PolarSSL v1.2.12
ssl_cli.c
Go to the documentation of this file.
1 /*
2  * SSLv3/TLSv1 client-side functions
3  *
4  * Copyright (C) 2006-2012, Brainspark B.V.
5  *
6  * This file is part of PolarSSL (http://www.polarssl.org)
7  * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
8  *
9  * All rights reserved.
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, write to the Free Software Foundation, Inc.,
23  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24  */
25 
26 #include "polarssl/config.h"
27 
28 #if defined(POLARSSL_SSL_CLI_C)
29 
30 #include "polarssl/debug.h"
31 #include "polarssl/ssl.h"
32 
33 #include <stdlib.h>
34 #include <stdio.h>
35 #include <time.h>
36 
37 #if defined(POLARSSL_SHA4_C)
38 #include "polarssl/sha4.h"
39 #endif
40 
41 static int ssl_write_client_hello( ssl_context *ssl )
42 {
43  int ret;
44  size_t i, n, ext_len = 0;
45  unsigned char *buf;
46  unsigned char *p;
47  time_t t;
48  unsigned char sig_alg_list[20];
49  size_t sig_alg_len = 0;
50 
51  SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
52 
53  if( ssl->f_rng == NULL )
54  {
55  SSL_DEBUG_MSG( 1, ( "no RNG provided") );
56  return( POLARSSL_ERR_SSL_NO_RNG );
57  }
58 
60  {
61  ssl->major_ver = ssl->min_major_ver;
62  ssl->minor_ver = ssl->min_minor_ver;
63  }
64 
65  if( ssl->max_major_ver == 0 && ssl->max_minor_ver == 0 )
66  {
69  }
70 
71  /*
72  * 0 . 0 handshake type
73  * 1 . 3 handshake length
74  * 4 . 5 highest version supported
75  * 6 . 9 current UNIX time
76  * 10 . 37 random bytes
77  */
78  buf = ssl->out_msg;
79  p = buf + 4;
80 
81  *p++ = (unsigned char) ssl->max_major_ver;
82  *p++ = (unsigned char) ssl->max_minor_ver;
83 
84  SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
85  buf[4], buf[5] ) );
86 
87  t = time( NULL );
88  *p++ = (unsigned char)( t >> 24 );
89  *p++ = (unsigned char)( t >> 16 );
90  *p++ = (unsigned char)( t >> 8 );
91  *p++ = (unsigned char)( t );
92 
93  SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
94 
95  if( ( ret = ssl->f_rng( ssl->p_rng, p, 28 ) ) != 0 )
96  return( ret );
97 
98  p += 28;
99 
100  memcpy( ssl->handshake->randbytes, buf + 6, 32 );
101 
102  SSL_DEBUG_BUF( 3, "client hello, random bytes", buf + 6, 32 );
103 
104  /*
105  * 38 . 38 session id length
106  * 39 . 39+n session id
107  * 40+n . 41+n ciphersuitelist length
108  * 42+n . .. ciphersuitelist
109  * .. . .. compression methods length
110  * .. . .. compression methods
111  * .. . .. extensions length
112  * .. . .. extensions
113  */
114  n = ssl->session_negotiate->length;
115 
116  if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE || n < 16 || n > 32 ||
117  ssl->handshake->resume == 0 )
118  n = 0;
119 
120  *p++ = (unsigned char) n;
121 
122  for( i = 0; i < n; i++ )
123  *p++ = ssl->session_negotiate->id[i];
124 
125  SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
126  SSL_DEBUG_BUF( 3, "client hello, session id", buf + 39, n );
127 
128  for( n = 0; ssl->ciphersuites[ssl->minor_ver][n] != 0; n++ );
129  if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE ) n++;
130  *p++ = (unsigned char)( n >> 7 );
131  *p++ = (unsigned char)( n << 1 );
132 
133  /*
134  * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
135  */
137  {
138  *p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
139  *p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO );
140  n--;
141  }
142 
143  SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites", n ) );
144 
145  for( i = 0; i < n; i++ )
146  {
147  SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %2d",
148  ssl->ciphersuites[ssl->minor_ver][i] ) );
149 
150  *p++ = (unsigned char)( ssl->ciphersuites[ssl->minor_ver][i] >> 8 );
151  *p++ = (unsigned char)( ssl->ciphersuites[ssl->minor_ver][i] );
152  }
153 
154 #if defined(POLARSSL_ZLIB_SUPPORT)
155  SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
156  SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
158 
159  *p++ = 2;
160  *p++ = SSL_COMPRESS_DEFLATE;
161  *p++ = SSL_COMPRESS_NULL;
162 #else
163  SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
164  SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d", SSL_COMPRESS_NULL ) );
165 
166  *p++ = 1;
167  *p++ = SSL_COMPRESS_NULL;
168 #endif
169 
170  if ( ssl->hostname != NULL )
171  {
172  SSL_DEBUG_MSG( 3, ( "client hello, prepping for server name extension: %s",
173  ssl->hostname ) );
174 
175  ext_len += ssl->hostname_len + 9;
176  }
177 
178  if( ssl->renegotiation == SSL_RENEGOTIATION )
179  {
180  SSL_DEBUG_MSG( 3, ( "client hello, prepping for renegotiation extension" ) );
181  ext_len += 5 + ssl->verify_data_len;
182  }
183 
184  /*
185  * Prepare signature_algorithms extension (TLS 1.2)
186  */
187  if( ssl->max_minor_ver == SSL_MINOR_VERSION_3 )
188  {
189 #if defined(POLARSSL_SHA4_C)
190  sig_alg_list[sig_alg_len++] = SSL_HASH_SHA512;
191  sig_alg_list[sig_alg_len++] = SSL_SIG_RSA;
192  sig_alg_list[sig_alg_len++] = SSL_HASH_SHA384;
193  sig_alg_list[sig_alg_len++] = SSL_SIG_RSA;
194 #endif
195 #if defined(POLARSSL_SHA2_C)
196  sig_alg_list[sig_alg_len++] = SSL_HASH_SHA256;
197  sig_alg_list[sig_alg_len++] = SSL_SIG_RSA;
198  sig_alg_list[sig_alg_len++] = SSL_HASH_SHA224;
199  sig_alg_list[sig_alg_len++] = SSL_SIG_RSA;
200 #endif
201 #if defined(POLARSSL_SHA1_C)
202  sig_alg_list[sig_alg_len++] = SSL_HASH_SHA1;
203  sig_alg_list[sig_alg_len++] = SSL_SIG_RSA;
204 #endif
205 #if defined(POLARSSL_MD5_C)
206  sig_alg_list[sig_alg_len++] = SSL_HASH_MD5;
207  sig_alg_list[sig_alg_len++] = SSL_SIG_RSA;
208 #endif
209  ext_len += 6 + sig_alg_len;
210  }
211 
212  SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
213  ext_len ) );
214 
215  if( ext_len > 0 )
216  {
217  *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
218  *p++ = (unsigned char)( ( ext_len ) & 0xFF );
219  }
220 
221  if ( ssl->hostname != NULL )
222  {
223  /*
224  * struct {
225  * NameType name_type;
226  * select (name_type) {
227  * case host_name: HostName;
228  * } name;
229  * } ServerName;
230  *
231  * enum {
232  * host_name(0), (255)
