ssl_cli.c 118 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526
  1. /*
  2. * SSLv3/TLSv1 client-side functions
  3. *
  4. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5. * SPDX-License-Identifier: Apache-2.0
  6. *
  7. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  8. * not use this file except in compliance with the License.
  9. * You may obtain a copy of the License at
  10. *
  11. * http://www.apache.org/licenses/LICENSE-2.0
  12. *
  13. * Unless required by applicable law or agreed to in writing, software
  14. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  15. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16. * See the License for the specific language governing permissions and
  17. * limitations under the License.
  18. *
  19. * This file is part of mbed TLS (https://tls.mbed.org)
  20. */
  21. #if !defined(MBEDTLS_CONFIG_FILE)
  22. #include "mbedtls/config.h"
  23. #else
  24. #include MBEDTLS_CONFIG_FILE
  25. #endif
  26. #if defined(MBEDTLS_SSL_CLI_C)
  27. #if defined(MBEDTLS_PLATFORM_C)
  28. #include "mbedtls/platform.h"
  29. #else
  30. #include <stdlib.h>
  31. #define mbedtls_calloc calloc
  32. #define mbedtls_free free
  33. #endif
  34. #include "mbedtls/debug.h"
  35. #include "mbedtls/ssl.h"
  36. #include "mbedtls/ssl_internal.h"
  37. #include <string.h>
  38. #include <stdint.h>
  39. #if defined(MBEDTLS_HAVE_TIME)
  40. #include "mbedtls/platform_time.h"
  41. #endif
  42. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  43. /* Implementation that should never be optimized out by the compiler */
  44. static void mbedtls_zeroize( void *v, size_t n ) {
  45. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  46. }
  47. #endif
  48. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  49. static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
  50. unsigned char *buf,
  51. size_t *olen )
  52. {
  53. unsigned char *p = buf;
  54. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  55. size_t hostname_len;
  56. *olen = 0;
  57. if( ssl->hostname == NULL )
  58. return;
  59. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
  60. ssl->hostname ) );
  61. hostname_len = strlen( ssl->hostname );
  62. if( end < p || (size_t)( end - p ) < hostname_len + 9 )
  63. {
  64. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  65. return;
  66. }
  67. /*
  68. * Sect. 3, RFC 6066 (TLS Extensions Definitions)
  69. *
  70. * In order to provide any of the server names, clients MAY include an
  71. * extension of type "server_name" in the (extended) client hello. The
  72. * "extension_data" field of this extension SHALL contain
  73. * "ServerNameList" where:
  74. *
  75. * struct {
  76. * NameType name_type;
  77. * select (name_type) {
  78. * case host_name: HostName;
  79. * } name;
  80. * } ServerName;
  81. *
  82. * enum {
  83. * host_name(0), (255)
  84. * } NameType;
  85. *
  86. * opaque HostName<1..2^16-1>;
  87. *
  88. * struct {
  89. * ServerName server_name_list<1..2^16-1>
  90. * } ServerNameList;
  91. *
  92. */
  93. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
  94. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
  95. *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
  96. *p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
  97. *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
  98. *p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
  99. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
  100. *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
  101. *p++ = (unsigned char)( ( hostname_len ) & 0xFF );
  102. memcpy( p, ssl->hostname, hostname_len );
  103. *olen = hostname_len + 9;
  104. }
  105. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  106. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  107. static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
  108. unsigned char *buf,
  109. size_t *olen )
  110. {
  111. unsigned char *p = buf;
  112. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  113. *olen = 0;
  114. /* We're always including an TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the
  115. * initial ClientHello, in which case also adding the renegotiation
  116. * info extension is NOT RECOMMENDED as per RFC 5746 Section 3.4. */
  117. if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  118. return;
  119. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
  120. if( end < p || (size_t)( end - p ) < 5 + ssl->verify_data_len )
  121. {
  122. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  123. return;
  124. }
  125. /*
  126. * Secure renegotiation
  127. */
  128. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
  129. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
  130. *p++ = 0x00;
  131. *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
  132. *p++ = ssl->verify_data_len & 0xFF;
  133. memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
  134. *olen = 5 + ssl->verify_data_len;
  135. }
  136. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  137. /*
  138. * Only if we handle at least one key exchange that needs signatures.
  139. */
  140. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  141. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  142. static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
  143. unsigned char *buf,
  144. size_t *olen )
  145. {
  146. unsigned char *p = buf;
  147. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  148. size_t sig_alg_len = 0;
  149. const int *md;
  150. #if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C)
  151. unsigned char *sig_alg_list = buf + 6;
  152. #endif
  153. *olen = 0;
  154. if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  155. return;
  156. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
  157. for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
  158. {
  159. #if defined(MBEDTLS_ECDSA_C)
  160. sig_alg_len += 2;
  161. #endif
  162. #if defined(MBEDTLS_RSA_C)
  163. sig_alg_len += 2;
  164. #endif
  165. }
  166. if( end < p || (size_t)( end - p ) < sig_alg_len + 6 )
  167. {
  168. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  169. return;
  170. }
  171. /*
  172. * Prepare signature_algorithms extension (TLS 1.2)
  173. */
  174. sig_alg_len = 0;
  175. for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
  176. {
  177. #if defined(MBEDTLS_ECDSA_C)
  178. sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
  179. sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
  180. #endif
  181. #if defined(MBEDTLS_RSA_C)
  182. sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
  183. sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
  184. #endif
  185. }
  186. /*
  187. * enum {
  188. * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
  189. * sha512(6), (255)
  190. * } HashAlgorithm;
  191. *
  192. * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
  193. * SignatureAlgorithm;
  194. *
  195. * struct {
  196. * HashAlgorithm hash;
  197. * SignatureAlgorithm signature;
  198. * } SignatureAndHashAlgorithm;
  199. *
  200. * SignatureAndHashAlgorithm
  201. * supported_signature_algorithms<2..2^16-2>;
  202. */
  203. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
  204. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
  205. *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
  206. *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
  207. *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
  208. *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
  209. *olen = 6 + sig_alg_len;
  210. }
  211. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  212. MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  213. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  214. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  215. static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
  216. unsigned char *buf,
  217. size_t *olen )
  218. {
  219. unsigned char *p = buf;
  220. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  221. unsigned char *elliptic_curve_list = p + 6;
  222. size_t elliptic_curve_len = 0;
  223. const mbedtls_ecp_curve_info *info;
  224. #if defined(MBEDTLS_ECP_C)
  225. const mbedtls_ecp_group_id *grp_id;
  226. #else
  227. ((void) ssl);
  228. #endif
  229. *olen = 0;
  230. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) );
  231. #if defined(MBEDTLS_ECP_C)
  232. for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
  233. #else
  234. for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
  235. #endif
  236. {
  237. #if defined(MBEDTLS_ECP_C)
  238. info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
  239. #endif
  240. if( info == NULL )
  241. {
  242. MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
  243. return;
  244. }
  245. elliptic_curve_len += 2;
  246. }
  247. if( end < p || (size_t)( end - p ) < 6 + elliptic_curve_len )
  248. {
  249. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  250. return;
  251. }
  252. elliptic_curve_len = 0;
  253. #if defined(MBEDTLS_ECP_C)
  254. for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
  255. #else
  256. for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
  257. #endif
  258. {
  259. #if defined(MBEDTLS_ECP_C)
  260. info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
  261. #endif
  262. elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
  263. elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
  264. }
  265. if( elliptic_curve_len == 0 )
  266. return;
  267. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF );
  268. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES ) & 0xFF );
  269. *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
  270. *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
  271. *p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
  272. *p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
  273. *olen = 6 + elliptic_curve_len;
  274. }
  275. static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
  276. unsigned char *buf,
  277. size_t *olen )
  278. {
  279. unsigned char *p = buf;
  280. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  281. *olen = 0;
  282. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) );
  283. if( end < p || (size_t)( end - p ) < 6 )
  284. {
  285. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  286. return;
  287. }
  288. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
  289. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
  290. *p++ = 0x00;
  291. *p++ = 2;
  292. *p++ = 1;
  293. *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
  294. *olen = 6;
  295. }
  296. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  297. MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  298. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  299. static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
  300. unsigned char *buf,
  301. size_t *olen )
  302. {
  303. int ret;
  304. unsigned char *p = buf;
  305. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  306. size_t kkpp_len;
  307. *olen = 0;
  308. /* Skip costly extension if we can't use EC J-PAKE anyway */
  309. if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
  310. return;
  311. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) );
  312. if( end - p < 4 )
  313. {
  314. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  315. return;
  316. }
  317. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
  318. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
  319. /*
  320. * We may need to send ClientHello multiple times for Hello verification.
  321. * We don't want to compute fresh values every time (both for performance
  322. * and consistency reasons), so cache the extension content.
