?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
fuck! don't perform ssl handshake for blocked hosts!
[mediator.git] / src / libpolarssl / ssl_srv.c
blob5f01a01bcf00b99f77e9092a0482fb162675eb2a
1 /*
2 * SSLv3/TLSv1 server-side functions
3 *
4 * Copyright (C) 2006-2014, ARM Limited, All Rights Reserved
5 *
6 * This file is part of mbed TLS (https://tls.mbed.org)
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21 */
22
23 #if !defined(POLARSSL_CONFIG_FILE)
24 #include "polarssl/config.h"
25 #else
26 #include POLARSSL_CONFIG_FILE
27 #endif
28
29 #if defined(POLARSSL_SSL_SRV_C)
30
31 #include "polarssl/debug.h"
32 #include "polarssl/ssl.h"
33
34 #include <string.h>
35
36 #if defined(POLARSSL_ECP_C)
37 #include "polarssl/ecp.h"
38 #endif
39
40 #if defined(POLARSSL_PLATFORM_C)
41 #include "polarssl/platform.h"
42 #else
43 #include <stdlib.h>
44 #define polarssl_malloc malloc
45 #define polarssl_free free
46 #endif
47
48 #if defined(POLARSSL_HAVE_TIME)
49 #include <time.h>
50 #endif
51
52 #if defined(POLARSSL_SSL_SESSION_TICKETS)
53 /* Implementation that should never be optimized out by the compiler */
54 static void polarssl_zeroize( void *v, size_t n ) {
55 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
56 }
57
58 /*
59 * Serialize a session in the following format:
60 * 0 . n-1 session structure, n = sizeof(ssl_session)
61 * n . n+2 peer_cert length = m (0 if no certificate)
62 * n+3 . n+2+m peer cert ASN.1
63 *
64 * Assumes ticket is NULL (always true on server side).
65 */
66 static int ssl_save_session( const ssl_session *session,
67 unsigned char *buf, size_t buf_len,
68 size_t *olen )
69 {
70 unsigned char *p = buf;
71 size_t left = buf_len;
72 #if defined(POLARSSL_X509_CRT_PARSE_C)
73 size_t cert_len;
74 #endif /* POLARSSL_X509_CRT_PARSE_C */
75
76 if( left < sizeof( ssl_session ) )
77 return( -1 );
78
79 memcpy( p, session, sizeof( ssl_session ) );
80 p += sizeof( ssl_session );
81 left -= sizeof( ssl_session );
82
83 #if defined(POLARSSL_X509_CRT_PARSE_C)
84 if( session->peer_cert == NULL )
85 cert_len = 0;
86 else
87 cert_len = session->peer_cert->raw.len;
88
89 if( left < 3 + cert_len )
90 return( -1 );
91
92 *p++ = (unsigned char)( cert_len >> 16 & 0xFF );
93 *p++ = (unsigned char)( cert_len >> 8 & 0xFF );
94 *p++ = (unsigned char)( cert_len & 0xFF );
95
96 if( session->peer_cert != NULL )
97 memcpy( p, session->peer_cert->raw.p, cert_len );
98
99 p += cert_len;
100 #endif /* POLARSSL_X509_CRT_PARSE_C */
101
102 *olen = p - buf;
103
104 return( 0 );
105 }
106
107 /*
108 * Unserialise session, see ssl_save_session()
109 */
110 static int ssl_load_session( ssl_session *session,
111 const unsigned char *buf, size_t len )
112 {
113 const unsigned char *p = buf;
114 const unsigned char * const end = buf + len;
115 #if defined(POLARSSL_X509_CRT_PARSE_C)
116 size_t cert_len;
117 #endif /* POLARSSL_X509_CRT_PARSE_C */
118
119 if( p + sizeof( ssl_session ) > end )
120 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
121
122 memcpy( session, p, sizeof( ssl_session ) );
123 p += sizeof( ssl_session );
124
125 #if defined(POLARSSL_X509_CRT_PARSE_C)
126 if( p + 3 > end )
127 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
128
129 cert_len = ( p[0] << 16 ) | ( p[1] << 8 ) | p[2];
130 p += 3;
131
132 if( cert_len == 0 )
133 {
134 session->peer_cert = NULL;
135 }
136 else
137 {
138 int ret;
139
140 if( p + cert_len > end )
141 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
142
143 session->peer_cert = polarssl_malloc( sizeof( x509_crt ) );
144
145 if( session->peer_cert == NULL )
146 return( POLARSSL_ERR_SSL_MALLOC_FAILED );
147
148 x509_crt_init( session->peer_cert );
149
150 if( ( ret = x509_crt_parse_der( session->peer_cert,
151 p, cert_len ) ) != 0 )
152 {
153 x509_crt_free( session->peer_cert );
154 polarssl_free( session->peer_cert );
155 session->peer_cert = NULL;
156 return( ret );
157 }
158
159 p += cert_len;
160 }
161 #endif /* POLARSSL_X509_CRT_PARSE_C */
162
163 if( p != end )
164 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
165
166 return( 0 );
167 }
168
169 /*
170 * Create session ticket, secured as recommended in RFC 5077 section 4:
171 *
172 * struct {
173 * opaque key_name[16];
174 * opaque iv[16];
175 * opaque encrypted_state<0..2^16-1>;
176 * opaque mac[32];
177 * } ticket;
178 *
179 * (the internal state structure differs, however).
180 */
181 static int ssl_write_ticket( ssl_context *ssl, size_t *tlen )
182 {
183 int ret;
184 unsigned char * const start = ssl->out_msg + 10;
185 unsigned char *p = start;
186 unsigned char *state;
187 unsigned char iv[16];
188 size_t clear_len, enc_len, pad_len, i;
189
190 *tlen = 0;
191
192 if( ssl->ticket_keys == NULL )
193 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
194
195 /* Write key name */
196 memcpy( p, ssl->ticket_keys->key_name, 16 );
197 p += 16;
198
199 /* Generate and write IV (with a copy for aes_crypt) */
200 if( ( ret = ssl->f_rng( ssl->p_rng, p, 16 ) ) != 0 )
201 return( ret );
202 memcpy( iv, p, 16 );
203 p += 16;
204
205 /*
206 * Dump session state
207 *
208 * After the session state itself, we still need room for 16 bytes of
209 * padding and 32 bytes of MAC, so there's only so much room left
210 */
211 state = p + 2;
212 if( ssl_save_session( ssl->session_negotiate, state,
213 SSL_MAX_CONTENT_LEN - ( state - ssl->out_ctr ) - 48,
214 &clear_len ) != 0 )
215 {
216 return( POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE );
217 }
218 SSL_DEBUG_BUF( 3, "session ticket cleartext", state, clear_len );
219
220 /* Apply PKCS padding */
221 pad_len = 16 - clear_len % 16;
222 enc_len = clear_len + pad_len;
223 for( i = clear_len; i < enc_len; i++ )
224 state[i] = (unsigned char) pad_len;
225
226 /* Encrypt */
227 if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->enc, AES_ENCRYPT,
228 enc_len, iv, state, state ) ) != 0 )
229 {
230 return( ret );
231 }
232
233 /* Write length */
234 *p++ = (unsigned char)( ( enc_len >> 8 ) & 0xFF );
235 *p++ = (unsigned char)( ( enc_len ) & 0xFF );
236 p = state + enc_len;
237
238 /* Compute and write MAC( key_name + iv + enc_state_len + enc_state ) */
239 sha256_hmac( ssl->ticket_keys->mac_key, 16, start, p - start, p, 0 );
240 p += 32;
241
242 *tlen = p - start;
243
244 SSL_DEBUG_BUF( 3, "session ticket structure", start, *tlen );
245
246 return( 0 );
247 }
248
249 /*
250 * Load session ticket (see ssl_write_ticket for structure)
251 */
252 static int ssl_parse_ticket( ssl_context *ssl,
253 unsigned char *buf,
254 size_t len )
255 {
256 int ret;
257 ssl_session session;
258 unsigned char *key_name = buf;
259 unsigned char *iv = buf + 16;
260 unsigned char *enc_len_p = iv + 16;
261 unsigned char *ticket = enc_len_p + 2;
262 unsigned char *mac;
263 unsigned char computed_mac[32];
264 size_t enc_len, clear_len, i;
265 unsigned char pad_len, diff;
266
267 SSL_DEBUG_BUF( 3, "session ticket structure", buf, len );
268
269 if( len < 34 || ssl->ticket_keys == NULL )
270 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
271
272 enc_len = ( enc_len_p[0] << 8 ) | enc_len_p[1];
273 mac = ticket + enc_len;
274
275 if( len != enc_len + 66 )
276 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
277
278 /* Check name, in constant time though it's not a big secret */
279 diff = 0;
280 for( i = 0; i < 16; i++ )
281 diff |= key_name[i] ^ ssl->ticket_keys->key_name[i];
282 /* don't return yet, check the MAC anyway */
283
284 /* Check mac, with constant-time buffer comparison */
285 sha256_hmac( ssl->ticket_keys->mac_key, 16, buf, len - 32,
286 computed_mac, 0 );
287
288 for( i = 0; i < 32; i++ )
289 diff |= mac[i] ^ computed_mac[i];
290
291 /* Now return if ticket is not authentic, since we want to avoid
292 * decrypting arbitrary attacker-chosen data */
293 if( diff != 0 )
294 return( POLARSSL_ERR_SSL_INVALID_MAC );
295
296 /* Decrypt */
297 if( ( ret = aes_crypt_cbc( &ssl->ticket_keys->dec, AES_DECRYPT,
298 enc_len, iv, ticket, ticket ) ) != 0 )
299 {
300 return( ret );
301 }
302
303 /* Check PKCS padding */
304 pad_len = ticket[enc_len - 1];
305
306 ret = 0;
307 for( i = 2; i < pad_len; i++ )
308 if( ticket[enc_len - i] != pad_len )
309 ret = POLARSSL_ERR_SSL_BAD_INPUT_DATA;
310 if( ret != 0 )
311 return( ret );
312
313 clear_len = enc_len - pad_len;
314
315 SSL_DEBUG_BUF( 3, "session ticket cleartext", ticket, clear_len );
316
317 /* Actually load session */
318 if( ( ret = ssl_load_session( &session, ticket, clear_len ) ) != 0 )
319 {
320 SSL_DEBUG_MSG( 1, ( "failed to parse ticket content" ) );
321 ssl_session_free( &session );
322 return( ret );
323 }
324
325 #if defined(POLARSSL_HAVE_TIME)
326 /* Check if still valid */
327 if( (int) ( time( NULL) - session.start ) > ssl->ticket_lifetime )
328 {
329 SSL_DEBUG_MSG( 1, ( "session ticket expired" ) );
330 ssl_session_free( &session );
331 return( POLARSSL_ERR_SSL_SESSION_TICKET_EXPIRED );
332 }
333 #endif
334
335 /*
336 * Keep the session ID sent by the client, since we MUST send it back to
337 * inform him we're accepting the ticket (RFC 5077 section 3.4)
338 */
339 session.length = ssl->session_negotiate->length;
340 memcpy( &session.id, ssl->session_negotiate->id, session.length );
341
342 ssl_session_free( ssl->session_negotiate );
343 memcpy( ssl->session_negotiate, &session, sizeof( ssl_session ) );
344
345 /* Zeroize instead of free as we copied the content */
346 polarssl_zeroize( &session, sizeof( ssl_session ) );
347
348 return( 0 );
349 }
350 #endif /* POLARSSL_SSL_SESSION_TICKETS */
351
352 #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
353 /*
354 * Wrapper around f_sni, allowing use of ssl_set_own_cert() but
355 * making it act on ssl->hanshake->sni_key_cert instead.
356 */
357 static int ssl_sni_wrapper( ssl_context *ssl,
358 const unsigned char* name, size_t len )
359 {
360 int ret;
361 ssl_key_cert *key_cert_ori = ssl->key_cert;
362
363 ssl->key_cert = NULL;
364 ret = ssl->f_sni( ssl->p_sni, ssl, name, len );
365 ssl->handshake->sni_key_cert = ssl->key_cert;
366
367 ssl->key_cert = key_cert_ori;
368
369 return( ret );
370 }
371
372 static int ssl_parse_servername_ext( ssl_context *ssl,
373 const unsigned char *buf,
374 size_t len )
375 {
376 int ret;
377 size_t servername_list_size, hostname_len;
378 const unsigned char *p;
379
380 SSL_DEBUG_MSG( 3, ( "parse ServerName extension" ) );
381
382 servername_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
383 if( servername_list_size + 2 != len )
384 {
385 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
386 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
387 }
388
389 p = buf + 2;
390 while( servername_list_size > 0 )
391 {
392 hostname_len = ( ( p[1] << 8 ) | p[2] );
393 if( hostname_len + 3 > servername_list_size )
394 {
395 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
396 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
397 }
398
399 if( p[0] == TLS_EXT_SERVERNAME_HOSTNAME )
400 {
401 ret = ssl_sni_wrapper( ssl, p + 3, hostname_len );
402 if( ret != 0 )
403 {
404 SSL_DEBUG_RET( 1, "ssl_sni_wrapper", ret );
405 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
406 SSL_ALERT_MSG_UNRECOGNIZED_NAME );
407 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
408 }
409 return( 0 );
410 }
411
412 servername_list_size -= hostname_len + 3;
413 p += hostname_len + 3;
414 }
415
416 if( servername_list_size != 0 )
417 {
418 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
419 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
420 }
421
422 return( 0 );
423 }
424 #endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
425
426 static int ssl_parse_renegotiation_info( ssl_context *ssl,
427 const unsigned char *buf,
428 size_t len )
429 {
430 int ret;
431
432 #if defined(POLARSSL_SSL_RENEGOTIATION)
433 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
434 {
435 /* Check verify-data in constant-time. The length OTOH is no secret */
436 if( len != 1 + ssl->verify_data_len ||
437 buf[0] != ssl->verify_data_len ||
438 safer_memcmp( buf + 1, ssl->peer_verify_data,
439 ssl->verify_data_len ) != 0 )
440 {
441 SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
442
443 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
444 return( ret );
445
446 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
447 }
448 }
449 else
450 #endif /* POLARSSL_SSL_RENEGOTIATION */
451 {
452 if( len != 1 || buf[0] != 0x0 )
453 {
454 SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
455
456 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
457 return( ret );
458
459 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
460 }
461
462 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
463 }
464
465 return( 0 );
466 }
467
468 #if defined(POLARSSL_SSL_PROTO_TLS1_2) && \
469 defined(POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED)
470 static int ssl_parse_signature_algorithms_ext( ssl_context *ssl,
471 const unsigned char *buf,
472 size_t len )
473 {
474 size_t sig_alg_list_size;
475 const unsigned char *p;
476 const unsigned char *end = buf + len;
477 const int *md_cur;
478
479
480 sig_alg_list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
481 if( sig_alg_list_size + 2 != len ||
482 sig_alg_list_size % 2 != 0 )
483 {
484 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
485 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
486 }
487
488 /*
489 * For now, ignore the SignatureAlgorithm part and rely on offered
490 * ciphersuites only for that part. To be fixed later.
