSL_DEBUG_RET( 1, "ssl_parse_ticket", ret );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200669 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200670 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200671
672 SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
673
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200674 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200675
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200676 /* Don't send a new ticket after all, this one is OK */
677 ssl->handshake->new_session_ticket = 0;
678
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200679 return( 0 );
680}
Paul Bakkera503a632013-08-14 13:48:06 +0200681#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200682
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100683/*
684 * Auxiliary functions for ServerHello parsing and related actions
685 */
686
687#if defined(POLARSSL_X509_CRT_PARSE_C)
688/*
689 * Return 1 if the given EC key uses the given curve, 0 otherwise
690 */
691#if defined(POLARSSL_ECDSA_C)
692static int ssl_key_matches_curves( pk_context *pk,
693 const ecp_curve_info **curves )
694{
695 const ecp_curve_info **crv = curves;
696 ecp_group_id grp_id = pk_ec( *pk )->grp.id;
697
698 while( *crv != NULL )
699 {
700 if( (*crv)->grp_id == grp_id )
701 return( 1 );
702 crv++;
703 }
704
705 return( 0 );
706}
707#endif /* POLARSSL_ECDSA_C */
708
709/*
710 * Try picking a certificate for this ciphersuite,
711 * return 0 on success and -1 on failure.
712 */
713static int ssl_pick_cert( ssl_context *ssl,
714 const ssl_ciphersuite_t * ciphersuite_info )
715{
716 ssl_key_cert *cur, *list;
717 pk_type_t pk_alg = ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
718
719#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
720 if( ssl->handshake->sni_key_cert != NULL )
721 list = ssl->handshake->sni_key_cert;
722 else
723#endif
724 list = ssl->handshake->key_cert;
725
726 if( pk_alg == POLARSSL_PK_NONE )
727 return( 0 );
728
729 for( cur = list; cur != NULL; cur = cur->next )
730 {
731 if( ! pk_can_do( cur->key, pk_alg ) )
732 continue;
733
734#if defined(POLARSSL_ECDSA_C)
735 if( pk_alg == POLARSSL_PK_ECDSA )
736 {
737 if( ssl_key_matches_curves( cur->key, ssl->handshake->curves ) )
738 break;
739 }
740 else
741#endif
742 break;
743 }
744
745 if( cur == NULL )
746 return( -1 );
747
748 ssl->handshake->key_cert = cur;
749 return( 0 );
750}
751#endif /* POLARSSL_X509_CRT_PARSE_C */
752
753/*
754 * Check if a given ciphersuite is suitable for use with our config/keys/etc
755 * Sets ciphersuite_info only if the suite matches.
756 */
757static int ssl_ciphersuite_match( ssl_context *ssl, int suite_id,
758 const ssl_ciphersuite_t **ciphersuite_info )
759{
760 const ssl_ciphersuite_t *suite_info;
761
762 suite_info = ssl_ciphersuite_from_id( suite_id );
763 if( suite_info == NULL )
764 {
765 SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", suite_id ) );
766 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
767 }
768
769 if( suite_info->min_minor_ver > ssl->minor_ver ||
770 suite_info->max_minor_ver < ssl->minor_ver )
771 return( 0 );
772
773#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
774 if( ssl_ciphersuite_uses_ec( suite_info ) &&
775 ( ssl->handshake->curves == NULL ||
776 ssl->handshake->curves[0] == NULL ) )
777 return( 0 );
778#endif
779
780#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
781 /* If the ciphersuite requires a pre-shared key and we don't
782 * have one, skip it now rather than failing later */
783 if( ssl_ciphersuite_uses_psk( suite_info ) &&
784 ssl->f_psk == NULL &&
785 ( ssl->psk == NULL || ssl->psk_identity == NULL ||
786 ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
787 return( 0 );
788#endif
789
790#if defined(POLARSSL_X509_CRT_PARSE_C)
791 /*
792 * Final check: if ciphersuite requires us to have a
793 * certificate/key of a particular type:
794 * - select the appropriate certificate if we have one, or
795 * - try the next ciphersuite if we don't
796 * This must be done last since we modify the key_cert list.
797 */
798 if( ssl_pick_cert( ssl, suite_info ) != 0 )
799 return( 0 );
800#endif
801
802 *ciphersuite_info = suite_info;
803 return( 0 );
804}
805
Paul Bakker78a8c712013-03-06 17:01:52 +0100806#if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
807static int ssl_parse_client_hello_v2( ssl_context *ssl )
808{
809 int ret;
810 unsigned int i, j;
811 size_t n;
812 unsigned int ciph_len, sess_len, chal_len;
813 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200814 const int *ciphersuites;
Paul Bakker59c28a22013-06-29 15:33:42 +0200815 const ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +0100816
817 SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
818
819 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
820 {
821 SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
822
823 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
824 return( ret );
825
826 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
827 }
828
829 buf = ssl->in_hdr;
830
831 SSL_DEBUG_BUF( 4, "record header", buf, 5 );
832
833 SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
834 buf[2] ) );
835 SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
836 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
837 SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
838 buf[3], buf[4] ) );
839
840 /*
841 * SSLv2 Client Hello
842 *
843 * Record layer:
844 * 0 . 1 message length
845 *
846 * SSL layer:
847 * 2 . 2 message type
848 * 3 . 4 protocol version
849 */
850 if( buf[2] != SSL_HS_CLIENT_HELLO ||
851 buf[3] != SSL_MAJOR_VERSION_3 )
852 {
853 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
854 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
855 }
856
857 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
858
859 if( n < 17 || n > 512 )
860 {
861 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
862 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
863 }
864
865 ssl->major_ver = SSL_MAJOR_VERSION_3;
Paul Bakker2fbefde2013-06-29 16:01:15 +0200866 ssl->minor_ver = ( buf[4] <= ssl->max_minor_ver )
867 ? buf[4] : ssl->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +0100868
869 if( ssl->minor_ver < ssl->min_minor_ver )
870 {
871 SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
872 " [%d:%d] < [%d:%d]", ssl->major_ver, ssl->minor_ver,
873 ssl->min_major_ver, ssl->min_minor_ver ) );
874
875 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
876 SSL_ALERT_MSG_PROTOCOL_VERSION );
877 return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
878 }
879
Paul Bakker2fbefde2013-06-29 16:01:15 +0200880 ssl->handshake->max_major_ver = buf[3];
881 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +0100882
883 if( ( ret = ssl_fetch_input( ssl, 2 + n ) ) != 0 )
884 {
885 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
886 return( ret );
887 }
888
889 ssl->handshake->update_checksum( ssl, buf + 2, n );
890
891 buf = ssl->in_msg;
892 n = ssl->in_left - 5;
893
894 /*
895 * 0 . 1 ciphersuitelist length
896 * 2 . 3 session id length
897 * 4 . 5 challenge length
898 * 6 . .. ciphersuitelist
899 * .. . .. session id
900 * .. . .. challenge
901 */
902 SSL_DEBUG_BUF( 4, "record contents", buf, n );
903
904 ciph_len = ( buf[0] << 8 ) | buf[1];
905 sess_len = ( buf[2] << 8 ) | buf[3];
906 chal_len = ( buf[4] << 8 ) | buf[5];
907
908 SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
909 ciph_len, sess_len, chal_len ) );
910
911 /*
912 * Make sure each parameter length is valid
913 */
914 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
915 {
916 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
917 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
918 }
919
920 if( sess_len > 32 )
921 {
922 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
923 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
924 }
925
926 if( chal_len < 8 || chal_len > 32 )
927 {
928 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
929 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
930 }
931
932 if( n != 6 + ciph_len + sess_len + chal_len )
933 {
934 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
935 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
936 }
937
938 SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
939 buf + 6, ciph_len );
940 SSL_DEBUG_BUF( 3, "client hello, session id",
941 buf + 6 + ciph_len, sess_len );
942 SSL_DEBUG_BUF( 3, "client hello, challenge",
943 buf + 6 + ciph_len + sess_len, chal_len );
944
945 p = buf + 6 + ciph_len;
946 ssl->session_negotiate->length = sess_len;
947 memset( ssl->session_negotiate->id, 0, sizeof( ssl->session_negotiate->id ) );
948 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->length );
949
950 p += sess_len;
951 memset( ssl->handshake->randbytes, 0, 64 );
952 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
953
954 /*
955 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
956 */
957 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
958 {
959 if( p[0] == 0 && p[1] == 0 && p[2] == SSL_EMPTY_RENEGOTIATION_INFO )
960 {
961 SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
962 if( ssl->renegotiation == SSL_RENEGOTIATION )
963 {
964 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
965
966 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
967 return( ret );
968
969 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
970 }
971 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
972 break;
973 }
974 }
975
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200976 ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100977 ciphersuite_info = NULL;
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200978 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +0100979 {
980 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
981 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100982 if( p[0] != 0 ||
983 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
984 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
985 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +0200986
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100987 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
988 &ciphersuite_info ) ) != 0 )
989 return( ret );
Paul Bakker59c28a22013-06-29 15:33:42 +0200990
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100991 if( ciphersuite_info != NULL )
Paul Bakker78a8c712013-03-06 17:01:52 +0100992 goto have_ciphersuite_v2;
993 }
994 }
995
996 SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
997
998 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
999
1000have_ciphersuite_v2:
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001001 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker59c28a22013-06-29 15:33:42 +02001002 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Paul Bakker41c83d32013-03-20 14:39:14 +01001003 ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Paul Bakker78a8c712013-03-06 17:01:52 +01001004
