ssl_srv.c 127 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929
  1. /*
  2. * SSLv3/TLSv1 server-side functions
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: GPL-2.0
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License as published by
  9. * the Free Software Foundation; either version 2 of the License, or
  10. * (at your option) any later version.
  11. *
  12. * This program is distributed in the hope that it will be useful,
  13. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15. * GNU General Public License for more details.
  16. *
  17. * You should have received a copy of the GNU General Public License along
  18. * with this program; if not, write to the Free Software Foundation, Inc.,
  19. * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20. *
  21. * This file is part of mbed TLS (https://tls.mbed.org)
  22. */
  23. #if !defined(MBEDTLS_CONFIG_FILE)
  24. #include "mbedtls/config.h"
  25. #else
  26. #include MBEDTLS_CONFIG_FILE
  27. #endif
  28. #if defined(MBEDTLS_SSL_SRV_C)
  29. #if defined(MBEDTLS_PLATFORM_C)
  30. #include "mbedtls/platform.h"
  31. #else
  32. #include <stdlib.h>
  33. #define mbedtls_calloc calloc
  34. #define mbedtls_free free
  35. #endif
  36. #include "mbedtls/debug.h"
  37. #include "mbedtls/ssl.h"
  38. #include "mbedtls/ssl_internal.h"
  39. #include <string.h>
  40. #if defined(MBEDTLS_ECP_C)
  41. #include "mbedtls/ecp.h"
  42. #endif
  43. #if defined(MBEDTLS_HAVE_TIME)
  44. #include "mbedtls/platform_time.h"
  45. #endif
  46. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  47. /* Implementation that should never be optimized out by the compiler */
  48. static void mbedtls_zeroize( void *v, size_t n ) {
  49. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  50. }
  51. #endif
  52. #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
  53. int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
  54. const unsigned char *info,
  55. size_t ilen )
  56. {
  57. if( ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER )
  58. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  59. mbedtls_free( ssl->cli_id );
  60. if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
  61. return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
  62. memcpy( ssl->cli_id, info, ilen );
  63. ssl->cli_id_len = ilen;
  64. return( 0 );
  65. }
  66. void mbedtls_ssl_conf_dtls_cookies( mbedtls_ssl_config *conf,
  67. mbedtls_ssl_cookie_write_t *f_cookie_write,
  68. mbedtls_ssl_cookie_check_t *f_cookie_check,
  69. void *p_cookie )
  70. {
  71. conf->f_cookie_write = f_cookie_write;
  72. conf->f_cookie_check = f_cookie_check;
  73. conf->p_cookie = p_cookie;
  74. }
  75. #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
  76. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  77. static int ssl_parse_servername_ext( mbedtls_ssl_context *ssl,
  78. const unsigned char *buf,
  79. size_t len )
  80. {
  81. int ret;
  82. size_t servername_list_size, hostname_len;
  83. const unsigned char *p;
  84. MBEDTLS_SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
  85. servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
  86. if( servername_list_size + 2 != len )
  87. {
  88. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  89. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  90. }
  91. p = buf + 2;
  92. while( servername_list_size > 0 )
  93. {
  94. hostname_len = ( ( p[1] << 8 ) | p[2] );
  95. if( hostname_len + 3 > servername_list_size )
  96. {
  97. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  98. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  99. }
  100. if( p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME )
  101. {
  102. ret = ssl->conf->f_sni( ssl->conf->p_sni,
  103. ssl, p + 3, hostname_len );
  104. if( ret != 0 )
  105. {
  106. MBEDTLS_SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
  107. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  108. MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME );
  109. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  110. }
  111. return( 0 );
  112. }
  113. servername_list_size -= hostname_len + 3;
  114. p += hostname_len + 3;
  115. }
  116. if( servername_list_size != 0 )
  117. {
  118. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  119. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  120. }
  121. return( 0 );
  122. }
  123. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  124. static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
  125. const unsigned char *buf,
  126. size_t len )
  127. {
  128. int ret;
  129. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  130. if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  131. {
  132. /* Check verify-data in constant-time. The length OTOH is no secret */
  133. if( len != 1 + ssl->verify_data_len ||
  134. buf[0] != ssl->verify_data_len ||
  135. mbedtls_ssl_safer_memcmp( buf + 1, ssl->peer_verify_data,
  136. ssl->verify_data_len ) != 0 )
  137. {
  138. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
  139. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  140. return( ret );
  141. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  142. }
  143. }
  144. else
  145. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  146. {
  147. if( len != 1 || buf[0] != 0x0 )
  148. {
  149. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
  150. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  151. return( ret );
  152. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  153. }
  154. ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
  155. }
  156. return( 0 );
  157. }
  158. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  159. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  160. static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
  161. const unsigned char *buf,
  162. size_t len )
  163. {
  164. size_t sig_alg_list_size;
  165. const unsigned char *p;
  166. const unsigned char *end = buf + len;
  167. const int *md_cur;
  168. sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
  169. if( sig_alg_list_size + 2 != len ||
  170. sig_alg_list_size % 2 != 0 )
  171. {
  172. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  173. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  174. }
  175. /*
  176. * For now, ignore the SignatureAlgorithm part and rely on offered
  177. * ciphersuites only for that part. To be fixed later.
  178. *
  179. * So, just look at the HashAlgorithm part.
  180. */
  181. for( md_cur = ssl->conf->sig_hashes; *md_cur != MBEDTLS_MD_NONE; md_cur++ ) {
  182. for( p = buf + 2; p < end; p += 2 ) {
  183. if( *md_cur == (int) mbedtls_ssl_md_alg_from_hash( p[0] ) ) {
  184. ssl->handshake->sig_alg = p[0];
  185. goto have_sig_alg;
  186. }
  187. }
  188. }
  189. /* Some key echanges do not need signatures at all */
  190. MBEDTLS_SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
  191. return( 0 );
  192. have_sig_alg:
  193. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
  194. ssl->handshake->sig_alg ) );
  195. return( 0 );
  196. }
  197. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  198. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  199. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  200. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  201. static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
  202. const unsigned char *buf,
  203. size_t len )
  204. {
  205. size_t list_size, our_size;
  206. const unsigned char *p;
  207. const mbedtls_ecp_curve_info *curve_info, **curves;
  208. list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
  209. if( list_size + 2 != len ||
  210. list_size % 2 != 0 )
  211. {
  212. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  213. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  214. }
  215. /* Should never happen unless client duplicates the extension */
  216. if( ssl->handshake->curves != NULL )
  217. {
  218. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  219. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  220. }
  221. /* Don't allow our peer to make us allocate too much memory,
  222. * and leave room for a final 0 */
  223. our_size = list_size / 2 + 1;
  224. if( our_size > MBEDTLS_ECP_DP_MAX )
  225. our_size = MBEDTLS_ECP_DP_MAX;
  226. if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
  227. return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
  228. ssl->handshake->curves = curves;
  229. p = buf + 2;
  230. while( list_size > 0 && our_size > 1 )
  231. {
  232. curve_info = mbedtls_ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
  233. if( curve_info != NULL )
  234. {
  235. *curves++ = curve_info;
  236. our_size--;
  237. }
  238. list_size -= 2;
  239. p += 2;
  240. }
  241. return( 0 );
  242. }
  243. static int ssl_parse_supported_point_formats( mbedtls_ssl_context *ssl,
  244. const unsigned char *buf,
  245. size_t len )
  246. {
  247. size_t list_size;
  248. const unsigned char *p;
  249. list_size = buf[0];
  250. if( list_size + 1 != len )
  251. {
  252. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  253. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  254. }
  255. p = buf + 1;
  256. while( list_size > 0 )
  257. {
  258. if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
  259. p[0] == MBEDTLS_ECP_PF_COMPRESSED )
  260. {
  261. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
  262. ssl->handshake->ecdh_ctx.point_format = p[0];
  263. #endif
  264. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  265. ssl->handshake->ecjpake_ctx.point_format = p[0];
  266. #endif
  267. MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
  268. return( 0 );
  269. }
  270. list_size--;
  271. p++;
  272. }
  273. return( 0 );
  274. }
  275. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  276. MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  277. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  278. static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
  279. const unsigned char *buf,
  280. size_t len )
  281. {
  282. int ret;
  283. if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
  284. {
  285. MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
  286. return( 0 );
  287. }
  288. if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
  289. buf, len ) ) != 0 )
  290. {
  291. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
  292. return( ret );
  293. }
  294. /* Only mark the extension as OK when we're sure it is */
  295. ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK;
  296. return( 0 );
  297. }
  298. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  299. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  300. static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
  301. const unsigned char *buf,
  302. size_t len )
  303. {
  304. if( len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID )
  305. {
  306. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  307. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  308. }
  309. ssl->session_negotiate->mfl_code = buf[0];
  310. return( 0 );
  311. }
  312. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  313. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  314. static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
  315. const unsigned char *buf,
  316. size_t len )
  317. {
  318. if( len != 0 )
  319. {
  320. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  321. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  322. }
  323. ((void) buf);
  324. if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED )
  325. ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
  326. return( 0 );
  327. }
  328. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  329. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  330. static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
  331. const unsigned char *buf,
  332. size_t len )
  333. {
  334. if( len != 0 )
  335. {
  336. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  337. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  338. }
  339. ((void) buf);
  340. if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
  341. ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
  342. {
  343. ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
  344. }
  345. return( 0 );
  346. }
  347. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  348. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  349. static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
  350. const unsigned char *buf,
  351. size_t len )
  352. {
  353. if( len != 0 )
  354. {
  355. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  356. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  357. }
  358. ((void) buf);
  359. if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED &&
  360. ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
  361. {
  362. ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
  363. }
  364. return( 0 );
  365. }
  366. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  367. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  368. static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
  369. unsigned char *buf,
  370. size_t len )
  371. {
  372. int ret;
  373. mbedtls_ssl_session session;
  374. mbedtls_ssl_session_init( &session );
  375. if( ssl->conf->f_ticket_parse == NULL ||
  376. ssl->conf->f_ticket_write == NULL )
  377. {
  378. return( 0 );
  379. }
  380. /* Remember the client asked us to send a new ticket */
  381. ssl->handshake->new_session_ticket = 1;
  382. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
  383. if( len == 0 )
  384. return( 0 );
  385. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  386. if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  387. {
  388. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
  389. return( 0 );
  390. }
  391. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  392. /*
  393. * Failures are ok: just ignore the ticket and proceed.
