blob: ccc32d73ac7f5d0c0ef8ffd74c879065068cdc2c [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Manuel Pégourié-Gonnard6fb81872015-07-27 11:11:48 +02004 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
Manuel Pégourié-Gonnard37ff1402015-09-04 14:21:07 +02005 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
Paul Bakkerb96f1542010-07-18 20:36:00 +000018 *
Manuel Pégourié-Gonnardfe446432015-03-06 13:17:10 +000019 * This file is part of mbed TLS (https://tls.mbed.org)
Paul Bakker5121ce52009-01-03 21:22:43 +000020 */
21
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020022#if !defined(MBEDTLS_CONFIG_FILE)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000023#include "mbedtls/config.h"
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020024#else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020025#include MBEDTLS_CONFIG_FILE
Manuel Pégourié-Gonnardcef4ad22014-04-29 12:39:06 +020026#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020028#if defined(MBEDTLS_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
SimonBd5800b72016-04-26 07:43:27 +010030#if defined(MBEDTLS_PLATFORM_C)
31#include "mbedtls/platform.h"
32#else
33#include <stdlib.h>
34#define mbedtls_calloc calloc
35#define mbedtls_free free
SimonBd5800b72016-04-26 07:43:27 +010036#endif
37
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000038#include "mbedtls/debug.h"
39#include "mbedtls/ssl.h"
Manuel Pégourié-Gonnard5e94dde2015-05-26 11:57:05 +020040#include "mbedtls/ssl_internal.h"
Andres Amaya Garcia84914062018-04-24 08:40:46 -050041#include "mbedtls/platform_util.h"
Rich Evans00ab4702015-02-06 13:43:58 +000042
43#include <string.h>
44
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020045#if defined(MBEDTLS_ECP_C)
Manuel Pégourié-Gonnard7f809972015-03-09 17:05:11 +000046#include "mbedtls/ecp.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010047#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020049#if defined(MBEDTLS_HAVE_TIME)
Simon Butcherb5b6af22016-07-13 14:46:18 +010050#include "mbedtls/platform_time.h"
Paul Bakkerfa9b1002013-07-03 15:31:03 +020051#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000052
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020053#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
54int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020055 const unsigned char *info,
56 size_t ilen )
57{
Hanno Becker2d9623f2019-06-13 12:07:05 +010058 if( mbedtls_ssl_conf_get_endpoint( ssl->conf ) != MBEDTLS_SSL_IS_SERVER )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020059 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020060
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020061 mbedtls_free( ssl->cli_id );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020062
Manuel Pégourié-Gonnard7551cb92015-05-26 16:04:06 +020063 if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
Manuel Pégourié-Gonnard6a8ca332015-05-28 09:33:39 +020064 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020065
66 memcpy( ssl->cli_id, info, ilen );
67 ssl->cli_id_len = ilen;
68
69 return( 0 );
70}
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020071
Manuel Pégourié-Gonnard6729e792015-05-11 09:50:24 +020072void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020073 mbedtls_ssl_cookie_write_t *f_cookie_write,
74 mbedtls_ssl_cookie_check_t *f_cookie_check,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020075 void *p_cookie )
76{
Manuel Pégourié-Gonnardd36e33f2015-05-05 10:45:39 +020077 conf->f_cookie_write = f_cookie_write;
78 conf->f_cookie_check = f_cookie_check;
79 conf->p_cookie = p_cookie;
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +020080}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020081#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard43c02182014-07-22 17:32:01 +020082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020083#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020084static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +000085 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +000086 size_t len )
87{
88 int ret;
89 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +000090 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +000091
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +020092 MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
Manuel Pégourié-Gonnard96ea2f22014-02-25 12:26:29 +010093
Philippe Antoine747fd532018-05-30 09:13:21 +020094 if( len < 2 )
95 {
96 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
97 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
98 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
99 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
100 }
Paul Bakker5701cdc2012-09-27 21:49:42 +0000101 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
102 if( servername_list_size + 2 != len )
103 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200104 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200105 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
106 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200107 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000108 }
109
110 p = buf + 2;
Philippe Antoine747fd532018-05-30 09:13:21 +0200111 while( servername_list_size > 2 )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000112 {
113 hostname_len = ( ( p[1] << 8 ) | p[2] );
114 if( hostname_len + 3 > servername_list_size )
115 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200116 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200117 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
118 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200119 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000120 }
121
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200122 if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
Paul Bakker5701cdc2012-09-27 21:49:42 +0000123 {
Manuel Pégourié-Gonnard1af6c852015-05-10 23:10:37 +0200124 ret = ssl->conf->f_sni( ssl->conf->p_sni,
125 ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000126 if( ret != 0 )
127 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200128 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
129 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
130 MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
131 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000132 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000133 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000134 }
135
136 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000137 p += hostname_len + 3;
138 }
139
140 if( servername_list_size != 0 )
141 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200142 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200143 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
144 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200145 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000146 }
147
148 return( 0 );
149}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200150#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000151
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200152static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000153 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000154 size_t len )
155{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200156#if defined(MBEDTLS_SSL_RENEGOTIATION)
157 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100158 {
159 /* Check verify-data in constant-time. The length OTOH is no secret */
160 if( len != 1 + ssl->verify_data_len ||
161 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200162 mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100163 ssl->verify_data_len ) != 0 )
164 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200165 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200166 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
167 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200168 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +0100169 }
170 }
171 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200172#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker48916f92012-09-16 19:57:18 +0000173 {
174 if( len != 1 || buf[0] != 0x0 )
175 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200176 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +0200177 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
178 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200179 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +0000180 }
181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200182 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker48916f92012-09-16 19:57:18 +0000183 }
Paul Bakker48916f92012-09-16 19:57:18 +0000184
185 return( 0 );
186}
187
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200188#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
189 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100190
191/*
192 * Status of the implementation of signature-algorithms extension:
193 *
194 * Currently, we are only considering the signature-algorithm extension
195 * to pick a ciphersuite which allows us to send the ServerKeyExchange
196 * message with a signature-hash combination that the user allows.
197 *
198 * We do *not* check whether all certificates in our certificate
199 * chain are signed with an allowed signature-hash pair.
200 * This needs to be done at a later stage.
201 *
202 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200203static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000204 const unsigned char *buf,
205 size_t len )
206{
207 size_t sig_alg_list_size;
Hanno Becker7e5437a2017-04-28 17:15:26 +0100208
Paul Bakker23f36802012-09-28 14:15:14 +0000209 const unsigned char *p;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200210 const unsigned char *end = buf + len;
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200211
Hanno Becker7e5437a2017-04-28 17:15:26 +0100212 mbedtls_md_type_t md_cur;
213 mbedtls_pk_type_t sig_cur;
Paul Bakker23f36802012-09-28 14:15:14 +0000214
Philippe Antoine747fd532018-05-30 09:13:21 +0200215 if ( len < 2 ) {
216 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
217 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
218 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
219 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
220 }
Paul Bakker23f36802012-09-28 14:15:14 +0000221 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
222 if( sig_alg_list_size + 2 != len ||
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200223 sig_alg_list_size % 2 != 0 )
Paul Bakker23f36802012-09-28 14:15:14 +0000224 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200225 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200226 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
227 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200228 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker23f36802012-09-28 14:15:14 +0000229 }
230
Hanno Becker7e5437a2017-04-28 17:15:26 +0100231 /* Currently we only guarantee signing the ServerKeyExchange message according
232 * to the constraints specified in this extension (see above), so it suffices
233 * to remember only one suitable hash for each possible signature algorithm.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200234 *
Hanno Becker7e5437a2017-04-28 17:15:26 +0100235 * This will change when we also consider certificate signatures,
236 * in which case we will need to remember the whole signature-hash
237 * pair list from the extension.
Manuel Pégourié-Gonnard08e81e02014-07-08 12:56:25 +0200238 */
Hanno Becker7e5437a2017-04-28 17:15:26 +0100239
240 for( p = buf + 2; p < end; p += 2 )
241 {
242 /* Silently ignore unknown signature or hash algorithms. */
243
244 if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
245 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100246 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext"
247 " unknown sig alg encoding %d", p[1] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100248 continue;
249 }
250
251 /* Check if we support the hash the user proposes */
252 md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
253 if( md_cur == MBEDTLS_MD_NONE )
254 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100255 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
256 " unknown hash alg encoding %d", p[0] ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +0100257 continue;
258 }
259
260 if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
261 {
262 mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
264 " match sig %d and hash %d",
Hanno Becker7e5437a2017-04-28 17:15:26 +0100265 sig_cur, md_cur ) );
266 }
267 else
268 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100269 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: "
270 "hash alg %d not supported", md_cur ) );
Paul Bakker23f36802012-09-28 14:15:14 +0000271 }
Paul Bakker23f36802012-09-28 14:15:14 +0000272 }
273
Paul Bakker23f36802012-09-28 14:15:14 +0000274 return( 0 );
275}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200276#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
277 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker23f36802012-09-28 14:15:14 +0000278
Robert Cragie136884c2015-10-02 13:34:31 +0100279#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +0100280 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200281static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100282 const unsigned char *buf, size_t len,
283 mbedtls_ecp_group_id curve_ids[ MBEDTLS_ECP_DP_MAX ] )
Paul Bakker41c83d32013-03-20 14:39:14 +0100284{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200285 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100286 const unsigned char *p;
287
Philippe Antoine747fd532018-05-30 09:13:21 +0200288 if ( len < 2 ) {
289 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
290 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
291 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
292 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
293 }
Paul Bakker41c83d32013-03-20 14:39:14 +0100294 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
295 if( list_size + 2 != len ||
296 list_size % 2 != 0 )
297 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200298 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200299 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
300 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200301 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100302 }
303
304 p = buf + 2;
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100305 our_size = MBEDTLS_ECP_DP_MAX;
306
307 /* Leave room for final 0-entry */
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200308 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100309 {
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100310 uint16_t const tls_id = ( p[0] << 8 ) | p[1];
311 mbedtls_ecp_curve_info const * const info =
312 mbedtls_ecp_curve_info_from_tls_id( tls_id );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200313
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100314 if( info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100315 {
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100316 mbedtls_ecp_group_id const *gid;
317 /* Remember the first curve that we also support. */
318 for( gid = ssl->conf->curve_list;
319 *gid != MBEDTLS_ECP_DP_NONE; gid++ )
320 {
321 if( info->grp_id != *gid )
322 continue;
323
324 if( ssl->handshake->curve_info == NULL )
325 ssl->handshake->curve_info = info;
326 }
327
328 *curve_ids++ = info->grp_id;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200329 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100330 }
331
332 list_size -= 2;
333 p += 2;
334 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100335 *curve_ids = MBEDTLS_ECP_DP_NONE;
Paul Bakker41c83d32013-03-20 14:39:14 +0100336
337 return( 0 );
338}
339
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200340static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200341 const unsigned char *buf,
342 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100343{
344 size_t list_size;
345 const unsigned char *p;
346
Philippe Antoine747fd532018-05-30 09:13:21 +0200347 if( len == 0 || (size_t)( buf[0] + 1 ) != len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100348 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200349 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200350 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
351 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200352 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker41c83d32013-03-20 14:39:14 +0100353 }
Philippe Antoine747fd532018-05-30 09:13:21 +0200354 list_size = buf[0];
Paul Bakker41c83d32013-03-20 14:39:14 +0100355
Manuel Pégourié-Gonnardc1b46d02015-09-16 11:18:32 +0200356 p = buf + 1;
Paul Bakker41c83d32013-03-20 14:39:14 +0100357 while( list_size > 0 )
358 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200359 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
360 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
Paul Bakker41c83d32013-03-20 14:39:14 +0100361 {
Robert Cragie136884c2015-10-02 13:34:31 +0100362#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200363 ssl->handshake->ecdh_ctx.point_format = p[0];
Robert Cragie136884c2015-10-02 13:34:31 +0100364#endif
Robert Cragieae8535d2015-10-06 17:11:18 +0100365#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Robert Cragie136884c2015-10-02 13:34:31 +0100366 ssl->handshake->ecjpake_ctx.point_format = p[0];
367#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200368 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100369 return( 0 );
370 }
371
372 list_size--;
373 p++;
374 }
375
376 return( 0 );
377}
Robert Cragieae8535d2015-10-06 17:11:18 +0100378#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
379 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +0100380
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200381#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
382static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
383 const unsigned char *buf,
384 size_t len )
385{
386 int ret;
387
388 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
389 {
390 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
391 return( 0 );
392 }
393
394 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
395 buf, len ) ) != 0 )
396 {
397 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200398 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
399 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200400 return( ret );
401 }
402
403 /* Only mark the extension as OK when we're sure it is */
404 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
405
406 return( 0 );
407}
408#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
409
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200410#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
411static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200412 const unsigned char *buf,
413 size_t len )
414{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200415 if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200417 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200418 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
419 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200420 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200421 }
422
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200423 ssl->session_negotiate->mfl_code = buf[0];
424
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200425 return( 0 );
426}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200427#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200428
Hanno Beckera5a2b082019-05-15 14:03:01 +0100429#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc403b262019-04-26 13:56:39 +0100430static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl,
431 const unsigned char *buf,
432 size_t len )
433{
434 size_t peer_cid_len;
435
436 /* CID extension only makes sense in DTLS */
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200437 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) )
Hanno Beckerc403b262019-04-26 13:56:39 +0100438 {
439 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
440 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
441 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
442 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
443 }
444
445 /*
Hanno Becker3cdf8fe2019-05-15 10:26:32 +0100446 * Quoting draft-ietf-tls-dtls-connection-id-05
447 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Beckerc403b262019-04-26 13:56:39 +0100448 *
449 * struct {
450 * opaque cid<0..2^8-1>;
451 * } ConnectionId;
452 */
453
454 if( len < 1 )
455 {
456 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
457 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
458 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
459 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
460 }
461
462 peer_cid_len = *buf++;
463 len--;
464
465 if( len != peer_cid_len )
466 {
467 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
468 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
469 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
470 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
471 }
472
473 /* Ignore CID if the user has disabled its use. */
474 if( ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
475 {
476 /* Leave ssl->handshake->cid_in_use in its default
477 * value of MBEDTLS_SSL_CID_DISABLED. */
478 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Client sent CID extension, but CID disabled" ) );
479 return( 0 );
480 }
481
482 if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
483 {
484 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
485 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
486 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
487 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
488 }
489
Hanno Becker19976b52019-05-03 12:43:44 +0100490 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
Hanno Beckerc403b262019-04-26 13:56:39 +0100491 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
492 memcpy( ssl->handshake->peer_cid, buf, peer_cid_len );
493
494 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
495 MBEDTLS_SSL_DEBUG_BUF( 3, "Client CID", buf, peer_cid_len );
496
Hanno Beckerc403b262019-04-26 13:56:39 +0100497 return( 0 );
498}
Hanno Beckera5a2b082019-05-15 14:03:01 +0100499#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Beckerc403b262019-04-26 13:56:39 +0100500
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200501#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
502static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200503 const unsigned char *buf,
504 size_t len )
505{
506 if( len != 0 )
507 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200508 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200509 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
510 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200511 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200512 }
513
514 ((void) buf);
515
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200516 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200517 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200518
519 return( 0 );
520}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200521#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200522
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200523#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
524static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100525 const unsigned char *buf,
526 size_t len )
527{
528 if( len != 0 )
529 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200530 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200531 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
532 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200533 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100534 }
535
536 ((void) buf);
537
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200538 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200539 ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100540 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200541 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100542 }
543
544 return( 0 );
545}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200546#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +0100547
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200548#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
549static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200550 const unsigned char *buf,
551 size_t len )
552{
553 if( len != 0 )
554 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200555 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200556 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
557 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200558 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200559 }
560
561 ((void) buf);
562
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200563 return( 0 );
564}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200565#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +0200566
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200567#if defined(MBEDTLS_SSL_SESSION_TICKETS)
568static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200569 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200570 size_t len )
571{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200572 int ret;
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200573 mbedtls_ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200574
Manuel Pégourié-Gonnardbae389b2015-06-24 10:45:58 +0200575 mbedtls_ssl_session_init( &session );
576
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200577 if( ssl->conf->f_ticket_parse == NULL ||
578 ssl->conf->f_ticket_write == NULL )
579 {
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200580 return( 0 );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200581 }
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200582
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200583 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200584 ssl->handshake->new_session_ticket = 1;
585
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200586 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200587
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200588 if( len == 0 )
589 return( 0 );
590
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200591#if defined(MBEDTLS_SSL_RENEGOTIATION)
592 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200593 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200594 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200595 return( 0 );
596 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200597#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200598
599 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200600 * Failures are ok: just ignore the ticket and proceed.