1005 /*
1006 * SSLv2 Client Hello relevant renegotiation security checks
1007 */
1008 if( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1009 ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
1010 {
1011 SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1012
1013 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1014 return( ret );
1015
1016 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1017 }
1018
1019 ssl->in_left = 0;
1020 ssl->state++;
1021
1022 SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
1023
1024 return( 0 );
1025}
1026#endif /* POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
1027
Paul Bakker5121ce52009-01-03 21:22:43 +00001028static int ssl_parse_client_hello( ssl_context *ssl )
1029{
Paul Bakker23986e52011-04-24 08:57:21 +00001030 int ret;
1031 unsigned int i, j;
1032 size_t n;
1033 unsigned int ciph_len, sess_len;
Paul Bakkerec636f32012-09-09 19:17:02 +00001034 unsigned int comp_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001035 unsigned int ext_len = 0;
1036 unsigned char *buf, *p, *ext;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001037 int renegotiation_info_seen = 0;
1038 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001039 const int *ciphersuites;
Paul Bakker41c83d32013-03-20 14:39:14 +01001040 const ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00001041
1042 SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
1043
Paul Bakker48916f92012-09-16 19:57:18 +00001044 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
1045 ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001046 {
1047 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1048 return( ret );
1049 }
1050
1051 buf = ssl->in_hdr;
1052
Paul Bakker78a8c712013-03-06 17:01:52 +01001053#if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1054 if( ( buf[0] & 0x80 ) != 0 )
1055 return ssl_parse_client_hello_v2( ssl );
1056#endif
1057
Paul Bakkerec636f32012-09-09 19:17:02 +00001058 SSL_DEBUG_BUF( 4, "record header", buf, 5 );
1059
1060 SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
1061 buf[0] ) );
1062 SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
1063 ( buf[3] << 8 ) | buf[4] ) );
1064 SSL_DEBUG_MSG( 3, ( "client hello v3, protocol ver: [%d:%d]",
1065 buf[1], buf[2] ) );
1066
1067 /*
1068 * SSLv3 Client Hello
1069 *
1070 * Record layer:
1071 * 0 . 0 message type
1072 * 1 . 2 protocol version
1073 * 3 . 4 message length
1074 */
1075 if( buf[0] != SSL_MSG_HANDSHAKE ||
1076 buf[1] != SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001077 {
Paul Bakkerec636f32012-09-09 19:17:02 +00001078 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1079 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1080 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001081
Paul Bakkerec636f32012-09-09 19:17:02 +00001082 n = ( buf[3] << 8 ) | buf[4];
Paul Bakker5121ce52009-01-03 21:22:43 +00001083
Manuel Pégourié-Gonnard72882b22013-08-02 13:36:00 +02001084 if( n < 45 || n > 2048 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001085 {
1086 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1087 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1088 }
1089
Paul Bakker48916f92012-09-16 19:57:18 +00001090 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
1091 ( ret = ssl_fetch_input( ssl, 5 + n ) ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001092 {
1093 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1094 return( ret );
1095 }
1096
1097 buf = ssl->in_msg;
Paul Bakker48916f92012-09-16 19:57:18 +00001098 if( !ssl->renegotiation )
1099 n = ssl->in_left - 5;
1100 else
1101 n = ssl->in_msglen;
Paul Bakkerec636f32012-09-09 19:17:02 +00001102
Paul Bakker48916f92012-09-16 19:57:18 +00001103 ssl->handshake->update_checksum( ssl, buf, n );
Paul Bakkerec636f32012-09-09 19:17:02 +00001104
1105 /*
1106 * SSL layer:
1107 * 0 . 0 handshake type
1108 * 1 . 3 handshake length
1109 * 4 . 5 protocol version
1110 * 6 . 9 UNIX time()
1111 * 10 . 37 random bytes
1112 * 38 . 38 session id length
1113 * 39 . 38+x session id
1114 * 39+x . 40+x ciphersuitelist length
1115 * 41+x . .. ciphersuitelist
1116 * .. . .. compression alg.
1117 * .. . .. extensions
1118 */
1119 SSL_DEBUG_BUF( 4, "record contents", buf, n );
1120
1121 SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d",
1122 buf[0] ) );
1123 SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
1124 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1125 SSL_DEBUG_MSG( 3, ( "client hello v3, max. version: [%d:%d]",
1126 buf[4], buf[5] ) );
1127
1128 /*
1129 * Check the handshake type and protocol version
1130 */
1131 if( buf[0] != SSL_HS_CLIENT_HELLO ||
1132 buf[4] != SSL_MAJOR_VERSION_3 )
1133 {
1134 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1135 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1136 }
1137
1138 ssl->major_ver = SSL_MAJOR_VERSION_3;
Paul Bakker2fbefde2013-06-29 16:01:15 +02001139 ssl->minor_ver = ( buf[5] <= ssl->max_minor_ver )
1140 ? buf[5] : ssl->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001141
Paul Bakker1d29fb52012-09-28 13:28:45 +00001142 if( ssl->minor_ver < ssl->min_minor_ver )
1143 {
1144 SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
1145 " [%d:%d] < [%d:%d]", ssl->major_ver, ssl->minor_ver,
Paul Bakker81420ab2012-10-23 10:31:15 +00001146 ssl->min_major_ver, ssl->min_minor_ver ) );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001147
1148 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
1149 SSL_ALERT_MSG_PROTOCOL_VERSION );
1150
1151 return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1152 }
1153
Paul Bakker2fbefde2013-06-29 16:01:15 +02001154 ssl->handshake->max_major_ver = buf[4];
1155 ssl->handshake->max_minor_ver = buf[5];
Paul Bakkerec636f32012-09-09 19:17:02 +00001156
Paul Bakker48916f92012-09-16 19:57:18 +00001157 memcpy( ssl->handshake->randbytes, buf + 6, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001158
1159 /*
1160 * Check the handshake message length
1161 */
1162 if( buf[1] != 0 || n != (unsigned int) 4 + ( ( buf[2] << 8 ) | buf[3] ) )
1163 {
1164 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1165 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1166 }
1167
1168 /*
1169 * Check the session length
1170 */
1171 sess_len = buf[38];
1172
1173 if( sess_len > 32 )
1174 {
1175 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1176 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1177 }
1178
Paul Bakker48916f92012-09-16 19:57:18 +00001179 ssl->session_negotiate->length = sess_len;
1180 memset( ssl->session_negotiate->id, 0,
1181 sizeof( ssl->session_negotiate->id ) );
1182 memcpy( ssl->session_negotiate->id, buf + 39,
1183 ssl->session_negotiate->length );
Paul Bakkerec636f32012-09-09 19:17:02 +00001184
1185 /*
1186 * Check the ciphersuitelist length
1187 */
1188 ciph_len = ( buf[39 + sess_len] << 8 )
1189 | ( buf[40 + sess_len] );
1190
1191 if( ciph_len < 2 || ciph_len > 256 || ( ciph_len % 2 ) != 0 )
1192 {
1193 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1194 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1195 }
1196
1197 /*
1198 * Check the compression algorithms length
1199 */
1200 comp_len = buf[41 + sess_len + ciph_len];
1201
1202 if( comp_len < 1 || comp_len > 16 )
1203 {
1204 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1205 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1206 }
1207
Paul Bakker48916f92012-09-16 19:57:18 +00001208 /*
1209 * Check the extension length
1210 */
1211 if( n > 42 + sess_len + ciph_len + comp_len )
1212 {
1213 ext_len = ( buf[42 + sess_len + ciph_len + comp_len] << 8 )
1214 | ( buf[43 + sess_len + ciph_len + comp_len] );
1215
1216 if( ( ext_len > 0 && ext_len < 4 ) ||
1217 n != 44 + sess_len + ciph_len + comp_len + ext_len )
1218 {
1219 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1220 SSL_DEBUG_BUF( 3, "Ext", buf + 44 + sess_len + ciph_len + comp_len, ext_len);
1221 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1222 }
1223 }
1224
1225 ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
Paul Bakkerec636f32012-09-09 19:17:02 +00001226#if defined(POLARSSL_ZLIB_SUPPORT)
1227 for( i = 0; i < comp_len; ++i )
1228 {
Paul Bakker48916f92012-09-16 19:57:18 +00001229 if( buf[42 + sess_len + ciph_len + i] == SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001230 {
Paul Bakker48916f92012-09-16 19:57:18 +00001231 ssl->session_negotiate->compression = SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001232 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001233 }
1234 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001235#endif
1236
Paul Bakkerec636f32012-09-09 19:17:02 +00001237 SSL_DEBUG_BUF( 3, "client hello, random bytes",
1238 buf + 6, 32 );
1239 SSL_DEBUG_BUF( 3, "client hello, session id",
1240 buf + 38, sess_len );
1241 SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
1242 buf + 41 + sess_len, ciph_len );
1243 SSL_DEBUG_BUF( 3, "client hello, compression",
1244 buf + 42 + sess_len + ciph_len, comp_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001245
Paul Bakkerec636f32012-09-09 19:17:02 +00001246 /*
Paul Bakker48916f92012-09-16 19:57:18 +00001247 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1248 */
1249 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
1250 {
1251 if( p[0] == 0 && p[1] == SSL_EMPTY_RENEGOTIATION_INFO )
1252 {
1253 SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1254 if( ssl->renegotiation == SSL_RENEGOTIATION )
1255 {
1256 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001257
1258 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1259 return( ret );
1260
Paul Bakker48916f92012-09-16 19:57:18 +00001261 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1262 }
1263 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
1264 break;
1265 }
1266 }
1267
Paul Bakker48916f92012-09-16 19:57:18 +00001268 ext = buf + 44 + sess_len + ciph_len + comp_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001269
1270 while( ext_len )
1271 {
1272 unsigned int ext_id = ( ( ext[0] << 8 )
1273 | ( ext[1] ) );
1274 unsigned int ext_size = ( ( ext[2] << 8 )
1275 | ( ext[3] ) );
1276
1277 if( ext_size + 4 > ext_len )
1278 {
1279 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1280 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1281 }
1282 switch( ext_id )
1283 {
Paul Bakker0be444a2013-08-27 21:55:01 +02001284#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
Paul Bakker5701cdc2012-09-27 21:49:42 +00001285 case TLS_EXT_SERVERNAME:
1286 SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1287 if( ssl->f_sni == NULL )
1288 break;
1289
1290 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1291 if( ret != 0 )
1292 return( ret );
1293 break;
Paul Bakker0be444a2013-08-27 21:55:01 +02001294#endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001295
Paul Bakker48916f92012-09-16 19:57:18 +00001296 case TLS_EXT_RENEGOTIATION_INFO:
