blob: 4b0f9971430f829562c7e21fa4e86c72aa879bb3 [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
34#define mbedtls_calloc calloc
35#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010036#endif
37
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000038#include "mbedtls/debug.h"
39#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020040#include "mbedtls/ssl_internal.h"
Rich Evans00ab4702015-02-06 13:43:58 +000041
42#include <string.h>
43
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020044#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000045#include "mbedtls/ecp.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010046#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000047
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020048#if defined(MBEDTLS_HAVE_TIME)
Simon Butcherb5b6af22016-07-13 14:46:18 +010049#include "mbedtls/platform_time.h"
Paul Bakkerfa9b1002013-07-03 15:31:03 +020050#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000051
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020052#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +020053/* Implementation that should never be optimized out by the compiler */
54static void mbedtls_zeroize( void *v, size_t n ) {
55 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
56}
Paul Bakker606b4ba2013-08-14 16:52:14 +020057#endif
58
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
60int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020061 const unsigned char *info,
62 size_t ilen )
63{
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +020064 if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020065 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020066
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020067 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020068
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020069 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020070 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020071
72 memcpy( ssl->cli_id, info, ilen );
73 ssl->cli_id_len = ilen;
74
75 return( 0 );
76}
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020077
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020078void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020079 mbedtls_ssl_cookie_write_t *f_cookie_write,
80 mbedtls_ssl_cookie_check_t *f_cookie_check,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020081 void *p_cookie )
82{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020083 conf->f_cookie_write = f_cookie_write;
84 conf->f_cookie_check = f_cookie_check;
85 conf->p_cookie = p_cookie;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020086}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020087#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020089#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020090static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +000091 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +000092 size_t len )
93{
94 int ret;
95 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +000096 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +000097
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020098 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +010099
Paul Bakker5701cdc2012-09-27 21:49:42 +0000100 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
101 if( servername_list_size + 2 != len )
102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
104 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000105 }
106
107 p = buf + 2;
108 while( servername_list_size > 0 )
109 {
110 hostname_len = ( ( p[1] << 8 ) | p[2] );
111 if( hostname_len + 3 > servername_list_size )
112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200113 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
114 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000115 }
116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200117 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000118 {
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +0200119 ret = ssl->conf->f_sni( ssl->conf->p_sni,
120 ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000121 if( ret != 0 )
122 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200123 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
124 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
125 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
126 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000127 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000128 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000129 }
130
131 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000132 p += hostname_len + 3;
133 }
134
135 if( servername_list_size != 0 )
136 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200137 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
138 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000139 }
140
141 return( 0 );
142}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200143#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000146 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000147 size_t len )
148{
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000149 int ret;
150
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200151#if defined(MBEDTLS_SSL_RENEGOTIATION)
152 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100153 {
154 /* Check verify-data in constant-time. The length OTOH is no secret */
155 if( len != 1 + ssl->verify_data_len ||
156 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200157 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100158 ssl->verify_data_len ) != 0 )
159 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100163 return( ret );
164
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100166 }
167 }
168 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200169#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +0000170 {
171 if( len != 1 || buf[0] != 0x0 )
172 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200173 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000174
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200175 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000176 return( ret );
177
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200178 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +0000179 }
180
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200181 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +0000182 }
Paul Bakker48916f92012-09-16 19:57:18 +0000183
184 return( 0 );
185}
186
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200187#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
188 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
189static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000190 const unsigned char *buf,
191 size_t len )
192{
193 size_t sig_alg_list_size;
194 const unsigned char *p;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200195 const unsigned char *end = buf + len;
196 const int *md_cur;
197
Paul Bakker23f36802012-09-28 14:15:14 +0000198
199 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
200 if( sig_alg_list_size + 2 != len ||
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200201 sig_alg_list_size % 2 != 0 )
Paul Bakker23f36802012-09-28 14:15:14 +0000202 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
204 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker23f36802012-09-28 14:15:14 +0000205 }
206
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200207 /*
208 * For now, ignore the SignatureAlgorithm part and rely on offered
209 * ciphersuites only for that part. To be fixed later.
210 *
211 * So, just look at the HashAlgorithm part.
212 */
Manuel Pégourié-Gonnard7bfc1222015-06-17 14:34:48 +0200213 for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200214 for( p = buf + 2; p < end; p += 2 ) {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200215 if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200216 ssl->handshake->sig_alg = p[0];
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200217 goto have_sig_alg;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200218 }
Paul Bakker23f36802012-09-28 14:15:14 +0000219 }
Paul Bakker23f36802012-09-28 14:15:14 +0000220 }
221
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200222 /* Some key echanges do not need signatures at all */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200223 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
Manuel Pégourié-Gonnard480905d2014-08-21 19:38:32 +0200224 return( 0 );
225
226have_sig_alg:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200227 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
Paul Bakker23f36802012-09-28 14:15:14 +0000228 ssl->handshake->sig_alg ) );
229
230 return( 0 );
231}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200232#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
233 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker23f36802012-09-28 14:15:14 +0000234
Robert Cragie136884c2015-10-02 13:34:31 +0100235#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +0100236 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200237static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200238 const unsigned char *buf,
239 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100240{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200241 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100242 const unsigned char *p;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200243 const mbedtls_ecp_curve_info *curve_info, **curves;
Paul Bakker41c83d32013-03-20 14:39:14 +0100244
245 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
246 if( list_size + 2 != len ||
247 list_size % 2 != 0 )
248 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200249 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
250 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100251 }
252
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200253 /* Should never happen unless client duplicates the extension */
254 if( ssl->handshake->curves != NULL )
255 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200256 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
257 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard43c3b282014-10-17 12:42:11 +0200258 }
259
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +0100260 /* Don't allow our peer to make us allocate too much memory,
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200261 * and leave room for a final 0 */
262 our_size = list_size / 2 + 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200263 if( our_size > MBEDTLS_ECP_DP_MAX )
264 our_size = MBEDTLS_ECP_DP_MAX;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200265
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +0200266 if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +0200267 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200268
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200269 ssl->handshake->curves = curves;
270
Paul Bakker41c83d32013-03-20 14:39:14 +0100271 p = buf + 2;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200272 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100273 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200274 curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200275
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200276 if( curve_info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100277 {
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200278 *curves++ = curve_info;
279 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100280 }
281
282 list_size -= 2;
283 p += 2;
284 }
285
286 return( 0 );
287}
288
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200289static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200290 const unsigned char *buf,
291 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100292{
293 size_t list_size;
294 const unsigned char *p;
295
296 list_size = buf[0];
297 if( list_size + 1 != len )
298 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200299 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
300 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100301 }
302
Manuel Pégourié-Gonnardc1b46d02015-09-16 11:18:32 +0200303 p = buf + 1;
Paul Bakker41c83d32013-03-20 14:39:14 +0100304 while( list_size > 0 )
305 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200306 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
307 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Paul Bakker41c83d32013-03-20 14:39:14 +0100308 {
Robert Cragie136884c2015-10-02 13:34:31 +0100309#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200310 ssl->handshake->ecdh_ctx.point_format = p[0];
Robert Cragie136884c2015-10-02 13:34:31 +0100311#endif
Robert Cragieae8535d2015-10-06 17:11:18 +0100312#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Robert Cragie136884c2015-10-02 13:34:31 +0100313 ssl->handshake->ecjpake_ctx.point_format = p[0];
314#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200315 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100316 return( 0 );
317 }
318
319 list_size--;
320 p++;
321 }
322
323 return( 0 );
324}
Robert Cragieae8535d2015-10-06 17:11:18 +0100325#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
326 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +0100327
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200328#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
329static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
330 const unsigned char *buf,
331 size_t len )
332{
333 int ret;
334
335 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
336 {
337 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
338 return( 0 );
339 }
340
341 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
342 buf, len ) ) != 0 )
343 {
344 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
345 return( ret );
346 }
347
348 /* Only mark the extension as OK when we're sure it is */
349 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
350
351 return( 0 );
352}
353#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
354
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200355#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
356static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200357 const unsigned char *buf,
358 size_t len )
359{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200360 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200361 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200362 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
363 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200364 }
365
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200366 ssl->session_negotiate->mfl_code = buf[0];
367
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200368 return( 0 );
369}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200370#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200371
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200372#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
373static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200374 const unsigned char *buf,
375 size_t len )
376{
377 if( len != 0 )
378 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200379 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
380 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200381 }
382
383 ((void) buf);
384
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200385 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200386 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200387
388 return( 0 );
389}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200390#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200391
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200392#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
393static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100394 const unsigned char *buf,
395 size_t len )
396{
397 if( len != 0 )
398 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200399 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
400 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100401 }
402
403 ((void) buf);
404
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200405 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200406 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200408 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100409 }
410
411 return( 0 );
412}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200413#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100414
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
416static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200417 const unsigned char *buf,
418 size_t len )
419{
420 if( len != 0 )
421 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200422 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
423 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200424 }
425
426 ((void) buf);
427
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200428 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200429 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200430 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200431 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Manuel Pégourié-Gonnardb575b542014-10-24 15:12:31 +0200432 }
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200433
434 return( 0 );
435}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200436#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200438#if defined(MBEDTLS_SSL_SESSION_TICKETS)
439static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200440 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200441 size_t len )
442{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200443 int ret;
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200444 mbedtls_ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200445
Manuel Pégourié-Gonnardbae389b2015-06-24 10:45:58 +0200446 mbedtls_ssl_session_init( &session );
447
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200448 if( ssl->conf->f_ticket_parse == NULL ||
449 ssl->conf->f_ticket_write == NULL )
450 {
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200451 return( 0 );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200452 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200453
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200454 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200455 ssl->handshake->new_session_ticket = 1;
456
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200457 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200458
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200459 if( len == 0 )
460 return( 0 );
461
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200462#if defined(MBEDTLS_SSL_RENEGOTIATION)
463 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200465 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200466 return( 0 );
467 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200468#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200469
470 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200471 * Failures are ok: just ignore the ticket and proceed.