601 */
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200602 if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
603 buf, len ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200604 {
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200605 mbedtls_ssl_session_free( &session );
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +0200606
607 if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
608 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
609 else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
610 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
611 else
612 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
613
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200614 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200615 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200616
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200617 /*
618 * Keep the session ID sent by the client, since we MUST send it back to
619 * inform them we're accepting the ticket (RFC 5077 section 3.4)
620 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +0200621 session.id_len = ssl->session_negotiate->id_len;
622 memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200623
624 mbedtls_ssl_session_free( ssl->session_negotiate );
625 memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
626
627 /* Zeroize instead of free as we copied the content */
Andres Amaya Garcia1f6301b2018-04-17 09:51:09 -0500628 mbedtls_platform_zeroize( &session, sizeof( mbedtls_ssl_session ) );
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +0200629
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200630 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200631
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200632 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200633
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200634 /* Don't send a new ticket after all, this one is OK */
635 ssl->handshake->new_session_ticket = 0;
636
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200637 return( 0 );
638}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200639#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200641#if defined(MBEDTLS_SSL_ALPN)
642static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard14beb082014-07-08 13:50:35 +0200643 const unsigned char *buf, size_t len )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200644{
Paul Bakker14b16c62014-05-28 11:33:54 +0200645 size_t list_len, cur_len, ours_len;
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200646 const unsigned char *theirs, *start, *end;
647 const char **ours;
648
649 /* If ALPN not configured, just ignore the extension */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200650 if( ssl->conf->alpn_list == NULL )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200651 return( 0 );
652
653 /*
654 * opaque ProtocolName<1..2^8-1>;
655 *
656 * struct {
657 * ProtocolName protocol_name_list<2..2^16-1>
658 * } ProtocolNameList;
659 */
660
661 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
662 if( len < 4 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200663 {
664 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
665 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200666 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200667 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200668
669 list_len = ( buf[0] << 8 ) | buf[1];
670 if( list_len != len - 2 )
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200671 {
672 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
673 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200674 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Gilles Peskine1cc8e342017-05-03 16:28:34 +0200675 }
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200676
677 /*
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100678 * Validate peer's list (lengths)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200679 */
680 start = buf + 2;
681 end = buf + len;
Manuel Pégourié-Gonnard239987f2018-01-09 10:43:43 +0100682 for( theirs = start; theirs != end; theirs += cur_len )
683 {
684 cur_len = *theirs++;
685
686 /* Current identifier must fit in list */
687 if( cur_len > (size_t)( end - theirs ) )
688 {
689 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
690 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
691 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
692 }
693
694 /* Empty strings MUST NOT be included */
695 if( cur_len == 0 )
696 {
697 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
698 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
699 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
700 }
701 }
702
703 /*
704 * Use our order of preference
705 */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200706 for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200707 {
Paul Bakker14b16c62014-05-28 11:33:54 +0200708 ours_len = strlen( *ours );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200709 for( theirs = start; theirs != end; theirs += cur_len )
710 {
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200711 cur_len = *theirs++;
712
Paul Bakker14b16c62014-05-28 11:33:54 +0200713 if( cur_len == ours_len &&
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200714 memcmp( theirs, *ours, cur_len ) == 0 )
715 {
716 ssl->alpn_chosen = *ours;
717 return( 0 );
718 }
719 }
720 }
721
722 /* If we get there, no match was found */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200723 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
724 MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
725 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200726}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200727#endif /* MBEDTLS_SSL_ALPN */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +0200728
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100729/*
730 * Auxiliary functions for ServerHello parsing and related actions
731 */
732
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200733#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100734/*
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100735 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100736 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200737#if defined(MBEDTLS_ECDSA_C)
738static int ssl_check_key_curve( mbedtls_pk_context *pk,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100739 mbedtls_ecp_group_id const *acceptable_ec_grp_ids )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100740{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200741 mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100742
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100743 if( acceptable_ec_grp_ids == NULL )
744 return( -1 );
745
746 while( *acceptable_ec_grp_ids != MBEDTLS_ECP_DP_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100747 {
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100748 if( *acceptable_ec_grp_ids == grp_id )
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100749 return( 0 );
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100750 acceptable_ec_grp_ids++;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100751 }
752
Manuel Pégourié-Gonnard6458e3b2015-01-08 14:16:56 +0100753 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100754}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200755#endif /* MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100756
757/*
758 * Try picking a certificate for this ciphersuite,
759 * return 0 on success and -1 on failure.
760 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200761static int ssl_pick_cert( mbedtls_ssl_context *ssl,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100762 const mbedtls_ssl_ciphersuite_t * ciphersuite_info,
763 mbedtls_ecp_group_id const *acceptable_ec_grp_ids )
764
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100765{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200766 mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +0100767 mbedtls_pk_type_t pk_alg =
768 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnarde6ef16f2015-05-11 19:54:43 +0200769 uint32_t flags;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100770
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200771#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100772 if( ssl->handshake->sni_key_cert != NULL )
773 list = ssl->handshake->sni_key_cert;
774 else
775#endif
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200776 list = ssl->conf->key_cert;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100777
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200778 if( pk_alg == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100779 return( 0 );
780
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200781 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000782
Manuel Pégourié-Gonnarde540b492015-07-07 12:44:38 +0200783 if( list == NULL )
784 {
785 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
786 return( -1 );
787 }
788
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100789 for( cur = list; cur != NULL; cur = cur->next )
790 {
Hanno Becker30649f72019-02-26 16:49:40 +0000791 int match = 1;
792 mbedtls_pk_context *pk;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000793
Hanno Becker30649f72019-02-26 16:49:40 +0000794 /* WARNING: With the current X.509 caching architecture, this MUST
795 * happen outside of the PK acquire/release block, because it moves
796 * the cached PK context. In a threading-enabled build, this would
797 * rightfully fail, but lead to a use-after-free otherwise. */
798 MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
799 cur->cert );
800
Hanno Becker74b89f62019-02-17 21:22:07 +0000801#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
802 /* ASYNC_PRIVATE may use a NULL entry for the opaque private key, so
803 * we have to use the public key context to infer the capabilities
804 * of the key. */
Hanno Becker30649f72019-02-26 16:49:40 +0000805 {
806 int ret;
807 ret = mbedtls_x509_crt_pk_acquire( cur->cert, &pk );
808 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +0100809 {
810 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
Hanno Becker30649f72019-02-26 16:49:40 +0000811 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +0100812 }
Hanno Becker30649f72019-02-26 16:49:40 +0000813 }
Hanno Becker74b89f62019-02-17 21:22:07 +0000814#else
815 /* Outside of ASYNC_PRIVATE, use private key context directly
816 * instead of querying for the public key context from the
817 * certificate, so save a few bytes of code. */
Hanno Becker30649f72019-02-26 16:49:40 +0000818 pk = cur->key;
Hanno Becker74b89f62019-02-17 21:22:07 +0000819#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100820
Hanno Becker74b89f62019-02-17 21:22:07 +0000821 if( ! mbedtls_pk_can_do( pk, pk_alg ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000822 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200823 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
Hanno Becker30649f72019-02-26 16:49:40 +0000824 match = 0;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000825 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100826
Hanno Becker30649f72019-02-26 16:49:40 +0000827#if defined(MBEDTLS_ECDSA_C)
828 if( pk_alg == MBEDTLS_PK_ECDSA &&
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100829 ssl_check_key_curve( pk, acceptable_ec_grp_ids ) != 0 )
Hanno Becker30649f72019-02-26 16:49:40 +0000830 {
831 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
832 match = 0;
833 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100834#else
835 ((void) acceptable_ec_grp_ids);
Hanno Becker30649f72019-02-26 16:49:40 +0000836#endif
837
838#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +0000839 mbedtls_x509_crt_pk_release( cur->cert );
Hanno Becker30649f72019-02-26 16:49:40 +0000840#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
841
842 if( match == 0 )
843 continue;
844
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200845 /*
846 * This avoids sending the client a cert it'll reject based on
847 * keyUsage or other extensions.
848 *
849 * It also allows the user to provision different certificates for
850 * different uses based on keyUsage, eg if they want to avoid signing
851 * and decrypting with the same RSA key.
852 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200853 if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
Manuel Pégourié-Gonnarde6efa6f2015-04-20 11:01:48 +0100854 MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200855 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200856 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000857 "(extended) key usage extension" ) );
Manuel Pégourié-Gonnard7f2a07d2014-04-09 09:50:57 +0200858 continue;
859 }
860
Hanno Becker828a8c02019-02-26 16:48:55 +0000861#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
862 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100863 /*
864 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
865 * present them a SHA-higher cert rather than failing if it's the only
866 * one we got that satisfies the other conditions.
867 */
Hanno Becker30649f72019-02-26 16:49:40 +0000868 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100869 {
Hanno Becker30649f72019-02-26 16:49:40 +0000870 mbedtls_md_type_t sig_md;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000871 {
Hanno Becker30649f72019-02-26 16:49:40 +0000872 int ret;
Hanno Becker5f268b32019-05-20 16:26:34 +0100873 mbedtls_x509_crt_frame const *frame;
Hanno Becker30649f72019-02-26 16:49:40 +0000874 ret = mbedtls_x509_crt_frame_acquire( cur->cert, &frame );
875 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +0100876 {
877 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_frame_acquire", ret );
Hanno Becker30649f72019-02-26 16:49:40 +0000878 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +0100879 }
Hanno Becker30649f72019-02-26 16:49:40 +0000880 sig_md = frame->sig_md;
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +0000881 mbedtls_x509_crt_frame_release( cur->cert );
Hanno Becker30649f72019-02-26 16:49:40 +0000882 }
883
884 if( sig_md != MBEDTLS_MD_SHA1 )
885 {
886 if( fallback == NULL )
887 fallback = cur;
888
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200889 MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
Hanno Becker30649f72019-02-26 16:49:40 +0000890 "sha-2 with pre-TLS 1.2 client" ) );
891 continue;
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000892 }
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100893 }
Hanno Becker828a8c02019-02-26 16:48:55 +0000894#endif /* MBEDTLS_SSL_PROTO_TLS1 ||
895 MBEDTLS_SSL_PROTO_TLS1_1 ||
896 MBEDTLS_SSL_PROTO_SSL3 */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100897
Manuel Pégourié-Gonnard846ba472015-01-08 13:54:38 +0100898 /* If we get there, we got a winner */
899 break;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100900 }
901
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000902 if( cur == NULL )
903 cur = fallback;
904
Manuel Pégourié-Gonnard8f618a82015-05-10 21:13:36 +0200905 /* Do not update ssl->handshake->key_cert unless there is a match */
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100906 if( cur != NULL )
907 {
908 ssl->handshake->key_cert = cur;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200909 MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000910 ssl->handshake->key_cert->cert );
Manuel Pégourié-Gonnarddf331a52015-01-08 16:43:07 +0100911 return( 0 );
912 }
913
914 return( -1 );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100915}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200916#endif /* MBEDTLS_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100917
918/*
919 * Check if a given ciphersuite is suitable for use with our config/keys/etc
920 * Sets ciphersuite_info only if the suite matches.
921 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200922static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100923 const mbedtls_ssl_ciphersuite_t **ciphersuite_info,
924 mbedtls_ecp_group_id const *acceptable_ec_grp_ids )
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100925{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200926 const mbedtls_ssl_ciphersuite_t *suite_info;
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100927
Hanno Becker7e5437a2017-04-28 17:15:26 +0100928#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Hanno Becker4cb1f4d2017-10-10 15:59:57 +0100929 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Hanno Becker7e5437a2017-04-28 17:15:26 +0100930 mbedtls_pk_type_t sig_type;
931#endif
932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200933 suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100934 if( suite_info == NULL )
935 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200936 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
937 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100938 }
939
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200940 MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000941
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100942 if( suite_info->min_minor_ver > ssl->minor_ver ||
943 suite_info->max_minor_ver < ssl->minor_ver )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000944 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200945 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100946 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000947 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100948
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200949#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +0200950 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200951 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
Manuel Pégourié-Gonnardd6664512014-02-06 13:26:57 +0100952 return( 0 );
953#endif
954
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200955#if defined(MBEDTLS_ARC4_C)
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200956 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200957 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000958 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200959 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100960 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000961 }
Manuel Pégourié-Gonnard66dc5552015-05-14 12:28:21 +0200962#endif
Manuel Pégourié-Gonnardbd47a582015-01-12 13:43:29 +0100963
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200964#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
965 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200966 ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200967 {
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +0200968 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
969 "not configured or ext missing" ) );
Manuel Pégourié-Gonnarde511b4e2015-09-16 14:11:09 +0200970 return( 0 );
971 }
972#endif
973
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200974#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
975 if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +0100976 ssl->handshake->curve_info == NULL )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000977 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200978 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000979 "no common elliptic curve" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100980 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000981 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100982#endif
983
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200984#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100985 /* If the ciphersuite requires a pre-shared key and we don't
986 * have one, skip it now rather than failing later */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200987 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +0200988 ssl->conf->f_psk == NULL &&
989 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
990 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000991 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +0200992 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100993 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +0000994 }
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100995#endif
996
Hanno Becker7e5437a2017-04-28 17:15:26 +0100997#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
998 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
999 /* If the ciphersuite requires signing, check whether
1000 * a suitable hash algorithm is present. */
1001 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1002 {
1003 sig_type = mbedtls_ssl_get_ciphersuite_sig_alg( suite_info );
1004 if( sig_type != MBEDTLS_PK_NONE &&
1005 mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs, sig_type ) == MBEDTLS_MD_NONE )
1006 {
1007 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no suitable hash algorithm "
1008 "for signature algorithm %d", sig_type ) );
1009 return( 0 );
1010 }
1011 }
1012
1013#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1014 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1015
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001016#if defined(MBEDTLS_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001017 /*
1018 * Final check: if ciphersuite requires us to have a
1019 * certificate/key of a particular type:
1020 * - select the appropriate certificate if we have one, or
1021 * - try the next ciphersuite if we don't
1022 * This must be done last since we modify the key_cert list.
1023 */
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001024 if( ssl_pick_cert( ssl, suite_info, acceptable_ec_grp_ids ) != 0 )
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001025 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001026 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001027 "no suitable certificate" ) );
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001028 return( 0 );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001029 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001030#else
1031 ((void) acceptable_ec_grp_ids);
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +01001032#endif
1033
1034 *ciphersuite_info = suite_info;
1035 return( 0 );
1036}
1037
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001038#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1039static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
Paul Bakker78a8c712013-03-06 17:01:52 +01001040{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001041 int ret, got_common_suite;
Paul Bakker78a8c712013-03-06 17:01:52 +01001042 unsigned int i, j;
1043 size_t n;
1044 unsigned int ciph_len, sess_len, chal_len;
1045 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001046 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001047 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +01001048
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001049 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001050
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001051#if defined(MBEDTLS_SSL_RENEGOTIATION)
1052 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001053 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001054 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001055 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1056 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001057 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001058 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001059#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakker78a8c712013-03-06 17:01:52 +01001060
1061 buf = ssl->in_hdr;
1062
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001063 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
Paul Bakker78a8c712013-03-06 17:01:52 +01001064
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001065 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001066 buf[2] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001067 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001068 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001069 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
Paul Bakker78a8c712013-03-06 17:01:52 +01001070 buf[3], buf[4] ) );
1071
1072 /*
1073 * SSLv2 Client Hello
1074 *
1075 * Record layer:
1076 * 0 . 1 message length
1077 *
1078 * SSL layer:
1079 * 2 . 2 message type
1080 * 3 . 4 protocol version
1081 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001082 if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
1083 buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001084 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001085 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1086 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001087 }
1088
1089 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
1090
1091 if( n < 17 || n > 512 )
1092 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001093 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1094 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001095 }
1096
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001097 ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001098 ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
1099 ? buf[4] : ssl->conf->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +01001100
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001101 if( ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker78a8c712013-03-06 17:01:52 +01001102 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001103 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001104 " [%d:%d] < [%d:%d]",
1105 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001106 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001107
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001108 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1109 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1110 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker78a8c712013-03-06 17:01:52 +01001111 }
1112
Paul Bakker2fbefde2013-06-29 16:01:15 +02001113 ssl->handshake->max_major_ver = buf[3];
1114 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +01001115
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001116 if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
Paul Bakker78a8c712013-03-06 17:01:52 +01001117 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001118 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Paul Bakker78a8c712013-03-06 17:01:52 +01001119 return( ret );
1120 }
1121
1122 ssl->handshake->update_checksum( ssl, buf + 2, n );
1123
1124 buf = ssl->in_msg;
1125 n = ssl->in_left - 5;
1126
1127 /*
1128 * 0 . 1 ciphersuitelist length
1129 * 2 . 3 session id length
1130 * 4 . 5 challenge length
1131 * 6 . .. ciphersuitelist
1132 * .. . .. session id
1133 * .. . .. challenge
1134 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001135 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
Paul Bakker78a8c712013-03-06 17:01:52 +01001136
1137 ciph_len = ( buf[0] << 8 ) | buf[1];
1138 sess_len = ( buf[2] << 8 ) | buf[3];
1139 chal_len = ( buf[4] << 8 ) | buf[5];
1140
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001141 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
Paul Bakker78a8c712013-03-06 17:01:52 +01001142 ciph_len, sess_len, chal_len ) );
1143
1144 /*
1145 * Make sure each parameter length is valid
1146 */
1147 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
1148 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001149 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1150 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001151 }
1152
1153 if( sess_len > 32 )
1154 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001155 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1156 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001157 }
1158
1159 if( chal_len < 8 || chal_len > 32 )
1160 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001161 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1162 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001163 }
1164
1165 if( n != 6 + ciph_len + sess_len + chal_len )
1166 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001167 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1168 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001169 }
1170
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001171 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Paul Bakker78a8c712013-03-06 17:01:52 +01001172 buf + 6, ciph_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001173 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
Paul Bakker78a8c712013-03-06 17:01:52 +01001174 buf + 6 + ciph_len, sess_len );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001175 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
Paul Bakker78a8c712013-03-06 17:01:52 +01001176 buf + 6 + ciph_len + sess_len, chal_len );
1177
1178 p = buf + 6 + ciph_len;
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001179 ssl->session_negotiate->id_len = sess_len;
Paul Bakkerb9e4e2c2014-05-01 14:18:25 +02001180 memset( ssl->session_negotiate->id, 0,
1181 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001182 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
Paul Bakker78a8c712013-03-06 17:01:52 +01001183
1184 p += sess_len;
1185 memset( ssl->handshake->randbytes, 0, 64 );
1186 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
1187
1188 /*
1189 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1190 */
1191 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1192 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001193 if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Paul Bakker78a8c712013-03-06 17:01:52 +01001194 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001195 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1196#if defined(MBEDTLS_SSL_RENEGOTIATION)
1197 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Paul Bakker78a8c712013-03-06 17:01:52 +01001198 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001199 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001200 "during renegotiation" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001201
Gilles Peskinec94f7352017-05-10 16:37:56 +02001202 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1203 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001204 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001205 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001206#endif /* MBEDTLS_SSL_RENEGOTIATION */
1207 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Paul Bakker78a8c712013-03-06 17:01:52 +01001208 break;
1209 }
1210 }
1211
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001212#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001213 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1214 {
1215 if( p[0] == 0 &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001216 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1217 p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001218 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001219 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001220
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001221 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001222 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001223 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001224
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001225 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1226 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001227
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001228 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001229 }
1230
1231 break;
1232 }
1233 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001234#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnard01b26992014-10-20 14:05:28 +02001235
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001236 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001237 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001238 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001239#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001240 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001241 for( i = 0; ciphersuites[i] != 0; i++ )
1242#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001243 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +01001244 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001245#endif
Paul Bakker78a8c712013-03-06 17:01:52 +01001246 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001247 if( p[0] != 0 ||
1248 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1249 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
1250 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +02001251
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001252 got_common_suite = 1;
1253
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001254 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001255 &ciphersuite_info,
1256 NULL ) ) )
1257 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001258 return( ret );
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001259 }
Paul Bakker59c28a22013-06-29 15:33:42 +02001260
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001261 if( ciphersuite_info != NULL )
Paul Bakker78a8c712013-03-06 17:01:52 +01001262 goto have_ciphersuite_v2;
1263 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001264
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001265 if( got_common_suite )
1266 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001267 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001268 "but none of them usable" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001269 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001270 }
1271 else
1272 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001273 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1274 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001275 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001276
1277have_ciphersuite_v2:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001278 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00001279
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001280 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Becker8759e162017-12-27 21:34:08 +00001281 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +01001282
1283 /*
1284 * SSLv2 Client Hello relevant renegotiation security checks
1285 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001286 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01001287 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
1288 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakker78a8c712013-03-06 17:01:52 +01001289 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001290 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02001291 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1292 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001293 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker78a8c712013-03-06 17:01:52 +01001294 }
1295
1296 ssl->in_left = 0;
1297 ssl->state++;
1298
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
Paul Bakker78a8c712013-03-06 17:01:52 +01001300
1301 return( 0 );
1302}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001303#endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
Paul Bakker78a8c712013-03-06 17:01:52 +01001304
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001305/* This function doesn't alert on errors that happen early during
1306 ClientHello parsing because they might indicate that the client is
1307 not talking SSL/TLS at all and would not understand our alert. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001308static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00001309{
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01001310 int ret, got_common_suite;
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001311 size_t i, j;
1312 size_t ciph_offset, comp_offset, ext_offset;
1313 size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001314#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard9de64f52015-07-01 15:51:43 +02001315 size_t cookie_offset, cookie_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001316#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001317 unsigned char *buf, *p, *ext;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001318#if defined(MBEDTLS_SSL_RENEGOTIATION)
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001319 int renegotiation_info_seen = 0;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001320#endif
Hanno Becker03b64fa2019-06-11 14:39:38 +01001321#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1322 int extended_ms_seen = 0;
1323#endif
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001324 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001325 const int *ciphersuites;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001326 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001327 int major, minor;
Paul Bakker5121ce52009-01-03 21:22:43 +00001328
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001329#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1330 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1331 mbedtls_ecp_group_id acceptable_ec_grp_ids[ MBEDTLS_ECP_DP_MAX ];
1332#else
1333 mbedtls_ecp_group_id * acceptable_ec_grp_ids = NULL;
1334#endif
1335
Hanno Becker7e5437a2017-04-28 17:15:26 +01001336 /* If there is no signature-algorithm extension present,
1337 * we need to fall back to the default values for allowed
1338 * signature-hash pairs. */
1339#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1340 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1341 int sig_hash_alg_ext_present = 0;
1342#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1343 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
1344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001345 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001346
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001347#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001348read_record_header:
1349#endif
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001350 /*
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001351 * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001352 * otherwise read it ourselves manually in order to support SSLv2
1353 * ClientHello, which doesn't use the same record layer format.
