blob: ec9201f8b7964620553a7bf0f73be2decb1b8c9d [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
34#define mbedtls_calloc calloc
35#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010036#endif
37
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000038#include "mbedtls/debug.h"
39#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020040#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia84914062018-04-24 08:40:46 -050041#include "mbedtls/platform_util.h"
Rich Evans00ab4702015-02-06 13:43:58 +000042
43#include <string.h>
44
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020045#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/ecp.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010047#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_HAVE_TIME)
Simon Butcherb5b6af22016-07-13 14:46:18 +010050#include "mbedtls/platform_time.h"
Paul Bakkerfa9b1002013-07-03 15:31:03 +020051#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020053#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
54int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020055 const unsigned char *info,
56 size_t ilen )
57{
Hanno Becker2d9623f2019-06-13 12:07:05 +010058 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020060
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020061 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020062
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020063 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020064 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020065
66 memcpy( ssl->cli_id, info, ilen );
67 ssl->cli_id_len = ilen;
68
69 return( 0 );
70}
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020071
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020072void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073 mbedtls_ssl_cookie_write_t *f_cookie_write,
74 mbedtls_ssl_cookie_check_t *f_cookie_check,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020075 void *p_cookie )
76{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020077 conf->f_cookie_write = f_cookie_write;
78 conf->f_cookie_check = f_cookie_check;
79 conf->p_cookie = p_cookie;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020080}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020081#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020084static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +000085 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +000086 size_t len )
87{
88 int ret;
89 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +000090 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +000091
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020092 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +010093
Philippe Antoine747fd532018-05-30 09:13:21 +020094 if( len < 2 )
95 {
96 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
97 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
98 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
99 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
100 }
Paul Bakker5701cdc2012-09-27 21:49:42 +0000101 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
102 if( servername_list_size + 2 != len )
103 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200104 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200105 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
106 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000108 }
109
110 p = buf + 2;
Philippe Antoine747fd532018-05-30 09:13:21 +0200111 while( servername_list_size > 2 )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000112 {
113 hostname_len = ( ( p[1] << 8 ) | p[2] );
114 if( hostname_len + 3 > servername_list_size )
115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200116 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200117 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
118 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000120 }
121
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200122 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000123 {
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +0200124 ret = ssl->conf->f_sni( ssl->conf->p_sni,
125 ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000126 if( ret != 0 )
127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
129 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
130 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
131 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000132 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000133 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000134 }
135
136 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000137 p += hostname_len + 3;
138 }
139
140 if( servername_list_size != 0 )
141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200143 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
144 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000146 }
147
148 return( 0 );
149}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200150#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000153 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000154 size_t len )
155{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200156#if defined(MBEDTLS_SSL_RENEGOTIATION)
157 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100158 {
159 /* Check verify-data in constant-time. The length OTOH is no secret */
160 if( len != 1 + ssl->verify_data_len ||
161 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100163 ssl->verify_data_len ) != 0 )
164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200166 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
167 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200168 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100169 }
170 }
171 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +0000173 {
174 if( len != 1 || buf[0] != 0x0 )
175 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200177 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
178 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200179 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +0000180 }
181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200182 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +0000183 }
Paul Bakker48916f92012-09-16 19:57:18 +0000184
185 return( 0 );
186}
187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
189 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100190
191/*
192 * Status of the implementation of signature-algorithms extension:
193 *
194 * Currently, we are only considering the signature-algorithm extension
195 * to pick a ciphersuite which allows us to send the ServerKeyExchange
196 * message with a signature-hash combination that the user allows.
197 *
198 * We do *not* check whether all certificates in our certificate
199 * chain are signed with an allowed signature-hash pair.
200 * This needs to be done at a later stage.
201 *
202 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000204 const unsigned char *buf,
205 size_t len )
206{
207 size_t sig_alg_list_size;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100208
Paul Bakker23f36802012-09-28 14:15:14 +0000209 const unsigned char *p;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200210 const unsigned char *end = buf + len;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200211
Hanno Becker7e5437a2017-04-28 17:15:26 +0100212 mbedtls_md_type_t md_cur;
213 mbedtls_pk_type_t sig_cur;
Paul Bakker23f36802012-09-28 14:15:14 +0000214
Philippe Antoine747fd532018-05-30 09:13:21 +0200215 if ( len < 2 ) {
216 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
217 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
218 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
219 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
220 }
Paul Bakker23f36802012-09-28 14:15:14 +0000221 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
222 if( sig_alg_list_size + 2 != len ||
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200223 sig_alg_list_size % 2 != 0 )
Paul Bakker23f36802012-09-28 14:15:14 +0000224 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200225 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200226 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
227 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200228 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker23f36802012-09-28 14:15:14 +0000229 }
230
Hanno Becker7e5437a2017-04-28 17:15:26 +0100231 /* Currently we only guarantee signing the ServerKeyExchange message according
232 * to the constraints specified in this extension (see above), so it suffices
233 * to remember only one suitable hash for each possible signature algorithm.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200234 *
Hanno Becker7e5437a2017-04-28 17:15:26 +0100235 * This will change when we also consider certificate signatures,
236 * in which case we will need to remember the whole signature-hash
237 * pair list from the extension.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200238 */
Hanno Becker7e5437a2017-04-28 17:15:26 +0100239
240 for( p = buf + 2; p < end; p += 2 )
241 {
242 /* Silently ignore unknown signature or hash algorithms. */
243
244 if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
245 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100246 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext"
247 " unknown sig alg encoding %d", p[1] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100248 continue;
249 }
250
251 /* Check if we support the hash the user proposes */
252 md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
253 if( md_cur == MBEDTLS_MD_NONE )
254 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100255 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
256 " unknown hash alg encoding %d", p[0] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100257 continue;
258 }
259
260 if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
261 {
262 mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
264 " match sig %d and hash %d",
Hanno Becker7e5437a2017-04-28 17:15:26 +0100265 sig_cur, md_cur ) );
266 }
267 else
268 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100269 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: "
270 "hash alg %d not supported", md_cur ) );
Paul Bakker23f36802012-09-28 14:15:14 +0000271 }
Paul Bakker23f36802012-09-28 14:15:14 +0000272 }
273
Paul Bakker23f36802012-09-28 14:15:14 +0000274 return( 0 );
275}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200276#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
277 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker23f36802012-09-28 14:15:14 +0000278
Robert Cragie136884c2015-10-02 13:34:31 +0100279#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +0100280 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200281static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100282 const unsigned char *buf, size_t len,
283 mbedtls_ecp_group_id curve_ids[ MBEDTLS_ECP_DP_MAX ] )
Paul Bakker41c83d32013-03-20 14:39:14 +0100284{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200285 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100286 const unsigned char *p;
287
Philippe Antoine747fd532018-05-30 09:13:21 +0200288 if ( len < 2 ) {
289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
290 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
291 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
292 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
293 }
Paul Bakker41c83d32013-03-20 14:39:14 +0100294 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
295 if( list_size + 2 != len ||
296 list_size % 2 != 0 )
297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200299 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
300 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200301 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100302 }
303
304 p = buf + 2;
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100305 our_size = MBEDTLS_ECP_DP_MAX;
306
307 /* Leave room for final 0-entry */
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200308 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100309 {
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100310 uint16_t const tls_id = ( p[0] << 8 ) | p[1];
311 mbedtls_ecp_curve_info const * const info =
312 mbedtls_ecp_curve_info_from_tls_id( tls_id );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200313
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100314 if( info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100315 {
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100316 mbedtls_ecp_group_id const *gid;
317 /* Remember the first curve that we also support. */
318 for( gid = ssl->conf->curve_list;
319 *gid != MBEDTLS_ECP_DP_NONE; gid++ )
320 {
321 if( info->grp_id != *gid )
322 continue;
323
324 if( ssl->handshake->curve_info == NULL )
325 ssl->handshake->curve_info = info;
326 }
327
328 *curve_ids++ = info->grp_id;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200329 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100330 }
331
332 list_size -= 2;
333 p += 2;
334 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100335 *curve_ids = MBEDTLS_ECP_DP_NONE;
Paul Bakker41c83d32013-03-20 14:39:14 +0100336
337 return( 0 );
338}
339
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200340static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200341 const unsigned char *buf,
342 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100343{
344 size_t list_size;
345 const unsigned char *p;
346
Philippe Antoine747fd532018-05-30 09:13:21 +0200347 if( len == 0 || (size_t)( buf[0] + 1 ) != len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100348 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200349 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200350 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
351 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100353 }
Philippe Antoine747fd532018-05-30 09:13:21 +0200354 list_size = buf[0];
Paul Bakker41c83d32013-03-20 14:39:14 +0100355
Manuel Pégourié-Gonnardc1b46d02015-09-16 11:18:32 +0200356 p = buf + 1;
Paul Bakker41c83d32013-03-20 14:39:14 +0100357 while( list_size > 0 )
358 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
360 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Paul Bakker41c83d32013-03-20 14:39:14 +0100361 {
Robert Cragie136884c2015-10-02 13:34:31 +0100362#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200363 ssl->handshake->ecdh_ctx.point_format = p[0];
Robert Cragie136884c2015-10-02 13:34:31 +0100364#endif
Robert Cragieae8535d2015-10-06 17:11:18 +0100365#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Robert Cragie136884c2015-10-02 13:34:31 +0100366 ssl->handshake->ecjpake_ctx.point_format = p[0];
367#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200368 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100369 return( 0 );
370 }
371
372 list_size--;
373 p++;
374 }
375
376 return( 0 );
377}
Robert Cragieae8535d2015-10-06 17:11:18 +0100378#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
379 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +0100380
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200381#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
382static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
383 const unsigned char *buf,
384 size_t len )
385{
386 int ret;
387
388 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
389 {
390 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
391 return( 0 );
392 }
393
394 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
395 buf, len ) ) != 0 )
396 {
397 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200398 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
399 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200400 return( ret );
401 }
402
403 /* Only mark the extension as OK when we're sure it is */
404 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
405
406 return( 0 );
407}
408#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200410#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
411static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200412 const unsigned char *buf,
413 size_t len )
414{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200417 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200418 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
419 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200420 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200421 }
422
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200423 ssl->session_negotiate->mfl_code = buf[0];
424
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200425 return( 0 );
426}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200427#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200428
Hanno Beckera5a2b082019-05-15 14:03:01 +0100429#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc403b262019-04-26 13:56:39 +0100430static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl,
431 const unsigned char *buf,
432 size_t len )
433{
434 size_t peer_cid_len;
435
436 /* CID extension only makes sense in DTLS */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200437 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Beckerc403b262019-04-26 13:56:39 +0100438 {
439 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
440 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
441 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
442 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
443 }
444
445 /*
Hanno Becker3cdf8fe2019-05-15 10:26:32 +0100446 * Quoting draft-ietf-tls-dtls-connection-id-05
447 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Beckerc403b262019-04-26 13:56:39 +0100448 *
449 * struct {
450 * opaque cid<0..2^8-1>;
451 * } ConnectionId;
452 */
453
454 if( len < 1 )
455 {
456 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
457 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
458 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
459 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
460 }
461
462 peer_cid_len = *buf++;
463 len--;
464
465 if( len != peer_cid_len )
466 {
467 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
468 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
469 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
470 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
471 }
472
473 /* Ignore CID if the user has disabled its use. */
474 if( ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
475 {
476 /* Leave ssl->handshake->cid_in_use in its default
477 * value of MBEDTLS_SSL_CID_DISABLED. */
478 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Client sent CID extension, but CID disabled" ) );
479 return( 0 );
480 }
481
482 if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
483 {
484 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
485 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
486 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
487 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
488 }
489
Hanno Becker19976b52019-05-03 12:43:44 +0100490 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
Hanno Beckerc403b262019-04-26 13:56:39 +0100491 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
492 memcpy( ssl->handshake->peer_cid, buf, peer_cid_len );
493
494 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
495 MBEDTLS_SSL_DEBUG_BUF( 3, "Client CID", buf, peer_cid_len );
496
Hanno Beckerc403b262019-04-26 13:56:39 +0100497 return( 0 );
498}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100499#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc403b262019-04-26 13:56:39 +0100500
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200501#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
502static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200503 const unsigned char *buf,
504 size_t len )
505{
506 if( len != 0 )
507 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200508 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200509 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
510 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200511 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200512 }
513
514 ((void) buf);
515
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200516 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200517 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200518
519 return( 0 );
520}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200521#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
524static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100525 const unsigned char *buf,
526 size_t len )
527{
528 if( len != 0 )
529 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200530 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200531 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
532 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200533 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100534 }
535
536 ((void) buf);
537
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200538 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200539 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100540 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200541 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100542 }
543
544 return( 0 );
545}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200546#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
549static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200550 const unsigned char *buf,
551 size_t len )
552{
553 if( len != 0 )
554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200556 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
557 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200558 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200559 }
560
561 ((void) buf);
562
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200563 return( 0 );
564}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200566
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200567#if defined(MBEDTLS_SSL_SESSION_TICKETS)
568static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200569 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200570 size_t len )
571{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200572 int ret;
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200573 mbedtls_ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200574
Manuel Pégourié-Gonnardbae389b2015-06-24 10:45:58 +0200575 mbedtls_ssl_session_init( &session );
576
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200577 if( ssl->conf->f_ticket_parse == NULL ||
578 ssl->conf->f_ticket_write == NULL )
579 {
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200580 return( 0 );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200581 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200582
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200583 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200584 ssl->handshake->new_session_ticket = 1;
585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200587
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200588 if( len == 0 )
589 return( 0 );
590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200591#if defined(MBEDTLS_SSL_RENEGOTIATION)
592 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200593 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200594 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200595 return( 0 );
596 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200597#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200598
599 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200600 * Failures are ok: just ignore the ticket and proceed.
601 */
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200602 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
603 buf, len ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200604 {
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200605 mbedtls_ssl_session_free( &session );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200606
607 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
608 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
609 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
610 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
611 else
612 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
613
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200614 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200615 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200616
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200617 /*
618 * Keep the session ID sent by the client, since we MUST send it back to
619 * inform them we're accepting the ticket (RFC 5077 section 3.4)
620 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200621 session.id_len = ssl->session_negotiate->id_len;
622 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200623
624 mbedtls_ssl_session_free( ssl->session_negotiate );
625 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
626
627 /* Zeroize instead of free as we copied the content */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500628 mbedtls_platform_zeroize( &session, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200630 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200631
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200632 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200633
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200634 /* Don't send a new ticket after all, this one is OK */
635 ssl->handshake->new_session_ticket = 0;
636
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200637 return( 0 );
638}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200639#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200641#if defined(MBEDTLS_SSL_ALPN)
642static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard14beb082014-07-08 13:50:35 +0200643 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200644{
Paul Bakker14b16c62014-05-28 11:33:54 +0200645 size_t list_len, cur_len, ours_len;
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200646 const unsigned char *theirs, *start, *end;
647 const char **ours;
648
649 /* If ALPN not configured, just ignore the extension */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200650 if( ssl->conf->alpn_list == NULL )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200651 return( 0 );
652
653 /*
654 * opaque ProtocolName<1..2^8-1>;
655 *
656 * struct {
657 * ProtocolName protocol_name_list<2..2^16-1>
658 * } ProtocolNameList;
659 */
660
661 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
662 if( len < 4 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200663 {
664 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
665 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200666 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200667 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200668
669 list_len = ( buf[0] << 8 ) | buf[1];
670 if( list_len != len - 2 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200671 {
672 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
673 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200675 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200676
677 /*
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100678 * Validate peer's list (lengths)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200679 */
680 start = buf + 2;
681 end = buf + len;
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100682 for( theirs = start; theirs != end; theirs += cur_len )
683 {
684 cur_len = *theirs++;
685
686 /* Current identifier must fit in list */
687 if( cur_len > (size_t)( end - theirs ) )
688 {
689 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
690 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
691 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
692 }
693
694 /* Empty strings MUST NOT be included */
695 if( cur_len == 0 )
696 {
697 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
698 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
699 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
700 }
701 }
702
703 /*
704 * Use our order of preference
705 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200706 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200707 {
Paul Bakker14b16c62014-05-28 11:33:54 +0200708 ours_len = strlen( *ours );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200709 for( theirs = start; theirs != end; theirs += cur_len )
710 {
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200711 cur_len = *theirs++;
712
Paul Bakker14b16c62014-05-28 11:33:54 +0200713 if( cur_len == ours_len &&
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200714 memcmp( theirs, *ours, cur_len ) == 0 )
715 {
716 ssl->alpn_chosen = *ours;
717 return( 0 );
718 }
719 }
720 }
721
722 /* If we get there, no match was found */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200723 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
724 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
725 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200726}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200727#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200728
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100729/*
730 * Auxiliary functions for ServerHello parsing and related actions
731 */
732
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200733#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100734/*
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100735 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100736 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737#if defined(MBEDTLS_ECDSA_C)
738static int ssl_check_key_curve( mbedtls_pk_context *pk,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100739 mbedtls_ecp_group_id const *acceptable_ec_grp_ids )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100740{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200741 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100742
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100743 if( acceptable_ec_grp_ids == NULL )
744 return( -1 );
745
746 while( *acceptable_ec_grp_ids != MBEDTLS_ECP_DP_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100747 {
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100748 if( *acceptable_ec_grp_ids == grp_id )
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100749 return( 0 );
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100750 acceptable_ec_grp_ids++;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100751 }
752
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100753 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100754}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100756
757/*
758 * Try picking a certificate for this ciphersuite,
759 * return 0 on success and -1 on failure.