233  * } NameType;
234  *
235  * opaque HostName<1..2^16-1>;
236  *
237  * struct {
238  * ServerName server_name_list<1..2^16-1>
239  * } ServerNameList;
240  */
241  SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
242  ssl->hostname ) );
243 
244  *p++ = (unsigned char)( ( TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
245  *p++ = (unsigned char)( ( TLS_EXT_SERVERNAME ) & 0xFF );
246 
247  *p++ = (unsigned char)( ( (ssl->hostname_len + 5) >> 8 ) & 0xFF );
248  *p++ = (unsigned char)( ( (ssl->hostname_len + 5) ) & 0xFF );
249 
250  *p++ = (unsigned char)( ( (ssl->hostname_len + 3) >> 8 ) & 0xFF );
251  *p++ = (unsigned char)( ( (ssl->hostname_len + 3) ) & 0xFF );
252 
253  *p++ = (unsigned char)( ( TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
254  *p++ = (unsigned char)( ( ssl->hostname_len >> 8 ) & 0xFF );
255  *p++ = (unsigned char)( ( ssl->hostname_len ) & 0xFF );
256 
257  memcpy( p, ssl->hostname, ssl->hostname_len );
258  p += ssl->hostname_len;
259  }
260 
261  if( ssl->renegotiation == SSL_RENEGOTIATION )
262  {
263  /*
264  * Secure renegotiation
265  */
266  SSL_DEBUG_MSG( 3, ( "client hello, renegotiation info extension" ) );
267 
268  *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
269  *p++ = (unsigned char)( ( TLS_EXT_RENEGOTIATION_INFO ) & 0xFF );
270 
271  *p++ = 0x00;
272  *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
273  *p++ = ssl->verify_data_len & 0xFF;
274 
275  memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
276  p += ssl->verify_data_len;
277  }
278 
279  if( ssl->max_minor_ver == SSL_MINOR_VERSION_3 )
280  {
281  /*
282  * enum {
283  * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
284  * sha512(6), (255)
285  * } HashAlgorithm;
286  *
287  * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
288  * SignatureAlgorithm;
289  *
290  * struct {
291  * HashAlgorithm hash;
292  * SignatureAlgorithm signature;
293  * } SignatureAndHashAlgorithm;
294  *
295  * SignatureAndHashAlgorithm
296  * supported_signature_algorithms<2..2^16-2>;
297  */
298  SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
299 
300  *p++ = (unsigned char)( ( TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
301  *p++ = (unsigned char)( ( TLS_EXT_SIG_ALG ) & 0xFF );
302 
303  *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
304  *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) ) & 0xFF );
305 
306  *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
307  *p++ = (unsigned char)( ( sig_alg_len ) & 0xFF );
308 
309  memcpy( p, sig_alg_list, sig_alg_len );
310 
311  p += sig_alg_len;
312  }
313 
314  ssl->out_msglen = p - buf;
316  ssl->out_msg[0] = SSL_HS_CLIENT_HELLO;
317 
318  ssl->state++;
319 
320  if( ( ret = ssl_write_record( ssl ) ) != 0 )
321  {
322  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
323  return( ret );
324  }
325 
326  SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
327 
328  return( 0 );
329 }
330 
331 static int ssl_parse_renegotiation_info( ssl_context *ssl,
332  unsigned char *buf,
333  size_t len )
334 {
335  int ret;
336 
338  {
339  if( len != 1 || buf[0] != 0x0 )
340  {
341  SSL_DEBUG_MSG( 1, ( "non-zero length renegotiated connection field" ) );
342 
343  if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
344  return( ret );
345 
347  }
348 
350  }
351  else
352  {
353  /* Check verify-data in constant-time. The length OTOH is no secret */
354  if( len != 1 + ssl->verify_data_len * 2 ||
355  buf[0] != ssl->verify_data_len * 2 ||
356  safer_memcmp( buf + 1,
357  ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
358  safer_memcmp( buf + 1 + ssl->verify_data_len,
359  ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
360  {
361  SSL_DEBUG_MSG( 1, ( "non-matching renegotiated connection field" ) );
362 
363  if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
364  return( ret );
365 
367  }
368  }
369 
370  return( 0 );
371 }
372 
373 static int ssl_parse_server_hello( ssl_context *ssl )
374 {
375 #if defined(POLARSSL_DEBUG_C)
376  time_t t;
377 #endif
378  int ret, i, comp;
379  size_t n;
380  size_t ext_len;
381  unsigned char *buf, *ext;
382  int renegotiation_info_seen = 0;
383  int handshake_failure = 0;
384 
385  SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
386 
387  /*
388  * 0 . 0 handshake type
389  * 1 . 3 handshake length
390  * 4 . 5 protocol version
391  * 6 . 9 UNIX time()
392  * 10 . 37 random bytes
393  */
394  buf = ssl->in_msg;
395 
396  if( ( ret = ssl_read_record( ssl ) ) != 0 )
397  {
398  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
399  return( ret );
400  }
401 
402  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
403  {
404  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
406  }
407 
408  SSL_DEBUG_MSG( 3, ( "server hello, chosen version: [%d:%d]",
409  buf[4], buf[5] ) );
410 
411  if( ssl->in_hslen < 42 ||
412  buf[0] != SSL_HS_SERVER_HELLO ||
413  buf[4] != SSL_MAJOR_VERSION_3 )
414  {
415  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
417  }
418 
419  if( buf[5] > ssl->max_minor_ver )
420  {
421  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
423  }
424 
425  ssl->minor_ver = buf[5];
426 
427  if( ssl->minor_ver < ssl->min_minor_ver )
428  {
429  SSL_DEBUG_MSG( 1, ( "server only supports ssl smaller than minimum"
430  " [%d:%d] < [%d:%d]", ssl->major_ver, ssl->minor_ver,
431  buf[4], buf[5] ) );
432 
435 
437  }
438 
439 #if defined(POLARSSL_DEBUG_C)
440  t = ( (time_t) buf[6] << 24 )
441  | ( (time_t) buf[7] << 16 )
442  | ( (time_t) buf[8] << 8 )
443  | ( (time_t) buf[9] );
444 #endif
445 
446  memcpy( ssl->handshake->randbytes + 32, buf + 6, 32 );
447 
448  n = buf[38];
449 
450  SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu", t ) );
451  SSL_DEBUG_BUF( 3, "server hello, random bytes", buf + 6, 32 );
452 
453  if( n > 32 )
454  {
455  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
457  }
458 
459  /*
460  * 38 . 38 session id length
461  * 39 . 38+n session id
462  * 39+n . 40+n chosen ciphersuite
463  * 41+n . 41+n chosen compression alg.