1354 */
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001355 if( mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
1356 ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001357 {
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001358 /* No alert on a read error. */
1359 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
1360 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00001361 }
1362
1363 buf = ssl->in_hdr;
1364
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001365#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) && \
1366 defined(MBEDTLS_SSL_PROTO_TLS)
1367 if( MBEDTLS_SSL_TRANSPORT_IS_TLS( ssl->conf->transport ) &&
1368 ( buf[0] & 0x80 ) != 0 )
1369 {
1370 return( ssl_parse_client_hello_v2( ssl ) );
1371 }
Paul Bakker78a8c712013-03-06 17:01:52 +01001372#endif
1373
Hanno Becker43395762019-05-03 14:46:38 +01001374 MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_in_hdr_len( ssl ) );
Paul Bakkerec636f32012-09-09 19:17:02 +00001375
Paul Bakkerec636f32012-09-09 19:17:02 +00001376 /*
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001377 * SSLv3/TLS Client Hello
Paul Bakkerec636f32012-09-09 19:17:02 +00001378 *
1379 * Record layer:
1380 * 0 . 0 message type
1381 * 1 . 2 protocol version
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001382 * 3 . 11 DTLS: epoch + record sequence number
Paul Bakkerec636f32012-09-09 19:17:02 +00001383 * 3 . 4 message length
1384 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001385 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001386 buf[0] ) );
1387
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001388 if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001389 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001390 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1391 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01001392 }
1393
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001394 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001395 ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
1396
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001397 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001398 buf[1], buf[2] ) );
1399
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001400 mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001401
1402 /* According to RFC 5246 Appendix E.1, the version here is typically
1403 * "{03,00}, the lowest version number supported by the client, [or] the
1404 * value of ClientHello.client_version", so the only meaningful check here
1405 * is the major version shouldn't be less than 3 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001406 if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001407 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001408 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1409 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001410 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001411
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001412 /* For DTLS if this is the initial handshake, remember the client sequence
1413 * number to use it in our next message (RFC 6347 4.2.1) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001414#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001415 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
1416 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001417 {
1418 /* Epoch should be 0 for initial handshakes */
1419 if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
1420 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001421 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1422 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001423 }
1424
Hanno Becker19859472018-08-06 09:40:20 +01001425 memcpy( ssl->cur_out_ctr + 2, ssl->in_ctr + 2, 6 );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001426
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001427#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
1428 if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001429 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001430 MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001431 ssl->next_record_offset = 0;
1432 ssl->in_left = 0;
1433 goto read_record_header;
1434 }
1435
1436 /* No MAC to check yet, so we can update right now */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001437 mbedtls_ssl_dtls_replay_update( ssl );
Manuel Pégourié-Gonnardf03c7aa2014-09-24 14:54:06 +02001438#endif
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001439 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001440#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001441
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001442 msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
Paul Bakker5121ce52009-01-03 21:22:43 +00001443
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001444#if defined(MBEDTLS_SSL_RENEGOTIATION)
1445 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001446 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001447 /* Set by mbedtls_ssl_read_record() */
Manuel Pégourié-Gonnardb89c4f32015-01-21 13:24:10 +00001448 msg_len = ssl->in_hslen;
1449 }
1450 else
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01001451#endif
Paul Bakkerec636f32012-09-09 19:17:02 +00001452 {
Angus Grattond8213d02016-05-25 20:56:48 +10001453 if( msg_len > MBEDTLS_SSL_IN_CONTENT_LEN )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001454 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001455 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1456 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001457 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001458
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01001459 if( ( ret = mbedtls_ssl_fetch_input( ssl,
Hanno Becker43395762019-05-03 14:46:38 +01001460 mbedtls_ssl_in_hdr_len( ssl ) + msg_len ) ) != 0 )
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001461 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001462 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001463 return( ret );
1464 }
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001465
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001466 /* Done reading this record, get ready for the next one */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001467#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001468 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
1469 {
Hanno Becker43395762019-05-03 14:46:38 +01001470 ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len( ssl );
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001471 }
1472 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001473#endif
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001474#if defined(MBEDTLS_SSL_PROTO_TLS)
1475 {
Manuel Pégourié-Gonnard30d16eb2014-08-19 17:43:50 +02001476 ssl->in_left = 0;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001477 }
1478#endif
Manuel Pégourié-Gonnardd6b721c2014-03-24 12:13:54 +01001479 }
Paul Bakkerec636f32012-09-09 19:17:02 +00001480
1481 buf = ssl->in_msg;
Paul Bakkerec636f32012-09-09 19:17:02 +00001482
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001483 MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001484
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001485 ssl->handshake->update_checksum( ssl, buf, msg_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001486
1487 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001488 * Handshake layer:
1489 * 0 . 0 handshake type
1490 * 1 . 3 handshake length
1491 * 4 . 5 DTLS only: message seqence number
1492 * 6 . 8 DTLS only: fragment offset
1493 * 9 . 11 DTLS only: fragment length
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001494 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001495 if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001496 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001497 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1498 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001499 }
1500
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001501 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001502
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001503 if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001504 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001505 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1506 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001507 }
1508
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001509 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001510 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1511
1512 /* We don't support fragmentation of ClientHello (yet?) */
1513 if( buf[1] != 0 ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001514 msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001515 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001516 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1517 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001518 }
1519
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001520#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02001521 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001522 {
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001523 /*
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001524 * Copy the client's handshake message_seq on initial handshakes,
1525 * check sequence number on renego.
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001526 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001527#if defined(MBEDTLS_SSL_RENEGOTIATION)
1528 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001529 {
1530 /* This couldn't be done in ssl_prepare_handshake_record() */
1531 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1532 ssl->in_msg[5];
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001533
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001534 if( cli_msg_seq != ssl->handshake->in_msg_seq )
1535 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001536 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001537 "%d (expected %d)", cli_msg_seq,
1538 ssl->handshake->in_msg_seq ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001539 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard1aa586e2014-09-03 12:54:04 +02001540 }
1541
1542 ssl->handshake->in_msg_seq++;
1543 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00001544 else
1545#endif
1546 {
1547 unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
1548 ssl->in_msg[5];
1549 ssl->handshake->out_msg_seq = cli_msg_seq;
1550 ssl->handshake->in_msg_seq = cli_msg_seq + 1;
1551 }
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001552
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001553 /*
1554 * For now we don't support fragmentation, so make sure
1555 * fragment_offset == 0 and fragment_length == length
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001556 */
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001557 if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
1558 memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
1559 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001560 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
1561 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnarde89bcf02014-02-18 18:50:02 +01001562 }
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001563 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001564#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001565
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001566 buf += mbedtls_ssl_hs_hdr_len( ssl );
1567 msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001568
Manuel Pégourié-Gonnardce441b32014-02-18 17:40:52 +01001569 /*
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001570 * ClientHello layer:
1571 * 0 . 1 protocol version
1572 * 2 . 33 random bytes (starting with 4 bytes of Unix time)
1573 * 34 . 35 session id length (1 byte)
1574 * 35 . 34+x session id
1575 * 35+x . 35+x DTLS only: cookie length (1 byte)
1576 * 36+x . .. DTLS only: cookie
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001577 * .. . .. ciphersuite list length (2 bytes)
1578 * .. . .. ciphersuite list
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001579 * .. . .. compression alg. list length (1 byte)
1580 * .. . .. compression alg. list
1581 * .. . .. extensions length (2 bytes, optional)
1582 * .. . .. extensions (optional)
Paul Bakkerec636f32012-09-09 19:17:02 +00001583 */
Paul Bakkerec636f32012-09-09 19:17:02 +00001584
1585 /*
Antonin Décimod5f47592019-01-23 15:24:37 +01001586 * Minimal length (with everything empty and extensions omitted) is
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001587 * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
1588 * read at least up to session id length without worrying.
Paul Bakkerec636f32012-09-09 19:17:02 +00001589 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001590 if( msg_len < 38 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001591 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001592 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1593 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001594 }
1595
1596 /*
1597 * Check and save the protocol version
1598 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001599 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001600
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001601 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001602 ssl->conf->transport, buf );
Paul Bakkerec636f32012-09-09 19:17:02 +00001603
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001604 ssl->handshake->max_major_ver = ssl->major_ver;
1605 ssl->handshake->max_minor_ver = ssl->minor_ver;
1606
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001607 if( ssl->major_ver < ssl->conf->min_major_ver ||
1608 ssl->minor_ver < ssl->conf->min_minor_ver )
Paul Bakker1d29fb52012-09-28 13:28:45 +00001609 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001610 MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001611 " [%d:%d] < [%d:%d]",
1612 ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001613 ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001614 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1615 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001616 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001617 }
1618
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001619 if( ssl->major_ver > ssl->conf->max_major_ver )
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001620 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001621 ssl->major_ver = ssl->conf->max_major_ver;
1622 ssl->minor_ver = ssl->conf->max_minor_ver;
Manuel Pégourié-Gonnard6b1e2072014-02-12 10:14:54 +01001623 }
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001624 else if( ssl->minor_ver > ssl->conf->max_minor_ver )
1625 ssl->minor_ver = ssl->conf->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001626
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001627 /*
1628 * Save client random (inc. Unix time)
1629 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001630 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001631
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001632 memcpy( ssl->handshake->randbytes, buf + 2, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001633
1634 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001635 * Check the session ID length and save session ID
Paul Bakkerec636f32012-09-09 19:17:02 +00001636 */
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001637 sess_len = buf[34];
Paul Bakkerec636f32012-09-09 19:17:02 +00001638
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001639 if( sess_len > sizeof( ssl->session_negotiate->id ) ||
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001640 sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
Paul Bakkerec636f32012-09-09 19:17:02 +00001641 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001642 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001643 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1644 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001645 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001646 }
1647
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001648 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001649
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001650 ssl->session_negotiate->id_len = sess_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001651 memset( ssl->session_negotiate->id, 0,
1652 sizeof( ssl->session_negotiate->id ) );
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001653 memcpy( ssl->session_negotiate->id, buf + 35,
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02001654 ssl->session_negotiate->id_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001655
1656 /*
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001657 * Check the cookie length and content
1658 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001659#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001660 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001661 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001662 cookie_offset = 35 + sess_len;
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001663 cookie_len = buf[cookie_offset];
1664
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001665 if( cookie_offset + 1 + cookie_len + 2 > msg_len )
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001666 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001667 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001668 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1669 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001670 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001671 }
1672
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001673 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001674 buf + cookie_offset + 1, cookie_len );
1675
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001676#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02001677 if( ssl->conf->f_cookie_check != NULL &&
1678 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001679 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02001680 if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001681 buf + cookie_offset + 1, cookie_len,
1682 ssl->cli_id, ssl->cli_id_len ) != 0 )
1683 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001684 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001685 ssl->handshake->verify_cookie_len = 1;
1686 }
1687 else
1688 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001689 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001690 ssl->handshake->verify_cookie_len = 0;
1691 }
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02001692 }
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02001693 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001694#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001695 {
1696 /* We know we didn't send a cookie, so it should be empty */
1697 if( cookie_len != 0 )
1698 {
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001699 /* This may be an attacker's probe, so don't send an alert */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001700 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1701 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001702 }
1703
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001704 MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02001705 }
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001706
1707 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001708 * Check the ciphersuitelist length (will be parsed later)
Paul Bakkerec636f32012-09-09 19:17:02 +00001709 */
Manuel Pégourié-Gonnard4128aa72014-03-21 09:40:12 +01001710 ciph_offset = cookie_offset + 1 + cookie_len;
Manuel Pégourié-Gonnarda06d7fe2015-03-13 10:36:55 +00001711 }
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001712 MBEDTLS_SSL_TRANSPORT_ELSE
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001713#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001714#if defined(MBEDTLS_SSL_PROTO_TLS)
1715 {
Manuel Pégourié-Gonnard19d438f2014-09-09 17:08:52 +02001716 ciph_offset = 35 + sess_len;
Manuel Pégourié-Gonnardff4bd9f2019-06-06 10:34:48 +02001717 }
Manuel Pégourié-Gonnardec1c2222019-06-12 10:18:26 +02001718#endif /* MBEDTLS_SSL_PROTO_TLS */
Paul Bakkerec636f32012-09-09 19:17:02 +00001719
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001720 ciph_len = ( buf[ciph_offset + 0] << 8 )
1721 | ( buf[ciph_offset + 1] );
1722
1723 if( ciph_len < 2 ||
1724 ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
1725 ( ciph_len % 2 ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001726 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001727 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001728 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1729 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001730 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001731 }
1732
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001733 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001734 buf + ciph_offset + 2, ciph_len );
Paul Bakkerec636f32012-09-09 19:17:02 +00001735
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001736 /*
1737 * Check the compression algorithms length and pick one
1738 */
1739 comp_offset = ciph_offset + 2 + ciph_len;
1740
1741 comp_len = buf[comp_offset];
1742
1743 if( comp_len < 1 ||
1744 comp_len > 16 ||
1745 comp_len + comp_offset + 1 > msg_len )
Paul Bakkerec636f32012-09-09 19:17:02 +00001746 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001747 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001748 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1749 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001750 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakkerec636f32012-09-09 19:17:02 +00001751 }
1752
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001753 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001754 buf + comp_offset + 1, comp_len );
Paul Bakker48916f92012-09-16 19:57:18 +00001755
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001756 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
1757#if defined(MBEDTLS_ZLIB_SUPPORT)
Paul Bakkerec636f32012-09-09 19:17:02 +00001758 for( i = 0; i < comp_len; ++i )
1759 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001760 if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001761 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001762 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001763 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001764 }
1765 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001766#endif
1767
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001768 /* See comments in ssl_write_client_hello() */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001769#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02001770 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001771 ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
Manuel Pégourié-Gonnarda0e16322014-07-14 17:38:41 +02001772#endif
Manuel Pégourié-Gonnard82202f02014-07-23 00:28:58 +02001773
Janos Follathc6dab2b2016-05-23 14:27:02 +01001774 /* Do not parse the extensions if the protocol is SSLv3 */
1775#if defined(MBEDTLS_SSL_PROTO_SSL3)
1776 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
1777 {
1778#endif
Simon Butcher584a5472016-05-23 16:24:52 +01001779 /*
1780 * Check the extension length
1781 */
1782 ext_offset = comp_offset + 1 + comp_len;
1783 if( msg_len > ext_offset )
Paul Bakker48916f92012-09-16 19:57:18 +00001784 {
Simon Butcher584a5472016-05-23 16:24:52 +01001785 if( msg_len < ext_offset + 2 )
1786 {
1787 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001788 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1789 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001790 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1791 }
1792
1793 ext_len = ( buf[ext_offset + 0] << 8 )
1794 | ( buf[ext_offset + 1] );
1795
1796 if( ( ext_len > 0 && ext_len < 4 ) ||
1797 msg_len != ext_offset + 2 + ext_len )
1798 {
1799 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001800 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1801 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001802 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1803 }
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001804 }