760 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200761static int ssl_pick_cert( mbedtls_ssl_context *ssl,
Hanno Becker473f98f2019-06-26 10:27:32 +0100762 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100763 mbedtls_ecp_group_id const *acceptable_ec_grp_ids )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100764{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200765 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100766 mbedtls_pk_type_t pk_alg =
767 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200768 uint32_t flags;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100769
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200770#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100771 if( ssl->handshake->sni_key_cert != NULL )
772 list = ssl->handshake->sni_key_cert;
773 else
774#endif
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200775 list = ssl->conf->key_cert;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100776
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200777 if( pk_alg == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100778 return( 0 );
779
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200780 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000781
Manuel Pégourié-Gonnarde540b492015-07-07 12:44:38 +0200782 if( list == NULL )
783 {
784 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
785 return( -1 );
786 }
787
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100788 for( cur = list; cur != NULL; cur = cur->next )
789 {
Hanno Becker30649f72019-02-26 16:49:40 +0000790 int match = 1;
791 mbedtls_pk_context *pk;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000792
Hanno Becker30649f72019-02-26 16:49:40 +0000793 /* WARNING: With the current X.509 caching architecture, this MUST
794 * happen outside of the PK acquire/release block, because it moves
795 * the cached PK context. In a threading-enabled build, this would
796 * rightfully fail, but lead to a use-after-free otherwise. */
797 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
798 cur->cert );
799
Hanno Becker74b89f62019-02-17 21:22:07 +0000800#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
801 /* ASYNC_PRIVATE may use a NULL entry for the opaque private key, so
802 * we have to use the public key context to infer the capabilities
803 * of the key. */
Hanno Becker30649f72019-02-26 16:49:40 +0000804 {
805 int ret;
806 ret = mbedtls_x509_crt_pk_acquire( cur->cert, &pk );
807 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +0100808 {
809 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker30649f72019-02-26 16:49:40 +0000810 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +0100811 }
Hanno Becker30649f72019-02-26 16:49:40 +0000812 }
Hanno Becker74b89f62019-02-17 21:22:07 +0000813#else
814 /* Outside of ASYNC_PRIVATE, use private key context directly
815 * instead of querying for the public key context from the
816 * certificate, so save a few bytes of code. */
Hanno Becker30649f72019-02-26 16:49:40 +0000817 pk = cur->key;
Hanno Becker74b89f62019-02-17 21:22:07 +0000818#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100819
Hanno Becker74b89f62019-02-17 21:22:07 +0000820 if( ! mbedtls_pk_can_do( pk, pk_alg ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000821 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200822 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Hanno Becker30649f72019-02-26 16:49:40 +0000823 match = 0;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000824 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100825
Hanno Becker30649f72019-02-26 16:49:40 +0000826#if defined(MBEDTLS_ECDSA_C)
827 if( pk_alg == MBEDTLS_PK_ECDSA &&
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100828 ssl_check_key_curve( pk, acceptable_ec_grp_ids ) != 0 )
Hanno Becker30649f72019-02-26 16:49:40 +0000829 {
830 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
831 match = 0;
832 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100833#else
834 ((void) acceptable_ec_grp_ids);
Hanno Becker30649f72019-02-26 16:49:40 +0000835#endif
836
837#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +0000838 mbedtls_x509_crt_pk_release( cur->cert );
Hanno Becker30649f72019-02-26 16:49:40 +0000839#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
840
841 if( match == 0 )
842 continue;
843
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200844 /*
845 * This avoids sending the client a cert it'll reject based on
846 * keyUsage or other extensions.
847 *
848 * It also allows the user to provision different certificates for
849 * different uses based on keyUsage, eg if they want to avoid signing
850 * and decrypting with the same RSA key.
851 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200852 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +0100853 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200854 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200855 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000856 "(extended) key usage extension" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200857 continue;
858 }
859
Hanno Becker828a8c02019-02-26 16:48:55 +0000860#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
861 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100862 /*
863 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
864 * present them a SHA-higher cert rather than failing if it's the only
865 * one we got that satisfies the other conditions.
866 */
Hanno Becker30649f72019-02-26 16:49:40 +0000867 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100868 {
Hanno Becker30649f72019-02-26 16:49:40 +0000869 mbedtls_md_type_t sig_md;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000870 {
Hanno Becker30649f72019-02-26 16:49:40 +0000871 int ret;
Hanno Becker5f268b32019-05-20 16:26:34 +0100872 mbedtls_x509_crt_frame const *frame;
Hanno Becker30649f72019-02-26 16:49:40 +0000873 ret = mbedtls_x509_crt_frame_acquire( cur->cert, &frame );
874 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +0100875 {
876 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_frame_acquire", ret );
Hanno Becker30649f72019-02-26 16:49:40 +0000877 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +0100878 }
Hanno Becker30649f72019-02-26 16:49:40 +0000879 sig_md = frame->sig_md;
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +0000880 mbedtls_x509_crt_frame_release( cur->cert );
Hanno Becker30649f72019-02-26 16:49:40 +0000881 }
882
883 if( sig_md != MBEDTLS_MD_SHA1 )
884 {
885 if( fallback == NULL )
886 fallback = cur;
887
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200888 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Hanno Becker30649f72019-02-26 16:49:40 +0000889 "sha-2 with pre-TLS 1.2 client" ) );
890 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000891 }
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100892 }
Hanno Becker828a8c02019-02-26 16:48:55 +0000893#endif /* MBEDTLS_SSL_PROTO_TLS1 ||
894 MBEDTLS_SSL_PROTO_TLS1_1 ||
895 MBEDTLS_SSL_PROTO_SSL3 */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100896
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100897 /* If we get there, we got a winner */
898 break;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100899 }
900
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000901 if( cur == NULL )
902 cur = fallback;
903
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200904 /* Do not update ssl->handshake->key_cert unless there is a match */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100905 if( cur != NULL )
906 {
907 ssl->handshake->key_cert = cur;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200908 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000909 ssl->handshake->key_cert->cert );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100910 return( 0 );
911 }
912
913 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100914}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200915#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100916
917/*
918 * Check if a given ciphersuite is suitable for use with our config/keys/etc
919 * Sets ciphersuite_info only if the suite matches.
920 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200921static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
Hanno Becker473f98f2019-06-26 10:27:32 +0100922 mbedtls_ssl_ciphersuite_handle_t *ciphersuite_info,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100923 mbedtls_ecp_group_id const *acceptable_ec_grp_ids )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100924{
Hanno Becker473f98f2019-06-26 10:27:32 +0100925 mbedtls_ssl_ciphersuite_handle_t suite_info;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100926
Hanno Becker7e5437a2017-04-28 17:15:26 +0100927#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Hanno Becker4cb1f4d2017-10-10 15:59:57 +0100928 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100929 mbedtls_pk_type_t sig_type;
930#endif
931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200932 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Hanno Becker473f98f2019-06-26 10:27:32 +0100933 if( suite_info == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100934 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200935 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
936 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100937 }
938
Hanno Becker473f98f2019-06-26 10:27:32 +0100939 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s",
940 mbedtls_ssl_suite_get_name( suite_info ) ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000941
Hanno Becker473f98f2019-06-26 10:27:32 +0100942 if( mbedtls_ssl_suite_get_min_minor_ver( suite_info ) > ssl->minor_ver ||
943 mbedtls_ssl_suite_get_max_minor_ver( suite_info ) < ssl->minor_ver )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100946 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000947 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200949#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200950 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Hanno Becker473f98f2019-06-26 10:27:32 +0100951 ( mbedtls_ssl_suite_get_flags( suite_info ) &
952 MBEDTLS_CIPHERSUITE_NODTLS ) )
953 {
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +0100954 return( 0 );
Hanno Becker473f98f2019-06-26 10:27:32 +0100955 }
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +0100956#endif
957
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200958#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200959 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
Hanno Becker473f98f2019-06-26 10:27:32 +0100960 mbedtls_ssl_suite_get_cipher( suite_info ) == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000961 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200962 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100963 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000964 }
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200965#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100966
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200967#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +0100968 if( mbedtls_ssl_suite_get_key_exchange( suite_info ) ==
969 MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200970 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200971 {
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200972 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
973 "not configured or ext missing" ) );
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200974 return( 0 );
975 }
976#endif
977
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200978#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
979 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100980 ssl->handshake->curve_info == NULL )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000981 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200982 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000983 "no common elliptic curve" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100984 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000985 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100986#endif
987
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200988#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100989 /* If the ciphersuite requires a pre-shared key and we don't
990 * have one, skip it now rather than failing later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200991 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200992 ssl->conf->f_psk == NULL &&
993 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
994 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000995 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200996 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100997 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000998 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100999#endif
1000
Hanno Becker7e5437a2017-04-28 17:15:26 +01001001#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1002 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1003 /* If the ciphersuite requires signing, check whether
1004 * a suitable hash algorithm is present. */
1005 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1006 {
1007 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg( suite_info );
1008 if( sig_type != MBEDTLS_PK_NONE &&
1009 mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs, sig_type ) == MBEDTLS_MD_NONE )
1010 {
1011 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm "
1012 "for signature algorithm %d", sig_type ) );
1013 return( 0 );
1014 }
1015 }
1016
1017#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1018 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1019
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001020#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001021 /*
1022 * Final check: if ciphersuite requires us to have a
1023 * certificate/key of a particular type:
1024 * - select the appropriate certificate if we have one, or
1025 * - try the next ciphersuite if we don't
1026 * This must be done last since we modify the key_cert list.
1027 */
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001028 if( ssl_pick_cert( ssl, suite_info, acceptable_ec_grp_ids ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001029 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001030 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001031 "no suitable certificate" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001032 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001033 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001034#else
1035 ((void) acceptable_ec_grp_ids);
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001036#endif
1037
1038 *ciphersuite_info = suite_info;
1039 return( 0 );
1040}
1041
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1043static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
Paul Bakker78a8c712013-03-06 17:01:52 +01001044{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001045 int ret, got_common_suite;
Paul Bakker78a8c712013-03-06 17:01:52 +01001046 unsigned int i, j;
1047 size_t n;
1048 unsigned int ciph_len, sess_len, chal_len;
1049 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001050 const int *ciphersuites;
Hanno Becker473f98f2019-06-26 10:27:32 +01001051 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +01001052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001053 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001055#if defined(MBEDTLS_SSL_RENEGOTIATION)
1056 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001057 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001058 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001059 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1060 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001061 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001062 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001063#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker78a8c712013-03-06 17:01:52 +01001064
1065 buf = ssl->in_hdr;
1066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
Paul Bakker78a8c712013-03-06 17:01:52 +01001068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001069 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001070 buf[2] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001072 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001073 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
Paul Bakker78a8c712013-03-06 17:01:52 +01001074 buf[3], buf[4] ) );
1075
1076 /*
1077 * SSLv2 Client Hello
1078 *
1079 * Record layer:
1080 * 0 . 1 message length
1081 *
1082 * SSL layer:
1083 * 2 . 2 message type
1084 * 3 . 4 protocol version
1085 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001086 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
1087 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001088 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001089 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1090 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001091 }
1092
1093 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
1094
1095 if( n < 17 || n > 512 )
1096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001097 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1098 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001099 }
1100
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001101 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001102 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
1103 ? buf[4] : ssl->conf->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +01001104
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001105 if( ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker78a8c712013-03-06 17:01:52 +01001106 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001107 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001108 " [%d:%d] < [%d:%d]",
1109 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001110 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001112 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1113 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1114 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker78a8c712013-03-06 17:01:52 +01001115 }
1116
Paul Bakker2fbefde2013-06-29 16:01:15 +02001117 ssl->handshake->max_major_ver = buf[3];
1118 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +01001119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001120 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001121 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001122 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Paul Bakker78a8c712013-03-06 17:01:52 +01001123 return( ret );
1124 }
1125
1126 ssl->handshake->update_checksum( ssl, buf + 2, n );
1127
1128 buf = ssl->in_msg;
1129 n = ssl->in_left - 5;
1130
1131 /*
1132 * 0 . 1 ciphersuitelist length
1133 * 2 . 3 session id length
1134 * 4 . 5 challenge length
1135 * 6 . .. ciphersuitelist
1136 * .. . .. session id
1137 * .. . .. challenge
1138 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001139 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
Paul Bakker78a8c712013-03-06 17:01:52 +01001140
1141 ciph_len = ( buf[0] << 8 ) | buf[1];
1142 sess_len = ( buf[2] << 8 ) | buf[3];
1143 chal_len = ( buf[4] << 8 ) | buf[5];
1144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001145 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001146 ciph_len, sess_len, chal_len ) );
1147
1148 /*
1149 * Make sure each parameter length is valid
1150 */
1151 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
1152 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001153 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1154 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001155 }
1156
1157 if( sess_len > 32 )
1158 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001159 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1160 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001161 }
1162
1163 if( chal_len < 8 || chal_len > 32 )
1164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1166 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001167 }
1168
1169 if( n != 6 + ciph_len + sess_len + chal_len )
1170 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001171 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1172 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001173 }
1174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001175 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Paul Bakker78a8c712013-03-06 17:01:52 +01001176 buf + 6, ciph_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001177 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
Paul Bakker78a8c712013-03-06 17:01:52 +01001178 buf + 6 + ciph_len, sess_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001179 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
Paul Bakker78a8c712013-03-06 17:01:52 +01001180 buf + 6 + ciph_len + sess_len, chal_len );
1181
1182 p = buf + 6 + ciph_len;
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001183 ssl->session_negotiate->id_len = sess_len;
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001184 memset( ssl->session_negotiate->id, 0,
1185 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001186 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
Paul Bakker78a8c712013-03-06 17:01:52 +01001187
1188 p += sess_len;
1189 memset( ssl->handshake->randbytes, 0, 64 );
1190 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
1191
1192 /*
1193 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1194 */
1195 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1196 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001197 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Paul Bakker78a8c712013-03-06 17:01:52 +01001198 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001199 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1200#if defined(MBEDTLS_SSL_RENEGOTIATION)
1201 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Paul Bakker78a8c712013-03-06 17:01:52 +01001202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001204 "during renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001205
Gilles Peskinec94f7352017-05-10 16:37:56 +02001206 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1207 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001208 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001209 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001210#endif /* MBEDTLS_SSL_RENEGOTIATION */
1211 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker78a8c712013-03-06 17:01:52 +01001212 break;
1213 }
1214 }
1215
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001217 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1218 {
1219 if( p[0] == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001220 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1221 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001222 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001224
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001225 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001226 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001227 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001229 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1230 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001231
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001232 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001233 }
1234
1235 break;
1236 }
1237 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001238#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001239
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001240 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001241 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Hanno Becker473f98f2019-06-26 10:27:32 +01001242 ciphersuite_info = MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001243#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001244 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001245 for( i = 0; ciphersuites[i] != 0; i++ )
1246#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001247 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +01001248 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001249#endif
Paul Bakker78a8c712013-03-06 17:01:52 +01001250 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001251 if( p[0] != 0 ||
1252 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1253 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
1254 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +02001255
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001256 got_common_suite = 1;
1257
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001258 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001259 &ciphersuite_info,
1260 NULL ) ) )
1261 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001262 return( ret );
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001263 }
Paul Bakker59c28a22013-06-29 15:33:42 +02001264
Hanno Becker473f98f2019-06-26 10:27:32 +01001265 if( ciphersuite_info != MBEDTLS_SSL_CIPHERSUITE_INVALD_HANDLE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001266 goto have_ciphersuite_v2;
1267 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001268
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001269 if( got_common_suite )
1270 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001271 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001272 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001273 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001274 }
1275 else
1276 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001277 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1278 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001279 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001280
1281have_ciphersuite_v2:
Hanno Becker473f98f2019-06-26 10:27:32 +01001282 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s",
1283 mbedtls_ssl_suite_get_name( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001284
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001285 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Becker8759e162017-12-27 21:34:08 +00001286 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +01001287
1288 /*
1289 * SSLv2 Client Hello relevant renegotiation security checks
1290 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001291 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01001292 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
1293 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001294 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001296 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1297 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001298 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001299 }
1300
1301 ssl->in_left = 0;
1302 ssl->state++;
1303
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001304 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001305
1306 return( 0 );
1307}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001308#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
Paul Bakker78a8c712013-03-06 17:01:52 +01001309
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001310/* This function doesn't alert on errors that happen early during
1311 ClientHello parsing because they might indicate that the client is
1312 not talking SSL/TLS at all and would not understand our alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001313static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001314{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001315 int ret, got_common_suite;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001316 size_t i, j;
1317 size_t ciph_offset, comp_offset, ext_offset;
1318 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001319#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001320 size_t cookie_offset, cookie_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001321#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001322 unsigned char *buf, *p, *ext;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001323#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001324 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001325#endif
Hanno Becker03b64fa2019-06-11 14:39:38 +01001326#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1327 int extended_ms_seen = 0;
1328#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001329 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001330 const int *ciphersuites;
Hanno Becker473f98f2019-06-26 10:27:32 +01001331 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001332 int major, minor;
Paul Bakker5121ce52009-01-03 21:22:43 +00001333
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001334#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1335 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1336 mbedtls_ecp_group_id acceptable_ec_grp_ids[ MBEDTLS_ECP_DP_MAX ];
1337#else
1338 mbedtls_ecp_group_id * acceptable_ec_grp_ids = NULL;
1339#endif
1340
Hanno Becker7e5437a2017-04-28 17:15:26 +01001341 /* If there is no signature-algorithm extension present,
1342 * we need to fall back to the default values for allowed
1343 * signature-hash pairs. */
1344#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1345 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1346 int sig_hash_alg_ext_present = 0;
1347#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1348 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1349
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001350 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001351
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001352#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001353read_record_header:
1354#endif
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001355 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001356 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001357 * otherwise read it ourselves manually in order to support SSLv2
1358 * ClientHello, which doesn't use the same record layer format.