  394. */
  395. if( ( ret = ssl->conf->f_ticket_parse( ssl->conf->p_ticket, &session,
  396. buf, len ) ) != 0 )
  397. {
  398. mbedtls_ssl_session_free( &session );
  399. if( ret == MBEDTLS_ERR_SSL_INVALID_MAC )
  400. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is not authentic" ) );
  401. else if( ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED )
  402. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket is expired" ) );
  403. else
  404. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_parse", ret );
  405. return( 0 );
  406. }
  407. /*
  408. * Keep the session ID sent by the client, since we MUST send it back to
  409. * inform them we're accepting the ticket (RFC 5077 section 3.4)
  410. */
  411. session.id_len = ssl->session_negotiate->id_len;
  412. memcpy( &session.id, ssl->session_negotiate->id, session.id_len );
  413. mbedtls_ssl_session_free( ssl->session_negotiate );
  414. memcpy( ssl->session_negotiate, &session, sizeof( mbedtls_ssl_session ) );
  415. /* Zeroize instead of free as we copied the content */
  416. mbedtls_zeroize( &session, sizeof( mbedtls_ssl_session ) );
  417. MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
  418. ssl->handshake->resume = 1;
  419. /* Don't send a new ticket after all, this one is OK */
  420. ssl->handshake->new_session_ticket = 0;
  421. return( 0 );
  422. }
  423. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  424. #if defined(MBEDTLS_SSL_ALPN)
  425. static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
  426. const unsigned char *buf, size_t len )
  427. {
  428. size_t list_len, cur_len, ours_len;
  429. const unsigned char *theirs, *start, *end;
  430. const char **ours;
  431. /* If ALPN not configured, just ignore the extension */
  432. if( ssl->conf->alpn_list == NULL )
  433. return( 0 );
  434. /*
  435. * opaque ProtocolName<1..2^8-1>;
  436. *
  437. * struct {
  438. * ProtocolName protocol_name_list<2..2^16-1>
  439. * } ProtocolNameList;
  440. */
  441. /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
  442. if( len < 4 )
  443. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  444. list_len = ( buf[0] << 8 ) | buf[1];
  445. if( list_len != len - 2 )
  446. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  447. /*
  448. * Use our order of preference
  449. */
  450. start = buf + 2;
  451. end = buf + len;
  452. for( ours = ssl->conf->alpn_list; *ours != NULL; ours++ )
  453. {
  454. ours_len = strlen( *ours );
  455. for( theirs = start; theirs != end; theirs += cur_len )
  456. {
  457. /* If the list is well formed, we should get equality first */
  458. if( theirs > end )
  459. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  460. cur_len = *theirs++;
  461. /* Empty strings MUST NOT be included */
  462. if( cur_len == 0 )
  463. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  464. if( cur_len == ours_len &&
  465. memcmp( theirs, *ours, cur_len ) == 0 )
  466. {
  467. ssl->alpn_chosen = *ours;
  468. return( 0 );
  469. }
  470. }
  471. }
  472. /* If we get there, no match was found */
  473. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  474. MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
  475. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  476. }
  477. #endif /* MBEDTLS_SSL_ALPN */
  478. /*
  479. * Auxiliary functions for ServerHello parsing and related actions
  480. */
  481. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  482. /*
  483. * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
  484. */
  485. #if defined(MBEDTLS_ECDSA_C)
  486. static int ssl_check_key_curve( mbedtls_pk_context *pk,
  487. const mbedtls_ecp_curve_info **curves )
  488. {
  489. const mbedtls_ecp_curve_info **crv = curves;
  490. mbedtls_ecp_group_id grp_id = mbedtls_pk_ec( *pk )->grp.id;
  491. while( *crv != NULL )
  492. {
  493. if( (*crv)->grp_id == grp_id )
  494. return( 0 );
  495. crv++;
  496. }
  497. return( -1 );
  498. }
  499. #endif /* MBEDTLS_ECDSA_C */
  500. /*
  501. * Try picking a certificate for this ciphersuite,
  502. * return 0 on success and -1 on failure.
  503. */
  504. static int ssl_pick_cert( mbedtls_ssl_context *ssl,
  505. const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
  506. {
  507. mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
  508. mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
  509. uint32_t flags;
  510. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  511. if( ssl->handshake->sni_key_cert != NULL )
  512. list = ssl->handshake->sni_key_cert;
  513. else
  514. #endif
  515. list = ssl->conf->key_cert;
  516. if( pk_alg == MBEDTLS_PK_NONE )
  517. return( 0 );
  518. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
  519. if( list == NULL )
  520. {
  521. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server has no certificate" ) );
  522. return( -1 );
  523. }
  524. for( cur = list; cur != NULL; cur = cur->next )
  525. {
  526. MBEDTLS_SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
  527. cur->cert );
  528. if( ! mbedtls_pk_can_do( cur->key, pk_alg ) )
  529. {
  530. MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
  531. continue;
  532. }
  533. /*
  534. * This avoids sending the client a cert it'll reject based on
  535. * keyUsage or other extensions.
  536. *
  537. * It also allows the user to provision different certificates for
  538. * different uses based on keyUsage, eg if they want to avoid signing
  539. * and decrypting with the same RSA key.
  540. */
  541. if( mbedtls_ssl_check_cert_usage( cur->cert, ciphersuite_info,
  542. MBEDTLS_SSL_IS_SERVER, &flags ) != 0 )
  543. {
  544. MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
  545. "(extended) key usage extension" ) );
  546. continue;
  547. }
  548. #if defined(MBEDTLS_ECDSA_C)
  549. if( pk_alg == MBEDTLS_PK_ECDSA &&
  550. ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
  551. {
  552. MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
  553. continue;
  554. }
  555. #endif
  556. /*
  557. * Try to select a SHA-1 certificate for pre-1.2 clients, but still
  558. * present them a SHA-higher cert rather than failing if it's the only
  559. * one we got that satisfies the other conditions.
  560. */
  561. if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 &&
  562. cur->cert->sig_md != MBEDTLS_MD_SHA1 )
  563. {
  564. if( fallback == NULL )
  565. fallback = cur;
  566. {
  567. MBEDTLS_SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
  568. "sha-2 with pre-TLS 1.2 client" ) );
  569. continue;
  570. }
  571. }
  572. /* If we get there, we got a winner */
  573. break;
  574. }
  575. if( cur == NULL )
  576. cur = fallback;
  577. /* Do not update ssl->handshake->key_cert unless there is a match */
  578. if( cur != NULL )
  579. {
  580. ssl->handshake->key_cert = cur;
  581. MBEDTLS_SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
  582. ssl->handshake->key_cert->cert );
  583. return( 0 );
  584. }
  585. return( -1 );
  586. }
  587. #endif /* MBEDTLS_X509_CRT_PARSE_C */
  588. /*
  589. * Check if a given ciphersuite is suitable for use with our config/keys/etc
  590. * Sets ciphersuite_info only if the suite matches.
  591. */
  592. static int ssl_ciphersuite_match( mbedtls_ssl_context *ssl, int suite_id,
  593. const mbedtls_ssl_ciphersuite_t **ciphersuite_info )
  594. {
  595. const mbedtls_ssl_ciphersuite_t *suite_info;
  596. suite_info = mbedtls_ssl_ciphersuite_from_id( suite_id );
  597. if( suite_info == NULL )
  598. {
  599. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  600. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  601. }
  602. MBEDTLS_SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
  603. if( suite_info->min_minor_ver > ssl->minor_ver ||
  604. suite_info->max_minor_ver < ssl->minor_ver )
  605. {
  606. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
  607. return( 0 );
  608. }
  609. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  610. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  611. ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
  612. return( 0 );
  613. #endif
  614. #if defined(MBEDTLS_ARC4_C)
  615. if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
  616. suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
  617. {
  618. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
  619. return( 0 );
  620. }
  621. #endif
  622. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  623. if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
  624. ( ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK ) == 0 )
  625. {
  626. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: ecjpake "
  627. "not configured or ext missing" ) );
  628. return( 0 );
  629. }
  630. #endif
  631. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
  632. if( mbedtls_ssl_ciphersuite_uses_ec( suite_info ) &&
  633. ( ssl->handshake->curves == NULL ||
  634. ssl->handshake->curves[0] == NULL ) )
  635. {
  636. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
  637. "no common elliptic curve" ) );
  638. return( 0 );
  639. }
  640. #endif
  641. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  642. /* If the ciphersuite requires a pre-shared key and we don't
  643. * have one, skip it now rather than failing later */
  644. if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
  645. ssl->conf->f_psk == NULL &&
  646. ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
  647. ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
  648. {
  649. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
  650. return( 0 );
  651. }
  652. #endif
  653. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  654. /*
  655. * Final check: if ciphersuite requires us to have a
  656. * certificate/key of a particular type:
  657. * - select the appropriate certificate if we have one, or
  658. * - try the next ciphersuite if we don't
  659. * This must be done last since we modify the key_cert list.
  660. */
  661. if( ssl_pick_cert( ssl, suite_info ) != 0 )
  662. {
  663. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
  664. "no suitable certificate" ) );
  665. return( 0 );
  666. }
  667. #endif
  668. *ciphersuite_info = suite_info;
  669. return( 0 );
  670. }
  671. #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
  672. static int ssl_parse_client_hello_v2( mbedtls_ssl_context *ssl )
  673. {
  674. int ret, got_common_suite;
  675. unsigned int i, j;
  676. size_t n;
  677. unsigned int ciph_len, sess_len, chal_len;
  678. unsigned char *buf, *p;
  679. const int *ciphersuites;
  680. const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  681. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
  682. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  683. if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  684. {
  685. MBEDTLS_SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
  686. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  687. return( ret );
  688. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  689. }
  690. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  691. buf = ssl->in_hdr;
  692. MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, 5 );
  693. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
  694. buf[2] ) );
  695. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
  696. ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
  697. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
  698. buf[3], buf[4] ) );
  699. /*
  700. * SSLv2 Client Hello
  701. *
  702. * Record layer:
  703. * 0 . 1 message length
  704. *
  705. * SSL layer:
  706. * 2 . 2 message type
  707. * 3 . 4 protocol version
  708. */
  709. if( buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO ||
  710. buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3 )
  711. {
  712. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  713. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  714. }
  715. n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
  716. if( n < 17 || n > 512 )
  717. {
  718. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  719. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  720. }
  721. ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
  722. ssl->minor_ver = ( buf[4] <= ssl->conf->max_minor_ver )
  723. ? buf[4] : ssl->conf->max_minor_ver;
  724. if( ssl->minor_ver < ssl->conf->min_minor_ver )
  725. {
  726. MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
  727. " [%d:%d] < [%d:%d]",
  728. ssl->major_ver, ssl->minor_ver,
  729. ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
  730. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  731. MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
  732. return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
  733. }
  734. ssl->handshake->max_major_ver = buf[3];
  735. ssl->handshake->max_minor_ver = buf[4];
  736. if( ( ret = mbedtls_ssl_fetch_input( ssl, 2 + n ) ) != 0 )
  737. {
  738. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
  739. return( ret );
  740. }
  741. ssl->handshake->update_checksum( ssl, buf + 2, n );
  742. buf = ssl->in_msg;
  743. n = ssl->in_left - 5;
  744. /*
  745. * 0 . 1 ciphersuitelist length
  746. * 2 . 3 session id length
  747. * 4 . 5 challenge length
  748. * 6 . .. ciphersuitelist
  749. * .. . .. session id
  750. * .. . .. challenge
  751. */
  752. MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, n );
  753. ciph_len = ( buf[0] << 8 ) | buf[1];
  754. sess_len = ( buf[2] << 8 ) | buf[3];
  755. chal_len = ( buf[4] << 8 ) | buf[5];
  756. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
  757. ciph_len, sess_len, chal_len ) );
  758. /*
  759. * Make sure each parameter length is valid
  760. */
  761. if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
  762. {
  763. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  764. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  765. }
  766. if( sess_len > 32 )
  767. {
  768. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  769. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  770. }
  771. if( chal_len < 8 || chal_len > 32 )
  772. {
  773. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  774. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  775. }
  776. if( n != 6 + ciph_len + sess_len + chal_len )
  777. {
  778. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  779. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  780. }
  781. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
  782. buf + 6, ciph_len );
  783. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id",
  784. buf + 6 + ciph_len, sess_len );
  785. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, challenge",
  786. buf + 6 + ciph_len + sess_len, chal_len );
  787. p = buf + 6 + ciph_len;
  788. ssl->session_negotiate->id_len = sess_len;
  789. memset( ssl->session_negotiate->id, 0,
  790. sizeof( ssl->session_negotiate->id ) );
  791. memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->id_len );
  792. p += sess_len;
  793. memset( ssl->handshake->randbytes, 0, 64 );
  794. memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
  795. /*
  796. * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  797. */
  798. for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
  799. {
  800. if( p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
  801. {
  802. MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
  803. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  804. if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  805. {
  806. MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
  807. "during renegotiation" ) );
  808. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  809. return( ret );
  810. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  811. }
  812. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  813. ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
  814. break;
  815. }
  816. }
  817. #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
  818. for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
  819. {
  820. if( p[0] == 0 &&
  821. p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
  822. p[2] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
  823. {
  824. MBEDTLS_SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
  825. if( ssl->minor_ver < ssl->conf->max_minor_ver )
  826. {
  827. MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
  828. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  829. MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
  830. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  831. }
  832. break;
  833. }
  834. }
  835. #endif /* MBEDTLS_SSL_FALLBACK_SCSV */
  836. got_common_suite = 0;
  837. ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
  838. ciphersuite_info = NULL;
  839. #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
  840. for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
  841. {
  842. for( i = 0; ciphersuites[i] != 0; i++ )
  843. #else
  844. for( i = 0; ciphersuites[i] != 0; i++ )
  845. {
  846. for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
  847. #endif
  848. {
  849. if( p[0] != 0 ||
  850. p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
  851. p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
  852. continue;
  853. got_common_suite = 1;
  854. if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
  855. &ciphersuite_info ) ) != 0 )
  856. return( ret );
  857. if( ciphersuite_info != NULL )
  858. goto have_ciphersuite_v2;
  859. }
  860. }
  861. if( got_common_suite )
  862. {
  863. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
  864. "but none of them usable" ) );
  865. return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
  866. }
  867. else
  868. {
  869. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
  870. return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
  871. }
  872. have_ciphersuite_v2:
  873. MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
  874. ssl->session_negotiate->ciphersuite = ciphersuites[i];
  875. ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
  876. /*
  877. * SSLv2 Client Hello relevant renegotiation security checks
  878. */
  879. if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  880. ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
  881. {
  882. MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
  883. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  884. return( ret );
  885. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  886. }
  887. ssl->in_left = 0;
  888. ssl->state++;
  889. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
  890. return( 0 );
  891. }
  892. #endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
  893. static int ssl_parse_client_hello( mbedtls_ssl_context *ssl )
  894. {
  895. int ret, got_common_suite;
  896. size_t i, j;
  897. size_t ciph_offset, comp_offset, ext_offset;
  898. size_t msg_len, ciph_len, sess_len, comp_len, ext_len;
  899. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  900. size_t cookie_offset, cookie_len;
  901. #endif
  902. unsigned char *buf, *p, *ext;
  903. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  904. int renegotiation_info_seen = 0;
  905. #endif
  906. int handshake_failure = 0;
  907. const int *ciphersuites;
  908. const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  909. int major, minor;
  910. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
  911. #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
  912. read_record_header:
  913. #endif
  914. /*
  915. * If renegotiating, then the input was read with mbedtls_ssl_read_record(),
  916. * otherwise read it ourselves manually in order to support SSLv2
  917. * ClientHello, which doesn't use the same record layer format.