1297 SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
1298 renegotiation_info_seen = 1;
1299
Paul Bakker23f36802012-09-28 14:15:14 +00001300 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1301 if( ret != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001302 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00001303 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001304
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001305#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker23f36802012-09-28 14:15:14 +00001306 case TLS_EXT_SIG_ALG:
1307 SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1308 if( ssl->renegotiation == SSL_RENEGOTIATION )
1309 break;
1310
1311 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1312 if( ret != 0 )
1313 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00001314 break;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001315#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker48916f92012-09-16 19:57:18 +00001316
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001317#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Paul Bakker41c83d32013-03-20 14:39:14 +01001318 case TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1319 SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
1320
1321 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1322 if( ret != 0 )
1323 return( ret );
1324 break;
1325
1326 case TLS_EXT_SUPPORTED_POINT_FORMATS:
1327 SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
Paul Bakker677377f2013-10-28 12:54:26 +01001328 ssl->handshake->cli_exts |= TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001329
1330 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1331 if( ret != 0 )
1332 return( ret );
1333 break;
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001334#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
Paul Bakker41c83d32013-03-20 14:39:14 +01001335
Paul Bakker05decb22013-08-15 13:33:48 +02001336#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001337 case TLS_EXT_MAX_FRAGMENT_LENGTH:
1338 SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
1339
1340 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1341 if( ret != 0 )
1342 return( ret );
1343 break;
Paul Bakker05decb22013-08-15 13:33:48 +02001344#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001345
Paul Bakker1f2bc622013-08-15 13:45:55 +02001346#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001347 case TLS_EXT_TRUNCATED_HMAC:
1348 SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
1349
1350 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1351 if( ret != 0 )
1352 return( ret );
1353 break;
Paul Bakker1f2bc622013-08-15 13:45:55 +02001354#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001355
Paul Bakkera503a632013-08-14 13:48:06 +02001356#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001357 case TLS_EXT_SESSION_TICKET:
1358 SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
1359
1360 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1361 if( ret != 0 )
1362 return( ret );
1363 break;
Paul Bakkera503a632013-08-14 13:48:06 +02001364#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001365
Paul Bakker48916f92012-09-16 19:57:18 +00001366 default:
1367 SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1368 ext_id ) );
1369 }
1370
1371 ext_len -= 4 + ext_size;
1372 ext += 4 + ext_size;
1373
1374 if( ext_len > 0 && ext_len < 4 )
1375 {
1376 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1377 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1378 }
1379 }
1380
1381 /*
1382 * Renegotiation security checks
1383 */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001384 if( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1385 ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
1386 {
1387 SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1388 handshake_failure = 1;
1389 }
1390 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1391 ssl->secure_renegotiation == SSL_SECURE_RENEGOTIATION &&
1392 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001393 {
1394 SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001395 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00001396 }
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001397 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1398 ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1399 ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00001400 {
1401 SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001402 handshake_failure = 1;
1403 }
1404 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1405 ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1406 renegotiation_info_seen == 1 )
1407 {
1408 SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
1409 handshake_failure = 1;
1410 }
1411
1412 if( handshake_failure == 1 )
1413 {
1414 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1415 return( ret );
1416
Paul Bakker48916f92012-09-16 19:57:18 +00001417 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1418 }
Paul Bakker380da532012-04-18 16:10:25 +00001419
Paul Bakker41c83d32013-03-20 14:39:14 +01001420 /*
1421 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02001422 * (At the end because we need information from the EC-based extensions
1423 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01001424 */
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001425 ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01001426 ciphersuite_info = NULL;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001427 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker41c83d32013-03-20 14:39:14 +01001428 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001429 for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
Paul Bakker41c83d32013-03-20 14:39:14 +01001430 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001431 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1432 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1433 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01001434
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001435 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1436 &ciphersuite_info ) ) != 0 )
1437 return( ret );
1438
1439 if( ciphersuite_info != NULL )
1440 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01001441 }
1442 }
1443
1444 SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1445
1446 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1447 return( ret );
1448
1449 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
1450
1451have_ciphersuite:
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001452 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker41c83d32013-03-20 14:39:14 +01001453 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
1454 ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
1455
Paul Bakker5121ce52009-01-03 21:22:43 +00001456 ssl->in_left = 0;
1457 ssl->state++;
1458
1459 SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
1460
1461 return( 0 );
1462}
1463
Paul Bakker1f2bc622013-08-15 13:45:55 +02001464#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001465static void ssl_write_truncated_hmac_ext( ssl_context *ssl,
1466 unsigned char *buf,
1467 size_t *olen )
1468{
1469 unsigned char *p = buf;
1470
1471 if( ssl->session_negotiate->trunc_hmac == SSL_TRUNC_HMAC_DISABLED )
1472 {
1473 *olen = 0;
1474 return;
1475 }
1476
1477 SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
1478
1479 *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
1480 *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
1481
1482 *p++ = 0x00;
1483 *p++ = 0x00;
1484
1485 *olen = 4;
1486}
Paul Bakker1f2bc622013-08-15 13:45:55 +02001487#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001488
Paul Bakkera503a632013-08-14 13:48:06 +02001489#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001490static void ssl_write_session_ticket_ext( ssl_context *ssl,
1491 unsigned char *buf,
1492 size_t *olen )
1493{
1494 unsigned char *p = buf;
1495
1496 if( ssl->handshake->new_session_ticket == 0 )
1497 {
1498 *olen = 0;
1499 return;
1500 }
1501
1502 SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
1503
1504 *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
1505 *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET ) & 0xFF );
1506
1507 *p++ = 0x00;
1508 *p++ = 0x00;
1509
1510 *olen = 4;
1511}
Paul Bakkera503a632013-08-14 13:48:06 +02001512#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001513
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001514static void ssl_write_renegotiation_ext( ssl_context *ssl,
1515 unsigned char *buf,
1516 size_t *olen )
1517{
1518 unsigned char *p = buf;
1519
1520 if( ssl->secure_renegotiation != SSL_SECURE_RENEGOTIATION )
1521 {
1522 *olen = 0;
1523 return;
1524 }
1525
1526 SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
1527
1528 *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
1529 *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
1530
1531 *p++ = 0x00;
1532 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
1533 *p++ = ssl->verify_data_len * 2 & 0xFF;
1534
1535 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
1536 p += ssl->verify_data_len;
1537 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
1538 p += ssl->verify_data_len;
1539
1540 *olen = 5 + ssl->verify_data_len * 2;
1541}
1542
Paul Bakker05decb22013-08-15 13:33:48 +02001543#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001544static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
1545 unsigned char *buf,
1546 size_t *olen )
1547{
1548 unsigned char *p = buf;
1549
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02001550 if( ssl->session_negotiate->mfl_code == SSL_MAX_FRAG_LEN_NONE )
1551 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001552 *olen = 0;
1553 return;
1554 }
1555
1556 SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
1557
1558 *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
1559 *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
1560
1561 *p++ = 0x00;
1562 *p++ = 1;
1563
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02001564 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001565
1566 *olen = 5;
1567}
Paul Bakker05decb22013-08-15 13:33:48 +02001568#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001569
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001570#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001571static void ssl_write_supported_point_formats_ext( ssl_context *ssl,
1572 unsigned char *buf,
1573 size_t *olen )
1574{
1575 unsigned char *p = buf;
1576 ((void) ssl);
1577
Paul Bakker677377f2013-10-28 12:54:26 +01001578 if( ( ssl->handshake->cli_exts &
1579 TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
1580 {
1581 *olen = 0;
1582 return;
1583 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001584
1585 SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
1586
1587 *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
