/src/openthread/third_party/mbedtls/repo/library/ssl_srv.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * SSLv3/TLSv1 server-side functions |
3 | | * |
4 | | * Copyright The Mbed TLS Contributors |
5 | | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
6 | | */ |
7 | | |
8 | | #include "common.h" |
9 | | |
10 | | #if defined(MBEDTLS_SSL_SRV_C) |
11 | | |
12 | | #include "mbedtls/platform.h" |
13 | | |
14 | | #include "mbedtls/ssl.h" |
15 | | #include "mbedtls/ssl_internal.h" |
16 | | #include "mbedtls/debug.h" |
17 | | #include "mbedtls/error.h" |
18 | | #include "mbedtls/platform_util.h" |
19 | | #include "constant_time_internal.h" |
20 | | #include "mbedtls/constant_time.h" |
21 | | |
22 | | #include <string.h> |
23 | | |
24 | | #if defined(MBEDTLS_ECP_C) |
25 | | #include "mbedtls/ecp.h" |
26 | | #endif |
27 | | |
28 | | #if defined(MBEDTLS_HAVE_TIME) |
29 | | #include "mbedtls/platform_time.h" |
30 | | #endif |
31 | | |
32 | | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
33 | | int mbedtls_ssl_set_client_transport_id(mbedtls_ssl_context *ssl, |
34 | | const unsigned char *info, |
35 | | size_t ilen) |
36 | 4.77k | { |
37 | 4.77k | if (ssl->conf->endpoint != MBEDTLS_SSL_IS_SERVER) { |
38 | 0 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
39 | 0 | } |
40 | | |
41 | 4.77k | mbedtls_free(ssl->cli_id); |
42 | | |
43 | 4.77k | if ((ssl->cli_id = mbedtls_calloc(1, ilen)) == NULL) { |
44 | 0 | return MBEDTLS_ERR_SSL_ALLOC_FAILED; |
45 | 0 | } |
46 | | |
47 | 4.77k | memcpy(ssl->cli_id, info, ilen); |
48 | 4.77k | ssl->cli_id_len = ilen; |
49 | | |
50 | 4.77k | return 0; |
51 | 4.77k | } |
52 | | |
53 | | void mbedtls_ssl_conf_dtls_cookies(mbedtls_ssl_config *conf, |
54 | | mbedtls_ssl_cookie_write_t *f_cookie_write, |
55 | | mbedtls_ssl_cookie_check_t *f_cookie_check, |
56 | | void *p_cookie) |
57 | 4.01k | { |
58 | 4.01k | conf->f_cookie_write = f_cookie_write; |
59 | 4.01k | conf->f_cookie_check = f_cookie_check; |
60 | 4.01k | conf->p_cookie = p_cookie; |
61 | 4.01k | } |
62 | | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
63 | | |
64 | | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
65 | | MBEDTLS_CHECK_RETURN_CRITICAL |
66 | | static int ssl_parse_servername_ext(mbedtls_ssl_context *ssl, |
67 | | const unsigned char *buf, |
68 | | size_t len) |
69 | | { |
70 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
71 | | size_t servername_list_size, hostname_len; |
72 | | const unsigned char *p; |
73 | | |
74 | | MBEDTLS_SSL_DEBUG_MSG(3, ("parse ServerName extension")); |
75 | | |
76 | | if (len < 2) { |
77 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
78 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
79 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
80 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
81 | | } |
82 | | servername_list_size = ((buf[0] << 8) | (buf[1])); |
83 | | if (servername_list_size + 2 != len) { |
84 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
85 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
86 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
87 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
88 | | } |
89 | | |
90 | | p = buf + 2; |
91 | | while (servername_list_size > 2) { |
92 | | hostname_len = ((p[1] << 8) | p[2]); |
93 | | if (hostname_len + 3 > servername_list_size) { |
94 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
95 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
96 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
97 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
98 | | } |
99 | | |
100 | | if (p[0] == MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME) { |
101 | | ret = ssl->conf->f_sni(ssl->conf->p_sni, |
102 | | ssl, p + 3, hostname_len); |
103 | | if (ret != 0) { |
104 | | MBEDTLS_SSL_DEBUG_RET(1, "ssl_sni_wrapper", ret); |
105 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
106 | | MBEDTLS_SSL_ALERT_MSG_UNRECOGNIZED_NAME); |
107 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
108 | | } |
109 | | return 0; |
110 | | } |
111 | | |
112 | | servername_list_size -= hostname_len + 3; |
113 | | p += hostname_len + 3; |
114 | | } |
115 | | |
116 | | if (servername_list_size != 0) { |
117 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
118 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
119 | | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
120 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
121 | | } |
122 | | |
123 | | return 0; |
124 | | } |
125 | | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
126 | | |
127 | | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
128 | | MBEDTLS_CHECK_RETURN_CRITICAL |
129 | | static int ssl_conf_has_psk_or_cb(mbedtls_ssl_config const *conf) |
130 | 0 | { |
131 | 0 | if (conf->f_psk != NULL) { |
132 | 0 | return 1; |
133 | 0 | } |
134 | | |
135 | 0 | if (conf->psk_identity_len == 0 || conf->psk_identity == NULL) { |
136 | 0 | return 0; |
137 | 0 | } |
138 | | |
139 | 0 | if (conf->psk != NULL && conf->psk_len != 0) { |
140 | 0 | return 1; |
141 | 0 | } |
142 | | |
143 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
144 | | if (!mbedtls_svc_key_id_is_null(conf->psk_opaque)) { |
145 | | return 1; |
146 | | } |
147 | | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
148 | | |
149 | 0 | return 0; |
150 | 0 | } |
151 | | |
152 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
153 | | MBEDTLS_CHECK_RETURN_CRITICAL |
154 | | static int ssl_use_opaque_psk(mbedtls_ssl_context const *ssl) |
155 | | { |
156 | | if (ssl->conf->f_psk != NULL) { |
157 | | /* If we've used a callback to select the PSK, |
158 | | * the static configuration is irrelevant. */ |
159 | | |
160 | | if (!mbedtls_svc_key_id_is_null(ssl->handshake->psk_opaque)) { |
161 | | return 1; |
162 | | } |
163 | | |
164 | | return 0; |
165 | | } |
166 | | |
167 | | if (!mbedtls_svc_key_id_is_null(ssl->conf->psk_opaque)) { |
168 | | return 1; |
169 | | } |
170 | | |
171 | | return 0; |
172 | | } |
173 | | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
174 | | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
175 | | |
176 | | MBEDTLS_CHECK_RETURN_CRITICAL |
177 | | static int ssl_parse_renegotiation_info(mbedtls_ssl_context *ssl, |
178 | | const unsigned char *buf, |
179 | | size_t len) |
180 | 0 | { |
181 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
182 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
183 | | /* Check verify-data in constant-time. The length OTOH is no secret */ |
184 | | if (len != 1 + ssl->verify_data_len || |
185 | | buf[0] != ssl->verify_data_len || |
186 | | mbedtls_ct_memcmp(buf + 1, ssl->peer_verify_data, |
187 | | ssl->verify_data_len) != 0) { |
188 | | MBEDTLS_SSL_DEBUG_MSG(1, ("non-matching renegotiation info")); |
189 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
190 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
191 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
192 | | } |
193 | | } else |
194 | | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
195 | 0 | { |
196 | 0 | if (len != 1 || buf[0] != 0x0) { |
197 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("non-zero length renegotiation info")); |
198 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
199 | 0 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
200 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
201 | 0 | } |
202 | | |
203 | 0 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
204 | 0 | } |
205 | | |
206 | 0 | return 0; |
207 | 0 | } |
208 | | |
209 | | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
210 | | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
211 | | |
212 | | /* |
213 | | * Status of the implementation of signature-algorithms extension: |
214 | | * |
215 | | * Currently, we are only considering the signature-algorithm extension |
216 | | * to pick a ciphersuite which allows us to send the ServerKeyExchange |
217 | | * message with a signature-hash combination that the user allows. |
218 | | * |
219 | | * We do *not* check whether all certificates in our certificate |
220 | | * chain are signed with an allowed signature-hash pair. |
221 | | * This needs to be done at a later stage. |
222 | | * |
223 | | */ |
224 | | MBEDTLS_CHECK_RETURN_CRITICAL |
225 | | static int ssl_parse_signature_algorithms_ext(mbedtls_ssl_context *ssl, |
226 | | const unsigned char *buf, |
227 | | size_t len) |
228 | 0 | { |
229 | 0 | size_t sig_alg_list_size; |
230 | |
|
231 | 0 | const unsigned char *p; |
232 | 0 | const unsigned char *end = buf + len; |
233 | |
|
234 | 0 | mbedtls_md_type_t md_cur; |
235 | 0 | mbedtls_pk_type_t sig_cur; |
236 | |
|
237 | 0 | if (len < 2) { |
238 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
239 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
240 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
241 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
242 | 0 | } |
243 | 0 | sig_alg_list_size = ((buf[0] << 8) | (buf[1])); |
244 | 0 | if (sig_alg_list_size + 2 != len || |
245 | 0 | sig_alg_list_size % 2 != 0) { |
246 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
247 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
248 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
249 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
250 | 0 | } |
251 | | |
252 | | /* Currently we only guarantee signing the ServerKeyExchange message according |
253 | | * to the constraints specified in this extension (see above), so it suffices |
254 | | * to remember only one suitable hash for each possible signature algorithm. |
255 | | * |
256 | | * This will change when we also consider certificate signatures, |
257 | | * in which case we will need to remember the whole signature-hash |
258 | | * pair list from the extension. |
259 | | */ |
260 | | |
261 | 0 | for (p = buf + 2; p < end; p += 2) { |
262 | | /* Silently ignore unknown signature or hash algorithms. */ |
263 | |
|
264 | 0 | if ((sig_cur = mbedtls_ssl_pk_alg_from_sig(p[1])) == MBEDTLS_PK_NONE) { |
265 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext" |
266 | 0 | " unknown sig alg encoding %d", p[1])); |
267 | 0 | continue; |
268 | 0 | } |
269 | | |
270 | | /* Check if we support the hash the user proposes */ |
271 | 0 | md_cur = mbedtls_ssl_md_alg_from_hash(p[0]); |
272 | 0 | if (md_cur == MBEDTLS_MD_NONE) { |
273 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext:" |
274 | 0 | " unknown hash alg encoding %d", p[0])); |
275 | 0 | continue; |
276 | 0 | } |
277 | | |
278 | 0 | if (mbedtls_ssl_check_sig_hash(ssl, md_cur) == 0) { |
279 | 0 | mbedtls_ssl_sig_hash_set_add(&ssl->handshake->hash_algs, sig_cur, md_cur); |
280 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext:" |
281 | 0 | " match sig %u and hash %u", |
282 | 0 | (unsigned) sig_cur, (unsigned) md_cur)); |
283 | 0 | } else { |
284 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext: " |
285 | 0 | "hash alg %u not supported", (unsigned) md_cur)); |
286 | 0 | } |
287 | 0 | } |
288 | |
|
289 | 0 | return 0; |
290 | 0 | } |
291 | | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
292 | | MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
293 | | |
294 | | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
295 | | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
296 | | MBEDTLS_CHECK_RETURN_CRITICAL |
297 | | static int ssl_parse_supported_elliptic_curves(mbedtls_ssl_context *ssl, |
298 | | const unsigned char *buf, |
299 | | size_t len) |
300 | 0 | { |
301 | 0 | size_t list_size, our_size; |
302 | 0 | const unsigned char *p; |
303 | 0 | const mbedtls_ecp_curve_info *curve_info, **curves; |
304 | |
|
305 | 0 | if (len < 2) { |
306 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
307 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
308 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
309 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
310 | 0 | } |
311 | 0 | list_size = ((buf[0] << 8) | (buf[1])); |
312 | 0 | if (list_size + 2 != len || |
313 | 0 | list_size % 2 != 0) { |
314 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
315 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
316 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
317 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
318 | 0 | } |
319 | | |
320 | | /* Should never happen unless client duplicates the extension */ |
321 | 0 | if (ssl->handshake->curves != NULL) { |
322 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
323 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
324 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
325 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
326 | 0 | } |
327 | | |
328 | | /* Don't allow our peer to make us allocate too much memory, |
329 | | * and leave room for a final 0 */ |
330 | 0 | our_size = list_size / 2 + 1; |
331 | 0 | if (our_size > MBEDTLS_ECP_DP_MAX) { |
332 | 0 | our_size = MBEDTLS_ECP_DP_MAX; |
333 | 0 | } |
334 | |
|
335 | 0 | if ((curves = mbedtls_calloc(our_size, sizeof(*curves))) == NULL) { |
336 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
337 | 0 | MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR); |
338 | 0 | return MBEDTLS_ERR_SSL_ALLOC_FAILED; |
339 | 0 | } |
340 | | |
341 | 0 | ssl->handshake->curves = curves; |
342 | |
|
343 | 0 | p = buf + 2; |
344 | 0 | while (list_size > 0 && our_size > 1) { |
345 | 0 | curve_info = mbedtls_ecp_curve_info_from_tls_id((p[0] << 8) | p[1]); |
346 | |
|
347 | 0 | if (curve_info != NULL) { |
348 | 0 | *curves++ = curve_info; |
349 | 0 | our_size--; |
350 | 0 | } |
351 | |
|
352 | 0 | list_size -= 2; |
353 | 0 | p += 2; |
354 | 0 | } |
355 | |
|
356 | 0 | return 0; |
357 | 0 | } |
358 | | |
359 | | MBEDTLS_CHECK_RETURN_CRITICAL |
360 | | static int ssl_parse_supported_point_formats(mbedtls_ssl_context *ssl, |
361 | | const unsigned char *buf, |
362 | | size_t len) |
363 | 0 | { |
364 | 0 | size_t list_size; |
365 | 0 | const unsigned char *p; |
366 | |
|
367 | 0 | if (len == 0 || (size_t) (buf[0] + 1) != len) { |
368 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
369 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
370 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
371 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
372 | 0 | } |
373 | 0 | list_size = buf[0]; |
374 | |
|
375 | 0 | p = buf + 1; |
376 | 0 | while (list_size > 0) { |
377 | 0 | if (p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED || |
378 | 0 | p[0] == MBEDTLS_ECP_PF_COMPRESSED) { |
379 | 0 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
380 | 0 | ssl->handshake->ecdh_ctx.point_format = p[0]; |
381 | 0 | #endif |
382 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
383 | 0 | ssl->handshake->ecjpake_ctx.point_format = p[0]; |
384 | 0 | #endif |
385 | 0 | MBEDTLS_SSL_DEBUG_MSG(4, ("point format selected: %d", p[0])); |
386 | 0 | return 0; |
387 | 0 | } |
388 | | |
389 | 0 | list_size--; |
390 | 0 | p++; |
391 | 0 | } |
392 | | |
393 | 0 | return 0; |
394 | 0 | } |
395 | | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
396 | | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
397 | | |
398 | | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
399 | | MBEDTLS_CHECK_RETURN_CRITICAL |
400 | | static int ssl_parse_ecjpake_kkpp(mbedtls_ssl_context *ssl, |
401 | | const unsigned char *buf, |
402 | | size_t len) |
403 | 0 | { |
404 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
405 | |
|
406 | 0 | if (mbedtls_ecjpake_check(&ssl->handshake->ecjpake_ctx) != 0) { |
407 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("skip ecjpake kkpp extension")); |
408 | 0 | return 0; |
409 | 0 | } |
410 | | |
411 | 0 | if ((ret = mbedtls_ecjpake_read_round_one(&ssl->handshake->ecjpake_ctx, |
412 | 0 | buf, len)) != 0) { |
413 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_one", ret); |
414 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
415 | 0 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
416 | 0 | return ret; |
417 | 0 | } |
418 | | |
419 | | /* Only mark the extension as OK when we're sure it is */ |
420 | 0 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK; |
421 | |
|
422 | 0 | return 0; |
423 | 0 | } |
424 | | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
425 | | |
426 | | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
427 | | MBEDTLS_CHECK_RETURN_CRITICAL |
428 | | static int ssl_parse_max_fragment_length_ext(mbedtls_ssl_context *ssl, |
429 | | const unsigned char *buf, |
430 | | size_t len) |
431 | 0 | { |
432 | 0 | if (len != 1 || buf[0] >= MBEDTLS_SSL_MAX_FRAG_LEN_INVALID) { |
433 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
434 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
435 | 0 | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
436 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
437 | 0 | } |
438 | | |
439 | 0 | ssl->session_negotiate->mfl_code = buf[0]; |
440 | |
|
441 | 0 | return 0; |
442 | 0 | } |
443 | | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
444 | | |
445 | | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
446 | | MBEDTLS_CHECK_RETURN_CRITICAL |
447 | | static int ssl_parse_cid_ext(mbedtls_ssl_context *ssl, |
448 | | const unsigned char *buf, |
449 | | size_t len) |
450 | | { |
451 | | size_t peer_cid_len; |
452 | | |
453 | | /* CID extension only makes sense in DTLS */ |
454 | | if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
455 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
456 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
457 | | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
458 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
459 | | } |
460 | | |
461 | | /* |
462 | | * Quoting draft-ietf-tls-dtls-connection-id-05 |
463 | | * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05 |
464 | | * |
465 | | * struct { |
466 | | * opaque cid<0..2^8-1>; |
467 | | * } ConnectionId; |
468 | | */ |
469 | | |
470 | | if (len < 1) { |
471 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
472 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
473 | | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
474 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
475 | | } |
476 | | |
477 | | peer_cid_len = *buf++; |
478 | | len--; |
479 | | |
480 | | if (len != peer_cid_len) { |
481 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
482 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
483 | | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
484 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
485 | | } |
486 | | |
487 | | /* Ignore CID if the user has disabled its use. */ |
488 | | if (ssl->negotiate_cid == MBEDTLS_SSL_CID_DISABLED) { |
489 | | /* Leave ssl->handshake->cid_in_use in its default |
490 | | * value of MBEDTLS_SSL_CID_DISABLED. */ |
491 | | MBEDTLS_SSL_DEBUG_MSG(3, ("Client sent CID extension, but CID disabled")); |
492 | | return 0; |
493 | | } |
494 | | |
495 | | if (peer_cid_len > MBEDTLS_SSL_CID_OUT_LEN_MAX) { |
496 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
497 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
498 | | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
499 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
500 | | } |
501 | | |
502 | | ssl->handshake->cid_in_use = MBEDTLS_SSL_CID_ENABLED; |
503 | | ssl->handshake->peer_cid_len = (uint8_t) peer_cid_len; |
504 | | memcpy(ssl->handshake->peer_cid, buf, peer_cid_len); |
505 | | |
506 | | MBEDTLS_SSL_DEBUG_MSG(3, ("Use of CID extension negotiated")); |
507 | | MBEDTLS_SSL_DEBUG_BUF(3, "Client CID", buf, peer_cid_len); |
508 | | |
509 | | return 0; |
510 | | } |
511 | | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
512 | | |
513 | | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
514 | | MBEDTLS_CHECK_RETURN_CRITICAL |
515 | | static int ssl_parse_truncated_hmac_ext(mbedtls_ssl_context *ssl, |
516 | | const unsigned char *buf, |
517 | | size_t len) |
518 | | { |
519 | | if (len != 0) { |
520 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
521 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
522 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
523 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
524 | | } |
525 | | |
526 | | ((void) buf); |
527 | | |
528 | | if (ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_ENABLED) { |
529 | | ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED; |
530 | | } |
531 | | |
532 | | return 0; |
533 | | } |
534 | | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
535 | | |
536 | | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
537 | | MBEDTLS_CHECK_RETURN_CRITICAL |
538 | | static int ssl_parse_encrypt_then_mac_ext(mbedtls_ssl_context *ssl, |
539 | | const unsigned char *buf, |
540 | | size_t len) |
541 | | { |
542 | | if (len != 0) { |
543 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
544 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
545 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
546 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
547 | | } |
548 | | |
549 | | ((void) buf); |
550 | | |
551 | | if (ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED && |
552 | | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0) { |
553 | | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED; |
554 | | } |
555 | | |
556 | | return 0; |
557 | | } |
558 | | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
559 | | |
560 | | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
561 | | MBEDTLS_CHECK_RETURN_CRITICAL |
562 | | static int ssl_parse_extended_ms_ext(mbedtls_ssl_context *ssl, |
563 | | const unsigned char *buf, |
564 | | size_t len) |
565 | | { |
566 | | if (len != 0) { |
567 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
568 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
569 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
570 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
571 | | } |
572 | | |
573 | | ((void) buf); |
574 | | |
575 | | if (ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED && |
576 | | ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0) { |
577 | | ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED; |
578 | | } |
579 | | |
580 | | return 0; |
581 | | } |
582 | | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
583 | | |
584 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
585 | | MBEDTLS_CHECK_RETURN_CRITICAL |
586 | | static int ssl_parse_session_ticket_ext(mbedtls_ssl_context *ssl, |
587 | | unsigned char *buf, |
588 | | size_t len) |
589 | | { |
590 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
591 | | mbedtls_ssl_session session; |
592 | | |
593 | | mbedtls_ssl_session_init(&session); |
594 | | |
595 | | if (ssl->conf->f_ticket_parse == NULL || |
596 | | ssl->conf->f_ticket_write == NULL) { |
597 | | return 0; |
598 | | } |
599 | | |
600 | | /* Remember the client asked us to send a new ticket */ |
601 | | ssl->handshake->new_session_ticket = 1; |
602 | | |
603 | | MBEDTLS_SSL_DEBUG_MSG(3, ("ticket length: %" MBEDTLS_PRINTF_SIZET, len)); |
604 | | |
605 | | if (len == 0) { |
606 | | return 0; |
607 | | } |
608 | | |
609 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