  918. */
  919. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  920. if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  921. #endif
  922. {
  923. if( ( ret = mbedtls_ssl_fetch_input( ssl, 5 ) ) != 0 )
  924. {
  925. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
  926. return( ret );
  927. }
  928. }
  929. buf = ssl->in_hdr;
  930. #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
  931. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  932. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM )
  933. #endif
  934. if( ( buf[0] & 0x80 ) != 0 )
  935. return ssl_parse_client_hello_v2( ssl );
  936. #endif
  937. MBEDTLS_SSL_DEBUG_BUF( 4, "record header", buf, mbedtls_ssl_hdr_len( ssl ) );
  938. /*
  939. * SSLv3/TLS Client Hello
  940. *
  941. * Record layer:
  942. * 0 . 0 message type
  943. * 1 . 2 protocol version
  944. * 3 . 11 DTLS: epoch + record sequence number
  945. * 3 . 4 message length
  946. */
  947. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
  948. buf[0] ) );
  949. if( buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE )
  950. {
  951. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  952. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  953. }
  954. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
  955. ( ssl->in_len[0] << 8 ) | ssl->in_len[1] ) );
  956. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, protocol version: [%d:%d]",
  957. buf[1], buf[2] ) );
  958. mbedtls_ssl_read_version( &major, &minor, ssl->conf->transport, buf + 1 );
  959. /* According to RFC 5246 Appendix E.1, the version here is typically
  960. * "{03,00}, the lowest version number supported by the client, [or] the
  961. * value of ClientHello.client_version", so the only meaningful check here
  962. * is the major version shouldn't be less than 3 */
  963. if( major < MBEDTLS_SSL_MAJOR_VERSION_3 )
  964. {
  965. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  966. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  967. }
  968. /* For DTLS if this is the initial handshake, remember the client sequence
  969. * number to use it in our next message (RFC 6347 4.2.1) */
  970. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  971. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM
  972. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  973. && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
  974. #endif
  975. )
  976. {
  977. /* Epoch should be 0 for initial handshakes */
  978. if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )
  979. {
  980. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  981. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  982. }
  983. memcpy( ssl->out_ctr + 2, ssl->in_ctr + 2, 6 );
  984. #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
  985. if( mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
  986. {
  987. MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record, discarding" ) );
  988. ssl->next_record_offset = 0;
  989. ssl->in_left = 0;
  990. goto read_record_header;
  991. }
  992. /* No MAC to check yet, so we can update right now */
  993. mbedtls_ssl_dtls_replay_update( ssl );
  994. #endif
  995. }
  996. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  997. msg_len = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
  998. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  999. if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  1000. {
  1001. /* Set by mbedtls_ssl_read_record() */
  1002. msg_len = ssl->in_hslen;
  1003. }
  1004. else
  1005. #endif
  1006. {
  1007. if( msg_len > MBEDTLS_SSL_MAX_CONTENT_LEN )
  1008. {
  1009. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1010. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1011. }
  1012. if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
  1013. {
  1014. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
  1015. return( ret );
  1016. }
  1017. /* Done reading this record, get ready for the next one */
  1018. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1019. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1020. ssl->next_record_offset = msg_len + mbedtls_ssl_hdr_len( ssl );
  1021. else
  1022. #endif
  1023. ssl->in_left = 0;
  1024. }
  1025. buf = ssl->in_msg;
  1026. MBEDTLS_SSL_DEBUG_BUF( 4, "record contents", buf, msg_len );
  1027. ssl->handshake->update_checksum( ssl, buf, msg_len );
  1028. /*
  1029. * Handshake layer:
  1030. * 0 . 0 handshake type
  1031. * 1 . 3 handshake length
  1032. * 4 . 5 DTLS only: message seqence number
  1033. * 6 . 8 DTLS only: fragment offset
  1034. * 9 . 11 DTLS only: fragment length
  1035. */
  1036. if( msg_len < mbedtls_ssl_hs_hdr_len( ssl ) )
  1037. {
  1038. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1039. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1040. }
  1041. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d", buf[0] ) );
  1042. if( buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
  1043. {
  1044. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1045. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1046. }
  1047. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
  1048. ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
  1049. /* We don't support fragmentation of ClientHello (yet?) */
  1050. if( buf[1] != 0 ||
  1051. msg_len != mbedtls_ssl_hs_hdr_len( ssl ) + ( ( buf[2] << 8 ) | buf[3] ) )
  1052. {
  1053. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1054. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1055. }
  1056. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1057. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1058. {
  1059. /*
  1060. * Copy the client's handshake message_seq on initial handshakes,
  1061. * check sequence number on renego.
  1062. */
  1063. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1064. if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  1065. {
  1066. /* This couldn't be done in ssl_prepare_handshake_record() */
  1067. unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
  1068. ssl->in_msg[5];
  1069. if( cli_msg_seq != ssl->handshake->in_msg_seq )
  1070. {
  1071. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message_seq: "
  1072. "%d (expected %d)", cli_msg_seq,
  1073. ssl->handshake->in_msg_seq ) );
  1074. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1075. }
  1076. ssl->handshake->in_msg_seq++;
  1077. }
  1078. else
  1079. #endif
  1080. {
  1081. unsigned int cli_msg_seq = ( ssl->in_msg[4] << 8 ) |
  1082. ssl->in_msg[5];
  1083. ssl->handshake->out_msg_seq = cli_msg_seq;
  1084. ssl->handshake->in_msg_seq = cli_msg_seq + 1;
  1085. }
  1086. /*
  1087. * For now we don't support fragmentation, so make sure
  1088. * fragment_offset == 0 and fragment_length == length
  1089. */
  1090. if( ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 ||
  1091. memcmp( ssl->in_msg + 1, ssl->in_msg + 9, 3 ) != 0 )
  1092. {
  1093. MBEDTLS_SSL_DEBUG_MSG( 1, ( "ClientHello fragmentation not supported" ) );
  1094. return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
  1095. }
  1096. }
  1097. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1098. buf += mbedtls_ssl_hs_hdr_len( ssl );
  1099. msg_len -= mbedtls_ssl_hs_hdr_len( ssl );
  1100. /*
  1101. * ClientHello layer:
  1102. * 0 . 1 protocol version
  1103. * 2 . 33 random bytes (starting with 4 bytes of Unix time)
  1104. * 34 . 35 session id length (1 byte)
  1105. * 35 . 34+x session id
  1106. * 35+x . 35+x DTLS only: cookie length (1 byte)
  1107. * 36+x . .. DTLS only: cookie
  1108. * .. . .. ciphersuite list length (2 bytes)
  1109. * .. . .. ciphersuite list
  1110. * .. . .. compression alg. list length (1 byte)
  1111. * .. . .. compression alg. list
  1112. * .. . .. extensions length (2 bytes, optional)
  1113. * .. . .. extensions (optional)
  1114. */
  1115. /*
  1116. * Minimal length (with everything empty and extensions ommitted) is
  1117. * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can
  1118. * read at least up to session id length without worrying.