491 *
492 * So, just look at the HashAlgorithm part.
493 */
494 for( md_cur = md_list(); *md_cur != POLARSSL_MD_NONE; md_cur++ ) {
495 for( p = buf + 2; p < end; p += 2 ) {
496 if( *md_cur == (int) ssl_md_alg_from_hash( p[0] ) ) {
497 ssl->handshake->sig_alg = p[0];
498 goto have_sig_alg;
499 }
500 }
501 }
502
503 /* Some key echanges do not need signatures at all */
504 SSL_DEBUG_MSG( 3, ( "no signature_algorithm in common" ) );
505 return( 0 );
506
507 have_sig_alg:
508 SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: %d",
509 ssl->handshake->sig_alg ) );
510
511 return( 0 );
512 }
513 #endif /* POLARSSL_SSL_PROTO_TLS1_2 &&
514 POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED */
515
516 #if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
517 static int ssl_parse_supported_elliptic_curves( ssl_context *ssl,
518 const unsigned char *buf,
519 size_t len )
520 {
521 size_t list_size, our_size;
522 const unsigned char *p;
523 const ecp_curve_info *curve_info, **curves;
524
525 list_size = ( ( buf[0] << 8 ) | ( buf[1] ) );
526 if( list_size + 2 != len ||
527 list_size % 2 != 0 )
528 {
529 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
530 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
531 }
532
533 /* Should never happen unless client duplicates the extension */
534 if( ssl->handshake->curves != NULL )
535 {
536 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
537 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
538 }
539
540 /* Don't allow our peer to make us allocate too much memory,
541 * and leave room for a final 0 */
542 our_size = list_size / 2 + 1;
543 if( our_size > POLARSSL_ECP_DP_MAX )
544 our_size = POLARSSL_ECP_DP_MAX;
545
546 if( ( curves = polarssl_malloc( our_size * sizeof( *curves ) ) ) == NULL )
547 return( POLARSSL_ERR_SSL_MALLOC_FAILED );
548
549 /* explicit void pointer cast for buggy MS compiler */
550 memset( (void *) curves, 0, our_size * sizeof( *curves ) );
551 ssl->handshake->curves = curves;
552
553 p = buf + 2;
554 while( list_size > 0 && our_size > 1 )
555 {
556 curve_info = ecp_curve_info_from_tls_id( ( p[0] << 8 ) | p[1] );
557
558 if( curve_info != NULL )
559 {
560 *curves++ = curve_info;
561 our_size--;
562 }
563
564 list_size -= 2;
565 p += 2;
566 }
567
568 return( 0 );
569 }
570
571 static int ssl_parse_supported_point_formats( ssl_context *ssl,
572 const unsigned char *buf,
573 size_t len )
574 {
575 size_t list_size;
576 const unsigned char *p;
577
578 list_size = buf[0];
579 if( list_size + 1 != len )
580 {
581 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
582 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
583 }
584
585 p = buf + 2;
586 while( list_size > 0 )
587 {
588 if( p[0] == POLARSSL_ECP_PF_UNCOMPRESSED ||
589 p[0] == POLARSSL_ECP_PF_COMPRESSED )
590 {
591 ssl->handshake->ecdh_ctx.point_format = p[0];
592 SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
593 return( 0 );
594 }
595
596 list_size--;
597 p++;
598 }
599
600 return( 0 );
601 }
602 #endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
603
604 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
605 static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
606 const unsigned char *buf,
607 size_t len )
608 {
609 if( len != 1 || buf[0] >= SSL_MAX_FRAG_LEN_INVALID )
610 {
611 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
612 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
613 }
614
615 ssl->session_negotiate->mfl_code = buf[0];
616
617 return( 0 );
618 }
619 #endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
620
621 #if defined(POLARSSL_SSL_TRUNCATED_HMAC)
622 static int ssl_parse_truncated_hmac_ext( ssl_context *ssl,
623 const unsigned char *buf,
624 size_t len )
625 {
626 if( len != 0 )
627 {
628 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
629 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
630 }
631
632 ((void) buf);
633
634 if( ssl->trunc_hmac == SSL_TRUNC_HMAC_ENABLED )
635 ssl->session_negotiate->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
636
637 return( 0 );
638 }
639 #endif /* POLARSSL_SSL_TRUNCATED_HMAC */
640
641 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
642 static int ssl_parse_encrypt_then_mac_ext( ssl_context *ssl,
643 const unsigned char *buf,
644 size_t len )
645 {
646 if( len != 0 )
647 {
648 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
649 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
650 }
651
652 ((void) buf);
653
654 if( ssl->encrypt_then_mac == SSL_ETM_ENABLED &&
655 ssl->minor_ver != SSL_MINOR_VERSION_0 )
656 {
657 ssl->session_negotiate->encrypt_then_mac = SSL_ETM_ENABLED;
658 }
659
660 return( 0 );
661 }
662 #endif /* POLARSSL_SSL_ENCRYPT_THEN_MAC */
663
664 #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
665 static int ssl_parse_extended_ms_ext( ssl_context *ssl,
666 const unsigned char *buf,
667 size_t len )
668 {
669 if( len != 0 )
670 {
671 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
672 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
673 }
674
675 ((void) buf);
676
677 if( ssl->extended_ms == SSL_EXTENDED_MS_ENABLED &&
678 ssl->minor_ver != SSL_MINOR_VERSION_0 )
679 {
680 ssl->handshake->extended_ms = SSL_EXTENDED_MS_ENABLED;
681 }
682
683 return( 0 );
684 }
685 #endif /* POLARSSL_SSL_EXTENDED_MASTER_SECRET */
686
687 #if defined(POLARSSL_SSL_SESSION_TICKETS)
688 static int ssl_parse_session_ticket_ext( ssl_context *ssl,
689 unsigned char *buf,
690 size_t len )
691 {
692 int ret;
693
694 if( ssl->session_tickets == SSL_SESSION_TICKETS_DISABLED )
695 return( 0 );
696
697 /* Remember the client asked us to send a new ticket */
698 ssl->handshake->new_session_ticket = 1;
699
700 SSL_DEBUG_MSG( 3, ( "ticket length: %d", len ) );
701
702 if( len == 0 )
703 return( 0 );
704
705 #if defined(POLARSSL_SSL_RENEGOTIATION)
706 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
707 {
708 SSL_DEBUG_MSG( 3, ( "ticket rejected: renegotiating" ) );
709 return( 0 );
710 }
711 #endif /* POLARSSL_SSL_RENEGOTIATION */
712
713 /*
714 * Failures are ok: just ignore the ticket and proceed.
715 */
716 if( ( ret = ssl_parse_ticket( ssl, buf, len ) ) != 0 )
717 {
718 SSL_DEBUG_RET( 1, "ssl_parse_ticket", ret );
719 return( 0 );
720 }
721
722 SSL_DEBUG_MSG( 3, ( "session successfully restored from ticket" ) );
723
724 ssl->handshake->resume = 1;
725
726 /* Don't send a new ticket after all, this one is OK */
727 ssl->handshake->new_session_ticket = 0;
728
729 return( 0 );
730 }
731 #endif /* POLARSSL_SSL_SESSION_TICKETS */
732
733 #if defined(POLARSSL_SSL_ALPN)
734 static int ssl_parse_alpn_ext( ssl_context *ssl,
735 const unsigned char *buf, size_t len )
736 {
737 size_t list_len, cur_len, ours_len;
738 const unsigned char *theirs, *start, *end;
739 const char **ours;
740
741 /* If ALPN not configured, just ignore the extension */
742 if( ssl->alpn_list == NULL )
743 return( 0 );
744
745 /*
746 * opaque ProtocolName<1..2^8-1>;
747 *
748 * struct {
749 * ProtocolName protocol_name_list<2..2^16-1>
750 * } ProtocolNameList;
751 */
752
753 /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
754 if( len < 4 )
755 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
756
757 list_len = ( buf[0] << 8 ) | buf[1];
758 if( list_len != len - 2 )
759 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
760
761 /*
762 * Use our order of preference
763 */
764 start = buf + 2;
765 end = buf + len;
766 for( ours = ssl->alpn_list; *ours != NULL; ours++ )
767 {
768 ours_len = strlen( *ours );
769 for( theirs = start; theirs != end; theirs += cur_len )
770 {
771 /* If the list is well formed, we should get equality first */
772 if( theirs > end )
773 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
774
775 cur_len = *theirs++;
776
777 /* Empty strings MUST NOT be included */
778 if( cur_len == 0 )
779 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
780
781 if( cur_len == ours_len &&
782 memcmp( theirs, *ours, cur_len ) == 0 )
783 {
784 ssl->alpn_chosen = *ours;
785 return( 0 );
786 }
787 }
788 }
789
790 /* If we get there, no match was found */
791 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
792 SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL );
793 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
794 }
795 #endif /* POLARSSL_SSL_ALPN */
796
797 /*
798 * Auxiliary functions for ServerHello parsing and related actions
799 */
800
801 #if defined(POLARSSL_X509_CRT_PARSE_C)
802 /*
803 * Return 0 if the given key uses one of the acceptable curves, -1 otherwise
804 */
805 #if defined(POLARSSL_ECDSA_C)
806 static int ssl_check_key_curve( pk_context *pk,
807 const ecp_curve_info **curves )
808 {
809 const ecp_curve_info **crv = curves;
810 ecp_group_id grp_id = pk_ec( *pk )->grp.id;
811
812 while( *crv != NULL )
813 {
814 if( (*crv)->grp_id == grp_id )
815 return( 0 );
816 crv++;
817 }
818
819 return( -1 );
820 }
821 #endif /* POLARSSL_ECDSA_C */
822
823 /*
824 * Try picking a certificate for this ciphersuite,
825 * return 0 on success and -1 on failure.
826 */
827 static int ssl_pick_cert( ssl_context *ssl,
828 const ssl_ciphersuite_t * ciphersuite_info )
829 {
830 ssl_key_cert *cur, *list, *fallback = NULL;
831 pk_type_t pk_alg = ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
832 int flags;
833
834 #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
835 if( ssl->handshake->sni_key_cert != NULL )
836 list = ssl->handshake->sni_key_cert;
837 else
838 #endif
839 list = ssl->handshake->key_cert;
840
841 if( pk_alg == POLARSSL_PK_NONE )
842 return( 0 );
843
844 SSL_DEBUG_MSG( 3, ( "ciphersuite requires certificate" ) );
845
846 for( cur = list; cur != NULL; cur = cur->next )
847 {
848 SSL_DEBUG_CRT( 3, "candidate certificate chain, certificate",
849 cur->cert );
850
851 if( ! pk_can_do( cur->key, pk_alg ) )
852 {
853 SSL_DEBUG_MSG( 3, ( "certificate mismatch: key type" ) );
854 continue;
855 }
856
857 /*
858 * This avoids sending the client a cert it'll reject based on
859 * keyUsage or other extensions.
860 *
861 * It also allows the user to provision different certificates for
862 * different uses based on keyUsage, eg if they want to avoid signing
863 * and decrypting with the same RSA key.
864 */
865 if( ssl_check_cert_usage( cur->cert, ciphersuite_info,
866 SSL_IS_SERVER, &flags ) != 0 )
867 {
868 SSL_DEBUG_MSG( 3, ( "certificate mismatch: "
869 "(extended) key usage extension" ) );
870 continue;
871 }
872
873 #if defined(POLARSSL_ECDSA_C)
874 if( pk_alg == POLARSSL_PK_ECDSA &&
875 ssl_check_key_curve( cur->key, ssl->handshake->curves ) != 0 )
876 {
877 SSL_DEBUG_MSG( 3, ( "certificate mismatch: elliptic curve" ) );
878 continue;
879 }
880 #endif
881
882 /*
883 * Try to select a SHA-1 certificate for pre-1.2 clients, but still
884 * present them a SHA-higher cert rather than failing if it's the only
885 * one we got that satisfies the other conditions.
886 */
887 if( ssl->minor_ver < SSL_MINOR_VERSION_3 &&
888 cur->cert->sig_md != POLARSSL_MD_SHA1 )
889 {
890 if( fallback == NULL )
891 fallback = cur;
892 {
893 SSL_DEBUG_MSG( 3, ( "certificate not preferred: "
894 "sha-2 with pre-TLS 1.2 client" ) );
895 continue;
896 }
897 }
898
899 /* If we get there, we got a winner */
900 break;
901 }
902
903 if( cur == NULL )
904 cur = fallback;
905
906
907 /* Do not update ssl->handshake->key_cert unless the is a match */
908 if( cur != NULL )
909 {
910 ssl->handshake->key_cert = cur;
911 SSL_DEBUG_CRT( 3, "selected certificate chain, certificate",
912 ssl->handshake->key_cert->cert );
913 return( 0 );
914 }
915
916 return( -1 );
917 }
918 #endif /* POLARSSL_X509_CRT_PARSE_C */
919
920 /*
921 * Check if a given ciphersuite is suitable for use with our config/keys/etc
922 * Sets ciphersuite_info only if the suite matches.
923 */
924 static int ssl_ciphersuite_match( ssl_context *ssl, int suite_id,
925 const ssl_ciphersuite_t **ciphersuite_info )
926 {
927 const ssl_ciphersuite_t *suite_info;
928
929 suite_info = ssl_ciphersuite_from_id( suite_id );
930 if( suite_info == NULL )
931 {
932 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
933 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
934 }
935
936 SSL_DEBUG_MSG( 3, ( "trying ciphersuite: %s", suite_info->name ) );
937
938 if( suite_info->min_minor_ver > ssl->minor_ver ||
939 suite_info->max_minor_ver < ssl->minor_ver )
940 {
941 SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: version" ) );
942 return( 0 );
943 }
944
945 if( ssl->arc4_disabled == SSL_ARC4_DISABLED &&
946 suite_info->cipher == POLARSSL_CIPHER_ARC4_128 )
947 {
948 SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: rc4" ) );
949 return( 0 );
950 }
951
952 #if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
953 if( ssl_ciphersuite_uses_ec( suite_info ) &&
954 ( ssl->handshake->curves == NULL ||
955 ssl->handshake->curves[0] == NULL ) )
956 {
957 SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
958 "no common elliptic curve" ) );
959 return( 0 );
960 }
961 #endif
962
963 #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
964 /* If the ciphersuite requires a pre-shared key and we don't
965 * have one, skip it now rather than failing later */
966 if( ssl_ciphersuite_uses_psk( suite_info ) &&
967 ssl->f_psk == NULL &&
968 ( ssl->psk == NULL || ssl->psk_identity == NULL ||
969 ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
970 {
971 SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: no pre-shared key" ) );
972 return( 0 );
973 }
974 #endif
975
976 #if defined(POLARSSL_X509_CRT_PARSE_C)
977 /*
978 * Final check: if ciphersuite requires us to have a
979 * certificate/key of a particular type:
980 * - select the appropriate certificate if we have one, or
981 * - try the next ciphersuite if we don't
982 * This must be done last since we modify the key_cert list.