  323. */
  324. if( ssl->handshake->ecjpake_cache == NULL ||
  325. ssl->handshake->ecjpake_cache_len == 0 )
  326. {
  327. MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
  328. ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
  329. p + 2, end - p - 2, &kkpp_len,
  330. ssl->conf->f_rng, ssl->conf->p_rng );
  331. if( ret != 0 )
  332. {
  333. MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
  334. return;
  335. }
  336. ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
  337. if( ssl->handshake->ecjpake_cache == NULL )
  338. {
  339. MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
  340. return;
  341. }
  342. memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
  343. ssl->handshake->ecjpake_cache_len = kkpp_len;
  344. }
  345. else
  346. {
  347. MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
  348. kkpp_len = ssl->handshake->ecjpake_cache_len;
  349. if( (size_t)( end - p - 2 ) < kkpp_len )
  350. {
  351. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  352. return;
  353. }
  354. memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
  355. }
  356. *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
  357. *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
  358. *olen = kkpp_len + 4;
  359. }
  360. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  361. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  362. static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
  363. unsigned char *buf,
  364. size_t *olen )
  365. {
  366. unsigned char *p = buf;
  367. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  368. *olen = 0;
  369. if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) {
  370. return;
  371. }
  372. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) );
  373. if( end < p || (size_t)( end - p ) < 5 )
  374. {
  375. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  376. return;
  377. }
  378. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
  379. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
  380. *p++ = 0x00;
  381. *p++ = 1;
  382. *p++ = ssl->conf->mfl_code;
  383. *olen = 5;
  384. }
  385. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  386. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  387. static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
  388. unsigned char *buf, size_t *olen )
  389. {
  390. unsigned char *p = buf;
  391. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  392. *olen = 0;
  393. if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
  394. {
  395. return;
  396. }
  397. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) );
  398. if( end < p || (size_t)( end - p ) < 4 )
  399. {
  400. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  401. return;
  402. }
  403. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
  404. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
  405. *p++ = 0x00;
  406. *p++ = 0x00;
  407. *olen = 4;
  408. }
  409. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  410. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  411. static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
  412. unsigned char *buf, size_t *olen )
  413. {
  414. unsigned char *p = buf;
  415. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  416. *olen = 0;
  417. if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
  418. ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
  419. {
  420. return;
  421. }
  422. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac "
  423. "extension" ) );
  424. if( end < p || (size_t)( end - p ) < 4 )
  425. {
  426. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  427. return;
  428. }
  429. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
  430. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
  431. *p++ = 0x00;
  432. *p++ = 0x00;
  433. *olen = 4;
  434. }
  435. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  436. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  437. static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
  438. unsigned char *buf, size_t *olen )
  439. {
  440. unsigned char *p = buf;
  441. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  442. *olen = 0;
  443. if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
  444. ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
  445. {
  446. return;
  447. }
  448. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret "
  449. "extension" ) );
  450. if( end < p || (size_t)( end - p ) < 4 )
  451. {
  452. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  453. return;
  454. }
  455. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
  456. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
  457. *p++ = 0x00;
  458. *p++ = 0x00;
  459. *olen = 4;
  460. }
  461. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  462. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  463. static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
  464. unsigned char *buf, size_t *olen )
  465. {
  466. unsigned char *p = buf;
  467. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  468. size_t tlen = ssl->session_negotiate->ticket_len;
  469. *olen = 0;
  470. if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
  471. {
  472. return;
  473. }
  474. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) );
  475. if( end < p || (size_t)( end - p ) < 4 + tlen )
  476. {
  477. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  478. return;
  479. }
  480. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
  481. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
  482. *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
  483. *p++ = (unsigned char)( ( tlen ) & 0xFF );
  484. *olen = 4;
  485. if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
  486. {
  487. return;
  488. }
  489. MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) );
  490. memcpy( p, ssl->session_negotiate->ticket, tlen );
  491. *olen += tlen;
  492. }
  493. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  494. #if defined(MBEDTLS_SSL_ALPN)
  495. static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
  496. unsigned char *buf, size_t *olen )
  497. {
  498. unsigned char *p = buf;
  499. const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
  500. size_t alpnlen = 0;
  501. const char **cur;
  502. *olen = 0;
  503. if( ssl->conf->alpn_list == NULL )
  504. {
  505. return;
  506. }
  507. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
  508. for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
  509. alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1;
  510. if( end < p || (size_t)( end - p ) < 6 + alpnlen )
  511. {
  512. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  513. return;
  514. }
  515. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
  516. *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
  517. /*
  518. * opaque ProtocolName<1..2^8-1>;
  519. *
  520. * struct {
  521. * ProtocolName protocol_name_list<2..2^16-1>
  522. * } ProtocolNameList;
  523. */
  524. /* Skip writing extension and list length for now */
  525. p += 4;
  526. for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
  527. {
  528. *p = (unsigned char)( strlen( *cur ) & 0xFF );
  529. memcpy( p + 1, *cur, *p );
  530. p += 1 + *p;
  531. }
  532. *olen = p - buf;
  533. /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
  534. buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
  535. buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
  536. /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
  537. buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
  538. buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
  539. }
  540. #endif /* MBEDTLS_SSL_ALPN */
  541. /*
  542. * Generate random bytes for ClientHello
  543. */
  544. static int ssl_generate_random( mbedtls_ssl_context *ssl )
  545. {
  546. int ret;
  547. unsigned char *p = ssl->handshake->randbytes;
  548. #if defined(MBEDTLS_HAVE_TIME)
  549. mbedtls_time_t t;
  550. #endif
  551. /*
  552. * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
  553. */
  554. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  555. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  556. ssl->handshake->verify_cookie != NULL )
  557. {
  558. return( 0 );
  559. }
  560. #endif
  561. #if defined(MBEDTLS_HAVE_TIME)
  562. t = mbedtls_time( NULL );
  563. *p++ = (unsigned char)( t >> 24 );
  564. *p++ = (unsigned char)( t >> 16 );
  565. *p++ = (unsigned char)( t >> 8 );
  566. *p++ = (unsigned char)( t );
  567. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
  568. #else
  569. if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
  570. return( ret );
  571. p += 4;
  572. #endif /* MBEDTLS_HAVE_TIME */
  573. if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
  574. return( ret );
  575. return( 0 );
  576. }
  577. /**
  578. * \brief Validate cipher suite against config in SSL context.
  579. *
  580. * \param suite_info cipher suite to validate
  581. * \param ssl SSL context
  582. * \param min_minor_ver Minimal minor version to accept a cipher suite
  583. * \param max_minor_ver Maximal minor version to accept a cipher suite
  584. *
  585. * \return 0 if valid, else 1
  586. */
  587. static int ssl_validate_ciphersuite( const mbedtls_ssl_ciphersuite_t * suite_info,
  588. const mbedtls_ssl_context * ssl,
  589. int min_minor_ver, int max_minor_ver )
  590. {
  591. (void) ssl;
  592. if( suite_info == NULL )
  593. return( 1 );
  594. if( suite_info->min_minor_ver > max_minor_ver ||
  595. suite_info->max_minor_ver < min_minor_ver )
  596. return( 1 );
  597. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  598. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  599. ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
  600. return( 1 );
  601. #endif
  602. #if defined(MBEDTLS_ARC4_C)
  603. if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
  604. suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
  605. return( 1 );
  606. #endif
  607. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  608. if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
  609. mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
  610. return( 1 );
  611. #endif
  612. return( 0 );
  613. }
  614. static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
  615. {
  616. int ret;
  617. size_t i, n, olen, ext_len = 0;
  618. unsigned char *buf;
  619. unsigned char *p, *q;
  620. unsigned char offer_compress;
  621. const int *ciphersuites;
  622. const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  623. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  624. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  625. int uses_ec = 0;
  626. #endif
  627. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
  628. if( ssl->conf->f_rng == NULL )
  629. {
  630. MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
  631. return( MBEDTLS_ERR_SSL_NO_RNG );
  632. }
  633. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  634. if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  635. #endif
  636. {
  637. ssl->major_ver = ssl->conf->min_major_ver;
  638. ssl->minor_ver = ssl->conf->min_minor_ver;
  639. }
  640. if( ssl->conf->max_major_ver == 0 )
  641. {
  642. MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, "
  643. "consider using mbedtls_ssl_config_defaults()" ) );
  644. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  645. }
  646. /*
  647. * 0 . 0 handshake type
  648. * 1 . 3 handshake length
  649. * 4 . 5 highest version supported
  650. * 6 . 9 current UNIX time
  651. * 10 . 37 random bytes
  652. */
  653. buf = ssl->out_msg;
  654. p = buf + 4;
  655. mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
  656. ssl->conf->transport, p );
  657. p += 2;
  658. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
  659. buf[4], buf[5] ) );
  660. if( ( ret = ssl_generate_random( ssl ) ) != 0 )
  661. {
  662. MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
  663. return( ret );
  664. }
  665. memcpy( p, ssl->handshake->randbytes, 32 );
  666. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
  667. p += 32;
  668. /*
  669. * 38 . 38 session id length
  670. * 39 . 39+n session id
  671. * 39+n . 39+n DTLS only: cookie length (1 byte)
  672. * 40+n . .. DTSL only: cookie
  673. * .. . .. ciphersuitelist length (2 bytes)
  674. * .. . .. ciphersuitelist
  675. * .. . .. compression methods length (1 byte)
  676. * .. . .. compression methods
  677. * .. . .. extensions length (2 bytes)
  678. * .. . .. extensions
  679. */
  680. n = ssl->session_negotiate->id_len;
  681. if( n < 16 || n > 32 ||
  682. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  683. ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
  684. #endif
  685. ssl->handshake->resume == 0 )
  686. {
  687. n = 0;
  688. }
  689. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  690. /*
  691. * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
  692. * generate and include a Session ID in the TLS ClientHello."