1588 *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
1589
1590 *p++ = 0x00;
1591 *p++ = 2;
1592
1593 *p++ = 1;
1594 *p++ = POLARSSL_ECP_PF_UNCOMPRESSED;
1595
1596 *olen = 6;
1597}
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001598#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001599
Paul Bakker5121ce52009-01-03 21:22:43 +00001600static int ssl_write_server_hello( ssl_context *ssl )
1601{
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001602#if defined(POLARSSL_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +00001603 time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001604#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001605 int ret;
1606 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00001607 unsigned char *buf, *p;
1608
1609 SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
1610
Paul Bakkera9a028e2013-11-21 17:31:06 +01001611 if( ssl->f_rng == NULL )
1612 {
1613 SSL_DEBUG_MSG( 1, ( "no RNG provided") );
1614 return( POLARSSL_ERR_SSL_NO_RNG );
1615 }
1616
Paul Bakker5121ce52009-01-03 21:22:43 +00001617 /*
1618 * 0 . 0 handshake type
1619 * 1 . 3 handshake length
1620 * 4 . 5 protocol version
1621 * 6 . 9 UNIX time()
1622 * 10 . 37 random bytes
1623 */
1624 buf = ssl->out_msg;
1625 p = buf + 4;
1626
1627 *p++ = (unsigned char) ssl->major_ver;
1628 *p++ = (unsigned char) ssl->minor_ver;
1629
1630 SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
1631 buf[4], buf[5] ) );
1632
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001633#if defined(POLARSSL_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +00001634 t = time( NULL );
1635 *p++ = (unsigned char)( t >> 24 );
1636 *p++ = (unsigned char)( t >> 16 );
1637 *p++ = (unsigned char)( t >> 8 );
1638 *p++ = (unsigned char)( t );
1639
1640 SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001641#else
1642 if( ( ret = ssl->f_rng( ssl->p_rng, p, 4 ) ) != 0 )
1643 return( ret );
1644
1645 p += 4;
1646#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001647
Paul Bakkera3d195c2011-11-27 21:07:34 +00001648 if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
1649 return( ret );
1650
1651 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00001652
Paul Bakker48916f92012-09-16 19:57:18 +00001653 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001654
1655 SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
1656
1657 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001658 * Resume is 0 by default, see ssl_handshake_init().
1659 * It may be already set to 1 by ssl_parse_session_ticket_ext().
1660 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00001661 */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001662 if( ssl->handshake->resume == 0 &&
1663 ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02001664 ssl->session_negotiate->length != 0 &&
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001665 ssl->f_get_cache != NULL &&
1666 ssl->f_get_cache( ssl->p_get_cache, ssl->session_negotiate ) == 0 )
1667 {
1668 ssl->handshake->resume = 1;
1669 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001670
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001671 if( ssl->handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001672 {
1673 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001674 * New session, create a new session id,
1675 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00001676 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001677 ssl->state++;
1678
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02001679#if defined(POLARSSL_HAVE_TIME)
1680 ssl->session_negotiate->start = time( NULL );
1681#endif
1682
Paul Bakkera503a632013-08-14 13:48:06 +02001683#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02001684 if( ssl->handshake->new_session_ticket != 0 )
1685 {
1686 ssl->session_negotiate->length = n = 0;
1687 memset( ssl->session_negotiate->id, 0, 32 );
1688 }
1689 else
1690#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001691 {
1692 ssl->session_negotiate->length = n = 32;
1693 if( ( ret = ssl->f_rng( ssl->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02001694 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001695 return( ret );
1696 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001697 }
1698 else
1699 {
1700 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001701 * Resuming a session
Paul Bakker5121ce52009-01-03 21:22:43 +00001702 */
Paul Bakkerf0e39ac2013-08-15 11:40:48 +02001703 n = ssl->session_negotiate->length;
Paul Bakker5121ce52009-01-03 21:22:43 +00001704 ssl->state = SSL_SERVER_CHANGE_CIPHER_SPEC;
Paul Bakkerff60ee62010-03-16 21:09:09 +00001705
1706 if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
1707 {
1708 SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
1709 return( ret );
1710 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001711 }
1712
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001713 /*
1714 * 38 . 38 session id length
1715 * 39 . 38+n session id
1716 * 39+n . 40+n chosen ciphersuite
1717 * 41+n . 41+n chosen compression alg.
1718 * 42+n . 43+n extensions length
1719 * 44+n . 43+n+m extensions
1720 */
1721 *p++ = (unsigned char) ssl->session_negotiate->length;
Paul Bakker48916f92012-09-16 19:57:18 +00001722 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->length );
1723 p += ssl->session_negotiate->length;
Paul Bakker5121ce52009-01-03 21:22:43 +00001724
1725 SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
1726 SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
1727 SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Paul Bakker0a597072012-09-25 21:55:46 +00001728 ssl->handshake->resume ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001729
Paul Bakker48916f92012-09-16 19:57:18 +00001730 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
1731 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
1732 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00001733
Manuel Pégourié-Gonnard51451f82013-09-17 12:06:25 +02001734 SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
1735 ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +02001736 SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00001737 ssl->session_negotiate->compression ) );
1738
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001739 /*
1740 * First write extensions, then the total length
1741 */
1742 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
1743 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00001744
Paul Bakker05decb22013-08-15 13:33:48 +02001745#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001746 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
1747 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02001748#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001749
Paul Bakker1f2bc622013-08-15 13:45:55 +02001750#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001751 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
1752 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02001753#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001754
Paul Bakkera503a632013-08-14 13:48:06 +02001755#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001756 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
1757 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02001758#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001759
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001760#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001761 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
1762 ext_len += olen;
1763#endif
1764
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001765 SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001766
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001767 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1768 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
1769 p += ext_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001770
1771 ssl->out_msglen = p - buf;
1772 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
1773 ssl->out_msg[0] = SSL_HS_SERVER_HELLO;
1774
1775 ret = ssl_write_record( ssl );
1776
1777 SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
1778
1779 return( ret );
1780}
1781
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001782#if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \
1783 !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02001784 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
1785 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Paul Bakker5121ce52009-01-03 21:22:43 +00001786static int ssl_write_certificate_request( ssl_context *ssl )
1787{
Paul Bakkered27a042013-04-18 22:46:23 +02001788 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
1789 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001790
1791 SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
1792
1793 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01001794 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02001795 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
1796 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001797 {
1798 SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
1799 ssl->state++;
1800 return( 0 );
1801 }
1802
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02001803 SSL_DEBUG_MSG( 1, ( "should not happen" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001804 return( ret );
1805}
1806#else
1807static int ssl_write_certificate_request( ssl_context *ssl )
1808{
1809 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
1810 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001811 size_t dn_size, total_dn_size; /* excluding length bytes */
1812 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00001813 unsigned char *buf, *p;
Paul Bakkerc559c7a2013-09-18 14:13:26 +02001814 const x509_crt *crt;
Paul Bakker5121ce52009-01-03 21:22:43 +00001815
1816 SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
1817
1818 ssl->state++;
1819
Paul Bakkerfbb17802013-04-17 19:10:21 +02001820 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01001821 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001822 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02001823 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
Paul Bakkerfbb17802013-04-17 19:10:21 +02001824 ssl->authmode == SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001825 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001826 SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001827 return( 0 );
1828 }
1829
1830 /*
1831 * 0 . 0 handshake type
1832 * 1 . 3 handshake length
1833 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01001834 * 5 .. m-1 cert types
1835 * m .. m+1 sig alg length (TLS 1.2 only)
1836 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00001837 * n .. n+1 length of all DNs
1838 * n+2 .. n+3 length of DN 1
1839 * n+4 .. ... Distinguished Name #1
1840 * ... .. ... length of DN 2, etc.
