blob: dfae8c5a18d30a5a9ba7ca53a20c8d381d7228da [file] [log] [blame]
Paul Bakker5121ce52009-01-03 21:22:43 +00001/*
2 * SSLv3/TLSv1 server-side functions
3 *
Paul Bakker68884e32013-01-07 18:20:04 +01004 * Copyright (C) 2006-2013, Brainspark B.V.
Paul Bakkerb96f1542010-07-18 20:36:00 +00005 *
6 * This file is part of PolarSSL (http://www.polarssl.org)
Paul Bakker84f12b72010-07-18 10:13:04 +00007 * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
Paul Bakkerb96f1542010-07-18 20:36:00 +00008 *
Paul Bakker77b385e2009-07-28 17:23:11 +00009 * All rights reserved.
Paul Bakkere0ccd0a2009-01-04 16:27:10 +000010 *
Paul Bakker5121ce52009-01-03 21:22:43 +000011 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License along
22 * with this program; if not, write to the Free Software Foundation, Inc.,
23 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24 */
25
Paul Bakker40e46942009-01-03 21:51:57 +000026#include "polarssl/config.h"
Paul Bakker5121ce52009-01-03 21:22:43 +000027
Paul Bakker40e46942009-01-03 21:51:57 +000028#if defined(POLARSSL_SSL_SRV_C)
Paul Bakker5121ce52009-01-03 21:22:43 +000029
Paul Bakker40e46942009-01-03 21:51:57 +000030#include "polarssl/debug.h"
31#include "polarssl/ssl.h"
Paul Bakker41c83d32013-03-20 14:39:14 +010032#if defined(POLARSSL_ECP_C)
33#include "polarssl/ecp.h"
34#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000035
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020036#if defined(POLARSSL_MEMORY_C)
37#include "polarssl/memory.h"
38#else
39#define polarssl_malloc malloc
40#define polarssl_free free
41#endif
42
Paul Bakker5121ce52009-01-03 21:22:43 +000043#include <stdlib.h>
44#include <stdio.h>
Paul Bakkerfa9b1002013-07-03 15:31:03 +020045
46#if defined(POLARSSL_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +000047#include <time.h>
Paul Bakkerfa9b1002013-07-03 15:31:03 +020048#endif
Paul Bakker5121ce52009-01-03 21:22:43 +000049
Paul Bakkera503a632013-08-14 13:48:06 +020050#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020051/*
52 * Serialize a session in the following format:
53 * 0 . n-1 session structure, n = sizeof(ssl_session)
54 * n . n+2 peer_cert length = m (0 if no certificate)
55 * n+3 . n+2+m peer cert ASN.1
56 *
57 * Assumes ticket is NULL (always true on server side).
58 */
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020059static int ssl_save_session( const ssl_session *session,
60 unsigned char *buf, size_t buf_len,
61 size_t *olen )
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020062{
63 unsigned char *p = buf;
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020064 size_t left = buf_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020065#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020066 size_t cert_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020067#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020068
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020069 if( left < sizeof( ssl_session ) )
70 return( -1 );
71
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020072 memcpy( p, session, sizeof( ssl_session ) );
73 p += sizeof( ssl_session );
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020074 left -= sizeof( ssl_session );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020075
Paul Bakker7c6b2c32013-09-16 13:49:26 +020076#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020077 if( session->peer_cert == NULL )
78 cert_len = 0;
79 else
80 cert_len = session->peer_cert->raw.len;
81
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020082 if( left < 3 + cert_len )
83 return( -1 );
84
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020085 *p++ = (unsigned char)( cert_len >> 16 & 0xFF );
86 *p++ = (unsigned char)( cert_len >> 8 & 0xFF );
87 *p++ = (unsigned char)( cert_len & 0xFF );
88
89 if( session->peer_cert != NULL )
90 memcpy( p, session->peer_cert->raw.p, cert_len );
91
92 p += cert_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +020093#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020094
95 *olen = p - buf;
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +020096
97 return( 0 );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +020098}
99
100/*
101 * Unserialise session, see ssl_save_session()
102 */
103static int ssl_load_session( ssl_session *session,
104 const unsigned char *buf, size_t len )
105{
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200106 const unsigned char *p = buf;
107 const unsigned char * const end = buf + len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200108#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200109 size_t cert_len;
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200110#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200111
112 if( p + sizeof( ssl_session ) > end )
113 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
114
115 memcpy( session, p, sizeof( ssl_session ) );
116 p += sizeof( ssl_session );
117
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200118#if defined(POLARSSL_X509_CRT_PARSE_C)
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200119 if( p + 3 > end )
120 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
121
122 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
123 p += 3;
124
125 if( cert_len == 0 )
126 {
127 session->peer_cert = NULL;
128 }
129 else
130 {
Paul Bakker2292d1f2013-09-15 17:06:49 +0200131 int ret;
132
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200133 if( p + cert_len > end )
134 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
135
Paul Bakkerc559c7a2013-09-18 14:13:26 +0200136 session->peer_cert = polarssl_malloc( sizeof( x509_crt ) );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200137
138 if( session->peer_cert == NULL )
139 return( POLARSSL_ERR_SSL_MALLOC_FAILED );
140
Paul Bakkerb6b09562013-09-18 14:17:41 +0200141 x509_crt_init( session->peer_cert );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200142
Paul Bakkerddf26b42013-09-18 13:46:23 +0200143 if( ( ret = x509_crt_parse( session->peer_cert, p, cert_len ) ) != 0 )
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200144 {
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200145 x509_crt_free( session->peer_cert );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200146 polarssl_free( session->peer_cert );
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200147 session->peer_cert = NULL;
148 return( ret );
149 }
150
151 p += cert_len;
152 }
Paul Bakker7c6b2c32013-09-16 13:49:26 +0200153#endif /* POLARSSL_X509_CRT_PARSE_C */
Manuel Pégourié-Gonnard94f6a792013-08-01 14:33:49 +0200154
155 if( p != end )
156 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
157
158 return( 0 );
159}
160
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200161/*
162 * Create session ticket, secured as recommended in RFC 5077 section 4:
163 *
164 * struct {
165 * opaque key_name[16];
166 * opaque iv[16];
167 * opaque encrypted_state<0..2^16-1>;
168 * opaque mac[32];
169 * } ticket;
170 *
171 * (the internal state structure differs, however).
172 */
173static int ssl_write_ticket( ssl_context *ssl, size_t *tlen )
174{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200175 int ret;
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200176 unsigned char * const start = ssl->out_msg + 10;
177 unsigned char *p = start;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200178 unsigned char *state;
179 unsigned char iv[16];
180 size_t clear_len, enc_len, pad_len, i;
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200181
Manuel Pégourié-Gonnard0a201712013-08-23 16:25:16 +0200182 *tlen = 0;
183
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +0200184 if( ssl->ticket_keys == NULL )
185 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
186
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200187 /* Write key name */
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +0200188 memcpy( p, ssl->ticket_keys->key_name, 16 );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200189 p += 16;
190
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200191 /* Generate and write IV (with a copy for aes_crypt) */
192 if( ( ret = ssl->f_rng( ssl->p_rng, p, 16 ) ) != 0 )
193 return( ret );
194 memcpy( iv, p, 16 );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200195 p += 16;
196
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +0200197 /*
198 * Dump session state
199 *
200 * After the session state itself, we still need room for 16 bytes of
201 * padding and 32 bytes of MAC, so there's only so much room left
202 */
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200203 state = p + 2;
Manuel Pégourié-Gonnardc6554aa2013-08-23 11:10:28 +0200204 if( ssl_save_session( ssl->session_negotiate, state,
205 SSL_MAX_CONTENT_LEN - (state - ssl->out_ctr) - 48,
206 &clear_len ) != 0 )
207 {
208 return( POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE );
209 }
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200210 SSL_DEBUG_BUF( 3, "session ticket cleartext", state, clear_len );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200211
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200212 /* Apply PKCS padding */
213 pad_len = 16 - clear_len % 16;
214 enc_len = clear_len + pad_len;
215 for( i = clear_len; i < enc_len; i++ )
216 state[i] = (unsigned char) pad_len;
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200217
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200218 /* Encrypt */
219 if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->enc, AES_ENCRYPT,
220 enc_len, iv, state, state ) ) != 0 )
221 {
222 return( ret );
223 }
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200224
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200225 /* Write length */
226 *p++ = (unsigned char)( ( enc_len >> 8 ) & 0xFF );
227 *p++ = (unsigned char)( ( enc_len ) & 0xFF );
228 p = state + enc_len;
229
Manuel Pégourié-Gonnard56dc9e82013-08-03 17:16:31 +0200230 /* Compute and write MAC( key_name + iv + enc_state_len + enc_state ) */
231 sha256_hmac( ssl->ticket_keys->mac_key, 16, start, p - start, p, 0 );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200232 p += 32;
233
234 *tlen = p - start;
235
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200236 SSL_DEBUG_BUF( 3, "session ticket structure", start, *tlen );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200237
238 return( 0 );
239}
240
241/*
242 * Load session ticket (see ssl_write_ticket for structure)
243 */
244static int ssl_parse_ticket( ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200245 unsigned char *buf,
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200246 size_t len )
247{
248 int ret;
249 ssl_session session;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200250 unsigned char *key_name = buf;
251 unsigned char *iv = buf + 16;
252 unsigned char *enc_len_p = iv + 16;
253 unsigned char *ticket = enc_len_p + 2;
254 unsigned char *mac;
Manuel Pégourié-Gonnard34ced2d2013-09-20 11:37:39 +0200255 unsigned char computed_mac[32];
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200256 size_t enc_len, clear_len, i;
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100257 unsigned char pad_len, diff;
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200258
259 SSL_DEBUG_BUF( 3, "session ticket structure", buf, len );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200260
Manuel Pégourié-Gonnard779e4292013-08-03 13:50:48 +0200261 if( len < 34 || ssl->ticket_keys == NULL )
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200262 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
263
264 enc_len = ( enc_len_p[0] << 8 ) | enc_len_p[1];
265 mac = ticket + enc_len;
266
267 if( len != enc_len + 66 )
268 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
269
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100270 /* Check name, in constant time though it's not a big secret */
271 diff = 0;
272 for( i = 0; i < 16; i++ )
273 diff |= key_name[i] ^ ssl->ticket_keys->key_name[i];
274 /* don't return yet, check the MAC anyway */
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200275
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100276 /* Check mac, with constant-time buffer comparison */
Manuel Pégourié-Gonnard56dc9e82013-08-03 17:16:31 +0200277 sha256_hmac( ssl->ticket_keys->mac_key, 16, buf, len - 32,
278 computed_mac, 0 );
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100279
Manuel Pégourié-Gonnard56dc9e82013-08-03 17:16:31 +0200280 for( i = 0; i < 32; i++ )
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100281 diff |= mac[i] ^ computed_mac[i];
282
283 /* Now return if ticket is not authentic, since we want to avoid
284 * decrypting arbitrary attacker-chosen data */
285 if( diff != 0 )
286 return( POLARSSL_ERR_SSL_INVALID_MAC );
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200287
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200288 /* Decrypt */
289 if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->dec, AES_DECRYPT,
290 enc_len, iv, ticket, ticket ) ) != 0 )
291 {
292 return( ret );
293 }
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200294
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200295 /* Check PKCS padding */
296 pad_len = ticket[enc_len - 1];
297
298 ret = 0;
299 for( i = 2; i < pad_len; i++ )
300 if( ticket[enc_len - i] != pad_len )
301 ret = POLARSSL_ERR_SSL_BAD_INPUT_DATA;
302 if( ret != 0 )
303 return( ret );
304
305 clear_len = enc_len - pad_len;
306
307 SSL_DEBUG_BUF( 3, "session ticket cleartext", ticket, clear_len );
308
309 /* Actually load session */
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200310 if( ( ret = ssl_load_session( &session, ticket, clear_len ) ) != 0 )
311 {
312 SSL_DEBUG_MSG( 1, ( "failed to parse ticket content" ) );
313 memset( &session, 0, sizeof( ssl_session ) );
314 return( ret );
315 }
316
Paul Bakker606b4ba2013-08-14 16:52:14 +0200317#if defined(POLARSSL_HAVE_TIME)
318 /* Check if still valid */
319 if( (int) ( time( NULL) - session.start ) > ssl->ticket_lifetime )
320 {
321 SSL_DEBUG_MSG( 1, ( "session ticket expired" ) );
322 memset( &session, 0, sizeof( ssl_session ) );
323 return( POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED );
324 }
325#endif
326
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200327 /*
328 * Keep the session ID sent by the client, since we MUST send it back to
329 * inform him we're accepting the ticket (RFC 5077 section 3.4)
330 */
331 session.length = ssl->session_negotiate->length;
332 memcpy( &session.id, ssl->session_negotiate->id, session.length );
333
334 ssl_session_free( ssl->session_negotiate );
335 memcpy( ssl->session_negotiate, &session, sizeof( ssl_session ) );
336 memset( &session, 0, sizeof( ssl_session ) );
337
338 return( 0 );
339}
Paul Bakkera503a632013-08-14 13:48:06 +0200340#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200341
Paul Bakker0be444a2013-08-27 21:55:01 +0200342#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200343/*
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +0200344 * Wrapper around f_sni, allowing use of ssl_set_own_cert() but
345 * making it act on ssl->hanshake->sni_key_cert instead.