  1119. */
  1120. if( msg_len < 38 )
  1121. {
  1122. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1123. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1124. }
  1125. /*
  1126. * Check and save the protocol version
  1127. */
  1128. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, version", buf, 2 );
  1129. mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
  1130. ssl->conf->transport, buf );
  1131. ssl->handshake->max_major_ver = ssl->major_ver;
  1132. ssl->handshake->max_minor_ver = ssl->minor_ver;
  1133. if( ssl->major_ver < ssl->conf->min_major_ver ||
  1134. ssl->minor_ver < ssl->conf->min_minor_ver )
  1135. {
  1136. MBEDTLS_SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
  1137. " [%d:%d] < [%d:%d]",
  1138. ssl->major_ver, ssl->minor_ver,
  1139. ssl->conf->min_major_ver, ssl->conf->min_minor_ver ) );
  1140. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1141. MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
  1142. return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
  1143. }
  1144. if( ssl->major_ver > ssl->conf->max_major_ver )
  1145. {
  1146. ssl->major_ver = ssl->conf->max_major_ver;
  1147. ssl->minor_ver = ssl->conf->max_minor_ver;
  1148. }
  1149. else if( ssl->minor_ver > ssl->conf->max_minor_ver )
  1150. ssl->minor_ver = ssl->conf->max_minor_ver;
  1151. /*
  1152. * Save client random (inc. Unix time)
  1153. */
  1154. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 2, 32 );
  1155. memcpy( ssl->handshake->randbytes, buf + 2, 32 );
  1156. /*
  1157. * Check the session ID length and save session ID
  1158. */
  1159. sess_len = buf[34];
  1160. if( sess_len > sizeof( ssl->session_negotiate->id ) ||
  1161. sess_len + 34 + 2 > msg_len ) /* 2 for cipherlist length field */
  1162. {
  1163. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1164. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1165. }
  1166. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 35, sess_len );
  1167. ssl->session_negotiate->id_len = sess_len;
  1168. memset( ssl->session_negotiate->id, 0,
  1169. sizeof( ssl->session_negotiate->id ) );
  1170. memcpy( ssl->session_negotiate->id, buf + 35,
  1171. ssl->session_negotiate->id_len );
  1172. /*
  1173. * Check the cookie length and content
  1174. */
  1175. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1176. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1177. {
  1178. cookie_offset = 35 + sess_len;
  1179. cookie_len = buf[cookie_offset];
  1180. if( cookie_offset + 1 + cookie_len + 2 > msg_len )
  1181. {
  1182. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1183. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1184. }
  1185. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
  1186. buf + cookie_offset + 1, cookie_len );
  1187. #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
  1188. if( ssl->conf->f_cookie_check != NULL
  1189. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1190. && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE
  1191. #endif
  1192. )
  1193. {
  1194. if( ssl->conf->f_cookie_check( ssl->conf->p_cookie,
  1195. buf + cookie_offset + 1, cookie_len,
  1196. ssl->cli_id, ssl->cli_id_len ) != 0 )
  1197. {
  1198. MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification failed" ) );
  1199. ssl->handshake->verify_cookie_len = 1;
  1200. }
  1201. else
  1202. {
  1203. MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification passed" ) );
  1204. ssl->handshake->verify_cookie_len = 0;
  1205. }
  1206. }
  1207. else
  1208. #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
  1209. {
  1210. /* We know we didn't send a cookie, so it should be empty */
  1211. if( cookie_len != 0 )
  1212. {
  1213. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1214. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1215. }
  1216. MBEDTLS_SSL_DEBUG_MSG( 2, ( "cookie verification skipped" ) );
  1217. }
  1218. /*
  1219. * Check the ciphersuitelist length (will be parsed later)
  1220. */
  1221. ciph_offset = cookie_offset + 1 + cookie_len;
  1222. }
  1223. else
  1224. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1225. ciph_offset = 35 + sess_len;
  1226. ciph_len = ( buf[ciph_offset + 0] << 8 )
  1227. | ( buf[ciph_offset + 1] );
  1228. if( ciph_len < 2 ||
  1229. ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */
  1230. ( ciph_len % 2 ) != 0 )
  1231. {
  1232. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1233. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1234. }
  1235. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
  1236. buf + ciph_offset + 2, ciph_len );
  1237. /*
  1238. * Check the compression algorithms length and pick one
  1239. */
  1240. comp_offset = ciph_offset + 2 + ciph_len;
  1241. comp_len = buf[comp_offset];
  1242. if( comp_len < 1 ||
  1243. comp_len > 16 ||
  1244. comp_len + comp_offset + 1 > msg_len )
  1245. {
  1246. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1247. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1248. }
  1249. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, compression",
  1250. buf + comp_offset + 1, comp_len );
  1251. ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
  1252. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1253. for( i = 0; i < comp_len; ++i )
  1254. {
  1255. if( buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE )
  1256. {
  1257. ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE;
  1258. break;
  1259. }
  1260. }
  1261. #endif
  1262. /* See comments in ssl_write_client_hello() */
  1263. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1264. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1265. ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL;
  1266. #endif
  1267. /* Do not parse the extensions if the protocol is SSLv3 */
  1268. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  1269. if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
  1270. {
  1271. #endif
  1272. /*
  1273. * Check the extension length
  1274. */
  1275. ext_offset = comp_offset + 1 + comp_len;
  1276. if( msg_len > ext_offset )
  1277. {
  1278. if( msg_len < ext_offset + 2 )
  1279. {
  1280. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1281. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1282. }
  1283. ext_len = ( buf[ext_offset + 0] << 8 )
  1284. | ( buf[ext_offset + 1] );
  1285. if( ( ext_len > 0 && ext_len < 4 ) ||
  1286. msg_len != ext_offset + 2 + ext_len )
  1287. {
  1288. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1289. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1290. }
  1291. }
  1292. else
  1293. ext_len = 0;
  1294. ext = buf + ext_offset + 2;
  1295. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello extensions", ext, ext_len );
  1296. while( ext_len != 0 )
  1297. {
  1298. unsigned int ext_id = ( ( ext[0] << 8 )
  1299. | ( ext[1] ) );
  1300. unsigned int ext_size = ( ( ext[2] << 8 )
  1301. | ( ext[3] ) );
  1302. if( ext_size + 4 > ext_len )
  1303. {
  1304. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1305. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1306. }
  1307. switch( ext_id )
  1308. {
  1309. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  1310. case MBEDTLS_TLS_EXT_SERVERNAME:
  1311. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
  1312. if( ssl->conf->f_sni == NULL )
  1313. break;
  1314. ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
  1315. if( ret != 0 )
  1316. return( ret );
  1317. break;
  1318. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  1319. case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
  1320. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
  1321. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1322. renegotiation_info_seen = 1;
  1323. #endif
  1324. ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
  1325. if( ret != 0 )
  1326. return( ret );
  1327. break;
  1328. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  1329. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  1330. case MBEDTLS_TLS_EXT_SIG_ALG:
  1331. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
  1332. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1333. if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  1334. break;
  1335. #endif
  1336. ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
  1337. if( ret != 0 )
  1338. return( ret );
  1339. break;
  1340. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  1341. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  1342. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1343. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1344. case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
  1345. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
  1346. ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
  1347. if( ret != 0 )
  1348. return( ret );
  1349. break;
  1350. case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
  1351. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
  1352. ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
  1353. ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
  1354. if( ret != 0 )
  1355. return( ret );
  1356. break;
  1357. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  1358. MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1359. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1360. case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
  1361. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake kkpp extension" ) );
  1362. ret = ssl_parse_ecjpake_kkpp( ssl, ext + 4, ext_size );
  1363. if( ret != 0 )
  1364. return( ret );
  1365. break;
  1366. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1367. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1368. case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
  1369. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
  1370. ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
  1371. if( ret != 0 )
  1372. return( ret );
  1373. break;
  1374. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  1375. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1376. case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
  1377. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
  1378. ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
  1379. if( ret != 0 )
  1380. return( ret );
  1381. break;
  1382. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  1383. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1384. case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
  1385. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
  1386. ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
  1387. if( ret != 0 )
  1388. return( ret );
  1389. break;
  1390. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  1391. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1392. case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
  1393. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
  1394. ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
  1395. if( ret != 0 )
  1396. return( ret );
  1397. break;
  1398. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  1399. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1400. case MBEDTLS_TLS_EXT_SESSION_TICKET:
  1401. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
  1402. ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
  1403. if( ret != 0 )
  1404. return( ret );
  1405. break;
  1406. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1407. #if defined(MBEDTLS_SSL_ALPN)
  1408. case MBEDTLS_TLS_EXT_ALPN:
  1409. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
  1410. ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
  1411. if( ret != 0 )
  1412. return( ret );
  1413. break;
  1414. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1415. default:
  1416. MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
  1417. ext_id ) );
  1418. }
  1419. ext_len -= 4 + ext_size;
  1420. ext += 4 + ext_size;
  1421. if( ext_len > 0 && ext_len < 4 )
  1422. {
  1423. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
  1424. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1425. }
  1426. }
  1427. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  1428. }
  1429. #endif
  1430. #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
  1431. for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
  1432. {
  1433. if( p[0] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 ) & 0xff ) &&
  1434. p[1] == (unsigned char)( ( MBEDTLS_SSL_FALLBACK_SCSV_VALUE ) & 0xff ) )
  1435. {
  1436. MBEDTLS_SSL_DEBUG_MSG( 2, ( "received FALLBACK_SCSV" ) );
  1437. if( ssl->minor_ver < ssl->conf->max_minor_ver )
  1438. {
  1439. MBEDTLS_SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
  1440. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1441. MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
  1442. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1443. }
  1444. break;
  1445. }
  1446. }
  1447. #endif /* MBEDTLS_SSL_FALLBACK_SCSV */
  1448. /*
  1449. * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  1450. */
  1451. for( i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2 )
  1452. {
  1453. if( p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO )
  1454. {
  1455. MBEDTLS_SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
  1456. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1457. if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  1458. {
  1459. MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
  1460. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  1461. return( ret );
  1462. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1463. }
  1464. #endif
  1465. ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
  1466. break;
  1467. }
  1468. }
  1469. /*
  1470. * Renegotiation security checks
  1471. */
  1472. if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION &&
  1473. ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
  1474. {
  1475. MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
  1476. handshake_failure = 1;
  1477. }
  1478. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1479. else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1480. ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
  1481. renegotiation_info_seen == 0 )
  1482. {
  1483. MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
  1484. handshake_failure = 1;
  1485. }
  1486. else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1487. ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1488. ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
  1489. {
  1490. MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
  1491. handshake_failure = 1;
  1492. }
  1493. else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1494. ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1495. renegotiation_info_seen == 1 )
  1496. {
  1497. MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
  1498. handshake_failure = 1;
  1499. }
  1500. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1501. if( handshake_failure == 1 )
  1502. {
  1503. if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
  1504. return( ret );
  1505. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
  1506. }
  1507. /*
  1508. * Search for a matching ciphersuite
  1509. * (At the end because we need information from the EC-based extensions
  1510. * and certificate from the SNI callback triggered by the SNI extension.)
  1511. */
  1512. got_common_suite = 0;
  1513. ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
  1514. ciphersuite_info = NULL;
  1515. #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
  1516. for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
  1517. {
  1518. for( i = 0; ciphersuites[i] != 0; i++ )
  1519. #else
  1520. for( i = 0; ciphersuites[i] != 0; i++ )
  1521. {
  1522. for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
  1523. #endif
  1524. {
  1525. if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
  1526. p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
  1527. continue;
  1528. got_common_suite = 1;
  1529. if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
  1530. &ciphersuite_info ) ) != 0 )
  1531. return( ret );
  1532. if( ciphersuite_info != NULL )
  1533. goto have_ciphersuite;
  1534. }
  1535. }
  1536. if( got_common_suite )
  1537. {
  1538. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
  1539. "but none of them usable" ) );
  1540. mbedtls_ssl_send_fatal_handshake_failure( ssl );
  1541. return( MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE );
  1542. }
  1543. else
  1544. {
  1545. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
  1546. mbedtls_ssl_send_fatal_handshake_failure( ssl );
  1547. return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
  1548. }
  1549. have_ciphersuite:
  1550. MBEDTLS_SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
  1551. ssl->session_negotiate->ciphersuite = ciphersuites[i];
  1552. ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
  1553. ssl->state++;
  1554. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1555. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1556. mbedtls_ssl_recv_flight_completed( ssl );
  1557. #endif
  1558. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
  1559. return( 0 );
  1560. }
  1561. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1562. static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
  1563. unsigned char *buf,
  1564. size_t *olen )
  1565. {
  1566. unsigned char *p = buf;
  1567. if( ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
  1568. {
  1569. *olen = 0;
  1570. return;
  1571. }
  1572. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
  1573. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
  1574. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
  1575. *p++ = 0x00;
  1576. *p++ = 0x00;
  1577. *olen = 4;
  1578. }
  1579. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  1580. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1581. static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
  1582. unsigned char *buf,
  1583. size_t *olen )
  1584. {
  1585. unsigned char *p = buf;
  1586. const mbedtls_ssl_ciphersuite_t *suite = NULL;
  1587. const mbedtls_cipher_info_t *cipher = NULL;
  1588. if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
  1589. ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
  1590. {
  1591. *olen = 0;
  1592. return;
  1593. }
  1594. /*
  1595. * RFC 7366: "If a server receives an encrypt-then-MAC request extension
  1596. * from a client and then selects a stream or Authenticated Encryption
  1597. * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
  1598. * encrypt-then-MAC response extension back to the client."