1841 */
1842 buf = ssl->out_msg;
1843 p = buf + 4;
1844
1845 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001846 * Supported certificate types
1847 *
1848 * ClientCertificateType certificate_types<1..2^8-1>;
1849 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00001850 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001851 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01001852
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001853#if defined(POLARSSL_RSA_C)
1854 p[1 + ct_len++] = SSL_CERT_TYPE_RSA_SIGN;
1855#endif
1856#if defined(POLARSSL_ECDSA_C)
1857 p[1 + ct_len++] = SSL_CERT_TYPE_ECDSA_SIGN;
1858#endif
1859
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001860 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001861 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01001862
Paul Bakker577e0062013-08-28 11:57:20 +02001863 sa_len = 0;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001864#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01001865 /*
1866 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01001867 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001868 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
1869 *
1870 * struct {
1871 * HashAlgorithm hash;
1872 * SignatureAlgorithm signature;
1873 * } SignatureAndHashAlgorithm;
1874 *
1875 * enum { (255) } HashAlgorithm;
1876 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01001877 */
Paul Bakker21dca692013-01-03 11:41:08 +01001878 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01001879 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001880 /*
1881 * Only use current running hash algorithm that is already required
1882 * for requested ciphersuite.
1883 */
Paul Bakker926af752012-11-23 13:38:07 +01001884 ssl->handshake->verify_sig_alg = SSL_HASH_SHA256;
1885
Paul Bakkerb7149bc2013-03-20 15:30:09 +01001886 if( ssl->transform_negotiate->ciphersuite_info->mac ==
1887 POLARSSL_MD_SHA384 )
Paul Bakker926af752012-11-23 13:38:07 +01001888 {
1889 ssl->handshake->verify_sig_alg = SSL_HASH_SHA384;
1890 }
Paul Bakkerf7abd422013-04-16 13:15:56 +02001891
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001892 /*
1893 * Supported signature algorithms
1894 */
1895#if defined(POLARSSL_RSA_C)
1896 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
1897 p[2 + sa_len++] = SSL_SIG_RSA;
1898#endif
1899#if defined(POLARSSL_ECDSA_C)
1900 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
1901 p[2 + sa_len++] = SSL_SIG_ECDSA;
1902#endif
Paul Bakker926af752012-11-23 13:38:07 +01001903
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001904 p[0] = (unsigned char)( sa_len >> 8 );
1905 p[1] = (unsigned char)( sa_len );
1906 sa_len += 2;
1907 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01001908 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001909#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001910
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001911 /*
1912 * DistinguishedName certificate_authorities<0..2^16-1>;
1913 * opaque DistinguishedName<1..2^16-1>;
1914 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001915 p += 2;
1916 crt = ssl->ca_chain;
1917
Paul Bakkerbc3d9842012-11-26 16:12:02 +01001918 total_dn_size = 0;
Paul Bakker29087132010-03-21 21:03:34 +00001919 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001920 {
1921 if( p - buf > 4096 )
1922 break;
1923
Paul Bakker926af752012-11-23 13:38:07 +01001924 dn_size = crt->subject_raw.len;
1925 *p++ = (unsigned char)( dn_size >> 8 );
1926 *p++ = (unsigned char)( dn_size );
1927 memcpy( p, crt->subject_raw.p, dn_size );
1928 p += dn_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001929
Paul Bakker926af752012-11-23 13:38:07 +01001930 SSL_DEBUG_BUF( 3, "requested DN", p, dn_size );
1931
Paul Bakkerbc3d9842012-11-26 16:12:02 +01001932 total_dn_size += 2 + dn_size;
Paul Bakker926af752012-11-23 13:38:07 +01001933 crt = crt->next;
Paul Bakker5121ce52009-01-03 21:22:43 +00001934 }
1935
Paul Bakker926af752012-11-23 13:38:07 +01001936 ssl->out_msglen = p - buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00001937 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
1938 ssl->out_msg[0] = SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001939 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
1940 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00001941
1942 ret = ssl_write_record( ssl );
1943
1944 SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
1945
1946 return( ret );
1947}
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001948#endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
1949 !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01001950 !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
1951 !POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00001952
Paul Bakker41c83d32013-03-20 14:39:14 +01001953static int ssl_write_server_key_exchange( ssl_context *ssl )
1954{
Paul Bakker23986e52011-04-24 08:57:21 +00001955 int ret;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02001956 size_t n = 0;
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02001957 const ssl_ciphersuite_t *ciphersuite_info =
1958 ssl->transform_negotiate->ciphersuite_info;
Paul Bakker2292d1f2013-09-15 17:06:49 +02001959
1960#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
1961 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
1962 defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02001963 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
Paul Bakker2292d1f2013-09-15 17:06:49 +02001964 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02001965 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02001966 unsigned char *dig_signed = p;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02001967 size_t dig_signed_len = 0, len;
Paul Bakker2292d1f2013-09-15 17:06:49 +02001968 ((void) dig_signed);
1969 ((void) dig_signed_len);
1970#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01001971
Paul Bakker5121ce52009-01-03 21:22:43 +00001972 SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
1973
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02001974 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA ||
1975 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
1976 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00001977 {
1978 SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
1979 ssl->state++;
1980 return( 0 );
1981 }
1982
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02001983#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
1984 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
1985 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
1986 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001987 {
1988 /* TODO: Support identity hints */
1989 *(p++) = 0x00;
1990 *(p++) = 0x00;
1991
1992 n += 2;
1993 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02001994#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED ||
1995 POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001996
1997#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
1998 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
1999 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
2000 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48916f92012-09-16 19:57:18 +00002001 {
Paul Bakker41c83d32013-03-20 14:39:14 +01002002 /*
2003 * Ephemeral DH parameters:
2004 *
2005 * struct {
2006 * opaque dh_p<1..2^16-1>;
2007 * opaque dh_g<1..2^16-1>;
2008 * opaque dh_Ys<1..2^16-1>;
2009 * } ServerDHParams;
2010 */
2011 if( ( ret = mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->dhm_P ) ) != 0 ||
2012 ( ret = mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->dhm_G ) ) != 0 )
2013 {
2014 SSL_DEBUG_RET( 1, "mpi_copy", ret );
2015 return( ret );
2016 }
Paul Bakker48916f92012-09-16 19:57:18 +00002017
Paul Bakker41c83d32013-03-20 14:39:14 +01002018 if( ( ret = dhm_make_params( &ssl->handshake->dhm_ctx,
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002019 (int) mpi_size( &ssl->handshake->dhm_ctx.P ),
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002020 p,
2021 &len, ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002022 {
2023 SSL_DEBUG_RET( 1, "dhm_make_params", ret );
2024 return( ret );
2025 }
2026
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002027 dig_signed = p;
2028 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002029
2030 p += len;
2031 n += len;
2032
Paul Bakker41c83d32013-03-20 14:39:14 +01002033 SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2034 SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2035 SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2036 SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
2037 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002038#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2039 POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01002040
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002041#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002042 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2043 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2044
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002045 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002046 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
2047 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002048 {
Paul Bakker41c83d32013-03-20 14:39:14 +01002049 /*
2050 * Ephemeral ECDH parameters:
2051 *
2052 * struct {
2053 * ECParameters curve_params;
2054 * ECPoint public;
2055 * } ServerECDHParams;
2056 */
Paul Bakker41c83d32013-03-20 14:39:14 +01002057 if( ( ret = ecp_use_known_dp( &ssl->handshake->ecdh_ctx.grp,
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +02002058 ssl->handshake->curves[0]->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002059 {
2060 SSL_DEBUG_RET( 1, "ecp_use_known_dp", ret );
2061 return( ret );
2062 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002063
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02002064 SSL_DEBUG_MSG( 2, ( "ECDH curve size: %d",
2065 (int) ssl->handshake->ecdh_ctx.grp.nbits ) );
2066
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002067 if( ( ret = ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
2068 p, SSL_MAX_CONTENT_LEN - n,
2069 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002070 {
2071 SSL_DEBUG_RET( 1, "ecdh_make_params", ret );
2072 return( ret );
2073 }
2074
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002075 dig_signed = p;
2076 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002077
2078 p += len;
2079 n += len;
2080
Paul Bakker41c83d32013-03-20 14:39:14 +01002081 SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
2082 }
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002083#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002084 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2085 POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002086
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002087#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002088 defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2089 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002090 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002091 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
2092 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002093 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002094 size_t signature_len = 0;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002095 unsigned int hashlen = 0;
2096 unsigned char hash[64];
2097 md_type_t md_alg = POLARSSL_MD_NONE;
Paul Bakker23f36802012-09-28 14:15:14 +00002098
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002099 /*
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002100 * Choose hash algorithm. NONE means MD5 + SHA1 here.