Simon Butcher584a5472016-05-23 16:24:52 +01001805 else
1806 ext_len = 0;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001807
Simon Butcher584a5472016-05-23 16:24:52 +01001808 ext = buf + ext_offset + 2;
1809 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001810
Simon Butcher584a5472016-05-23 16:24:52 +01001811 while( ext_len != 0 )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01001812 {
Philippe Antoine747fd532018-05-30 09:13:21 +02001813 unsigned int ext_id;
1814 unsigned int ext_size;
1815 if ( ext_len < 4 ) {
1816 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1817 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1818 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1819 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1820 }
1821 ext_id = ( ( ext[0] << 8 ) | ( ext[1] ) );
1822 ext_size = ( ( ext[2] << 8 ) | ( ext[3] ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001823
Simon Butcher584a5472016-05-23 16:24:52 +01001824 if( ext_size + 4 > ext_len )
1825 {
1826 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001827 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1828 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001829 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1830 }
1831 switch( ext_id )
1832 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001833#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001834 case MBEDTLS_TLS_EXT_SERVERNAME:
1835 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1836 if( ssl->conf->f_sni == NULL )
1837 break;
Paul Bakker5701cdc2012-09-27 21:49:42 +00001838
Simon Butcher584a5472016-05-23 16:24:52 +01001839 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1840 if( ret != 0 )
1841 return( ret );
1842 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001843#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001844
Simon Butcher584a5472016-05-23 16:24:52 +01001845 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1846 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001847#if defined(MBEDTLS_SSL_RENEGOTIATION)
Simon Butcher584a5472016-05-23 16:24:52 +01001848 renegotiation_info_seen = 1;
Manuel Pégourié-Gonnardeaecbd32014-11-06 02:38:02 +01001849#endif
Paul Bakker48916f92012-09-16 19:57:18 +00001850
Simon Butcher584a5472016-05-23 16:24:52 +01001851 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1852 if( ret != 0 )
1853 return( ret );
1854 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001855
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001856#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1857 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001858 case MBEDTLS_TLS_EXT_SIG_ALG:
Ron Eldor73a38172017-10-03 15:58:26 +03001859 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1860
Simon Butcher584a5472016-05-23 16:24:52 +01001861 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1862 if( ret != 0 )
1863 return( ret );
Hanno Becker7e5437a2017-04-28 17:15:26 +01001864
1865 sig_hash_alg_ext_present = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001866 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001867#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
1868 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
Paul Bakker48916f92012-09-16 19:57:18 +00001869
Robert Cragie136884c2015-10-02 13:34:31 +01001870#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01001871 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001872 case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1873 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
Paul Bakker41c83d32013-03-20 14:39:14 +01001874
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01001875 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4,
1876 ext_size,
1877 acceptable_ec_grp_ids );
Simon Butcher584a5472016-05-23 16:24:52 +01001878 if( ret != 0 )
1879 return( ret );
1880 break;
Paul Bakker41c83d32013-03-20 14:39:14 +01001881
Simon Butcher584a5472016-05-23 16:24:52 +01001882 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1883 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1884 ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001885
Simon Butcher584a5472016-05-23 16:24:52 +01001886 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1887 if( ret != 0 )
1888 return( ret );
1889 break;
Robert Cragieae8535d2015-10-06 17:11:18 +01001890#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1891 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01001892
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001893#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Simon Butcher584a5472016-05-23 16:24:52 +01001894 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1895 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001896
Simon Butcher584a5472016-05-23 16:24:52 +01001897 ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
1898 if( ret != 0 )
1899 return( ret );
1900 break;
Manuel Pégourié-Gonnardbf57be62015-09-16 15:04:01 +02001901#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1902
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001903#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Simon Butcher584a5472016-05-23 16:24:52 +01001904 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1905 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001906
Simon Butcher584a5472016-05-23 16:24:52 +01001907 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1908 if( ret != 0 )
1909 return( ret );
1910 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001911#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001912
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001913#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001914 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1915 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001916
Simon Butcher584a5472016-05-23 16:24:52 +01001917 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1918 if( ret != 0 )
1919 return( ret );
1920 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001921#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001922
Hanno Beckera5a2b082019-05-15 14:03:01 +01001923#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Beckerc403b262019-04-26 13:56:39 +01001924 case MBEDTLS_TLS_EXT_CID:
1925 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) );
1926
1927 ret = ssl_parse_cid_ext( ssl, ext + 4, ext_size );
1928 if( ret != 0 )
1929 return( ret );
1930 break;
1931#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001933#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Simon Butcher584a5472016-05-23 16:24:52 +01001934 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1935 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001936
Simon Butcher584a5472016-05-23 16:24:52 +01001937 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1938 if( ret != 0 )
1939 return( ret );
1940 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001941#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01001942
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001943#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Simon Butcher584a5472016-05-23 16:24:52 +01001944 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1945 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001946
Simon Butcher584a5472016-05-23 16:24:52 +01001947 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1948 if( ret != 0 )
1949 return( ret );
Hanno Becker03b64fa2019-06-11 14:39:38 +01001950 extended_ms_seen = 1;
Simon Butcher584a5472016-05-23 16:24:52 +01001951 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001952#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02001953
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001954#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Simon Butcher584a5472016-05-23 16:24:52 +01001955 case MBEDTLS_TLS_EXT_SESSION_TICKET:
1956 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001957
Simon Butcher584a5472016-05-23 16:24:52 +01001958 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1959 if( ret != 0 )
1960 return( ret );
1961 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001962#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001964#if defined(MBEDTLS_SSL_ALPN)
Simon Butcher584a5472016-05-23 16:24:52 +01001965 case MBEDTLS_TLS_EXT_ALPN:
1966 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001967
Simon Butcher584a5472016-05-23 16:24:52 +01001968 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1969 if( ret != 0 )
1970 return( ret );
1971 break;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001972#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02001973
Simon Butcher584a5472016-05-23 16:24:52 +01001974 default:
1975 MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1976 ext_id ) );
1977 }
1978
1979 ext_len -= 4 + ext_size;
1980 ext += 4 + ext_size;
1981
1982 if( ext_len > 0 && ext_len < 4 )
1983 {
1984 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
Gilles Peskine1cc8e342017-05-03 16:28:34 +02001985 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1986 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
Simon Butcher584a5472016-05-23 16:24:52 +01001987 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
1988 }
Paul Bakker48916f92012-09-16 19:57:18 +00001989 }
Janos Follathc6dab2b2016-05-23 14:27:02 +01001990#if defined(MBEDTLS_SSL_PROTO_SSL3)
1991 }
1992#endif
1993
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001994#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
Gilles Peskined50177f2017-05-16 17:53:03 +02001995 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001996 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02001997 if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
1998 p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01001999 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002000 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002001
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002002 if( ssl->minor_ver < ssl->conf->max_minor_ver )
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002003 {
Manuel Pégourié-Gonnardcb0d2122015-07-22 11:52:11 +02002004 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002005
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002006 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2007 MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002008
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002009 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002010 }
2011
2012 break;
2013 }
2014 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002015#endif /* MBEDTLS_SSL_FALLBACK_SCSV */
Manuel Pégourié-Gonnardfedba982014-11-05 16:12:09 +01002016
Hanno Becker7e5437a2017-04-28 17:15:26 +01002017#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2018 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
2019
2020 /*
2021 * Try to fall back to default hash SHA1 if the client
2022 * hasn't provided any preferred signature-hash combinations.
2023 */
2024 if( sig_hash_alg_ext_present == 0 )
2025 {
2026 mbedtls_md_type_t md_default = MBEDTLS_MD_SHA1;
2027
2028 if( mbedtls_ssl_check_sig_hash( ssl, md_default ) != 0 )
2029 md_default = MBEDTLS_MD_NONE;
2030
2031 mbedtls_ssl_sig_hash_set_const_hash( &ssl->handshake->hash_algs, md_default );
2032 }
2033
2034#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
2035 MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
2036
Paul Bakker48916f92012-09-16 19:57:18 +00002037 /*
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002038 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
2039 */
2040 for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
2041 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002042 if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002043 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002044 MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
2045#if defined(MBEDTLS_SSL_RENEGOTIATION)
2046 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002047 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002048 MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
2049 "during renegotiation" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002050 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2051 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002052 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002053 }
Manuel Pégourié-Gonnard69849f82015-03-10 11:54:02 +00002054#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002055 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002056 break;
2057 }
2058 }
2059
2060 /*
Paul Bakker48916f92012-09-16 19:57:18 +00002061 * Renegotiation security checks
2062 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002063 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01002064 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf ) ==
2065 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002066 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002067 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002068 handshake_failure = 1;
2069 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002070#if defined(MBEDTLS_SSL_RENEGOTIATION)
2071 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2072 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002073 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00002074 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002075 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002076 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00002077 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002078 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2079 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Hanno Beckerb0b2b672019-06-12 16:58:10 +01002080 mbedtls_ssl_conf_get_allow_legacy_renegotiation( ssl->conf )
2081 == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00002082 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002083 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002084 handshake_failure = 1;
2085 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002086 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2087 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002088 renegotiation_info_seen == 1 )
2089 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002090 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002091 handshake_failure = 1;
2092 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002093#endif /* MBEDTLS_SSL_RENEGOTIATION */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002094
Jarno Lamsa842be162019-06-10 15:05:33 +03002095 /*
2096 * Check if extended master secret is being enforced
2097 */
2098#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Hanno Beckeraabbb582019-06-11 13:43:27 +01002099 if( mbedtls_ssl_conf_get_ems( ssl->conf ) ==
Hanno Becker03b64fa2019-06-11 14:39:38 +01002100 MBEDTLS_SSL_EXTENDED_MS_ENABLED )
Jarno Lamsa842be162019-06-10 15:05:33 +03002101 {
Hanno Becker03b64fa2019-06-11 14:39:38 +01002102 if( extended_ms_seen )
2103 {
Hanno Becker1ab322b2019-06-11 14:50:54 +01002104#if !defined(MBEDTLS_SSL_EXTENDED_MS_ENFORCED)
Hanno Becker03b64fa2019-06-11 14:39:38 +01002105 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
Hanno Becker1ab322b2019-06-11 14:50:54 +01002106#endif /* !MBEDTLS_SSL_EXTENDED_MS_ENFORCED */
Hanno Becker03b64fa2019-06-11 14:39:38 +01002107 }
2108 else if( mbedtls_ssl_conf_get_ems_enforced( ssl->conf ) ==
2109 MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED )
2110 {
2111 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Peer not offering extended master "
2112 "secret, while it is enforced") );
2113 handshake_failure = 1;
2114 }
Jarno Lamsa842be162019-06-10 15:05:33 +03002115 }
2116#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
2117
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00002118 if( handshake_failure == 1 )
2119 {
Gilles Peskinec94f7352017-05-10 16:37:56 +02002120 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2121 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002122 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker48916f92012-09-16 19:57:18 +00002123 }
Paul Bakker380da532012-04-18 16:10:25 +00002124
Paul Bakker41c83d32013-03-20 14:39:14 +01002125 /*
2126 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02002127 * (At the end because we need information from the EC-based extensions
2128 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01002129 */
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002130 got_common_suite = 0;
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002131 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01002132 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002133#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002134 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01002135 for( i = 0; ciphersuites[i] != 0; i++ )
2136#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002137 for( i = 0; ciphersuites[i] != 0; i++ )
Manuel Pégourié-Gonnard8933a652014-03-20 17:29:27 +01002138 for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01002139#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01002140 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002141 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
2142 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
2143 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01002144
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002145 got_common_suite = 1;
2146
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002147 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01002148 &ciphersuite_info,
2149 acceptable_ec_grp_ids ) ) != 0 )
2150 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002151 return( ret );
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01002152 }
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01002153
2154 if( ciphersuite_info != NULL )
2155 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01002156 }
Paul Bakker41c83d32013-03-20 14:39:14 +01002157
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002158 if( got_common_suite )
2159 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002160 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002161 "but none of them usable" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002162 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2163 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002164 return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002165 }
2166 else
2167 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002168 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
Gilles Peskinec94f7352017-05-10 16:37:56 +02002169 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2170 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002171 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Manuel Pégourié-Gonnardf01768c2015-01-08 17:06:16 +01002172 }
Paul Bakker41c83d32013-03-20 14:39:14 +01002173
2174have_ciphersuite:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002175 MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
Manuel Pégourié-Gonnard607d6632015-01-26 11:17:20 +00002176
Paul Bakker8f4ddae2013-04-15 15:09:54 +02002177 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Hanno Becker8759e162017-12-27 21:34:08 +00002178 ssl->handshake->ciphersuite_info = ciphersuite_info;
Paul Bakker41c83d32013-03-20 14:39:14 +01002179
Paul Bakker5121ce52009-01-03 21:22:43 +00002180 ssl->state++;
2181
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002182#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002183 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002184 mbedtls_ssl_recv_flight_completed( ssl );
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02002185#endif
2186
Hanno Becker7e5437a2017-04-28 17:15:26 +01002187 /* Debugging-only output for testsuite */
2188#if defined(MBEDTLS_DEBUG_C) && \
2189 defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
2190 defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
2191 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2192 {
2193 mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg( ciphersuite_info );
2194 if( sig_alg != MBEDTLS_PK_NONE )
2195 {
2196 mbedtls_md_type_t md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
2197 sig_alg );
2198 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
2199 mbedtls_ssl_hash_from_md_alg( md_alg ) ) );
2200 }
2201 else
2202 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002203 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm "
2204 "%d - should not happen", sig_alg ) );
Hanno Becker7e5437a2017-04-28 17:15:26 +01002205 }
2206 }
2207#endif
2208
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002209 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002210
2211 return( 0 );
2212}
2213
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002214#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
2215static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002216 unsigned char *buf,
2217 size_t *olen )
2218{
2219 unsigned char *p = buf;
2220
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002221 if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002222 {
2223 *olen = 0;
2224 return;
2225 }
2226
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002227 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002228
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002229 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
2230 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002231
2232 *p++ = 0x00;
2233 *p++ = 0x00;
2234
2235 *olen = 4;
2236}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002237#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002238
Hanno Beckera5a2b082019-05-15 14:03:01 +01002239#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker072d4ec2019-04-26 15:46:55 +01002240static void ssl_write_cid_ext( mbedtls_ssl_context *ssl,
2241 unsigned char *buf,
2242 size_t *olen )
2243{
2244 unsigned char *p = buf;
2245 size_t ext_len;
2246 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
2247
2248 *olen = 0;
2249
2250 /* Skip writing the extension if we don't want to use it or if
2251 * the client hasn't offered it. */
2252 if( ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED )
2253 return;
2254
2255 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
2256 * which is at most 255, so the increment cannot overflow. */
2257 if( end < p || (size_t)( end - p ) < (unsigned)( ssl->own_cid_len + 5 ) )
2258 {
2259 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2260 return;
2261 }
2262
2263 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding CID extension" ) );
2264
2265 /*
Hanno Becker3cdf8fe2019-05-15 10:26:32 +01002266 * Quoting draft-ietf-tls-dtls-connection-id-05
2267 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
Hanno Becker072d4ec2019-04-26 15:46:55 +01002268 *
2269 * struct {
2270 * opaque cid<0..2^8-1>;
2271 * } ConnectionId;
2272 */
2273
2274 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID >> 8 ) & 0xFF );
2275 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID ) & 0xFF );
2276 ext_len = (size_t) ssl->own_cid_len + 1;
2277 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2278 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2279
2280 *p++ = (uint8_t) ssl->own_cid_len;
2281 memcpy( p, ssl->own_cid, ssl->own_cid_len );
2282
2283 *olen = ssl->own_cid_len + 5;
2284}
Hanno Beckera5a2b082019-05-15 14:03:01 +01002285#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
Hanno Becker072d4ec2019-04-26 15:46:55 +01002286
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002287#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2288static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002289 unsigned char *buf,
2290 size_t *olen )
2291{
2292 unsigned char *p = buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002293 const mbedtls_ssl_ciphersuite_t *suite = NULL;
2294 const mbedtls_cipher_info_t *cipher = NULL;
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002295
Hanno Becker27b34d52017-10-20 14:24:51 +01002296 if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002297 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002298 {
2299 *olen = 0;
2300 return;
2301 }
2302
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002303 /*
2304 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
2305 * from a client and then selects a stream or Authenticated Encryption
2306 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
2307 * encrypt-then-MAC response extension back to the client."