  1599. */
  1600. if( ( suite = mbedtls_ssl_ciphersuite_from_id(
  1601. ssl->session_negotiate->ciphersuite ) ) == NULL ||
  1602. ( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
  1603. cipher->mode != MBEDTLS_MODE_CBC )
  1604. {
  1605. *olen = 0;
  1606. return;
  1607. }
  1608. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
  1609. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
  1610. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
  1611. *p++ = 0x00;
  1612. *p++ = 0x00;
  1613. *olen = 4;
  1614. }
  1615. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  1616. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1617. static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
  1618. unsigned char *buf,
  1619. size_t *olen )
  1620. {
  1621. unsigned char *p = buf;
  1622. if( ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
  1623. ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
  1624. {
  1625. *olen = 0;
  1626. return;
  1627. }
  1628. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
  1629. "extension" ) );
  1630. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
  1631. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
  1632. *p++ = 0x00;
  1633. *p++ = 0x00;
  1634. *olen = 4;
  1635. }
  1636. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  1637. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1638. static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
  1639. unsigned char *buf,
  1640. size_t *olen )
  1641. {
  1642. unsigned char *p = buf;
  1643. if( ssl->handshake->new_session_ticket == 0 )
  1644. {
  1645. *olen = 0;
  1646. return;
  1647. }
  1648. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
  1649. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
  1650. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
  1651. *p++ = 0x00;
  1652. *p++ = 0x00;
  1653. *olen = 4;
  1654. }
  1655. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1656. static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
  1657. unsigned char *buf,
  1658. size_t *olen )
  1659. {
  1660. unsigned char *p = buf;
  1661. if( ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION )
  1662. {
  1663. *olen = 0;
  1664. return;
  1665. }
  1666. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
  1667. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
  1668. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
  1669. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1670. if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  1671. {
  1672. *p++ = 0x00;
  1673. *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
  1674. *p++ = ssl->verify_data_len * 2 & 0xFF;
  1675. memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
  1676. p += ssl->verify_data_len;
  1677. memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
  1678. p += ssl->verify_data_len;
  1679. }
  1680. else
  1681. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1682. {
  1683. *p++ = 0x00;
  1684. *p++ = 0x01;
  1685. *p++ = 0x00;
  1686. }
  1687. *olen = p - buf;
  1688. }
  1689. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1690. static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
  1691. unsigned char *buf,
  1692. size_t *olen )
  1693. {
  1694. unsigned char *p = buf;
  1695. if( ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
  1696. {
  1697. *olen = 0;
  1698. return;
  1699. }
  1700. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
  1701. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
  1702. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
  1703. *p++ = 0x00;
  1704. *p++ = 1;
  1705. *p++ = ssl->session_negotiate->mfl_code;
  1706. *olen = 5;
  1707. }
  1708. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  1709. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1710. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1711. static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
  1712. unsigned char *buf,
  1713. size_t *olen )
  1714. {
  1715. unsigned char *p = buf;
  1716. ((void) ssl);
  1717. if( ( ssl->handshake->cli_exts &
  1718. MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
  1719. {
  1720. *olen = 0;
  1721. return;
  1722. }
  1723. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
  1724. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
  1725. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
  1726. *p++ = 0x00;
  1727. *p++ = 2;
  1728. *p++ = 1;
  1729. *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
  1730. *olen = 6;
  1731. }
  1732. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1733. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1734. static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
  1735. unsigned char *buf,
  1736. size_t *olen )
  1737. {
  1738. int ret;
  1739. unsigned char *p = buf;
  1740. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  1741. size_t kkpp_len;
  1742. *olen = 0;
  1743. /* Skip costly computation if not needed */
  1744. if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
  1745. MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  1746. return;
  1747. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, ecjpake kkpp extension" ) );
  1748. if( end - p < 4 )
  1749. {
  1750. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  1751. return;
  1752. }
  1753. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
  1754. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
  1755. ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
  1756. p + 2, end - p - 2, &kkpp_len,
  1757. ssl->conf->f_rng, ssl->conf->p_rng );
  1758. if( ret != 0 )
  1759. {
  1760. MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
  1761. return;
  1762. }
  1763. *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
  1764. *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
  1765. *olen = kkpp_len + 4;
  1766. }
  1767. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1768. #if defined(MBEDTLS_SSL_ALPN )
  1769. static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
  1770. unsigned char *buf, size_t *olen )
  1771. {
  1772. if( ssl->alpn_chosen == NULL )
  1773. {
  1774. *olen = 0;
  1775. return;
  1776. }
  1777. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
  1778. /*
  1779. * 0 . 1 ext identifier
  1780. * 2 . 3 ext length
  1781. * 4 . 5 protocol list length
  1782. * 6 . 6 protocol name length
  1783. * 7 . 7+n protocol name
  1784. */
  1785. buf[0] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
  1786. buf[1] = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
  1787. *olen = 7 + strlen( ssl->alpn_chosen );
  1788. buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
  1789. buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
  1790. buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
  1791. buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
  1792. buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
  1793. memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
  1794. }
  1795. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */
  1796. #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
  1797. static int ssl_write_hello_verify_request( mbedtls_ssl_context *ssl )
  1798. {
  1799. int ret;
  1800. unsigned char *p = ssl->out_msg + 4;
  1801. unsigned char *cookie_len_byte;
  1802. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write hello verify request" ) );
  1803. /*
  1804. * struct {
  1805. * ProtocolVersion server_version;
  1806. * opaque cookie<0..2^8-1>;
  1807. * } HelloVerifyRequest;
  1808. */
  1809. /* The RFC is not clear on this point, but sending the actual negotiated
  1810. * version looks like the most interoperable thing to do. */
  1811. mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
  1812. ssl->conf->transport, p );
  1813. MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
  1814. p += 2;
  1815. /* If we get here, f_cookie_check is not null */
  1816. if( ssl->conf->f_cookie_write == NULL )
  1817. {
  1818. MBEDTLS_SSL_DEBUG_MSG( 1, ( "inconsistent cookie callbacks" ) );
  1819. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  1820. }
  1821. /* Skip length byte until we know the length */
  1822. cookie_len_byte = p++;
  1823. if( ( ret = ssl->conf->f_cookie_write( ssl->conf->p_cookie,
  1824. &p, ssl->out_buf + MBEDTLS_SSL_BUFFER_LEN,
  1825. ssl->cli_id, ssl->cli_id_len ) ) != 0 )
  1826. {
  1827. MBEDTLS_SSL_DEBUG_RET( 1, "f_cookie_write", ret );
  1828. return( ret );
  1829. }
  1830. *cookie_len_byte = (unsigned char)( p - ( cookie_len_byte + 1 ) );
  1831. MBEDTLS_SSL_DEBUG_BUF( 3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte );
  1832. ssl->out_msglen = p - ssl->out_msg;
  1833. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  1834. ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST;
  1835. ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT;
  1836. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  1837. {
  1838. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  1839. return( ret );
  1840. }
  1841. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write hello verify request" ) );
  1842. return( 0 );
  1843. }
  1844. #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
  1845. static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
  1846. {
  1847. #if defined(MBEDTLS_HAVE_TIME)
  1848. mbedtls_time_t t;
  1849. #endif
  1850. int ret;
  1851. size_t olen, ext_len = 0, n;
  1852. unsigned char *buf, *p;
  1853. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
  1854. #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
  1855. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  1856. ssl->handshake->verify_cookie_len != 0 )
  1857. {
  1858. MBEDTLS_SSL_DEBUG_MSG( 2, ( "client hello was not authenticated" ) );
  1859. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
  1860. return( ssl_write_hello_verify_request( ssl ) );
  1861. }
  1862. #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */
  1863. if( ssl->conf->f_rng == NULL )
  1864. {
  1865. MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
  1866. return( MBEDTLS_ERR_SSL_NO_RNG );
  1867. }
  1868. /*
  1869. * 0 . 0 handshake type
  1870. * 1 . 3 handshake length
  1871. * 4 . 5 protocol version
  1872. * 6 . 9 UNIX time()
  1873. * 10 . 37 random bytes
  1874. */
  1875. buf = ssl->out_msg;
  1876. p = buf + 4;
  1877. mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
  1878. ssl->conf->transport, p );
  1879. p += 2;
  1880. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
  1881. buf[4], buf[5] ) );
  1882. #if defined(MBEDTLS_HAVE_TIME)
  1883. t = mbedtls_time( NULL );
  1884. *p++ = (unsigned char)( t >> 24 );
  1885. *p++ = (unsigned char)( t >> 16 );
  1886. *p++ = (unsigned char)( t >> 8 );
  1887. *p++ = (unsigned char)( t );
  1888. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
  1889. #else
  1890. if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
  1891. return( ret );
  1892. p += 4;
  1893. #endif /* MBEDTLS_HAVE_TIME */
  1894. if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
  1895. return( ret );
  1896. p += 28;
  1897. memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
  1898. MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
  1899. /*
  1900. * Resume is 0 by default, see ssl_handshake_init().
  1901. * It may be already set to 1 by ssl_parse_session_ticket_ext().
  1902. * If not, try looking up session ID in our cache.
  1903. */
  1904. if( ssl->handshake->resume == 0 &&
  1905. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1906. ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE &&
  1907. #endif
  1908. ssl->session_negotiate->id_len != 0 &&
  1909. ssl->conf->f_get_cache != NULL &&
  1910. ssl->conf->f_get_cache( ssl->conf->p_cache, ssl->session_negotiate ) == 0 )
  1911. {
  1912. MBEDTLS_SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
  1913. ssl->handshake->resume = 1;
  1914. }
  1915. if( ssl->handshake->resume == 0 )
  1916. {
  1917. /*
  1918. * New session, create a new session id,
  1919. * unless we're about to issue a session ticket
  1920. */
  1921. ssl->state++;
  1922. #if defined(MBEDTLS_HAVE_TIME)
  1923. ssl->session_negotiate->start = mbedtls_time( NULL );
  1924. #endif
  1925. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1926. if( ssl->handshake->new_session_ticket != 0 )
  1927. {
  1928. ssl->session_negotiate->id_len = n = 0;
  1929. memset( ssl->session_negotiate->id, 0, 32 );
  1930. }
  1931. else
  1932. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1933. {
  1934. ssl->session_negotiate->id_len = n = 32;
  1935. if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id,
  1936. n ) ) != 0 )
  1937. return( ret );
  1938. }
  1939. }
  1940. else
  1941. {
  1942. /*
  1943. * Resuming a session
  1944. */
  1945. n = ssl->session_negotiate->id_len;
  1946. ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
  1947. if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  1948. {
  1949. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  1950. return( ret );
  1951. }
  1952. }
  1953. /*
  1954. * 38 . 38 session id length
  1955. * 39 . 38+n session id
  1956. * 39+n . 40+n chosen ciphersuite
  1957. * 41+n . 41+n chosen compression alg.
  1958. * 42+n . 43+n extensions length
  1959. * 44+n . 43+n+m extensions
  1960. */
  1961. *p++ = (unsigned char) ssl->session_negotiate->id_len;
  1962. memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
  1963. p += ssl->session_negotiate->id_len;
  1964. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
  1965. MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
  1966. MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
  1967. ssl->handshake->resume ? "a" : "no" ) );
  1968. *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
  1969. *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
  1970. *p++ = (unsigned char)( ssl->session_negotiate->compression );
  1971. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
  1972. mbedtls_ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
  1973. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
  1974. ssl->session_negotiate->compression ) );
  1975. /* Do not write the extensions if the protocol is SSLv3 */
  1976. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  1977. if( ( ssl->major_ver != 3 ) || ( ssl->minor_ver != 0 ) )
  1978. {
  1979. #endif
  1980. /*
  1981. * First write extensions, then the total length
  1982. */
  1983. ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
  1984. ext_len += olen;
  1985. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1986. ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
  1987. ext_len += olen;
  1988. #endif
  1989. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1990. ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
  1991. ext_len += olen;
  1992. #endif
  1993. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1994. ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
  1995. ext_len += olen;
  1996. #endif
  1997. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1998. ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
  1999. ext_len += olen;
  2000. #endif
  2001. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  2002. ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
  2003. ext_len += olen;
  2004. #endif
  2005. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  2006. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2007. ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
  2008. ext_len += olen;
  2009. #endif
  2010. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2011. ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
  2012. ext_len += olen;
  2013. #endif
  2014. #if defined(MBEDTLS_SSL_ALPN)
  2015. ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
  2016. ext_len += olen;
  2017. #endif
  2018. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
  2019. if( ext_len > 0 )
  2020. {
  2021. *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
  2022. *p++ = (unsigned char)( ( ext_len ) & 0xFF );
  2023. p += ext_len;
  2024. }
  2025. #if defined(MBEDTLS_SSL_PROTO_SSL3)
  2026. }
  2027. #endif
  2028. ssl->out_msglen = p - buf;
  2029. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  2030. ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO;
  2031. ret = mbedtls_ssl_write_record( ssl );
  2032. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
  2033. return( ret );
  2034. }
  2035. #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
  2036. !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
  2037. !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
  2038. !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
  2039. !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
  2040. !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2041. static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
  2042. {
  2043. const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
  2044. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
  2045. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2046. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  2047. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2048. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2049. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2050. {
  2051. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
  2052. ssl->state++;
  2053. return( 0 );
  2054. }
  2055. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2056. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2057. }
  2058. #else
  2059. static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
  2060. {
  2061. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2062. const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
  2063. size_t dn_size, total_dn_size; /* excluding length bytes */
  2064. size_t ct_len, sa_len; /* including length bytes */
  2065. unsigned char *buf, *p;
  2066. const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  2067. const mbedtls_x509_crt *crt;
  2068. int authmode;
  2069. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
  2070. ssl->state++;
  2071. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  2072. if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
  2073. authmode = ssl->handshake->sni_authmode;
  2074. else
  2075. #endif
  2076. authmode = ssl->conf->authmode;
  2077. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2078. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  2079. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2080. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2081. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
  2082. authmode == MBEDTLS_SSL_VERIFY_NONE )
  2083. {
  2084. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
  2085. return( 0 );
  2086. }
  2087. /*
  2088. * 0 . 0 handshake type
  2089. * 1 . 3 handshake length
  2090. * 4 . 4 cert type count
  2091. * 5 .. m-1 cert types
  2092. * m .. m+1 sig alg length (TLS 1.2 only)
  2093. * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
  2094. * n .. n+1 length of all DNs
  2095. * n+2 .. n+3 length of DN 1
  2096. * n+4 .. ... Distinguished Name #1
  2097. * ... .. ... length of DN 2, etc.