610 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
611 | | MBEDTLS_SSL_DEBUG_MSG(3, ("ticket rejected: renegotiating")); |
612 | | return 0; |
613 | | } |
614 | | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
615 | | |
616 | | /* |
617 | | * Failures are ok: just ignore the ticket and proceed. |
618 | | */ |
619 | | if ((ret = ssl->conf->f_ticket_parse(ssl->conf->p_ticket, &session, |
620 | | buf, len)) != 0) { |
621 | | mbedtls_ssl_session_free(&session); |
622 | | |
623 | | if (ret == MBEDTLS_ERR_SSL_INVALID_MAC) { |
624 | | MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is not authentic")); |
625 | | } else if (ret == MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED) { |
626 | | MBEDTLS_SSL_DEBUG_MSG(3, ("ticket is expired")); |
627 | | } else { |
628 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_parse", ret); |
629 | | } |
630 | | |
631 | | return 0; |
632 | | } |
633 | | |
634 | | /* |
635 | | * Keep the session ID sent by the client, since we MUST send it back to |
636 | | * inform them we're accepting the ticket (RFC 5077 section 3.4) |
637 | | */ |
638 | | session.id_len = ssl->session_negotiate->id_len; |
639 | | memcpy(&session.id, ssl->session_negotiate->id, session.id_len); |
640 | | |
641 | | mbedtls_ssl_session_free(ssl->session_negotiate); |
642 | | memcpy(ssl->session_negotiate, &session, sizeof(mbedtls_ssl_session)); |
643 | | |
644 | | /* Zeroize instead of free as we copied the content */ |
645 | | mbedtls_platform_zeroize(&session, sizeof(mbedtls_ssl_session)); |
646 | | |
647 | | MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from ticket")); |
648 | | |
649 | | ssl->handshake->resume = 1; |
650 | | |
651 | | /* Don't send a new ticket after all, this one is OK */ |
652 | | ssl->handshake->new_session_ticket = 0; |
653 | | |
654 | | return 0; |
655 | | } |
656 | | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
657 | | |
658 | | #if defined(MBEDTLS_SSL_ALPN) |
659 | | MBEDTLS_CHECK_RETURN_CRITICAL |
660 | | static int ssl_parse_alpn_ext(mbedtls_ssl_context *ssl, |
661 | | const unsigned char *buf, size_t len) |
662 | | { |
663 | | size_t list_len, cur_len, ours_len; |
664 | | const unsigned char *theirs, *start, *end; |
665 | | const char **ours; |
666 | | |
667 | | /* If ALPN not configured, just ignore the extension */ |
668 | | if (ssl->conf->alpn_list == NULL) { |
669 | | return 0; |
670 | | } |
671 | | |
672 | | /* |
673 | | * opaque ProtocolName<1..2^8-1>; |
674 | | * |
675 | | * struct { |
676 | | * ProtocolName protocol_name_list<2..2^16-1> |
677 | | * } ProtocolNameList; |
678 | | */ |
679 | | |
680 | | /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */ |
681 | | if (len < 4) { |
682 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
683 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
684 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
685 | | } |
686 | | |
687 | | list_len = (buf[0] << 8) | buf[1]; |
688 | | if (list_len != len - 2) { |
689 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
690 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
691 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
692 | | } |
693 | | |
694 | | /* |
695 | | * Validate peer's list (lengths) |
696 | | */ |
697 | | start = buf + 2; |
698 | | end = buf + len; |
699 | | for (theirs = start; theirs != end; theirs += cur_len) { |
700 | | cur_len = *theirs++; |
701 | | |
702 | | /* Current identifier must fit in list */ |
703 | | if (cur_len > (size_t) (end - theirs)) { |
704 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
705 | | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
706 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
707 | | } |
708 | | |
709 | | /* Empty strings MUST NOT be included */ |
710 | | if (cur_len == 0) { |
711 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
712 | | MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); |
713 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
714 | | } |
715 | | } |
716 | | |
717 | | /* |
718 | | * Use our order of preference |
719 | | */ |
720 | | for (ours = ssl->conf->alpn_list; *ours != NULL; ours++) { |
721 | | ours_len = strlen(*ours); |
722 | | for (theirs = start; theirs != end; theirs += cur_len) { |
723 | | cur_len = *theirs++; |
724 | | |
725 | | if (cur_len == ours_len && |
726 | | memcmp(theirs, *ours, cur_len) == 0) { |
727 | | ssl->alpn_chosen = *ours; |
728 | | return 0; |
729 | | } |
730 | | } |
731 | | } |
732 | | |
733 | | /* If we get there, no match was found */ |
734 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
735 | | MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL); |
736 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
737 | | } |
738 | | #endif /* MBEDTLS_SSL_ALPN */ |
739 | | |
740 | | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
741 | | MBEDTLS_CHECK_RETURN_CRITICAL |
742 | | static int ssl_parse_use_srtp_ext(mbedtls_ssl_context *ssl, |
743 | | const unsigned char *buf, |
744 | | size_t len) |
745 | | { |
746 | | mbedtls_ssl_srtp_profile client_protection = MBEDTLS_TLS_SRTP_UNSET; |
747 | | size_t i, j; |
748 | | size_t profile_length; |
749 | | uint16_t mki_length; |
750 | | /*! 2 bytes for profile length and 1 byte for mki len */ |
751 | | const size_t size_of_lengths = 3; |
752 | | |
753 | | /* If use_srtp is not configured, just ignore the extension */ |
754 | | if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || |
755 | | (ssl->conf->dtls_srtp_profile_list == NULL) || |
756 | | (ssl->conf->dtls_srtp_profile_list_len == 0)) { |
757 | | return 0; |
758 | | } |
759 | | |
760 | | /* RFC5764 section 4.1.1 |
761 | | * uint8 SRTPProtectionProfile[2]; |
762 | | * |
763 | | * struct { |
764 | | * SRTPProtectionProfiles SRTPProtectionProfiles; |
765 | | * opaque srtp_mki<0..255>; |
766 | | * } UseSRTPData; |
767 | | |
768 | | * SRTPProtectionProfile SRTPProtectionProfiles<2..2^16-1>; |
769 | | */ |
770 | | |
771 | | /* |
772 | | * Min length is 5: at least one protection profile(2 bytes) |
773 | | * and length(2 bytes) + srtp_mki length(1 byte) |
774 | | * Check here that we have at least 2 bytes of protection profiles length |
775 | | * and one of srtp_mki length |
776 | | */ |
777 | | if (len < size_of_lengths) { |
778 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
779 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
780 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
781 | | } |
782 | | |
783 | | ssl->dtls_srtp_info.chosen_dtls_srtp_profile = MBEDTLS_TLS_SRTP_UNSET; |
784 | | |
785 | | /* first 2 bytes are protection profile length(in bytes) */ |
786 | | profile_length = (buf[0] << 8) | buf[1]; |
787 | | buf += 2; |
788 | | |
789 | | /* The profile length cannot be bigger than input buffer size - lengths fields */ |
790 | | if (profile_length > len - size_of_lengths || |
791 | | profile_length % 2 != 0) { /* profiles are 2 bytes long, so the length must be even */ |
792 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
793 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
794 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
795 | | } |
796 | | /* |
797 | | * parse the extension list values are defined in |
798 | | * http://www.iana.org/assignments/srtp-protection/srtp-protection.xhtml |
799 | | */ |
800 | | for (j = 0; j < profile_length; j += 2) { |
801 | | uint16_t protection_profile_value = buf[j] << 8 | buf[j + 1]; |
802 | | client_protection = mbedtls_ssl_check_srtp_profile_value(protection_profile_value); |
803 | | |
804 | | if (client_protection != MBEDTLS_TLS_SRTP_UNSET) { |
805 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found srtp profile: %s", |
806 | | mbedtls_ssl_get_srtp_profile_as_string( |
807 | | client_protection))); |
808 | | } else { |
809 | | continue; |
810 | | } |
811 | | /* check if suggested profile is in our list */ |
812 | | for (i = 0; i < ssl->conf->dtls_srtp_profile_list_len; i++) { |
813 | | if (client_protection == ssl->conf->dtls_srtp_profile_list[i]) { |
814 | | ssl->dtls_srtp_info.chosen_dtls_srtp_profile = ssl->conf->dtls_srtp_profile_list[i]; |
815 | | MBEDTLS_SSL_DEBUG_MSG(3, ("selected srtp profile: %s", |
816 | | mbedtls_ssl_get_srtp_profile_as_string( |
817 | | client_protection))); |
818 | | break; |
819 | | } |
820 | | } |
821 | | if (ssl->dtls_srtp_info.chosen_dtls_srtp_profile != MBEDTLS_TLS_SRTP_UNSET) { |
822 | | break; |
823 | | } |
824 | | } |
825 | | buf += profile_length; /* buf points to the mki length */ |
826 | | mki_length = *buf; |
827 | | buf++; |
828 | | |
829 | | if (mki_length > MBEDTLS_TLS_SRTP_MAX_MKI_LENGTH || |
830 | | mki_length + profile_length + size_of_lengths != len) { |
831 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
832 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
833 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
834 | | } |
835 | | |
836 | | /* Parse the mki only if present and mki is supported locally */ |
837 | | if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED && |
838 | | mki_length > 0) { |
839 | | ssl->dtls_srtp_info.mki_len = mki_length; |
840 | | |
841 | | memcpy(ssl->dtls_srtp_info.mki_value, buf, mki_length); |
842 | | |
843 | | MBEDTLS_SSL_DEBUG_BUF(3, "using mki", ssl->dtls_srtp_info.mki_value, |
844 | | ssl->dtls_srtp_info.mki_len); |
845 | | } |
846 | | |
847 | | return 0; |
848 | | } |
849 | | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
850 | | |
851 | | /* |
852 | | * Auxiliary functions for ServerHello parsing and related actions |
853 | | */ |
854 | | |
855 | | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
856 | | /* |
857 | | * Return 0 if the given key uses one of the acceptable curves, -1 otherwise |
858 | | */ |
859 | | #if defined(MBEDTLS_ECDSA_C) |
860 | | MBEDTLS_CHECK_RETURN_CRITICAL |
861 | | static int ssl_check_key_curve(mbedtls_pk_context *pk, |
862 | | const mbedtls_ecp_curve_info **curves) |
863 | 0 | { |
864 | 0 | const mbedtls_ecp_curve_info **crv = curves; |
865 | 0 | mbedtls_ecp_group_id grp_id = mbedtls_pk_ec(*pk)->grp.id; |
866 | |
|
867 | 0 | while (*crv != NULL) { |
868 | 0 | if ((*crv)->grp_id == grp_id) { |
869 | 0 | return 0; |
870 | 0 | } |
871 | 0 | crv++; |
872 | 0 | } |
873 | | |
874 | 0 | return -1; |
875 | 0 | } |
876 | | #endif /* MBEDTLS_ECDSA_C */ |
877 | | |
878 | | /* |
879 | | * Try picking a certificate for this ciphersuite, |
880 | | * return 0 on success and -1 on failure. |
881 | | */ |
882 | | MBEDTLS_CHECK_RETURN_CRITICAL |
883 | | static int ssl_pick_cert(mbedtls_ssl_context *ssl, |
884 | | const mbedtls_ssl_ciphersuite_t *ciphersuite_info) |
885 | 0 | { |
886 | 0 | mbedtls_ssl_key_cert *cur, *list, *fallback = NULL; |
887 | 0 | mbedtls_pk_type_t pk_alg = |
888 | 0 | mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info); |
889 | 0 | uint32_t flags; |
890 | |
|
891 | | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
892 | | if (ssl->handshake->sni_key_cert != NULL) { |
893 | | list = ssl->handshake->sni_key_cert; |
894 | | } else |
895 | | #endif |
896 | 0 | list = ssl->conf->key_cert; |
897 | |
|
898 | 0 | if (pk_alg == MBEDTLS_PK_NONE) { |
899 | 0 | return 0; |
900 | 0 | } |
901 | | |
902 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite requires certificate")); |
903 | |
|
904 | 0 | if (list == NULL) { |
905 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server has no certificate")); |
906 | 0 | return -1; |
907 | 0 | } |
908 | | |
909 | 0 | for (cur = list; cur != NULL; cur = cur->next) { |
910 | 0 | flags = 0; |
911 | 0 | MBEDTLS_SSL_DEBUG_CRT(3, "candidate certificate chain, certificate", |
912 | 0 | cur->cert); |
913 | |
|
914 | 0 | if (!mbedtls_pk_can_do(&cur->cert->pk, pk_alg)) { |
915 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: key type")); |
916 | 0 | continue; |
917 | 0 | } |
918 | | |
919 | | /* |
920 | | * This avoids sending the client a cert it'll reject based on |
921 | | * keyUsage or other extensions. |
922 | | * |
923 | | * It also allows the user to provision different certificates for |
924 | | * different uses based on keyUsage, eg if they want to avoid signing |
925 | | * and decrypting with the same RSA key. |
926 | | */ |
927 | 0 | if (mbedtls_ssl_check_cert_usage(cur->cert, ciphersuite_info, |
928 | 0 | MBEDTLS_SSL_IS_SERVER, &flags) != 0) { |
929 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: " |
930 | 0 | "(extended) key usage extension")); |
931 | 0 | continue; |
932 | 0 | } |
933 | | |
934 | 0 | #if defined(MBEDTLS_ECDSA_C) |
935 | 0 | if (pk_alg == MBEDTLS_PK_ECDSA && |
936 | 0 | ssl_check_key_curve(&cur->cert->pk, ssl->handshake->curves) != 0) { |
937 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: elliptic curve")); |
938 | 0 | continue; |
939 | 0 | } |
940 | 0 | #endif |
941 | | |
942 | | /* |
943 | | * Try to select a SHA-1 certificate for pre-1.2 clients, but still |
944 | | * present them a SHA-higher cert rather than failing if it's the only |
945 | | * one we got that satisfies the other conditions. |
946 | | */ |
947 | 0 | if (ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 && |
948 | 0 | cur->cert->sig_md != MBEDTLS_MD_SHA1) { |
949 | 0 | if (fallback == NULL) { |
950 | 0 | fallback = cur; |
951 | 0 | } |
952 | 0 | { |
953 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("certificate not preferred: " |
954 | 0 | "sha-2 with pre-TLS 1.2 client")); |
955 | 0 | continue; |
956 | 0 | } |
957 | 0 | } |
958 | | |
959 | | /* If we get there, we got a winner */ |
960 | 0 | break; |
961 | 0 | } |
962 | |
|
963 | 0 | if (cur == NULL) { |
964 | 0 | cur = fallback; |
965 | 0 | } |
966 | | |
967 | | /* Do not update ssl->handshake->key_cert unless there is a match */ |
968 | 0 | if (cur != NULL) { |
969 | 0 | ssl->handshake->key_cert = cur; |
970 | 0 | MBEDTLS_SSL_DEBUG_CRT(3, "selected certificate chain, certificate", |
971 | 0 | ssl->handshake->key_cert->cert); |
972 | 0 | return 0; |
973 | 0 | } |
974 | | |
975 | 0 | return -1; |
976 | 0 | } |
977 | | #endif /* MBEDTLS_X509_CRT_PARSE_C */ |
978 | | |
979 | | /* |
980 | | * Check if a given ciphersuite is suitable for use with our config/keys/etc |
981 | | * Sets ciphersuite_info only if the suite matches. |
982 | | */ |
983 | | MBEDTLS_CHECK_RETURN_CRITICAL |
984 | | static int ssl_ciphersuite_match(mbedtls_ssl_context *ssl, int suite_id, |
985 | | const mbedtls_ssl_ciphersuite_t **ciphersuite_info) |
986 | 0 | { |
987 | 0 | const mbedtls_ssl_ciphersuite_t *suite_info; |
988 | |
|
989 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
990 | 0 | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
991 | 0 | mbedtls_pk_type_t sig_type; |
992 | 0 | #endif |
993 | |
|
994 | 0 | suite_info = mbedtls_ssl_ciphersuite_from_id(suite_id); |
995 | 0 | if (suite_info == NULL) { |
996 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
997 | 0 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
998 | 0 | } |
999 | | |
1000 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("trying ciphersuite: %#04x (%s)", |
1001 | 0 | (unsigned int) suite_id, suite_info->name)); |
1002 | |
|
1003 | 0 | if (suite_info->min_minor_ver > ssl->minor_ver || |
1004 | 0 | suite_info->max_minor_ver < ssl->minor_ver) { |
1005 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: version")); |
1006 | 0 | return 0; |
1007 | 0 | } |
1008 | | |
1009 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1010 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
1011 | 0 | (suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS)) { |
1012 | 0 | return 0; |
1013 | 0 | } |
1014 | 0 | #endif |
1015 | | |
1016 | | #if defined(MBEDTLS_ARC4_C) |
1017 | | if (ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED && |
1018 | | suite_info->cipher == MBEDTLS_CIPHER_ARC4_128) { |
1019 | | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: rc4")); |
1020 | | return 0; |
1021 | | } |
1022 | | #endif |
1023 | | |
1024 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
1025 | 0 | if (suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE && |
1026 | 0 | (ssl->handshake->cli_exts & MBEDTLS_TLS_EXT_ECJPAKE_KKPP_OK) == 0) { |
1027 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: ecjpake " |
1028 | 0 | "not configured or ext missing")); |
1029 | 0 | return 0; |
1030 | 0 | } |
1031 | 0 | #endif |
1032 | | |
1033 | | |
1034 | 0 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) |
1035 | 0 | if (mbedtls_ssl_ciphersuite_uses_ec(suite_info) && |
1036 | 0 | (ssl->handshake->curves == NULL || |
1037 | 0 | ssl->handshake->curves[0] == NULL)) { |
1038 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: " |
1039 | 0 | "no common elliptic curve")); |
1040 | 0 | return 0; |
1041 | 0 | } |
1042 | 0 | #endif |
1043 | | |
1044 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
1045 | | /* If the ciphersuite requires a pre-shared key and we don't |
1046 | | * have one, skip it now rather than failing later */ |
1047 | 0 | if (mbedtls_ssl_ciphersuite_uses_psk(suite_info) && |
1048 | 0 | ssl_conf_has_psk_or_cb(ssl->conf) == 0) { |
1049 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no pre-shared key")); |
1050 | 0 | return 0; |
1051 | 0 | } |
1052 | 0 | #endif |
1053 | | |
1054 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
1055 | 0 | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
1056 | | /* If the ciphersuite requires signing, check whether |
1057 | | * a suitable hash algorithm is present. */ |
1058 | 0 | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3) { |
1059 | 0 | sig_type = mbedtls_ssl_get_ciphersuite_sig_alg(suite_info); |
1060 | 0 | if (sig_type != MBEDTLS_PK_NONE && |
1061 | 0 | mbedtls_ssl_sig_hash_set_find(&ssl->handshake->hash_algs, |
1062 | 0 | sig_type) == MBEDTLS_MD_NONE) { |
1063 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: no suitable hash algorithm " |
1064 | 0 | "for signature algorithm %u", (unsigned) sig_type)); |
1065 | 0 | return 0; |
1066 | 0 | } |
1067 | 0 | } |
1068 | | |
1069 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
1070 | | MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
1071 | | |
1072 | 0 | #if defined(MBEDTLS_X509_CRT_PARSE_C) |
1073 | | /* |
1074 | | * Final check: if ciphersuite requires us to have a |
1075 | | * certificate/key of a particular type: |
1076 | | * - select the appropriate certificate if we have one, or |
1077 | | * - try the next ciphersuite if we don't |
1078 | | * This must be done last since we modify the key_cert list. |
1079 | | */ |
1080 | 0 | if (ssl_pick_cert(ssl, suite_info) != 0) { |
1081 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("ciphersuite mismatch: " |
1082 | 0 | "no suitable certificate")); |
1083 | 0 | return 0; |
1084 | 0 | } |
1085 | 0 | #endif |
1086 | | |
1087 | 0 | *ciphersuite_info = suite_info; |
1088 | 0 | return 0; |
1089 | 0 | } |
1090 | | |
1091 | | #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) |
1092 | | MBEDTLS_CHECK_RETURN_CRITICAL |
1093 | | static int ssl_parse_client_hello_v2(mbedtls_ssl_context *ssl) |
1094 | | { |
1095 | | int ret, got_common_suite; |
1096 | | unsigned int i, j; |
1097 | | size_t n; |
1098 | | unsigned int ciph_len, sess_len, chal_len; |
1099 | | unsigned char *buf, *p; |
1100 | | const int *ciphersuites; |
1101 | | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
1102 | | |
1103 | | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello v2")); |
1104 | | |
1105 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1106 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
1107 | | MBEDTLS_SSL_DEBUG_MSG(1, ("client hello v2 illegal for renegotiation")); |
1108 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1109 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
1110 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1111 | | } |
1112 | | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
1113 | | |
1114 | | buf = ssl->in_hdr; |
1115 | | |
1116 | | MBEDTLS_SSL_DEBUG_BUF(4, "record header", buf, 5); |
1117 | | |
1118 | | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v2, message type: %d", |
1119 | | buf[2])); |
1120 | | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v2, message len.: %d", |
1121 | | ((buf[0] & 0x7F) << 8) | buf[1])); |
1122 | | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v2, max. version: [%d:%d]", |
1123 | | buf[3], buf[4])); |
1124 | | |
1125 | | /* |
1126 | | * SSLv2 Client Hello |
1127 | | * |
1128 | | * Record layer: |
1129 | | * 0 . 1 message length |
1130 | | * |
1131 | | * SSL layer: |
1132 | | * 2 . 2 message type |
1133 | | * 3 . 4 protocol version |
1134 | | */ |
1135 | | if (buf[2] != MBEDTLS_SSL_HS_CLIENT_HELLO || |
1136 | | buf[3] != MBEDTLS_SSL_MAJOR_VERSION_3) { |
1137 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1138 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1139 | | } |
1140 | | |
1141 | | n = ((buf[0] << 8) | buf[1]) & 0x7FFF; |
1142 | | |
1143 | | if (n < 17 || n > 512) { |
1144 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1145 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1146 | | } |
1147 | | |
1148 | | ssl->major_ver = MBEDTLS_SSL_MAJOR_VERSION_3; |
1149 | | ssl->minor_ver = (buf[4] <= ssl->conf->max_minor_ver) |
1150 | | ? buf[4] : ssl->conf->max_minor_ver; |
1151 | | |
1152 | | if (ssl->minor_ver < ssl->conf->min_minor_ver) { |
1153 | | MBEDTLS_SSL_DEBUG_MSG(1, ("client only supports ssl smaller than minimum" |
1154 | | " [%d:%d] < [%d:%d]", |
1155 | | ssl->major_ver, ssl->minor_ver, |
1156 | | ssl->conf->min_major_ver, ssl->conf->min_minor_ver)); |
1157 | | |
1158 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1159 | | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION); |
1160 | | return MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION; |
1161 | | } |
1162 | | |
1163 | | ssl->handshake->max_major_ver = buf[3]; |
1164 | | ssl->handshake->max_minor_ver = buf[4]; |
1165 | | |
1166 | | if ((ret = mbedtls_ssl_fetch_input(ssl, 2 + n)) != 0) { |
1167 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); |
1168 | | return ret; |
1169 | | } |
1170 | | |
1171 | | ssl->handshake->update_checksum(ssl, buf + 2, n); |
1172 | | |
1173 | | buf = ssl->in_msg; |
1174 | | n = ssl->in_left - 5; |
1175 | | |
1176 | | /* |
1177 | | * 0 . 1 ciphersuitelist length |
1178 | | * 2 . 3 session id length |
1179 | | * 4 . 5 challenge length |
1180 | | * 6 . .. ciphersuitelist |
1181 | | * .. . .. session id |
1182 | | * .. . .. challenge |
1183 | | */ |
1184 | | MBEDTLS_SSL_DEBUG_BUF(4, "record contents", buf, n); |
1185 | | |
1186 | | ciph_len = (buf[0] << 8) | buf[1]; |
1187 | | sess_len = (buf[2] << 8) | buf[3]; |
1188 | | chal_len = (buf[4] << 8) | buf[5]; |
1189 | | |
1190 | | MBEDTLS_SSL_DEBUG_MSG(3, ("ciph_len: %u, sess_len: %u, chal_len: %u", |
1191 | | ciph_len, sess_len, chal_len)); |
1192 | | |
1193 | | /* |
1194 | | * Make sure each parameter length is valid |
1195 | | */ |
1196 | | if (ciph_len < 3 || (ciph_len % 3) != 0) { |
1197 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1198 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1199 | | } |
1200 | | |
1201 | | if (sess_len > 32) { |
1202 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1203 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1204 | | } |
1205 | | |
