xref: /freebsd/contrib/bearssl/src/ssl/ssl_hs_client.t0 (revision 10ff414c)

\ Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
\
\ Permission is hereby granted, free of charge, to any person obtaining
\ a copy of this software and associated documentation files (the
\ "Software"), to deal in the Software without restriction, including
\ without limitation the rights to use, copy, modify, merge, publish,
\ distribute, sublicense, and/or sell copies of the Software, and to
\ permit persons to whom the Software is furnished to do so, subject to
\ the following conditions:
\
\ The above copyright notice and this permission notice shall be
\ included in all copies or substantial portions of the Software.
\
\ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
\ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
\ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
\ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
\ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
\ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
\ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
\ SOFTWARE.

\ ----------------------------------------------------------------------
\ Handshake processing code, for the client.
\ The common T0 code (ssl_hs_common.t0) shall be read first.

preamble {

/*
 * This macro evaluates to a pointer to the client context, under that
 * specific name. It must be noted that since the engine context is the
 * first field of the br_ssl_client_context structure ('eng'), then
 * pointers values of both types are interchangeable, modulo an
 * appropriate cast. This also means that "addresses" computed as offsets
 * within the structure work for both kinds of context.
 */
#define CTX  ((br_ssl_client_context *)ENG)

/*
 * Generate the pre-master secret for RSA key exchange, and encrypt it
 * with the server's public key. Returned value is either the encrypted
 * data length (in bytes), or -x on error, with 'x' being an error code.
 *
 * This code assumes that the public key has been already verified (it
 * was properly obtained by the X.509 engine, and it has the right type,
 * i.e. it is of type RSA and suitable for encryption).
 */
static int
make_pms_rsa(br_ssl_client_context *ctx, int prf_id)
{
	const br_x509_class **xc;
	const br_x509_pkey *pk;
	const unsigned char *n;
	unsigned char *pms;
	size_t nlen, u;

	xc = ctx->eng.x509ctx;
	pk = (*xc)->get_pkey(xc, NULL);

	/*
	 * Compute actual RSA key length, in case there are leading zeros.
	 */
	n = pk->key.rsa.n;
	nlen = pk->key.rsa.nlen;
	while (nlen > 0 && *n == 0) {
		n ++;
		nlen --;
	}

	/*
	 * We need at least 59 bytes (48 bytes for pre-master secret, and
	 * 11 bytes for the PKCS#1 type 2 padding). Note that the X.509
	 * minimal engine normally blocks RSA keys shorter than 128 bytes,
	 * so this is mostly for public keys provided explicitly by the
	 * caller.
	 */
	if (nlen < 59) {
		return -BR_ERR_X509_WEAK_PUBLIC_KEY;
	}
	if (nlen > sizeof ctx->eng.pad) {
		return -BR_ERR_LIMIT_EXCEEDED;
	}

	/*
	 * Make PMS.
	 */
	pms = ctx->eng.pad + nlen - 48;
	br_enc16be(pms, ctx->eng.version_max);
	br_hmac_drbg_generate(&ctx->eng.rng, pms + 2, 46);
	br_ssl_engine_compute_master(&ctx->eng, prf_id, pms, 48);

	/*
	 * Apply PKCS#1 type 2 padding.
	 */
	ctx->eng.pad[0] = 0x00;
	ctx->eng.pad[1] = 0x02;
	ctx->eng.pad[nlen - 49] = 0x00;
	br_hmac_drbg_generate(&ctx->eng.rng, ctx->eng.pad + 2, nlen - 51);
	for (u = 2; u < nlen - 49; u ++) {
		while (ctx->eng.pad[u] == 0) {
			br_hmac_drbg_generate(&ctx->eng.rng,
				&ctx->eng.pad[u], 1);
		}
	}

	/*
	 * Compute RSA encryption.
	 */
	if (!ctx->irsapub(ctx->eng.pad, nlen, &pk->key.rsa)) {
		return -BR_ERR_LIMIT_EXCEEDED;
	}
	return (int)nlen;
}

/*
 * OID for hash functions in RSA signatures.
 */
static const unsigned char *HASH_OID[] = {
	BR_HASH_OID_SHA1,
	BR_HASH_OID_SHA224,
	BR_HASH_OID_SHA256,
	BR_HASH_OID_SHA384,
	BR_HASH_OID_SHA512
};

/*
 * Check the RSA signature on the ServerKeyExchange message.
 *
 *   hash      hash function ID (2 to 6), or 0 for MD5+SHA-1 (with RSA only)
 *   use_rsa   non-zero for RSA signature, zero for ECDSA
 *   sig_len   signature length (in bytes); signature value is in the pad
 *
 * Returned value is 0 on success, or an error code.
 */
static int
verify_SKE_sig(br_ssl_client_context *ctx,
	int hash, int use_rsa, size_t sig_len)
{
	const br_x509_class **xc;
	const br_x509_pkey *pk;
	br_multihash_context mhc;
	unsigned char hv[64], head[4];
	size_t hv_len;