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200346 */
347static int ssl_sni_wrapper( ssl_context *ssl,
348 const unsigned char* name, size_t len )
349{
350 int ret;
351 ssl_key_cert *key_cert_ori = ssl->key_cert;
352
353 ssl->key_cert = NULL;
354 ret = ssl->f_sni( ssl->p_sni, ssl, name, len );
Manuel Pégourié-Gonnard83724542013-09-24 22:30:56 +0200355 ssl->handshake->sni_key_cert = ssl->key_cert;
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200356
357 ssl->key_cert = key_cert_ori;
358
359 return( ret );
360}
361
Paul Bakker5701cdc2012-09-27 21:49:42 +0000362static int ssl_parse_servername_ext( ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000363 const unsigned char *buf,
Paul Bakker5701cdc2012-09-27 21:49:42 +0000364 size_t len )
365{
366 int ret;
367 size_t servername_list_size, hostname_len;
Paul Bakker23f36802012-09-28 14:15:14 +0000368 const unsigned char *p;
Paul Bakker5701cdc2012-09-27 21:49:42 +0000369
370 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
371 if( servername_list_size + 2 != len )
372 {
373 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
374 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
375 }
376
377 p = buf + 2;
378 while( servername_list_size > 0 )
379 {
380 hostname_len = ( ( p[1] << 8 ) | p[2] );
381 if( hostname_len + 3 > servername_list_size )
382 {
383 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
384 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
385 }
386
387 if( p[0] == TLS_EXT_SERVERNAME_HOSTNAME )
388 {
Manuel Pégourié-Gonnard705fcca2013-09-23 20:04:20 +0200389 ret = ssl_sni_wrapper( ssl, p + 3, hostname_len );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000390 if( ret != 0 )
391 {
392 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
393 SSL_ALERT_MSG_UNRECOGNIZED_NAME );
394 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
395 }
Paul Bakker81420ab2012-10-23 10:31:15 +0000396 return( 0 );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000397 }
398
399 servername_list_size -= hostname_len + 3;
Paul Bakker23f36802012-09-28 14:15:14 +0000400 p += hostname_len + 3;
401 }
402
403 if( servername_list_size != 0 )
404 {
405 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
406 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
Paul Bakker5701cdc2012-09-27 21:49:42 +0000407 }
408
409 return( 0 );
410}
Paul Bakker0be444a2013-08-27 21:55:01 +0200411#endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +0000412
Paul Bakker48916f92012-09-16 19:57:18 +0000413static int ssl_parse_renegotiation_info( ssl_context *ssl,
Paul Bakker23f36802012-09-28 14:15:14 +0000414 const unsigned char *buf,
Paul Bakker48916f92012-09-16 19:57:18 +0000415 size_t len )
416{
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000417 int ret;
418
Paul Bakker48916f92012-09-16 19:57:18 +0000419 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
420 {
421 if( len != 1 || buf[0] != 0x0 )
422 {
423 SSL_DEBUG_MSG( 1, ( "non-zero length renegotiated connection field" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000424
425 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
426 return( ret );
427
Paul Bakker48916f92012-09-16 19:57:18 +0000428 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
429 }
430
431 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
432 }
433 else
434 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100435 /* Check verify-data in constant-time. The length OTOH is no secret */
Paul Bakker48916f92012-09-16 19:57:18 +0000436 if( len != 1 + ssl->verify_data_len ||
437 buf[0] != ssl->verify_data_len ||
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +0100438 safer_memcmp( buf + 1, ssl->peer_verify_data,
439 ssl->verify_data_len ) != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +0000440 {
441 SSL_DEBUG_MSG( 1, ( "non-matching renegotiated connection field" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +0000442
443 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
444 return( ret );
445
Paul Bakker48916f92012-09-16 19:57:18 +0000446 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
447 }
448 }
449
450 return( 0 );
451}
452
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200453#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker23f36802012-09-28 14:15:14 +0000454static int ssl_parse_signature_algorithms_ext( ssl_context *ssl,
455 const unsigned char *buf,
456 size_t len )
457{
458 size_t sig_alg_list_size;
459 const unsigned char *p;
460
461 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
462 if( sig_alg_list_size + 2 != len ||
463 sig_alg_list_size %2 != 0 )
464 {
465 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
466 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
467 }
468
469 p = buf + 2;
470 while( sig_alg_list_size > 0 )
471 {
Manuel Pégourié-Gonnardd11eb7c2013-08-22 15:57:15 +0200472 /*
473 * For now, just ignore signature algorithm and rely on offered
474 * ciphersuites only. To be fixed later.
475 */
Paul Bakker9e36f042013-06-30 14:34:05 +0200476#if defined(POLARSSL_SHA512_C)
Paul Bakker23f36802012-09-28 14:15:14 +0000477 if( p[0] == SSL_HASH_SHA512 )
478 {
479 ssl->handshake->sig_alg = SSL_HASH_SHA512;
480 break;
481 }
482 if( p[0] == SSL_HASH_SHA384 )
483 {
484 ssl->handshake->sig_alg = SSL_HASH_SHA384;
485 break;
486 }
487#endif
Paul Bakker9e36f042013-06-30 14:34:05 +0200488#if defined(POLARSSL_SHA256_C)
Paul Bakker23f36802012-09-28 14:15:14 +0000489 if( p[0] == SSL_HASH_SHA256 )
490 {
491 ssl->handshake->sig_alg = SSL_HASH_SHA256;
492 break;
493 }
494 if( p[0] == SSL_HASH_SHA224 )
495 {
496 ssl->handshake->sig_alg = SSL_HASH_SHA224;
497 break;
498 }
499#endif
500 if( p[0] == SSL_HASH_SHA1 )
501 {
502 ssl->handshake->sig_alg = SSL_HASH_SHA1;
503 break;
504 }
505 if( p[0] == SSL_HASH_MD5 )
506 {
507 ssl->handshake->sig_alg = SSL_HASH_MD5;
508 break;
509 }
510
511 sig_alg_list_size -= 2;
512 p += 2;
513 }
514
515 SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
516 ssl->handshake->sig_alg ) );
517
518 return( 0 );
519}
Paul Bakkerd2f068e2013-08-27 21:19:20 +0200520#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker23f36802012-09-28 14:15:14 +0000521
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +0200522#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200523static int ssl_parse_supported_elliptic_curves( ssl_context *ssl,
524 const unsigned char *buf,
525 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100526{
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200527 size_t list_size, our_size;
Paul Bakker41c83d32013-03-20 14:39:14 +0100528 const unsigned char *p;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200529 const ecp_curve_info *curve_info, **curves;
Paul Bakker41c83d32013-03-20 14:39:14 +0100530
531 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
532 if( list_size + 2 != len ||
533 list_size % 2 != 0 )
534 {
535 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
536 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
537 }
538
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200539 /* Don't allow our peer to make use allocated too much memory,
540 * and leave room for a final 0 */
541 our_size = list_size / 2 + 1;
542 if( our_size > POLARSSL_ECP_DP_MAX )
543 our_size = POLARSSL_ECP_DP_MAX;
544
545 if( ( curves = polarssl_malloc( our_size * sizeof( *curves ) ) ) == NULL )
546 return( POLARSSL_ERR_SSL_MALLOC_FAILED );
547
Paul Bakkerbeccd9f2013-10-11 15:20:27 +0200548 /* explicit void pointer cast for buggy MS compiler */
549 memset( (void *) curves, 0, our_size * sizeof( *curves ) );
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200550 ssl->handshake->curves = curves;
551
Paul Bakker41c83d32013-03-20 14:39:14 +0100552 p = buf + 2;
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200553 while( list_size > 0 && our_size > 1 )
Paul Bakker41c83d32013-03-20 14:39:14 +0100554 {
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200555 curve_info = ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +0200556
Manuel Pégourié-Gonnardf24b4a72013-09-23 18:14:50 +0200557 if( curve_info != NULL )
Paul Bakker41c83d32013-03-20 14:39:14 +0100558 {
Manuel Pégourié-Gonnardd09453c2013-09-23 19:11:32 +0200559 *curves++ = curve_info;
560 our_size--;
Paul Bakker41c83d32013-03-20 14:39:14 +0100561 }
562
563 list_size -= 2;
564 p += 2;
565 }
566
567 return( 0 );
568}
569
Paul Bakkerb6c5d2e2013-06-25 16:25:17 +0200570static int ssl_parse_supported_point_formats( ssl_context *ssl,
571 const unsigned char *buf,
572 size_t len )
Paul Bakker41c83d32013-03-20 14:39:14 +0100573{
574 size_t list_size;
575 const unsigned char *p;
576
577 list_size = buf[0];
578 if( list_size + 1 != len )
579 {
580 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
581 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
582 }
583
584 p = buf + 2;
585 while( list_size > 0 )
586 {
587 if( p[0] == POLARSSL_ECP_PF_UNCOMPRESSED ||
588 p[0] == POLARSSL_ECP_PF_COMPRESSED )
589 {
Manuel Pégourié-Gonnard5734b2d2013-08-15 19:04:02 +0200590 ssl->handshake->ecdh_ctx.point_format = p[0];
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +0200591 SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
Paul Bakker41c83d32013-03-20 14:39:14 +0100592 return( 0 );
593 }
594
595 list_size--;
596 p++;
597 }
598
599 return( 0 );
600}
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +0200601#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
Paul Bakker41c83d32013-03-20 14:39:14 +0100602
Paul Bakker05decb22013-08-15 13:33:48 +0200603#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200604static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
605 const unsigned char *buf,
606 size_t len )
607{
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200608 if( len != 1 || buf[0] >= SSL_MAX_FRAG_LEN_INVALID )
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200609 {
610 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
611 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
612 }
613
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +0200614 ssl->session_negotiate->mfl_code = buf[0];
615
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200616 return( 0 );
617}
Paul Bakker05decb22013-08-15 13:33:48 +0200618#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +0200619
Paul Bakker1f2bc622013-08-15 13:45:55 +0200620#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200621static int ssl_parse_truncated_hmac_ext( ssl_context *ssl,
622 const unsigned char *buf,
623 size_t len )
624{
625 if( len != 0 )
626 {
627 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
628 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
629 }
630
631 ((void) buf);
632
633 ssl->session_negotiate->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
634
635 return( 0 );
636}
Paul Bakker1f2bc622013-08-15 13:45:55 +0200637#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +0200638
Paul Bakkera503a632013-08-14 13:48:06 +0200639#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200640static int ssl_parse_session_ticket_ext( ssl_context *ssl,
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200641 unsigned char *buf,
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200642 size_t len )
643{
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200644 int ret;
645
Manuel Pégourié-Gonnardaa0d4d12013-08-03 13:02:31 +0200646 if( ssl->session_tickets == SSL_SESSION_TICKETS_DISABLED )
647 return( 0 );
648
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200649 /* Remember the client asked us to send a new ticket */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200650 ssl->handshake->new_session_ticket = 1;
651
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200652 SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
653
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200654 if( len == 0 )
655 return( 0 );
656
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +0200657 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
658 {
659 SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
660 return( 0 );
661 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200662
663 /*
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200664 * Failures are ok: just ignore the ticket and proceed.
665 */
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200666 if( ( ret = ssl_parse_ticket( ssl, buf, len ) ) != 0 )
667 {
668 SSL_DEBUG_RET( 1, "ssl_parse_ticket", ret );
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200669 return( 0 );
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +0200670 }
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200671
672 SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
673
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +0200674 ssl->handshake->resume = 1;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200675
Manuel Pégourié-Gonnard306827e2013-08-02 18:05:14 +0200676 /* Don't send a new ticket after all, this one is OK */
677 ssl->handshake->new_session_ticket = 0;
678
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200679 return( 0 );
680}
Paul Bakkera503a632013-08-14 13:48:06 +0200681#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +0200682
Manuel Pégourié-Gonnard32525602013-11-30 17:50:32 +0100683/*
684 * Auxiliary functions for ServerHello parsing and related actions
685 */
686
687#if defined(POLARSSL_X509_CRT_PARSE_C)
688/*
689 * Return 1 if the given EC key uses the given curve, 0 otherwise
690 */
691#if defined(POLARSSL_ECDSA_C)
692static int ssl_key_matches_curves( pk_context *pk,
693 const ecp_curve_info **curves )
694{
695 const ecp_curve_info **crv = curves;
696 ecp_group_id grp_id = pk_ec( *pk )->grp.id;
697
698 while( *crv != NULL )
699 {
700 if( (*crv)->grp_id == grp_id )
701 return( 1 );
702 crv++;
703 }
704
705 return( 0 );
706}
707#endif /* POLARSSL_ECDSA_C */
708
709/*
710 * Try picking a certificate for this ciphersuite,
711 * return 0 on success and -1 on failure.
712 */
713static int ssl_pick_cert( ssl_context *ssl,
714 const ssl_ciphersuite_t * ciphersuite_info )
715{
716 ssl_key_cert *cur, *list;
717 pk_type_t pk_alg = ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
718
719#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
720 if( ssl->handshake->sni_key_cert != NULL )
721 list = ssl->handshake->sni_key_cert;
722 else
723#endif
724 list = ssl->handshake->key_cert;
725
726 if( pk_alg == POLARSSL_PK_NONE )
727 return( 0 );
728
729 for( cur = list; cur != NULL; cur = cur->next )
730 {
731 if( ! pk_can_do( cur->key, pk_alg ) )
732 continue;
733
734#if defined(POLARSSL_ECDSA_C)
735 if( pk_alg == POLARSSL_PK_ECDSA )
736 {
737 if( ssl_key_matches_curves( cur->key, ssl->handshake->curves ) )
738 break;
739 }
740 else
741#endif
742 break;
743 }
744
745 if( cur == NULL )
746 return( -1 );
747
748 ssl->handshake->key_cert = cur;
749 return( 0 );
750}
751#endif /* POLARSSL_X509_CRT_PARSE_C */
752
753/*
754 * Check if a given ciphersuite is suitable for use with our config/keys/etc
755 * Sets ciphersuite_info only if the suite matches.
756 */
757static int ssl_ciphersuite_match( ssl_context *ssl, int suite_id,
758 const ssl_ciphersuite_t **ciphersuite_info )
759{
760 const ssl_ciphersuite_t *suite_info;
761
762 suite_info = ssl_ciphersuite_from_id( suite_id );
763 if( suite_info == NULL )
764 {
765 SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", suite_id ) );
766 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
767 }
768
769 if( suite_info->min_minor_ver > ssl->minor_ver ||
770 suite_info->max_minor_ver < ssl->minor_ver )
771 return( 0 );
772
773#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
774 if( ssl_ciphersuite_uses_ec( suite_info ) &&
775 ( ssl->handshake->curves == NULL ||
776 ssl->handshake->curves[0] == NULL ) )
777 return( 0 );
778#endif
779
780#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
781 /* If the ciphersuite requires a pre-shared key and we don't
782 * have one, skip it now rather than failing later */
783 if( ssl_ciphersuite_uses_psk( suite_info ) &&
784 ssl->f_psk == NULL &&
785 ( ssl->psk == NULL || ssl->psk_identity == NULL ||
786 ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
787 return( 0 );
788#endif
789
790#if defined(POLARSSL_X509_CRT_PARSE_C)
791 /*
792 * Final check: if ciphersuite requires us to have a
793 * certificate/key of a particular type:
794 * - select the appropriate certificate if we have one, or
795 * - try the next ciphersuite if we don't
796 * This must be done last since we modify the key_cert list.
