1 /*
2 * SSLv3/TLSv1 client-side functions
3 *
4 * Copyright The Mbed TLS Contributors
5 * SPDX-License-Identifier: Apache-2.0
6 *
7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
8 * not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 */
19
20 #include "common.h"
21
22 #if defined(MBEDTLS_SSL_CLI_C)
23
24 #if defined(MBEDTLS_PLATFORM_C)
25 #include "mbedtls/platform.h"
26 #else
27 #include <stdlib.h>
28 #define mbedtls_calloc calloc
29 #define mbedtls_free free
30 #endif
31
32 #include "mbedtls/ssl.h"
33 #include "mbedtls/ssl_internal.h"
34 #include "mbedtls/debug.h"
35 #include "mbedtls/error.h"
36
37 #if defined(MBEDTLS_USE_PSA_CRYPTO)
38 #include "mbedtls/psa_util.h"
39 #endif /* MBEDTLS_USE_PSA_CRYPTO */
40
41 #include <string.h>
42
43 #include <stdint.h>
44
45 #if defined(MBEDTLS_HAVE_TIME)
46 #include "mbedtls/platform_time.h"
47 #endif
48
49 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
50 #include "mbedtls/platform_util.h"
51 #endif
52
53 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
ssl_conf_has_static_psk(mbedtls_ssl_config const * conf)54 static int ssl_conf_has_static_psk( mbedtls_ssl_config const *conf )
55 {
56 if( conf->psk_identity == NULL ||
57 conf->psk_identity_len == 0 )
58 {
59 return( 0 );
60 }
61
62 if( conf->psk != NULL && conf->psk_len != 0 )
63 return( 1 );
64
65 #if defined(MBEDTLS_USE_PSA_CRYPTO)
66 if( ! mbedtls_svc_key_id_is_null( conf->psk_opaque ) )
67 return( 1 );
68 #endif /* MBEDTLS_USE_PSA_CRYPTO */
69
70 return( 0 );
71 }
72
73 #if defined(MBEDTLS_USE_PSA_CRYPTO)
ssl_conf_has_static_raw_psk(mbedtls_ssl_config const * conf)74 static int ssl_conf_has_static_raw_psk( mbedtls_ssl_config const *conf )
75 {
76 if( conf->psk_identity == NULL ||
77 conf->psk_identity_len == 0 )
78 {
79 return( 0 );
80 }
81
82 if( conf->psk != NULL && conf->psk_len != 0 )
83 return( 1 );
84
85 return( 0 );
86 }
87 #endif /* MBEDTLS_USE_PSA_CRYPTO */
88
89 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
90
91 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
ssl_write_hostname_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)92 static int ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
93 unsigned char *buf,
94 const unsigned char *end,
95 size_t *olen )
96 {
97 unsigned char *p = buf;
98 size_t hostname_len;
99
100 *olen = 0;
101
102 if( ssl->hostname == NULL )
103 return( 0 );
104
105 MBEDTLS_SSL_DEBUG_MSG( 3,
106 ( "client hello, adding server name extension: %s",
107 ssl->hostname ) );
108
109 hostname_len = strlen( ssl->hostname );
110
111 MBEDTLS_SSL_CHK_BUF_PTR( p, end, hostname_len + 9 );
112
113 /*
114 * Sect. 3, RFC 6066 (TLS Extensions Definitions)
115 *
116 * In order to provide any of the server names, clients MAY include an
117 * extension of type "server_name" in the (extended) client hello. The
118 * "extension_data" field of this extension SHALL contain
119 * "ServerNameList" where:
120 *
121 * struct {
122 * NameType name_type;
123 * select (name_type) {
124 * case host_name: HostName;
125 * } name;
126 * } ServerName;
127 *
128 * enum {
129 * host_name(0), (255)
130 * } NameType;
131 *
132 * opaque HostName<1..2^16-1>;
133 *
134 * struct {
135 * ServerName server_name_list<1..2^16-1>
136 * } ServerNameList;
137 *
138 */
139 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
140 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
141
142 *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
143 *p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
144
145 *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
146 *p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
147
148 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
149 *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
150 *p++ = (unsigned char)( ( hostname_len ) & 0xFF );
151
152 memcpy( p, ssl->hostname, hostname_len );
153
154 *olen = hostname_len + 9;
155
156 return( 0 );
157 }
158 #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
159
160 #if defined(MBEDTLS_SSL_RENEGOTIATION)
ssl_write_renegotiation_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)161 static int ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
162 unsigned char *buf,
163 const unsigned char *end,
164 size_t *olen )
165 {
166 unsigned char *p = buf;
167
168 *olen = 0;
169
170 /* We're always including an TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the
171 * initial ClientHello, in which case also adding the renegotiation
172 * info extension is NOT RECOMMENDED as per RFC 5746 Section 3.4. */
173 if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
174 return( 0 );
175
176 MBEDTLS_SSL_DEBUG_MSG( 3,
177 ( "client hello, adding renegotiation extension" ) );
178
179 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 5 + ssl->verify_data_len );
180
181 /*
182 * Secure renegotiation
183 */
184 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 )
185 & 0xFF );
186 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO )
187 & 0xFF );
188
189 *p++ = 0x00;
190 *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
191 *p++ = ssl->verify_data_len & 0xFF;
192
193 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
194
195 *olen = 5 + ssl->verify_data_len;
196
197 return( 0 );
198 }
199 #endif /* MBEDTLS_SSL_RENEGOTIATION */
200
201 /*
202 * Only if we handle at least one key exchange that needs signatures.
203 */
204 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
205 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
ssl_write_signature_algorithms_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)206 static int ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
207 unsigned char *buf,
208 const unsigned char *end,
209 size_t *olen )
210 {
211 unsigned char *p = buf;
212 size_t sig_alg_len = 0;
213 const int *md;
214
215 #if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C)
216 unsigned char *sig_alg_list = buf + 6;
217 #endif
218
219 *olen = 0;
220
221 if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
222 return( 0 );
223
224 MBEDTLS_SSL_DEBUG_MSG( 3,
225 ( "client hello, adding signature_algorithms extension" ) );
226
227 if( ssl->conf->sig_hashes == NULL )
228 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
229
230 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
231 {
232 #if defined(MBEDTLS_ECDSA_C)
233 sig_alg_len += 2;
234 #endif
235 #if defined(MBEDTLS_RSA_C)
236 sig_alg_len += 2;
237 #endif
238 if( sig_alg_len > MBEDTLS_SSL_MAX_SIG_HASH_ALG_LIST_LEN )
239 {
240 MBEDTLS_SSL_DEBUG_MSG( 3,
241 ( "length in bytes of sig-hash-alg extension too big" ) );
242 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
243 }
244 }
245
246 /* Empty signature algorithms list, this is a configuration error. */
247 if( sig_alg_len == 0 )
248 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
249
250 MBEDTLS_SSL_CHK_BUF_PTR( p, end, sig_alg_len + 6 );
251
252 /*
253 * Prepare signature_algorithms extension (TLS 1.2)
254 */
255 sig_alg_len = 0;
256
257 for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
258 {
259 #if defined(MBEDTLS_ECDSA_C)
260 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
261 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
262 #endif
263 #if defined(MBEDTLS_RSA_C)
264 sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
265 sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
266 #endif
267 }
268
269 /*
270 * enum {
271 * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
272 * sha512(6), (255)
273 * } HashAlgorithm;
274 *
275 * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
276 * SignatureAlgorithm;
277 *
278 * struct {
279 * HashAlgorithm hash;
280 * SignatureAlgorithm signature;
281 * } SignatureAndHashAlgorithm;
282 *
283 * SignatureAndHashAlgorithm
284 * supported_signature_algorithms<2..2^16-2>;
285 */
286 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
287 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
288
289 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
290 *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
291
292 *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
293 *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
294
295 *olen = 6 + sig_alg_len;
296
297 return( 0 );
298 }
299 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
300 MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
301
302 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
303 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_supported_elliptic_curves_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)304 static int ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
305 unsigned char *buf,
306 const unsigned char *end,
307 size_t *olen )
308 {
309 unsigned char *p = buf;
310 unsigned char *elliptic_curve_list = p + 6;
311 size_t elliptic_curve_len = 0;
312 const mbedtls_ecp_curve_info *info;
313 const mbedtls_ecp_group_id *grp_id;
314
315 *olen = 0;
316
317 MBEDTLS_SSL_DEBUG_MSG( 3,
318 ( "client hello, adding supported_elliptic_curves extension" ) );
319
320 if( ssl->conf->curve_list == NULL )
321 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
322
323 for( grp_id = ssl->conf->curve_list;
324 *grp_id != MBEDTLS_ECP_DP_NONE;
325 grp_id++ )
326 {
327 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
328 if( info == NULL )
329 {
330 MBEDTLS_SSL_DEBUG_MSG( 1,
331 ( "invalid curve in ssl configuration" ) );
332 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
333 }
334 elliptic_curve_len += 2;
335
336 if( elliptic_curve_len > MBEDTLS_SSL_MAX_CURVE_LIST_LEN )
337 {
338 MBEDTLS_SSL_DEBUG_MSG( 3,
339 ( "malformed supported_elliptic_curves extension in config" ) );
340 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
341 }
342 }
343
344 /* Empty elliptic curve list, this is a configuration error. */
345 if( elliptic_curve_len == 0 )
346 return( MBEDTLS_ERR_SSL_BAD_CONFIG );
347
348 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 + elliptic_curve_len );
349
350 elliptic_curve_len = 0;
351
352 for( grp_id = ssl->conf->curve_list;
353 *grp_id != MBEDTLS_ECP_DP_NONE;
354 grp_id++ )
355 {
356 info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
357 elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
358 elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
359 }
360
361 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 )
362 & 0xFF );
363 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES )
364 & 0xFF );
365
366 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
367 *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
368
369 *p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
370 *p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
371
372 *olen = 6 + elliptic_curve_len;
373
374 return( 0 );
375 }
376
ssl_write_supported_point_formats_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)377 static int ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
378 unsigned char *buf,
379 const unsigned char *end,
380 size_t *olen )
381 {
382 unsigned char *p = buf;
383 (void) ssl; /* ssl used for debugging only */
384
385 *olen = 0;
386
387 MBEDTLS_SSL_DEBUG_MSG( 3,
388 ( "client hello, adding supported_point_formats extension" ) );
389 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 );
390
391 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 )
392 & 0xFF );
393 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS )
394 & 0xFF );
395
396 *p++ = 0x00;
397 *p++ = 2;
398
399 *p++ = 1;
400 *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
401
402 *olen = 6;
403
404 return( 0 );
405 }
406 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
407 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
408
409 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)410 static int ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
411 unsigned char *buf,
412 const unsigned char *end,
413 size_t *olen )
414 {
415 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
416 unsigned char *p = buf;
417 size_t kkpp_len;
418
419 *olen = 0;
420
421 /* Skip costly extension if we can't use EC J-PAKE anyway */
422 if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
423 return( 0 );
424
425 MBEDTLS_SSL_DEBUG_MSG( 3,
426 ( "client hello, adding ecjpake_kkpp extension" ) );
427
428 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
429
430 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
431 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
432
433 /*
434 * We may need to send ClientHello multiple times for Hello verification.
435 * We don't want to compute fresh values every time (both for performance
436 * and consistency reasons), so cache the extension content.
437 */
438 if( ssl->handshake->ecjpake_cache == NULL ||
439 ssl->handshake->ecjpake_cache_len == 0 )
440 {
441 MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
442
443 ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
444 p + 2, end - p - 2, &kkpp_len,
445 ssl->conf->f_rng, ssl->conf->p_rng );
446 if( ret != 0 )
447 {
448 MBEDTLS_SSL_DEBUG_RET( 1 ,
449 "mbedtls_ecjpake_write_round_one", ret );
450 return( ret );
451 }
452
453 ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
454 if( ssl->handshake->ecjpake_cache == NULL )
455 {
456 MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
457 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
458 }
459
460 memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
461 ssl->handshake->ecjpake_cache_len = kkpp_len;
462 }
463 else
464 {
465 MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
466
467 kkpp_len = ssl->handshake->ecjpake_cache_len;
468 MBEDTLS_SSL_CHK_BUF_PTR( p + 2, end, kkpp_len );
469
470 memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
471 }
472
473 *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
474 *p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
475
476 *olen = kkpp_len + 4;
477
478 return( 0 );
479 }
480 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
481
482 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
ssl_write_cid_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)483 static int ssl_write_cid_ext( mbedtls_ssl_context *ssl,
484 unsigned char *buf,
485 const unsigned char *end,
486 size_t *olen )
487 {
488 unsigned char *p = buf;
489 size_t ext_len;
490
491 /*
492 * Quoting draft-ietf-tls-dtls-connection-id-05
493 * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
494 *
495 * struct {
496 * opaque cid<0..2^8-1>;
497 * } ConnectionId;
498 */
499
500 *olen = 0;
501 if( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
502 ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
503 {
504 return( 0 );
505 }
506 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding CID extension" ) );
507
508 /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX
509 * which is at most 255, so the increment cannot overflow. */
510 MBEDTLS_SSL_CHK_BUF_PTR( p, end, (unsigned)( ssl->own_cid_len + 5 ) );
511
512 /* Add extension ID + size */
513 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID >> 8 ) & 0xFF );
514 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_CID ) & 0xFF );
515 ext_len = (size_t) ssl->own_cid_len + 1;
516 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
517 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
518
519 *p++ = (uint8_t) ssl->own_cid_len;
520 memcpy( p, ssl->own_cid, ssl->own_cid_len );
521
522 *olen = ssl->own_cid_len + 5;
523
524 return( 0 );
525 }
526 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
527
528 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
ssl_write_max_fragment_length_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)529 static int ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
530 unsigned char *buf,
531 const unsigned char *end,
532 size_t *olen )
533 {
534 unsigned char *p = buf;
535
536 *olen = 0;
537
538 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE )
539 return( 0 );
540
541 MBEDTLS_SSL_DEBUG_MSG( 3,
542 ( "client hello, adding max_fragment_length extension" ) );
543
544 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 5 );
545
546 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 )
547 & 0xFF );
548 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH )
549 & 0xFF );
550
551 *p++ = 0x00;
552 *p++ = 1;
553
554 *p++ = ssl->conf->mfl_code;
555
556 *olen = 5;
557
558 return( 0 );
559 }
560 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
561
562 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
ssl_write_truncated_hmac_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)563 static int ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
564 unsigned char *buf,
565 const unsigned char *end,
566 size_t *olen )
567 {
568 unsigned char *p = buf;
569
570 *olen = 0;
571
572 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
573 return( 0 );
574
575 MBEDTLS_SSL_DEBUG_MSG( 3,
576 ( "client hello, adding truncated_hmac extension" ) );
577
578 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
579
580 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
581 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
582
583 *p++ = 0x00;
584 *p++ = 0x00;
585
586 *olen = 4;
587
588 return( 0 );
589 }
590 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
591
592 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)593 static int ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
594 unsigned char *buf,
595 const unsigned char *end,
596 size_t *olen )
597 {
598 unsigned char *p = buf;
599
600 *olen = 0;
601
602 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
603 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
604 return( 0 );
605
606 MBEDTLS_SSL_DEBUG_MSG( 3,
607 ( "client hello, adding encrypt_then_mac extension" ) );
608
609 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
610
611 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
612 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
613
614 *p++ = 0x00;
615 *p++ = 0x00;
616
617 *olen = 4;
618
619 return( 0 );
620 }
621 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
622
623 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
ssl_write_extended_ms_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)624 static int ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
625 unsigned char *buf,
626 const unsigned char *end,
627 size_t *olen )
628 {
629 unsigned char *p = buf;
630
631 *olen = 0;
632
633 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
634 ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
635 return( 0 );
636
637 MBEDTLS_SSL_DEBUG_MSG( 3,
638 ( "client hello, adding extended_master_secret extension" ) );
639
640 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 );
641
642 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 )
643 & 0xFF );
644 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET )
645 & 0xFF );
646
647 *p++ = 0x00;
648 *p++ = 0x00;
649
650 *olen = 4;
651
652 return( 0 );
653 }
654 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
655
656 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
ssl_write_session_ticket_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)657 static int ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
658 unsigned char *buf,
659 const unsigned char *end,
660 size_t *olen )
661 {
662 unsigned char *p = buf;
663 size_t tlen = ssl->session_negotiate->ticket_len;
664
665 *olen = 0;
666
667 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
668 return( 0 );
669
670 MBEDTLS_SSL_DEBUG_MSG( 3,
671 ( "client hello, adding session ticket extension" ) );
672
673 /* The addition is safe here since the ticket length is 16 bit. */
674 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 4 + tlen );
675
676 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
677 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
678
679 *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
680 *p++ = (unsigned char)( ( tlen ) & 0xFF );
681
682 *olen = 4;
683
684 if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
685 return( 0 );
686
687 MBEDTLS_SSL_DEBUG_MSG( 3,
688 ( "sending session ticket of length %" MBEDTLS_PRINTF_SIZET, tlen ) );
689
690 memcpy( p, ssl->session_negotiate->ticket, tlen );
691
692 *olen += tlen;
693
694 return( 0 );
695 }
696 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
697
698 #if defined(MBEDTLS_SSL_ALPN)
ssl_write_alpn_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)699 static int ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
700 unsigned char *buf,
701 const unsigned char *end,
702 size_t *olen )
703 {
704 unsigned char *p = buf;
705 size_t alpnlen = 0;
706 const char **cur;
707
708 *olen = 0;
709
710 if( ssl->conf->alpn_list == NULL )
711 return( 0 );
712
713 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
714
715 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
716 alpnlen += strlen( *cur ) + 1;
717
718 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 6 + alpnlen );
719
720 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
721 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
722
723 /*
724 * opaque ProtocolName<1..2^8-1>;
725 *
726 * struct {
727 * ProtocolName protocol_name_list<2..2^16-1>
728 * } ProtocolNameList;
729 */
730
731 /* Skip writing extension and list length for now */
732 p += 4;
733
734 for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
735 {
736 /*
737 * mbedtls_ssl_conf_set_alpn_protocols() checked that the length of
738 * protocol names is less than 255.