2308 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002309 if( ( suite = mbedtls_ssl_ciphersuite_from_id(
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002310 ssl->session_negotiate->ciphersuite ) ) == NULL ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002311 ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
2312 cipher->mode != MBEDTLS_MODE_CBC )
Manuel Pégourié-Gonnard78e745f2014-11-04 15:44:06 +01002313 {
2314 *olen = 0;
2315 return;
2316 }
2317
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002318 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002319
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002320 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
2321 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002322
2323 *p++ = 0x00;
2324 *p++ = 0x00;
2325
2326 *olen = 4;
2327}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002328#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002329
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002330#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2331static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002332 unsigned char *buf,
2333 size_t *olen )
2334{
2335 unsigned char *p = buf;
2336
Hanno Beckera49ec562019-06-11 14:47:55 +01002337 if( mbedtls_ssl_hs_get_extended_ms( ssl->handshake )
2338 == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002339 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002340 {
2341 *olen = 0;
2342 return;
2343 }
2344
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002345 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002346 "extension" ) );
2347
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002348 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
2349 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002350
2351 *p++ = 0x00;
2352 *p++ = 0x00;
2353
2354 *olen = 4;
2355}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002356#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002357
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002358#if defined(MBEDTLS_SSL_SESSION_TICKETS)
2359static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002360 unsigned char *buf,
2361 size_t *olen )
2362{
2363 unsigned char *p = buf;
2364
2365 if( ssl->handshake->new_session_ticket == 0 )
2366 {
2367 *olen = 0;
2368 return;
2369 }
2370
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002371 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002372
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002373 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
2374 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002375
2376 *p++ = 0x00;
2377 *p++ = 0x00;
2378
2379 *olen = 4;
2380}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002381#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002382
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002383static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002384 unsigned char *buf,
2385 size_t *olen )
2386{
2387 unsigned char *p = buf;
2388
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002389 if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002390 {
2391 *olen = 0;
2392 return;
2393 }
2394
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002395 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002396
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002397 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
2398 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002399
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002400#if defined(MBEDTLS_SSL_RENEGOTIATION)
2401 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002402 {
2403 *p++ = 0x00;
2404 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
2405 *p++ = ssl->verify_data_len * 2 & 0xFF;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002406
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002407 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
2408 p += ssl->verify_data_len;
2409 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
2410 p += ssl->verify_data_len;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002411 }
2412 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002413#endif /* MBEDTLS_SSL_RENEGOTIATION */
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002414 {
2415 *p++ = 0x00;
2416 *p++ = 0x01;
2417 *p++ = 0x00;
Manuel Pégourié-Gonnard615e6772014-11-03 08:23:14 +01002418 }
Manuel Pégourié-Gonnard19389752015-06-23 13:46:44 +02002419
2420 *olen = p - buf;
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002421}
2422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002423#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2424static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002425 unsigned char *buf,
2426 size_t *olen )
2427{
2428 unsigned char *p = buf;
2429
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002430 if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02002431 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002432 *olen = 0;
2433 return;
2434 }
2435
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002436 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002437
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002438 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
2439 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002440
2441 *p++ = 0x00;
2442 *p++ = 1;
2443
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02002444 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002445
2446 *olen = 5;
2447}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002448#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002449
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002450#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002451 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002452static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002453 unsigned char *buf,
2454 size_t *olen )
2455{
2456 unsigned char *p = buf;
2457 ((void) ssl);
2458
Paul Bakker677377f2013-10-28 12:54:26 +01002459 if( ( ssl->handshake->cli_exts &
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002460 MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
Paul Bakker677377f2013-10-28 12:54:26 +01002461 {
2462 *olen = 0;
2463 return;
2464 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002465
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002466 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002467
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002468 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
2469 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002470
2471 *p++ = 0x00;
2472 *p++ = 2;
2473
2474 *p++ = 1;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002475 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002476
2477 *olen = 6;
2478}
Manuel Pégourié-Gonnardeef142d2015-09-16 10:05:04 +02002479#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002480
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002481#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2482static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
2483 unsigned char *buf,
2484 size_t *olen )
2485{
2486 int ret;
2487 unsigned char *p = buf;
Angus Grattond8213d02016-05-25 20:56:48 +10002488 const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002489 size_t kkpp_len;
2490
2491 *olen = 0;
2492
2493 /* Skip costly computation if not needed */
Hanno Becker8759e162017-12-27 21:34:08 +00002494 if( ssl->handshake->ciphersuite_info->key_exchange !=
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002495 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2496 return;
2497
2498 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
2499
2500 if( end - p < 4 )
2501 {
2502 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
2503 return;
2504 }
2505
2506 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
2507 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
2508
Manuel Pégourié-Gonnard5674a972015-10-19 15:14:03 +02002509 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
2510 p + 2, end - p - 2, &kkpp_len,
2511 ssl->conf->f_rng, ssl->conf->p_rng );
2512 if( ret != 0 )
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002513 {
2514 MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
2515 return;
2516 }
2517
2518 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
2519 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
2520
2521 *olen = kkpp_len + 4;
2522}
2523#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2524
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002525#if defined(MBEDTLS_SSL_ALPN )
2526static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002527 unsigned char *buf, size_t *olen )
2528{
2529 if( ssl->alpn_chosen == NULL )
2530 {
2531 *olen = 0;
2532 return;
2533 }
2534
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002535 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002536
2537 /*
2538 * 0 . 1 ext identifier
2539 * 2 . 3 ext length
2540 * 4 . 5 protocol list length
2541 * 6 . 6 protocol name length
2542 * 7 . 7+n protocol name
2543 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002544 buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
2545 buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002546
2547 *olen = 7 + strlen( ssl->alpn_chosen );
2548
2549 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2550 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2551
2552 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2553 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2554
2555 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2556
2557 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2558}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002559#endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002561#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
2562static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002563{
2564 int ret;
2565 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002566 unsigned char *cookie_len_byte;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002567
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002568 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002569
2570 /*
2571 * struct {
2572 * ProtocolVersion server_version;
2573 * opaque cookie<0..2^8-1>;
2574 * } HelloVerifyRequest;
2575 */
2576
Manuel Pégourié-Gonnardb35fe562014-08-09 17:00:46 +02002577 /* The RFC is not clear on this point, but sending the actual negotiated
2578 * version looks like the most interoperable thing to do. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002579 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002580 ssl->conf->transport, p );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002581 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002582 p += 2;
2583
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002584 /* If we get here, f_cookie_check is not null */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002585 if( ssl->conf->f_cookie_write == NULL )
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002586 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002587 MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
2588 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard7d38d212014-07-23 17:52:09 +02002589 }
2590
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002591 /* Skip length byte until we know the length */
2592 cookie_len_byte = p++;
2593
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002594 if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
Angus Grattond8213d02016-05-25 20:56:48 +10002595 &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN,
Manuel Pégourié-Gonnardd485d192014-07-23 14:56:15 +02002596 ssl->cli_id, ssl->cli_id_len ) ) != 0 )
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002597 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002598 MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002599 return( ret );
2600 }
2601
2602 *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
2603
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002604 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002605
2606 ssl->out_msglen = p - ssl->out_msg;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002607 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2608 ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002609
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002610 ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002611
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002612 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002613 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002614 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002615 return( ret );
2616 }
2617
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002618#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002619 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002620 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
2621 {
2622 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
2623 return( ret );
2624 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01002625#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02002626
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002627 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002628
2629 return( 0 );
2630}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002631#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002632
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002633static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002634{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002635#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002636 mbedtls_time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002637#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002638 int ret;
2639 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002640 unsigned char *buf, *p;
2641
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002642 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002643
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002644#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02002645 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnardd7f9bc52014-07-23 11:09:27 +02002646 ssl->handshake->verify_cookie_len != 0 )
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002647 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002648 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
2649 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002650
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02002651 return( ssl_write_hello_verify_request( ssl ) );
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002652 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002653#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
Manuel Pégourié-Gonnard2c9ee812014-07-22 11:45:03 +02002654
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002655 if( ssl->conf->f_rng == NULL )
Paul Bakkera9a028e2013-11-21 17:31:06 +01002656 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2658 return( MBEDTLS_ERR_SSL_NO_RNG );
Paul Bakkera9a028e2013-11-21 17:31:06 +01002659 }
2660
Paul Bakker5121ce52009-01-03 21:22:43 +00002661 /*
2662 * 0 . 0 handshake type
2663 * 1 . 3 handshake length
2664 * 4 . 5 protocol version
2665 * 6 . 9 UNIX time()
2666 * 10 . 37 random bytes
2667 */
2668 buf = ssl->out_msg;
2669 p = buf + 4;
2670
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002671 mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002672 ssl->conf->transport, p );
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002673 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00002674
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002675 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
Manuel Pégourié-Gonnardabc7e3b2014-02-11 18:15:03 +01002676 buf[4], buf[5] ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002677
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002678#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002679 t = mbedtls_time( NULL );
Paul Bakker5121ce52009-01-03 21:22:43 +00002680 *p++ = (unsigned char)( t >> 24 );
2681 *p++ = (unsigned char)( t >> 16 );
2682 *p++ = (unsigned char)( t >> 8 );
2683 *p++ = (unsigned char)( t );
2684
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002685 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002686#else
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002687 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
Paul Bakkerfa9b1002013-07-03 15:31:03 +02002688 return( ret );
2689
2690 p += 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002691#endif /* MBEDTLS_HAVE_TIME */
Paul Bakker5121ce52009-01-03 21:22:43 +00002692
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002693 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
Paul Bakkera3d195c2011-11-27 21:07:34 +00002694 return( ret );
2695
2696 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00002697
Paul Bakker48916f92012-09-16 19:57:18 +00002698 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002699
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002700 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002701
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002702#if !defined(MBEDTLS_SSL_NO_SESSION_CACHE)
Paul Bakker5121ce52009-01-03 21:22:43 +00002703 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002704 * Resume is 0 by default, see ssl_handshake_init().
2705 * It may be already set to 1 by ssl_parse_session_ticket_ext().
2706 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00002707 */
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002708 if( mbedtls_ssl_handshake_get_resume( ssl->handshake ) == 0 &&
Manuel Pégourié-Gonnard754b9f32019-07-01 12:20:54 +02002709 mbedtls_ssl_get_renego_status( ssl ) == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002710 ssl->session_negotiate->id_len != 0 &&
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02002711 ssl->conf->f_get_cache != NULL &&
Manuel Pégourié-Gonnard5cb33082015-05-06 18:06:26 +01002712 ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002713 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002714 MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002715 ssl->handshake->resume = 1;
2716 }
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002717#endif /* !MBEDTLS_SSL_NO_SESSION_CACHE */
Paul Bakker5121ce52009-01-03 21:22:43 +00002718
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002719#if !defined(MBEDTLS_SSL_NO_SESSION_RESUMPTION)
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002720 if( mbedtls_ssl_handshake_get_resume( ssl->handshake ) == 1 )
Jarno Lamsa29f2dd02019-06-20 15:31:52 +03002721 {
2722 /*
2723 * Resuming a session
2724 */
2725 n = ssl->session_negotiate->id_len;
2726 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
2727
2728 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
2729 {
2730 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
2731 return( ret );
2732 }
2733 }
2734 else
2735#endif /* !MBEDTLS_SSL_NO_SESSION_RESUMPTION */
Paul Bakker5121ce52009-01-03 21:22:43 +00002736 {
2737 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002738 * New session, create a new session id,
2739 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00002740 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002741 ssl->state++;
2742
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002743#if defined(MBEDTLS_HAVE_TIME)
SimonBd5800b72016-04-26 07:43:27 +01002744 ssl->session_negotiate->start = mbedtls_time( NULL );
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002745#endif
2746
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002747#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002748 if( ssl->handshake->new_session_ticket != 0 )
2749 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002750 ssl->session_negotiate->id_len = n = 0;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002751 memset( ssl->session_negotiate->id, 0, 32 );
2752 }
2753 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002754#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002755 {
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002756 ssl->session_negotiate->id_len = n = 32;
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01002757 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02002758 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002759 return( ret );
2760 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002761 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002762
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02002763 /*
2764 * 38 . 38 session id length
2765 * 39 . 38+n session id
2766 * 39+n . 40+n chosen ciphersuite
2767 * 41+n . 41+n chosen compression alg.
2768 * 42+n . 43+n extensions length
2769 * 44+n . 43+n+m extensions
2770 */
Manuel Pégourié-Gonnard12ad7982015-06-18 15:50:37 +02002771 *p++ = (unsigned char) ssl->session_negotiate->id_len;
2772 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
2773 p += ssl->session_negotiate->id_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00002774
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002775 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2776 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2777 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Manuel Pégourié-Gonnard3652e992019-07-01 12:09:22 +02002778 mbedtls_ssl_handshake_get_resume( ssl->handshake ) ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002779
Paul Bakker48916f92012-09-16 19:57:18 +00002780 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2781 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2782 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00002783
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002784 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2785 mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2786 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00002787 ssl->session_negotiate->compression ) );
2788
Janos Follathc6dab2b2016-05-23 14:27:02 +01002789 /* Do not write the extensions if the protocol is SSLv3 */
2790#if defined(MBEDTLS_SSL_PROTO_SSL3)
2791 if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
2792 {
2793#endif
2794
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02002795 /*
2796 * First write extensions, then the total length
2797 */
2798 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2799 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00002800
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002801#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002802 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2803 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02002804#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02002805
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002806#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002807 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
2808 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02002809#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02002810
Hanno Beckera5a2b082019-05-15 14:03:01 +01002811#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Hanno Becker072d4ec2019-04-26 15:46:55 +01002812 ssl_write_cid_ext( ssl, p + 2 + ext_len, &olen );
2813 ext_len += olen;
2814#endif
2815
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002816#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
Manuel Pégourié-Gonnard699cafa2014-10-27 13:57:03 +01002817 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2818 ext_len += olen;
2819#endif
2820
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002821#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
Manuel Pégourié-Gonnard367381f2014-10-20 18:40:56 +02002822 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2823 ext_len += olen;
2824#endif
2825
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002826#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002827 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2828 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02002829#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002830
Manuel Pégourié-Gonnardf4721792015-09-15 10:53:51 +02002831#if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
Robert Cragieae8535d2015-10-06 17:11:18 +01002832 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
Ron Eldor755bb6a2018-02-14 19:30:48 +02002833 if ( mbedtls_ssl_ciphersuite_uses_ec(
2834 mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite ) ) )
2835 {
2836 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2837 ext_len += olen;
2838 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02002839#endif
2840
Manuel Pégourié-Gonnard55c7f992015-09-16 15:35:27 +02002841#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2842 ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
2843 ext_len += olen;
2844#endif
2845
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002846#if defined(MBEDTLS_SSL_ALPN)
Manuel Pégourié-Gonnard89e35792014-04-07 12:10:30 +02002847 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2848 ext_len += olen;
2849#endif
2850
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002851 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00002852
Paul Bakkera7036632014-04-30 10:15:38 +02002853 if( ext_len > 0 )
2854 {
2855 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2856 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2857 p += ext_len;
2858 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002859
Janos Follathc6dab2b2016-05-23 14:27:02 +01002860#if defined(MBEDTLS_SSL_PROTO_SSL3)
2861 }
2862#endif
2863
Paul Bakker5121ce52009-01-03 21:22:43 +00002864 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002865 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
2866 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00002867
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02002868 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00002869
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002870 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002871
2872 return( ret );
2873}
2874
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002875#if !defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002876static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00002877{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002878 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00002879 ssl->handshake->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002880
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002881 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002882
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002883 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002884 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002885 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002886 ssl->state++;
2887 return( 0 );
2888 }
2889
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002890 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2891 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002892}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002893#else /* !MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002894static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002895{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002896 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01002897 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00002898 ssl->handshake->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002899 size_t dn_size, total_dn_size; /* excluding length bytes */
2900 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00002901 unsigned char *buf, *p;
Angus Grattond8213d02016-05-25 20:56:48 +10002902 const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002903 const mbedtls_x509_crt *crt;
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002904 int authmode;
Paul Bakker5121ce52009-01-03 21:22:43 +00002905
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002906 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002907
2908 ssl->state++;
2909
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002910#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
2911 if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
2912 authmode = ssl->handshake->sni_authmode;
2913 else
2914#endif
Hanno Beckeracd4fc02019-06-12 16:40:50 +01002915 authmode = mbedtls_ssl_conf_get_authmode( ssl->conf );
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002916
Hanno Beckerae39b9e2019-02-07 12:32:43 +00002917 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) ||
Manuel Pégourié-Gonnardcdc26ae2015-06-19 12:16:31 +02002918 authmode == MBEDTLS_SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00002919 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002920 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00002921 return( 0 );
2922 }
2923
2924 /*
2925 * 0 . 0 handshake type
2926 * 1 . 3 handshake length
2927 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01002928 * 5 .. m-1 cert types
2929 * m .. m+1 sig alg length (TLS 1.2 only)
Paul Bakker9af723c2014-05-01 13:03:14 +02002930 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00002931 * n .. n+1 length of all DNs
2932 * n+2 .. n+3 length of DN 1
2933 * n+4 .. ... Distinguished Name #1
2934 * ... .. ... length of DN 2, etc.