1359 */
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001360 if( mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
1361 ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001362 {
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001363 /* No alert on a read error. */
1364 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
1365 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001366 }
1367
1368 buf = ssl->in_hdr;
1369
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001370#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) && \
1371 defined(MBEDTLS_SSL_PROTO_TLS)
1372 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) &&
1373 ( buf[0] & 0x80 ) != 0 )
1374 {
1375 return( ssl_parse_client_hello_v2( ssl ) );
1376 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001377#endif
1378
Hanno Becker43395762019-05-03 14:46:38 +01001379 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_in_hdr_len( ssl ) );
Paul Bakkerec636f32012-09-09 19:17:02 +00001380
Paul Bakkerec636f32012-09-09 19:17:02 +00001381 /*
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001382 * SSLv3/TLS Client Hello
Paul Bakkerec636f32012-09-09 19:17:02 +00001383 *
1384 * Record layer:
1385 * 0 . 0 message type
1386 * 1 . 2 protocol version
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001387 * 3 . 11 DTLS: epoch + record sequence number
Paul Bakkerec636f32012-09-09 19:17:02 +00001388 * 3 . 4 message length
1389 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001390 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001391 buf[0] ) );
1392
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001393 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001394 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001395 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1396 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001397 }
1398
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001399 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001400 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
1401
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001402 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001403 buf[1], buf[2] ) );
1404
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001405 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001406
1407 /* According to RFC 5246 Appendix E.1, the version here is typically
1408 * "{03,00}, the lowest version number supported by the client, [or] the
1409 * value of ClientHello.client_version", so the only meaningful check here
1410 * is the major version shouldn't be less than 3 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001411 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001412 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001413 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1414 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001415 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001416
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001417 /* For DTLS if this is the initial handshake, remember the client sequence
1418 * number to use it in our next message (RFC 6347 4.2.1) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001419#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001420 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
1421 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001422 {
1423 /* Epoch should be 0 for initial handshakes */
1424 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
1425 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001426 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1427 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001428 }
1429
Hanno Becker19859472018-08-06 09:40:20 +01001430 memcpy( ssl->cur_out_ctr + 2, ssl->in_ctr + 2, 6 );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001431
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001432#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1433 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001434 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001435 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001436 ssl->next_record_offset = 0;
1437 ssl->in_left = 0;
1438 goto read_record_header;
1439 }
1440
1441 /* No MAC to check yet, so we can update right now */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001442 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001443#endif
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001444 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001445#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001446
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001447 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Paul Bakker5121ce52009-01-03 21:22:43 +00001448
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001449#if defined(MBEDTLS_SSL_RENEGOTIATION)
1450 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001451 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001452 /* Set by mbedtls_ssl_read_record() */
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001453 msg_len = ssl->in_hslen;
1454 }
1455 else
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001456#endif
Paul Bakkerec636f32012-09-09 19:17:02 +00001457 {
Angus Grattond8213d02016-05-25 20:56:48 +10001458 if( msg_len > MBEDTLS_SSL_IN_CONTENT_LEN )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001459 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001460 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1461 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001462 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001463
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01001464 if( ( ret = mbedtls_ssl_fetch_input( ssl,
Hanno Becker43395762019-05-03 14:46:38 +01001465 mbedtls_ssl_in_hdr_len( ssl ) + msg_len ) ) != 0 )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001466 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001467 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001468 return( ret );
1469 }
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001470
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001471 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001472#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001473 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
1474 {
Hanno Becker43395762019-05-03 14:46:38 +01001475 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len( ssl );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001476 }
1477 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001478#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001479#if defined(MBEDTLS_SSL_PROTO_TLS)
1480 {
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001481 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001482 }
1483#endif
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001484 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001485
1486 buf = ssl->in_msg;
Paul Bakkerec636f32012-09-09 19:17:02 +00001487
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001488 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001489
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001490 ssl->handshake->update_checksum( ssl, buf, msg_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001491
1492 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001493 * Handshake layer:
1494 * 0 . 0 handshake type
1495 * 1 . 3 handshake length
1496 * 4 . 5 DTLS only: message seqence number
1497 * 6 . 8 DTLS only: fragment offset
1498 * 9 . 11 DTLS only: fragment length
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001499 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001500 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001501 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001502 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1503 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001504 }
1505
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001506 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001508 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001509 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001510 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1511 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001512 }
1513
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001514 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001515 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1516
1517 /* We don't support fragmentation of ClientHello (yet?) */
1518 if( buf[1] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001519 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001520 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001521 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1522 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001523 }
1524
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001525#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02001526 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001527 {
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001528 /*
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001529 * Copy the client's handshake message_seq on initial handshakes,
1530 * check sequence number on renego.
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001531 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001532#if defined(MBEDTLS_SSL_RENEGOTIATION)
1533 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001534 {
1535 /* This couldn't be done in ssl_prepare_handshake_record() */
1536 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1537 ssl->in_msg[5];
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001538
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001539 if( cli_msg_seq != ssl->handshake->in_msg_seq )
1540 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001541 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001542 "%d (expected %d)", cli_msg_seq,
1543 ssl->handshake->in_msg_seq ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001544 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001545 }
1546
1547 ssl->handshake->in_msg_seq++;
1548 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001549 else
1550#endif
1551 {
1552 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1553 ssl->in_msg[5];
1554 ssl->handshake->out_msg_seq = cli_msg_seq;
1555 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1556 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001557
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001558 /*
1559 * For now we don't support fragmentation, so make sure
1560 * fragment_offset == 0 and fragment_length == length
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001561 */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001562 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
1563 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
1564 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001565 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
1566 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001567 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001568 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001569#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001570
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001571 buf += mbedtls_ssl_hs_hdr_len( ssl );
1572 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001573
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001574 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001575 * ClientHello layer:
1576 * 0 . 1 protocol version
1577 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1578 * 34 . 35 session id length (1 byte)
1579 * 35 . 34+x session id
1580 * 35+x . 35+x DTLS only: cookie length (1 byte)
1581 * 36+x . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001582 * .. . .. ciphersuite list length (2 bytes)
1583 * .. . .. ciphersuite list
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001584 * .. . .. compression alg. list length (1 byte)
1585 * .. . .. compression alg. list
1586 * .. . .. extensions length (2 bytes, optional)
1587 * .. . .. extensions (optional)
Paul Bakkerec636f32012-09-09 19:17:02 +00001588 */
Paul Bakkerec636f32012-09-09 19:17:02 +00001589
1590 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01001591 * Minimal length (with everything empty and extensions omitted) is
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001592 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1593 * read at least up to session id length without worrying.
Paul Bakkerec636f32012-09-09 19:17:02 +00001594 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001595 if( msg_len < 38 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001596 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001597 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1598 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001599 }
1600
1601 /*
1602 * Check and save the protocol version
1603 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001604 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001606 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001607 ssl->conf->transport, buf );
Paul Bakkerec636f32012-09-09 19:17:02 +00001608
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001609 ssl->handshake->max_major_ver = ssl->major_ver;
1610 ssl->handshake->max_minor_ver = ssl->minor_ver;
1611
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001612 if( ssl->major_ver < ssl->conf->min_major_ver ||
1613 ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00001614 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001615 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001616 " [%d:%d] < [%d:%d]",
1617 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001618 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001619 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1620 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001621 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001622 }
1623
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001624 if( ssl->major_ver > ssl->conf->max_major_ver )
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001625 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001626 ssl->major_ver = ssl->conf->max_major_ver;
1627 ssl->minor_ver = ssl->conf->max_minor_ver;
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001628 }
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001629 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
1630 ssl->minor_ver = ssl->conf->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001631
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001632 /*
1633 * Save client random (inc. Unix time)
1634 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001635 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001636
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001637 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001638
1639 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001640 * Check the session ID length and save session ID
Paul Bakkerec636f32012-09-09 19:17:02 +00001641 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001642 sess_len = buf[34];
Paul Bakkerec636f32012-09-09 19:17:02 +00001643
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001644 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001645 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Paul Bakkerec636f32012-09-09 19:17:02 +00001646 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001647 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001648 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1649 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001650 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001651 }
1652
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001654
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001655 ssl->session_negotiate->id_len = sess_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001656 memset( ssl->session_negotiate->id, 0,
1657 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001658 memcpy( ssl->session_negotiate->id, buf + 35,
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001659 ssl->session_negotiate->id_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001660
1661 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001662 * Check the cookie length and content
1663 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001664#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001665 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001666 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001667 cookie_offset = 35 + sess_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001668 cookie_len = buf[cookie_offset];
1669
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001670 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001671 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001672 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001673 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1674 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001675 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001676 }
1677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001678 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001679 buf + cookie_offset + 1, cookie_len );
1680
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001681#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001682 if( ssl->conf->f_cookie_check != NULL &&
1683 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001684 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001685 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001686 buf + cookie_offset + 1, cookie_len,
1687 ssl->cli_id, ssl->cli_id_len ) != 0 )
1688 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001690 ssl->handshake->verify_cookie_len = 1;
1691 }
1692 else
1693 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001694 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001695 ssl->handshake->verify_cookie_len = 0;
1696 }
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001697 }
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02001698 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001699#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001700 {
1701 /* We know we didn't send a cookie, so it should be empty */
1702 if( cookie_len != 0 )
1703 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001704 /* This may be an attacker's probe, so don't send an alert */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1706 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001707 }
1708
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001709 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001710 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001711
1712 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001713 * Check the ciphersuitelist length (will be parsed later)
Paul Bakkerec636f32012-09-09 19:17:02 +00001714 */
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001715 ciph_offset = cookie_offset + 1 + cookie_len;
Manuel Pégourié-Gonnarda06d7fe2015-03-13 10:36:55 +00001716 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001717 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001718#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001719#if defined(MBEDTLS_SSL_PROTO_TLS)
1720 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001721 ciph_offset = 35 + sess_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001722 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02001723#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakkerec636f32012-09-09 19:17:02 +00001724
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001725 ciph_len = ( buf[ciph_offset + 0] << 8 )
1726 | ( buf[ciph_offset + 1] );
1727
1728 if( ciph_len < 2 ||
1729 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1730 ( ciph_len % 2 ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001731 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001732 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001733 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1734 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001735 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001736 }
1737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001738 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001739 buf + ciph_offset + 2, ciph_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001740
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001741 /*
1742 * Check the compression algorithms length and pick one
1743 */
1744 comp_offset = ciph_offset + 2 + ciph_len;
1745
1746 comp_len = buf[comp_offset];
1747
1748 if( comp_len < 1 ||
1749 comp_len > 16 ||
1750 comp_len + comp_offset + 1 > msg_len )
Paul Bakkerec636f32012-09-09 19:17:02 +00001751 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001752 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001753 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1754 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001755 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001756 }
1757
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001758 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001759 buf + comp_offset + 1, comp_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001760
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001761 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
1762#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakkerec636f32012-09-09 19:17:02 +00001763 for( i = 0; i < comp_len; ++i )
1764 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001765 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001766 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001767 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001768 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001769 }
1770 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001771#endif
1772
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001773 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001774#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02001775 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001776 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001777#endif
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001778
Janos Follathc6dab2b2016-05-23 14:27:02 +01001779 /* Do not parse the extensions if the protocol is SSLv3 */
1780#if defined(MBEDTLS_SSL_PROTO_SSL3)
1781 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
1782 {
1783#endif
Simon Butcher584a5472016-05-23 16:24:52 +01001784 /*
1785 * Check the extension length
1786 */
1787 ext_offset = comp_offset + 1 + comp_len;
1788 if( msg_len > ext_offset )
Paul Bakker48916f92012-09-16 19:57:18 +00001789 {
Simon Butcher584a5472016-05-23 16:24:52 +01001790 if( msg_len < ext_offset + 2 )
1791 {
1792 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001793 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1794 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001795 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1796 }
1797
1798 ext_len = ( buf[ext_offset + 0] << 8 )
1799 | ( buf[ext_offset + 1] );
1800
1801 if( ( ext_len > 0 && ext_len < 4 ) ||
1802 msg_len != ext_offset + 2 + ext_len )
1803 {
1804 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001805 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1806 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001807 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1808 }
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001809 }
Simon Butcher584a5472016-05-23 16:24:52 +01001810 else
1811 ext_len = 0;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001812
Simon Butcher584a5472016-05-23 16:24:52 +01001813 ext = buf + ext_offset + 2;