464  * 42+n . 43+n extensions length
465  * 44+n . 44+n+m extensions
466  */
467  if( ssl->in_hslen > 43 + n )
468  {
469  ext_len = ( ( buf[42 + n] << 8 )
470  | ( buf[43 + n] ) );
471 
472  if( ( ext_len > 0 && ext_len < 4 ) ||
473  ssl->in_hslen != 44 + n + ext_len )
474  {
475  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
477  }
478  }
479  else if( ssl->in_hslen == 42 + n )
480  {
481  ext_len = 0;
482  }
483  else
484  {
485  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
487  }
488 
489  i = ( buf[39 + n] << 8 ) | buf[40 + n];
490  comp = buf[41 + n];
491 
492  /*
493  * Initialize update checksum functions
494  */
495  ssl_optimize_checksum( ssl, i );
496 
497  SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
498  SSL_DEBUG_BUF( 3, "server hello, session id", buf + 39, n );
499 
500  /*
501  * Check if the session can be resumed
502  */
503  if( ssl->renegotiation != SSL_INITIAL_HANDSHAKE ||
504  ssl->handshake->resume == 0 || n == 0 ||
505  ssl->session_negotiate->ciphersuite != i ||
506  ssl->session_negotiate->compression != comp ||
507  ssl->session_negotiate->length != n ||
508  memcmp( ssl->session_negotiate->id, buf + 39, n ) != 0 )
509  {
510  ssl->state++;
511  ssl->handshake->resume = 0;
512  ssl->session_negotiate->start = time( NULL );
513  ssl->session_negotiate->ciphersuite = i;
514  ssl->session_negotiate->compression = comp;
515  ssl->session_negotiate->length = n;
516  memcpy( ssl->session_negotiate->id, buf + 39, n );
517  }
518  else
519  {
521 
522  if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
523  {
524  SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
525  return( ret );
526  }
527  }
528 
529  SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
530  ssl->handshake->resume ? "a" : "no" ) );
531 
532  SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %d", i ) );
533  SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[41 + n] ) );
534 
535  i = 0;
536  while( 1 )
537  {
538  if( ssl->ciphersuites[ssl->minor_ver][i] == 0 )
539  {
540  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
542  }
543 
544  if( ssl->ciphersuites[ssl->minor_ver][i++] == ssl->session_negotiate->ciphersuite )
545  break;
546  }
547 
548  if( comp != SSL_COMPRESS_NULL
549 #if defined(POLARSSL_ZLIB_SUPPORT)
550  && comp != SSL_COMPRESS_DEFLATE
551 #endif
552  )
553  {
554  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
556  }
557  ssl->session_negotiate->compression = comp;
558 
559  ext = buf + 44 + n;
560 
561  while( ext_len )
562  {
563  unsigned int ext_id = ( ( ext[0] << 8 )
564  | ( ext[1] ) );
565  unsigned int ext_size = ( ( ext[2] << 8 )
566  | ( ext[3] ) );
567 
568  if( ext_size + 4 > ext_len )
569  {
570  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
572  }
573 
574  switch( ext_id )
575  {
577  SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
578  renegotiation_info_seen = 1;
579 
580  if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4, ext_size ) ) != 0 )
581  return( ret );
582 
583  break;
584 
585  default:
586  SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
587  ext_id ) );
588  }
589 
590  ext_len -= 4 + ext_size;
591  ext += 4 + ext_size;
592 
593  if( ext_len > 0 && ext_len < 4 )
594  {
595  SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
597  }
598  }
599 
600  /*
601  * Renegotiation security checks
602  */
605  {
606  SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
607  handshake_failure = 1;
608  }
609  else if( ssl->renegotiation == SSL_RENEGOTIATION &&
611  renegotiation_info_seen == 0 )
612  {
613  SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
614  handshake_failure = 1;
615  }
616  else if( ssl->renegotiation == SSL_RENEGOTIATION &&
619  {
620  SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
621  handshake_failure = 1;
622  }
623  else if( ssl->renegotiation == SSL_RENEGOTIATION &&
625  renegotiation_info_seen == 1 )
626  {
627  SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
628  handshake_failure = 1;
629  }
630 
631  if( handshake_failure == 1 )
632  {
633  if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
634  return( ret );
635 
637  }
638 
639  SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
640 
641  return( 0 );
642 }
643 
644 static int ssl_parse_server_key_exchange( ssl_context *ssl )
645 {
646 #if defined(POLARSSL_DHM_C)
647  int ret;
648  size_t n;
649  unsigned char *p, *end;
650  unsigned char hash[64];
653  int hash_id = SIG_RSA_RAW;
654  unsigned int hashlen = 0;
655 #endif
656 
657  SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
658 
671  {
672  SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
673  ssl->state++;
674  return( 0 );
675  }
676 
677 #if !defined(POLARSSL_DHM_C)
678  SSL_DEBUG_MSG( 1, ( "support for dhm in not available" ) );
680 #else
681  if( ( ret = ssl_read_record( ssl ) ) != 0 )
682  {
683  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
684  return( ret );
685  }
686 
687  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
688  {
689  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
691  }
692 
693  if( ssl->in_msg[0] != SSL_HS_SERVER_KEY_EXCHANGE )
694  {
695  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
697  }
698 
699  SSL_DEBUG_BUF( 3, "server key exchange", ssl->in_msg + 4, ssl->in_hslen - 4 );
700 
701  /*
702  * Ephemeral DH parameters:
703  *
704  * struct {
705  * opaque dh_p<1..2^16-1>;
706  * opaque dh_g<1..2^16-1>;
707  * opaque dh_Ys<1..2^16-1>;
708  * } ServerDHParams;
709  */
710  p = ssl->in_msg + 4;
711  end = ssl->in_msg + ssl->in_hslen;
712 
713  if( ( ret = dhm_read_params( &ssl->handshake->dhm_ctx, &p, end ) ) != 0 )