  693. */
  694. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  695. if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  696. #endif
  697. {
  698. if( ssl->session_negotiate->ticket != NULL &&
  699. ssl->session_negotiate->ticket_len != 0 )
  700. {
  701. ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 );
  702. if( ret != 0 )
  703. return( ret );
  704. ssl->session_negotiate->id_len = n = 32;
  705. }
  706. }
  707. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  708. *p++ = (unsigned char) n;
  709. for( i = 0; i < n; i++ )
  710. *p++ = ssl->session_negotiate->id[i];
  711. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
  712. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
  713. /*
  714. * DTLS cookie
  715. */
  716. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  717. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  718. {
  719. if( ssl->handshake->verify_cookie == NULL )
  720. {
  721. MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
  722. *p++ = 0;
  723. }
  724. else
  725. {
  726. MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
  727. ssl->handshake->verify_cookie,
  728. ssl->handshake->verify_cookie_len );
  729. *p++ = ssl->handshake->verify_cookie_len;
  730. memcpy( p, ssl->handshake->verify_cookie,
  731. ssl->handshake->verify_cookie_len );
  732. p += ssl->handshake->verify_cookie_len;
  733. }
  734. }
  735. #endif
  736. /*
  737. * Ciphersuite list
  738. */
  739. ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
  740. /* Skip writing ciphersuite length for now */
  741. n = 0;
  742. q = p;
  743. p += 2;
  744. for( i = 0; ciphersuites[i] != 0; i++ )
  745. {
  746. ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
  747. if( ssl_validate_ciphersuite( ciphersuite_info, ssl,
  748. ssl->conf->min_minor_ver,
  749. ssl->conf->max_minor_ver ) != 0 )
  750. continue;
  751. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
  752. ciphersuites[i] ) );
  753. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  754. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  755. uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
  756. #endif
  757. n++;
  758. *p++ = (unsigned char)( ciphersuites[i] >> 8 );
  759. *p++ = (unsigned char)( ciphersuites[i] );
  760. }
  761. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites (excluding SCSVs)", n ) );
  762. /*
  763. * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  764. */
  765. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  766. if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  767. #endif
  768. {
  769. MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
  770. *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
  771. *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
  772. n++;
  773. }
  774. /* Some versions of OpenSSL don't handle it correctly if not at end */
  775. #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
  776. if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
  777. {
  778. MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
  779. *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
  780. *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
  781. n++;
  782. }
  783. #endif
  784. *q++ = (unsigned char)( n >> 7 );
  785. *q++ = (unsigned char)( n << 1 );
  786. #if defined(MBEDTLS_ZLIB_SUPPORT)
  787. offer_compress = 1;
  788. #else
  789. offer_compress = 0;
  790. #endif
  791. /*
  792. * We don't support compression with DTLS right now: if many records come
  793. * in the same datagram, uncompressing one could overwrite the next one.
  794. * We don't want to add complexity for handling that case unless there is
  795. * an actual need for it.
  796. */
  797. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  798. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  799. offer_compress = 0;
  800. #endif
  801. if( offer_compress )
  802. {
  803. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
  804. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
  805. MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) );
  806. *p++ = 2;
  807. *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
  808. *p++ = MBEDTLS_SSL_COMPRESS_NULL;
  809. }
  810. else
  811. {
  812. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
  813. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
  814. MBEDTLS_SSL_COMPRESS_NULL ) );
  815. *p++ = 1;
  816. *p++ = MBEDTLS_SSL_COMPRESS_NULL;
  817. }
  818. // First write extensions, then the total length
  819. //
  820. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  821. ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen );
  822. ext_len += olen;
  823. #endif
  824. /* Note that TLS_EMPTY_RENEGOTIATION_INFO_SCSV is always added
  825. * even if MBEDTLS_SSL_RENEGOTIATION is not defined. */
  826. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  827. ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
  828. ext_len += olen;
  829. #endif
  830. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  831. defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  832. ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen );
  833. ext_len += olen;
  834. #endif
  835. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  836. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  837. if( uses_ec )
  838. {
  839. ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen );
  840. ext_len += olen;
  841. ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
  842. ext_len += olen;
  843. }
  844. #endif
  845. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  846. ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
  847. ext_len += olen;
  848. #endif
  849. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  850. ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
  851. ext_len += olen;
  852. #endif
  853. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  854. ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
  855. ext_len += olen;
  856. #endif
  857. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  858. ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
  859. ext_len += olen;
  860. #endif
  861. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  862. ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
  863. ext_len += olen;
  864. #endif
  865. #if defined(MBEDTLS_SSL_ALPN)
  866. ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
  867. ext_len += olen;
  868. #endif
  869. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  870. ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
  871. ext_len += olen;
  872. #endif
  873. /* olen unused if all extensions are disabled */
  874. ((void) olen);
  875. MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
  876. ext_len ) );
  877. if( ext_len > 0 )
  878. {
  879. *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
  880. *p++ = (unsigned char)( ( ext_len ) & 0xFF );
  881. p += ext_len;
  882. }
  883. ssl->out_msglen = p - buf;
  884. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  885. ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
  886. ssl->state++;
  887. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  888. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  889. mbedtls_ssl_send_flight_completed( ssl );
  890. #endif
  891. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  892. {
  893. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  894. return( ret );
  895. }
  896. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
  897. return( 0 );
  898. }
  899. static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
  900. const unsigned char *buf,
  901. size_t len )
  902. {
  903. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  904. if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  905. {
  906. /* Check verify-data in constant-time. The length OTOH is no secret */
  907. if( len != 1 + ssl->verify_data_len * 2 ||
  908. buf[0] != ssl->verify_data_len * 2 ||
  909. mbedtls_ssl_safer_memcmp( buf + 1,
  910. ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
  911. mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
  912. ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
  913. {
  914. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
  915. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  916. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  917. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  918. }
  919. }
  920. else
  921. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  922. {
  923. if( len != 1 || buf[0] != 0x00 )
  924. {
  925. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
  926. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  927. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  928. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  929. }
  930. ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
  931. }
  932. return( 0 );
  933. }
  934. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  935. static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
  936. const unsigned char *buf,
  937. size_t len )
  938. {
  939. /*
  940. * server should use the extension only if we did,
  941. * and if so the server's value should match ours (and len is always 1)
  942. */
  943. if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ||
  944. len != 1 ||
  945. buf[0] != ssl->conf->mfl_code )
  946. {
  947. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching max fragment length extension" ) );
  948. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  949. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  950. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  951. }
  952. return( 0 );
  953. }
  954. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  955. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  956. static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
  957. const unsigned char *buf,
  958. size_t len )
  959. {
  960. if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ||
  961. len != 0 )
  962. {
  963. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching truncated HMAC extension" ) );
  964. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  965. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  966. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  967. }
  968. ((void) buf);
  969. ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
  970. return( 0 );
  971. }
  972. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  973. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  974. static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
  975. const unsigned char *buf,
  976. size_t len )
  977. {
  978. if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
  979. ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
  980. len != 0 )
  981. {
  982. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching encrypt-then-MAC extension" ) );
  983. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  984. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  985. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  986. }
  987. ((void) buf);
  988. ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
  989. return( 0 );
  990. }
  991. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  992. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  993. static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
  994. const unsigned char *buf,
  995. size_t len )
  996. {
  997. if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
  998. ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
  999. len != 0 )
  1000. {
  1001. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching extended master secret extension" ) );
  1002. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1003. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1004. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1005. }
  1006. ((void) buf);
  1007. ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
  1008. return( 0 );
  1009. }
  1010. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  1011. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1012. static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
  1013. const unsigned char *buf,
  1014. size_t len )
  1015. {
  1016. if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ||
  1017. len != 0 )
  1018. {
  1019. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching session ticket extension" ) );
  1020. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1021. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1022. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1023. }
  1024. ((void) buf);
  1025. ssl->handshake->new_session_ticket = 1;
  1026. return( 0 );
  1027. }
  1028. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1029. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1030. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1031. static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
  1032. const unsigned char *buf,
  1033. size_t len )
  1034. {
  1035. size_t list_size;
  1036. const unsigned char *p;
  1037. if( len == 0 || (size_t)( buf[0] + 1 ) != len )
  1038. {
  1039. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1040. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1041. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1042. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1043. }
  1044. list_size = buf[0];
  1045. p = buf + 1;
  1046. while( list_size > 0 )
  1047. {
  1048. if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
  1049. p[0] == MBEDTLS_ECP_PF_COMPRESSED )
  1050. {
  1051. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
  1052. ssl->handshake->ecdh_ctx.point_format = p[0];
  1053. #endif
  1054. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1055. ssl->handshake->ecjpake_ctx.point_format = p[0];
  1056. #endif
  1057. MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
  1058. return( 0 );
  1059. }
  1060. list_size--;
  1061. p++;
  1062. }
  1063. MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
  1064. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1065. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1066. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1067. }
  1068. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  1069. MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1070. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1071. static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
  1072. const unsigned char *buf,
  1073. size_t len )
  1074. {
  1075. int ret;
  1076. if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
  1077. MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  1078. {
  1079. MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
  1080. return( 0 );
  1081. }
  1082. /* If we got here, we no longer need our cached extension */
  1083. mbedtls_free( ssl->handshake->ecjpake_cache );
  1084. ssl->handshake->ecjpake_cache = NULL;
  1085. ssl->handshake->ecjpake_cache_len = 0;
  1086. if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
  1087. buf, len ) ) != 0 )
  1088. {
  1089. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
  1090. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1091. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1092. return( ret );
  1093. }
  1094. return( 0 );
  1095. }
  1096. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1097. #if defined(MBEDTLS_SSL_ALPN)
  1098. static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
  1099. const unsigned char *buf, size_t len )
  1100. {
  1101. size_t list_len, name_len;
  1102. const char **p;
  1103. /* If we didn't send it, the server shouldn't send it */
  1104. if( ssl->conf->alpn_list == NULL )
  1105. {
  1106. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) );
  1107. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1108. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1109. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1110. }
  1111. /*
  1112. * opaque ProtocolName<1..2^8-1>;
  1113. *
  1114. * struct {
  1115. * ProtocolName protocol_name_list<2..2^16-1>
  1116. * } ProtocolNameList;
  1117. *
  1118. * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
  1119. */
  1120. /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
  1121. if( len < 4 )
  1122. {
  1123. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1124. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1125. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1126. }
  1127. list_len = ( buf[0] << 8 ) | buf[1];
  1128. if( list_len != len - 2 )
  1129. {
  1130. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1131. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1132. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1133. }
  1134. name_len = buf[2];
  1135. if( name_len != list_len - 1 )
  1136. {
  1137. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1138. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1139. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1140. }
  1141. /* Check that the server chosen protocol was in our list and save it */
  1142. for( p = ssl->conf->alpn_list; *p != NULL; p++ )
  1143. {
  1144. if( name_len == strlen( *p ) &&
  1145. memcmp( buf + 3, *p, name_len ) == 0 )
  1146. {
  1147. ssl->alpn_chosen = *p;
  1148. return( 0 );
  1149. }
  1150. }
  1151. MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
  1152. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1153. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1154. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1155. }
  1156. #endif /* MBEDTLS_SSL_ALPN */
  1157. /*
  1158. * Parse HelloVerifyRequest. Only called after verifying the HS type.