983 */
984 if( ssl_pick_cert( ssl, suite_info ) != 0 )
985 {
986 SSL_DEBUG_MSG( 3, ( "ciphersuite mismatch: "
987 "no suitable certificate" ) );
988 return( 0 );
989 }
990 #endif
991
992 *ciphersuite_info = suite_info;
993 return( 0 );
994 }
995
996 #if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
997 static int ssl_parse_client_hello_v2( ssl_context *ssl )
998 {
999 int ret, got_common_suite;
1000 unsigned int i, j;
1001 size_t n;
1002 unsigned int ciph_len, sess_len, chal_len;
1003 unsigned char *buf, *p;
1004 const int *ciphersuites;
1005 const ssl_ciphersuite_t *ciphersuite_info;
1006
1007 SSL_DEBUG_MSG( 2, ( "=> parse client hello v2" ) );
1008
1009 #if defined(POLARSSL_SSL_RENEGOTIATION)
1010 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
1011 {
1012 SSL_DEBUG_MSG( 1, ( "client hello v2 illegal for renegotiation" ) );
1013
1014 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1015 return( ret );
1016
1017 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1018 }
1019 #endif /* POLARSSL_SSL_RENEGOTIATION */
1020
1021 buf = ssl->in_hdr;
1022
1023 SSL_DEBUG_BUF( 4, "record header", buf, 5 );
1024
1025 SSL_DEBUG_MSG( 3, ( "client hello v2, message type: %d",
1026 buf[2] ) );
1027 SSL_DEBUG_MSG( 3, ( "client hello v2, message len.: %d",
1028 ( ( buf[0] & 0x7F ) << 8 ) | buf[1] ) );
1029 SSL_DEBUG_MSG( 3, ( "client hello v2, max. version: [%d:%d]",
1030 buf[3], buf[4] ) );
1031
1032 /*
1033 * SSLv2 Client Hello
1034 *
1035 * Record layer:
1036 * 0 . 1 message length
1037 *
1038 * SSL layer:
1039 * 2 . 2 message type
1040 * 3 . 4 protocol version
1041 */
1042 if( buf[2] != SSL_HS_CLIENT_HELLO ||
1043 buf[3] != SSL_MAJOR_VERSION_3 )
1044 {
1045 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1046 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1047 }
1048
1049 n = ( ( buf[0] << 8 ) | buf[1] ) & 0x7FFF;
1050
1051 if( n < 17 || n > 512 )
1052 {
1053 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1054 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1055 }
1056
1057 ssl->major_ver = SSL_MAJOR_VERSION_3;
1058 ssl->minor_ver = ( buf[4] <= ssl->max_minor_ver )
1059 ? buf[4] : ssl->max_minor_ver;
1060
1061 if( ssl->minor_ver < ssl->min_minor_ver )
1062 {
1063 SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
1064 " [%d:%d] < [%d:%d]",
1065 ssl->major_ver, ssl->minor_ver,
1066 ssl->min_major_ver, ssl->min_minor_ver ) );
1067
1068 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
1069 SSL_ALERT_MSG_PROTOCOL_VERSION );
1070 return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1071 }
1072
1073 ssl->handshake->max_major_ver = buf[3];
1074 ssl->handshake->max_minor_ver = buf[4];
1075
1076 if( ( ret = ssl_fetch_input( ssl, 2 + n ) ) != 0 )
1077 {
1078 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1079 return( ret );
1080 }
1081
1082 ssl->handshake->update_checksum( ssl, buf + 2, n );
1083
1084 buf = ssl->in_msg;
1085 n = ssl->in_left - 5;
1086
1087 /*
1088 * 0 . 1 ciphersuitelist length
1089 * 2 . 3 session id length
1090 * 4 . 5 challenge length
1091 * 6 . .. ciphersuitelist
1092 * .. . .. session id
1093 * .. . .. challenge
1094 */
1095 SSL_DEBUG_BUF( 4, "record contents", buf, n );
1096
1097 ciph_len = ( buf[0] << 8 ) | buf[1];
1098 sess_len = ( buf[2] << 8 ) | buf[3];
1099 chal_len = ( buf[4] << 8 ) | buf[5];
1100
1101 SSL_DEBUG_MSG( 3, ( "ciph_len: %d, sess_len: %d, chal_len: %d",
1102 ciph_len, sess_len, chal_len ) );
1103
1104 /*
1105 * Make sure each parameter length is valid
1106 */
1107 if( ciph_len < 3 || ( ciph_len % 3 ) != 0 )
1108 {
1109 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1110 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1111 }
1112
1113 if( sess_len > 32 )
1114 {
1115 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1116 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1117 }
1118
1119 if( chal_len < 8 || chal_len > 32 )
1120 {
1121 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1122 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1123 }
1124
1125 if( n != 6 + ciph_len + sess_len + chal_len )
1126 {
1127 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1128 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1129 }
1130
1131 SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
1132 buf + 6, ciph_len );
1133 SSL_DEBUG_BUF( 3, "client hello, session id",
1134 buf + 6 + ciph_len, sess_len );
1135 SSL_DEBUG_BUF( 3, "client hello, challenge",
1136 buf + 6 + ciph_len + sess_len, chal_len );
1137
1138 p = buf + 6 + ciph_len;
1139 ssl->session_negotiate->length = sess_len;
1140 memset( ssl->session_negotiate->id, 0,
1141 sizeof( ssl->session_negotiate->id ) );
1142 memcpy( ssl->session_negotiate->id, p, ssl->session_negotiate->length );
1143
1144 p += sess_len;
1145 memset( ssl->handshake->randbytes, 0, 64 );
1146 memcpy( ssl->handshake->randbytes + 32 - chal_len, p, chal_len );
1147
1148 /*
1149 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1150 */
1151 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1152 {
1153 if( p[0] == 0 && p[1] == 0 && p[2] == SSL_EMPTY_RENEGOTIATION_INFO )
1154 {
1155 SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1156 #if defined(POLARSSL_SSL_RENEGOTIATION)
1157 if( ssl->renegotiation == SSL_RENEGOTIATION )
1158 {
1159 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
1160 "during renegotiation" ) );
1161
1162 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1163 return( ret );
1164
1165 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1166 }
1167 #endif /* POLARSSL_SSL_RENEGOTIATION */
1168 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
1169 break;
1170 }
1171 }
1172
1173 #if defined(POLARSSL_SSL_FALLBACK_SCSV)
1174 for( i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3 )
1175 {
1176 if( p[0] == 0 &&
1177 p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV >> 8 ) & 0xff ) &&
1178 p[2] == (unsigned char)( ( SSL_FALLBACK_SCSV ) & 0xff ) )
1179 {
1180 SSL_DEBUG_MSG( 3, ( "received FALLBACK_SCSV" ) );
1181
1182 if( ssl->minor_ver < ssl->max_minor_ver )
1183 {
1184 SSL_DEBUG_MSG( 1, ( "inapropriate fallback" ) );
1185
1186 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
1187 SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
1188
1189 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1190 }
1191
1192 break;
1193 }
1194 }
1195 #endif /* POLARSSL_SSL_FALLBACK_SCSV */
1196
1197 got_common_suite = 0;
1198 ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
1199 ciphersuite_info = NULL;
1200 #if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
1201 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
1202 {
1203 for( i = 0; ciphersuites[i] != 0; i++ )
1204 #else
1205 for( i = 0; ciphersuites[i] != 0; i++ )
1206 {
1207 for( j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3 )
1208 #endif
1209 {
1210 if( p[0] != 0 ||
1211 p[1] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1212 p[2] != ( ( ciphersuites[i] ) & 0xFF ) )
1213 continue;
1214
1215 got_common_suite = 1;
1216
1217 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1218 &ciphersuite_info ) ) != 0 )
1219 return( ret );
1220
1221 if( ciphersuite_info != NULL )
1222 goto have_ciphersuite_v2;
1223 }
1224 }
1225
1226 if( got_common_suite )
1227 {
1228 SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
1229 "but none of them usable" ) );
1230 return( POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE );
1231 }
1232 else
1233 {
1234 SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1235 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
1236 }
1237
1238 have_ciphersuite_v2:
1239 SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
1240
1241 ssl->session_negotiate->ciphersuite = ciphersuites[i];
1242 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
1243 ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
1244
1245 /*
1246 * SSLv2 Client Hello relevant renegotiation security checks
1247 */
1248 if( ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1249 ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
1250 {
1251 SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1252
1253 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1254 return( ret );
1255
1256 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1257 }
1258
1259 ssl->in_left = 0;
1260 ssl->state++;
1261
1262 SSL_DEBUG_MSG( 2, ( "<= parse client hello v2" ) );
1263
1264 return( 0 );
1265 }
1266 #endif /* POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */
1267
1268 static int ssl_parse_client_hello( ssl_context *ssl )
1269 {
1270 int ret, got_common_suite;
1271 unsigned int i, j;
1272 size_t n;
1273 unsigned int ciph_len, sess_len;
1274 unsigned int comp_len;
1275 unsigned int ext_len = 0;
1276 unsigned char *buf, *p, *ext;
1277 #if defined(POLARSSL_SSL_RENEGOTIATION)
1278 int renegotiation_info_seen = 0;
1279 #endif
1280 int handshake_failure = 0;
1281 const int *ciphersuites;
1282 const ssl_ciphersuite_t *ciphersuite_info;
1283
1284 SSL_DEBUG_MSG( 2, ( "=> parse client hello" ) );
1285
1286 #if defined(POLARSSL_SSL_RENEGOTIATION)
1287 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
1288 #endif
1289 {
1290 if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
1291 {
1292 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1293 return( ret );
1294 }
1295 }
1296
1297 buf = ssl->in_hdr;
1298
1299 #if defined(POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO)
1300 if( ( buf[0] & 0x80 ) != 0 )
1301 return ssl_parse_client_hello_v2( ssl );
1302 #endif
1303
1304 SSL_DEBUG_BUF( 4, "record header", buf, 5 );
1305
1306 SSL_DEBUG_MSG( 3, ( "client hello v3, message type: %d",
1307 buf[0] ) );
1308 SSL_DEBUG_MSG( 3, ( "client hello v3, message len.: %d",
1309 ( buf[3] << 8 ) | buf[4] ) );
1310 SSL_DEBUG_MSG( 3, ( "client hello v3, protocol ver: [%d:%d]",
1311 buf[1], buf[2] ) );
1312
1313 /*
1314 * SSLv3/TLS Client Hello
1315 *
1316 * Record layer:
1317 * 0 . 0 message type
1318 * 1 . 2 protocol version
1319 * 3 . 4 message length
1320 */
1321
1322 /* According to RFC 5246 Appendix E.1, the version here is typically
1323 * "{03,00}, the lowest version number supported by the client, [or] the
1324 * value of ClientHello.client_version", so the only meaningful check here
1325 * is the major version shouldn't be less than 3 */
1326 if( buf[0] != SSL_MSG_HANDSHAKE ||
1327 buf[1] < SSL_MAJOR_VERSION_3 )
1328 {
1329 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1330 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1331 }
1332
1333 n = ( buf[3] << 8 ) | buf[4];
1334
1335 if( n < 45 || n > SSL_MAX_CONTENT_LEN )
1336 {
1337 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1338 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1339 }
1340
1341 #if defined(POLARSSL_SSL_RENEGOTIATION)
1342 if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
1343 #endif
1344 {
1345 if( ( ret = ssl_fetch_input( ssl, 5 + n ) ) != 0 )
1346 {
1347 SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1348 return( ret );
1349 }
1350 }
1351
1352 buf = ssl->in_msg;
1353 #if defined(POLARSSL_SSL_RENEGOTIATION)
1354 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
1355 n = ssl->in_msglen;
1356 else
1357 #endif
1358 n = ssl->in_left - 5;
1359
1360 ssl->handshake->update_checksum( ssl, buf, n );
1361
1362 /*
1363 * SSL layer:
1364 * 0 . 0 handshake type
1365 * 1 . 3 handshake length
1366 * 4 . 5 protocol version
1367 * 6 . 9 UNIX time()
1368 * 10 . 37 random bytes
1369 * 38 . 38 session id length
1370 * 39 . 38+x session id
1371 * 39+x . 40+x ciphersuitelist length
1372 * 41+x . 40+y ciphersuitelist
1373 * 41+y . 41+y compression alg length
1374 * 42+y . 41+z compression algs
1375 * .. . .. extensions
1376 */
1377 SSL_DEBUG_BUF( 4, "record contents", buf, n );
1378
1379 SSL_DEBUG_MSG( 3, ( "client hello v3, handshake type: %d",
1380 buf[0] ) );