714  {
715  SSL_DEBUG_MSG( 2, ( "DHM Read Params returned -0x%x", -ret ) );
716  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
718  }
719 
720  if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
721  {
722  if( p[1] != SSL_SIG_RSA )
723  {
724  SSL_DEBUG_MSG( 2, ( "server used unsupported SignatureAlgorithm %d", p[1] ) );
725  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
727  }
728 
729  switch( p[0] )
730  {
731 #if defined(POLARSSL_MD5_C)
732  case SSL_HASH_MD5:
733  hash_id = SIG_RSA_MD5;
734  break;
735 #endif
736 #if defined(POLARSSL_SHA1_C)
737  case SSL_HASH_SHA1:
738  hash_id = SIG_RSA_SHA1;
739  break;
740 #endif
741 #if defined(POLARSSL_SHA2_C)
742  case SSL_HASH_SHA224:
743  hash_id = SIG_RSA_SHA224;
744  break;
745  case SSL_HASH_SHA256:
746  hash_id = SIG_RSA_SHA256;
747  break;
748 #endif
749 #if defined(POLARSSL_SHA4_C)
750  case SSL_HASH_SHA384:
751  hash_id = SIG_RSA_SHA384;
752  break;
753  case SSL_HASH_SHA512:
754  hash_id = SIG_RSA_SHA512;
755  break;
756 #endif
757  default:
758  SSL_DEBUG_MSG( 2, ( "Server used unsupported HashAlgorithm %d", p[0] ) );
759  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
761  }
762 
763  SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", p[1] ) );
764  SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", p[0] ) );
765  p += 2;
766  }
767 
768  n = ( p[0] << 8 ) | p[1];
769  p += 2;
770 
771  if( end != p + n )
772  {
773  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
775  }
776 
777  if( (unsigned int)( end - p ) !=
779  {
780  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
782  }
783 
784  if( ssl->handshake->dhm_ctx.len < 64 || ssl->handshake->dhm_ctx.len > 512 )
785  {
786  SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
788  }
789 
790  SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P );
791  SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G );
792  SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
793 
794  if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
795  {
796  /*
797  * digitally-signed struct {
798  * opaque md5_hash[16];
799  * opaque sha_hash[20];
800  * };
801  *
802  * md5_hash
803  * MD5(ClientHello.random + ServerHello.random
804  * + ServerParams);
805  * sha_hash
806  * SHA(ClientHello.random + ServerHello.random
807  * + ServerParams);
808  */
809  n = ssl->in_hslen - ( end - p ) - 6;
810 
811  md5_starts( &md5 );
812  md5_update( &md5, ssl->handshake->randbytes, 64 );
813  md5_update( &md5, ssl->in_msg + 4, n );
814  md5_finish( &md5, hash );
815 
816  sha1_starts( &sha1 );
817  sha1_update( &sha1, ssl->handshake->randbytes, 64 );
818  sha1_update( &sha1, ssl->in_msg + 4, n );
819  sha1_finish( &sha1, hash + 16 );
820 
821  hash_id = SIG_RSA_RAW;
822  hashlen = 36;
823  }
824  else
825  {
827 #if defined(POLARSSL_SHA4_C)
829 #endif
830 
831  n = ssl->in_hslen - ( end - p ) - 8;
832 
833  /*
834  * digitally-signed struct {
835  * opaque client_random[32];
836  * opaque server_random[32];
837  * ServerDHParams params;
838  * };
839  */
840  switch( hash_id )
841  {
842 #if defined(POLARSSL_MD5_C)
843  case SIG_RSA_MD5:
844  md5_starts( &md5 );
845  md5_update( &md5, ssl->handshake->randbytes, 64 );
846  md5_update( &md5, ssl->in_msg + 4, n );
847  md5_finish( &md5, hash );
848  hashlen = 16;
849  break;
850 #endif
851 #if defined(POLARSSL_SHA1_C)
852  case SIG_RSA_SHA1:
853  sha1_starts( &sha1 );
854  sha1_update( &sha1, ssl->handshake->randbytes, 64 );
855  sha1_update( &sha1, ssl->in_msg + 4, n );
856  sha1_finish( &sha1, hash );
857  hashlen = 20;
858  break;
859 #endif
860 #if defined(POLARSSL_SHA2_C)
861  case SIG_RSA_SHA224:
862  sha2_starts( &sha2, 1 );
863  sha2_update( &sha2, ssl->handshake->randbytes, 64 );
864  sha2_update( &sha2, ssl->in_msg + 4, n );
865  sha2_finish( &sha2, hash );
866  hashlen = 28;
867  break;
868  case SIG_RSA_SHA256:
869  sha2_starts( &sha2, 0 );
870  sha2_update( &sha2, ssl->handshake->randbytes, 64 );
871  sha2_update( &sha2, ssl->in_msg + 4, n );
872  sha2_finish( &sha2, hash );
873  hashlen = 32;
874  break;
875 #endif
876 #if defined(POLARSSL_SHA4_C)
877  case SIG_RSA_SHA384:
878  sha4_starts( &sha4, 1 );
879  sha4_update( &sha4, ssl->handshake->randbytes, 64 );
880  sha4_update( &sha4, ssl->in_msg + 4, n );
881  sha4_finish( &sha4, hash );
882  hashlen = 48;
883  break;
884  case SIG_RSA_SHA512:
885  sha4_starts( &sha4, 0 );
886  sha4_update( &sha4, ssl->handshake->randbytes, 64 );
887  sha4_update( &sha4, ssl->in_msg + 4, n );
888  sha4_finish( &sha4, hash );
889  hashlen = 64;
890  break;
891 #endif
892  }
893  }
894 
895  SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
896 
897  if( ( ret = rsa_pkcs1_verify( &ssl->session_negotiate->peer_cert->rsa,
898  NULL, NULL, RSA_PUBLIC,
899  hash_id, hashlen, hash, p ) ) != 0 )
900  {
901  SSL_DEBUG_RET( 1, "rsa_pkcs1_verify", ret );
902  return( ret );
903  }
904 
905  ssl->state++;
906 
907  SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
908 
909  return( 0 );
910 #endif
911 }
912 
913 static int ssl_parse_certificate_request( ssl_context *ssl )
914 {
915  int ret;
916  unsigned char *buf, *p;
917  size_t n = 0, m = 0;
918  size_t cert_type_len = 0, sig_alg_len = 0, dn_len = 0;
919 
920  SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
921 
922  /*
923  * 0 . 0 handshake type
924  * 1 . 3 handshake length
925  * 4 . 4 cert type count
926  * 5 .. m-1 cert types
927  * m .. m+1 sig alg length (TLS 1.2 only)
928  * m+1 .. n-1 SignatureAndHashAlgorithms (TLS 1.2 only)
929  * n .. n+1 length of all DNs
930  * n+2 .. n+3 length of DN 1
931  * n+4 .. ... Distinguished Name #1
932  * ... .. ... length of DN 2, etc.