797 */
798 if( ssl_pick_cert( ssl, suite_info ) != 0 )
799 return( 0 );
800#endif
801
802 *ciphersuite_info = suite_info;
803 return( 0 );
804}
805
Paul Bakker78a8c712013-03-06 17:01:52 +0100806#if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
807static int ssl_parse_client_hello_v2( ssl_context *ssl )
808{
809 int ret;
810 unsigned int i, j;
811 size_t n;
812 unsigned int ciph_len, sess_len, chal_len;
813 unsigned char *buf, *p;
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200814 const int *ciphersuites;
Paul Bakker59c28a22013-06-29 15:33:42 +0200815 const ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker78a8c712013-03-06 17:01:52 +0100816
817 SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
818
819 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
820 {
821 SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
822
823 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
824 return( ret );
825
826 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
827 }
828
829 buf = ssl->in_hdr;
830
831 SSL_DEBUG_BUF( 4, "record header", buf, 5 );
832
833 SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
834 buf[2] ) );
835 SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
836 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
837 SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
838 buf[3], buf[4] ) );
839
840 /*
841 * SSLv2 Client Hello
842 *
843 * Record layer:
844 * 0 . 1 message length
845 *
846 * SSL layer:
847 * 2 . 2 message type
848 * 3 . 4 protocol version
849 */
850 if( buf[2] != SSL_HS_CLIENT_HELLO ||
851 buf[3] != SSL_MAJOR_VERSION_3 )
852 {
853 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
854 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
855 }
856
857 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
858
859 if( n < 17 || n > 512 )
860 {
861 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
862 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
863 }
864
865 ssl->major_ver = SSL_MAJOR_VERSION_3;
Paul Bakker2fbefde2013-06-29 16:01:15 +0200866 ssl->minor_ver = ( buf[4] <= ssl->max_minor_ver )
867 ? buf[4] : ssl->max_minor_ver;
Paul Bakker78a8c712013-03-06 17:01:52 +0100868
869 if( ssl->minor_ver < ssl->min_minor_ver )
870 {
871 SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
872 " [%d:%d] < [%d:%d]", ssl->major_ver, ssl->minor_ver,
873 ssl->min_major_ver, ssl->min_minor_ver ) );
874
875 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
876 SSL_ALERT_MSG_PROTOCOL_VERSION );
877 return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
878 }
879
Paul Bakker2fbefde2013-06-29 16:01:15 +0200880 ssl->handshake->max_major_ver = buf[3];
881 ssl->handshake->max_minor_ver = buf[4];
Paul Bakker78a8c712013-03-06 17:01:52 +0100882
883 if( ( ret = ssl_fetch_input( ssl, 2 + n ) ) != 0 )
884 {
885 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
886 return( ret );
887 }
888
889 ssl->handshake->update_checksum( ssl, buf + 2, n );
890
891 buf = ssl->in_msg;
892 n = ssl->in_left - 5;
893
894 /*
895 * 0 . 1 ciphersuitelist length
896 * 2 . 3 session id length
897 * 4 . 5 challenge length
898 * 6 . .. ciphersuitelist
899 * .. . .. session id
900 * .. . .. challenge
901 */
902 SSL_DEBUG_BUF( 4, "record contents", buf, n );
903
904 ciph_len = ( buf[0] << 8 ) | buf[1];
905 sess_len = ( buf[2] << 8 ) | buf[3];
906 chal_len = ( buf[4] << 8 ) | buf[5];
907
908 SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
909 ciph_len, sess_len, chal_len ) );
910
911 /*
912 * Make sure each parameter length is valid
913 */
914 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
915 {
916 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
917 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
918 }
919
920 if( sess_len > 32 )
921 {
922 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
923 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
924 }
925
926 if( chal_len < 8 || chal_len > 32 )
927 {
928 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
929 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
930 }
931
932 if( n != 6 + ciph_len + sess_len + chal_len )
933 {
934 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
935 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
936 }
937
938 SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
939 buf + 6, ciph_len );
940 SSL_DEBUG_BUF( 3, "client hello, session id",
941 buf + 6 + ciph_len, sess_len );
942 SSL_DEBUG_BUF( 3, "client hello, challenge",
943 buf + 6 + ciph_len + sess_len, chal_len );
944
945 p = buf + 6 + ciph_len;
946 ssl->session_negotiate->length = sess_len;
947 memset( ssl->session_negotiate->id, 0, sizeof( ssl->session_negotiate->id ) );
948 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->length );
949
950 p += sess_len;
951 memset( ssl->handshake->randbytes, 0, 64 );
952 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
953
954 /*
955 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
956 */
957 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
958 {
959 if( p[0] == 0 && p[1] == 0 && p[2] == SSL_EMPTY_RENEGOTIATION_INFO )
960 {
961 SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
962 if( ssl->renegotiation == SSL_RENEGOTIATION )
963 {
964 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
965
966 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
967 return( ret );
968
969 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
970 }
971 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
972 break;
973 }
974 }
975
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200976 ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100977 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100978#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
979 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
980 {
981 for( i = 0; ciphersuites[i] != 0; i++ )
982#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +0200983 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker78a8c712013-03-06 17:01:52 +0100984 {
985 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +0100986#endif
Paul Bakker78a8c712013-03-06 17:01:52 +0100987 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100988 if( p[0] != 0 ||
989 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
990 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
991 continue;
Paul Bakker59c28a22013-06-29 15:33:42 +0200992
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100993 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
994 &ciphersuite_info ) ) != 0 )
995 return( ret );
Paul Bakker59c28a22013-06-29 15:33:42 +0200996
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +0100997 if( ciphersuite_info != NULL )
Paul Bakker78a8c712013-03-06 17:01:52 +0100998 goto have_ciphersuite_v2;
999 }
1000 }
1001
1002 SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1003
1004 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
1005
1006have_ciphersuite_v2:
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001007 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker59c28a22013-06-29 15:33:42 +02001008 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
Paul Bakker41c83d32013-03-20 14:39:14 +01001009 ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
Paul Bakker78a8c712013-03-06 17:01:52 +01001010
1011 /*
1012 * SSLv2 Client Hello relevant renegotiation security checks
1013 */
1014 if( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1015 ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
1016 {
1017 SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1018
1019 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1020 return( ret );
1021
1022 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1023 }
1024
1025 ssl->in_left = 0;
1026 ssl->state++;
1027
1028 SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
1029
1030 return( 0 );
1031}
1032#endif /* POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
1033
Paul Bakker5121ce52009-01-03 21:22:43 +00001034static int ssl_parse_client_hello( ssl_context *ssl )
1035{
Paul Bakker23986e52011-04-24 08:57:21 +00001036 int ret;
1037 unsigned int i, j;
1038 size_t n;
1039 unsigned int ciph_len, sess_len;
Paul Bakkerec636f32012-09-09 19:17:02 +00001040 unsigned int comp_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001041 unsigned int ext_len = 0;
1042 unsigned char *buf, *p, *ext;
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001043 int renegotiation_info_seen = 0;
1044 int handshake_failure = 0;
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001045 const int *ciphersuites;
Paul Bakker41c83d32013-03-20 14:39:14 +01001046 const ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00001047
1048 SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
1049
Paul Bakker48916f92012-09-16 19:57:18 +00001050 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
1051 ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001052 {
1053 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1054 return( ret );
1055 }
1056
1057 buf = ssl->in_hdr;
1058
Paul Bakker78a8c712013-03-06 17:01:52 +01001059#if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1060 if( ( buf[0] & 0x80 ) != 0 )
1061 return ssl_parse_client_hello_v2( ssl );
1062#endif
1063
Paul Bakkerec636f32012-09-09 19:17:02 +00001064 SSL_DEBUG_BUF( 4, "record header", buf, 5 );
1065
1066 SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
1067 buf[0] ) );
1068 SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
1069 ( buf[3] << 8 ) | buf[4] ) );
1070 SSL_DEBUG_MSG( 3, ( "client hello v3, protocol ver: [%d:%d]",
1071 buf[1], buf[2] ) );
1072
1073 /*
1074 * SSLv3 Client Hello
1075 *
1076 * Record layer:
1077 * 0 . 0 message type
1078 * 1 . 2 protocol version
1079 * 3 . 4 message length
1080 */
1081 if( buf[0] != SSL_MSG_HANDSHAKE ||
1082 buf[1] != SSL_MAJOR_VERSION_3 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001083 {
Paul Bakkerec636f32012-09-09 19:17:02 +00001084 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1085 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1086 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001087
Paul Bakkerec636f32012-09-09 19:17:02 +00001088 n = ( buf[3] << 8 ) | buf[4];
Paul Bakker5121ce52009-01-03 21:22:43 +00001089
Manuel Pégourié-Gonnard72882b22013-08-02 13:36:00 +02001090 if( n < 45 || n > 2048 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001091 {
1092 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1093 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1094 }
1095
Paul Bakker48916f92012-09-16 19:57:18 +00001096 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
1097 ( ret = ssl_fetch_input( ssl, 5 + n ) ) != 0 )
Paul Bakkerec636f32012-09-09 19:17:02 +00001098 {
1099 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1100 return( ret );
1101 }
1102
1103 buf = ssl->in_msg;
Paul Bakker48916f92012-09-16 19:57:18 +00001104 if( !ssl->renegotiation )
1105 n = ssl->in_left - 5;
1106 else
1107 n = ssl->in_msglen;
Paul Bakkerec636f32012-09-09 19:17:02 +00001108
Paul Bakker48916f92012-09-16 19:57:18 +00001109 ssl->handshake->update_checksum( ssl, buf, n );
Paul Bakkerec636f32012-09-09 19:17:02 +00001110
1111 /*
1112 * SSL layer:
1113 * 0 . 0 handshake type
1114 * 1 . 3 handshake length
1115 * 4 . 5 protocol version
1116 * 6 . 9 UNIX time()
1117 * 10 . 37 random bytes
1118 * 38 . 38 session id length
1119 * 39 . 38+x session id
1120 * 39+x . 40+x ciphersuitelist length
1121 * 41+x . .. ciphersuitelist
1122 * .. . .. compression alg.