  1159. */
  1160. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1161. static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
  1162. {
  1163. const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  1164. int major_ver, minor_ver;
  1165. unsigned char cookie_len;
  1166. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
  1167. /*
  1168. * struct {
  1169. * ProtocolVersion server_version;
  1170. * opaque cookie<0..2^8-1>;
  1171. * } HelloVerifyRequest;
  1172. */
  1173. MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
  1174. mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
  1175. p += 2;
  1176. /*
  1177. * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
  1178. * even is lower than our min version.
  1179. */
  1180. if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
  1181. minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ||
  1182. major_ver > ssl->conf->max_major_ver ||
  1183. minor_ver > ssl->conf->max_minor_ver )
  1184. {
  1185. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
  1186. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1187. MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
  1188. return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
  1189. }
  1190. cookie_len = *p++;
  1191. MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
  1192. if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
  1193. {
  1194. MBEDTLS_SSL_DEBUG_MSG( 1,
  1195. ( "cookie length does not match incoming message size" ) );
  1196. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1197. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1198. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1199. }
  1200. mbedtls_free( ssl->handshake->verify_cookie );
  1201. ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
  1202. if( ssl->handshake->verify_cookie == NULL )
  1203. {
  1204. MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
  1205. return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
  1206. }
  1207. memcpy( ssl->handshake->verify_cookie, p, cookie_len );
  1208. ssl->handshake->verify_cookie_len = cookie_len;
  1209. /* Start over at ClientHello */
  1210. ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
  1211. mbedtls_ssl_reset_checksum( ssl );
  1212. mbedtls_ssl_recv_flight_completed( ssl );
  1213. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
  1214. return( 0 );
  1215. }
  1216. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1217. static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
  1218. {
  1219. int ret, i;
  1220. size_t n;
  1221. size_t ext_len;
  1222. unsigned char *buf, *ext;
  1223. unsigned char comp;
  1224. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1225. int accept_comp;
  1226. #endif
  1227. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1228. int renegotiation_info_seen = 0;
  1229. #endif
  1230. int handshake_failure = 0;
  1231. const mbedtls_ssl_ciphersuite_t *suite_info;
  1232. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
  1233. buf = ssl->in_msg;
  1234. if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
  1235. {
  1236. /* No alert on a read error. */
  1237. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  1238. return( ret );
  1239. }
  1240. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  1241. {
  1242. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1243. if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  1244. {
  1245. ssl->renego_records_seen++;
  1246. if( ssl->conf->renego_max_records >= 0 &&
  1247. ssl->renego_records_seen > ssl->conf->renego_max_records )
  1248. {
  1249. MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
  1250. "but not honored by server" ) );
  1251. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1252. }
  1253. MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
  1254. ssl->keep_current_message = 1;
  1255. return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
  1256. }
  1257. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1258. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1259. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1260. MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  1261. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1262. }
  1263. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1264. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1265. {
  1266. if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
  1267. {
  1268. MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
  1269. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
  1270. return( ssl_parse_hello_verify_request( ssl ) );
  1271. }
  1272. else
  1273. {
  1274. /* We made it through the verification process */
  1275. mbedtls_free( ssl->handshake->verify_cookie );
  1276. ssl->handshake->verify_cookie = NULL;
  1277. ssl->handshake->verify_cookie_len = 0;
  1278. }
  1279. }
  1280. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1281. if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) ||
  1282. buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
  1283. {
  1284. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1285. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1286. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1287. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1288. }
  1289. /*
  1290. * 0 . 1 server_version
  1291. * 2 . 33 random (maybe including 4 bytes of Unix time)
  1292. * 34 . 34 session_id length = n
  1293. * 35 . 34+n session_id
  1294. * 35+n . 36+n cipher_suite
  1295. * 37+n . 37+n compression_method
  1296. *
  1297. * 38+n . 39+n extensions length (optional)
  1298. * 40+n . .. extensions
  1299. */
  1300. buf += mbedtls_ssl_hs_hdr_len( ssl );
  1301. MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
  1302. mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
  1303. ssl->conf->transport, buf + 0 );
  1304. if( ssl->major_ver < ssl->conf->min_major_ver ||
  1305. ssl->minor_ver < ssl->conf->min_minor_ver ||
  1306. ssl->major_ver > ssl->conf->max_major_ver ||
  1307. ssl->minor_ver > ssl->conf->max_minor_ver )
  1308. {
  1309. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
  1310. " min: [%d:%d], server: [%d:%d], max: [%d:%d]",
  1311. ssl->conf->min_major_ver, ssl->conf->min_minor_ver,
  1312. ssl->major_ver, ssl->minor_ver,
  1313. ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) );
  1314. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1315. MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
  1316. return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
  1317. }
  1318. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu",
  1319. ( (uint32_t) buf[2] << 24 ) |
  1320. ( (uint32_t) buf[3] << 16 ) |
  1321. ( (uint32_t) buf[4] << 8 ) |
  1322. ( (uint32_t) buf[5] ) ) );
  1323. memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
  1324. n = buf[34];
  1325. MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
  1326. if( n > 32 )
  1327. {
  1328. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1329. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1330. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1331. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1332. }
  1333. if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
  1334. {
  1335. ext_len = ( ( buf[38 + n] << 8 )
  1336. | ( buf[39 + n] ) );
  1337. if( ( ext_len > 0 && ext_len < 4 ) ||
  1338. ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
  1339. {
  1340. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1341. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1342. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1343. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1344. }
  1345. }
  1346. else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
  1347. {
  1348. ext_len = 0;
  1349. }
  1350. else
  1351. {
  1352. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1353. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1354. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1355. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1356. }
  1357. /* ciphersuite (used later) */
  1358. i = ( buf[35 + n] << 8 ) | buf[36 + n];
  1359. /*
  1360. * Read and check compression
  1361. */
  1362. comp = buf[37 + n];
  1363. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1364. /* See comments in ssl_write_client_hello() */
  1365. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1366. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1367. accept_comp = 0;
  1368. else
  1369. #endif
  1370. accept_comp = 1;
  1371. if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
  1372. ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) )
  1373. #else /* MBEDTLS_ZLIB_SUPPORT */
  1374. if( comp != MBEDTLS_SSL_COMPRESS_NULL )
  1375. #endif/* MBEDTLS_ZLIB_SUPPORT */
  1376. {
  1377. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
  1378. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1379. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1380. return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
  1381. }
  1382. /*
  1383. * Initialize update checksum functions
  1384. */
  1385. ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
  1386. if( ssl->transform_negotiate->ciphersuite_info == NULL )
  1387. {
  1388. MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) );
  1389. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1390. MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
  1391. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  1392. }
  1393. mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
  1394. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
  1395. MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
  1396. /*
  1397. * Check if the session can be resumed
  1398. */
  1399. if( ssl->handshake->resume == 0 || n == 0 ||
  1400. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1401. ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
  1402. #endif
  1403. ssl->session_negotiate->ciphersuite != i ||
  1404. ssl->session_negotiate->compression != comp ||
  1405. ssl->session_negotiate->id_len != n ||
  1406. memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
  1407. {
  1408. ssl->state++;
  1409. ssl->handshake->resume = 0;
  1410. #if defined(MBEDTLS_HAVE_TIME)
  1411. ssl->session_negotiate->start = mbedtls_time( NULL );
  1412. #endif
  1413. ssl->session_negotiate->ciphersuite = i;
  1414. ssl->session_negotiate->compression = comp;
  1415. ssl->session_negotiate->id_len = n;
  1416. memcpy( ssl->session_negotiate->id, buf + 35, n );
  1417. }
  1418. else
  1419. {
  1420. ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
  1421. if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  1422. {
  1423. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  1424. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1425. MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
  1426. return( ret );
  1427. }
  1428. }
  1429. MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
  1430. ssl->handshake->resume ? "a" : "no" ) );
  1431. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
  1432. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
  1433. /*
  1434. * Perform cipher suite validation in same way as in ssl_write_client_hello.
