Context Navigation

← Previous Revision
Latest Revision
Next Revision →
Blame
Revision Log

ssl_cli.c@ 398

Last change on this file since 398 was 398, checked in by coas-nagasima, 5 years ago
mbedTLS版Azure IoT Hub接続サンプルのソースコードを追加
Property svn:eol-style set to `native` Property svn:mime-type set to `text/x-csrc;charset=UTF-8`
File size: 121.0 KB

Line
1	/*
2	* SSLv3/TLSv1 client-side functions
3	*
4	* Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
5	* SPDX-License-Identifier: Apache-2.0
6	*
7	* Licensed under the Apache License, Version 2.0 (the "License"); you may
8	* not use this file except in compliance with the License.
9	* You may obtain a copy of the License at
10	*
11	* http://www.apache.org/licenses/LICENSE-2.0
12	*
13	* Unless required by applicable law or agreed to in writing, software
14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16	* See the License for the specific language governing permissions and
17	* limitations under the License.
18	*
19	* This file is part of mbed TLS (https://tls.mbed.org)
20	*/
21
22	#if !defined(MBEDTLS_CONFIG_FILE)
23	#include "mbedtls/config.h"
24	#else
25	#include MBEDTLS_CONFIG_FILE
26	#endif
27
28	#if defined(MBEDTLS_SSL_CLI_C)
29
30	#if defined(MBEDTLS_PLATFORM_C)
31	#include "mbedtls/platform.h"
32	#else
33	#include <stdlib.h>
34	#define mbedtls_calloc calloc
35	#define mbedtls_free free
36	#endif
37
38	#include "mbedtls/debug.h"
39	#include "mbedtls/ssl.h"
40	#include "mbedtls/ssl_internal.h"
41
42	#include <string.h>
43
44	#include <stdint.h>
45
46	#if defined(MBEDTLS_HAVE_TIME)
47	#include "mbedtls/platform_time.h"
48	#endif
49
50	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
51	#include "mbedtls/platform_util.h"
52	#endif
53
54	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
55	static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
56	unsigned char *buf,
57	size_t *olen )
58	{
59	unsigned char *p = buf;
60	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
61	size_t hostname_len;
62
63	*olen = 0;
64
65	if( ssl->hostname == NULL )
66	return;
67
68	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
69	ssl->hostname ) );
70
71	hostname_len = strlen( ssl->hostname );
72
73	if( end < p \|\| (size_t)( end - p ) < hostname_len + 9 )
74	{
75	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
76	return;
77	}
78
79	/*
80	* Sect. 3, RFC 6066 (TLS Extensions Definitions)
81	*
82	* In order to provide any of the server names, clients MAY include an
83	* extension of type "server_name" in the (extended) client hello. The
84	* "extension_data" field of this extension SHALL contain
85	* "ServerNameList" where:
86	*
87	* struct {
88	* NameType name_type;
89	* select (name_type) {
90	* case host_name: HostName;
91	* } name;
92	* } ServerName;
93	*
94	* enum {
95	* host_name(0), (255)
96	* } NameType;
97	*
98	* opaque HostName<1..2^16-1>;
99	*
100	* struct {
101	* ServerName server_name_list<1..2^16-1>
102	* } ServerNameList;
103	*
104	*/
105	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
106	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME ) & 0xFF );
107
108	*p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
109	*p++ = (unsigned char)( ( (hostname_len + 5) ) & 0xFF );
110
111	*p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
112	*p++ = (unsigned char)( ( (hostname_len + 3) ) & 0xFF );
113
114	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
115	*p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
116	*p++ = (unsigned char)( ( hostname_len ) & 0xFF );
117
118	memcpy( p, ssl->hostname, hostname_len );
119
120	*olen = hostname_len + 9;
121	}
122	#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
123
124	#if defined(MBEDTLS_SSL_RENEGOTIATION)
125	static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
126	unsigned char *buf,
127	size_t *olen )
128	{
129	unsigned char *p = buf;
130	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
131
132	*olen = 0;
133
134	/* We're always including an TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the
135	* initial ClientHello, in which case also adding the renegotiation
136	* info extension is NOT RECOMMENDED as per RFC 5746 Section 3.4. */
137	if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
138	return;
139
140	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
141
142	if( end < p \|\| (size_t)( end - p ) < 5 + ssl->verify_data_len )
143	{
144	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
145	return;
146	}
147
148	/*
149	* Secure renegotiation
150	*/
151	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
152	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
153
154	*p++ = 0x00;
155	*p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
156	*p++ = ssl->verify_data_len & 0xFF;
157
158	memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
159
160	*olen = 5 + ssl->verify_data_len;
161	}
162	#endif /* MBEDTLS_SSL_RENEGOTIATION */
163
164	/*
165	* Only if we handle at least one key exchange that needs signatures.
166	*/
167	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
168	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
169	static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
170	unsigned char *buf,
171	size_t *olen )
172	{
173	unsigned char *p = buf;
174	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
175	size_t sig_alg_len = 0;
176	const int *md;
177	#if defined(MBEDTLS_RSA_C) \|\| defined(MBEDTLS_ECDSA_C)
178	unsigned char *sig_alg_list = buf + 6;
179	#endif
180
181	*olen = 0;
182
183	if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
184	return;
185
186	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
187
188	for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
189	{
190	#if defined(MBEDTLS_ECDSA_C)
191	sig_alg_len += 2;
192	#endif
193	#if defined(MBEDTLS_RSA_C)
194	sig_alg_len += 2;
195	#endif
196	}
197
198	if( end < p \|\| (size_t)( end - p ) < sig_alg_len + 6 )
199	{
200	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
201	return;
202	}
203
204	/*
205	* Prepare signature_algorithms extension (TLS 1.2)
206	*/
207	sig_alg_len = 0;
208
209	for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
210	{
211	#if defined(MBEDTLS_ECDSA_C)
212	sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
213	sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
214	#endif
215	#if defined(MBEDTLS_RSA_C)
216	sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
217	sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
218	#endif
219	}
220
221	/*
222	* enum {
223	* none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
224	* sha512(6), (255)
225	* } HashAlgorithm;
226	*
227	* enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
228	* SignatureAlgorithm;
229	*
230	* struct {
231	* HashAlgorithm hash;
232	* SignatureAlgorithm signature;
233	* } SignatureAndHashAlgorithm;
234	*
235	* SignatureAndHashAlgorithm
236	* supported_signature_algorithms<2..2^16-2>;
237	*/
238	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
239	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG ) & 0xFF );
240
241	*p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
242	*p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
243
244	*p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
245	*p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
246
247	*olen = 6 + sig_alg_len;
248	}
249	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
250	MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
251
252	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
253	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
254	static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
255	unsigned char *buf,
256	size_t *olen )
257	{
258	unsigned char *p = buf;
259	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
260	unsigned char *elliptic_curve_list = p + 6;
261	size_t elliptic_curve_len = 0;
262	const mbedtls_ecp_curve_info *info;
263	#if defined(MBEDTLS_ECP_C)
264	const mbedtls_ecp_group_id *grp_id;
265	#else
266	((void) ssl);
267	#endif
268
269	*olen = 0;
270
271	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) );
272
273	#if defined(MBEDTLS_ECP_C)
274	for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
275	#else
276	for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
277	#endif
278	{
279	#if defined(MBEDTLS_ECP_C)
280	info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
281	#endif
282	if( info == NULL )
283	{
284	MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
285	return;
286	}
287
288	elliptic_curve_len += 2;
289	}
290
291	if( end < p \|\| (size_t)( end - p ) < 6 + elliptic_curve_len )
292	{
293	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
294	return;
295	}
296
297	elliptic_curve_len = 0;
298
299	#if defined(MBEDTLS_ECP_C)
300	for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
301	#else
302	for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
303	#endif
304	{
305	#if defined(MBEDTLS_ECP_C)
306	info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
307	#endif
308	elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
309	elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
310	}
311
312	if( elliptic_curve_len == 0 )
313	return;
314
315	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF );
316	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES ) & 0xFF );
317
318	*p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
319	*p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) ) & 0xFF );
320
321	*p++ = (unsigned char)( ( ( elliptic_curve_len ) >> 8 ) & 0xFF );
322	*p++ = (unsigned char)( ( ( elliptic_curve_len ) ) & 0xFF );
323
324	*olen = 6 + elliptic_curve_len;
325	}
326
327	static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
328	unsigned char *buf,
329	size_t *olen )
330	{
331	unsigned char *p = buf;
332	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
333
334	*olen = 0;
335
336	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) );
337
338	if( end < p \|\| (size_t)( end - p ) < 6 )
339	{
340	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
341	return;
342	}
343
344	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
345	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS ) & 0xFF );
346
347	*p++ = 0x00;
348	*p++ = 2;
349
350	*p++ = 1;
351	*p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
352
353	*olen = 6;
354	}
355	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
356	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
357
358	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
359	static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
360	unsigned char *buf,
361	size_t *olen )
362	{
363	int ret;
364	unsigned char *p = buf;
365	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
366	size_t kkpp_len;
367
368	*olen = 0;
369
370	/* Skip costly extension if we can't use EC J-PAKE anyway */
371	if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
372	return;
373
374	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) );
375
376	if( end - p < 4 )
377	{
378	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
379	return;
380	}
381
382	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
383	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP ) & 0xFF );
384
385	/*
386	* We may need to send ClientHello multiple times for Hello verification.
387	* We don't want to compute fresh values every time (both for performance
388	* and consistency reasons), so cache the extension content.