1123 * .. . .. extensions
1124 */
1125 SSL_DEBUG_BUF( 4, "record contents", buf, n );
1126
1127 SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d",
1128 buf[0] ) );
1129 SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
1130 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1131 SSL_DEBUG_MSG( 3, ( "client hello v3, max. version: [%d:%d]",
1132 buf[4], buf[5] ) );
1133
1134 /*
1135 * Check the handshake type and protocol version
1136 */
1137 if( buf[0] != SSL_HS_CLIENT_HELLO ||
1138 buf[4] != SSL_MAJOR_VERSION_3 )
1139 {
1140 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1141 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1142 }
1143
1144 ssl->major_ver = SSL_MAJOR_VERSION_3;
Paul Bakker2fbefde2013-06-29 16:01:15 +02001145 ssl->minor_ver = ( buf[5] <= ssl->max_minor_ver )
1146 ? buf[5] : ssl->max_minor_ver;
Paul Bakkerec636f32012-09-09 19:17:02 +00001147
Paul Bakker1d29fb52012-09-28 13:28:45 +00001148 if( ssl->minor_ver < ssl->min_minor_ver )
1149 {
1150 SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
1151 " [%d:%d] < [%d:%d]", ssl->major_ver, ssl->minor_ver,
Paul Bakker81420ab2012-10-23 10:31:15 +00001152 ssl->min_major_ver, ssl->min_minor_ver ) );
Paul Bakker1d29fb52012-09-28 13:28:45 +00001153
1154 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
1155 SSL_ALERT_MSG_PROTOCOL_VERSION );
1156
1157 return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1158 }
1159
Paul Bakker2fbefde2013-06-29 16:01:15 +02001160 ssl->handshake->max_major_ver = buf[4];
1161 ssl->handshake->max_minor_ver = buf[5];
Paul Bakkerec636f32012-09-09 19:17:02 +00001162
Paul Bakker48916f92012-09-16 19:57:18 +00001163 memcpy( ssl->handshake->randbytes, buf + 6, 32 );
Paul Bakkerec636f32012-09-09 19:17:02 +00001164
1165 /*
1166 * Check the handshake message length
1167 */
1168 if( buf[1] != 0 || n != (unsigned int) 4 + ( ( buf[2] << 8 ) | buf[3] ) )
1169 {
1170 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1171 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1172 }
1173
1174 /*
1175 * Check the session length
1176 */
1177 sess_len = buf[38];
1178
1179 if( sess_len > 32 )
1180 {
1181 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1182 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1183 }
1184
Paul Bakker48916f92012-09-16 19:57:18 +00001185 ssl->session_negotiate->length = sess_len;
1186 memset( ssl->session_negotiate->id, 0,
1187 sizeof( ssl->session_negotiate->id ) );
1188 memcpy( ssl->session_negotiate->id, buf + 39,
1189 ssl->session_negotiate->length );
Paul Bakkerec636f32012-09-09 19:17:02 +00001190
1191 /*
1192 * Check the ciphersuitelist length
1193 */
1194 ciph_len = ( buf[39 + sess_len] << 8 )
1195 | ( buf[40 + sess_len] );
1196
1197 if( ciph_len < 2 || ciph_len > 256 || ( ciph_len % 2 ) != 0 )
1198 {
1199 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1200 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1201 }
1202
1203 /*
1204 * Check the compression algorithms length
1205 */
1206 comp_len = buf[41 + sess_len + ciph_len];
1207
1208 if( comp_len < 1 || comp_len > 16 )
1209 {
1210 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1211 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1212 }
1213
Paul Bakker48916f92012-09-16 19:57:18 +00001214 /*
1215 * Check the extension length
1216 */
1217 if( n > 42 + sess_len + ciph_len + comp_len )
1218 {
1219 ext_len = ( buf[42 + sess_len + ciph_len + comp_len] << 8 )
1220 | ( buf[43 + sess_len + ciph_len + comp_len] );
1221
1222 if( ( ext_len > 0 && ext_len < 4 ) ||
1223 n != 44 + sess_len + ciph_len + comp_len + ext_len )
1224 {
1225 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1226 SSL_DEBUG_BUF( 3, "Ext", buf + 44 + sess_len + ciph_len + comp_len, ext_len);
1227 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1228 }
1229 }
1230
1231 ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
Paul Bakkerec636f32012-09-09 19:17:02 +00001232#if defined(POLARSSL_ZLIB_SUPPORT)
1233 for( i = 0; i < comp_len; ++i )
1234 {
Paul Bakker48916f92012-09-16 19:57:18 +00001235 if( buf[42 + sess_len + ciph_len + i] == SSL_COMPRESS_DEFLATE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001236 {
Paul Bakker48916f92012-09-16 19:57:18 +00001237 ssl->session_negotiate->compression = SSL_COMPRESS_DEFLATE;
Paul Bakkerec636f32012-09-09 19:17:02 +00001238 break;
Paul Bakker5121ce52009-01-03 21:22:43 +00001239 }
1240 }
Paul Bakker2770fbd2012-07-03 13:30:23 +00001241#endif
1242
Paul Bakkerec636f32012-09-09 19:17:02 +00001243 SSL_DEBUG_BUF( 3, "client hello, random bytes",
1244 buf + 6, 32 );
1245 SSL_DEBUG_BUF( 3, "client hello, session id",
1246 buf + 38, sess_len );
1247 SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
1248 buf + 41 + sess_len, ciph_len );
1249 SSL_DEBUG_BUF( 3, "client hello, compression",
1250 buf + 42 + sess_len + ciph_len, comp_len );
Paul Bakker5121ce52009-01-03 21:22:43 +00001251
Paul Bakkerec636f32012-09-09 19:17:02 +00001252 /*
Paul Bakker48916f92012-09-16 19:57:18 +00001253 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1254 */
1255 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
1256 {
1257 if( p[0] == 0 && p[1] == SSL_EMPTY_RENEGOTIATION_INFO )
1258 {
1259 SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1260 if( ssl->renegotiation == SSL_RENEGOTIATION )
1261 {
1262 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001263
1264 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1265 return( ret );
1266
Paul Bakker48916f92012-09-16 19:57:18 +00001267 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1268 }
1269 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
1270 break;
1271 }
1272 }
1273
Paul Bakker48916f92012-09-16 19:57:18 +00001274 ext = buf + 44 + sess_len + ciph_len + comp_len;
Paul Bakker48916f92012-09-16 19:57:18 +00001275
1276 while( ext_len )
1277 {
1278 unsigned int ext_id = ( ( ext[0] << 8 )
1279 | ( ext[1] ) );
1280 unsigned int ext_size = ( ( ext[2] << 8 )
1281 | ( ext[3] ) );
1282
1283 if( ext_size + 4 > ext_len )
1284 {
1285 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1286 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1287 }
1288 switch( ext_id )
1289 {
Paul Bakker0be444a2013-08-27 21:55:01 +02001290#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
Paul Bakker5701cdc2012-09-27 21:49:42 +00001291 case TLS_EXT_SERVERNAME:
1292 SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1293 if( ssl->f_sni == NULL )
1294 break;
1295
1296 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1297 if( ret != 0 )
1298 return( ret );
1299 break;
Paul Bakker0be444a2013-08-27 21:55:01 +02001300#endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
Paul Bakker5701cdc2012-09-27 21:49:42 +00001301
Paul Bakker48916f92012-09-16 19:57:18 +00001302 case TLS_EXT_RENEGOTIATION_INFO:
1303 SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
1304 renegotiation_info_seen = 1;
1305
Paul Bakker23f36802012-09-28 14:15:14 +00001306 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1307 if( ret != 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001308 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00001309 break;
Paul Bakker48916f92012-09-16 19:57:18 +00001310
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001311#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker23f36802012-09-28 14:15:14 +00001312 case TLS_EXT_SIG_ALG:
1313 SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1314 if( ssl->renegotiation == SSL_RENEGOTIATION )
1315 break;
1316
1317 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1318 if( ret != 0 )
1319 return( ret );
Paul Bakker48916f92012-09-16 19:57:18 +00001320 break;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001321#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker48916f92012-09-16 19:57:18 +00001322
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001323#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Paul Bakker41c83d32013-03-20 14:39:14 +01001324 case TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1325 SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
1326
1327 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1328 if( ret != 0 )
1329 return( ret );
1330 break;
1331
1332 case TLS_EXT_SUPPORTED_POINT_FORMATS:
1333 SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
Paul Bakker677377f2013-10-28 12:54:26 +01001334 ssl->handshake->cli_exts |= TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
Paul Bakker41c83d32013-03-20 14:39:14 +01001335
1336 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1337 if( ret != 0 )
1338 return( ret );
1339 break;
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001340#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
Paul Bakker41c83d32013-03-20 14:39:14 +01001341
Paul Bakker05decb22013-08-15 13:33:48 +02001342#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001343 case TLS_EXT_MAX_FRAGMENT_LENGTH:
1344 SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
1345
1346 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1347 if( ret != 0 )
1348 return( ret );
1349 break;
Paul Bakker05decb22013-08-15 13:33:48 +02001350#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard48f8d0d2013-07-17 10:25:37 +02001351
Paul Bakker1f2bc622013-08-15 13:45:55 +02001352#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001353 case TLS_EXT_TRUNCATED_HMAC:
1354 SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
1355
1356 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1357 if( ret != 0 )
1358 return( ret );
1359 break;
Paul Bakker1f2bc622013-08-15 13:45:55 +02001360#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001361
Paul Bakkera503a632013-08-14 13:48:06 +02001362#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001363 case TLS_EXT_SESSION_TICKET:
1364 SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
1365
1366 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1367 if( ret != 0 )
1368 return( ret );
1369 break;
Paul Bakkera503a632013-08-14 13:48:06 +02001370#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001371
Paul Bakker48916f92012-09-16 19:57:18 +00001372 default:
1373 SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1374 ext_id ) );
1375 }
1376
1377 ext_len -= 4 + ext_size;
1378 ext += 4 + ext_size;
1379
1380 if( ext_len > 0 && ext_len < 4 )
1381 {
1382 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1383 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1384 }
1385 }
1386
1387 /*
1388 * Renegotiation security checks
1389 */
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001390 if( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1391 ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
1392 {
1393 SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1394 handshake_failure = 1;
1395 }
1396 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1397 ssl->secure_renegotiation == SSL_SECURE_RENEGOTIATION &&
1398 renegotiation_info_seen == 0 )
Paul Bakker48916f92012-09-16 19:57:18 +00001399 {
1400 SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001401 handshake_failure = 1;
Paul Bakker48916f92012-09-16 19:57:18 +00001402 }
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001403 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1404 ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1405 ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION )
Paul Bakker48916f92012-09-16 19:57:18 +00001406 {
1407 SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
Paul Bakkerd0f6fa72012-09-17 09:18:12 +00001408 handshake_failure = 1;
1409 }
1410 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1411 ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1412 renegotiation_info_seen == 1 )
1413 {
1414 SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
1415 handshake_failure = 1;
1416 }
1417
1418 if( handshake_failure == 1 )
1419 {
1420 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1421 return( ret );
1422
Paul Bakker48916f92012-09-16 19:57:18 +00001423 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1424 }
Paul Bakker380da532012-04-18 16:10:25 +00001425
Paul Bakker41c83d32013-03-20 14:39:14 +01001426 /*
1427 * Search for a matching ciphersuite
Manuel Pégourié-Gonnard3ebb2cd2013-09-23 17:00:18 +02001428 * (At the end because we need information from the EC-based extensions
1429 * and certificate from the SNI callback triggered by the SNI extension.)
Paul Bakker41c83d32013-03-20 14:39:14 +01001430 */
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001431 ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
Manuel Pégourié-Gonnard59b81d72013-11-30 17:46:04 +01001432 ciphersuite_info = NULL;
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001433#if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
1434 for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
1435 {
1436 for( i = 0; ciphersuites[i] != 0; i++ )
1437#else
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001438 for( i = 0; ciphersuites[i] != 0; i++ )
Paul Bakker41c83d32013-03-20 14:39:14 +01001439 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001440 for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
Manuel Pégourié-Gonnard1a9f2c72013-11-30 18:30:06 +01001441#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01001442 {
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001443 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1444 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1445 continue;
Paul Bakker41c83d32013-03-20 14:39:14 +01001446
Manuel Pégourié-Gonnard011a8db2013-11-30 18:11:07 +01001447 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1448 &ciphersuite_info ) ) != 0 )
1449 return( ret );
1450
1451 if( ciphersuite_info != NULL )
1452 goto have_ciphersuite;
Paul Bakker41c83d32013-03-20 14:39:14 +01001453 }
1454 }
1455
1456 SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1457
1458 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1459 return( ret );
1460
1461 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
1462
1463have_ciphersuite:
Paul Bakker8f4ddae2013-04-15 15:09:54 +02001464 ssl->session_negotiate->ciphersuite = ciphersuites[i];
Paul Bakker41c83d32013-03-20 14:39:14 +01001465 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
1466 ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
1467
Paul Bakker5121ce52009-01-03 21:22:43 +00001468 ssl->in_left = 0;
1469 ssl->state++;
1470
1471 SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
1472
1473 return( 0 );
1474}
1475
Paul Bakker1f2bc622013-08-15 13:45:55 +02001476#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001477static void ssl_write_truncated_hmac_ext( ssl_context *ssl,
1478 unsigned char *buf,
1479 size_t *olen )
1480{
1481 unsigned char *p = buf;
1482
1483 if( ssl->session_negotiate->trunc_hmac == SSL_TRUNC_HMAC_DISABLED )
1484 {
1485 *olen = 0;
1486 return;
1487 }
1488
1489 SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
1490
1491 *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
1492 *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
1493
1494 *p++ = 0x00;
1495 *p++ = 0x00;
1496
1497 *olen = 4;
1498}
Paul Bakker1f2bc622013-08-15 13:45:55 +02001499#endif /* POLARSSL_SSL_TRUNCATED_HMAC */
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001500
Paul Bakkera503a632013-08-14 13:48:06 +02001501#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001502static void ssl_write_session_ticket_ext( ssl_context *ssl,
1503 unsigned char *buf,
1504 size_t *olen )
1505{
1506 unsigned char *p = buf;
1507
1508 if( ssl->handshake->new_session_ticket == 0 )
1509 {
1510 *olen = 0;
1511 return;
1512 }
1513
1514 SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
1515
1516 *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
1517 *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET ) & 0xFF );
1518
1519 *p++ = 0x00;
1520 *p++ = 0x00;
1521
1522 *olen = 4;
1523}
Paul Bakkera503a632013-08-14 13:48:06 +02001524#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001525
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001526static void ssl_write_renegotiation_ext( ssl_context *ssl,
1527 unsigned char *buf,
1528 size_t *olen )
1529{
1530 unsigned char *p = buf;
1531
1532 if( ssl->secure_renegotiation != SSL_SECURE_RENEGOTIATION )
1533 {
1534 *olen = 0;
1535 return;
1536 }
1537
1538 SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
1539
1540 *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
1541 *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
1542
1543 *p++ = 0x00;
1544 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
1545 *p++ = ssl->verify_data_len * 2 & 0xFF;
1546
1547 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
1548 p += ssl->verify_data_len;
1549 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
1550 p += ssl->verify_data_len;
1551
1552 *olen = 5 + ssl->verify_data_len * 2;
1553}
1554
Paul Bakker05decb22013-08-15 13:33:48 +02001555#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001556static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
1557 unsigned char *buf,
1558 size_t *olen )
1559{
1560 unsigned char *p = buf;
1561
Manuel Pégourié-Gonnarde048b672013-07-19 12:47:00 +02001562 if( ssl->session_negotiate->mfl_code == SSL_MAX_FRAG_LEN_NONE )
1563 {
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001564 *olen = 0;
1565 return;
1566 }
1567
1568 SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
1569
1570 *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
1571 *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
1572
1573 *p++ = 0x00;
1574 *p++ = 1;
1575
Manuel Pégourié-Gonnarded4af8b2013-07-18 14:07:09 +02001576 *p++ = ssl->session_negotiate->mfl_code;
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001577
1578 *olen = 5;
1579}
Paul Bakker05decb22013-08-15 13:33:48 +02001580#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001581
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001582#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001583static void ssl_write_supported_point_formats_ext( ssl_context *ssl,
1584 unsigned char *buf,
1585 size_t *olen )
1586{
1587 unsigned char *p = buf;
1588 ((void) ssl);
1589
Paul Bakker677377f2013-10-28 12:54:26 +01001590 if( ( ssl->handshake->cli_exts &
1591 TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
1592 {
1593 *olen = 0;
1594 return;
1595 }
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001596
1597 SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
1598
1599 *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
1600 *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
1601
1602 *p++ = 0x00;
1603 *p++ = 2;
1604
1605 *p++ = 1;
1606 *p++ = POLARSSL_ECP_PF_UNCOMPRESSED;
1607
1608 *olen = 6;
1609}
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001610#endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001611
Paul Bakker5121ce52009-01-03 21:22:43 +00001612static int ssl_write_server_hello( ssl_context *ssl )
1613{
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001614#if defined(POLARSSL_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +00001615 time_t t;
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001616#endif
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001617 int ret;
1618 size_t olen, ext_len = 0, n;
Paul Bakker5121ce52009-01-03 21:22:43 +00001619 unsigned char *buf, *p;
1620
1621 SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
1622
Paul Bakkera9a028e2013-11-21 17:31:06 +01001623 if( ssl->f_rng == NULL )
1624 {
1625 SSL_DEBUG_MSG( 1, ( "no RNG provided") );
1626 return( POLARSSL_ERR_SSL_NO_RNG );
1627 }
1628
Paul Bakker5121ce52009-01-03 21:22:43 +00001629 /*
1630 * 0 . 0 handshake type
1631 * 1 . 3 handshake length
1632 * 4 . 5 protocol version
1633 * 6 . 9 UNIX time()
1634 * 10 . 37 random bytes
1635 */
1636 buf = ssl->out_msg;
1637 p = buf + 4;
1638
1639 *p++ = (unsigned char) ssl->major_ver;
1640 *p++ = (unsigned char) ssl->minor_ver;
1641
1642 SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
1643 buf[4], buf[5] ) );
1644
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001645#if defined(POLARSSL_HAVE_TIME)
Paul Bakker5121ce52009-01-03 21:22:43 +00001646 t = time( NULL );
1647 *p++ = (unsigned char)( t >> 24 );
1648 *p++ = (unsigned char)( t >> 16 );
1649 *p++ = (unsigned char)( t >> 8 );
1650 *p++ = (unsigned char)( t );
1651
1652 SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
Paul Bakkerfa9b1002013-07-03 15:31:03 +02001653#else
1654 if( ( ret = ssl->f_rng( ssl->p_rng, p, 4 ) ) != 0 )
1655 return( ret );
1656
1657 p += 4;
1658#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00001659
Paul Bakkera3d195c2011-11-27 21:07:34 +00001660 if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
1661 return( ret );
1662
1663 p += 28;
Paul Bakker5121ce52009-01-03 21:22:43 +00001664
Paul Bakker48916f92012-09-16 19:57:18 +00001665 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
Paul Bakker5121ce52009-01-03 21:22:43 +00001666
1667 SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
1668
1669 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001670 * Resume is 0 by default, see ssl_handshake_init().