739 */
740 *p = (unsigned char)strlen( *cur );
741 memcpy( p + 1, *cur, *p );
742 p += 1 + *p;
743 }
744
745 *olen = p - buf;
746
747 /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
748 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
749 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
750
751 /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
752 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
753 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
754
755 return( 0 );
756 }
757 #endif /* MBEDTLS_SSL_ALPN */
758
759 #if defined(MBEDTLS_SSL_DTLS_SRTP)
ssl_write_use_srtp_ext(mbedtls_ssl_context * ssl,unsigned char * buf,const unsigned char * end,size_t * olen)760 static int ssl_write_use_srtp_ext( mbedtls_ssl_context *ssl,
761 unsigned char *buf,
762 const unsigned char *end,
763 size_t *olen )
764 {
765 unsigned char *p = buf;
766 size_t protection_profiles_index = 0, ext_len = 0;
767 uint16_t mki_len = 0, profile_value = 0;
768
769 *olen = 0;
770
771 if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
772 ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
773 ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
774 {
775 return( 0 );
776 }
777
778 /* RFC 5764 section 4.1.1
779 * uint8 SRTPProtectionProfile[2];
780 *
781 * struct {
782 * SRTPProtectionProfiles SRTPProtectionProfiles;
783 * opaque srtp_mki<0..255>;
784 * } UseSRTPData;
785 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
786 */
787 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED )
788 {
789 mki_len = ssl->dtls_srtp_info.mki_len;
790 }
791 /* Extension length = 2 bytes for profiles length,
792 * ssl->conf->dtls_srtp_profile_list_len * 2 (each profile is 2 bytes length ),
793 * 1 byte for srtp_mki vector length and the mki_len value
794 */
795 ext_len = 2 + 2 * ( ssl->conf->dtls_srtp_profile_list_len ) + 1 + mki_len;
796
797 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding use_srtp extension" ) );
798
799 /* Check there is room in the buffer for the extension + 4 bytes
800 * - the extension tag (2 bytes)
801 * - the extension length (2 bytes)
802 */
803 MBEDTLS_SSL_CHK_BUF_PTR( p, end, ext_len + 4 );
804
805 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP >> 8 ) & 0xFF );
806 *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_USE_SRTP ) & 0xFF );
807
808
809 *p++ = (unsigned char)( ( ( ext_len & 0xFF00 ) >> 8 ) & 0xFF );
810 *p++ = (unsigned char)( ext_len & 0xFF );
811
812 /* protection profile length: 2*(ssl->conf->dtls_srtp_profile_list_len) */
813 /* micro-optimization:
814 * the list size is limited to MBEDTLS_TLS_SRTP_MAX_PROFILE_LIST_LENGTH
815 * which is lower than 127, so the upper byte of the length is always 0
816 * For the documentation, the more generic code is left in comments
817 * *p++ = (unsigned char)( ( ( 2 * ssl->conf->dtls_srtp_profile_list_len )
818 * >> 8 ) & 0xFF );
819 */
820 *p++ = 0;
821 *p++ = (unsigned char)( ( 2 * ssl->conf->dtls_srtp_profile_list_len )
822 & 0xFF );
823
824 for( protection_profiles_index=0;
825 protection_profiles_index < ssl->conf->dtls_srtp_profile_list_len;
826 protection_profiles_index++ )
827 {
828 profile_value = mbedtls_ssl_check_srtp_profile_value
829 ( ssl->conf->dtls_srtp_profile_list[protection_profiles_index] );
830 if( profile_value != MBEDTLS_TLS_SRTP_UNSET )
831 {
832 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ssl_write_use_srtp_ext, add profile: %04x",
833 profile_value ) );
834 *p++ = ( ( profile_value >> 8 ) & 0xFF );
835 *p++ = ( profile_value & 0xFF );
836 }
837 else
838 {
839 /*
840 * Note: we shall never arrive here as protection profiles
841 * is checked by mbedtls_ssl_conf_dtls_srtp_protection_profiles function
842 */
843 MBEDTLS_SSL_DEBUG_MSG( 3,
844 ( "client hello, "
845 "illegal DTLS-SRTP protection profile %d",
846 ssl->conf->dtls_srtp_profile_list[protection_profiles_index]
847 ) );
848 return( MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED );
849 }
850 }
851
852 *p++ = mki_len & 0xFF;
853
854 if( mki_len != 0 )
855 {
856 memcpy( p, ssl->dtls_srtp_info.mki_value, mki_len );
857 /*
858 * Increment p to point to the current position.
859 */
860 p += mki_len;
861 MBEDTLS_SSL_DEBUG_BUF( 3, "sending mki", ssl->dtls_srtp_info.mki_value,
862 ssl->dtls_srtp_info.mki_len );
863 }
864
865 /*
866 * total extension length: extension type (2 bytes)
867 * + extension length (2 bytes)
868 * + protection profile length (2 bytes)
869 * + 2 * number of protection profiles
870 * + srtp_mki vector length(1 byte)
871 * + mki value
872 */
873 *olen = p - buf;
874
875 return( 0 );
876 }
877 #endif /* MBEDTLS_SSL_DTLS_SRTP */
878
879 /*
880 * Generate random bytes for ClientHello
881 */
ssl_generate_random(mbedtls_ssl_context * ssl)882 static int ssl_generate_random( mbedtls_ssl_context *ssl )
883 {
884 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
885 unsigned char *p = ssl->handshake->randbytes;
886 #if defined(MBEDTLS_HAVE_TIME)
887 mbedtls_time_t t;
888 #endif
889
890 /*
891 * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
892 */
893 #if defined(MBEDTLS_SSL_PROTO_DTLS)
894 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
895 ssl->handshake->verify_cookie != NULL )
896 {
897 return( 0 );
898 }
899 #endif
900
901 #if defined(MBEDTLS_HAVE_TIME)
902 t = mbedtls_time( NULL );
903 *p++ = (unsigned char)( t >> 24 );
904 *p++ = (unsigned char)( t >> 16 );
905 *p++ = (unsigned char)( t >> 8 );
906 *p++ = (unsigned char)( t );
907
908 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %" MBEDTLS_PRINTF_LONGLONG,
909 (long long) t ) );
910 #else
911 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
912 return( ret );
913
914 p += 4;
915 #endif /* MBEDTLS_HAVE_TIME */
916
917 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
918 return( ret );
919
920 return( 0 );
921 }
922
923 /**
924 * \brief Validate cipher suite against config in SSL context.
925 *
926 * \param suite_info cipher suite to validate
927 * \param ssl SSL context
928 * \param min_minor_ver Minimal minor version to accept a cipher suite
929 * \param max_minor_ver Maximal minor version to accept a cipher suite
930 *
931 * \return 0 if valid, else 1
932 */
ssl_validate_ciphersuite(const mbedtls_ssl_ciphersuite_t * suite_info,const mbedtls_ssl_context * ssl,int min_minor_ver,int max_minor_ver)933 static int ssl_validate_ciphersuite(
934 const mbedtls_ssl_ciphersuite_t * suite_info,
935 const mbedtls_ssl_context * ssl,
936 int min_minor_ver, int max_minor_ver )
937 {
938 (void) ssl;
939 if( suite_info == NULL )
940 return( 1 );
941
942 if( suite_info->min_minor_ver > max_minor_ver ||
943 suite_info->max_minor_ver < min_minor_ver )
944 return( 1 );
945
946 #if defined(MBEDTLS_SSL_PROTO_DTLS)
947 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
948 ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
949 return( 1 );
950 #endif
951
952 #if defined(MBEDTLS_ARC4_C)
953 if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
954 suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
955 return( 1 );
956 #endif
957
958 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
959 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
960 mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
961 return( 1 );
962 #endif
963
964 /* Don't suggest PSK-based ciphersuite if no PSK is available. */
965 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
966 if( mbedtls_ssl_ciphersuite_uses_psk( suite_info ) &&
967 ssl_conf_has_static_psk( ssl->conf ) == 0 )
968 {
969 return( 1 );
970 }
971 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
972
973 return( 0 );
974 }
975
ssl_write_client_hello(mbedtls_ssl_context * ssl)976 static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
977 {
978 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
979 size_t i, n, olen, ext_len = 0;
980
981 unsigned char *buf;
982 unsigned char *p, *q;
983 const unsigned char *end;
984
985 unsigned char offer_compress;
986 const int *ciphersuites;
987 const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
988 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
989 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
990 int uses_ec = 0;
991 #endif
992
993 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
994
995 if( ssl->conf->f_rng == NULL )
996 {
997 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
998 return( MBEDTLS_ERR_SSL_NO_RNG );
999 }
1000
1001 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1002 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
1003 #endif
1004 {
1005 ssl->major_ver = ssl->conf->min_major_ver;
1006 ssl->minor_ver = ssl->conf->min_minor_ver;
1007 }
1008
1009 if( ssl->conf->max_major_ver == 0 )
1010 {
1011 MBEDTLS_SSL_DEBUG_MSG( 1,
1012 ( "configured max major version is invalid, consider using mbedtls_ssl_config_defaults()" ) );
1013 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1014 }
1015
1016 buf = ssl->out_msg;
1017 end = buf + MBEDTLS_SSL_OUT_CONTENT_LEN;
1018
1019 /*
1020 * Check if there's enough space for the first part of the ClientHello
1021 * consisting of the 38 bytes described below, the session identifier (at
1022 * most 32 bytes) and its length (1 byte).
1023 *
1024 * Use static upper bounds instead of the actual values
1025 * to allow the compiler to optimize this away.
1026 */
1027 MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 38 + 1 + 32 );
1028
1029 /*
1030 * The 38 first bytes of the ClientHello:
1031 * 0 . 0 handshake type (written later)
1032 * 1 . 3 handshake length (written later)
1033 * 4 . 5 highest version supported
1034 * 6 . 9 current UNIX time
1035 * 10 . 37 random bytes
1036 *
1037 * The current UNIX time (4 bytes) and following 28 random bytes are written
1038 * by ssl_generate_random() into ssl->handshake->randbytes buffer and then
1039 * copied from there into the output buffer.
1040 */
1041
1042 p = buf + 4;
1043 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
1044 ssl->conf->max_minor_ver,
1045 ssl->conf->transport, p );
1046 p += 2;
1047
1048 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
1049 buf[4], buf[5] ) );
1050
1051 if( ( ret = ssl_generate_random( ssl ) ) != 0 )
1052 {
1053 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
1054 return( ret );
1055 }
1056
1057 memcpy( p, ssl->handshake->randbytes, 32 );
1058 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
1059 p += 32;
1060
1061 /*
1062 * 38 . 38 session id length
1063 * 39 . 39+n session id
1064 * 39+n . 39+n DTLS only: cookie length (1 byte)
1065 * 40+n . .. DTLS only: cookie
1066 * .. . .. ciphersuitelist length (2 bytes)
1067 * .. . .. ciphersuitelist
1068 * .. . .. compression methods length (1 byte)
1069 * .. . .. compression methods
1070 * .. . .. extensions length (2 bytes)
1071 * .. . .. extensions
1072 */
1073 n = ssl->session_negotiate->id_len;
1074
1075 if( n < 16 || n > 32 ||
1076 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1077 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
1078 #endif
1079 ssl->handshake->resume == 0 )
1080 {
1081 n = 0;
1082 }
1083
1084 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1085 /*
1086 * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
1087 * generate and include a Session ID in the TLS ClientHello."
1088 */
1089 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1090 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
1091 #endif
1092 {
1093 if( ssl->session_negotiate->ticket != NULL &&
1094 ssl->session_negotiate->ticket_len != 0 )
1095 {
1096 ret = ssl->conf->f_rng( ssl->conf->p_rng,
1097 ssl->session_negotiate->id, 32 );
1098
1099 if( ret != 0 )
1100 return( ret );
1101
1102 ssl->session_negotiate->id_len = n = 32;
1103 }
1104 }
1105 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1106
1107 /*
1108 * The first check of the output buffer size above (
1109 * MBEDTLS_SSL_CHK_BUF_PTR( buf, end, 38 + 1 + 32 );)
1110 * has checked that there is enough space in the output buffer for the
1111 * session identifier length byte and the session identifier (n <= 32).