389	*/
390	if( ssl->handshake->ecjpake_cache == NULL \|\|
391	ssl->handshake->ecjpake_cache_len == 0 )
392	{
393	MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
394
395	ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
396	p + 2, end - p - 2, &kkpp_len,
397	ssl->conf->f_rng, ssl->conf->p_rng );
398	if( ret != 0 )
399	{
400	MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
401	return;
402	}
403
404	ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
405	if( ssl->handshake->ecjpake_cache == NULL )
406	{
407	MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
408	return;
409	}
410
411	memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
412	ssl->handshake->ecjpake_cache_len = kkpp_len;
413	}
414	else
415	{
416	MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
417
418	kkpp_len = ssl->handshake->ecjpake_cache_len;
419
420	if( (size_t)( end - p - 2 ) < kkpp_len )
421	{
422	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
423	return;
424	}
425
426	memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
427	}
428
429	*p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
430	*p++ = (unsigned char)( ( kkpp_len ) & 0xFF );
431
432	*olen = kkpp_len + 4;
433	}
434	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
435
436	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
437	static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
438	unsigned char *buf,
439	size_t *olen )
440	{
441	unsigned char *p = buf;
442	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
443
444	*olen = 0;
445
446	if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) {
447	return;
448	}
449
450	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) );
451
452	if( end < p \|\| (size_t)( end - p ) < 5 )
453	{
454	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
455	return;
456	}
457
458	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
459	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH ) & 0xFF );
460
461	*p++ = 0x00;
462	*p++ = 1;
463
464	*p++ = ssl->conf->mfl_code;
465
466	*olen = 5;
467	}
468	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
469
470	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
471	static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
472	unsigned char buf, size_t olen )
473	{
474	unsigned char *p = buf;
475	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
476
477	*olen = 0;
478
479	if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
480	{
481	return;
482	}
483
484	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) );
485
486	if( end < p \|\| (size_t)( end - p ) < 4 )
487	{
488	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
489	return;
490	}
491
492	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
493	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC ) & 0xFF );
494
495	*p++ = 0x00;
496	*p++ = 0x00;
497
498	*olen = 4;
499	}
500	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
501
502	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
503	static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
504	unsigned char buf, size_t olen )
505	{
506	unsigned char *p = buf;
507	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
508
509	*olen = 0;
510
511	if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED \|\|
512	ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
513	{
514	return;
515	}
516
517	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac "
518	"extension" ) );
519
520	if( end < p \|\| (size_t)( end - p ) < 4 )
521	{
522	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
523	return;
524	}
525
526	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
527	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC ) & 0xFF );
528
529	*p++ = 0x00;
530	*p++ = 0x00;
531
532	*olen = 4;
533	}
534	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
535
536	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
537	static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
538	unsigned char buf, size_t olen )
539	{
540	unsigned char *p = buf;
541	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
542
543	*olen = 0;
544
545	if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
546	ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
547	{
548	return;
549	}
550
551	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret "
552	"extension" ) );
553
554	if( end < p \|\| (size_t)( end - p ) < 4 )
555	{
556	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
557	return;
558	}
559
560	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
561	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET ) & 0xFF );
562
563	*p++ = 0x00;
564	*p++ = 0x00;
565
566	*olen = 4;
567	}
568	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
569
570	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
571	static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
572	unsigned char buf, size_t olen )
573	{
574	unsigned char *p = buf;
575	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
576	size_t tlen = ssl->session_negotiate->ticket_len;
577
578	*olen = 0;
579
580	if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
581	{
582	return;
583	}
584
585	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) );
586
587	if( end < p \|\| (size_t)( end - p ) < 4 + tlen )
588	{
589	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
590	return;
591	}
592
593	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
594	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET ) & 0xFF );
595
596	*p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
597	*p++ = (unsigned char)( ( tlen ) & 0xFF );
598
599	*olen = 4;
600
601	if( ssl->session_negotiate->ticket == NULL \|\| tlen == 0 )
602	{
603	return;
604	}
605
606	MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) );
607
608	memcpy( p, ssl->session_negotiate->ticket, tlen );
609
610	*olen += tlen;
611	}
612	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
613
614	#if defined(MBEDTLS_SSL_ALPN)
615	static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
616	unsigned char buf, size_t olen )
617	{
618	unsigned char *p = buf;
619	const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
620	size_t alpnlen = 0;
621	const char **cur;
622
623	*olen = 0;
624
625	if( ssl->conf->alpn_list == NULL )
626	{
627	return;
628	}
629
630	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
631
632	for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
633	alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1;
634
635	if( end < p \|\| (size_t)( end - p ) < 6 + alpnlen )
636	{
637	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
638	return;
639	}
640
641	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
642	*p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN ) & 0xFF );
643
644	/*
645	* opaque ProtocolName<1..2^8-1>;
646	*
647	* struct {
648	* ProtocolName protocol_name_list<2..2^16-1>
649	* } ProtocolNameList;
650	*/
651
652	/* Skip writing extension and list length for now */
653	p += 4;
654
655	for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
656	{
657	p = (unsigned char)( strlen( cur ) & 0xFF );
658	memcpy( p + 1, cur, p );
659	p += 1 + *p;
660	}
661
662	*olen = p - buf;
663
664	/* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
665	buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
666	buf[5] = (unsigned char)( ( ( *olen - 6 ) ) & 0xFF );
667
668	/* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
669	buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
670	buf[3] = (unsigned char)( ( ( *olen - 4 ) ) & 0xFF );
671	}
672	#endif /* MBEDTLS_SSL_ALPN */
673
674	/*
675	* Generate random bytes for ClientHello
676	*/
677	static int ssl_generate_random( mbedtls_ssl_context *ssl )
678	{
679	int ret;
680	unsigned char *p = ssl->handshake->randbytes;
681	#if defined(MBEDTLS_HAVE_TIME)
682	mbedtls_time_t t;
683	#endif
684
685	/*
686	* When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
687	*/
688	#if defined(MBEDTLS_SSL_PROTO_DTLS)
689	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
690	ssl->handshake->verify_cookie != NULL )
691	{
692	return( 0 );
693	}
694	#endif
695
696	#if defined(MBEDTLS_HAVE_TIME)
697	t = mbedtls_time( NULL );
698	*p++ = (unsigned char)( t >> 24 );
699	*p++ = (unsigned char)( t >> 16 );
700	*p++ = (unsigned char)( t >> 8 );
701	*p++ = (unsigned char)( t );
702
703	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
704	#else
705	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
706	return( ret );
707
708	p += 4;
709	#endif /* MBEDTLS_HAVE_TIME */
710
711	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
712	return( ret );
713
714	return( 0 );
715	}
716
717	/**
718	* \brief Validate cipher suite against config in SSL context.
719	*
720	* \param suite_info cipher suite to validate
721	* \param ssl SSL context
722	* \param min_minor_ver Minimal minor version to accept a cipher suite
723	* \param max_minor_ver Maximal minor version to accept a cipher suite
724	*
725	* \return 0 if valid, else 1
726	*/
727	static int ssl_validate_ciphersuite( const mbedtls_ssl_ciphersuite_t * suite_info,
728	const mbedtls_ssl_context * ssl,
729	int min_minor_ver, int max_minor_ver )
730	{
731	(void) ssl;
732	if( suite_info == NULL )
733	return( 1 );
734
735	if( suite_info->min_minor_ver > max_minor_ver \|\|
736	suite_info->max_minor_ver < min_minor_ver )
737	return( 1 );
738
739	#if defined(MBEDTLS_SSL_PROTO_DTLS)
740	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
741	( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
742	return( 1 );
743	#endif
744
745	#if defined(MBEDTLS_ARC4_C)
746	if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
747	suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
748	return( 1 );
749	#endif
750
751	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
752	if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
753	mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
754	return( 1 );
755	#endif
756
757	return( 0 );
758	}
759
760	static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
761	{
762	int ret;
763	size_t i, n, olen, ext_len = 0;
764	unsigned char *buf;
765	unsigned char p, q;
766	unsigned char offer_compress;
767	const int *ciphersuites;
768	const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
769	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
770	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
771	int uses_ec = 0;
772	#endif
773
774	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
775
776	if( ssl->conf->f_rng == NULL )
777	{
778	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
779	return( MBEDTLS_ERR_SSL_NO_RNG );
780	}
781
782	#if defined(MBEDTLS_SSL_RENEGOTIATION)
783	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
784	#endif
785	{
786	ssl->major_ver = ssl->conf->min_major_ver;
787	ssl->minor_ver = ssl->conf->min_minor_ver;
788	}
789
790	if( ssl->conf->max_major_ver == 0 )
791	{
792	MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, "
793	"consider using mbedtls_ssl_config_defaults()" ) );
794	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
795	}
796
797	/*
798	* 0 . 0 handshake type
799	* 1 . 3 handshake length
800	* 4 . 5 highest version supported
801	* 6 . 9 current UNIX time
802	* 10 . 37 random bytes
803	*/
804	buf = ssl->out_msg;
805	p = buf + 4;
806
807	mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
808	ssl->conf->transport, p );
809	p += 2;
810
811	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
812	buf[4], buf[5] ) );
813
814	if( ( ret = ssl_generate_random( ssl ) ) != 0 )
815	{
816	MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
817	return( ret );
818	}
819
820	memcpy( p, ssl->handshake->randbytes, 32 );
821	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
822	p += 32;
823
824	/*
825	* 38 . 38 session id length
826	* 39 . 39+n session id
827	* 39+n . 39+n DTLS only: cookie length (1 byte)
828	* 40+n . .. DTSL only: cookie
829	* .. . .. ciphersuitelist length (2 bytes)
830	* .. . .. ciphersuitelist
831	* .. . .. compression methods length (1 byte)
832	* .. . .. compression methods
833	* .. . .. extensions length (2 bytes)
834	* .. . .. extensions
835	*/
836	n = ssl->session_negotiate->id_len;
837
838	if( n < 16 \|\| n > 32 \|\|
839	#if defined(MBEDTLS_SSL_RENEGOTIATION)
840	ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE \|\|
841	#endif
842	ssl->handshake->resume == 0 )
843	{
844	n = 0;
845	}
846
847	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
848	/*
849	* RFC 5077 section 3.4: "When presenting a ticket, the client MAY
850	* generate and include a Session ID in the TLS ClientHello."