1814 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001815
Simon Butcher584a5472016-05-23 16:24:52 +01001816 while( ext_len != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001817 {
Philippe Antoine747fd532018-05-30 09:13:21 +02001818 unsigned int ext_id;
1819 unsigned int ext_size;
1820 if ( ext_len < 4 ) {
1821 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1822 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1823 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1824 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1825 }
1826 ext_id = ( ( ext[0] << 8 ) | ( ext[1] ) );
1827 ext_size = ( ( ext[2] << 8 ) | ( ext[3] ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001828
Simon Butcher584a5472016-05-23 16:24:52 +01001829 if( ext_size + 4 > ext_len )
1830 {
1831 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001832 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1833 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001834 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1835 }
1836 switch( ext_id )
1837 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001838#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001839 case MBEDTLS_TLS_EXT_SERVERNAME:
1840 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1841 if( ssl->conf->f_sni == NULL )
1842 break;
Paul Bakker5701cdc2012-09-27 21:49:42 +00001843
Simon Butcher584a5472016-05-23 16:24:52 +01001844 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1845 if( ret != 0 )
1846 return( ret );
1847 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001848#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001849
Simon Butcher584a5472016-05-23 16:24:52 +01001850 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1851 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001852#if defined(MBEDTLS_SSL_RENEGOTIATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001853 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001854#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001855
Simon Butcher584a5472016-05-23 16:24:52 +01001856 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1857 if( ret != 0 )
1858 return( ret );
1859 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001860
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001861#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1862 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001863 case MBEDTLS_TLS_EXT_SIG_ALG:
Ron Eldor73a38172017-10-03 15:58:26 +03001864 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1865
Simon Butcher584a5472016-05-23 16:24:52 +01001866 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1867 if( ret != 0 )
1868 return( ret );
Hanno Becker7e5437a2017-04-28 17:15:26 +01001869
1870 sig_hash_alg_ext_present = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001871 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001872#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1873 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001874
Robert Cragie136884c2015-10-02 13:34:31 +01001875#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001876 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001877 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1878 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Paul Bakker41c83d32013-03-20 14:39:14 +01001879
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001880 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4,
1881 ext_size,
1882 acceptable_ec_grp_ids );
Simon Butcher584a5472016-05-23 16:24:52 +01001883 if( ret != 0 )
1884 return( ret );
1885 break;
Paul Bakker41c83d32013-03-20 14:39:14 +01001886
Simon Butcher584a5472016-05-23 16:24:52 +01001887 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1888 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1889 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001890
Simon Butcher584a5472016-05-23 16:24:52 +01001891 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1892 if( ret != 0 )
1893 return( ret );
1894 break;
Robert Cragieae8535d2015-10-06 17:11:18 +01001895#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1896 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01001897
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001898#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001899 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1900 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001901
Simon Butcher584a5472016-05-23 16:24:52 +01001902 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
1903 if( ret != 0 )
1904 return( ret );
1905 break;
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001906#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1907
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001908#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Simon Butcher584a5472016-05-23 16:24:52 +01001909 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1910 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001911
Simon Butcher584a5472016-05-23 16:24:52 +01001912 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1913 if( ret != 0 )
1914 return( ret );
1915 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001916#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001917
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001918#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001919 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1920 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001921
Simon Butcher584a5472016-05-23 16:24:52 +01001922 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1923 if( ret != 0 )
1924 return( ret );
1925 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001926#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001927
Hanno Beckera5a2b082019-05-15 14:03:01 +01001928#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc403b262019-04-26 13:56:39 +01001929 case MBEDTLS_TLS_EXT_CID:
1930 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) );
1931
1932 ret = ssl_parse_cid_ext( ssl, ext + 4, ext_size );
1933 if( ret != 0 )
1934 return( ret );
1935 break;
1936#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1937
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001938#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001939 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1940 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001941
Simon Butcher584a5472016-05-23 16:24:52 +01001942 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1943 if( ret != 0 )
1944 return( ret );
1945 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001946#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001947
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001948#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Simon Butcher584a5472016-05-23 16:24:52 +01001949 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1950 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001951
Simon Butcher584a5472016-05-23 16:24:52 +01001952 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1953 if( ret != 0 )
1954 return( ret );
Hanno Becker03b64fa2019-06-11 14:39:38 +01001955 extended_ms_seen = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001956 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001957#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001958
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001959#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Simon Butcher584a5472016-05-23 16:24:52 +01001960 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1961 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001962
Simon Butcher584a5472016-05-23 16:24:52 +01001963 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1964 if( ret != 0 )
1965 return( ret );
1966 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001967#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001968
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001969#if defined(MBEDTLS_SSL_ALPN)
Simon Butcher584a5472016-05-23 16:24:52 +01001970 case MBEDTLS_TLS_EXT_ALPN:
1971 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001972
Simon Butcher584a5472016-05-23 16:24:52 +01001973 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1974 if( ret != 0 )
1975 return( ret );
1976 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001977#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001978
Simon Butcher584a5472016-05-23 16:24:52 +01001979 default:
1980 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1981 ext_id ) );
1982 }
1983
1984 ext_len -= 4 + ext_size;
1985 ext += 4 + ext_size;
1986
1987 if( ext_len > 0 && ext_len < 4 )
1988 {
1989 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001990 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1991 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001992 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1993 }
Paul Bakker48916f92012-09-16 19:57:18 +00001994 }
Janos Follathc6dab2b2016-05-23 14:27:02 +01001995#if defined(MBEDTLS_SSL_PROTO_SSL3)
1996 }
1997#endif
1998
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001999#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Gilles Peskined50177f2017-05-16 17:53:03 +02002000 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002001 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002002 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
2003 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002004 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002005 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002006
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002007 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002008 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002009 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002010
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002011 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2012 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002013
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002014 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002015 }
2016
2017 break;
2018 }
2019 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002020#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002021
Hanno Becker7e5437a2017-04-28 17:15:26 +01002022#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2023 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
2024
2025 /*
2026 * Try to fall back to default hash SHA1 if the client
2027 * hasn't provided any preferred signature-hash combinations.
2028 */
2029 if( sig_hash_alg_ext_present == 0 )
2030 {
2031 mbedtls_md_type_t md_default = MBEDTLS_MD_SHA1;
2032
2033 if( mbedtls_ssl_check_sig_hash( ssl, md_default ) != 0 )
2034 md_default = MBEDTLS_MD_NONE;
2035
2036 mbedtls_ssl_sig_hash_set_const_hash( &ssl->handshake->hash_algs, md_default );
2037 }
2038
2039#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
2040 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
2041
Paul Bakker48916f92012-09-16 19:57:18 +00002042 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002043 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
2044 */
2045 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
2046 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002047 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002048 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002049 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
2050#if defined(MBEDTLS_SSL_RENEGOTIATION)
2051 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002052 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002053 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
2054 "during renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002055 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2056 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002057 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002058 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00002059#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002060 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002061 break;
2062 }
2063 }
2064
2065 /*
Paul Bakker48916f92012-09-16 19:57:18 +00002066 * Renegotiation security checks
2067 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002068 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01002069 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
2070 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002071 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002072 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002073 handshake_failure = 1;
2074 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002075#if defined(MBEDTLS_SSL_RENEGOTIATION)
2076 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2077 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002078 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00002079 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002080 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002081 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00002082 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002083 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2084 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01002085 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf )
2086 == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00002087 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002088 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002089 handshake_failure = 1;
2090 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002091 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2092 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002093 renegotiation_info_seen == 1 )
2094 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002095 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002096 handshake_failure = 1;
2097 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002098#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002099
Jarno Lamsa842be162019-06-10 15:05:33 +03002100 /*
2101 * Check if extended master secret is being enforced
2102 */
2103#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +01002104 if( mbedtls_ssl_conf_get_ems( ssl->conf ) ==
Hanno Becker03b64fa2019-06-11 14:39:38 +01002105 MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Jarno Lamsa842be162019-06-10 15:05:33 +03002106 {
Hanno Becker03b64fa2019-06-11 14:39:38 +01002107 if( extended_ms_seen )
2108 {
Hanno Becker1ab322b2019-06-11 14:50:54 +01002109#if !defined(MBEDTLS_SSL_EXTENDED_MS_ENFORCED)
Hanno Becker03b64fa2019-06-11 14:39:38 +01002110 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Becker1ab322b2019-06-11 14:50:54 +01002111#endif /* !MBEDTLS_SSL_EXTENDED_MS_ENFORCED */
Hanno Becker03b64fa2019-06-11 14:39:38 +01002112 }
2113 else if( mbedtls_ssl_conf_get_ems_enforced( ssl->conf ) ==
2114 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED )
2115 {
2116 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Peer not offering extended master "
2117 "secret, while it is enforced") );
2118 handshake_failure = 1;
2119 }
Jarno Lamsa842be162019-06-10 15:05:33 +03002120 }
2121#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
2122
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002123 if( handshake_failure == 1 )
2124 {
Gilles Peskinec94f7352017-05-10 16:37:56 +02002125 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2126 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002127 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002128 }
Paul Bakker380da532012-04-18 16:10:25 +00002129
Paul Bakker41c83d32013-03-20 14:39:14 +01002130 /*
2131 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02002132 * (At the end because we need information from the EC-based extensions
2133 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01002134 */
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002135 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002136 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Hanno Becker473f98f2019-06-26 10:27:32 +01002137 ciphersuite_info = MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002138#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002139 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01002140 for( i = 0; ciphersuites[i] != 0; i++ )
2141#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002142 for( i = 0; ciphersuites[i] != 0; i++ )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002143 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01002144#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01002145 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002146 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
2147 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
2148 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01002149
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002150 got_common_suite = 1;
2151
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002152 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01002153 &ciphersuite_info,
2154 acceptable_ec_grp_ids ) ) != 0 )
2155 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002156 return( ret );
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01002157 }
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002158
Hanno Becker473f98f2019-06-26 10:27:32 +01002159 if( ciphersuite_info != MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002160 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01002161 }
Paul Bakker41c83d32013-03-20 14:39:14 +01002162
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002163 if( got_common_suite )
2164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002166 "but none of them usable" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002167 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2168 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002169 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002170 }
2171 else
2172 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002174 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2175 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002176 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002177 }
Paul Bakker41c83d32013-03-20 14:39:14 +01002178
2179have_ciphersuite:
Hanno Becker473f98f2019-06-26 10:27:32 +01002180 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s",
2181 mbedtls_ssl_suite_get_name( ciphersuite_info ) ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00002182
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002183 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Becker8759e162017-12-27 21:34:08 +00002184 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker41c83d32013-03-20 14:39:14 +01002185
Paul Bakker5121ce52009-01-03 21:22:43 +00002186 ssl->state++;
2187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002188#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002189 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002190 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002191#endif
2192
Hanno Becker7e5437a2017-04-28 17:15:26 +01002193 /* Debugging-only output for testsuite */
2194#if defined(MBEDTLS_DEBUG_C) && \
2195 defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2196 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
2197 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2198 {
2199 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg( ciphersuite_info );
2200 if( sig_alg != MBEDTLS_PK_NONE )
2201 {
2202 mbedtls_md_type_t md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
2203 sig_alg );
2204 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
2205 mbedtls_ssl_hash_from_md_alg( md_alg ) ) );
2206 }
2207 else
2208 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002209 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm "
2210 "%d - should not happen", sig_alg ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +01002211 }
2212 }
2213#endif
2214
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002215 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002216
2217 return( 0 );
2218}
2219
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002220#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
2221static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002222 unsigned char *buf,
2223 size_t *olen )
2224{
2225 unsigned char *p = buf;
2226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002227 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002228 {
2229 *olen = 0;
2230 return;
2231 }
2232
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002233 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002234
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002235 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
2236 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002237
2238 *p++ = 0x00;
2239 *p++ = 0x00;
2240
2241 *olen = 4;
2242}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002243#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002244
Hanno Beckera5a2b082019-05-15 14:03:01 +01002245#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker072d4ec2019-04-26 15:46:55 +01002246static void ssl_write_cid_ext( mbedtls_ssl_context *ssl,
2247 unsigned char *buf,
2248 size_t *olen )
2249{
2250 unsigned char *p = buf;
2251 size_t ext_len;
2252 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
2253
2254 *olen = 0;
2255
2256 /* Skip writing the extension if we don't want to use it or if
2257 * the client hasn't offered it. */
2258 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED )
2259 return;
2260
2261 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
2262 * which is at most 255, so the increment cannot overflow. */
2263 if( end < p || (size_t)( end - p ) < (unsigned)( ssl->own_cid_len + 5 ) )
2264 {
2265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2266 return;
2267 }
2268
2269 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding CID extension" ) );
2270
2271 /*
Hanno Becker3cdf8fe2019-05-15 10:26:32 +01002272 * Quoting draft-ietf-tls-dtls-connection-id-05
2273 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Becker072d4ec2019-04-26 15:46:55 +01002274 *
2275 * struct {
2276 * opaque cid<0..2^8-1>;
2277 * } ConnectionId;
2278 */
2279
2280 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID >> 8 ) & 0xFF );
2281 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID ) & 0xFF );
2282 ext_len = (size_t) ssl->own_cid_len + 1;
2283 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2284 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2285
2286 *p++ = (uint8_t) ssl->own_cid_len;
2287 memcpy( p, ssl->own_cid, ssl->own_cid_len );
2288
2289 *olen = ssl->own_cid_len + 5;
2290}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002291#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker072d4ec2019-04-26 15:46:55 +01002292
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002293#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2294static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002295 unsigned char *buf,
2296 size_t *olen )
2297{
2298 unsigned char *p = buf;
Hanno Becker473f98f2019-06-26 10:27:32 +01002299 mbedtls_ssl_ciphersuite_handle_t suite =
2300 MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002301 const mbedtls_cipher_info_t *cipher = NULL;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002302
Hanno Becker27b34d52017-10-20 14:24:51 +01002303 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002304 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002305 {
2306 *olen = 0;
2307 return;
2308 }
2309
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002310 /*
2311 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
2312 * from a client and then selects a stream or Authenticated Encryption
2313 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
2314 * encrypt-then-MAC response extension back to the client."