1671 * It may be already set to 1 by ssl_parse_session_ticket_ext().
1672 * If not, try looking up session ID in our cache.
Paul Bakker5121ce52009-01-03 21:22:43 +00001673 */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001674 if( ssl->handshake->resume == 0 &&
1675 ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
Manuel Pégourié-Gonnardc086cce2013-08-02 14:13:02 +02001676 ssl->session_negotiate->length != 0 &&
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001677 ssl->f_get_cache != NULL &&
1678 ssl->f_get_cache( ssl->p_get_cache, ssl->session_negotiate ) == 0 )
1679 {
1680 ssl->handshake->resume = 1;
1681 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001682
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001683 if( ssl->handshake->resume == 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00001684 {
1685 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001686 * New session, create a new session id,
1687 * unless we're about to issue a session ticket
Paul Bakker5121ce52009-01-03 21:22:43 +00001688 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001689 ssl->state++;
1690
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02001691#if defined(POLARSSL_HAVE_TIME)
1692 ssl->session_negotiate->start = time( NULL );
1693#endif
1694
Paul Bakkera503a632013-08-14 13:48:06 +02001695#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02001696 if( ssl->handshake->new_session_ticket != 0 )
1697 {
1698 ssl->session_negotiate->length = n = 0;
1699 memset( ssl->session_negotiate->id, 0, 32 );
1700 }
1701 else
1702#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001703 {
1704 ssl->session_negotiate->length = n = 32;
1705 if( ( ret = ssl->f_rng( ssl->p_rng, ssl->session_negotiate->id,
Paul Bakkera503a632013-08-14 13:48:06 +02001706 n ) ) != 0 )
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001707 return( ret );
1708 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001709 }
1710 else
1711 {
1712 /*
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001713 * Resuming a session
Paul Bakker5121ce52009-01-03 21:22:43 +00001714 */
Paul Bakkerf0e39ac2013-08-15 11:40:48 +02001715 n = ssl->session_negotiate->length;
Paul Bakker5121ce52009-01-03 21:22:43 +00001716 ssl->state = SSL_SERVER_CHANGE_CIPHER_SPEC;
Paul Bakkerff60ee62010-03-16 21:09:09 +00001717
1718 if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
1719 {
1720 SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
1721 return( ret );
1722 }
Paul Bakker5121ce52009-01-03 21:22:43 +00001723 }
1724
Manuel Pégourié-Gonnard3ffa3db2013-08-02 11:59:05 +02001725 /*
1726 * 38 . 38 session id length
1727 * 39 . 38+n session id
1728 * 39+n . 40+n chosen ciphersuite
1729 * 41+n . 41+n chosen compression alg.
1730 * 42+n . 43+n extensions length
1731 * 44+n . 43+n+m extensions
1732 */
1733 *p++ = (unsigned char) ssl->session_negotiate->length;
Paul Bakker48916f92012-09-16 19:57:18 +00001734 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->length );
1735 p += ssl->session_negotiate->length;
Paul Bakker5121ce52009-01-03 21:22:43 +00001736
1737 SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
1738 SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
1739 SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
Paul Bakker0a597072012-09-25 21:55:46 +00001740 ssl->handshake->resume ? "a" : "no" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001741
Paul Bakker48916f92012-09-16 19:57:18 +00001742 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
1743 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
1744 *p++ = (unsigned char)( ssl->session_negotiate->compression );
Paul Bakker5121ce52009-01-03 21:22:43 +00001745
Manuel Pégourié-Gonnard51451f82013-09-17 12:06:25 +02001746 SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
1747 ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
Manuel Pégourié-Gonnard32ea60a2013-08-17 17:39:04 +02001748 SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
Paul Bakker48916f92012-09-16 19:57:18 +00001749 ssl->session_negotiate->compression ) );
1750
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001751 /*
1752 * First write extensions, then the total length
1753 */
1754 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
1755 ext_len += olen;
Paul Bakker48916f92012-09-16 19:57:18 +00001756
Paul Bakker05decb22013-08-15 13:33:48 +02001757#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001758 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
1759 ext_len += olen;
Paul Bakker05decb22013-08-15 13:33:48 +02001760#endif
Manuel Pégourié-Gonnard7bb78992013-07-17 13:50:08 +02001761
Paul Bakker1f2bc622013-08-15 13:45:55 +02001762#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001763 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
1764 ext_len += olen;
Paul Bakker1f2bc622013-08-15 13:45:55 +02001765#endif
Manuel Pégourié-Gonnard57c28522013-07-19 11:41:43 +02001766
Paul Bakkera503a632013-08-14 13:48:06 +02001767#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001768 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
1769 ext_len += olen;
Paul Bakkera503a632013-08-14 13:48:06 +02001770#endif
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02001771
Manuel Pégourié-Gonnard0b272672013-08-15 19:38:07 +02001772#if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
Manuel Pégourié-Gonnard7b19c162013-08-15 18:01:11 +02001773 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
1774 ext_len += olen;
1775#endif
1776
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001777 SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
Paul Bakker48916f92012-09-16 19:57:18 +00001778
Manuel Pégourié-Gonnardf11a6d72013-07-17 11:17:14 +02001779 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1780 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
1781 p += ext_len;
Paul Bakker5121ce52009-01-03 21:22:43 +00001782
1783 ssl->out_msglen = p - buf;
1784 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
1785 ssl->out_msg[0] = SSL_HS_SERVER_HELLO;
1786
1787 ret = ssl_write_record( ssl );
1788
1789 SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
1790
1791 return( ret );
1792}
1793
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001794#if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \
1795 !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02001796 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
1797 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Paul Bakker5121ce52009-01-03 21:22:43 +00001798static int ssl_write_certificate_request( ssl_context *ssl )
1799{
Paul Bakkered27a042013-04-18 22:46:23 +02001800 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
1801 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001802
1803 SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
1804
1805 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01001806 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02001807 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
1808 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001809 {
1810 SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
1811 ssl->state++;
1812 return( 0 );
1813 }
1814
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02001815 SSL_DEBUG_MSG( 1, ( "should not happen" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001816 return( ret );
1817}
1818#else
1819static int ssl_write_certificate_request( ssl_context *ssl )
1820{
1821 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
1822 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001823 size_t dn_size, total_dn_size; /* excluding length bytes */
1824 size_t ct_len, sa_len; /* including length bytes */
Paul Bakker5121ce52009-01-03 21:22:43 +00001825 unsigned char *buf, *p;
Paul Bakkerc559c7a2013-09-18 14:13:26 +02001826 const x509_crt *crt;
Paul Bakker5121ce52009-01-03 21:22:43 +00001827
1828 SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
1829
1830 ssl->state++;
1831
Paul Bakkerfbb17802013-04-17 19:10:21 +02001832 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01001833 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001834 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02001835 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
Paul Bakkerfbb17802013-04-17 19:10:21 +02001836 ssl->authmode == SSL_VERIFY_NONE )
Paul Bakker5121ce52009-01-03 21:22:43 +00001837 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001838 SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
Paul Bakker5121ce52009-01-03 21:22:43 +00001839 return( 0 );
1840 }
1841
1842 /*
1843 * 0 . 0 handshake type
1844 * 1 . 3 handshake length
1845 * 4 . 4 cert type count
Paul Bakker926af752012-11-23 13:38:07 +01001846 * 5 .. m-1 cert types
1847 * m .. m+1 sig alg length (TLS 1.2 only)
1848 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
Paul Bakker5121ce52009-01-03 21:22:43 +00001849 * n .. n+1 length of all DNs
1850 * n+2 .. n+3 length of DN 1
1851 * n+4 .. ... Distinguished Name #1
1852 * ... .. ... length of DN 2, etc.
1853 */
1854 buf = ssl->out_msg;
1855 p = buf + 4;
1856
1857 /*
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001858 * Supported certificate types
1859 *
1860 * ClientCertificateType certificate_types<1..2^8-1>;
1861 * enum { (255) } ClientCertificateType;
Paul Bakker5121ce52009-01-03 21:22:43 +00001862 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001863 ct_len = 0;
Paul Bakker926af752012-11-23 13:38:07 +01001864
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001865#if defined(POLARSSL_RSA_C)
1866 p[1 + ct_len++] = SSL_CERT_TYPE_RSA_SIGN;
1867#endif
1868#if defined(POLARSSL_ECDSA_C)
1869 p[1 + ct_len++] = SSL_CERT_TYPE_ECDSA_SIGN;
1870#endif
1871
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02001872 p[0] = (unsigned char) ct_len++;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001873 p += ct_len;
Paul Bakker926af752012-11-23 13:38:07 +01001874
Paul Bakker577e0062013-08-28 11:57:20 +02001875 sa_len = 0;
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001876#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker926af752012-11-23 13:38:07 +01001877 /*
1878 * Add signature_algorithms for verify (TLS 1.2)
Paul Bakker926af752012-11-23 13:38:07 +01001879 *
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001880 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
1881 *
1882 * struct {
1883 * HashAlgorithm hash;
1884 * SignatureAlgorithm signature;
1885 * } SignatureAndHashAlgorithm;
1886 *
1887 * enum { (255) } HashAlgorithm;
1888 * enum { (255) } SignatureAlgorithm;
Paul Bakker926af752012-11-23 13:38:07 +01001889 */
Paul Bakker21dca692013-01-03 11:41:08 +01001890 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01001891 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001892 /*
1893 * Only use current running hash algorithm that is already required
1894 * for requested ciphersuite.