2935 */
2936 buf = ssl->out_msg;
2937 p = buf + 4;
2938
2939 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002940 * Supported certificate types
2941 *
2942 * ClientCertificateType certificate_types<1..2^8-1>;
2943 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00002944 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002945 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01002946
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002947#if defined(MBEDTLS_RSA_C)
2948 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002949#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002950#if defined(MBEDTLS_ECDSA_C)
2951 p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002952#endif
2953
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002954 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002955 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01002956
Paul Bakker577e0062013-08-28 11:57:20 +02002957 sa_len = 0;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002958#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01002959 /*
2960 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01002961 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002962 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2963 *
2964 * struct {
2965 * HashAlgorithm hash;
2966 * SignatureAlgorithm signature;
2967 * } SignatureAndHashAlgorithm;
2968 *
2969 * enum { (255) } HashAlgorithm;
2970 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01002971 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002972 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002973 {
Simon Butcher99000142016-10-13 17:21:01 +01002974 const int *cur;
Paul Bakkerf7abd422013-04-16 13:15:56 +02002975
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002976 /*
2977 * Supported signature algorithms
2978 */
Simon Butcher99000142016-10-13 17:21:01 +01002979 for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
2980 {
2981 unsigned char hash = mbedtls_ssl_hash_from_md_alg( *cur );
2982
2983 if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
2984 continue;
2985
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002986#if defined(MBEDTLS_RSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01002987 p[2 + sa_len++] = hash;
2988 p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002989#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02002990#if defined(MBEDTLS_ECDSA_C)
Simon Butcher99000142016-10-13 17:21:01 +01002991 p[2 + sa_len++] = hash;
2992 p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002993#endif
Simon Butcher99000142016-10-13 17:21:01 +01002994 }
Paul Bakker926af752012-11-23 13:38:07 +01002995
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002996 p[0] = (unsigned char)( sa_len >> 8 );
2997 p[1] = (unsigned char)( sa_len );
2998 sa_len += 2;
2999 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01003000 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003001#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00003002
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003003 /*
3004 * DistinguishedName certificate_authorities<0..2^16-1>;
3005 * opaque DistinguishedName<1..2^16-1>;
3006 */
Paul Bakker5121ce52009-01-03 21:22:43 +00003007 p += 2;
Paul Bakker5121ce52009-01-03 21:22:43 +00003008
Paul Bakkerbc3d9842012-11-26 16:12:02 +01003009 total_dn_size = 0;
Janos Follath088ce432017-04-10 12:42:31 +01003010
Hanno Beckerc2cfdaa2019-06-13 12:33:03 +01003011 if( mbedtls_ssl_conf_get_cert_req_ca_list( ssl->conf )
3012 == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED )
Paul Bakker5121ce52009-01-03 21:22:43 +00003013 {
Janos Follath088ce432017-04-10 12:42:31 +01003014#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
3015 if( ssl->handshake->sni_ca_chain != NULL )
3016 crt = ssl->handshake->sni_ca_chain;
3017 else
3018#endif
3019 crt = ssl->conf->ca_chain;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003020
Hanno Becker371e0e42019-02-25 18:08:59 +00003021 while( crt != NULL && crt->raw.p != NULL )
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003022 {
Hanno Becker5f268b32019-05-20 16:26:34 +01003023 mbedtls_x509_crt_frame const *frame;
Hanno Becker232f8fa2019-02-26 16:49:57 +00003024 ret = mbedtls_x509_crt_frame_acquire( crt, &frame );
3025 if( ret != 0 )
Hanno Becker2224ccf2019-06-28 10:52:45 +01003026 {
3027 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_frame_acquire", ret );
Hanno Becker232f8fa2019-02-26 16:49:57 +00003028 return( ret );
Hanno Becker2224ccf2019-06-28 10:52:45 +01003029 }
Hanno Becker232f8fa2019-02-26 16:49:57 +00003030
Hanno Becker1e11f212019-03-04 14:43:43 +00003031 dn_size = frame->subject_raw.len;
Janos Follath088ce432017-04-10 12:42:31 +01003032
3033 if( end < p ||
3034 (size_t)( end - p ) < dn_size ||
3035 (size_t)( end - p ) < 2 + dn_size )
3036 {
3037 MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00003038 mbedtls_x509_crt_frame_release( crt );
Janos Follath088ce432017-04-10 12:42:31 +01003039 break;
3040 }
3041
3042 *p++ = (unsigned char)( dn_size >> 8 );
3043 *p++ = (unsigned char)( dn_size );
Hanno Becker1e11f212019-03-04 14:43:43 +00003044 memcpy( p, frame->subject_raw.p, dn_size );
Janos Follath088ce432017-04-10 12:42:31 +01003045 p += dn_size;
3046
3047 MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
3048
3049 total_dn_size += 2 + dn_size;
Hanno Becker232f8fa2019-02-26 16:49:57 +00003050
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00003051 mbedtls_x509_crt_frame_release( crt );
Hanno Becker232f8fa2019-02-26 16:49:57 +00003052
Janos Follath088ce432017-04-10 12:42:31 +01003053 crt = crt->next;
Manuel Pégourié-Gonnardbc1babb2015-10-02 11:16:47 +02003054 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003055 }
3056
Paul Bakker926af752012-11-23 13:38:07 +01003057 ssl->out_msglen = p - buf;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003058 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3059 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02003060 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
3061 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00003062
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003063 ret = mbedtls_ssl_write_handshake_msg( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003064
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003065 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003066
3067 return( ret );
3068}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00003069#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003070
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003071#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3072 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3073static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003074{
3075 int ret;
3076
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003077 if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003078 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003079 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
3080 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003081 }
3082
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003083 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
3084 mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
3085 MBEDTLS_ECDH_OURS ) ) != 0 )
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003086 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003087 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003088 return( ret );
3089 }
3090
3091 return( 0 );
3092}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003093#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
3094 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01003095
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003096#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003097 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003098static int ssl_resume_server_key_exchange( mbedtls_ssl_context *ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003099 size_t *signature_len )
Paul Bakker41c83d32013-03-20 14:39:14 +01003100{
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003101 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3102 * signature length which will be added in ssl_write_server_key_exchange
3103 * after the call to ssl_prepare_server_key_exchange.
3104 * ssl_write_server_key_exchange also takes care of incrementing
3105 * ssl->out_msglen. */
3106 unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2;
Angus Grattond8213d02016-05-25 20:56:48 +10003107 size_t sig_max_len = ( ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003108 - sig_start );
Gilles Peskine8f97af72018-04-26 11:46:10 +02003109 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003110 sig_start, signature_len, sig_max_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003111 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3112 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003113 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003114 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003115 }
Gilles Peskined3eb0612018-01-08 17:07:44 +01003116 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_resume_server_key_exchange", ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003117 return( ret );
3118}
3119#endif /* defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003120 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003121
Gilles Peskined3eb0612018-01-08 17:07:44 +01003122/* Prepare the ServerKeyExchange message, up to and including
Gilles Peskine168dae82018-04-25 23:35:42 +02003123 * calculating the signature if any, but excluding formatting the
3124 * signature and sending the message. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003125static int ssl_prepare_server_key_exchange( mbedtls_ssl_context *ssl,
3126 size_t *signature_len )
Paul Bakker5690efc2011-05-26 13:16:06 +00003127{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003128 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00003129 ssl->handshake->ciphersuite_info;
3130
Hanno Becker1aa267c2017-04-28 17:08:27 +01003131#if defined(MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED)
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003132#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskine3ce9b902018-01-06 01:34:21 +01003133 unsigned char *dig_signed = NULL;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003134#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
3135#endif /* MBEDTLS_KEY_EXCHANGE__SOME_PFS__ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003136
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003137 (void) ciphersuite_info; /* unused in some configurations */
Gilles Peskine22e695f2018-04-26 00:22:50 +02003138#if !defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3139 (void) signature_len;
3140#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003141
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003142 ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */
Paul Bakker5121ce52009-01-03 21:22:43 +00003143
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003144 /*
3145 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003146 * Part 1: Provide key exchange parameters for chosen ciphersuite.
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003147 *
3148 */
3149
3150 /*
3151 * - ECJPAKE key exchanges
3152 */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003153#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3154 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3155 {
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003156 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003157 size_t len = 0;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003158
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003159 ret = mbedtls_ecjpake_write_round_two(
3160 &ssl->handshake->ecjpake_ctx,
3161 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003162 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003163 ssl->conf->f_rng, ssl->conf->p_rng );
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003164 if( ret != 0 )
3165 {
3166 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
3167 return( ret );
3168 }
3169
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003170 ssl->out_msglen += len;
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02003171 }
3172#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
3173
Hanno Becker1aa267c2017-04-28 17:08:27 +01003174 /*
3175 * For (EC)DHE key exchanges with PSK, parameters are prefixed by support
3176 * identity hint (RFC 4279, Sec. 3). Until someone needs this feature,
3177 * we use empty support identity hints here.
3178 **/
3179#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003180 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3181 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3182 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003183 {
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003184 ssl->out_msg[ssl->out_msglen++] = 0x00;
3185 ssl->out_msg[ssl->out_msglen++] = 0x00;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003186 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003187#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
3188 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003189
Hanno Becker7e5437a2017-04-28 17:15:26 +01003190 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003191 * - DHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003192 */
3193#if defined(MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED)
3194 if( mbedtls_ssl_ciphersuite_uses_dhe( ciphersuite_info ) )
Paul Bakker48916f92012-09-16 19:57:18 +00003195 {
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003196 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003197 size_t len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003198
Manuel Pégourié-Gonnard1028b742015-05-06 17:33:07 +01003199 if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
3200 {
3201 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
3202 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3203 }
3204
Paul Bakker41c83d32013-03-20 14:39:14 +01003205 /*
3206 * Ephemeral DH parameters:
3207 *
3208 * struct {
3209 * opaque dh_p<1..2^16-1>;
3210 * opaque dh_g<1..2^16-1>;
3211 * opaque dh_Ys<1..2^16-1>;
3212 * } ServerDHParams;
3213 */
Hanno Beckerab740562017-10-04 13:15:37 +01003214 if( ( ret = mbedtls_dhm_set_group( &ssl->handshake->dhm_ctx,
3215 &ssl->conf->dhm_P,
3216 &ssl->conf->dhm_G ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003217 {
Hanno Beckerab740562017-10-04 13:15:37 +01003218 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_set_group", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003219 return( ret );
3220 }
Paul Bakker48916f92012-09-16 19:57:18 +00003221
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003222 if( ( ret = mbedtls_dhm_make_params(
3223 &ssl->handshake->dhm_ctx,
3224 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3225 ssl->out_msg + ssl->out_msglen, &len,
3226 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003227 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003228 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003229 return( ret );
3230 }
3231
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003232#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003233 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003234#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003235
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003236 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003237
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003238 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
3239 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
3240 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
3241 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
Paul Bakker41c83d32013-03-20 14:39:14 +01003242 }
Hanno Becker1aa267c2017-04-28 17:08:27 +01003243#endif /* MBEDTLS_KEY_EXCHANGE__SOME__DHE_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01003244
Hanno Becker1aa267c2017-04-28 17:08:27 +01003245 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003246 * - ECDHE key exchanges
Hanno Becker1aa267c2017-04-28 17:08:27 +01003247 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003248#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
Hanno Becker1aa267c2017-04-28 17:08:27 +01003249 if( mbedtls_ssl_ciphersuite_uses_ecdhe( ciphersuite_info ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00003250 {
Paul Bakker41c83d32013-03-20 14:39:14 +01003251 /*
3252 * Ephemeral ECDH parameters:
3253 *
3254 * struct {
3255 * ECParameters curve_params;
3256 * ECPoint public;
3257 * } ServerECDHParams;
3258 */
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003259 const mbedtls_ecp_curve_info *curve = ssl->handshake->curve_info;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003260 int ret;
Simon Butcher600c5e62018-06-14 08:58:59 +01003261 size_t len = 0;
Gergely Budai987bfb52014-01-19 21:48:42 +01003262
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003263 if( curve == NULL )
Gergely Budai987bfb52014-01-19 21:48:42 +01003264 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003265 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
3266 return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
Gergely Budai987bfb52014-01-19 21:48:42 +01003267 }
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003268 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", curve->name ) );
Gergely Budai987bfb52014-01-19 21:48:42 +01003269
Janos Follath3fbdada2018-08-15 10:26:53 +01003270 if( ( ret = mbedtls_ecdh_setup( &ssl->handshake->ecdh_ctx,
Hanno Beckerd3b2fcb2019-06-17 14:30:05 +01003271 curve->grp_id ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003272 {
Manuel Pégourié-Gonnarde3a062b2015-05-11 18:46:47 +02003273 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003274 return( ret );
3275 }
Paul Bakker5121ce52009-01-03 21:22:43 +00003276
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003277 if( ( ret = mbedtls_ecdh_make_params(
3278 &ssl->handshake->ecdh_ctx, &len,
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003279 ssl->out_msg + ssl->out_msglen,
Angus Grattond8213d02016-05-25 20:56:48 +10003280 MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen,
Gilles Peskinefe1c0932017-11-23 13:35:02 +01003281 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01003282 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003283 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
Paul Bakker41c83d32013-03-20 14:39:14 +01003284 return( ret );
3285 }
3286
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003287#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003288 dig_signed = ssl->out_msg + ssl->out_msglen;
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003289#endif
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003290
Gilles Peskinef9f15ae2018-01-08 17:13:01 +01003291 ssl->out_msglen += len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003292
Janos Follath3fbdada2018-08-15 10:26:53 +01003293 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3294 MBEDTLS_DEBUG_ECDH_Q );
Paul Bakker41c83d32013-03-20 14:39:14 +01003295 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003296#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00003297
Hanno Becker1aa267c2017-04-28 17:08:27 +01003298 /*
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003299 *
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003300 * Part 2: For key exchanges involving the server signing the
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003301 * exchange parameters, compute and add the signature here.
3302 *
Hanno Becker1aa267c2017-04-28 17:08:27 +01003303 */
3304#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3305 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
Paul Bakker1ef83d62012-04-11 12:09:53 +00003306 {
Gilles Peskine1004c192018-01-08 16:59:14 +01003307 size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed;
Gilles Peskineca1d7422018-04-24 11:53:22 +02003308 size_t hashlen = 0;
Gilles Peskinee1efdf92018-01-05 21:18:37 +01003309 unsigned char hash[MBEDTLS_MD_MAX_SIZE];
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003310 int ret;
Paul Bakker23f36802012-09-28 14:15:14 +00003311
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003312 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003313 * 2.1: Choose hash algorithm:
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003314 * A: For TLS 1.2, obey signature-hash-algorithm extension
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003315 * to choose appropriate hash.
3316 * B: For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1
3317 * (RFC 4492, Sec. 5.4)
3318 * C: Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003319 */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003320
3321 mbedtls_md_type_t md_alg;
3322
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003323#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003324 mbedtls_pk_type_t sig_alg =
3325 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003326 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003327 {
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003328 /* A: For TLS 1.2, obey signature-hash-algorithm extension
3329 * (RFC 5246, Sec. 7.4.1.4.1). */
Hanno Becker7e5437a2017-04-28 17:15:26 +01003330 if( sig_alg == MBEDTLS_PK_NONE ||
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003331 ( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
3332 sig_alg ) ) == MBEDTLS_MD_NONE )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003333 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003334 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Hanno Becker4cb1f4d2017-10-10 15:59:57 +01003335 /* (... because we choose a cipher suite
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01003336 * only if there is a matching hash.) */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003337 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003338 }
3339 }
Paul Bakker577e0062013-08-28 11:57:20 +02003340 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003341#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3342#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3343 defined(MBEDTLS_SSL_PROTO_TLS1_1)
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003344 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003345 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003346 /* B: Default hash SHA1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003347 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003348 }
3349 else
Hanno Becker1aa267c2017-04-28 17:08:27 +01003350#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3351 MBEDTLS_SSL_PROTO_TLS1_1 */
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003352 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003353 /* C: MD5 + SHA1 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003354 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003355 }
3356
Hanno Becker7e5437a2017-04-28 17:15:26 +01003357 MBEDTLS_SSL_DEBUG_MSG( 3, ( "pick hash algorithm %d for signing", md_alg ) );
3358
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02003359 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003360 * 2.2: Compute the hash to be signed
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003361 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003362#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3363 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3364 if( md_alg == MBEDTLS_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00003365 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003366 hashlen = 36;
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003367 ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash,
3368 dig_signed,
3369 dig_signed_len );
3370 if( ret != 0 )
3371 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003372 }
3373 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003374#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3375 MBEDTLS_SSL_PROTO_TLS1_1 */
3376#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3377 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3378 if( md_alg != MBEDTLS_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003379 {
Gilles Peskineca1d7422018-04-24 11:53:22 +02003380 ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
Andres Amaya Garcia46f5a3e2017-07-20 16:17:51 +01003381 dig_signed,
3382 dig_signed_len,
3383 md_alg );
3384 if( ret != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003385 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003386 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003387 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003388#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3389 MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02003390 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003391 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3392 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker577e0062013-08-28 11:57:20 +02003393 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02003394
Gilles Peskineebd652f2018-01-05 21:18:59 +01003395 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003396
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003397 /*
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003398 * 2.3: Compute and add the signature
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02003399 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003400#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3401 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker23f36802012-09-28 14:15:14 +00003402 {
Hanno Beckercf7ae7e2017-05-11 14:07:25 +01003403 /*
3404 * For TLS 1.2, we need to specify signature and hash algorithm
Hanno Becker7e5437a2017-04-28 17:15:26 +01003405 * explicitly through a prefix to the signature.
3406 *
3407 * struct {
3408 * HashAlgorithm hash;
3409 * SignatureAlgorithm signature;
3410 * } SignatureAndHashAlgorithm;
3411 *
3412 * struct {
3413 * SignatureAndHashAlgorithm algorithm;
3414 * opaque signature<0..2^16-1>;
3415 * } DigitallySigned;
3416 *
3417 */
3418
Gilles Peskine1004c192018-01-08 16:59:14 +01003419 ssl->out_msg[ssl->out_msglen++] =
3420 mbedtls_ssl_hash_from_md_alg( md_alg );
3421 ssl->out_msg[ssl->out_msglen++] =
3422 mbedtls_ssl_sig_from_pk_alg( sig_alg );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003423 }
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003424#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003425
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003426#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003427 if( ssl->conf->f_async_sign_start != NULL )
3428 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003429 ret = ssl->conf->f_async_sign_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003430 mbedtls_ssl_own_cert( ssl ),
3431 md_alg, hash, hashlen );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003432 switch( ret )
3433 {
3434 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3435 /* act as if f_async_sign was null */
3436 break;
3437 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003438 ssl->handshake->async_in_progress = 1;
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003439 return( ssl_resume_server_key_exchange( ssl, signature_len ) );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003440 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003441 ssl->handshake->async_in_progress = 1;
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003442 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3443 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003444 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_sign_start", ret );
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003445 return( ret );
3446 }
3447 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003448#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine4bf9a282018-01-05 21:20:50 +01003449
3450 if( mbedtls_ssl_own_key( ssl ) == NULL )
3451 {
3452 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
3453 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3454 }
3455
Gilles Peskine0fd90dd2018-04-26 07:41:09 +02003456 /* Append the signature to ssl->out_msg, leaving 2 bytes for the
3457 * signature length which will be added in ssl_write_server_key_exchange
3458 * after the call to ssl_prepare_server_key_exchange.