851	*/
852	#if defined(MBEDTLS_SSL_RENEGOTIATION)
853	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
854	#endif
855	{
856	if( ssl->session_negotiate->ticket != NULL &&
857	ssl->session_negotiate->ticket_len != 0 )
858	{
859	ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 );
860
861	if( ret != 0 )
862	return( ret );
863
864	ssl->session_negotiate->id_len = n = 32;
865	}
866	}
867	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
868
869	*p++ = (unsigned char) n;
870
871	for( i = 0; i < n; i++ )
872	*p++ = ssl->session_negotiate->id[i];
873
874	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
875	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
876
877	/*
878	* DTLS cookie
879	*/
880	#if defined(MBEDTLS_SSL_PROTO_DTLS)
881	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
882	{
883	if( ssl->handshake->verify_cookie == NULL )
884	{
885	MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
886	*p++ = 0;
887	}
888	else
889	{
890	MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
891	ssl->handshake->verify_cookie,
892	ssl->handshake->verify_cookie_len );
893
894	*p++ = ssl->handshake->verify_cookie_len;
895	memcpy( p, ssl->handshake->verify_cookie,
896	ssl->handshake->verify_cookie_len );
897	p += ssl->handshake->verify_cookie_len;
898	}
899	}
900	#endif
901
902	/*
903	* Ciphersuite list
904	*/
905	ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
906
907	/* Skip writing ciphersuite length for now */
908	n = 0;
909	q = p;
910	p += 2;
911
912	for( i = 0; ciphersuites[i] != 0; i++ )
913	{
914	ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
915
916	if( ssl_validate_ciphersuite( ciphersuite_info, ssl,
917	ssl->conf->min_minor_ver,
918	ssl->conf->max_minor_ver ) != 0 )
919	continue;
920
921	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
922	ciphersuites[i] ) );
923
924	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
925	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
926	uses_ec \|= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
927	#endif
928
929	n++;
930	*p++ = (unsigned char)( ciphersuites[i] >> 8 );
931	*p++ = (unsigned char)( ciphersuites[i] );
932	}
933
934	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites (excluding SCSVs)", n ) );
935
936	/*
937	* Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
938	*/
939	#if defined(MBEDTLS_SSL_RENEGOTIATION)
940	if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
941	#endif
942	{
943	MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
944	*p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
945	*p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO );
946	n++;
947	}
948
949	/* Some versions of OpenSSL don't handle it correctly if not at end */
950	#if defined(MBEDTLS_SSL_FALLBACK_SCSV)
951	if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
952	{
953	MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
954	*p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
955	*p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE );
956	n++;
957	}
958	#endif
959
960	*q++ = (unsigned char)( n >> 7 );
961	*q++ = (unsigned char)( n << 1 );
962
963	#if defined(MBEDTLS_ZLIB_SUPPORT)
964	offer_compress = 1;
965	#else
966	offer_compress = 0;
967	#endif
968
969	/*
970	* We don't support compression with DTLS right now: if many records come
971	* in the same datagram, uncompressing one could overwrite the next one.
972	* We don't want to add complexity for handling that case unless there is
973	* an actual need for it.
974	*/
975	#if defined(MBEDTLS_SSL_PROTO_DTLS)
976	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
977	offer_compress = 0;
978	#endif
979
980	if( offer_compress )
981	{
982	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
983	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
984	MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) );
985
986	*p++ = 2;
987	*p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
988	*p++ = MBEDTLS_SSL_COMPRESS_NULL;
989	}
990	else
991	{
992	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
993	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
994	MBEDTLS_SSL_COMPRESS_NULL ) );
995
996	*p++ = 1;
997	*p++ = MBEDTLS_SSL_COMPRESS_NULL;
998	}
999
1000	// First write extensions, then the total length
1001	//
1002	#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
1003	ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen );
1004	ext_len += olen;
1005	#endif
1006
1007	/* Note that TLS_EMPTY_RENEGOTIATION_INFO_SCSV is always added
1008	* even if MBEDTLS_SSL_RENEGOTIATION is not defined. */
1009	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1010	ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
1011	ext_len += olen;
1012	#endif
1013
1014	#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
1015	defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
1016	ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen );
1017	ext_len += olen;
1018	#endif
1019
1020	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
1021	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1022	if( uses_ec )
1023	{
1024	ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen );
1025	ext_len += olen;
1026
1027	ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
1028	ext_len += olen;
1029	}
1030	#endif
1031
1032	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1033	ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
1034	ext_len += olen;
1035	#endif
1036
1037	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1038	ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
1039	ext_len += olen;
1040	#endif
1041
1042	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1043	ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
1044	ext_len += olen;
1045	#endif
1046
1047	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1048	ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
1049	ext_len += olen;
1050	#endif
1051
1052	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1053	ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
1054	ext_len += olen;
1055	#endif
1056
1057	#if defined(MBEDTLS_SSL_ALPN)
1058	ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
1059	ext_len += olen;
1060	#endif
1061
1062	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1063	ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
1064	ext_len += olen;
1065	#endif
1066
1067	/* olen unused if all extensions are disabled */
1068	((void) olen);
1069
1070	MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
1071	ext_len ) );
1072
1073	if( ext_len > 0 )
1074	{
1075	*p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
1076	*p++ = (unsigned char)( ( ext_len ) & 0xFF );
1077	p += ext_len;
1078	}
1079
1080	ssl->out_msglen = p - buf;
1081	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
1082	ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_HELLO;
1083
1084	ssl->state++;
1085
1086	#if defined(MBEDTLS_SSL_PROTO_DTLS)
1087	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1088	mbedtls_ssl_send_flight_completed( ssl );
1089	#endif
1090
1091	if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
1092	{
1093	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
1094	return( ret );
1095	}
1096
1097	#if defined(MBEDTLS_SSL_PROTO_DTLS)
1098	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
1099	( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
1100	{
1101	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
1102	return( ret );
1103	}
1104	#endif /* MBEDTLS_SSL_PROTO_DTLS */
1105
1106	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
1107
1108	return( 0 );
1109	}
1110
1111	static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
1112	const unsigned char *buf,
1113	size_t len )
1114	{
1115	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1116	if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
1117	{
1118	/* Check verify-data in constant-time. The length OTOH is no secret */
1119	if( len != 1 + ssl->verify_data_len * 2 \|\|
1120	buf[0] != ssl->verify_data_len * 2 \|\|
1121	mbedtls_ssl_safer_memcmp( buf + 1,
1122	ssl->own_verify_data, ssl->verify_data_len ) != 0 \|\|
1123	mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
1124	ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
1125	{
1126	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
1127	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1128	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1129	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1130	}
1131	}
1132	else
1133	#endif /* MBEDTLS_SSL_RENEGOTIATION */
1134	{
1135	if( len != 1 \|\| buf[0] != 0x00 )
1136	{
1137	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
1138	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1139	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1140	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1141	}
1142
1143	ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
1144	}
1145
1146	return( 0 );
1147	}
1148
1149	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1150	static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
1151	const unsigned char *buf,
1152	size_t len )
1153	{
1154	/*
1155	* server should use the extension only if we did,
1156	* and if so the server's value should match ours (and len is always 1)
1157	*/
1158	if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE \|\|
1159	len != 1 \|\|
1160	buf[0] != ssl->conf->mfl_code )
1161	{
1162	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching max fragment length extension" ) );
1163	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1164	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1165	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1166	}
1167
1168	return( 0 );
1169	}
1170	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1171
1172	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1173	static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
1174	const unsigned char *buf,
1175	size_t len )
1176	{
1177	if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED \|\|
1178	len != 0 )
1179	{
1180	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching truncated HMAC extension" ) );
1181	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1182	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1183	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1184	}
1185
1186	((void) buf);
1187
1188	ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
1189
1190	return( 0 );
1191	}
1192	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1193
1194	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1195	static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
1196	const unsigned char *buf,
1197	size_t len )
1198	{
1199	if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED \|\|
1200	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 \|\|
1201	len != 0 )
1202	{
1203	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching encrypt-then-MAC extension" ) );
1204	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1205	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1206	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1207	}
1208
1209	((void) buf);
1210
1211	ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
1212
1213	return( 0 );
1214	}
1215	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1216
1217	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1218	static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
1219	const unsigned char *buf,
1220	size_t len )
1221	{
1222	if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED \|\|
1223	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 \|\|
1224	len != 0 )
1225	{
1226	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching extended master secret extension" ) );
1227	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1228	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1229	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1230	}
1231
1232	((void) buf);
1233
1234	ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
1235
1236	return( 0 );
1237	}
1238	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1239
1240	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1241	static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
1242	const unsigned char *buf,
1243	size_t len )
1244	{
1245	if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED \|\|
1246	len != 0 )
1247	{
1248	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching session ticket extension" ) );
1249	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1250	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1251	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1252	}
1253
1254	((void) buf);
1255
1256	ssl->handshake->new_session_ticket = 1;
1257
1258	return( 0 );
1259	}
1260	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
1261
1262	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
1263	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1264	static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
1265	const unsigned char *buf,
1266	size_t len )
1267	{
1268	size_t list_size;
1269	const unsigned char *p;
1270
1271	if( len == 0 \|\| (size_t)( buf[0] + 1 ) != len )
1272	{
1273	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1274	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1275	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1276	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1277	}
1278	list_size = buf[0];
1279
1280	p = buf + 1;
1281	while( list_size > 0 )
1282	{
1283	if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED \|\|
1284	p[0] == MBEDTLS_ECP_PF_COMPRESSED )
1285	{
1286	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C)
1287	ssl->handshake->ecdh_ctx.point_format = p[0];
1288	#endif
1289	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1290	ssl->handshake->ecjpake_ctx.point_format = p[0];
1291	#endif
1292	MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
1293	return( 0 );
1294	}
1295
1296	list_size--;
1297	p++;
1298	}
1299
1300	MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
1301	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1302	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1303	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1304	}
1305	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
1306	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1307
1308	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1309	static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
1310	const unsigned char *buf,
1311	size_t len )
1312	{
1313	int ret;
1314
1315	if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
1316	MBEDTLS_KEY_EXCHANGE_ECJPAKE )
1317	{
1318	MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
1319	return( 0 );
1320	}
1321
1322	/* If we got here, we no longer need our cached extension */
1323	mbedtls_free( ssl->handshake->ecjpake_cache );
1324	ssl->handshake->ecjpake_cache = NULL;
1325	ssl->handshake->ecjpake_cache_len = 0;
1326
1327	if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
1328	buf, len ) ) != 0 )
1329	{
1330	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
1331	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1332	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1333	return( ret );
1334	}
1335
1336	return( 0 );
1337	}
1338	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1339
1340	#if defined(MBEDTLS_SSL_ALPN)
1341	static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
1342	const unsigned char *buf, size_t len )
1343	{
1344	size_t list_len, name_len;
1345	const char **p;
1346
1347	/* If we didn't send it, the server shouldn't send it */
1348	if( ssl->conf->alpn_list == NULL )
1349	{
1350	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) );
1351	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1352	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1353	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1354	}
1355
1356	/*
1357	* opaque ProtocolName<1..2^8-1>;
1358	*
1359	* struct {
1360	* ProtocolName protocol_name_list<2..2^16-1>
1361	* } ProtocolNameList;
1362	*
1363	* the "ProtocolNameList" MUST contain exactly one "ProtocolName"
1364	*/
1365
1366	/* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
1367	if( len < 4 )
1368	{
1369	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1370	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1371	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1372	}
1373
1374	list_len = ( buf[0] << 8 ) \| buf[1];
1375	if( list_len != len - 2 )
1376	{
1377	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1378	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1379	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1380	}
1381
1382	name_len = buf[2];
1383	if( name_len != list_len - 1 )
1384	{
1385	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1386	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1387	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1388	}
1389
1390	/* Check that the server chosen protocol was in our list and save it */
1391	for( p = ssl->conf->alpn_list; *p != NULL; p++ )
1392	{
1393	if( name_len == strlen( *p ) &&
1394	memcmp( buf + 3, *p, name_len ) == 0 )
1395	{
1396	ssl->alpn_chosen = *p;
1397	return( 0 );
1398	}
1399	}
1400
1401	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
1402	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1403	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1404	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1405	}
1406	#endif /* MBEDTLS_SSL_ALPN */
1407
1408	/*
1409	* Parse HelloVerifyRequest. Only called after verifying the HS type.