  2098. */
  2099. buf = ssl->out_msg;
  2100. p = buf + 4;
  2101. /*
  2102. * Supported certificate types
  2103. *
  2104. * ClientCertificateType certificate_types<1..2^8-1>;
  2105. * enum { (255) } ClientCertificateType;
  2106. */
  2107. ct_len = 0;
  2108. #if defined(MBEDTLS_RSA_C)
  2109. p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN;
  2110. #endif
  2111. #if defined(MBEDTLS_ECDSA_C)
  2112. p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN;
  2113. #endif
  2114. p[0] = (unsigned char) ct_len++;
  2115. p += ct_len;
  2116. sa_len = 0;
  2117. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2118. /*
  2119. * Add signature_algorithms for verify (TLS 1.2)
  2120. *
  2121. * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
  2122. *
  2123. * struct {
  2124. * HashAlgorithm hash;
  2125. * SignatureAlgorithm signature;
  2126. * } SignatureAndHashAlgorithm;
  2127. *
  2128. * enum { (255) } HashAlgorithm;
  2129. * enum { (255) } SignatureAlgorithm;
  2130. */
  2131. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2132. {
  2133. const int *cur;
  2134. /*
  2135. * Supported signature algorithms
  2136. */
  2137. for( cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++ )
  2138. {
  2139. unsigned char hash = mbedtls_ssl_hash_from_md_alg( *cur );
  2140. if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
  2141. continue;
  2142. #if defined(MBEDTLS_RSA_C)
  2143. p[2 + sa_len++] = hash;
  2144. p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA;
  2145. #endif
  2146. #if defined(MBEDTLS_ECDSA_C)
  2147. p[2 + sa_len++] = hash;
  2148. p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA;
  2149. #endif
  2150. }
  2151. p[0] = (unsigned char)( sa_len >> 8 );
  2152. p[1] = (unsigned char)( sa_len );
  2153. sa_len += 2;
  2154. p += sa_len;
  2155. }
  2156. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2157. /*
  2158. * DistinguishedName certificate_authorities<0..2^16-1>;
  2159. * opaque DistinguishedName<1..2^16-1>;
  2160. */
  2161. p += 2;
  2162. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  2163. if( ssl->handshake->sni_ca_chain != NULL )
  2164. crt = ssl->handshake->sni_ca_chain;
  2165. else
  2166. #endif
  2167. crt = ssl->conf->ca_chain;
  2168. total_dn_size = 0;
  2169. while( crt != NULL && crt->version != 0 )
  2170. {
  2171. dn_size = crt->subject_raw.len;
  2172. if( end < p ||
  2173. (size_t)( end - p ) < dn_size ||
  2174. (size_t)( end - p ) < 2 + dn_size )
  2175. {
  2176. MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
  2177. break;
  2178. }
  2179. *p++ = (unsigned char)( dn_size >> 8 );
  2180. *p++ = (unsigned char)( dn_size );
  2181. memcpy( p, crt->subject_raw.p, dn_size );
  2182. p += dn_size;
  2183. MBEDTLS_SSL_DEBUG_BUF( 3, "requested DN", p - dn_size, dn_size );
  2184. total_dn_size += 2 + dn_size;
  2185. crt = crt->next;
  2186. }
  2187. ssl->out_msglen = p - buf;
  2188. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  2189. ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST;
  2190. ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
  2191. ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
  2192. ret = mbedtls_ssl_write_record( ssl );
  2193. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
  2194. return( ret );
  2195. }
  2196. #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
  2197. !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
  2198. !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
  2199. !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
  2200. !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
  2201. !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  2202. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  2203. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2204. static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
  2205. {
  2206. int ret;
  2207. if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECKEY ) )
  2208. {
  2209. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
  2210. return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  2211. }
  2212. if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx,
  2213. mbedtls_pk_ec( *mbedtls_ssl_own_key( ssl ) ),
  2214. MBEDTLS_ECDH_OURS ) ) != 0 )
  2215. {
  2216. MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
  2217. return( ret );
  2218. }
  2219. return( 0 );
  2220. }
  2221. #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
  2222. MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  2223. static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
  2224. {
  2225. int ret;
  2226. size_t n = 0;
  2227. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2228. ssl->transform_negotiate->ciphersuite_info;
  2229. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  2230. defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
  2231. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  2232. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
  2233. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
  2234. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2235. unsigned char *p = ssl->out_msg + 4;
  2236. unsigned char *dig_signed = p;
  2237. size_t dig_signed_len = 0, len;
  2238. ((void) dig_signed);
  2239. ((void) dig_signed_len);
  2240. ((void) len);
  2241. #endif
  2242. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
  2243. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
  2244. defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
  2245. defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2246. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA ||
  2247. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2248. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  2249. {
  2250. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
  2251. ssl->state++;
  2252. return( 0 );
  2253. }
  2254. #endif
  2255. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  2256. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2257. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
  2258. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
  2259. {
  2260. ssl_get_ecdh_params_from_cert( ssl );
  2261. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
  2262. ssl->state++;
  2263. return( 0 );
  2264. }
  2265. #endif
  2266. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2267. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2268. {
  2269. size_t jlen;
  2270. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  2271. ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
  2272. p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng );
  2273. if( ret != 0 )
  2274. {
  2275. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
  2276. return( ret );
  2277. }
  2278. p += jlen;
  2279. n += jlen;
  2280. }
  2281. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  2282. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
  2283. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  2284. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2285. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  2286. {
  2287. /* Note: we don't support identity hints, until someone asks
  2288. * for them. */
  2289. *(p++) = 0x00;
  2290. *(p++) = 0x00;
  2291. n += 2;
  2292. }
  2293. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED ||
  2294. MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
  2295. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  2296. defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  2297. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
  2298. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
  2299. {
  2300. if( ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL )
  2301. {
  2302. MBEDTLS_SSL_DEBUG_MSG( 1, ( "no DH parameters set" ) );
  2303. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  2304. }
  2305. /*
  2306. * Ephemeral DH parameters:
  2307. *
  2308. * struct {
  2309. * opaque dh_p<1..2^16-1>;
  2310. * opaque dh_g<1..2^16-1>;
  2311. * opaque dh_Ys<1..2^16-1>;
  2312. * } ServerDHParams;
  2313. */
  2314. if( ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->conf->dhm_P ) ) != 0 ||
  2315. ( ret = mbedtls_mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->conf->dhm_G ) ) != 0 )
  2316. {
  2317. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
  2318. return( ret );
  2319. }
  2320. if( ( ret = mbedtls_dhm_make_params( &ssl->handshake->dhm_ctx,
  2321. (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
  2322. p, &len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2323. {
  2324. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_params", ret );
  2325. return( ret );
  2326. }
  2327. dig_signed = p;
  2328. dig_signed_len = len;
  2329. p += len;
  2330. n += len;
  2331. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
  2332. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
  2333. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
  2334. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
  2335. }
  2336. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  2337. MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2338. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
  2339. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2340. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
  2341. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  2342. {
  2343. /*
  2344. * Ephemeral ECDH parameters:
  2345. *
  2346. * struct {
  2347. * ECParameters curve_params;
  2348. * ECPoint public;
  2349. * } ServerECDHParams;
  2350. */
  2351. const mbedtls_ecp_curve_info **curve = NULL;
  2352. const mbedtls_ecp_group_id *gid;
  2353. /* Match our preference list against the offered curves */
  2354. for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
  2355. for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
  2356. if( (*curve)->grp_id == *gid )
  2357. goto curve_matching_done;
  2358. curve_matching_done:
  2359. if( curve == NULL || *curve == NULL )
  2360. {
  2361. MBEDTLS_SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
  2362. return( MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN );
  2363. }
  2364. MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
  2365. if( ( ret = mbedtls_ecp_group_load( &ssl->handshake->ecdh_ctx.grp,
  2366. (*curve)->grp_id ) ) != 0 )
  2367. {
  2368. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecp_group_load", ret );
  2369. return( ret );
  2370. }
  2371. if( ( ret = mbedtls_ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
  2372. p, MBEDTLS_SSL_MAX_CONTENT_LEN - n,
  2373. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2374. {
  2375. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_params", ret );
  2376. return( ret );
  2377. }
  2378. dig_signed = p;
  2379. dig_signed_len = len;
  2380. p += len;
  2381. n += len;
  2382. MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
  2383. }
  2384. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
  2385. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  2386. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  2387. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2388. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
  2389. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2390. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
  2391. {
  2392. size_t signature_len = 0;
  2393. unsigned int hashlen = 0;
  2394. unsigned char hash[64];
  2395. mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
  2396. /*
  2397. * Choose hash algorithm. NONE means MD5 + SHA1 here.