2101 */
Paul Bakker577e0062013-08-28 11:57:20 +02002102#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002103 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2104 {
2105 md_alg = ssl_md_alg_from_hash( ssl->handshake->sig_alg );
2106
2107 if( md_alg == POLARSSL_MD_NONE )
2108 {
2109 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2110 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
2111 }
2112 }
Paul Bakker577e0062013-08-28 11:57:20 +02002113 else
2114#endif
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002115#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2116 defined(POLARSSL_SSL_PROTO_TLS1_1)
Paul Bakker577e0062013-08-28 11:57:20 +02002117 if ( ciphersuite_info->key_exchange ==
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002118 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
2119 {
2120 md_alg = POLARSSL_MD_SHA1;
2121 }
2122 else
Paul Bakker577e0062013-08-28 11:57:20 +02002123#endif
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002124 {
2125 md_alg = POLARSSL_MD_NONE;
2126 }
2127
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002128 /*
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002129 * Compute the hash to be signed
2130 */
Paul Bakker577e0062013-08-28 11:57:20 +02002131#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2132 defined(POLARSSL_SSL_PROTO_TLS1_1)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002133 if( md_alg == POLARSSL_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00002134 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002135 md5_context md5;
2136 sha1_context sha1;
2137
2138 /*
2139 * digitally-signed struct {
2140 * opaque md5_hash[16];
2141 * opaque sha_hash[20];
2142 * };
2143 *
2144 * md5_hash
2145 * MD5(ClientHello.random + ServerHello.random
2146 * + ServerParams);
2147 * sha_hash
2148 * SHA(ClientHello.random + ServerHello.random
2149 * + ServerParams);
2150 */
2151 md5_starts( &md5 );
2152 md5_update( &md5, ssl->handshake->randbytes, 64 );
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002153 md5_update( &md5, dig_signed, dig_signed_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002154 md5_finish( &md5, hash );
2155
2156 sha1_starts( &sha1 );
2157 sha1_update( &sha1, ssl->handshake->randbytes, 64 );
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002158 sha1_update( &sha1, dig_signed, dig_signed_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002159 sha1_finish( &sha1, hash + 16 );
2160
2161 hashlen = 36;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002162 }
2163 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002164#endif /* POLARSSL_SSL_PROTO_SSL3 || POLARSSL_SSL_PROTO_TLS1 || \
2165 POLARSSL_SSL_PROTO_TLS1_1 */
Paul Bakker9659dae2013-08-28 16:21:34 +02002166#if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
2167 defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker577e0062013-08-28 11:57:20 +02002168 if( md_alg != POLARSSL_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002169 {
2170 md_context_t ctx;
2171
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002172 /* Info from md_alg will be used instead */
2173 hashlen = 0;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002174
2175 /*
2176 * digitally-signed struct {
2177 * opaque client_random[32];
2178 * opaque server_random[32];
2179 * ServerDHParams params;
2180 * };
2181 */
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002182 if( ( ret = md_init_ctx( &ctx, md_info_from_type(md_alg) ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002183 {
2184 SSL_DEBUG_RET( 1, "md_init_ctx", ret );
2185 return( ret );
2186 }
2187
2188 md_starts( &ctx );
2189 md_update( &ctx, ssl->handshake->randbytes, 64 );
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002190 md_update( &ctx, dig_signed, dig_signed_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002191 md_finish( &ctx, hash );
Paul Bakker61d113b2013-07-04 11:51:43 +02002192
2193 if( ( ret = md_free_ctx( &ctx ) ) != 0 )
2194 {
2195 SSL_DEBUG_RET( 1, "md_free_ctx", ret );
2196 return( ret );
2197 }
2198
Paul Bakker23f36802012-09-28 14:15:14 +00002199 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002200 else
Paul Bakker9659dae2013-08-28 16:21:34 +02002201#endif /* POLARSSL_SSL_PROTO_TLS1 || POLARSSL_SSL_PROTO_TLS1_1 || \
2202 POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02002203 {
2204 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002205 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
Paul Bakker577e0062013-08-28 11:57:20 +02002206 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002207
Manuel Pégourié-Gonnard9cc6f5c2013-08-27 14:29:44 +02002208 SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
2209 (unsigned int) ( md_info_from_type( md_alg ) )->size );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002210
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002211 /*
2212 * Make the signature
2213 */
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002214 if( ssl_own_key( ssl ) == NULL )
Paul Bakker23f36802012-09-28 14:15:14 +00002215 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002216 SSL_DEBUG_MSG( 1, ( "got no private key" ) );
2217 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002218 }
Paul Bakker23f36802012-09-28 14:15:14 +00002219
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002220#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker23f36802012-09-28 14:15:14 +00002221 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2222 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002223 *(p++) = ssl->handshake->sig_alg;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002224 *(p++) = ssl_sig_from_pk( ssl_own_key( ssl ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002225
2226 n += 2;
2227 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002228#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002229
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002230 if( ( ret = pk_sign( ssl_own_key( ssl ), md_alg, hash, hashlen,
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02002231 p + 2 , &signature_len,
2232 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002233 {
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02002234 SSL_DEBUG_RET( 1, "pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002235 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00002236 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002237
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002238 *(p++) = (unsigned char)( signature_len >> 8 );
2239 *(p++) = (unsigned char)( signature_len );
Paul Bakkerbf63b362012-04-12 20:44:34 +00002240 n += 2;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002241
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002242 SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
Paul Bakker48916f92012-09-16 19:57:18 +00002243
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002244 p += signature_len;
2245 n += signature_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002246 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002247#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002248 POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2249 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002250
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002251 ssl->out_msglen = 4 + n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002252 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2253 ssl->out_msg[0] = SSL_HS_SERVER_KEY_EXCHANGE;
2254
2255 ssl->state++;
2256
2257 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2258 {
2259 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2260 return( ret );
2261 }
2262
2263 SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
2264
2265 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002266}
2267
2268static int ssl_write_server_hello_done( ssl_context *ssl )
2269{
2270 int ret;
2271
2272 SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
2273
2274 ssl->out_msglen = 4;
2275 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2276 ssl->out_msg[0] = SSL_HS_SERVER_HELLO_DONE;
2277
2278 ssl->state++;
2279
2280 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2281 {
2282 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2283 return( ret );
2284 }
2285
2286 SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
2287
2288 return( 0 );
2289}
2290
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002291#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2292 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2293static int ssl_parse_client_dh_public( ssl_context *ssl, unsigned char **p,
2294 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002295{
2296 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002297 size_t n;
2298
2299 /*
2300 * Receive G^Y mod P, premaster = (G^Y)^X mod P
2301 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002302 if( *p + 2 > end )
2303 {
2304 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2305 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2306 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02002307
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002308 n = ( (*p)[0] << 8 ) | (*p)[1];
2309 *p += 2;
2310
2311 if( n < 1 || n > ssl->handshake->dhm_ctx.len || *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002312 {
2313 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2314 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2315 }
2316
2317 if( ( ret = dhm_read_public( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002318 *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002319 {
2320 SSL_DEBUG_RET( 1, "dhm_read_public", ret );
2321 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
2322 }
2323
2324 SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
2325
Paul Bakker70df2fb2013-04-17 17:19:09 +02002326 return( ret );
2327}
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002328#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2329 POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02002330
Manuel Pégourié-Gonnardbac0e3b2013-10-15 11:54:47 +02002331#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) || \
2332 defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002333static int ssl_parse_encrypted_pms( ssl_context *ssl,
2334 const unsigned char *p,
2335 const unsigned char *end,
2336 size_t pms_offset )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002337{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002338 int ret;
2339 size_t len = pk_get_len( ssl_own_key( ssl ) );
2340 unsigned char *pms = ssl->handshake->premaster + pms_offset;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002341
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002342 if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_RSA ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002343 {
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +02002344 SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002345 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2346 }
2347
2348 /*
2349 * Decrypt the premaster using own private RSA key
2350 */
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002351#if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
2352 defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker70df2fb2013-04-17 17:19:09 +02002353 if( ssl->minor_ver != SSL_MINOR_VERSION_0 )
2354 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002355 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
2356 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002357 {
2358 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2359 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2360 }
2361 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002362#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02002363
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002364 if( p + len != end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002365 {
2366 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2367 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2368 }
2369
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002370 ret = pk_decrypt( ssl_own_key( ssl ), p, len,
2371 pms, &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard070cc7f2013-08-21 15:09:31 +02002372 sizeof(ssl->handshake->premaster),
2373 ssl->f_rng, ssl->p_rng );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002374
2375 if( ret != 0 || ssl->handshake->pmslen != 48 ||
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002376 pms[0] != ssl->handshake->max_major_ver ||
2377 pms[1] != ssl->handshake->max_minor_ver )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002378 {
2379 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2380
2381 /*
2382 * Protection against Bleichenbacher's attack:
2383 * invalid PKCS#1 v1.5 padding must not cause
2384 * the connection to end immediately; instead,
2385 * send a bad_record_mac later in the handshake.