1410	*/
1411	#if defined(MBEDTLS_SSL_PROTO_DTLS)
1412	static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
1413	{
1414	const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
1415	int major_ver, minor_ver;
1416	unsigned char cookie_len;
1417
1418	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
1419
1420	/*
1421	* struct {
1422	* ProtocolVersion server_version;
1423	* opaque cookie<0..2^8-1>;
1424	* } HelloVerifyRequest;
1425	*/
1426	MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
1427	mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
1428	p += 2;
1429
1430	/*
1431	* Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
1432	* even is lower than our min version.
1433	*/
1434	if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 \|\|
1435	minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 \|\|
1436	major_ver > ssl->conf->max_major_ver \|\|
1437	minor_ver > ssl->conf->max_minor_ver )
1438	{
1439	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
1440
1441	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1442	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1443
1444	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1445	}
1446
1447	cookie_len = *p++;
1448	MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
1449
1450	if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
1451	{
1452	MBEDTLS_SSL_DEBUG_MSG( 1,
1453	( "cookie length does not match incoming message size" ) );
1454	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1455	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1456	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1457	}
1458
1459	mbedtls_free( ssl->handshake->verify_cookie );
1460
1461	ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
1462	if( ssl->handshake->verify_cookie == NULL )
1463	{
1464	MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
1465	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
1466	}
1467
1468	memcpy( ssl->handshake->verify_cookie, p, cookie_len );
1469	ssl->handshake->verify_cookie_len = cookie_len;
1470
1471	/* Start over at ClientHello */
1472	ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
1473	mbedtls_ssl_reset_checksum( ssl );
1474
1475	mbedtls_ssl_recv_flight_completed( ssl );
1476
1477	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
1478
1479	return( 0 );
1480	}
1481	#endif /* MBEDTLS_SSL_PROTO_DTLS */
1482
1483	static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
1484	{
1485	int ret, i;
1486	size_t n;
1487	size_t ext_len;
1488	unsigned char buf, ext;
1489	unsigned char comp;
1490	#if defined(MBEDTLS_ZLIB_SUPPORT)
1491	int accept_comp;
1492	#endif
1493	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1494	int renegotiation_info_seen = 0;
1495	#endif
1496	int handshake_failure = 0;
1497	const mbedtls_ssl_ciphersuite_t *suite_info;
1498
1499	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
1500
1501	buf = ssl->in_msg;
1502
1503	if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
1504	{
1505	/* No alert on a read error. */
1506	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
1507	return( ret );
1508	}
1509
1510	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
1511	{
1512	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1513	if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
1514	{
1515	ssl->renego_records_seen++;
1516
1517	if( ssl->conf->renego_max_records >= 0 &&
1518	ssl->renego_records_seen > ssl->conf->renego_max_records )
1519	{
1520	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
1521	"but not honored by server" ) );
1522	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1523	}
1524
1525	MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
1526
1527	ssl->keep_current_message = 1;
1528	return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
1529	}
1530	#endif /* MBEDTLS_SSL_RENEGOTIATION */
1531
1532	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1533	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1534	MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
1535	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
1536	}
1537
1538	#if defined(MBEDTLS_SSL_PROTO_DTLS)
1539	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1540	{
1541	if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
1542	{
1543	MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
1544	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
1545	return( ssl_parse_hello_verify_request( ssl ) );
1546	}
1547	else
1548	{
1549	/* We made it through the verification process */
1550	mbedtls_free( ssl->handshake->verify_cookie );
1551	ssl->handshake->verify_cookie = NULL;
1552	ssl->handshake->verify_cookie_len = 0;
1553	}
1554	}
1555	#endif /* MBEDTLS_SSL_PROTO_DTLS */
1556
1557	if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) \|\|
1558	buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
1559	{
1560	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1561	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1562	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1563	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1564	}
1565
1566	/*
1567	* 0 . 1 server_version
1568	* 2 . 33 random (maybe including 4 bytes of Unix time)
1569	* 34 . 34 session_id length = n
1570	* 35 . 34+n session_id
1571	* 35+n . 36+n cipher_suite
1572	* 37+n . 37+n compression_method
1573	*
1574	* 38+n . 39+n extensions length (optional)
1575	* 40+n . .. extensions
1576	*/
1577	buf += mbedtls_ssl_hs_hdr_len( ssl );
1578
1579	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
1580	mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
1581	ssl->conf->transport, buf + 0 );
1582
1583	if( ssl->major_ver < ssl->conf->min_major_ver \|\|
1584	ssl->minor_ver < ssl->conf->min_minor_ver \|\|
1585	ssl->major_ver > ssl->conf->max_major_ver \|\|
1586	ssl->minor_ver > ssl->conf->max_minor_ver )
1587	{
1588	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
1589	" min: [%d:%d], server: [%d:%d], max: [%d:%d]",
1590	ssl->conf->min_major_ver, ssl->conf->min_minor_ver,
1591	ssl->major_ver, ssl->minor_ver,
1592	ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) );
1593
1594	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1595	MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
1596
1597	return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
1598	}
1599
1600	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu",
1601	( (uint32_t) buf[2] << 24 ) \|
1602	( (uint32_t) buf[3] << 16 ) \|
1603	( (uint32_t) buf[4] << 8 ) \|
1604	( (uint32_t) buf[5] ) ) );
1605
1606	memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
1607
1608	n = buf[34];
1609
1610	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 2, 32 );
1611
1612	if( n > 32 )
1613	{
1614	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1615	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1616	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1617	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1618	}
1619
1620	if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
1621	{
1622	ext_len = ( ( buf[38 + n] << 8 )
1623	\| ( buf[39 + n] ) );
1624
1625	if( ( ext_len > 0 && ext_len < 4 ) \|\|
1626	ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
1627	{
1628	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1629	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1630	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1631	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1632	}
1633	}
1634	else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
1635	{
1636	ext_len = 0;
1637	}
1638	else
1639	{
1640	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1641	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1642	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1643	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1644	}
1645
1646	/* ciphersuite (used later) */
1647	i = ( buf[35 + n] << 8 ) \| buf[36 + n];
1648
1649	/*
1650	* Read and check compression
1651	*/
1652	comp = buf[37 + n];
1653
1654	#if defined(MBEDTLS_ZLIB_SUPPORT)
1655	/* See comments in ssl_write_client_hello() */
1656	#if defined(MBEDTLS_SSL_PROTO_DTLS)
1657	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
1658	accept_comp = 0;
1659	else
1660	#endif
1661	accept_comp = 1;
1662
1663	if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
1664	( comp != MBEDTLS_SSL_COMPRESS_DEFLATE \|\| accept_comp == 0 ) )
1665	#else /* MBEDTLS_ZLIB_SUPPORT */
1666	if( comp != MBEDTLS_SSL_COMPRESS_NULL )
1667	#endif/* MBEDTLS_ZLIB_SUPPORT */
1668	{
1669	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
1670	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1671	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1672	return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
1673	}
1674
1675	/*
1676	* Initialize update checksum functions
1677	*/
1678	ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
1679
1680	if( ssl->transform_negotiate->ciphersuite_info == NULL )
1681	{
1682	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) );
1683	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1684	MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
1685	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
1686	}
1687
1688	mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
1689
1690	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
1691	MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, session id", buf + 35, n );
1692
1693	/*
1694	* Check if the session can be resumed
1695	*/
1696	if( ssl->handshake->resume == 0 \|\| n == 0 \|\|
1697	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1698	ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE \|\|
1699	#endif
1700	ssl->session_negotiate->ciphersuite != i \|\|
1701	ssl->session_negotiate->compression != comp \|\|
1702	ssl->session_negotiate->id_len != n \|\|
1703	memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
1704	{
1705	ssl->state++;
1706	ssl->handshake->resume = 0;
1707	#if defined(MBEDTLS_HAVE_TIME)
1708	ssl->session_negotiate->start = mbedtls_time( NULL );
1709	#endif
1710	ssl->session_negotiate->ciphersuite = i;
1711	ssl->session_negotiate->compression = comp;
1712	ssl->session_negotiate->id_len = n;
1713	memcpy( ssl->session_negotiate->id, buf + 35, n );
1714	}
1715	else
1716	{
1717	ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
1718
1719	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
1720	{
1721	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
1722	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1723	MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
1724	return( ret );
1725	}
1726	}
1727
1728	MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
1729	ssl->handshake->resume ? "a" : "no" ) );
1730
1731	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
1732	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
1733
1734	/*
1735	* Perform cipher suite validation in same way as in ssl_write_client_hello.