472 */
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200473 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
474 buf, len ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200475 {
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200476 mbedtls_ssl_session_free( &session );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200477
478 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
479 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
480 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
481 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
482 else
483 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
484
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200485 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200486 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200487
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200488 /*
489 * Keep the session ID sent by the client, since we MUST send it back to
490 * inform them we're accepting the ticket (RFC 5077 section 3.4)
491 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200492 session.id_len = ssl->session_negotiate->id_len;
493 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200494
495 mbedtls_ssl_session_free( ssl->session_negotiate );
496 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
497
498 /* Zeroize instead of free as we copied the content */
499 mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
500
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200501 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200502
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200503 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200504
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200505 /* Don't send a new ticket after all, this one is OK */
506 ssl->handshake->new_session_ticket = 0;
507
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200508 return( 0 );
509}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200510#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200511
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200512#if defined(MBEDTLS_SSL_ALPN)
513static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard14beb082014-07-08 13:50:35 +0200514 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200515{
Paul Bakker14b16c62014-05-28 11:33:54 +0200516 size_t list_len, cur_len, ours_len;
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200517 const unsigned char *theirs, *start, *end;
518 const char **ours;
519
520 /* If ALPN not configured, just ignore the extension */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200521 if( ssl->conf->alpn_list == NULL )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200522 return( 0 );
523
524 /*
525 * opaque ProtocolName<1..2^8-1>;
526 *
527 * struct {
528 * ProtocolName protocol_name_list<2..2^16-1>
529 * } ProtocolNameList;
530 */
531
532 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
533 if( len < 4 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200534 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200535
536 list_len = ( buf[0] << 8 ) | buf[1];
537 if( list_len != len - 2 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200538 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200539
540 /*
541 * Use our order of preference
542 */
543 start = buf + 2;
544 end = buf + len;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200545 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200546 {
Paul Bakker14b16c62014-05-28 11:33:54 +0200547 ours_len = strlen( *ours );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200548 for( theirs = start; theirs != end; theirs += cur_len )
549 {
550 /* If the list is well formed, we should get equality first */
551 if( theirs > end )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200552 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200553
554 cur_len = *theirs++;
555
556 /* Empty strings MUST NOT be included */
557 if( cur_len == 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200558 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200559
Paul Bakker14b16c62014-05-28 11:33:54 +0200560 if( cur_len == ours_len &&
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200561 memcmp( theirs, *ours, cur_len ) == 0 )
562 {
563 ssl->alpn_chosen = *ours;
564 return( 0 );
565 }
566 }
567 }
568
569 /* If we get there, no match was found */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200570 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
571 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
572 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200573}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200574#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200575
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100576/*
577 * Auxiliary functions for ServerHello parsing and related actions
578 */
579
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200580#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100581/*
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100582 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100583 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200584#if defined(MBEDTLS_ECDSA_C)
585static int ssl_check_key_curve( mbedtls_pk_context *pk,
586 const mbedtls_ecp_curve_info **curves )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100587{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200588 const mbedtls_ecp_curve_info **crv = curves;
589 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100590
591 while( *crv != NULL )
592 {
593 if( (*crv)->grp_id == grp_id )
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100594 return( 0 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100595 crv++;
596 }
597
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100598 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100599}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200600#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100601
602/*
603 * Try picking a certificate for this ciphersuite,
604 * return 0 on success and -1 on failure.
605 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200606static int ssl_pick_cert( mbedtls_ssl_context *ssl,
607 const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100608{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200609 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
610 mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200611 uint32_t flags;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100612
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200613#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100614 if( ssl->handshake->sni_key_cert != NULL )
615 list = ssl->handshake->sni_key_cert;
616 else
617#endif
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200618 list = ssl->conf->key_cert;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100619
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200620 if( pk_alg == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100621 return( 0 );
622
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200623 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000624
Manuel Pégourié-Gonnarde540b492015-07-07 12:44:38 +0200625 if( list == NULL )
626 {
627 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
628 return( -1 );
629 }
630
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100631 for( cur = list; cur != NULL; cur = cur->next )
632 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200633 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000634 cur->cert );
635
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200636 if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000637 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200638 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100639 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000640 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100641
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200642 /*
643 * This avoids sending the client a cert it'll reject based on
644 * keyUsage or other extensions.
645 *
646 * It also allows the user to provision different certificates for
647 * different uses based on keyUsage, eg if they want to avoid signing
648 * and decrypting with the same RSA key.
649 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200650 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +0100651 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200653 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000654 "(extended) key usage extension" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200655 continue;
656 }
657
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200658#if defined(MBEDTLS_ECDSA_C)
659 if( pk_alg == MBEDTLS_PK_ECDSA &&
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100660 ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000661 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200662 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100663 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000664 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100665#endif
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100666
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100667 /*
668 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
669 * present them a SHA-higher cert rather than failing if it's the only
670 * one we got that satisfies the other conditions.
671 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200672 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
673 cur->cert->sig_md != MBEDTLS_MD_SHA1 )
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100674 {
675 if( fallback == NULL )
676 fallback = cur;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000677 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200678 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000679 "sha-2 with pre-TLS 1.2 client" ) );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100680 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000681 }
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100682 }
683
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100684 /* If we get there, we got a winner */
685 break;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100686 }
687
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000688 if( cur == NULL )
689 cur = fallback;
690
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200691 /* Do not update ssl->handshake->key_cert unless there is a match */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100692 if( cur != NULL )
693 {
694 ssl->handshake->key_cert = cur;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200695 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000696 ssl->handshake->key_cert->cert );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100697 return( 0 );
698 }
699
700 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100701}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200702#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100703
704/*
705 * Check if a given ciphersuite is suitable for use with our config/keys/etc
706 * Sets ciphersuite_info only if the suite matches.
707 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200708static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
709 const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100710{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200711 const mbedtls_ssl_ciphersuite_t *suite_info;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200713 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100714 if( suite_info == NULL )
715 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200716 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
717 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100718 }
719
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200720 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000721
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100722 if( suite_info->min_minor_ver > ssl->minor_ver ||
723 suite_info->max_minor_ver < ssl->minor_ver )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000724 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200725 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100726 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000727 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100728
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200729#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200730 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200731 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +0100732 return( 0 );
733#endif
734
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200735#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200736 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000738 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200739 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100740 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000741 }
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200742#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100743
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200744#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
745 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200746 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200747 {
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200748 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
749 "not configured or ext missing" ) );
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200750 return( 0 );
751 }
752#endif
753
754
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
756 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100757 ( ssl->handshake->curves == NULL ||
758 ssl->handshake->curves[0] == NULL ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000759 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200760 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000761 "no common elliptic curve" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100762 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000763 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100764#endif
765
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100767 /* If the ciphersuite requires a pre-shared key and we don't
768 * have one, skip it now rather than failing later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200769 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200770 ssl->conf->f_psk == NULL &&
771 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
772 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000773 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200774 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100775 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000776 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100777#endif
778
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200779#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100780 /*
781 * Final check: if ciphersuite requires us to have a
782 * certificate/key of a particular type:
783 * - select the appropriate certificate if we have one, or
784 * - try the next ciphersuite if we don't
785 * This must be done last since we modify the key_cert list.
786 */
787 if( ssl_pick_cert( ssl, suite_info ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000788 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200789 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000790 "no suitable certificate" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100791 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000792 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100793#endif
794
795 *ciphersuite_info = suite_info;
796 return( 0 );
797}
798
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200799#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
800static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
Paul Bakker78a8c712013-03-06 17:01:52 +0100801{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +0100802 int ret, got_common_suite;
Paul Bakker78a8c712013-03-06 17:01:52 +0100803 unsigned int i, j;
804 size_t n;
805 unsigned int ciph_len, sess_len, chal_len;
806 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200807 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200808 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +0100809
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200810 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100811
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200812#if defined(MBEDTLS_SSL_RENEGOTIATION)
813 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +0100814 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200815 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100816
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200817 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100818 return( ret );
819
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200820 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100821 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200822#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker78a8c712013-03-06 17:01:52 +0100823
824 buf = ssl->in_hdr;
825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200826 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
Paul Bakker78a8c712013-03-06 17:01:52 +0100827
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200828 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +0100829 buf[2] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200830 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +0100831 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200832 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
Paul Bakker78a8c712013-03-06 17:01:52 +0100833 buf[3], buf[4] ) );
834
835 /*
836 * SSLv2 Client Hello
837 *
838 * Record layer:
839 * 0 . 1 message length
840 *
841 * SSL layer:
842 * 2 . 2 message type
843 * 3 . 4 protocol version
844 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200845 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
846 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100847 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200848 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
849 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100850 }
851
852 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
853
854 if( n < 17 || n > 512 )
855 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200856 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
857 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100858 }
859
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200860 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200861 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
862 ? buf[4] : ssl->conf->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +0100863
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200864 if( ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker78a8c712013-03-06 17:01:52 +0100865 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200866 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200867 " [%d:%d] < [%d:%d]",
868 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200869 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200871 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
872 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
873 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker78a8c712013-03-06 17:01:52 +0100874 }
875
Paul Bakker2fbefde2013-06-29 16:01:15 +0200876 ssl->handshake->max_major_ver = buf[3];
877 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +0100878
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200879 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100880 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200881 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Paul Bakker78a8c712013-03-06 17:01:52 +0100882 return( ret );
883 }
884
885 ssl->handshake->update_checksum( ssl, buf + 2, n );
886
887 buf = ssl->in_msg;
888 n = ssl->in_left - 5;
889
890 /*
891 * 0 . 1 ciphersuitelist length
892 * 2 . 3 session id length
893 * 4 . 5 challenge length
894 * 6 . .. ciphersuitelist
895 * .. . .. session id
896 * .. . .. challenge
897 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200898 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
Paul Bakker78a8c712013-03-06 17:01:52 +0100899
900 ciph_len = ( buf[0] << 8 ) | buf[1];
901 sess_len = ( buf[2] << 8 ) | buf[3];
902 chal_len = ( buf[4] << 8 ) | buf[5];
903
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200904 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +0100905 ciph_len, sess_len, chal_len ) );
906
907 /*
908 * Make sure each parameter length is valid
909 */
910 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
911 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200912 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
913 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100914 }
915
916 if( sess_len > 32 )
917 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200918 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
919 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100920 }
921
922 if( chal_len < 8 || chal_len > 32 )
923 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200924 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
925 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100926 }
927
928 if( n != 6 + ciph_len + sess_len + chal_len )
929 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200930 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
931 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100932 }
933
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200934 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Paul Bakker78a8c712013-03-06 17:01:52 +0100935 buf + 6, ciph_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200936 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
Paul Bakker78a8c712013-03-06 17:01:52 +0100937 buf + 6 + ciph_len, sess_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200938 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
Paul Bakker78a8c712013-03-06 17:01:52 +0100939 buf + 6 + ciph_len + sess_len, chal_len );
940
941 p = buf + 6 + ciph_len;
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200942 ssl->session_negotiate->id_len = sess_len;
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +0200943 memset( ssl->session_negotiate->id, 0,
944 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200945 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
Paul Bakker78a8c712013-03-06 17:01:52 +0100946
947 p += sess_len;
948 memset( ssl->handshake->randbytes, 0, 64 );
949 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
950
951 /*
952 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
953 */
954 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
955 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200956 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Paul Bakker78a8c712013-03-06 17:01:52 +0100957 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200958 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
959#if defined(MBEDTLS_SSL_RENEGOTIATION)
960 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Paul Bakker78a8c712013-03-06 17:01:52 +0100961 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200962 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100963 "during renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +0100964
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200965 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +0100966 return( ret );
967
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200968 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +0100969 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200970#endif /* MBEDTLS_SSL_RENEGOTIATION */
971 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker78a8c712013-03-06 17:01:52 +0100972 break;
973 }
974 }
975
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200976#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200977 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
978 {
979 if( p[0] == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200980 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
981 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200982 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200983 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200984
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200985 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200986 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200987 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200988
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200989 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
990 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200991
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200992 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200993 }
994
995 break;
996 }
997 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200998#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +0200999
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001000 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001001 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001002 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001003#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001004 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
1005 {
1006 for( i = 0; ciphersuites[i] != 0; i++ )
1007#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001008 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +01001009 {
1010 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001011#endif
Paul Bakker78a8c712013-03-06 17:01:52 +01001012 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001013 if( p[0] != 0 ||
1014 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1015 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
1016 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +02001017
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001018 got_common_suite = 1;
1019
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001020 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1021 &ciphersuite_info ) ) != 0 )
1022 return( ret );
Paul Bakker59c28a22013-06-29 15:33:42 +02001023
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001024 if( ciphersuite_info != NULL )
Paul Bakker78a8c712013-03-06 17:01:52 +01001025 goto have_ciphersuite_v2;
1026 }
1027 }
1028
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001029 if( got_common_suite )
1030 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001031 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001032 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001033 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001034 }
1035 else
1036 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1038 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001039 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001040
1041have_ciphersuite_v2:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001042 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001043
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001044 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker59c28a22013-06-29 15:33:42 +02001045 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001046 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Paul Bakker78a8c712013-03-06 17:01:52 +01001047
1048 /*
1049 * SSLv2 Client Hello relevant renegotiation security checks
1050 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001051 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001052 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001053 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001055
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001056 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001057 return( ret );
1058
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001059 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001060 }
1061
1062 ssl->in_left = 0;
1063 ssl->state++;
1064
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001065 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001066
1067 return( 0 );
1068}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001069#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
Paul Bakker78a8c712013-03-06 17:01:52 +01001070
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001071static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001072{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001073 int ret, got_common_suite;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001074 size_t i, j;
1075 size_t ciph_offset, comp_offset, ext_offset;
1076 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001077#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001078 size_t cookie_offset, cookie_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001079#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001080 unsigned char *buf, *p, *ext;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001081#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001082 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001083#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001084 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001085 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001086 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001087 int major, minor;
Paul Bakker5121ce52009-01-03 21:22:43 +00001088
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001089 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001090
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001091#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001092read_record_header:
1093#endif
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001094 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001095 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001096 * otherwise read it ourselves manually in order to support SSLv2
1097 * ClientHello, which doesn't use the same record layer format.