1206 | | if (chal_len < 8 || chal_len > 32) { |
1207 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1208 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1209 | | } |
1210 | | |
1211 | | if (n != 6 + ciph_len + sess_len + chal_len) { |
1212 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1213 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1214 | | } |
1215 | | |
1216 | | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, ciphersuitelist", |
1217 | | buf + 6, ciph_len); |
1218 | | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id", |
1219 | | buf + 6 + ciph_len, sess_len); |
1220 | | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, challenge", |
1221 | | buf + 6 + ciph_len + sess_len, chal_len); |
1222 | | |
1223 | | p = buf + 6 + ciph_len; |
1224 | | ssl->session_negotiate->id_len = sess_len; |
1225 | | memset(ssl->session_negotiate->id, 0, |
1226 | | sizeof(ssl->session_negotiate->id)); |
1227 | | memcpy(ssl->session_negotiate->id, p, ssl->session_negotiate->id_len); |
1228 | | |
1229 | | p += sess_len; |
1230 | | memset(ssl->handshake->randbytes, 0, 64); |
1231 | | memcpy(ssl->handshake->randbytes + 32 - chal_len, p, chal_len); |
1232 | | |
1233 | | /* |
1234 | | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
1235 | | */ |
1236 | | for (i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3) { |
1237 | | if (p[0] == 0 && p[1] == 0 && p[2] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO) { |
1238 | | MBEDTLS_SSL_DEBUG_MSG(3, ("received TLS_EMPTY_RENEGOTIATION_INFO ")); |
1239 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1240 | | if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { |
1241 | | MBEDTLS_SSL_DEBUG_MSG(1, ("received RENEGOTIATION SCSV " |
1242 | | "during renegotiation")); |
1243 | | |
1244 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1245 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
1246 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1247 | | } |
1248 | | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
1249 | | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
1250 | | break; |
1251 | | } |
1252 | | } |
1253 | | |
1254 | | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) |
1255 | | for (i = 0, p = buf + 6; i < ciph_len; i += 3, p += 3) { |
1256 | | if (p[0] == 0 && |
1257 | | MBEDTLS_GET_UINT16_BE(p, 1) != MBEDTLS_SSL_FALLBACK_SCSV_VALUE) { |
1258 | | MBEDTLS_SSL_DEBUG_MSG(3, ("received FALLBACK_SCSV")); |
1259 | | |
1260 | | if (ssl->minor_ver < ssl->conf->max_minor_ver) { |
1261 | | MBEDTLS_SSL_DEBUG_MSG(1, ("inapropriate fallback")); |
1262 | | |
1263 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1264 | | MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK); |
1265 | | |
1266 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1267 | | } |
1268 | | |
1269 | | break; |
1270 | | } |
1271 | | } |
1272 | | #endif /* MBEDTLS_SSL_FALLBACK_SCSV */ |
1273 | | |
1274 | | got_common_suite = 0; |
1275 | | ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; |
1276 | | ciphersuite_info = NULL; |
1277 | | #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE) |
1278 | | for (j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3) { |
1279 | | for (i = 0; ciphersuites[i] != 0; i++) { |
1280 | | if (p[0] != 0 || |
1281 | | MBEDTLS_GET_UINT16_BE(p, 1) != ciphersuites[i]) { |
1282 | | continue; |
1283 | | } |
1284 | | |
1285 | | got_common_suite = 1; |
1286 | | |
1287 | | if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], |
1288 | | &ciphersuite_info)) != 0) { |
1289 | | return ret; |
1290 | | } |
1291 | | |
1292 | | if (ciphersuite_info != NULL) { |
1293 | | goto have_ciphersuite_v2; |
1294 | | } |
1295 | | } |
1296 | | } |
1297 | | #else |
1298 | | for (i = 0; ciphersuites[i] != 0; i++) { |
1299 | | for (j = 0, p = buf + 6; j < ciph_len; j += 3, p += 3) { |
1300 | | if (p[0] != 0 || |
1301 | | MBEDTLS_GET_UINT16_BE(p, 1) != ciphersuites[i]) { |
1302 | | continue; |
1303 | | } |
1304 | | |
1305 | | got_common_suite = 1; |
1306 | | |
1307 | | if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], |
1308 | | &ciphersuite_info)) != 0) { |
1309 | | return ret; |
1310 | | } |
1311 | | |
1312 | | if (ciphersuite_info != NULL) { |
1313 | | goto have_ciphersuite_v2; |
1314 | | } |
1315 | | } |
1316 | | } |
1317 | | #endif |
1318 | | |
1319 | | if (got_common_suite) { |
1320 | | MBEDTLS_SSL_DEBUG_MSG(1, ("got ciphersuites in common, " |
1321 | | "but none of them usable")); |
1322 | | return MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE; |
1323 | | } else { |
1324 | | MBEDTLS_SSL_DEBUG_MSG(1, ("got no ciphersuites in common")); |
1325 | | return MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN; |
1326 | | } |
1327 | | |
1328 | | have_ciphersuite_v2: |
1329 | | MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %s", ciphersuite_info->name)); |
1330 | | |
1331 | | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
1332 | | ssl->handshake->ciphersuite_info = ciphersuite_info; |
1333 | | |
1334 | | /* |
1335 | | * SSLv2 Client Hello relevant renegotiation security checks |
1336 | | */ |
1337 | | if (ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
1338 | | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) { |
1339 | | MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation, breaking off handshake")); |
1340 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1341 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
1342 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1343 | | } |
1344 | | |
1345 | | ssl->in_left = 0; |
1346 | | ssl->state++; |
1347 | | |
1348 | | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello v2")); |
1349 | | |
1350 | | return 0; |
1351 | | } |
1352 | | #endif /* MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO */ |
1353 | | |
1354 | | /* This function doesn't alert on errors that happen early during |
1355 | | ClientHello parsing because they might indicate that the client is |
1356 | | not talking SSL/TLS at all and would not understand our alert. */ |
1357 | | MBEDTLS_CHECK_RETURN_CRITICAL |
1358 | | static int ssl_parse_client_hello(mbedtls_ssl_context *ssl) |
1359 | 8.78k | { |
1360 | 8.78k | int ret, got_common_suite; |
1361 | 8.78k | size_t i, j; |
1362 | 8.78k | size_t ciph_offset, comp_offset, ext_offset; |
1363 | 8.78k | size_t msg_len, ciph_len, sess_len, comp_len, ext_len; |
1364 | 8.78k | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1365 | 8.78k | size_t cookie_offset, cookie_len; |
1366 | 8.78k | #endif |
1367 | 8.78k | unsigned char *buf, *p, *ext; |
1368 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1369 | | int renegotiation_info_seen = 0; |
1370 | | #endif |
1371 | 8.78k | int handshake_failure = 0; |
1372 | 8.78k | const int *ciphersuites; |
1373 | 8.78k | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
1374 | 8.78k | int major, minor; |
1375 | | |
1376 | | /* If there is no signature-algorithm extension present, |
1377 | | * we need to fall back to the default values for allowed |
1378 | | * signature-hash pairs. */ |
1379 | 8.78k | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
1380 | 8.78k | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
1381 | 8.78k | int sig_hash_alg_ext_present = 0; |
1382 | 8.78k | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
1383 | | MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
1384 | | |
1385 | 8.78k | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello")); |
1386 | | |
1387 | 8.78k | int renegotiating = 0; |
1388 | 8.78k | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
1389 | 8.78k | read_record_header: |
1390 | 8.78k | #endif |
1391 | | /* |
1392 | | * If renegotiating, then the input was read with mbedtls_ssl_read_record(), |
1393 | | * otherwise read it ourselves manually in order to support SSLv2 |
1394 | | * ClientHello, which doesn't use the same record layer format. |
1395 | | */ |
1396 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1397 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
1398 | | renegotiating = 1; |
1399 | | } |
1400 | | #endif |
1401 | 8.78k | if (!renegotiating) { |
1402 | 8.78k | if ((ret = mbedtls_ssl_fetch_input(ssl, 5)) != 0) { |
1403 | | /* No alert on a read error. */ |
1404 | 4.83k | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); |
1405 | 4.83k | return ret; |
1406 | 4.83k | } |
1407 | 8.78k | } |
1408 | | |
1409 | 3.95k | buf = ssl->in_hdr; |
1410 | | |
1411 | | #if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) |
1412 | | int is_dtls = 0; |
1413 | | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1414 | | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
1415 | | is_dtls = 1; |
1416 | | } |
1417 | | #endif |
1418 | | if (!is_dtls) { |
1419 | | if ((buf[0] & 0x80) != 0) { |
1420 | | return ssl_parse_client_hello_v2(ssl); |
1421 | | } |
1422 | | } |
1423 | | #endif |
1424 | | |
1425 | 3.95k | MBEDTLS_SSL_DEBUG_BUF(4, "record header", buf, mbedtls_ssl_in_hdr_len(ssl)); |
1426 | | |
1427 | | /* |
1428 | | * SSLv3/TLS Client Hello |
1429 | | * |
1430 | | * Record layer: |
1431 | | * 0 . 0 message type |
1432 | | * 1 . 2 protocol version |
1433 | | * 3 . 11 DTLS: epoch + record sequence number |
1434 | | * 3 . 4 message length |
1435 | | */ |
1436 | 3.95k | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, message type: %d", |
1437 | 3.95k | buf[0])); |
1438 | | |
1439 | 3.95k | if (buf[0] != MBEDTLS_SSL_MSG_HANDSHAKE) { |
1440 | 446 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1441 | 446 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1442 | 446 | } |
1443 | | |
1444 | 3.50k | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, message len.: %d", |
1445 | 3.50k | (ssl->in_len[0] << 8) | ssl->in_len[1])); |
1446 | | |
1447 | 3.50k | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, protocol version: [%d:%d]", |
1448 | 3.50k | buf[1], buf[2])); |
1449 | | |
1450 | 3.50k | mbedtls_ssl_read_version(&major, &minor, ssl->conf->transport, buf + 1); |
1451 | | |
1452 | | /* According to RFC 5246 Appendix E.1, the version here is typically |
1453 | | * "{03,00}, the lowest version number supported by the client, [or] the |
1454 | | * value of ClientHello.client_version", so the only meaningful check here |
1455 | | * is the major version shouldn't be less than 3 */ |
1456 | 3.50k | if (major < MBEDTLS_SSL_MAJOR_VERSION_3) { |
1457 | 352 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1458 | 352 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1459 | 352 | } |
1460 | | |
1461 | | /* For DTLS if this is the initial handshake, remember the client sequence |
1462 | | * number to use it in our next message (RFC 6347 4.2.1) */ |
1463 | 3.15k | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1464 | 3.15k | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM |
1465 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1466 | | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
1467 | | #endif |
1468 | 3.15k | ) { |
1469 | | /* Epoch should be 0 for initial handshakes */ |
1470 | 3.15k | if (ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0) { |
1471 | 1.02k | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1472 | 1.02k | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1473 | 1.02k | } |
1474 | | |
1475 | 2.13k | memcpy(ssl->cur_out_ctr + 2, ssl->in_ctr + 2, 6); |
1476 | | |
1477 | 2.13k | #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) |
1478 | 2.13k | if (mbedtls_ssl_dtls_replay_check(ssl) != 0) { |
1479 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("replayed record, discarding")); |
1480 | 0 | ssl->next_record_offset = 0; |
1481 | 0 | ssl->in_left = 0; |
1482 | 0 | goto read_record_header; |
1483 | 0 | } |
1484 | | |
1485 | | /* No MAC to check yet, so we can update right now */ |
1486 | 2.13k | mbedtls_ssl_dtls_replay_update(ssl); |
1487 | 2.13k | #endif |
1488 | 2.13k | } |
1489 | 2.13k | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
1490 | | |
1491 | 2.13k | msg_len = (ssl->in_len[0] << 8) | ssl->in_len[1]; |
1492 | | |
1493 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1494 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
1495 | | /* Set by mbedtls_ssl_read_record() */ |
1496 | | msg_len = ssl->in_hslen; |
1497 | | } else |
1498 | | #endif |
1499 | 2.13k | { |
1500 | 2.13k | if (msg_len > MBEDTLS_SSL_IN_CONTENT_LEN) { |
1501 | 651 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1502 | 651 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1503 | 651 | } |
1504 | | |
1505 | 1.48k | if ((ret = mbedtls_ssl_fetch_input(ssl, |
1506 | 1.48k | mbedtls_ssl_in_hdr_len(ssl) + msg_len)) != 0) { |
1507 | 1.06k | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_fetch_input", ret); |
1508 | 1.06k | return ret; |
1509 | 1.06k | } |
1510 | | |
1511 | | /* Done reading this record, get ready for the next one */ |
1512 | 415 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1513 | 415 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
1514 | 415 | ssl->next_record_offset = msg_len + mbedtls_ssl_in_hdr_len(ssl); |
1515 | 415 | } else |
1516 | 0 | #endif |
1517 | 0 | ssl->in_left = 0; |
1518 | 415 | } |
1519 | | |
1520 | 0 | buf = ssl->in_msg; |
1521 | | |
1522 | 415 | MBEDTLS_SSL_DEBUG_BUF(4, "record contents", buf, msg_len); |
1523 | | |
1524 | 415 | ssl->handshake->update_checksum(ssl, buf, msg_len); |
1525 | | |
1526 | | /* |
1527 | | * Handshake layer: |
1528 | | * 0 . 0 handshake type |
1529 | | * 1 . 3 handshake length |
1530 | | * 4 . 5 DTLS only: message sequence number |
1531 | | * 6 . 8 DTLS only: fragment offset |
1532 | | * 9 . 11 DTLS only: fragment length |
1533 | | */ |
1534 | 415 | if (msg_len < mbedtls_ssl_hs_hdr_len(ssl)) { |
1535 | 415 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1536 | 415 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1537 | 415 | } |
1538 | | |
1539 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake type: %d", buf[0])); |
1540 | |
|
1541 | 0 | if (buf[0] != MBEDTLS_SSL_HS_CLIENT_HELLO) { |
1542 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1543 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1544 | 0 | } |
1545 | | |
1546 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, handshake len.: %d", |
1547 | 0 | (buf[1] << 16) | (buf[2] << 8) | buf[3])); |
1548 | |
|
1549 | 0 | if (buf[1] != 0) { |
1550 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message: %u != 0", |
1551 | 0 | (unsigned) buf[1])); |
1552 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1553 | 0 | } |
1554 | | /* We don't support fragmentation of ClientHello (yet?) */ |
1555 | 0 | if (msg_len != mbedtls_ssl_hs_hdr_len(ssl) + ((buf[2] << 8) | buf[3])) { |
1556 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message: %u != %u + %u", |
1557 | 0 | (unsigned) msg_len, |
1558 | 0 | (unsigned) mbedtls_ssl_hs_hdr_len(ssl), |
1559 | 0 | (unsigned) (buf[2] << 8) | buf[3])); |
1560 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1561 | 0 | } |
1562 | | |
1563 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1564 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
1565 | | /* |
1566 | | * Copy the client's handshake message_seq on initial handshakes, |
1567 | | * check sequence number on renego. |
1568 | | */ |
1569 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1570 | | if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { |
1571 | | /* This couldn't be done in ssl_prepare_handshake_record() */ |
1572 | | unsigned int cli_msg_seq = (ssl->in_msg[4] << 8) | |
1573 | | ssl->in_msg[5]; |
1574 | | |
1575 | | if (cli_msg_seq != ssl->handshake->in_msg_seq) { |
1576 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message_seq: " |
1577 | | "%u (expected %u)", cli_msg_seq, |
1578 | | ssl->handshake->in_msg_seq)); |
1579 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1580 | | } |
1581 | | |
1582 | | ssl->handshake->in_msg_seq++; |
1583 | | } else |
1584 | | #endif |
1585 | 0 | { |
1586 | 0 | unsigned int cli_msg_seq = (ssl->in_msg[4] << 8) | |
1587 | 0 | ssl->in_msg[5]; |
1588 | 0 | ssl->handshake->out_msg_seq = cli_msg_seq; |
1589 | 0 | ssl->handshake->in_msg_seq = cli_msg_seq + 1; |
1590 | 0 | } |
1591 | | |
1592 | | /* |
1593 | | * For now we don't support fragmentation, so make sure |
1594 | | * fragment_offset == 0 and fragment_length == length |
1595 | | */ |
1596 | 0 | MBEDTLS_SSL_DEBUG_MSG( |
1597 | 0 | 4, ("fragment_offset=%u fragment_length=%u length=%u", |
1598 | 0 | (unsigned) (ssl->in_msg[6] << 16 | ssl->in_msg[7] << 8 | ssl->in_msg[8]), |
1599 | 0 | (unsigned) (ssl->in_msg[9] << 16 | ssl->in_msg[10] << 8 | ssl->in_msg[11]), |
1600 | 0 | (unsigned) (ssl->in_msg[1] << 16 | ssl->in_msg[2] << 8 | ssl->in_msg[3]))); |
1601 | 0 | if (ssl->in_msg[6] != 0 || ssl->in_msg[7] != 0 || ssl->in_msg[8] != 0 || |
1602 | 0 | memcmp(ssl->in_msg + 1, ssl->in_msg + 9, 3) != 0) { |
1603 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("ClientHello fragmentation not supported")); |
1604 | 0 | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
1605 | 0 | } |
1606 | 0 | } |
1607 | 0 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
1608 | | |
1609 | 0 | buf += mbedtls_ssl_hs_hdr_len(ssl); |
1610 | 0 | msg_len -= mbedtls_ssl_hs_hdr_len(ssl); |
1611 | | |
1612 | | /* |
1613 | | * ClientHello layer: |
1614 | | * 0 . 1 protocol version |
1615 | | * 2 . 33 random bytes (starting with 4 bytes of Unix time) |
1616 | | * 34 . 35 session id length (1 byte) |
1617 | | * 35 . 34+x session id |
1618 | | * 35+x . 35+x DTLS only: cookie length (1 byte) |
1619 | | * 36+x . .. DTLS only: cookie |
1620 | | * .. . .. ciphersuite list length (2 bytes) |
1621 | | * .. . .. ciphersuite list |
1622 | | * .. . .. compression alg. list length (1 byte) |
1623 | | * .. . .. compression alg. list |
1624 | | * .. . .. extensions length (2 bytes, optional) |
1625 | | * .. . .. extensions (optional) |
1626 | | */ |
1627 | | |
1628 | | /* |
1629 | | * Minimal length (with everything empty and extensions omitted) is |
1630 | | * 2 + 32 + 1 + 2 + 1 = 38 bytes. Check that first, so that we can |
1631 | | * read at least up to session id length without worrying. |
1632 | | */ |
1633 | 0 | if (msg_len < 38) { |
1634 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1635 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1636 | 0 | } |
1637 | | |
1638 | | /* |
1639 | | * Check and save the protocol version |
1640 | | */ |
1641 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, version", buf, 2); |
1642 | |
|
1643 | 0 | mbedtls_ssl_read_version(&ssl->major_ver, &ssl->minor_ver, |
1644 | 0 | ssl->conf->transport, buf); |
1645 | |
|
1646 | 0 | ssl->handshake->max_major_ver = ssl->major_ver; |
1647 | 0 | ssl->handshake->max_minor_ver = ssl->minor_ver; |
1648 | |
|
1649 | 0 | if (ssl->major_ver < ssl->conf->min_major_ver || |
1650 | 0 | ssl->minor_ver < ssl->conf->min_minor_ver) { |
1651 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("client only supports ssl smaller than minimum" |
1652 | 0 | " [%d:%d] < [%d:%d]", |
1653 | 0 | ssl->major_ver, ssl->minor_ver, |
1654 | 0 | ssl->conf->min_major_ver, ssl->conf->min_minor_ver)); |
1655 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1656 | 0 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION); |
1657 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION; |
1658 | 0 | } |
1659 | | |
1660 | 0 | if (ssl->major_ver > ssl->conf->max_major_ver) { |
1661 | 0 | ssl->major_ver = ssl->conf->max_major_ver; |
1662 | 0 | ssl->minor_ver = ssl->conf->max_minor_ver; |
1663 | 0 | } else if (ssl->minor_ver > ssl->conf->max_minor_ver) { |
1664 | 0 | ssl->minor_ver = ssl->conf->max_minor_ver; |
1665 | 0 | } |
1666 | | |
1667 | | /* |
1668 | | * Save client random (inc. Unix time) |
1669 | | */ |
1670 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, random bytes", buf + 2, 32); |
1671 | |
|
1672 | 0 | memcpy(ssl->handshake->randbytes, buf + 2, 32); |
1673 | | |
1674 | | /* |
1675 | | * Check the session ID length and save session ID |
1676 | | */ |
1677 | 0 | sess_len = buf[34]; |
1678 | |
|
1679 | 0 | if (sess_len > sizeof(ssl->session_negotiate->id) || |
1680 | 0 | sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */ |
1681 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1682 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1683 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1684 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1685 | 0 | } |
1686 | | |
1687 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, session id", buf + 35, sess_len); |
1688 | |
|
1689 | 0 | ssl->session_negotiate->id_len = sess_len; |
1690 | 0 | memset(ssl->session_negotiate->id, 0, |
1691 | 0 | sizeof(ssl->session_negotiate->id)); |
1692 | 0 | memcpy(ssl->session_negotiate->id, buf + 35, |
1693 | 0 | ssl->session_negotiate->id_len); |
1694 | | |
1695 | | /* |
1696 | | * Check the cookie length and content |
1697 | | */ |
1698 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1699 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
1700 | 0 | cookie_offset = 35 + sess_len; |
1701 | 0 | cookie_len = buf[cookie_offset]; |
1702 | |
|
1703 | 0 | if (cookie_offset + 1 + cookie_len + 2 > msg_len) { |
1704 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1705 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1706 | 0 | MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION); |
1707 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1708 | 0 | } |
1709 | | |
1710 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, cookie", |
1711 | 0 | buf + cookie_offset + 1, cookie_len); |
1712 | |
|
1713 | 0 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
1714 | 0 | if (ssl->conf->f_cookie_check != NULL |
1715 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1716 | | && ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE |
1717 | | #endif |
1718 | 0 | ) { |
1719 | 0 | if (ssl->conf->f_cookie_check(ssl->conf->p_cookie, |
1720 | 0 | buf + cookie_offset + 1, cookie_len, |
1721 | 0 | ssl->cli_id, ssl->cli_id_len) != 0) { |
1722 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification failed")); |
1723 | 0 | ssl->handshake->verify_cookie_len = 1; |
1724 | 0 | } else { |
1725 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification passed")); |
1726 | 0 | ssl->handshake->verify_cookie_len = 0; |
1727 | 0 | } |
1728 | 0 | } else |
1729 | 0 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
1730 | 0 | { |
1731 | | /* We know we didn't send a cookie, so it should be empty */ |
1732 | 0 | if (cookie_len != 0) { |
1733 | | /* This may be an attacker's probe, so don't send an alert */ |
1734 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1735 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1736 | 0 | } |
1737 | | |
1738 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("cookie verification skipped")); |
1739 | 0 | } |
1740 | | |
1741 | | /* |
1742 | | * Check the ciphersuitelist length (will be parsed later) |
1743 | | */ |
1744 | 0 | ciph_offset = cookie_offset + 1 + cookie_len; |
1745 | 0 | } else |
1746 | 0 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
1747 | 0 | ciph_offset = 35 + sess_len; |
1748 | | |
1749 | 0 | ciph_len = (buf[ciph_offset + 0] << 8) |