1895 */
Paul Bakker926af752012-11-23 13:38:07 +01001896 ssl->handshake->verify_sig_alg = SSL_HASH_SHA256;
1897
Paul Bakkerb7149bc2013-03-20 15:30:09 +01001898 if( ssl->transform_negotiate->ciphersuite_info->mac ==
1899 POLARSSL_MD_SHA384 )
Paul Bakker926af752012-11-23 13:38:07 +01001900 {
1901 ssl->handshake->verify_sig_alg = SSL_HASH_SHA384;
1902 }
Paul Bakkerf7abd422013-04-16 13:15:56 +02001903
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001904 /*
1905 * Supported signature algorithms
1906 */
1907#if defined(POLARSSL_RSA_C)
1908 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
1909 p[2 + sa_len++] = SSL_SIG_RSA;
1910#endif
1911#if defined(POLARSSL_ECDSA_C)
1912 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
1913 p[2 + sa_len++] = SSL_SIG_ECDSA;
1914#endif
Paul Bakker926af752012-11-23 13:38:07 +01001915
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001916 p[0] = (unsigned char)( sa_len >> 8 );
1917 p[1] = (unsigned char)( sa_len );
1918 sa_len += 2;
1919 p += sa_len;
Paul Bakker926af752012-11-23 13:38:07 +01001920 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02001921#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001922
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001923 /*
1924 * DistinguishedName certificate_authorities<0..2^16-1>;
1925 * opaque DistinguishedName<1..2^16-1>;
1926 */
Paul Bakker5121ce52009-01-03 21:22:43 +00001927 p += 2;
1928 crt = ssl->ca_chain;
1929
Paul Bakkerbc3d9842012-11-26 16:12:02 +01001930 total_dn_size = 0;
Paul Bakker29087132010-03-21 21:03:34 +00001931 while( crt != NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00001932 {
1933 if( p - buf > 4096 )
1934 break;
1935
Paul Bakker926af752012-11-23 13:38:07 +01001936 dn_size = crt->subject_raw.len;
1937 *p++ = (unsigned char)( dn_size >> 8 );
1938 *p++ = (unsigned char)( dn_size );
1939 memcpy( p, crt->subject_raw.p, dn_size );
1940 p += dn_size;
Paul Bakker5121ce52009-01-03 21:22:43 +00001941
Paul Bakker926af752012-11-23 13:38:07 +01001942 SSL_DEBUG_BUF( 3, "requested DN", p, dn_size );
1943
Paul Bakkerbc3d9842012-11-26 16:12:02 +01001944 total_dn_size += 2 + dn_size;
Paul Bakker926af752012-11-23 13:38:07 +01001945 crt = crt->next;
Paul Bakker5121ce52009-01-03 21:22:43 +00001946 }
1947
Paul Bakker926af752012-11-23 13:38:07 +01001948 ssl->out_msglen = p - buf;
Paul Bakker5121ce52009-01-03 21:22:43 +00001949 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
1950 ssl->out_msg[0] = SSL_HS_CERTIFICATE_REQUEST;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02001951 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
1952 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
Paul Bakker5121ce52009-01-03 21:22:43 +00001953
1954 ret = ssl_write_record( ssl );
1955
1956 SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
1957
1958 return( ret );
1959}
Paul Bakker48f7a5d2013-04-19 14:30:58 +02001960#endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
1961 !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
Manuel Pégourié-Gonnardda1ff382013-11-25 17:38:36 +01001962 !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
1963 !POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00001964
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01001965#if defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
1966 defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
1967static int ssl_get_ecdh_params_from_cert( ssl_context *ssl )
1968{
1969 int ret;
1970
1971 if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_ECKEY ) )
1972 {
1973 SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
1974 return( POLARSSL_ERR_SSL_PK_TYPE_MISMATCH );
1975 }
1976
1977 if( ( ret = ecdh_get_params( &ssl->handshake->ecdh_ctx,
1978 pk_ec( *ssl_own_key( ssl ) ),
1979 POLARSSL_ECDH_OURS ) ) != 0 )
1980 {
1981 SSL_DEBUG_RET( 1, ( "ecdh_get_params" ), ret );
1982 return( ret );
1983 }
1984
1985 return( 0 );
1986}
1987#endif /* POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
1988 POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
1989
Paul Bakker41c83d32013-03-20 14:39:14 +01001990static int ssl_write_server_key_exchange( ssl_context *ssl )
1991{
Paul Bakker23986e52011-04-24 08:57:21 +00001992 int ret;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02001993 size_t n = 0;
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02001994 const ssl_ciphersuite_t *ciphersuite_info =
1995 ssl->transform_negotiate->ciphersuite_info;
Paul Bakker2292d1f2013-09-15 17:06:49 +02001996
1997#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
1998 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
1999 defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002000 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
Paul Bakker2292d1f2013-09-15 17:06:49 +02002001 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002002 unsigned char *p = ssl->out_msg + 4;
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002003 unsigned char *dig_signed = p;
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002004 size_t dig_signed_len = 0, len;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002005 ((void) dig_signed);
2006 ((void) dig_signed_len);
2007#endif
Paul Bakker41c83d32013-03-20 14:39:14 +01002008
Paul Bakker5121ce52009-01-03 21:22:43 +00002009 SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
2010
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002011#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) || \
2012 defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) || \
2013 defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
Manuel Pégourié-Gonnard09258b92013-10-15 10:43:36 +02002014 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA ||
2015 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
2016 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002017 {
2018 SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
2019 ssl->state++;
2020 return( 0 );
2021 }
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002022#endif
2023
2024#if defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2025 defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2026 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_RSA ||
2027 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
2028 {
2029 ssl_get_ecdh_params_from_cert( ssl );
2030
2031 SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
2032 ssl->state++;
2033 return( 0 );
2034 }
2035#endif
Paul Bakker5121ce52009-01-03 21:22:43 +00002036
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002037#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2038 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2039 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
2040 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002041 {
2042 /* TODO: Support identity hints */
2043 *(p++) = 0x00;
2044 *(p++) = 0x00;
2045
2046 n += 2;
2047 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002048#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2049 POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002050
2051#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2052 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2053 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
2054 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
Paul Bakker48916f92012-09-16 19:57:18 +00002055 {
Paul Bakker41c83d32013-03-20 14:39:14 +01002056 /*
2057 * Ephemeral DH parameters:
2058 *
2059 * struct {
2060 * opaque dh_p<1..2^16-1>;
2061 * opaque dh_g<1..2^16-1>;
2062 * opaque dh_Ys<1..2^16-1>;
2063 * } ServerDHParams;
2064 */
2065 if( ( ret = mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->dhm_P ) ) != 0 ||
2066 ( ret = mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->dhm_G ) ) != 0 )
2067 {
2068 SSL_DEBUG_RET( 1, "mpi_copy", ret );
2069 return( ret );
2070 }
Paul Bakker48916f92012-09-16 19:57:18 +00002071
Paul Bakker41c83d32013-03-20 14:39:14 +01002072 if( ( ret = dhm_make_params( &ssl->handshake->dhm_ctx,
Paul Bakkerb9cfaa02013-10-11 18:58:55 +02002073 (int) mpi_size( &ssl->handshake->dhm_ctx.P ),
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002074 p,
2075 &len, ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002076 {
2077 SSL_DEBUG_RET( 1, "dhm_make_params", ret );
2078 return( ret );
2079 }
2080
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002081 dig_signed = p;
2082 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002083
2084 p += len;
2085 n += len;
2086
Paul Bakker41c83d32013-03-20 14:39:14 +01002087 SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2088 SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2089 SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2090 SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
2091 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002092#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2093 POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker41c83d32013-03-20 14:39:14 +01002094
Gergely Budai987bfb52014-01-19 21:48:42 +01002095#if defined(POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002096 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002097 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
2098 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
Paul Bakker5121ce52009-01-03 21:22:43 +00002099 {
Paul Bakker41c83d32013-03-20 14:39:14 +01002100 /*
2101 * Ephemeral ECDH parameters:
2102 *
2103 * struct {
2104 * ECParameters curve_params;
2105 * ECPoint public;
2106 * } ServerECDHParams;
2107 */
Gergely Budai987bfb52014-01-19 21:48:42 +01002108
2109 unsigned int pref_idx, curv_idx, found;
2110
2111 /* Match our preference list against the agreed curves */
2112 for( pref_idx = 0, found = 0;
2113 ssl->ecdh_curve_list[pref_idx] != POLARSSL_ECP_DP_NONE;
2114 pref_idx++ )
2115 {
2116 /* Look through the agreed curve list */
2117 for( curv_idx = 0;
2118 ssl->handshake->curves[curv_idx] != NULL;
2119 curv_idx++ )
2120 {
2121 if (ssl->handshake->curves[curv_idx]->grp_id ==
2122 ssl->ecdh_curve_list[pref_idx] )
2123 {
2124 /* We found our most preferred curve */
2125 found = 1;
2126 break;
2127 }
2128 }
2129
2130 /* Exit the search if we have found our curve */
2131 if( found == 1 )
2132 {
2133 break;
2134 }
2135 }
2136 /* If we haven't found any allowed / preferred curve,
2137 * ssl->ecdh_curve_list[pref_idx] will contain POLARSSL_ECP_DP_NONE and
2138 * ecp_use_known_dp() will fail.
2139 */
2140
Paul Bakker41c83d32013-03-20 14:39:14 +01002141 if( ( ret = ecp_use_known_dp( &ssl->handshake->ecdh_ctx.grp,
Gergely Budai987bfb52014-01-19 21:48:42 +01002142 ssl->ecdh_curve_list[pref_idx] ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002143 {
2144 SSL_DEBUG_RET( 1, "ecp_use_known_dp", ret );
2145 return( ret );
2146 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002147
Manuel Pégourié-Gonnard568c9cf2013-09-16 17:30:04 +02002148 SSL_DEBUG_MSG( 2, ( "ECDH curve size: %d",
2149 (int) ssl->handshake->ecdh_ctx.grp.nbits ) );
2150
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002151 if( ( ret = ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
2152 p, SSL_MAX_CONTENT_LEN - n,
2153 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002154 {
2155 SSL_DEBUG_RET( 1, "ecdh_make_params", ret );
2156 return( ret );
2157 }
2158
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002159 dig_signed = p;
2160 dig_signed_len = len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002161
2162 p += len;
2163 n += len;
2164
Paul Bakker41c83d32013-03-20 14:39:14 +01002165 SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
2166 }
Gergely Budai987bfb52014-01-19 21:48:42 +01002167#endif /* POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002168
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002169#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002170 defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2171 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002172 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002173 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
2174 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
Paul Bakker1ef83d62012-04-11 12:09:53 +00002175 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002176 size_t signature_len = 0;
Paul Bakker2292d1f2013-09-15 17:06:49 +02002177 unsigned int hashlen = 0;
2178 unsigned char hash[64];
2179 md_type_t md_alg = POLARSSL_MD_NONE;
Paul Bakker23f36802012-09-28 14:15:14 +00002180
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002181 /*
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002182 * Choose hash algorithm. NONE means MD5 + SHA1 here.
2183 */
Paul Bakker577e0062013-08-28 11:57:20 +02002184#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002185 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2186 {
2187 md_alg = ssl_md_alg_from_hash( ssl->handshake->sig_alg );
2188
2189 if( md_alg == POLARSSL_MD_NONE )
2190 {
2191 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2192 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
2193 }
2194 }
Paul Bakker577e0062013-08-28 11:57:20 +02002195 else
2196#endif
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002197#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2198 defined(POLARSSL_SSL_PROTO_TLS1_1)
Paul Bakker577e0062013-08-28 11:57:20 +02002199 if ( ciphersuite_info->key_exchange ==
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002200 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
2201 {
2202 md_alg = POLARSSL_MD_SHA1;
2203 }
2204 else
Paul Bakker577e0062013-08-28 11:57:20 +02002205#endif
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002206 {
2207 md_alg = POLARSSL_MD_NONE;
2208 }
2209
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002210 /*
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002211 * Compute the hash to be signed
2212 */
Paul Bakker577e0062013-08-28 11:57:20 +02002213#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2214 defined(POLARSSL_SSL_PROTO_TLS1_1)
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002215 if( md_alg == POLARSSL_MD_NONE )
Paul Bakker23f36802012-09-28 14:15:14 +00002216 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002217 md5_context md5;
2218 sha1_context sha1;
2219
2220 /*
2221 * digitally-signed struct {
2222 * opaque md5_hash[16];
2223 * opaque sha_hash[20];
2224 * };
2225 *
2226 * md5_hash
2227 * MD5(ClientHello.random + ServerHello.random
2228 * + ServerParams);
2229 * sha_hash
2230 * SHA(ClientHello.random + ServerHello.random
2231 * + ServerParams);
2232 */
2233 md5_starts( &md5 );
2234 md5_update( &md5, ssl->handshake->randbytes, 64 );
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002235 md5_update( &md5, dig_signed, dig_signed_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002236 md5_finish( &md5, hash );
2237
2238 sha1_starts( &sha1 );
2239 sha1_update( &sha1, ssl->handshake->randbytes, 64 );
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002240 sha1_update( &sha1, dig_signed, dig_signed_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002241 sha1_finish( &sha1, hash + 16 );
2242
2243 hashlen = 36;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002244 }
2245 else
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002246#endif /* POLARSSL_SSL_PROTO_SSL3 || POLARSSL_SSL_PROTO_TLS1 || \
2247 POLARSSL_SSL_PROTO_TLS1_1 */
Paul Bakker9659dae2013-08-28 16:21:34 +02002248#if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
2249 defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker577e0062013-08-28 11:57:20 +02002250 if( md_alg != POLARSSL_MD_NONE )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002251 {
2252 md_context_t ctx;
2253
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002254 /* Info from md_alg will be used instead */
2255 hashlen = 0;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002256
2257 /*
2258 * digitally-signed struct {
2259 * opaque client_random[32];
2260 * opaque server_random[32];
2261 * ServerDHParams params;
2262 * };
2263 */
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002264 if( ( ret = md_init_ctx( &ctx, md_info_from_type(md_alg) ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002265 {
2266 SSL_DEBUG_RET( 1, "md_init_ctx", ret );
2267 return( ret );
2268 }
2269
2270 md_starts( &ctx );
2271 md_update( &ctx, ssl->handshake->randbytes, 64 );
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002272 md_update( &ctx, dig_signed, dig_signed_len );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002273 md_finish( &ctx, hash );
Paul Bakker61d113b2013-07-04 11:51:43 +02002274
2275 if( ( ret = md_free_ctx( &ctx ) ) != 0 )
2276 {
2277 SSL_DEBUG_RET( 1, "md_free_ctx", ret );
2278 return( ret );
2279 }
2280
Paul Bakker23f36802012-09-28 14:15:14 +00002281 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002282 else
Paul Bakker9659dae2013-08-28 16:21:34 +02002283#endif /* POLARSSL_SSL_PROTO_TLS1 || POLARSSL_SSL_PROTO_TLS1_1 || \
2284 POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker577e0062013-08-28 11:57:20 +02002285 {
2286 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002287 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
Paul Bakker577e0062013-08-28 11:57:20 +02002288 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002289
Manuel Pégourié-Gonnard9cc6f5c2013-08-27 14:29:44 +02002290 SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
2291 (unsigned int) ( md_info_from_type( md_alg ) )->size );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002292
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002293 /*
2294 * Make the signature
2295 */
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002296 if( ssl_own_key( ssl ) == NULL )
Paul Bakker23f36802012-09-28 14:15:14 +00002297 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002298 SSL_DEBUG_MSG( 1, ( "got no private key" ) );
2299 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002300 }
Paul Bakker23f36802012-09-28 14:15:14 +00002301
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002302#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker23f36802012-09-28 14:15:14 +00002303 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2304 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002305 *(p++) = ssl->handshake->sig_alg;
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002306 *(p++) = ssl_sig_from_pk( ssl_own_key( ssl ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002307
2308 n += 2;
2309 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002310#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002311
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002312 if( ( ret = pk_sign( ssl_own_key( ssl ), md_alg, hash, hashlen,
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02002313 p + 2 , &signature_len,
2314 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002315 {
Manuel Pégourié-Gonnard0d420492013-08-21 16:14:26 +02002316 SSL_DEBUG_RET( 1, "pk_sign", ret );
Paul Bakkerc70b9822013-04-07 22:00:46 +02002317 return( ret );
Paul Bakker23f36802012-09-28 14:15:14 +00002318 }
Paul Bakkerc70b9822013-04-07 22:00:46 +02002319
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002320 *(p++) = (unsigned char)( signature_len >> 8 );
2321 *(p++) = (unsigned char)( signature_len );
Paul Bakkerbf63b362012-04-12 20:44:34 +00002322 n += 2;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002323
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002324 SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
Paul Bakker48916f92012-09-16 19:57:18 +00002325
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002326 p += signature_len;
2327 n += signature_len;
Paul Bakker1ef83d62012-04-11 12:09:53 +00002328 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002329#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002330 POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2331 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
Paul Bakker1ef83d62012-04-11 12:09:53 +00002332
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002333 ssl->out_msglen = 4 + n;
Paul Bakker5121ce52009-01-03 21:22:43 +00002334 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2335 ssl->out_msg[0] = SSL_HS_SERVER_KEY_EXCHANGE;
2336
2337 ssl->state++;
2338
2339 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2340 {
2341 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2342 return( ret );
2343 }
2344
2345 SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
2346
2347 return( 0 );
Paul Bakker5121ce52009-01-03 21:22:43 +00002348}
2349
2350static int ssl_write_server_hello_done( ssl_context *ssl )
2351{
2352 int ret;
2353
2354 SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
2355
2356 ssl->out_msglen = 4;
2357 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2358 ssl->out_msg[0] = SSL_HS_SERVER_HELLO_DONE;
2359
2360 ssl->state++;
2361
2362 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2363 {
2364 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2365 return( ret );
2366 }
2367
2368 SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
2369
2370 return( 0 );
2371}
2372
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002373#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2374 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2375static int ssl_parse_client_dh_public( ssl_context *ssl, unsigned char **p,
2376 const unsigned char *end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002377{
2378 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002379 size_t n;
2380
2381 /*
2382 * Receive G^Y mod P, premaster = (G^Y)^X mod P
2383 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002384 if( *p + 2 > end )
2385 {
2386 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2387 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2388 }
Paul Bakker70df2fb2013-04-17 17:19:09 +02002389
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002390 n = ( (*p)[0] << 8 ) | (*p)[1];
2391 *p += 2;
2392
2393 if( n < 1 || n > ssl->handshake->dhm_ctx.len || *p + n > end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002394 {
2395 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2396 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2397 }
2398
2399 if( ( ret = dhm_read_public( &ssl->handshake->dhm_ctx,
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002400 *p, n ) ) != 0 )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002401 {
2402 SSL_DEBUG_RET( 1, "dhm_read_public", ret );
2403 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
2404 }
2405
2406 SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
2407
Paul Bakker70df2fb2013-04-17 17:19:09 +02002408 return( ret );
2409}
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002410#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2411 POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02002412
Manuel Pégourié-Gonnardbac0e3b2013-10-15 11:54:47 +02002413#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) || \
2414 defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002415static int ssl_parse_encrypted_pms( ssl_context *ssl,
2416 const unsigned char *p,
2417 const unsigned char *end,
2418 size_t pms_offset )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002419{
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002420 int ret;
2421 size_t len = pk_get_len( ssl_own_key( ssl ) );
2422 unsigned char *pms = ssl->handshake->premaster + pms_offset;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002423
Manuel Pégourié-Gonnard834ea852013-09-23 14:46:13 +02002424 if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_RSA ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002425 {
Manuel Pégourié-Gonnarda2d3f222013-08-21 11:51:08 +02002426 SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002427 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2428 }
2429
2430 /*
2431 * Decrypt the premaster using own private RSA key
2432 */
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002433#if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
2434 defined(POLARSSL_SSL_PROTO_TLS1_2)
Paul Bakker70df2fb2013-04-17 17:19:09 +02002435 if( ssl->minor_ver != SSL_MINOR_VERSION_0 )
2436 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002437 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
2438 *p++ != ( ( len ) & 0xFF ) )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002439 {
2440 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2441 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2442 }
2443 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002444#endif
Paul Bakker70df2fb2013-04-17 17:19:09 +02002445
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002446 if( p + len != end )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002447 {
2448 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2449 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2450 }
2451
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002452 ret = pk_decrypt( ssl_own_key( ssl ), p, len,
2453 pms, &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard070cc7f2013-08-21 15:09:31 +02002454 sizeof(ssl->handshake->premaster),
2455 ssl->f_rng, ssl->p_rng );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002456
2457 if( ret != 0 || ssl->handshake->pmslen != 48 ||
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002458 pms[0] != ssl->handshake->max_major_ver ||
2459 pms[1] != ssl->handshake->max_minor_ver )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002460 {
2461 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2462
2463 /*
2464 * Protection against Bleichenbacher's attack:
2465 * invalid PKCS#1 v1.5 padding must not cause
2466 * the connection to end immediately; instead,
2467 * send a bad_record_mac later in the handshake.