3459 * ssl_write_server_key_exchange also takes care of incrementing
3460 * ssl->out_msglen. */
Gilles Peskine1004c192018-01-08 16:59:14 +01003461 if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ),
3462 md_alg, hash, hashlen,
3463 ssl->out_msg + ssl->out_msglen + 2,
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003464 signature_len,
Gilles Peskine1004c192018-01-08 16:59:14 +01003465 ssl->conf->f_rng,
3466 ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003467 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003468 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02003469 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00003470 }
Paul Bakker1ef83d62012-04-11 12:09:53 +00003471 }
Hanno Becker1aa267c2017-04-28 17:08:27 +01003472#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00003473
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003474 return( 0 );
3475}
Paul Bakker1ef83d62012-04-11 12:09:53 +00003476
Gilles Peskined3eb0612018-01-08 17:07:44 +01003477/* Prepare the ServerKeyExchange message and send it. For ciphersuites
Gilles Peskine168dae82018-04-25 23:35:42 +02003478 * that do not include a ServerKeyExchange message, do nothing. Either
3479 * way, if successful, move on to the next step in the SSL state
3480 * machine. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003481static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
3482{
3483 int ret;
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003484 size_t signature_len = 0;
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003485#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
3486 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00003487 ssl->handshake->ciphersuite_info;
Gilles Peskinef1127252018-04-24 13:05:39 +02003488#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003489
Gilles Peskined3eb0612018-01-08 17:07:44 +01003490 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
3491
3492#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
3493 /* Extract static ECDH parameters and abort if ServerKeyExchange
3494 * is not needed. */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003495 if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
3496 {
3497 /* For suites involving ECDH, extract DH parameters
3498 * from certificate at this point. */
3499#if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED)
3500 if( mbedtls_ssl_ciphersuite_uses_ecdh( ciphersuite_info ) )
3501 {
3502 ssl_get_ecdh_params_from_cert( ssl );
3503 }
3504#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
3505
3506 /* Key exchanges not involving ephemeral keys don't use
3507 * ServerKeyExchange, so end here. */
3508 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
3509 ssl->state++;
3510 return( 0 );
3511 }
Gilles Peskinef1127252018-04-24 13:05:39 +02003512#endif /* MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED */
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003513
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003514#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) && \
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003515 defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskined3eb0612018-01-08 17:07:44 +01003516 /* If we have already prepared the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003517 * signature operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003518 if( ssl->handshake->async_in_progress != 0 )
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003519 {
3520 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming signature operation" ) );
3521 ret = ssl_resume_server_key_exchange( ssl, &signature_len );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003522 }
3523 else
3524#endif /* defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED) &&
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003525 defined(MBEDTLS_SSL_ASYNC_PRIVATE) */
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003526 {
3527 /* ServerKeyExchange is needed. Prepare the message. */
3528 ret = ssl_prepare_server_key_exchange( ssl, &signature_len );
Gilles Peskined3eb0612018-01-08 17:07:44 +01003529 }
3530
3531 if( ret != 0 )
3532 {
Gilles Peskinead28bf02018-04-26 00:19:16 +02003533 /* If we're starting to write a new message, set ssl->out_msglen
3534 * to 0. But if we're resuming after an asynchronous message,
3535 * out_msglen is the amount of data written so far and mst be
3536 * preserved. */
Gilles Peskined3eb0612018-01-08 17:07:44 +01003537 if( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3538 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange (pending)" ) );
3539 else
3540 ssl->out_msglen = 0;
3541 return( ret );
Gilles Peskineebd30ae2018-01-06 03:34:20 +01003542 }
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003543
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003544 /* If there is a signature, write its length.
Gilles Peskine168dae82018-04-25 23:35:42 +02003545 * ssl_prepare_server_key_exchange already wrote the signature
3546 * itself at its proper place in the output buffer. */
Gilles Peskine7ab013a2018-01-08 17:04:16 +01003547#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
3548 if( signature_len != 0 )
3549 {
3550 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len >> 8 );
3551 ssl->out_msg[ssl->out_msglen++] = (unsigned char)( signature_len );
3552
3553 MBEDTLS_SSL_DEBUG_BUF( 3, "my signature",
3554 ssl->out_msg + ssl->out_msglen,
3555 signature_len );
3556
3557 /* Skip over the already-written signature */
3558 ssl->out_msglen += signature_len;
3559 }
3560#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
3561
Gilles Peskine184a3fa2018-01-06 01:46:17 +01003562 /* Add header and send. */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003563 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3564 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003565
3566 ssl->state++;
3567
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003568 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003569 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003570 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003571 return( ret );
3572 }
3573
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003574 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003575 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00003576}
3577
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003578static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003579{
3580 int ret;
3581
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003582 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003583
3584 ssl->out_msglen = 4;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003585 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3586 ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
Paul Bakker5121ce52009-01-03 21:22:43 +00003587
3588 ssl->state++;
3589
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003590#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02003591 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003592 mbedtls_ssl_send_flight_completed( ssl );
Manuel Pégourié-Gonnard7de3c9e2014-09-29 15:29:48 +02003593#endif
3594
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003595 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003596 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02003597 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003598 return( ret );
3599 }
3600
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003601#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02003602 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003603 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3604 {
3605 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
3606 return( ret );
3607 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01003608#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02003609
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003610 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003611
3612 return( 0 );
3613}
3614
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003615#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3616 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3617static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003618 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003619{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003620 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003621 size_t n;
3622
3623 /*
3624 * Receive G^Y mod P, premaster = (G^Y)^X mod P
3625 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003626 if( *p + 2 > end )
3627 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003628 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3629 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003630 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02003631
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003632 n = ( (*p)[0] << 8 ) | (*p)[1];
3633 *p += 2;
3634
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003635 if( *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003636 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003637 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3638 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003639 }
3640
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003641 if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003642 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003643 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
3644 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003645 }
3646
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003647 *p += n;
3648
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003649 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003650
Paul Bakker70df2fb2013-04-17 17:19:09 +02003651 return( ret );
3652}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003653#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3654 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003655
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003656#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3657 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003658
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003659#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003660static int ssl_resume_decrypt_pms( mbedtls_ssl_context *ssl,
3661 unsigned char *peer_pms,
3662 size_t *peer_pmslen,
3663 size_t peer_pmssize )
3664{
Gilles Peskine8f97af72018-04-26 11:46:10 +02003665 int ret = ssl->conf->f_async_resume( ssl,
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003666 peer_pms, peer_pmslen, peer_pmssize );
3667 if( ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3668 {
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003669 ssl->handshake->async_in_progress = 0;
Gilles Peskine1febfef2018-04-30 11:54:39 +02003670 mbedtls_ssl_set_async_operation_data( ssl, NULL );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003671 }
3672 MBEDTLS_SSL_DEBUG_RET( 2, "ssl_decrypt_encrypted_pms", ret );
3673 return( ret );
3674}
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003675#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003676
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003677static int ssl_decrypt_encrypted_pms( mbedtls_ssl_context *ssl,
3678 const unsigned char *p,
3679 const unsigned char *end,
3680 unsigned char *peer_pms,
3681 size_t *peer_pmslen,
3682 size_t peer_pmssize )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003683{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003684 int ret;
Hanno Becker81bb4d02019-02-16 11:03:48 +00003685 size_t len = (size_t)( end - p ); /* Cast is safe because p <= end. */
Gilles Peskine422ccab2018-01-11 18:29:01 +01003686 mbedtls_pk_context *private_key = mbedtls_ssl_own_key( ssl );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003687
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003688#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003689 /* If we have already started decoding the message and there is an ongoing
Gilles Peskine168dae82018-04-25 23:35:42 +02003690 * decryption operation, resume signing. */
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003691 if( ssl->handshake->async_in_progress != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003692 {
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003693 MBEDTLS_SSL_DEBUG_MSG( 2, ( "resuming decryption operation" ) );
3694 return( ssl_resume_decrypt_pms( ssl,
3695 peer_pms, peer_pmslen, peer_pmssize ) );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003696 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003697#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003698
3699 /*
Gilles Peskine422ccab2018-01-11 18:29:01 +01003700 * Prepare to decrypt the premaster using own private RSA key
Paul Bakker70df2fb2013-04-17 17:19:09 +02003701 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003702#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3703 defined(MBEDTLS_SSL_PROTO_TLS1_2)
Hanno Becker81bb4d02019-02-16 11:03:48 +00003704#if defined(MBEDTLS_SSL_PROTO_SSL3)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003705 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
Hanno Becker81bb4d02019-02-16 11:03:48 +00003706#endif /* MBEDTLS_SSL_PROTO_SSL3 */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003707 {
Hanno Becker81bb4d02019-02-16 11:03:48 +00003708 if( len < 2 )
3709 {
Philippe Antoine747fd532018-05-30 09:13:21 +02003710 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3711 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3712 }
Hanno Becker81bb4d02019-02-16 11:03:48 +00003713 len -= 2;
3714
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02003715 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
3716 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02003717 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003718 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3719 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003720 }
3721 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02003722#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003723
Gilles Peskine422ccab2018-01-11 18:29:01 +01003724 /*
3725 * Decrypt the premaster secret
3726 */
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003727#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003728 if( ssl->conf->f_async_decrypt_start != NULL )
3729 {
Gilles Peskine8f97af72018-04-26 11:46:10 +02003730 ret = ssl->conf->f_async_decrypt_start( ssl,
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003731 mbedtls_ssl_own_cert( ssl ),
3732 p, len );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003733 switch( ret )
3734 {
3735 case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH:
3736 /* act as if f_async_decrypt_start was null */
3737 break;
3738 case 0:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003739 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003740 return( ssl_resume_decrypt_pms( ssl,
3741 peer_pms,
3742 peer_pmslen,
3743 peer_pmssize ) );
3744 case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003745 ssl->handshake->async_in_progress = 1;
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003746 return( MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS );
3747 default:
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003748 MBEDTLS_SSL_DEBUG_RET( 1, "f_async_decrypt_start", ret );
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003749 return( ret );
3750 }
3751 }
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003752#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003753
Gilles Peskine422ccab2018-01-11 18:29:01 +01003754 if( ! mbedtls_pk_can_do( private_key, MBEDTLS_PK_RSA ) )
3755 {
Gilles Peskine422ccab2018-01-11 18:29:01 +01003756 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
3757 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3758 }
3759
3760 ret = mbedtls_pk_decrypt( private_key, p, len,
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003761 peer_pms, peer_pmslen, peer_pmssize,
3762 ssl->conf->f_rng, ssl->conf->p_rng );
3763 return( ret );
3764}
3765
3766static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
3767 const unsigned char *p,
3768 const unsigned char *end,
3769 size_t pms_offset )
3770{
3771 int ret;
3772 unsigned char *pms = ssl->handshake->premaster + pms_offset;
3773 unsigned char ver[2];
3774 unsigned char fake_pms[48], peer_pms[48];
3775 unsigned char mask;
3776 size_t i, peer_pmslen;
3777 unsigned int diff;
3778
Gilles Peskine0a8352b2018-06-13 18:16:41 +02003779 /* In case of a failure in decryption, the decryption may write less than
3780 * 2 bytes of output, but we always read the first two bytes. It doesn't
3781 * matter in the end because diff will be nonzero in that case due to
3782 * peer_pmslen being less than 48, and we only care whether diff is 0.
3783 * But do initialize peer_pms for robustness anyway. This also makes
3784 * memory analyzers happy (don't access uninitialized memory, even
3785 * if it's an unsigned char). */
3786 peer_pms[0] = peer_pms[1] = ~0;
3787
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003788 ret = ssl_decrypt_encrypted_pms( ssl, p, end,
3789 peer_pms,
3790 &peer_pmslen,
3791 sizeof( peer_pms ) );
3792
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003793#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003794 if ( ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS )
3795 return( ret );
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003796#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003797
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003798 mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
Gilles Peskine2e333372018-04-24 13:22:10 +02003799 ssl->handshake->max_minor_ver,
3800 ssl->conf->transport, ver );
3801
3802 /* Avoid data-dependent branches while checking for invalid
3803 * padding, to protect against timing-based Bleichenbacher-type
3804 * attacks. */
3805 diff = (unsigned int) ret;
3806 diff |= peer_pmslen ^ 48;
3807 diff |= peer_pms[0] ^ ver[0];
3808 diff |= peer_pms[1] ^ ver[1];
3809
3810 /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
3811 /* MSVC has a warning about unary minus on unsigned, but this is
3812 * well-defined and precisely what we want to do here */
3813#if defined(_MSC_VER)
3814#pragma warning( push )
3815#pragma warning( disable : 4146 )
3816#endif
3817 mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
3818#if defined(_MSC_VER)
3819#pragma warning( pop )
3820#endif
Manuel Pégourié-Gonnardb9c93d02015-06-23 13:53:15 +02003821
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003822 /*
3823 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
3824 * must not cause the connection to end immediately; instead, send a
3825 * bad_record_mac later in the handshake.
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003826 * To protect against timing-based variants of the attack, we must
3827 * not have any branch that depends on whether the decryption was
3828 * successful. In particular, always generate the fake premaster secret,
3829 * regardless of whether it will ultimately influence the output or not.
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003830 */
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003831 ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003832 if( ret != 0 )
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003833 {
Gilles Peskinee1416382018-04-26 10:23:21 +02003834 /* It's ok to abort on an RNG failure, since this does not reveal
3835 * anything about the RSA decryption. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003836 return( ret );
Gilles Peskinebcd98a52018-01-11 21:30:40 +01003837 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003838
Manuel Pégourié-Gonnard331ba572015-04-20 12:33:57 +01003839#if defined(MBEDTLS_SSL_DEBUG_ALL)
Manuel Pégourié-Gonnardce60fbe2015-04-15 16:45:52 +02003840 if( diff != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003841 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003842#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02003843
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003844 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
3845 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
3846 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003847 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3848 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003849 }
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003850 ssl->handshake->pmslen = 48;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003851
Gilles Peskine422ccab2018-01-11 18:29:01 +01003852 /* Set pms to either the true or the fake PMS, without
3853 * data-dependent branches. */
Manuel Pégourié-Gonnard6674cce2015-02-06 10:30:58 +00003854 for( i = 0; i < ssl->handshake->pmslen; i++ )
3855 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
3856
3857 return( 0 );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003858}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003859#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
3860 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02003861
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003862#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
3863static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003864 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003865{
Paul Bakker6db455e2013-09-18 17:29:31 +02003866 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003867 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003868
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003869 if( ssl->conf->f_psk == NULL &&
3870 ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
3871 ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003872 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003873 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
3874 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003875 }
3876
3877 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003878 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02003879 */
Hanno Becker83c9f492017-06-26 13:52:14 +01003880 if( end - *p < 2 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003881 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003882 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3883 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003884 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02003885
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003886 n = ( (*p)[0] << 8 ) | (*p)[1];
3887 *p += 2;
3888
Hanno Becker83c9f492017-06-26 13:52:14 +01003889 if( n < 1 || n > 65535 || n > (size_t) ( end - *p ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003890 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003891 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3892 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003893 }
3894
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003895 if( ssl->conf->f_psk != NULL )
Paul Bakker6db455e2013-09-18 17:29:31 +02003896 {
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003897 if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003898 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003899 }
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003900 else
Paul Bakker6db455e2013-09-18 17:29:31 +02003901 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01003902 /* Identity is not a big secret since clients send it in the clear,
3903 * but treat it carefully anyway, just in case */
Manuel Pégourié-Gonnard7ca4e4d2015-05-04 10:55:58 +02003904 if( n != ssl->conf->psk_identity_len ||
3905 mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02003906 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003907 ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
Paul Bakker6db455e2013-09-18 17:29:31 +02003908 }
3909 }
3910
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003911 if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02003912 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003913 MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Gilles Peskinec94f7352017-05-10 16:37:56 +02003914 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3915 MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY );
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003916 return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003917 }
3918
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003919 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02003920
Manuel Pégourié-Gonnardd27680b2014-07-08 14:15:55 +02003921 return( 0 );
Paul Bakkerfbb17802013-04-17 19:10:21 +02003922}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003923#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02003924
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003925static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003926{
Paul Bakker23986e52011-04-24 08:57:21 +00003927 int ret;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003928 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003929 unsigned char *p, *end;
Paul Bakker70df2fb2013-04-17 17:19:09 +02003930
Hanno Becker8759e162017-12-27 21:34:08 +00003931 ciphersuite_info = ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00003932
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003933 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00003934
Gilles Peskineb74a1c72018-04-24 13:09:22 +02003935#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003936 ( defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
3937 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) )
3938 if( ( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3939 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ) &&
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02003940 ( ssl->handshake->async_in_progress != 0 ) )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003941 {
3942 /* We've already read a record and there is an asynchronous
3943 * operation in progress to decrypt it. So skip reading the
Gilles Peskine168dae82018-04-25 23:35:42 +02003944 * record. */
Gilles Peskine2c6078e2018-01-12 13:46:43 +01003945 MBEDTLS_SSL_DEBUG_MSG( 3, ( "will resume decryption of previously-read record" ) );
3946 }
3947 else
3948#endif
Hanno Becker327c93b2018-08-15 13:56:18 +01003949 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003950 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003951 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003952 return( ret );
3953 }
3954
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003955 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00003956 end = ssl->in_msg + ssl->in_hslen;
Manuel Pégourié-Gonnardf8995832014-09-10 08:25:12 +00003957
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003958 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003959 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003960 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3961 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003962 }
3963
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003964 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
Paul Bakker5121ce52009-01-03 21:22:43 +00003965 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003966 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3967 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00003968 }
3969
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003970#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3971 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00003972 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003973 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00003974 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003975 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003976 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00003977 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003978
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003979 if( p != end )
3980 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003981 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3982 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01003983 }
3984
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003985 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003986 ssl->handshake->premaster,
Manuel Pégourié-Gonnard33352052015-06-02 16:17:08 +01003987 MBEDTLS_PREMASTER_SIZE,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02003988 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01003989 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003990 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003991 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
3992 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003993 }
3994
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003995 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02003996 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02003997 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02003998#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3999#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
4000 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
4001 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
4002 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
4003 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
4004 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
4005 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
4006 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02004007 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004008 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00004009 p, end - p) ) != 0 )
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004010 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004011 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
4012 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004013 }
4014
Janos Follath3fbdada2018-08-15 10:26:53 +01004015 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4016 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004017
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004018 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004019 &ssl->handshake->pmslen,
4020 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004021 MBEDTLS_MPI_MAX_SIZE,
Manuel Pégourié-Gonnard750e4d72015-05-07 12:35:38 +01004022 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004023 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004024 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
4025 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004026 }
4027
Janos Follath3fbdada2018-08-15 10:26:53 +01004028 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4029 MBEDTLS_DEBUG_ECDH_Z );
Paul Bakker5121ce52009-01-03 21:22:43 +00004030 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004031 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004032#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
4033 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
4034 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
4035 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
4036#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
4037 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02004038 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004039 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02004040 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004041 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakkerfbb17802013-04-17 19:10:21 +02004042 return( ret );
4043 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004044
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004045 if( p != end )
4046 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004047 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4048 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004049 }
4050
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004051 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004052 ciphersuite_info->key_exchange ) ) != 0 )
4053 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004054 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004055 return( ret );
4056 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02004057 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004058 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004059#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
4060#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
4061 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004062 {
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004063#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
Gilles Peskinedf13d5c2018-04-25 20:39:48 +02004064 if ( ssl->handshake->async_in_progress != 0 )
Gilles Peskine2c6078e2018-01-12 13:46:43 +01004065 {
4066 /* There is an asynchronous operation in progress to
4067 * decrypt the encrypted premaster secret, so skip
4068 * directly to resuming this operation. */
4069 MBEDTLS_SSL_DEBUG_MSG( 3, ( "PSK identity already parsed" ) );
4070 /* Update p to skip the PSK identity. ssl_parse_encrypted_pms
4071 * won't actually use it, but maintain p anyway for robustness. */
4072 p += ssl->conf->psk_identity_len + 2;
4073 }
4074 else
Gilles Peskineb74a1c72018-04-24 13:09:22 +02004075#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004076 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4077 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004078 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004079 return( ret );
4080 }
4081
4082 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
4083 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004084 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004085 return( ret );
4086 }
4087
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004088 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004089 ciphersuite_info->key_exchange ) ) != 0 )
4090 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004091 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02004092 return( ret );
4093 }
4094 }
4095 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004096#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
4097#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
4098 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004099 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004100 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4101 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004102 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004103 return( ret );
4104 }
4105 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
4106 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004107 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004108 return( ret );
4109 }
4110
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004111 if( p != end )
4112 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004113 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
4114 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Manuel Pégourié-Gonnard969ccc62014-03-26 19:53:25 +01004115 }
4116
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004117 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004118 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004119 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004120 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004121 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004122 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004123 }
4124 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004125#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
4126#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
4127 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004128 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004129 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
4130 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004131 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004132 return( ret );
4133 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004134
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004135 if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004136 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004137 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004138 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
4139 return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004140 }
4141
Janos Follath3fbdada2018-08-15 10:26:53 +01004142 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4143 MBEDTLS_DEBUG_ECDH_QP );
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02004144
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004145 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02004146 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004147 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004148 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004149 return( ret );
4150 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02004151 }
4152 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004153#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
4154#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
4155 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01004156 {
Manuel Pégourié-Gonnard2114d722014-09-10 13:59:41 +00004157 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01004158 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004159 MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02004160 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004161 }
4162 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004163 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004164#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
Manuel Pégourié-Gonnard0f1660a2015-09-16 22:41:06 +02004165#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4166 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
4167 {
4168 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
4169 p, end - p );
4170 if( ret != 0 )
4171 {
4172 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
4173 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
4174 }
4175
4176 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
4177 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
4178 ssl->conf->f_rng, ssl->conf->p_rng );
4179 if( ret != 0 )
4180 {
4181 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
4182 return( ret );
4183 }
4184 }
4185 else
4186#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004187 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004188 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4189 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004190 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004191
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004192 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
Paul Bakkerff60ee62010-03-16 21:09:09 +00004193 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004194 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
Paul Bakkerff60ee62010-03-16 21:09:09 +00004195 return( ret );
4196 }
Paul Bakker5121ce52009-01-03 21:22:43 +00004197
Paul Bakker5121ce52009-01-03 21:22:43 +00004198 ssl->state++;
4199
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004200 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004201
4202 return( 0 );
4203}
4204
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004205#if !defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004206static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004207{
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004208 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00004209 ssl->handshake->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00004210
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004211 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004212
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004213 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakkered27a042013-04-18 22:46:23 +02004214 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004215 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakkered27a042013-04-18 22:46:23 +02004216 ssl->state++;
4217 return( 0 );
4218 }
4219
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004220 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4221 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004222}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004223#else /* !MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004224static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004225{
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004226 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004227 size_t i, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004228 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004229 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004230 size_t hashlen;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004231#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4232 mbedtls_pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02004233#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004234 mbedtls_md_type_t md_alg;
Hanno Becker0d0cd4b2017-05-11 14:06:43 +01004235 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
Hanno Becker8759e162017-12-27 21:34:08 +00004236 ssl->handshake->ciphersuite_info;
Hanno Becker5882dd02019-06-06 16:25:57 +01004237 mbedtls_pk_context *peer_pk = NULL;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004238
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004239 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004240
Hanno Beckercd901262019-02-07 13:17:25 +00004241 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004242 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004243 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02004244 ssl->state++;
4245 return( 0 );
4246 }
4247
Hanno Becker5882dd02019-06-06 16:25:57 +01004248 /* Skip if we haven't received a certificate from the client.