  2398. */
  2399. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2400. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2401. {
  2402. md_alg = mbedtls_ssl_md_alg_from_hash( ssl->handshake->sig_alg );
  2403. if( md_alg == MBEDTLS_MD_NONE )
  2404. {
  2405. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2406. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2407. }
  2408. }
  2409. else
  2410. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2411. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2412. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2413. if( ciphersuite_info->key_exchange ==
  2414. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
  2415. {
  2416. md_alg = MBEDTLS_MD_SHA1;
  2417. }
  2418. else
  2419. #endif
  2420. {
  2421. md_alg = MBEDTLS_MD_NONE;
  2422. }
  2423. /*
  2424. * Compute the hash to be signed
  2425. */
  2426. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2427. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2428. if( md_alg == MBEDTLS_MD_NONE )
  2429. {
  2430. mbedtls_md5_context mbedtls_md5;
  2431. mbedtls_sha1_context mbedtls_sha1;
  2432. mbedtls_md5_init( &mbedtls_md5 );
  2433. mbedtls_sha1_init( &mbedtls_sha1 );
  2434. /*
  2435. * digitally-signed struct {
  2436. * opaque md5_hash[16];
  2437. * opaque sha_hash[20];
  2438. * };
  2439. *
  2440. * md5_hash
  2441. * MD5(ClientHello.random + ServerHello.random
  2442. * + ServerParams);
  2443. * sha_hash
  2444. * SHA(ClientHello.random + ServerHello.random
  2445. * + ServerParams);
  2446. */
  2447. mbedtls_md5_starts( &mbedtls_md5 );
  2448. mbedtls_md5_update( &mbedtls_md5, ssl->handshake->randbytes, 64 );
  2449. mbedtls_md5_update( &mbedtls_md5, dig_signed, dig_signed_len );
  2450. mbedtls_md5_finish( &mbedtls_md5, hash );
  2451. mbedtls_sha1_starts( &mbedtls_sha1 );
  2452. mbedtls_sha1_update( &mbedtls_sha1, ssl->handshake->randbytes, 64 );
  2453. mbedtls_sha1_update( &mbedtls_sha1, dig_signed, dig_signed_len );
  2454. mbedtls_sha1_finish( &mbedtls_sha1, hash + 16 );
  2455. hashlen = 36;
  2456. mbedtls_md5_free( &mbedtls_md5 );
  2457. mbedtls_sha1_free( &mbedtls_sha1 );
  2458. }
  2459. else
  2460. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  2461. MBEDTLS_SSL_PROTO_TLS1_1 */
  2462. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  2463. defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2464. if( md_alg != MBEDTLS_MD_NONE )
  2465. {
  2466. mbedtls_md_context_t ctx;
  2467. const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
  2468. mbedtls_md_init( &ctx );
  2469. /* Info from md_alg will be used instead */
  2470. hashlen = 0;
  2471. /*
  2472. * digitally-signed struct {
  2473. * opaque client_random[32];
  2474. * opaque server_random[32];
  2475. * ServerDHParams params;
  2476. * };
  2477. */
  2478. if( ( ret = mbedtls_md_setup( &ctx, md_info, 0 ) ) != 0 )
  2479. {
  2480. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_md_setup", ret );
  2481. return( ret );
  2482. }
  2483. mbedtls_md_starts( &ctx );
  2484. mbedtls_md_update( &ctx, ssl->handshake->randbytes, 64 );
  2485. mbedtls_md_update( &ctx, dig_signed, dig_signed_len );
  2486. mbedtls_md_finish( &ctx, hash );
  2487. mbedtls_md_free( &ctx );
  2488. }
  2489. else
  2490. #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
  2491. MBEDTLS_SSL_PROTO_TLS1_2 */
  2492. {
  2493. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2494. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2495. }
  2496. MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
  2497. (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
  2498. /*
  2499. * Make the signature
  2500. */
  2501. if( mbedtls_ssl_own_key( ssl ) == NULL )
  2502. {
  2503. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key" ) );
  2504. return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  2505. }
  2506. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2507. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2508. {
  2509. *(p++) = ssl->handshake->sig_alg;
  2510. *(p++) = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
  2511. n += 2;
  2512. }
  2513. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2514. if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
  2515. p + 2 , &signature_len,
  2516. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2517. {
  2518. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
  2519. return( ret );
  2520. }
  2521. *(p++) = (unsigned char)( signature_len >> 8 );
  2522. *(p++) = (unsigned char)( signature_len );
  2523. n += 2;
  2524. MBEDTLS_SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
  2525. n += signature_len;
  2526. }
  2527. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
  2528. MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2529. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  2530. ssl->out_msglen = 4 + n;
  2531. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  2532. ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE;
  2533. ssl->state++;
  2534. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  2535. {
  2536. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  2537. return( ret );
  2538. }
  2539. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
  2540. return( 0 );
  2541. }
  2542. static int ssl_write_server_hello_done( mbedtls_ssl_context *ssl )
  2543. {
  2544. int ret;
  2545. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
  2546. ssl->out_msglen = 4;
  2547. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  2548. ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE;
  2549. ssl->state++;
  2550. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  2551. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  2552. mbedtls_ssl_send_flight_completed( ssl );
  2553. #endif
  2554. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  2555. {
  2556. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  2557. return( ret );
  2558. }
  2559. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
  2560. return( 0 );
  2561. }
  2562. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  2563. defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  2564. static int ssl_parse_client_dh_public( mbedtls_ssl_context *ssl, unsigned char **p,
  2565. const unsigned char *end )
  2566. {
  2567. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2568. size_t n;
  2569. /*
  2570. * Receive G^Y mod P, premaster = (G^Y)^X mod P
  2571. */
  2572. if( *p + 2 > end )
  2573. {
  2574. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2575. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2576. }
  2577. n = ( (*p)[0] << 8 ) | (*p)[1];
  2578. *p += 2;
  2579. if( *p + n > end )
  2580. {
  2581. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2582. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2583. }
  2584. if( ( ret = mbedtls_dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
  2585. {
  2586. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_read_public", ret );
  2587. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
  2588. }
  2589. *p += n;
  2590. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
  2591. return( ret );
  2592. }
  2593. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  2594. MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2595. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
  2596. defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2597. static int ssl_parse_encrypted_pms( mbedtls_ssl_context *ssl,
  2598. const unsigned char *p,
  2599. const unsigned char *end,
  2600. size_t pms_offset )
  2601. {
  2602. int ret;
  2603. size_t len = mbedtls_pk_get_len( mbedtls_ssl_own_key( ssl ) );
  2604. unsigned char *pms = ssl->handshake->premaster + pms_offset;
  2605. unsigned char ver[2];
  2606. unsigned char fake_pms[48], peer_pms[48];
  2607. unsigned char mask;
  2608. size_t i, peer_pmslen;
  2609. unsigned int diff;
  2610. if( ! mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_RSA ) )
  2611. {
  2612. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
  2613. return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  2614. }
  2615. /*
  2616. * Decrypt the premaster using own private RSA key
  2617. */
  2618. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  2619. defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2620. if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
  2621. {
  2622. if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
  2623. *p++ != ( ( len ) & 0xFF ) )
  2624. {
  2625. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2626. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2627. }
  2628. }
  2629. #endif
  2630. if( p + len != end )
  2631. {
  2632. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2633. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2634. }
  2635. mbedtls_ssl_write_version( ssl->handshake->max_major_ver,
  2636. ssl->handshake->max_minor_ver,
  2637. ssl->conf->transport, ver );
  2638. /*
  2639. * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
  2640. * must not cause the connection to end immediately; instead, send a
  2641. * bad_record_mac later in the handshake.
  2642. * Also, avoid data-dependant branches here to protect against
  2643. * timing-based variants.
  2644. */
  2645. ret = ssl->conf->f_rng( ssl->conf->p_rng, fake_pms, sizeof( fake_pms ) );
  2646. if( ret != 0 )
  2647. return( ret );
  2648. ret = mbedtls_pk_decrypt( mbedtls_ssl_own_key( ssl ), p, len,
  2649. peer_pms, &peer_pmslen,
  2650. sizeof( peer_pms ),
  2651. ssl->conf->f_rng, ssl->conf->p_rng );
  2652. diff = (unsigned int) ret;
  2653. diff |= peer_pmslen ^ 48;
  2654. diff |= peer_pms[0] ^ ver[0];
  2655. diff |= peer_pms[1] ^ ver[1];
  2656. #if defined(MBEDTLS_SSL_DEBUG_ALL)
  2657. if( diff != 0 )
  2658. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2659. #endif
  2660. if( sizeof( ssl->handshake->premaster ) < pms_offset ||
  2661. sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
  2662. {
  2663. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2664. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2665. }
  2666. ssl->handshake->pmslen = 48;
  2667. /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */
  2668. /* MSVC has a warning about unary minus on unsigned, but this is
  2669. * well-defined and precisely what we want to do here */
  2670. #if defined(_MSC_VER)
  2671. #pragma warning( push )
  2672. #pragma warning( disable : 4146 )
  2673. #endif
  2674. mask = - ( ( diff | - diff ) >> ( sizeof( unsigned int ) * 8 - 1 ) );
  2675. #if defined(_MSC_VER)
  2676. #pragma warning( pop )
  2677. #endif
  2678. for( i = 0; i < ssl->handshake->pmslen; i++ )
  2679. pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
  2680. return( 0 );
  2681. }
  2682. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
  2683. MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
  2684. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  2685. static int ssl_parse_client_psk_identity( mbedtls_ssl_context *ssl, unsigned char **p,
  2686. const unsigned char *end )
  2687. {
  2688. int ret = 0;
  2689. size_t n;
  2690. if( ssl->conf->f_psk == NULL &&
  2691. ( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL ||
  2692. ssl->conf->psk_identity_len == 0 || ssl->conf->psk_len == 0 ) )
  2693. {
  2694. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
  2695. return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  2696. }
  2697. /*
  2698. * Receive client pre-shared key identity name
  2699. */
  2700. if( *p + 2 > end )
  2701. {
  2702. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2703. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2704. }
  2705. n = ( (*p)[0] << 8 ) | (*p)[1];
  2706. *p += 2;
  2707. if( n < 1 || n > 65535 || *p + n > end )
  2708. {
  2709. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2710. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2711. }
  2712. if( ssl->conf->f_psk != NULL )
  2713. {
  2714. if( ssl->conf->f_psk( ssl->conf->p_psk, ssl, *p, n ) != 0 )
  2715. ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
  2716. }
  2717. else
  2718. {
  2719. /* Identity is not a big secret since clients send it in the clear,
  2720. * but treat it carefully anyway, just in case */
  2721. if( n != ssl->conf->psk_identity_len ||
  2722. mbedtls_ssl_safer_memcmp( ssl->conf->psk_identity, *p, n ) != 0 )
  2723. {
  2724. ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY;
  2725. }
  2726. }
  2727. if( ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY )
  2728. {
  2729. MBEDTLS_SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
  2730. if( ( ret = mbedtls_ssl_send_alert_message( ssl,
  2731. MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2732. MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
  2733. {
  2734. return( ret );
  2735. }
  2736. return( MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY );
  2737. }
  2738. *p += n;
  2739. return( 0 );
  2740. }
  2741. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  2742. static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
  2743. {
  2744. int ret;
  2745. const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  2746. unsigned char *p, *end;
  2747. ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
  2748. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
  2749. if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
  2750. {
  2751. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2752. return( ret );
  2753. }
  2754. p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  2755. end = ssl->in_msg + ssl->in_hslen;
  2756. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2757. {
  2758. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2759. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2760. }
  2761. if( ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE )
  2762. {
  2763. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
  2764. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2765. }
  2766. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
  2767. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
  2768. {
  2769. if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
  2770. {
  2771. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
  2772. return( ret );
  2773. }
  2774. if( p != end )
  2775. {
  2776. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
  2777. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2778. }
  2779. if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
  2780. ssl->handshake->premaster,
  2781. MBEDTLS_PREMASTER_SIZE,
  2782. &ssl->handshake->pmslen,
  2783. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2784. {
  2785. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
  2786. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
  2787. }
  2788. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
  2789. }
  2790. else
  2791. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
  2792. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  2793. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
  2794. defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  2795. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2796. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2797. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
  2798. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
  2799. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
  2800. {
  2801. if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
  2802. p, end - p) ) != 0 )
  2803. {
  2804. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
  2805. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
  2806. }
  2807. MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
  2808. if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
  2809. &ssl->handshake->pmslen,
  2810. ssl->handshake->premaster,
  2811. MBEDTLS_MPI_MAX_SIZE,
  2812. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2813. {
  2814. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
  2815. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
  2816. }
  2817. MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
  2818. }
  2819. else
  2820. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2821. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  2822. MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  2823. MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  2824. #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
  2825. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
  2826. {
  2827. if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
  2828. {
  2829. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
  2830. return( ret );
  2831. }
  2832. if( p != end )
  2833. {
  2834. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
  2835. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2836. }
  2837. if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