1098 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001099#if defined(MBEDTLS_SSL_RENEGOTIATION)
1100 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001101#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001103 if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001104 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001105 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnard59c6f2e2015-01-22 11:06:40 +00001106 return( ret );
1107 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001108 }
1109
1110 buf = ssl->in_hdr;
1111
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001112#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1113#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001114 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
Manuel Pégourié-Gonnard8a7cf252014-10-09 17:35:53 +02001115#endif
1116 if( ( buf[0] & 0x80 ) != 0 )
1117 return ssl_parse_client_hello_v2( ssl );
Paul Bakker78a8c712013-03-06 17:01:52 +01001118#endif
1119
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001120 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
Paul Bakkerec636f32012-09-09 19:17:02 +00001121
Paul Bakkerec636f32012-09-09 19:17:02 +00001122 /*
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001123 * SSLv3/TLS Client Hello
Paul Bakkerec636f32012-09-09 19:17:02 +00001124 *
1125 * Record layer:
1126 * 0 . 0 message type
1127 * 1 . 2 protocol version
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001128 * 3 . 11 DTLS: epoch + record sequence number
Paul Bakkerec636f32012-09-09 19:17:02 +00001129 * 3 . 4 message length
1130 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001131 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001132 buf[0] ) );
1133
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001134 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001135 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001136 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1137 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001138 }
1139
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001140 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001141 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
1142
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001143 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001144 buf[1], buf[2] ) );
1145
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001146 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001147
1148 /* According to RFC 5246 Appendix E.1, the version here is typically
1149 * "{03,00}, the lowest version number supported by the client, [or] the
1150 * value of ClientHello.client_version", so the only meaningful check here
1151 * is the major version shouldn't be less than 3 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001152 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001153 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001154 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1155 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001156 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001157
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001158 /* For DTLS if this is the initial handshake, remember the client sequence
1159 * number to use it in our next message (RFC 6347 4.2.1) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001160#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001161 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001162#if defined(MBEDTLS_SSL_RENEGOTIATION)
1163 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Manuel Pégourié-Gonnard3a173f42015-01-22 13:30:33 +00001164#endif
1165 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001166 {
1167 /* Epoch should be 0 for initial handshakes */
1168 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
1169 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001170 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1171 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001172 }
1173
1174 memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001175
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001176#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1177 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001178 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001179 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001180 ssl->next_record_offset = 0;
1181 ssl->in_left = 0;
1182 goto read_record_header;
1183 }
1184
1185 /* No MAC to check yet, so we can update right now */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001186 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001187#endif
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001188 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001189#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001190
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001191 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Paul Bakker5121ce52009-01-03 21:22:43 +00001192
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001193#if defined(MBEDTLS_SSL_RENEGOTIATION)
1194 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001195 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001196 /* Set by mbedtls_ssl_read_record() */
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001197 msg_len = ssl->in_hslen;
1198 }
1199 else
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001200#endif
Paul Bakkerec636f32012-09-09 19:17:02 +00001201 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001202 if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001203 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1205 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001206 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001207
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001208 if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001209 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001210 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001211 return( ret );
1212 }
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001213
1214 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001215#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001216 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001217 ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001218 else
1219#endif
1220 ssl->in_left = 0;
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001221 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001222
1223 buf = ssl->in_msg;
Paul Bakkerec636f32012-09-09 19:17:02 +00001224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001225 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001226
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001227 ssl->handshake->update_checksum( ssl, buf, msg_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001228
1229 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001230 * Handshake layer:
1231 * 0 . 0 handshake type
1232 * 1 . 3 handshake length
1233 * 4 . 5 DTLS only: message seqence number
1234 * 6 . 8 DTLS only: fragment offset
1235 * 9 . 11 DTLS only: fragment length
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001236 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001237 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001238 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001239 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1240 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001241 }
1242
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001243 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001244
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001245 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001246 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1248 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001249 }
1250
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001251 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001252 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1253
1254 /* We don't support fragmentation of ClientHello (yet?) */
1255 if( buf[1] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001256 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001257 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001258 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1259 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001260 }
1261
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001262#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001263 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001264 {
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001265 /*
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001266 * Copy the client's handshake message_seq on initial handshakes,
1267 * check sequence number on renego.
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001268 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001269#if defined(MBEDTLS_SSL_RENEGOTIATION)
1270 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001271 {
1272 /* This couldn't be done in ssl_prepare_handshake_record() */
1273 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1274 ssl->in_msg[5];
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001275
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001276 if( cli_msg_seq != ssl->handshake->in_msg_seq )
1277 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001278 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001279 "%d (expected %d)", cli_msg_seq,
1280 ssl->handshake->in_msg_seq ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001281 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001282 }
1283
1284 ssl->handshake->in_msg_seq++;
1285 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001286 else
1287#endif
1288 {
1289 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1290 ssl->in_msg[5];
1291 ssl->handshake->out_msg_seq = cli_msg_seq;
1292 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1293 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001294
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001295 /*
1296 * For now we don't support fragmentation, so make sure
1297 * fragment_offset == 0 and fragment_length == length
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001298 */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001299 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
1300 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
1301 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001302 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
1303 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001304 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001305 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001306#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001307
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001308 buf += mbedtls_ssl_hs_hdr_len( ssl );
1309 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001310
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001311 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001312 * ClientHello layer:
1313 * 0 . 1 protocol version
1314 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1315 * 34 . 35 session id length (1 byte)
1316 * 35 . 34+x session id
1317 * 35+x . 35+x DTLS only: cookie length (1 byte)
1318 * 36+x . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001319 * .. . .. ciphersuite list length (2 bytes)
1320 * .. . .. ciphersuite list
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001321 * .. . .. compression alg. list length (1 byte)
1322 * .. . .. compression alg. list
1323 * .. . .. extensions length (2 bytes, optional)
1324 * .. . .. extensions (optional)
Paul Bakkerec636f32012-09-09 19:17:02 +00001325 */
Paul Bakkerec636f32012-09-09 19:17:02 +00001326
1327 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001328 * Minimal length (with everything empty and extensions ommitted) is
1329 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1330 * read at least up to session id length without worrying.