1381 SSL_DEBUG_MSG( 3, ( "client hello v3, handshake len.: %d",
1382 ( buf[1] << 16 ) | ( buf[2] << 8 ) | buf[3] ) );
1383 SSL_DEBUG_MSG( 3, ( "client hello v3, max. version: [%d:%d]",
1384 buf[4], buf[5] ) );
1385
1386 /*
1387 * Check the handshake type and protocol version
1388 */
1389 if( buf[0] != SSL_HS_CLIENT_HELLO )
1390 {
1391 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1392 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1393 }
1394
1395 ssl->major_ver = buf[4];
1396 ssl->minor_ver = buf[5];
1397
1398 ssl->handshake->max_major_ver = ssl->major_ver;
1399 ssl->handshake->max_minor_ver = ssl->minor_ver;
1400
1401 if( ssl->major_ver < ssl->min_major_ver ||
1402 ssl->minor_ver < ssl->min_minor_ver )
1403 {
1404 SSL_DEBUG_MSG( 1, ( "client only supports ssl smaller than minimum"
1405 " [%d:%d] < [%d:%d]",
1406 ssl->major_ver, ssl->minor_ver,
1407 ssl->min_major_ver, ssl->min_minor_ver ) );
1408
1409 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
1410 SSL_ALERT_MSG_PROTOCOL_VERSION );
1411
1412 return( POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1413 }
1414
1415 if( ssl->major_ver > ssl->max_major_ver )
1416 {
1417 ssl->major_ver = ssl->max_major_ver;
1418 ssl->minor_ver = ssl->max_minor_ver;
1419 }
1420 else if( ssl->minor_ver > ssl->max_minor_ver )
1421 ssl->minor_ver = ssl->max_minor_ver;
1422
1423 memcpy( ssl->handshake->randbytes, buf + 6, 32 );
1424
1425 /*
1426 * Check the handshake message length
1427 */
1428 if( buf[1] != 0 || n != (unsigned int) 4 + ( ( buf[2] << 8 ) | buf[3] ) )
1429 {
1430 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1431 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1432 }
1433
1434 /*
1435 * Check the session length
1436 */
1437 sess_len = buf[38];
1438
1439 if( sess_len > 32 || sess_len > n - 42 )
1440 {
1441 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1442 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1443 }
1444
1445 ssl->session_negotiate->length = sess_len;
1446 memset( ssl->session_negotiate->id, 0,
1447 sizeof( ssl->session_negotiate->id ) );
1448 memcpy( ssl->session_negotiate->id, buf + 39,
1449 ssl->session_negotiate->length );
1450
1451 /*
1452 * Check the ciphersuitelist length
1453 */
1454 ciph_len = ( buf[39 + sess_len] << 8 )
1455 | ( buf[40 + sess_len] );
1456
1457 if( ciph_len < 2 || ( ciph_len % 2 ) != 0 || ciph_len > n - 42 - sess_len )
1458 {
1459 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1460 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1461 }
1462
1463 /*
1464 * Check the compression algorithms length
1465 */
1466 comp_len = buf[41 + sess_len + ciph_len];
1467
1468 if( comp_len < 1 || comp_len > 16 ||
1469 comp_len > n - 42 - sess_len - ciph_len )
1470 {
1471 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1472 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1473 }
1474
1475 /*
1476 * Check the extension length
1477 */
1478 if( n > 42 + sess_len + ciph_len + comp_len )
1479 {
1480 ext_len = ( buf[42 + sess_len + ciph_len + comp_len] << 8 )
1481 | ( buf[43 + sess_len + ciph_len + comp_len] );
1482
1483 if( ( ext_len > 0 && ext_len < 4 ) ||
1484 n != 44 + sess_len + ciph_len + comp_len + ext_len )
1485 {
1486 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1487 SSL_DEBUG_BUF( 3, "Ext", buf + 44 + sess_len + ciph_len + comp_len, ext_len);
1488 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1489 }
1490 }
1491
1492 ssl->session_negotiate->compression = SSL_COMPRESS_NULL;
1493 #if defined(POLARSSL_ZLIB_SUPPORT)
1494 for( i = 0; i < comp_len; ++i )
1495 {
1496 if( buf[42 + sess_len + ciph_len + i] == SSL_COMPRESS_DEFLATE )
1497 {
1498 ssl->session_negotiate->compression = SSL_COMPRESS_DEFLATE;
1499 break;
1500 }
1501 }
1502 #endif
1503
1504 SSL_DEBUG_BUF( 3, "client hello, random bytes",
1505 buf + 6, 32 );
1506 SSL_DEBUG_BUF( 3, "client hello, session id",
1507 buf + 38, sess_len );
1508 SSL_DEBUG_BUF( 3, "client hello, ciphersuitelist",
1509 buf + 41 + sess_len, ciph_len );
1510 SSL_DEBUG_BUF( 3, "client hello, compression",
1511 buf + 42 + sess_len + ciph_len, comp_len );
1512
1513 /*
1514 * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV
1515 */
1516 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
1517 {
1518 if( p[0] == 0 && p[1] == SSL_EMPTY_RENEGOTIATION_INFO )
1519 {
1520 SSL_DEBUG_MSG( 3, ( "received TLS_EMPTY_RENEGOTIATION_INFO " ) );
1521 #if defined(POLARSSL_SSL_RENEGOTIATION)
1522 if( ssl->renegotiation == SSL_RENEGOTIATION )
1523 {
1524 SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
1525
1526 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1527 return( ret );
1528
1529 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1530 }
1531 renegotiation_info_seen = 1;
1532 #endif /* POLARSSL_SSL_RENEGOTIATION */
1533 ssl->secure_renegotiation = SSL_SECURE_RENEGOTIATION;
1534 break;
1535 }
1536 }
1537
1538 #if defined(POLARSSL_SSL_FALLBACK_SCSV)
1539 for( i = 0, p = buf + 41 + sess_len; i < ciph_len; i += 2, p += 2 )
1540 {
1541 if( p[0] == (unsigned char)( ( SSL_FALLBACK_SCSV >> 8 ) & 0xff ) &&
1542 p[1] == (unsigned char)( ( SSL_FALLBACK_SCSV ) & 0xff ) )
1543 {
1544 SSL_DEBUG_MSG( 0, ( "received FALLBACK_SCSV" ) );
1545
1546 if( ssl->minor_ver < ssl->max_minor_ver )
1547 {
1548 SSL_DEBUG_MSG( 0, ( "inapropriate fallback" ) );
1549
1550 ssl_send_alert_message( ssl, SSL_ALERT_LEVEL_FATAL,
1551 SSL_ALERT_MSG_INAPROPRIATE_FALLBACK );
1552
1553 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1554 }
1555
1556 break;
1557 }
1558 }
1559 #endif /* POLARSSL_SSL_FALLBACK_SCSV */
1560
1561 ext = buf + 44 + sess_len + ciph_len + comp_len;
1562
1563 while( ext_len )
1564 {
1565 unsigned int ext_id = ( ( ext[0] << 8 )
1566 | ( ext[1] ) );
1567 unsigned int ext_size = ( ( ext[2] << 8 )
1568 | ( ext[3] ) );
1569
1570 if( ext_size + 4 > ext_len )
1571 {
1572 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1573 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1574 }
1575 switch( ext_id )
1576 {
1577 #if defined(POLARSSL_SSL_SERVER_NAME_INDICATION)
1578 case TLS_EXT_SERVERNAME:
1579 SSL_DEBUG_MSG( 3, ( "found ServerName extension" ) );
1580 if( ssl->f_sni == NULL )
1581 break;
1582
1583 ret = ssl_parse_servername_ext( ssl, ext + 4, ext_size );
1584 if( ret != 0 )
1585 return( ret );
1586 break;
1587 #endif /* POLARSSL_SSL_SERVER_NAME_INDICATION */
1588
1589 case TLS_EXT_RENEGOTIATION_INFO:
1590 SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
1591 #if defined(POLARSSL_SSL_RENEGOTIATION)
1592 renegotiation_info_seen = 1;
1593 #endif
1594
1595 ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size );
1596 if( ret != 0 )
1597 return( ret );
1598 break;
1599
1600 #if defined(POLARSSL_SSL_PROTO_TLS1_2) && \
1601 defined(POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED)
1602 case TLS_EXT_SIG_ALG:
1603 SSL_DEBUG_MSG( 3, ( "found signature_algorithms extension" ) );
1604 #if defined(POLARSSL_SSL_RENEGOTIATION)
1605 if( ssl->renegotiation == SSL_RENEGOTIATION )
1606 break;
1607 #endif
1608
1609 ret = ssl_parse_signature_algorithms_ext( ssl, ext + 4, ext_size );
1610 if( ret != 0 )
1611 return( ret );
1612 break;
1613 #endif /* POLARSSL_SSL_PROTO_TLS1_2 &&
1614 POLARSSL_KEY_EXCHANGE__WITH_CERT__ENABLED */
1615
1616 #if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
1617 case TLS_EXT_SUPPORTED_ELLIPTIC_CURVES:
1618 SSL_DEBUG_MSG( 3, ( "found supported elliptic curves extension" ) );
1619
1620 ret = ssl_parse_supported_elliptic_curves( ssl, ext + 4, ext_size );
1621 if( ret != 0 )
1622 return( ret );
1623 break;
1624
1625 case TLS_EXT_SUPPORTED_POINT_FORMATS:
1626 SSL_DEBUG_MSG( 3, ( "found supported point formats extension" ) );
1627 ssl->handshake->cli_exts |= TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT;
1628
1629 ret = ssl_parse_supported_point_formats( ssl, ext + 4, ext_size );
1630 if( ret != 0 )
1631 return( ret );
1632 break;
1633 #endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
1634
1635 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
1636 case TLS_EXT_MAX_FRAGMENT_LENGTH:
1637 SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
1638
1639 ret = ssl_parse_max_fragment_length_ext( ssl, ext + 4, ext_size );
1640 if( ret != 0 )
1641 return( ret );
1642 break;
1643 #endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
1644
1645 #if defined(POLARSSL_SSL_TRUNCATED_HMAC)
1646 case TLS_EXT_TRUNCATED_HMAC:
1647 SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
1648
1649 ret = ssl_parse_truncated_hmac_ext( ssl, ext + 4, ext_size );
1650 if( ret != 0 )
1651 return( ret );
1652 break;
1653 #endif /* POLARSSL_SSL_TRUNCATED_HMAC */
1654
1655 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
1656 case TLS_EXT_ENCRYPT_THEN_MAC:
1657 SSL_DEBUG_MSG( 3, ( "found encrypt then mac extension" ) );
1658
1659 ret = ssl_parse_encrypt_then_mac_ext( ssl, ext + 4, ext_size );
1660 if( ret != 0 )
1661 return( ret );
1662 break;
1663 #endif /* POLARSSL_SSL_ENCRYPT_THEN_MAC */
1664
1665 #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
1666 case TLS_EXT_EXTENDED_MASTER_SECRET:
1667 SSL_DEBUG_MSG( 3, ( "found extended master secret extension" ) );
1668
1669 ret = ssl_parse_extended_ms_ext( ssl, ext + 4, ext_size );
1670 if( ret != 0 )
1671 return( ret );
1672 break;
1673 #endif /* POLARSSL_SSL_EXTENDED_MASTER_SECRET */
1674
1675 #if defined(POLARSSL_SSL_SESSION_TICKETS)
1676 case TLS_EXT_SESSION_TICKET:
1677 SSL_DEBUG_MSG( 3, ( "found session ticket extension" ) );
1678
1679 ret = ssl_parse_session_ticket_ext( ssl, ext + 4, ext_size );
1680 if( ret != 0 )
1681 return( ret );
1682 break;
1683 #endif /* POLARSSL_SSL_SESSION_TICKETS */
1684
1685 #if defined(POLARSSL_SSL_ALPN)
1686 case TLS_EXT_ALPN:
1687 SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
1688
1689 ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size );
1690 if( ret != 0 )
1691 return( ret );
1692 break;
1693 #endif /* POLARSSL_SSL_SESSION_TICKETS */
1694
1695 default:
1696 SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1697 ext_id ) );
1698 }
1699
1700 ext_len -= 4 + ext_size;
1701 ext += 4 + ext_size;
1702
1703 if( ext_len > 0 && ext_len < 4 )
1704 {
1705 SSL_DEBUG_MSG( 1, ( "bad client hello message" ) );
1706 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1707 }
1708 }
1709
1710 /*
1711 * Renegotiation security checks
1712 */
1713 if( ssl->secure_renegotiation != SSL_SECURE_RENEGOTIATION &&
1714 ssl->allow_legacy_renegotiation == SSL_LEGACY_BREAK_HANDSHAKE )
1715 {
1716 SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1717 handshake_failure = 1;
1718 }
1719 #if defined(POLARSSL_SSL_RENEGOTIATION)
1720 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1721 ssl->secure_renegotiation == SSL_SECURE_RENEGOTIATION &&
1722 renegotiation_info_seen == 0 )
1723 {
1724 SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
1725 handshake_failure = 1;
1726 }
1727 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1728 ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1729 ssl->allow_legacy_renegotiation == SSL_LEGACY_NO_RENEGOTIATION )
1730 {
1731 SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
1732 handshake_failure = 1;
1733 }
1734 else if( ssl->renegotiation == SSL_RENEGOTIATION &&
1735 ssl->secure_renegotiation == SSL_LEGACY_RENEGOTIATION &&
1736 renegotiation_info_seen == 1 )
1737 {
1738 SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
1739 handshake_failure = 1;
1740 }
1741 #endif /* POLARSSL_SSL_RENEGOTIATION */
1742
1743 if( handshake_failure == 1 )
1744 {
1745 if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
1746 return( ret );
1747
1748 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
1749 }
1750
1751 /*
1752 * Search for a matching ciphersuite
1753 * (At the end because we need information from the EC-based extensions
1754 * and certificate from the SNI callback triggered by the SNI extension.)