  1435. */
  1436. i = 0;
  1437. while( 1 )
  1438. {
  1439. if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
  1440. {
  1441. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1442. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1443. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1444. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1445. }
  1446. if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
  1447. ssl->session_negotiate->ciphersuite )
  1448. {
  1449. break;
  1450. }
  1451. }
  1452. suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
  1453. if( ssl_validate_ciphersuite( suite_info, ssl, ssl->minor_ver, ssl->minor_ver ) != 0 )
  1454. {
  1455. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1456. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1457. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1458. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1459. }
  1460. MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
  1461. if( comp != MBEDTLS_SSL_COMPRESS_NULL
  1462. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1463. && comp != MBEDTLS_SSL_COMPRESS_DEFLATE
  1464. #endif
  1465. )
  1466. {
  1467. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1468. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1469. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1470. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1471. }
  1472. ssl->session_negotiate->compression = comp;
  1473. ext = buf + 40 + n;
  1474. MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
  1475. while( ext_len )
  1476. {
  1477. unsigned int ext_id = ( ( ext[0] << 8 )
  1478. | ( ext[1] ) );
  1479. unsigned int ext_size = ( ( ext[2] << 8 )
  1480. | ( ext[3] ) );
  1481. if( ext_size + 4 > ext_len )
  1482. {
  1483. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1484. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1485. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1486. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1487. }
  1488. switch( ext_id )
  1489. {
  1490. case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
  1491. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
  1492. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1493. renegotiation_info_seen = 1;
  1494. #endif
  1495. if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
  1496. ext_size ) ) != 0 )
  1497. return( ret );
  1498. break;
  1499. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1500. case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
  1501. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
  1502. if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
  1503. ext + 4, ext_size ) ) != 0 )
  1504. {
  1505. return( ret );
  1506. }
  1507. break;
  1508. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  1509. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1510. case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
  1511. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
  1512. if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
  1513. ext + 4, ext_size ) ) != 0 )
  1514. {
  1515. return( ret );
  1516. }
  1517. break;
  1518. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  1519. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1520. case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
  1521. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
  1522. if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
  1523. ext + 4, ext_size ) ) != 0 )
  1524. {
  1525. return( ret );
  1526. }
  1527. break;
  1528. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  1529. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1530. case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
  1531. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) );
  1532. if( ( ret = ssl_parse_extended_ms_ext( ssl,
  1533. ext + 4, ext_size ) ) != 0 )
  1534. {
  1535. return( ret );
  1536. }
  1537. break;
  1538. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  1539. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1540. case MBEDTLS_TLS_EXT_SESSION_TICKET:
  1541. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
  1542. if( ( ret = ssl_parse_session_ticket_ext( ssl,
  1543. ext + 4, ext_size ) ) != 0 )
  1544. {
  1545. return( ret );
  1546. }
  1547. break;
  1548. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1549. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1550. defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1551. case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
  1552. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) );
  1553. if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
  1554. ext + 4, ext_size ) ) != 0 )
  1555. {
  1556. return( ret );
  1557. }
  1558. break;
  1559. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  1560. MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1561. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1562. case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
  1563. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
  1564. if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
  1565. ext + 4, ext_size ) ) != 0 )
  1566. {
  1567. return( ret );
  1568. }
  1569. break;
  1570. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1571. #if defined(MBEDTLS_SSL_ALPN)
  1572. case MBEDTLS_TLS_EXT_ALPN:
  1573. MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
  1574. if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
  1575. return( ret );
  1576. break;
  1577. #endif /* MBEDTLS_SSL_ALPN */
  1578. default:
  1579. MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
  1580. ext_id ) );
  1581. }
  1582. ext_len -= 4 + ext_size;
  1583. ext += 4 + ext_size;
  1584. if( ext_len > 0 && ext_len < 4 )
  1585. {
  1586. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1587. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1588. }
  1589. }
  1590. /*
  1591. * Renegotiation security checks
  1592. */
  1593. if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1594. ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
  1595. {
  1596. MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
  1597. handshake_failure = 1;
  1598. }
  1599. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1600. else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1601. ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
  1602. renegotiation_info_seen == 0 )
  1603. {
  1604. MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
  1605. handshake_failure = 1;
  1606. }
  1607. else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1608. ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1609. ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
  1610. {
  1611. MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
  1612. handshake_failure = 1;
  1613. }
  1614. else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1615. ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1616. renegotiation_info_seen == 1 )
  1617. {
  1618. MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
  1619. handshake_failure = 1;
  1620. }
  1621. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1622. if( handshake_failure == 1 )
  1623. {
  1624. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1625. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1626. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1627. }
  1628. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
  1629. return( 0 );
  1630. }
  1631. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  1632. defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  1633. static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl, unsigned char **p,
  1634. unsigned char *end )
  1635. {
  1636. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  1637. /*
  1638. * Ephemeral DH parameters:
  1639. *
  1640. * struct {
  1641. * opaque dh_p<1..2^16-1>;
  1642. * opaque dh_g<1..2^16-1>;
  1643. * opaque dh_Ys<1..2^16-1>;
  1644. * } ServerDHParams;
  1645. */
  1646. if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 )
  1647. {
  1648. MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
  1649. return( ret );
  1650. }
  1651. if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
  1652. {
  1653. MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
  1654. ssl->handshake->dhm_ctx.len * 8,
  1655. ssl->conf->dhm_min_bitlen ) );
  1656. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1657. }
  1658. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
  1659. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
  1660. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
  1661. return( ret );
  1662. }
  1663. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  1664. MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  1665. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  1666. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
  1667. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
  1668. defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  1669. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  1670. static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
  1671. {
  1672. const mbedtls_ecp_curve_info *curve_info;
  1673. curve_info = mbedtls_ecp_curve_info_from_grp_id( ssl->handshake->ecdh_ctx.grp.id );
  1674. if( curve_info == NULL )
  1675. {
  1676. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  1677. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  1678. }
  1679. MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
  1680. #if defined(MBEDTLS_ECP_C)
  1681. if( mbedtls_ssl_check_curve( ssl, ssl->handshake->ecdh_ctx.grp.id ) != 0 )
  1682. #else
  1683. if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
  1684. ssl->handshake->ecdh_ctx.grp.nbits > 521 )
  1685. #endif
  1686. return( -1 );
  1687. MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Qp", &ssl->handshake->ecdh_ctx.Qp );
  1688. return( 0 );
  1689. }
  1690. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  1691. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  1692. MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
  1693. MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  1694. MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  1695. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  1696. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
  1697. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  1698. static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
  1699. unsigned char **p,
  1700. unsigned char *end )
  1701. {
  1702. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  1703. /*
  1704. * Ephemeral ECDH parameters:
  1705. *
  1706. * struct {
  1707. * ECParameters curve_params;
  1708. * ECPoint public;
  1709. * } ServerECDHParams;
  1710. */
  1711. if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
  1712. (const unsigned char **) p, end ) ) != 0 )
  1713. {
  1714. MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
  1715. return( ret );
  1716. }
  1717. if( ssl_check_server_ecdh_params( ssl ) != 0 )
  1718. {
  1719. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) );
  1720. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1721. }
  1722. return( ret );
  1723. }
  1724. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  1725. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  1726. MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
  1727. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  1728. static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
  1729. unsigned char **p,
  1730. unsigned char *end )
  1731. {
  1732. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  1733. size_t len;
  1734. ((void) ssl);
  1735. /*
  1736. * PSK parameters:
  1737. *
  1738. * opaque psk_identity_hint<0..2^16-1>;
  1739. */
  1740. if( end - (*p) < 2 )
  1741. {
  1742. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
  1743. "(psk_identity_hint length)" ) );
  1744. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1745. }
  1746. len = (*p)[0] << 8 | (*p)[1];
  1747. *p += 2;
  1748. if( end - (*p) < (int) len )
  1749. {
  1750. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
  1751. "(psk_identity_hint length)" ) );
  1752. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1753. }
  1754. /*
  1755. * Note: we currently ignore the PKS identity hint, as we only allow one
  1756. * PSK to be provisionned on the client. This could be changed later if
  1757. * someone needs that feature.