2315 */
Hanno Becker473f98f2019-06-26 10:27:32 +01002316 suite = mbedtls_ssl_ciphersuite_from_id(
2317 ssl->session_negotiate->ciphersuite );
2318 if( suite == MBEDTLS_SSL_CIPHERSUITE_INVALID_HANDLE )
2319 {
2320 *olen = 0;
2321 return;
2322 }
2323
2324 cipher = mbedtls_cipher_info_from_type(
2325 mbedtls_ssl_suite_get_cipher( suite ) );
2326 if( cipher == NULL ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002327 cipher->mode != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002328 {
2329 *olen = 0;
2330 return;
2331 }
2332
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002333 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002334
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002335 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
2336 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002337
2338 *p++ = 0x00;
2339 *p++ = 0x00;
2340
2341 *olen = 4;
2342}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002343#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002345#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2346static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002347 unsigned char *buf,
2348 size_t *olen )
2349{
2350 unsigned char *p = buf;
2351
Hanno Beckera49ec562019-06-11 14:47:55 +01002352 if( mbedtls_ssl_hs_get_extended_ms( ssl->handshake )
2353 == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002354 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002355 {
2356 *olen = 0;
2357 return;
2358 }
2359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002360 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002361 "extension" ) );
2362
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002363 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
2364 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002365
2366 *p++ = 0x00;
2367 *p++ = 0x00;
2368
2369 *olen = 4;
2370}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002371#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002372
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002373#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2374static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002375 unsigned char *buf,
2376 size_t *olen )
2377{
2378 unsigned char *p = buf;
2379
2380 if( ssl->handshake->new_session_ticket == 0 )
2381 {
2382 *olen = 0;
2383 return;
2384 }
2385
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002386 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002387
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002388 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
2389 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002390
2391 *p++ = 0x00;
2392 *p++ = 0x00;
2393
2394 *olen = 4;
2395}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002396#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002397
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002398static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002399 unsigned char *buf,
2400 size_t *olen )
2401{
2402 unsigned char *p = buf;
2403
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002404 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002405 {
2406 *olen = 0;
2407 return;
2408 }
2409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002410 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002411
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002412 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
2413 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002415#if defined(MBEDTLS_SSL_RENEGOTIATION)
2416 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002417 {
2418 *p++ = 0x00;
2419 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
2420 *p++ = ssl->verify_data_len * 2 & 0xFF;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002421
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002422 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
2423 p += ssl->verify_data_len;
2424 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
2425 p += ssl->verify_data_len;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002426 }
2427 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002428#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002429 {
2430 *p++ = 0x00;
2431 *p++ = 0x01;
2432 *p++ = 0x00;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002433 }
Manuel Pégourié-Gonnard19389752015-06-23 13:46:44 +02002434
2435 *olen = p - buf;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002436}
2437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002438#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2439static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002440 unsigned char *buf,
2441 size_t *olen )
2442{
2443 unsigned char *p = buf;
2444
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002445 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02002446 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002447 *olen = 0;
2448 return;
2449 }
2450
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002451 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002452
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002453 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
2454 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002455
2456 *p++ = 0x00;
2457 *p++ = 1;
2458
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02002459 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002460
2461 *olen = 5;
2462}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002463#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002464
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002465#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002466 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002467static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002468 unsigned char *buf,
2469 size_t *olen )
2470{
2471 unsigned char *p = buf;
2472 ((void) ssl);
2473
Paul Bakker677377f2013-10-28 12:54:26 +01002474 if( ( ssl->handshake->cli_exts &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002475 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Paul Bakker677377f2013-10-28 12:54:26 +01002476 {
2477 *olen = 0;
2478 return;
2479 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002480
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002481 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002482
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002483 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
2484 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002485
2486 *p++ = 0x00;
2487 *p++ = 2;
2488
2489 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002490 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002491
2492 *olen = 6;
2493}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002494#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002495
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002496#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2497static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
2498 unsigned char *buf,
2499 size_t *olen )
2500{
2501 int ret;
2502 unsigned char *p = buf;
Angus Grattond8213d02016-05-25 20:56:48 +10002503 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002504 size_t kkpp_len;
2505
2506 *olen = 0;
2507
2508 /* Skip costly computation if not needed */
Hanno Becker473f98f2019-06-26 10:27:32 +01002509 if( mbedtls_ssl_suite_get_key_exchange( ssl->handshake->ciphersuite_info ) !=
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002510 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2511 return;
2512
2513 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
2514
2515 if( end - p < 4 )
2516 {
2517 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2518 return;
2519 }
2520
2521 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
2522 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
2523
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02002524 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
2525 p + 2, end - p - 2, &kkpp_len,
Hanno Beckerece325c2019-06-13 15:39:27 +01002526 mbedtls_ssl_conf_get_frng( ssl->conf ),
2527 ssl->conf->p_rng );
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02002528 if( ret != 0 )
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002529 {
2530 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
2531 return;
2532 }
2533
2534 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
2535 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
2536
2537 *olen = kkpp_len + 4;
2538}
2539#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2540
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002541#if defined(MBEDTLS_SSL_ALPN )
2542static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002543 unsigned char *buf, size_t *olen )
2544{
2545 if( ssl->alpn_chosen == NULL )
2546 {
2547 *olen = 0;
2548 return;
2549 }
2550
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002551 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002552
2553 /*
2554 * 0 . 1 ext identifier
2555 * 2 . 3 ext length
2556 * 4 . 5 protocol list length
2557 * 6 . 6 protocol name length
2558 * 7 . 7+n protocol name
2559 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002560 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
2561 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002562
2563 *olen = 7 + strlen( ssl->alpn_chosen );
2564
2565 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2566 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2567
2568 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2569 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2570
2571 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2572
2573 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2574}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002575#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002576
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002577#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2578static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002579{
2580 int ret;
2581 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002582 unsigned char *cookie_len_byte;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002584 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002585
2586 /*
2587 * struct {
2588 * ProtocolVersion server_version;
2589 * opaque cookie<0..2^8-1>;
2590 * } HelloVerifyRequest;
2591 */
2592
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02002593 /* The RFC is not clear on this point, but sending the actual negotiated
2594 * version looks like the most interoperable thing to do. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002595 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002596 ssl->conf->transport, p );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002597 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002598 p += 2;
2599
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002600 /* If we get here, f_cookie_check is not null */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002601 if( ssl->conf->f_cookie_write == NULL )
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002602 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002603 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
2604 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002605 }
2606
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002607 /* Skip length byte until we know the length */
2608 cookie_len_byte = p++;
2609
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002610 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Angus Grattond8213d02016-05-25 20:56:48 +10002611 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002612 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002613 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002614 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002615 return( ret );
2616 }
2617
2618 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
2619
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002620 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002621
2622 ssl->out_msglen = p - ssl->out_msg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002623 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2624 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002625
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002626 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002627
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002628 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002629 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002630 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002631 return( ret );
2632 }
2633
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002634#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002635 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002636 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2637 {
2638 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2639 return( ret );
2640 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01002641#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002642
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002643 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002644
2645 return( 0 );
2646}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002647#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002649static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002650{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002651#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002652 mbedtls_time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002653#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002654 int ret;
2655 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002656 unsigned char *buf, *p;
2657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002658 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002660#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002661 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002662 ssl->handshake->verify_cookie_len != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002663 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002664 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
2665 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002666
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002667 return( ssl_write_hello_verify_request( ssl ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002668 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002669#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002670
Hanno Beckerece325c2019-06-13 15:39:27 +01002671 if( mbedtls_ssl_conf_get_frng( ssl->conf ) == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +01002672 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002673 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2674 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +01002675 }
2676
Paul Bakker5121ce52009-01-03 21:22:43 +00002677 /*
2678 * 0 . 0 handshake type
2679 * 1 . 3 handshake length
2680 * 4 . 5 protocol version
2681 * 6 . 9 UNIX time()
2682 * 10 . 37 random bytes
2683 */
2684 buf = ssl->out_msg;
2685 p = buf + 4;
2686
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002687 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002688 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002689 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002690
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002691 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002692 buf[4], buf[5] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002693
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002694#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002695 t = mbedtls_time( NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +00002696 *p++ = (unsigned char)( t >> 24 );
2697 *p++ = (unsigned char)( t >> 16 );
2698 *p++ = (unsigned char)( t >> 8 );
2699 *p++ = (unsigned char)( t );
2700
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002701 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002702#else
Hanno Beckerece325c2019-06-13 15:39:27 +01002703 if( ( ret = mbedtls_ssl_conf_get_frng( ssl->conf )
2704 ( ssl->conf->p_rng, p, 4 ) ) != 0 )
2705 {
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002706 return( ret );
Hanno Beckerece325c2019-06-13 15:39:27 +01002707 }
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002708
2709 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002710#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker5121ce52009-01-03 21:22:43 +00002711
Hanno Beckerece325c2019-06-13 15:39:27 +01002712 if( ( ret = mbedtls_ssl_conf_get_frng( ssl->conf )
2713 ( ssl->conf->p_rng, p, 28 ) ) != 0 )
2714 {
Paul Bakkera3d195c2011-11-27 21:07:34 +00002715 return( ret );
Hanno Beckerece325c2019-06-13 15:39:27 +01002716 }
Paul Bakkera3d195c2011-11-27 21:07:34 +00002717
2718 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00002719
Paul Bakker48916f92012-09-16 19:57:18 +00002720 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002721
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002722 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002723
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002724#if !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker5121ce52009-01-03 21:22:43 +00002725 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002726 * Resume is 0 by default, see ssl_handshake_init().
2727 * It may be already set to 1 by ssl_parse_session_ticket_ext().
2728 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00002729 */
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002730 if( mbedtls_ssl_handshake_get_resume( ssl->handshake ) == 0 &&
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02002731 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002732 ssl->session_negotiate->id_len != 0 &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002733 ssl->conf->f_get_cache != NULL &&
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01002734 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002735 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002736 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002737 ssl->handshake->resume = 1;
2738 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002739#endif /* !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00002740
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002741#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002742 if( mbedtls_ssl_handshake_get_resume( ssl->handshake ) == 1 )
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002743 {
2744 /*
2745 * Resuming a session
2746 */
2747 n = ssl->session_negotiate->id_len;
2748 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
2749
2750 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
2751 {
2752 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
2753 return( ret );
2754 }
2755 }
2756 else
2757#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002758 {
2759 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002760 * New session, create a new session id,
2761 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00002762 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002763 ssl->state++;
2764
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002765#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002766 ssl->session_negotiate->start = mbedtls_time( NULL );
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002767#endif
2768
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002769#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002770 if( ssl->handshake->new_session_ticket != 0 )
2771 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002772 ssl->session_negotiate->id_len = n = 0;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002773 memset( ssl->session_negotiate->id, 0, 32 );
2774 }
2775 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002776#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002777 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002778 ssl->session_negotiate->id_len = n = 32;
Hanno Beckerece325c2019-06-13 15:39:27 +01002779 if( ( ret = mbedtls_ssl_conf_get_frng( ssl->conf )
2780 ( ssl->conf->p_rng, ssl->session_negotiate->id, n ) ) != 0 )
2781 {
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002782 return( ret );
Hanno Beckerece325c2019-06-13 15:39:27 +01002783 }
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002784 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002785 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002786
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002787 /*
2788 * 38 . 38 session id length
2789 * 39 . 38+n session id
2790 * 39+n . 40+n chosen ciphersuite
2791 * 41+n . 41+n chosen compression alg.
2792 * 42+n . 43+n extensions length
2793 * 44+n . 43+n+m extensions
2794 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002795 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2796 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
2797 p += ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002799 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2800 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2801 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002802 mbedtls_ssl_handshake_get_resume( ssl->handshake ) ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002803
Paul Bakker48916f92012-09-16 19:57:18 +00002804 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2805 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2806 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00002807
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002808 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2809 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2810 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00002811 ssl->session_negotiate->compression ) );
2812
Janos Follathc6dab2b2016-05-23 14:27:02 +01002813 /* Do not write the extensions if the protocol is SSLv3 */
2814#if defined(MBEDTLS_SSL_PROTO_SSL3)
2815 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
2816 {
2817#endif
2818
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002819 /*
2820 * First write extensions, then the total length
2821 */
2822 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2823 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00002824
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002825#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002826 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2827 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02002828#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002829
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002830#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002831 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
2832 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02002833#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002834
Hanno Beckera5a2b082019-05-15 14:03:01 +01002835#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker072d4ec2019-04-26 15:46:55 +01002836 ssl_write_cid_ext( ssl, p + 2 + ext_len, &olen );
2837 ext_len += olen;
2838#endif
2839
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002840#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002841 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2842 ext_len += olen;
2843#endif
2844
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002845#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002846 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2847 ext_len += olen;
2848#endif
2849
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002850#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002851 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2852 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02002853#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002854
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002855#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01002856 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Ron Eldor755bb6a2018-02-14 19:30:48 +02002857 if ( mbedtls_ssl_ciphersuite_uses_ec(
2858 mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite ) ) )
2859 {
2860 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2861 ext_len += olen;
2862 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002863#endif
2864
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002865#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2866 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
2867 ext_len += olen;
2868#endif
2869
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002870#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002871 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2872 ext_len += olen;
2873#endif
2874
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002875 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002876
Paul Bakkera7036632014-04-30 10:15:38 +02002877 if( ext_len > 0 )
2878 {
2879 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2880 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2881 p += ext_len;
2882 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002883
Janos Follathc6dab2b2016-05-23 14:27:02 +01002884#if defined(MBEDTLS_SSL_PROTO_SSL3)
2885 }
2886#endif
2887
Paul Bakker5121ce52009-01-03 21:22:43 +00002888 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002889 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2890 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002891
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002892 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002893
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002894 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002895
2896 return( ret );
2897}
2898
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002899#if !defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002900static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002901{
Hanno Becker473f98f2019-06-26 10:27:32 +01002902 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00002903 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002904
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002905 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002906
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002907 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002908 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002909 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002910 ssl->state++;
2911 return( 0 );
2912 }
2913
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002914 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2915 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002916}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002917#else /* !MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002918static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002919{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002920 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Becker473f98f2019-06-26 10:27:32 +01002921 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00002922 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002923 size_t dn_size, total_dn_size; /* excluding length bytes */
2924 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00002925 unsigned char *buf, *p;
Angus Grattond8213d02016-05-25 20:56:48 +10002926 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002927 const mbedtls_x509_crt *crt;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002928 int authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00002929
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002930 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002931
2932 ssl->state++;
2933
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002934#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2935 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
2936 authmode = ssl->handshake->sni_authmode;
2937 else
2938#endif
Hanno Beckeracd4fc02019-06-12 16:40:50 +01002939 authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002940
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002941 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ||
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002942 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002943 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002944 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002945 return( 0 );
2946 }
2947
2948 /*
2949 * 0 . 0 handshake type
2950 * 1 . 3 handshake length
2951 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01002952 * 5 .. m-1 cert types
2953 * m .. m+1 sig alg length (TLS 1.2 only)
Paul Bakker9af723c2014-05-01 13:03:14 +02002954 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00002955 * n .. n+1 length of all DNs
2956 * n+2 .. n+3 length of DN 1
2957 * n+4 .. ... Distinguished Name #1
2958 * ... .. ... length of DN 2, etc.