2468 */
2469 ssl->handshake->pmslen = 48;
2470
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002471 ret = ssl->f_rng( ssl->p_rng, pms, ssl->handshake->pmslen );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002472 if( ret != 0 )
2473 return( ret );
2474 }
2475
2476 return( ret );
2477}
Manuel Pégourié-Gonnardbac0e3b2013-10-15 11:54:47 +02002478#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED ||
2479 POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker70df2fb2013-04-17 17:19:09 +02002480
Manuel Pégourié-Gonnard8a3c64d2013-10-14 19:54:10 +02002481#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002482static int ssl_parse_client_psk_identity( ssl_context *ssl, unsigned char **p,
2483 const unsigned char *end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002484{
Paul Bakker6db455e2013-09-18 17:29:31 +02002485 int ret = 0;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002486 size_t n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002487
Paul Bakker6db455e2013-09-18 17:29:31 +02002488 if( ssl->f_psk == NULL &&
2489 ( ssl->psk == NULL || ssl->psk_identity == NULL ||
2490 ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002491 {
2492 SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
2493 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2494 }
2495
2496 /*
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002497 * Receive client pre-shared key identity name
Paul Bakkerfbb17802013-04-17 19:10:21 +02002498 */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002499 if( *p + 2 > end )
2500 {
2501 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2502 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2503 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02002504
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002505 n = ( (*p)[0] << 8 ) | (*p)[1];
2506 *p += 2;
2507
2508 if( n < 1 || n > 65535 || *p + n > end )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002509 {
2510 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2511 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2512 }
2513
Paul Bakker6db455e2013-09-18 17:29:31 +02002514 if( ssl->f_psk != NULL )
2515 {
2516 if( ( ret != ssl->f_psk( ssl->p_psk, ssl, *p, n ) ) != 0 )
2517 ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
2518 }
2519
2520 if( ret == 0 )
2521 {
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01002522 /* Identity is not a big secret since clients send it in the clear,
2523 * but treat it carefully anyway, just in case */
Paul Bakker6db455e2013-09-18 17:29:31 +02002524 if( n != ssl->psk_identity_len ||
Manuel Pégourié-Gonnard31ff1d22013-10-28 13:46:11 +01002525 safer_memcmp( ssl->psk_identity, *p, n ) != 0 )
Paul Bakker6db455e2013-09-18 17:29:31 +02002526 {
2527 ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
2528 }
2529 }
2530
2531 if( ret == POLARSSL_ERR_SSL_UNKNOWN_IDENTITY )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002532 {
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002533 SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
Paul Bakker6db455e2013-09-18 17:29:31 +02002534 if( ( ret = ssl_send_alert_message( ssl,
2535 SSL_ALERT_LEVEL_FATAL,
2536 SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
2537 {
2538 return( ret );
2539 }
2540
2541 return( POLARSSL_ERR_SSL_UNKNOWN_IDENTITY );
Paul Bakkerfbb17802013-04-17 19:10:21 +02002542 }
2543
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002544 *p += n;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002545 ret = 0;
2546
Paul Bakkerfbb17802013-04-17 19:10:21 +02002547 return( ret );
2548}
Manuel Pégourié-Gonnard8a3c64d2013-10-14 19:54:10 +02002549#endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */
Paul Bakkerfbb17802013-04-17 19:10:21 +02002550
Paul Bakker5121ce52009-01-03 21:22:43 +00002551static int ssl_parse_client_key_exchange( ssl_context *ssl )
2552{
Paul Bakker23986e52011-04-24 08:57:21 +00002553 int ret;
Paul Bakker41c83d32013-03-20 14:39:14 +01002554 const ssl_ciphersuite_t *ciphersuite_info;
Paul Bakker70df2fb2013-04-17 17:19:09 +02002555
Paul Bakker41c83d32013-03-20 14:39:14 +01002556 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00002557
2558 SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
2559
2560 if( ( ret = ssl_read_record( ssl ) ) != 0 )
2561 {
2562 SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2563 return( ret );
2564 }
2565
2566 if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
2567 {
2568 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002569 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002570 }
2571
2572 if( ssl->in_msg[0] != SSL_HS_CLIENT_KEY_EXCHANGE )
2573 {
2574 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002575 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002576 }
2577
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002578#if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)
Paul Bakker41c83d32013-03-20 14:39:14 +01002579 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA )
Paul Bakker5121ce52009-01-03 21:22:43 +00002580 {
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002581 unsigned char *p = ssl->in_msg + 4;
2582 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2583
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002584 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002585 {
Paul Bakker70df2fb2013-04-17 17:19:09 +02002586 SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
2587 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002588 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002589
2590 ssl->handshake->pmslen = ssl->handshake->dhm_ctx.len;
2591
2592 if( ( ret = dhm_calc_secret( &ssl->handshake->dhm_ctx,
2593 ssl->handshake->premaster,
Manuel Pégourié-Gonnard2d627642013-09-04 14:22:07 +02002594 &ssl->handshake->pmslen,
Manuel Pégourié-Gonnard15d5de12013-09-17 11:34:11 +02002595 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002596 {
2597 SSL_DEBUG_RET( 1, "dhm_calc_secret", ret );
2598 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
2599 }
2600
2601 SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002602 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002603 else
2604#endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED */
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002605#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002606 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
2607 defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2608 defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002609 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002610 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
2611 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_RSA ||
2612 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
Paul Bakker70df2fb2013-04-17 17:19:09 +02002613 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002614 size_t n = ssl->in_msg[3];
2615
2616 if( n < 1 || n > mpi_size( &ssl->handshake->ecdh_ctx.grp.P ) * 2 + 2 ||
2617 n + 4 != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002618 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002619 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2620 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
Paul Bakker5121ce52009-01-03 21:22:43 +00002621 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002622
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002623 if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
2624 ssl->in_msg + 4, n ) ) != 0 )
2625 {
2626 SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
2627 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
2628 }
2629
2630 SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
2631
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002632 SSL_DEBUG_MSG( 0, ( "ECDH: id %d", ssl->handshake->ecdh_ctx.grp.id ) );
2633 SSL_DEBUG_ECP( 0, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
2634 SSL_DEBUG_MPI( 0, "ECDH: d ", &ssl->handshake->ecdh_ctx.d );
2635
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002636 if( ( ret = ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
2637 &ssl->handshake->pmslen,
2638 ssl->handshake->premaster,
Manuel Pégourié-Gonnarde09d2f82013-09-02 14:29:09 +02002639 POLARSSL_MPI_MAX_SIZE,
2640 ssl->f_rng, ssl->p_rng ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002641 {
2642 SSL_DEBUG_RET( 1, "ecdh_calc_secret", ret );
2643 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
2644 }
2645
2646 SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
Paul Bakker5121ce52009-01-03 21:22:43 +00002647 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002648 else
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002649#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
Manuel Pégourié-Gonnard55389702013-12-12 11:14:16 +01002650 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
2651 POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
2652 POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002653#if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)
2654 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002655 {
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002656 unsigned char *p = ssl->in_msg + 4;
2657 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2658
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002659 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
Paul Bakkerfbb17802013-04-17 19:10:21 +02002660 {
2661 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2662 return( ret );
2663 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002664
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002665 if( ( ret = ssl_psk_derive_premaster( ssl,
2666 ciphersuite_info->key_exchange ) ) != 0 )
2667 {
2668 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
2669 return( ret );
2670 }
Paul Bakkerfbb17802013-04-17 19:10:21 +02002671 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002672 else
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002673#endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002674#if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
2675 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
2676 {
2677 unsigned char *p = ssl->in_msg + 4;
2678 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2679
2680 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
2681 {
2682 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2683 return( ret );
2684 }
2685
2686 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
2687 {
2688 SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
2689 return( ret );
2690 }
2691
2692 if( ( ret = ssl_psk_derive_premaster( ssl,
2693 ciphersuite_info->key_exchange ) ) != 0 )
2694 {
2695 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
2696 return( ret );
2697 }
2698 }
2699 else
2700#endif /* POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002701#if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2702 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
2703 {
Manuel Pégourié-Gonnarda7496f02013-09-20 11:29:59 +02002704 unsigned char *p = ssl->in_msg + 4;
2705 unsigned char *end = ssl->in_msg + ssl->in_msglen;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002706
2707 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
2708 {
2709 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2710 return( ret );
2711 }
2712 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
2713 {
2714 SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
2715 return( ret );
2716 }
2717
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002718 if( ( ret = ssl_psk_derive_premaster( ssl,
2719 ciphersuite_info->key_exchange ) ) != 0 )
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002720 {
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002721 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
2722 return( ret );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002723 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002724 }
2725 else
2726#endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002727#if defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2728 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
2729 {
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002730 unsigned char *p = ssl->in_msg + 4;
2731 unsigned char *end = ssl->in_msg + ssl->in_msglen;
2732
2733 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
2734 {
2735 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
2736 return( ret );
2737 }
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002738
2739 if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
2740 p, end - p ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002741 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002742 SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
2743 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002744 }
2745
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002746 SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
2747
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002748 if( ( ret = ssl_psk_derive_premaster( ssl,
2749 ciphersuite_info->key_exchange ) ) != 0 )
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002750 {
Manuel Pégourié-Gonnardbd1ae242013-10-14 13:09:25 +02002751 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002752 return( ret );
2753 }
Manuel Pégourié-Gonnard3ce3bbd2013-10-11 16:53:50 +02002754 }
2755 else
2756#endif /* POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002757#if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)
2758 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA )
Paul Bakker41c83d32013-03-20 14:39:14 +01002759 {
Manuel Pégourié-Gonnard0fae60b2013-10-14 17:39:48 +02002760 if( ( ret = ssl_parse_encrypted_pms( ssl,
2761 ssl->in_msg + 4,
2762 ssl->in_msg + ssl->in_msglen,
2763 0 ) ) != 0 )
Paul Bakker41c83d32013-03-20 14:39:14 +01002764 {
Manuel Pégourié-Gonnardb59d6992013-10-14 12:00:45 +02002765 SSL_DEBUG_RET( 1, ( "ssl_parse_parse_ecrypted_pms_secret" ), ret );
Paul Bakker70df2fb2013-04-17 17:19:09 +02002766 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002767 }
2768 }
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002769 else
2770#endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */
2771 {
Manuel Pégourié-Gonnardabae74c2013-08-20 13:53:44 +02002772 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002773 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
2774 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002775
Paul Bakkerff60ee62010-03-16 21:09:09 +00002776 if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
2777 {
2778 SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
2779 return( ret );
2780 }
Paul Bakker5121ce52009-01-03 21:22:43 +00002781
Paul Bakker5121ce52009-01-03 21:22:43 +00002782 ssl->state++;
2783
2784 SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
2785
2786 return( 0 );