1750 | 0 | | (buf[ciph_offset + 1]); |
1751 | |
|
1752 | 0 | if (ciph_len < 2 || |
1753 | 0 | ciph_len + 2 + ciph_offset + 1 > msg_len || /* 1 for comp. alg. len */ |
1754 | 0 | (ciph_len % 2) != 0) { |
1755 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1756 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1757 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1758 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1759 | 0 | } |
1760 | | |
1761 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, ciphersuitelist", |
1762 | 0 | buf + ciph_offset + 2, ciph_len); |
1763 | | |
1764 | | /* |
1765 | | * Check the compression algorithms length and pick one |
1766 | | */ |
1767 | 0 | comp_offset = ciph_offset + 2 + ciph_len; |
1768 | |
|
1769 | 0 | comp_len = buf[comp_offset]; |
1770 | |
|
1771 | 0 | if (comp_len < 1 || |
1772 | 0 | comp_len > 16 || |
1773 | 0 | comp_len + comp_offset + 1 > msg_len) { |
1774 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1775 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1776 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1777 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1778 | 0 | } |
1779 | | |
1780 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello, compression", |
1781 | 0 | buf + comp_offset + 1, comp_len); |
1782 | |
|
1783 | 0 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL; |
1784 | | #if defined(MBEDTLS_ZLIB_SUPPORT) |
1785 | | for (i = 0; i < comp_len; ++i) { |
1786 | | if (buf[comp_offset + 1 + i] == MBEDTLS_SSL_COMPRESS_DEFLATE) { |
1787 | | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_DEFLATE; |
1788 | | break; |
1789 | | } |
1790 | | } |
1791 | | #endif |
1792 | | |
1793 | | /* See comments in ssl_write_client_hello() */ |
1794 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
1795 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
1796 | 0 | ssl->session_negotiate->compression = MBEDTLS_SSL_COMPRESS_NULL; |
1797 | 0 | } |
1798 | 0 | #endif |
1799 | | |
1800 | | /* Do not parse the extensions if the protocol is SSLv3 */ |
1801 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
1802 | | if ((ssl->major_ver != 3) || (ssl->minor_ver != 0)) { |
1803 | | #endif |
1804 | | /* |
1805 | | * Check the extension length |
1806 | | */ |
1807 | 0 | ext_offset = comp_offset + 1 + comp_len; |
1808 | 0 | if (msg_len > ext_offset) { |
1809 | 0 | if (msg_len < ext_offset + 2) { |
1810 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1811 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1812 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1813 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1814 | 0 | } |
1815 | | |
1816 | 0 | ext_len = (buf[ext_offset + 0] << 8) |
1817 | 0 | | (buf[ext_offset + 1]); |
1818 | |
|
1819 | 0 | if (msg_len != ext_offset + 2 + ext_len) { |
1820 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1821 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1822 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1823 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1824 | 0 | } |
1825 | 0 | } else { |
1826 | 0 | ext_len = 0; |
1827 | 0 | } |
1828 | | |
1829 | 0 | ext = buf + ext_offset + 2; |
1830 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "client hello extensions", ext, ext_len); |
1831 | |
|
1832 | 0 | while (ext_len != 0) { |
1833 | 0 | unsigned int ext_id; |
1834 | 0 | unsigned int ext_size; |
1835 | 0 | if (ext_len < 4) { |
1836 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1837 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1838 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1839 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1840 | 0 | } |
1841 | 0 | ext_id = ((ext[0] << 8) | (ext[1])); |
1842 | 0 | ext_size = ((ext[2] << 8) | (ext[3])); |
1843 | |
|
1844 | 0 | if (ext_size + 4 > ext_len) { |
1845 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message")); |
1846 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
1847 | 0 | MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR); |
1848 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
1849 | 0 | } |
1850 | 0 | switch (ext_id) { |
1851 | | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
1852 | | case MBEDTLS_TLS_EXT_SERVERNAME: |
1853 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found ServerName extension")); |
1854 | | if (ssl->conf->f_sni == NULL) { |
1855 | | break; |
1856 | | } |
1857 | | |
1858 | | ret = ssl_parse_servername_ext(ssl, ext + 4, ext_size); |
1859 | | if (ret != 0) { |
1860 | | return ret; |
1861 | | } |
1862 | | break; |
1863 | | #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ |
1864 | | |
1865 | 0 | case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO: |
1866 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("found renegotiation extension")); |
1867 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
1868 | | renegotiation_info_seen = 1; |
1869 | | #endif |
1870 | |
|
1871 | 0 | ret = ssl_parse_renegotiation_info(ssl, ext + 4, ext_size); |
1872 | 0 | if (ret != 0) { |
1873 | 0 | return ret; |
1874 | 0 | } |
1875 | 0 | break; |
1876 | | |
1877 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
1878 | 0 | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
1879 | 0 | case MBEDTLS_TLS_EXT_SIG_ALG: |
1880 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("found signature_algorithms extension")); |
1881 | |
|
1882 | 0 | ret = ssl_parse_signature_algorithms_ext(ssl, ext + 4, ext_size); |
1883 | 0 | if (ret != 0) { |
1884 | 0 | return ret; |
1885 | 0 | } |
1886 | | |
1887 | 0 | sig_hash_alg_ext_present = 1; |
1888 | 0 | break; |
1889 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
1890 | | MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
1891 | | |
1892 | 0 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
1893 | 0 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
1894 | 0 | case MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES: |
1895 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("found supported elliptic curves extension")); |
1896 | |
|
1897 | 0 | ret = ssl_parse_supported_elliptic_curves(ssl, ext + 4, ext_size); |
1898 | 0 | if (ret != 0) { |
1899 | 0 | return ret; |
1900 | 0 | } |
1901 | 0 | break; |
1902 | | |
1903 | 0 | case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS: |
1904 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("found supported point formats extension")); |
1905 | 0 | ssl->handshake->cli_exts |= MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT; |
1906 | |
|
1907 | 0 | ret = ssl_parse_supported_point_formats(ssl, ext + 4, ext_size); |
1908 | 0 | if (ret != 0) { |
1909 | 0 | return ret; |
1910 | 0 | } |
1911 | 0 | break; |
1912 | 0 | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || |
1913 | | MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
1914 | | |
1915 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
1916 | 0 | case MBEDTLS_TLS_EXT_ECJPAKE_KKPP: |
1917 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("found ecjpake kkpp extension")); |
1918 | |
|
1919 | 0 | ret = ssl_parse_ecjpake_kkpp(ssl, ext + 4, ext_size); |
1920 | 0 | if (ret != 0) { |
1921 | 0 | return ret; |
1922 | 0 | } |
1923 | 0 | break; |
1924 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
1925 | | |
1926 | 0 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
1927 | 0 | case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH: |
1928 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("found max fragment length extension")); |
1929 | |
|
1930 | 0 | ret = ssl_parse_max_fragment_length_ext(ssl, ext + 4, ext_size); |
1931 | 0 | if (ret != 0) { |
1932 | 0 | return ret; |
1933 | 0 | } |
1934 | 0 | break; |
1935 | 0 | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
1936 | | |
1937 | | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
1938 | | case MBEDTLS_TLS_EXT_TRUNCATED_HMAC: |
1939 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found truncated hmac extension")); |
1940 | | |
1941 | | ret = ssl_parse_truncated_hmac_ext(ssl, ext + 4, ext_size); |
1942 | | if (ret != 0) { |
1943 | | return ret; |
1944 | | } |
1945 | | break; |
1946 | | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
1947 | | |
1948 | | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
1949 | | case MBEDTLS_TLS_EXT_CID: |
1950 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found CID extension")); |
1951 | | |
1952 | | ret = ssl_parse_cid_ext(ssl, ext + 4, ext_size); |
1953 | | if (ret != 0) { |
1954 | | return ret; |
1955 | | } |
1956 | | break; |
1957 | | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
1958 | | |
1959 | | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
1960 | | case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC: |
1961 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found encrypt then mac extension")); |
1962 | | |
1963 | | ret = ssl_parse_encrypt_then_mac_ext(ssl, ext + 4, ext_size); |
1964 | | if (ret != 0) { |
1965 | | return ret; |
1966 | | } |
1967 | | break; |
1968 | | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
1969 | | |
1970 | | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
1971 | | case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET: |
1972 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found extended master secret extension")); |
1973 | | |
1974 | | ret = ssl_parse_extended_ms_ext(ssl, ext + 4, ext_size); |
1975 | | if (ret != 0) { |
1976 | | return ret; |
1977 | | } |
1978 | | break; |
1979 | | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
1980 | | |
1981 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
1982 | | case MBEDTLS_TLS_EXT_SESSION_TICKET: |
1983 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found session ticket extension")); |
1984 | | |
1985 | | ret = ssl_parse_session_ticket_ext(ssl, ext + 4, ext_size); |
1986 | | if (ret != 0) { |
1987 | | return ret; |
1988 | | } |
1989 | | break; |
1990 | | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
1991 | | |
1992 | | #if defined(MBEDTLS_SSL_ALPN) |
1993 | | case MBEDTLS_TLS_EXT_ALPN: |
1994 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found alpn extension")); |
1995 | | |
1996 | | ret = ssl_parse_alpn_ext(ssl, ext + 4, ext_size); |
1997 | | if (ret != 0) { |
1998 | | return ret; |
1999 | | } |
2000 | | break; |
2001 | | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
2002 | | |
2003 | | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
2004 | | case MBEDTLS_TLS_EXT_USE_SRTP: |
2005 | | MBEDTLS_SSL_DEBUG_MSG(3, ("found use_srtp extension")); |
2006 | | |
2007 | | ret = ssl_parse_use_srtp_ext(ssl, ext + 4, ext_size); |
2008 | | if (ret != 0) { |
2009 | | return ret; |
2010 | | } |
2011 | | break; |
2012 | | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
2013 | | |
2014 | 0 | default: |
2015 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("unknown extension found: %u (ignoring)", |
2016 | 0 | ext_id)); |
2017 | 0 | } |
2018 | | |
2019 | 0 | ext_len -= 4 + ext_size; |
2020 | 0 | ext += 4 + ext_size; |
2021 | 0 | } |
2022 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
2023 | | } |
2024 | | #endif |
2025 | | |
2026 | | #if defined(MBEDTLS_SSL_FALLBACK_SCSV) |
2027 | | for (i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2) { |
2028 | | if (MBEDTLS_GET_UINT16_BE(p, 0) == MBEDTLS_SSL_FALLBACK_SCSV_VALUE) { |
2029 | | MBEDTLS_SSL_DEBUG_MSG(2, ("received FALLBACK_SCSV")); |
2030 | | |
2031 | | if (ssl->minor_ver < ssl->conf->max_minor_ver) { |
2032 | | MBEDTLS_SSL_DEBUG_MSG(1, ("inapropriate fallback")); |
2033 | | |
2034 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
2035 | | MBEDTLS_SSL_ALERT_MSG_INAPROPRIATE_FALLBACK); |
2036 | | |
2037 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
2038 | | } |
2039 | | |
2040 | | break; |
2041 | | } |
2042 | | } |
2043 | | #endif /* MBEDTLS_SSL_FALLBACK_SCSV */ |
2044 | | |
2045 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
2046 | 0 | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
2047 | | |
2048 | | /* |
2049 | | * Try to fall back to default hash SHA1 if the client |
2050 | | * hasn't provided any preferred signature-hash combinations. |
2051 | | */ |
2052 | 0 | if (sig_hash_alg_ext_present == 0) { |
2053 | 0 | mbedtls_md_type_t md_default = MBEDTLS_MD_SHA1; |
2054 | |
|
2055 | 0 | if (mbedtls_ssl_check_sig_hash(ssl, md_default) != 0) { |
2056 | 0 | md_default = MBEDTLS_MD_NONE; |
2057 | 0 | } |
2058 | |
|
2059 | 0 | mbedtls_ssl_sig_hash_set_const_hash(&ssl->handshake->hash_algs, md_default); |
2060 | 0 | } |
2061 | |
|
2062 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 && |
2063 | | MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ |
2064 | | |
2065 | | /* |
2066 | | * Check for TLS_EMPTY_RENEGOTIATION_INFO_SCSV |
2067 | | */ |
2068 | 0 | for (i = 0, p = buf + ciph_offset + 2; i < ciph_len; i += 2, p += 2) { |
2069 | 0 | if (p[0] == 0 && p[1] == MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO) { |
2070 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("received TLS_EMPTY_RENEGOTIATION_INFO ")); |
2071 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
2072 | | if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS) { |
2073 | | MBEDTLS_SSL_DEBUG_MSG(1, ("received RENEGOTIATION SCSV " |
2074 | | "during renegotiation")); |
2075 | | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
2076 | | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
2077 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
2078 | | } |
2079 | | #endif |
2080 | 0 | ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION; |
2081 | 0 | break; |
2082 | 0 | } |
2083 | 0 | } |
2084 | | |
2085 | | /* |
2086 | | * Renegotiation security checks |
2087 | | */ |
2088 | 0 | if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION && |
2089 | 0 | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE) { |
2090 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation, breaking off handshake")); |
2091 | 0 | handshake_failure = 1; |
2092 | 0 | } |
2093 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
2094 | | else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
2095 | | ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION && |
2096 | | renegotiation_info_seen == 0) { |
2097 | | MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension missing (secure)")); |
2098 | | handshake_failure = 1; |
2099 | | } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
2100 | | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
2101 | | ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION) { |
2102 | | MBEDTLS_SSL_DEBUG_MSG(1, ("legacy renegotiation not allowed")); |
2103 | | handshake_failure = 1; |
2104 | | } else if (ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS && |
2105 | | ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION && |
2106 | | renegotiation_info_seen == 1) { |
2107 | | MBEDTLS_SSL_DEBUG_MSG(1, ("renegotiation_info extension present (legacy)")); |
2108 | | handshake_failure = 1; |
2109 | | } |
2110 | | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
2111 | |
|
2112 | 0 | if (handshake_failure == 1) { |
2113 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
2114 | 0 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
2115 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO; |
2116 | 0 | } |
2117 | | |
2118 | | /* |
2119 | | * Search for a matching ciphersuite |
2120 | | * (At the end because we need information from the EC-based extensions |
2121 | | * and certificate from the SNI callback triggered by the SNI extension.) |
2122 | | */ |
2123 | 0 | got_common_suite = 0; |
2124 | 0 | ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver]; |
2125 | 0 | ciphersuite_info = NULL; |
2126 | | #if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE) |
2127 | | for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) { |
2128 | | for (i = 0; ciphersuites[i] != 0; i++) { |
2129 | | if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) { |
2130 | | continue; |
2131 | | } |
2132 | | |
2133 | | got_common_suite = 1; |
2134 | | |
2135 | | if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], |
2136 | | &ciphersuite_info)) != 0) { |
2137 | | return ret; |
2138 | | } |
2139 | | |
2140 | | if (ciphersuite_info != NULL) { |
2141 | | goto have_ciphersuite; |
2142 | | } |
2143 | | } |
2144 | | } |
2145 | | #else |
2146 | 0 | for (i = 0; ciphersuites[i] != 0; i++) { |
2147 | 0 | for (j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2) { |
2148 | 0 | if (MBEDTLS_GET_UINT16_BE(p, 0) != ciphersuites[i]) { |
2149 | 0 | continue; |
2150 | 0 | } |
2151 | | |
2152 | 0 | got_common_suite = 1; |
2153 | |
|
2154 | 0 | if ((ret = ssl_ciphersuite_match(ssl, ciphersuites[i], |
2155 | 0 | &ciphersuite_info)) != 0) { |
2156 | 0 | return ret; |
2157 | 0 | } |
2158 | | |
2159 | 0 | if (ciphersuite_info != NULL) { |
2160 | 0 | goto have_ciphersuite; |
2161 | 0 | } |
2162 | 0 | } |
2163 | 0 | } |
2164 | 0 | #endif |
2165 | | |
2166 | 0 | if (got_common_suite) { |
2167 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("got ciphersuites in common, " |
2168 | 0 | "but none of them usable")); |
2169 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
2170 | 0 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
2171 | 0 | return MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE; |
2172 | 0 | } else { |
2173 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("got no ciphersuites in common")); |
2174 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
2175 | 0 | MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); |
2176 | 0 | return MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN; |
2177 | 0 | } |
2178 | | |
2179 | 0 | have_ciphersuite: |
2180 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("selected ciphersuite: %s", ciphersuite_info->name)); |
2181 | |
|
2182 | 0 | ssl->session_negotiate->ciphersuite = ciphersuites[i]; |
2183 | 0 | ssl->handshake->ciphersuite_info = ciphersuite_info; |
2184 | |
|
2185 | 0 | ssl->state++; |
2186 | |
|
2187 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
2188 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
2189 | 0 | mbedtls_ssl_recv_flight_completed(ssl); |
2190 | 0 | } |
2191 | 0 | #endif |
2192 | | |
2193 | | /* Debugging-only output for testsuite */ |
2194 | | #if defined(MBEDTLS_DEBUG_C) && \ |
2195 | | defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ |
2196 | | defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) |
2197 | | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3) { |
2198 | | mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_alg(ciphersuite_info); |
2199 | | if (sig_alg != MBEDTLS_PK_NONE) { |
2200 | | mbedtls_md_type_t md_alg = mbedtls_ssl_sig_hash_set_find(&ssl->handshake->hash_algs, |
2201 | | sig_alg); |
2202 | | MBEDTLS_SSL_DEBUG_MSG(3, ("client hello v3, signature_algorithm ext: %d", |
2203 | | mbedtls_ssl_hash_from_md_alg(md_alg))); |
2204 | | } else { |
2205 | | MBEDTLS_SSL_DEBUG_MSG(3, ("no hash algorithm for signature algorithm " |
2206 | | "%u - should not happen", (unsigned) sig_alg)); |
2207 | | } |
2208 | | } |
2209 | | #endif |
2210 | |
|
2211 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client hello")); |
2212 | |
|
2213 | 0 | return 0; |
2214 | 0 | } |
2215 | | |
2216 | | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
2217 | | static void ssl_write_truncated_hmac_ext(mbedtls_ssl_context *ssl, |
2218 | | unsigned char *buf, |
2219 | | size_t *olen) |
2220 | | { |
2221 | | unsigned char *p = buf; |
2222 | | |
2223 | | if (ssl->session_negotiate->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED) { |
2224 | | *olen = 0; |
2225 | | return; |
2226 | | } |
2227 | | |
2228 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding truncated hmac extension")); |
2229 | | |
2230 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_TRUNCATED_HMAC, p, 0); |
2231 | | p += 2; |
2232 | | |
2233 | | *p++ = 0x00; |
2234 | | *p++ = 0x00; |
2235 | | |
2236 | | *olen = 4; |
2237 | | } |
2238 | | #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */ |
2239 | | |
2240 | | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
2241 | | static void ssl_write_cid_ext(mbedtls_ssl_context *ssl, |
2242 | | unsigned char *buf, |
2243 | | size_t *olen) |
2244 | | { |
2245 | | unsigned char *p = buf; |
2246 | | size_t ext_len; |
2247 | | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
2248 | | |
2249 | | *olen = 0; |
2250 | | |
2251 | | /* Skip writing the extension if we don't want to use it or if |
2252 | | * the client hasn't offered it. */ |
2253 | | if (ssl->handshake->cid_in_use == MBEDTLS_SSL_CID_DISABLED) { |
2254 | | return; |
2255 | | } |
2256 | | |
2257 | | /* ssl->own_cid_len is at most MBEDTLS_SSL_CID_IN_LEN_MAX |
2258 | | * which is at most 255, so the increment cannot overflow. */ |
2259 | | if (end < p || (size_t) (end - p) < (unsigned) (ssl->own_cid_len + 5)) { |
2260 | | MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); |
2261 | | return; |
2262 | | } |
2263 | | |
2264 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding CID extension")); |
2265 | | |
2266 | | /* |
2267 | | * Quoting draft-ietf-tls-dtls-connection-id-05 |
2268 | | * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05 |
2269 | | * |
2270 | | * struct { |
2271 | | * opaque cid<0..2^8-1>; |
2272 | | * } ConnectionId; |
2273 | | */ |
2274 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_CID, p, 0); |
2275 | | p += 2; |
2276 | | ext_len = (size_t) ssl->own_cid_len + 1; |
2277 | | MBEDTLS_PUT_UINT16_BE(ext_len, p, 0); |
2278 | | p += 2; |
2279 | | |
2280 | | *p++ = (uint8_t) ssl->own_cid_len; |
2281 | | memcpy(p, ssl->own_cid, ssl->own_cid_len); |
2282 | | |
2283 | | *olen = ssl->own_cid_len + 5; |
2284 | | } |
2285 | | #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ |
2286 | | |
2287 | | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
2288 | | static void ssl_write_encrypt_then_mac_ext(mbedtls_ssl_context *ssl, |
2289 | | unsigned char *buf, |
2290 | | size_t *olen) |
2291 | | { |
2292 | | unsigned char *p = buf; |
2293 | | const mbedtls_ssl_ciphersuite_t *suite = NULL; |
2294 | | const mbedtls_cipher_info_t *cipher = NULL; |
2295 | | |
2296 | | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0) { |
2297 | | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; |
2298 | | } |
2299 | | |
2300 | | /* |
2301 | | * RFC 7366: "If a server receives an encrypt-then-MAC request extension |
2302 | | * from a client and then selects a stream or Authenticated Encryption |
2303 | | * with Associated Data (AEAD) ciphersuite, it MUST NOT send an |
2304 | | * encrypt-then-MAC response extension back to the client." |
2305 | | */ |
2306 | | if ((suite = mbedtls_ssl_ciphersuite_from_id( |
2307 | | ssl->session_negotiate->ciphersuite)) == NULL || |
2308 | | (cipher = mbedtls_cipher_info_from_type(suite->cipher)) == NULL || |
2309 | | cipher->mode != MBEDTLS_MODE_CBC) { |
2310 | | ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; |
2311 | | } |
2312 | | |
2313 | | if (ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED) { |
2314 | | *olen = 0; |
2315 | | return; |
2316 | | } |
2317 | | |