2959 */
2960 buf = ssl->out_msg;
2961 p = buf + 4;
2962
2963 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002964 * Supported certificate types
2965 *
2966 * ClientCertificateType certificate_types<1..2^8-1>;
2967 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00002968 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002969 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01002970
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002971#if defined(MBEDTLS_RSA_C)
2972 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002973#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002974#if defined(MBEDTLS_ECDSA_C)
2975 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002976#endif
2977
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002978 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002979 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01002980
Paul Bakker577e0062013-08-28 11:57:20 +02002981 sa_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002982#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01002983 /*
2984 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01002985 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002986 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2987 *
2988 * struct {
2989 * HashAlgorithm hash;
2990 * SignatureAlgorithm signature;
2991 * } SignatureAndHashAlgorithm;
2992 *
2993 * enum { (255) } HashAlgorithm;
2994 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01002995 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002996 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002997 {
Simon Butcher99000142016-10-13 17:21:01 +01002998 const int *cur;
Paul Bakkerf7abd422013-04-16 13:15:56 +02002999
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003000 /*
3001 * Supported signature algorithms
3002 */
Simon Butcher99000142016-10-13 17:21:01 +01003003 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
3004 {
3005 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *cur );
3006
3007 if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
3008 continue;
3009
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003010#if defined(MBEDTLS_RSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01003011 p[2 + sa_len++] = hash;
3012 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003013#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003014#if defined(MBEDTLS_ECDSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01003015 p[2 + sa_len++] = hash;
3016 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003017#endif
Simon Butcher99000142016-10-13 17:21:01 +01003018 }
Paul Bakker926af752012-11-23 13:38:07 +01003019
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003020 p[0] = (unsigned char)( sa_len >> 8 );
3021 p[1] = (unsigned char)( sa_len );
3022 sa_len += 2;
3023 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01003024 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003025#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00003026
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003027 /*
3028 * DistinguishedName certificate_authorities<0..2^16-1>;
3029 * opaque DistinguishedName<1..2^16-1>;
3030 */
Paul Bakker5121ce52009-01-03 21:22:43 +00003031 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00003032
Paul Bakkerbc3d9842012-11-26 16:12:02 +01003033 total_dn_size = 0;
Janos Follath088ce432017-04-10 12:42:31 +01003034
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01003035 if( mbedtls_ssl_conf_get_cert_req_ca_list( ssl->conf )
3036 == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED )
Paul Bakker5121ce52009-01-03 21:22:43 +00003037 {
Janos Follath088ce432017-04-10 12:42:31 +01003038#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3039 if( ssl->handshake->sni_ca_chain != NULL )
3040 crt = ssl->handshake->sni_ca_chain;
3041 else
3042#endif
3043 crt = ssl->conf->ca_chain;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003044
Hanno Becker371e0e42019-02-25 18:08:59 +00003045 while( crt != NULL && crt->raw.p != NULL )
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003046 {
Hanno Becker5f268b32019-05-20 16:26:34 +01003047 mbedtls_x509_crt_frame const *frame;
Hanno Becker232f8fa2019-02-26 16:49:57 +00003048 ret = mbedtls_x509_crt_frame_acquire( crt, &frame );
3049 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01003050 {
3051 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_frame_acquire", ret );
Hanno Becker232f8fa2019-02-26 16:49:57 +00003052 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01003053 }
Hanno Becker232f8fa2019-02-26 16:49:57 +00003054
Hanno Becker1e11f212019-03-04 14:43:43 +00003055 dn_size = frame->subject_raw.len;
Janos Follath088ce432017-04-10 12:42:31 +01003056
3057 if( end < p ||
3058 (size_t)( end - p ) < dn_size ||
3059 (size_t)( end - p ) < 2 + dn_size )
3060 {
3061 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00003062 mbedtls_x509_crt_frame_release( crt );
Janos Follath088ce432017-04-10 12:42:31 +01003063 break;
3064 }
3065
3066 *p++ = (unsigned char)( dn_size >> 8 );
3067 *p++ = (unsigned char)( dn_size );
Hanno Becker1e11f212019-03-04 14:43:43 +00003068 memcpy( p, frame->subject_raw.p, dn_size );
Janos Follath088ce432017-04-10 12:42:31 +01003069 p += dn_size;
3070
3071 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
3072
3073 total_dn_size += 2 + dn_size;
Hanno Becker232f8fa2019-02-26 16:49:57 +00003074
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00003075 mbedtls_x509_crt_frame_release( crt );
Hanno Becker232f8fa2019-02-26 16:49:57 +00003076
Janos Follath088ce432017-04-10 12:42:31 +01003077 crt = crt->next;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003078 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003079 }
3080
Paul Bakker926af752012-11-23 13:38:07 +01003081 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003082 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3083 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003084 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
3085 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00003086
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003087 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003089 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003090
3091 return( ret );
3092}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00003093#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003094
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003095#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3096 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3097static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003098{
3099 int ret;
3100
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003101 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
3104 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003105 }
3106
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003107 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
3108 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
3109 MBEDTLS_ECDH_OURS ) ) != 0 )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003110 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003111 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003112 return( ret );
3113 }
3114
3115 return( 0 );
3116}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003117#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
3118 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003119
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003120#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003121 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003122static int ssl_resume_server_key_exchange( mbedtls_ssl_context *ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003123 size_t *signature_len )
Paul Bakker41c83d32013-03-20 14:39:14 +01003124{
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003125 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3126 * signature length which will be added in ssl_write_server_key_exchange
3127 * after the call to ssl_prepare_server_key_exchange.
3128 * ssl_write_server_key_exchange also takes care of incrementing
3129 * ssl->out_msglen. */
3130 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2;
Angus Grattond8213d02016-05-25 20:56:48 +10003131 size_t sig_max_len = ( ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003132 - sig_start );
Gilles Peskine8f97af72018-04-26 11:46:10 +02003133 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003134 sig_start, signature_len, sig_max_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003135 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3136 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003137 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003138 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003139 }
Gilles Peskined3eb0612018-01-08 17:07:44 +01003140 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_resume_server_key_exchange", ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003141 return( ret );
3142}
3143#endif /* defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003144 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003145
Gilles Peskined3eb0612018-01-08 17:07:44 +01003146/* Prepare the ServerKeyExchange message, up to and including
Gilles Peskine168dae82018-04-25 23:35:42 +02003147 * calculating the signature if any, but excluding formatting the
3148 * signature and sending the message. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003149static int ssl_prepare_server_key_exchange( mbedtls_ssl_context *ssl,
3150 size_t *signature_len )
Paul Bakker5690efc2011-05-26 13:16:06 +00003151{
Hanno Becker473f98f2019-06-26 10:27:32 +01003152 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00003153 ssl->handshake->ciphersuite_info;
3154
Hanno Becker1aa267c2017-04-28 17:08:27 +01003155#if defined(MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED)
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003156#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskine3ce9b902018-01-06 01:34:21 +01003157 unsigned char *dig_signed = NULL;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003158#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
3159#endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003160
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003161 (void) ciphersuite_info; /* unused in some configurations */
Gilles Peskine22e695f2018-04-26 00:22:50 +02003162#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3163 (void) signature_len;
3164#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003165
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003166 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */
Paul Bakker5121ce52009-01-03 21:22:43 +00003167
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003168 /*
3169 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003170 * Part 1: Provide key exchange parameters for chosen ciphersuite.
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003171 *
3172 */
3173
3174 /*
3175 * - ECJPAKE key exchanges
3176 */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003177#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01003178 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
3179 == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003180 {
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003181 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003182 size_t len = 0;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003183
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003184 ret = mbedtls_ecjpake_write_round_two(
3185 &ssl->handshake->ecjpake_ctx,
3186 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003187 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01003188 mbedtls_ssl_conf_get_frng( ssl->conf ),
3189 ssl->conf->p_rng );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003190 if( ret != 0 )
3191 {
3192 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
3193 return( ret );
3194 }
3195
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003196 ssl->out_msglen += len;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003197 }
3198#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
3199
Hanno Becker1aa267c2017-04-28 17:08:27 +01003200 /*
3201 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
3202 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
3203 * we use empty support identity hints here.
3204 **/
3205#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003206 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01003207 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3208 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003209 {
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003210 ssl->out_msg[ssl->out_msglen++] = 0x00;
3211 ssl->out_msg[ssl->out_msglen++] = 0x00;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003212 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003213#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
3214 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003215
Hanno Becker7e5437a2017-04-28 17:15:26 +01003216 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003217 * - DHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003218 */
3219#if defined(MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED)
3220 if( mbedtls_ssl_ciphersuite_uses_dhe( ciphersuite_info ) )
Paul Bakker48916f92012-09-16 19:57:18 +00003221 {
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003222 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003223 size_t len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003224
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01003225 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
3226 {
3227 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
3228 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3229 }
3230
Paul Bakker41c83d32013-03-20 14:39:14 +01003231 /*
3232 * Ephemeral DH parameters:
3233 *
3234 * struct {
3235 * opaque dh_p<1..2^16-1>;
3236 * opaque dh_g<1..2^16-1>;
3237 * opaque dh_Ys<1..2^16-1>;
3238 * } ServerDHParams;
3239 */
Hanno Beckerab740562017-10-04 13:15:37 +01003240 if( ( ret = mbedtls_dhm_set_group( &ssl->handshake->dhm_ctx,
3241 &ssl->conf->dhm_P,
3242 &ssl->conf->dhm_G ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003243 {
Hanno Beckerab740562017-10-04 13:15:37 +01003244 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_set_group", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003245 return( ret );
3246 }
Paul Bakker48916f92012-09-16 19:57:18 +00003247
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003248 if( ( ret = mbedtls_dhm_make_params(
3249 &ssl->handshake->dhm_ctx,
3250 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3251 ssl->out_msg + ssl->out_msglen, &len,
Hanno Beckerece325c2019-06-13 15:39:27 +01003252 mbedtls_ssl_conf_get_frng( ssl->conf ),
3253 ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003254 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003255 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003256 return( ret );
3257 }
3258
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003259#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003260 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003261#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003262
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003263 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003264
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003265 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
3266 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
3267 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
3268 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker41c83d32013-03-20 14:39:14 +01003269 }
Hanno Becker1aa267c2017-04-28 17:08:27 +01003270#endif /* MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003271
Hanno Becker1aa267c2017-04-28 17:08:27 +01003272 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003273 * - ECDHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003274 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003275#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003276 if( mbedtls_ssl_ciphersuite_uses_ecdhe( ciphersuite_info ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003277 {
Paul Bakker41c83d32013-03-20 14:39:14 +01003278 /*
3279 * Ephemeral ECDH parameters:
3280 *
3281 * struct {
3282 * ECParameters curve_params;
3283 * ECPoint public;
3284 * } ServerECDHParams;
3285 */
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003286 const mbedtls_ecp_curve_info *curve = ssl->handshake->curve_info;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003287 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003288 size_t len = 0;
Gergely Budai987bfb52014-01-19 21:48:42 +01003289
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003290 if( curve == NULL )
Gergely Budai987bfb52014-01-19 21:48:42 +01003291 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003292 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
3293 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Gergely Budai987bfb52014-01-19 21:48:42 +01003294 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003295 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", curve->name ) );
Gergely Budai987bfb52014-01-19 21:48:42 +01003296
Janos Follath3fbdada2018-08-15 10:26:53 +01003297 if( ( ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003298 curve->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003299 {
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003300 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003301 return( ret );
3302 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003303
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003304 if( ( ret = mbedtls_ecdh_make_params(
3305 &ssl->handshake->ecdh_ctx, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003306 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003307 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen,
Hanno Beckerece325c2019-06-13 15:39:27 +01003308 mbedtls_ssl_conf_get_frng( ssl->conf ),
3309 ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003310 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003311 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003312 return( ret );
3313 }
3314
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003315#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003316 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003317#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003318
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003319 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003320
Janos Follath3fbdada2018-08-15 10:26:53 +01003321 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3322 MBEDTLS_DEBUG_ECDH_Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01003323 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003324#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003325
Hanno Becker1aa267c2017-04-28 17:08:27 +01003326 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003327 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003328 * Part 2: For key exchanges involving the server signing the
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003329 * exchange parameters, compute and add the signature here.
3330 *
Hanno Becker1aa267c2017-04-28 17:08:27 +01003331 */
3332#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3333 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003334 {
Gilles Peskine1004c192018-01-08 16:59:14 +01003335 size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed;
Gilles Peskineca1d7422018-04-24 11:53:22 +02003336 size_t hashlen = 0;
Gilles Peskinee1efdf92018-01-05 21:18:37 +01003337 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003338 int ret;
Paul Bakker23f36802012-09-28 14:15:14 +00003339
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003340 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003341 * 2.1: Choose hash algorithm:
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003342 * A: For TLS 1.2, obey signature-hash-algorithm extension
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003343 * to choose appropriate hash.
3344 * B: For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1
3345 * (RFC 4492, Sec. 5.4)
3346 * C: Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003347 */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003348
3349 mbedtls_md_type_t md_alg;
3350
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003351#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003352 mbedtls_pk_type_t sig_alg =
3353 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003354 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003355 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003356 /* A: For TLS 1.2, obey signature-hash-algorithm extension
3357 * (RFC 5246, Sec. 7.4.1.4.1). */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003358 if( sig_alg == MBEDTLS_PK_NONE ||
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003359 ( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
3360 sig_alg ) ) == MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003361 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003362 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003363 /* (... because we choose a cipher suite
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003364 * only if there is a matching hash.) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003365 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003366 }
3367 }
Paul Bakker577e0062013-08-28 11:57:20 +02003368 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003369#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3370#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3371 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Becker473f98f2019-06-26 10:27:32 +01003372 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
3373 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003374 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003375 /* B: Default hash SHA1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003376 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003377 }
3378 else
Hanno Becker1aa267c2017-04-28 17:08:27 +01003379#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3380 MBEDTLS_SSL_PROTO_TLS1_1 */
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003381 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003382 /* C: MD5 + SHA1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003383 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003384 }
3385
Hanno Becker7e5437a2017-04-28 17:15:26 +01003386 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pick hash algorithm %d for signing", md_alg ) );
3387
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003388 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003389 * 2.2: Compute the hash to be signed
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003390 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003391#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3392 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3393 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00003394 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003395 hashlen = 36;
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003396 ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash,
3397 dig_signed,
3398 dig_signed_len );
3399 if( ret != 0 )
3400 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003401 }
3402 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003403#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3404 MBEDTLS_SSL_PROTO_TLS1_1 */
3405#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3406 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3407 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003408 {
Gilles Peskineca1d7422018-04-24 11:53:22 +02003409 ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003410 dig_signed,
3411 dig_signed_len,
3412 md_alg );
3413 if( ret != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003414 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003415 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003416 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003417#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3418 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003419 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003420 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3421 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003422 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02003423
Gilles Peskineebd652f2018-01-05 21:18:59 +01003424 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003425
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003426 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003427 * 2.3: Compute and add the signature
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003428 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003429#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3430 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker23f36802012-09-28 14:15:14 +00003431 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003432 /*
3433 * For TLS 1.2, we need to specify signature and hash algorithm
Hanno Becker7e5437a2017-04-28 17:15:26 +01003434 * explicitly through a prefix to the signature.
3435 *
3436 * struct {
3437 * HashAlgorithm hash;
3438 * SignatureAlgorithm signature;
3439 * } SignatureAndHashAlgorithm;
3440 *
3441 * struct {
3442 * SignatureAndHashAlgorithm algorithm;
3443 * opaque signature<0..2^16-1>;
3444 * } DigitallySigned;
3445 *
3446 */
3447
Gilles Peskine1004c192018-01-08 16:59:14 +01003448 ssl->out_msg[ssl->out_msglen++] =
3449 mbedtls_ssl_hash_from_md_alg( md_alg );
3450 ssl->out_msg[ssl->out_msglen++] =
3451 mbedtls_ssl_sig_from_pk_alg( sig_alg );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003452 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003453#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003454
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003455#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003456 if( ssl->conf->f_async_sign_start != NULL )
3457 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003458 ret = ssl->conf->f_async_sign_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003459 mbedtls_ssl_own_cert( ssl ),
3460 md_alg, hash, hashlen );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003461 switch( ret )
3462 {
3463 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3464 /* act as if f_async_sign was null */
3465 break;
3466 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003467 ssl->handshake->async_in_progress = 1;
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003468 return( ssl_resume_server_key_exchange( ssl, signature_len ) );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003469 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003470 ssl->handshake->async_in_progress = 1;
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003471 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3472 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003473 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_sign_start", ret );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003474 return( ret );
3475 }
3476 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003477#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003478
3479 if( mbedtls_ssl_own_key( ssl ) == NULL )
3480 {
3481 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
3482 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3483 }
3484
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003485 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3486 * signature length which will be added in ssl_write_server_key_exchange
3487 * after the call to ssl_prepare_server_key_exchange.