1755 */
1756 got_common_suite = 0;
1757 ciphersuites = ssl->ciphersuite_list[ssl->minor_ver];
1758 ciphersuite_info = NULL;
1759 #if defined(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
1760 for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
1761 {
1762 for( i = 0; ciphersuites[i] != 0; i++ )
1763 #else
1764 for( i = 0; ciphersuites[i] != 0; i++ )
1765 {
1766 for( j = 0, p = buf + 41 + sess_len; j < ciph_len; j += 2, p += 2 )
1767 #endif
1768 {
1769 if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
1770 p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
1771 continue;
1772
1773 got_common_suite = 1;
1774
1775 if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
1776 &ciphersuite_info ) ) != 0 )
1777 return( ret );
1778
1779 if( ciphersuite_info != NULL )
1780 goto have_ciphersuite;
1781 }
1782 }
1783
1784 if( got_common_suite )
1785 {
1786 SSL_DEBUG_MSG( 1, ( "got ciphersuites in common, "
1787 "but none of them usable" ) );
1788 ssl_send_fatal_handshake_failure( ssl );
1789 return( POLARSSL_ERR_SSL_NO_USABLE_CIPHERSUITE );
1790 }
1791 else
1792 {
1793 SSL_DEBUG_MSG( 1, ( "got no ciphersuites in common" ) );
1794 ssl_send_fatal_handshake_failure( ssl );
1795 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
1796 }
1797
1798 have_ciphersuite:
1799 SSL_DEBUG_MSG( 2, ( "selected ciphersuite: %s", ciphersuite_info->name ) );
1800
1801 ssl->session_negotiate->ciphersuite = ciphersuites[i];
1802 ssl->transform_negotiate->ciphersuite_info = ciphersuite_info;
1803 ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
1804
1805 ssl->in_left = 0;
1806 ssl->state++;
1807
1808 SSL_DEBUG_MSG( 2, ( "<= parse client hello" ) );
1809
1810 return( 0 );
1811 }
1812
1813 #if defined(POLARSSL_SSL_TRUNCATED_HMAC)
1814 static void ssl_write_truncated_hmac_ext( ssl_context *ssl,
1815 unsigned char *buf,
1816 size_t *olen )
1817 {
1818 unsigned char *p = buf;
1819
1820 if( ssl->session_negotiate->trunc_hmac == SSL_TRUNC_HMAC_DISABLED )
1821 {
1822 *olen = 0;
1823 return;
1824 }
1825
1826 SSL_DEBUG_MSG( 3, ( "server hello, adding truncated hmac extension" ) );
1827
1828 *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
1829 *p++ = (unsigned char)( ( TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
1830
1831 *p++ = 0x00;
1832 *p++ = 0x00;
1833
1834 *olen = 4;
1835 }
1836 #endif /* POLARSSL_SSL_TRUNCATED_HMAC */
1837
1838 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
1839 static void ssl_write_encrypt_then_mac_ext( ssl_context *ssl,
1840 unsigned char *buf,
1841 size_t *olen )
1842 {
1843 unsigned char *p = buf;
1844 const ssl_ciphersuite_t *suite = NULL;
1845 const cipher_info_t *cipher = NULL;
1846
1847 if( ssl->session_negotiate->encrypt_then_mac == SSL_EXTENDED_MS_DISABLED ||
1848 ssl->minor_ver == SSL_MINOR_VERSION_0 )
1849 {
1850 *olen = 0;
1851 return;
1852 }
1853
1854 /*
1855 * RFC 7366: "If a server receives an encrypt-then-MAC request extension
1856 * from a client and then selects a stream or Authenticated Encryption
1857 * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
1858 * encrypt-then-MAC response extension back to the client."
1859 */
1860 if( ( suite = ssl_ciphersuite_from_id(
1861 ssl->session_negotiate->ciphersuite ) ) == NULL ||
1862 ( cipher = cipher_info_from_type( suite->cipher ) ) == NULL ||
1863 cipher->mode != POLARSSL_MODE_CBC )
1864 {
1865 *olen = 0;
1866 return;
1867 }
1868
1869 SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
1870
1871 *p++ = (unsigned char)( ( TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
1872 *p++ = (unsigned char)( ( TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
1873
1874 *p++ = 0x00;
1875 *p++ = 0x00;
1876
1877 *olen = 4;
1878 }
1879 #endif /* POLARSSL_SSL_ENCRYPT_THEN_MAC */
1880
1881 #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
1882 static void ssl_write_extended_ms_ext( ssl_context *ssl,
1883 unsigned char *buf,
1884 size_t *olen )
1885 {
1886 unsigned char *p = buf;
1887
1888 if( ssl->handshake->extended_ms == SSL_EXTENDED_MS_DISABLED ||
1889 ssl->minor_ver == SSL_MINOR_VERSION_0 )
1890 {
1891 *olen = 0;
1892 return;
1893 }
1894
1895 SSL_DEBUG_MSG( 3, ( "server hello, adding extended master secret "
1896 "extension" ) );
1897
1898 *p++ = (unsigned char)( ( TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
1899 *p++ = (unsigned char)( ( TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
1900
1901 *p++ = 0x00;
1902 *p++ = 0x00;
1903
1904 *olen = 4;
1905 }
1906 #endif /* POLARSSL_SSL_EXTENDED_MASTER_SECRET */
1907
1908 #if defined(POLARSSL_SSL_SESSION_TICKETS)
1909 static void ssl_write_session_ticket_ext( ssl_context *ssl,
1910 unsigned char *buf,
1911 size_t *olen )
1912 {
1913 unsigned char *p = buf;
1914
1915 if( ssl->handshake->new_session_ticket == 0 )
1916 {
1917 *olen = 0;
1918 return;
1919 }
1920
1921 SSL_DEBUG_MSG( 3, ( "server hello, adding session ticket extension" ) );
1922
1923 *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
1924 *p++ = (unsigned char)( ( TLS_EXT_SESSION_TICKET ) & 0xFF );
1925
1926 *p++ = 0x00;
1927 *p++ = 0x00;
1928
1929 *olen = 4;
1930 }
1931 #endif /* POLARSSL_SSL_SESSION_TICKETS */
1932
1933 static void ssl_write_renegotiation_ext( ssl_context *ssl,
1934 unsigned char *buf,
1935 size_t *olen )
1936 {
1937 unsigned char *p = buf;
1938
1939 if( ssl->secure_renegotiation != SSL_SECURE_RENEGOTIATION )
1940 {
1941 *olen = 0;
1942 return;
1943 }
1944
1945 SSL_DEBUG_MSG( 3, ( "server hello, secure renegotiation extension" ) );
1946
1947 *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
1948 *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
1949
1950 #if defined(POLARSSL_SSL_RENEGOTIATION)
1951 if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE )
1952 {
1953 *p++ = 0x00;
1954 *p++ = ( ssl->verify_data_len * 2 + 1 ) & 0xFF;
1955 *p++ = ssl->verify_data_len * 2 & 0xFF;
1956
1957 memcpy( p, ssl->peer_verify_data, ssl->verify_data_len );
1958 p += ssl->verify_data_len;
1959 memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
1960 p += ssl->verify_data_len;
1961
1962 *olen = 5 + ssl->verify_data_len * 2;
1963 }
1964 else
1965 #endif /* POLARSSL_SSL_RENEGOTIATION */
1966 {
1967 *p++ = 0x00;
1968 *p++ = 0x01;
1969 *p++ = 0x00;
1970
1971 *olen = 5;
1972 }
1973 }
1974
1975 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
1976 static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
1977 unsigned char *buf,
1978 size_t *olen )
1979 {
1980 unsigned char *p = buf;
1981
1982 if( ssl->session_negotiate->mfl_code == SSL_MAX_FRAG_LEN_NONE )
1983 {
1984 *olen = 0;
1985 return;
1986 }
1987
1988 SSL_DEBUG_MSG( 3, ( "server hello, max_fragment_length extension" ) );
1989
1990 *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
1991 *p++ = (unsigned char)( ( TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
1992
1993 *p++ = 0x00;
1994 *p++ = 1;
1995
1996 *p++ = ssl->session_negotiate->mfl_code;
1997
1998 *olen = 5;
1999 }
2000 #endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
2001
2002 #if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
2003 static void ssl_write_supported_point_formats_ext( ssl_context *ssl,
2004 unsigned char *buf,
2005 size_t *olen )
2006 {
2007 unsigned char *p = buf;
2008 ((void) ssl);
2009
2010 if( ( ssl->handshake->cli_exts &
2011 TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT ) == 0 )
2012 {
2013 *olen = 0;
2014 return;
2015 }
2016
2017 SSL_DEBUG_MSG( 3, ( "server hello, supported_point_formats extension" ) );
2018
2019 *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
2020 *p++ = (unsigned char)( ( TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
2021
2022 *p++ = 0x00;
2023 *p++ = 2;
2024
2025 *p++ = 1;
2026 *p++ = POLARSSL_ECP_PF_UNCOMPRESSED;
2027
2028 *olen = 6;
2029 }
2030 #endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
2031
2032 #if defined(POLARSSL_SSL_ALPN )
2033 static void ssl_write_alpn_ext( ssl_context *ssl,
2034 unsigned char *buf, size_t *olen )
2035 {
2036 if( ssl->alpn_chosen == NULL )
2037 {
2038 *olen = 0;
2039 return;
2040 }
2041
2042 SSL_DEBUG_MSG( 3, ( "server hello, adding alpn extension" ) );
2043
2044 /*
2045 * 0 . 1 ext identifier
2046 * 2 . 3 ext length
2047 * 4 . 5 protocol list length
2048 * 6 . 6 protocol name length
2049 * 7 . 7+n protocol name
2050 */
2051 buf[0] = (unsigned char)( ( TLS_EXT_ALPN >> 8 ) & 0xFF );
2052 buf[1] = (unsigned char)( ( TLS_EXT_ALPN ) & 0xFF );
2053
2054 *olen = 7 + strlen( ssl->alpn_chosen );
2055
2056 buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
2057 buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
2058
2059 buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
2060 buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
2061
2062 buf[6] = (unsigned char)( ( ( *olen - 7 ) ) & 0xFF );
2063
2064 memcpy( buf + 7, ssl->alpn_chosen, *olen - 7 );
2065 }
2066 #endif /* POLARSSL_ECDH_C || POLARSSL_ECDSA_C */
2067
2068 static int ssl_write_server_hello( ssl_context *ssl )
2069 {
2070 #if defined(POLARSSL_HAVE_TIME)
2071 time_t t;
2072 #endif
2073 int ret;
2074 size_t olen, ext_len = 0, n;
2075 unsigned char *buf, *p;
2076
2077 SSL_DEBUG_MSG( 2, ( "=> write server hello" ) );
2078
2079 if( ssl->f_rng == NULL )
2080 {
2081 SSL_DEBUG_MSG( 1, ( "no RNG provided") );
2082 return( POLARSSL_ERR_SSL_NO_RNG );
2083 }
2084
2085 /*
2086 * 0 . 0 handshake type
2087 * 1 . 3 handshake length
2088 * 4 . 5 protocol version
2089 * 6 . 9 UNIX time()
2090 * 10 . 37 random bytes
2091 */
2092 buf = ssl->out_msg;
2093 p = buf + 4;
2094
2095 *p++ = (unsigned char) ssl->major_ver;
2096 *p++ = (unsigned char) ssl->minor_ver;
2097
2098 SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
2099 buf[4], buf[5] ) );
2100
2101 #if defined(POLARSSL_HAVE_TIME)
2102 t = time( NULL );
2103 *p++ = (unsigned char)( t >> 24 );
2104 *p++ = (unsigned char)( t >> 16 );
2105 *p++ = (unsigned char)( t >> 8 );
2106 *p++ = (unsigned char)( t );
2107
2108 SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
2109 #else
2110 if( ( ret = ssl->f_rng( ssl->p_rng, p, 4 ) ) != 0 )
2111 return( ret );
2112
2113 p += 4;
2114 #endif /* POLARSSL_HAVE_TIME */
2115
2116 if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
2117 return( ret );
2118
2119 p += 28;
2120
2121 memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
2122
2123 SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
2124
2125 /*
2126 * Resume is 0 by default, see ssl_handshake_init().
2127 * It may be already set to 1 by ssl_parse_session_ticket_ext().
2128 * If not, try looking up session ID in our cache.
2129 */
2130 if( ssl->handshake->resume == 0 &&
2131 #if defined(POLARSSL_SSL_RENEGOTIATION)
2132 ssl->renegotiation == SSL_INITIAL_HANDSHAKE &&
2133 #endif
2134 ssl->session_negotiate->length != 0 &&
2135 ssl->f_get_cache != NULL &&
2136 ssl->f_get_cache( ssl->p_get_cache, ssl->session_negotiate ) == 0 )
2137 {
2138 SSL_DEBUG_MSG( 3, ( "session successfully restored from cache" ) );
2139 ssl->handshake->resume = 1;
2140 }
2141
2142 if( ssl->handshake->resume == 0 )
2143 {
2144 /*
2145 * New session, create a new session id,
2146 * unless we're about to issue a session ticket
2147 */
2148 ssl->state++;
2149
2150 #if defined(POLARSSL_HAVE_TIME)
2151 ssl->session_negotiate->start = time( NULL );
2152 #endif
2153
2154 #if defined(POLARSSL_SSL_SESSION_TICKETS)
2155 if( ssl->handshake->new_session_ticket != 0 )
2156 {
2157 ssl->session_negotiate->length = n = 0;
2158 memset( ssl->session_negotiate->id, 0, 32 );
2159 }
2160 else
2161 #endif /* POLARSSL_SSL_SESSION_TICKETS */
2162 {
2163 ssl->session_negotiate->length = n = 32;
2164 if( ( ret = ssl->f_rng( ssl->p_rng, ssl->session_negotiate->id,
2165 n ) ) != 0 )
2166 return( ret );
2167 }
2168 }
2169 else
2170 {
2171 /*
2172 * Resuming a session
2173 */
2174 n = ssl->session_negotiate->length;
2175 ssl->state = SSL_SERVER_CHANGE_CIPHER_SPEC;
2176
2177 if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
2178 {
2179 SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
2180 return( ret );
2181 }
2182 }
2183
2184 /*
2185 * 38 . 38 session id length
2186 * 39 . 38+n session id
2187 * 39+n . 40+n chosen ciphersuite
2188 * 41+n . 41+n chosen compression alg.