933  */
934  if( ( ret = ssl_read_record( ssl ) ) != 0 )
935  {
936  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
937  return( ret );
938  }
939 
940  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
941  {
942  SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
944  }
945 
946  ssl->client_auth = 0;
947  ssl->state++;
948 
949  if( ssl->in_msg[0] == SSL_HS_CERTIFICATE_REQUEST )
950  ssl->client_auth++;
951 
952  SSL_DEBUG_MSG( 3, ( "got %s certificate request",
953  ssl->client_auth ? "a" : "no" ) );
954 
955  if( ssl->client_auth == 0 )
956  goto exit;
957 
958  // TODO: handshake_failure alert for an anonymous server to request
959  // client authentication
960 
961  buf = ssl->in_msg;
962 
963  // Retrieve cert types
964  //
965  cert_type_len = buf[4];
966  n = cert_type_len;
967 
968  if( ssl->in_hslen < 6 + n )
969  {
970  SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
972  }
973 
974  p = buf + 5;
975  while( cert_type_len > 0 )
976  {
977  if( *p == SSL_CERT_TYPE_RSA_SIGN )
978  {
980  break;
981  }
982 
983  cert_type_len--;
984  p++;
985  }
986 
987  if( ssl->handshake->cert_type == 0 )
988  {
989  SSL_DEBUG_MSG( 1, ( "no known cert_type provided" ) );
991  }
992 
993  if( ssl->minor_ver == SSL_MINOR_VERSION_3 )
994  {
995  sig_alg_len = ( ( buf[5 + n] << 8 )
996  | ( buf[6 + n] ) );
997 
998  p = buf + 7 + n;
999  m += 2;
1000  n += sig_alg_len;
1001 
1002  if( ssl->in_hslen < 6 + n )
1003  {
1004  SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
1006  }
1007  }
1008 
1009  dn_len = ( ( buf[5 + m + n] << 8 )
1010  | ( buf[6 + m + n] ) );
1011 
1012  n += dn_len;
1013  if( ssl->in_hslen != 7 + m + n )
1014  {
1015  SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
1017  }
1018 
1019 exit:
1020  SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
1021 
1022  return( 0 );
1023 }
1024 
1025 static int ssl_parse_server_hello_done( ssl_context *ssl )
1026 {
1027  int ret;
1028 
1029  SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
1030 
1031  if( ssl->client_auth != 0 )
1032  {
1033  if( ( ret = ssl_read_record( ssl ) ) != 0 )
1034  {
1035  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
1036  return( ret );
1037  }
1038 
1039  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
1040  {
1041  SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
1043  }
1044  }
1045 
1046  if( ssl->in_hslen != 4 ||
1047  ssl->in_msg[0] != SSL_HS_SERVER_HELLO_DONE )
1048  {
1049  SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
1051  }
1052 
1053  ssl->state++;
1054 
1055  SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
1056 
1057  return( 0 );
1058 }
1059 
1060 static int ssl_write_client_key_exchange( ssl_context *ssl )
1061 {
1062  int ret;
1063  size_t i, n;
1064 
1065  SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
1066 
1079  {
1080 #if !defined(POLARSSL_DHM_C)
1081  SSL_DEBUG_MSG( 1, ( "support for dhm in not available" ) );
1083 #else
1084  /*
1085  * DHM key exchange -- send G^X mod P
1086  */
1087  n = ssl->handshake->dhm_ctx.len;
1088 
1089  ssl->out_msg[4] = (unsigned char)( n >> 8 );
1090  ssl->out_msg[5] = (unsigned char)( n );
1091  i = 6;
1092 
1093  ret = dhm_make_public( &ssl->handshake->dhm_ctx,
1094  (int) mpi_size( &ssl->handshake->dhm_ctx.P ),
1095  &ssl->out_msg[i], n,
1096  ssl->f_rng, ssl->p_rng );
1097  if( ret != 0 )
1098  {
1099  SSL_DEBUG_RET( 1, "dhm_make_public", ret );
1100  return( ret );
1101  }
1102 
1103  SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X );
1104  SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
1105 
1106  ssl->handshake->pmslen = ssl->handshake->dhm_ctx.len;
1107 
1108  if( ( ret = dhm_calc_secret( &ssl->handshake->dhm_ctx,
1109  ssl->handshake->premaster,
1110  &ssl->handshake->pmslen ) ) != 0 )
1111  {
1112  SSL_DEBUG_RET( 1, "dhm_calc_secret", ret );
1113  return( ret );
1114  }
1115 
1116  SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K );
1117 #endif
1118  }
1119  else
1120  {
1121  /*
1122  * RSA key exchange -- send rsa_public(pkcs1 v1.5(premaster))
1123  */
1124  ssl->handshake->premaster[0] = (unsigned char) ssl->max_major_ver;
1125  ssl->handshake->premaster[1] = (unsigned char) ssl->max_minor_ver;
1126  ssl->handshake->pmslen = 48;
1127 
1128  ret = ssl->f_rng( ssl->p_rng, ssl->handshake->premaster + 2,
1129  ssl->handshake->pmslen - 2 );
1130  if( ret != 0 )
1131  return( ret );
1132 
1133  i = 4;
1134  n = ssl->session_negotiate->peer_cert->rsa.len;
1135 
1136  if( ssl->minor_ver != SSL_MINOR_VERSION_0 )
1137  {
1138  i += 2;
1139  ssl->out_msg[4] = (unsigned char)( n >> 8 );
1140  ssl->out_msg[5] = (unsigned char)( n );
1141  }
1142 
1144  ssl->f_rng, ssl->p_rng,
1145  RSA_PUBLIC,
1146  ssl->handshake->pmslen,
1147  ssl->handshake->premaster,
1148  ssl->out_msg + i );
1149  if( ret != 0 )
1150  {
1151  SSL_DEBUG_RET( 1, "rsa_pkcs1_encrypt", ret );
1152  return( ret );
1153  }
1154  }
1155 
1156  if( ( ret = ssl_derive_keys( ssl ) ) != 0 )
1157  {
1158  SSL_DEBUG_RET( 1, "ssl_derive_keys", ret );
1159  return( ret );
1160  }
1161 
1162  ssl->out_msglen = i + n;
1165 
1166  ssl->state++;
1167 
1168  if( ( ret = ssl_write_record( ssl ) ) != 0 )
1169  {
1170  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
1171  return( ret );
1172  }
1173 