2787}
2788
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002789#if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \
2790 !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02002791 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
2792 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
Paul Bakker5121ce52009-01-03 21:22:43 +00002793static int ssl_parse_certificate_verify( ssl_context *ssl )
2794{
Paul Bakkered27a042013-04-18 22:46:23 +02002795 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
Paul Bakkerfbb17802013-04-17 19:10:21 +02002796 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
Paul Bakker5121ce52009-01-03 21:22:43 +00002797
2798 SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
2799
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002800 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01002801 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002802 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002803 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
Paul Bakkered27a042013-04-18 22:46:23 +02002804 {
2805 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
2806 ssl->state++;
2807 return( 0 );
2808 }
2809
Manuel Pégourié-Gonnarda3104592013-09-17 21:17:44 +02002810 SSL_DEBUG_MSG( 1, ( "should not happen" ) );
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002811 return( ret );
2812}
2813#else
2814static int ssl_parse_certificate_verify( ssl_context *ssl )
2815{
2816 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002817 size_t sa_len, sig_len;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002818 unsigned char hash[48];
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002819 unsigned char *hash_start = hash;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002820 size_t hashlen;
Paul Bakker577e0062013-08-28 11:57:20 +02002821#if defined(POLARSSL_SSL_PROTO_TLS1_2)
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002822 pk_type_t pk_alg;
Paul Bakker577e0062013-08-28 11:57:20 +02002823#endif
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002824 md_type_t md_alg;
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002825 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
2826
2827 SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
2828
2829 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
Manuel Pégourié-Gonnarddc953e82013-11-25 17:27:39 +01002830 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
Manuel Pégourié-Gonnard1b62c7f2013-10-14 14:02:19 +02002831 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002832 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
2833 {
2834 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
2835 ssl->state++;
2836 return( 0 );
2837 }
2838
Paul Bakkered27a042013-04-18 22:46:23 +02002839 if( ssl->session_negotiate->peer_cert == NULL )
Paul Bakker5121ce52009-01-03 21:22:43 +00002840 {
2841 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
2842 ssl->state++;
2843 return( 0 );
2844 }
2845
Paul Bakker48916f92012-09-16 19:57:18 +00002846 ssl->handshake->calc_verify( ssl, hash );
Paul Bakker5121ce52009-01-03 21:22:43 +00002847
2848 if( ( ret = ssl_read_record( ssl ) ) != 0 )
2849 {
2850 SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2851 return( ret );
2852 }
2853
2854 ssl->state++;
2855
2856 if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
2857 {
2858 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002859 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00002860 }
2861
2862 if( ssl->in_msg[0] != SSL_HS_CERTIFICATE_VERIFY )
2863 {
2864 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002865 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00002866 }
2867
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002868 /*
2869 * 0 . 0 handshake type
2870 * 1 . 3 handshake length
2871 * 4 . 5 sig alg (TLS 1.2 only)
2872 * 4+n . 5+n signature length (n = sa_len)
2873 * 6+n . 6+n+m signature (m = sig_len)
2874 */
Paul Bakker5121ce52009-01-03 21:22:43 +00002875
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002876#if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2877 defined(POLARSSL_SSL_PROTO_TLS1_1)
2878 if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
Paul Bakker926af752012-11-23 13:38:07 +01002879 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002880 sa_len = 0;
2881
Paul Bakkerc70b9822013-04-07 22:00:46 +02002882 md_alg = POLARSSL_MD_NONE;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002883 hashlen = 36;
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002884
2885 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
2886 if( pk_can_do( &ssl->session_negotiate->peer_cert->pk,
2887 POLARSSL_PK_ECDSA ) )
2888 {
2889 hash_start += 16;
2890 hashlen -= 16;
2891 md_alg = POLARSSL_MD_SHA1;
2892 }
Paul Bakker926af752012-11-23 13:38:07 +01002893 }
Paul Bakkerd2f068e2013-08-27 21:19:20 +02002894 else
2895#endif
Paul Bakker577e0062013-08-28 11:57:20 +02002896#if defined(POLARSSL_SSL_PROTO_TLS1_2)
2897 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02002898 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002899 sa_len = 2;
2900
Paul Bakker5121ce52009-01-03 21:22:43 +00002901 /*
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002902 * Hash
Paul Bakker5121ce52009-01-03 21:22:43 +00002903 */
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002904 if( ssl->in_msg[4] != ssl->handshake->verify_sig_alg )
Paul Bakker5121ce52009-01-03 21:22:43 +00002905 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002906 SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
2907 " for verify message" ) );
Paul Bakker926af752012-11-23 13:38:07 +01002908 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
2909 }
2910
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002911 md_alg = ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
Paul Bakker926af752012-11-23 13:38:07 +01002912
Manuel Pégourié-Gonnardbfe32ef2013-08-22 14:55:30 +02002913 /* Info from md_alg will be used instead */
2914 hashlen = 0;
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002915
2916 /*
2917 * Signature
2918 */
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002919 if( ( pk_alg = ssl_pk_alg_from_sig( ssl->in_msg[5] ) )
2920 == POLARSSL_PK_NONE )
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002921 {
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002922 SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
2923 " for verify message" ) );
2924 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002925 }
2926
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002927 /*
2928 * Check the certificate's key type matches the signature alg
2929 */
2930 if( ! pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
2931 {
2932 SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
2933 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
2934 }
Paul Bakker577e0062013-08-28 11:57:20 +02002935 }
2936 else
2937#endif /* POLARSSL_SSL_PROTO_TLS1_2 */
2938 {
2939 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02002940 return( POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE );
Manuel Pégourié-Gonnardb3d91872013-08-14 15:56:19 +02002941 }
Manuel Pégourié-Gonnardff56da32013-07-11 10:46:21 +02002942
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002943 sig_len = ( ssl->in_msg[4 + sa_len] << 8 ) | ssl->in_msg[5 + sa_len];
Paul Bakker926af752012-11-23 13:38:07 +01002944
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002945 if( sa_len + sig_len + 6 != ssl->in_hslen )
Paul Bakker5121ce52009-01-03 21:22:43 +00002946 {
2947 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
Paul Bakker40e46942009-01-03 21:51:57 +00002948 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
Paul Bakker5121ce52009-01-03 21:22:43 +00002949 }
2950
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002951 if( ( ret = pk_verify( &ssl->session_negotiate->peer_cert->pk,
Manuel Pégourié-Gonnard4bd12842013-08-27 13:31:28 +02002952 md_alg, hash_start, hashlen,
Manuel Pégourié-Gonnarda20c58c2013-08-22 13:52:48 +02002953 ssl->in_msg + 6 + sa_len, sig_len ) ) != 0 )
Paul Bakker5121ce52009-01-03 21:22:43 +00002954 {
Manuel Pégourié-Gonnard0b032002013-08-17 13:01:41 +02002955 SSL_DEBUG_RET( 1, "pk_verify", ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002956 return( ret );
2957 }
2958
2959 SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
2960
Paul Bakkered27a042013-04-18 22:46:23 +02002961 return( ret );
Paul Bakker5121ce52009-01-03 21:22:43 +00002962}
Paul Bakker48f7a5d2013-04-19 14:30:58 +02002963#endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
2964 !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
2965 !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
Paul Bakker5121ce52009-01-03 21:22:43 +00002966
Paul Bakkera503a632013-08-14 13:48:06 +02002967#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002968static int ssl_write_new_session_ticket( ssl_context *ssl )
2969{
2970 int ret;
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02002971 size_t tlen;
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002972 uint32_t lifetime = (uint32_t) ssl->ticket_lifetime;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002973
2974 SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
2975
2976 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2977 ssl->out_msg[0] = SSL_HS_NEW_SESSION_TICKET;
2978
2979 /*
2980 * struct {
2981 * uint32 ticket_lifetime_hint;
2982 * opaque ticket<0..2^16-1>;
2983 * } NewSessionTicket;
2984 *
2985 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
2986 * 8 . 9 ticket_len (n)
2987 * 10 . 9+n ticket content
2988 */
Manuel Pégourié-Gonnard164d8942013-09-23 22:01:39 +02002989
2990 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
2991 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
2992 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
2993 ssl->out_msg[7] = ( lifetime ) & 0xFF;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02002994
Manuel Pégourié-Gonnard990c51a2013-08-03 15:37:58 +02002995 if( ( ret = ssl_write_ticket( ssl, &tlen ) ) != 0 )
2996 {
2997 SSL_DEBUG_RET( 1, "ssl_write_ticket", ret );
2998 tlen = 0;
2999 }
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003000
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003001 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
3002 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003003
Manuel Pégourié-Gonnard609bc812013-08-01 15:08:40 +02003004 ssl->out_msglen = 10 + tlen;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003005
3006 if( ( ret = ssl_write_record( ssl ) ) != 0 )
3007 {
3008 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
3009 return( ret );
3010 }
3011
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003012 /* No need to remember writing a NewSessionTicket any more */
3013 ssl->handshake->new_session_ticket = 0;
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003014
3015 SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
3016
3017 return( 0 );
3018}
Paul Bakkera503a632013-08-14 13:48:06 +02003019#endif /* POLARSSL_SSL_SESSION_TICKETS */
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003020
Paul Bakker5121ce52009-01-03 21:22:43 +00003021/*
Paul Bakker1961b702013-01-25 14:49:24 +01003022 * SSL handshake -- server side -- single step
Paul Bakker5121ce52009-01-03 21:22:43 +00003023 */
Paul Bakker1961b702013-01-25 14:49:24 +01003024int ssl_handshake_server_step( ssl_context *ssl )
Paul Bakker5121ce52009-01-03 21:22:43 +00003025{
3026 int ret = 0;
3027
Paul Bakker1961b702013-01-25 14:49:24 +01003028 if( ssl->state == SSL_HANDSHAKE_OVER )
3029 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003030
Paul Bakker1961b702013-01-25 14:49:24 +01003031 SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
3032
3033 if( ( ret = ssl_flush_output( ssl ) ) != 0 )
3034 return( ret );
3035
3036 switch( ssl->state )
Paul Bakker5121ce52009-01-03 21:22:43 +00003037 {
Paul Bakker1961b702013-01-25 14:49:24 +01003038 case SSL_HELLO_REQUEST:
3039 ssl->state = SSL_CLIENT_HELLO;
Paul Bakker5121ce52009-01-03 21:22:43 +00003040 break;
3041
Paul Bakker1961b702013-01-25 14:49:24 +01003042 /*
3043 * <== ClientHello
3044 */
3045 case SSL_CLIENT_HELLO:
3046 ret = ssl_parse_client_hello( ssl );
Paul Bakker5121ce52009-01-03 21:22:43 +00003047 break;
Paul Bakker1961b702013-01-25 14:49:24 +01003048
3049 /*
3050 * ==> ServerHello
3051 * Certificate
3052 * ( ServerKeyExchange )
3053 * ( CertificateRequest )
3054 * ServerHelloDone
3055 */
3056 case SSL_SERVER_HELLO:
3057 ret = ssl_write_server_hello( ssl );
3058 break;
3059
3060 case SSL_SERVER_CERTIFICATE:
3061 ret = ssl_write_certificate( ssl );
3062 break;
3063
3064 case SSL_SERVER_KEY_EXCHANGE:
3065 ret = ssl_write_server_key_exchange( ssl );
3066 break;
3067
3068 case SSL_CERTIFICATE_REQUEST:
3069 ret = ssl_write_certificate_request( ssl );
3070 break;
3071
3072 case SSL_SERVER_HELLO_DONE:
3073 ret = ssl_write_server_hello_done( ssl );
3074 break;
3075
3076 /*
3077 * <== ( Certificate/Alert )
3078 * ClientKeyExchange
3079 * ( CertificateVerify )
3080 * ChangeCipherSpec
3081 * Finished
3082 */
3083 case SSL_CLIENT_CERTIFICATE:
3084 ret = ssl_parse_certificate( ssl );
3085 break;
3086
3087 case SSL_CLIENT_KEY_EXCHANGE:
3088 ret = ssl_parse_client_key_exchange( ssl );
3089 break;
3090
3091 case SSL_CERTIFICATE_VERIFY:
3092 ret = ssl_parse_certificate_verify( ssl );
3093 break;
3094
3095 case SSL_CLIENT_CHANGE_CIPHER_SPEC:
3096 ret = ssl_parse_change_cipher_spec( ssl );
3097 break;
3098
3099 case SSL_CLIENT_FINISHED:
3100 ret = ssl_parse_finished( ssl );
3101 break;
3102
3103 /*
Manuel Pégourié-Gonnard7a358b82013-08-01 11:47:56 +02003104 * ==> ( NewSessionTicket )
3105 * ChangeCipherSpec
Paul Bakker1961b702013-01-25 14:49:24 +01003106 * Finished
3107 */
3108 case SSL_SERVER_CHANGE_CIPHER_SPEC:
Paul Bakkera503a632013-08-14 13:48:06 +02003109#if defined(POLARSSL_SSL_SESSION_TICKETS)
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003110 if( ssl->handshake->new_session_ticket != 0 )
3111 ret = ssl_write_new_session_ticket( ssl );
3112 else
Paul Bakkera503a632013-08-14 13:48:06 +02003113#endif
Manuel Pégourié-Gonnard7cd59242013-08-02 13:24:41 +02003114 ret = ssl_write_change_cipher_spec( ssl );
Paul Bakker1961b702013-01-25 14:49:24 +01003115 break;
3116
3117 case SSL_SERVER_FINISHED:
3118 ret = ssl_write_finished( ssl );
3119 break;
3120
3121 case SSL_FLUSH_BUFFERS:
3122 SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3123 ssl->state = SSL_HANDSHAKE_WRAPUP;
3124 break;
3125
3126 case SSL_HANDSHAKE_WRAPUP:
3127 ssl_handshake_wrapup( ssl );
3128 break;
3129
3130 default:
3131 SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3132 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
Paul Bakker5121ce52009-01-03 21:22:43 +00003133 }
3134
Paul Bakker5121ce52009-01-03 21:22:43 +00003135 return( ret );
3136}
Paul Bakker5121ce52009-01-03 21:22:43 +00003137#endif