2189 * 42+n . 43+n extensions length
2190 * 44+n . 43+n+m extensions
2191 */
2192 *p++ = (unsigned char) ssl->session_negotiate->length;
2193 memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->length );
2194 p += ssl->session_negotiate->length;
2195
2196 SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
2197 SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
2198 SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
2199 ssl->handshake->resume ? "a" : "no" ) );
2200
2201 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite >> 8 );
2202 *p++ = (unsigned char)( ssl->session_negotiate->ciphersuite );
2203 *p++ = (unsigned char)( ssl->session_negotiate->compression );
2204
2205 SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s",
2206 ssl_get_ciphersuite_name( ssl->session_negotiate->ciphersuite ) ) );
2207 SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: 0x%02X",
2208 ssl->session_negotiate->compression ) );
2209
2210 /*
2211 * First write extensions, then the total length
2212 */
2213 ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
2214 ext_len += olen;
2215
2216 #if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
2217 ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
2218 ext_len += olen;
2219 #endif
2220
2221 #if defined(POLARSSL_SSL_TRUNCATED_HMAC)
2222 ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
2223 ext_len += olen;
2224 #endif
2225
2226 #if defined(POLARSSL_SSL_ENCRYPT_THEN_MAC)
2227 ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
2228 ext_len += olen;
2229 #endif
2230
2231 #if defined(POLARSSL_SSL_EXTENDED_MASTER_SECRET)
2232 ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
2233 ext_len += olen;
2234 #endif
2235
2236 #if defined(POLARSSL_SSL_SESSION_TICKETS)
2237 ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
2238 ext_len += olen;
2239 #endif
2240
2241 #if defined(POLARSSL_ECDH_C) || defined(POLARSSL_ECDSA_C)
2242 ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
2243 ext_len += olen;
2244 #endif
2245
2246 #if defined(POLARSSL_SSL_ALPN)
2247 ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
2248 ext_len += olen;
2249 #endif
2250
2251 SSL_DEBUG_MSG( 3, ( "server hello, total extension length: %d", ext_len ) );
2252
2253 if( ext_len > 0 )
2254 {
2255 *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
2256 *p++ = (unsigned char)( ( ext_len ) & 0xFF );
2257 p += ext_len;
2258 }
2259
2260 ssl->out_msglen = p - buf;
2261 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2262 ssl->out_msg[0] = SSL_HS_SERVER_HELLO;
2263
2264 ret = ssl_write_record( ssl );
2265
2266 SSL_DEBUG_MSG( 2, ( "<= write server hello" ) );
2267
2268 return( ret );
2269 }
2270
2271 #if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \
2272 !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
2273 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
2274 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2275 static int ssl_write_certificate_request( ssl_context *ssl )
2276 {
2277 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
2278
2279 SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
2280
2281 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
2282 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
2283 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
2284 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
2285 {
2286 SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
2287 ssl->state++;
2288 return( 0 );
2289 }
2290
2291 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2292 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
2293 }
2294 #else
2295 static int ssl_write_certificate_request( ssl_context *ssl )
2296 {
2297 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
2298 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
2299 size_t dn_size, total_dn_size; /* excluding length bytes */
2300 size_t ct_len, sa_len; /* including length bytes */
2301 unsigned char *buf, *p;
2302 const x509_crt *crt;
2303
2304 SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
2305
2306 ssl->state++;
2307
2308 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
2309 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
2310 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
2311 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
2312 ssl->authmode == SSL_VERIFY_NONE )
2313 {
2314 SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
2315 return( 0 );
2316 }
2317
2318 /*
2319 * 0 . 0 handshake type
2320 * 1 . 3 handshake length
2321 * 4 . 4 cert type count
2322 * 5 .. m-1 cert types
2323 * m .. m+1 sig alg length (TLS 1.2 only)
2324 * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
2325 * n .. n+1 length of all DNs
2326 * n+2 .. n+3 length of DN 1
2327 * n+4 .. ... Distinguished Name #1
2328 * ... .. ... length of DN 2, etc.
2329 */
2330 buf = ssl->out_msg;
2331 p = buf + 4;
2332
2333 /*
2334 * Supported certificate types
2335 *
2336 * ClientCertificateType certificate_types<1..2^8-1>;
2337 * enum { (255) } ClientCertificateType;
2338 */
2339 ct_len = 0;
2340
2341 #if defined(POLARSSL_RSA_C)
2342 p[1 + ct_len++] = SSL_CERT_TYPE_RSA_SIGN;
2343 #endif
2344 #if defined(POLARSSL_ECDSA_C)
2345 p[1 + ct_len++] = SSL_CERT_TYPE_ECDSA_SIGN;
2346 #endif
2347
2348 p[0] = (unsigned char) ct_len++;
2349 p += ct_len;
2350
2351 sa_len = 0;
2352 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
2353 /*
2354 * Add signature_algorithms for verify (TLS 1.2)
2355 *
2356 * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>;
2357 *
2358 * struct {
2359 * HashAlgorithm hash;
2360 * SignatureAlgorithm signature;
2361 * } SignatureAndHashAlgorithm;
2362 *
2363 * enum { (255) } HashAlgorithm;
2364 * enum { (255) } SignatureAlgorithm;
2365 */
2366 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2367 {
2368 /*
2369 * Only use current running hash algorithm that is already required
2370 * for requested ciphersuite.
2371 */
2372 ssl->handshake->verify_sig_alg = SSL_HASH_SHA256;
2373
2374 if( ssl->transform_negotiate->ciphersuite_info->mac ==
2375 POLARSSL_MD_SHA384 )
2376 {
2377 ssl->handshake->verify_sig_alg = SSL_HASH_SHA384;
2378 }
2379
2380 /*
2381 * Supported signature algorithms
2382 */
2383 #if defined(POLARSSL_RSA_C)
2384 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
2385 p[2 + sa_len++] = SSL_SIG_RSA;
2386 #endif
2387 #if defined(POLARSSL_ECDSA_C)
2388 p[2 + sa_len++] = ssl->handshake->verify_sig_alg;
2389 p[2 + sa_len++] = SSL_SIG_ECDSA;
2390 #endif
2391
2392 p[0] = (unsigned char)( sa_len >> 8 );
2393 p[1] = (unsigned char)( sa_len );
2394 sa_len += 2;
2395 p += sa_len;
2396 }
2397 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
2398
2399 /*
2400 * DistinguishedName certificate_authorities<0..2^16-1>;
2401 * opaque DistinguishedName<1..2^16-1>;
2402 */
2403 p += 2;
2404 crt = ssl->ca_chain;
2405
2406 total_dn_size = 0;
2407 while( crt != NULL && crt->version != 0 )
2408 {
2409 if( p - buf > 4096 )
2410 break;
2411
2412 dn_size = crt->subject_raw.len;
2413 *p++ = (unsigned char)( dn_size >> 8 );
2414 *p++ = (unsigned char)( dn_size );
2415 memcpy( p, crt->subject_raw.p, dn_size );
2416 p += dn_size;
2417
2418 SSL_DEBUG_BUF( 3, "requested DN", p, dn_size );
2419
2420 total_dn_size += 2 + dn_size;
2421 crt = crt->next;
2422 }
2423
2424 ssl->out_msglen = p - buf;
2425 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2426 ssl->out_msg[0] = SSL_HS_CERTIFICATE_REQUEST;
2427 ssl->out_msg[4 + ct_len + sa_len] = (unsigned char)( total_dn_size >> 8 );
2428 ssl->out_msg[5 + ct_len + sa_len] = (unsigned char)( total_dn_size );
2429
2430 ret = ssl_write_record( ssl );
2431
2432 SSL_DEBUG_MSG( 2, ( "<= write certificate request" ) );
2433
2434 return( ret );
2435 }
2436 #endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
2437 !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
2438 !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
2439 !POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2440
2441 #if defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2442 defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2443 static int ssl_get_ecdh_params_from_cert( ssl_context *ssl )
2444 {
2445 int ret;
2446
2447 if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_ECKEY ) )
2448 {
2449 SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
2450 return( POLARSSL_ERR_SSL_PK_TYPE_MISMATCH );
2451 }
2452
2453 if( ( ret = ecdh_get_params( &ssl->handshake->ecdh_ctx,
2454 pk_ec( *ssl_own_key( ssl ) ),
2455 POLARSSL_ECDH_OURS ) ) != 0 )
2456 {
2457 SSL_DEBUG_RET( 1, ( "ecdh_get_params" ), ret );
2458 return( ret );
2459 }
2460
2461 return( 0 );
2462 }
2463 #endif /* POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
2464 POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2465
2466 static int ssl_write_server_key_exchange( ssl_context *ssl )
2467 {
2468 int ret;
2469 size_t n = 0;
2470 const ssl_ciphersuite_t *ciphersuite_info =
2471 ssl->transform_negotiate->ciphersuite_info;
2472
2473 #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2474 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2475 defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2476 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
2477 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2478 unsigned char *p = ssl->out_msg + 4;
2479 unsigned char *dig_signed = p;
2480 size_t dig_signed_len = 0, len;
2481 ((void) dig_signed);
2482 ((void) dig_signed_len);
2483 #endif
2484
2485 SSL_DEBUG_MSG( 2, ( "=> write server key exchange" ) );
2486
2487 #if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) || \
2488 defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED) || \
2489 defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
2490 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA ||
2491 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
2492 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
2493 {
2494 SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
2495 ssl->state++;
2496 return( 0 );
2497 }
2498 #endif
2499
2500 #if defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
2501 defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2502 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_RSA ||
2503 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
2504 {
2505 ssl_get_ecdh_params_from_cert( ssl );
2506
2507 SSL_DEBUG_MSG( 2, ( "<= skip write server key exchange" ) );
2508 ssl->state++;
2509 return( 0 );
2510 }
2511 #endif
2512
2513 #if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED) || \
2514 defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2515 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK ||
2516 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
2517 {
2518 /* TODO: Support identity hints */
2519 *(p++) = 0x00;
2520 *(p++) = 0x00;
2521
2522 n += 2;
2523 }
2524 #endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED ||
2525 POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2526
2527 #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2528 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2529 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
2530 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
2531 {
2532 /*
2533 * Ephemeral DH parameters:
2534 *
2535 * struct {
2536 * opaque dh_p<1..2^16-1>;
2537 * opaque dh_g<1..2^16-1>;
2538 * opaque dh_Ys<1..2^16-1>;
2539 * } ServerDHParams;
2540 */
2541 if( ( ret = mpi_copy( &ssl->handshake->dhm_ctx.P, &ssl->dhm_P ) ) != 0 ||
2542 ( ret = mpi_copy( &ssl->handshake->dhm_ctx.G, &ssl->dhm_G ) ) != 0 )
2543 {
2544 SSL_DEBUG_RET( 1, "mpi_copy", ret );
2545 return( ret );
2546 }
2547
2548 if( ( ret = dhm_make_params( &ssl->handshake->dhm_ctx,
2549 (int) mpi_size( &ssl->handshake->dhm_ctx.P ),
2550 p, &len, ssl->f_rng, ssl->p_rng ) ) != 0 )
2551 {
2552 SSL_DEBUG_RET( 1, "dhm_make_params", ret );
2553 return( ret );
2554 }
2555
2556 dig_signed = p;
2557 dig_signed_len = len;
2558
2559 p += len;
2560 n += len;
2561
2562 SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2563 SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2564 SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2565 SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
2566 }
2567 #endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2568 POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
2569
2570 #if defined(POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED)
2571 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
2572 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
2573 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
2574 {
2575 /*
2576 * Ephemeral ECDH parameters:
2577 *
2578 * struct {
2579 * ECParameters curve_params;
2580 * ECPoint public;
2581 * } ServerECDHParams;
2582 */
2583 const ecp_curve_info **curve = NULL;
2584 #if defined(POLARSSL_SSL_SET_CURVES)
2585 const ecp_group_id *gid;
2586
2587 /* Match our preference list against the offered curves */
2588 for( gid = ssl->curve_list; *gid != POLARSSL_ECP_DP_NONE; gid++ )
2589 for( curve = ssl->handshake->curves; *curve != NULL; curve++ )
2590 if( (*curve)->grp_id == *gid )
2591 goto curve_matching_done;
2592
2593 curve_matching_done:
2594 #else
2595 curve = ssl->handshake->curves;
2596 #endif
2597
2598 if( *curve == NULL )
2599 {
2600 SSL_DEBUG_MSG( 1, ( "no matching curve for ECDHE" ) );
2601 return( POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN );
2602 }
2603
2604 SSL_DEBUG_MSG( 2, ( "ECDHE curve: %s", (*curve)->name ) );
2605
2606 if( ( ret = ecp_use_known_dp( &ssl->handshake->ecdh_ctx.grp,
2607 (*curve)->grp_id ) ) != 0 )
2608 {
2609 SSL_DEBUG_RET( 1, "ecp_use_known_dp", ret );
2610 return( ret );
2611 }
2612
2613 if( ( ret = ecdh_make_params( &ssl->handshake->ecdh_ctx, &len,
2614 p, SSL_MAX_CONTENT_LEN - n,
2615 ssl->f_rng, ssl->p_rng ) ) != 0 )
2616 {
2617 SSL_DEBUG_RET( 1, "ecdh_make_params", ret );
2618 return( ret );
2619 }
2620
2621 dig_signed = p;
2622 dig_signed_len = len;
2623
2624 p += len;
2625 n += len;
2626
2627 SSL_DEBUG_ECP( 3, "ECDH: Q ", &ssl->handshake->ecdh_ctx.Q );
2628 }
2629 #endif /* POLARSSL_KEY_EXCHANGE__SOME__ECDHE_ENABLED */
2630
2631 #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2632 defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
2633 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2634 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA ||
2635 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
2636 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
2637 {
2638 size_t signature_len = 0;
2639 unsigned int hashlen = 0;
2640 unsigned char hash[64];
2641 md_type_t md_alg = POLARSSL_MD_NONE;
2642
2643 /*
2644 * Choose hash algorithm. NONE means MD5 + SHA1 here.