Paul Bakkerec636f32012-09-09 19:17:02 +00001331 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001332 if( msg_len < 38 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001333 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001334 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1335 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001336 }
1337
1338 /*
1339 * Check and save the protocol version
1340 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001341 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001342
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001343 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001344 ssl->conf->transport, buf );
Paul Bakkerec636f32012-09-09 19:17:02 +00001345
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001346 ssl->handshake->max_major_ver = ssl->major_ver;
1347 ssl->handshake->max_minor_ver = ssl->minor_ver;
1348
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001349 if( ssl->major_ver < ssl->conf->min_major_ver ||
1350 ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00001351 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001352 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001353 " [%d:%d] < [%d:%d]",
1354 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001355 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001356
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001357 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1358 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001359
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001360 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001361 }
1362
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001363 if( ssl->major_ver > ssl->conf->max_major_ver )
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001364 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001365 ssl->major_ver = ssl->conf->max_major_ver;
1366 ssl->minor_ver = ssl->conf->max_minor_ver;
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001367 }
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001368 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
1369 ssl->minor_ver = ssl->conf->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001370
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001371 /*
1372 * Save client random (inc. Unix time)
1373 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001374 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001375
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001376 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001377
1378 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001379 * Check the session ID length and save session ID
Paul Bakkerec636f32012-09-09 19:17:02 +00001380 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001381 sess_len = buf[34];
Paul Bakkerec636f32012-09-09 19:17:02 +00001382
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001383 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001384 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Paul Bakkerec636f32012-09-09 19:17:02 +00001385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1387 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001388 }
1389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001390 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001391
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001392 ssl->session_negotiate->id_len = sess_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001393 memset( ssl->session_negotiate->id, 0,
1394 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001395 memcpy( ssl->session_negotiate->id, buf + 35,
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001396 ssl->session_negotiate->id_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001397
1398 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001399 * Check the cookie length and content
1400 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001401#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001402 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001403 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001404 cookie_offset = 35 + sess_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001405 cookie_len = buf[cookie_offset];
1406
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001407 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001408 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001409 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1410 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001411 }
1412
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001413 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001414 buf + cookie_offset + 1, cookie_len );
1415
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001416#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001417 if( ssl->conf->f_cookie_check != NULL
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001418#if defined(MBEDTLS_SSL_RENEGOTIATION)
1419 && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001420#endif
1421 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001422 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001423 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001424 buf + cookie_offset + 1, cookie_len,
1425 ssl->cli_id, ssl->cli_id_len ) != 0 )
1426 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001428 ssl->handshake->verify_cookie_len = 1;
1429 }
1430 else
1431 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001432 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001433 ssl->handshake->verify_cookie_len = 0;
1434 }
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001435 }
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02001436 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001438 {
1439 /* We know we didn't send a cookie, so it should be empty */
1440 if( cookie_len != 0 )
1441 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001442 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1443 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001444 }
1445
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001446 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001447 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001448
1449 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001450 * Check the ciphersuitelist length (will be parsed later)
Paul Bakkerec636f32012-09-09 19:17:02 +00001451 */
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001452 ciph_offset = cookie_offset + 1 + cookie_len;
Manuel Pégourié-Gonnarda06d7fe2015-03-13 10:36:55 +00001453 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001454 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001455#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001456 ciph_offset = 35 + sess_len;
Paul Bakkerec636f32012-09-09 19:17:02 +00001457
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001458 ciph_len = ( buf[ciph_offset + 0] << 8 )
1459 | ( buf[ciph_offset + 1] );
1460
1461 if( ciph_len < 2 ||
1462 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1463 ( ciph_len % 2 ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001464 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001465 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1466 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001467 }
1468
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001469 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001470 buf + ciph_offset + 2, ciph_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001471
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001472 /*
1473 * Check the compression algorithms length and pick one
1474 */
1475 comp_offset = ciph_offset + 2 + ciph_len;
1476
1477 comp_len = buf[comp_offset];
1478
1479 if( comp_len < 1 ||
1480 comp_len > 16 ||
1481 comp_len + comp_offset + 1 > msg_len )
Paul Bakkerec636f32012-09-09 19:17:02 +00001482 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001483 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1484 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001485 }
1486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001487 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001488 buf + comp_offset + 1, comp_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001490 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
1491#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakkerec636f32012-09-09 19:17:02 +00001492 for( i = 0; i < comp_len; ++i )
1493 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001494 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001495 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001496 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001497 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001498 }
1499 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001500#endif
1501
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001502 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001503#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001504 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001505 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001506#endif
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001507
Janos Follathc6dab2b2016-05-23 14:27:02 +01001508 /* Do not parse the extensions if the protocol is SSLv3 */
1509#if defined(MBEDTLS_SSL_PROTO_SSL3)
1510 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
1511 {
1512#endif
Simon Butcher584a5472016-05-23 16:24:52 +01001513 /*
1514 * Check the extension length
1515 */
1516 ext_offset = comp_offset + 1 + comp_len;
1517 if( msg_len > ext_offset )
Paul Bakker48916f92012-09-16 19:57:18 +00001518 {
Simon Butcher584a5472016-05-23 16:24:52 +01001519 if( msg_len < ext_offset + 2 )
1520 {
1521 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1522 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1523 }
1524
1525 ext_len = ( buf[ext_offset + 0] << 8 )
1526 | ( buf[ext_offset + 1] );
1527
1528 if( ( ext_len > 0 && ext_len < 4 ) ||
1529 msg_len != ext_offset + 2 + ext_len )
1530 {
1531 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1532 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1533 }
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001534 }
Simon Butcher584a5472016-05-23 16:24:52 +01001535 else
1536 ext_len = 0;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001537
Simon Butcher584a5472016-05-23 16:24:52 +01001538 ext = buf + ext_offset + 2;
1539 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001540
Simon Butcher584a5472016-05-23 16:24:52 +01001541 while( ext_len != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001542 {
Simon Butcher584a5472016-05-23 16:24:52 +01001543 unsigned int ext_id = ( ( ext[0] << 8 )
1544 | ( ext[1] ) );
1545 unsigned int ext_size = ( ( ext[2] << 8 )
1546 | ( ext[3] ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001547
Simon Butcher584a5472016-05-23 16:24:52 +01001548 if( ext_size + 4 > ext_len )
1549 {
1550 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1551 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1552 }
1553 switch( ext_id )
1554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001555#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001556 case MBEDTLS_TLS_EXT_SERVERNAME:
1557 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1558 if( ssl->conf->f_sni == NULL )
1559 break;
Paul Bakker5701cdc2012-09-27 21:49:42 +00001560
Simon Butcher584a5472016-05-23 16:24:52 +01001561 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1562 if( ret != 0 )
1563 return( ret );
1564 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001565#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001566
Simon Butcher584a5472016-05-23 16:24:52 +01001567 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1568 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001569#if defined(MBEDTLS_SSL_RENEGOTIATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001570 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001571#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001572
Simon Butcher584a5472016-05-23 16:24:52 +01001573 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1574 if( ret != 0 )
1575 return( ret );
1576 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001578#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1579 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001580 case MBEDTLS_TLS_EXT_SIG_ALG:
1581 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001582#if defined(MBEDTLS_SSL_RENEGOTIATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001583 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
1584 break;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001585#endif
Paul Bakker23f36802012-09-28 14:15:14 +00001586
Simon Butcher584a5472016-05-23 16:24:52 +01001587 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1588 if( ret != 0 )
1589 return( ret );
1590 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001591#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1592 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001593
Robert Cragie136884c2015-10-02 13:34:31 +01001594#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001595 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001596 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1597 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Paul Bakker41c83d32013-03-20 14:39:14 +01001598
Simon Butcher584a5472016-05-23 16:24:52 +01001599 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1600 if( ret != 0 )
1601 return( ret );
1602 break;
Paul Bakker41c83d32013-03-20 14:39:14 +01001603
Simon Butcher584a5472016-05-23 16:24:52 +01001604 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1605 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1606 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001607
Simon Butcher584a5472016-05-23 16:24:52 +01001608 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1609 if( ret != 0 )
1610 return( ret );
1611 break;
Robert Cragieae8535d2015-10-06 17:11:18 +01001612#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1613 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01001614
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001615#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001616 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1617 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001618
Simon Butcher584a5472016-05-23 16:24:52 +01001619 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
1620 if( ret != 0 )
1621 return( ret );
1622 break;
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001623#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1624
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001625#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Simon Butcher584a5472016-05-23 16:24:52 +01001626 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1627 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001628
Simon Butcher584a5472016-05-23 16:24:52 +01001629 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1630 if( ret != 0 )
1631 return( ret );
1632 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001633#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001634
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001635#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001636 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1637 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001638
Simon Butcher584a5472016-05-23 16:24:52 +01001639 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1640 if( ret != 0 )
1641 return( ret );
1642 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001643#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001644
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001645#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001646 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1647 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001648
Simon Butcher584a5472016-05-23 16:24:52 +01001649 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1650 if( ret != 0 )
1651 return( ret );
1652 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001653#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001654
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001655#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Simon Butcher584a5472016-05-23 16:24:52 +01001656 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1657 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001658
Simon Butcher584a5472016-05-23 16:24:52 +01001659 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1660 if( ret != 0 )
1661 return( ret );
1662 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001663#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001664
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001665#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Simon Butcher584a5472016-05-23 16:24:52 +01001666 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1667 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001668
Simon Butcher584a5472016-05-23 16:24:52 +01001669 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1670 if( ret != 0 )
1671 return( ret );
1672 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001673#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001675#if defined(MBEDTLS_SSL_ALPN)
Simon Butcher584a5472016-05-23 16:24:52 +01001676 case MBEDTLS_TLS_EXT_ALPN:
1677 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001678
Simon Butcher584a5472016-05-23 16:24:52 +01001679 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1680 if( ret != 0 )
1681 return( ret );
1682 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001683#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001684
Simon Butcher584a5472016-05-23 16:24:52 +01001685 default:
1686 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1687 ext_id ) );
1688 }
1689
1690 ext_len -= 4 + ext_size;
1691 ext += 4 + ext_size;
1692
1693 if( ext_len > 0 && ext_len < 4 )
1694 {
1695 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1696 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1697 }
Paul Bakker48916f92012-09-16 19:57:18 +00001698 }
Janos Follathc6dab2b2016-05-23 14:27:02 +01001699#if defined(MBEDTLS_SSL_PROTO_SSL3)
1700 }
1701#endif
1702
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001703#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001704 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
1705 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001706 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1707 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001708 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001709 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001710
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001711 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001712 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02001713 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001714
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001715 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1716 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001718 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001719 }
1720
1721 break;
1722 }
1723 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001724#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001725
Paul Bakker48916f92012-09-16 19:57:18 +00001726 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001727 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1728 */
1729 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
1730 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001731 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001732 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1734#if defined(MBEDTLS_SSL_RENEGOTIATION)
1735 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001736 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001737 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001738
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001739 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001740 return( ret );
1741
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001742 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001743 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001744#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001745 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001746 break;
1747 }
1748 }
1749
1750 /*
Paul Bakker48916f92012-09-16 19:57:18 +00001751 * Renegotiation security checks
1752 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001753 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001754 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001755 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001757 handshake_failure = 1;
1758 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001759#if defined(MBEDTLS_SSL_RENEGOTIATION)
1760 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1761 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001762 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001763 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001764 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001765 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00001766 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001767 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1768 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001769 ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00001770 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001771 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001772 handshake_failure = 1;
1773 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001774 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1775 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001776 renegotiation_info_seen == 1 )
1777 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001778 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001779 handshake_failure = 1;
1780 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001781#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001782
1783 if( handshake_failure == 1 )
1784 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001785 if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001786 return( ret );
1787
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001788 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00001789 }
Paul Bakker380da532012-04-18 16:10:25 +00001790
Paul Bakker41c83d32013-03-20 14:39:14 +01001791 /*
1792 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02001793 * (At the end because we need information from the EC-based extensions
1794 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01001795 */
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001796 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001797 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01001798 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001799#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001800 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001801 {
1802 for( i = 0; ciphersuites[i] != 0; i++ )
1803#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001804 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker41c83d32013-03-20 14:39:14 +01001805 {
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001806 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001807#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01001808 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001809 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1810 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1811 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01001812
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001813 got_common_suite = 1;
1814
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001815 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1816 &ciphersuite_info ) ) != 0 )
1817 return( ret );
1818
1819 if( ciphersuite_info != NULL )
1820 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01001821 }
1822 }
1823
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001824 if( got_common_suite )
1825 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001826 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001827 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001828 mbedtls_ssl_send_fatal_handshake_failure( ssl );
1829 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001830 }
1831 else
1832 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001833 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1834 mbedtls_ssl_send_fatal_handshake_failure( ssl );
1835 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001836 }
Paul Bakker41c83d32013-03-20 14:39:14 +01001837
1838have_ciphersuite:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001839 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001840
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001841 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker41c83d32013-03-20 14:39:14 +01001842 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001843 mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Paul Bakker41c83d32013-03-20 14:39:14 +01001844
Paul Bakker5121ce52009-01-03 21:22:43 +00001845 ssl->state++;
1846
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001847#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001848 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001849 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02001850#endif
1851
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001852 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001853
1854 return( 0 );
1855}
1856
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001857#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1858static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001859 unsigned char *buf,
1860 size_t *olen )
1861{
1862 unsigned char *p = buf;
1863
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001864 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001865 {
1866 *olen = 0;
1867 return;
1868 }
1869
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001870 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001871
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001872 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
1873 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001874
1875 *p++ = 0x00;
1876 *p++ = 0x00;
1877
1878 *olen = 4;
1879}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001880#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001881
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001882#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1883static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001884 unsigned char *buf,
1885 size_t *olen )
1886{
1887 unsigned char *p = buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001888 const mbedtls_ssl_ciphersuite_t *suite = NULL;
1889 const mbedtls_cipher_info_t *cipher = NULL;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001890
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001891 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
1892 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001893 {
1894 *olen = 0;
1895 return;
1896 }
1897
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01001898 /*
1899 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
1900 * from a client and then selects a stream or Authenticated Encryption
1901 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
1902 * encrypt-then-MAC response extension back to the client."