	xc = ctx->eng.x509ctx;
	pk = (*xc)->get_pkey(xc, NULL);
	br_multihash_zero(&mhc);
	br_multihash_copyimpl(&mhc, &ctx->eng.mhash);
	br_multihash_init(&mhc);
	br_multihash_update(&mhc,
		ctx->eng.client_random, sizeof ctx->eng.client_random);
	br_multihash_update(&mhc,
		ctx->eng.server_random, sizeof ctx->eng.server_random);
	head[0] = 3;
	head[1] = 0;
	head[2] = ctx->eng.ecdhe_curve;
	head[3] = ctx->eng.ecdhe_point_len;
	br_multihash_update(&mhc, head, sizeof head);
	br_multihash_update(&mhc,
		ctx->eng.ecdhe_point, ctx->eng.ecdhe_point_len);
	if (hash) {
		hv_len = br_multihash_out(&mhc, hash, hv);
		if (hv_len == 0) {
			return BR_ERR_INVALID_ALGORITHM;
		}
	} else {
		if (!br_multihash_out(&mhc, br_md5_ID, hv)
			|| !br_multihash_out(&mhc, br_sha1_ID, hv + 16))
		{
			return BR_ERR_INVALID_ALGORITHM;
		}
		hv_len = 36;
	}
	if (use_rsa) {
		unsigned char tmp[64];
		const unsigned char *hash_oid;

		if (hash) {
			hash_oid = HASH_OID[hash - 2];
		} else {
			hash_oid = NULL;
		}
		if (!ctx->eng.irsavrfy(ctx->eng.pad, sig_len,
			hash_oid, hv_len, &pk->key.rsa, tmp)
			|| memcmp(tmp, hv, hv_len) != 0)
		{
			return BR_ERR_BAD_SIGNATURE;
		}
	} else {
		if (!ctx->eng.iecdsa(ctx->eng.iec, hv, hv_len, &pk->key.ec,
			ctx->eng.pad, sig_len))
		{
			return BR_ERR_BAD_SIGNATURE;
		}
	}
	return 0;
}

/*
 * Perform client-side ECDH (or ECDHE). The point that should be sent to
 * the server is written in the pad; returned value is either the point
 * length (in bytes), or -x on error, with 'x' being an error code.
 *
 * The point _from_ the server is taken from ecdhe_point[] if 'ecdhe'
 * is non-zero, or from the X.509 engine context if 'ecdhe' is zero
 * (for static ECDH).
 */
static int
make_pms_ecdh(br_ssl_client_context *ctx, unsigned ecdhe, int prf_id)
{
	int curve;
	unsigned char key[66], point[133];
	const unsigned char *order, *point_src;
	size_t glen, olen, point_len, xoff, xlen;
	unsigned char mask;

	if (ecdhe) {
		curve = ctx->eng.ecdhe_curve;
		point_src = ctx->eng.ecdhe_point;
		point_len = ctx->eng.ecdhe_point_len;
	} else {
		const br_x509_class **xc;
		const br_x509_pkey *pk;

		xc = ctx->eng.x509ctx;
		pk = (*xc)->get_pkey(xc, NULL);
		curve = pk->key.ec.curve;
		point_src = pk->key.ec.q;
		point_len = pk->key.ec.qlen;
	}
	if ((ctx->eng.iec->supported_curves & ((uint32_t)1 << curve)) == 0) {
		return -BR_ERR_INVALID_ALGORITHM;
	}

	/*
	 * We need to generate our key, as a non-zero random value which
	 * is lower than the curve order, in a "large enough" range. We
	 * force top bit to 0 and bottom bit to 1, which guarantees that
	 * the value is in the proper range.
	 */
	order = ctx->eng.iec->order(curve, &olen);
	mask = 0xFF;
	while (mask >= order[0]) {
		mask >>= 1;
	}
	br_hmac_drbg_generate(&ctx->eng.rng, key, olen);
	key[0] &= mask;
	key[olen - 1] |= 0x01;

	/*
	 * Compute the common ECDH point, whose X coordinate is the
	 * pre-master secret.
	 */
	ctx->eng.iec->generator(curve, &glen);
	if (glen != point_len) {
		return -BR_ERR_INVALID_ALGORITHM;
	}

	memcpy(point, point_src, glen);
	if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
		return -BR_ERR_INVALID_ALGORITHM;
	}

	/*
	 * The pre-master secret is the X coordinate.
	 */
	xoff = ctx->eng.iec->xoff(curve, &xlen);
	br_ssl_engine_compute_master(&ctx->eng, prf_id, point + xoff, xlen);

	ctx->eng.iec->mulgen(point, key, olen, curve);
	memcpy(ctx->eng.pad, point, glen);
	return (int)glen;
}