2386 */
2387 ssl->handshake->pmslen = 48;
2388
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002389 ret = ssl->f_rng( ssl->p_rng, pms, ssl->handshake->pmslen );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002390 if( ret != 0 )
2391 return( ret );
2392 }
2393
2394 return( ret );
2395}
Manuel Pégourié-Gonnardbac0e3b2013-10-15 11:54:47 +02002396#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED ||
2397 POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02002398
Manuel Pégourié-Gonnard8a3c64d2013-10-14 19:54:10 +02002399#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002400static int ssl_parse_client_psk_identity( ssl_context *ssl, unsigned char **p,
2401 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002402{
Paul Bakker6db455e2013-09-18 17:29:31 +02002403 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002404 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002405
Paul Bakker6db455e2013-09-18 17:29:31 +02002406 if( ssl->f_psk == NULL &&
2407 ( ssl->psk == NULL || ssl->psk_identity == NULL ||
2408 ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002409 {
2410 SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
2411 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2412 }
2413
2414 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002415 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02002416 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002417 if( *p + 2 > end )
2418 {
2419 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2420 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2421 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02002422
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002423 n = ( (*p)[0] << 8 ) | (*p)[1];
2424 *p += 2;
2425
2426 if( n < 1 || n > 65535 || *p + n > end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002427 {
2428 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2429 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2430 }
2431
Paul Bakker6db455e2013-09-18 17:29:31 +02002432 if( ssl->f_psk != NULL )
2433 {
2434 if( ( ret != ssl->f_psk( ssl->p_psk, ssl, *p, n ) ) != 0 )
2435 ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
2436 }
2437
2438 if( ret == 0 )
2439 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01002440 /* Identity is not a big secret since clients send it in the clear,
2441 * but treat it carefully anyway, just in case */
Paul Bakker6db455e2013-09-18 17:29:31 +02002442 if( n != ssl->psk_identity_len ||
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01002443 safer_memcmp( ssl->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02002444 {
2445 ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
2446 }
2447 }
2448
2449 if( ret == POLARSSL_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002450 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002451 SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Paul Bakker6db455e2013-09-18 17:29:31 +02002452 if( ( ret = ssl_send_alert_message( ssl,
2453 SSL_ALERT_LEVEL_FATAL,
2454 SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
2455 {
2456 return( ret );
2457 }
2458
2459 return( POLARSSL_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02002460 }
2461
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002462 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002463 ret = 0;
2464
Paul Bakkerfbb17802013-04-17 19:10:21 +02002465 return( ret );
2466}
Manuel Pégourié-Gonnard8a3c64d2013-10-14 19:54:10 +02002467#endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02002468
Paul Bakker5121ce52009-01-03 21:22:43 +00002469static int ssl_parse_client_key_exchange( ssl_context *ssl )
2470{
Paul Bakker23986e52011-04-24 08:57:21 +00002471 int ret;
Paul Bakker41c83d32013-03-20 14:39:14 +01002472 const ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002473
Paul Bakker41c83d32013-03-20 14:39:14 +01002474 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00002475
2476 SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
2477
2478 if( ( ret = ssl_read_record( ssl ) ) != 0 )
2479 {
2480 SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2481 return( ret );
2482 }
2483
2484 if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
2485 {
2486 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002487 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002488 }
2489
2490 if( ssl->in_msg[0] != SSL_HS_CLIENT_KEY_EXCHANGE )
2491 {
2492 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002493 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002494 }
2495
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002496#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)
Paul Bakker41c83d32013-03-20 14:39:14 +01002497 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00002498 {
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002499 unsigned char *p = ssl->in_msg + 4;
2500 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2501
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002502 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002503 {
Paul Bakker70df2fb2013-04-17 17:19:09 +02002504 SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
2505 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002506 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002507
2508 ssl->handshake->pmslen = ssl->handshake->dhm_ctx.len;
2509
2510 if( ( ret = dhm_calc_secret( &ssl->handshake->dhm_ctx,
2511 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02002512 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +02002513 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002514 {
2515 SSL_DEBUG_RET( 1, "dhm_calc_secret", ret );
2516 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
2517 }
2518
2519 SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002520 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002521 else
2522#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED */
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002523#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2524 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2525 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
2526 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002527 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002528 size_t n = ssl->in_msg[3];
2529
2530 if( n < 1 || n > mpi_size( &ssl->handshake->ecdh_ctx.grp.P ) * 2 + 2 ||
2531 n + 4 != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002532 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002533 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2534 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002535 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002536
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002537 if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
2538 ssl->in_msg + 4, n ) ) != 0 )
2539 {
2540 SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
2541 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
2542 }
2543
2544 SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
2545
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002546 if( ( ret = ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
2547 &ssl->handshake->pmslen,
2548 ssl->handshake->premaster,
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +02002549 POLARSSL_MPI_MAX_SIZE,
2550 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002551 {
2552 SSL_DEBUG_RET( 1, "ecdh_calc_secret", ret );
2553 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
2554 }
2555
2556 SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
Paul Bakker5121ce52009-01-03 21:22:43 +00002557 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002558 else
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002559#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2560 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002561#if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)
2562 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002563 {
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002564 unsigned char *p = ssl->in_msg + 4;
2565 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2566
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002567 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002568 {
2569 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2570 return( ret );
2571 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002572
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002573 if( ( ret = ssl_psk_derive_premaster( ssl,
2574 ciphersuite_info->key_exchange ) ) != 0 )
2575 {
2576 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
2577 return( ret );
2578 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02002579 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002580 else
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002581#endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002582#if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
2583 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
2584 {
2585 unsigned char *p = ssl->in_msg + 4;
2586 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2587
2588 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
2589 {
2590 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2591 return( ret );
2592 }
2593
2594 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
2595 {
2596 SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
2597 return( ret );
2598 }
2599
2600 if( ( ret = ssl_psk_derive_premaster( ssl,
2601 ciphersuite_info->key_exchange ) ) != 0 )
2602 {
2603 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
2604 return( ret );
2605 }
2606 }
2607 else
2608#endif /* POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002609#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2610 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
2611 {
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002612 unsigned char *p = ssl->in_msg + 4;
2613 unsigned char *end = ssl->in_msg + ssl->in_msglen;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002614
2615 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
2616 {
2617 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2618 return( ret );
2619 }
2620 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
2621 {
2622 SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
2623 return( ret );
2624 }
2625
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002626 if( ( ret = ssl_psk_derive_premaster( ssl,
2627 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002628 {
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002629 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
2630 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002631 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002632 }
2633 else
2634#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002635#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2636 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
2637 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002638 unsigned char *p = ssl->in_msg + 4;
2639 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2640
2641 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
2642 {
2643 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2644 return( ret );
2645 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002646
2647 if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
2648 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002649 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002650 SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
2651 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002652 }
2653
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002654 SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
2655
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002656 if( ( ret = ssl_psk_derive_premaster( ssl,
2657 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002658 {
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002659 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002660 return( ret );
2661 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002662 }
2663 else
2664#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002665#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)
2666 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01002667 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002668 if( ( ret = ssl_parse_encrypted_pms( ssl,
2669 ssl->in_msg + 4,
2670 ssl->in_msg + ssl->in_msglen,
2671 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002672 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002673 SSL_DEBUG_RET( 1, ( "ssl_parse_parse_ecrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002674 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002675 }
2676 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002677 else
2678#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */
2679 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002680 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002681 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
2682 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002683
Paul Bakkerff60ee62010-03-16 21:09:09 +00002684 if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
2685 {
2686 SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
2687 return( ret );
2688 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002689
Paul Bakker5121ce52009-01-03 21:22:43 +00002690 ssl->state++;
2691
2692 SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
2693
2694 return( 0 );
2695}
2696
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002697#if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \
2698 !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02002699 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