1112 */
1113 *p++ = (unsigned char) n;
1114
1115 for( i = 0; i < n; i++ )
1116 *p++ = ssl->session_negotiate->id[i];
1117
1118 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n ) );
1119 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
1120
1121 /*
1122 * With 'n' being the length of the session identifier
1123 *
1124 * 39+n . 39+n DTLS only: cookie length (1 byte)
1125 * 40+n . .. DTLS only: cookie
1126 * .. . .. ciphersuitelist length (2 bytes)
1127 * .. . .. ciphersuitelist
1128 * .. . .. compression methods length (1 byte)
1129 * .. . .. compression methods
1130 * .. . .. extensions length (2 bytes)
1131 * .. . .. extensions
1132 */
1133
1134 /*
1135 * DTLS cookie
1136 */
1137 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1138 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1139 {
1140 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
1141
1142 if( ssl->handshake->verify_cookie == NULL )
1143 {
1144 MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
1145 *p++ = 0;
1146 }
1147 else
1148 {
1149 MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
1150 ssl->handshake->verify_cookie,
1151 ssl->handshake->verify_cookie_len );
1152
1153 *p++ = ssl->handshake->verify_cookie_len;
1154
1155 MBEDTLS_SSL_CHK_BUF_PTR( p, end,
1156 ssl->handshake->verify_cookie_len );
1157 memcpy( p, ssl->handshake->verify_cookie,
1158 ssl->handshake->verify_cookie_len );
1159 p += ssl->handshake->verify_cookie_len;
1160 }
1161 }
1162 #endif
1163
1164 /*
1165 * Ciphersuite list
1166 */
1167 ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
1168
1169 /* Skip writing ciphersuite length for now */
1170 n = 0;
1171 q = p;
1172
1173 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1174 p += 2;
1175
1176 for( i = 0; ciphersuites[i] != 0; i++ )
1177 {
1178 ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
1179
1180 if( ssl_validate_ciphersuite( ciphersuite_info, ssl,
1181 ssl->conf->min_minor_ver,
1182 ssl->conf->max_minor_ver ) != 0 )
1183 continue;
1184
1185 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %#04x (%s)",
1186 (unsigned int)ciphersuites[i], ciphersuite_info->name ) );
1187
1188 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1189 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1190 uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
1191 #endif
1192
1193 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1194
1195 n++;
1196 *p++ = (unsigned char)( ciphersuites[i] >> 8 );
1197 *p++ = (unsigned char)( ciphersuites[i] );
1198 }
1199
1200 MBEDTLS_SSL_DEBUG_MSG( 3,
1201 ( "client hello, got %" MBEDTLS_PRINTF_SIZET " ciphersuites (excluding SCSVs)", n ) );
1202
1203 /*
1204 * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1205 */
1206 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1207 if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
1208 #endif
1209 {
1210 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
1211 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1212 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
1213 *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
1214 n++;
1215 }
1216
1217 /* Some versions of OpenSSL don't handle it correctly if not at end */
1218 #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
1219 if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
1220 {
1221 MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
1222
1223 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1224 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
1225 *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
1226 n++;
1227 }
1228 #endif
1229
1230 *q++ = (unsigned char)( n >> 7 );
1231 *q++ = (unsigned char)( n << 1 );
1232
1233 #if defined(MBEDTLS_ZLIB_SUPPORT)
1234 offer_compress = 1;
1235 #else
1236 offer_compress = 0;
1237 #endif
1238
1239 /*
1240 * We don't support compression with DTLS right now: if many records come
1241 * in the same datagram, uncompressing one could overwrite the next one.
1242 * We don't want to add complexity for handling that case unless there is
1243 * an actual need for it.
1244 */
1245 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1246 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1247 offer_compress = 0;
1248 #endif
1249
1250 if( offer_compress )
1251 {
1252 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
1253 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
1254 MBEDTLS_SSL_COMPRESS_DEFLATE,
1255 MBEDTLS_SSL_COMPRESS_NULL ) );
1256
1257 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 3 );
1258 *p++ = 2;
1259 *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
1260 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
1261 }
1262 else
1263 {
1264 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
1265 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
1266 MBEDTLS_SSL_COMPRESS_NULL ) );
1267
1268 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1269 *p++ = 1;
1270 *p++ = MBEDTLS_SSL_COMPRESS_NULL;
1271 }
1272
1273 /* First write extensions, then the total length */
1274
1275 MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
1276
1277 #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1278 if( ( ret = ssl_write_hostname_ext( ssl, p + 2 + ext_len,
1279 end, &olen ) ) != 0 )
1280 {
1281 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_hostname_ext", ret );
1282 return( ret );
1283 }
1284 ext_len += olen;
1285 #endif
1286
1287 /* Note that TLS_EMPTY_RENEGOTIATION_INFO_SCSV is always added
1288 * even if MBEDTLS_SSL_RENEGOTIATION is not defined. */
1289 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1290 if( ( ret = ssl_write_renegotiation_ext( ssl, p + 2 + ext_len,
1291 end, &olen ) ) != 0 )
1292 {
1293 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_renegotiation_ext", ret );
1294 return( ret );
1295 }
1296 ext_len += olen;
1297 #endif
1298
1299 #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1300 defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
1301 if( ( ret = ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len,
1302 end, &olen ) ) != 0 )
1303 {
1304 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_signature_algorithms_ext", ret );
1305 return( ret );
1306 }
1307 ext_len += olen;
1308 #endif
1309
1310 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1311 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1312 if( uses_ec )
1313 {
1314 if( ( ret = ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len,
1315 end, &olen ) ) != 0 )
1316 {
1317 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_supported_elliptic_curves_ext", ret );
1318 return( ret );
1319 }
1320 ext_len += olen;
1321
1322 if( ( ret = ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len,
1323 end, &olen ) ) != 0 )
1324 {
1325 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_supported_point_formats_ext", ret );
1326 return( ret );
1327 }
1328 ext_len += olen;
1329 }
1330 #endif
1331
1332 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1333 if( ( ret = ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len,
1334 end, &olen ) ) != 0 )
1335 {
1336 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_ecjpake_kkpp_ext", ret );
1337 return( ret );
1338 }
1339 ext_len += olen;
1340 #endif
1341
1342 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
1343 if( ( ret = ssl_write_cid_ext( ssl, p + 2 + ext_len, end, &olen ) ) != 0 )
1344 {
1345 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_cid_ext", ret );
1346 return( ret );
1347 }
1348 ext_len += olen;
1349 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1350
1351 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1352 if( ( ret = ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len,
1353 end, &olen ) ) != 0 )
1354 {
1355 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_max_fragment_length_ext", ret );
1356 return( ret );
1357 }
1358 ext_len += olen;
1359 #endif
1360
1361 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1362 if( ( ret = ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len,
1363 end, &olen ) ) != 0 )
1364 {
1365 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_truncated_hmac_ext", ret );
1366 return( ret );
1367 }
1368 ext_len += olen;
1369 #endif
1370
1371 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1372 if( ( ret = ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len,
1373 end, &olen ) ) != 0 )
1374 {
1375 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_encrypt_then_mac_ext", ret );
1376 return( ret );
1377 }
1378 ext_len += olen;
1379 #endif
1380
1381 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1382 if( ( ret = ssl_write_extended_ms_ext( ssl, p + 2 + ext_len,
1383 end, &olen ) ) != 0 )
1384 {
1385 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_extended_ms_ext", ret );
1386 return( ret );
1387 }
1388 ext_len += olen;
1389 #endif
1390
1391 #if defined(MBEDTLS_SSL_ALPN)
1392 if( ( ret = ssl_write_alpn_ext( ssl, p + 2 + ext_len,
1393 end, &olen ) ) != 0 )
1394 {
1395 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_alpn_ext", ret );
1396 return( ret );
1397 }
1398 ext_len += olen;
1399 #endif
1400
1401 #if defined(MBEDTLS_SSL_DTLS_SRTP)
1402 if( ( ret = ssl_write_use_srtp_ext( ssl, p + 2 + ext_len,
1403 end, &olen ) ) != 0 )
1404 {
1405 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_use_srtp_ext", ret );
1406 return( ret );
1407 }
1408 ext_len += olen;
1409 #endif
1410
1411 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
1412 if( ( ret = ssl_write_session_ticket_ext( ssl, p + 2 + ext_len,
1413 end, &olen ) ) != 0 )
1414 {
1415 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_write_session_ticket_ext", ret );
1416 return( ret );
1417 }
1418 ext_len += olen;
1419 #endif
1420
1421 /* olen unused if all extensions are disabled */
1422 ((void) olen);
1423
1424 MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %" MBEDTLS_PRINTF_SIZET,
1425 ext_len ) );
1426
1427 if( ext_len > 0 )
1428 {
1429 /* No need to check for space here, because the extension
1430 * writing functions already took care of that. */
1431 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1432 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
1433 p += ext_len;
1434 }
1435
1436 ssl->out_msglen = p - buf;
1437 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1438 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
1439
1440 ssl->state++;
1441
1442 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1443 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1444 mbedtls_ssl_send_flight_completed( ssl );
1445 #endif
1446
1447 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
1448 {
1449 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
1450 return( ret );
1451 }
1452
1453 #if defined(MBEDTLS_SSL_PROTO_DTLS)
1454 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
1455 ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
1456 {
1457 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
1458 return( ret );
1459 }
1460 #endif /* MBEDTLS_SSL_PROTO_DTLS */
1461
1462 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
1463
1464 return( 0 );
1465 }
1466
ssl_parse_renegotiation_info(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1467 static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
1468 const unsigned char *buf,
1469 size_t len )
1470 {
1471 #if defined(MBEDTLS_SSL_RENEGOTIATION)
1472 if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
1473 {
1474 /* Check verify-data in constant-time. The length OTOH is no secret */
1475 if( len != 1 + ssl->verify_data_len * 2 ||
1476 buf[0] != ssl->verify_data_len * 2 ||
1477 mbedtls_ssl_safer_memcmp( buf + 1,
1478 ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
1479 mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
1480 ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
1481 {
1482 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
1483 mbedtls_ssl_send_alert_message(
1484 ssl,
1485 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1486 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1487 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1488 }
1489 }
1490 else
1491 #endif /* MBEDTLS_SSL_RENEGOTIATION */
1492 {
1493 if( len != 1 || buf[0] != 0x00 )
1494 {
1495 MBEDTLS_SSL_DEBUG_MSG( 1,
1496 ( "non-zero length renegotiation info" ) );
1497 mbedtls_ssl_send_alert_message(
1498 ssl,
1499 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1500 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1501 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1502 }
1503
1504 ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
1505 }
1506
1507 return( 0 );
1508 }
1509
1510 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
ssl_parse_max_fragment_length_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1511 static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
1512 const unsigned char *buf,
1513 size_t len )
1514 {
1515 /*
1516 * server should use the extension only if we did,
1517 * and if so the server's value should match ours (and len is always 1)
1518 */
1519 if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ||
1520 len != 1 ||
1521 buf[0] != ssl->conf->mfl_code )
1522 {
1523 MBEDTLS_SSL_DEBUG_MSG( 1,
1524 ( "non-matching max fragment length extension" ) );
1525 mbedtls_ssl_send_alert_message(
1526 ssl,
1527 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1528 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1529 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1530 }
1531
1532 return( 0 );
1533 }
1534 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1535
1536 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
ssl_parse_truncated_hmac_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1537 static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
1538 const unsigned char *buf,
1539 size_t len )
1540 {
1541 if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ||
1542 len != 0 )
1543 {
1544 MBEDTLS_SSL_DEBUG_MSG( 1,
1545 ( "non-matching truncated HMAC extension" ) );
1546 mbedtls_ssl_send_alert_message(
1547 ssl,
1548 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1549 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1550 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1551 }
1552
1553 ((void) buf);
1554
1555 ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
1556
1557 return( 0 );
1558 }
1559 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1560
1561 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
ssl_parse_cid_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1562 static int ssl_parse_cid_ext( mbedtls_ssl_context *ssl,
1563 const unsigned char *buf,
1564 size_t len )
1565 {
1566 size_t peer_cid_len;
1567
1568 if( /* CID extension only makes sense in DTLS */
1569 ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ||
1570 /* The server must only send the CID extension if we have offered it. */
1571 ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED )
1572 {
1573 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension unexpected" ) );
1574 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1575 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1576 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1577 }
1578
1579 if( len == 0 )
1580 {
1581 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
1582 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1583 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1584 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1585 }
1586
1587 peer_cid_len = *buf++;
1588 len--;
1589
1590 if( peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX )
1591 {
1592 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
1593 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1594 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1595 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1596 }
1597
1598 if( len != peer_cid_len )
1599 {
1600 MBEDTLS_SSL_DEBUG_MSG( 1, ( "CID extension invalid" ) );
1601 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1602 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1603 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1604 }
1605
1606 ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED;
1607 ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len;
1608 memcpy( ssl->handshake->peer_cid, buf, peer_cid_len );
1609
1610 MBEDTLS_SSL_DEBUG_MSG( 3, ( "Use of CID extension negotiated" ) );
1611 MBEDTLS_SSL_DEBUG_BUF( 3, "Server CID", buf, peer_cid_len );
1612
1613 return( 0 );
1614 }
1615 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
1616
1617 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1618 static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
1619 const unsigned char *buf,
1620 size_t len )
1621 {
1622 if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
1623 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1624 len != 0 )
1625 {
1626 MBEDTLS_SSL_DEBUG_MSG( 1,
1627 ( "non-matching encrypt-then-MAC extension" ) );
1628 mbedtls_ssl_send_alert_message(
1629 ssl,
1630 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1631 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1632 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1633 }
1634
1635 ((void) buf);
1636
1637 ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
1638
1639 return( 0 );
1640 }
1641 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1642
1643 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
ssl_parse_extended_ms_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1644 static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
1645 const unsigned char *buf,
1646 size_t len )
1647 {
1648 if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
1649 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
1650 len != 0 )
1651 {
1652 MBEDTLS_SSL_DEBUG_MSG( 1,
1653 ( "non-matching extended master secret extension" ) );
1654 mbedtls_ssl_send_alert_message(
1655 ssl,
1656 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1657 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1658 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1659 }
1660
1661 ((void) buf);
1662
1663 ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
1664
1665 return( 0 );
1666 }
1667 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1668
1669 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
ssl_parse_session_ticket_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1670 static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
1671 const unsigned char *buf,
1672 size_t len )
1673 {
1674 if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ||
1675 len != 0 )
1676 {
1677 MBEDTLS_SSL_DEBUG_MSG( 1,
1678 ( "non-matching session ticket extension" ) );
1679 mbedtls_ssl_send_alert_message(
1680 ssl,
1681 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1682 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1683 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1684 }
1685
1686 ((void) buf);
1687
1688 ssl->handshake->new_session_ticket = 1;
1689
1690 return( 0 );
1691 }
1692 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
1693
1694 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
1695 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_parse_supported_point_formats_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1696 static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
1697 const unsigned char *buf,
1698 size_t len )
1699 {
1700 size_t list_size;
1701 const unsigned char *p;
1702
1703 if( len == 0 || (size_t)( buf[0] + 1 ) != len )
1704 {
1705 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1706 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1707 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1708 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1709 }
1710 list_size = buf[0];
1711
1712 p = buf + 1;
1713 while( list_size > 0 )
1714 {
1715 if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
1716 p[0] == MBEDTLS_ECP_PF_COMPRESSED )
1717 {