/*
 * Perform full static ECDH. This occurs only in the context of client
 * authentication with certificates: the server uses an EC public key,
 * the cipher suite is of type ECDH (not ECDHE), the server requested a
 * client certificate and accepts static ECDH, the client has a
 * certificate with an EC public key in the same curve, and accepts
 * static ECDH as well.
 *
 * Returned value is 0 on success, -1 on error.
 */
static int
make_pms_static_ecdh(br_ssl_client_context *ctx, int prf_id)
{
	unsigned char point[133];
	size_t point_len;
	const br_x509_class **xc;
	const br_x509_pkey *pk;

	xc = ctx->eng.x509ctx;
	pk = (*xc)->get_pkey(xc, NULL);
	point_len = pk->key.ec.qlen;
	if (point_len > sizeof point) {
		return -1;
	}
	memcpy(point, pk->key.ec.q, point_len);
	if (!(*ctx->client_auth_vtable)->do_keyx(
		ctx->client_auth_vtable, point, &point_len))
	{
		return -1;
	}
	br_ssl_engine_compute_master(&ctx->eng,
		prf_id, point, point_len);
	return 0;
}

/*
 * Compute the client-side signature. This is invoked only when a
 * signature-based client authentication was selected. The computed
 * signature is in the pad; its length (in bytes) is returned. On
 * error, 0 is returned.
 */
static size_t
make_client_sign(br_ssl_client_context *ctx)
{
	size_t hv_len;

	/*
	 * Compute hash of handshake messages so far. This "cannot" fail
	 * because the list of supported hash functions provided to the
	 * client certificate handler was trimmed to include only the
	 * hash functions that the multi-hasher supports.
	 */
	if (ctx->hash_id) {
		hv_len = br_multihash_out(&ctx->eng.mhash,
			ctx->hash_id, ctx->eng.pad);
	} else {
		br_multihash_out(&ctx->eng.mhash,
			br_md5_ID, ctx->eng.pad);
		br_multihash_out(&ctx->eng.mhash,
			br_sha1_ID, ctx->eng.pad + 16);
		hv_len = 36;
	}
	return (*ctx->client_auth_vtable)->do_sign(
		ctx->client_auth_vtable, ctx->hash_id, hv_len,
		ctx->eng.pad, sizeof ctx->eng.pad);
}

}

\ =======================================================================

: addr-ctx:
	next-word { field }
	"addr-" field + 0 1 define-word
	0 8191 "offsetof(br_ssl_client_context, " field + ")" + make-CX
	postpone literal postpone ; ;

addr-ctx: min_clienthello_len
addr-ctx: hashes
addr-ctx: auth_type
addr-ctx: hash_id

\ Length of the Secure Renegotiation extension. This is 5 for the
\ first handshake, 17 for a renegotiation (if the server supports the
\ extension), or 0 if we know that the server does not support the
\ extension.
: ext-reneg-length ( -- n )
	addr-reneg get8 dup if 1 - 17 * else drop 5 then ;

\ Length of SNI extension.
: ext-sni-length ( -- len )
	addr-server_name strlen dup if 9 + then ;

\ Length of Maximum Fragment Length extension.
: ext-frag-length ( -- len )
	addr-log_max_frag_len get8 14 = if 0 else 5 then ;

\ Length of Signatures extension.
: ext-signatures-length ( -- len )
	supported-hash-functions { num } drop 0
	supports-rsa-sign? if num + then
	supports-ecdsa? if num + then
	dup if 1 << 6 + then ;

\ Write supported hash functions ( sign -- )
: write-hashes
	{ sign }
	supported-hash-functions drop
	\ We advertise hash functions in the following preference order:
	\   SHA-256 SHA-224 SHA-384 SHA-512 SHA-1
	\ Rationale:
	\ -- SHA-256 and SHA-224 are more efficient on 32-bit architectures
	\ -- SHA-1 is less than ideally collision-resistant
	dup 0x10 and if 4 write8 sign write8 then
	dup 0x08 and if 3 write8 sign write8 then
	dup 0x20 and if 5 write8 sign write8 then
	dup 0x40 and if 6 write8 sign write8 then
	0x04 and if 2 write8 sign write8 then ;

\ Length of Supported Curves extension.
: ext-supported-curves-length ( -- len )
	supported-curves dup if
		0 { x }
		begin dup while
			dup 1 and x + >x
			1 >>
		repeat
		drop x 1 << 6 +
	then ;

\ Length of Supported Point Formats extension.
: ext-point-format-length ( -- len )
	supported-curves if 6 else 0 then ;

\ Length of ALPN extension.
cc: ext-ALPN-length ( -- len ) {
	size_t u, len;

	if (ENG->protocol_names_num == 0) {
		T0_PUSH(0);
		T0_RET();
	}
	len = 6;
	for (u = 0; u < ENG->protocol_names_num; u ++) {
		len += 1 + strlen(ENG->protocol_names[u]);
	}
	T0_PUSH(len);
}

\ Write handshake message: ClientHello
: write-ClientHello ( -- )
	{ ; total-ext-length }

	\ Compute length for extensions (without the general two-byte header).
	\ This does not take padding extension into account.
	ext-reneg-length ext-sni-length + ext-frag-length +
	ext-signatures-length +
	ext-supported-curves-length + ext-point-format-length +
	ext-ALPN-length +
	>total-ext-length