3488 * ssl_write_server_key_exchange also takes care of incrementing
3489 * ssl->out_msglen. */
Gilles Peskine1004c192018-01-08 16:59:14 +01003490 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ),
3491 md_alg, hash, hashlen,
3492 ssl->out_msg + ssl->out_msglen + 2,
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003493 signature_len,
Hanno Beckerece325c2019-06-13 15:39:27 +01003494 mbedtls_ssl_conf_get_frng( ssl->conf ),
Gilles Peskine1004c192018-01-08 16:59:14 +01003495 ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003496 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003497 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02003498 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003499 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003500 }
Hanno Becker1aa267c2017-04-28 17:08:27 +01003501#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00003502
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003503 return( 0 );
3504}
Paul Bakker1ef83d62012-04-11 12:09:53 +00003505
Gilles Peskined3eb0612018-01-08 17:07:44 +01003506/* Prepare the ServerKeyExchange message and send it. For ciphersuites
Gilles Peskine168dae82018-04-25 23:35:42 +02003507 * that do not include a ServerKeyExchange message, do nothing. Either
3508 * way, if successful, move on to the next step in the SSL state
3509 * machine. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003510static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
3511{
3512 int ret;
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003513 size_t signature_len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003514#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01003515 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00003516 ssl->handshake->ciphersuite_info;
Gilles Peskinef1127252018-04-24 13:05:39 +02003517#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003518
Gilles Peskined3eb0612018-01-08 17:07:44 +01003519 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
3520
3521#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
3522 /* Extract static ECDH parameters and abort if ServerKeyExchange
3523 * is not needed. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003524 if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
3525 {
3526 /* For suites involving ECDH, extract DH parameters
3527 * from certificate at this point. */
3528#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
3529 if( mbedtls_ssl_ciphersuite_uses_ecdh( ciphersuite_info ) )
3530 {
3531 ssl_get_ecdh_params_from_cert( ssl );
3532 }
3533#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
3534
3535 /* Key exchanges not involving ephemeral keys don't use
3536 * ServerKeyExchange, so end here. */
3537 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
3538 ssl->state++;
3539 return( 0 );
3540 }
Gilles Peskinef1127252018-04-24 13:05:39 +02003541#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003542
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003543#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003544 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskined3eb0612018-01-08 17:07:44 +01003545 /* If we have already prepared the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003546 * signature operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003547 if( ssl->handshake->async_in_progress != 0 )
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003548 {
3549 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming signature operation" ) );
3550 ret = ssl_resume_server_key_exchange( ssl, &signature_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003551 }
3552 else
3553#endif /* defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003554 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003555 {
3556 /* ServerKeyExchange is needed. Prepare the message. */
3557 ret = ssl_prepare_server_key_exchange( ssl, &signature_len );
Gilles Peskined3eb0612018-01-08 17:07:44 +01003558 }
3559
3560 if( ret != 0 )
3561 {
Gilles Peskinead28bf02018-04-26 00:19:16 +02003562 /* If we're starting to write a new message, set ssl->out_msglen
3563 * to 0. But if we're resuming after an asynchronous message,
3564 * out_msglen is the amount of data written so far and mst be
3565 * preserved. */
Gilles Peskined3eb0612018-01-08 17:07:44 +01003566 if( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3567 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange (pending)" ) );
3568 else
3569 ssl->out_msglen = 0;
3570 return( ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003571 }
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003572
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003573 /* If there is a signature, write its length.
Gilles Peskine168dae82018-04-25 23:35:42 +02003574 * ssl_prepare_server_key_exchange already wrote the signature
3575 * itself at its proper place in the output buffer. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003576#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3577 if( signature_len != 0 )
3578 {
3579 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len >> 8 );
3580 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len );
3581
3582 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature",
3583 ssl->out_msg + ssl->out_msglen,
3584 signature_len );
3585
3586 /* Skip over the already-written signature */
3587 ssl->out_msglen += signature_len;
3588 }
3589#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
3590
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003591 /* Add header and send. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003592 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3593 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003594
3595 ssl->state++;
3596
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003597 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003598 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003599 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003600 return( ret );
3601 }
3602
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003603 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003604 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003605}
3606
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003607static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003608{
3609 int ret;
3610
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003611 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003612
3613 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003614 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3615 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003616
3617 ssl->state++;
3618
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003619#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02003620 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003621 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003622#endif
3623
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003624 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003625 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003626 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003627 return( ret );
3628 }
3629
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003630#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02003631 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003632 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3633 {
3634 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
3635 return( ret );
3636 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01003637#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003638
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003639 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003640
3641 return( 0 );
3642}
3643
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003644#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3645 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3646static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003647 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003648{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003649 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003650 size_t n;
3651
3652 /*
3653 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3654 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003655 if( *p + 2 > end )
3656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3658 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003659 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02003660
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003661 n = ( (*p)[0] << 8 ) | (*p)[1];
3662 *p += 2;
3663
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003664 if( *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003665 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003666 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3667 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003668 }
3669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003670 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003671 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003672 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
3673 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003674 }
3675
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003676 *p += n;
3677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003678 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003679
Paul Bakker70df2fb2013-04-17 17:19:09 +02003680 return( ret );
3681}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003682#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3683 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003684
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003685#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3686 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003687
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003688#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003689static int ssl_resume_decrypt_pms( mbedtls_ssl_context *ssl,
3690 unsigned char *peer_pms,
3691 size_t *peer_pmslen,
3692 size_t peer_pmssize )
3693{
Gilles Peskine8f97af72018-04-26 11:46:10 +02003694 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003695 peer_pms, peer_pmslen, peer_pmssize );
3696 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3697 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003698 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003699 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003700 }
3701 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_decrypt_encrypted_pms", ret );
3702 return( ret );
3703}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003704#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003705
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003706static int ssl_decrypt_encrypted_pms( mbedtls_ssl_context *ssl,
3707 const unsigned char *p,
3708 const unsigned char *end,
3709 unsigned char *peer_pms,
3710 size_t *peer_pmslen,
3711 size_t peer_pmssize )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003712{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003713 int ret;
Hanno Becker81bb4d02019-02-16 11:03:48 +00003714 size_t len = (size_t)( end - p ); /* Cast is safe because p <= end. */
Gilles Peskine422ccab2018-01-11 18:29:01 +01003715 mbedtls_pk_context *private_key = mbedtls_ssl_own_key( ssl );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003716
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003717#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003718 /* If we have already started decoding the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003719 * decryption operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003720 if( ssl->handshake->async_in_progress != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003721 {
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003722 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming decryption operation" ) );
3723 return( ssl_resume_decrypt_pms( ssl,
3724 peer_pms, peer_pmslen, peer_pmssize ) );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003725 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003726#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003727
3728 /*
Gilles Peskine422ccab2018-01-11 18:29:01 +01003729 * Prepare to decrypt the premaster using own private RSA key
Paul Bakker70df2fb2013-04-17 17:19:09 +02003730 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003731#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3732 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker81bb4d02019-02-16 11:03:48 +00003733#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003734 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker81bb4d02019-02-16 11:03:48 +00003735#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003736 {
Hanno Becker81bb4d02019-02-16 11:03:48 +00003737 if( len < 2 )
3738 {
Philippe Antoine747fd532018-05-30 09:13:21 +02003739 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3740 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3741 }
Hanno Becker81bb4d02019-02-16 11:03:48 +00003742 len -= 2;
3743
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003744 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
3745 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003746 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003747 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3748 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003749 }
3750 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003751#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003752
Gilles Peskine422ccab2018-01-11 18:29:01 +01003753 /*
3754 * Decrypt the premaster secret
3755 */
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003756#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003757 if( ssl->conf->f_async_decrypt_start != NULL )
3758 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003759 ret = ssl->conf->f_async_decrypt_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003760 mbedtls_ssl_own_cert( ssl ),
3761 p, len );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003762 switch( ret )
3763 {
3764 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3765 /* act as if f_async_decrypt_start was null */
3766 break;
3767 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003768 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003769 return( ssl_resume_decrypt_pms( ssl,
3770 peer_pms,
3771 peer_pmslen,
3772 peer_pmssize ) );
3773 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003774 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003775 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3776 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003777 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_decrypt_start", ret );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003778 return( ret );
3779 }
3780 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003781#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003782
Gilles Peskine422ccab2018-01-11 18:29:01 +01003783 if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_RSA ) )
3784 {
Gilles Peskine422ccab2018-01-11 18:29:01 +01003785 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
3786 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3787 }
3788
3789 ret = mbedtls_pk_decrypt( private_key, p, len,
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003790 peer_pms, peer_pmslen, peer_pmssize,
Hanno Beckerece325c2019-06-13 15:39:27 +01003791 mbedtls_ssl_conf_get_frng( ssl->conf ),
3792 ssl->conf->p_rng );
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003793 return( ret );
3794}
3795
3796static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
3797 const unsigned char *p,
3798 const unsigned char *end,
3799 size_t pms_offset )
3800{
3801 int ret;
3802 unsigned char *pms = ssl->handshake->premaster + pms_offset;
3803 unsigned char ver[2];
3804 unsigned char fake_pms[48], peer_pms[48];
3805 unsigned char mask;
3806 size_t i, peer_pmslen;
3807 unsigned int diff;
3808
Gilles Peskine0a8352b2018-06-13 18:16:41 +02003809 /* In case of a failure in decryption, the decryption may write less than
3810 * 2 bytes of output, but we always read the first two bytes. It doesn't
3811 * matter in the end because diff will be nonzero in that case due to
3812 * peer_pmslen being less than 48, and we only care whether diff is 0.
3813 * But do initialize peer_pms for robustness anyway. This also makes
3814 * memory analyzers happy (don't access uninitialized memory, even
3815 * if it's an unsigned char). */
3816 peer_pms[0] = peer_pms[1] = ~0;
3817
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003818 ret = ssl_decrypt_encrypted_pms( ssl, p, end,
3819 peer_pms,
3820 &peer_pmslen,
3821 sizeof( peer_pms ) );
3822
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003823#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003824 if ( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3825 return( ret );
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003826#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003827
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003828 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Gilles Peskine2e333372018-04-24 13:22:10 +02003829 ssl->handshake->max_minor_ver,
3830 ssl->conf->transport, ver );
3831
3832 /* Avoid data-dependent branches while checking for invalid
3833 * padding, to protect against timing-based Bleichenbacher-type
3834 * attacks. */
3835 diff = (unsigned int) ret;
3836 diff |= peer_pmslen ^ 48;
3837 diff |= peer_pms[0] ^ ver[0];
3838 diff |= peer_pms[1] ^ ver[1];
3839
3840 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
3841 /* MSVC has a warning about unary minus on unsigned, but this is
3842 * well-defined and precisely what we want to do here */
3843#if defined(_MSC_VER)
3844#pragma warning( push )
3845#pragma warning( disable : 4146 )
3846#endif
3847 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
3848#if defined(_MSC_VER)
3849#pragma warning( pop )
3850#endif
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003851
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003852 /*
3853 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3854 * must not cause the connection to end immediately; instead, send a
3855 * bad_record_mac later in the handshake.
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003856 * To protect against timing-based variants of the attack, we must
3857 * not have any branch that depends on whether the decryption was
3858 * successful. In particular, always generate the fake premaster secret,
3859 * regardless of whether it will ultimately influence the output or not.