1718 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
1719 ssl->handshake->ecdh_ctx.point_format = p[0];
1720 #endif
1721 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1722 ssl->handshake->ecjpake_ctx.point_format = p[0];
1723 #endif
1724 MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
1725 return( 0 );
1726 }
1727
1728 list_size--;
1729 p++;
1730 }
1731
1732 MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
1733 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1734 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1735 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1736 }
1737 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
1738 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1739
1740 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_parse_ecjpake_kkpp(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1741 static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
1742 const unsigned char *buf,
1743 size_t len )
1744 {
1745 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
1746
1747 if( ssl->handshake->ciphersuite_info->key_exchange !=
1748 MBEDTLS_KEY_EXCHANGE_ECJPAKE )
1749 {
1750 MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
1751 return( 0 );
1752 }
1753
1754 /* If we got here, we no longer need our cached extension */
1755 mbedtls_free( ssl->handshake->ecjpake_cache );
1756 ssl->handshake->ecjpake_cache = NULL;
1757 ssl->handshake->ecjpake_cache_len = 0;
1758
1759 if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
1760 buf, len ) ) != 0 )
1761 {
1762 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
1763 mbedtls_ssl_send_alert_message(
1764 ssl,
1765 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1766 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1767 return( ret );
1768 }
1769
1770 return( 0 );
1771 }
1772 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1773
1774 #if defined(MBEDTLS_SSL_ALPN)
ssl_parse_alpn_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1775 static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
1776 const unsigned char *buf, size_t len )
1777 {
1778 size_t list_len, name_len;
1779 const char **p;
1780
1781 /* If we didn't send it, the server shouldn't send it */
1782 if( ssl->conf->alpn_list == NULL )
1783 {
1784 MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) );
1785 mbedtls_ssl_send_alert_message(
1786 ssl,
1787 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1788 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1789 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1790 }
1791
1792 /*
1793 * opaque ProtocolName<1..2^8-1>;
1794 *
1795 * struct {
1796 * ProtocolName protocol_name_list<2..2^16-1>
1797 * } ProtocolNameList;
1798 *
1799 * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
1800 */
1801
1802 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
1803 if( len < 4 )
1804 {
1805 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1806 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1807 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1808 }
1809
1810 list_len = ( buf[0] << 8 ) | buf[1];
1811 if( list_len != len - 2 )
1812 {
1813 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1814 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1815 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1816 }
1817
1818 name_len = buf[2];
1819 if( name_len != list_len - 1 )
1820 {
1821 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1822 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1823 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1824 }
1825
1826 /* Check that the server chosen protocol was in our list and save it */
1827 for( p = ssl->conf->alpn_list; *p != NULL; p++ )
1828 {
1829 if( name_len == strlen( *p ) &&
1830 memcmp( buf + 3, *p, name_len ) == 0 )
1831 {
1832 ssl->alpn_chosen = *p;
1833 return( 0 );
1834 }
1835 }
1836
1837 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
1838 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1839 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1840 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1841 }
1842 #endif /* MBEDTLS_SSL_ALPN */
1843
1844 #if defined(MBEDTLS_SSL_DTLS_SRTP)
ssl_parse_use_srtp_ext(mbedtls_ssl_context * ssl,const unsigned char * buf,size_t len)1845 static int ssl_parse_use_srtp_ext( mbedtls_ssl_context *ssl,
1846 const unsigned char *buf,
1847 size_t len )
1848 {
1849 mbedtls_ssl_srtp_profile server_protection = MBEDTLS_TLS_SRTP_UNSET;
1850 size_t i, mki_len = 0;
1851 uint16_t server_protection_profile_value = 0;
1852
1853 /* If use_srtp is not configured, just ignore the extension */
1854 if( ( ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM ) ||
1855 ( ssl->conf->dtls_srtp_profile_list == NULL ) ||
1856 ( ssl->conf->dtls_srtp_profile_list_len == 0 ) )
1857 return( 0 );
1858
1859 /* RFC 5764 section 4.1.1
1860 * uint8 SRTPProtectionProfile[2];
1861 *
1862 * struct {
1863 * SRTPProtectionProfiles SRTPProtectionProfiles;
1864 * opaque srtp_mki<0..255>;
1865 * } UseSRTPData;
1866
1867 * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>;
1868 *
1869 */
1870 if( ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED )
1871 {
1872 mki_len = ssl->dtls_srtp_info.mki_len;
1873 }
1874
1875 /*
1876 * Length is 5 + optional mki_value : one protection profile length (2 bytes)
1877 * + protection profile (2 bytes)
1878 * + mki_len(1 byte)
1879 * and optional srtp_mki
1880 */
1881 if( ( len < 5 ) || ( len != ( buf[4] + 5u ) ) )
1882 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1883
1884 /*
1885 * get the server protection profile
1886 */
1887
1888 /*
1889 * protection profile length must be 0x0002 as we must have only
1890 * one protection profile in server Hello
1891 */
1892 if( ( buf[0] != 0 ) || ( buf[1] != 2 ) )
1893 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1894
1895 server_protection_profile_value = ( buf[2] << 8 ) | buf[3];
1896 server_protection = mbedtls_ssl_check_srtp_profile_value(
1897 server_protection_profile_value );
1898 if( server_protection != MBEDTLS_TLS_SRTP_UNSET )
1899 {
1900 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found srtp profile: %s",
1901 mbedtls_ssl_get_srtp_profile_as_string(
1902 server_protection ) ) );
1903 }
1904
1905 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET;
1906
1907 /*
1908 * Check we have the server profile in our list
1909 */
1910 for( i=0; i < ssl->conf->dtls_srtp_profile_list_len; i++)
1911 {
1912 if( server_protection == ssl->conf->dtls_srtp_profile_list[i] )
1913 {
1914 ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i];
1915 MBEDTLS_SSL_DEBUG_MSG( 3, ( "selected srtp profile: %s",
1916 mbedtls_ssl_get_srtp_profile_as_string(
1917 server_protection ) ) );
1918 break;
1919 }
1920 }
1921
1922 /* If no match was found : server problem, it shall never answer with incompatible profile */
1923 if( ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET )
1924 {
1925 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1926 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1927 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1928 }
1929
1930 /* If server does not use mki in its reply, make sure the client won't keep
1931 * one as negotiated */
1932 if( len == 5 )
1933 {
1934 ssl->dtls_srtp_info.mki_len = 0;
1935 }
1936
1937 /*
1938 * RFC5764:
1939 * If the client detects a nonzero-length MKI in the server's response
1940 * that is different than the one the client offered, then the client
1941 * MUST abort the handshake and SHOULD send an invalid_parameter alert.
1942 */
1943 if( len > 5 && ( buf[4] != mki_len ||
1944 ( memcmp( ssl->dtls_srtp_info.mki_value, &buf[5], mki_len ) ) ) )
1945 {
1946 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1947 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1948 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1949 }
1950 #if defined (MBEDTLS_DEBUG_C)
1951 if( len > 5 )
1952 {
1953 MBEDTLS_SSL_DEBUG_BUF( 3, "received mki", ssl->dtls_srtp_info.mki_value,
1954 ssl->dtls_srtp_info.mki_len );
1955 }
1956 #endif
1957 return( 0 );
1958 }
1959 #endif /* MBEDTLS_SSL_DTLS_SRTP */
1960
1961 /*
1962 * Parse HelloVerifyRequest. Only called after verifying the HS type.
1963 */
1964 #if defined(MBEDTLS_SSL_PROTO_DTLS)
ssl_parse_hello_verify_request(mbedtls_ssl_context * ssl)1965 static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
1966 {
1967 const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
1968 int major_ver, minor_ver;
1969 unsigned char cookie_len;
1970
1971 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
1972
1973 /* Check that there is enough room for:
1974 * - 2 bytes of version
1975 * - 1 byte of cookie_len
1976 */
1977 if( mbedtls_ssl_hs_hdr_len( ssl ) + 3 > ssl->in_msglen )
1978 {
1979 MBEDTLS_SSL_DEBUG_MSG( 1,
1980 ( "incoming HelloVerifyRequest message is too short" ) );
1981 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1982 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1983 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1984 }
1985
1986 /*
1987 * struct {
1988 * ProtocolVersion server_version;
1989 * opaque cookie<0..2^8-1>;
1990 * } HelloVerifyRequest;
1991 */
1992 MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
1993 mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
1994 p += 2;
1995
1996 /*
1997 * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
1998 * even is lower than our min version.
1999 */
2000 if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
2001 minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ||
2002 major_ver > ssl->conf->max_major_ver ||
2003 minor_ver > ssl->conf->max_minor_ver )
2004 {
2005 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
2006
2007 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2008 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
2009
2010 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
2011 }
2012
2013 cookie_len = *p++;
2014 if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
2015 {
2016 MBEDTLS_SSL_DEBUG_MSG( 1,
2017 ( "cookie length does not match incoming message size" ) );
2018 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2019 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2020 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2021 }
2022 MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
2023
2024 mbedtls_free( ssl->handshake->verify_cookie );
2025
2026 ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
2027 if( ssl->handshake->verify_cookie == NULL )
2028 {
2029 MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
2030 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
2031 }
2032
2033 memcpy( ssl->handshake->verify_cookie, p, cookie_len );
2034 ssl->handshake->verify_cookie_len = cookie_len;
2035
2036 /* Start over at ClientHello */
2037 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
2038 mbedtls_ssl_reset_checksum( ssl );
2039
2040 mbedtls_ssl_recv_flight_completed( ssl );
2041
2042 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
2043
2044 return( 0 );
2045 }
2046 #endif /* MBEDTLS_SSL_PROTO_DTLS */
2047
ssl_parse_server_hello(mbedtls_ssl_context * ssl)2048 static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
2049 {
2050 int ret, i;
2051 size_t n;
2052 size_t ext_len;
2053 unsigned char *buf, *ext;
2054 unsigned char comp;
2055 #if defined(MBEDTLS_ZLIB_SUPPORT)
2056 int accept_comp;
2057 #endif
2058 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2059 int renegotiation_info_seen = 0;
2060 #endif
2061 int handshake_failure = 0;
2062 const mbedtls_ssl_ciphersuite_t *suite_info;
2063
2064 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
2065
2066 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2067 {
2068 /* No alert on a read error. */
2069 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2070 return( ret );
2071 }
2072
2073 buf = ssl->in_msg;
2074
2075 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2076 {
2077 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2078 if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
2079 {
2080 ssl->renego_records_seen++;
2081
2082 if( ssl->conf->renego_max_records >= 0 &&
2083 ssl->renego_records_seen > ssl->conf->renego_max_records )
2084 {
2085 MBEDTLS_SSL_DEBUG_MSG( 1,
2086 ( "renegotiation requested, but not honored by server" ) );
2087 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2088 }
2089
2090 MBEDTLS_SSL_DEBUG_MSG( 1,
2091 ( "non-handshake message during renegotiation" ) );
2092
2093 ssl->keep_current_message = 1;
2094 return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
2095 }
2096 #endif /* MBEDTLS_SSL_RENEGOTIATION */
2097
2098 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2099 mbedtls_ssl_send_alert_message(
2100 ssl,
2101 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2102 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2103 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2104 }
2105
2106 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2107 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2108 {
2109 if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
2110 {
2111 MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
2112 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
2113 return( ssl_parse_hello_verify_request( ssl ) );
2114 }
2115 else
2116 {
2117 /* We made it through the verification process */
2118 mbedtls_free( ssl->handshake->verify_cookie );
2119 ssl->handshake->verify_cookie = NULL;
2120 ssl->handshake->verify_cookie_len = 0;
2121 }
2122 }
2123 #endif /* MBEDTLS_SSL_PROTO_DTLS */
2124
2125 if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) ||
2126 buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
2127 {
2128 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2129 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2130 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2131 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2132 }
2133
2134 /*
2135 * 0 . 1 server_version
2136 * 2 . 33 random (maybe including 4 bytes of Unix time)
2137 * 34 . 34 session_id length = n
2138 * 35 . 34+n session_id
2139 * 35+n . 36+n cipher_suite
2140 * 37+n . 37+n compression_method
2141 *
2142 * 38+n . 39+n extensions length (optional)
2143 * 40+n . .. extensions
2144 */
2145 buf += mbedtls_ssl_hs_hdr_len( ssl );
2146
2147 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
2148 mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
2149 ssl->conf->transport, buf + 0 );
2150
2151 if( ssl->major_ver < ssl->conf->min_major_ver ||
2152 ssl->minor_ver < ssl->conf->min_minor_ver ||
2153 ssl->major_ver > ssl->conf->max_major_ver ||
2154 ssl->minor_ver > ssl->conf->max_minor_ver )
2155 {
2156 MBEDTLS_SSL_DEBUG_MSG( 1,
2157 ( "server version out of bounds - min: [%d:%d], server: [%d:%d], max: [%d:%d]",
2158 ssl->conf->min_major_ver,
2159 ssl->conf->min_minor_ver,
2160 ssl->major_ver, ssl->minor_ver,
2161 ssl->conf->max_major_ver,
2162 ssl->conf->max_minor_ver ) );
2163
2164 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2165 MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
2166
2167 return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
2168 }
2169
2170 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu",
2171 ( (unsigned long) buf[2] << 24 ) |
2172 ( (unsigned long) buf[3] << 16 ) |
2173 ( (unsigned long) buf[4] << 8 ) |
2174 ( (unsigned long) buf[5] ) ) );
2175
2176 memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
2177
2178 n = buf[34];
2179
2180 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
2181
2182 if( n > 32 )
2183 {
2184 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2185 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2186 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2187 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2188 }
2189
2190 if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
2191 {
2192 ext_len = ( ( buf[38 + n] << 8 )
2193 | ( buf[39 + n] ) );
2194
2195 if( ( ext_len > 0 && ext_len < 4 ) ||
2196 ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
2197 {
2198 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2199 mbedtls_ssl_send_alert_message(
2200 ssl,
2201 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2202 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2203 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2204 }
2205 }
2206 else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
2207 {
2208 ext_len = 0;
2209 }
2210 else
2211 {
2212 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2213 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2214 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2215 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2216 }
2217
2218 /* ciphersuite (used later) */
2219 i = ( buf[35 + n] << 8 ) | buf[36 + n];
2220
2221 /*
2222 * Read and check compression
2223 */
2224 comp = buf[37 + n];
2225
2226 #if defined(MBEDTLS_ZLIB_SUPPORT)
2227 /* See comments in ssl_write_client_hello() */
2228 #if defined(MBEDTLS_SSL_PROTO_DTLS)
2229 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2230 accept_comp = 0;
2231 else
2232 #endif
2233 accept_comp = 1;
2234
2235 if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
2236 ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) )
2237 #else /* MBEDTLS_ZLIB_SUPPORT */
2238 if( comp != MBEDTLS_SSL_COMPRESS_NULL )
2239 #endif/* MBEDTLS_ZLIB_SUPPORT */
2240 {
2241 MBEDTLS_SSL_DEBUG_MSG( 1,
2242 ( "server hello, bad compression: %d", comp ) );
2243 mbedtls_ssl_send_alert_message(
2244 ssl,
2245 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2246 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2247 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
2248 }
2249
2250 /*
2251 * Initialize update checksum functions
2252 */
2253 ssl->handshake->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
2254 if( ssl->handshake->ciphersuite_info == NULL )
2255 {
2256 MBEDTLS_SSL_DEBUG_MSG( 1,
2257 ( "ciphersuite info for %04x not found", (unsigned int)i ) );
2258 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2259 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2260 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
2261 }
2262
2263 mbedtls_ssl_optimize_checksum( ssl, ssl->handshake->ciphersuite_info );
2264
2265 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n ) );
2266 MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
2267
2268 /*
2269 * Check if the session can be resumed
2270 */
2271 if( ssl->handshake->resume == 0 || n == 0 ||
2272 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2273 ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
2274 #endif
2275 ssl->session_negotiate->ciphersuite != i ||
2276 ssl->session_negotiate->compression != comp ||
2277 ssl->session_negotiate->id_len != n ||
2278 memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
2279 {
2280 ssl->state++;
2281 ssl->handshake->resume = 0;
2282 #if defined(MBEDTLS_HAVE_TIME)
2283 ssl->session_negotiate->start = mbedtls_time( NULL );
2284 #endif
2285 ssl->session_negotiate->ciphersuite = i;
2286 ssl->session_negotiate->compression = comp;
2287 ssl->session_negotiate->id_len = n;
2288 memcpy( ssl->session_negotiate->id, buf + 35, n );
2289 }
2290 else
2291 {
2292 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
2293
2294 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
2295 {
2296 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
2297 mbedtls_ssl_send_alert_message(
2298 ssl,
2299 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2300 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
2301 return( ret );
2302 }
2303 }
2304
2305 MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
2306 ssl->handshake->resume ? "a" : "no" ) );
2307
2308 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", (unsigned) i ) );
2309 MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d",
2310 buf[37 + n] ) );
2311
2312 /*
2313 * Perform cipher suite validation in same way as in ssl_write_client_hello.