	\ ClientHello type
	1 write8

	\ Compute and write length
	39 addr-session_id_len get8 + addr-suites_num get8 1 << +
	total-ext-length if 2+ total-ext-length + then
	\ Compute padding (if requested).
	addr-min_clienthello_len get16 over - dup 0> if
		\ We well add a Pad ClientHello extension, which has its
		\ own header (4 bytes) and might be the only extension
		\ (2 extra bytes for the extension list header).
		total-ext-length ifnot swap 2+ swap 2- then
		\ Account for the extension header.
		4 - dup 0< if drop 0 then
		\ Adjust total extension length.
		dup 4 + total-ext-length + >total-ext-length
		\ Adjust ClientHello length.
		swap 4 + over + swap
	else
		drop
		-1
	then
	{ ext-padding-amount }
	write24

	\ Protocol version
	addr-version_max get16 write16

	\ Client random
	addr-client_random 4 bzero
	addr-client_random 4 + 28 mkrand
	addr-client_random 32 write-blob

	\ Session ID
	addr-session_id addr-session_id_len get8 write-blob-head8

	\ Supported cipher suites. We also check here that we indeed
	\ support all these suites.
	addr-suites_num get8 dup 1 << write16
	addr-suites_buf swap
	begin
		dup while 1-
		over get16
		dup suite-supported? ifnot ERR_BAD_CIPHER_SUITE fail then
		write16
		swap 2+ swap
	repeat
	2drop

	\ Compression methods (only "null" compression)
	1 write8 0 write8

	\ Extensions
	total-ext-length if
		total-ext-length write16
		ext-reneg-length if
			0xFF01 write16          \ extension type (0xFF01)
			addr-saved_finished
			ext-reneg-length 4 - dup write16 \ extension length
			1- write-blob-head8              \ verify data
		then
		ext-sni-length if
			0x0000 write16          \ extension type (0)
			addr-server_name
			ext-sni-length 4 - dup write16 \ extension length
			2 - dup write16                \ ServerNameList length
			0 write8                       \ name type: host_name
			3 - write-blob-head16          \ the name itself
		then
		ext-frag-length if
			0x0001 write16          \ extension type (1)
			0x0001 write16          \ extension length
			addr-log_max_frag_len get8 8 - write8
		then
		ext-signatures-length if
			0x000D write16          \ extension type (13)
			ext-signatures-length 4 - dup write16 \ extension length
			2 - write16             \ list length
			supports-ecdsa? if 3 write-hashes then
			supports-rsa-sign? if 1 write-hashes then
		then
		\ TODO: add an API to specify preference order for curves.
		\ Right now we send Curve25519 first, then other curves in
		\ increasing ID values (hence P-256 in second).
		ext-supported-curves-length dup if
			0x000A write16          \ extension type (10)
			4 - dup write16         \ extension length
			2- write16              \ list length
			supported-curves 0
			dup 0x20000000 and if
				0xDFFFFFFF and 29 write16
			then
			begin dup 32 < while
				dup2 >> 1 and if dup write16 then
				1+
			repeat
			2drop
		else
			drop
		then
		ext-point-format-length if
			0x000B write16          \ extension type (11)
			0x0002 write16          \ extension length
			0x0100 write16          \ value: 1 format: uncompressed
		then
		ext-ALPN-length dup if
			0x0010 write16          \ extension type (16)
			4 - dup write16         \ extension length
			2- write16              \ list length
			addr-protocol_names_num get16 0
			begin
				dup2 > while
				dup copy-protocol-name
				dup write8 addr-pad swap write-blob
				1+
			repeat
			2drop
		else
			drop
		then
		ext-padding-amount 0< ifnot
			0x0015 write16          \ extension value (21)
			ext-padding-amount
			dup write16             \ extension length
			begin dup while
			1- 0 write8 repeat      \ value (only zeros)
			drop
		then
	then
	;

\ =======================================================================

\ Parse server SNI extension. If present, then it should be empty.
: read-server-sni ( lim -- lim )
	read16 if ERR_BAD_SNI fail then ;

\ Parse server Max Fragment Length extension. If present, then it should
\ advertise the same length as the client. Note that whether the server
\ sends it or not changes nothing for us: we won't send any record larger
\ than the advertised value anyway, and we will accept incoming records
\ up to our input buffer length.
: read-server-frag ( lim -- lim )
	read16 1 = ifnot ERR_BAD_FRAGLEN fail then
	read8 8 + addr-log_max_frag_len get8 = ifnot ERR_BAD_FRAGLEN fail then ;

\ Parse server Secure Renegotiation extension. This is called only if
\ the client sent that extension, so we only have two cases to
\ distinguish: first handshake, and renegotiation; in the latter case,
\ we know that the server supports the extension, otherwise the client
\ would not have sent it.
: read-server-reneg ( lim -- lim )
	read16
	addr-reneg get8 ifnot
		\ "reneg" is 0, so this is a first handshake. The server's
		\ extension MUST be empty. We also learn that the server
		\ supports the extension.
		1 = ifnot ERR_BAD_SECRENEG fail then
		read8 0 = ifnot ERR_BAD_SECRENEG fail then
		2 addr-reneg set8
	else
		\ "reneg" is non-zero, and we sent an extension, so it must
		\ be 2 and this is a renegotiation. We must verify that
		\ the extension contents have length exactly 24 bytes and
		\ match the saved client and server "Finished".
		25 = ifnot ERR_BAD_SECRENEG fail then
		read8 24 = ifnot ERR_BAD_SECRENEG fail then
		addr-pad 24 read-blob
		addr-saved_finished addr-pad 24 memcmp ifnot
			ERR_BAD_SECRENEG fail
		then
	then ;