2645 */
2646 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
2647 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2648 {
2649 md_alg = ssl_md_alg_from_hash( ssl->handshake->sig_alg );
2650
2651 if( md_alg == POLARSSL_MD_NONE )
2652 {
2653 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2654 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
2655 }
2656 }
2657 else
2658 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
2659 #if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2660 defined(POLARSSL_SSL_PROTO_TLS1_1)
2661 if( ciphersuite_info->key_exchange ==
2662 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA )
2663 {
2664 md_alg = POLARSSL_MD_SHA1;
2665 }
2666 else
2667 #endif
2668 {
2669 md_alg = POLARSSL_MD_NONE;
2670 }
2671
2672 /*
2673 * Compute the hash to be signed
2674 */
2675 #if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
2676 defined(POLARSSL_SSL_PROTO_TLS1_1)
2677 if( md_alg == POLARSSL_MD_NONE )
2678 {
2679 md5_context md5;
2680 sha1_context sha1;
2681
2682 md5_init( &md5 );
2683 sha1_init( &sha1 );
2684
2685 /*
2686 * digitally-signed struct {
2687 * opaque md5_hash[16];
2688 * opaque sha_hash[20];
2689 * };
2690 *
2691 * md5_hash
2692 * MD5(ClientHello.random + ServerHello.random
2693 * + ServerParams);
2694 * sha_hash
2695 * SHA(ClientHello.random + ServerHello.random
2696 * + ServerParams);
2697 */
2698 md5_starts( &md5 );
2699 md5_update( &md5, ssl->handshake->randbytes, 64 );
2700 md5_update( &md5, dig_signed, dig_signed_len );
2701 md5_finish( &md5, hash );
2702
2703 sha1_starts( &sha1 );
2704 sha1_update( &sha1, ssl->handshake->randbytes, 64 );
2705 sha1_update( &sha1, dig_signed, dig_signed_len );
2706 sha1_finish( &sha1, hash + 16 );
2707
2708 hashlen = 36;
2709
2710 md5_free( &md5 );
2711 sha1_free( &sha1 );
2712 }
2713 else
2714 #endif /* POLARSSL_SSL_PROTO_SSL3 || POLARSSL_SSL_PROTO_TLS1 || \
2715 POLARSSL_SSL_PROTO_TLS1_1 */
2716 #if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
2717 defined(POLARSSL_SSL_PROTO_TLS1_2)
2718 if( md_alg != POLARSSL_MD_NONE )
2719 {
2720 md_context_t ctx;
2721 const md_info_t *md_info = md_info_from_type( md_alg );
2722
2723 md_init( &ctx );
2724
2725 /* Info from md_alg will be used instead */
2726 hashlen = 0;
2727
2728 /*
2729 * digitally-signed struct {
2730 * opaque client_random[32];
2731 * opaque server_random[32];
2732 * ServerDHParams params;
2733 * };
2734 */
2735 if( ( ret = md_init_ctx( &ctx, md_info ) ) != 0 )
2736 {
2737 SSL_DEBUG_RET( 1, "md_init_ctx", ret );
2738 return( ret );
2739 }
2740
2741 md_starts( &ctx );
2742 md_update( &ctx, ssl->handshake->randbytes, 64 );
2743 md_update( &ctx, dig_signed, dig_signed_len );
2744 md_finish( &ctx, hash );
2745 md_free( &ctx );
2746 }
2747 else
2748 #endif /* POLARSSL_SSL_PROTO_TLS1 || POLARSSL_SSL_PROTO_TLS1_1 || \
2749 POLARSSL_SSL_PROTO_TLS1_2 */
2750 {
2751 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2752 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
2753 }
2754
2755 SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen != 0 ? hashlen :
2756 (unsigned int) ( md_info_from_type( md_alg ) )->size );
2757
2758 /*
2759 * Make the signature
2760 */
2761 if( ssl_own_key( ssl ) == NULL )
2762 {
2763 SSL_DEBUG_MSG( 1, ( "got no private key" ) );
2764 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2765 }
2766
2767 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
2768 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
2769 {
2770 *(p++) = ssl->handshake->sig_alg;
2771 *(p++) = ssl_sig_from_pk( ssl_own_key( ssl ) );
2772
2773 n += 2;
2774 }
2775 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
2776
2777 if( ( ret = pk_sign( ssl_own_key( ssl ), md_alg, hash, hashlen,
2778 p + 2 , &signature_len,
2779 ssl->f_rng, ssl->p_rng ) ) != 0 )
2780 {
2781 SSL_DEBUG_RET( 1, "pk_sign", ret );
2782 return( ret );
2783 }
2784
2785 *(p++) = (unsigned char)( signature_len >> 8 );
2786 *(p++) = (unsigned char)( signature_len );
2787 n += 2;
2788
2789 SSL_DEBUG_BUF( 3, "my signature", p, signature_len );
2790
2791 p += signature_len;
2792 n += signature_len;
2793 }
2794 #endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) ||
2795 POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
2796 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2797
2798 ssl->out_msglen = 4 + n;
2799 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2800 ssl->out_msg[0] = SSL_HS_SERVER_KEY_EXCHANGE;
2801
2802 ssl->state++;
2803
2804 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2805 {
2806 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2807 return( ret );
2808 }
2809
2810 SSL_DEBUG_MSG( 2, ( "<= write server key exchange" ) );
2811
2812 return( 0 );
2813 }
2814
2815 static int ssl_write_server_hello_done( ssl_context *ssl )
2816 {
2817 int ret;
2818
2819 SSL_DEBUG_MSG( 2, ( "=> write server hello done" ) );
2820
2821 ssl->out_msglen = 4;
2822 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
2823 ssl->out_msg[0] = SSL_HS_SERVER_HELLO_DONE;
2824
2825 ssl->state++;
2826
2827 if( ( ret = ssl_write_record( ssl ) ) != 0 )
2828 {
2829 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2830 return( ret );
2831 }
2832
2833 SSL_DEBUG_MSG( 2, ( "<= write server hello done" ) );
2834
2835 return( 0 );
2836 }
2837
2838 #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
2839 defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
2840 static int ssl_parse_client_dh_public( ssl_context *ssl, unsigned char **p,
2841 const unsigned char *end )
2842 {
2843 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
2844 size_t n;
2845
2846 /*
2847 * Receive G^Y mod P, premaster = (G^Y)^X mod P
2848 */
2849 if( *p + 2 > end )
2850 {
2851 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2852 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2853 }
2854
2855 n = ( (*p)[0] << 8 ) | (*p)[1];
2856 *p += 2;
2857
2858 if( *p + n > end )
2859 {
2860 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2861 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2862 }
2863
2864 if( ( ret = dhm_read_public( &ssl->handshake->dhm_ctx, *p, n ) ) != 0 )
2865 {
2866 SSL_DEBUG_RET( 1, "dhm_read_public", ret );
2867 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
2868 }
2869
2870 *p += n;
2871
2872 SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
2873
2874 return( ret );
2875 }
2876 #endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED ||
2877 POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
2878
2879 #if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) || \
2880 defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
2881 static int ssl_parse_encrypted_pms( ssl_context *ssl,
2882 const unsigned char *p,
2883 const unsigned char *end,
2884 size_t pms_offset )
2885 {
2886 int ret;
2887 size_t len = pk_get_len( ssl_own_key( ssl ) );
2888 unsigned char *pms = ssl->handshake->premaster + pms_offset;
2889 unsigned char fake_pms[48], peer_pms[48];
2890 unsigned char mask;
2891 size_t i, diff, peer_pmslen;
2892
2893 if( ! pk_can_do( ssl_own_key( ssl ), POLARSSL_PK_RSA ) )
2894 {
2895 SSL_DEBUG_MSG( 1, ( "got no RSA private key" ) );
2896 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2897 }
2898
2899 /*
2900 * Decrypt the premaster using own private RSA key
2901 */
2902 #if defined(POLARSSL_SSL_PROTO_TLS1) || defined(POLARSSL_SSL_PROTO_TLS1_1) || \
2903 defined(POLARSSL_SSL_PROTO_TLS1_2)
2904 if( ssl->minor_ver != SSL_MINOR_VERSION_0 )
2905 {
2906 if( *p++ != ( ( len >> 8 ) & 0xFF ) ||
2907 *p++ != ( ( len ) & 0xFF ) )
2908 {
2909 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2910 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2911 }
2912 }
2913 #endif
2914
2915 if( p + len != end )
2916 {
2917 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2918 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2919 }
2920
2921 /*
2922 * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding
2923 * must not cause the connection to end immediately; instead, send a
2924 * bad_record_mac later in the handshake.
2925 * Also, avoid data-dependant branches here to protect against
2926 * timing-based variants.
2927 */
2928 ret = ssl->f_rng( ssl->p_rng, fake_pms, sizeof( fake_pms ) );
2929 if( ret != 0 )
2930 return( ret );
2931
2932 ret = pk_decrypt( ssl_own_key( ssl ), p, len,
2933 peer_pms, &peer_pmslen,
2934 sizeof( peer_pms ),
2935 ssl->f_rng, ssl->p_rng );
2936
2937 diff = (size_t) ret;
2938 diff |= peer_pmslen ^ 48;
2939 diff |= peer_pms[0] ^ ssl->handshake->max_major_ver;
2940 diff |= peer_pms[1] ^ ssl->handshake->max_minor_ver;
2941
2942 #if defined(POLARSSL_SSL_DEBUG_ALL)
2943 if( diff != 0 )
2944 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2945 #endif
2946
2947 if( sizeof( ssl->handshake->premaster ) < pms_offset ||
2948 sizeof( ssl->handshake->premaster ) - pms_offset < 48 )
2949 {
2950 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2951 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
2952 }
2953 ssl->handshake->pmslen = 48;
2954
2955 mask = ( diff | - diff ) >> ( sizeof( size_t ) * 8 - 1 );
2956 mask = (unsigned char)( - ( ret != 0 ) ); /* mask = diff ? 0xff : 0x00 */
2957 for( i = 0; i < ssl->handshake->pmslen; i++ )
2958 pms[i] = ( mask & fake_pms[i] ) | ( (~mask) & peer_pms[i] );
2959
2960 return( 0 );
2961 }
2962 #endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED ||
2963 POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
2964
2965 #if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
2966 static int ssl_parse_client_psk_identity( ssl_context *ssl, unsigned char **p,
2967 const unsigned char *end )
2968 {
2969 int ret = 0;
2970 size_t n;
2971
2972 if( ssl->f_psk == NULL &&
2973 ( ssl->psk == NULL || ssl->psk_identity == NULL ||
2974 ssl->psk_identity_len == 0 || ssl->psk_len == 0 ) )
2975 {
2976 SSL_DEBUG_MSG( 1, ( "got no pre-shared key" ) );
2977 return( POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED );
2978 }
2979
2980 /*
2981 * Receive client pre-shared key identity name
2982 */
2983 if( *p + 2 > end )
2984 {
2985 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2986 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2987 }
2988
2989 n = ( (*p)[0] << 8 ) | (*p)[1];
2990 *p += 2;
2991
2992 if( n < 1 || n > 65535 || *p + n > end )
2993 {
2994 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
2995 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
2996 }
2997
2998 if( ssl->f_psk != NULL )
2999 {
3000 if( ssl->f_psk( ssl->p_psk, ssl, *p, n ) != 0 )
3001 ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
3002 }
3003 else
3004 {
3005 /* Identity is not a big secret since clients send it in the clear,
3006 * but treat it carefully anyway, just in case */
3007 if( n != ssl->psk_identity_len ||
3008 safer_memcmp( ssl->psk_identity, *p, n ) != 0 )
3009 {
3010 ret = POLARSSL_ERR_SSL_UNKNOWN_IDENTITY;
3011 }
3012 }
3013
3014 if( ret == POLARSSL_ERR_SSL_UNKNOWN_IDENTITY )
3015 {
3016 SSL_DEBUG_BUF( 3, "Unknown PSK identity", *p, n );
3017 if( ( ret = ssl_send_alert_message( ssl,
3018 SSL_ALERT_LEVEL_FATAL,
3019 SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY ) ) != 0 )
3020 {
3021 return( ret );
3022 }
3023
3024 return( POLARSSL_ERR_SSL_UNKNOWN_IDENTITY );
3025 }
3026
3027 *p += n;
3028
3029 return( 0 );
3030 }
3031 #endif /* POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED */
3032
3033 static int ssl_parse_client_key_exchange( ssl_context *ssl )
3034 {
3035 int ret;
3036 const ssl_ciphersuite_t *ciphersuite_info;
3037
3038 ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
3039
3040 SSL_DEBUG_MSG( 2, ( "=> parse client key exchange" ) );
3041
3042 if( ( ret = ssl_read_record( ssl ) ) != 0 )
3043 {
3044 SSL_DEBUG_RET( 1, "ssl_read_record", ret );
3045 return( ret );
3046 }
3047
3048 if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
3049 {
3050 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3051 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3052 }
3053
3054 if( ssl->in_msg[0] != SSL_HS_CLIENT_KEY_EXCHANGE )
3055 {
3056 SSL_DEBUG_MSG( 1, ( "bad client key exchange message" ) );
3057 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3058 }
3059
3060 #if defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED)
3061 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_RSA )
3062 {
3063 unsigned char *p = ssl->in_msg + 4;
3064 unsigned char *end = ssl->in_msg + ssl->in_hslen;
3065
3066 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
3067 {
3068 SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
3069 return( ret );
3070 }
3071
3072 if( p != end )
3073 {
3074 SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3075 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3076 }
3077
3078 ssl->handshake->pmslen = POLARSSL_PREMASTER_SIZE;
3079
3080 if( ( ret = dhm_calc_secret( &ssl->handshake->dhm_ctx,
3081 ssl->handshake->premaster,
3082 &ssl->handshake->pmslen,
3083 ssl->f_rng, ssl->p_rng ) ) != 0 )
3084 {
3085 SSL_DEBUG_RET( 1, "dhm_calc_secret", ret );
3086 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
3087 }
3088
3089 SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
3090 }
3091 else
3092 #endif /* POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED */
3093 #if defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
3094 defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
3095 defined(POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
3096 defined(POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
3097 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_RSA ||
3098 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA ||
3099 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_RSA ||
3100 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDH_ECDSA )
3101 {
3102 if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
3103 ssl->in_msg + 4, ssl->in_hslen - 4 ) ) != 0 )
3104 {
3105 SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
3106 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
3107 }
3108
3109 SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
3110
3111 if( ( ret = ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
3112 &ssl->handshake->pmslen,
3113 ssl->handshake->premaster,
3114 POLARSSL_MPI_MAX_SIZE,
3115 ssl->f_rng, ssl->p_rng ) ) != 0 )
3116 {
3117 SSL_DEBUG_RET( 1, "ecdh_calc_secret", ret );
3118 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS );
3119 }
3120
3121 SSL_DEBUG_MPI( 3, "ECDH: z ", &ssl->handshake->ecdh_ctx.z );
3122 }
3123 else
3124 #endif /* POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