2314 */
2315 i = 0;
2316 while( 1 )
2317 {
2318 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
2319 {
2320 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2321 mbedtls_ssl_send_alert_message(
2322 ssl,
2323 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2324 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2325 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2326 }
2327
2328 if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
2329 ssl->session_negotiate->ciphersuite )
2330 {
2331 break;
2332 }
2333 }
2334
2335 suite_info = mbedtls_ssl_ciphersuite_from_id(
2336 ssl->session_negotiate->ciphersuite );
2337 if( ssl_validate_ciphersuite( suite_info, ssl, ssl->minor_ver,
2338 ssl->minor_ver ) != 0 )
2339 {
2340 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2341 mbedtls_ssl_send_alert_message(
2342 ssl,
2343 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2344 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2345 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2346 }
2347
2348 MBEDTLS_SSL_DEBUG_MSG( 3,
2349 ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
2350
2351 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2352 if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA &&
2353 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2354 {
2355 ssl->handshake->ecrs_enabled = 1;
2356 }
2357 #endif
2358
2359 if( comp != MBEDTLS_SSL_COMPRESS_NULL
2360 #if defined(MBEDTLS_ZLIB_SUPPORT)
2361 && comp != MBEDTLS_SSL_COMPRESS_DEFLATE
2362 #endif
2363 )
2364 {
2365 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2366 mbedtls_ssl_send_alert_message(
2367 ssl,
2368 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2369 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2370 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2371 }
2372 ssl->session_negotiate->compression = comp;
2373
2374 ext = buf + 40 + n;
2375
2376 MBEDTLS_SSL_DEBUG_MSG( 2,
2377 ( "server hello, total extension length: %" MBEDTLS_PRINTF_SIZET, ext_len ) );
2378
2379 while( ext_len )
2380 {
2381 unsigned int ext_id = ( ( ext[0] << 8 )
2382 | ( ext[1] ) );
2383 unsigned int ext_size = ( ( ext[2] << 8 )
2384 | ( ext[3] ) );
2385
2386 if( ext_size + 4 > ext_len )
2387 {
2388 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2389 mbedtls_ssl_send_alert_message(
2390 ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2391 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2392 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2393 }
2394
2395 switch( ext_id )
2396 {
2397 case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
2398 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
2399 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2400 renegotiation_info_seen = 1;
2401 #endif
2402
2403 if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
2404 ext_size ) ) != 0 )
2405 return( ret );
2406
2407 break;
2408
2409 #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
2410 case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
2411 MBEDTLS_SSL_DEBUG_MSG( 3,
2412 ( "found max_fragment_length extension" ) );
2413
2414 if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
2415 ext + 4, ext_size ) ) != 0 )
2416 {
2417 return( ret );
2418 }
2419
2420 break;
2421 #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
2422
2423 #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
2424 case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
2425 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
2426
2427 if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
2428 ext + 4, ext_size ) ) != 0 )
2429 {
2430 return( ret );
2431 }
2432
2433 break;
2434 #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
2435
2436 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
2437 case MBEDTLS_TLS_EXT_CID:
2438 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found CID extension" ) );
2439
2440 if( ( ret = ssl_parse_cid_ext( ssl,
2441 ext + 4,
2442 ext_size ) ) != 0 )
2443 {
2444 return( ret );
2445 }
2446
2447 break;
2448 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
2449
2450 #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
2451 case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
2452 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
2453
2454 if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
2455 ext + 4, ext_size ) ) != 0 )
2456 {
2457 return( ret );
2458 }
2459
2460 break;
2461 #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
2462
2463 #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
2464 case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
2465 MBEDTLS_SSL_DEBUG_MSG( 3,
2466 ( "found extended_master_secret extension" ) );
2467
2468 if( ( ret = ssl_parse_extended_ms_ext( ssl,
2469 ext + 4, ext_size ) ) != 0 )
2470 {
2471 return( ret );
2472 }
2473
2474 break;
2475 #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
2476
2477 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
2478 case MBEDTLS_TLS_EXT_SESSION_TICKET:
2479 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
2480
2481 if( ( ret = ssl_parse_session_ticket_ext( ssl,
2482 ext + 4, ext_size ) ) != 0 )
2483 {
2484 return( ret );
2485 }
2486
2487 break;
2488 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
2489
2490 #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
2491 defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2492 case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
2493 MBEDTLS_SSL_DEBUG_MSG( 3,
2494 ( "found supported_point_formats extension" ) );
2495
2496 if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
2497 ext + 4, ext_size ) ) != 0 )
2498 {
2499 return( ret );
2500 }
2501
2502 break;
2503 #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
2504 MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2505
2506 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2507 case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
2508 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
2509
2510 if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
2511 ext + 4, ext_size ) ) != 0 )
2512 {
2513 return( ret );
2514 }
2515
2516 break;
2517 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2518
2519 #if defined(MBEDTLS_SSL_ALPN)
2520 case MBEDTLS_TLS_EXT_ALPN:
2521 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
2522
2523 if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
2524 return( ret );
2525
2526 break;
2527 #endif /* MBEDTLS_SSL_ALPN */
2528
2529 #if defined(MBEDTLS_SSL_DTLS_SRTP)
2530 case MBEDTLS_TLS_EXT_USE_SRTP:
2531 MBEDTLS_SSL_DEBUG_MSG( 3, ( "found use_srtp extension" ) );
2532
2533 if( ( ret = ssl_parse_use_srtp_ext( ssl, ext + 4, ext_size ) ) != 0 )
2534 return( ret );
2535
2536 break;
2537 #endif /* MBEDTLS_SSL_DTLS_SRTP */
2538
2539 default:
2540 MBEDTLS_SSL_DEBUG_MSG( 3,
2541 ( "unknown extension found: %u (ignoring)", ext_id ) );
2542 }
2543
2544 ext_len -= 4 + ext_size;
2545 ext += 4 + ext_size;
2546
2547 if( ext_len > 0 && ext_len < 4 )
2548 {
2549 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
2550 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2551 }
2552 }
2553
2554 /*
2555 * Renegotiation security checks
2556 */
2557 if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
2558 ssl->conf->allow_legacy_renegotiation ==
2559 MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
2560 {
2561 MBEDTLS_SSL_DEBUG_MSG( 1,
2562 ( "legacy renegotiation, breaking off handshake" ) );
2563 handshake_failure = 1;
2564 }
2565 #if defined(MBEDTLS_SSL_RENEGOTIATION)
2566 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2567 ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
2568 renegotiation_info_seen == 0 )
2569 {
2570 MBEDTLS_SSL_DEBUG_MSG( 1,
2571 ( "renegotiation_info extension missing (secure)" ) );
2572 handshake_failure = 1;
2573 }
2574 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2575 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
2576 ssl->conf->allow_legacy_renegotiation ==
2577 MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
2578 {
2579 MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
2580 handshake_failure = 1;
2581 }
2582 else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
2583 ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
2584 renegotiation_info_seen == 1 )
2585 {
2586 MBEDTLS_SSL_DEBUG_MSG( 1,
2587 ( "renegotiation_info extension present (legacy)" ) );
2588 handshake_failure = 1;
2589 }
2590 #endif /* MBEDTLS_SSL_RENEGOTIATION */
2591
2592 if( handshake_failure == 1 )
2593 {
2594 mbedtls_ssl_send_alert_message(
2595 ssl,
2596 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2597 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2598 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
2599 }
2600
2601 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
2602
2603 return( 0 );
2604 }
2605
2606 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2607 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
ssl_parse_server_dh_params(mbedtls_ssl_context * ssl,unsigned char ** p,unsigned char * end)2608 static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl,
2609 unsigned char **p,
2610 unsigned char *end )
2611 {
2612 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2613
2614 /*
2615 * Ephemeral DH parameters:
2616 *
2617 * struct {
2618 * opaque dh_p<1..2^16-1>;
2619 * opaque dh_g<1..2^16-1>;
2620 * opaque dh_Ys<1..2^16-1>;
2621 * } ServerDHParams;
2622 */
2623 if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx,
2624 p, end ) ) != 0 )
2625 {
2626 MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
2627 return( ret );
2628 }
2629
2630 if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
2631 {
2632 MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %" MBEDTLS_PRINTF_SIZET " < %u",
2633 ssl->handshake->dhm_ctx.len * 8,
2634 ssl->conf->dhm_min_bitlen ) );
2635 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2636 }
2637
2638 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2639 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2640 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
2641
2642 return( ret );
2643 }
2644 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2645 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2646
2647 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2648 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2649 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
2650 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2651 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
ssl_check_server_ecdh_params(const mbedtls_ssl_context * ssl)2652 static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
2653 {
2654 const mbedtls_ecp_curve_info *curve_info;
2655 mbedtls_ecp_group_id grp_id;
2656 #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
2657 grp_id = ssl->handshake->ecdh_ctx.grp.id;
2658 #else
2659 grp_id = ssl->handshake->ecdh_ctx.grp_id;
2660 #endif
2661
2662 curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
2663 if( curve_info == NULL )
2664 {
2665 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2666 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2667 }
2668
2669 MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
2670
2671 #if defined(MBEDTLS_ECP_C)
2672 if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
2673 #else
2674 if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
2675 ssl->handshake->ecdh_ctx.grp.nbits > 521 )
2676 #endif
2677 return( -1 );
2678
2679 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2680 MBEDTLS_DEBUG_ECDH_QP );
2681
2682 return( 0 );
2683 }
2684 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2685 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2686 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
2687 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2688 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2689
2690 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
2691 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2692 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) )
ssl_parse_server_ecdh_params_psa(mbedtls_ssl_context * ssl,unsigned char ** p,unsigned char * end)2693 static int ssl_parse_server_ecdh_params_psa( mbedtls_ssl_context *ssl,
2694 unsigned char **p,
2695 unsigned char *end )
2696 {
2697 uint16_t tls_id;
2698 size_t ecdh_bits = 0;
2699 uint8_t ecpoint_len;
2700 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
2701
2702 /*
2703 * Parse ECC group
2704 */
2705
2706 if( end - *p < 4 )
2707 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2708
2709 /* First byte is curve_type; only named_curve is handled */
2710 if( *(*p)++ != MBEDTLS_ECP_TLS_NAMED_CURVE )
2711 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2712
2713 /* Next two bytes are the namedcurve value */
2714 tls_id = *(*p)++;
2715 tls_id <<= 8;
2716 tls_id |= *(*p)++;
2717
2718 /* Convert EC group to PSA key type. */
2719 if( ( handshake->ecdh_psa_type =
2720 mbedtls_psa_parse_tls_ecc_group( tls_id, &ecdh_bits ) ) == 0 )
2721 {
2722 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2723 }
2724 if( ecdh_bits > 0xffff )
2725 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2726 handshake->ecdh_bits = (uint16_t) ecdh_bits;
2727
2728 /*
2729 * Put peer's ECDH public key in the format understood by PSA.