\ Read the ALPN extension from the server. It must contain a single name,
\ and that name must match one of our names.
: read-ALPN-from-server ( lim -- lim )
	\ Extension contents length.
	read16 open-elt
	\ Length of list of names.
	read16 open-elt
	\ There should be a single name.
	read8 addr-pad swap dup { len } read-blob
	close-elt
	close-elt
	len test-protocol-name dup 0< if
		3 flag? if ERR_UNEXPECTED fail then
		drop
	else
		1+ addr-selected_protocol set16
	then ;

\ Save a value in a 16-bit field, or check it in case of session resumption.
: check-resume ( val addr resume -- )
	if get16 = ifnot ERR_RESUME_MISMATCH fail then else set16 then ;

cc: DEBUG-BLOB ( addr len -- ) {
	extern int printf(const char *fmt, ...);

	size_t len = T0_POP();
	unsigned char *buf = (unsigned char *)CTX + T0_POP();
	size_t u;

	printf("BLOB:");
	for (u = 0; u < len; u ++) {
		if (u % 16 == 0) {
			printf("\n    ");
		}
		printf(" %02x", buf[u]);
	}
	printf("\n");
}

\ Parse incoming ServerHello. Returned value is true (-1) on session
\ resumption.
: read-ServerHello ( -- bool )
	\ Get header, and check message type.
	read-handshake-header 2 = ifnot ERR_UNEXPECTED fail then

	\ Get protocol version.
	read16 { version }
	version addr-version_min get16 < version addr-version_max get16 > or if
		ERR_UNSUPPORTED_VERSION fail
	then

	\ Enforce chosen version for subsequent records in both directions.
	version addr-version_in get16 <> if ERR_BAD_VERSION fail then
	version addr-version_out set16

	\ Server random.
	addr-server_random 32 read-blob

	\ The "session resumption" flag.
	0 { resume }

	\ Session ID.
	read8 { idlen }
	idlen 32 > if ERR_OVERSIZED_ID fail then
	addr-pad idlen read-blob
	idlen addr-session_id_len get8 = idlen 0 > and if
		addr-session_id addr-pad idlen memcmp if
			\ Server session ID is non-empty and matches what
			\ we sent, so this is a session resumption.
			-1 >resume
		then
	then
	addr-session_id addr-pad idlen memcpy
	idlen addr-session_id_len set8

	\ Record version.
	version addr-version resume check-resume

	\ Cipher suite. We check that it is part of the list of cipher
	\ suites that we advertised.
	read16
	dup scan-suite 0< if ERR_BAD_CIPHER_SUITE fail then
	\ Also check that the cipher suite is compatible with the
	\ announced version: suites that don't use HMAC/SHA-1 are
	\ for TLS-1.2 only, not older versions.
	dup use-tls12? version 0x0303 < and if ERR_BAD_CIPHER_SUITE fail then
	addr-cipher_suite resume check-resume

	\ Compression method. Should be 0 (no compression).
	read8 if ERR_BAD_COMPRESSION fail then

	\ Parse extensions (if any). If there is no extension, then the
	\ read limit (on the TOS) should be 0 at that point.
	dup if
		\ Length of extension list.
		\ message size.
		read16 open-elt

		\ Enumerate extensions. For each of them, check that we
		\ sent an extension of that type, and did not see it
		\ yet; and then process it.
		ext-sni-length { ok-sni }
		ext-reneg-length { ok-reneg }
		ext-frag-length { ok-frag }
		ext-signatures-length { ok-signatures }
		ext-supported-curves-length { ok-curves }
		ext-point-format-length { ok-points }
		ext-ALPN-length { ok-ALPN }
		begin dup while
			read16
			case
				\ Server Name Indication. The server may
				\ send such an extension if it uses the SNI
				\ from the client, but that "response
				\ extension" is supposed to be empty.
				0x0000 of
					ok-sni ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-sni
					read-server-sni
				endof

				\ Max Frag Length. The contents shall be
				\ a single byte whose value matches the one
				\ sent by the client.
				0x0001 of
					ok-frag ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-frag
					read-server-frag
				endof

				\ Secure Renegotiation.
				0xFF01 of
					ok-reneg ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-reneg
					read-server-reneg
				endof

				\ Signature Algorithms.
				\ Normally, the server should never send this
				\ extension (so says RFC 5246 #7.4.1.4.1),
				\ but some existing servers do.
				0x000D of
					ok-signatures ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-signatures
					read-ignore-16
				endof

				\ Supported Curves.
				0x000A of
					ok-curves ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-curves
					read-ignore-16
				endof

				\ Supported Point Formats.
				0x000B of
					ok-points ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-points
					read-ignore-16
				endof

				\ ALPN.
				0x0010 of
					ok-ALPN ifnot
						ERR_EXTRA_EXTENSION fail
					then
					0 >ok-ALPN
					read-ALPN-from-server
				endof