1903 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001904 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01001905 ssl->session_negotiate->ciphersuite ) ) == NULL ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001906 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
1907 cipher->mode != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01001908 {
1909 *olen = 0;
1910 return;
1911 }
1912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001913 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001914
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001915 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
1916 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001917
1918 *p++ = 0x00;
1919 *p++ = 0x00;
1920
1921 *olen = 4;
1922}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001923#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001924
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001925#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1926static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001927 unsigned char *buf,
1928 size_t *olen )
1929{
1930 unsigned char *p = buf;
1931
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001932 if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
1933 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001934 {
1935 *olen = 0;
1936 return;
1937 }
1938
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001939 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001940 "extension" ) );
1941
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001942 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
1943 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001944
1945 *p++ = 0x00;
1946 *p++ = 0x00;
1947
1948 *olen = 4;
1949}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001950#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001951
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001952#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1953static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001954 unsigned char *buf,
1955 size_t *olen )
1956{
1957 unsigned char *p = buf;
1958
1959 if( ssl->handshake->new_session_ticket == 0 )
1960 {
1961 *olen = 0;
1962 return;
1963 }
1964
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001965 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001966
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001967 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
1968 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001969
1970 *p++ = 0x00;
1971 *p++ = 0x00;
1972
1973 *olen = 4;
1974}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001975#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001976
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001977static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001978 unsigned char *buf,
1979 size_t *olen )
1980{
1981 unsigned char *p = buf;
1982
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001983 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001984 {
1985 *olen = 0;
1986 return;
1987 }
1988
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001989 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001990
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001991 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
1992 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001994#if defined(MBEDTLS_SSL_RENEGOTIATION)
1995 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001996 {
1997 *p++ = 0x00;
1998 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
1999 *p++ = ssl->verify_data_len * 2 & 0xFF;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002000
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002001 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
2002 p += ssl->verify_data_len;
2003 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
2004 p += ssl->verify_data_len;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002005 }
2006 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002007#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002008 {
2009 *p++ = 0x00;
2010 *p++ = 0x01;
2011 *p++ = 0x00;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002012 }
Manuel Pégourié-Gonnard19389752015-06-23 13:46:44 +02002013
2014 *olen = p - buf;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002015}
2016
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002017#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2018static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002019 unsigned char *buf,
2020 size_t *olen )
2021{
2022 unsigned char *p = buf;
2023
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002024 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02002025 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002026 *olen = 0;
2027 return;
2028 }
2029
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002030 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002031
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002032 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
2033 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002034
2035 *p++ = 0x00;
2036 *p++ = 1;
2037
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02002038 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002039
2040 *olen = 5;
2041}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002042#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002043
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002044#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002045 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002046static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002047 unsigned char *buf,
2048 size_t *olen )
2049{
2050 unsigned char *p = buf;
2051 ((void) ssl);
2052
Paul Bakker677377f2013-10-28 12:54:26 +01002053 if( ( ssl->handshake->cli_exts &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002054 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Paul Bakker677377f2013-10-28 12:54:26 +01002055 {
2056 *olen = 0;
2057 return;
2058 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002059
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002060 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002061
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002062 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
2063 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002064
2065 *p++ = 0x00;
2066 *p++ = 2;
2067
2068 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002069 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002070
2071 *olen = 6;
2072}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002073#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002074
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002075#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2076static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
2077 unsigned char *buf,
2078 size_t *olen )
2079{
2080 int ret;
2081 unsigned char *p = buf;
Robert Cragie39a60de2015-10-02 13:57:59 +01002082 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002083 size_t kkpp_len;
2084
2085 *olen = 0;
2086
2087 /* Skip costly computation if not needed */
2088 if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
2089 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2090 return;
2091
2092 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
2093
2094 if( end - p < 4 )
2095 {
2096 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2097 return;
2098 }
2099
2100 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
2101 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
2102
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02002103 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
2104 p + 2, end - p - 2, &kkpp_len,
2105 ssl->conf->f_rng, ssl->conf->p_rng );
2106 if( ret != 0 )
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002107 {
2108 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
2109 return;
2110 }
2111
2112 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
2113 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
2114
2115 *olen = kkpp_len + 4;
2116}
2117#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2118
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002119#if defined(MBEDTLS_SSL_ALPN )
2120static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002121 unsigned char *buf, size_t *olen )
2122{
2123 if( ssl->alpn_chosen == NULL )
2124 {
2125 *olen = 0;
2126 return;
2127 }
2128
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002129 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002130
2131 /*
2132 * 0 . 1 ext identifier
2133 * 2 . 3 ext length
2134 * 4 . 5 protocol list length
2135 * 6 . 6 protocol name length
2136 * 7 . 7+n protocol name
2137 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002138 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
2139 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002140
2141 *olen = 7 + strlen( ssl->alpn_chosen );
2142
2143 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2144 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2145
2146 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2147 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2148
2149 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2150
2151 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2152}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002153#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002154
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002155#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2156static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002157{
2158 int ret;
2159 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002160 unsigned char *cookie_len_byte;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002161
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002162 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002163
2164 /*
2165 * struct {
2166 * ProtocolVersion server_version;
2167 * opaque cookie<0..2^8-1>;
2168 * } HelloVerifyRequest;
2169 */
2170
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02002171 /* The RFC is not clear on this point, but sending the actual negotiated
2172 * version looks like the most interoperable thing to do. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002173 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002174 ssl->conf->transport, p );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002175 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002176 p += 2;
2177
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002178 /* If we get here, f_cookie_check is not null */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002179 if( ssl->conf->f_cookie_write == NULL )
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002180 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002181 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
2182 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002183 }
2184
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002185 /* Skip length byte until we know the length */
2186 cookie_len_byte = p++;
2187
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002188 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002189 &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002190 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002191 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002192 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002193 return( ret );
2194 }
2195
2196 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
2197
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002198 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002199
2200 ssl->out_msglen = p - ssl->out_msg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002201 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2202 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002203
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002204 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002205
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002206 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002207 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002208 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002209 return( ret );
2210 }
2211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002212 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002213
2214 return( 0 );
2215}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002216#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002217
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002218static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002219{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002220#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002221 mbedtls_time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002222#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002223 int ret;
2224 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002225 unsigned char *buf, *p;
2226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002227 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002229#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002230 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002231 ssl->handshake->verify_cookie_len != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002232 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002233 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
2234 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002235
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002236 return( ssl_write_hello_verify_request( ssl ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002237 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002238#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002239
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002240 if( ssl->conf->f_rng == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +01002241 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002242 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2243 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +01002244 }
2245
Paul Bakker5121ce52009-01-03 21:22:43 +00002246 /*
2247 * 0 . 0 handshake type
2248 * 1 . 3 handshake length
2249 * 4 . 5 protocol version
2250 * 6 . 9 UNIX time()
2251 * 10 . 37 random bytes
2252 */
2253 buf = ssl->out_msg;
2254 p = buf + 4;
2255
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002256 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002257 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002258 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002259
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002260 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002261 buf[4], buf[5] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002262
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002263#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002264 t = mbedtls_time( NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +00002265 *p++ = (unsigned char)( t >> 24 );
2266 *p++ = (unsigned char)( t >> 16 );
2267 *p++ = (unsigned char)( t >> 8 );
2268 *p++ = (unsigned char)( t );
2269
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002270 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002271#else
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002272 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002273 return( ret );
2274
2275 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002276#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker5121ce52009-01-03 21:22:43 +00002277
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002278 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Paul Bakkera3d195c2011-11-27 21:07:34 +00002279 return( ret );
2280
2281 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00002282
Paul Bakker48916f92012-09-16 19:57:18 +00002283 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002284
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002285 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002286
2287 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002288 * Resume is 0 by default, see ssl_handshake_init().
2289 * It may be already set to 1 by ssl_parse_session_ticket_ext().
2290 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00002291 */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002292 if( ssl->handshake->resume == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002293#if defined(MBEDTLS_SSL_RENEGOTIATION)
2294 ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002295#endif
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002296 ssl->session_negotiate->id_len != 0 &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002297 ssl->conf->f_get_cache != NULL &&
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01002298 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002299 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002300 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002301 ssl->handshake->resume = 1;
2302 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002303
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002304 if( ssl->handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002305 {
2306 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002307 * New session, create a new session id,
2308 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00002309 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002310 ssl->state++;
2311
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002312#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002313 ssl->session_negotiate->start = mbedtls_time( NULL );
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002314#endif
2315
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002316#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002317 if( ssl->handshake->new_session_ticket != 0 )
2318 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002319 ssl->session_negotiate->id_len = n = 0;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002320 memset( ssl->session_negotiate->id, 0, 32 );
2321 }
2322 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002323#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002324 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002325 ssl->session_negotiate->id_len = n = 32;
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002326 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02002327 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002328 return( ret );
2329 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002330 }
2331 else
2332 {
2333 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002334 * Resuming a session
Paul Bakker5121ce52009-01-03 21:22:43 +00002335 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002336 n = ssl->session_negotiate->id_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002337 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
Paul Bakkerff60ee62010-03-16 21:09:09 +00002338
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002339 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00002340 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002341 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00002342 return( ret );
2343 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002344 }
2345
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002346 /*
2347 * 38 . 38 session id length
2348 * 39 . 38+n session id
2349 * 39+n . 40+n chosen ciphersuite
2350 * 41+n . 41+n chosen compression alg.