  1758. */
  1759. *p += len;
  1760. ret = 0;
  1761. return( ret );
  1762. }
  1763. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  1764. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
  1765. defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  1766. /*
  1767. * Generate a pre-master secret and encrypt it with the server's RSA key
  1768. */
  1769. static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
  1770. size_t offset, size_t *olen,
  1771. size_t pms_offset )
  1772. {
  1773. int ret;
  1774. size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
  1775. unsigned char *p = ssl->handshake->premaster + pms_offset;
  1776. if( offset + len_bytes > MBEDTLS_SSL_MAX_CONTENT_LEN )
  1777. {
  1778. MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
  1779. return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
  1780. }
  1781. /*
  1782. * Generate (part of) the pre-master as
  1783. * struct {
  1784. * ProtocolVersion client_version;
  1785. * opaque random[46];
  1786. * } PreMasterSecret;
  1787. */
  1788. mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
  1789. ssl->conf->transport, p );
  1790. if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
  1791. {
  1792. MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
  1793. return( ret );
  1794. }
  1795. ssl->handshake->pmslen = 48;
  1796. if( ssl->session_negotiate->peer_cert == NULL )
  1797. {
  1798. MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
  1799. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1800. }
  1801. /*
  1802. * Now write it out, encrypted
  1803. */
  1804. if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
  1805. MBEDTLS_PK_RSA ) )
  1806. {
  1807. MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
  1808. return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  1809. }
  1810. if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk,
  1811. p, ssl->handshake->pmslen,
  1812. ssl->out_msg + offset + len_bytes, olen,
  1813. MBEDTLS_SSL_MAX_CONTENT_LEN - offset - len_bytes,
  1814. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  1815. {
  1816. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
  1817. return( ret );
  1818. }
  1819. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  1820. defined(MBEDTLS_SSL_PROTO_TLS1_2)
  1821. if( len_bytes == 2 )
  1822. {
  1823. ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
  1824. ssl->out_msg[offset+1] = (unsigned char)( *olen );
  1825. *olen += 2;
  1826. }
  1827. #endif
  1828. return( 0 );
  1829. }
  1830. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
  1831. MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
  1832. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  1833. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  1834. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  1835. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  1836. static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
  1837. unsigned char **p,
  1838. unsigned char *end,
  1839. mbedtls_md_type_t *md_alg,
  1840. mbedtls_pk_type_t *pk_alg )
  1841. {
  1842. ((void) ssl);
  1843. *md_alg = MBEDTLS_MD_NONE;
  1844. *pk_alg = MBEDTLS_PK_NONE;
  1845. /* Only in TLS 1.2 */
  1846. if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  1847. {
  1848. return( 0 );
  1849. }
  1850. if( (*p) + 2 > end )
  1851. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1852. /*
  1853. * Get hash algorithm
  1854. */
  1855. if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) ) == MBEDTLS_MD_NONE )
  1856. {
  1857. MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
  1858. "HashAlgorithm %d", *(p)[0] ) );
  1859. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1860. }
  1861. /*
  1862. * Get signature algorithm
  1863. */
  1864. if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) ) == MBEDTLS_PK_NONE )
  1865. {
  1866. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
  1867. "SignatureAlgorithm %d", (*p)[1] ) );
  1868. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1869. }
  1870. /*
  1871. * Check if the hash is acceptable
  1872. */
  1873. if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
  1874. {
  1875. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm %d that was not offered",
  1876. *(p)[0] ) );
  1877. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  1878. }
  1879. MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) );
  1880. MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) );
  1881. *p += 2;
  1882. return( 0 );
  1883. }
  1884. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  1885. MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  1886. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  1887. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  1888. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  1889. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  1890. static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
  1891. {
  1892. int ret;
  1893. const mbedtls_ecp_keypair *peer_key;
  1894. if( ssl->session_negotiate->peer_cert == NULL )
  1895. {
  1896. MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
  1897. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1898. }
  1899. if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
  1900. MBEDTLS_PK_ECKEY ) )
  1901. {
  1902. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
  1903. return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  1904. }
  1905. peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk );
  1906. if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
  1907. MBEDTLS_ECDH_THEIRS ) ) != 0 )
  1908. {
  1909. MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
  1910. return( ret );
  1911. }
  1912. if( ssl_check_server_ecdh_params( ssl ) != 0 )
  1913. {
  1914. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
  1915. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
  1916. }
  1917. return( ret );
  1918. }
  1919. #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
  1920. MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  1921. static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
  1922. {
  1923. int ret;
  1924. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  1925. ssl->transform_negotiate->ciphersuite_info;
  1926. unsigned char *p = NULL, *end = NULL;
  1927. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
  1928. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
  1929. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
  1930. {
  1931. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
  1932. ssl->state++;
  1933. return( 0 );
  1934. }
  1935. ((void) p);
  1936. ((void) end);
  1937. #endif
  1938. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  1939. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  1940. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
  1941. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
  1942. {
  1943. if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
  1944. {
  1945. MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
  1946. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1947. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1948. return( ret );
  1949. }
  1950. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
  1951. ssl->state++;
  1952. return( 0 );
  1953. }
  1954. ((void) p);
  1955. ((void) end);
  1956. #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  1957. MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  1958. if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
  1959. {
  1960. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  1961. return( ret );
  1962. }
  1963. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  1964. {
  1965. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  1966. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1967. MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  1968. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1969. }
  1970. /*
  1971. * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
  1972. * doesn't use a psk_identity_hint
  1973. */
  1974. if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
  1975. {
  1976. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  1977. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  1978. {
  1979. /* Current message is probably either
  1980. * CertificateRequest or ServerHelloDone */
  1981. ssl->keep_current_message = 1;
  1982. goto exit;
  1983. }
  1984. MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key exchange message must "
  1985. "not be skipped" ) );
  1986. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1987. MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  1988. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1989. }
  1990. p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  1991. end = ssl->in_msg + ssl->in_hslen;
  1992. MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
  1993. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  1994. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  1995. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  1996. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  1997. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  1998. {
  1999. if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
  2000. {
  2001. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2002. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2003. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2004. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2005. }
  2006. } /* FALLTROUGH */
  2007. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  2008. #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
  2009. defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2010. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2011. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  2012. ; /* nothing more to do */
  2013. else
  2014. #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
  2015. MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
  2016. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
  2017. defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  2018. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
  2019. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
  2020. {
  2021. if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
  2022. {
  2023. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2024. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2025. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2026. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2027. }
  2028. }
  2029. else
  2030. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  2031. MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2032. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  2033. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
  2034. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2035. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2036. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2037. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
  2038. {
  2039. if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
  2040. {
  2041. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2042. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2043. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2044. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2045. }
  2046. }
  2047. else
  2048. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2049. MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
  2050. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  2051. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2052. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2053. {
  2054. ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
  2055. p, end - p );
  2056. if( ret != 0 )
  2057. {
  2058. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
  2059. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2060. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2061. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2062. }
  2063. }
  2064. else
  2065. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  2066. {
  2067. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2068. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2069. }
  2070. #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
  2071. if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
  2072. {
  2073. size_t sig_len, hashlen;
  2074. unsigned char hash[64];
  2075. mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
  2076. mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
  2077. unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  2078. size_t params_len = p - params;
  2079. /*
  2080. * Handle the digitally-signed structure
  2081. */
  2082. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2083. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2084. {
  2085. if( ssl_parse_signature_algorithm( ssl, &p, end,
  2086. &md_alg, &pk_alg ) != 0 )
  2087. {
  2088. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2089. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2090. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2091. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2092. }
  2093. if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
  2094. {
  2095. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2096. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2097. MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2098. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2099. }
  2100. }
  2101. else
  2102. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2103. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2104. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2105. if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
  2106. {
  2107. pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
  2108. /* Default hash for ECDSA is SHA-1 */
  2109. if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
  2110. md_alg = MBEDTLS_MD_SHA1;
  2111. }
  2112. else
  2113. #endif
  2114. {
  2115. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2116. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2117. }
  2118. /*
  2119. * Read signature
  2120. */
  2121. if( p > end - 2 )
  2122. {
  2123. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2124. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2125. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2126. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2127. }
  2128. sig_len = ( p[0] << 8 ) | p[1];
  2129. p += 2;
  2130. if( p != end - sig_len )
  2131. {
  2132. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2133. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2134. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2135. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2136. }
  2137. MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
  2138. /*
  2139. * Compute the hash that has been signed
  2140. */
  2141. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2142. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2143. if( md_alg == MBEDTLS_MD_NONE )
  2144. {
  2145. hashlen = 36;
  2146. ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash, params,
  2147. params_len );
  2148. if( ret != 0 )
  2149. return( ret );
  2150. }
  2151. else
  2152. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  2153. MBEDTLS_SSL_PROTO_TLS1_1 */
  2154. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  2155. defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2156. if( md_alg != MBEDTLS_MD_NONE )
  2157. {
  2158. /* Info from md_alg will be used instead */
  2159. hashlen = 0;
  2160. ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, params,
  2161. params_len, md_alg );
  2162. if( ret != 0 )
  2163. return( ret );
  2164. }
  2165. else
  2166. #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
  2167. MBEDTLS_SSL_PROTO_TLS1_2 */
  2168. {
  2169. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2170. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2171. }
  2172. MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
  2173. (unsigned int) ( mbedtls_md_get_size( mbedtls_md_info_from_type( md_alg ) ) ) );
  2174. if( ssl->session_negotiate->peer_cert == NULL )
  2175. {
  2176. MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
  2177. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2178. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  2179. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2180. }
  2181. /*
  2182. * Verify signature
  2183. */
  2184. if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
  2185. {
  2186. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2187. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2188. MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  2189. return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  2190. }
  2191. if( ( ret = mbedtls_pk_verify( &ssl->session_negotiate->peer_cert->pk,
  2192. md_alg, hash, hashlen, p, sig_len ) ) != 0 )
  2193. {
  2194. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2195. MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
  2196. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
  2197. return( ret );
  2198. }
  2199. }
  2200. #endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
  2201. exit:
  2202. ssl->state++;
  2203. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
  2204. return( 0 );
  2205. }
  2206. #if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
  2207. static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
  2208. {
  2209. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2210. ssl->transform_negotiate->ciphersuite_info;
  2211. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
  2212. if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
  2213. {
  2214. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
  2215. ssl->state++;
  2216. return( 0 );
  2217. }
  2218. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2219. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2220. }
  2221. #else /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
  2222. static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
  2223. {
  2224. int ret;
  2225. unsigned char *buf;
  2226. size_t n = 0;
  2227. size_t cert_type_len = 0, dn_len = 0;
  2228. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2229. ssl->transform_negotiate->ciphersuite_info;
  2230. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
  2231. if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
  2232. {
  2233. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
  2234. ssl->state++;
  2235. return( 0 );
  2236. }
  2237. if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
  2238. {
  2239. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2240. return( ret );
  2241. }
  2242. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2243. {
  2244. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2245. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2246. MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  2247. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2248. }
  2249. ssl->state++;
  2250. ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST );
  2251. MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
  2252. ssl->client_auth ? "a" : "no" ) );
  2253. if( ssl->client_auth == 0 )
  2254. {
  2255. /* Current message is probably the ServerHelloDone */
  2256. ssl->keep_current_message = 1;
  2257. goto exit;
  2258. }
  2259. /*
  2260. * struct {
  2261. * ClientCertificateType certificate_types<1..2^8-1>;
  2262. * SignatureAndHashAlgorithm
  2263. * supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
  2264. * DistinguishedName certificate_authorities<0..2^16-1>;
  2265. * } CertificateRequest;
  2266. *
  2267. * Since we only support a single certificate on clients, let's just
  2268. * ignore all the information that's supposed to help us pick a
  2269. * certificate.
  2270. *
  2271. * We could check that our certificate matches the request, and bail out
  2272. * if it doesn't, but it's simpler to just send the certificate anyway,
  2273. * and give the server the opportunity to decide if it should terminate
  2274. * the connection when it doesn't like our certificate.
  2275. *
  2276. * Same goes for the hash in TLS 1.2's signature_algorithms: at this
  2277. * point we only have one hash available (see comments in
  2278. * write_certificate_verify), so let's just use what we have.
  2279. *
  2280. * However, we still minimally parse the message to check it is at least
  2281. * superficially sane.