2318 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding encrypt then mac extension")); |
2319 | | |
2320 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC, p, 0); |
2321 | | p += 2; |
2322 | | |
2323 | | *p++ = 0x00; |
2324 | | *p++ = 0x00; |
2325 | | |
2326 | | *olen = 4; |
2327 | | } |
2328 | | #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ |
2329 | | |
2330 | | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
2331 | | static void ssl_write_extended_ms_ext(mbedtls_ssl_context *ssl, |
2332 | | unsigned char *buf, |
2333 | | size_t *olen) |
2334 | | { |
2335 | | unsigned char *p = buf; |
2336 | | |
2337 | | if (ssl->handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED || |
2338 | | ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0) { |
2339 | | *olen = 0; |
2340 | | return; |
2341 | | } |
2342 | | |
2343 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding extended master secret " |
2344 | | "extension")); |
2345 | | |
2346 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET, p, 0); |
2347 | | p += 2; |
2348 | | |
2349 | | *p++ = 0x00; |
2350 | | *p++ = 0x00; |
2351 | | |
2352 | | *olen = 4; |
2353 | | } |
2354 | | #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ |
2355 | | |
2356 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
2357 | | static void ssl_write_session_ticket_ext(mbedtls_ssl_context *ssl, |
2358 | | unsigned char *buf, |
2359 | | size_t *olen) |
2360 | | { |
2361 | | unsigned char *p = buf; |
2362 | | |
2363 | | if (ssl->handshake->new_session_ticket == 0) { |
2364 | | *olen = 0; |
2365 | | return; |
2366 | | } |
2367 | | |
2368 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding session ticket extension")); |
2369 | | |
2370 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SESSION_TICKET, p, 0); |
2371 | | p += 2; |
2372 | | |
2373 | | *p++ = 0x00; |
2374 | | *p++ = 0x00; |
2375 | | |
2376 | | *olen = 4; |
2377 | | } |
2378 | | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
2379 | | |
2380 | | static void ssl_write_renegotiation_ext(mbedtls_ssl_context *ssl, |
2381 | | unsigned char *buf, |
2382 | | size_t *olen) |
2383 | 0 | { |
2384 | 0 | unsigned char *p = buf; |
2385 | |
|
2386 | 0 | if (ssl->secure_renegotiation != MBEDTLS_SSL_SECURE_RENEGOTIATION) { |
2387 | 0 | *olen = 0; |
2388 | 0 | return; |
2389 | 0 | } |
2390 | | |
2391 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, secure renegotiation extension")); |
2392 | |
|
2393 | 0 | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_RENEGOTIATION_INFO, p, 0); |
2394 | 0 | p += 2; |
2395 | |
|
2396 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
2397 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
2398 | | *p++ = 0x00; |
2399 | | *p++ = (ssl->verify_data_len * 2 + 1) & 0xFF; |
2400 | | *p++ = ssl->verify_data_len * 2 & 0xFF; |
2401 | | |
2402 | | memcpy(p, ssl->peer_verify_data, ssl->verify_data_len); |
2403 | | p += ssl->verify_data_len; |
2404 | | memcpy(p, ssl->own_verify_data, ssl->verify_data_len); |
2405 | | p += ssl->verify_data_len; |
2406 | | } else |
2407 | | #endif /* MBEDTLS_SSL_RENEGOTIATION */ |
2408 | 0 | { |
2409 | 0 | *p++ = 0x00; |
2410 | 0 | *p++ = 0x01; |
2411 | 0 | *p++ = 0x00; |
2412 | 0 | } |
2413 | |
|
2414 | 0 | *olen = p - buf; |
2415 | 0 | } |
2416 | | |
2417 | | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
2418 | | static void ssl_write_max_fragment_length_ext(mbedtls_ssl_context *ssl, |
2419 | | unsigned char *buf, |
2420 | | size_t *olen) |
2421 | 0 | { |
2422 | 0 | unsigned char *p = buf; |
2423 | |
|
2424 | 0 | if (ssl->session_negotiate->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE) { |
2425 | 0 | *olen = 0; |
2426 | 0 | return; |
2427 | 0 | } |
2428 | | |
2429 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, max_fragment_length extension")); |
2430 | |
|
2431 | 0 | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH, p, 0); |
2432 | 0 | p += 2; |
2433 | |
|
2434 | 0 | *p++ = 0x00; |
2435 | 0 | *p++ = 1; |
2436 | |
|
2437 | 0 | *p++ = ssl->session_negotiate->mfl_code; |
2438 | |
|
2439 | 0 | *olen = 5; |
2440 | 0 | } |
2441 | | #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ |
2442 | | |
2443 | | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
2444 | | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
2445 | | static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl, |
2446 | | unsigned char *buf, |
2447 | | size_t *olen) |
2448 | 0 | { |
2449 | 0 | unsigned char *p = buf; |
2450 | 0 | ((void) ssl); |
2451 | |
|
2452 | 0 | if ((ssl->handshake->cli_exts & |
2453 | 0 | MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS_PRESENT) == 0) { |
2454 | 0 | *olen = 0; |
2455 | 0 | return; |
2456 | 0 | } |
2457 | | |
2458 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, supported_point_formats extension")); |
2459 | |
|
2460 | 0 | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS, p, 0); |
2461 | 0 | p += 2; |
2462 | |
|
2463 | 0 | *p++ = 0x00; |
2464 | 0 | *p++ = 2; |
2465 | |
|
2466 | 0 | *p++ = 1; |
2467 | 0 | *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED; |
2468 | |
|
2469 | 0 | *olen = 6; |
2470 | 0 | } |
2471 | | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
2472 | | |
2473 | | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
2474 | | static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, |
2475 | | unsigned char *buf, |
2476 | | size_t *olen) |
2477 | 0 | { |
2478 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
2479 | 0 | unsigned char *p = buf; |
2480 | 0 | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
2481 | 0 | size_t kkpp_len; |
2482 | |
|
2483 | 0 | *olen = 0; |
2484 | | |
2485 | | /* Skip costly computation if not needed */ |
2486 | 0 | if (ssl->handshake->ciphersuite_info->key_exchange != |
2487 | 0 | MBEDTLS_KEY_EXCHANGE_ECJPAKE) { |
2488 | 0 | return; |
2489 | 0 | } |
2490 | | |
2491 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension")); |
2492 | |
|
2493 | 0 | if (end - p < 4) { |
2494 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); |
2495 | 0 | return; |
2496 | 0 | } |
2497 | | |
2498 | 0 | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0); |
2499 | 0 | p += 2; |
2500 | |
|
2501 | 0 | ret = mbedtls_ecjpake_write_round_one(&ssl->handshake->ecjpake_ctx, |
2502 | 0 | p + 2, end - p - 2, &kkpp_len, |
2503 | 0 | ssl->conf->f_rng, ssl->conf->p_rng); |
2504 | 0 | if (ret != 0) { |
2505 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_one", ret); |
2506 | 0 | return; |
2507 | 0 | } |
2508 | | |
2509 | 0 | MBEDTLS_PUT_UINT16_BE(kkpp_len, p, 0); |
2510 | 0 | p += 2; |
2511 | |
|
2512 | 0 | *olen = kkpp_len + 4; |
2513 | 0 | } |
2514 | | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
2515 | | |
2516 | | #if defined(MBEDTLS_SSL_ALPN) |
2517 | | static void ssl_write_alpn_ext(mbedtls_ssl_context *ssl, |
2518 | | unsigned char *buf, size_t *olen) |
2519 | | { |
2520 | | if (ssl->alpn_chosen == NULL) { |
2521 | | *olen = 0; |
2522 | | return; |
2523 | | } |
2524 | | |
2525 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding alpn extension")); |
2526 | | |
2527 | | /* |
2528 | | * 0 . 1 ext identifier |
2529 | | * 2 . 3 ext length |
2530 | | * 4 . 5 protocol list length |
2531 | | * 6 . 6 protocol name length |
2532 | | * 7 . 7+n protocol name |
2533 | | */ |
2534 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ALPN, buf, 0); |
2535 | | |
2536 | | *olen = 7 + strlen(ssl->alpn_chosen); |
2537 | | |
2538 | | MBEDTLS_PUT_UINT16_BE(*olen - 4, buf, 2); |
2539 | | |
2540 | | MBEDTLS_PUT_UINT16_BE(*olen - 6, buf, 4); |
2541 | | |
2542 | | buf[6] = MBEDTLS_BYTE_0(*olen - 7); |
2543 | | |
2544 | | memcpy(buf + 7, ssl->alpn_chosen, *olen - 7); |
2545 | | } |
2546 | | #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C */ |
2547 | | |
2548 | | #if defined(MBEDTLS_SSL_DTLS_SRTP) && defined(MBEDTLS_SSL_PROTO_DTLS) |
2549 | | static void ssl_write_use_srtp_ext(mbedtls_ssl_context *ssl, |
2550 | | unsigned char *buf, |
2551 | | size_t *olen) |
2552 | | { |
2553 | | size_t mki_len = 0, ext_len = 0; |
2554 | | uint16_t profile_value = 0; |
2555 | | const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
2556 | | |
2557 | | *olen = 0; |
2558 | | |
2559 | | if ((ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) || |
2560 | | (ssl->dtls_srtp_info.chosen_dtls_srtp_profile == MBEDTLS_TLS_SRTP_UNSET)) { |
2561 | | return; |
2562 | | } |
2563 | | |
2564 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, adding use_srtp extension")); |
2565 | | |
2566 | | if (ssl->conf->dtls_srtp_mki_support == MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED) { |
2567 | | mki_len = ssl->dtls_srtp_info.mki_len; |
2568 | | } |
2569 | | |
2570 | | /* The extension total size is 9 bytes : |
2571 | | * - 2 bytes for the extension tag |
2572 | | * - 2 bytes for the total size |
2573 | | * - 2 bytes for the protection profile length |
2574 | | * - 2 bytes for the protection profile |
2575 | | * - 1 byte for the mki length |
2576 | | * + the actual mki length |
2577 | | * Check we have enough room in the output buffer */ |
2578 | | if ((size_t) (end - buf) < mki_len + 9) { |
2579 | | MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); |
2580 | | return; |
2581 | | } |
2582 | | |
2583 | | /* extension */ |
2584 | | MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_USE_SRTP, buf, 0); |
2585 | | /* |
2586 | | * total length 5 and mki value: only one profile(2 bytes) |
2587 | | * and length(2 bytes) and srtp_mki ) |
2588 | | */ |
2589 | | ext_len = 5 + mki_len; |
2590 | | MBEDTLS_PUT_UINT16_BE(ext_len, buf, 2); |
2591 | | |
2592 | | /* protection profile length: 2 */ |
2593 | | buf[4] = 0x00; |
2594 | | buf[5] = 0x02; |
2595 | | profile_value = mbedtls_ssl_check_srtp_profile_value( |
2596 | | ssl->dtls_srtp_info.chosen_dtls_srtp_profile); |
2597 | | if (profile_value != MBEDTLS_TLS_SRTP_UNSET) { |
2598 | | MBEDTLS_PUT_UINT16_BE(profile_value, buf, 6); |
2599 | | } else { |
2600 | | MBEDTLS_SSL_DEBUG_MSG(1, ("use_srtp extension invalid profile")); |
2601 | | return; |
2602 | | } |
2603 | | |
2604 | | buf[8] = mki_len & 0xFF; |
2605 | | memcpy(&buf[9], ssl->dtls_srtp_info.mki_value, mki_len); |
2606 | | |
2607 | | *olen = 9 + mki_len; |
2608 | | } |
2609 | | #endif /* MBEDTLS_SSL_DTLS_SRTP */ |
2610 | | |
2611 | | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
2612 | | MBEDTLS_CHECK_RETURN_CRITICAL |
2613 | | static int ssl_write_hello_verify_request(mbedtls_ssl_context *ssl) |
2614 | 0 | { |
2615 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
2616 | 0 | unsigned char *p = ssl->out_msg + 4; |
2617 | 0 | unsigned char *cookie_len_byte; |
2618 | |
|
2619 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write hello verify request")); |
2620 | | |
2621 | | /* |
2622 | | * struct { |
2623 | | * ProtocolVersion server_version; |
2624 | | * opaque cookie<0..2^8-1>; |
2625 | | * } HelloVerifyRequest; |
2626 | | */ |
2627 | | |
2628 | | /* The RFC is not clear on this point, but sending the actual negotiated |
2629 | | * version looks like the most interoperable thing to do. */ |
2630 | 0 | mbedtls_ssl_write_version(ssl->major_ver, ssl->minor_ver, |
2631 | 0 | ssl->conf->transport, p); |
2632 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "server version", p, 2); |
2633 | 0 | p += 2; |
2634 | | |
2635 | | /* If we get here, f_cookie_check is not null */ |
2636 | 0 | if (ssl->conf->f_cookie_write == NULL) { |
2637 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("inconsistent cookie callbacks")); |
2638 | 0 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
2639 | 0 | } |
2640 | | |
2641 | | /* Skip length byte until we know the length */ |
2642 | 0 | cookie_len_byte = p++; |
2643 | |
|
2644 | 0 | if ((ret = ssl->conf->f_cookie_write(ssl->conf->p_cookie, |
2645 | 0 | &p, ssl->out_buf + MBEDTLS_SSL_OUT_BUFFER_LEN, |
2646 | 0 | ssl->cli_id, ssl->cli_id_len)) != 0) { |
2647 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "f_cookie_write", ret); |
2648 | 0 | return ret; |
2649 | 0 | } |
2650 | | |
2651 | 0 | *cookie_len_byte = (unsigned char) (p - (cookie_len_byte + 1)); |
2652 | |
|
2653 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "cookie sent", cookie_len_byte + 1, *cookie_len_byte); |
2654 | |
|
2655 | 0 | ssl->out_msglen = p - ssl->out_msg; |
2656 | 0 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
2657 | 0 | ssl->out_msg[0] = MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST; |
2658 | |
|
2659 | 0 | ssl->state = MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT; |
2660 | |
|
2661 | 0 | if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { |
2662 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); |
2663 | 0 | return ret; |
2664 | 0 | } |
2665 | | |
2666 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
2667 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
2668 | 0 | (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { |
2669 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); |
2670 | 0 | return ret; |
2671 | 0 | } |
2672 | 0 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
2673 | | |
2674 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write hello verify request")); |
2675 | |
|
2676 | 0 | return 0; |
2677 | 0 | } |
2678 | | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
2679 | | |
2680 | | static void ssl_handle_id_based_session_resumption(mbedtls_ssl_context *ssl) |
2681 | 0 | { |
2682 | 0 | int ret; |
2683 | 0 | mbedtls_ssl_session session_tmp; |
2684 | 0 | mbedtls_ssl_session * const session = ssl->session_negotiate; |
2685 | | |
2686 | | /* Resume is 0 by default, see ssl_handshake_init(). |
2687 | | * It may be already set to 1 by ssl_parse_session_ticket_ext(). */ |
2688 | 0 | if (ssl->handshake->resume == 1) { |
2689 | 0 | return; |
2690 | 0 | } |
2691 | 0 | if (session->id_len == 0) { |
2692 | 0 | return; |
2693 | 0 | } |
2694 | 0 | if (ssl->conf->f_get_cache == NULL) { |
2695 | 0 | return; |
2696 | 0 | } |
2697 | | #if defined(MBEDTLS_SSL_RENEGOTIATION) |
2698 | | if (ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE) { |
2699 | | return; |
2700 | | } |
2701 | | #endif |
2702 | | |
2703 | 0 | mbedtls_ssl_session_init(&session_tmp); |
2704 | |
|
2705 | 0 | session_tmp.id_len = session->id_len; |
2706 | 0 | memcpy(session_tmp.id, session->id, session->id_len); |
2707 | |
|
2708 | 0 | ret = ssl->conf->f_get_cache(ssl->conf->p_cache, |
2709 | 0 | &session_tmp); |
2710 | 0 | if (ret != 0) { |
2711 | 0 | goto exit; |
2712 | 0 | } |
2713 | | |
2714 | 0 | if (session->ciphersuite != session_tmp.ciphersuite || |
2715 | 0 | session->compression != session_tmp.compression) { |
2716 | | /* Mismatch between cached and negotiated session */ |
2717 | 0 | goto exit; |
2718 | 0 | } |
2719 | | |
2720 | | /* Move semantics */ |
2721 | 0 | mbedtls_ssl_session_free(session); |
2722 | 0 | *session = session_tmp; |
2723 | 0 | memset(&session_tmp, 0, sizeof(session_tmp)); |
2724 | |
|
2725 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("session successfully restored from cache")); |
2726 | 0 | ssl->handshake->resume = 1; |
2727 | |
|
2728 | 0 | exit: |
2729 | |
|
2730 | 0 | mbedtls_ssl_session_free(&session_tmp); |
2731 | 0 | } |
2732 | | |
2733 | | MBEDTLS_CHECK_RETURN_CRITICAL |
2734 | | static int ssl_write_server_hello(mbedtls_ssl_context *ssl) |
2735 | 0 | { |
2736 | | #if defined(MBEDTLS_HAVE_TIME) |
2737 | | mbedtls_time_t t; |
2738 | | #endif |
2739 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
2740 | 0 | size_t olen, ext_len = 0, n; |
2741 | 0 | unsigned char *buf, *p; |
2742 | |
|
2743 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello")); |
2744 | |
|
2745 | 0 | #if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) |
2746 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
2747 | 0 | ssl->handshake->verify_cookie_len != 0) { |
2748 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("client hello was not authenticated")); |
2749 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello")); |
2750 | |
|
2751 | 0 | return ssl_write_hello_verify_request(ssl); |
2752 | 0 | } |
2753 | 0 | #endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ |
2754 | | |
2755 | 0 | if (ssl->conf->f_rng == NULL) { |
2756 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("no RNG provided")); |
2757 | 0 | return MBEDTLS_ERR_SSL_NO_RNG; |
2758 | 0 | } |
2759 | | |
2760 | | /* |
2761 | | * 0 . 0 handshake type |
2762 | | * 1 . 3 handshake length |
2763 | | * 4 . 5 protocol version |
2764 | | * 6 . 9 UNIX time() |
2765 | | * 10 . 37 random bytes |
2766 | | */ |
2767 | 0 | buf = ssl->out_msg; |
2768 | 0 | p = buf + 4; |
2769 | |
|
2770 | 0 | mbedtls_ssl_write_version(ssl->major_ver, ssl->minor_ver, |
2771 | 0 | ssl->conf->transport, p); |
2772 | 0 | p += 2; |
2773 | |
|
2774 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen version: [%d:%d]", |
2775 | 0 | buf[4], buf[5])); |
2776 | |
|
2777 | | #if defined(MBEDTLS_HAVE_TIME) |
2778 | | t = mbedtls_time(NULL); |
2779 | | MBEDTLS_PUT_UINT32_BE(t, p, 0); |
2780 | | p += 4; |
2781 | | |
2782 | | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, current time: %" MBEDTLS_PRINTF_LONGLONG, |
2783 | | (long long) t)); |
2784 | | #else |
2785 | 0 | if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 4)) != 0) { |
2786 | 0 | return ret; |
2787 | 0 | } |
2788 | | |
2789 | 0 | p += 4; |
2790 | 0 | #endif /* MBEDTLS_HAVE_TIME */ |
2791 | |
|
2792 | 0 | if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, p, 28)) != 0) { |
2793 | 0 | return ret; |
2794 | 0 | } |
2795 | | |
2796 | 0 | p += 28; |
2797 | |
|
2798 | 0 | memcpy(ssl->handshake->randbytes + 32, buf + 6, 32); |
2799 | |
|
2800 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "server hello, random bytes", buf + 6, 32); |
2801 | |
|
2802 | 0 | ssl_handle_id_based_session_resumption(ssl); |
2803 | |
|
2804 | 0 | if (ssl->handshake->resume == 0) { |
2805 | | /* |
2806 | | * New session, create a new session id, |
2807 | | * unless we're about to issue a session ticket |
2808 | | */ |
2809 | 0 | ssl->state++; |
2810 | |
|
2811 | | #if defined(MBEDTLS_HAVE_TIME) |
2812 | | ssl->session_negotiate->start = mbedtls_time(NULL); |
2813 | | #endif |
2814 | |
|
2815 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
2816 | | if (ssl->handshake->new_session_ticket != 0) { |
2817 | | ssl->session_negotiate->id_len = n = 0; |
2818 | | memset(ssl->session_negotiate->id, 0, 32); |
2819 | | } else |
2820 | | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
2821 | 0 | { |
2822 | 0 | ssl->session_negotiate->id_len = n = 32; |
2823 | 0 | if ((ret = ssl->conf->f_rng(ssl->conf->p_rng, ssl->session_negotiate->id, |
2824 | 0 | n)) != 0) { |
2825 | 0 | return ret; |
2826 | 0 | } |
2827 | 0 | } |
2828 | 0 | } else { |
2829 | | /* |
2830 | | * Resuming a session |
2831 | | */ |
2832 | 0 | n = ssl->session_negotiate->id_len; |
2833 | 0 | ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC; |
2834 | |
|
2835 | 0 | if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) { |
2836 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret); |
2837 | 0 | return ret; |
2838 | 0 | } |
2839 | 0 | } |
2840 | | |
2841 | | /* |
2842 | | * 38 . 38 session id length |
2843 | | * 39 . 38+n session id |
2844 | | * 39+n . 40+n chosen ciphersuite |
2845 | | * 41+n . 41+n chosen compression alg. |
2846 | | * 42+n . 43+n extensions length |
2847 | | * 44+n . 43+n+m extensions |
2848 | | */ |
2849 | 0 | *p++ = (unsigned char) ssl->session_negotiate->id_len; |
2850 | 0 | memcpy(p, ssl->session_negotiate->id, ssl->session_negotiate->id_len); |
2851 | 0 | p += ssl->session_negotiate->id_len; |
2852 | |
|
2853 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, session id len.: %" MBEDTLS_PRINTF_SIZET, n)); |
2854 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "server hello, session id", buf + 39, n); |
2855 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("%s session has been resumed", |
2856 | 0 | ssl->handshake->resume ? "a" : "no")); |
2857 | |
|
2858 | 0 | MBEDTLS_PUT_UINT16_BE(ssl->session_negotiate->ciphersuite, p, 0); |
2859 | 0 | p += 2; |
2860 | 0 | *p++ = MBEDTLS_BYTE_0(ssl->session_negotiate->compression); |
2861 | |
|
2862 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, chosen ciphersuite: %s", |
2863 | 0 | mbedtls_ssl_get_ciphersuite_name(ssl->session_negotiate->ciphersuite))); |
2864 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, compress alg.: 0x%02X", |
2865 | 0 | (unsigned int) ssl->session_negotiate->compression)); |
2866 | | |
2867 | | /* Do not write the extensions if the protocol is SSLv3 */ |
2868 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
2869 | | if ((ssl->major_ver != 3) || (ssl->minor_ver != 0)) { |
2870 | | #endif |
2871 | | |
2872 | | /* |
2873 | | * First write extensions, then the total length |
2874 | | */ |
2875 | 0 | ssl_write_renegotiation_ext(ssl, p + 2 + ext_len, &olen); |
2876 | 0 | ext_len += olen; |
2877 | |
|
2878 | 0 | #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) |
2879 | 0 | ssl_write_max_fragment_length_ext(ssl, p + 2 + ext_len, &olen); |
2880 | 0 | ext_len += olen; |
2881 | 0 | #endif |
2882 | |
|
2883 | | #if defined(MBEDTLS_SSL_TRUNCATED_HMAC) |
2884 | | ssl_write_truncated_hmac_ext(ssl, p + 2 + ext_len, &olen); |
2885 | | ext_len += olen; |
2886 | | #endif |
2887 | |
|
2888 | | #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) |
2889 | | ssl_write_cid_ext(ssl, p + 2 + ext_len, &olen); |
2890 | | ext_len += olen; |
2891 | | #endif |
2892 | |
|
2893 | | #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) |
2894 | | ssl_write_encrypt_then_mac_ext(ssl, p + 2 + ext_len, &olen); |
2895 | | ext_len += olen; |
2896 | | #endif |
2897 | |
|
2898 | | #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) |
2899 | | ssl_write_extended_ms_ext(ssl, p + 2 + ext_len, &olen); |
2900 | | ext_len += olen; |
2901 | | #endif |
2902 | |
|
2903 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
2904 | | ssl_write_session_ticket_ext(ssl, p + 2 + ext_len, &olen); |
2905 | | ext_len += olen; |
2906 | | #endif |
2907 | |
|
2908 | 0 | #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \ |
2909 | 0 | defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
2910 | 0 | if (mbedtls_ssl_ciphersuite_uses_ec( |
2911 | 0 | mbedtls_ssl_ciphersuite_from_id(ssl->session_negotiate->ciphersuite))) { |
2912 | 0 | ssl_write_supported_point_formats_ext(ssl, p + 2 + ext_len, &olen); |
2913 | 0 | ext_len += olen; |
2914 | 0 | } |
2915 | 0 | #endif |
2916 | |
|
2917 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
2918 | 0 | ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen); |
2919 | 0 | ext_len += olen; |
2920 | 0 | #endif |
2921 | |
|
2922 | | #if defined(MBEDTLS_SSL_ALPN) |
2923 | | ssl_write_alpn_ext(ssl, p + 2 + ext_len, &olen); |
2924 | | ext_len += olen; |
2925 | | #endif |
2926 | |
|
2927 | | #if defined(MBEDTLS_SSL_DTLS_SRTP) |
2928 | | ssl_write_use_srtp_ext(ssl, p + 2 + ext_len, &olen); |
2929 | | ext_len += olen; |
2930 | | #endif |
2931 | |
|
2932 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, total extension length: %" MBEDTLS_PRINTF_SIZET, |
2933 | 0 | ext_len)); |
2934 | |
|
2935 | 0 | if (ext_len > 0) { |