  2838. ciphersuite_info->key_exchange ) ) != 0 )
  2839. {
  2840. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
  2841. return( ret );
  2842. }
  2843. }
  2844. else
  2845. #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
  2846. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2847. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  2848. {
  2849. if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
  2850. {
  2851. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
  2852. return( ret );
  2853. }
  2854. if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
  2855. {
  2856. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
  2857. return( ret );
  2858. }
  2859. if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
  2860. ciphersuite_info->key_exchange ) ) != 0 )
  2861. {
  2862. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
  2863. return( ret );
  2864. }
  2865. }
  2866. else
  2867. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
  2868. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  2869. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
  2870. {
  2871. if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
  2872. {
  2873. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
  2874. return( ret );
  2875. }
  2876. if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
  2877. {
  2878. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
  2879. return( ret );
  2880. }
  2881. if( p != end )
  2882. {
  2883. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
  2884. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
  2885. }
  2886. if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
  2887. ciphersuite_info->key_exchange ) ) != 0 )
  2888. {
  2889. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
  2890. return( ret );
  2891. }
  2892. }
  2893. else
  2894. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2895. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  2896. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  2897. {
  2898. if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
  2899. {
  2900. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
  2901. return( ret );
  2902. }
  2903. if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx,
  2904. p, end - p ) ) != 0 )
  2905. {
  2906. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret );
  2907. return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
  2908. }
  2909. MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
  2910. if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
  2911. ciphersuite_info->key_exchange ) ) != 0 )
  2912. {
  2913. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
  2914. return( ret );
  2915. }
  2916. }
  2917. else
  2918. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
  2919. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
  2920. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
  2921. {
  2922. if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 0 ) ) != 0 )
  2923. {
  2924. MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
  2925. return( ret );
  2926. }
  2927. }
  2928. else
  2929. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
  2930. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2931. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2932. {
  2933. ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
  2934. p, end - p );
  2935. if( ret != 0 )
  2936. {
  2937. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
  2938. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2939. }
  2940. ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
  2941. ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
  2942. ssl->conf->f_rng, ssl->conf->p_rng );
  2943. if( ret != 0 )
  2944. {
  2945. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
  2946. return( ret );
  2947. }
  2948. }
  2949. else
  2950. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  2951. {
  2952. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2953. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2954. }
  2955. if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  2956. {
  2957. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  2958. return( ret );
  2959. }
  2960. ssl->state++;
  2961. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
  2962. return( 0 );
  2963. }
  2964. #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
  2965. !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
  2966. !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
  2967. !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
  2968. !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
  2969. !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2970. static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
  2971. {
  2972. const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
  2973. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
  2974. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2975. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  2976. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2977. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2978. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2979. {
  2980. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
  2981. ssl->state++;
  2982. return( 0 );
  2983. }
  2984. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2985. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2986. }
  2987. #else
  2988. static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
  2989. {
  2990. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2991. size_t i, sig_len;
  2992. unsigned char hash[48];
  2993. unsigned char *hash_start = hash;
  2994. size_t hashlen;
  2995. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2996. mbedtls_pk_type_t pk_alg;
  2997. #endif
  2998. mbedtls_md_type_t md_alg;
  2999. const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
  3000. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
  3001. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  3002. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  3003. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  3004. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  3005. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE ||
  3006. ssl->session_negotiate->peer_cert == NULL )
  3007. {
  3008. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
  3009. ssl->state++;
  3010. return( 0 );
  3011. }
  3012. /* Read the message without adding it to the checksum */
  3013. do {
  3014. if( ( ret = mbedtls_ssl_read_record_layer( ssl ) ) != 0 )
  3015. {
  3016. MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_read_record_layer" ), ret );
  3017. return( ret );
  3018. }
  3019. ret = mbedtls_ssl_handle_message_type( ssl );
  3020. } while( MBEDTLS_ERR_SSL_NON_FATAL == ret );
  3021. if( 0 != ret )
  3022. {
  3023. MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ssl_handle_message_type" ), ret );
  3024. return( ret );
  3025. }
  3026. ssl->state++;
  3027. /* Process the message contents */
  3028. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
  3029. ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY )
  3030. {
  3031. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
  3032. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3033. }
  3034. i = mbedtls_ssl_hs_hdr_len( ssl );
  3035. /*
  3036. * struct {
  3037. * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only
  3038. * opaque signature<0..2^16-1>;
  3039. * } DigitallySigned;
  3040. */
  3041. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  3042. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  3043. if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  3044. {
  3045. md_alg = MBEDTLS_MD_NONE;
  3046. hashlen = 36;
  3047. /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
  3048. if( mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
  3049. MBEDTLS_PK_ECDSA ) )
  3050. {
  3051. hash_start += 16;
  3052. hashlen -= 16;
  3053. md_alg = MBEDTLS_MD_SHA1;
  3054. }
  3055. }
  3056. else
  3057. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 ||
  3058. MBEDTLS_SSL_PROTO_TLS1_1 */
  3059. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  3060. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  3061. {
  3062. if( i + 2 > ssl->in_hslen )
  3063. {
  3064. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
  3065. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3066. }
  3067. /*
  3068. * Hash
  3069. */
  3070. md_alg = mbedtls_ssl_md_alg_from_hash( ssl->in_msg[i] );
  3071. if( md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md( ssl, ssl->in_msg[i] ) )
  3072. {
  3073. MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
  3074. " for verify message" ) );
  3075. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3076. }
  3077. #if !defined(MBEDTLS_MD_SHA1)
  3078. if( MBEDTLS_MD_SHA1 == md_alg )
  3079. hash_start += 16;
  3080. #endif
  3081. /* Info from md_alg will be used instead */
  3082. hashlen = 0;
  3083. i++;
  3084. /*
  3085. * Signature
  3086. */
  3087. if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( ssl->in_msg[i] ) )
  3088. == MBEDTLS_PK_NONE )
  3089. {
  3090. MBEDTLS_SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
  3091. " for verify message" ) );
  3092. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3093. }
  3094. /*
  3095. * Check the certificate's key type matches the signature alg
  3096. */
  3097. if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
  3098. {
  3099. MBEDTLS_SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
  3100. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3101. }
  3102. i++;
  3103. }
  3104. else
  3105. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  3106. {
  3107. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  3108. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  3109. }
  3110. if( i + 2 > ssl->in_hslen )
  3111. {
  3112. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
  3113. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3114. }
  3115. sig_len = ( ssl->in_msg[i] << 8 ) | ssl->in_msg[i+1];
  3116. i += 2;
  3117. if( i + sig_len != ssl->in_hslen )
  3118. {
  3119. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
  3120. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
  3121. }
  3122. /* Calculate hash and verify signature */
  3123. ssl->handshake->calc_verify( ssl, hash );
  3124. if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
  3125. md_alg, hash_start, hashlen,
  3126. ssl->in_msg + i, sig_len ) ) != 0 )
  3127. {
  3128. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
  3129. return( ret );
  3130. }
  3131. mbedtls_ssl_update_handshake_status( ssl );
  3132. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
  3133. return( ret );
  3134. }
  3135. #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
  3136. !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
  3137. !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
  3138. !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
  3139. !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
  3140. !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  3141. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  3142. static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl )
  3143. {
  3144. int ret;
  3145. size_t tlen;
  3146. uint32_t lifetime;
  3147. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
  3148. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  3149. ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET;
  3150. /*
  3151. * struct {
  3152. * uint32 ticket_lifetime_hint;
  3153. * opaque ticket<0..2^16-1>;
  3154. * } NewSessionTicket;
  3155. *
  3156. * 4 . 7 ticket_lifetime_hint (0 = unspecified)
  3157. * 8 . 9 ticket_len (n)
  3158. * 10 . 9+n ticket content
  3159. */
  3160. if( ( ret = ssl->conf->f_ticket_write( ssl->conf->p_ticket,
  3161. ssl->session_negotiate,
  3162. ssl->out_msg + 10,
  3163. ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN,
  3164. &tlen, &lifetime ) ) != 0 )
  3165. {
  3166. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_ticket_write", ret );
  3167. tlen = 0;
  3168. }
  3169. ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
  3170. ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
  3171. ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
  3172. ssl->out_msg[7] = ( lifetime ) & 0xFF;
  3173. ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
  3174. ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
  3175. ssl->out_msglen = 10 + tlen;
  3176. /*
  3177. * Morally equivalent to updating ssl->state, but NewSessionTicket and
  3178. * ChangeCipherSpec share the same state.
  3179. */
  3180. ssl->handshake->new_session_ticket = 0;
  3181. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  3182. {
  3183. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  3184. return( ret );
  3185. }
  3186. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
  3187. return( 0 );
  3188. }
  3189. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  3190. /*
  3191. * SSL handshake -- server side -- single step
  3192. */
  3193. int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl )
  3194. {
  3195. int ret = 0;
  3196. if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
  3197. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  3198. MBEDTLS_SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
  3199. if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
  3200. return( ret );
  3201. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  3202. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  3203. ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
  3204. {
  3205. if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
  3206. return( ret );
  3207. }
  3208. #endif
  3209. switch( ssl->state )
  3210. {
  3211. case MBEDTLS_SSL_HELLO_REQUEST:
  3212. ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
  3213. break;
  3214. /*
  3215. * <== ClientHello
  3216. */
  3217. case MBEDTLS_SSL_CLIENT_HELLO:
  3218. ret = ssl_parse_client_hello( ssl );
  3219. break;
  3220. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  3221. case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT:
  3222. return( MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED );
  3223. #endif
  3224. /*
  3225. * ==> ServerHello
  3226. * Certificate
  3227. * ( ServerKeyExchange )
  3228. * ( CertificateRequest )
  3229. * ServerHelloDone
  3230. */
  3231. case MBEDTLS_SSL_SERVER_HELLO:
  3232. ret = ssl_write_server_hello( ssl );
  3233. break;
  3234. case MBEDTLS_SSL_SERVER_CERTIFICATE:
  3235. ret = mbedtls_ssl_write_certificate( ssl );
  3236. break;
  3237. case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
  3238. ret = ssl_write_server_key_exchange( ssl );
  3239. break;
  3240. case MBEDTLS_SSL_CERTIFICATE_REQUEST:
  3241. ret = ssl_write_certificate_request( ssl );
  3242. break;
  3243. case MBEDTLS_SSL_SERVER_HELLO_DONE:
  3244. ret = ssl_write_server_hello_done( ssl );
  3245. break;
  3246. /*
  3247. * <== ( Certificate/Alert )
  3248. * ClientKeyExchange
  3249. * ( CertificateVerify )
  3250. * ChangeCipherSpec
  3251. * Finished
  3252. */
  3253. case MBEDTLS_SSL_CLIENT_CERTIFICATE:
  3254. ret = mbedtls_ssl_parse_certificate( ssl );
  3255. break;
  3256. case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
  3257. ret = ssl_parse_client_key_exchange( ssl );
  3258. break;
  3259. case MBEDTLS_SSL_CERTIFICATE_VERIFY:
  3260. ret = ssl_parse_certificate_verify( ssl );
  3261. break;
  3262. case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
  3263. ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
  3264. break;
  3265. case MBEDTLS_SSL_CLIENT_FINISHED:
  3266. ret = mbedtls_ssl_parse_finished( ssl );
  3267. break;
  3268. /*
  3269. * ==> ( NewSessionTicket )
  3270. * ChangeCipherSpec
  3271. * Finished
  3272. */
  3273. case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
  3274. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  3275. if( ssl->handshake->new_session_ticket != 0 )
  3276. ret = ssl_write_new_session_ticket( ssl );
  3277. else
  3278. #endif
  3279. ret = mbedtls_ssl_write_change_cipher_spec( ssl );
  3280. break;
  3281. case MBEDTLS_SSL_SERVER_FINISHED:
  3282. ret = mbedtls_ssl_write_finished( ssl );
  3283. break;
  3284. case MBEDTLS_SSL_FLUSH_BUFFERS:
  3285. MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
  3286. ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
  3287. break;
  3288. case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
  3289. mbedtls_ssl_handshake_wrapup( ssl );
  3290. break;
  3291. default:
  3292. MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
  3293. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  3294. }
  3295. return( ret );
  3296. }
  3297. #endif /* MBEDTLS_SSL_SRV_C */