				ERR_EXTRA_EXTENSION fail
			endcase
		repeat

		\ If we sent a secure renegotiation extension but did not
		\ receive a response, then the server does not support
		\ secure renegotiation. This is a hard failure if this
		\ is a renegotiation.
		ok-reneg if
			ok-reneg 5 > if ERR_BAD_SECRENEG fail then
			1 addr-reneg set8
		then
		close-elt
	else
		\ No extension received at all, so the server does not
		\ support secure renegotiation. This is a hard failure
		\ if the server was previously known to support it (i.e.
		\ this is a renegotiation).
		ext-reneg-length 5 > if ERR_BAD_SECRENEG fail then
		1 addr-reneg set8
	then
	close-elt
	resume
	;

cc: set-server-curve ( -- ) {
	const br_x509_class *xc;
	const br_x509_pkey *pk;

	xc = *(ENG->x509ctx);
	pk = xc->get_pkey(ENG->x509ctx, NULL);
	CTX->server_curve =
		(pk->key_type == BR_KEYTYPE_EC) ? pk->key.ec.curve : 0;
}

\ Read Certificate message from server.
: read-Certificate-from-server ( -- )
	addr-cipher_suite get16 expected-key-type
	-1 read-Certificate
	dup 0< if neg fail then
	dup ifnot ERR_UNEXPECTED fail then
	over and <> if ERR_WRONG_KEY_USAGE fail then

	\ Set server curve (used for static ECDH).
	set-server-curve ;

\ Verify signature on ECDHE point sent by the server.
\   'hash' is the hash function to use (1 to 6, or 0 for RSA with MD5+SHA-1)
\   'use-rsa' is 0 for ECDSA, -1 for for RSA
\   'sig-len' is the signature length (in bytes)
\ The signature itself is in the pad.
cc: verify-SKE-sig ( hash use-rsa sig-len -- err ) {
	size_t sig_len = T0_POP();
	int use_rsa = T0_POPi();
	int hash = T0_POPi();

	T0_PUSH(verify_SKE_sig(CTX, hash, use_rsa, sig_len));
}

\ Parse ServerKeyExchange
: read-ServerKeyExchange ( -- )
	\ Get header, and check message type.
	read-handshake-header 12 = ifnot ERR_UNEXPECTED fail then

	\ We expect a named curve, and we must support it.
	read8 3 = ifnot ERR_INVALID_ALGORITHM fail then
	read16 dup addr-ecdhe_curve set8
	dup 32 >= if ERR_INVALID_ALGORITHM fail then
	supported-curves swap >> 1 and ifnot ERR_INVALID_ALGORITHM fail then

	\ Read the server point.
	read8
	dup 133 > if ERR_INVALID_ALGORITHM fail then
	dup addr-ecdhe_point_len set8
	addr-ecdhe_point swap read-blob

	\ If using TLS-1.2+, then the hash function and signature algorithm
	\ are explicitly provided; the signature algorithm must match what
	\ the cipher suite specifies. With TLS-1.0 and 1.1, the signature
	\ algorithm is inferred from the cipher suite, and the hash is
	\ either MD5+SHA-1 (for RSA signatures) or SHA-1 (for ECDSA).
	addr-version get16 0x0303 >= { tls1.2+ }
	addr-cipher_suite get16 use-rsa-ecdhe? { use-rsa }
	2 { hash }
	tls1.2+ if
		\ Read hash function; accept only the SHA-* identifiers
		\ (from SHA-1 to SHA-512, no MD5 here).
		read8
		dup dup 2 < swap 6 > or if ERR_INVALID_ALGORITHM fail then
		>hash
		read8
		\ Get expected signature algorithm and compare with what
		\ the server just sent. Expected value is 1 for RSA, 3
		\ for ECDSA. Note that 'use-rsa' evaluates to -1 for RSA,
		\ 0 for ECDSA.
		use-rsa 1 << 3 + = ifnot ERR_INVALID_ALGORITHM fail then
	else
		\ For MD5+SHA-1, we set 'hash' to 0.
		use-rsa if 0 >hash then
	then

	\ Read signature into the pad.
	read16 dup { sig-len }

	dup 512 > if ERR_LIMIT_EXCEEDED fail then
	addr-pad swap read-blob

	\ Verify signature.
	hash use-rsa sig-len verify-SKE-sig
	dup if fail then drop

	close-elt ;

\ Client certificate: start processing of anchor names.
cc: anchor-dn-start-name-list ( -- ) {
	if (CTX->client_auth_vtable != NULL) {
		(*CTX->client_auth_vtable)->start_name_list(
			CTX->client_auth_vtable);
	}
}

\ Client certificate: start a new anchor DN (length is 16-bit).
cc: anchor-dn-start-name ( length -- ) {
	size_t len;

	len = T0_POP();
	if (CTX->client_auth_vtable != NULL) {
		(*CTX->client_auth_vtable)->start_name(
			CTX->client_auth_vtable, len);
	}
}