1736	*/
1737	i = 0;
1738	while( 1 )
1739	{
1740	if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
1741	{
1742	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1743	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1744	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1745	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1746	}
1747
1748	if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
1749	ssl->session_negotiate->ciphersuite )
1750	{
1751	break;
1752	}
1753	}
1754
1755	suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
1756	if( ssl_validate_ciphersuite( suite_info, ssl, ssl->minor_ver, ssl->minor_ver ) != 0 )
1757	{
1758	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1759	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1760	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1761	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1762	}
1763
1764	MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
1765
1766	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
1767	if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA &&
1768	ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
1769	{
1770	ssl->handshake->ecrs_enabled = 1;
1771	}
1772	#endif
1773
1774	if( comp != MBEDTLS_SSL_COMPRESS_NULL
1775	#if defined(MBEDTLS_ZLIB_SUPPORT)
1776	&& comp != MBEDTLS_SSL_COMPRESS_DEFLATE
1777	#endif
1778	)
1779	{
1780	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1781	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1782	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
1783	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1784	}
1785	ssl->session_negotiate->compression = comp;
1786
1787	ext = buf + 40 + n;
1788
1789	MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
1790
1791	while( ext_len )
1792	{
1793	unsigned int ext_id = ( ( ext[0] << 8 )
1794	\| ( ext[1] ) );
1795	unsigned int ext_size = ( ( ext[2] << 8 )
1796	\| ( ext[3] ) );
1797
1798	if( ext_size + 4 > ext_len )
1799	{
1800	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1801	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1802	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
1803	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1804	}
1805
1806	switch( ext_id )
1807	{
1808	case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
1809	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
1810	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1811	renegotiation_info_seen = 1;
1812	#endif
1813
1814	if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
1815	ext_size ) ) != 0 )
1816	return( ret );
1817
1818	break;
1819
1820	#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
1821	case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
1822	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
1823
1824	if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
1825	ext + 4, ext_size ) ) != 0 )
1826	{
1827	return( ret );
1828	}
1829
1830	break;
1831	#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
1832
1833	#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
1834	case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
1835	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
1836
1837	if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
1838	ext + 4, ext_size ) ) != 0 )
1839	{
1840	return( ret );
1841	}
1842
1843	break;
1844	#endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
1845
1846	#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
1847	case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
1848	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
1849
1850	if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
1851	ext + 4, ext_size ) ) != 0 )
1852	{
1853	return( ret );
1854	}
1855
1856	break;
1857	#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
1858
1859	#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
1860	case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
1861	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) );
1862
1863	if( ( ret = ssl_parse_extended_ms_ext( ssl,
1864	ext + 4, ext_size ) ) != 0 )
1865	{
1866	return( ret );
1867	}
1868
1869	break;
1870	#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
1871
1872	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
1873	case MBEDTLS_TLS_EXT_SESSION_TICKET:
1874	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
1875
1876	if( ( ret = ssl_parse_session_ticket_ext( ssl,
1877	ext + 4, ext_size ) ) != 0 )
1878	{
1879	return( ret );
1880	}
1881
1882	break;
1883	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
1884
1885	#if defined(MBEDTLS_ECDH_C) \|\| defined(MBEDTLS_ECDSA_C) \|\| \
1886	defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1887	case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
1888	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) );
1889
1890	if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
1891	ext + 4, ext_size ) ) != 0 )
1892	{
1893	return( ret );
1894	}
1895
1896	break;
1897	#endif /* MBEDTLS_ECDH_C \|\| MBEDTLS_ECDSA_C \|\|
1898	MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1899
1900	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
1901	case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
1902	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
1903
1904	if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
1905	ext + 4, ext_size ) ) != 0 )
1906	{
1907	return( ret );
1908	}
1909
1910	break;
1911	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
1912
1913	#if defined(MBEDTLS_SSL_ALPN)
1914	case MBEDTLS_TLS_EXT_ALPN:
1915	MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
1916
1917	if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
1918	return( ret );
1919
1920	break;
1921	#endif /* MBEDTLS_SSL_ALPN */
1922
1923	default:
1924	MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
1925	ext_id ) );
1926	}
1927
1928	ext_len -= 4 + ext_size;
1929	ext += 4 + ext_size;
1930
1931	if( ext_len > 0 && ext_len < 4 )
1932	{
1933	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
1934	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1935	}
1936	}
1937
1938	/*
1939	* Renegotiation security checks
1940	*/
1941	if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1942	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
1943	{
1944	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
1945	handshake_failure = 1;
1946	}
1947	#if defined(MBEDTLS_SSL_RENEGOTIATION)
1948	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1949	ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
1950	renegotiation_info_seen == 0 )
1951	{
1952	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
1953	handshake_failure = 1;
1954	}
1955	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1956	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1957	ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
1958	{
1959	MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
1960	handshake_failure = 1;
1961	}
1962	else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
1963	ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
1964	renegotiation_info_seen == 1 )
1965	{
1966	MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
1967	handshake_failure = 1;
1968	}
1969	#endif /* MBEDTLS_SSL_RENEGOTIATION */
1970
1971	if( handshake_failure == 1 )
1972	{
1973	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1974	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
1975	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
1976	}
1977
1978	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
1979
1980	return( 0 );
1981	}
1982
1983	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
1984	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
1985	static int ssl_parse_server_dh_params( mbedtls_ssl_context ssl, unsigned char *p,
1986	unsigned char *end )
1987	{
1988	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
1989
1990	/*
1991	* Ephemeral DH parameters:
1992	*
1993	* struct {
1994	* opaque dh_p<1..2^16-1>;
1995	* opaque dh_g<1..2^16-1>;
1996	* opaque dh_Ys<1..2^16-1>;
1997	* } ServerDHParams;
1998	*/
1999	if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 )
2000	{
2001	MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
2002	return( ret );
2003	}
2004
2005	if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
2006	{
2007	MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
2008	ssl->handshake->dhm_ctx.len * 8,
2009	ssl->conf->dhm_min_bitlen ) );
2010	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2011	}
2012
2013	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
2014	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
2015	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
2016
2017	return( ret );
2018	}
2019	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
2020	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2021
2022	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
2023	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
2024	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) \|\| \
2025	defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
2026	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2027	static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
2028	{
2029	const mbedtls_ecp_curve_info *curve_info;
2030	mbedtls_ecp_group_id grp_id;
2031	#if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
2032	grp_id = ssl->handshake->ecdh_ctx.grp.id;
2033	#else
2034	grp_id = ssl->handshake->ecdh_ctx.grp_id;
2035	#endif
2036
2037	curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
2038	if( curve_info == NULL )
2039	{
2040	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2041	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2042	}
2043
2044	MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
2045
2046	#if defined(MBEDTLS_ECP_C)
2047	if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
2048	#else
2049	if( ssl->handshake->ecdh_ctx.grp.nbits < 163 \|\|
2050	ssl->handshake->ecdh_ctx.grp.nbits > 521 )
2051	#endif
2052	return( -1 );
2053
2054	MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2055	MBEDTLS_DEBUG_ECDH_QP );
2056
2057	return( 0 );
2058	}
2059	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
2060	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
2061	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \|\|
2062	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
2063	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2064
2065	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
2066	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
2067	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
2068	static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
2069	unsigned char **p,
2070	unsigned char *end )
2071	{
2072	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2073
2074	/*
2075	* Ephemeral ECDH parameters:
2076	*
2077	* struct {
2078	* ECParameters curve_params;
2079	* ECPoint public;
2080	* } ServerECDHParams;
2081	*/
2082	if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
2083	(const unsigned char **) p, end ) ) != 0 )
2084	{
2085	MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
2086	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2087	if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2088	ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
2089	#endif
2090	return( ret );
2091	}
2092
2093	if( ssl_check_server_ecdh_params( ssl ) != 0 )
2094	{
2095	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) );
2096	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2097	}
2098
2099	return( ret );
2100	}
2101	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
2102	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
2103	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
2104
2105	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2106	static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
2107	unsigned char **p,
2108	unsigned char *end )
2109	{
2110	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
2111	size_t len;
2112	((void) ssl);
2113
2114	/*
2115	* PSK parameters:
2116	*
2117	* opaque psk_identity_hint<0..2^16-1>;
2118	*/
2119	if( end - (*p) < 2 )
2120	{
2121	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
2122	"(psk_identity_hint length)" ) );
2123	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2124	}
2125	len = (p)[0] << 8 \| (p)[1];
2126	*p += 2;
2127
2128	if( end - (*p) < (int) len )
2129	{
2130	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
2131	"(psk_identity_hint length)" ) );
2132	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2133	}
2134
2135	/*
2136	* Note: we currently ignore the PKS identity hint, as we only allow one
2137	* PSK to be provisionned on the client. This could be changed later if
2138	* someone needs that feature.
2139	*/
2140	*p += len;
2141	ret = 0;
2142
2143	return( ret );
2144	}
2145	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2146
2147	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) \|\| \
2148	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2149	/*
2150	* Generate a pre-master secret and encrypt it with the server's RSA key
2151	*/
2152	static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
2153	size_t offset, size_t *olen,
2154	size_t pms_offset )
2155	{
2156	int ret;
2157	size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
2158	unsigned char *p = ssl->handshake->premaster + pms_offset;
2159
2160	if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN )
2161	{
2162	MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
2163	return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
2164	}
2165
2166	/*
2167	* Generate (part of) the pre-master as
2168	* struct {
2169	* ProtocolVersion client_version;
2170	* opaque random[46];
2171	* } PreMasterSecret;
2172	*/
2173	mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
2174	ssl->conf->transport, p );
2175
2176	if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
2177	{
2178	MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
2179	return( ret );
2180	}
2181
2182	ssl->handshake->pmslen = 48;
2183
2184	if( ssl->session_negotiate->peer_cert == NULL )
2185	{
2186	MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
2187	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2188	}
2189
2190	/*
2191	* Now write it out, encrypted
2192	*/
2193	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
2194	MBEDTLS_PK_RSA ) )
2195	{
2196	MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
2197	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2198	}
2199
2200	if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk,
2201	p, ssl->handshake->pmslen,
2202	ssl->out_msg + offset + len_bytes, olen,
2203	MBEDTLS_SSL_OUT_CONTENT_LEN - offset - len_bytes,
2204	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2205	{
2206	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
2207	return( ret );
2208	}
2209
2210	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
2211	defined(MBEDTLS_SSL_PROTO_TLS1_2)
2212	if( len_bytes == 2 )
2213	{
2214	ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
2215	ssl->out_msg[offset+1] = (unsigned char)( *olen );
2216	*olen += 2;
2217	}
2218	#endif
2219
2220	return( 0 );
2221	}
2222	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED \|\|
2223	MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2224
2225	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2226	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
2227	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
2228	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2229	static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
2230	unsigned char **p,
2231	unsigned char *end,
2232	mbedtls_md_type_t *md_alg,
2233	mbedtls_pk_type_t *pk_alg )
2234	{
2235	((void) ssl);
2236	*md_alg = MBEDTLS_MD_NONE;
2237	*pk_alg = MBEDTLS_PK_NONE;
2238
2239	/* Only in TLS 1.2 */
2240	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
2241	{
2242	return( 0 );
2243	}
2244
2245	if( (*p) + 2 > end )
2246	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2247
2248	/*
2249	* Get hash algorithm
2250	*/
2251	if( ( md_alg = mbedtls_ssl_md_alg_from_hash( (p)[0] ) ) == MBEDTLS_MD_NONE )
2252	{
2253	MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
2254	"HashAlgorithm %d", *(p)[0] ) );
2255	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2256	}
2257
2258	/*
2259	* Get signature algorithm
2260	*/
2261	if( ( pk_alg = mbedtls_ssl_pk_alg_from_sig( (p)[1] ) ) == MBEDTLS_PK_NONE )
2262	{
2263	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
2264	"SignatureAlgorithm %d", (*p)[1] ) );
2265	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2266	}
2267
2268	/*
2269	* Check if the hash is acceptable
2270	*/
2271	if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
2272	{
2273	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm %d that was not offered",
2274	*(p)[0] ) );
2275	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2276	}
2277
2278	MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) );
2279	MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) );
2280	*p += 2;
2281
2282	return( 0 );
2283	}
2284	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
2285	MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
2286	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2287	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2288
2289	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
2290	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2291	static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
2292	{
2293	int ret;
2294	const mbedtls_ecp_keypair *peer_key;
2295
2296	if( ssl->session_negotiate->peer_cert == NULL )
2297	{
2298	MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