2730 */
2731
2732 ecpoint_len = *(*p)++;
2733 if( (size_t)( end - *p ) < ecpoint_len )
2734 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2735
2736 if( mbedtls_psa_tls_ecpoint_to_psa_ec(
2737 *p, ecpoint_len,
2738 handshake->ecdh_psa_peerkey,
2739 sizeof( handshake->ecdh_psa_peerkey ),
2740 &handshake->ecdh_psa_peerkey_len ) != 0 )
2741 {
2742 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
2743 }
2744
2745 *p += ecpoint_len;
2746 return( 0 );
2747 }
2748 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
2749 ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2750 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ) */
2751
2752 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2753 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2754 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
ssl_parse_server_ecdh_params(mbedtls_ssl_context * ssl,unsigned char ** p,unsigned char * end)2755 static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
2756 unsigned char **p,
2757 unsigned char *end )
2758 {
2759 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2760
2761 /*
2762 * Ephemeral ECDH parameters:
2763 *
2764 * struct {
2765 * ECParameters curve_params;
2766 * ECPoint public;
2767 * } ServerECDHParams;
2768 */
2769 if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
2770 (const unsigned char **) p, end ) ) != 0 )
2771 {
2772 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
2773 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
2774 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2775 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
2776 #endif
2777 return( ret );
2778 }
2779
2780 if( ssl_check_server_ecdh_params( ssl ) != 0 )
2781 {
2782 MBEDTLS_SSL_DEBUG_MSG( 1,
2783 ( "bad server key exchange message (ECDHE curve)" ) );
2784 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2785 }
2786
2787 return( ret );
2788 }
2789 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2790 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2791 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2792
2793 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
ssl_parse_server_psk_hint(mbedtls_ssl_context * ssl,unsigned char ** p,unsigned char * end)2794 static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
2795 unsigned char **p,
2796 unsigned char *end )
2797 {
2798 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2799 uint16_t len;
2800 ((void) ssl);
2801
2802 /*
2803 * PSK parameters:
2804 *
2805 * opaque psk_identity_hint<0..2^16-1>;
2806 */
2807 if( end - (*p) < 2 )
2808 {
2809 MBEDTLS_SSL_DEBUG_MSG( 1,
2810 ( "bad server key exchange message (psk_identity_hint length)" ) );
2811 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2812 }
2813 len = (*p)[0] << 8 | (*p)[1];
2814 *p += 2;
2815
2816 if( end - (*p) < len )
2817 {
2818 MBEDTLS_SSL_DEBUG_MSG( 1,
2819 ( "bad server key exchange message (psk_identity_hint length)" ) );
2820 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2821 }
2822
2823 /*
2824 * Note: we currently ignore the PKS identity hint, as we only allow one
2825 * PSK to be provisionned on the client. This could be changed later if
2826 * someone needs that feature.
2827 */
2828 *p += len;
2829 ret = 0;
2830
2831 return( ret );
2832 }
2833 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
2834
2835 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
2836 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2837 /*
2838 * Generate a pre-master secret and encrypt it with the server's RSA key
2839 */
ssl_write_encrypted_pms(mbedtls_ssl_context * ssl,size_t offset,size_t * olen,size_t pms_offset)2840 static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
2841 size_t offset, size_t *olen,
2842 size_t pms_offset )
2843 {
2844 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2845 size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
2846 unsigned char *p = ssl->handshake->premaster + pms_offset;
2847 mbedtls_pk_context * peer_pk;
2848
2849 if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN )
2850 {
2851 MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
2852 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2853 }
2854
2855 /*
2856 * Generate (part of) the pre-master as
2857 * struct {
2858 * ProtocolVersion client_version;
2859 * opaque random[46];
2860 * } PreMasterSecret;
2861 */
2862 mbedtls_ssl_write_version( ssl->conf->max_major_ver,
2863 ssl->conf->max_minor_ver,
2864 ssl->conf->transport, p );
2865
2866 if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
2867 {
2868 MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
2869 return( ret );
2870 }
2871
2872 ssl->handshake->pmslen = 48;
2873
2874 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2875 peer_pk = &ssl->handshake->peer_pubkey;
2876 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2877 if( ssl->session_negotiate->peer_cert == NULL )
2878 {
2879 /* Should never happen */
2880 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2881 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2882 }
2883 peer_pk = &ssl->session_negotiate->peer_cert->pk;
2884 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2885
2886 /*
2887 * Now write it out, encrypted
2888 */
2889 if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_RSA ) )
2890 {
2891 MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
2892 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2893 }
2894
2895 if( ( ret = mbedtls_pk_encrypt( peer_pk,
2896 p, ssl->handshake->pmslen,
2897 ssl->out_msg + offset + len_bytes, olen,
2898 MBEDTLS_SSL_OUT_CONTENT_LEN - offset - len_bytes,
2899 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2900 {
2901 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
2902 return( ret );
2903 }
2904
2905 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
2906 defined(MBEDTLS_SSL_PROTO_TLS1_2)
2907 if( len_bytes == 2 )
2908 {
2909 ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
2910 ssl->out_msg[offset+1] = (unsigned char)( *olen );
2911 *olen += 2;
2912 }
2913 #endif
2914
2915 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
2916 /* We don't need the peer's public key anymore. Free it. */
2917 mbedtls_pk_free( peer_pk );
2918 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
2919 return( 0 );
2920 }
2921 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
2922 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2923
2924 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2925 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2926 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2927 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
ssl_parse_signature_algorithm(mbedtls_ssl_context * ssl,unsigned char ** p,unsigned char * end,mbedtls_md_type_t * md_alg,mbedtls_pk_type_t * pk_alg)2928 static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
2929 unsigned char **p,
2930 unsigned char *end,
2931 mbedtls_md_type_t *md_alg,
2932 mbedtls_pk_type_t *pk_alg )
2933 {
2934 ((void) ssl);
2935 *md_alg = MBEDTLS_MD_NONE;
2936 *pk_alg = MBEDTLS_PK_NONE;
2937
2938 /* Only in TLS 1.2 */
2939 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
2940 {
2941 return( 0 );
2942 }
2943
2944 if( (*p) + 2 > end )
2945 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2946
2947 /*
2948 * Get hash algorithm
2949 */
2950 if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) )
2951 == MBEDTLS_MD_NONE )
2952 {
2953 MBEDTLS_SSL_DEBUG_MSG( 1,
2954 ( "Server used unsupported HashAlgorithm %d", *(p)[0] ) );
2955 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2956 }
2957
2958 /*
2959 * Get signature algorithm
2960 */
2961 if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) )
2962 == MBEDTLS_PK_NONE )
2963 {
2964 MBEDTLS_SSL_DEBUG_MSG( 1,
2965 ( "server used unsupported SignatureAlgorithm %d", (*p)[1] ) );
2966 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2967 }
2968
2969 /*
2970 * Check if the hash is acceptable
2971 */
2972 if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
2973 {
2974 MBEDTLS_SSL_DEBUG_MSG( 1,
2975 ( "server used HashAlgorithm %d that was not offered", *(p)[0] ) );
2976 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2977 }
2978
2979 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d",
2980 (*p)[1] ) );
2981 MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d",
2982 (*p)[0] ) );
2983 *p += 2;
2984
2985 return( 0 );
2986 }
2987 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2988 MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2989 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2990 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2991
2992 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2993 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
ssl_get_ecdh_params_from_cert(mbedtls_ssl_context * ssl)2994 static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
2995 {
2996 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
2997 const mbedtls_ecp_keypair *peer_key;
2998 mbedtls_pk_context * peer_pk;
2999
3000 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3001 peer_pk = &ssl->handshake->peer_pubkey;
3002 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3003 if( ssl->session_negotiate->peer_cert == NULL )
3004 {
3005 /* Should never happen */
3006 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3007 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3008 }
3009 peer_pk = &ssl->session_negotiate->peer_cert->pk;
3010 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3011
3012 if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECKEY ) )
3013 {
3014 MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
3015 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
3016 }
3017
3018 peer_key = mbedtls_pk_ec( *peer_pk );
3019
3020 if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
3021 MBEDTLS_ECDH_THEIRS ) ) != 0 )
3022 {
3023 MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
3024 return( ret );
3025 }
3026
3027 if( ssl_check_server_ecdh_params( ssl ) != 0 )
3028 {
3029 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
3030 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
3031 }
3032
3033 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3034 /* We don't need the peer's public key anymore. Free it,
3035 * so that more RAM is available for upcoming expensive
3036 * operations like ECDHE. */
3037 mbedtls_pk_free( peer_pk );
3038 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3039
3040 return( ret );
3041 }
3042 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
3043 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3044
ssl_parse_server_key_exchange(mbedtls_ssl_context * ssl)3045 static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
3046 {
3047 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3048 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3049 ssl->handshake->ciphersuite_info;
3050 unsigned char *p = NULL, *end = NULL;
3051
3052 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
3053
3054 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3055 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
3056 {
3057 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
3058 ssl->state++;
3059 return( 0 );
3060 }
3061 ((void) p);
3062 ((void) end);
3063 #endif
3064
3065 #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3066 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3067 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3068 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
3069 {
3070 if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
3071 {
3072 MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
3073 mbedtls_ssl_send_alert_message(
3074 ssl,
3075 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3076 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
3077 return( ret );
3078 }
3079
3080 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
3081 ssl->state++;
3082 return( 0 );
3083 }
3084 ((void) p);
3085 ((void) end);
3086 #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3087 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3088
3089 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3090 if( ssl->handshake->ecrs_enabled &&
3091 ssl->handshake->ecrs_state == ssl_ecrs_ske_start_processing )
3092 {
3093 goto start_processing;
3094 }
3095 #endif
3096
3097 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
3098 {
3099 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3100 return( ret );
3101 }
3102
3103 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3104 {
3105 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3106 mbedtls_ssl_send_alert_message(
3107 ssl,
3108 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3109 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3110 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3111 }
3112
3113 /*
3114 * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
3115 * doesn't use a psk_identity_hint
3116 */
3117 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
3118 {
3119 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3120 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
3121 {
3122 /* Current message is probably either
3123 * CertificateRequest or ServerHelloDone */
3124 ssl->keep_current_message = 1;
3125 goto exit;
3126 }
3127
3128 MBEDTLS_SSL_DEBUG_MSG( 1,
3129 ( "server key exchange message must not be skipped" ) );
3130 mbedtls_ssl_send_alert_message(
3131 ssl,
3132 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3133 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3134
3135 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3136 }
3137
3138 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3139 if( ssl->handshake->ecrs_enabled )
3140 ssl->handshake->ecrs_state = ssl_ecrs_ske_start_processing;
3141
3142 start_processing:
3143 #endif
3144 p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
3145 end = ssl->in_msg + ssl->in_hslen;
3146 MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
3147
3148 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
3149 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3150 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
3151 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
3152 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
3153 {
3154 if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
3155 {
3156 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3157 mbedtls_ssl_send_alert_message(
3158 ssl,
3159 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3160 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3161 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3162 }
3163 } /* FALLTROUGH */
3164 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
3165
3166 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
3167 defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3168 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
3169 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
3170 ; /* nothing more to do */
3171 else
3172 #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
3173 MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
3174 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
3175 defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3176 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
3177 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
3178 {
3179 if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
3180 {
3181 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3182 mbedtls_ssl_send_alert_message(
3183 ssl,
3184 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3185 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3186 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3187 }
3188 }
3189 else
3190 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
3191 MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3192 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
3193 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3194 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) )
3195 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3196 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
3197 {
3198 if( ssl_parse_server_ecdh_params_psa( ssl, &p, end ) != 0 )
3199 {
3200 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3201 mbedtls_ssl_send_alert_message(
3202 ssl,
3203 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3204 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3205 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3206 }
3207 }
3208 else
3209 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
3210 ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3211 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ) */
3212 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3213 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
3214 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3215 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3216 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
3217 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
3218 {
3219 if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
3220 {
3221 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3222 mbedtls_ssl_send_alert_message(
3223 ssl,
3224 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3225 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3226 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3227 }
3228 }
3229 else
3230 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3231 MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
3232 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
3233 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3234 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3235 {
3236 ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
3237 p, end - p );
3238 if( ret != 0 )
3239 {
3240 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
3241 mbedtls_ssl_send_alert_message(
3242 ssl,
3243 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3244 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3245 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3246 }
3247 }
3248 else
3249 #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
3250 {
3251 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3252 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3253 }
3254
3255 #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED)
3256 if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
3257 {
3258 size_t sig_len, hashlen;
3259 unsigned char hash[64];
3260 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
3261 mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
3262 unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
3263 size_t params_len = p - params;
3264 void *rs_ctx = NULL;
3265
3266 mbedtls_pk_context * peer_pk;
3267
3268 /*
3269 * Handle the digitally-signed structure
3270 */
3271 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3272 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
3273 {
3274 if( ssl_parse_signature_algorithm( ssl, &p, end,
3275 &md_alg, &pk_alg ) != 0 )
3276 {
3277 MBEDTLS_SSL_DEBUG_MSG( 1,
3278 ( "bad server key exchange message" ) );
3279 mbedtls_ssl_send_alert_message(
3280 ssl,
3281 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3282 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3283 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3284 }
3285
3286 if( pk_alg !=
3287 mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
3288 {
3289 MBEDTLS_SSL_DEBUG_MSG( 1,
3290 ( "bad server key exchange message" ) );
3291 mbedtls_ssl_send_alert_message(
3292 ssl,
3293 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3294 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
3295 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3296 }
3297 }
3298 else
3299 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3300 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3301 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3302 if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
3303 {
3304 pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
3305
3306 /* Default hash for ECDSA is SHA-1 */
3307 if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
3308 md_alg = MBEDTLS_MD_SHA1;
3309 }
3310 else
3311 #endif
3312 {
3313 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3314 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3315 }
3316
3317 /*
3318 * Read signature
3319 */
3320
3321 if( p > end - 2 )
3322 {
3323 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3324 mbedtls_ssl_send_alert_message(
3325 ssl,
3326 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3327 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3328 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3329 }
3330 sig_len = ( p[0] << 8 ) | p[1];
3331 p += 2;
3332
3333 if( p != end - sig_len )
3334 {
3335 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3336 mbedtls_ssl_send_alert_message(
3337 ssl,
3338 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3339 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3340 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
3341 }
3342
3343 MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
3344
3345 /*
3346 * Compute the hash that has been signed
3347 */
3348 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
3349 defined(MBEDTLS_SSL_PROTO_TLS1_1)
3350 if( md_alg == MBEDTLS_MD_NONE )
3351 {
3352 hashlen = 36;
3353 ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash, params,
3354 params_len );
3355 if( ret != 0 )
3356 return( ret );
3357 }
3358 else
3359 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
3360 MBEDTLS_SSL_PROTO_TLS1_1 */
3361 #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
3362 defined(MBEDTLS_SSL_PROTO_TLS1_2)
3363 if( md_alg != MBEDTLS_MD_NONE )
3364 {
3365 ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
3366 params, params_len,
3367 md_alg );
3368 if( ret != 0 )
3369 return( ret );
3370 }
3371 else
3372 #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
3373 MBEDTLS_SSL_PROTO_TLS1_2 */
3374 {
3375 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3376 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3377 }
3378
3379 MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
3380
3381 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3382 peer_pk = &ssl->handshake->peer_pubkey;
3383 #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3384 if( ssl->session_negotiate->peer_cert == NULL )
3385 {
3386 /* Should never happen */
3387 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3388 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3389 }
3390 peer_pk = &ssl->session_negotiate->peer_cert->pk;
3391 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3392
3393 /*
3394 * Verify signature
3395 */
3396 if( !mbedtls_pk_can_do( peer_pk, pk_alg ) )
3397 {
3398 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
3399 mbedtls_ssl_send_alert_message(
3400 ssl,
3401 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3402 MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
3403 return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
3404 }
3405
3406 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3407 if( ssl->handshake->ecrs_enabled )
3408 rs_ctx = &ssl->handshake->ecrs_ctx.pk;
3409 #endif
3410
3411 if( ( ret = mbedtls_pk_verify_restartable( peer_pk,
3412 md_alg, hash, hashlen, p, sig_len, rs_ctx ) ) != 0 )
3413 {
3414 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3415 if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
3416 #endif
3417 mbedtls_ssl_send_alert_message(
3418 ssl,
3419 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3420 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
3421 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
3422 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3423 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3424 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3425 #endif
3426 return( ret );
3427 }
3428
3429 #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
3430 /* We don't need the peer's public key anymore. Free it,
3431 * so that more RAM is available for upcoming expensive
3432 * operations like ECDHE. */
3433 mbedtls_pk_free( peer_pk );
3434 #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
3435 }
3436 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */
3437
3438 exit:
3439 ssl->state++;
3440
3441 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
3442
3443 return( 0 );
3444 }
3445
3446 #if ! defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
ssl_parse_certificate_request(mbedtls_ssl_context * ssl)3447 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
3448 {
3449 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3450 ssl->handshake->ciphersuite_info;
3451
3452 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
3453
3454 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
3455 {
3456 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
3457 ssl->state++;
3458 return( 0 );
3459 }
3460
3461 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3462 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3463 }
3464 #else /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
ssl_parse_certificate_request(mbedtls_ssl_context * ssl)3465 static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
3466 {
3467 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3468 unsigned char *buf;
3469 size_t n = 0;
3470 size_t cert_type_len = 0, dn_len = 0;
3471 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3472 ssl->handshake->ciphersuite_info;
3473
3474 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
3475
3476 if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
3477 {
3478 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
3479 ssl->state++;
3480 return( 0 );
3481 }
3482
3483 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
3484 {
3485 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3486 return( ret );
3487 }
3488
3489 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3490 {
3491 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
3492 mbedtls_ssl_send_alert_message(
3493 ssl,
3494 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3495 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3496 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3497 }
3498
3499 ssl->state++;
3500 ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST );
3501
3502 MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
3503 ssl->client_auth ? "a" : "no" ) );
3504
3505 if( ssl->client_auth == 0 )
3506 {
3507 /* Current message is probably the ServerHelloDone */
3508 ssl->keep_current_message = 1;
3509 goto exit;
3510 }
3511
3512 /*
3513 * struct {
3514 * ClientCertificateType certificate_types<1..2^8-1>;
3515 * SignatureAndHashAlgorithm
3516 * supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
3517 * DistinguishedName certificate_authorities<0..2^16-1>;
3518 * } CertificateRequest;
3519 *
3520 * Since we only support a single certificate on clients, let's just
3521 * ignore all the information that's supposed to help us pick a
3522 * certificate.