\ Client certificate: push some data for current anchor DN.
cc: anchor-dn-append-name ( length -- ) {
	size_t len;

	len = T0_POP();
	if (CTX->client_auth_vtable != NULL) {
		(*CTX->client_auth_vtable)->append_name(
			CTX->client_auth_vtable, ENG->pad, len);
	}
}

\ Client certificate: end current anchor DN.
cc: anchor-dn-end-name ( -- ) {
	if (CTX->client_auth_vtable != NULL) {
		(*CTX->client_auth_vtable)->end_name(
			CTX->client_auth_vtable);
	}
}

\ Client certificate: end list of anchor DN.
cc: anchor-dn-end-name-list ( -- ) {
	if (CTX->client_auth_vtable != NULL) {
		(*CTX->client_auth_vtable)->end_name_list(
			CTX->client_auth_vtable);
	}
}

\ Client certificate: obtain the client certificate chain.
cc: get-client-chain ( auth_types -- ) {
	uint32_t auth_types;

	auth_types = T0_POP();
	if (CTX->client_auth_vtable != NULL) {
		br_ssl_client_certificate ux;

		(*CTX->client_auth_vtable)->choose(CTX->client_auth_vtable,
			CTX, auth_types, &ux);
		CTX->auth_type = (unsigned char)ux.auth_type;
		CTX->hash_id = (unsigned char)ux.hash_id;
		ENG->chain = ux.chain;
		ENG->chain_len = ux.chain_len;
	} else {
		CTX->hash_id = 0;
		ENG->chain_len = 0;
	}
}

\ Parse CertificateRequest. Header has already been read.
: read-contents-CertificateRequest ( lim -- )
	\ Read supported client authentication types. We keep only
	\ RSA, ECDSA, and ECDH.
	0 { auth_types }
	read8 open-elt
	begin dup while
		read8 case
			1  of 0x0000FF endof
			64 of 0x00FF00 endof
			65 of 0x010000 endof
			66 of 0x020000 endof
			0 swap
		endcase
		auth_types or >auth_types
	repeat
	close-elt

	\ Full static ECDH is allowed only if the cipher suite is ECDH
	\ (not ECDHE). It would be theoretically feasible to use static
	\ ECDH on the client side with an ephemeral key pair from the
	\ server, but RFC 4492 (section 3) forbids it because ECDHE suites
	\ are supposed to provide forward secrecy, and static ECDH would
	\ negate that property.
	addr-cipher_suite get16 use-ecdh? ifnot
		auth_types 0xFFFF and >auth_types
	then

	\ Note: if the cipher suite is ECDH, then the X.509 validation
	\ engine was invoked with the BR_KEYTYPE_EC | BR_KEYTYPE_KEYX
	\ combination, so the server's public key has already been
	\ checked to be fit for a key exchange.

	\ With TLS 1.2:
	\  - rsa_fixed_ecdh and ecdsa_fixed_ecdh are synoymous.
	\  - There is an explicit list of supported sign+hash.
	\ With TLS 1.0,
	addr-version get16 0x0303 >= if
		\ With TLS 1.2:
		\  - There is an explicit list of supported sign+hash.
		\  - The ECDH flags must be adjusted for RSA/ECDSA
		\    support.
		read-list-sign-algos dup addr-hashes set32

		\ Trim down the list depending on what hash functions
		\ we support (since the hashing itself is done by the SSL
		\ engine, not by the certificate handler).
		supported-hash-functions drop dup 8 << or 0x030000 or and

		auth_types and
		auth_types 0x030000 and if
			dup 0x0000FF and if 0x010000 or then
			dup 0x00FF00 and if 0x020000 or then
		then
		>auth_types
	else
		\ TLS 1.0 or 1.1. The hash function is fixed for signatures
		\ (MD5+SHA-1 for RSA, SHA-1 for ECDSA).
		auth_types 0x030401 and >auth_types
	then

	\ Parse list of anchor DN.
	anchor-dn-start-name-list
	read16 open-elt
	begin dup while
		read16 open-elt
		dup anchor-dn-start-name

		\ We read the DN by chunks through the pad, so
		\ as to use the existing reading function (read-blob)
		\ that also ensures proper hashing.
		begin
			dup while
			dup 256 > if 256 else dup then { len }
			addr-pad len read-blob
			len anchor-dn-append-name
		repeat
		close-elt
		anchor-dn-end-name
	repeat
	close-elt
	anchor-dn-end-name-list

	\ We should have reached the message end.
	close-elt

	\ Obtain the client chain.
	auth_types get-client-chain
	;