  2282. */
  2283. buf = ssl->in_msg;
  2284. /* certificate_types */
  2285. if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) )
  2286. {
  2287. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2288. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2289. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2290. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2291. }
  2292. cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
  2293. n = cert_type_len;
  2294. /*
  2295. * In the subsequent code there are two paths that read from buf:
  2296. * * the length of the signature algorithms field (if minor version of
  2297. * SSL is 3),
  2298. * * distinguished name length otherwise.
  2299. * Both reach at most the index:
  2300. * ...hdr_len + 2 + n,
  2301. * therefore the buffer length at this point must be greater than that
  2302. * regardless of the actual code path.
  2303. */
  2304. if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
  2305. {
  2306. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2307. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2308. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2309. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2310. }
  2311. /* supported_signature_algorithms */
  2312. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2313. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2314. {
  2315. size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
  2316. | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
  2317. #if defined(MBEDTLS_DEBUG_C)
  2318. unsigned char* sig_alg;
  2319. size_t i;
  2320. #endif
  2321. /*
  2322. * The furthest access in buf is in the loop few lines below:
  2323. * sig_alg[i + 1],
  2324. * where:
  2325. * sig_alg = buf + ...hdr_len + 3 + n,
  2326. * max(i) = sig_alg_len - 1.
  2327. * Therefore the furthest access is:
  2328. * buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
  2329. * which reduces to:
  2330. * buf[...hdr_len + 3 + n + sig_alg_len],
  2331. * which is one less than we need the buf to be.
  2332. */
  2333. if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n + sig_alg_len )
  2334. {
  2335. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2336. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2337. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2338. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2339. }
  2340. #if defined(MBEDTLS_DEBUG_C)
  2341. sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
  2342. for( i = 0; i < sig_alg_len; i += 2 )
  2343. {
  2344. MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d"
  2345. ",%d", sig_alg[i], sig_alg[i + 1] ) );
  2346. }
  2347. #endif
  2348. n += 2 + sig_alg_len;
  2349. }
  2350. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2351. /* certificate_authorities */
  2352. dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
  2353. | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
  2354. n += dn_len;
  2355. if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
  2356. {
  2357. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2358. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2359. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2360. return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2361. }
  2362. exit:
  2363. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
  2364. return( 0 );
  2365. }
  2366. #endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
  2367. static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
  2368. {
  2369. int ret;
  2370. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
  2371. if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
  2372. {
  2373. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2374. return( ret );
  2375. }
  2376. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2377. {
  2378. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
  2379. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2380. }
  2381. if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ||
  2382. ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
  2383. {
  2384. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
  2385. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2386. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2387. return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
  2388. }
  2389. ssl->state++;
  2390. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  2391. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  2392. mbedtls_ssl_recv_flight_completed( ssl );
  2393. #endif
  2394. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
  2395. return( 0 );
  2396. }
  2397. static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
  2398. {
  2399. int ret;
  2400. size_t i, n;
  2401. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2402. ssl->transform_negotiate->ciphersuite_info;
  2403. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
  2404. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
  2405. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
  2406. {
  2407. /*
  2408. * DHM key exchange -- send G^X mod P
  2409. */
  2410. n = ssl->handshake->dhm_ctx.len;
  2411. ssl->out_msg[4] = (unsigned char)( n >> 8 );
  2412. ssl->out_msg[5] = (unsigned char)( n );
  2413. i = 6;
  2414. ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
  2415. (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
  2416. &ssl->out_msg[i], n,
  2417. ssl->conf->f_rng, ssl->conf->p_rng );
  2418. if( ret != 0 )
  2419. {
  2420. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
  2421. return( ret );
  2422. }
  2423. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
  2424. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
  2425. if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
  2426. ssl->handshake->premaster,
  2427. MBEDTLS_PREMASTER_SIZE,
  2428. &ssl->handshake->pmslen,
  2429. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2430. {
  2431. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
  2432. return( ret );
  2433. }
  2434. MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
  2435. }
  2436. else
  2437. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
  2438. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
  2439. defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
  2440. defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  2441. defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2442. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2443. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
  2444. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
  2445. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
  2446. {
  2447. /*
  2448. * ECDH key exchange -- send client public value
  2449. */
  2450. i = 4;
  2451. ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
  2452. &n,
  2453. &ssl->out_msg[i], 1000,
  2454. ssl->conf->f_rng, ssl->conf->p_rng );
  2455. if( ret != 0 )
  2456. {
  2457. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
  2458. return( ret );
  2459. }
  2460. MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
  2461. if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
  2462. &ssl->handshake->pmslen,
  2463. ssl->handshake->premaster,
  2464. MBEDTLS_MPI_MAX_SIZE,
  2465. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2466. {
  2467. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
  2468. return( ret );
  2469. }
  2470. MBEDTLS_SSL_DEBUG_MPI( 3, "ECDH: z", &ssl->handshake->ecdh_ctx.z );
  2471. }
  2472. else
  2473. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2474. MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  2475. MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  2476. MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  2477. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  2478. if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
  2479. {
  2480. /*
  2481. * opaque psk_identity<0..2^16-1>;
  2482. */
  2483. if( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL )
  2484. {
  2485. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) );
  2486. return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  2487. }
  2488. i = 4;
  2489. n = ssl->conf->psk_identity_len;
  2490. if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
  2491. {
  2492. MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or "
  2493. "SSL buffer too short" ) );
  2494. return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
  2495. }
  2496. ssl->out_msg[i++] = (unsigned char)( n >> 8 );
  2497. ssl->out_msg[i++] = (unsigned char)( n );
  2498. memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len );
  2499. i += ssl->conf->psk_identity_len;
  2500. #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
  2501. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
  2502. {
  2503. n = 0;
  2504. }
  2505. else
  2506. #endif
  2507. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2508. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  2509. {
  2510. if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 )
  2511. return( ret );
  2512. }
  2513. else
  2514. #endif
  2515. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  2516. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
  2517. {
  2518. /*
  2519. * ClientDiffieHellmanPublic public (DHM send G^X mod P)
  2520. */
  2521. n = ssl->handshake->dhm_ctx.len;
  2522. if( i + 2 + n > MBEDTLS_SSL_MAX_CONTENT_LEN )
  2523. {
  2524. MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long"
  2525. " or SSL buffer too short" ) );
  2526. return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
  2527. }
  2528. ssl->out_msg[i++] = (unsigned char)( n >> 8 );
  2529. ssl->out_msg[i++] = (unsigned char)( n );
  2530. ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
  2531. (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
  2532. &ssl->out_msg[i], n,
  2533. ssl->conf->f_rng, ssl->conf->p_rng );
  2534. if( ret != 0 )
  2535. {
  2536. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
  2537. return( ret );
  2538. }
  2539. }
  2540. else
  2541. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2542. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  2543. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  2544. {
  2545. /*
  2546. * ClientECDiffieHellmanPublic public;
  2547. */
  2548. ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n,
  2549. &ssl->out_msg[i], MBEDTLS_SSL_MAX_CONTENT_LEN - i,
  2550. ssl->conf->f_rng, ssl->conf->p_rng );
  2551. if( ret != 0 )
  2552. {
  2553. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
  2554. return( ret );
  2555. }
  2556. MBEDTLS_SSL_DEBUG_ECP( 3, "ECDH: Q", &ssl->handshake->ecdh_ctx.Q );
  2557. }
  2558. else
  2559. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
  2560. {
  2561. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2562. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2563. }
  2564. if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
  2565. ciphersuite_info->key_exchange ) ) != 0 )
  2566. {
  2567. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
  2568. return( ret );
  2569. }
  2570. }
  2571. else
  2572. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  2573. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
  2574. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
  2575. {
  2576. i = 4;
  2577. if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 )
  2578. return( ret );
  2579. }
  2580. else
  2581. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
  2582. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2583. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2584. {
  2585. i = 4;
  2586. ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
  2587. ssl->out_msg + i, MBEDTLS_SSL_MAX_CONTENT_LEN - i, &n,
  2588. ssl->conf->f_rng, ssl->conf->p_rng );
  2589. if( ret != 0 )
  2590. {
  2591. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
  2592. return( ret );
  2593. }
  2594. ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
  2595. ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
  2596. ssl->conf->f_rng, ssl->conf->p_rng );
  2597. if( ret != 0 )
  2598. {
  2599. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
  2600. return( ret );
  2601. }
  2602. }
  2603. else
  2604. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
  2605. {
  2606. ((void) ciphersuite_info);
  2607. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2608. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2609. }
  2610. ssl->out_msglen = i + n;
  2611. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  2612. ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
  2613. ssl->state++;
  2614. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  2615. {
  2616. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  2617. return( ret );
  2618. }
  2619. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
  2620. return( 0 );
  2621. }
  2622. #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
  2623. !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
  2624. !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
  2625. !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
  2626. !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
  2627. !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2628. static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
  2629. {
  2630. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2631. ssl->transform_negotiate->ciphersuite_info;
  2632. int ret;
  2633. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
  2634. if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  2635. {
  2636. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  2637. return( ret );
  2638. }
  2639. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2640. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  2641. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2642. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2643. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2644. {
  2645. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
  2646. ssl->state++;
  2647. return( 0 );
  2648. }
  2649. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2650. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2651. }
  2652. #else
  2653. static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
  2654. {
  2655. int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2656. const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2657. ssl->transform_negotiate->ciphersuite_info;
  2658. size_t n = 0, offset = 0;
  2659. unsigned char hash[48];
  2660. unsigned char *hash_start = hash;
  2661. mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
  2662. unsigned int hashlen;
  2663. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
  2664. if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  2665. {
  2666. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  2667. return( ret );
  2668. }
  2669. if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2670. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  2671. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2672. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2673. ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2674. {
  2675. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
  2676. ssl->state++;
  2677. return( 0 );
  2678. }
  2679. if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
  2680. {
  2681. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
  2682. ssl->state++;
  2683. return( 0 );
  2684. }
  2685. if( mbedtls_ssl_own_key( ssl ) == NULL )
  2686. {
  2687. MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
  2688. return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  2689. }
  2690. /*
  2691. * Make an RSA signature of the handshake digests
  2692. */
  2693. ssl->handshake->calc_verify( ssl, hash );
  2694. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2695. defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2696. if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  2697. {
  2698. /*
  2699. * digitally-signed struct {
  2700. * opaque md5_hash[16];
  2701. * opaque sha_hash[20];
  2702. * };
  2703. *
  2704. * md5_hash
  2705. * MD5(handshake_messages);
  2706. *
  2707. * sha_hash
  2708. * SHA(handshake_messages);
  2709. */
  2710. hashlen = 36;
  2711. md_alg = MBEDTLS_MD_NONE;
  2712. /*
  2713. * For ECDSA, default hash is SHA-1 only
  2714. */
  2715. if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
  2716. {
  2717. hash_start += 16;
  2718. hashlen -= 16;
  2719. md_alg = MBEDTLS_MD_SHA1;
  2720. }
  2721. }
  2722. else
  2723. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  2724. MBEDTLS_SSL_PROTO_TLS1_1 */
  2725. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2726. if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2727. {
  2728. /*
  2729. * digitally-signed struct {
  2730. * opaque handshake_messages[handshake_messages_length];
  2731. * };
  2732. *
  2733. * Taking shortcut here. We assume that the server always allows the
  2734. * PRF Hash function and has sent it in the allowed signature
  2735. * algorithms list received in the Certificate Request message.