2936 | 0 | MBEDTLS_PUT_UINT16_BE(ext_len, p, 0); |
2937 | 0 | p += 2 + ext_len; |
2938 | 0 | } |
2939 | |
|
2940 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) |
2941 | | } |
2942 | | #endif |
2943 | |
|
2944 | 0 | ssl->out_msglen = p - buf; |
2945 | 0 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
2946 | 0 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO; |
2947 | |
|
2948 | 0 | ret = mbedtls_ssl_write_handshake_msg(ssl); |
2949 | |
|
2950 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello")); |
2951 | |
|
2952 | 0 | return ret; |
2953 | 0 | } |
2954 | | |
2955 | | #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) |
2956 | | MBEDTLS_CHECK_RETURN_CRITICAL |
2957 | | static int ssl_write_certificate_request(mbedtls_ssl_context *ssl) |
2958 | | { |
2959 | | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
2960 | | ssl->handshake->ciphersuite_info; |
2961 | | |
2962 | | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request")); |
2963 | | |
2964 | | if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { |
2965 | | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request")); |
2966 | | ssl->state++; |
2967 | | return 0; |
2968 | | } |
2969 | | |
2970 | | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
2971 | | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
2972 | | } |
2973 | | #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
2974 | | MBEDTLS_CHECK_RETURN_CRITICAL |
2975 | | static int ssl_write_certificate_request(mbedtls_ssl_context *ssl) |
2976 | 0 | { |
2977 | 0 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
2978 | 0 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
2979 | 0 | ssl->handshake->ciphersuite_info; |
2980 | 0 | uint16_t dn_size, total_dn_size; /* excluding length bytes */ |
2981 | 0 | size_t ct_len, sa_len; /* including length bytes */ |
2982 | 0 | unsigned char *buf, *p; |
2983 | 0 | const unsigned char * const end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; |
2984 | 0 | const mbedtls_x509_crt *crt; |
2985 | 0 | int authmode; |
2986 | |
|
2987 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write certificate request")); |
2988 | |
|
2989 | 0 | ssl->state++; |
2990 | |
|
2991 | | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
2992 | | if (ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET) { |
2993 | | authmode = ssl->handshake->sni_authmode; |
2994 | | } else |
2995 | | #endif |
2996 | 0 | authmode = ssl->conf->authmode; |
2997 | |
|
2998 | 0 | if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info) || |
2999 | 0 | authmode == MBEDTLS_SSL_VERIFY_NONE) { |
3000 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write certificate request")); |
3001 | 0 | return 0; |
3002 | 0 | } |
3003 | | |
3004 | | /* |
3005 | | * 0 . 0 handshake type |
3006 | | * 1 . 3 handshake length |
3007 | | * 4 . 4 cert type count |
3008 | | * 5 .. m-1 cert types |
3009 | | * m .. m+1 sig alg length (TLS 1.2 only) |
3010 | | * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only) |
3011 | | * n .. n+1 length of all DNs |
3012 | | * n+2 .. n+3 length of DN 1 |
3013 | | * n+4 .. ... Distinguished Name #1 |
3014 | | * ... .. ... length of DN 2, etc. |
3015 | | */ |
3016 | 0 | buf = ssl->out_msg; |
3017 | 0 | p = buf + 4; |
3018 | | |
3019 | | /* |
3020 | | * Supported certificate types |
3021 | | * |
3022 | | * ClientCertificateType certificate_types<1..2^8-1>; |
3023 | | * enum { (255) } ClientCertificateType; |
3024 | | */ |
3025 | 0 | ct_len = 0; |
3026 | |
|
3027 | | #if defined(MBEDTLS_RSA_C) |
3028 | | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_RSA_SIGN; |
3029 | | #endif |
3030 | 0 | #if defined(MBEDTLS_ECDSA_C) |
3031 | 0 | p[1 + ct_len++] = MBEDTLS_SSL_CERT_TYPE_ECDSA_SIGN; |
3032 | 0 | #endif |
3033 | |
|
3034 | 0 | p[0] = (unsigned char) ct_len++; |
3035 | 0 | p += ct_len; |
3036 | |
|
3037 | 0 | sa_len = 0; |
3038 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
3039 | | /* |
3040 | | * Add signature_algorithms for verify (TLS 1.2) |
3041 | | * |
3042 | | * SignatureAndHashAlgorithm supported_signature_algorithms<2..2^16-2>; |
3043 | | * |
3044 | | * struct { |
3045 | | * HashAlgorithm hash; |
3046 | | * SignatureAlgorithm signature; |
3047 | | * } SignatureAndHashAlgorithm; |
3048 | | * |
3049 | | * enum { (255) } HashAlgorithm; |
3050 | | * enum { (255) } SignatureAlgorithm; |
3051 | | */ |
3052 | 0 | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3) { |
3053 | 0 | const int *cur; |
3054 | | |
3055 | | /* |
3056 | | * Supported signature algorithms |
3057 | | */ |
3058 | 0 | for (cur = ssl->conf->sig_hashes; *cur != MBEDTLS_MD_NONE; cur++) { |
3059 | 0 | unsigned char hash = mbedtls_ssl_hash_from_md_alg(*cur); |
3060 | |
|
3061 | 0 | if (MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md(ssl, hash)) { |
3062 | 0 | continue; |
3063 | 0 | } |
3064 | | |
3065 | | #if defined(MBEDTLS_RSA_C) |
3066 | | p[2 + sa_len++] = hash; |
3067 | | p[2 + sa_len++] = MBEDTLS_SSL_SIG_RSA; |
3068 | | #endif |
3069 | 0 | #if defined(MBEDTLS_ECDSA_C) |
3070 | 0 | p[2 + sa_len++] = hash; |
3071 | 0 | p[2 + sa_len++] = MBEDTLS_SSL_SIG_ECDSA; |
3072 | 0 | #endif |
3073 | 0 | } |
3074 | |
|
3075 | 0 | MBEDTLS_PUT_UINT16_BE(sa_len, p, 0); |
3076 | 0 | sa_len += 2; |
3077 | 0 | p += sa_len; |
3078 | 0 | } |
3079 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
3080 | | |
3081 | | /* |
3082 | | * DistinguishedName certificate_authorities<0..2^16-1>; |
3083 | | * opaque DistinguishedName<1..2^16-1>; |
3084 | | */ |
3085 | 0 | p += 2; |
3086 | |
|
3087 | 0 | total_dn_size = 0; |
3088 | |
|
3089 | 0 | if (ssl->conf->cert_req_ca_list == MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED) { |
3090 | | /* NOTE: If trusted certificates are provisioned |
3091 | | * via a CA callback (configured through |
3092 | | * `mbedtls_ssl_conf_ca_cb()`, then the |
3093 | | * CertificateRequest is currently left empty. */ |
3094 | |
|
3095 | | #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) |
3096 | | if (ssl->handshake->sni_ca_chain != NULL) { |
3097 | | crt = ssl->handshake->sni_ca_chain; |
3098 | | } else |
3099 | | #endif |
3100 | 0 | crt = ssl->conf->ca_chain; |
3101 | |
|
3102 | 0 | while (crt != NULL && crt->version != 0) { |
3103 | | /* It follows from RFC 5280 A.1 that this length |
3104 | | * can be represented in at most 11 bits. */ |
3105 | 0 | dn_size = (uint16_t) crt->subject_raw.len; |
3106 | |
|
3107 | 0 | if (end < p || (size_t) (end - p) < 2 + (size_t) dn_size) { |
3108 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("skipping CAs: buffer too short")); |
3109 | 0 | break; |
3110 | 0 | } |
3111 | | |
3112 | 0 | MBEDTLS_PUT_UINT16_BE(dn_size, p, 0); |
3113 | 0 | p += 2; |
3114 | 0 | memcpy(p, crt->subject_raw.p, dn_size); |
3115 | 0 | p += dn_size; |
3116 | |
|
3117 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "requested DN", p - dn_size, dn_size); |
3118 | |
|
3119 | 0 | total_dn_size += 2 + dn_size; |
3120 | 0 | crt = crt->next; |
3121 | 0 | } |
3122 | 0 | } |
3123 | |
|
3124 | 0 | ssl->out_msglen = p - buf; |
3125 | 0 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
3126 | 0 | ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_REQUEST; |
3127 | 0 | MBEDTLS_PUT_UINT16_BE(total_dn_size, ssl->out_msg, 4 + ct_len + sa_len); |
3128 | |
|
3129 | 0 | ret = mbedtls_ssl_write_handshake_msg(ssl); |
3130 | |
|
3131 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write certificate request")); |
3132 | |
|
3133 | 0 | return ret; |
3134 | 0 | } |
3135 | | #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
3136 | | |
3137 | | #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
3138 | | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
3139 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3140 | | static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) |
3141 | | { |
3142 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3143 | | mbedtls_pk_context *own_key = mbedtls_ssl_own_key(ssl); |
3144 | | |
3145 | | /* Check if the key is a transparent ECDH key. |
3146 | | * This also ensures that it is safe to call mbedtls_pk_ec(). */ |
3147 | | if (mbedtls_pk_get_type(own_key) != MBEDTLS_PK_ECKEY && |
3148 | | mbedtls_pk_get_type(own_key) != MBEDTLS_PK_ECKEY_DH) { |
3149 | | MBEDTLS_SSL_DEBUG_MSG(1, ("server key not ECDH capable")); |
3150 | | return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; |
3151 | | } |
3152 | | |
3153 | | if ((ret = mbedtls_ecdh_get_params(&ssl->handshake->ecdh_ctx, |
3154 | | mbedtls_pk_ec(*own_key), |
3155 | | MBEDTLS_ECDH_OURS)) != 0) { |
3156 | | MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ecdh_get_params"), ret); |
3157 | | return ret; |
3158 | | } |
3159 | | |
3160 | | return 0; |
3161 | | } |
3162 | | #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || |
3163 | | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
3164 | | |
3165 | | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ |
3166 | | defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3167 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3168 | | static int ssl_resume_server_key_exchange(mbedtls_ssl_context *ssl, |
3169 | | size_t *signature_len) |
3170 | | { |
3171 | | /* Append the signature to ssl->out_msg, leaving 2 bytes for the |
3172 | | * signature length which will be added in ssl_write_server_key_exchange |
3173 | | * after the call to ssl_prepare_server_key_exchange. |
3174 | | * ssl_write_server_key_exchange also takes care of incrementing |
3175 | | * ssl->out_msglen. */ |
3176 | | unsigned char *sig_start = ssl->out_msg + ssl->out_msglen + 2; |
3177 | | size_t sig_max_len = (ssl->out_buf + MBEDTLS_SSL_OUT_CONTENT_LEN |
3178 | | - sig_start); |
3179 | | int ret = ssl->conf->f_async_resume(ssl, |
3180 | | sig_start, signature_len, sig_max_len); |
3181 | | if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { |
3182 | | ssl->handshake->async_in_progress = 0; |
3183 | | mbedtls_ssl_set_async_operation_data(ssl, NULL); |
3184 | | } |
3185 | | MBEDTLS_SSL_DEBUG_RET(2, "ssl_resume_server_key_exchange", ret); |
3186 | | return ret; |
3187 | | } |
3188 | | #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && |
3189 | | defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ |
3190 | | |
3191 | | /* Prepare the ServerKeyExchange message, up to and including |
3192 | | * calculating the signature if any, but excluding formatting the |
3193 | | * signature and sending the message. */ |
3194 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3195 | | static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl, |
3196 | | size_t *signature_len) |
3197 | 0 | { |
3198 | 0 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
3199 | 0 | ssl->handshake->ciphersuite_info; |
3200 | |
|
3201 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED) |
3202 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
3203 | 0 | unsigned char *dig_signed = NULL; |
3204 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
3205 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PFS_ENABLED */ |
3206 | |
|
3207 | 0 | (void) ciphersuite_info; /* unused in some configurations */ |
3208 | | #if !defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
3209 | | (void) signature_len; |
3210 | | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
3211 | |
|
3212 | 0 | ssl->out_msglen = 4; /* header (type:1, length:3) to be written later */ |
3213 | | |
3214 | | /* |
3215 | | * |
3216 | | * Part 1: Provide key exchange parameters for chosen ciphersuite. |
3217 | | * |
3218 | | */ |
3219 | | |
3220 | | /* |
3221 | | * - ECJPAKE key exchanges |
3222 | | */ |
3223 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
3224 | 0 | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { |
3225 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3226 | 0 | size_t len = 0; |
3227 | |
|
3228 | 0 | ret = mbedtls_ecjpake_write_round_two( |
3229 | 0 | &ssl->handshake->ecjpake_ctx, |
3230 | 0 | ssl->out_msg + ssl->out_msglen, |
3231 | 0 | MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, &len, |
3232 | 0 | ssl->conf->f_rng, ssl->conf->p_rng); |
3233 | 0 | if (ret != 0) { |
3234 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_two", ret); |
3235 | 0 | return ret; |
3236 | 0 | } |
3237 | | |
3238 | 0 | ssl->out_msglen += len; |
3239 | 0 | } |
3240 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
3241 | | |
3242 | | /* |
3243 | | * For (EC)DHE key exchanges with PSK, parameters are prefixed by support |
3244 | | * identity hint (RFC 4279, Sec. 3). Until someone needs this feature, |
3245 | | * we use empty support identity hints here. |
3246 | | **/ |
3247 | | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) || \ |
3248 | | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
3249 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK || |
3250 | | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { |
3251 | | ssl->out_msg[ssl->out_msglen++] = 0x00; |
3252 | | ssl->out_msg[ssl->out_msglen++] = 0x00; |
3253 | | } |
3254 | | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED || |
3255 | | MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
3256 | | |
3257 | | /* |
3258 | | * - DHE key exchanges |
3259 | | */ |
3260 | | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED) |
3261 | | if (mbedtls_ssl_ciphersuite_uses_dhe(ciphersuite_info)) { |
3262 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3263 | | size_t len = 0; |
3264 | | |
3265 | | if (ssl->conf->dhm_P.p == NULL || ssl->conf->dhm_G.p == NULL) { |
3266 | | MBEDTLS_SSL_DEBUG_MSG(1, ("no DH parameters set")); |
3267 | | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
3268 | | } |
3269 | | |
3270 | | /* |
3271 | | * Ephemeral DH parameters: |
3272 | | * |
3273 | | * struct { |
3274 | | * opaque dh_p<1..2^16-1>; |
3275 | | * opaque dh_g<1..2^16-1>; |
3276 | | * opaque dh_Ys<1..2^16-1>; |
3277 | | * } ServerDHParams; |
3278 | | */ |
3279 | | if ((ret = mbedtls_dhm_set_group(&ssl->handshake->dhm_ctx, |
3280 | | &ssl->conf->dhm_P, |
3281 | | &ssl->conf->dhm_G)) != 0) { |
3282 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_set_group", ret); |
3283 | | return ret; |
3284 | | } |
3285 | | |
3286 | | if ((ret = mbedtls_dhm_make_params( |
3287 | | &ssl->handshake->dhm_ctx, |
3288 | | (int) mbedtls_mpi_size(&ssl->handshake->dhm_ctx.P), |
3289 | | ssl->out_msg + ssl->out_msglen, &len, |
3290 | | ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { |
3291 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_make_params", ret); |
3292 | | return ret; |
3293 | | } |
3294 | | |
3295 | | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
3296 | | dig_signed = ssl->out_msg + ssl->out_msglen; |
3297 | | #endif |
3298 | | |
3299 | | ssl->out_msglen += len; |
3300 | | |
3301 | | MBEDTLS_SSL_DEBUG_MPI(3, "DHM: X ", &ssl->handshake->dhm_ctx.X); |
3302 | | MBEDTLS_SSL_DEBUG_MPI(3, "DHM: P ", &ssl->handshake->dhm_ctx.P); |
3303 | | MBEDTLS_SSL_DEBUG_MPI(3, "DHM: G ", &ssl->handshake->dhm_ctx.G); |
3304 | | MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GX", &ssl->handshake->dhm_ctx.GX); |
3305 | | } |
3306 | | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED */ |
3307 | | |
3308 | | /* |
3309 | | * - ECDHE key exchanges |
3310 | | */ |
3311 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED) |
3312 | 0 | if (mbedtls_ssl_ciphersuite_uses_ecdhe(ciphersuite_info)) { |
3313 | | /* |
3314 | | * Ephemeral ECDH parameters: |
3315 | | * |
3316 | | * struct { |
3317 | | * ECParameters curve_params; |
3318 | | * ECPoint public; |
3319 | | * } ServerECDHParams; |
3320 | | */ |
3321 | 0 | const mbedtls_ecp_curve_info **curve = NULL; |
3322 | 0 | const mbedtls_ecp_group_id *gid; |
3323 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3324 | 0 | size_t len = 0; |
3325 | | |
3326 | | /* Match our preference list against the offered curves */ |
3327 | 0 | for (gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++) { |
3328 | 0 | for (curve = ssl->handshake->curves; *curve != NULL; curve++) { |
3329 | 0 | if ((*curve)->grp_id == *gid) { |
3330 | 0 | goto curve_matching_done; |
3331 | 0 | } |
3332 | 0 | } |
3333 | 0 | } |
3334 | | |
3335 | 0 | curve_matching_done: |
3336 | 0 | if (curve == NULL || *curve == NULL) { |
3337 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("no matching curve for ECDHE")); |
3338 | 0 | return MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN; |
3339 | 0 | } |
3340 | | |
3341 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("ECDHE curve: %s", (*curve)->name)); |
3342 | |
|
3343 | 0 | if ((ret = mbedtls_ecdh_setup(&ssl->handshake->ecdh_ctx, |
3344 | 0 | (*curve)->grp_id)) != 0) { |
3345 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecp_group_load", ret); |
3346 | 0 | return ret; |
3347 | 0 | } |
3348 | | |
3349 | 0 | if ((ret = mbedtls_ecdh_make_params( |
3350 | 0 | &ssl->handshake->ecdh_ctx, &len, |
3351 | 0 | ssl->out_msg + ssl->out_msglen, |
3352 | 0 | MBEDTLS_SSL_OUT_CONTENT_LEN - ssl->out_msglen, |
3353 | 0 | ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { |
3354 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_make_params", ret); |
3355 | 0 | return ret; |
3356 | 0 | } |
3357 | | |
3358 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
3359 | 0 | dig_signed = ssl->out_msg + ssl->out_msglen; |
3360 | 0 | #endif |
3361 | |
|
3362 | 0 | ssl->out_msglen += len; |
3363 | |
|
3364 | 0 | MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, |
3365 | 0 | MBEDTLS_DEBUG_ECDH_Q); |
3366 | 0 | } |
3367 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDHE_ENABLED */ |
3368 | | |
3369 | | /* |
3370 | | * |
3371 | | * Part 2: For key exchanges involving the server signing the |
3372 | | * exchange parameters, compute and add the signature here. |
3373 | | * |
3374 | | */ |
3375 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
3376 | 0 | if (mbedtls_ssl_ciphersuite_uses_server_signature(ciphersuite_info)) { |
3377 | 0 | size_t dig_signed_len = ssl->out_msg + ssl->out_msglen - dig_signed; |
3378 | 0 | size_t hashlen = 0; |
3379 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
3380 | | unsigned char hash[PSA_HASH_MAX_SIZE]; |
3381 | | #else |
3382 | 0 | unsigned char hash[MBEDTLS_MD_MAX_SIZE]; |
3383 | 0 | #endif |
3384 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3385 | | |
3386 | | /* |
3387 | | * 2.1: Choose hash algorithm: |
3388 | | * A: For TLS 1.2, obey signature-hash-algorithm extension |
3389 | | * to choose appropriate hash. |
3390 | | * B: For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1 |
3391 | | * (RFC 4492, Sec. 5.4) |
3392 | | * C: Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3) |
3393 | | */ |
3394 | |
|
3395 | 0 | mbedtls_md_type_t md_alg; |
3396 | |
|
3397 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
3398 | 0 | mbedtls_pk_type_t sig_alg = |
3399 | 0 | mbedtls_ssl_get_ciphersuite_sig_pk_alg(ciphersuite_info); |
3400 | 0 | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3) { |
3401 | | /* A: For TLS 1.2, obey signature-hash-algorithm extension |
3402 | | * (RFC 5246, Sec. 7.4.1.4.1). */ |
3403 | 0 | if (sig_alg == MBEDTLS_PK_NONE || |
3404 | 0 | (md_alg = mbedtls_ssl_sig_hash_set_find(&ssl->handshake->hash_algs, |
3405 | 0 | sig_alg)) == MBEDTLS_MD_NONE) { |
3406 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
3407 | | /* (... because we choose a cipher suite |
3408 | | * only if there is a matching hash.) */ |
3409 | 0 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
3410 | 0 | } |
3411 | 0 | } else |
3412 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
3413 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
3414 | | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
3415 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA) { |
3416 | | /* B: Default hash SHA1 */ |
3417 | | md_alg = MBEDTLS_MD_SHA1; |
3418 | | } else |
3419 | | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ |
3420 | | MBEDTLS_SSL_PROTO_TLS1_1 */ |
3421 | 0 | { |
3422 | | /* C: MD5 + SHA1 */ |
3423 | 0 | md_alg = MBEDTLS_MD_NONE; |
3424 | 0 | } |
3425 | | |
3426 | 0 | MBEDTLS_SSL_DEBUG_MSG(3, ("pick hash algorithm %u for signing", (unsigned) md_alg)); |
3427 | | |
3428 | | /* |
3429 | | * 2.2: Compute the hash to be signed |
3430 | | */ |
3431 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
3432 | | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
3433 | | if (md_alg == MBEDTLS_MD_NONE) { |
3434 | | hashlen = 36; |
3435 | | ret = mbedtls_ssl_get_key_exchange_md_ssl_tls(ssl, hash, |
3436 | | dig_signed, |
3437 | | dig_signed_len); |
3438 | | if (ret != 0) { |
3439 | | return ret; |
3440 | | } |
3441 | | } else |
3442 | | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \ |
3443 | | MBEDTLS_SSL_PROTO_TLS1_1 */ |
3444 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
3445 | 0 | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
3446 | 0 | if (md_alg != MBEDTLS_MD_NONE) { |
3447 | 0 | ret = mbedtls_ssl_get_key_exchange_md_tls1_2(ssl, hash, &hashlen, |
3448 | 0 | dig_signed, |
3449 | 0 | dig_signed_len, |
3450 | 0 | md_alg); |
3451 | 0 | if (ret != 0) { |
3452 | 0 | return ret; |
3453 | 0 | } |
3454 | 0 | } else |
3455 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ |
3456 | | MBEDTLS_SSL_PROTO_TLS1_2 */ |
3457 | 0 | { |
3458 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
3459 | 0 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
3460 | 0 | } |
3461 | | |
3462 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "parameters hash", hash, hashlen); |
3463 | | |
3464 | | /* |
3465 | | * 2.3: Compute and add the signature |
3466 | | */ |
3467 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
3468 | 0 | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3) { |
3469 | | /* |
3470 | | * For TLS 1.2, we need to specify signature and hash algorithm |
3471 | | * explicitly through a prefix to the signature. |
3472 | | * |
3473 | | * struct { |
3474 | | * HashAlgorithm hash; |
3475 | | * SignatureAlgorithm signature; |
3476 | | * } SignatureAndHashAlgorithm; |
3477 | | * |
3478 | | * struct { |
3479 | | * SignatureAndHashAlgorithm algorithm; |
3480 | | * opaque signature<0..2^16-1>; |
3481 | | * } DigitallySigned; |
3482 | | * |
3483 | | */ |
3484 | |
|
3485 | 0 | ssl->out_msg[ssl->out_msglen++] = |
3486 | 0 | mbedtls_ssl_hash_from_md_alg(md_alg); |
3487 | 0 | ssl->out_msg[ssl->out_msglen++] = |
3488 | 0 | mbedtls_ssl_sig_from_pk_alg(sig_alg); |
3489 | 0 | } |
3490 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
3491 | |
|
3492 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3493 | | if (ssl->conf->f_async_sign_start != NULL) { |
3494 | | ret = ssl->conf->f_async_sign_start(ssl, |
3495 | | mbedtls_ssl_own_cert(ssl), |
3496 | | md_alg, hash, hashlen); |
3497 | | switch (ret) { |
3498 | | case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: |
3499 | | /* act as if f_async_sign was null */ |
3500 | | break; |
3501 | | case 0: |
3502 | | ssl->handshake->async_in_progress = 1; |
3503 | | return ssl_resume_server_key_exchange(ssl, signature_len); |
3504 | | case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: |
3505 | | ssl->handshake->async_in_progress = 1; |
3506 | | return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; |