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003860 */
Hanno Beckerece325c2019-06-13 15:39:27 +01003861 ret = mbedtls_ssl_conf_get_frng( ssl->conf )
3862 ( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003863 if( ret != 0 )
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003864 {
Gilles Peskinee1416382018-04-26 10:23:21 +02003865 /* It's ok to abort on an RNG failure, since this does not reveal
3866 * anything about the RSA decryption. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003867 return( ret );
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003868 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003869
Manuel Pégourié-Gonnard331ba572015-04-20 12:33:57 +01003870#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003871 if( diff != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003872 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003873#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003874
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003875 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
3876 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
3877 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003878 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3879 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003880 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003881 ssl->handshake->pmslen = 48;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003882
Gilles Peskine422ccab2018-01-11 18:29:01 +01003883 /* Set pms to either the true or the fake PMS, without
3884 * data-dependent branches. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003885 for( i = 0; i < ssl->handshake->pmslen; i++ )
3886 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
3887
3888 return( 0 );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003889}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003890#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3891 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003892
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003893#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
3894static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003895 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003896{
Paul Bakker6db455e2013-09-18 17:29:31 +02003897 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003898 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003899
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003900 if( ssl->conf->f_psk == NULL &&
3901 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
3902 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003903 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003904 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
3905 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003906 }
3907
3908 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003909 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02003910 */
Hanno Becker83c9f492017-06-26 13:52:14 +01003911 if( end - *p < 2 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3914 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003915 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003916
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003917 n = ( (*p)[0] << 8 ) | (*p)[1];
3918 *p += 2;
3919
Hanno Becker83c9f492017-06-26 13:52:14 +01003920 if( n < 1 || n > 65535 || n > (size_t) ( end - *p ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003921 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003922 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3923 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003924 }
3925
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003926 if( ssl->conf->f_psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02003927 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003928 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003929 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003930 }
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003931 else
Paul Bakker6db455e2013-09-18 17:29:31 +02003932 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01003933 /* Identity is not a big secret since clients send it in the clear,
3934 * but treat it carefully anyway, just in case */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003935 if( n != ssl->conf->psk_identity_len ||
3936 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003937 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003938 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003939 }
3940 }
3941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003942 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003943 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003944 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Gilles Peskinec94f7352017-05-10 16:37:56 +02003945 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3946 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003947 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003948 }
3949
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003950 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003951
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003952 return( 0 );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003953}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003954#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02003955
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003956static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003957{
Paul Bakker23986e52011-04-24 08:57:21 +00003958 int ret;
Hanno Becker473f98f2019-06-26 10:27:32 +01003959 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info;
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003960 unsigned char *p, *end;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003961
Hanno Becker8759e162017-12-27 21:34:08 +00003962 ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003964 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003965
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003966#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003967 ( defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3968 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) )
Hanno Becker473f98f2019-06-26 10:27:32 +01003969 if( ( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3970 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) == MBEDTLS_KEY_EXCHANGE_RSA ) &&
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003971 ( ssl->handshake->async_in_progress != 0 ) )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003972 {
3973 /* We've already read a record and there is an asynchronous
3974 * operation in progress to decrypt it. So skip reading the
Gilles Peskine168dae82018-04-25 23:35:42 +02003975 * record. */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003976 MBEDTLS_SSL_DEBUG_MSG( 3, ( "will resume decryption of previously-read record" ) );
3977 }
3978 else
3979#endif
Hanno Becker327c93b2018-08-15 13:56:18 +01003980 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003981 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003982 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003983 return( ret );
3984 }
3985
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003986 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003987 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnardf8995832014-09-10 08:25:12 +00003988
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003989 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003990 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003991 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3992 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003993 }
3994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003995 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003996 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003997 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3998 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003999 }
4000
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004001#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004002 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
4003 == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00004004 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004005 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004006 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004007 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02004008 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004009 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004010
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004011 if( p != end )
4012 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004013 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4014 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004015 }
4016
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004017 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004018 ssl->handshake->premaster,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01004019 MBEDTLS_PREMASTER_SIZE,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02004020 &ssl->handshake->pmslen,
Hanno Beckerece325c2019-06-13 15:39:27 +01004021 mbedtls_ssl_conf_get_frng( ssl->conf ),
4022 ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004023 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004024 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
4025 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004026 }
4027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004028 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02004029 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004030 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004031#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
4032#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
4033 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
4034 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
4035 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004036 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
4037 == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
4038 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
4039 == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
4040 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
4041 == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
4042 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info )
4043 == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02004044 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004045 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00004046 p, end - p) ) != 0 )
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004047 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004048 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
4049 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004050 }
4051
Janos Follath3fbdada2018-08-15 10:26:53 +01004052 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4053 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004054
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004055 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004056 &ssl->handshake->pmslen,
4057 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004058 MBEDTLS_MPI_MAX_SIZE,
Hanno Beckerece325c2019-06-13 15:39:27 +01004059 mbedtls_ssl_conf_get_frng( ssl->conf ),
4060 ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004061 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004062 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
4063 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004064 }
4065
Janos Follath3fbdada2018-08-15 10:26:53 +01004066 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4067 MBEDTLS_DEBUG_ECDH_Z );
Paul Bakker5121ce52009-01-03 21:22:43 +00004068 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004069 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004070#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
4071 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
4072 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
4073 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
4074#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004075 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
4076 MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02004077 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004078 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02004079 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004080 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakkerfbb17802013-04-17 19:10:21 +02004081 return( ret );
4082 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004083
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004084 if( p != end )
4085 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004086 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4087 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004088 }
4089
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004090 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Hanno Becker473f98f2019-06-26 10:27:32 +01004091 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ) ) != 0 )
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004092 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004093 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004094 return( ret );
4095 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02004096 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004097 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004098#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
4099#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004100 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
4101 MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004102 {
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004103#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004104 if ( ssl->handshake->async_in_progress != 0 )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01004105 {
4106 /* There is an asynchronous operation in progress to
4107 * decrypt the encrypted premaster secret, so skip
4108 * directly to resuming this operation. */
4109 MBEDTLS_SSL_DEBUG_MSG( 3, ( "PSK identity already parsed" ) );
4110 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms
4111 * won't actually use it, but maintain p anyway for robustness. */
4112 p += ssl->conf->psk_identity_len + 2;
4113 }
4114 else
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004115#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004116 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4117 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004118 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004119 return( ret );
4120 }
4121
4122 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
4123 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004124 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004125 return( ret );
4126 }
4127
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004128 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Hanno Becker473f98f2019-06-26 10:27:32 +01004129 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ) ) != 0 )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004130 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004131 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004132 return( ret );
4133 }
4134 }
4135 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004136#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
4137#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004138 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
4139 MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004140 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004141 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4142 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004143 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004144 return( ret );
4145 }
4146 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
4147 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004148 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004149 return( ret );
4150 }
4151
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004152 if( p != end )
4153 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004154 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4155 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004156 }
4157
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004158 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Hanno Becker473f98f2019-06-26 10:27:32 +01004159 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004160 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004161 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004162 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004163 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004164 }
4165 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004166#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
4167#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004168 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
4169 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004170 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004171 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4172 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004173 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004174 return( ret );
4175 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004176
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004177 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004178 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004179 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004180 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
4181 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004182 }
4183
Janos Follath3fbdada2018-08-15 10:26:53 +01004184 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4185 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004187 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Hanno Becker473f98f2019-06-26 10:27:32 +01004188 mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004189 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004190 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004191 return( ret );
4192 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004193 }
4194 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004195#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
4196#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004197 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
4198 MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01004199 {
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00004200 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01004201 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004202 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02004203 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004204 }
4205 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004206 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004207#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004208#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Hanno Becker473f98f2019-06-26 10:27:32 +01004209 if( mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) ==
4210 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004211 {
4212 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
4213 p, end - p );
4214 if( ret != 0 )
4215 {
4216 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
4217 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
4218 }
4219
4220 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
4221 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
Hanno Beckerece325c2019-06-13 15:39:27 +01004222 mbedtls_ssl_conf_get_frng( ssl->conf ),
4223 ssl->conf->p_rng );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004224 if( ret != 0 )
4225 {
4226 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
4227 return( ret );
4228 }
4229 }
4230 else
4231#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004232 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004233 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4234 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004235 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004236
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004237 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00004238 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004239 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00004240 return( ret );
4241 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004242
Paul Bakker5121ce52009-01-03 21:22:43 +00004243 ssl->state++;
4244
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004245 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004246
4247 return( 0 );
4248}
4249
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004250#if !defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004251static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004252{
Hanno Becker473f98f2019-06-26 10:27:32 +01004253 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00004254 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00004255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004256 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004257
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004258 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakkered27a042013-04-18 22:46:23 +02004259 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004260 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02004261 ssl->state++;
4262 return( 0 );
4263 }
4264
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4266 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004267}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004268#else /* !MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004269static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004270{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004271 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004272 size_t i, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004273 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004274 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004275 size_t hashlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004276#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4277 mbedtls_pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02004278#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004279 mbedtls_md_type_t md_alg;
Hanno Becker473f98f2019-06-26 10:27:32 +01004280 mbedtls_ssl_ciphersuite_handle_t ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00004281 ssl->handshake->ciphersuite_info;
Hanno Becker5882dd02019-06-06 16:25:57 +01004282 mbedtls_pk_context *peer_pk = NULL;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004283
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004284 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004285
Hanno Beckercd901262019-02-07 13:17:25 +00004286 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004287 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004288 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004289 ssl->state++;
4290 return( 0 );
4291 }
4292
Hanno Becker5882dd02019-06-06 16:25:57 +01004293 /* Skip if we haven't received a certificate from the client.
4294 * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is set, this can be
4295 * inferred from the setting of mbedtls_ssl_session::peer_cert.
4296 * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is not set, it can
4297 * be inferred from whether we've held back the peer CRT's
4298 * public key in mbedtls_ssl_handshake_params::peer_pubkey. */
4299#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4300 /* Because the peer CRT pubkey is embedded into the handshake
4301 * params currently, and there's no 'is_init' functions for PK
4302 * contexts, we need to break the abstraction and peek into
4303 * the PK context to see if it has been initialized. */
4304 if( ssl->handshake->peer_pubkey.pk_info != NULL )
4305 peer_pk = &ssl->handshake->peer_pubkey;
4306#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4307 if( ssl->session_negotiate->peer_cert != NULL )
Hanno Becker73cd8d82019-02-28 14:04:16 +00004308 {
4309 ret = mbedtls_x509_crt_pk_acquire( ssl->session_negotiate->peer_cert,
4310 &peer_pk );
4311 if( ret != 0 )
4312 {
Hanno Becker2224ccf2019-06-28 10:52:45 +01004313 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
4314 return( ret );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004315 }
4316 }
Hanno Becker5882dd02019-06-06 16:25:57 +01004317#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4318
4319 if( peer_pk == NULL )
Hanno Beckercd901262019-02-07 13:17:25 +00004320 {
4321 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
4322 ssl->state++;
4323 return( 0 );
4324 }
Hanno Beckercd901262019-02-07 13:17:25 +00004325
Simon Butcher99000142016-10-13 17:21:01 +01004326 /* Read the message without adding it to the checksum */
Hanno Becker327c93b2018-08-15 13:56:18 +01004327 ret = mbedtls_ssl_read_record( ssl, 0 /* no checksum update */ );
Simon Butcher99000142016-10-13 17:21:01 +01004328 if( 0 != ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00004329 {
Hanno Becker327c93b2018-08-15 13:56:18 +01004330 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret );
Hanno Beckerbc6b5982019-07-02 15:36:44 +01004331 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004332 }
4333
4334 ssl->state++;
4335
Simon Butcher99000142016-10-13 17:21:01 +01004336 /* Process the message contents */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004337 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
4338 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00004339 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004340 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerbc6b5982019-07-02 15:36:44 +01004341 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4342 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004343 }
4344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004345 i = mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004346
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004347 /*
4348 * struct {
4349 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
4350 * opaque signature<0..2^16-1>;
4351 * } DigitallySigned;
4352 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004353#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
4354 defined(MBEDTLS_SSL_PROTO_TLS1_1)
4355 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01004356 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004357 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004358 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004359
4360 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
Hanno Becker0833c102019-02-06 18:31:04 +00004361 if( mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECDSA ) )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004362 {
4363 hash_start += 16;
4364 hashlen -= 16;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004365 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004366 }
Paul Bakker926af752012-11-23 13:38:07 +01004367 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02004368 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004369#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
4370 MBEDTLS_SSL_PROTO_TLS1_1 */
4371#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4372 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004373 {
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004374 if( i + 2 > ssl->in_hslen )
4375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004376 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004377 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4378 goto exit;
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004379 }
4380
Paul Bakker5121ce52009-01-03 21:22:43 +00004381 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004382 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00004383 */
Simon Butcher99000142016-10-13 17:21:01 +01004384 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] );
4385
4386 if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004387 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004389 " for verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004390 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4391 goto exit;
Paul Bakker926af752012-11-23 13:38:07 +01004392 }
4393
Simon Butcher99000142016-10-13 17:21:01 +01004394#if !defined(MBEDTLS_MD_SHA1)
4395 if( MBEDTLS_MD_SHA1 == md_alg )
4396 hash_start += 16;
4397#endif
Paul Bakker926af752012-11-23 13:38:07 +01004398
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02004399 /* Info from md_alg will be used instead */
4400 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004401
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004402 i++;
4403
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004404 /*
4405 * Signature
4406 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004407 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
4408 == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004409 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004410 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004411 " for verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004412 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4413 goto exit;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004414 }
4415
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004416 /*
4417 * Check the certificate's key type matches the signature alg
4418 */
Hanno Becker0833c102019-02-06 18:31:04 +00004419 if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004420 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004421 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004422 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4423 goto exit;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004424 }
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004425
4426 i++;
Paul Bakker577e0062013-08-28 11:57:20 +02004427 }
4428 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004429#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02004430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004431 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4432 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004433 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02004434
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004435 if( i + 2 > ssl->in_hslen )
4436 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004437 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004438 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4439 goto exit;
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004440 }
4441
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004442 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
4443 i += 2;
Paul Bakker926af752012-11-23 13:38:07 +01004444
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004445 if( i + sig_len != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00004446 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004447 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004448 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4449 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004450 }
4451
Simon Butcher99000142016-10-13 17:21:01 +01004452 /* Calculate hash and verify signature */
Manuel Pégourié-Gonnarda5759752019-05-03 11:43:28 +02004453 {
4454 size_t dummy_hlen;
4455 ssl->handshake->calc_verify( ssl, hash, &dummy_hlen );
4456 }
Simon Butcher99000142016-10-13 17:21:01 +01004457
Hanno Becker0833c102019-02-06 18:31:04 +00004458 if( ( ret = mbedtls_pk_verify( peer_pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004459 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004460 ssl->in_msg + i, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004462 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004463 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004464 }
4465
Simon Butcher99000142016-10-13 17:21:01 +01004466 mbedtls_ssl_update_handshake_status( ssl );
4467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004468 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004469
Hanno Becker73cd8d82019-02-28 14:04:16 +00004470exit:
4471
4472#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00004473 mbedtls_x509_crt_pk_release( ssl->session_negotiate->peer_cert );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004474#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4475
Paul Bakkered27a042013-04-18 22:46:23 +02004476 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004477}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004478#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00004479
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004480#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4481static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004482{
4483 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004484 size_t tlen;
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004485 uint32_t lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004488
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004489 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4490 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004491
4492 /*
4493 * struct {
4494 * uint32 ticket_lifetime_hint;
4495 * opaque ticket<0..2^16-1>;
4496 * } NewSessionTicket;
4497 *
4498 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
4499 * 8 . 9 ticket_len (n)
4500 * 10 . 9+n ticket content
4501 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02004502
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004503 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +02004504 ssl->session_negotiate,
4505 ssl->out_msg + 10,
Angus Grattond8213d02016-05-25 20:56:48 +10004506 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004507 &tlen, &lifetime ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004508 {
Manuel Pégourié-Gonnarda4a47352015-05-15 15:14:54 +02004509 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004510 tlen = 0;
4511 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004512
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004513 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
4514 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
4515 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
4516 ssl->out_msg[7] = ( lifetime ) & 0xFF;
4517
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004518 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
4519 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004520
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004521 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004522
Manuel Pégourié-Gonnard145dfcb2014-02-26 14:23:33 +01004523 /*
4524 * Morally equivalent to updating ssl->state, but NewSessionTicket and
4525 * ChangeCipherSpec share the same state.
4526 */
4527 ssl->handshake->new_session_ticket = 0;
4528
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004529 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004530 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004531 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004532 return( ret );
4533 }
4534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004535 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004536
4537 return( 0 );
4538}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004539#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004540
Paul Bakker5121ce52009-01-03 21:22:43 +00004541/*
Paul Bakker1961b702013-01-25 14:49:24 +01004542 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00004543 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004544int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004545{
4546 int ret = 0;
4547
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02004548 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004549 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004550
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004551 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01004552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004553 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01004554 return( ret );
4555
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004556#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004557 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004558 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004559 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004560 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004561 return( ret );
4562 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01004563#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004564
Paul Bakker1961b702013-01-25 14:49:24 +01004565 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00004566 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004567 case MBEDTLS_SSL_HELLO_REQUEST:
4568 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00004569 break;
4570
Paul Bakker1961b702013-01-25 14:49:24 +01004571 /*
4572 * <== ClientHello
4573 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004574 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004575 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004576 break;
Paul Bakker1961b702013-01-25 14:49:24 +01004577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004578#if defined(MBEDTLS_SSL_PROTO_DTLS)
4579 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
4580 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02004581#endif
4582
Paul Bakker1961b702013-01-25 14:49:24 +01004583 /*
4584 * ==> ServerHello
4585 * Certificate
4586 * ( ServerKeyExchange )
4587 * ( CertificateRequest )
4588 * ServerHelloDone
4589 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004590 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004591 ret = ssl_write_server_hello( ssl );
4592 break;
4593
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004594 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4595 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004596 break;
4597
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004598 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004599 ret = ssl_write_server_key_exchange( ssl );
4600 break;
4601
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004602 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01004603 ret = ssl_write_certificate_request( ssl );
4604 break;
4605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004606 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01004607 ret = ssl_write_server_hello_done( ssl );
4608 break;
4609
4610 /*
4611 * <== ( Certificate/Alert )
4612 * ClientKeyExchange
4613 * ( CertificateVerify )
4614 * ChangeCipherSpec
4615 * Finished
4616 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004617 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4618 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004619 break;
4620
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004621 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004622 ret = ssl_parse_client_key_exchange( ssl );
4623 break;
4624
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004625 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01004626 ret = ssl_parse_certificate_verify( ssl );
4627 break;
4628
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004629 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4630 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004631 break;
4632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004633 case MBEDTLS_SSL_CLIENT_FINISHED:
4634 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004635 break;
4636
4637 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004638 * ==> ( NewSessionTicket )
4639 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01004640 * Finished
4641 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004642 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4643#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02004644 if( ssl->handshake->new_session_ticket != 0 )
4645 ret = ssl_write_new_session_ticket( ssl );
4646 else
Paul Bakkera503a632013-08-14 13:48:06 +02004647#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004648 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004649 break;
4650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004651 case MBEDTLS_SSL_SERVER_FINISHED:
4652 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004653 break;
4654
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004655 case MBEDTLS_SSL_FLUSH_BUFFERS:
4656 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
4657 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01004658 break;
4659
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004660 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4661 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004662 break;
4663
4664 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004665 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
4666 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004667 }
4668
Paul Bakker5121ce52009-01-03 21:22:43 +00004669 return( ret );
4670}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004671#endif /* MBEDTLS_SSL_SRV_C */