2299	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2300	}
2301
2302	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
2303	MBEDTLS_PK_ECKEY ) )
2304	{
2305	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
2306	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2307	}
2308
2309	peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk );
2310
2311	if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
2312	MBEDTLS_ECDH_THEIRS ) ) != 0 )
2313	{
2314	MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
2315	return( ret );
2316	}
2317
2318	if( ssl_check_server_ecdh_params( ssl ) != 0 )
2319	{
2320	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
2321	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
2322	}
2323
2324	return( ret );
2325	}
2326	#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\|
2327	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2328
2329	static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
2330	{
2331	int ret;
2332	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2333	ssl->transform_negotiate->ciphersuite_info;
2334	unsigned char p = NULL, end = NULL;
2335
2336	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
2337
2338	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
2339	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
2340	{
2341	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
2342	ssl->state++;
2343	return( 0 );
2344	}
2345	((void) p);
2346	((void) end);
2347	#endif
2348
2349	#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
2350	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2351	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
2352	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2353	{
2354	if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
2355	{
2356	MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
2357	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2358	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2359	return( ret );
2360	}
2361
2362	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
2363	ssl->state++;
2364	return( 0 );
2365	}
2366	((void) p);
2367	((void) end);
2368	#endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
2369	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
2370
2371	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2372	if( ssl->handshake->ecrs_enabled &&
2373	ssl->handshake->ecrs_state == ssl_ecrs_ske_start_processing )
2374	{
2375	goto start_processing;
2376	}
2377	#endif
2378
2379	if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2380	{
2381	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2382	return( ret );
2383	}
2384
2385	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2386	{
2387	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2388	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2389	MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2390	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2391	}
2392
2393	/*
2394	* ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
2395	* doesn't use a psk_identity_hint
2396	*/
2397	if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
2398	{
2399	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
2400	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2401	{
2402	/* Current message is probably either
2403	* CertificateRequest or ServerHelloDone */
2404	ssl->keep_current_message = 1;
2405	goto exit;
2406	}
2407
2408	MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key exchange message must "
2409	"not be skipped" ) );
2410	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2411	MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2412
2413	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2414	}
2415
2416	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2417	if( ssl->handshake->ecrs_enabled )
2418	ssl->handshake->ecrs_state = ssl_ecrs_ske_start_processing;
2419
2420	start_processing:
2421	#endif
2422	p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
2423	end = ssl->in_msg + ssl->in_hslen;
2424	MBEDTLS_SSL_DEBUG_BUF( 3, "server key exchange", p, end - p );
2425
2426	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
2427	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
2428	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
2429	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
2430	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
2431	{
2432	if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
2433	{
2434	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2435	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2436	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2437	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2438	}
2439	} /* FALLTROUGH */
2440	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
2441
2442	#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) \|\| \
2443	defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
2444	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
2445	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
2446	; /* nothing more to do */
2447	else
2448	#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED \|\|
2449	MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
2450	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) \|\| \
2451	defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
2452	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA \|\|
2453	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
2454	{
2455	if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
2456	{
2457	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2458	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2459	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2460	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2461	}
2462	}
2463	else
2464	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED \|\|
2465	MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
2466	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
2467	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) \|\| \
2468	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
2469	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
2470	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
2471	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
2472	{
2473	if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
2474	{
2475	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2476	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2477	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2478	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2479	}
2480	}
2481	else
2482	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
2483	MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED \|\|
2484	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
2485	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
2486	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
2487	{
2488	ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
2489	p, end - p );
2490	if( ret != 0 )
2491	{
2492	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
2493	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2494	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2495	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2496	}
2497	}
2498	else
2499	#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
2500	{
2501	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2502	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2503	}
2504
2505	#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
2506	if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
2507	{
2508	size_t sig_len, hashlen;
2509	unsigned char hash[64];
2510	mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
2511	mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
2512	unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
2513	size_t params_len = p - params;
2514	void *rs_ctx = NULL;
2515
2516	/*
2517	* Handle the digitally-signed structure
2518	*/
2519	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2520	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2521	{
2522	if( ssl_parse_signature_algorithm( ssl, &p, end,
2523	&md_alg, &pk_alg ) != 0 )
2524	{
2525	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2526	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2527	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2528	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2529	}
2530
2531	if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
2532	{
2533	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2534	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2535	MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
2536	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2537	}
2538	}
2539	else
2540	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2541	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
2542	defined(MBEDTLS_SSL_PROTO_TLS1_1)
2543	if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
2544	{
2545	pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
2546
2547	/* Default hash for ECDSA is SHA-1 */
2548	if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
2549	md_alg = MBEDTLS_MD_SHA1;
2550	}
2551	else
2552	#endif
2553	{
2554	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2555	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2556	}
2557
2558	/*
2559	* Read signature
2560	*/
2561
2562	if( p > end - 2 )
2563	{
2564	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2565	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2566	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2567	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2568	}
2569	sig_len = ( p[0] << 8 ) \| p[1];
2570	p += 2;
2571
2572	if( p != end - sig_len )
2573	{
2574	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2575	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2576	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2577	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
2578	}
2579
2580	MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
2581
2582	/*
2583	* Compute the hash that has been signed
2584	*/
2585	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
2586	defined(MBEDTLS_SSL_PROTO_TLS1_1)
2587	if( md_alg == MBEDTLS_MD_NONE )
2588	{
2589	hashlen = 36;
2590	ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash, params,
2591	params_len );
2592	if( ret != 0 )
2593	return( ret );
2594	}
2595	else
2596	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\| \
2597	MBEDTLS_SSL_PROTO_TLS1_1 */
2598	#if defined(MBEDTLS_SSL_PROTO_TLS1) \|\| defined(MBEDTLS_SSL_PROTO_TLS1_1) \|\| \
2599	defined(MBEDTLS_SSL_PROTO_TLS1_2)
2600	if( md_alg != MBEDTLS_MD_NONE )
2601	{
2602	ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
2603	params, params_len,
2604	md_alg );
2605	if( ret != 0 )
2606	return( ret );
2607	}
2608	else
2609	#endif /* MBEDTLS_SSL_PROTO_TLS1 \|\| MBEDTLS_SSL_PROTO_TLS1_1 \|\| \
2610	MBEDTLS_SSL_PROTO_TLS1_2 */
2611	{
2612	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2613	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2614	}
2615
2616	MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
2617
2618	if( ssl->session_negotiate->peer_cert == NULL )
2619	{
2620	MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
2621	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2622	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2623	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2624	}
2625
2626	/*
2627	* Verify signature
2628	*/
2629	if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
2630	{
2631	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
2632	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2633	MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
2634	return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
2635	}
2636
2637	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2638	if( ssl->handshake->ecrs_enabled )
2639	rs_ctx = &ssl->handshake->ecrs_ctx.pk;
2640	#endif
2641
2642	if( ( ret = mbedtls_pk_verify_restartable(
2643	&ssl->session_negotiate->peer_cert->pk,
2644	md_alg, hash, hashlen, p, sig_len, rs_ctx ) ) != 0 )
2645	{
2646	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2647	if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
2648	#endif
2649	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2650	MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
2651	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
2652	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2653	if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2654	ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
2655	#endif
2656	return( ret );
2657	}
2658	}
2659	#endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
2660
2661	exit:
2662	ssl->state++;
2663
2664	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
2665
2666	return( 0 );
2667	}
2668
2669	#if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
2670	static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
2671	{
2672	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2673	ssl->transform_negotiate->ciphersuite_info;
2674
2675	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
2676
2677	if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
2678	{
2679	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
2680	ssl->state++;
2681	return( 0 );
2682	}
2683
2684	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
2685	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
2686	}
2687	#else /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
2688	static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
2689	{
2690	int ret;
2691	unsigned char *buf;
2692	size_t n = 0;
2693	size_t cert_type_len = 0, dn_len = 0;
2694	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2695	ssl->transform_negotiate->ciphersuite_info;
2696
2697	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
2698
2699	if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
2700	{
2701	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
2702	ssl->state++;
2703	return( 0 );
2704	}
2705
2706	if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2707	{
2708	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2709	return( ret );
2710	}
2711
2712	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2713	{
2714	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2715	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2716	MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
2717	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2718	}
2719
2720	ssl->state++;
2721	ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST );
2722
2723	MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
2724	ssl->client_auth ? "a" : "no" ) );
2725
2726	if( ssl->client_auth == 0 )
2727	{
2728	/* Current message is probably the ServerHelloDone */
2729	ssl->keep_current_message = 1;
2730	goto exit;
2731	}
2732
2733	/*
2734	* struct {
2735	* ClientCertificateType certificate_types<1..2^8-1>;
2736	* SignatureAndHashAlgorithm
2737	* supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
2738	* DistinguishedName certificate_authorities<0..2^16-1>;
2739	* } CertificateRequest;
2740	*
2741	* Since we only support a single certificate on clients, let's just
2742	* ignore all the information that's supposed to help us pick a
2743	* certificate.
2744	*
2745	* We could check that our certificate matches the request, and bail out
2746	* if it doesn't, but it's simpler to just send the certificate anyway,
2747	* and give the server the opportunity to decide if it should terminate
2748	* the connection when it doesn't like our certificate.
2749	*
2750	* Same goes for the hash in TLS 1.2's signature_algorithms: at this
2751	* point we only have one hash available (see comments in
2752	* write_certificate_verify), so let's just use what we have.
2753	*
2754	* However, we still minimally parse the message to check it is at least
2755	* superficially sane.
2756	*/
2757	buf = ssl->in_msg;
2758
2759	/* certificate_types */
2760	if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) )
2761	{
2762	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2763	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2764	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2765	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2766	}
2767	cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
2768	n = cert_type_len;
2769
2770	/*
2771	* In the subsequent code there are two paths that read from buf:
2772	* * the length of the signature algorithms field (if minor version of
2773	* SSL is 3),
2774	* * distinguished name length otherwise.
2775	* Both reach at most the index:
2776	* ...hdr_len + 2 + n,
2777	* therefore the buffer length at this point must be greater than that
2778	* regardless of the actual code path.
2779	*/
2780	if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
2781	{
2782	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2783	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2784	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2785	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2786	}
2787
2788	/* supported_signature_algorithms */
2789	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
2790	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
2791	{
2792	size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
2793	\| ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
2794	#if defined(MBEDTLS_DEBUG_C)
2795	unsigned char* sig_alg;
2796	size_t i;
2797	#endif
2798
2799	/*
2800	* The furthest access in buf is in the loop few lines below:
2801	* sig_alg[i + 1],
2802	* where:
2803	* sig_alg = buf + ...hdr_len + 3 + n,
2804	* max(i) = sig_alg_len - 1.