1174  SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
1175 
1176  return( 0 );
1177 }
1178 
1179 static int ssl_write_certificate_verify( ssl_context *ssl )
1180 {
1181  int ret = 0;
1182  size_t n = 0, offset = 0;
1183  unsigned char hash[48];
1184  int hash_id = SIG_RSA_RAW;
1185  unsigned int hashlen = 36;
1186 
1187  SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
1188 
1189  if( ssl->client_auth == 0 || ssl->own_cert == NULL )
1190  {
1191  SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
1192  ssl->state++;
1193  return( 0 );
1194  }
1195 
1196  if( ssl->rsa_key == NULL )
1197  {
1198  SSL_DEBUG_MSG( 1, ( "got no private key" ) );
1200  }
1201 
1202  /*
1203  * Make an RSA signature of the handshake digests
1204  */
1205  ssl->handshake->calc_verify( ssl, hash );
1206 
1207  if( ssl->minor_ver != SSL_MINOR_VERSION_3 )
1208  {
1209  /*
1210  * digitally-signed struct {
1211  * opaque md5_hash[16];
1212  * opaque sha_hash[20];
1213  * };
1214  *
1215  * md5_hash
1216  * MD5(handshake_messages);
1217  *
1218  * sha_hash
1219  * SHA(handshake_messages);
1220  */
1221  hashlen = 36;
1222  hash_id = SIG_RSA_RAW;
1223  }
1224  else
1225  {
1226  /*
1227  * digitally-signed struct {
1228  * opaque handshake_messages[handshake_messages_length];
1229  * };
1230  *
1231  * Taking shortcut here. We assume that the server always allows the
1232  * PRF Hash function and has sent it in the allowed signature
1233  * algorithms list received in the Certificate Request message.
1234  *
1235  * Until we encounter a server that does not, we will take this
1236  * shortcut.
1237  *
1238  * Reason: Otherwise we should have running hashes for SHA512 and SHA224
1239  * in order to satisfy 'weird' needs from the server side.
1240  */
1243  {
1244  hash_id = SIG_RSA_SHA384;
1245  hashlen = 48;
1246  ssl->out_msg[4] = SSL_HASH_SHA384;
1247  ssl->out_msg[5] = SSL_SIG_RSA;
1248  }
1249  else
1250  {
1251  hash_id = SIG_RSA_SHA256;
1252  hashlen = 32;
1253  ssl->out_msg[4] = SSL_HASH_SHA256;
1254  ssl->out_msg[5] = SSL_SIG_RSA;
1255  }
1256 
1257  offset = 2;
1258  }
1259 
1260  if ( ssl->rsa_key )
1261  n = ssl->rsa_key_len ( ssl->rsa_key );
1262 
1263  ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
1264  ssl->out_msg[5 + offset] = (unsigned char)( n );
1265 
1266  if( ssl->rsa_key )
1267  {
1268  ret = ssl->rsa_sign( ssl->rsa_key, ssl->f_rng, ssl->p_rng,
1269  RSA_PRIVATE, hash_id,
1270  hashlen, hash, ssl->out_msg + 6 + offset );
1271  }
1272 
1273  if (ret != 0)
1274  {
1275  SSL_DEBUG_RET( 1, "pkcs1_sign", ret );
1276  return( ret );
1277  }
1278 
1279  ssl->out_msglen = 6 + n + offset;
1282 
1283  ssl->state++;
1284 
1285  if( ( ret = ssl_write_record( ssl ) ) != 0 )
1286  {
1287  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
1288  return( ret );
1289  }
1290 
1291  SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
1292 
1293  return( 0 );
1294 }
1295 
1296 /*
1297  * SSL handshake -- client side -- single step
1298  */
1300 {
1301  int ret = 0;
1302 
1303  if( ssl->state == SSL_HANDSHAKE_OVER )
1305 
1306  SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
1307 
1308  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
1309  return( ret );
1310 
1311  switch( ssl->state )
1312  {
1313  case SSL_HELLO_REQUEST:
1314  ssl->state = SSL_CLIENT_HELLO;
1315  break;
1316 
1317  /*
1318  * ==> ClientHello
1319  */
1320  case SSL_CLIENT_HELLO:
1321  ret = ssl_write_client_hello( ssl );
1322  break;
1323 
1324  /*
1325  * <== ServerHello
1326  * Certificate
1327  * ( ServerKeyExchange )
1328  * ( CertificateRequest )
1329  * ServerHelloDone
1330  */
1331  case SSL_SERVER_HELLO:
1332  ret = ssl_parse_server_hello( ssl );
1333  break;
1334 
1336  ret = ssl_parse_certificate( ssl );
1337  break;
1338 
1340  ret = ssl_parse_server_key_exchange( ssl );
1341  break;
1342 
1344  ret = ssl_parse_certificate_request( ssl );
1345  break;
1346 
1347  case SSL_SERVER_HELLO_DONE:
1348  ret = ssl_parse_server_hello_done( ssl );
1349  break;
1350 
1351  /*
1352  * ==> ( Certificate/Alert )
1353  * ClientKeyExchange
1354  * ( CertificateVerify )
1355  * ChangeCipherSpec
1356  * Finished
1357  */
1359  ret = ssl_write_certificate( ssl );
1360  break;
1361 
1363  ret = ssl_write_client_key_exchange( ssl );
1364  break;
1365 
1367  ret = ssl_write_certificate_verify( ssl );
1368  break;
1369 
1371  ret = ssl_write_change_cipher_spec( ssl );
1372  break;
1373 
1374  case SSL_CLIENT_FINISHED:
1375  ret = ssl_write_finished( ssl );
1376  break;
1377 
1378  /*
1379  * <== ChangeCipherSpec
1380  * Finished
1381  */
1383  ret = ssl_parse_change_cipher_spec( ssl );
1384  break;
1385 
1386  case SSL_SERVER_FINISHED:
1387  ret = ssl_parse_finished( ssl );
1388  break;
1389 
1390  case SSL_FLUSH_BUFFERS:
1391  SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
1392  ssl->state = SSL_HANDSHAKE_WRAPUP;
1393  break;
1394 
1395  case SSL_HANDSHAKE_WRAPUP:
1396  ssl_handshake_wrapup( ssl );
1397  break;
1398 
1399  default:
1400  SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
1402  }
1403 
1404  return( ret );
1405 }
1406 #endif
#define SSL_HS_CLIENT_KEY_EXCHANGE
Definition: ssl.h:256
unsigned char * hostname
Definition: ssl.h:516
#define SSL_ALERT_LEVEL_FATAL
Definition: ssl.h:219
#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS 1.2.