4249 * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is set, this can be
4250 * inferred from the setting of mbedtls_ssl_session::peer_cert.
4251 * If MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is not set, it can
4252 * be inferred from whether we've held back the peer CRT's
4253 * public key in mbedtls_ssl_handshake_params::peer_pubkey. */
4254#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
4255 /* Because the peer CRT pubkey is embedded into the handshake
4256 * params currently, and there's no 'is_init' functions for PK
4257 * contexts, we need to break the abstraction and peek into
4258 * the PK context to see if it has been initialized. */
4259 if( ssl->handshake->peer_pubkey.pk_info != NULL )
4260 peer_pk = &ssl->handshake->peer_pubkey;
4261#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4262 if( ssl->session_negotiate->peer_cert != NULL )
Hanno Becker73cd8d82019-02-28 14:04:16 +00004263 {
4264 ret = mbedtls_x509_crt_pk_acquire( ssl->session_negotiate->peer_cert,
4265 &peer_pk );
4266 if( ret != 0 )
4267 {
Hanno Becker2224ccf2019-06-28 10:52:45 +01004268 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_x509_crt_pk_acquire", ret );
4269 return( ret );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004270 }
4271 }
Hanno Becker5882dd02019-06-06 16:25:57 +01004272#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4273
4274 if( peer_pk == NULL )
Hanno Beckercd901262019-02-07 13:17:25 +00004275 {
4276 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
4277 ssl->state++;
4278 return( 0 );
4279 }
Hanno Beckercd901262019-02-07 13:17:25 +00004280
Simon Butcher99000142016-10-13 17:21:01 +01004281 /* Read the message without adding it to the checksum */
Hanno Becker327c93b2018-08-15 13:56:18 +01004282 ret = mbedtls_ssl_read_record( ssl, 0 /* no checksum update */ );
Simon Butcher99000142016-10-13 17:21:01 +01004283 if( 0 != ret )
Paul Bakker5121ce52009-01-03 21:22:43 +00004284 {
Hanno Becker327c93b2018-08-15 13:56:18 +01004285 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record" ), ret );
Hanno Beckerbc6b5982019-07-02 15:36:44 +01004286 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004287 }
4288
4289 ssl->state++;
4290
Simon Butcher99000142016-10-13 17:21:01 +01004291 /* Process the message contents */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004292 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
4293 ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
Paul Bakker5121ce52009-01-03 21:22:43 +00004294 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004295 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Beckerbc6b5982019-07-02 15:36:44 +01004296 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4297 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004298 }
4299
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004300 i = mbedtls_ssl_hs_hdr_len( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004301
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004302 /*
4303 * struct {
4304 * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
4305 * opaque signature<0..2^16-1>;
4306 * } DigitallySigned;
4307 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004308#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
4309 defined(MBEDTLS_SSL_PROTO_TLS1_1)
4310 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01004311 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004312 md_alg = MBEDTLS_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004313 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004314
4315 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
Hanno Becker0833c102019-02-06 18:31:04 +00004316 if( mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECDSA ) )
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004317 {
4318 hash_start += 16;
4319 hashlen -= 16;
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004320 md_alg = MBEDTLS_MD_SHA1;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004321 }
Paul Bakker926af752012-11-23 13:38:07 +01004322 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02004323 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004324#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
4325 MBEDTLS_SSL_PROTO_TLS1_1 */
4326#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4327 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004328 {
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004329 if( i + 2 > ssl->in_hslen )
4330 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004331 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004332 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4333 goto exit;
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004334 }
4335
Paul Bakker5121ce52009-01-03 21:22:43 +00004336 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004337 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00004338 */
Simon Butcher99000142016-10-13 17:21:01 +01004339 md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] );
4340
4341 if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) )
Paul Bakker5121ce52009-01-03 21:22:43 +00004342 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004343 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004344 " for verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004345 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4346 goto exit;
Paul Bakker926af752012-11-23 13:38:07 +01004347 }
4348
Simon Butcher99000142016-10-13 17:21:01 +01004349#if !defined(MBEDTLS_MD_SHA1)
4350 if( MBEDTLS_MD_SHA1 == md_alg )
4351 hash_start += 16;
4352#endif
Paul Bakker926af752012-11-23 13:38:07 +01004353
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02004354 /* Info from md_alg will be used instead */
4355 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004356
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004357 i++;
4358
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004359 /*
4360 * Signature
4361 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004362 if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
4363 == MBEDTLS_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004364 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02004366 " for verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004367 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4368 goto exit;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004369 }
4370
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004371 /*
4372 * Check the certificate's key type matches the signature alg
4373 */
Hanno Becker0833c102019-02-06 18:31:04 +00004374 if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004375 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004376 MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004377 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4378 goto exit;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02004379 }
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004380
4381 i++;
Paul Bakker577e0062013-08-28 11:57:20 +02004382 }
4383 else
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004384#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02004385 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004386 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4387 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02004388 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02004389
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004390 if( i + 2 > ssl->in_hslen )
4391 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004392 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004393 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4394 goto exit;
Manuel Pégourié-Gonnard5ee96542014-09-10 14:27:21 +00004395 }
4396
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004397 sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
4398 i += 2;
Paul Bakker926af752012-11-23 13:38:07 +01004399
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004400 if( i + sig_len != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00004401 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004402 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004403 ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY;
4404 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004405 }
4406
Simon Butcher99000142016-10-13 17:21:01 +01004407 /* Calculate hash and verify signature */
Manuel Pégourié-Gonnarda5759752019-05-03 11:43:28 +02004408 {
4409 size_t dummy_hlen;
4410 ssl->handshake->calc_verify( ssl, hash, &dummy_hlen );
4411 }
Simon Butcher99000142016-10-13 17:21:01 +01004412
Hanno Becker0833c102019-02-06 18:31:04 +00004413 if( ( ret = mbedtls_pk_verify( peer_pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02004414 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnard4528f3f2014-09-10 14:17:23 +00004415 ssl->in_msg + i, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00004416 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004417 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004418 goto exit;
Paul Bakker5121ce52009-01-03 21:22:43 +00004419 }
4420
Simon Butcher99000142016-10-13 17:21:01 +01004421 mbedtls_ssl_update_handshake_status( ssl );
4422
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004423 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00004424
Hanno Becker73cd8d82019-02-28 14:04:16 +00004425exit:
4426
4427#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Hanno Beckerc6d1c3e2019-03-05 13:50:56 +00004428 mbedtls_x509_crt_pk_release( ssl->session_negotiate->peer_cert );
Hanno Becker73cd8d82019-02-28 14:04:16 +00004429#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
4430
Paul Bakkered27a042013-04-18 22:46:23 +02004431 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00004432}
Hanno Beckerae39b9e2019-02-07 12:32:43 +00004433#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00004434
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004435#if defined(MBEDTLS_SSL_SESSION_TICKETS)
4436static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004437{
4438 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004439 size_t tlen;
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004440 uint32_t lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004441
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004442 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004443
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004444 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4445 ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004446
4447 /*
4448 * struct {
4449 * uint32 ticket_lifetime_hint;
4450 * opaque ticket<0..2^16-1>;
4451 * } NewSessionTicket;
4452 *
4453 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
4454 * 8 . 9 ticket_len (n)
4455 * 10 . 9+n ticket content
4456 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02004457
Manuel Pégourié-Gonnardd59675d2015-05-19 15:28:00 +02004458 if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
Manuel Pégourié-Gonnard69f17282015-05-18 14:35:08 +02004459 ssl->session_negotiate,
4460 ssl->out_msg + 10,
Angus Grattond8213d02016-05-25 20:56:48 +10004461 ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004462 &tlen, &lifetime ) ) != 0 )
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004463 {
Manuel Pégourié-Gonnarda4a47352015-05-15 15:14:54 +02004464 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02004465 tlen = 0;
4466 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004467
Manuel Pégourié-Gonnardb0394be2015-05-19 11:40:30 +02004468 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
4469 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
4470 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
4471 ssl->out_msg[7] = ( lifetime ) & 0xFF;
4472
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004473 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
4474 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004475
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02004476 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004477
Manuel Pégourié-Gonnard145dfcb2014-02-26 14:23:33 +01004478 /*
4479 * Morally equivalent to updating ssl->state, but NewSessionTicket and
4480 * ChangeCipherSpec share the same state.
4481 */
4482 ssl->handshake->new_session_ticket = 0;
4483
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004484 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004485 {
Manuel Pégourié-Gonnard31c15862017-09-13 09:38:11 +02004486 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004487 return( ret );
4488 }
4489
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004490 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004491
4492 return( 0 );
4493}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004494#endif /* MBEDTLS_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004495
Paul Bakker5121ce52009-01-03 21:22:43 +00004496/*
Paul Bakker1961b702013-01-25 14:49:24 +01004497 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00004498 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004499int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00004500{
4501 int ret = 0;
4502
Manuel Pégourié-Gonnarddba460f2015-06-24 22:59:30 +02004503 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004504 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004505
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004506 MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
Paul Bakker1961b702013-01-25 14:49:24 +01004507
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004508 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
Paul Bakker1961b702013-01-25 14:49:24 +01004509 return( ret );
4510
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004511#if defined(MBEDTLS_SSL_PROTO_DTLS)
Manuel Pégourié-Gonnard64c16812019-06-06 12:43:51 +02004512 if( MBEDTLS_SSL_TRANSPORT_IS_DTLS( ssl->conf->transport ) &&
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004513 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004514 {
Manuel Pégourié-Gonnard87a346f2017-09-13 12:45:21 +02004515 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004516 return( ret );
4517 }
Hanno Beckerbc2498a2018-08-28 10:13:29 +01004518#endif /* MBEDTLS_SSL_PROTO_DTLS */
Manuel Pégourié-Gonnard5d8ba532014-09-19 15:09:21 +02004519
Paul Bakker1961b702013-01-25 14:49:24 +01004520 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00004521 {
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004522 case MBEDTLS_SSL_HELLO_REQUEST:
4523 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00004524 break;
4525
Paul Bakker1961b702013-01-25 14:49:24 +01004526 /*
4527 * <== ClientHello
4528 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004529 case MBEDTLS_SSL_CLIENT_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004530 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00004531 break;
Paul Bakker1961b702013-01-25 14:49:24 +01004532
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004533#if defined(MBEDTLS_SSL_PROTO_DTLS)
4534 case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
4535 return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
Manuel Pégourié-Gonnard579950c2014-09-29 17:47:33 +02004536#endif
4537
Paul Bakker1961b702013-01-25 14:49:24 +01004538 /*
4539 * ==> ServerHello
4540 * Certificate
4541 * ( ServerKeyExchange )
4542 * ( CertificateRequest )
4543 * ServerHelloDone
4544 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004545 case MBEDTLS_SSL_SERVER_HELLO:
Paul Bakker1961b702013-01-25 14:49:24 +01004546 ret = ssl_write_server_hello( ssl );
4547 break;
4548
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004549 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4550 ret = mbedtls_ssl_write_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004551 break;
4552
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004553 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004554 ret = ssl_write_server_key_exchange( ssl );
4555 break;
4556
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004557 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
Paul Bakker1961b702013-01-25 14:49:24 +01004558 ret = ssl_write_certificate_request( ssl );
4559 break;
4560
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004561 case MBEDTLS_SSL_SERVER_HELLO_DONE:
Paul Bakker1961b702013-01-25 14:49:24 +01004562 ret = ssl_write_server_hello_done( ssl );
4563 break;
4564
4565 /*
4566 * <== ( Certificate/Alert )
4567 * ClientKeyExchange
4568 * ( CertificateVerify )
4569 * ChangeCipherSpec
4570 * Finished
4571 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004572 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4573 ret = mbedtls_ssl_parse_certificate( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004574 break;
4575
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004576 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
Paul Bakker1961b702013-01-25 14:49:24 +01004577 ret = ssl_parse_client_key_exchange( ssl );
4578 break;
4579
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004580 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
Paul Bakker1961b702013-01-25 14:49:24 +01004581 ret = ssl_parse_certificate_verify( ssl );
4582 break;
4583
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004584 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4585 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004586 break;
4587
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004588 case MBEDTLS_SSL_CLIENT_FINISHED:
4589 ret = mbedtls_ssl_parse_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004590 break;
4591
4592 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02004593 * ==> ( NewSessionTicket )
4594 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01004595 * Finished
4596 */
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004597 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4598#if defined(MBEDTLS_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02004599 if( ssl->handshake->new_session_ticket != 0 )
4600 ret = ssl_write_new_session_ticket( ssl );
4601 else
Paul Bakkera503a632013-08-14 13:48:06 +02004602#endif
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004603 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004604 break;
4605
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004606 case MBEDTLS_SSL_SERVER_FINISHED:
4607 ret = mbedtls_ssl_write_finished( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004608 break;
4609
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004610 case MBEDTLS_SSL_FLUSH_BUFFERS:
4611 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
4612 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
Paul Bakker1961b702013-01-25 14:49:24 +01004613 break;
4614
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004615 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4616 mbedtls_ssl_handshake_wrapup( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01004617 break;
4618
4619 default:
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004620 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
4621 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00004622 }
4623
Paul Bakker5121ce52009-01-03 21:22:43 +00004624 return( ret );
4625}
Manuel Pégourié-Gonnard2cf5a7c2015-04-08 12:49:31 +02004626#endif /* MBEDTLS_SSL_SRV_C */