2700 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Paul Bakker5121ce52009-01-03 21:22:43 +00002701static int ssl_parse_certificate_verify( ssl_context *ssl )
2702{
Paul Bakkered27a042013-04-18 22:46:23 +02002703 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002704 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00002705
2706 SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
2707
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002708 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01002709 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002710 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002711 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
Paul Bakkered27a042013-04-18 22:46:23 +02002712 {
2713 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
2714 ssl->state++;
2715 return( 0 );
2716 }
2717
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02002718 SSL_DEBUG_MSG( 1, ( "should not happen" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002719 return( ret );
2720}
2721#else
2722static int ssl_parse_certificate_verify( ssl_context *ssl )
2723{
2724 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002725 size_t sa_len, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002726 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002727 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002728 size_t hashlen;
Paul Bakker577e0062013-08-28 11:57:20 +02002729#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002730 pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02002731#endif
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002732 md_type_t md_alg;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002733 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
2734
2735 SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
2736
2737 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01002738 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002739 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002740 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
2741 {
2742 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
2743 ssl->state++;
2744 return( 0 );
2745 }
2746
Paul Bakkered27a042013-04-18 22:46:23 +02002747 if( ssl->session_negotiate->peer_cert == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00002748 {
2749 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
2750 ssl->state++;
2751 return( 0 );
2752 }
2753
Paul Bakker48916f92012-09-16 19:57:18 +00002754 ssl->handshake->calc_verify( ssl, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00002755
2756 if( ( ret = ssl_read_record( ssl ) ) != 0 )
2757 {
2758 SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2759 return( ret );
2760 }
2761
2762 ssl->state++;
2763
2764 if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
2765 {
2766 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002767 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00002768 }
2769
2770 if( ssl->in_msg[0] != SSL_HS_CERTIFICATE_VERIFY )
2771 {
2772 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002773 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00002774 }
2775
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002776 /*
2777 * 0 . 0 handshake type
2778 * 1 . 3 handshake length
2779 * 4 . 5 sig alg (TLS 1.2 only)
2780 * 4+n . 5+n signature length (n = sa_len)
2781 * 6+n . 6+n+m signature (m = sig_len)
2782 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002783
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002784#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2785 defined(POLARSSL_SSL_PROTO_TLS1_1)
2786 if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002787 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002788 sa_len = 0;
2789
Paul Bakkerc70b9822013-04-07 22:00:46 +02002790 md_alg = POLARSSL_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002791 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002792
2793 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
2794 if( pk_can_do( &ssl->session_negotiate->peer_cert->pk,
2795 POLARSSL_PK_ECDSA ) )
2796 {
2797 hash_start += 16;
2798 hashlen -= 16;
2799 md_alg = POLARSSL_MD_SHA1;
2800 }
Paul Bakker926af752012-11-23 13:38:07 +01002801 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002802 else
2803#endif
Paul Bakker577e0062013-08-28 11:57:20 +02002804#if defined(POLARSSL_SSL_PROTO_TLS1_2)
2805 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02002806 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002807 sa_len = 2;
2808
Paul Bakker5121ce52009-01-03 21:22:43 +00002809 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002810 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00002811 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002812 if( ssl->in_msg[4] != ssl->handshake->verify_sig_alg )
Paul Bakker5121ce52009-01-03 21:22:43 +00002813 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002814 SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
2815 " for verify message" ) );
Paul Bakker926af752012-11-23 13:38:07 +01002816 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
2817 }
2818
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002819 md_alg = ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
Paul Bakker926af752012-11-23 13:38:07 +01002820
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002821 /* Info from md_alg will be used instead */
2822 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002823
2824 /*
2825 * Signature
2826 */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002827 if( ( pk_alg = ssl_pk_alg_from_sig( ssl->in_msg[5] ) )
2828 == POLARSSL_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002829 {
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002830 SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
2831 " for verify message" ) );
2832 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002833 }
2834
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002835 /*
2836 * Check the certificate's key type matches the signature alg
2837 */
2838 if( ! pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
2839 {
2840 SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
2841 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
2842 }
Paul Bakker577e0062013-08-28 11:57:20 +02002843 }
2844 else
2845#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
2846 {
2847 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02002848 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02002849 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02002850
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002851 sig_len = ( ssl->in_msg[4 + sa_len] << 8 ) | ssl->in_msg[5 + sa_len];
Paul Bakker926af752012-11-23 13:38:07 +01002852
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002853 if( sa_len + sig_len + 6 != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002854 {
2855 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002856 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00002857 }
2858
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002859 if( ( ret = pk_verify( &ssl->session_negotiate->peer_cert->pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002860 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002861 ssl->in_msg + 6 + sa_len, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002862 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002863 SSL_DEBUG_RET( 1, "pk_verify", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002864 return( ret );
2865 }
2866
2867 SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
2868
Paul Bakkered27a042013-04-18 22:46:23 +02002869 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002870}
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002871#endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
2872 !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
2873 !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002874
Paul Bakkera503a632013-08-14 13:48:06 +02002875#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002876static int ssl_write_new_session_ticket( ssl_context *ssl )
2877{
2878 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02002879 size_t tlen;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002880 uint32_t lifetime = (uint32_t) ssl->ticket_lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002881
2882 SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
2883
2884 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2885 ssl->out_msg[0] = SSL_HS_NEW_SESSION_TICKET;
2886
2887 /*
2888 * struct {
2889 * uint32 ticket_lifetime_hint;
2890 * opaque ticket<0..2^16-1>;
2891 * } NewSessionTicket;
2892 *
2893 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
2894 * 8 . 9 ticket_len (n)
2895 * 10 . 9+n ticket content
2896 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002897
2898 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
2899 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
2900 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
2901 ssl->out_msg[7] = ( lifetime ) & 0xFF;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002902
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02002903 if( ( ret = ssl_write_ticket( ssl, &tlen ) ) != 0 )
2904 {
2905 SSL_DEBUG_RET( 1, "ssl_write_ticket", ret );
2906 tlen = 0;
2907 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002908
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02002909 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
2910 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002911
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02002912 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002913
2914 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2915 {
2916 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2917 return( ret );
2918 }
2919
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02002920 /* No need to remember writing a NewSessionTicket any more */
2921 ssl->handshake->new_session_ticket = 0;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002922
2923 SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
2924
2925 return( 0 );
2926}
Paul Bakkera503a632013-08-14 13:48:06 +02002927#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002928
Paul Bakker5121ce52009-01-03 21:22:43 +00002929/*
Paul Bakker1961b702013-01-25 14:49:24 +01002930 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00002931 */
Paul Bakker1961b702013-01-25 14:49:24 +01002932int ssl_handshake_server_step( ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002933{
2934 int ret = 0;
2935
Paul Bakker1961b702013-01-25 14:49:24 +01002936 if( ssl->state == SSL_HANDSHAKE_OVER )
2937 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00002938
Paul Bakker1961b702013-01-25 14:49:24 +01002939 SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
2940
2941 if( ( ret = ssl_flush_output( ssl ) ) != 0 )
2942 return( ret );
2943
2944 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00002945 {
Paul Bakker1961b702013-01-25 14:49:24 +01002946 case SSL_HELLO_REQUEST:
2947 ssl->state = SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002948 break;
2949
Paul Bakker1961b702013-01-25 14:49:24 +01002950 /*
2951 * <== ClientHello
2952 */
2953 case SSL_CLIENT_HELLO:
2954 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002955 break;
Paul Bakker1961b702013-01-25 14:49:24 +01002956
2957 /*
2958 * ==> ServerHello
2959 * Certificate
2960 * ( ServerKeyExchange )
2961 * ( CertificateRequest )
2962 * ServerHelloDone
2963 */
2964 case SSL_SERVER_HELLO:
2965 ret = ssl_write_server_hello( ssl );
2966 break;
2967
2968 case SSL_SERVER_CERTIFICATE:
2969 ret = ssl_write_certificate( ssl );
2970 break;
2971
2972 case SSL_SERVER_KEY_EXCHANGE:
2973 ret = ssl_write_server_key_exchange( ssl );
2974 break;
2975
2976 case SSL_CERTIFICATE_REQUEST:
2977 ret = ssl_write_certificate_request( ssl );
2978 break;
2979
2980 case SSL_SERVER_HELLO_DONE:
2981 ret = ssl_write_server_hello_done( ssl );
2982 break;
2983
2984 /*
2985 * <== ( Certificate/Alert )
2986 * ClientKeyExchange
2987 * ( CertificateVerify )
2988 * ChangeCipherSpec
2989 * Finished
2990 */
2991 case SSL_CLIENT_CERTIFICATE:
2992 ret = ssl_parse_certificate( ssl );
2993 break;
2994
2995 case SSL_CLIENT_KEY_EXCHANGE:
2996 ret = ssl_parse_client_key_exchange( ssl );
2997 break;
2998
2999 case SSL_CERTIFICATE_VERIFY:
3000 ret = ssl_parse_certificate_verify( ssl );
3001 break;
3002
3003 case SSL_CLIENT_CHANGE_CIPHER_SPEC:
3004 ret = ssl_parse_change_cipher_spec( ssl );
3005 break;
3006
3007 case SSL_CLIENT_FINISHED:
3008 ret = ssl_parse_finished( ssl );
3009 break;
3010
3011 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003012 * ==> ( NewSessionTicket )
3013 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01003014 * Finished
3015 */
3016 case SSL_SERVER_CHANGE_CIPHER_SPEC:
Paul Bakkera503a632013-08-14 13:48:06 +02003017#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003018 if( ssl->handshake->new_session_ticket != 0 )
3019 ret = ssl_write_new_session_ticket( ssl );
3020 else
Paul Bakkera503a632013-08-14 13:48:06 +02003021#endif
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003022 ret = ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003023 break;
3024
3025 case SSL_SERVER_FINISHED:
3026 ret = ssl_write_finished( ssl );
3027 break;
3028
3029 case SSL_FLUSH_BUFFERS:
3030 SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3031 ssl->state = SSL_HANDSHAKE_WRAPUP;
3032 break;
3033
3034 case SSL_HANDSHAKE_WRAPUP:
3035 ssl_handshake_wrapup( ssl );
3036 break;
3037
3038 default:
3039 SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3040 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003041 }
3042
Paul Bakker5121ce52009-01-03 21:22:43 +00003043 return( ret );
3044}
Paul Bakker5121ce52009-01-03 21:22:43 +00003045#endif