3125 POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
3126 POLARSSL_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
3127 POLARSSL_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3128 #if defined(POLARSSL_KEY_EXCHANGE_PSK_ENABLED)
3129 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK )
3130 {
3131 unsigned char *p = ssl->in_msg + 4;
3132 unsigned char *end = ssl->in_msg + ssl->in_hslen;
3133
3134 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3135 {
3136 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
3137 return( ret );
3138 }
3139
3140 if( p != end )
3141 {
3142 SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3143 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3144 }
3145
3146 if( ( ret = ssl_psk_derive_premaster( ssl,
3147 ciphersuite_info->key_exchange ) ) != 0 )
3148 {
3149 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
3150 return( ret );
3151 }
3152 }
3153 else
3154 #endif /* POLARSSL_KEY_EXCHANGE_PSK_ENABLED */
3155 #if defined(POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED)
3156 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK )
3157 {
3158 unsigned char *p = ssl->in_msg + 4;
3159 unsigned char *end = ssl->in_msg + ssl->in_hslen;
3160
3161 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3162 {
3163 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
3164 return( ret );
3165 }
3166
3167 if( ( ret = ssl_parse_encrypted_pms( ssl, p, end, 2 ) ) != 0 )
3168 {
3169 SSL_DEBUG_RET( 1, ( "ssl_parse_encrypted_pms" ), ret );
3170 return( ret );
3171 }
3172
3173 if( ( ret = ssl_psk_derive_premaster( ssl,
3174 ciphersuite_info->key_exchange ) ) != 0 )
3175 {
3176 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
3177 return( ret );
3178 }
3179 }
3180 else
3181 #endif /* POLARSSL_KEY_EXCHANGE_RSA_PSK_ENABLED */
3182 #if defined(POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED)
3183 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
3184 {
3185 unsigned char *p = ssl->in_msg + 4;
3186 unsigned char *end = ssl->in_msg + ssl->in_hslen;
3187
3188 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3189 {
3190 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
3191 return( ret );
3192 }
3193 if( ( ret = ssl_parse_client_dh_public( ssl, &p, end ) ) != 0 )
3194 {
3195 SSL_DEBUG_RET( 1, ( "ssl_parse_client_dh_public" ), ret );
3196 return( ret );
3197 }
3198
3199 if( p != end )
3200 {
3201 SSL_DEBUG_MSG( 1, ( "bad client key exchange" ) );
3202 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE );
3203 }
3204
3205 if( ( ret = ssl_psk_derive_premaster( ssl,
3206 ciphersuite_info->key_exchange ) ) != 0 )
3207 {
3208 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
3209 return( ret );
3210 }
3211 }
3212 else
3213 #endif /* POLARSSL_KEY_EXCHANGE_DHE_PSK_ENABLED */
3214 #if defined(POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3215 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK )
3216 {
3217 unsigned char *p = ssl->in_msg + 4;
3218 unsigned char *end = ssl->in_msg + ssl->in_hslen;
3219
3220 if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
3221 {
3222 SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );
3223 return( ret );
3224 }
3225
3226 if( ( ret = ecdh_read_public( &ssl->handshake->ecdh_ctx,
3227 p, end - p ) ) != 0 )
3228 {
3229 SSL_DEBUG_RET( 1, "ecdh_read_public", ret );
3230 return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP );
3231 }
3232
3233 SSL_DEBUG_ECP( 3, "ECDH: Qp ", &ssl->handshake->ecdh_ctx.Qp );
3234
3235 if( ( ret = ssl_psk_derive_premaster( ssl,
3236 ciphersuite_info->key_exchange ) ) != 0 )
3237 {
3238 SSL_DEBUG_RET( 1, "ssl_psk_derive_premaster", ret );
3239 return( ret );
3240 }
3241 }
3242 else
3243 #endif /* POLARSSL_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
3244 #if defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED)
3245 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA )
3246 {
3247 if( ( ret = ssl_parse_encrypted_pms( ssl,
3248 ssl->in_msg + 4,
3249 ssl->in_msg + ssl->in_hslen,
3250 0 ) ) != 0 )
3251 {
3252 SSL_DEBUG_RET( 1, ( "ssl_parse_parse_encrypted_pms_secret" ), ret );
3253 return( ret );
3254 }
3255 }
3256 else
3257 #endif /* POLARSSL_KEY_EXCHANGE_RSA_ENABLED */
3258 {
3259 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3260 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
3261 }
3262
3263 if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
3264 {
3265 SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
3266 return( ret );
3267 }
3268
3269 ssl->state++;
3270
3271 SSL_DEBUG_MSG( 2, ( "<= parse client key exchange" ) );
3272
3273 return( 0 );
3274 }
3275
3276 #if !defined(POLARSSL_KEY_EXCHANGE_RSA_ENABLED) && \
3277 !defined(POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
3278 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
3279 !defined(POLARSSL_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3280 static int ssl_parse_certificate_verify( ssl_context *ssl )
3281 {
3282 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
3283
3284 SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
3285
3286 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
3287 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
3288 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
3289 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
3290 {
3291 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
3292 ssl->state++;
3293 return( 0 );
3294 }
3295
3296 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3297 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
3298 }
3299 #else
3300 static int ssl_parse_certificate_verify( ssl_context *ssl )
3301 {
3302 int ret = POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE;
3303 size_t sa_len, sig_len;
3304 unsigned char hash[48];
3305 unsigned char *hash_start = hash;
3306 size_t hashlen;
3307 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
3308 pk_type_t pk_alg;
3309 #endif
3310 md_type_t md_alg;
3311 const ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
3312
3313 SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
3314
3315 if( ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_PSK ||
3316 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_RSA_PSK ||
3317 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_ECDHE_PSK ||
3318 ciphersuite_info->key_exchange == POLARSSL_KEY_EXCHANGE_DHE_PSK )
3319 {
3320 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
3321 ssl->state++;
3322 return( 0 );
3323 }
3324
3325 if( ssl->session_negotiate->peer_cert == NULL )
3326 {
3327 SSL_DEBUG_MSG( 2, ( "<= skip parse certificate verify" ) );
3328 ssl->state++;
3329 return( 0 );
3330 }
3331
3332 ssl->handshake->calc_verify( ssl, hash );
3333
3334 if( ( ret = ssl_read_record( ssl ) ) != 0 )
3335 {
3336 SSL_DEBUG_RET( 1, "ssl_read_record", ret );
3337 return( ret );
3338 }
3339
3340 ssl->state++;
3341
3342 if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
3343 {
3344 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3345 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
3346 }
3347
3348 if( ssl->in_msg[0] != SSL_HS_CERTIFICATE_VERIFY )
3349 {
3350 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3351 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
3352 }
3353
3354 /*
3355 * 0 . 0 handshake type
3356 * 1 . 3 handshake length
3357 * 4 . 5 sig alg (TLS 1.2 only)
3358 * 4+n . 5+n signature length (n = sa_len)
3359 * 6+n . 6+n+m signature (m = sig_len)
3360 */
3361
3362 #if defined(POLARSSL_SSL_PROTO_SSL3) || defined(POLARSSL_SSL_PROTO_TLS1) || \
3363 defined(POLARSSL_SSL_PROTO_TLS1_1)
3364 if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
3365 {
3366 sa_len = 0;
3367
3368 md_alg = POLARSSL_MD_NONE;
3369 hashlen = 36;
3370
3371 /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */
3372 if( pk_can_do( &ssl->session_negotiate->peer_cert->pk,
3373 POLARSSL_PK_ECDSA ) )
3374 {
3375 hash_start += 16;
3376 hashlen -= 16;
3377 md_alg = POLARSSL_MD_SHA1;
3378 }
3379 }
3380 else
3381 #endif /* POLARSSL_SSL_PROTO_SSL3 || POLARSSL_SSL_PROTO_TLS1 ||
3382 POLARSSL_SSL_PROTO_TLS1_1 */
3383 #if defined(POLARSSL_SSL_PROTO_TLS1_2)
3384 if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
3385 {
3386 sa_len = 2;
3387
3388 /*
3389 * Hash
3390 */
3391 if( ssl->in_msg[4] != ssl->handshake->verify_sig_alg )
3392 {
3393 SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
3394 " for verify message" ) );
3395 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
3396 }
3397
3398 md_alg = ssl_md_alg_from_hash( ssl->handshake->verify_sig_alg );
3399
3400 /* Info from md_alg will be used instead */
3401 hashlen = 0;
3402
3403 /*
3404 * Signature
3405 */
3406 if( ( pk_alg = ssl_pk_alg_from_sig( ssl->in_msg[5] ) )
3407 == POLARSSL_PK_NONE )
3408 {
3409 SSL_DEBUG_MSG( 1, ( "peer not adhering to requested sig_alg"
3410 " for verify message" ) );
3411 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
3412 }
3413
3414 /*
3415 * Check the certificate's key type matches the signature alg
3416 */
3417 if( ! pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
3418 {
3419 SSL_DEBUG_MSG( 1, ( "sig_alg doesn't match cert key" ) );
3420 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
3421 }
3422 }
3423 else
3424 #endif /* POLARSSL_SSL_PROTO_TLS1_2 */
3425 {
3426 SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3427 return( POLARSSL_ERR_SSL_INTERNAL_ERROR );
3428 }
3429
3430 sig_len = ( ssl->in_msg[4 + sa_len] << 8 ) | ssl->in_msg[5 + sa_len];
3431
3432 if( sa_len + sig_len + 6 != ssl->in_hslen )
3433 {
3434 SSL_DEBUG_MSG( 1, ( "bad certificate verify message" ) );
3435 return( POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY );
3436 }
3437
3438 if( ( ret = pk_verify( &ssl->session_negotiate->peer_cert->pk,
3439 md_alg, hash_start, hashlen,
3440 ssl->in_msg + 6 + sa_len, sig_len ) ) != 0 )
3441 {
3442 SSL_DEBUG_RET( 1, "pk_verify", ret );
3443 return( ret );
3444 }
3445
3446 SSL_DEBUG_MSG( 2, ( "<= parse certificate verify" ) );
3447
3448 return( ret );
3449 }
3450 #endif /* !POLARSSL_KEY_EXCHANGE_RSA_ENABLED &&
3451 !POLARSSL_KEY_EXCHANGE_DHE_RSA_ENABLED &&
3452 !POLARSSL_KEY_EXCHANGE_ECDHE_RSA_ENABLED */
3453
3454 #if defined(POLARSSL_SSL_SESSION_TICKETS)
3455 static int ssl_write_new_session_ticket( ssl_context *ssl )
3456 {
3457 int ret;
3458 size_t tlen;
3459 uint32_t lifetime = (uint32_t) ssl->ticket_lifetime;
3460
3461 SSL_DEBUG_MSG( 2, ( "=> write new session ticket" ) );
3462
3463 ssl->out_msgtype = SSL_MSG_HANDSHAKE;
3464 ssl->out_msg[0] = SSL_HS_NEW_SESSION_TICKET;
3465
3466 /*
3467 * struct {
3468 * uint32 ticket_lifetime_hint;
3469 * opaque ticket<0..2^16-1>;
3470 * } NewSessionTicket;
3471 *
3472 * 4 . 7 ticket_lifetime_hint (0 = unspecified)
3473 * 8 . 9 ticket_len (n)
3474 * 10 . 9+n ticket content
3475 */
3476
3477 ssl->out_msg[4] = ( lifetime >> 24 ) & 0xFF;
3478 ssl->out_msg[5] = ( lifetime >> 16 ) & 0xFF;
3479 ssl->out_msg[6] = ( lifetime >> 8 ) & 0xFF;
3480 ssl->out_msg[7] = ( lifetime ) & 0xFF;
3481
3482 if( ( ret = ssl_write_ticket( ssl, &tlen ) ) != 0 )
3483 {
3484 SSL_DEBUG_RET( 1, "ssl_write_ticket", ret );
3485 tlen = 0;
3486 }
3487
3488 ssl->out_msg[8] = (unsigned char)( ( tlen >> 8 ) & 0xFF );
3489 ssl->out_msg[9] = (unsigned char)( ( tlen ) & 0xFF );
3490
3491 ssl->out_msglen = 10 + tlen;
3492
3493 /*
3494 * Morally equivalent to updating ssl->state, but NewSessionTicket and
3495 * ChangeCipherSpec share the same state.
3496 */
3497 ssl->handshake->new_session_ticket = 0;
3498
3499 if( ( ret = ssl_write_record( ssl ) ) != 0 )
3500 {
3501 SSL_DEBUG_RET( 1, "ssl_write_record", ret );
3502 return( ret );
3503 }
3504
3505 SSL_DEBUG_MSG( 2, ( "<= write new session ticket" ) );
3506
3507 return( 0 );
3508 }
3509 #endif /* POLARSSL_SSL_SESSION_TICKETS */
3510
3511 /*
3512 * SSL handshake -- server side -- single step
3513 */
3514 int ssl_handshake_server_step( ssl_context *ssl )
3515 {
3516 int ret = 0;
3517
3518 if( ssl->state == SSL_HANDSHAKE_OVER )
3519 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
3520
3521 SSL_DEBUG_MSG( 2, ( "server state: %d", ssl->state ) );
3522
3523 if( ( ret = ssl_flush_output( ssl ) ) != 0 )
3524 return( ret );
3525
3526 switch( ssl->state )
3527 {
3528 case SSL_HELLO_REQUEST:
3529 ssl->state = SSL_CLIENT_HELLO;
3530 break;
3531
3532 /*
3533 * <== ClientHello
3534 */
3535 case SSL_CLIENT_HELLO:
3536 ret = ssl_parse_client_hello( ssl );
3537 break;
3538
3539 /*
3540 * ==> ServerHello
3541 * Certificate
3542 * ( ServerKeyExchange )
3543 * ( CertificateRequest )
3544 * ServerHelloDone
3545 */
3546 case SSL_SERVER_HELLO:
3547 ret = ssl_write_server_hello( ssl );
3548 break;
3549
3550 case SSL_SERVER_CERTIFICATE:
3551 ret = ssl_write_certificate( ssl );
3552 break;
3553
3554 case SSL_SERVER_KEY_EXCHANGE:
3555 ret = ssl_write_server_key_exchange( ssl );
3556 break;
3557
3558 case SSL_CERTIFICATE_REQUEST:
3559 ret = ssl_write_certificate_request( ssl );
3560 break;
3561
3562 case SSL_SERVER_HELLO_DONE:
3563 ret = ssl_write_server_hello_done( ssl );
3564 break;
3565
3566 /*
3567 * <== ( Certificate/Alert )
3568 * ClientKeyExchange
3569 * ( CertificateVerify )
3570 * ChangeCipherSpec
3571 * Finished
3572 */
3573 case SSL_CLIENT_CERTIFICATE:
3574 ret = ssl_parse_certificate( ssl );
3575 break;
3576
3577 case SSL_CLIENT_KEY_EXCHANGE:
3578 ret = ssl_parse_client_key_exchange( ssl );
3579 break;
3580
3581 case SSL_CERTIFICATE_VERIFY:
3582 ret = ssl_parse_certificate_verify( ssl );
3583 break;
3584
3585 case SSL_CLIENT_CHANGE_CIPHER_SPEC:
3586 ret = ssl_parse_change_cipher_spec( ssl );
3587 break;
3588
3589 case SSL_CLIENT_FINISHED:
3590 ret = ssl_parse_finished( ssl );
3591 break;
3592
3593 /*
3594 * ==> ( NewSessionTicket )
3595 * ChangeCipherSpec
3596 * Finished
3597 */
3598 case SSL_SERVER_CHANGE_CIPHER_SPEC:
3599 #if defined(POLARSSL_SSL_SESSION_TICKETS)
3600 if( ssl->handshake->new_session_ticket != 0 )
3601 ret = ssl_write_new_session_ticket( ssl );
3602 else
3603 #endif
3604 ret = ssl_write_change_cipher_spec( ssl );
3605 break;
3606
3607 case SSL_SERVER_FINISHED:
3608 ret = ssl_write_finished( ssl );
3609 break;
3610
3611 case SSL_FLUSH_BUFFERS:
3612 SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3613 ssl->state = SSL_HANDSHAKE_WRAPUP;
3614 break;
3615
3616 case SSL_HANDSHAKE_WRAPUP:
3617 ssl_handshake_wrapup( ssl );
3618 break;
3619
3620 default:
3621 SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3622 return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
3623 }
3624
3625 return( ret );
3626 }
3627 #endif /* POLARSSL_SSL_SRV_C */
simple coroutine-based http/https proxy server