Definition: ssl.h:174
size_t length
Definition: ssl.h:323
#define SIG_RSA_MD5
Definition: rsa.h:51
int ciphersuite
Definition: ssl.h:321
mpi P
Definition: dhm.h:139
size_t in_hslen
Definition: ssl.h:470
int ssl_send_alert_message(ssl_context *ssl, unsigned char level, unsigned char message)
Send an alert message.
int(* f_rng)(void *, unsigned char *, size_t)
Definition: ssl.h:420
#define TLS_EXT_SERVERNAME_HOSTNAME
Definition: ssl.h:263
#define POLARSSL_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE
Processing of the ServerKeyExchange handshake message failed.
Definition: ssl.h:81
SHA-256 context structure.
Definition: sha2.h:50
int major_ver
Definition: ssl.h:409
#define SSL_DEBUG_RET(level, text, ret)
Definition: debug.h:38
SHA-1 context structure.
Definition: sha1.h:50
int compression
Definition: ssl.h:322
#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO_DONE
Processing of the ServerHelloDone handshake message failed.
Definition: ssl.h:82
const int ** ciphersuites
Definition: ssl.h:506
int state
Definition: ssl.h:406
char peer_verify_data[36]
Definition: ssl.h:526
#define SSL_HS_CLIENT_HELLO
Definition: ssl.h:249
Debug functions.
void sha1(const unsigned char *input, size_t ilen, unsigned char output[20])
Output = SHA-1( input buffer )
void(* calc_verify)(ssl_context *, unsigned char *)
Definition: ssl.h:386
void sha1_finish(sha1_context *ctx, unsigned char output[20])
SHA-1 final digest.
#define SSL_HS_SERVER_KEY_EXCHANGE
Definition: ssl.h:252
x509_cert * peer_cert
Definition: ssl.h:326
#define POLARSSL_ERR_SSL_BAD_HS_SERVER_HELLO
Processing of the ServerHello handshake message failed.
Definition: ssl.h:78
#define SSL_HASH_SHA1
Definition: ssl.h:197
ssl_session * session_negotiate
Definition: ssl.h:445
int ssl_parse_certificate(ssl_context *ssl)
size_t out_msglen
Definition: ssl.h:481
mpi GX
Definition: dhm.h:142
#define SSL_SIG_RSA
Definition: ssl.h:203
int ssl_parse_finished(ssl_context *ssl)
void * p_rng
Definition: ssl.h:429
rsa_sign_func rsa_sign
Definition: ssl.h:489
#define RSA_PUBLIC
Definition: rsa.h:58
#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
TLS 1.2.
Definition: ssl.h:181
#define SSL_RENEGOTIATION
Definition: ssl.h:115
int ssl_write_finished(ssl_context *ssl)
Configuration options (set of defines)
#define SSL_DEBUG_MSG(level, args)
Definition: debug.h:35
mpi X
Definition: dhm.h:141
void ssl_handshake_wrapup(ssl_context *ssl)
char own_verify_data[36]
Definition: ssl.h:525
#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Definition: ssl.h:188
void md5_finish(md5_context *ctx, unsigned char output[16])
MD5 final digest.
int secure_renegotiation
Definition: ssl.h:522
time_t start
Definition: ssl.h:320
#define SSL_HASH_MD5
Definition: ssl.h:196
#define SSL_LEGACY_NO_RENEGOTIATION
Definition: ssl.h:123
#define SSL_MAJOR_VERSION_3
Definition: ssl.h:99
#define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
Definition: ssl.h:165
unsigned char id[32]
Definition: ssl.h:324
size_t len
Definition: dhm.h:138
int max_major_ver
Definition: ssl.h:412
size_t len
Definition: rsa.h:138
#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
Definition: ssl.h:187
int max_minor_ver
Definition: ssl.h:413
int dhm_read_params(dhm_context *ctx, unsigned char **p, const unsigned char *end)
Parse the ServerKeyExchange parameters.
unsigned char premaster[POLARSSL_MPI_MAX_SIZE]
Definition: ssl.h:395
void sha4_starts(sha4_context *ctx, int is384)
SHA-512 context setup.
#define TLS_EXT_SIG_ALG
Definition: ssl.h:265
#define SSL_CERT_TYPE_RSA_SIGN
Definition: ssl.h:208
#define SSL_HS_CERTIFICATE_REQUEST
Definition: ssl.h:253
#define TLS_RSA_WITH_AES_256_GCM_SHA384
Definition: ssl.h:186
ssl_handshake_params * handshake
Definition: ssl.h:447
#define SSL_MSG_HANDSHAKE
Definition: ssl.h:215
int ssl_write_certificate(ssl_context *ssl)
#define SSL_ALERT_MSG_PROTOCOL_VERSION
Definition: ssl.h:240
#define POLARSSL_ERR_SSL_NO_RNG
No RNG was provided to the SSL module.
Definition: ssl.h:67
int rsa_pkcs1_encrypt(rsa_context *ctx, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng, int mode, size_t ilen, const unsigned char *input, unsigned char *output)
Generic wrapper to perform a PKCS#1 encryption using the mode from the context.
#define SIG_RSA_SHA512
Definition: rsa.h:56
SHA-384 and SHA-512 cryptographic hash function.
rsa_key_len_func rsa_key_len
Definition: ssl.h:490
int in_msgtype
Definition: ssl.h:466
#define RSA_PRIVATE
Definition: rsa.h:59
size_t verify_data_len
Definition: ssl.h:524
#define SIG_RSA_SHA1
Definition: rsa.h:52
mpi G
Definition: dhm.h:140
int min_minor_ver
Definition: ssl.h:415
unsigned char * out_msg
Definition: ssl.h:478
#define SSL_MINOR_VERSION_0
Definition: ssl.h:100
int client_auth
Definition: ssl.h:502
#define POLARSSL_ERR_SSL_BAD_HS_PROTOCOL_VERSION
Handshake protocol not within min/max boundaries.