2351 * 42+n . 43+n extensions length
2352 * 44+n . 43+n+m extensions
2353 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002354 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2355 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
2356 p += ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2359 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2360 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Paul Bakker0a597072012-09-25 21:55:46 +00002361 ssl->handshake->resume ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002362
Paul Bakker48916f92012-09-16 19:57:18 +00002363 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2364 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2365 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00002366
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002367 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2368 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2369 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00002370 ssl->session_negotiate->compression ) );
2371
Janos Follathc6dab2b2016-05-23 14:27:02 +01002372 /* Do not write the extensions if the protocol is SSLv3 */
2373#if defined(MBEDTLS_SSL_PROTO_SSL3)
2374 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
2375 {
2376#endif
2377
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002378 /*
2379 * First write extensions, then the total length
2380 */
2381 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2382 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00002383
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002384#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002385 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2386 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02002387#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002388
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002389#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002390 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
2391 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02002392#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002393
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002394#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002395 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2396 ext_len += olen;
2397#endif
2398
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002399#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002400 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2401 ext_len += olen;
2402#endif
2403
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002404#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002405 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2406 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02002407#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002408
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002409#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01002410 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002411 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2412 ext_len += olen;
2413#endif
2414
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002415#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2416 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
2417 ext_len += olen;
2418#endif
2419
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002420#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002421 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2422 ext_len += olen;
2423#endif
2424
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002425 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002426
Paul Bakkera7036632014-04-30 10:15:38 +02002427 if( ext_len > 0 )
2428 {
2429 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2430 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2431 p += ext_len;
2432 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002433
Janos Follathc6dab2b2016-05-23 14:27:02 +01002434#if defined(MBEDTLS_SSL_PROTO_SSL3)
2435 }
2436#endif
2437
Paul Bakker5121ce52009-01-03 21:22:43 +00002438 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002439 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2440 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002442 ret = mbedtls_ssl_write_record( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002443
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002444 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002445
2446 return( ret );
2447}
2448
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002449#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
2450 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Paul Bakker29f221f2016-07-22 13:49:02 +01002451 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002452 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
Paul Bakker29f221f2016-07-22 13:49:02 +01002453 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002454 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2455static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002456{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002457 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002458
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002459 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002460
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002461 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2462 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
2463 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02002464 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
2465 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002466 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002467 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002468 ssl->state++;
2469 return( 0 );
2470 }
2471
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002472 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2473 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002474}
2475#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002476static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002477{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002478 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2479 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002480 size_t dn_size, total_dn_size; /* excluding length bytes */
2481 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00002482 unsigned char *buf, *p;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02002483 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002484 const mbedtls_x509_crt *crt;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002485 int authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00002486
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002487 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002488
2489 ssl->state++;
2490
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002491#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2492 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
2493 authmode = ssl->handshake->sni_authmode;
2494 else
2495#endif
2496 authmode = ssl->conf->authmode;
2497
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002498 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2499 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
2500 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2501 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02002502 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002503 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002504 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002505 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002506 return( 0 );
2507 }
2508
2509 /*
2510 * 0 . 0 handshake type
2511 * 1 . 3 handshake length
2512 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01002513 * 5 .. m-1 cert types
2514 * m .. m+1 sig alg length (TLS 1.2 only)
Paul Bakker9af723c2014-05-01 13:03:14 +02002515 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00002516 * n .. n+1 length of all DNs
2517 * n+2 .. n+3 length of DN 1
2518 * n+4 .. ... Distinguished Name #1
2519 * ... .. ... length of DN 2, etc.
2520 */
2521 buf = ssl->out_msg;
2522 p = buf + 4;
2523
2524 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002525 * Supported certificate types
2526 *
2527 * ClientCertificateType certificate_types<1..2^8-1>;
2528 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00002529 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002530 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01002531
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002532#if defined(MBEDTLS_RSA_C)
2533 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002534#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002535#if defined(MBEDTLS_ECDSA_C)
2536 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002537#endif
2538
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002539 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002540 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01002541
Paul Bakker577e0062013-08-28 11:57:20 +02002542 sa_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002543#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01002544 /*
2545 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01002546 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002547 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2548 *
2549 * struct {
2550 * HashAlgorithm hash;
2551 * SignatureAlgorithm signature;
2552 * } SignatureAndHashAlgorithm;
2553 *
2554 * enum { (255) } HashAlgorithm;
2555 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01002556 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002557 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002558 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002559 /*
2560 * Only use current running hash algorithm that is already required
2561 * for requested ciphersuite.
2562 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002563 ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA256;
Paul Bakker926af752012-11-23 13:38:07 +01002564
Paul Bakkerb7149bc2013-03-20 15:30:09 +01002565 if( ssl->transform_negotiate->ciphersuite_info->mac ==
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002566 MBEDTLS_MD_SHA384 )
Paul Bakker926af752012-11-23 13:38:07 +01002567 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002568 ssl->handshake->verify_sig_alg = MBEDTLS_SSL_HASH_SHA384;
Paul Bakker926af752012-11-23 13:38:07 +01002569 }
Paul Bakkerf7abd422013-04-16 13:15:56 +02002570
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002571 /*
2572 * Supported signature algorithms
2573 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002574#if defined(MBEDTLS_RSA_C)
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002575 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002576 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002577#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002578#if defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002579 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002580 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002581#endif
Paul Bakker926af752012-11-23 13:38:07 +01002582
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002583 p[0] = (unsigned char)( sa_len >> 8 );
2584 p[1] = (unsigned char)( sa_len );
2585 sa_len += 2;
2586 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01002587 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002588#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002589
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002590 /*
2591 * DistinguishedName certificate_authorities<0..2^16-1>;
2592 * opaque DistinguishedName<1..2^16-1>;
2593 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002594 p += 2;
Manuel Pégourié-Gonnard8b431fb2015-05-11 12:54:52 +02002595#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2596 if( ssl->handshake->sni_ca_chain != NULL )
2597 crt = ssl->handshake->sni_ca_chain;
2598 else
2599#endif
2600 crt = ssl->conf->ca_chain;
Paul Bakker5121ce52009-01-03 21:22:43 +00002601
Paul Bakkerbc3d9842012-11-26 16:12:02 +01002602 total_dn_size = 0;
Paul Bakkerc70e4252014-04-18 13:47:38 +02002603 while( crt != NULL && crt->version != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002604 {
Paul Bakker926af752012-11-23 13:38:07 +01002605 dn_size = crt->subject_raw.len;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02002606
Manuel Pégourié-Gonnard7f171552015-12-10 14:36:25 +01002607 if( end < p ||
2608 (size_t)( end - p ) < dn_size ||
2609 (size_t)( end - p ) < 2 + dn_size )
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02002610 {
2611 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
2612 break;
2613 }
2614
Paul Bakker926af752012-11-23 13:38:07 +01002615 *p++ = (unsigned char)( dn_size >> 8 );
2616 *p++ = (unsigned char)( dn_size );
2617 memcpy( p, crt->subject_raw.p, dn_size );
2618 p += dn_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00002619
Manuel Pégourié-Gonnardb0761162015-07-22 11:39:23 +02002620 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
Paul Bakker926af752012-11-23 13:38:07 +01002621
Paul Bakkerbc3d9842012-11-26 16:12:02 +01002622 total_dn_size += 2 + dn_size;
Paul Bakker926af752012-11-23 13:38:07 +01002623 crt = crt->next;
Paul Bakker5121ce52009-01-03 21:22:43 +00002624 }
2625
Paul Bakker926af752012-11-23 13:38:07 +01002626 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002627 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2628 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002629 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
2630 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00002631
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002632 ret = mbedtls_ssl_write_record( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002633
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002634 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002635
2636 return( ret );
2637}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002638#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
2639 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
Paul Bakker29f221f2016-07-22 13:49:02 +01002640 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002641 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
Paul Bakker29f221f2016-07-22 13:49:02 +01002642 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002643 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002644
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002645#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2646 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2647static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002648{
2649 int ret;
2650
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002651 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002652 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002653 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
2654 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002655 }
2656
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002657 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
2658 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
2659 MBEDTLS_ECDH_OURS ) ) != 0 )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002660 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002661 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002662 return( ret );
2663 }
2664
2665 return( 0 );
2666}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002667#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2668 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002669
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002670static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker41c83d32013-03-20 14:39:14 +01002671{
Paul Bakker23986e52011-04-24 08:57:21 +00002672 int ret;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002673 size_t n = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002674 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02002675 ssl->transform_negotiate->ciphersuite_info;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002676
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002677#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2678 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2679 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2680 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
Robert Cragie136884c2015-10-02 13:34:31 +01002681 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2682 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002683 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002684 unsigned char *dig_signed = p;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002685 size_t dig_signed_len = 0, len;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002686 ((void) dig_signed);
2687 ((void) dig_signed_len);
Robert Cragie136884c2015-10-02 13:34:31 +01002688 ((void) len);
Paul Bakker2292d1f2013-09-15 17:06:49 +02002689#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01002690
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002691 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002692
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002693#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
2694 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
2695 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2696 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ||
2697 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
2698 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002699 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002700 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002701 ssl->state++;
2702 return( 0 );
2703 }
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002704#endif
2705
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002706#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2707 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2708 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
2709 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002710 {
2711 ssl_get_ecdh_params_from_cert( ssl );
2712
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002713 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002714 ssl->state++;
2715 return( 0 );
2716 }
2717#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002718
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02002719#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2720 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2721 {
2722 size_t jlen;
Robert Cragie39a60de2015-10-02 13:57:59 +01002723 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02002724
2725 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
2726 p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng );
2727 if( ret != 0 )
2728 {
2729 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
2730 return( ret );
2731 }
2732
2733 p += jlen;
2734 n += jlen;
2735 }
2736#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2737
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002738#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2739 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2740 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
2741 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002742 {
Manuel Pégourié-Gonnard9d624122016-02-22 11:10:14 +01002743 /* Note: we don't support identity hints, until someone asks
2744 * for them. */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002745 *(p++) = 0x00;
2746 *(p++) = 0x00;
2747
2748 n += 2;
2749 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002750#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2751 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002753#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2754 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2755 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
2756 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48916f92012-09-16 19:57:18 +00002757 {
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01002758 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
2759 {
2760 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
2761 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2762 }
2763
Paul Bakker41c83d32013-03-20 14:39:14 +01002764 /*
2765 * Ephemeral DH parameters:
2766 *
2767 * struct {
2768 * opaque dh_p<1..2^16-1>;
2769 * opaque dh_g<1..2^16-1>;
2770 * opaque dh_Ys<1..2^16-1>;
2771 * } ServerDHParams;
2772 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002773 if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 ||
2774 ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002775 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002776 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002777 return( ret );
2778 }
Paul Bakker48916f92012-09-16 19:57:18 +00002779
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002780 if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
2781 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002782 p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002783 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002784 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002785 return( ret );
2786 }
2787
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002788 dig_signed = p;
2789 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002790
2791 p += len;
2792 n += len;
2793
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002794 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2795 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2796 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2797 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker41c83d32013-03-20 14:39:14 +01002798 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002799#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2800 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01002801
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002802#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
2803 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2804 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
2805 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002806 {
Paul Bakker41c83d32013-03-20 14:39:14 +01002807 /*
2808 * Ephemeral ECDH parameters:
2809 *
2810 * struct {
2811 * ECParameters curve_params;
2812 * ECPoint public;
2813 * } ServerECDHParams;
2814 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002815 const mbedtls_ecp_curve_info **curve = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002816 const mbedtls_ecp_group_id *gid;
Gergely Budai987bfb52014-01-19 21:48:42 +01002817
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002818 /* Match our preference list against the offered curves */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002819 for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002820 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
2821 if( (*curve)->grp_id == *gid )
2822 goto curve_matching_done;
2823
2824curve_matching_done:
Manuel Pégourié-Gonnardb86145e2015-06-23 14:11:39 +02002825 if( curve == NULL || *curve == NULL )
Gergely Budai987bfb52014-01-19 21:48:42 +01002826 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002827 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
2828 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Gergely Budai987bfb52014-01-19 21:48:42 +01002829 }
Manuel Pégourié-Gonnardde053902014-02-04 13:58:39 +01002830
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002831 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
Gergely Budai987bfb52014-01-19 21:48:42 +01002832
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02002833 if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
Manuel Pégourié-Gonnardc3f6b62c2014-02-06 10:13:09 +01002834 (*curve)->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002835 {
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02002836 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002837 return( ret );
2838 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002839
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002840 if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
2841 p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002842 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002843 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002844 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01002845 return( ret );
2846 }
2847
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002848 dig_signed = p;
2849 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002850
2851 p += len;
2852 n += len;
2853
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002854 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01002855 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002856#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002857
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002858#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2859 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2860 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2861 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
2862 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
2863 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002864 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002865 size_t signature_len = 0;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002866 unsigned int hashlen = 0;
2867 unsigned char hash[64];
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002868 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
Paul Bakker23f36802012-09-28 14:15:14 +00002869
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002870 /*
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002871 * Choose hash algorithm. NONE means MD5 + SHA1 here.