3523 *
3524 * We could check that our certificate matches the request, and bail out
3525 * if it doesn't, but it's simpler to just send the certificate anyway,
3526 * and give the server the opportunity to decide if it should terminate
3527 * the connection when it doesn't like our certificate.
3528 *
3529 * Same goes for the hash in TLS 1.2's signature_algorithms: at this
3530 * point we only have one hash available (see comments in
3531 * write_certificate_verify), so let's just use what we have.
3532 *
3533 * However, we still minimally parse the message to check it is at least
3534 * superficially sane.
3535 */
3536 buf = ssl->in_msg;
3537
3538 /* certificate_types */
3539 if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) )
3540 {
3541 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
3542 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3543 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3544 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
3545 }
3546 cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
3547 n = cert_type_len;
3548
3549 /*
3550 * In the subsequent code there are two paths that read from buf:
3551 * * the length of the signature algorithms field (if minor version of
3552 * SSL is 3),
3553 * * distinguished name length otherwise.
3554 * Both reach at most the index:
3555 * ...hdr_len + 2 + n,
3556 * therefore the buffer length at this point must be greater than that
3557 * regardless of the actual code path.
3558 */
3559 if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
3560 {
3561 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
3562 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3563 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3564 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
3565 }
3566
3567 /* supported_signature_algorithms */
3568 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3569 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
3570 {
3571 size_t sig_alg_len =
3572 ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
3573 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
3574 #if defined(MBEDTLS_DEBUG_C)
3575 unsigned char* sig_alg;
3576 size_t i;
3577 #endif
3578
3579 /*
3580 * The furthest access in buf is in the loop few lines below:
3581 * sig_alg[i + 1],
3582 * where:
3583 * sig_alg = buf + ...hdr_len + 3 + n,
3584 * max(i) = sig_alg_len - 1.
3585 * Therefore the furthest access is:
3586 * buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
3587 * which reduces to:
3588 * buf[...hdr_len + 3 + n + sig_alg_len],
3589 * which is one less than we need the buf to be.
3590 */
3591 if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl )
3592 + 3 + n + sig_alg_len )
3593 {
3594 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
3595 mbedtls_ssl_send_alert_message(
3596 ssl,
3597 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3598 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3599 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
3600 }
3601
3602 #if defined(MBEDTLS_DEBUG_C)
3603 sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
3604 for( i = 0; i < sig_alg_len; i += 2 )
3605 {
3606 MBEDTLS_SSL_DEBUG_MSG( 3,
3607 ( "Supported Signature Algorithm found: %d,%d",
3608 sig_alg[i], sig_alg[i + 1] ) );
3609 }
3610 #endif
3611
3612 n += 2 + sig_alg_len;
3613 }
3614 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3615
3616 /* certificate_authorities */
3617 dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
3618 | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
3619
3620 n += dn_len;
3621 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
3622 {
3623 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
3624 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3625 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3626 return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
3627 }
3628
3629 exit:
3630 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
3631
3632 return( 0 );
3633 }
3634 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
3635
ssl_parse_server_hello_done(mbedtls_ssl_context * ssl)3636 static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
3637 {
3638 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3639
3640 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
3641
3642 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
3643 {
3644 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3645 return( ret );
3646 }
3647
3648 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3649 {
3650 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
3651 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3652 }
3653
3654 if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ||
3655 ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
3656 {
3657 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
3658 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3659 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3660 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
3661 }
3662
3663 ssl->state++;
3664
3665 #if defined(MBEDTLS_SSL_PROTO_DTLS)
3666 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
3667 mbedtls_ssl_recv_flight_completed( ssl );
3668 #endif
3669
3670 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
3671
3672 return( 0 );
3673 }
3674
ssl_write_client_key_exchange(mbedtls_ssl_context * ssl)3675 static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
3676 {
3677 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
3678
3679 size_t header_len;
3680 size_t content_len;
3681 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3682 ssl->handshake->ciphersuite_info;
3683
3684 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
3685
3686 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
3687 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
3688 {
3689 /*
3690 * DHM key exchange -- send G^X mod P
3691 */
3692 content_len = ssl->handshake->dhm_ctx.len;
3693
3694 ssl->out_msg[4] = (unsigned char)( content_len >> 8 );
3695 ssl->out_msg[5] = (unsigned char)( content_len );
3696 header_len = 6;
3697
3698 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
3699 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3700 &ssl->out_msg[header_len], content_len,
3701 ssl->conf->f_rng, ssl->conf->p_rng );
3702 if( ret != 0 )
3703 {
3704 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
3705 return( ret );
3706 }
3707
3708 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
3709 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
3710
3711 if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
3712 ssl->handshake->premaster,
3713 MBEDTLS_PREMASTER_SIZE,
3714 &ssl->handshake->pmslen,
3715 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
3716 {
3717 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
3718 return( ret );
3719 }
3720
3721 MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
3722 }
3723 else
3724 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
3725 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
3726 ( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3727 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) )
3728 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3729 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
3730 {
3731 psa_status_t status;
3732 psa_key_attributes_t key_attributes;
3733
3734 mbedtls_ssl_handshake_params *handshake = ssl->handshake;
3735
3736 unsigned char own_pubkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH];
3737 size_t own_pubkey_len;
3738 unsigned char *own_pubkey_ecpoint;
3739 size_t own_pubkey_ecpoint_len;
3740
3741 header_len = 4;
3742
3743 MBEDTLS_SSL_DEBUG_MSG( 1, ( "Perform PSA-based ECDH computation." ) );
3744
3745 /*
3746 * Generate EC private key for ECDHE exchange.
3747 */
3748
3749 /* The master secret is obtained from the shared ECDH secret by
3750 * applying the TLS 1.2 PRF with a specific salt and label. While
3751 * the PSA Crypto API encourages combining key agreement schemes
3752 * such as ECDH with fixed KDFs such as TLS 1.2 PRF, it does not
3753 * yet support the provisioning of salt + label to the KDF.
3754 * For the time being, we therefore need to split the computation
3755 * of the ECDH secret and the application of the TLS 1.2 PRF. */
3756 key_attributes = psa_key_attributes_init();
3757 psa_set_key_usage_flags( &key_attributes, PSA_KEY_USAGE_DERIVE );
3758 psa_set_key_algorithm( &key_attributes, PSA_ALG_ECDH );
3759 psa_set_key_type( &key_attributes, handshake->ecdh_psa_type );
3760 psa_set_key_bits( &key_attributes, handshake->ecdh_bits );
3761
3762 /* Generate ECDH private key. */
3763 status = psa_generate_key( &key_attributes,
3764 &handshake->ecdh_psa_privkey );
3765 if( status != PSA_SUCCESS )
3766 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3767
3768 /* Export the public part of the ECDH private key from PSA
3769 * and convert it to ECPoint format used in ClientKeyExchange. */
3770 status = psa_export_public_key( handshake->ecdh_psa_privkey,
3771 own_pubkey, sizeof( own_pubkey ),
3772 &own_pubkey_len );
3773 if( status != PSA_SUCCESS )
3774 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3775
3776 if( mbedtls_psa_tls_psa_ec_to_ecpoint( own_pubkey,
3777 own_pubkey_len,
3778 &own_pubkey_ecpoint,
3779 &own_pubkey_ecpoint_len ) != 0 )
3780 {
3781 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3782 }
3783
3784 /* Copy ECPoint structure to outgoing message buffer. */
3785 ssl->out_msg[header_len] = (unsigned char) own_pubkey_ecpoint_len;
3786 memcpy( ssl->out_msg + header_len + 1,
3787 own_pubkey_ecpoint, own_pubkey_ecpoint_len );
3788 content_len = own_pubkey_ecpoint_len + 1;
3789
3790 /* The ECDH secret is the premaster secret used for key derivation. */
3791
3792 /* Compute ECDH shared secret. */
3793 status = psa_raw_key_agreement( PSA_ALG_ECDH,
3794 handshake->ecdh_psa_privkey,
3795 handshake->ecdh_psa_peerkey,
3796 handshake->ecdh_psa_peerkey_len,
3797 ssl->handshake->premaster,
3798 sizeof( ssl->handshake->premaster ),
3799 &ssl->handshake->pmslen );
3800 if( status != PSA_SUCCESS )
3801 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3802
3803 status = psa_destroy_key( handshake->ecdh_psa_privkey );
3804 if( status != PSA_SUCCESS )
3805 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
3806 handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
3807 }
3808 else
3809 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
3810 ( MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3811 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ) */
3812 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3813 defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3814 defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3815 defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3816 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
3817 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
3818 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
3819 ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
3820 {
3821 /*
3822 * ECDH key exchange -- send client public value
3823 */
3824 header_len = 4;
3825
3826 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3827 if( ssl->handshake->ecrs_enabled )
3828 {
3829 if( ssl->handshake->ecrs_state == ssl_ecrs_cke_ecdh_calc_secret )
3830 goto ecdh_calc_secret;
3831
3832 mbedtls_ecdh_enable_restart( &ssl->handshake->ecdh_ctx );
3833 }
3834 #endif
3835
3836 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
3837 &content_len,
3838 &ssl->out_msg[header_len], 1000,
3839 ssl->conf->f_rng, ssl->conf->p_rng );
3840 if( ret != 0 )
3841 {
3842 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
3843 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3844 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3845 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3846 #endif
3847 return( ret );
3848 }
3849
3850 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3851 MBEDTLS_DEBUG_ECDH_Q );
3852
3853 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3854 if( ssl->handshake->ecrs_enabled )
3855 {
3856 ssl->handshake->ecrs_n = content_len;
3857 ssl->handshake->ecrs_state = ssl_ecrs_cke_ecdh_calc_secret;
3858 }
3859
3860 ecdh_calc_secret:
3861 if( ssl->handshake->ecrs_enabled )
3862 content_len = ssl->handshake->ecrs_n;
3863 #endif
3864 if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
3865 &ssl->handshake->pmslen,
3866 ssl->handshake->premaster,
3867 MBEDTLS_MPI_MAX_SIZE,
3868 ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
3869 {
3870 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
3871 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
3872 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3873 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3874 #endif
3875 return( ret );
3876 }
3877
3878 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3879 MBEDTLS_DEBUG_ECDH_Z );
3880 }
3881 else
3882 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3883 MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3884 MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3885 MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3886 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
3887 if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
3888 {
3889 /*
3890 * opaque psk_identity<0..2^16-1>;
3891 */
3892 if( ssl_conf_has_static_psk( ssl->conf ) == 0 )
3893 {
3894 /* We don't offer PSK suites if we don't have a PSK,
3895 * and we check that the server's choice is among the
3896 * ciphersuites we offered, so this should never happen. */
3897 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3898 }
3899
3900 header_len = 4;
3901 content_len = ssl->conf->psk_identity_len;
3902
3903 if( header_len + 2 + content_len > MBEDTLS_SSL_OUT_CONTENT_LEN )
3904 {
3905 MBEDTLS_SSL_DEBUG_MSG( 1,
3906 ( "psk identity too long or SSL buffer too short" ) );
3907 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3908 }
3909
3910 ssl->out_msg[header_len++] = (unsigned char)( content_len >> 8 );
3911 ssl->out_msg[header_len++] = (unsigned char)( content_len );
3912
3913 memcpy( ssl->out_msg + header_len,
3914 ssl->conf->psk_identity,
3915 ssl->conf->psk_identity_len );
3916 header_len += ssl->conf->psk_identity_len;
3917
3918 #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3919 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
3920 {
3921 content_len = 0;
3922 }
3923 else
3924 #endif
3925 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3926 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
3927 {
3928 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3929 /* Opaque PSKs are currently only supported for PSK-only suites. */
3930 if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
3931 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3932 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3933
3934 if( ( ret = ssl_write_encrypted_pms( ssl, header_len,
3935 &content_len, 2 ) ) != 0 )
3936 return( ret );
3937 }
3938 else
3939 #endif
3940 #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3941 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
3942 {
3943 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3944 /* Opaque PSKs are currently only supported for PSK-only suites. */
3945 if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
3946 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3947 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3948
3949 /*
3950 * ClientDiffieHellmanPublic public (DHM send G^X mod P)
3951 */
3952 content_len = ssl->handshake->dhm_ctx.len;
3953
3954 if( header_len + 2 + content_len >
3955 MBEDTLS_SSL_OUT_CONTENT_LEN )
3956 {
3957 MBEDTLS_SSL_DEBUG_MSG( 1,
3958 ( "psk identity or DHM size too long or SSL buffer too short" ) );
3959 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3960 }
3961
3962 ssl->out_msg[header_len++] = (unsigned char)( content_len >> 8 );
3963 ssl->out_msg[header_len++] = (unsigned char)( content_len );
3964
3965 ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
3966 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3967 &ssl->out_msg[header_len], content_len,
3968 ssl->conf->f_rng, ssl->conf->p_rng );
3969 if( ret != 0 )
3970 {
3971 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
3972 return( ret );
3973 }
3974 }
3975 else
3976 #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3977 #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3978 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
3979 {
3980 #if defined(MBEDTLS_USE_PSA_CRYPTO)
3981 /* Opaque PSKs are currently only supported for PSK-only suites. */
3982 if( ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
3983 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
3984 #endif /* MBEDTLS_USE_PSA_CRYPTO */
3985
3986 /*
3987 * ClientECDiffieHellmanPublic public;
3988 */
3989 ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
3990 &content_len,
3991 &ssl->out_msg[header_len],
3992 MBEDTLS_SSL_OUT_CONTENT_LEN - header_len,
3993 ssl->conf->f_rng, ssl->conf->p_rng );
3994 if( ret != 0 )