\ (obsolete)
\ Write an empty Certificate message.
\ : write-empty-Certificate ( -- )
\ 	11 write8 3 write24 0 write24 ;

cc: do-rsa-encrypt ( prf_id -- nlen ) {
	int x;

	x = make_pms_rsa(CTX, T0_POP());
	if (x < 0) {
		br_ssl_engine_fail(ENG, -x);
		T0_CO();
	} else {
		T0_PUSH(x);
	}
}

cc: do-ecdh ( echde prf_id -- ulen ) {
	unsigned prf_id = T0_POP();
	unsigned ecdhe = T0_POP();
	int x;

	x = make_pms_ecdh(CTX, ecdhe, prf_id);
	if (x < 0) {
		br_ssl_engine_fail(ENG, -x);
		T0_CO();
	} else {
		T0_PUSH(x);
	}
}

cc: do-static-ecdh ( prf-id -- ) {
	unsigned prf_id = T0_POP();

	if (make_pms_static_ecdh(CTX, prf_id) < 0) {
		br_ssl_engine_fail(ENG, BR_ERR_INVALID_ALGORITHM);
		T0_CO();
	}
}

cc: do-client-sign ( -- sig_len ) {
	size_t sig_len;

	sig_len = make_client_sign(CTX);
	if (sig_len == 0) {
		br_ssl_engine_fail(ENG, BR_ERR_INVALID_ALGORITHM);
		T0_CO();
	}
	T0_PUSH(sig_len);
}

\ Write ClientKeyExchange.
: write-ClientKeyExchange ( -- )
	16 write8
	addr-cipher_suite get16
	dup use-rsa-keyx? if
		prf-id do-rsa-encrypt
		dup 2+ write24
		dup write16
		addr-pad swap write-blob
	else
		dup use-ecdhe? swap prf-id do-ecdh
		dup 1+ write24
		dup write8
		addr-pad swap write-blob
	then ;

\ Write CertificateVerify. This is invoked only if a client certificate
\ was requested and sent, and the authentication is not full static ECDH.
: write-CertificateVerify ( -- )
	do-client-sign
	15 write8 dup
	addr-version get16 0x0303 >= if
		4 + write24
		addr-hash_id get8 write8
		addr-auth_type get8 write8
	else
		2+ write24
	then
	dup write16 addr-pad swap write-blob ;

\ =======================================================================

\ Perform a handshake.
: do-handshake ( -- )
	0 addr-application_data set8
	22 addr-record_type_out set8
	0 addr-selected_protocol set16
	multihash-init

	write-ClientHello
	flush-record
	read-ServerHello

	if
		\ Session resumption.
		-1 read-CCS-Finished
		-1 write-CCS-Finished

	else

		\ Not a session resumption.

		\ Read certificate; then check key type and usages against
		\ cipher suite.
		read-Certificate-from-server

		\ Depending on cipher suite, we may now expect a
		\ ServerKeyExchange.
		addr-cipher_suite get16 expected-key-type
		CX 0 63 { BR_KEYTYPE_SIGN } and if
			read-ServerKeyExchange
		then

		\ Get next header.
		read-handshake-header

		\ If this is a CertificateRequest, parse it, then read
		\ next header.
		dup 13 = if
			drop read-contents-CertificateRequest
			read-handshake-header
			-1
		else
			0
		then
		{ seen-CR }

		\ At that point, we should have a ServerHelloDone,
		\ whose length must be 0.
		14 = ifnot ERR_UNEXPECTED fail then
		if ERR_BAD_HELLO_DONE fail then

		\ There should not be more bytes in the record at that point.
		more-incoming-bytes? if ERR_UNEXPECTED fail then

		seen-CR if
			\ If the server requested a client certificate, then
			\ we must write a Certificate message (it may be
			\ empty).
			write-Certificate

			\ If using static ECDH, then the ClientKeyExchange
			\ is empty, and there is no CertificateVerify.
			\ Otherwise, there is a ClientKeyExchange; there
			\ will then be a CertificateVerify if a client chain
			\ was indeed sent.
			addr-hash_id get8 0xFF = if
				drop
				16 write8 0 write24
				addr-cipher_suite get16 prf-id do-static-ecdh
			else
				write-ClientKeyExchange
				if write-CertificateVerify then
			then
		else
			write-ClientKeyExchange
		then

		-1 write-CCS-Finished
		-1 read-CCS-Finished
	then

	\ Now we should be invoked only in case of renegotiation.
	1 addr-application_data set8
	23 addr-record_type_out set8 ;

\ Read a HelloRequest message.
: read-HelloRequest ( -- )
	\ A HelloRequest has length 0 and type 0.
	read-handshake-header-core
	if ERR_UNEXPECTED fail then
	if ERR_BAD_HANDSHAKE fail then ;

\ Entry point.
: main ( -- ! )
	\ Perform initial handshake.
	do-handshake

	begin
		\ Wait for further invocation. At that point, we should
		\ get either an explicit call for renegotiation, or
		\ an incoming HelloRequest handshake message.
		wait-co
		dup 0x07 and case
			0x00 of
				0x10 and if
					do-handshake
				then
			endof
			0x01 of
				drop
				0 addr-application_data set8
				read-HelloRequest
				\ Reject renegotiations if the peer does not
				\ support secure renegotiation, or if the
				\ "no renegotiation" flag is set.
				addr-reneg get8 1 = 1 flag? or if
					flush-record
					begin can-output? not while
						wait-co drop
					repeat
					100 send-warning
					\ We rejected the renegotiation,
					\ but the connection is not dead.
					\ We must set back things into
					\ working "application data" state.
					1 addr-application_data set8
					23 addr-record_type_out set8
				else
					do-handshake
				then
			endof
			ERR_UNEXPECTED fail
		endcase
	again
	;