2872 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002873#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2874 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002875 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002876 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002877
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002878 if( md_alg == MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002879 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002880 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2881 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002882 }
2883 }
Paul Bakker577e0062013-08-28 11:57:20 +02002884 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002885#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2886#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2887 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Paul Bakker66d5d072014-06-17 16:39:18 +02002888 if( ciphersuite_info->key_exchange ==
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002889 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002890 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002891 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002892 }
2893 else
Paul Bakker577e0062013-08-28 11:57:20 +02002894#endif
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002895 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002896 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002897 }
2898
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002899 /*
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002900 * Compute the hash to be signed
2901 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002902#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
2903 defined(MBEDTLS_SSL_PROTO_TLS1_1)
2904 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00002905 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002906 mbedtls_md5_context mbedtls_md5;
2907 mbedtls_sha1_context mbedtls_sha1;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002908
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002909 mbedtls_md5_init( &mbedtls_md5 );
2910 mbedtls_sha1_init( &mbedtls_sha1 );
Paul Bakker5b4af392014-06-26 12:09:34 +02002911
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002912 /*
2913 * digitally-signed struct {
2914 * opaque md5_hash[16];
2915 * opaque sha_hash[20];
2916 * };
2917 *
2918 * md5_hash
2919 * MD5(ClientHello.random + ServerHello.random
2920 * + ServerParams);
2921 * sha_hash
2922 * SHA(ClientHello.random + ServerHello.random
2923 * + ServerParams);
2924 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002925 mbedtls_md5_starts( &mbedtls_md5 );
2926 mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
2927 mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
2928 mbedtls_md5_finish( &mbedtls_md5, hash );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002929
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002930 mbedtls_sha1_starts( &mbedtls_sha1 );
2931 mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
2932 mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
2933 mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002934
2935 hashlen = 36;
Paul Bakker5b4af392014-06-26 12:09:34 +02002936
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002937 mbedtls_md5_free( &mbedtls_md5 );
2938 mbedtls_sha1_free( &mbedtls_sha1 );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002939 }
2940 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002941#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
2942 MBEDTLS_SSL_PROTO_TLS1_1 */
2943#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2944 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2945 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002946 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002947 mbedtls_md_context_t ctx;
2948 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002949
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002950 mbedtls_md_init( &ctx );
Paul Bakker84bbeb52014-07-01 14:53:22 +02002951
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002952 /* Info from md_alg will be used instead */
2953 hashlen = 0;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002954
2955 /*
2956 * digitally-signed struct {
2957 * opaque client_random[32];
2958 * opaque server_random[32];
2959 * ServerDHParams params;
2960 * };
2961 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002962 if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002963 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002964 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002965 return( ret );
2966 }
2967
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002968 mbedtls_md_starts( &ctx );
2969 mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
2970 mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
2971 mbedtls_md_finish( &ctx, hash );
2972 mbedtls_md_free( &ctx );
Paul Bakker23f36802012-09-28 14:15:14 +00002973 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002974 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002975#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
2976 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02002977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002978 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2979 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02002980 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002981
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002982 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
2983 (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002984
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002985 /*
2986 * Make the signature
2987 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002988 if( mbedtls_ssl_own_key( ssl ) == NULL )
Paul Bakker23f36802012-09-28 14:15:14 +00002989 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002990 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
2991 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002992 }
Paul Bakker23f36802012-09-28 14:15:14 +00002993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002994#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2995 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker23f36802012-09-28 14:15:14 +00002996 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002997 *(p++) = ssl->handshake->sig_alg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002998 *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002999
3000 n += 2;
3001 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003002#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003003
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003004 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02003005 p + 2 , &signature_len,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003006 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003007 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003008 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02003009 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003010 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02003011
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003012 *(p++) = (unsigned char)( signature_len >> 8 );
3013 *(p++) = (unsigned char)( signature_len );
Paul Bakkerbf63b362012-04-12 20:44:34 +00003014 n += 2;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003015
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003016 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
Paul Bakker48916f92012-09-16 19:57:18 +00003017
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003018 n += signature_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00003019 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003020#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
3021 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3022 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00003023
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003024 ssl->out_msglen = 4 + n;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003025 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3026 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003027
3028 ssl->state++;
3029
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003030 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003031 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003032 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003033 return( ret );
3034 }
3035
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003036 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003037
3038 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003039}
3040
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003041static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003042{
3043 int ret;
3044
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003045 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003046
3047 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003048 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3049 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003050
3051 ssl->state++;
3052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003053#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003054 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003055 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003056#endif
3057
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003058 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003059 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003060 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003061 return( ret );
3062 }
3063
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003064 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003065
3066 return( 0 );
3067}
3068
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003069#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3070 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3071static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003072 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003073{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003074 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003075 size_t n;
3076
3077 /*
3078 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3079 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003080 if( *p + 2 > end )
3081 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003082 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3083 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003084 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02003085
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003086 n = ( (*p)[0] << 8 ) | (*p)[1];
3087 *p += 2;
3088
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003089 if( *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003090 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003091 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3092 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003093 }
3094
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003095 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003096 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003097 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
3098 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003099 }
3100
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003101 *p += n;
3102
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003103 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003104
Paul Bakker70df2fb2013-04-17 17:19:09 +02003105 return( ret );
3106}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003107#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3108 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003109
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003110#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3111 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3112static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003113 const unsigned char *p,
3114 const unsigned char *end,
3115 size_t pms_offset )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003116{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003117 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003118 size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003119 unsigned char *pms = ssl->handshake->premaster + pms_offset;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003120 unsigned char ver[2];
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003121 unsigned char fake_pms[48], peer_pms[48];
3122 unsigned char mask;
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003123 size_t i, peer_pmslen;
3124 unsigned int diff;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003125
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003126 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003128 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
3129 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003130 }
3131
3132 /*
3133 * Decrypt the premaster using own private RSA key
3134 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003135#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3136 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3137 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003138 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003139 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
3140 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3143 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003144 }
3145 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003146#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003147
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003148 if( p + len != end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003149 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003150 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3151 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003152 }
3153
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003154 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003155 ssl->handshake->max_minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003156 ssl->conf->transport, ver );
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003157
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003158 /*
3159 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3160 * must not cause the connection to end immediately; instead, send a
3161 * bad_record_mac later in the handshake.
3162 * Also, avoid data-dependant branches here to protect against
3163 * timing-based variants.
3164 */
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003165 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003166 if( ret != 0 )
3167 return( ret );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01003168
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003169 ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003170 peer_pms, &peer_pmslen,
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003171 sizeof( peer_pms ),
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003172 ssl->conf->f_rng, ssl->conf->p_rng );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003173
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003174 diff = (unsigned int) ret;
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003175 diff |= peer_pmslen ^ 48;
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003176 diff |= peer_pms[0] ^ ver[0];
3177 diff |= peer_pms[1] ^ ver[1];
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003178
Manuel Pégourié-Gonnard331ba572015-04-20 12:33:57 +01003179#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003180 if( diff != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003181 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003182#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003183
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003184 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
3185 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
3186 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003187 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3188 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003189 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003190 ssl->handshake->pmslen = 48;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003191
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02003192 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
3193 /* MSVC has a warning about unary minus on unsigned, but this is
3194 * well-defined and precisely what we want to do here */
3195#if defined(_MSC_VER)
3196#pragma warning( push )
3197#pragma warning( disable : 4146 )
3198#endif
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003199 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02003200#if defined(_MSC_VER)
3201#pragma warning( pop )
3202#endif
3203
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003204 for( i = 0; i < ssl->handshake->pmslen; i++ )
3205 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
3206
3207 return( 0 );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003208}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003209#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3210 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003212#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
3213static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003214 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003215{
Paul Bakker6db455e2013-09-18 17:29:31 +02003216 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003217 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003218
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003219 if( ssl->conf->f_psk == NULL &&
3220 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
3221 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003222 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003223 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
3224 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003225 }
3226
3227 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003228 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02003229 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003230 if( *p + 2 > end )
3231 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003232 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3233 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003234 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003235
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003236 n = ( (*p)[0] << 8 ) | (*p)[1];
3237 *p += 2;
3238
3239 if( n < 1 || n > 65535 || *p + n > end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003240 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003241 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3242 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003243 }
3244
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003245 if( ssl->conf->f_psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02003246 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003247 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003248 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003249 }
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003250 else
Paul Bakker6db455e2013-09-18 17:29:31 +02003251 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01003252 /* Identity is not a big secret since clients send it in the clear,
3253 * but treat it carefully anyway, just in case */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003254 if( n != ssl->conf->psk_identity_len ||
3255 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003256 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003257 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003258 }
3259 }
3260
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003261 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003262 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003263 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
3264 if( ( ret = mbedtls_ssl_send_alert_message( ssl,
3265 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3266 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003267 {
3268 return( ret );
3269 }
3270
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003271 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003272 }
3273
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003274 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003275
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003276 return( 0 );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003277}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003278#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02003279
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003280static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003281{
Paul Bakker23986e52011-04-24 08:57:21 +00003282 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003283 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003284 unsigned char *p, *end;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003285
Paul Bakker41c83d32013-03-20 14:39:14 +01003286 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003287
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003288 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003289
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003290 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003291 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003292 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003293 return( ret );
3294 }
3295
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003296 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003297 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnardf8995832014-09-10 08:25:12 +00003298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003299 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003300 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003301 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3302 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003303 }
3304
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003305 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003306 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003307 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3308 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003309 }
3310
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003311#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3312 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003313 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003314 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003315 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003316 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003317 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003318 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003319
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003320 if( p != end )
3321 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003322 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3323 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003324 }
3325
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003326 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003327 ssl->handshake->premaster,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01003328 MBEDTLS_PREMASTER_SIZE,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02003329 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003330 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003331 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003332 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
3333 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003334 }
3335
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003336 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003337 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003338 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003339#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3340#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3341 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3342 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3343 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3344 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3345 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3346 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3347 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003348 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003349 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003350 p, end - p) ) != 0 )
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003351 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003352 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
3353 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003354 }
3355
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003356 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003358 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003359 &ssl->handshake->pmslen,
3360 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003361 MBEDTLS_MPI_MAX_SIZE,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003362 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003363 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003364 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
3365 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003366 }
3367
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003368 MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