3507 | | default: |
3508 | | MBEDTLS_SSL_DEBUG_RET(1, "f_async_sign_start", ret); |
3509 | | return ret; |
3510 | | } |
3511 | | } |
3512 | | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
3513 | |
|
3514 | 0 | if (mbedtls_ssl_own_key(ssl) == NULL) { |
3515 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("got no private key")); |
3516 | 0 | return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; |
3517 | 0 | } |
3518 | | |
3519 | | /* Append the signature to ssl->out_msg, leaving 2 bytes for the |
3520 | | * signature length which will be added in ssl_write_server_key_exchange |
3521 | | * after the call to ssl_prepare_server_key_exchange. |
3522 | | * ssl_write_server_key_exchange also takes care of incrementing |
3523 | | * ssl->out_msglen. */ |
3524 | 0 | if ((ret = mbedtls_pk_sign(mbedtls_ssl_own_key(ssl), |
3525 | 0 | md_alg, hash, hashlen, |
3526 | 0 | ssl->out_msg + ssl->out_msglen + 2, |
3527 | 0 | signature_len, |
3528 | 0 | ssl->conf->f_rng, |
3529 | 0 | ssl->conf->p_rng)) != 0) { |
3530 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_sign", ret); |
3531 | 0 | return ret; |
3532 | 0 | } |
3533 | 0 | } |
3534 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
3535 | | |
3536 | 0 | return 0; |
3537 | 0 | } |
3538 | | |
3539 | | /* Prepare the ServerKeyExchange message and send it. For ciphersuites |
3540 | | * that do not include a ServerKeyExchange message, do nothing. Either |
3541 | | * way, if successful, move on to the next step in the SSL state |
3542 | | * machine. */ |
3543 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3544 | | static int ssl_write_server_key_exchange(mbedtls_ssl_context *ssl) |
3545 | 0 | { |
3546 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3547 | 0 | size_t signature_len = 0; |
3548 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) |
3549 | 0 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
3550 | 0 | ssl->handshake->ciphersuite_info; |
3551 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ |
3552 | |
|
3553 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server key exchange")); |
3554 | |
|
3555 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED) |
3556 | | /* Extract static ECDH parameters and abort if ServerKeyExchange |
3557 | | * is not needed. */ |
3558 | 0 | if (mbedtls_ssl_ciphersuite_no_pfs(ciphersuite_info)) { |
3559 | | /* For suites involving ECDH, extract DH parameters |
3560 | | * from certificate at this point. */ |
3561 | | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED) |
3562 | | if (mbedtls_ssl_ciphersuite_uses_ecdh(ciphersuite_info)) { |
3563 | | ret = ssl_get_ecdh_params_from_cert(ssl); |
3564 | | if (ret != 0) { |
3565 | | MBEDTLS_SSL_DEBUG_RET(1, "ssl_get_ecdh_params_from_cert", ret); |
3566 | | return ret; |
3567 | | } |
3568 | | } |
3569 | | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_ECDH_ENABLED */ |
3570 | | |
3571 | | /* Key exchanges not involving ephemeral keys don't use |
3572 | | * ServerKeyExchange, so end here. */ |
3573 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip write server key exchange")); |
3574 | 0 | ssl->state++; |
3575 | 0 | return 0; |
3576 | 0 | } |
3577 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_NON_PFS_ENABLED */ |
3578 | | |
3579 | | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && \ |
3580 | | defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3581 | | /* If we have already prepared the message and there is an ongoing |
3582 | | * signature operation, resume signing. */ |
3583 | | if (ssl->handshake->async_in_progress != 0) { |
3584 | | MBEDTLS_SSL_DEBUG_MSG(2, ("resuming signature operation")); |
3585 | | ret = ssl_resume_server_key_exchange(ssl, &signature_len); |
3586 | | } else |
3587 | | #endif /* defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) && |
3588 | | defined(MBEDTLS_SSL_ASYNC_PRIVATE) */ |
3589 | 0 | { |
3590 | | /* ServerKeyExchange is needed. Prepare the message. */ |
3591 | 0 | ret = ssl_prepare_server_key_exchange(ssl, &signature_len); |
3592 | 0 | } |
3593 | |
|
3594 | 0 | if (ret != 0) { |
3595 | | /* If we're starting to write a new message, set ssl->out_msglen |
3596 | | * to 0. But if we're resuming after an asynchronous message, |
3597 | | * out_msglen is the amount of data written so far and mst be |
3598 | | * preserved. */ |
3599 | 0 | if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { |
3600 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange (pending)")); |
3601 | 0 | } else { |
3602 | 0 | ssl->out_msglen = 0; |
3603 | 0 | } |
3604 | 0 | return ret; |
3605 | 0 | } |
3606 | | |
3607 | | /* If there is a signature, write its length. |
3608 | | * ssl_prepare_server_key_exchange already wrote the signature |
3609 | | * itself at its proper place in the output buffer. */ |
3610 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) |
3611 | 0 | if (signature_len != 0) { |
3612 | 0 | ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_1(signature_len); |
3613 | 0 | ssl->out_msg[ssl->out_msglen++] = MBEDTLS_BYTE_0(signature_len); |
3614 | |
|
3615 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "my signature", |
3616 | 0 | ssl->out_msg + ssl->out_msglen, |
3617 | 0 | signature_len); |
3618 | | |
3619 | | /* Skip over the already-written signature */ |
3620 | 0 | ssl->out_msglen += signature_len; |
3621 | 0 | } |
3622 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED */ |
3623 | | |
3624 | | /* Add header and send. */ |
3625 | 0 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
3626 | 0 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE; |
3627 | |
|
3628 | 0 | ssl->state++; |
3629 | |
|
3630 | 0 | if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { |
3631 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); |
3632 | 0 | return ret; |
3633 | 0 | } |
3634 | | |
3635 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server key exchange")); |
3636 | 0 | return 0; |
3637 | 0 | } |
3638 | | |
3639 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3640 | | static int ssl_write_server_hello_done(mbedtls_ssl_context *ssl) |
3641 | 0 | { |
3642 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3643 | |
|
3644 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write server hello done")); |
3645 | |
|
3646 | 0 | ssl->out_msglen = 4; |
3647 | 0 | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
3648 | 0 | ssl->out_msg[0] = MBEDTLS_SSL_HS_SERVER_HELLO_DONE; |
3649 | |
|
3650 | 0 | ssl->state++; |
3651 | |
|
3652 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
3653 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) { |
3654 | 0 | mbedtls_ssl_send_flight_completed(ssl); |
3655 | 0 | } |
3656 | 0 | #endif |
3657 | |
|
3658 | 0 | if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { |
3659 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); |
3660 | 0 | return ret; |
3661 | 0 | } |
3662 | | |
3663 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
3664 | 0 | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
3665 | 0 | (ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { |
3666 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_flight_transmit", ret); |
3667 | 0 | return ret; |
3668 | 0 | } |
3669 | 0 | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
3670 | | |
3671 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write server hello done")); |
3672 | |
|
3673 | 0 | return 0; |
3674 | 0 | } |
3675 | | |
3676 | | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \ |
3677 | | defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
3678 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3679 | | static int ssl_parse_client_dh_public(mbedtls_ssl_context *ssl, unsigned char **p, |
3680 | | const unsigned char *end) |
3681 | | { |
3682 | | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
3683 | | size_t n; |
3684 | | |
3685 | | /* |
3686 | | * Receive G^Y mod P, premaster = (G^Y)^X mod P |
3687 | | */ |
3688 | | if (*p + 2 > end) { |
3689 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3690 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3691 | | } |
3692 | | |
3693 | | n = ((*p)[0] << 8) | (*p)[1]; |
3694 | | *p += 2; |
3695 | | |
3696 | | if (*p + n > end) { |
3697 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3698 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3699 | | } |
3700 | | |
3701 | | if ((ret = mbedtls_dhm_read_public(&ssl->handshake->dhm_ctx, *p, n)) != 0) { |
3702 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_read_public", ret); |
3703 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP; |
3704 | | } |
3705 | | |
3706 | | *p += n; |
3707 | | |
3708 | | MBEDTLS_SSL_DEBUG_MPI(3, "DHM: GY", &ssl->handshake->dhm_ctx.GY); |
3709 | | |
3710 | | return ret; |
3711 | | } |
3712 | | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED || |
3713 | | MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
3714 | | |
3715 | | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
3716 | | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
3717 | | |
3718 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3719 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3720 | | static int ssl_resume_decrypt_pms(mbedtls_ssl_context *ssl, |
3721 | | unsigned char *peer_pms, |
3722 | | size_t *peer_pmslen, |
3723 | | size_t peer_pmssize) |
3724 | | { |
3725 | | int ret = ssl->conf->f_async_resume(ssl, |
3726 | | peer_pms, peer_pmslen, peer_pmssize); |
3727 | | if (ret != MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { |
3728 | | ssl->handshake->async_in_progress = 0; |
3729 | | mbedtls_ssl_set_async_operation_data(ssl, NULL); |
3730 | | } |
3731 | | MBEDTLS_SSL_DEBUG_RET(2, "ssl_decrypt_encrypted_pms", ret); |
3732 | | return ret; |
3733 | | } |
3734 | | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
3735 | | |
3736 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3737 | | static int ssl_decrypt_encrypted_pms(mbedtls_ssl_context *ssl, |
3738 | | const unsigned char *p, |
3739 | | const unsigned char *end, |
3740 | | unsigned char *peer_pms, |
3741 | | size_t *peer_pmslen, |
3742 | | size_t peer_pmssize) |
3743 | | { |
3744 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3745 | | |
3746 | | mbedtls_x509_crt *own_cert = mbedtls_ssl_own_cert(ssl); |
3747 | | if (own_cert == NULL) { |
3748 | | MBEDTLS_SSL_DEBUG_MSG(1, ("got no local certificate")); |
3749 | | return MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE; |
3750 | | } |
3751 | | mbedtls_pk_context *public_key = &own_cert->pk; |
3752 | | mbedtls_pk_context *private_key = mbedtls_ssl_own_key(ssl); |
3753 | | size_t len = mbedtls_pk_get_len(public_key); |
3754 | | |
3755 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3756 | | /* If we have already started decoding the message and there is an ongoing |
3757 | | * decryption operation, resume signing. */ |
3758 | | if (ssl->handshake->async_in_progress != 0) { |
3759 | | MBEDTLS_SSL_DEBUG_MSG(2, ("resuming decryption operation")); |
3760 | | return ssl_resume_decrypt_pms(ssl, |
3761 | | peer_pms, peer_pmslen, peer_pmssize); |
3762 | | } |
3763 | | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
3764 | | |
3765 | | /* |
3766 | | * Prepare to decrypt the premaster using own private RSA key |
3767 | | */ |
3768 | | #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ |
3769 | | defined(MBEDTLS_SSL_PROTO_TLS1_2) |
3770 | | if (ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0) { |
3771 | | if (p + 2 > end) { |
3772 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3773 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3774 | | } |
3775 | | if (*p++ != MBEDTLS_BYTE_1(len) || |
3776 | | *p++ != MBEDTLS_BYTE_0(len)) { |
3777 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3778 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3779 | | } |
3780 | | } |
3781 | | #endif |
3782 | | |
3783 | | if (p + len != end) { |
3784 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3785 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3786 | | } |
3787 | | |
3788 | | /* |
3789 | | * Decrypt the premaster secret |
3790 | | */ |
3791 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3792 | | if (ssl->conf->f_async_decrypt_start != NULL) { |
3793 | | ret = ssl->conf->f_async_decrypt_start(ssl, |
3794 | | mbedtls_ssl_own_cert(ssl), |
3795 | | p, len); |
3796 | | switch (ret) { |
3797 | | case MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH: |
3798 | | /* act as if f_async_decrypt_start was null */ |
3799 | | break; |
3800 | | case 0: |
3801 | | ssl->handshake->async_in_progress = 1; |
3802 | | return ssl_resume_decrypt_pms(ssl, |
3803 | | peer_pms, |
3804 | | peer_pmslen, |
3805 | | peer_pmssize); |
3806 | | case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS: |
3807 | | ssl->handshake->async_in_progress = 1; |
3808 | | return MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; |
3809 | | default: |
3810 | | MBEDTLS_SSL_DEBUG_RET(1, "f_async_decrypt_start", ret); |
3811 | | return ret; |
3812 | | } |
3813 | | } |
3814 | | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
3815 | | |
3816 | | if (!mbedtls_pk_can_do(private_key, MBEDTLS_PK_RSA)) { |
3817 | | MBEDTLS_SSL_DEBUG_MSG(1, ("got no RSA private key")); |
3818 | | return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; |
3819 | | } |
3820 | | |
3821 | | ret = mbedtls_pk_decrypt(private_key, p, len, |
3822 | | peer_pms, peer_pmslen, peer_pmssize, |
3823 | | ssl->conf->f_rng, ssl->conf->p_rng); |
3824 | | return ret; |
3825 | | } |
3826 | | |
3827 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3828 | | static int ssl_parse_encrypted_pms(mbedtls_ssl_context *ssl, |
3829 | | const unsigned char *p, |
3830 | | const unsigned char *end, |
3831 | | size_t pms_offset) |
3832 | | { |
3833 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3834 | | unsigned char *pms = ssl->handshake->premaster + pms_offset; |
3835 | | unsigned char ver[2]; |
3836 | | unsigned char fake_pms[48], peer_pms[48]; |
3837 | | unsigned char mask; |
3838 | | size_t i, peer_pmslen; |
3839 | | unsigned int diff; |
3840 | | |
3841 | | /* In case of a failure in decryption, the decryption may write less than |
3842 | | * 2 bytes of output, but we always read the first two bytes. It doesn't |
3843 | | * matter in the end because diff will be nonzero in that case due to |
3844 | | * ret being nonzero, and we only care whether diff is 0. |
3845 | | * But do initialize peer_pms and peer_pmslen for robustness anyway. This |
3846 | | * also makes memory analyzers happy (don't access uninitialized memory, |
3847 | | * even if it's an unsigned char). */ |
3848 | | peer_pms[0] = peer_pms[1] = ~0; |
3849 | | peer_pmslen = 0; |
3850 | | |
3851 | | ret = ssl_decrypt_encrypted_pms(ssl, p, end, |
3852 | | peer_pms, |
3853 | | &peer_pmslen, |
3854 | | sizeof(peer_pms)); |
3855 | | |
3856 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
3857 | | if (ret == MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS) { |
3858 | | return ret; |
3859 | | } |
3860 | | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
3861 | | |
3862 | | mbedtls_ssl_write_version(ssl->handshake->max_major_ver, |
3863 | | ssl->handshake->max_minor_ver, |
3864 | | ssl->conf->transport, ver); |
3865 | | |
3866 | | /* Avoid data-dependent branches while checking for invalid |
3867 | | * padding, to protect against timing-based Bleichenbacher-type |
3868 | | * attacks. */ |
3869 | | diff = (unsigned int) ret; |
3870 | | diff |= peer_pmslen ^ 48; |
3871 | | diff |= peer_pms[0] ^ ver[0]; |
3872 | | diff |= peer_pms[1] ^ ver[1]; |
3873 | | |
3874 | | /* mask = diff ? 0xff : 0x00 using bit operations to avoid branches */ |
3875 | | mask = mbedtls_ct_uint_mask(diff); |
3876 | | |
3877 | | /* |
3878 | | * Protection against Bleichenbacher's attack: invalid PKCS#1 v1.5 padding |
3879 | | * must not cause the connection to end immediately; instead, send a |
3880 | | * bad_record_mac later in the handshake. |
3881 | | * To protect against timing-based variants of the attack, we must |
3882 | | * not have any branch that depends on whether the decryption was |
3883 | | * successful. In particular, always generate the fake premaster secret, |
3884 | | * regardless of whether it will ultimately influence the output or not. |
3885 | | */ |
3886 | | ret = ssl->conf->f_rng(ssl->conf->p_rng, fake_pms, sizeof(fake_pms)); |
3887 | | if (ret != 0) { |
3888 | | /* It's ok to abort on an RNG failure, since this does not reveal |
3889 | | * anything about the RSA decryption. */ |
3890 | | return ret; |
3891 | | } |
3892 | | |
3893 | | #if defined(MBEDTLS_SSL_DEBUG_ALL) |
3894 | | if (diff != 0) { |
3895 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3896 | | } |
3897 | | #endif |
3898 | | |
3899 | | if (sizeof(ssl->handshake->premaster) < pms_offset || |
3900 | | sizeof(ssl->handshake->premaster) - pms_offset < 48) { |
3901 | | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
3902 | | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
3903 | | } |
3904 | | ssl->handshake->pmslen = 48; |
3905 | | |
3906 | | /* Set pms to either the true or the fake PMS, without |
3907 | | * data-dependent branches. */ |
3908 | | for (i = 0; i < ssl->handshake->pmslen; i++) { |
3909 | | pms[i] = (mask & fake_pms[i]) | ((~mask) & peer_pms[i]); |
3910 | | } |
3911 | | |
3912 | | return 0; |
3913 | | } |
3914 | | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED || |
3915 | | MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
3916 | | |
3917 | | #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) |
3918 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3919 | | static int ssl_parse_client_psk_identity(mbedtls_ssl_context *ssl, unsigned char **p, |
3920 | | const unsigned char *end) |
3921 | 0 | { |
3922 | 0 | int ret = 0; |
3923 | 0 | uint16_t n; |
3924 | |
|
3925 | 0 | if (ssl_conf_has_psk_or_cb(ssl->conf) == 0) { |
3926 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("got no pre-shared key")); |
3927 | 0 | return MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED; |
3928 | 0 | } |
3929 | | |
3930 | | /* |
3931 | | * Receive client pre-shared key identity name |
3932 | | */ |
3933 | 0 | if (end - *p < 2) { |
3934 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3935 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3936 | 0 | } |
3937 | | |
3938 | 0 | n = ((*p)[0] << 8) | (*p)[1]; |
3939 | 0 | *p += 2; |
3940 | |
|
3941 | 0 | if (n == 0 || n > end - *p) { |
3942 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
3943 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
3944 | 0 | } |
3945 | | |
3946 | 0 | if (ssl->conf->f_psk != NULL) { |
3947 | 0 | if (ssl->conf->f_psk(ssl->conf->p_psk, ssl, *p, n) != 0) { |
3948 | 0 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
3949 | 0 | } |
3950 | 0 | } else { |
3951 | | /* Identity is not a big secret since clients send it in the clear, |
3952 | | * but treat it carefully anyway, just in case */ |
3953 | 0 | if (n != ssl->conf->psk_identity_len || |
3954 | 0 | mbedtls_ct_memcmp(ssl->conf->psk_identity, *p, n) != 0) { |
3955 | 0 | ret = MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
3956 | 0 | } |
3957 | 0 | } |
3958 | |
|
3959 | 0 | if (ret == MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY) { |
3960 | 0 | MBEDTLS_SSL_DEBUG_BUF(3, "Unknown PSK identity", *p, n); |
3961 | 0 | mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, |
3962 | 0 | MBEDTLS_SSL_ALERT_MSG_UNKNOWN_PSK_IDENTITY); |
3963 | 0 | return MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY; |
3964 | 0 | } |
3965 | | |
3966 | 0 | *p += n; |
3967 | |
|
3968 | 0 | return 0; |
3969 | 0 | } |
3970 | | #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ |
3971 | | |
3972 | | MBEDTLS_CHECK_RETURN_CRITICAL |
3973 | | static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl) |
3974 | 0 | { |
3975 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
3976 | 0 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info; |
3977 | 0 | unsigned char *p, *end; |
3978 | |
|
3979 | 0 | ciphersuite_info = ssl->handshake->ciphersuite_info; |
3980 | |
|
3981 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client key exchange")); |
3982 | |
|
3983 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && \ |
3984 | | (defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \ |
3985 | | defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)) |
3986 | | if ((ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK || |
3987 | | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) && |
3988 | | (ssl->handshake->async_in_progress != 0)) { |
3989 | | /* We've already read a record and there is an asynchronous |
3990 | | * operation in progress to decrypt it. So skip reading the |
3991 | | * record. */ |
3992 | | MBEDTLS_SSL_DEBUG_MSG(3, ("will resume decryption of previously-read record")); |
3993 | | } else |
3994 | | #endif |
3995 | 0 | if ((ret = mbedtls_ssl_read_record(ssl, 1)) != 0) { |
3996 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret); |
3997 | 0 | return ret; |
3998 | 0 | } |
3999 | | |
4000 | 0 | p = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl); |
4001 | 0 | end = ssl->in_msg + ssl->in_hslen; |
4002 | |
|
4003 | 0 | if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) { |
4004 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
4005 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
4006 | 0 | } |
4007 | | |
4008 | 0 | if (ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE) { |
4009 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange message")); |
4010 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
4011 | 0 | } |
4012 | | |
4013 | | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) |
4014 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA) { |
4015 | | if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) { |
4016 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret); |
4017 | | return ret; |
4018 | | } |
4019 | | |
4020 | | if (p != end) { |
4021 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); |
4022 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
4023 | | } |
4024 | | |
4025 | | if ((ret = mbedtls_dhm_calc_secret(&ssl->handshake->dhm_ctx, |
4026 | | ssl->handshake->premaster, |
4027 | | MBEDTLS_PREMASTER_SIZE, |
4028 | | &ssl->handshake->pmslen, |
4029 | | ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { |
4030 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_dhm_calc_secret", ret); |
4031 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS; |
4032 | | } |
4033 | | |
4034 | | MBEDTLS_SSL_DEBUG_MPI(3, "DHM: K ", &ssl->handshake->dhm_ctx.K); |
4035 | | } else |
4036 | | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */ |
4037 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ |
4038 | 0 | defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \ |
4039 | 0 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \ |
4040 | 0 | defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) |
4041 | 0 | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA || |
4042 | 0 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA || |
4043 | 0 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA || |
4044 | 0 | ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA) { |
4045 | 0 | if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx, |
4046 | 0 | p, end - p)) != 0) { |
4047 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret); |
4048 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP; |
4049 | 0 | } |
4050 | | |
4051 | 0 | MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, |
4052 | 0 | MBEDTLS_DEBUG_ECDH_QP); |
4053 | |
|
4054 | 0 | if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx, |
4055 | 0 | &ssl->handshake->pmslen, |
4056 | 0 | ssl->handshake->premaster, |
4057 | 0 | MBEDTLS_MPI_MAX_SIZE, |
4058 | 0 | ssl->conf->f_rng, ssl->conf->p_rng)) != 0) { |
4059 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret); |
4060 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS; |
4061 | 0 | } |
4062 | | |
4063 | 0 | MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, |
4064 | 0 | MBEDTLS_DEBUG_ECDH_Z); |
4065 | 0 | } else |
4066 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || |
4067 | | MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED || |
4068 | | MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED || |
4069 | | MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ |
4070 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) |
4071 | 0 | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK) { |
4072 | 0 | if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { |
4073 | 0 | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); |
4074 | 0 | return ret; |
4075 | 0 | } |
4076 | | |
4077 | 0 | if (p != end) { |
4078 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); |
4079 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
4080 | 0 | } |
4081 | | |
4082 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
4083 | | /* For opaque PSKs, we perform the PSK-to-MS derivation automatically |
4084 | | * and skip the intermediate PMS. */ |
4085 | | if (ssl_use_opaque_psk(ssl) == 1) { |
4086 | | MBEDTLS_SSL_DEBUG_MSG(1, ("skip PMS generation for opaque PSK")); |
4087 | | } else |
4088 | | #endif /* MBEDTLS_USE_PSA_CRYPTO */ |
4089 | 0 | if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, |
4090 | 0 | ciphersuite_info->key_exchange)) != 0) { |
4091 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); |
4092 | 0 | return ret; |
4093 | 0 | } |
4094 | 0 | } else |
4095 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ |
4096 | | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) |
4097 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK) { |
4098 | | #if defined(MBEDTLS_SSL_ASYNC_PRIVATE) |
4099 | | if (ssl->handshake->async_in_progress != 0) { |
4100 | | /* There is an asynchronous operation in progress to |
4101 | | * decrypt the encrypted premaster secret, so skip |
4102 | | * directly to resuming this operation. */ |
4103 | | MBEDTLS_SSL_DEBUG_MSG(3, ("PSK identity already parsed")); |
4104 | | /* Update p to skip the PSK identity. ssl_parse_encrypted_pms |
4105 | | * won't actually use it, but maintain p anyway for robustness. */ |
4106 | | p += ssl->conf->psk_identity_len + 2; |
4107 | | } else |
4108 | | #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ |
4109 | | if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { |
4110 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); |
4111 | | return ret; |
4112 | | } |
4113 | | |
4114 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
4115 | | /* Opaque PSKs are currently only supported for PSK-only. */ |
4116 | | if (ssl_use_opaque_psk(ssl) == 1) { |
4117 | | MBEDTLS_SSL_DEBUG_MSG(1, ("opaque PSK not supported with RSA-PSK")); |
4118 | | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
4119 | | } |
4120 | | #endif |
4121 | | |
4122 | | if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 2)) != 0) { |
4123 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_encrypted_pms"), ret); |
4124 | | return ret; |
4125 | | } |
4126 | | |
4127 | | if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, |
4128 | | ciphersuite_info->key_exchange)) != 0) { |
4129 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); |
4130 | | return ret; |
4131 | | } |
4132 | | } else |
4133 | | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ |
4134 | | #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) |
4135 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK) { |
4136 | | if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { |
4137 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); |
4138 | | return ret; |
4139 | | } |
4140 | | if ((ret = ssl_parse_client_dh_public(ssl, &p, end)) != 0) { |
4141 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_dh_public"), ret); |
4142 | | return ret; |
4143 | | } |
4144 | | |
4145 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
4146 | | /* Opaque PSKs are currently only supported for PSK-only. */ |
4147 | | if (ssl_use_opaque_psk(ssl) == 1) { |
4148 | | MBEDTLS_SSL_DEBUG_MSG(1, ("opaque PSK not supported with DHE-PSK")); |
4149 | | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
4150 | | } |
4151 | | #endif |
4152 | | |
4153 | | if (p != end) { |
4154 | | MBEDTLS_SSL_DEBUG_MSG(1, ("bad client key exchange")); |
4155 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE; |
4156 | | } |
4157 | | |
4158 | | if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, |
4159 | | ciphersuite_info->key_exchange)) != 0) { |
4160 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); |
4161 | | return ret; |
4162 | | } |
4163 | | } else |
4164 | | #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */ |
4165 | | #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) |
4166 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK) { |
4167 | | if ((ret = ssl_parse_client_psk_identity(ssl, &p, end)) != 0) { |
4168 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_client_psk_identity"), ret); |
4169 | | return ret; |
4170 | | } |
4171 | | |
4172 | | if ((ret = mbedtls_ecdh_read_public(&ssl->handshake->ecdh_ctx, |
4173 | | p, end - p)) != 0) { |
4174 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_read_public", ret); |
4175 | | return MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP; |
4176 | | } |
4177 | | |
4178 | | #if defined(MBEDTLS_USE_PSA_CRYPTO) |
4179 | | /* Opaque PSKs are currently only supported for PSK-only. */ |
4180 | | if (ssl_use_opaque_psk(ssl) == 1) { |
4181 | | MBEDTLS_SSL_DEBUG_MSG(1, ("opaque PSK not supported with ECDHE-PSK")); |
4182 | | return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
4183 | | } |
4184 | | #endif |
4185 | | |
4186 | | MBEDTLS_SSL_DEBUG_ECDH(3, &ssl->handshake->ecdh_ctx, |
4187 | | MBEDTLS_DEBUG_ECDH_QP); |
4188 | | |
4189 | | if ((ret = mbedtls_ssl_psk_derive_premaster(ssl, |
4190 | | ciphersuite_info->key_exchange)) != 0) { |
4191 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_psk_derive_premaster", ret); |
4192 | | return ret; |
4193 | | } |
4194 | | } else |
4195 | | #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ |
4196 | | #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) |
4197 | | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA) { |
4198 | | if ((ret = ssl_parse_encrypted_pms(ssl, p, end, 0)) != 0) { |
4199 | | MBEDTLS_SSL_DEBUG_RET(1, ("ssl_parse_parse_encrypted_pms_secret"), ret); |
4200 | | return ret; |
4201 | | } |
4202 | | } else |
4203 | | #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */ |
4204 | 0 | #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) |
4205 | 0 | if (ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE) { |
4206 | 0 | ret = mbedtls_ecjpake_read_round_two(&ssl->handshake->ecjpake_ctx, |
4207 | 0 | p, end - p); |
4208 | 0 | if (ret != 0) { |
4209 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_read_round_two", ret); |
4210 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE; |
4211 | 0 | } |
4212 | | |
4213 | 0 | ret = mbedtls_ecjpake_derive_secret(&ssl->handshake->ecjpake_ctx, |
4214 | 0 | ssl->handshake->premaster, 32, &ssl->handshake->pmslen, |
4215 | 0 | ssl->conf->f_rng, ssl->conf->p_rng); |
4216 | 0 | if (ret != 0) { |
4217 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_derive_secret", ret); |
4218 | 0 | return ret; |
4219 | 0 | } |
4220 | 0 | } else |
4221 | 0 | #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ |
4222 | 0 | { |
4223 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
4224 | 0 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
4225 | 0 | } |
4226 | | |
4227 | 0 | if ((ret = mbedtls_ssl_derive_keys(ssl)) != 0) { |
4228 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_derive_keys", ret); |
4229 | 0 | return ret; |
4230 | 0 | } |
4231 | | |
4232 | 0 | ssl->state++; |
4233 | |
|
4234 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse client key exchange")); |
4235 | |
|
4236 | 0 | return 0; |
4237 | 0 | } |
4238 | | |
4239 | | #if !defined(MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED) |
4240 | | MBEDTLS_CHECK_RETURN_CRITICAL |
4241 | | static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) |
4242 | | { |
4243 | | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
4244 | | ssl->handshake->ciphersuite_info; |
4245 | | |
4246 | | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); |
4247 | | |
4248 | | if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { |
4249 | | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); |
4250 | | ssl->state++; |
4251 | | return 0; |
4252 | | } |
4253 | | |
4254 | | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
4255 | | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
4256 | | } |
4257 | | #else /* !MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
4258 | | MBEDTLS_CHECK_RETURN_CRITICAL |
4259 | | static int ssl_parse_certificate_verify(mbedtls_ssl_context *ssl) |
4260 | 0 | { |
4261 | 0 | int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; |
4262 | 0 | size_t i, sig_len; |
4263 | 0 | unsigned char hash[48]; |
4264 | 0 | unsigned char *hash_start = hash; |
4265 | 0 | size_t hashlen; |
4266 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
4267 | 0 | mbedtls_pk_type_t pk_alg; |
4268 | 0 | #endif |
4269 | 0 | mbedtls_md_type_t md_alg; |
4270 | 0 | const mbedtls_ssl_ciphersuite_t *ciphersuite_info = |
4271 | 0 | ssl->handshake->ciphersuite_info; |
4272 | 0 | mbedtls_pk_context *peer_pk; |
4273 | |
|
4274 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse certificate verify")); |
4275 | |
|
4276 | 0 | if (!mbedtls_ssl_ciphersuite_cert_req_allowed(ciphersuite_info)) { |
4277 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); |
4278 | 0 | ssl->state++; |
4279 | 0 | return 0; |
4280 | 0 | } |
4281 | | |
4282 | | #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
4283 | | if (ssl->session_negotiate->peer_cert == NULL) { |
4284 | | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); |
4285 | | ssl->state++; |
4286 | | return 0; |
4287 | | } |
4288 | | #else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
4289 | 0 | if (ssl->session_negotiate->peer_cert_digest == NULL) { |
4290 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= skip parse certificate verify")); |
4291 | 0 | ssl->state++; |
4292 | 0 | return 0; |
4293 | 0 | } |
4294 | 0 | #endif /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
4295 | | |
4296 | | /* Read the message without adding it to the checksum */ |
4297 | 0 | ret = mbedtls_ssl_read_record(ssl, 0 /* no checksum update */); |
4298 | 0 | if (0 != ret) { |
4299 | 0 | MBEDTLS_SSL_DEBUG_RET(1, ("mbedtls_ssl_read_record"), ret); |
4300 | 0 | return ret; |
4301 | 0 | } |
4302 | | |
4303 | 0 | ssl->state++; |
4304 | | |
4305 | | /* Process the message contents */ |
4306 | 0 | if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE || |
4307 | 0 | ssl->in_msg[0] != MBEDTLS_SSL_HS_CERTIFICATE_VERIFY) { |
4308 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); |
4309 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4310 | 0 | } |
4311 | | |
4312 | 0 | i = mbedtls_ssl_hs_hdr_len(ssl); |
4313 | |
|
4314 | 0 | #if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) |
4315 | 0 | peer_pk = &ssl->handshake->peer_pubkey; |
4316 | | #else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
4317 | | if (ssl->session_negotiate->peer_cert == NULL) { |
4318 | | /* Should never happen */ |
4319 | | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
4320 | | } |
4321 | | peer_pk = &ssl->session_negotiate->peer_cert->pk; |
4322 | | #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ |
4323 | | |
4324 | | /* |
4325 | | * struct { |
4326 | | * SignatureAndHashAlgorithm algorithm; -- TLS 1.2 only |
4327 | | * opaque signature<0..2^16-1>; |
4328 | | * } DigitallySigned; |
4329 | | */ |
4330 | | #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \ |
4331 | | defined(MBEDTLS_SSL_PROTO_TLS1_1) |
4332 | | if (ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3) { |
4333 | | md_alg = MBEDTLS_MD_NONE; |
4334 | | hashlen = 36; |
4335 | | |
4336 | | /* For ECDSA, use SHA-1, not MD-5 + SHA-1 */ |
4337 | | if (mbedtls_pk_can_do(peer_pk, MBEDTLS_PK_ECDSA)) { |
4338 | | hash_start += 16; |
4339 | | hashlen -= 16; |
4340 | | md_alg = MBEDTLS_MD_SHA1; |
4341 | | } |
4342 | | } else |
4343 | | #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || |
4344 | | MBEDTLS_SSL_PROTO_TLS1_1 */ |
4345 | 0 | #if defined(MBEDTLS_SSL_PROTO_TLS1_2) |
4346 | 0 | if (ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3) { |
4347 | 0 | if (i + 2 > ssl->in_hslen) { |
4348 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); |
4349 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4350 | 0 | } |
4351 | | |
4352 | | /* |
4353 | | * Hash |
4354 | | */ |
4355 | 0 | md_alg = mbedtls_ssl_md_alg_from_hash(ssl->in_msg[i]); |
4356 | |
|
4357 | 0 | if (md_alg == MBEDTLS_MD_NONE || mbedtls_ssl_set_calc_verify_md(ssl, ssl->in_msg[i])) { |
4358 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg" |
4359 | 0 | " for verify message")); |
4360 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4361 | 0 | } |
4362 | | |
4363 | 0 | #if !defined(MBEDTLS_MD_SHA1) |
4364 | 0 | if (MBEDTLS_MD_SHA1 == md_alg) { |
4365 | 0 | hash_start += 16; |
4366 | 0 | } |
4367 | 0 | #endif |
4368 | | |
4369 | | /* Info from md_alg will be used instead */ |
4370 | 0 | hashlen = 0; |
4371 | |
|
4372 | 0 | i++; |
4373 | | |
4374 | | /* |
4375 | | * Signature |
4376 | | */ |
4377 | 0 | if ((pk_alg = mbedtls_ssl_pk_alg_from_sig(ssl->in_msg[i])) |
4378 | 0 | == MBEDTLS_PK_NONE) { |
4379 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("peer not adhering to requested sig_alg" |
4380 | 0 | " for verify message")); |
4381 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4382 | 0 | } |
4383 | | |
4384 | | /* |
4385 | | * Check the certificate's key type matches the signature alg |
4386 | | */ |
4387 | 0 | if (!mbedtls_pk_can_do(peer_pk, pk_alg)) { |
4388 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("sig_alg doesn't match cert key")); |
4389 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4390 | 0 | } |
4391 | | |
4392 | 0 | i++; |
4393 | 0 | } else |
4394 | 0 | #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ |
4395 | 0 | { |
4396 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("should never happen")); |
4397 | 0 | return MBEDTLS_ERR_SSL_INTERNAL_ERROR; |
4398 | 0 | } |
4399 | | |
4400 | 0 | if (i + 2 > ssl->in_hslen) { |
4401 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); |
4402 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4403 | 0 | } |
4404 | | |
4405 | 0 | sig_len = (ssl->in_msg[i] << 8) | ssl->in_msg[i+1]; |
4406 | 0 | i += 2; |
4407 | |
|
4408 | 0 | if (i + sig_len != ssl->in_hslen) { |
4409 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate verify message")); |
4410 | 0 | return MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY; |
4411 | 0 | } |
4412 | | |
4413 | | /* Calculate hash and verify signature */ |
4414 | 0 | { |
4415 | 0 | size_t dummy_hlen; |
4416 | 0 | ssl->handshake->calc_verify(ssl, hash, &dummy_hlen); |
4417 | 0 | } |
4418 | |
|
4419 | 0 | if ((ret = mbedtls_pk_verify(peer_pk, |
4420 | 0 | md_alg, hash_start, hashlen, |
4421 | 0 | ssl->in_msg + i, sig_len)) != 0) { |
4422 | 0 | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_pk_verify", ret); |
4423 | 0 | return ret; |
4424 | 0 | } |
4425 | | |
4426 | 0 | mbedtls_ssl_update_handshake_status(ssl); |
4427 | |
|
4428 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("<= parse certificate verify")); |
4429 | |
|
4430 | 0 | return ret; |
4431 | 0 | } |
4432 | | #endif /* MBEDTLS_KEY_EXCHANGE_CERT_REQ_ALLOWED_ENABLED */ |
4433 | | |
4434 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
4435 | | MBEDTLS_CHECK_RETURN_CRITICAL |
4436 | | static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl) |
4437 | | { |
4438 | | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
4439 | | size_t tlen; |
4440 | | uint32_t lifetime; |
4441 | | |
4442 | | MBEDTLS_SSL_DEBUG_MSG(2, ("=> write new session ticket")); |
4443 | | |
4444 | | ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE; |
4445 | | ssl->out_msg[0] = MBEDTLS_SSL_HS_NEW_SESSION_TICKET; |
4446 | | |
4447 | | /* |
4448 | | * struct { |
4449 | | * uint32 ticket_lifetime_hint; |
4450 | | * opaque ticket<0..2^16-1>; |
4451 | | * } NewSessionTicket; |
4452 | | * |
4453 | | * 4 . 7 ticket_lifetime_hint (0 = unspecified) |
4454 | | * 8 . 9 ticket_len (n) |
4455 | | * 10 . 9+n ticket content |
4456 | | */ |
4457 | | |
4458 | | if ((ret = ssl->conf->f_ticket_write(ssl->conf->p_ticket, |
4459 | | ssl->session_negotiate, |
4460 | | ssl->out_msg + 10, |
4461 | | ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN, |
4462 | | &tlen, &lifetime)) != 0) { |
4463 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_write", ret); |
4464 | | tlen = 0; |
4465 | | } |
4466 | | |
4467 | | MBEDTLS_PUT_UINT32_BE(lifetime, ssl->out_msg, 4); |
4468 | | MBEDTLS_PUT_UINT16_BE(tlen, ssl->out_msg, 8); |
4469 | | ssl->out_msglen = 10 + tlen; |
4470 | | |
4471 | | /* |
4472 | | * Morally equivalent to updating ssl->state, but NewSessionTicket and |
4473 | | * ChangeCipherSpec share the same state. |
4474 | | */ |
4475 | | ssl->handshake->new_session_ticket = 0; |
4476 | | |
4477 | | if ((ret = mbedtls_ssl_write_handshake_msg(ssl)) != 0) { |
4478 | | MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_handshake_msg", ret); |
4479 | | return ret; |
4480 | | } |
4481 | | |
4482 | | MBEDTLS_SSL_DEBUG_MSG(2, ("<= write new session ticket")); |
4483 | | |
4484 | | return 0; |
4485 | | } |
4486 | | #endif /* MBEDTLS_SSL_SESSION_TICKETS */ |
4487 | | |
4488 | | /* |
4489 | | * SSL handshake -- server side -- single step |
4490 | | */ |
4491 | | int mbedtls_ssl_handshake_server_step(mbedtls_ssl_context *ssl) |
4492 | 12.7k | { |
4493 | 12.7k | int ret = 0; |
4494 | | |
4495 | 12.7k | if (ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL) { |
4496 | 0 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
4497 | 0 | } |
4498 | | |
4499 | 12.7k | MBEDTLS_SSL_DEBUG_MSG(2, ("server state: %d", ssl->state)); |
4500 | | |
4501 | 12.7k | if ((ret = mbedtls_ssl_flush_output(ssl)) != 0) { |
4502 | 0 | return ret; |
4503 | 0 | } |
4504 | | |
4505 | 12.7k | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
4506 | 12.7k | if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM && |
4507 | 12.7k | ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING) { |
4508 | 0 | if ((ret = mbedtls_ssl_flight_transmit(ssl)) != 0) { |
4509 | 0 | return ret; |
4510 | 0 | } |
4511 | 0 | } |
4512 | 12.7k | #endif /* MBEDTLS_SSL_PROTO_DTLS */ |
4513 | | |
4514 | 12.7k | switch (ssl->state) { |
4515 | 4.01k | case MBEDTLS_SSL_HELLO_REQUEST: |
4516 | 4.01k | ssl->state = MBEDTLS_SSL_CLIENT_HELLO; |
4517 | 4.01k | break; |
4518 | | |
4519 | | /* |
4520 | | * <== ClientHello |
4521 | | */ |
4522 | 8.78k | case MBEDTLS_SSL_CLIENT_HELLO: |
4523 | 8.78k | ret = ssl_parse_client_hello(ssl); |
4524 | 8.78k | break; |
4525 | | |
4526 | 0 | #if defined(MBEDTLS_SSL_PROTO_DTLS) |
4527 | 0 | case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: |
4528 | 0 | return MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED; |
4529 | 0 | #endif |
4530 | | |
4531 | | /* |
4532 | | * ==> ServerHello |
4533 | | * Certificate |
4534 | | * ( ServerKeyExchange ) |
4535 | | * ( CertificateRequest ) |
4536 | | * ServerHelloDone |
4537 | | */ |
4538 | 0 | case MBEDTLS_SSL_SERVER_HELLO: |
4539 | 0 | ret = ssl_write_server_hello(ssl); |
4540 | 0 | break; |
4541 | | |
4542 | 0 | case MBEDTLS_SSL_SERVER_CERTIFICATE: |
4543 | 0 | ret = mbedtls_ssl_write_certificate(ssl); |
4544 | 0 | break; |
4545 | | |
4546 | 0 | case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: |
4547 | 0 | ret = ssl_write_server_key_exchange(ssl); |
4548 | 0 | break; |
4549 | | |
4550 | 0 | case MBEDTLS_SSL_CERTIFICATE_REQUEST: |
4551 | 0 | ret = ssl_write_certificate_request(ssl); |
4552 | 0 | break; |
4553 | | |
4554 | 0 | case MBEDTLS_SSL_SERVER_HELLO_DONE: |
4555 | 0 | ret = ssl_write_server_hello_done(ssl); |
4556 | 0 | break; |
4557 | | |
4558 | | /* |
4559 | | * <== ( Certificate/Alert ) |
4560 | | * ClientKeyExchange |
4561 | | * ( CertificateVerify ) |
4562 | | * ChangeCipherSpec |
4563 | | * Finished |
4564 | | */ |
4565 | 0 | case MBEDTLS_SSL_CLIENT_CERTIFICATE: |
4566 | 0 | ret = mbedtls_ssl_parse_certificate(ssl); |
4567 | 0 | break; |
4568 | | |
4569 | 0 | case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: |
4570 | 0 | ret = ssl_parse_client_key_exchange(ssl); |
4571 | 0 | break; |
4572 | | |
4573 | 0 | case MBEDTLS_SSL_CERTIFICATE_VERIFY: |
4574 | 0 | ret = ssl_parse_certificate_verify(ssl); |
4575 | 0 | break; |
4576 | | |
4577 | 0 | case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: |
4578 | 0 | ret = mbedtls_ssl_parse_change_cipher_spec(ssl); |
4579 | 0 | break; |
4580 | | |
4581 | 0 | case MBEDTLS_SSL_CLIENT_FINISHED: |
4582 | 0 | ret = mbedtls_ssl_parse_finished(ssl); |
4583 | 0 | break; |
4584 | | |
4585 | | /* |
4586 | | * ==> ( NewSessionTicket ) |
4587 | | * ChangeCipherSpec |
4588 | | * Finished |
4589 | | */ |
4590 | 0 | case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: |
4591 | | #if defined(MBEDTLS_SSL_SESSION_TICKETS) |
4592 | | if (ssl->handshake->new_session_ticket != 0) { |
4593 | | ret = ssl_write_new_session_ticket(ssl); |
4594 | | } else |
4595 | | #endif |
4596 | 0 | ret = mbedtls_ssl_write_change_cipher_spec(ssl); |
4597 | 0 | break; |
4598 | | |
4599 | 0 | case MBEDTLS_SSL_SERVER_FINISHED: |
4600 | 0 | ret = mbedtls_ssl_write_finished(ssl); |
4601 | 0 | break; |
4602 | | |
4603 | 0 | case MBEDTLS_SSL_FLUSH_BUFFERS: |
4604 | 0 | MBEDTLS_SSL_DEBUG_MSG(2, ("handshake: done")); |
4605 | 0 | ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP; |
4606 | 0 | break; |
4607 | | |
4608 | 0 | case MBEDTLS_SSL_HANDSHAKE_WRAPUP: |
4609 | 0 | mbedtls_ssl_handshake_wrapup(ssl); |
4610 | 0 | break; |
4611 | | |
4612 | 0 | default: |
4613 | 0 | MBEDTLS_SSL_DEBUG_MSG(1, ("invalid state %d", ssl->state)); |
4614 | 0 | return MBEDTLS_ERR_SSL_BAD_INPUT_DATA; |
4615 | 12.7k | } |
4616 | | |
4617 | 12.7k | return ret; |
4618 | 12.7k | } |
4619 | | #endif /* MBEDTLS_SSL_SRV_C */ |