3995 {
3996 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
3997 return( ret );
3998 }
3999
4000 MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
4001 MBEDTLS_DEBUG_ECDH_Q );
4002 }
4003 else
4004 #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
4005 {
4006 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4007 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4008 }
4009
4010 #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
4011 defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
4012 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK &&
4013 ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 &&
4014 ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
4015 {
4016 MBEDTLS_SSL_DEBUG_MSG( 1,
4017 ( "skip PMS generation for opaque PSK" ) );
4018 }
4019 else
4020 #endif /* MBEDTLS_USE_PSA_CRYPTO &&
4021 MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
4022 if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
4023 ciphersuite_info->key_exchange ) ) != 0 )
4024 {
4025 MBEDTLS_SSL_DEBUG_RET( 1,
4026 "mbedtls_ssl_psk_derive_premaster", ret );
4027 return( ret );
4028 }
4029 }
4030 else
4031 #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
4032 #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
4033 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
4034 {
4035 header_len = 4;
4036 if( ( ret = ssl_write_encrypted_pms( ssl, header_len,
4037 &content_len, 0 ) ) != 0 )
4038 return( ret );
4039 }
4040 else
4041 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
4042 #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
4043 if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
4044 {
4045 header_len = 4;
4046
4047 ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
4048 ssl->out_msg + header_len,
4049 MBEDTLS_SSL_OUT_CONTENT_LEN - header_len,
4050 &content_len,
4051 ssl->conf->f_rng, ssl->conf->p_rng );
4052 if( ret != 0 )
4053 {
4054 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
4055 return( ret );
4056 }
4057
4058 ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
4059 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
4060 ssl->conf->f_rng, ssl->conf->p_rng );
4061 if( ret != 0 )
4062 {
4063 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
4064 return( ret );
4065 }
4066 }
4067 else
4068 #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
4069 {
4070 ((void) ciphersuite_info);
4071 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4072 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4073 }
4074
4075 ssl->out_msglen = header_len + content_len;
4076 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4077 ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
4078
4079 ssl->state++;
4080
4081 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
4082 {
4083 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
4084 return( ret );
4085 }
4086
4087 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
4088
4089 return( 0 );
4090 }
4091
4092 #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED)
ssl_write_certificate_verify(mbedtls_ssl_context * ssl)4093 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
4094 {
4095 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
4096 ssl->handshake->ciphersuite_info;
4097 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4098
4099 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
4100
4101 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
4102 {
4103 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
4104 return( ret );
4105 }
4106
4107 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
4108 {
4109 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
4110 ssl->state++;
4111 return( 0 );
4112 }
4113
4114 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4115 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4116 }
4117 #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
ssl_write_certificate_verify(mbedtls_ssl_context * ssl)4118 static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
4119 {
4120 int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
4121 const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
4122 ssl->handshake->ciphersuite_info;
4123 size_t n = 0, offset = 0;
4124 unsigned char hash[48];
4125 unsigned char *hash_start = hash;
4126 mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
4127 size_t hashlen;
4128 void *rs_ctx = NULL;
4129
4130 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
4131
4132 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
4133 if( ssl->handshake->ecrs_enabled &&
4134 ssl->handshake->ecrs_state == ssl_ecrs_crt_vrfy_sign )
4135 {
4136 goto sign;
4137 }
4138 #endif
4139
4140 if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
4141 {
4142 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
4143 return( ret );
4144 }
4145
4146 if( !mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
4147 {
4148 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
4149 ssl->state++;
4150 return( 0 );
4151 }
4152
4153 if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
4154 {
4155 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
4156 ssl->state++;
4157 return( 0 );
4158 }
4159
4160 if( mbedtls_ssl_own_key( ssl ) == NULL )
4161 {
4162 MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
4163 return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
4164 }
4165
4166 /*
4167 * Make a signature of the handshake digests
4168 */
4169 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
4170 if( ssl->handshake->ecrs_enabled )
4171 ssl->handshake->ecrs_state = ssl_ecrs_crt_vrfy_sign;
4172
4173 sign:
4174 #endif
4175
4176 ssl->handshake->calc_verify( ssl, hash, &hashlen );
4177
4178 #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
4179 defined(MBEDTLS_SSL_PROTO_TLS1_1)
4180 if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
4181 {
4182 /*
4183 * digitally-signed struct {
4184 * opaque md5_hash[16];
4185 * opaque sha_hash[20];
4186 * };
4187 *
4188 * md5_hash
4189 * MD5(handshake_messages);
4190 *
4191 * sha_hash
4192 * SHA(handshake_messages);
4193 */
4194 md_alg = MBEDTLS_MD_NONE;
4195
4196 /*
4197 * For ECDSA, default hash is SHA-1 only
4198 */
4199 if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
4200 {
4201 hash_start += 16;
4202 hashlen -= 16;
4203 md_alg = MBEDTLS_MD_SHA1;
4204 }
4205 }
4206 else
4207 #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
4208 MBEDTLS_SSL_PROTO_TLS1_1 */
4209 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
4210 if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
4211 {
4212 /*
4213 * digitally-signed struct {
4214 * opaque handshake_messages[handshake_messages_length];
4215 * };
4216 *
4217 * Taking shortcut here. We assume that the server always allows the
4218 * PRF Hash function and has sent it in the allowed signature
4219 * algorithms list received in the Certificate Request message.
4220 *
4221 * Until we encounter a server that does not, we will take this
4222 * shortcut.
4223 *
4224 * Reason: Otherwise we should have running hashes for SHA512 and
4225 * SHA224 in order to satisfy 'weird' needs from the server
4226 * side.
4227 */
4228 if( ssl->handshake->ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
4229 {
4230 md_alg = MBEDTLS_MD_SHA384;
4231 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
4232 }
4233 else
4234 {
4235 md_alg = MBEDTLS_MD_SHA256;
4236 ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
4237 }
4238 ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
4239
4240 /* Info from md_alg will be used instead */
4241 hashlen = 0;
4242 offset = 2;
4243 }
4244 else
4245 #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
4246 {
4247 MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
4248 return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
4249 }
4250
4251 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
4252 if( ssl->handshake->ecrs_enabled )
4253 rs_ctx = &ssl->handshake->ecrs_ctx.pk;
4254 #endif
4255
4256 if( ( ret = mbedtls_pk_sign_restartable( mbedtls_ssl_own_key( ssl ),
4257 md_alg, hash_start, hashlen,
4258 ssl->out_msg + 6 + offset, &n,
4259 ssl->conf->f_rng, ssl->conf->p_rng, rs_ctx ) ) != 0 )
4260 {
4261 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
4262 #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
4263 if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
4264 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
4265 #endif
4266 return( ret );
4267 }
4268
4269 ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
4270 ssl->out_msg[5 + offset] = (unsigned char)( n );
4271
4272 ssl->out_msglen = 6 + n + offset;
4273 ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
4274 ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
4275
4276 ssl->state++;
4277
4278 if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
4279 {
4280 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
4281 return( ret );
4282 }
4283
4284 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
4285
4286 return( ret );
4287 }
4288 #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */
4289
4290 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
ssl_parse_new_session_ticket(mbedtls_ssl_context * ssl)4291 static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
4292 {
4293 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
4294 uint32_t lifetime;
4295 size_t ticket_len;
4296 unsigned char *ticket;
4297 const unsigned char *msg;
4298
4299 MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
4300
4301 if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
4302 {
4303 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
4304 return( ret );
4305 }
4306
4307 if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
4308 {
4309 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
4310 mbedtls_ssl_send_alert_message(
4311 ssl,
4312 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4313 MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
4314 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
4315 }
4316
4317 /*
4318 * struct {
4319 * uint32 ticket_lifetime_hint;
4320 * opaque ticket<0..2^16-1>;
4321 * } NewSessionTicket;
4322 *
4323 * 0 . 3 ticket_lifetime_hint
4324 * 4 . 5 ticket_len (n)
4325 * 6 . 5+n ticket content
4326 */
4327 if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ||
4328 ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
4329 {
4330 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
4331 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4332 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
4333 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
4334 }
4335
4336 msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
4337
4338 lifetime = ( ((uint32_t) msg[0]) << 24 ) | ( msg[1] << 16 ) |
4339 ( msg[2] << 8 ) | ( msg[3] );
4340
4341 ticket_len = ( msg[4] << 8 ) | ( msg[5] );
4342
4343 if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
4344 {
4345 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
4346 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4347 MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
4348 return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
4349 }
4350
4351 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %" MBEDTLS_PRINTF_SIZET, ticket_len ) );
4352
4353 /* We're not waiting for a NewSessionTicket message any more */
4354 ssl->handshake->new_session_ticket = 0;
4355 ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
4356
4357 /*
4358 * Zero-length ticket means the server changed his mind and doesn't want
4359 * to send a ticket after all, so just forget it
4360 */
4361 if( ticket_len == 0 )
4362 return( 0 );
4363
4364 if( ssl->session != NULL && ssl->session->ticket != NULL )
4365 {
4366 mbedtls_platform_zeroize( ssl->session->ticket,
4367 ssl->session->ticket_len );
4368 mbedtls_free( ssl->session->ticket );
4369 ssl->session->ticket = NULL;
4370 ssl->session->ticket_len = 0;
4371 }
4372
4373 mbedtls_platform_zeroize( ssl->session_negotiate->ticket,
4374 ssl->session_negotiate->ticket_len );
4375 mbedtls_free( ssl->session_negotiate->ticket );
4376 ssl->session_negotiate->ticket = NULL;
4377 ssl->session_negotiate->ticket_len = 0;
4378
4379 if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
4380 {
4381 MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
4382 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
4383 MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
4384 return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
4385 }
4386
4387 memcpy( ticket, msg + 6, ticket_len );
4388
4389 ssl->session_negotiate->ticket = ticket;
4390 ssl->session_negotiate->ticket_len = ticket_len;
4391 ssl->session_negotiate->ticket_lifetime = lifetime;
4392
4393 /*
4394 * RFC 5077 section 3.4:
4395 * "If the client receives a session ticket from the server, then it
4396 * discards any Session ID that was sent in the ServerHello."
4397 */
4398 MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
4399 ssl->session_negotiate->id_len = 0;
4400
4401 MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
4402
4403 return( 0 );
4404 }
4405 #endif /* MBEDTLS_SSL_SESSION_TICKETS */
4406
4407 /*
4408 * SSL handshake -- client side -- single step
4409 */
mbedtls_ssl_handshake_client_step(mbedtls_ssl_context * ssl)4410 int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
4411 {
4412 int ret = 0;
4413
4414 if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
4415 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4416
4417 MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
4418
4419 if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
4420 return( ret );
4421
4422 #if defined(MBEDTLS_SSL_PROTO_DTLS)
4423 if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
4424 ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
4425 {
4426 if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
4427 return( ret );
4428 }
4429 #endif /* MBEDTLS_SSL_PROTO_DTLS */
4430
4431 /* Change state now, so that it is right in mbedtls_ssl_read_record(), used
4432 * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
4433 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4434 if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
4435 ssl->handshake->new_session_ticket != 0 )
4436 {
4437 ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
4438 }
4439 #endif
4440
4441 switch( ssl->state )
4442 {
4443 case MBEDTLS_SSL_HELLO_REQUEST:
4444 ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
4445 break;
4446
4447 /*
4448 * ==> ClientHello
4449 */
4450 case MBEDTLS_SSL_CLIENT_HELLO:
4451 ret = ssl_write_client_hello( ssl );
4452 break;
4453
4454 /*
4455 * <== ServerHello
4456 * Certificate
4457 * ( ServerKeyExchange )
4458 * ( CertificateRequest )
4459 * ServerHelloDone
4460 */
4461 case MBEDTLS_SSL_SERVER_HELLO:
4462 ret = ssl_parse_server_hello( ssl );
4463 break;
4464
4465 case MBEDTLS_SSL_SERVER_CERTIFICATE:
4466 ret = mbedtls_ssl_parse_certificate( ssl );
4467 break;
4468
4469 case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
4470 ret = ssl_parse_server_key_exchange( ssl );
4471 break;
4472
4473 case MBEDTLS_SSL_CERTIFICATE_REQUEST:
4474 ret = ssl_parse_certificate_request( ssl );
4475 break;
4476
4477 case MBEDTLS_SSL_SERVER_HELLO_DONE:
4478 ret = ssl_parse_server_hello_done( ssl );
4479 break;
4480
4481 /*
4482 * ==> ( Certificate/Alert )
4483 * ClientKeyExchange
4484 * ( CertificateVerify )
4485 * ChangeCipherSpec
4486 * Finished
4487 */
4488 case MBEDTLS_SSL_CLIENT_CERTIFICATE:
4489 ret = mbedtls_ssl_write_certificate( ssl );
4490 break;
4491
4492 case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
4493 ret = ssl_write_client_key_exchange( ssl );
4494 break;
4495
4496 case MBEDTLS_SSL_CERTIFICATE_VERIFY:
4497 ret = ssl_write_certificate_verify( ssl );
4498 break;
4499
4500 case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
4501 ret = mbedtls_ssl_write_change_cipher_spec( ssl );
4502 break;
4503
4504 case MBEDTLS_SSL_CLIENT_FINISHED:
4505 ret = mbedtls_ssl_write_finished( ssl );
4506 break;
4507
4508 /*
4509 * <== ( NewSessionTicket )
4510 * ChangeCipherSpec
4511 * Finished
4512 */
4513 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
4514 case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
4515 ret = ssl_parse_new_session_ticket( ssl );
4516 break;
4517 #endif
4518
4519 case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
4520 ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
4521 break;
4522
4523 case MBEDTLS_SSL_SERVER_FINISHED:
4524 ret = mbedtls_ssl_parse_finished( ssl );
4525 break;
4526
4527 case MBEDTLS_SSL_FLUSH_BUFFERS:
4528 MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
4529 ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
4530 break;
4531
4532 case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
4533 mbedtls_ssl_handshake_wrapup( ssl );
4534 break;
4535
4536 default:
4537 MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
4538 return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
4539 }
4540
4541 return( ret );
4542 }
4543 #endif /* MBEDTLS_SSL_CLI_C */
4544