Paul Bakker5121ce52009-01-03 21:22:43 +00003369 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003370 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003371#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3372 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3373 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3374 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3375#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3376 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003377 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003378 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003379 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003380 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003381 return( ret );
3382 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003383
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003384 if( p != end )
3385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3387 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003388 }
3389
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003390 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003391 ciphersuite_info->key_exchange ) ) != 0 )
3392 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003393 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003394 return( ret );
3395 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003396 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003397 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003398#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
3399#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3400 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003401 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003402 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3403 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003404 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003405 return( ret );
3406 }
3407
3408 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
3409 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003410 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003411 return( ret );
3412 }
3413
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003414 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003415 ciphersuite_info->key_exchange ) ) != 0 )
3416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003417 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003418 return( ret );
3419 }
3420 }
3421 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003422#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3423#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3424 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003425 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003426 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3427 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003428 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003429 return( ret );
3430 }
3431 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
3432 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003433 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003434 return( ret );
3435 }
3436
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003437 if( p != end )
3438 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003439 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3440 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003441 }
3442
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003443 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003444 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003445 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003446 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003447 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003448 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003449 }
3450 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003451#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3452#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3453 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003454 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003455 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3456 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003457 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003458 return( ret );
3459 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003460
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003461 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003462 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003463 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003464 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
3465 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003466 }
3467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003468 MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02003469
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003470 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02003471 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003472 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003473 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003474 return( ret );
3475 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02003476 }
3477 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003478#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
3479#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3480 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01003481 {
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003482 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003483 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003484 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003485 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003486 }
3487 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003488 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003489#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003490#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3491 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3492 {
3493 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
3494 p, end - p );
3495 if( ret != 0 )
3496 {
3497 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
3498 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3499 }
3500
3501 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
3502 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
3503 ssl->conf->f_rng, ssl->conf->p_rng );
3504 if( ret != 0 )
3505 {
3506 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
3507 return( ret );
3508 }
3509 }
3510 else
3511#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003512 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003513 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3514 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003515 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003516
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003517 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00003518 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003519 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00003520 return( ret );
3521 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003522
Paul Bakker5121ce52009-01-03 21:22:43 +00003523 ssl->state++;
3524
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003525 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003526
3527 return( 0 );
3528}
3529
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003530#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
3531 !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Paul Bakker29f221f2016-07-22 13:49:02 +01003532 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003533 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
Paul Bakker29f221f2016-07-22 13:49:02 +01003534 !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003535 !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3536static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003537{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003538 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003539
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003540 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003541
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003542 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3543 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3544 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02003545 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3546 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
Paul Bakkered27a042013-04-18 22:46:23 +02003547 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003548 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02003549 ssl->state++;
3550 return( 0 );
3551 }
3552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003553 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3554 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003555}
3556#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003557static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003558{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003559 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003560 size_t i, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003561 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003562 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003563 size_t hashlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003564#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3565 mbedtls_pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02003566#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003567 mbedtls_md_type_t md_alg;
3568 const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003569
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003570 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003571
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003572 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3573 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3574 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3575 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard25dbeb02015-09-16 17:30:03 +02003576 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
Manuel Pégourié-Gonnard72226212014-09-10 14:23:38 +00003577 ssl->session_negotiate->peer_cert == NULL )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003578 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003579 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003580 ssl->state++;
3581 return( 0 );
3582 }
3583
Manuel Pégourié-Gonnard72226212014-09-10 14:23:38 +00003584 /* Needs to be done before read_record() to exclude current message */
Paul Bakker48916f92012-09-16 19:57:18 +00003585 ssl->handshake->calc_verify( ssl, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00003586
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003587 if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003588 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003589 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003590 return( ret );
3591 }
3592
3593 ssl->state++;
3594
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003595 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
3596 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00003597 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003598 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3599 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00003600 }
3601
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003602 i = mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003603
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003604 /*
3605 * struct {
3606 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
3607 * opaque signature<0..2^16-1>;
3608 * } DigitallySigned;
3609 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003610#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3611 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3612 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01003613 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003614 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003615 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003616
3617 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003618 if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
3619 MBEDTLS_PK_ECDSA ) )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003620 {
3621 hash_start += 16;
3622 hashlen -= 16;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003623 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003624 }
Paul Bakker926af752012-11-23 13:38:07 +01003625 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003626 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003627#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
3628 MBEDTLS_SSL_PROTO_TLS1_1 */
3629#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3630 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02003631 {
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003632 if( i + 2 > ssl->in_hslen )
3633 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003634 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3635 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003636 }
3637
Paul Bakker5121ce52009-01-03 21:22:43 +00003638 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02003639 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00003640 */
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003641 if( ssl->in_msg[i] != ssl->handshake->verify_sig_alg )
Paul Bakker5121ce52009-01-03 21:22:43 +00003642 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003643 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003644 " for verify message" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003645 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker926af752012-11-23 13:38:07 +01003646 }
3647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003648 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
Paul Bakker926af752012-11-23 13:38:07 +01003649
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02003650 /* Info from md_alg will be used instead */
3651 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003652
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003653 i++;
3654
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003655 /*
3656 * Signature
3657 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003658 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
3659 == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003660 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003661 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02003662 " for verify message" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003663 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003664 }
3665
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003666 /*
3667 * Check the certificate's key type matches the signature alg
3668 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003669 if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003670 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003671 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
3672 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003673 }
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003674
3675 i++;
Paul Bakker577e0062013-08-28 11:57:20 +02003676 }
3677 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003678#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003679 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003680 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3681 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02003682 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02003683
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003684 if( i + 2 > ssl->in_hslen )
3685 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003686 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3687 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00003688 }
3689
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003690 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
3691 i += 2;
Paul Bakker926af752012-11-23 13:38:07 +01003692
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003693 if( i + sig_len != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00003694 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003695 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3696 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00003697 }
3698
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003699 if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003700 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00003701 ssl->in_msg + i, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003702 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003703 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003704 return( ret );
3705 }
3706
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003707 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003708
Paul Bakkered27a042013-04-18 22:46:23 +02003709 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003710}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003711#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
3712 !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
Paul Bakker29f221f2016-07-22 13:49:02 +01003713 !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
3714 !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
3715 !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
3716 !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003717
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003718#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3719static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003720{
3721 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003722 size_t tlen;
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02003723 uint32_t lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003724
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003725 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003726
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003727 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3728 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003729
3730 /*
3731 * struct {
3732 * uint32 ticket_lifetime_hint;
3733 * opaque ticket<0..2^16-1>;
3734 * } NewSessionTicket;
3735 *
3736 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
3737 * 8 . 9 ticket_len (n)
3738 * 10 . 9+n ticket content
3739 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02003740
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02003741 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +02003742 ssl->session_negotiate,
3743 ssl->out_msg + 10,
3744 ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02003745 &tlen, &lifetime ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02003746 {
Manuel Pégourié-Gonnarda4a47352015-05-15 15:14:54 +02003747 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02003748 tlen = 0;
3749 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003750
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02003751 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
3752 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
3753 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
3754 ssl->out_msg[7] = ( lifetime ) & 0xFF;
3755
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003756 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
3757 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003758
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003759 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003760
Manuel Pégourié-Gonnard145dfcb2014-02-26 14:23:33 +01003761 /*
3762 * Morally equivalent to updating ssl->state, but NewSessionTicket and
3763 * ChangeCipherSpec share the same state.
3764 */
3765 ssl->handshake->new_session_ticket = 0;
3766
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003767 if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003768 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003769 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003770 return( ret );
3771 }
3772
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003773 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003774
3775 return( 0 );
3776}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003777#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003778
Paul Bakker5121ce52009-01-03 21:22:43 +00003779/*
Paul Bakker1961b702013-01-25 14:49:24 +01003780 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00003781 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003782int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003783{
3784 int ret = 0;
3785
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02003786 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003787 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003788
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003789 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01003790
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003791 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01003792 return( ret );
3793
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003794#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003795 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003796 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003797 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003798 if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02003799 return( ret );
3800 }
3801#endif
3802
Paul Bakker1961b702013-01-25 14:49:24 +01003803 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00003804 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003805 case MBEDTLS_SSL_HELLO_REQUEST:
3806 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00003807 break;
3808
Paul Bakker1961b702013-01-25 14:49:24 +01003809 /*
3810 * <== ClientHello
3811 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003812 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01003813 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003814 break;
Paul Bakker1961b702013-01-25 14:49:24 +01003815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003816#if defined(MBEDTLS_SSL_PROTO_DTLS)
3817 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
3818 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02003819#endif
3820
Paul Bakker1961b702013-01-25 14:49:24 +01003821 /*
3822 * ==> ServerHello
3823 * Certificate
3824 * ( ServerKeyExchange )
3825 * ( CertificateRequest )
3826 * ServerHelloDone
3827 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003828 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01003829 ret = ssl_write_server_hello( ssl );
3830 break;
3831
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003832 case MBEDTLS_SSL_SERVER_CERTIFICATE:
3833 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003834 break;
3835
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003836 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01003837 ret = ssl_write_server_key_exchange( ssl );
3838 break;
3839
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003840 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01003841 ret = ssl_write_certificate_request( ssl );
3842 break;
3843
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003844 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01003845 ret = ssl_write_server_hello_done( ssl );
3846 break;
3847
3848 /*
3849 * <== ( Certificate/Alert )
3850 * ClientKeyExchange
3851 * ( CertificateVerify )
3852 * ChangeCipherSpec
3853 * Finished
3854 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003855 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
3856 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003857 break;
3858
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003859 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01003860 ret = ssl_parse_client_key_exchange( ssl );
3861 break;
3862
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003863 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01003864 ret = ssl_parse_certificate_verify( ssl );
3865 break;
3866
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003867 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
3868 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003869 break;
3870
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003871 case MBEDTLS_SSL_CLIENT_FINISHED:
3872 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003873 break;
3874
3875 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003876 * ==> ( NewSessionTicket )
3877 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01003878 * Finished
3879 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003880 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
3881#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003882 if( ssl->handshake->new_session_ticket != 0 )
3883 ret = ssl_write_new_session_ticket( ssl );
3884 else
Paul Bakkera503a632013-08-14 13:48:06 +02003885#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003886 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003887 break;
3888
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003889 case MBEDTLS_SSL_SERVER_FINISHED:
3890 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003891 break;
3892
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003893 case MBEDTLS_SSL_FLUSH_BUFFERS:
3894 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3895 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01003896 break;
3897
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003898 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
3899 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003900 break;
3901
3902 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003903 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3904 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003905 }
3906
Paul Bakker5121ce52009-01-03 21:22:43 +00003907 return( ret );
3908}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003909#endif /* MBEDTLS_SSL_SRV_C */