2805	* Therefore the furthest access is:
2806	* buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
2807	* which reduces to:
2808	* buf[...hdr_len + 3 + n + sig_alg_len],
2809	* which is one less than we need the buf to be.
2810	*/
2811	if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n + sig_alg_len )
2812	{
2813	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2814	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2815	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2816	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2817	}
2818
2819	#if defined(MBEDTLS_DEBUG_C)
2820	sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
2821	for( i = 0; i < sig_alg_len; i += 2 )
2822	{
2823	MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d"
2824	",%d", sig_alg[i], sig_alg[i + 1] ) );
2825	}
2826	#endif
2827
2828	n += 2 + sig_alg_len;
2829	}
2830	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
2831
2832	/* certificate_authorities */
2833	dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] << 8 )
2834	\| ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n] ) );
2835
2836	n += dn_len;
2837	if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
2838	{
2839	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
2840	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2841	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2842	return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
2843	}
2844
2845	exit:
2846	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
2847
2848	return( 0 );
2849	}
2850	#endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
2851
2852	static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
2853	{
2854	int ret;
2855
2856	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
2857
2858	if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
2859	{
2860	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
2861	return( ret );
2862	}
2863
2864	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
2865	{
2866	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
2867	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
2868	}
2869
2870	if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) \|\|
2871	ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
2872	{
2873	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
2874	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
2875	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
2876	return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
2877	}
2878
2879	ssl->state++;
2880
2881	#if defined(MBEDTLS_SSL_PROTO_DTLS)
2882	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
2883	mbedtls_ssl_recv_flight_completed( ssl );
2884	#endif
2885
2886	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
2887
2888	return( 0 );
2889	}
2890
2891	static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
2892	{
2893	int ret;
2894	size_t i, n;
2895	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
2896	ssl->transform_negotiate->ciphersuite_info;
2897
2898	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
2899
2900	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
2901	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
2902	{
2903	/*
2904	* DHM key exchange -- send G^X mod P
2905	*/
2906	n = ssl->handshake->dhm_ctx.len;
2907
2908	ssl->out_msg[4] = (unsigned char)( n >> 8 );
2909	ssl->out_msg[5] = (unsigned char)( n );
2910	i = 6;
2911
2912	ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
2913	(int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
2914	&ssl->out_msg[i], n,
2915	ssl->conf->f_rng, ssl->conf->p_rng );
2916	if( ret != 0 )
2917	{
2918	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
2919	return( ret );
2920	}
2921
2922	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
2923	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
2924
2925	if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
2926	ssl->handshake->premaster,
2927	MBEDTLS_PREMASTER_SIZE,
2928	&ssl->handshake->pmslen,
2929	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2930	{
2931	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
2932	return( ret );
2933	}
2934
2935	MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
2936	}
2937	else
2938	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
2939	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) \|\| \
2940	defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) \|\| \
2941	defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) \|\| \
2942	defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
2943	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA \|\|
2944	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA \|\|
2945	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA \|\|
2946	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
2947	{
2948	/*
2949	* ECDH key exchange -- send client public value
2950	*/
2951	i = 4;
2952
2953	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2954	if( ssl->handshake->ecrs_enabled )
2955	{
2956	if( ssl->handshake->ecrs_state == ssl_ecrs_cke_ecdh_calc_secret )
2957	goto ecdh_calc_secret;
2958
2959	mbedtls_ecdh_enable_restart( &ssl->handshake->ecdh_ctx );
2960	}
2961	#endif
2962
2963	ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
2964	&n,
2965	&ssl->out_msg[i], 1000,
2966	ssl->conf->f_rng, ssl->conf->p_rng );
2967	if( ret != 0 )
2968	{
2969	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
2970	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2971	if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
2972	ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
2973	#endif
2974	return( ret );
2975	}
2976
2977	MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
2978	MBEDTLS_DEBUG_ECDH_Q );
2979
2980	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2981	if( ssl->handshake->ecrs_enabled )
2982	{
2983	ssl->handshake->ecrs_n = n;
2984	ssl->handshake->ecrs_state = ssl_ecrs_cke_ecdh_calc_secret;
2985	}
2986
2987	ecdh_calc_secret:
2988	if( ssl->handshake->ecrs_enabled )
2989	n = ssl->handshake->ecrs_n;
2990	#endif
2991	if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
2992	&ssl->handshake->pmslen,
2993	ssl->handshake->premaster,
2994	MBEDTLS_MPI_MAX_SIZE,
2995	ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
2996	{
2997	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
2998	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
2999	if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3000	ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3001	#endif
3002	return( ret );
3003	}
3004
3005	MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3006	MBEDTLS_DEBUG_ECDH_Z );
3007	}
3008	else
3009	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED \|\|
3010	MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \|\|
3011	MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \|\|
3012	MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
3013	#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
3014	if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
3015	{
3016	/*
3017	* opaque psk_identity<0..2^16-1>;
3018	*/
3019	if( ssl->conf->psk == NULL \|\| ssl->conf->psk_identity == NULL )
3020	{
3021	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) );
3022	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3023	}
3024
3025	i = 4;
3026	n = ssl->conf->psk_identity_len;
3027
3028	if( i + 2 + n > MBEDTLS_SSL_OUT_CONTENT_LEN )
3029	{
3030	MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or "
3031	"SSL buffer too short" ) );
3032	return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3033	}
3034
3035	ssl->out_msg[i++] = (unsigned char)( n >> 8 );
3036	ssl->out_msg[i++] = (unsigned char)( n );
3037
3038	memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len );
3039	i += ssl->conf->psk_identity_len;
3040
3041	#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
3042	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
3043	{
3044	n = 0;
3045	}
3046	else
3047	#endif
3048	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
3049	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
3050	{
3051	if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 )
3052	return( ret );
3053	}
3054	else
3055	#endif
3056	#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
3057	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
3058	{
3059	/*
3060	* ClientDiffieHellmanPublic public (DHM send G^X mod P)
3061	*/
3062	n = ssl->handshake->dhm_ctx.len;
3063
3064	if( i + 2 + n > MBEDTLS_SSL_OUT_CONTENT_LEN )
3065	{
3066	MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long"
3067	" or SSL buffer too short" ) );
3068	return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
3069	}
3070
3071	ssl->out_msg[i++] = (unsigned char)( n >> 8 );
3072	ssl->out_msg[i++] = (unsigned char)( n );
3073
3074	ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
3075	(int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
3076	&ssl->out_msg[i], n,
3077	ssl->conf->f_rng, ssl->conf->p_rng );
3078	if( ret != 0 )
3079	{
3080	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
3081	return( ret );
3082	}
3083	}
3084	else
3085	#endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
3086	#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
3087	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
3088	{
3089	/*
3090	* ClientECDiffieHellmanPublic public;
3091	*/
3092	ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n,
3093	&ssl->out_msg[i], MBEDTLS_SSL_OUT_CONTENT_LEN - i,
3094	ssl->conf->f_rng, ssl->conf->p_rng );
3095	if( ret != 0 )
3096	{
3097	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
3098	return( ret );
3099	}
3100
3101	MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
3102	MBEDTLS_DEBUG_ECDH_Q );
3103	}
3104	else
3105	#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
3106	{
3107	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3108	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3109	}
3110
3111	if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
3112	ciphersuite_info->key_exchange ) ) != 0 )
3113	{
3114	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
3115	return( ret );
3116	}
3117	}
3118	else
3119	#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
3120	#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
3121	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
3122	{
3123	i = 4;
3124	if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 )
3125	return( ret );
3126	}
3127	else
3128	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
3129	#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
3130	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3131	{
3132	i = 4;
3133
3134	ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
3135	ssl->out_msg + i, MBEDTLS_SSL_OUT_CONTENT_LEN - i, &n,
3136	ssl->conf->f_rng, ssl->conf->p_rng );
3137	if( ret != 0 )
3138	{
3139	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
3140	return( ret );
3141	}
3142
3143	ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
3144	ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
3145	ssl->conf->f_rng, ssl->conf->p_rng );
3146	if( ret != 0 )
3147	{
3148	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
3149	return( ret );
3150	}
3151	}
3152	else
3153	#endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
3154	{
3155	((void) ciphersuite_info);
3156	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3157	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3158	}
3159
3160	ssl->out_msglen = i + n;
3161	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3162	ssl->out_msg[0] = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
3163
3164	ssl->state++;
3165
3166	if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
3167	{
3168	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
3169	return( ret );
3170	}
3171
3172	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
3173
3174	return( 0 );
3175	}
3176
3177	#if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) && \
3178	!defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) && \
3179	!defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) && \
3180	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
3181	!defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
3182	!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
3183	static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
3184	{
3185	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3186	ssl->transform_negotiate->ciphersuite_info;
3187	int ret;
3188
3189	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
3190
3191	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
3192	{
3193	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
3194	return( ret );
3195	}
3196
3197	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
3198	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
3199	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
3200	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
3201	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3202	{
3203	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
3204	ssl->state++;
3205	return( 0 );
3206	}
3207
3208	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3209	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3210	}
3211	#else
3212	static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
3213	{
3214	int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
3215	const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
3216	ssl->transform_negotiate->ciphersuite_info;
3217	size_t n = 0, offset = 0;
3218	unsigned char hash[48];
3219	unsigned char *hash_start = hash;
3220	mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
3221	unsigned int hashlen;
3222	void *rs_ctx = NULL;
3223
3224	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
3225
3226	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
3227	if( ssl->handshake->ecrs_enabled &&
3228	ssl->handshake->ecrs_state == ssl_ecrs_crt_vrfy_sign )
3229	{
3230	goto sign;
3231	}
3232	#endif
3233
3234	if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
3235	{
3236	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
3237	return( ret );
3238	}
3239
3240	if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK \|\|
3241	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK \|\|
3242	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK \|\|
3243	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK \|\|
3244	ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
3245	{
3246	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
3247	ssl->state++;
3248	return( 0 );
3249	}
3250
3251	if( ssl->client_auth == 0 \|\| mbedtls_ssl_own_cert( ssl ) == NULL )
3252	{
3253	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
3254	ssl->state++;
3255	return( 0 );
3256	}
3257
3258	if( mbedtls_ssl_own_key( ssl ) == NULL )
3259	{
3260	MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
3261	return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
3262	}
3263
3264	/*
3265	* Make a signature of the handshake digests
3266	*/
3267	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
3268	if( ssl->handshake->ecrs_enabled )
3269	ssl->handshake->ecrs_state = ssl_ecrs_crt_vrfy_sign;
3270
3271	sign:
3272	#endif
3273
3274	ssl->handshake->calc_verify( ssl, hash );
3275
3276	#if defined(MBEDTLS_SSL_PROTO_SSL3) \|\| defined(MBEDTLS_SSL_PROTO_TLS1) \|\| \
3277	defined(MBEDTLS_SSL_PROTO_TLS1_1)
3278	if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
3279	{
3280	/*
3281	* digitally-signed struct {
3282	* opaque md5_hash[16];
3283	* opaque sha_hash[20];
3284	* };
3285	*
3286	* md5_hash
3287	* MD5(handshake_messages);
3288	*
3289	* sha_hash
3290	* SHA(handshake_messages);
3291	*/
3292	hashlen = 36;
3293	md_alg = MBEDTLS_MD_NONE;
3294
3295	/*
3296	* For ECDSA, default hash is SHA-1 only
3297	*/
3298	if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
3299	{
3300	hash_start += 16;
3301	hashlen -= 16;
3302	md_alg = MBEDTLS_MD_SHA1;
3303	}
3304	}
3305	else
3306	#endif /* MBEDTLS_SSL_PROTO_SSL3 \|\| MBEDTLS_SSL_PROTO_TLS1 \|\| \
3307	MBEDTLS_SSL_PROTO_TLS1_1 */
3308	#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
3309	if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
3310	{
3311	/*
3312	* digitally-signed struct {
3313	* opaque handshake_messages[handshake_messages_length];
3314	* };
3315	*
3316	* Taking shortcut here. We assume that the server always allows the
3317	* PRF Hash function and has sent it in the allowed signature
3318	* algorithms list received in the Certificate Request message.