  2736. *
  2737. * Until we encounter a server that does not, we will take this
  2738. * shortcut.
  2739. *
  2740. * Reason: Otherwise we should have running hashes for SHA512 and SHA224
  2741. * in order to satisfy 'weird' needs from the server side.
  2742. */
  2743. if( ssl->transform_negotiate->ciphersuite_info->mac ==
  2744. MBEDTLS_MD_SHA384 )
  2745. {
  2746. md_alg = MBEDTLS_MD_SHA384;
  2747. ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
  2748. }
  2749. else
  2750. {
  2751. md_alg = MBEDTLS_MD_SHA256;
  2752. ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
  2753. }
  2754. ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
  2755. /* Info from md_alg will be used instead */
  2756. hashlen = 0;
  2757. offset = 2;
  2758. }
  2759. else
  2760. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2761. {
  2762. MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2763. return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2764. }
  2765. if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash_start, hashlen,
  2766. ssl->out_msg + 6 + offset, &n,
  2767. ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2768. {
  2769. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
  2770. return( ret );
  2771. }
  2772. ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
  2773. ssl->out_msg[5 + offset] = (unsigned char)( n );
  2774. ssl->out_msglen = 6 + n + offset;
  2775. ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  2776. ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
  2777. ssl->state++;
  2778. if( ( ret = mbedtls_ssl_write_record( ssl ) ) != 0 )
  2779. {
  2780. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_record", ret );
  2781. return( ret );
  2782. }
  2783. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
  2784. return( ret );
  2785. }
  2786. #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
  2787. !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
  2788. !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
  2789. !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
  2790. !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
  2791. !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  2792. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  2793. static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
  2794. {
  2795. int ret;
  2796. uint32_t lifetime;
  2797. size_t ticket_len;
  2798. unsigned char *ticket;
  2799. const unsigned char *msg;
  2800. MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
  2801. if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
  2802. {
  2803. MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2804. return( ret );
  2805. }
  2806. if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2807. {
  2808. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
  2809. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2810. MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  2811. return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2812. }
  2813. /*
  2814. * struct {
  2815. * uint32 ticket_lifetime_hint;
  2816. * opaque ticket<0..2^16-1>;
  2817. * } NewSessionTicket;
  2818. *
  2819. * 0 . 3 ticket_lifetime_hint
  2820. * 4 . 5 ticket_len (n)
  2821. * 6 . 5+n ticket content
  2822. */
  2823. if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ||
  2824. ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
  2825. {
  2826. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
  2827. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2828. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2829. return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
  2830. }
  2831. msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  2832. lifetime = ( ((uint32_t) msg[0]) << 24 ) | ( msg[1] << 16 ) |
  2833. ( msg[2] << 8 ) | ( msg[3] );
  2834. ticket_len = ( msg[4] << 8 ) | ( msg[5] );
  2835. if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
  2836. {
  2837. MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
  2838. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2839. MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2840. return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
  2841. }
  2842. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
  2843. /* We're not waiting for a NewSessionTicket message any more */
  2844. ssl->handshake->new_session_ticket = 0;
  2845. ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
  2846. /*
  2847. * Zero-length ticket means the server changed his mind and doesn't want
  2848. * to send a ticket after all, so just forget it
  2849. */
  2850. if( ticket_len == 0 )
  2851. return( 0 );
  2852. mbedtls_zeroize( ssl->session_negotiate->ticket,
  2853. ssl->session_negotiate->ticket_len );
  2854. mbedtls_free( ssl->session_negotiate->ticket );
  2855. ssl->session_negotiate->ticket = NULL;
  2856. ssl->session_negotiate->ticket_len = 0;
  2857. if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
  2858. {
  2859. MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
  2860. mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2861. MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
  2862. return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
  2863. }
  2864. memcpy( ticket, msg + 6, ticket_len );
  2865. ssl->session_negotiate->ticket = ticket;
  2866. ssl->session_negotiate->ticket_len = ticket_len;
  2867. ssl->session_negotiate->ticket_lifetime = lifetime;
  2868. /*
  2869. * RFC 5077 section 3.4:
  2870. * "If the client receives a session ticket from the server, then it
  2871. * discards any Session ID that was sent in the ServerHello."
  2872. */
  2873. MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
  2874. ssl->session_negotiate->id_len = 0;
  2875. MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
  2876. return( 0 );
  2877. }
  2878. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  2879. /*
  2880. * SSL handshake -- client side -- single step
  2881. */
  2882. int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
  2883. {
  2884. int ret = 0;
  2885. if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
  2886. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  2887. MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
  2888. if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
  2889. return( ret );
  2890. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  2891. if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  2892. ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
  2893. {
  2894. if( ( ret = mbedtls_ssl_resend( ssl ) ) != 0 )
  2895. return( ret );
  2896. }
  2897. #endif
  2898. /* Change state now, so that it is right in mbedtls_ssl_read_record(), used
  2899. * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
  2900. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  2901. if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
  2902. ssl->handshake->new_session_ticket != 0 )
  2903. {
  2904. ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
  2905. }
  2906. #endif
  2907. switch( ssl->state )
  2908. {
  2909. case MBEDTLS_SSL_HELLO_REQUEST:
  2910. ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
  2911. break;
  2912. /*
  2913. * ==> ClientHello
  2914. */
  2915. case MBEDTLS_SSL_CLIENT_HELLO:
  2916. ret = ssl_write_client_hello( ssl );
  2917. break;
  2918. /*
  2919. * <== ServerHello
  2920. * Certificate
  2921. * ( ServerKeyExchange )
  2922. * ( CertificateRequest )
  2923. * ServerHelloDone
  2924. */
  2925. case MBEDTLS_SSL_SERVER_HELLO:
  2926. ret = ssl_parse_server_hello( ssl );
  2927. break;
  2928. case MBEDTLS_SSL_SERVER_CERTIFICATE:
  2929. ret = mbedtls_ssl_parse_certificate( ssl );
  2930. break;
  2931. case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
  2932. ret = ssl_parse_server_key_exchange( ssl );
  2933. break;
  2934. case MBEDTLS_SSL_CERTIFICATE_REQUEST:
  2935. ret = ssl_parse_certificate_request( ssl );
  2936. break;
  2937. case MBEDTLS_SSL_SERVER_HELLO_DONE:
  2938. ret = ssl_parse_server_hello_done( ssl );
  2939. break;
  2940. /*
  2941. * ==> ( Certificate/Alert )
  2942. * ClientKeyExchange
  2943. * ( CertificateVerify )
  2944. * ChangeCipherSpec
  2945. * Finished
  2946. */
  2947. case MBEDTLS_SSL_CLIENT_CERTIFICATE:
  2948. ret = mbedtls_ssl_write_certificate( ssl );
  2949. break;
  2950. case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
  2951. ret = ssl_write_client_key_exchange( ssl );
  2952. break;
  2953. case MBEDTLS_SSL_CERTIFICATE_VERIFY:
  2954. ret = ssl_write_certificate_verify( ssl );
  2955. break;
  2956. case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
  2957. ret = mbedtls_ssl_write_change_cipher_spec( ssl );
  2958. break;
  2959. case MBEDTLS_SSL_CLIENT_FINISHED:
  2960. ret = mbedtls_ssl_write_finished( ssl );
  2961. break;
  2962. /*
  2963. * <== ( NewSessionTicket )
  2964. * ChangeCipherSpec
  2965. * Finished
  2966. */
  2967. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  2968. case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
  2969. ret = ssl_parse_new_session_ticket( ssl );
  2970. break;
  2971. #endif
  2972. case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
  2973. ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
  2974. break;
  2975. case MBEDTLS_SSL_SERVER_FINISHED:
  2976. ret = mbedtls_ssl_parse_finished( ssl );
  2977. break;
  2978. case MBEDTLS_SSL_FLUSH_BUFFERS:
  2979. MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
  2980. ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
  2981. break;
  2982. case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
  2983. mbedtls_ssl_handshake_wrapup( ssl );
  2984. break;
  2985. default:
  2986. MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
  2987. return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  2988. }
  2989. return( ret );
  2990. }
  2991. #endif /* MBEDTLS_SSL_CLI_C */