Definition: ssl.h:93
#define SSL_HS_SERVER_HELLO_DONE
Definition: ssl.h:254
#define TLS_DHE_RSA_WITH_DES_CBC_SHA
Weak! Not in TLS 1.2.
Definition: ssl.h:159
int ssl_handshake_client_step(ssl_context *ssl)
void sha4_update(sha4_context *ctx, const unsigned char *input, size_t ilen)
SHA-512 process buffer.
#define POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE
An unexpected message was received from our peer.
Definition: ssl.h:73
#define TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
Definition: ssl.h:177
mpi GY
Definition: dhm.h:143
void md5_starts(md5_context *ctx)
MD5 context setup.
int ssl_flush_output(ssl_context *ssl)
#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Definition: ssl.h:170
#define SSL_HS_SERVER_HELLO
Definition: ssl.h:250
#define SSL_COMPRESS_DEFLATE
Definition: ssl.h:108
unsigned char * in_msg
Definition: ssl.h:463
#define SSL_MINOR_VERSION_3
Definition: ssl.h:103
mpi K
Definition: dhm.h:144
MD5 context structure.
Definition: md5.h:50
#define TLS_EXT_RENEGOTIATION_INFO
Definition: ssl.h:267
#define POLARSSL_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST
Processing of the CertificateRequest handshake message failed.
Definition: ssl.h:80
int ssl_parse_change_cipher_spec(ssl_context *ssl)
size_t hostname_len
Definition: ssl.h:517
void sha1_starts(sha1_context *ctx)
SHA-1 context setup.
int minor_ver
Definition: ssl.h:410
#define SSL_EMPTY_RENEGOTIATION_INFO
renegotiation info ext
Definition: ssl.h:190
#define SSL_HASH_SHA256
Definition: ssl.h:199
#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS 1.2.
Definition: ssl.h:173
#define SSL_DEBUG_BUF(level, text, buf, len)
Definition: debug.h:41
#define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED
The own private key is not set, but needed.
Definition: ssl.h:71
#define SSL_INITIAL_HANDSHAKE
Definition: ssl.h:114
#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
Definition: ssl.h:179
void sha2_update(sha2_context *ctx, const unsigned char *input, size_t ilen)
SHA-256 process buffer.
int allow_legacy_renegotiation
Definition: ssl.h:505
#define SSL_COMPRESS_NULL
Definition: ssl.h:107
int dhm_calc_secret(dhm_context *ctx, unsigned char *output, size_t *olen)
Derive and export the shared secret (G^Y)^X mod P.
int ssl_read_record(ssl_context *ssl)
void sha4(const unsigned char *input, size_t ilen, unsigned char output[64], int is384)
Output = SHA-512( input buffer )
int out_msgtype
Definition: ssl.h:480
#define SIG_RSA_SHA224
Definition: rsa.h:53
#define SSL_HS_CERTIFICATE_VERIFY
Definition: ssl.h:255
#define TLS_EXT_SERVERNAME
Definition: ssl.h:262
int dhm_make_public(dhm_context *ctx, int x_size, unsigned char *output, size_t olen, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng)
Create own private value X and export G^X.
#define SSL_DEBUG_MPI(level, text, X)
Definition: debug.h:44
size_t mpi_size(const mpi *X)
Return the total size in bytes.
#define SSL_LEGACY_BREAK_HANDSHAKE
Definition: ssl.h:125
x509_cert * own_cert
Definition: ssl.h:492
int min_major_ver
Definition: ssl.h:414
SHA-512 context structure.
Definition: sha4.h:51
#define SSL_LEGACY_RENEGOTIATION
Definition: ssl.h:117
#define SSL_HASH_SHA224
Definition: ssl.h:198
#define SSL_SECURE_RENEGOTIATION
Definition: ssl.h:118
#define SIG_RSA_SHA256
Definition: rsa.h:54
SSL/TLS functions.
void sha1_update(sha1_context *ctx, const unsigned char *input, size_t ilen)
SHA-1 process buffer.
#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA
Definition: ssl.h:168
void md5_update(md5_context *ctx, const unsigned char *input, size_t ilen)
MD5 process buffer.
int ssl_write_change_cipher_spec(ssl_context *ssl)
void sha2(const unsigned char *input, size_t ilen, unsigned char output[32], int is224)
Output = SHA-256( input buffer )
void * rsa_key
Definition: ssl.h:487
int ssl_derive_keys(ssl_context *ssl)
void sha4_finish(sha4_context *ctx, unsigned char output[64])
SHA-512 final digest.
#define SIG_RSA_SHA384
Definition: rsa.h:55
int renegotiation
Definition: ssl.h:407
dhm_context dhm_ctx
Definition: ssl.h:374
static int safer_memcmp(const void *a, const void *b, size_t n)
Definition: ssl.h:1147
#define SIG_RSA_RAW
Definition: rsa.h:48
void ssl_optimize_checksum(ssl_context *ssl, int ciphersuite)
int ssl_send_fatal_handshake_failure(ssl_context *ssl)
void sha2_starts(sha2_context *ctx, int is224)
SHA-256 context setup.
#define TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
TLS 1.2.
Definition: ssl.h:183
rsa_context rsa
Container for the RSA context.
Definition: x509.h:310
void md5(const unsigned char *input, size_t ilen, unsigned char output[16])
Output = MD5( input buffer )
#define POLARSSL_ERR_SSL_FEATURE_UNAVAILABLE
The requested feature is not available.
Definition: ssl.h:60
#define POLARSSL_ERR_SSL_BAD_INPUT_DATA
Bad input parameters to function.
Definition: ssl.h:61
#define SSL_HASH_SHA512
Definition: ssl.h:201
#define SSL_HASH_SHA384
Definition: ssl.h:200
int ssl_write_record(ssl_context *ssl)
int rsa_pkcs1_verify(rsa_context *ctx, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng, int mode, int hash_id, unsigned int hashlen, const unsigned char *hash, unsigned char *sig)
Generic wrapper to perform a PKCS#1 verification using the mode from the context. ...
unsigned char randbytes[64]
Definition: ssl.h:394
void sha2_finish(sha2_context *ctx, unsigned char output[32])
SHA-256 final digest.