3319	*
3320	* Until we encounter a server that does not, we will take this
3321	* shortcut.
3322	*
3323	* Reason: Otherwise we should have running hashes for SHA512 and SHA224
3324	* in order to satisfy 'weird' needs from the server side.
3325	*/
3326	if( ssl->transform_negotiate->ciphersuite_info->mac ==
3327	MBEDTLS_MD_SHA384 )
3328	{
3329	md_alg = MBEDTLS_MD_SHA384;
3330	ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
3331	}
3332	else
3333	{
3334	md_alg = MBEDTLS_MD_SHA256;
3335	ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
3336	}
3337	ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
3338
3339	/* Info from md_alg will be used instead */
3340	hashlen = 0;
3341	offset = 2;
3342	}
3343	else
3344	#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
3345	{
3346	MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
3347	return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
3348	}
3349
3350	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
3351	if( ssl->handshake->ecrs_enabled )
3352	rs_ctx = &ssl->handshake->ecrs_ctx.pk;
3353	#endif
3354
3355	if( ( ret = mbedtls_pk_sign_restartable( mbedtls_ssl_own_key( ssl ),
3356	md_alg, hash_start, hashlen,
3357	ssl->out_msg + 6 + offset, &n,
3358	ssl->conf->f_rng, ssl->conf->p_rng, rs_ctx ) ) != 0 )
3359	{
3360	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
3361	#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
3362	if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
3363	ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
3364	#endif
3365	return( ret );
3366	}
3367
3368	ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
3369	ssl->out_msg[5 + offset] = (unsigned char)( n );
3370
3371	ssl->out_msglen = 6 + n + offset;
3372	ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
3373	ssl->out_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
3374
3375	ssl->state++;
3376
3377	if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
3378	{
3379	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
3380	return( ret );
3381	}
3382
3383	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
3384
3385	return( ret );
3386	}
3387	#endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
3388	!MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
3389	!MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
3390	!MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
3391	!MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
3392	!MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
3393
3394	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3395	static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
3396	{
3397	int ret;
3398	uint32_t lifetime;
3399	size_t ticket_len;
3400	unsigned char *ticket;
3401	const unsigned char *msg;
3402
3403	MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
3404
3405	if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
3406	{
3407	MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
3408	return( ret );
3409	}
3410
3411	if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
3412	{
3413	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
3414	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3415	MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
3416	return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
3417	}
3418
3419	/*
3420	* struct {
3421	* uint32 ticket_lifetime_hint;
3422	* opaque ticket<0..2^16-1>;
3423	* } NewSessionTicket;
3424	*
3425	* 0 . 3 ticket_lifetime_hint
3426	* 4 . 5 ticket_len (n)
3427	* 6 . 5+n ticket content
3428	*/
3429	if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET \|\|
3430	ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
3431	{
3432	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
3433	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3434	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3435	return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
3436	}
3437
3438	msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
3439
3440	lifetime = ( ((uint32_t) msg[0]) << 24 ) \| ( msg[1] << 16 ) \|
3441	( msg[2] << 8 ) \| ( msg[3] );
3442
3443	ticket_len = ( msg[4] << 8 ) \| ( msg[5] );
3444
3445	if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
3446	{
3447	MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
3448	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3449	MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
3450	return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
3451	}
3452
3453	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
3454
3455	/* We're not waiting for a NewSessionTicket message any more */
3456	ssl->handshake->new_session_ticket = 0;
3457	ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
3458
3459	/*
3460	* Zero-length ticket means the server changed his mind and doesn't want
3461	* to send a ticket after all, so just forget it
3462	*/
3463	if( ticket_len == 0 )
3464	return( 0 );
3465
3466	mbedtls_platform_zeroize( ssl->session_negotiate->ticket,
3467	ssl->session_negotiate->ticket_len );
3468	mbedtls_free( ssl->session_negotiate->ticket );
3469	ssl->session_negotiate->ticket = NULL;
3470	ssl->session_negotiate->ticket_len = 0;
3471
3472	if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
3473	{
3474	MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
3475	mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
3476	MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
3477	return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
3478	}
3479
3480	memcpy( ticket, msg + 6, ticket_len );
3481
3482	ssl->session_negotiate->ticket = ticket;
3483	ssl->session_negotiate->ticket_len = ticket_len;
3484	ssl->session_negotiate->ticket_lifetime = lifetime;
3485
3486	/*
3487	* RFC 5077 section 3.4:
3488	* "If the client receives a session ticket from the server, then it
3489	* discards any Session ID that was sent in the ServerHello."
3490	*/
3491	MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
3492	ssl->session_negotiate->id_len = 0;
3493
3494	MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
3495
3496	return( 0 );
3497	}
3498	#endif /* MBEDTLS_SSL_SESSION_TICKETS */
3499
3500	/*
3501	* SSL handshake -- client side -- single step
3502	*/
3503	int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
3504	{
3505	int ret = 0;
3506
3507	if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER \|\| ssl->handshake == NULL )
3508	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3509
3510	MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
3511
3512	if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
3513	return( ret );
3514
3515	#if defined(MBEDTLS_SSL_PROTO_DTLS)
3516	if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
3517	ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
3518	{
3519	if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
3520	return( ret );
3521	}
3522	#endif /* MBEDTLS_SSL_PROTO_DTLS */
3523
3524	/* Change state now, so that it is right in mbedtls_ssl_read_record(), used
3525	* by DTLS for dropping out-of-sequence ChangeCipherSpec records */
3526	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3527	if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
3528	ssl->handshake->new_session_ticket != 0 )
3529	{
3530	ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
3531	}
3532	#endif
3533
3534	switch( ssl->state )
3535	{
3536	case MBEDTLS_SSL_HELLO_REQUEST:
3537	ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
3538	break;
3539
3540	/*
3541	* ==> ClientHello
3542	*/
3543	case MBEDTLS_SSL_CLIENT_HELLO:
3544	ret = ssl_write_client_hello( ssl );
3545	break;
3546
3547	/*
3548	* <== ServerHello
3549	* Certificate
3550	* ( ServerKeyExchange )
3551	* ( CertificateRequest )
3552	* ServerHelloDone
3553	*/
3554	case MBEDTLS_SSL_SERVER_HELLO:
3555	ret = ssl_parse_server_hello( ssl );
3556	break;
3557
3558	case MBEDTLS_SSL_SERVER_CERTIFICATE:
3559	ret = mbedtls_ssl_parse_certificate( ssl );
3560	break;
3561
3562	case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
3563	ret = ssl_parse_server_key_exchange( ssl );
3564	break;
3565
3566	case MBEDTLS_SSL_CERTIFICATE_REQUEST:
3567	ret = ssl_parse_certificate_request( ssl );
3568	break;
3569
3570	case MBEDTLS_SSL_SERVER_HELLO_DONE:
3571	ret = ssl_parse_server_hello_done( ssl );
3572	break;
3573
3574	/*
3575	* ==> ( Certificate/Alert )
3576	* ClientKeyExchange
3577	* ( CertificateVerify )
3578	* ChangeCipherSpec
3579	* Finished
3580	*/
3581	case MBEDTLS_SSL_CLIENT_CERTIFICATE:
3582	ret = mbedtls_ssl_write_certificate( ssl );
3583	break;
3584
3585	case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
3586	ret = ssl_write_client_key_exchange( ssl );
3587	break;
3588
3589	case MBEDTLS_SSL_CERTIFICATE_VERIFY:
3590	ret = ssl_write_certificate_verify( ssl );
3591	break;
3592
3593	case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
3594	ret = mbedtls_ssl_write_change_cipher_spec( ssl );
3595	break;
3596
3597	case MBEDTLS_SSL_CLIENT_FINISHED:
3598	ret = mbedtls_ssl_write_finished( ssl );
3599	break;
3600
3601	/*
3602	* <== ( NewSessionTicket )
3603	* ChangeCipherSpec
3604	* Finished
3605	*/
3606	#if defined(MBEDTLS_SSL_SESSION_TICKETS)
3607	case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
3608	ret = ssl_parse_new_session_ticket( ssl );
3609	break;
3610	#endif
3611
3612	case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
3613	ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
3614	break;
3615
3616	case MBEDTLS_SSL_SERVER_FINISHED:
3617	ret = mbedtls_ssl_parse_finished( ssl );
3618	break;
3619
3620	case MBEDTLS_SSL_FLUSH_BUFFERS:
3621	MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
3622	ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
3623	break;
3624
3625	case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
3626	mbedtls_ssl_handshake_wrapup( ssl );
3627	break;
3628
3629	default:
3630	MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
3631	return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
3632	}
3633
3634	return( ret );
3635	}
3636	#endif /* MBEDTLS_SSL_CLI_C */

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: azure_iot_hub_mbedtls/trunk/mbedtls-2.16.1/library/ssl_cli.c@ 398

Download in other formats: