Subversion Repositories Kolibri OS

Rev

Blame | Last modification | View Log | Download | RSS feed

  1. /*
  2.  *  SSLv3/TLSv1 client-side functions
  3.  *
  4.  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  5.  *  SPDX-License-Identifier: GPL-2.0
  6.  *
  7.  *  This program is free software; you can redistribute it and/or modify
  8.  *  it under the terms of the GNU General Public License as published by
  9.  *  the Free Software Foundation; either version 2 of the License, or
  10.  *  (at your option) any later version.
  11.  *
  12.  *  This program is distributed in the hope that it will be useful,
  13.  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14.  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15.  *  GNU General Public License for more details.
  16.  *
  17.  *  You should have received a copy of the GNU General Public License along
  18.  *  with this program; if not, write to the Free Software Foundation, Inc.,
  19.  *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20.  *
  21.  *  This file is part of mbed TLS (https://tls.mbed.org)
  22.  */
  23.  
  24. #if !defined(MBEDTLS_CONFIG_FILE)
  25. #include "mbedtls/config.h"
  26. #else
  27. #include MBEDTLS_CONFIG_FILE
  28. #endif
  29.  
  30. #if defined(MBEDTLS_SSL_CLI_C)
  31.  
  32. #if defined(MBEDTLS_PLATFORM_C)
  33. #include "mbedtls/platform.h"
  34. #else
  35. #include <stdlib.h>
  36. #define mbedtls_calloc    calloc
  37. #define mbedtls_free      free
  38. #endif
  39.  
  40. #include "mbedtls/debug.h"
  41. #include "mbedtls/ssl.h"
  42. #include "mbedtls/ssl_internal.h"
  43.  
  44. #include <string.h>
  45.  
  46. #include <stdint.h>
  47.  
  48. #if defined(MBEDTLS_HAVE_TIME)
  49. #include "mbedtls/platform_time.h"
  50. #endif
  51.  
  52. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  53. #include "mbedtls/platform_util.h"
  54. #endif
  55.  
  56. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  57. static void ssl_write_hostname_ext( mbedtls_ssl_context *ssl,
  58.                                     unsigned char *buf,
  59.                                     size_t *olen )
  60. {
  61.     unsigned char *p = buf;
  62.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  63.     size_t hostname_len;
  64.  
  65.     *olen = 0;
  66.  
  67.     if( ssl->hostname == NULL )
  68.         return;
  69.  
  70.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
  71.                    ssl->hostname ) );
  72.  
  73.     hostname_len = strlen( ssl->hostname );
  74.  
  75.     if( end < p || (size_t)( end - p ) < hostname_len + 9 )
  76.     {
  77.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  78.         return;
  79.     }
  80.  
  81.     /*
  82.      * Sect. 3, RFC 6066 (TLS Extensions Definitions)
  83.      *
  84.      * In order to provide any of the server names, clients MAY include an
  85.      * extension of type "server_name" in the (extended) client hello. The
  86.      * "extension_data" field of this extension SHALL contain
  87.      * "ServerNameList" where:
  88.      *
  89.      * struct {
  90.      *     NameType name_type;
  91.      *     select (name_type) {
  92.      *         case host_name: HostName;
  93.      *     } name;
  94.      * } ServerName;
  95.      *
  96.      * enum {
  97.      *     host_name(0), (255)
  98.      * } NameType;
  99.      *
  100.      * opaque HostName<1..2^16-1>;
  101.      *
  102.      * struct {
  103.      *     ServerName server_name_list<1..2^16-1>
  104.      * } ServerNameList;
  105.      *
  106.      */
  107.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME >> 8 ) & 0xFF );
  108.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME      ) & 0xFF );
  109.  
  110.     *p++ = (unsigned char)( ( (hostname_len + 5) >> 8 ) & 0xFF );
  111.     *p++ = (unsigned char)( ( (hostname_len + 5)      ) & 0xFF );
  112.  
  113.     *p++ = (unsigned char)( ( (hostname_len + 3) >> 8 ) & 0xFF );
  114.     *p++ = (unsigned char)( ( (hostname_len + 3)      ) & 0xFF );
  115.  
  116.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SERVERNAME_HOSTNAME ) & 0xFF );
  117.     *p++ = (unsigned char)( ( hostname_len >> 8 ) & 0xFF );
  118.     *p++ = (unsigned char)( ( hostname_len      ) & 0xFF );
  119.  
  120.     memcpy( p, ssl->hostname, hostname_len );
  121.  
  122.     *olen = hostname_len + 9;
  123. }
  124. #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
  125.  
  126. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  127. static void ssl_write_renegotiation_ext( mbedtls_ssl_context *ssl,
  128.                                          unsigned char *buf,
  129.                                          size_t *olen )
  130. {
  131.     unsigned char *p = buf;
  132.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  133.  
  134.     *olen = 0;
  135.  
  136.     /* We're always including an TLS_EMPTY_RENEGOTIATION_INFO_SCSV in the
  137.      * initial ClientHello, in which case also adding the renegotiation
  138.      * info extension is NOT RECOMMENDED as per RFC 5746 Section 3.4. */
  139.     if( ssl->renego_status != MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  140.         return;
  141.  
  142.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding renegotiation extension" ) );
  143.  
  144.     if( end < p || (size_t)( end - p ) < 5 + ssl->verify_data_len )
  145.     {
  146.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  147.         return;
  148.     }
  149.  
  150.     /*
  151.      * Secure renegotiation
  152.      */
  153.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO >> 8 ) & 0xFF );
  154.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_RENEGOTIATION_INFO      ) & 0xFF );
  155.  
  156.     *p++ = 0x00;
  157.     *p++ = ( ssl->verify_data_len + 1 ) & 0xFF;
  158.     *p++ = ssl->verify_data_len & 0xFF;
  159.  
  160.     memcpy( p, ssl->own_verify_data, ssl->verify_data_len );
  161.  
  162.     *olen = 5 + ssl->verify_data_len;
  163. }
  164. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  165.  
  166. /*
  167.  * Only if we handle at least one key exchange that needs signatures.
  168.  */
  169. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  170.     defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  171. static void ssl_write_signature_algorithms_ext( mbedtls_ssl_context *ssl,
  172.                                                 unsigned char *buf,
  173.                                                 size_t *olen )
  174. {
  175.     unsigned char *p = buf;
  176.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  177.     size_t sig_alg_len = 0;
  178.     const int *md;
  179. #if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_C)
  180.     unsigned char *sig_alg_list = buf + 6;
  181. #endif
  182.  
  183.     *olen = 0;
  184.  
  185.     if( ssl->conf->max_minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  186.         return;
  187.  
  188.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding signature_algorithms extension" ) );
  189.  
  190.     for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
  191.     {
  192. #if defined(MBEDTLS_ECDSA_C)
  193.         sig_alg_len += 2;
  194. #endif
  195. #if defined(MBEDTLS_RSA_C)
  196.         sig_alg_len += 2;
  197. #endif
  198.     }
  199.  
  200.     if( end < p || (size_t)( end - p ) < sig_alg_len + 6 )
  201.     {
  202.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  203.         return;
  204.     }
  205.  
  206.     /*
  207.      * Prepare signature_algorithms extension (TLS 1.2)
  208.      */
  209.     sig_alg_len = 0;
  210.  
  211.     for( md = ssl->conf->sig_hashes; *md != MBEDTLS_MD_NONE; md++ )
  212.     {
  213. #if defined(MBEDTLS_ECDSA_C)
  214.         sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
  215.         sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_ECDSA;
  216. #endif
  217. #if defined(MBEDTLS_RSA_C)
  218.         sig_alg_list[sig_alg_len++] = mbedtls_ssl_hash_from_md_alg( *md );
  219.         sig_alg_list[sig_alg_len++] = MBEDTLS_SSL_SIG_RSA;
  220. #endif
  221.     }
  222.  
  223.     /*
  224.      * enum {
  225.      *     none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
  226.      *     sha512(6), (255)
  227.      * } HashAlgorithm;
  228.      *
  229.      * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
  230.      *   SignatureAlgorithm;
  231.      *
  232.      * struct {
  233.      *     HashAlgorithm hash;
  234.      *     SignatureAlgorithm signature;
  235.      * } SignatureAndHashAlgorithm;
  236.      *
  237.      * SignatureAndHashAlgorithm
  238.      *   supported_signature_algorithms<2..2^16-2>;
  239.      */
  240.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG >> 8 ) & 0xFF );
  241.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SIG_ALG      ) & 0xFF );
  242.  
  243.     *p++ = (unsigned char)( ( ( sig_alg_len + 2 ) >> 8 ) & 0xFF );
  244.     *p++ = (unsigned char)( ( ( sig_alg_len + 2 )      ) & 0xFF );
  245.  
  246.     *p++ = (unsigned char)( ( sig_alg_len >> 8 ) & 0xFF );
  247.     *p++ = (unsigned char)( ( sig_alg_len      ) & 0xFF );
  248.  
  249.     *olen = 6 + sig_alg_len;
  250. }
  251. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
  252.           MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED */
  253.  
  254. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  255.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  256. static void ssl_write_supported_elliptic_curves_ext( mbedtls_ssl_context *ssl,
  257.                                                      unsigned char *buf,
  258.                                                      size_t *olen )
  259. {
  260.     unsigned char *p = buf;
  261.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  262.     unsigned char *elliptic_curve_list = p + 6;
  263.     size_t elliptic_curve_len = 0;
  264.     const mbedtls_ecp_curve_info *info;
  265. #if defined(MBEDTLS_ECP_C)
  266.     const mbedtls_ecp_group_id *grp_id;
  267. #else
  268.     ((void) ssl);
  269. #endif
  270.  
  271.     *olen = 0;
  272.  
  273.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_elliptic_curves extension" ) );
  274.  
  275. #if defined(MBEDTLS_ECP_C)
  276.     for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
  277. #else
  278.     for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
  279. #endif
  280.     {
  281. #if defined(MBEDTLS_ECP_C)
  282.         info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
  283. #endif
  284.         if( info == NULL )
  285.         {
  286.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid curve in ssl configuration" ) );
  287.             return;
  288.         }
  289.  
  290.         elliptic_curve_len += 2;
  291.     }
  292.  
  293.     if( end < p || (size_t)( end - p ) < 6 + elliptic_curve_len )
  294.     {
  295.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  296.         return;
  297.     }
  298.  
  299.     elliptic_curve_len = 0;
  300.  
  301. #if defined(MBEDTLS_ECP_C)
  302.     for( grp_id = ssl->conf->curve_list; *grp_id != MBEDTLS_ECP_DP_NONE; grp_id++ )
  303. #else
  304.     for( info = mbedtls_ecp_curve_list(); info->grp_id != MBEDTLS_ECP_DP_NONE; info++ )
  305. #endif
  306.     {
  307. #if defined(MBEDTLS_ECP_C)
  308.         info = mbedtls_ecp_curve_info_from_grp_id( *grp_id );
  309. #endif
  310.         elliptic_curve_list[elliptic_curve_len++] = info->tls_id >> 8;
  311.         elliptic_curve_list[elliptic_curve_len++] = info->tls_id & 0xFF;
  312.     }
  313.  
  314.     if( elliptic_curve_len == 0 )
  315.         return;
  316.  
  317.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES >> 8 ) & 0xFF );
  318.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_ELLIPTIC_CURVES      ) & 0xFF );
  319.  
  320.     *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 ) >> 8 ) & 0xFF );
  321.     *p++ = (unsigned char)( ( ( elliptic_curve_len + 2 )      ) & 0xFF );
  322.  
  323.     *p++ = (unsigned char)( ( ( elliptic_curve_len     ) >> 8 ) & 0xFF );
  324.     *p++ = (unsigned char)( ( ( elliptic_curve_len     )      ) & 0xFF );
  325.  
  326.     *olen = 6 + elliptic_curve_len;
  327. }
  328.  
  329. static void ssl_write_supported_point_formats_ext( mbedtls_ssl_context *ssl,
  330.                                                    unsigned char *buf,
  331.                                                    size_t *olen )
  332. {
  333.     unsigned char *p = buf;
  334.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  335.  
  336.     *olen = 0;
  337.  
  338.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding supported_point_formats extension" ) );
  339.  
  340.     if( end < p || (size_t)( end - p ) < 6 )
  341.     {
  342.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  343.         return;
  344.     }
  345.  
  346.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS >> 8 ) & 0xFF );
  347.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS      ) & 0xFF );
  348.  
  349.     *p++ = 0x00;
  350.     *p++ = 2;
  351.  
  352.     *p++ = 1;
  353.     *p++ = MBEDTLS_ECP_PF_UNCOMPRESSED;
  354.  
  355.     *olen = 6;
  356. }
  357. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  358.           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  359.  
  360. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  361. static void ssl_write_ecjpake_kkpp_ext( mbedtls_ssl_context *ssl,
  362.                                         unsigned char *buf,
  363.                                         size_t *olen )
  364. {
  365.     int ret;
  366.     unsigned char *p = buf;
  367.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  368.     size_t kkpp_len;
  369.  
  370.     *olen = 0;
  371.  
  372.     /* Skip costly extension if we can't use EC J-PAKE anyway */
  373.     if( mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
  374.         return;
  375.  
  376.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding ecjpake_kkpp extension" ) );
  377.  
  378.     if( end - p < 4 )
  379.     {
  380.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  381.         return;
  382.     }
  383.  
  384.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP >> 8 ) & 0xFF );
  385.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ECJPAKE_KKPP      ) & 0xFF );
  386.  
  387.     /*
  388.      * We may need to send ClientHello multiple times for Hello verification.
  389.      * We don't want to compute fresh values every time (both for performance
  390.      * and consistency reasons), so cache the extension content.
  391.      */
  392.     if( ssl->handshake->ecjpake_cache == NULL ||
  393.         ssl->handshake->ecjpake_cache_len == 0 )
  394.     {
  395.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "generating new ecjpake parameters" ) );
  396.  
  397.         ret = mbedtls_ecjpake_write_round_one( &ssl->handshake->ecjpake_ctx,
  398.                                         p + 2, end - p - 2, &kkpp_len,
  399.                                         ssl->conf->f_rng, ssl->conf->p_rng );
  400.         if( ret != 0 )
  401.         {
  402.             MBEDTLS_SSL_DEBUG_RET( 1 , "mbedtls_ecjpake_write_round_one", ret );
  403.             return;
  404.         }
  405.  
  406.         ssl->handshake->ecjpake_cache = mbedtls_calloc( 1, kkpp_len );
  407.         if( ssl->handshake->ecjpake_cache == NULL )
  408.         {
  409.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "allocation failed" ) );
  410.             return;
  411.         }
  412.  
  413.         memcpy( ssl->handshake->ecjpake_cache, p + 2, kkpp_len );
  414.         ssl->handshake->ecjpake_cache_len = kkpp_len;
  415.     }
  416.     else
  417.     {
  418.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "re-using cached ecjpake parameters" ) );
  419.  
  420.         kkpp_len = ssl->handshake->ecjpake_cache_len;
  421.  
  422.         if( (size_t)( end - p - 2 ) < kkpp_len )
  423.         {
  424.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  425.             return;
  426.         }
  427.  
  428.         memcpy( p + 2, ssl->handshake->ecjpake_cache, kkpp_len );
  429.     }
  430.  
  431.     *p++ = (unsigned char)( ( kkpp_len >> 8 ) & 0xFF );
  432.     *p++ = (unsigned char)( ( kkpp_len      ) & 0xFF );
  433.  
  434.     *olen = kkpp_len + 4;
  435. }
  436. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  437.  
  438. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  439. static void ssl_write_max_fragment_length_ext( mbedtls_ssl_context *ssl,
  440.                                                unsigned char *buf,
  441.                                                size_t *olen )
  442. {
  443.     unsigned char *p = buf;
  444.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  445.  
  446.     *olen = 0;
  447.  
  448.     if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ) {
  449.         return;
  450.     }
  451.  
  452.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding max_fragment_length extension" ) );
  453.  
  454.     if( end < p || (size_t)( end - p ) < 5 )
  455.     {
  456.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  457.         return;
  458.     }
  459.  
  460.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH >> 8 ) & 0xFF );
  461.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH      ) & 0xFF );
  462.  
  463.     *p++ = 0x00;
  464.     *p++ = 1;
  465.  
  466.     *p++ = ssl->conf->mfl_code;
  467.  
  468.     *olen = 5;
  469. }
  470. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  471.  
  472. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  473. static void ssl_write_truncated_hmac_ext( mbedtls_ssl_context *ssl,
  474.                                           unsigned char *buf, size_t *olen )
  475. {
  476.     unsigned char *p = buf;
  477.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  478.  
  479.     *olen = 0;
  480.  
  481.     if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED )
  482.     {
  483.         return;
  484.     }
  485.  
  486.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding truncated_hmac extension" ) );
  487.  
  488.     if( end < p || (size_t)( end - p ) < 4 )
  489.     {
  490.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  491.         return;
  492.     }
  493.  
  494.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC >> 8 ) & 0xFF );
  495.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_TRUNCATED_HMAC      ) & 0xFF );
  496.  
  497.     *p++ = 0x00;
  498.     *p++ = 0x00;
  499.  
  500.     *olen = 4;
  501. }
  502. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  503.  
  504. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  505. static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
  506.                                        unsigned char *buf, size_t *olen )
  507. {
  508.     unsigned char *p = buf;
  509.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  510.  
  511.     *olen = 0;
  512.  
  513.     if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
  514.         ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
  515.     {
  516.         return;
  517.     }
  518.  
  519.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding encrypt_then_mac "
  520.                         "extension" ) );
  521.  
  522.     if( end < p || (size_t)( end - p ) < 4 )
  523.     {
  524.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  525.         return;
  526.     }
  527.  
  528.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );
  529.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC      ) & 0xFF );
  530.  
  531.     *p++ = 0x00;
  532.     *p++ = 0x00;
  533.  
  534.     *olen = 4;
  535. }
  536. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  537.  
  538. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  539. static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
  540.                                        unsigned char *buf, size_t *olen )
  541. {
  542.     unsigned char *p = buf;
  543.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  544.  
  545.     *olen = 0;
  546.  
  547.     if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
  548.         ssl->conf->max_minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
  549.     {
  550.         return;
  551.     }
  552.  
  553.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding extended_master_secret "
  554.                         "extension" ) );
  555.  
  556.     if( end < p || (size_t)( end - p ) < 4 )
  557.     {
  558.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  559.         return;
  560.     }
  561.  
  562.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET >> 8 ) & 0xFF );
  563.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET      ) & 0xFF );
  564.  
  565.     *p++ = 0x00;
  566.     *p++ = 0x00;
  567.  
  568.     *olen = 4;
  569. }
  570. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  571.  
  572. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  573. static void ssl_write_session_ticket_ext( mbedtls_ssl_context *ssl,
  574.                                           unsigned char *buf, size_t *olen )
  575. {
  576.     unsigned char *p = buf;
  577.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  578.     size_t tlen = ssl->session_negotiate->ticket_len;
  579.  
  580.     *olen = 0;
  581.  
  582.     if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
  583.     {
  584.         return;
  585.     }
  586.  
  587.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding session ticket extension" ) );
  588.  
  589.     if( end < p || (size_t)( end - p ) < 4 + tlen )
  590.     {
  591.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  592.         return;
  593.     }
  594.  
  595.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET >> 8 ) & 0xFF );
  596.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_SESSION_TICKET      ) & 0xFF );
  597.  
  598.     *p++ = (unsigned char)( ( tlen >> 8 ) & 0xFF );
  599.     *p++ = (unsigned char)( ( tlen      ) & 0xFF );
  600.  
  601.     *olen = 4;
  602.  
  603.     if( ssl->session_negotiate->ticket == NULL || tlen == 0 )
  604.     {
  605.         return;
  606.     }
  607.  
  608.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "sending session ticket of length %d", tlen ) );
  609.  
  610.     memcpy( p, ssl->session_negotiate->ticket, tlen );
  611.  
  612.     *olen += tlen;
  613. }
  614. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  615.  
  616. #if defined(MBEDTLS_SSL_ALPN)
  617. static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
  618.                                 unsigned char *buf, size_t *olen )
  619. {
  620.     unsigned char *p = buf;
  621.     const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
  622.     size_t alpnlen = 0;
  623.     const char **cur;
  624.  
  625.     *olen = 0;
  626.  
  627.     if( ssl->conf->alpn_list == NULL )
  628.     {
  629.         return;
  630.     }
  631.  
  632.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, adding alpn extension" ) );
  633.  
  634.     for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
  635.         alpnlen += (unsigned char)( strlen( *cur ) & 0xFF ) + 1;
  636.  
  637.     if( end < p || (size_t)( end - p ) < 6 + alpnlen )
  638.     {
  639.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
  640.         return;
  641.     }
  642.  
  643.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN >> 8 ) & 0xFF );
  644.     *p++ = (unsigned char)( ( MBEDTLS_TLS_EXT_ALPN      ) & 0xFF );
  645.  
  646.     /*
  647.      * opaque ProtocolName<1..2^8-1>;
  648.      *
  649.      * struct {
  650.      *     ProtocolName protocol_name_list<2..2^16-1>
  651.      * } ProtocolNameList;
  652.      */
  653.  
  654.     /* Skip writing extension and list length for now */
  655.     p += 4;
  656.  
  657.     for( cur = ssl->conf->alpn_list; *cur != NULL; cur++ )
  658.     {
  659.         *p = (unsigned char)( strlen( *cur ) & 0xFF );
  660.         memcpy( p + 1, *cur, *p );
  661.         p += 1 + *p;
  662.     }
  663.  
  664.     *olen = p - buf;
  665.  
  666.     /* List length = olen - 2 (ext_type) - 2 (ext_len) - 2 (list_len) */
  667.     buf[4] = (unsigned char)( ( ( *olen - 6 ) >> 8 ) & 0xFF );
  668.     buf[5] = (unsigned char)( ( ( *olen - 6 )      ) & 0xFF );
  669.  
  670.     /* Extension length = olen - 2 (ext_type) - 2 (ext_len) */
  671.     buf[2] = (unsigned char)( ( ( *olen - 4 ) >> 8 ) & 0xFF );
  672.     buf[3] = (unsigned char)( ( ( *olen - 4 )      ) & 0xFF );
  673. }
  674. #endif /* MBEDTLS_SSL_ALPN */
  675.  
  676. /*
  677.  * Generate random bytes for ClientHello
  678.  */
  679. static int ssl_generate_random( mbedtls_ssl_context *ssl )
  680. {
  681.     int ret;
  682.     unsigned char *p = ssl->handshake->randbytes;
  683. #if defined(MBEDTLS_HAVE_TIME)
  684.     mbedtls_time_t t;
  685. #endif
  686.  
  687.     /*
  688.      * When responding to a verify request, MUST reuse random (RFC 6347 4.2.1)
  689.      */
  690. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  691.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  692.         ssl->handshake->verify_cookie != NULL )
  693.     {
  694.         return( 0 );
  695.     }
  696. #endif
  697.  
  698. #if defined(MBEDTLS_HAVE_TIME)
  699.     t = mbedtls_time( NULL );
  700.     *p++ = (unsigned char)( t >> 24 );
  701.     *p++ = (unsigned char)( t >> 16 );
  702.     *p++ = (unsigned char)( t >>  8 );
  703.     *p++ = (unsigned char)( t       );
  704.  
  705.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, current time: %lu", t ) );
  706. #else
  707.     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 4 ) ) != 0 )
  708.         return( ret );
  709.  
  710.     p += 4;
  711. #endif /* MBEDTLS_HAVE_TIME */
  712.  
  713.     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p, 28 ) ) != 0 )
  714.         return( ret );
  715.  
  716.     return( 0 );
  717. }
  718.  
  719. /**
  720.  * \brief           Validate cipher suite against config in SSL context.
  721.  *
  722.  * \param suite_info    cipher suite to validate
  723.  * \param ssl           SSL context
  724.  * \param min_minor_ver Minimal minor version to accept a cipher suite
  725.  * \param max_minor_ver Maximal minor version to accept a cipher suite
  726.  *
  727.  * \return          0 if valid, else 1
  728.  */
  729. static int ssl_validate_ciphersuite( const mbedtls_ssl_ciphersuite_t * suite_info,
  730.                                      const mbedtls_ssl_context * ssl,
  731.                                      int min_minor_ver, int max_minor_ver )
  732. {
  733.     (void) ssl;
  734.     if( suite_info == NULL )
  735.         return( 1 );
  736.  
  737.     if( suite_info->min_minor_ver > max_minor_ver ||
  738.             suite_info->max_minor_ver < min_minor_ver )
  739.         return( 1 );
  740.  
  741. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  742.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  743.             ( suite_info->flags & MBEDTLS_CIPHERSUITE_NODTLS ) )
  744.         return( 1 );
  745. #endif
  746.  
  747. #if defined(MBEDTLS_ARC4_C)
  748.     if( ssl->conf->arc4_disabled == MBEDTLS_SSL_ARC4_DISABLED &&
  749.             suite_info->cipher == MBEDTLS_CIPHER_ARC4_128 )
  750.         return( 1 );
  751. #endif
  752.  
  753. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  754.     if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE &&
  755.             mbedtls_ecjpake_check( &ssl->handshake->ecjpake_ctx ) != 0 )
  756.         return( 1 );
  757. #endif
  758.  
  759.     return( 0 );
  760. }
  761.  
  762. static int ssl_write_client_hello( mbedtls_ssl_context *ssl )
  763. {
  764.     int ret;
  765.     size_t i, n, olen, ext_len = 0;
  766.     unsigned char *buf;
  767.     unsigned char *p, *q;
  768.     unsigned char offer_compress;
  769.     const int *ciphersuites;
  770.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
  771. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  772.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  773.     int uses_ec = 0;
  774. #endif
  775.  
  776.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client hello" ) );
  777.  
  778.     if( ssl->conf->f_rng == NULL )
  779.     {
  780.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided") );
  781.         return( MBEDTLS_ERR_SSL_NO_RNG );
  782.     }
  783.  
  784. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  785.     if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  786. #endif
  787.     {
  788.         ssl->major_ver = ssl->conf->min_major_ver;
  789.         ssl->minor_ver = ssl->conf->min_minor_ver;
  790.     }
  791.  
  792.     if( ssl->conf->max_major_ver == 0 )
  793.     {
  794.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "configured max major version is invalid, "
  795.                             "consider using mbedtls_ssl_config_defaults()" ) );
  796.         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  797.     }
  798.  
  799.     /*
  800.      *     0  .   0   handshake type
  801.      *     1  .   3   handshake length
  802.      *     4  .   5   highest version supported
  803.      *     6  .   9   current UNIX time
  804.      *    10  .  37   random bytes
  805.      */
  806.     buf = ssl->out_msg;
  807.     p = buf + 4;
  808.  
  809.     mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
  810.                        ssl->conf->transport, p );
  811.     p += 2;
  812.  
  813.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, max version: [%d:%d]",
  814.                    buf[4], buf[5] ) );
  815.  
  816.     if( ( ret = ssl_generate_random( ssl ) ) != 0 )
  817.     {
  818.         MBEDTLS_SSL_DEBUG_RET( 1, "ssl_generate_random", ret );
  819.         return( ret );
  820.     }
  821.  
  822.     memcpy( p, ssl->handshake->randbytes, 32 );
  823.     MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, random bytes", p, 32 );
  824.     p += 32;
  825.  
  826.     /*
  827.      *    38  .  38   session id length
  828.      *    39  . 39+n  session id
  829.      *   39+n . 39+n  DTLS only: cookie length (1 byte)
  830.      *   40+n .  ..   DTSL only: cookie
  831.      *   ..   . ..    ciphersuitelist length (2 bytes)
  832.      *   ..   . ..    ciphersuitelist
  833.      *   ..   . ..    compression methods length (1 byte)
  834.      *   ..   . ..    compression methods
  835.      *   ..   . ..    extensions length (2 bytes)
  836.      *   ..   . ..    extensions
  837.      */
  838.     n = ssl->session_negotiate->id_len;
  839.  
  840.     if( n < 16 || n > 32 ||
  841. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  842.         ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
  843. #endif
  844.         ssl->handshake->resume == 0 )
  845.     {
  846.         n = 0;
  847.     }
  848.  
  849. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  850.     /*
  851.      * RFC 5077 section 3.4: "When presenting a ticket, the client MAY
  852.      * generate and include a Session ID in the TLS ClientHello."
  853.      */
  854. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  855.     if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  856. #endif
  857.     {
  858.         if( ssl->session_negotiate->ticket != NULL &&
  859.                 ssl->session_negotiate->ticket_len != 0 )
  860.         {
  861.             ret = ssl->conf->f_rng( ssl->conf->p_rng, ssl->session_negotiate->id, 32 );
  862.  
  863.             if( ret != 0 )
  864.                 return( ret );
  865.  
  866.             ssl->session_negotiate->id_len = n = 32;
  867.         }
  868.     }
  869. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  870.  
  871.     *p++ = (unsigned char) n;
  872.  
  873.     for( i = 0; i < n; i++ )
  874.         *p++ = ssl->session_negotiate->id[i];
  875.  
  876.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, session id len.: %d", n ) );
  877.     MBEDTLS_SSL_DEBUG_BUF( 3,   "client hello, session id", buf + 39, n );
  878.  
  879.     /*
  880.      * DTLS cookie
  881.      */
  882. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  883.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  884.     {
  885.         if( ssl->handshake->verify_cookie == NULL )
  886.         {
  887.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "no verify cookie to send" ) );
  888.             *p++ = 0;
  889.         }
  890.         else
  891.         {
  892.             MBEDTLS_SSL_DEBUG_BUF( 3, "client hello, cookie",
  893.                               ssl->handshake->verify_cookie,
  894.                               ssl->handshake->verify_cookie_len );
  895.  
  896.             *p++ = ssl->handshake->verify_cookie_len;
  897.             memcpy( p, ssl->handshake->verify_cookie,
  898.                        ssl->handshake->verify_cookie_len );
  899.             p += ssl->handshake->verify_cookie_len;
  900.         }
  901.     }
  902. #endif
  903.  
  904.     /*
  905.      * Ciphersuite list
  906.      */
  907.     ciphersuites = ssl->conf->ciphersuite_list[ssl->minor_ver];
  908.  
  909.     /* Skip writing ciphersuite length for now */
  910.     n = 0;
  911.     q = p;
  912.     p += 2;
  913.  
  914.     for( i = 0; ciphersuites[i] != 0; i++ )
  915.     {
  916.         ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( ciphersuites[i] );
  917.  
  918.         if( ssl_validate_ciphersuite( ciphersuite_info, ssl,
  919.                                       ssl->conf->min_minor_ver,
  920.                                       ssl->conf->max_minor_ver ) != 0 )
  921.             continue;
  922.  
  923.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, add ciphersuite: %04x",
  924.                                     ciphersuites[i] ) );
  925.  
  926. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  927.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  928.         uses_ec |= mbedtls_ssl_ciphersuite_uses_ec( ciphersuite_info );
  929. #endif
  930.  
  931.         n++;
  932.         *p++ = (unsigned char)( ciphersuites[i] >> 8 );
  933.         *p++ = (unsigned char)( ciphersuites[i]      );
  934.     }
  935.  
  936.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, got %d ciphersuites (excluding SCSVs)", n ) );
  937.  
  938.     /*
  939.      * Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
  940.      */
  941. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  942.     if( ssl->renego_status == MBEDTLS_SSL_INITIAL_HANDSHAKE )
  943. #endif
  944.     {
  945.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding EMPTY_RENEGOTIATION_INFO_SCSV" ) );
  946.         *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
  947.         *p++ = (unsigned char)( MBEDTLS_SSL_EMPTY_RENEGOTIATION_INFO      );
  948.         n++;
  949.     }
  950.  
  951.     /* Some versions of OpenSSL don't handle it correctly if not at end */
  952. #if defined(MBEDTLS_SSL_FALLBACK_SCSV)
  953.     if( ssl->conf->fallback == MBEDTLS_SSL_IS_FALLBACK )
  954.     {
  955.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "adding FALLBACK_SCSV" ) );
  956.         *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE >> 8 );
  957.         *p++ = (unsigned char)( MBEDTLS_SSL_FALLBACK_SCSV_VALUE      );
  958.         n++;
  959.     }
  960. #endif
  961.  
  962.     *q++ = (unsigned char)( n >> 7 );
  963.     *q++ = (unsigned char)( n << 1 );
  964.  
  965. #if defined(MBEDTLS_ZLIB_SUPPORT)
  966.     offer_compress = 1;
  967. #else
  968.     offer_compress = 0;
  969. #endif
  970.  
  971.     /*
  972.      * We don't support compression with DTLS right now: if many records come
  973.      * in the same datagram, uncompressing one could overwrite the next one.
  974.      * We don't want to add complexity for handling that case unless there is
  975.      * an actual need for it.
  976.      */
  977. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  978.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  979.         offer_compress = 0;
  980. #endif
  981.  
  982.     if( offer_compress )
  983.     {
  984.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 2 ) );
  985.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d %d",
  986.                             MBEDTLS_SSL_COMPRESS_DEFLATE, MBEDTLS_SSL_COMPRESS_NULL ) );
  987.  
  988.         *p++ = 2;
  989.         *p++ = MBEDTLS_SSL_COMPRESS_DEFLATE;
  990.         *p++ = MBEDTLS_SSL_COMPRESS_NULL;
  991.     }
  992.     else
  993.     {
  994.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress len.: %d", 1 ) );
  995.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, compress alg.: %d",
  996.                             MBEDTLS_SSL_COMPRESS_NULL ) );
  997.  
  998.         *p++ = 1;
  999.         *p++ = MBEDTLS_SSL_COMPRESS_NULL;
  1000.     }
  1001.  
  1002.     // First write extensions, then the total length
  1003.     //
  1004. #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
  1005.     ssl_write_hostname_ext( ssl, p + 2 + ext_len, &olen );
  1006.     ext_len += olen;
  1007. #endif
  1008.  
  1009.     /* Note that TLS_EMPTY_RENEGOTIATION_INFO_SCSV is always added
  1010.      * even if MBEDTLS_SSL_RENEGOTIATION is not defined. */
  1011. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1012.     ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
  1013.     ext_len += olen;
  1014. #endif
  1015.  
  1016. #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
  1017.     defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
  1018.     ssl_write_signature_algorithms_ext( ssl, p + 2 + ext_len, &olen );
  1019.     ext_len += olen;
  1020. #endif
  1021.  
  1022. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1023.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1024.     if( uses_ec )
  1025.     {
  1026.         ssl_write_supported_elliptic_curves_ext( ssl, p + 2 + ext_len, &olen );
  1027.         ext_len += olen;
  1028.  
  1029.         ssl_write_supported_point_formats_ext( ssl, p + 2 + ext_len, &olen );
  1030.         ext_len += olen;
  1031.     }
  1032. #endif
  1033.  
  1034. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1035.     ssl_write_ecjpake_kkpp_ext( ssl, p + 2 + ext_len, &olen );
  1036.     ext_len += olen;
  1037. #endif
  1038.  
  1039. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1040.     ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
  1041.     ext_len += olen;
  1042. #endif
  1043.  
  1044. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1045.     ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
  1046.     ext_len += olen;
  1047. #endif
  1048.  
  1049. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1050.     ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
  1051.     ext_len += olen;
  1052. #endif
  1053.  
  1054. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1055.     ssl_write_extended_ms_ext( ssl, p + 2 + ext_len, &olen );
  1056.     ext_len += olen;
  1057. #endif
  1058.  
  1059. #if defined(MBEDTLS_SSL_ALPN)
  1060.     ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
  1061.     ext_len += olen;
  1062. #endif
  1063.  
  1064. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1065.     ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
  1066.     ext_len += olen;
  1067. #endif
  1068.  
  1069.     /* olen unused if all extensions are disabled */
  1070.     ((void) olen);
  1071.  
  1072.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello, total extension length: %d",
  1073.                    ext_len ) );
  1074.  
  1075.     if( ext_len > 0 )
  1076.     {
  1077.         *p++ = (unsigned char)( ( ext_len >> 8 ) & 0xFF );
  1078.         *p++ = (unsigned char)( ( ext_len      ) & 0xFF );
  1079.         p += ext_len;
  1080.     }
  1081.  
  1082.     ssl->out_msglen  = p - buf;
  1083.     ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  1084.     ssl->out_msg[0]  = MBEDTLS_SSL_HS_CLIENT_HELLO;
  1085.  
  1086.     ssl->state++;
  1087.  
  1088. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1089.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1090.         mbedtls_ssl_send_flight_completed( ssl );
  1091. #endif
  1092.  
  1093.     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
  1094.     {
  1095.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
  1096.         return( ret );
  1097.     }
  1098.  
  1099. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1100.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  1101.         ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
  1102.     {
  1103.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_flight_transmit", ret );
  1104.         return( ret );
  1105.     }
  1106. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1107.  
  1108.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client hello" ) );
  1109.  
  1110.     return( 0 );
  1111. }
  1112.  
  1113. static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
  1114.                                          const unsigned char *buf,
  1115.                                          size_t len )
  1116. {
  1117. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1118.     if( ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE )
  1119.     {
  1120.         /* Check verify-data in constant-time. The length OTOH is no secret */
  1121.         if( len    != 1 + ssl->verify_data_len * 2 ||
  1122.             buf[0] !=     ssl->verify_data_len * 2 ||
  1123.             mbedtls_ssl_safer_memcmp( buf + 1,
  1124.                           ssl->own_verify_data, ssl->verify_data_len ) != 0 ||
  1125.             mbedtls_ssl_safer_memcmp( buf + 1 + ssl->verify_data_len,
  1126.                           ssl->peer_verify_data, ssl->verify_data_len ) != 0 )
  1127.         {
  1128.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching renegotiation info" ) );
  1129.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1130.                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1131.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1132.         }
  1133.     }
  1134.     else
  1135. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1136.     {
  1137.         if( len != 1 || buf[0] != 0x00 )
  1138.         {
  1139.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-zero length renegotiation info" ) );
  1140.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1141.                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1142.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1143.         }
  1144.  
  1145.         ssl->secure_renegotiation = MBEDTLS_SSL_SECURE_RENEGOTIATION;
  1146.     }
  1147.  
  1148.     return( 0 );
  1149. }
  1150.  
  1151. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1152. static int ssl_parse_max_fragment_length_ext( mbedtls_ssl_context *ssl,
  1153.                                               const unsigned char *buf,
  1154.                                               size_t len )
  1155. {
  1156.     /*
  1157.      * server should use the extension only if we did,
  1158.      * and if so the server's value should match ours (and len is always 1)
  1159.      */
  1160.     if( ssl->conf->mfl_code == MBEDTLS_SSL_MAX_FRAG_LEN_NONE ||
  1161.         len != 1 ||
  1162.         buf[0] != ssl->conf->mfl_code )
  1163.     {
  1164.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching max fragment length extension" ) );
  1165.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1166.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1167.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1168.     }
  1169.  
  1170.     return( 0 );
  1171. }
  1172. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  1173.  
  1174. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1175. static int ssl_parse_truncated_hmac_ext( mbedtls_ssl_context *ssl,
  1176.                                          const unsigned char *buf,
  1177.                                          size_t len )
  1178. {
  1179.     if( ssl->conf->trunc_hmac == MBEDTLS_SSL_TRUNC_HMAC_DISABLED ||
  1180.         len != 0 )
  1181.     {
  1182.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching truncated HMAC extension" ) );
  1183.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1184.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1185.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1186.     }
  1187.  
  1188.     ((void) buf);
  1189.  
  1190.     ssl->session_negotiate->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
  1191.  
  1192.     return( 0 );
  1193. }
  1194. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  1195.  
  1196. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1197. static int ssl_parse_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
  1198.                                          const unsigned char *buf,
  1199.                                          size_t len )
  1200. {
  1201.     if( ssl->conf->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ||
  1202.         ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
  1203.         len != 0 )
  1204.     {
  1205.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching encrypt-then-MAC extension" ) );
  1206.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1207.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1208.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1209.     }
  1210.  
  1211.     ((void) buf);
  1212.  
  1213.     ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
  1214.  
  1215.     return( 0 );
  1216. }
  1217. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  1218.  
  1219. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1220. static int ssl_parse_extended_ms_ext( mbedtls_ssl_context *ssl,
  1221.                                          const unsigned char *buf,
  1222.                                          size_t len )
  1223. {
  1224.     if( ssl->conf->extended_ms == MBEDTLS_SSL_EXTENDED_MS_DISABLED ||
  1225.         ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ||
  1226.         len != 0 )
  1227.     {
  1228.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching extended master secret extension" ) );
  1229.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1230.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1231.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1232.     }
  1233.  
  1234.     ((void) buf);
  1235.  
  1236.     ssl->handshake->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
  1237.  
  1238.     return( 0 );
  1239. }
  1240. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  1241.  
  1242. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1243. static int ssl_parse_session_ticket_ext( mbedtls_ssl_context *ssl,
  1244.                                          const unsigned char *buf,
  1245.                                          size_t len )
  1246. {
  1247.     if( ssl->conf->session_tickets == MBEDTLS_SSL_SESSION_TICKETS_DISABLED ||
  1248.         len != 0 )
  1249.     {
  1250.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching session ticket extension" ) );
  1251.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1252.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1253.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1254.     }
  1255.  
  1256.     ((void) buf);
  1257.  
  1258.     ssl->handshake->new_session_ticket = 1;
  1259.  
  1260.     return( 0 );
  1261. }
  1262. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1263.  
  1264. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1265.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1266. static int ssl_parse_supported_point_formats_ext( mbedtls_ssl_context *ssl,
  1267.                                                   const unsigned char *buf,
  1268.                                                   size_t len )
  1269. {
  1270.     size_t list_size;
  1271.     const unsigned char *p;
  1272.  
  1273.     if( len == 0 || (size_t)( buf[0] + 1 ) != len )
  1274.     {
  1275.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1276.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1277.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1278.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1279.     }
  1280.     list_size = buf[0];
  1281.  
  1282.     p = buf + 1;
  1283.     while( list_size > 0 )
  1284.     {
  1285.         if( p[0] == MBEDTLS_ECP_PF_UNCOMPRESSED ||
  1286.             p[0] == MBEDTLS_ECP_PF_COMPRESSED )
  1287.         {
  1288. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C)
  1289.             ssl->handshake->ecdh_ctx.point_format = p[0];
  1290. #endif
  1291. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1292.             ssl->handshake->ecjpake_ctx.point_format = p[0];
  1293. #endif
  1294.             MBEDTLS_SSL_DEBUG_MSG( 4, ( "point format selected: %d", p[0] ) );
  1295.             return( 0 );
  1296.         }
  1297.  
  1298.         list_size--;
  1299.         p++;
  1300.     }
  1301.  
  1302.     MBEDTLS_SSL_DEBUG_MSG( 1, ( "no point format in common" ) );
  1303.     mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1304.                                     MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1305.     return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1306. }
  1307. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  1308.           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1309.  
  1310. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1311. static int ssl_parse_ecjpake_kkpp( mbedtls_ssl_context *ssl,
  1312.                                    const unsigned char *buf,
  1313.                                    size_t len )
  1314. {
  1315.     int ret;
  1316.  
  1317.     if( ssl->transform_negotiate->ciphersuite_info->key_exchange !=
  1318.         MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  1319.     {
  1320.         MBEDTLS_SSL_DEBUG_MSG( 3, ( "skip ecjpake kkpp extension" ) );
  1321.         return( 0 );
  1322.     }
  1323.  
  1324.     /* If we got here, we no longer need our cached extension */
  1325.     mbedtls_free( ssl->handshake->ecjpake_cache );
  1326.     ssl->handshake->ecjpake_cache = NULL;
  1327.     ssl->handshake->ecjpake_cache_len = 0;
  1328.  
  1329.     if( ( ret = mbedtls_ecjpake_read_round_one( &ssl->handshake->ecjpake_ctx,
  1330.                                                 buf, len ) ) != 0 )
  1331.     {
  1332.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_one", ret );
  1333.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1334.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1335.         return( ret );
  1336.     }
  1337.  
  1338.     return( 0 );
  1339. }
  1340. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1341.  
  1342. #if defined(MBEDTLS_SSL_ALPN)
  1343. static int ssl_parse_alpn_ext( mbedtls_ssl_context *ssl,
  1344.                                const unsigned char *buf, size_t len )
  1345. {
  1346.     size_t list_len, name_len;
  1347.     const char **p;
  1348.  
  1349.     /* If we didn't send it, the server shouldn't send it */
  1350.     if( ssl->conf->alpn_list == NULL )
  1351.     {
  1352.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-matching ALPN extension" ) );
  1353.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1354.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1355.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1356.     }
  1357.  
  1358.     /*
  1359.      * opaque ProtocolName<1..2^8-1>;
  1360.      *
  1361.      * struct {
  1362.      *     ProtocolName protocol_name_list<2..2^16-1>
  1363.      * } ProtocolNameList;
  1364.      *
  1365.      * the "ProtocolNameList" MUST contain exactly one "ProtocolName"
  1366.      */
  1367.  
  1368.     /* Min length is 2 (list_len) + 1 (name_len) + 1 (name) */
  1369.     if( len < 4 )
  1370.     {
  1371.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1372.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1373.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1374.     }
  1375.  
  1376.     list_len = ( buf[0] << 8 ) | buf[1];
  1377.     if( list_len != len - 2 )
  1378.     {
  1379.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1380.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1381.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1382.     }
  1383.  
  1384.     name_len = buf[2];
  1385.     if( name_len != list_len - 1 )
  1386.     {
  1387.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1388.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1389.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1390.     }
  1391.  
  1392.     /* Check that the server chosen protocol was in our list and save it */
  1393.     for( p = ssl->conf->alpn_list; *p != NULL; p++ )
  1394.     {
  1395.         if( name_len == strlen( *p ) &&
  1396.             memcmp( buf + 3, *p, name_len ) == 0 )
  1397.         {
  1398.             ssl->alpn_chosen = *p;
  1399.             return( 0 );
  1400.         }
  1401.     }
  1402.  
  1403.     MBEDTLS_SSL_DEBUG_MSG( 1, ( "ALPN extension: no matching protocol" ) );
  1404.     mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1405.                                     MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1406.     return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1407. }
  1408. #endif /* MBEDTLS_SSL_ALPN */
  1409.  
  1410. /*
  1411.  * Parse HelloVerifyRequest.  Only called after verifying the HS type.
  1412.  */
  1413. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1414. static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
  1415. {
  1416.     const unsigned char *p = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  1417.     int major_ver, minor_ver;
  1418.     unsigned char cookie_len;
  1419.  
  1420.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse hello verify request" ) );
  1421.  
  1422.     /* Check that there is enough room for:
  1423.      * - 2 bytes of version
  1424.      * - 1 byte of cookie_len
  1425.      */
  1426.     if( mbedtls_ssl_hs_hdr_len( ssl ) + 3 > ssl->in_msglen )
  1427.     {
  1428.         MBEDTLS_SSL_DEBUG_MSG( 1,
  1429.             ( "incoming HelloVerifyRequest message is too short" ) );
  1430.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1431.                                     MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1432.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1433.     }
  1434.  
  1435.     /*
  1436.      * struct {
  1437.      *   ProtocolVersion server_version;
  1438.      *   opaque cookie<0..2^8-1>;
  1439.      * } HelloVerifyRequest;
  1440.      */
  1441.     MBEDTLS_SSL_DEBUG_BUF( 3, "server version", p, 2 );
  1442.     mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, p );
  1443.     p += 2;
  1444.  
  1445.     /*
  1446.      * Since the RFC is not clear on this point, accept DTLS 1.0 (TLS 1.1)
  1447.      * even is lower than our min version.
  1448.      */
  1449.     if( major_ver < MBEDTLS_SSL_MAJOR_VERSION_3 ||
  1450.         minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 ||
  1451.         major_ver > ssl->conf->max_major_ver  ||
  1452.         minor_ver > ssl->conf->max_minor_ver  )
  1453.     {
  1454.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server version" ) );
  1455.  
  1456.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1457.                                      MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
  1458.  
  1459.         return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
  1460.     }
  1461.  
  1462.     cookie_len = *p++;
  1463.     if( ( ssl->in_msg + ssl->in_msglen ) - p < cookie_len )
  1464.     {
  1465.         MBEDTLS_SSL_DEBUG_MSG( 1,
  1466.             ( "cookie length does not match incoming message size" ) );
  1467.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1468.                                     MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1469.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1470.     }
  1471.     MBEDTLS_SSL_DEBUG_BUF( 3, "cookie", p, cookie_len );
  1472.  
  1473.     mbedtls_free( ssl->handshake->verify_cookie );
  1474.  
  1475.     ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
  1476.     if( ssl->handshake->verify_cookie  == NULL )
  1477.     {
  1478.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
  1479.         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
  1480.     }
  1481.  
  1482.     memcpy( ssl->handshake->verify_cookie, p, cookie_len );
  1483.     ssl->handshake->verify_cookie_len = cookie_len;
  1484.  
  1485.     /* Start over at ClientHello */
  1486.     ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
  1487.     mbedtls_ssl_reset_checksum( ssl );
  1488.  
  1489.     mbedtls_ssl_recv_flight_completed( ssl );
  1490.  
  1491.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse hello verify request" ) );
  1492.  
  1493.     return( 0 );
  1494. }
  1495. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1496.  
  1497. static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
  1498. {
  1499.     int ret, i;
  1500.     size_t n;
  1501.     size_t ext_len;
  1502.     unsigned char *buf, *ext;
  1503.     unsigned char comp;
  1504. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1505.     int accept_comp;
  1506. #endif
  1507. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1508.     int renegotiation_info_seen = 0;
  1509. #endif
  1510.     int handshake_failure = 0;
  1511.     const mbedtls_ssl_ciphersuite_t *suite_info;
  1512.  
  1513.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello" ) );
  1514.  
  1515.     buf = ssl->in_msg;
  1516.  
  1517.     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
  1518.     {
  1519.         /* No alert on a read error. */
  1520.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  1521.         return( ret );
  1522.     }
  1523.  
  1524.     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  1525.     {
  1526. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1527.         if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
  1528.         {
  1529.             ssl->renego_records_seen++;
  1530.  
  1531.             if( ssl->conf->renego_max_records >= 0 &&
  1532.                 ssl->renego_records_seen > ssl->conf->renego_max_records )
  1533.             {
  1534.                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
  1535.                                     "but not honored by server" ) );
  1536.                 return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1537.             }
  1538.  
  1539.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "non-handshake message during renego" ) );
  1540.  
  1541.             ssl->keep_current_message = 1;
  1542.             return( MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO );
  1543.         }
  1544. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1545.  
  1546.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1547.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1548.                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  1549.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  1550.     }
  1551.  
  1552. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1553.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1554.     {
  1555.         if( buf[0] == MBEDTLS_SSL_HS_HELLO_VERIFY_REQUEST )
  1556.         {
  1557.             MBEDTLS_SSL_DEBUG_MSG( 2, ( "received hello verify request" ) );
  1558.             MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
  1559.             return( ssl_parse_hello_verify_request( ssl ) );
  1560.         }
  1561.         else
  1562.         {
  1563.             /* We made it through the verification process */
  1564.             mbedtls_free( ssl->handshake->verify_cookie );
  1565.             ssl->handshake->verify_cookie = NULL;
  1566.             ssl->handshake->verify_cookie_len = 0;
  1567.         }
  1568.     }
  1569. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  1570.  
  1571.     if( ssl->in_hslen < 38 + mbedtls_ssl_hs_hdr_len( ssl ) ||
  1572.         buf[0] != MBEDTLS_SSL_HS_SERVER_HELLO )
  1573.     {
  1574.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1575.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1576.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1577.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1578.     }
  1579.  
  1580.     /*
  1581.      *  0   .  1    server_version
  1582.      *  2   . 33    random (maybe including 4 bytes of Unix time)
  1583.      * 34   . 34    session_id length = n
  1584.      * 35   . 34+n  session_id
  1585.      * 35+n . 36+n  cipher_suite
  1586.      * 37+n . 37+n  compression_method
  1587.      *
  1588.      * 38+n . 39+n  extensions length (optional)
  1589.      * 40+n .  ..   extensions
  1590.      */
  1591.     buf += mbedtls_ssl_hs_hdr_len( ssl );
  1592.  
  1593.     MBEDTLS_SSL_DEBUG_BUF( 3, "server hello, version", buf + 0, 2 );
  1594.     mbedtls_ssl_read_version( &ssl->major_ver, &ssl->minor_ver,
  1595.                       ssl->conf->transport, buf + 0 );
  1596.  
  1597.     if( ssl->major_ver < ssl->conf->min_major_ver ||
  1598.         ssl->minor_ver < ssl->conf->min_minor_ver ||
  1599.         ssl->major_ver > ssl->conf->max_major_ver ||
  1600.         ssl->minor_ver > ssl->conf->max_minor_ver )
  1601.     {
  1602.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server version out of bounds - "
  1603.                             " min: [%d:%d], server: [%d:%d], max: [%d:%d]",
  1604.                             ssl->conf->min_major_ver, ssl->conf->min_minor_ver,
  1605.                             ssl->major_ver, ssl->minor_ver,
  1606.                             ssl->conf->max_major_ver, ssl->conf->max_minor_ver ) );
  1607.  
  1608.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1609.                                      MBEDTLS_SSL_ALERT_MSG_PROTOCOL_VERSION );
  1610.  
  1611.         return( MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION );
  1612.     }
  1613.  
  1614.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, current time: %lu",
  1615.                            ( (uint32_t) buf[2] << 24 ) |
  1616.                            ( (uint32_t) buf[3] << 16 ) |
  1617.                            ( (uint32_t) buf[4] <<  8 ) |
  1618.                            ( (uint32_t) buf[5]       ) ) );
  1619.  
  1620.     memcpy( ssl->handshake->randbytes + 32, buf + 2, 32 );
  1621.  
  1622.     n = buf[34];
  1623.  
  1624.     MBEDTLS_SSL_DEBUG_BUF( 3,   "server hello, random bytes", buf + 2, 32 );
  1625.  
  1626.     if( n > 32 )
  1627.     {
  1628.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1629.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1630.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1631.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1632.     }
  1633.  
  1634.     if( ssl->in_hslen > mbedtls_ssl_hs_hdr_len( ssl ) + 39 + n )
  1635.     {
  1636.         ext_len = ( ( buf[38 + n] <<  8 )
  1637.                   | ( buf[39 + n]       ) );
  1638.  
  1639.         if( ( ext_len > 0 && ext_len < 4 ) ||
  1640.             ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 40 + n + ext_len )
  1641.         {
  1642.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1643.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1644.                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1645.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1646.         }
  1647.     }
  1648.     else if( ssl->in_hslen == mbedtls_ssl_hs_hdr_len( ssl ) + 38 + n )
  1649.     {
  1650.         ext_len = 0;
  1651.     }
  1652.     else
  1653.     {
  1654.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1655.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1656.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1657.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1658.     }
  1659.  
  1660.     /* ciphersuite (used later) */
  1661.     i = ( buf[35 + n] << 8 ) | buf[36 + n];
  1662.  
  1663.     /*
  1664.      * Read and check compression
  1665.      */
  1666.     comp = buf[37 + n];
  1667.  
  1668. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1669.     /* See comments in ssl_write_client_hello() */
  1670. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  1671.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  1672.         accept_comp = 0;
  1673.     else
  1674. #endif
  1675.         accept_comp = 1;
  1676.  
  1677.     if( comp != MBEDTLS_SSL_COMPRESS_NULL &&
  1678.         ( comp != MBEDTLS_SSL_COMPRESS_DEFLATE || accept_comp == 0 ) )
  1679. #else /* MBEDTLS_ZLIB_SUPPORT */
  1680.     if( comp != MBEDTLS_SSL_COMPRESS_NULL )
  1681. #endif/* MBEDTLS_ZLIB_SUPPORT */
  1682.     {
  1683.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server hello, bad compression: %d", comp ) );
  1684.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1685.                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1686.         return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
  1687.     }
  1688.  
  1689.     /*
  1690.      * Initialize update checksum functions
  1691.      */
  1692.     ssl->transform_negotiate->ciphersuite_info = mbedtls_ssl_ciphersuite_from_id( i );
  1693.  
  1694.     if( ssl->transform_negotiate->ciphersuite_info == NULL )
  1695.     {
  1696.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ciphersuite info for %04x not found", i ) );
  1697.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1698.                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
  1699.         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  1700.     }
  1701.  
  1702.     mbedtls_ssl_optimize_checksum( ssl, ssl->transform_negotiate->ciphersuite_info );
  1703.  
  1704.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, session id len.: %d", n ) );
  1705.     MBEDTLS_SSL_DEBUG_BUF( 3,   "server hello, session id", buf + 35, n );
  1706.  
  1707.     /*
  1708.      * Check if the session can be resumed
  1709.      */
  1710.     if( ssl->handshake->resume == 0 || n == 0 ||
  1711. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1712.         ssl->renego_status != MBEDTLS_SSL_INITIAL_HANDSHAKE ||
  1713. #endif
  1714.         ssl->session_negotiate->ciphersuite != i ||
  1715.         ssl->session_negotiate->compression != comp ||
  1716.         ssl->session_negotiate->id_len != n ||
  1717.         memcmp( ssl->session_negotiate->id, buf + 35, n ) != 0 )
  1718.     {
  1719.         ssl->state++;
  1720.         ssl->handshake->resume = 0;
  1721. #if defined(MBEDTLS_HAVE_TIME)
  1722.         ssl->session_negotiate->start = mbedtls_time( NULL );
  1723. #endif
  1724.         ssl->session_negotiate->ciphersuite = i;
  1725.         ssl->session_negotiate->compression = comp;
  1726.         ssl->session_negotiate->id_len = n;
  1727.         memcpy( ssl->session_negotiate->id, buf + 35, n );
  1728.     }
  1729.     else
  1730.     {
  1731.         ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
  1732.  
  1733.         if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  1734.         {
  1735.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  1736.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1737.                                             MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
  1738.             return( ret );
  1739.         }
  1740.     }
  1741.  
  1742.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
  1743.                    ssl->handshake->resume ? "a" : "no" ) );
  1744.  
  1745.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %04x", i ) );
  1746.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, compress alg.: %d", buf[37 + n] ) );
  1747.  
  1748.     /*
  1749.      * Perform cipher suite validation in same way as in ssl_write_client_hello.
  1750.      */
  1751.     i = 0;
  1752.     while( 1 )
  1753.     {
  1754.         if( ssl->conf->ciphersuite_list[ssl->minor_ver][i] == 0 )
  1755.         {
  1756.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1757.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1758.                                             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1759.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1760.         }
  1761.  
  1762.         if( ssl->conf->ciphersuite_list[ssl->minor_ver][i++] ==
  1763.             ssl->session_negotiate->ciphersuite )
  1764.         {
  1765.             break;
  1766.         }
  1767.     }
  1768.  
  1769.     suite_info = mbedtls_ssl_ciphersuite_from_id( ssl->session_negotiate->ciphersuite );
  1770.     if( ssl_validate_ciphersuite( suite_info, ssl, ssl->minor_ver, ssl->minor_ver ) != 0 )
  1771.     {
  1772.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1773.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1774.                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1775.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1776.     }
  1777.  
  1778.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server hello, chosen ciphersuite: %s", suite_info->name ) );
  1779.  
  1780. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  1781.     if( suite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA &&
  1782.         ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  1783.     {
  1784.         ssl->handshake->ecrs_enabled = 1;
  1785.     }
  1786. #endif
  1787.  
  1788.     if( comp != MBEDTLS_SSL_COMPRESS_NULL
  1789. #if defined(MBEDTLS_ZLIB_SUPPORT)
  1790.         && comp != MBEDTLS_SSL_COMPRESS_DEFLATE
  1791. #endif
  1792.       )
  1793.     {
  1794.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1795.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1796.                                         MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  1797.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1798.     }
  1799.     ssl->session_negotiate->compression = comp;
  1800.  
  1801.     ext = buf + 40 + n;
  1802.  
  1803.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "server hello, total extension length: %d", ext_len ) );
  1804.  
  1805.     while( ext_len )
  1806.     {
  1807.         unsigned int ext_id   = ( ( ext[0] <<  8 )
  1808.                                 | ( ext[1]       ) );
  1809.         unsigned int ext_size = ( ( ext[2] <<  8 )
  1810.                                 | ( ext[3]       ) );
  1811.  
  1812.         if( ext_size + 4 > ext_len )
  1813.         {
  1814.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1815.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1816.                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  1817.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1818.         }
  1819.  
  1820.         switch( ext_id )
  1821.         {
  1822.         case MBEDTLS_TLS_EXT_RENEGOTIATION_INFO:
  1823.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found renegotiation extension" ) );
  1824. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1825.             renegotiation_info_seen = 1;
  1826. #endif
  1827.  
  1828.             if( ( ret = ssl_parse_renegotiation_info( ssl, ext + 4,
  1829.                                                       ext_size ) ) != 0 )
  1830.                 return( ret );
  1831.  
  1832.             break;
  1833.  
  1834. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
  1835.         case MBEDTLS_TLS_EXT_MAX_FRAGMENT_LENGTH:
  1836.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
  1837.  
  1838.             if( ( ret = ssl_parse_max_fragment_length_ext( ssl,
  1839.                             ext + 4, ext_size ) ) != 0 )
  1840.             {
  1841.                 return( ret );
  1842.             }
  1843.  
  1844.             break;
  1845. #endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
  1846.  
  1847. #if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
  1848.         case MBEDTLS_TLS_EXT_TRUNCATED_HMAC:
  1849.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );
  1850.  
  1851.             if( ( ret = ssl_parse_truncated_hmac_ext( ssl,
  1852.                             ext + 4, ext_size ) ) != 0 )
  1853.             {
  1854.                 return( ret );
  1855.             }
  1856.  
  1857.             break;
  1858. #endif /* MBEDTLS_SSL_TRUNCATED_HMAC */
  1859.  
  1860. #if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
  1861.         case MBEDTLS_TLS_EXT_ENCRYPT_THEN_MAC:
  1862.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found encrypt_then_mac extension" ) );
  1863.  
  1864.             if( ( ret = ssl_parse_encrypt_then_mac_ext( ssl,
  1865.                             ext + 4, ext_size ) ) != 0 )
  1866.             {
  1867.                 return( ret );
  1868.             }
  1869.  
  1870.             break;
  1871. #endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
  1872.  
  1873. #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
  1874.         case MBEDTLS_TLS_EXT_EXTENDED_MASTER_SECRET:
  1875.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found extended_master_secret extension" ) );
  1876.  
  1877.             if( ( ret = ssl_parse_extended_ms_ext( ssl,
  1878.                             ext + 4, ext_size ) ) != 0 )
  1879.             {
  1880.                 return( ret );
  1881.             }
  1882.  
  1883.             break;
  1884. #endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
  1885.  
  1886. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  1887.         case MBEDTLS_TLS_EXT_SESSION_TICKET:
  1888.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found session_ticket extension" ) );
  1889.  
  1890.             if( ( ret = ssl_parse_session_ticket_ext( ssl,
  1891.                             ext + 4, ext_size ) ) != 0 )
  1892.             {
  1893.                 return( ret );
  1894.             }
  1895.  
  1896.             break;
  1897. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  1898.  
  1899. #if defined(MBEDTLS_ECDH_C) || defined(MBEDTLS_ECDSA_C) || \
  1900.     defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1901.         case MBEDTLS_TLS_EXT_SUPPORTED_POINT_FORMATS:
  1902.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found supported_point_formats extension" ) );
  1903.  
  1904.             if( ( ret = ssl_parse_supported_point_formats_ext( ssl,
  1905.                             ext + 4, ext_size ) ) != 0 )
  1906.             {
  1907.                 return( ret );
  1908.             }
  1909.  
  1910.             break;
  1911. #endif /* MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
  1912.           MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1913.  
  1914. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  1915.         case MBEDTLS_TLS_EXT_ECJPAKE_KKPP:
  1916.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found ecjpake_kkpp extension" ) );
  1917.  
  1918.             if( ( ret = ssl_parse_ecjpake_kkpp( ssl,
  1919.                             ext + 4, ext_size ) ) != 0 )
  1920.             {
  1921.                 return( ret );
  1922.             }
  1923.  
  1924.             break;
  1925. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  1926.  
  1927. #if defined(MBEDTLS_SSL_ALPN)
  1928.         case MBEDTLS_TLS_EXT_ALPN:
  1929.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "found alpn extension" ) );
  1930.  
  1931.             if( ( ret = ssl_parse_alpn_ext( ssl, ext + 4, ext_size ) ) != 0 )
  1932.                 return( ret );
  1933.  
  1934.             break;
  1935. #endif /* MBEDTLS_SSL_ALPN */
  1936.  
  1937.         default:
  1938.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown extension found: %d (ignoring)",
  1939.                            ext_id ) );
  1940.         }
  1941.  
  1942.         ext_len -= 4 + ext_size;
  1943.         ext += 4 + ext_size;
  1944.  
  1945.         if( ext_len > 0 && ext_len < 4 )
  1946.         {
  1947.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello message" ) );
  1948.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1949.         }
  1950.     }
  1951.  
  1952.     /*
  1953.      * Renegotiation security checks
  1954.      */
  1955.     if( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1956.         ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE )
  1957.     {
  1958.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation, breaking off handshake" ) );
  1959.         handshake_failure = 1;
  1960.     }
  1961. #if defined(MBEDTLS_SSL_RENEGOTIATION)
  1962.     else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1963.              ssl->secure_renegotiation == MBEDTLS_SSL_SECURE_RENEGOTIATION &&
  1964.              renegotiation_info_seen == 0 )
  1965.     {
  1966.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension missing (secure)" ) );
  1967.         handshake_failure = 1;
  1968.     }
  1969.     else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1970.              ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1971.              ssl->conf->allow_legacy_renegotiation == MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION )
  1972.     {
  1973.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "legacy renegotiation not allowed" ) );
  1974.         handshake_failure = 1;
  1975.     }
  1976.     else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
  1977.              ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
  1978.              renegotiation_info_seen == 1 )
  1979.     {
  1980.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation_info extension present (legacy)" ) );
  1981.         handshake_failure = 1;
  1982.     }
  1983. #endif /* MBEDTLS_SSL_RENEGOTIATION */
  1984.  
  1985.     if( handshake_failure == 1 )
  1986.     {
  1987.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  1988.                                         MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  1989.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO );
  1990.     }
  1991.  
  1992.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello" ) );
  1993.  
  1994.     return( 0 );
  1995. }
  1996.  
  1997. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
  1998.     defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  1999. static int ssl_parse_server_dh_params( mbedtls_ssl_context *ssl, unsigned char **p,
  2000.                                        unsigned char *end )
  2001. {
  2002.     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2003.  
  2004.     /*
  2005.      * Ephemeral DH parameters:
  2006.      *
  2007.      * struct {
  2008.      *     opaque dh_p<1..2^16-1>;
  2009.      *     opaque dh_g<1..2^16-1>;
  2010.      *     opaque dh_Ys<1..2^16-1>;
  2011.      * } ServerDHParams;
  2012.      */
  2013.     if( ( ret = mbedtls_dhm_read_params( &ssl->handshake->dhm_ctx, p, end ) ) != 0 )
  2014.     {
  2015.         MBEDTLS_SSL_DEBUG_RET( 2, ( "mbedtls_dhm_read_params" ), ret );
  2016.         return( ret );
  2017.     }
  2018.  
  2019.     if( ssl->handshake->dhm_ctx.len * 8 < ssl->conf->dhm_min_bitlen )
  2020.     {
  2021.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "DHM prime too short: %d < %d",
  2022.                                     ssl->handshake->dhm_ctx.len * 8,
  2023.                                     ssl->conf->dhm_min_bitlen ) );
  2024.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2025.     }
  2026.  
  2027.     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: P ", &ssl->handshake->dhm_ctx.P  );
  2028.     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: G ", &ssl->handshake->dhm_ctx.G  );
  2029.     MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GY", &ssl->handshake->dhm_ctx.GY );
  2030.  
  2031.     return( ret );
  2032. }
  2033. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  2034.           MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2035.  
  2036. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
  2037.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) ||                   \
  2038.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) ||                     \
  2039.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||                      \
  2040.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2041. static int ssl_check_server_ecdh_params( const mbedtls_ssl_context *ssl )
  2042. {
  2043.     const mbedtls_ecp_curve_info *curve_info;
  2044.     mbedtls_ecp_group_id grp_id;
  2045. #if defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
  2046.     grp_id = ssl->handshake->ecdh_ctx.grp.id;
  2047. #else
  2048.     grp_id = ssl->handshake->ecdh_ctx.grp_id;
  2049. #endif
  2050.  
  2051.     curve_info = mbedtls_ecp_curve_info_from_grp_id( grp_id );
  2052.     if( curve_info == NULL )
  2053.     {
  2054.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2055.         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2056.     }
  2057.  
  2058.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "ECDH curve: %s", curve_info->name ) );
  2059.  
  2060. #if defined(MBEDTLS_ECP_C)
  2061.     if( mbedtls_ssl_check_curve( ssl, grp_id ) != 0 )
  2062. #else
  2063.     if( ssl->handshake->ecdh_ctx.grp.nbits < 163 ||
  2064.         ssl->handshake->ecdh_ctx.grp.nbits > 521 )
  2065. #endif
  2066.         return( -1 );
  2067.  
  2068.     MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
  2069.                             MBEDTLS_DEBUG_ECDH_QP );
  2070.  
  2071.     return( 0 );
  2072. }
  2073. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2074.           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  2075.           MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
  2076.           MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  2077.           MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  2078.  
  2079. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
  2080.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) ||                   \
  2081.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  2082. static int ssl_parse_server_ecdh_params( mbedtls_ssl_context *ssl,
  2083.                                          unsigned char **p,
  2084.                                          unsigned char *end )
  2085. {
  2086.     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2087.  
  2088.     /*
  2089.      * Ephemeral ECDH parameters:
  2090.      *
  2091.      * struct {
  2092.      *     ECParameters curve_params;
  2093.      *     ECPoint      public;
  2094.      * } ServerECDHParams;
  2095.      */
  2096.     if( ( ret = mbedtls_ecdh_read_params( &ssl->handshake->ecdh_ctx,
  2097.                                   (const unsigned char **) p, end ) ) != 0 )
  2098.     {
  2099.         MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_read_params" ), ret );
  2100. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2101.         if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
  2102.             ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
  2103. #endif
  2104.         return( ret );
  2105.     }
  2106.  
  2107.     if( ssl_check_server_ecdh_params( ssl ) != 0 )
  2108.     {
  2109.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (ECDHE curve)" ) );
  2110.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2111.     }
  2112.  
  2113.     return( ret );
  2114. }
  2115. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2116.           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  2117.           MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
  2118.  
  2119. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  2120. static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
  2121.                                       unsigned char **p,
  2122.                                       unsigned char *end )
  2123. {
  2124.     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  2125.     size_t  len;
  2126.     ((void) ssl);
  2127.  
  2128.     /*
  2129.      * PSK parameters:
  2130.      *
  2131.      * opaque psk_identity_hint<0..2^16-1>;
  2132.      */
  2133.     if( end - (*p) < 2 )
  2134.     {
  2135.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
  2136.                                     "(psk_identity_hint length)" ) );
  2137.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2138.     }
  2139.     len = (*p)[0] << 8 | (*p)[1];
  2140.     *p += 2;
  2141.  
  2142.     if( end - (*p) < (int) len )
  2143.     {
  2144.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
  2145.                                     "(psk_identity_hint length)" ) );
  2146.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2147.     }
  2148.  
  2149.     /*
  2150.      * Note: we currently ignore the PKS identity hint, as we only allow one
  2151.      * PSK to be provisionned on the client. This could be changed later if
  2152.      * someone needs that feature.
  2153.      */
  2154.     *p += len;
  2155.     ret = 0;
  2156.  
  2157.     return( ret );
  2158. }
  2159. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  2160.  
  2161. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) ||                           \
  2162.     defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2163. /*
  2164.  * Generate a pre-master secret and encrypt it with the server's RSA key
  2165.  */
  2166. static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
  2167.                                     size_t offset, size_t *olen,
  2168.                                     size_t pms_offset )
  2169. {
  2170.     int ret;
  2171.     size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
  2172.     unsigned char *p = ssl->handshake->premaster + pms_offset;
  2173.  
  2174.     if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN )
  2175.     {
  2176.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "buffer too small for encrypted pms" ) );
  2177.         return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
  2178.     }
  2179.  
  2180.     /*
  2181.      * Generate (part of) the pre-master as
  2182.      *  struct {
  2183.      *      ProtocolVersion client_version;
  2184.      *      opaque random[46];
  2185.      *  } PreMasterSecret;
  2186.      */
  2187.     mbedtls_ssl_write_version( ssl->conf->max_major_ver, ssl->conf->max_minor_ver,
  2188.                        ssl->conf->transport, p );
  2189.  
  2190.     if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng, p + 2, 46 ) ) != 0 )
  2191.     {
  2192.         MBEDTLS_SSL_DEBUG_RET( 1, "f_rng", ret );
  2193.         return( ret );
  2194.     }
  2195.  
  2196.     ssl->handshake->pmslen = 48;
  2197.  
  2198.     if( ssl->session_negotiate->peer_cert == NULL )
  2199.     {
  2200.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
  2201.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2202.     }
  2203.  
  2204.     /*
  2205.      * Now write it out, encrypted
  2206.      */
  2207.     if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
  2208.                 MBEDTLS_PK_RSA ) )
  2209.     {
  2210.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
  2211.         return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  2212.     }
  2213.  
  2214.     if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk,
  2215.                             p, ssl->handshake->pmslen,
  2216.                             ssl->out_msg + offset + len_bytes, olen,
  2217.                             MBEDTLS_SSL_OUT_CONTENT_LEN - offset - len_bytes,
  2218.                             ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2219.     {
  2220.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_rsa_pkcs1_encrypt", ret );
  2221.         return( ret );
  2222.     }
  2223.  
  2224. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  2225.     defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2226.     if( len_bytes == 2 )
  2227.     {
  2228.         ssl->out_msg[offset+0] = (unsigned char)( *olen >> 8 );
  2229.         ssl->out_msg[offset+1] = (unsigned char)( *olen      );
  2230.         *olen += 2;
  2231.     }
  2232. #endif
  2233.  
  2234.     return( 0 );
  2235. }
  2236. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED ||
  2237.           MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
  2238.  
  2239. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2240. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
  2241.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
  2242.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2243. static int ssl_parse_signature_algorithm( mbedtls_ssl_context *ssl,
  2244.                                           unsigned char **p,
  2245.                                           unsigned char *end,
  2246.                                           mbedtls_md_type_t *md_alg,
  2247.                                           mbedtls_pk_type_t *pk_alg )
  2248. {
  2249.     ((void) ssl);
  2250.     *md_alg = MBEDTLS_MD_NONE;
  2251.     *pk_alg = MBEDTLS_PK_NONE;
  2252.  
  2253.     /* Only in TLS 1.2 */
  2254.     if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  2255.     {
  2256.         return( 0 );
  2257.     }
  2258.  
  2259.     if( (*p) + 2 > end )
  2260.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2261.  
  2262.     /*
  2263.      * Get hash algorithm
  2264.      */
  2265.     if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) ) == MBEDTLS_MD_NONE )
  2266.     {
  2267.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
  2268.                             "HashAlgorithm %d", *(p)[0] ) );
  2269.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2270.     }
  2271.  
  2272.     /*
  2273.      * Get signature algorithm
  2274.      */
  2275.     if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) ) == MBEDTLS_PK_NONE )
  2276.     {
  2277.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
  2278.                             "SignatureAlgorithm %d", (*p)[1] ) );
  2279.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2280.     }
  2281.  
  2282.     /*
  2283.      * Check if the hash is acceptable
  2284.      */
  2285.     if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
  2286.     {
  2287.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm %d that was not offered",
  2288.                                     *(p)[0] ) );
  2289.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2290.     }
  2291.  
  2292.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used SignatureAlgorithm %d", (*p)[1] ) );
  2293.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used HashAlgorithm %d", (*p)[0] ) );
  2294.     *p += 2;
  2295.  
  2296.     return( 0 );
  2297. }
  2298. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  2299.           MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2300.           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  2301. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2302.  
  2303. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  2304.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2305. static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
  2306. {
  2307.     int ret;
  2308.     const mbedtls_ecp_keypair *peer_key;
  2309.  
  2310.     if( ssl->session_negotiate->peer_cert == NULL )
  2311.     {
  2312.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
  2313.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2314.     }
  2315.  
  2316.     if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk,
  2317.                      MBEDTLS_PK_ECKEY ) )
  2318.     {
  2319.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );
  2320.         return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  2321.     }
  2322.  
  2323.     peer_key = mbedtls_pk_ec( ssl->session_negotiate->peer_cert->pk );
  2324.  
  2325.     if( ( ret = mbedtls_ecdh_get_params( &ssl->handshake->ecdh_ctx, peer_key,
  2326.                                  MBEDTLS_ECDH_THEIRS ) ) != 0 )
  2327.     {
  2328.         MBEDTLS_SSL_DEBUG_RET( 1, ( "mbedtls_ecdh_get_params" ), ret );
  2329.         return( ret );
  2330.     }
  2331.  
  2332.     if( ssl_check_server_ecdh_params( ssl ) != 0 )
  2333.     {
  2334.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server certificate (ECDH curve)" ) );
  2335.         return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE );
  2336.     }
  2337.  
  2338.     return( ret );
  2339. }
  2340. #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||
  2341.           MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  2342.  
  2343. static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
  2344. {
  2345.     int ret;
  2346.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2347.         ssl->transform_negotiate->ciphersuite_info;
  2348.     unsigned char *p = NULL, *end = NULL;
  2349.  
  2350.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
  2351.  
  2352. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
  2353.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
  2354.     {
  2355.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
  2356.         ssl->state++;
  2357.         return( 0 );
  2358.     }
  2359.     ((void) p);
  2360.     ((void) end);
  2361. #endif
  2362.  
  2363. #if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || \
  2364.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2365.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
  2366.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
  2367.     {
  2368.         if( ( ret = ssl_get_ecdh_params_from_cert( ssl ) ) != 0 )
  2369.         {
  2370.             MBEDTLS_SSL_DEBUG_RET( 1, "ssl_get_ecdh_params_from_cert", ret );
  2371.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2372.                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  2373.             return( ret );
  2374.         }
  2375.  
  2376.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse server key exchange" ) );
  2377.         ssl->state++;
  2378.         return( 0 );
  2379.     }
  2380.     ((void) p);
  2381.     ((void) end);
  2382. #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  2383.           MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  2384.  
  2385. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2386.     if( ssl->handshake->ecrs_enabled &&
  2387.         ssl->handshake->ecrs_state == ssl_ecrs_ske_start_processing )
  2388.     {
  2389.         goto start_processing;
  2390.     }
  2391. #endif
  2392.  
  2393.     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
  2394.     {
  2395.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2396.         return( ret );
  2397.     }
  2398.  
  2399.     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2400.     {
  2401.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2402.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2403.                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  2404.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2405.     }
  2406.  
  2407.     /*
  2408.      * ServerKeyExchange may be skipped with PSK and RSA-PSK when the server
  2409.      * doesn't use a psk_identity_hint
  2410.      */
  2411.     if( ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_KEY_EXCHANGE )
  2412.     {
  2413.         if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2414.             ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  2415.         {
  2416.             /* Current message is probably either
  2417.              * CertificateRequest or ServerHelloDone */
  2418.             ssl->keep_current_message = 1;
  2419.             goto exit;
  2420.         }
  2421.  
  2422.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key exchange message must "
  2423.                                     "not be skipped" ) );
  2424.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2425.                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  2426.  
  2427.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2428.     }
  2429.  
  2430. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2431.     if( ssl->handshake->ecrs_enabled )
  2432.         ssl->handshake->ecrs_state = ssl_ecrs_ske_start_processing;
  2433.  
  2434. start_processing:
  2435. #endif
  2436.     p   = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  2437.     end = ssl->in_msg + ssl->in_hslen;
  2438.     MBEDTLS_SSL_DEBUG_BUF( 3,   "server key exchange", p, end - p );
  2439.  
  2440. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  2441.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2442.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  2443.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  2444.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  2445.     {
  2446.         if( ssl_parse_server_psk_hint( ssl, &p, end ) != 0 )
  2447.         {
  2448.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2449.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2450.                                             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2451.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2452.         }
  2453.     } /* FALLTROUGH */
  2454. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  2455.  
  2456. #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) ||                       \
  2457.     defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  2458.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  2459.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  2460.         ; /* nothing more to do */
  2461.     else
  2462. #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
  2463.           MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
  2464. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) ||                       \
  2465.     defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  2466.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA ||
  2467.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
  2468.     {
  2469.         if( ssl_parse_server_dh_params( ssl, &p, end ) != 0 )
  2470.         {
  2471.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2472.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2473.                                             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2474.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2475.         }
  2476.     }
  2477.     else
  2478. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED ||
  2479.           MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  2480. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
  2481.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) ||                     \
  2482.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  2483.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2484.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  2485.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA )
  2486.     {
  2487.         if( ssl_parse_server_ecdh_params( ssl, &p, end ) != 0 )
  2488.         {
  2489.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2490.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2491.                                             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2492.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2493.         }
  2494.     }
  2495.     else
  2496. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  2497.           MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
  2498.           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  2499. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  2500.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  2501.     {
  2502.         ret = mbedtls_ecjpake_read_round_two( &ssl->handshake->ecjpake_ctx,
  2503.                                               p, end - p );
  2504.         if( ret != 0 )
  2505.         {
  2506.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_read_round_two", ret );
  2507.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2508.                                             MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2509.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2510.         }
  2511.     }
  2512.     else
  2513. #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
  2514.     {
  2515.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2516.         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2517.     }
  2518.  
  2519. #if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
  2520.     if( mbedtls_ssl_ciphersuite_uses_server_signature( ciphersuite_info ) )
  2521.     {
  2522.         size_t sig_len, hashlen;
  2523.         unsigned char hash[64];
  2524.         mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
  2525.         mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
  2526.         unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  2527.         size_t params_len = p - params;
  2528.         void *rs_ctx = NULL;
  2529.  
  2530.         /*
  2531.          * Handle the digitally-signed structure
  2532.          */
  2533. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2534.         if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2535.         {
  2536.             if( ssl_parse_signature_algorithm( ssl, &p, end,
  2537.                                                &md_alg, &pk_alg ) != 0 )
  2538.             {
  2539.                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2540.                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2541.                                                 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2542.                 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2543.             }
  2544.  
  2545.             if( pk_alg != mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info ) )
  2546.             {
  2547.                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2548.                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2549.                                                 MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER );
  2550.                 return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2551.             }
  2552.         }
  2553.         else
  2554. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2555. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2556.     defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2557.         if( ssl->minor_ver < MBEDTLS_SSL_MINOR_VERSION_3 )
  2558.         {
  2559.             pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
  2560.  
  2561.             /* Default hash for ECDSA is SHA-1 */
  2562.             if( pk_alg == MBEDTLS_PK_ECDSA && md_alg == MBEDTLS_MD_NONE )
  2563.                 md_alg = MBEDTLS_MD_SHA1;
  2564.         }
  2565.         else
  2566. #endif
  2567.         {
  2568.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2569.             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2570.         }
  2571.  
  2572.         /*
  2573.          * Read signature
  2574.          */
  2575.  
  2576.         if( p > end - 2 )
  2577.         {
  2578.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2579.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2580.                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2581.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2582.         }
  2583.         sig_len = ( p[0] << 8 ) | p[1];
  2584.         p += 2;
  2585.  
  2586.         if( p != end - sig_len )
  2587.         {
  2588.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2589.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2590.                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2591.             return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
  2592.         }
  2593.  
  2594.         MBEDTLS_SSL_DEBUG_BUF( 3, "signature", p, sig_len );
  2595.  
  2596.         /*
  2597.          * Compute the hash that has been signed
  2598.          */
  2599. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  2600.     defined(MBEDTLS_SSL_PROTO_TLS1_1)
  2601.         if( md_alg == MBEDTLS_MD_NONE )
  2602.         {
  2603.             hashlen = 36;
  2604.             ret = mbedtls_ssl_get_key_exchange_md_ssl_tls( ssl, hash, params,
  2605.                                                            params_len );
  2606.             if( ret != 0 )
  2607.                 return( ret );
  2608.         }
  2609.         else
  2610. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  2611.           MBEDTLS_SSL_PROTO_TLS1_1 */
  2612. #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
  2613.     defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2614.         if( md_alg != MBEDTLS_MD_NONE )
  2615.         {
  2616.             ret = mbedtls_ssl_get_key_exchange_md_tls1_2( ssl, hash, &hashlen,
  2617.                                                           params, params_len,
  2618.                                                           md_alg );
  2619.             if( ret != 0 )
  2620.                 return( ret );
  2621.         }
  2622.         else
  2623. #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
  2624.           MBEDTLS_SSL_PROTO_TLS1_2 */
  2625.         {
  2626.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2627.             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2628.         }
  2629.  
  2630.         MBEDTLS_SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
  2631.  
  2632.         if( ssl->session_negotiate->peer_cert == NULL )
  2633.         {
  2634.             MBEDTLS_SSL_DEBUG_MSG( 2, ( "certificate required" ) );
  2635.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2636.                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  2637.             return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2638.         }
  2639.  
  2640.         /*
  2641.          * Verify signature
  2642.          */
  2643.         if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, pk_alg ) )
  2644.         {
  2645.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message" ) );
  2646.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2647.                                             MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE );
  2648.             return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
  2649.         }
  2650.  
  2651. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2652.         if( ssl->handshake->ecrs_enabled )
  2653.             rs_ctx = &ssl->handshake->ecrs_ctx.pk;
  2654. #endif
  2655.  
  2656.         if( ( ret = mbedtls_pk_verify_restartable(
  2657.                         &ssl->session_negotiate->peer_cert->pk,
  2658.                         md_alg, hash, hashlen, p, sig_len, rs_ctx ) ) != 0 )
  2659.         {
  2660. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2661.             if( ret != MBEDTLS_ERR_ECP_IN_PROGRESS )
  2662. #endif
  2663.                 mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2664.                                                 MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR );
  2665.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify", ret );
  2666. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2667.             if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
  2668.                 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
  2669. #endif
  2670.             return( ret );
  2671.         }
  2672.     }
  2673. #endif /* MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED */
  2674.  
  2675. exit:
  2676.     ssl->state++;
  2677.  
  2678.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server key exchange" ) );
  2679.  
  2680.     return( 0 );
  2681. }
  2682.  
  2683. #if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
  2684. static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
  2685. {
  2686.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2687.         ssl->transform_negotiate->ciphersuite_info;
  2688.  
  2689.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
  2690.  
  2691.     if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
  2692.     {
  2693.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
  2694.         ssl->state++;
  2695.         return( 0 );
  2696.     }
  2697.  
  2698.     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  2699.     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  2700. }
  2701. #else /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
  2702. static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
  2703. {
  2704.     int ret;
  2705.     unsigned char *buf;
  2706.     size_t n = 0;
  2707.     size_t cert_type_len = 0, dn_len = 0;
  2708.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2709.         ssl->transform_negotiate->ciphersuite_info;
  2710.  
  2711.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
  2712.  
  2713.     if( ! mbedtls_ssl_ciphersuite_cert_req_allowed( ciphersuite_info ) )
  2714.     {
  2715.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate request" ) );
  2716.         ssl->state++;
  2717.         return( 0 );
  2718.     }
  2719.  
  2720.     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
  2721.     {
  2722.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2723.         return( ret );
  2724.     }
  2725.  
  2726.     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2727.     {
  2728.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2729.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2730.                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  2731.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2732.     }
  2733.  
  2734.     ssl->state++;
  2735.     ssl->client_auth = ( ssl->in_msg[0] == MBEDTLS_SSL_HS_CERTIFICATE_REQUEST );
  2736.  
  2737.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "got %s certificate request",
  2738.                         ssl->client_auth ? "a" : "no" ) );
  2739.  
  2740.     if( ssl->client_auth == 0 )
  2741.     {
  2742.         /* Current message is probably the ServerHelloDone */
  2743.         ssl->keep_current_message = 1;
  2744.         goto exit;
  2745.     }
  2746.  
  2747.     /*
  2748.      *  struct {
  2749.      *      ClientCertificateType certificate_types<1..2^8-1>;
  2750.      *      SignatureAndHashAlgorithm
  2751.      *        supported_signature_algorithms<2^16-1>; -- TLS 1.2 only
  2752.      *      DistinguishedName certificate_authorities<0..2^16-1>;
  2753.      *  } CertificateRequest;
  2754.      *
  2755.      *  Since we only support a single certificate on clients, let's just
  2756.      *  ignore all the information that's supposed to help us pick a
  2757.      *  certificate.
  2758.      *
  2759.      *  We could check that our certificate matches the request, and bail out
  2760.      *  if it doesn't, but it's simpler to just send the certificate anyway,
  2761.      *  and give the server the opportunity to decide if it should terminate
  2762.      *  the connection when it doesn't like our certificate.
  2763.      *
  2764.      *  Same goes for the hash in TLS 1.2's signature_algorithms: at this
  2765.      *  point we only have one hash available (see comments in
  2766.      *  write_certificate_verify), so let's just use what we have.
  2767.      *
  2768.      *  However, we still minimally parse the message to check it is at least
  2769.      *  superficially sane.
  2770.      */
  2771.     buf = ssl->in_msg;
  2772.  
  2773.     /* certificate_types */
  2774.     if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) )
  2775.     {
  2776.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2777.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2778.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2779.         return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2780.     }
  2781.     cert_type_len = buf[mbedtls_ssl_hs_hdr_len( ssl )];
  2782.     n = cert_type_len;
  2783.  
  2784.     /*
  2785.      * In the subsequent code there are two paths that read from buf:
  2786.      *     * the length of the signature algorithms field (if minor version of
  2787.      *       SSL is 3),
  2788.      *     * distinguished name length otherwise.
  2789.      * Both reach at most the index:
  2790.      *    ...hdr_len + 2 + n,
  2791.      * therefore the buffer length at this point must be greater than that
  2792.      * regardless of the actual code path.
  2793.      */
  2794.     if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n )
  2795.     {
  2796.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2797.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2798.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2799.         return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2800.     }
  2801.  
  2802.     /* supported_signature_algorithms */
  2803. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  2804.     if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  2805.     {
  2806.         size_t sig_alg_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] <<  8 )
  2807.                              | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n]       ) );
  2808. #if defined(MBEDTLS_DEBUG_C)
  2809.         unsigned char* sig_alg;
  2810.         size_t i;
  2811. #endif
  2812.  
  2813.         /*
  2814.          * The furthest access in buf is in the loop few lines below:
  2815.          *     sig_alg[i + 1],
  2816.          * where:
  2817.          *     sig_alg = buf + ...hdr_len + 3 + n,
  2818.          *     max(i) = sig_alg_len - 1.
  2819.          * Therefore the furthest access is:
  2820.          *     buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
  2821.          * which reduces to:
  2822.          *     buf[...hdr_len + 3 + n + sig_alg_len],
  2823.          * which is one less than we need the buf to be.
  2824.          */
  2825.         if( ssl->in_hslen <= mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n + sig_alg_len )
  2826.         {
  2827.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2828.             mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2829.                                             MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2830.             return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2831.         }
  2832.  
  2833. #if defined(MBEDTLS_DEBUG_C)
  2834.         sig_alg = buf + mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n;
  2835.         for( i = 0; i < sig_alg_len; i += 2 )
  2836.         {
  2837.             MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d"
  2838.                                         ",%d", sig_alg[i], sig_alg[i + 1]  ) );
  2839.         }
  2840. #endif
  2841.  
  2842.         n += 2 + sig_alg_len;
  2843.     }
  2844. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  2845.  
  2846.     /* certificate_authorities */
  2847.     dn_len = ( ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 1 + n] <<  8 )
  2848.              | ( buf[mbedtls_ssl_hs_hdr_len( ssl ) + 2 + n]       ) );
  2849.  
  2850.     n += dn_len;
  2851.     if( ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) + 3 + n )
  2852.     {
  2853.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate request message" ) );
  2854.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2855.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2856.         return( MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST );
  2857.     }
  2858.  
  2859. exit:
  2860.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse certificate request" ) );
  2861.  
  2862.     return( 0 );
  2863. }
  2864. #endif /* MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED */
  2865.  
  2866. static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl )
  2867. {
  2868.     int ret;
  2869.  
  2870.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) );
  2871.  
  2872.     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
  2873.     {
  2874.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  2875.         return( ret );
  2876.     }
  2877.  
  2878.     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  2879.     {
  2880.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
  2881.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  2882.     }
  2883.  
  2884.     if( ssl->in_hslen  != mbedtls_ssl_hs_hdr_len( ssl ) ||
  2885.         ssl->in_msg[0] != MBEDTLS_SSL_HS_SERVER_HELLO_DONE )
  2886.     {
  2887.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server hello done message" ) );
  2888.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  2889.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  2890.         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE );
  2891.     }
  2892.  
  2893.     ssl->state++;
  2894.  
  2895. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  2896.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
  2897.         mbedtls_ssl_recv_flight_completed( ssl );
  2898. #endif
  2899.  
  2900.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) );
  2901.  
  2902.     return( 0 );
  2903. }
  2904.  
  2905. static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
  2906. {
  2907.     int ret;
  2908.     size_t i, n;
  2909.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  2910.         ssl->transform_negotiate->ciphersuite_info;
  2911.  
  2912.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
  2913.  
  2914. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)
  2915.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_RSA )
  2916.     {
  2917.         /*
  2918.          * DHM key exchange -- send G^X mod P
  2919.          */
  2920.         n = ssl->handshake->dhm_ctx.len;
  2921.  
  2922.         ssl->out_msg[4] = (unsigned char)( n >> 8 );
  2923.         ssl->out_msg[5] = (unsigned char)( n      );
  2924.         i = 6;
  2925.  
  2926.         ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
  2927.                                 (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
  2928.                                &ssl->out_msg[i], n,
  2929.                                 ssl->conf->f_rng, ssl->conf->p_rng );
  2930.         if( ret != 0 )
  2931.         {
  2932.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
  2933.             return( ret );
  2934.         }
  2935.  
  2936.         MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: X ", &ssl->handshake->dhm_ctx.X  );
  2937.         MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: GX", &ssl->handshake->dhm_ctx.GX );
  2938.  
  2939.         if( ( ret = mbedtls_dhm_calc_secret( &ssl->handshake->dhm_ctx,
  2940.                                       ssl->handshake->premaster,
  2941.                                       MBEDTLS_PREMASTER_SIZE,
  2942.                                      &ssl->handshake->pmslen,
  2943.                                       ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  2944.         {
  2945.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_calc_secret", ret );
  2946.             return( ret );
  2947.         }
  2948.  
  2949.         MBEDTLS_SSL_DEBUG_MPI( 3, "DHM: K ", &ssl->handshake->dhm_ctx.K  );
  2950.     }
  2951.     else
  2952. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED */
  2953. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) ||                     \
  2954.     defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) ||                   \
  2955.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) ||                      \
  2956.     defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)
  2957.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_RSA ||
  2958.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA ||
  2959.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_RSA ||
  2960.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA )
  2961.     {
  2962.         /*
  2963.          * ECDH key exchange -- send client public value
  2964.          */
  2965.         i = 4;
  2966.  
  2967. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2968.         if( ssl->handshake->ecrs_enabled )
  2969.         {
  2970.             if( ssl->handshake->ecrs_state == ssl_ecrs_cke_ecdh_calc_secret )
  2971.                 goto ecdh_calc_secret;
  2972.  
  2973.             mbedtls_ecdh_enable_restart( &ssl->handshake->ecdh_ctx );
  2974.         }
  2975. #endif
  2976.  
  2977.         ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx,
  2978.                                 &n,
  2979.                                 &ssl->out_msg[i], 1000,
  2980.                                 ssl->conf->f_rng, ssl->conf->p_rng );
  2981.         if( ret != 0 )
  2982.         {
  2983.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
  2984. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2985.             if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
  2986.                 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
  2987. #endif
  2988.             return( ret );
  2989.         }
  2990.  
  2991.         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
  2992.                                 MBEDTLS_DEBUG_ECDH_Q );
  2993.  
  2994. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  2995.         if( ssl->handshake->ecrs_enabled )
  2996.         {
  2997.             ssl->handshake->ecrs_n = n;
  2998.             ssl->handshake->ecrs_state = ssl_ecrs_cke_ecdh_calc_secret;
  2999.         }
  3000.  
  3001. ecdh_calc_secret:
  3002.         if( ssl->handshake->ecrs_enabled )
  3003.             n = ssl->handshake->ecrs_n;
  3004. #endif
  3005.         if( ( ret = mbedtls_ecdh_calc_secret( &ssl->handshake->ecdh_ctx,
  3006.                                       &ssl->handshake->pmslen,
  3007.                                        ssl->handshake->premaster,
  3008.                                        MBEDTLS_MPI_MAX_SIZE,
  3009.                                        ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
  3010.         {
  3011.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_calc_secret", ret );
  3012. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  3013.             if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
  3014.                 ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
  3015. #endif
  3016.             return( ret );
  3017.         }
  3018.  
  3019.         MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
  3020.                                 MBEDTLS_DEBUG_ECDH_Z );
  3021.     }
  3022.     else
  3023. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED ||
  3024.           MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED ||
  3025.           MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED ||
  3026.           MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */
  3027. #if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
  3028.     if( mbedtls_ssl_ciphersuite_uses_psk( ciphersuite_info ) )
  3029.     {
  3030.         /*
  3031.          * opaque psk_identity<0..2^16-1>;
  3032.          */
  3033.         if( ssl->conf->psk == NULL || ssl->conf->psk_identity == NULL )
  3034.         {
  3035.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for PSK" ) );
  3036.             return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  3037.         }
  3038.  
  3039.         i = 4;
  3040.         n = ssl->conf->psk_identity_len;
  3041.  
  3042.         if( i + 2 + n > MBEDTLS_SSL_OUT_CONTENT_LEN )
  3043.         {
  3044.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity too long or "
  3045.                                         "SSL buffer too short" ) );
  3046.             return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
  3047.         }
  3048.  
  3049.         ssl->out_msg[i++] = (unsigned char)( n >> 8 );
  3050.         ssl->out_msg[i++] = (unsigned char)( n      );
  3051.  
  3052.         memcpy( ssl->out_msg + i, ssl->conf->psk_identity, ssl->conf->psk_identity_len );
  3053.         i += ssl->conf->psk_identity_len;
  3054.  
  3055. #if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
  3056.         if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK )
  3057.         {
  3058.             n = 0;
  3059.         }
  3060.         else
  3061. #endif
  3062. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED)
  3063.         if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK )
  3064.         {
  3065.             if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 2 ) ) != 0 )
  3066.                 return( ret );
  3067.         }
  3068.         else
  3069. #endif
  3070. #if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED)
  3071.         if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK )
  3072.         {
  3073.             /*
  3074.              * ClientDiffieHellmanPublic public (DHM send G^X mod P)
  3075.              */
  3076.             n = ssl->handshake->dhm_ctx.len;
  3077.  
  3078.             if( i + 2 + n > MBEDTLS_SSL_OUT_CONTENT_LEN )
  3079.             {
  3080.                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "psk identity or DHM size too long"
  3081.                                             " or SSL buffer too short" ) );
  3082.                 return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
  3083.             }
  3084.  
  3085.             ssl->out_msg[i++] = (unsigned char)( n >> 8 );
  3086.             ssl->out_msg[i++] = (unsigned char)( n      );
  3087.  
  3088.             ret = mbedtls_dhm_make_public( &ssl->handshake->dhm_ctx,
  3089.                     (int) mbedtls_mpi_size( &ssl->handshake->dhm_ctx.P ),
  3090.                     &ssl->out_msg[i], n,
  3091.                     ssl->conf->f_rng, ssl->conf->p_rng );
  3092.             if( ret != 0 )
  3093.             {
  3094.                 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_dhm_make_public", ret );
  3095.                 return( ret );
  3096.             }
  3097.         }
  3098.         else
  3099. #endif /* MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED */
  3100. #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED)
  3101.         if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK )
  3102.         {
  3103.             /*
  3104.              * ClientECDiffieHellmanPublic public;
  3105.              */
  3106.             ret = mbedtls_ecdh_make_public( &ssl->handshake->ecdh_ctx, &n,
  3107.                     &ssl->out_msg[i], MBEDTLS_SSL_OUT_CONTENT_LEN - i,
  3108.                     ssl->conf->f_rng, ssl->conf->p_rng );
  3109.             if( ret != 0 )
  3110.             {
  3111.                 MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_make_public", ret );
  3112.                 return( ret );
  3113.             }
  3114.  
  3115.             MBEDTLS_SSL_DEBUG_ECDH( 3, &ssl->handshake->ecdh_ctx,
  3116.                                     MBEDTLS_DEBUG_ECDH_Q );
  3117.         }
  3118.         else
  3119. #endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
  3120.         {
  3121.             MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  3122.             return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  3123.         }
  3124.  
  3125.         if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
  3126.                         ciphersuite_info->key_exchange ) ) != 0 )
  3127.         {
  3128.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
  3129.             return( ret );
  3130.         }
  3131.     }
  3132.     else
  3133. #endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
  3134. #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)
  3135.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA )
  3136.     {
  3137.         i = 4;
  3138.         if( ( ret = ssl_write_encrypted_pms( ssl, i, &n, 0 ) ) != 0 )
  3139.             return( ret );
  3140.     }
  3141.     else
  3142. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
  3143. #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
  3144.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  3145.     {
  3146.         i = 4;
  3147.  
  3148.         ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
  3149.                 ssl->out_msg + i, MBEDTLS_SSL_OUT_CONTENT_LEN - i, &n,
  3150.                 ssl->conf->f_rng, ssl->conf->p_rng );
  3151.         if( ret != 0 )
  3152.         {
  3153.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
  3154.             return( ret );
  3155.         }
  3156.  
  3157.         ret = mbedtls_ecjpake_derive_secret( &ssl->handshake->ecjpake_ctx,
  3158.                 ssl->handshake->premaster, 32, &ssl->handshake->pmslen,
  3159.                 ssl->conf->f_rng, ssl->conf->p_rng );
  3160.         if( ret != 0 )
  3161.         {
  3162.             MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_derive_secret", ret );
  3163.             return( ret );
  3164.         }
  3165.     }
  3166.     else
  3167. #endif /* MBEDTLS_KEY_EXCHANGE_RSA_ENABLED */
  3168.     {
  3169.         ((void) ciphersuite_info);
  3170.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  3171.         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  3172.     }
  3173.  
  3174.     ssl->out_msglen  = i + n;
  3175.     ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  3176.     ssl->out_msg[0]  = MBEDTLS_SSL_HS_CLIENT_KEY_EXCHANGE;
  3177.  
  3178.     ssl->state++;
  3179.  
  3180.     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
  3181.     {
  3182.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
  3183.         return( ret );
  3184.     }
  3185.  
  3186.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write client key exchange" ) );
  3187.  
  3188.     return( 0 );
  3189. }
  3190.  
  3191. #if !defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED)       && \
  3192.     !defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED)   && \
  3193.     !defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED)  && \
  3194.     !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
  3195.     !defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED)&& \
  3196.     !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
  3197. static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
  3198. {
  3199.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  3200.         ssl->transform_negotiate->ciphersuite_info;
  3201.     int ret;
  3202.  
  3203.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
  3204.  
  3205.     if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  3206.     {
  3207.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  3208.         return( ret );
  3209.     }
  3210.  
  3211.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  3212.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  3213.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  3214.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  3215.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  3216.     {
  3217.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
  3218.         ssl->state++;
  3219.         return( 0 );
  3220.     }
  3221.  
  3222.     MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  3223.     return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  3224. }
  3225. #else
  3226. static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
  3227. {
  3228.     int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
  3229.     const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
  3230.         ssl->transform_negotiate->ciphersuite_info;
  3231.     size_t n = 0, offset = 0;
  3232.     unsigned char hash[48];
  3233.     unsigned char *hash_start = hash;
  3234.     mbedtls_md_type_t md_alg = MBEDTLS_MD_NONE;
  3235.     unsigned int hashlen;
  3236.     void *rs_ctx = NULL;
  3237.  
  3238.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
  3239.  
  3240. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  3241.     if( ssl->handshake->ecrs_enabled &&
  3242.         ssl->handshake->ecrs_state == ssl_ecrs_crt_vrfy_sign )
  3243.     {
  3244.         goto sign;
  3245.     }
  3246. #endif
  3247.  
  3248.     if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
  3249.     {
  3250.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
  3251.         return( ret );
  3252.     }
  3253.  
  3254.     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
  3255.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
  3256.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
  3257.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
  3258.         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
  3259.     {
  3260.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
  3261.         ssl->state++;
  3262.         return( 0 );
  3263.     }
  3264.  
  3265.     if( ssl->client_auth == 0 || mbedtls_ssl_own_cert( ssl ) == NULL )
  3266.     {
  3267.         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate verify" ) );
  3268.         ssl->state++;
  3269.         return( 0 );
  3270.     }
  3271.  
  3272.     if( mbedtls_ssl_own_key( ssl ) == NULL )
  3273.     {
  3274.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no private key for certificate" ) );
  3275.         return( MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED );
  3276.     }
  3277.  
  3278.     /*
  3279.      * Make a signature of the handshake digests
  3280.      */
  3281. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  3282.     if( ssl->handshake->ecrs_enabled )
  3283.         ssl->handshake->ecrs_state = ssl_ecrs_crt_vrfy_sign;
  3284.  
  3285. sign:
  3286. #endif
  3287.  
  3288.     ssl->handshake->calc_verify( ssl, hash );
  3289.  
  3290. #if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
  3291.     defined(MBEDTLS_SSL_PROTO_TLS1_1)
  3292.     if( ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_3 )
  3293.     {
  3294.         /*
  3295.          * digitally-signed struct {
  3296.          *     opaque md5_hash[16];
  3297.          *     opaque sha_hash[20];
  3298.          * };
  3299.          *
  3300.          * md5_hash
  3301.          *     MD5(handshake_messages);
  3302.          *
  3303.          * sha_hash
  3304.          *     SHA(handshake_messages);
  3305.          */
  3306.         hashlen = 36;
  3307.         md_alg = MBEDTLS_MD_NONE;
  3308.  
  3309.         /*
  3310.          * For ECDSA, default hash is SHA-1 only
  3311.          */
  3312.         if( mbedtls_pk_can_do( mbedtls_ssl_own_key( ssl ), MBEDTLS_PK_ECDSA ) )
  3313.         {
  3314.             hash_start += 16;
  3315.             hashlen -= 16;
  3316.             md_alg = MBEDTLS_MD_SHA1;
  3317.         }
  3318.     }
  3319.     else
  3320. #endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
  3321.           MBEDTLS_SSL_PROTO_TLS1_1 */
  3322. #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
  3323.     if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
  3324.     {
  3325.         /*
  3326.          * digitally-signed struct {
  3327.          *     opaque handshake_messages[handshake_messages_length];
  3328.          * };
  3329.          *
  3330.          * Taking shortcut here. We assume that the server always allows the
  3331.          * PRF Hash function and has sent it in the allowed signature
  3332.          * algorithms list received in the Certificate Request message.
  3333.          *
  3334.          * Until we encounter a server that does not, we will take this
  3335.          * shortcut.
  3336.          *
  3337.          * Reason: Otherwise we should have running hashes for SHA512 and SHA224
  3338.          *         in order to satisfy 'weird' needs from the server side.
  3339.          */
  3340.         if( ssl->transform_negotiate->ciphersuite_info->mac ==
  3341.             MBEDTLS_MD_SHA384 )
  3342.         {
  3343.             md_alg = MBEDTLS_MD_SHA384;
  3344.             ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA384;
  3345.         }
  3346.         else
  3347.         {
  3348.             md_alg = MBEDTLS_MD_SHA256;
  3349.             ssl->out_msg[4] = MBEDTLS_SSL_HASH_SHA256;
  3350.         }
  3351.         ssl->out_msg[5] = mbedtls_ssl_sig_from_pk( mbedtls_ssl_own_key( ssl ) );
  3352.  
  3353.         /* Info from md_alg will be used instead */
  3354.         hashlen = 0;
  3355.         offset = 2;
  3356.     }
  3357.     else
  3358. #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
  3359.     {
  3360.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
  3361.         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
  3362.     }
  3363.  
  3364. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  3365.     if( ssl->handshake->ecrs_enabled )
  3366.         rs_ctx = &ssl->handshake->ecrs_ctx.pk;
  3367. #endif
  3368.  
  3369.     if( ( ret = mbedtls_pk_sign_restartable( mbedtls_ssl_own_key( ssl ),
  3370.                          md_alg, hash_start, hashlen,
  3371.                          ssl->out_msg + 6 + offset, &n,
  3372.                          ssl->conf->f_rng, ssl->conf->p_rng, rs_ctx ) ) != 0 )
  3373.     {
  3374.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
  3375. #if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
  3376.         if( ret == MBEDTLS_ERR_ECP_IN_PROGRESS )
  3377.             ret = MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
  3378. #endif
  3379.         return( ret );
  3380.     }
  3381.  
  3382.     ssl->out_msg[4 + offset] = (unsigned char)( n >> 8 );
  3383.     ssl->out_msg[5 + offset] = (unsigned char)( n      );
  3384.  
  3385.     ssl->out_msglen  = 6 + n + offset;
  3386.     ssl->out_msgtype = MBEDTLS_SSL_MSG_HANDSHAKE;
  3387.     ssl->out_msg[0]  = MBEDTLS_SSL_HS_CERTIFICATE_VERIFY;
  3388.  
  3389.     ssl->state++;
  3390.  
  3391.     if( ( ret = mbedtls_ssl_write_handshake_msg( ssl ) ) != 0 )
  3392.     {
  3393.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_write_handshake_msg", ret );
  3394.         return( ret );
  3395.     }
  3396.  
  3397.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= write certificate verify" ) );
  3398.  
  3399.     return( ret );
  3400. }
  3401. #endif /* !MBEDTLS_KEY_EXCHANGE_RSA_ENABLED &&
  3402.           !MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED &&
  3403.           !MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED &&
  3404.           !MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED &&
  3405.           !MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED &&
  3406.           !MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */
  3407.  
  3408. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  3409. static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
  3410. {
  3411.     int ret;
  3412.     uint32_t lifetime;
  3413.     size_t ticket_len;
  3414.     unsigned char *ticket;
  3415.     const unsigned char *msg;
  3416.  
  3417.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse new session ticket" ) );
  3418.  
  3419.     if( ( ret = mbedtls_ssl_read_record( ssl, 1 ) ) != 0 )
  3420.     {
  3421.         MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_read_record", ret );
  3422.         return( ret );
  3423.     }
  3424.  
  3425.     if( ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE )
  3426.     {
  3427.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
  3428.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  3429.                                         MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE );
  3430.         return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
  3431.     }
  3432.  
  3433.     /*
  3434.      * struct {
  3435.      *     uint32 ticket_lifetime_hint;
  3436.      *     opaque ticket<0..2^16-1>;
  3437.      * } NewSessionTicket;
  3438.      *
  3439.      * 0  .  3   ticket_lifetime_hint
  3440.      * 4  .  5   ticket_len (n)
  3441.      * 6  .  5+n ticket content
  3442.      */
  3443.     if( ssl->in_msg[0] != MBEDTLS_SSL_HS_NEW_SESSION_TICKET ||
  3444.         ssl->in_hslen < 6 + mbedtls_ssl_hs_hdr_len( ssl ) )
  3445.     {
  3446.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
  3447.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  3448.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  3449.         return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
  3450.     }
  3451.  
  3452.     msg = ssl->in_msg + mbedtls_ssl_hs_hdr_len( ssl );
  3453.  
  3454.     lifetime = ( ((uint32_t) msg[0]) << 24 ) | ( msg[1] << 16 ) |
  3455.                ( msg[2] << 8 ) | ( msg[3] );
  3456.  
  3457.     ticket_len = ( msg[4] << 8 ) | ( msg[5] );
  3458.  
  3459.     if( ticket_len + 6 + mbedtls_ssl_hs_hdr_len( ssl ) != ssl->in_hslen )
  3460.     {
  3461.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad new session ticket message" ) );
  3462.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  3463.                                         MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR );
  3464.         return( MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET );
  3465.     }
  3466.  
  3467.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket length: %d", ticket_len ) );
  3468.  
  3469.     /* We're not waiting for a NewSessionTicket message any more */
  3470.     ssl->handshake->new_session_ticket = 0;
  3471.     ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
  3472.  
  3473.     /*
  3474.      * Zero-length ticket means the server changed his mind and doesn't want
  3475.      * to send a ticket after all, so just forget it
  3476.      */
  3477.     if( ticket_len == 0 )
  3478.         return( 0 );
  3479.  
  3480.     mbedtls_platform_zeroize( ssl->session_negotiate->ticket,
  3481.                               ssl->session_negotiate->ticket_len );
  3482.     mbedtls_free( ssl->session_negotiate->ticket );
  3483.     ssl->session_negotiate->ticket = NULL;
  3484.     ssl->session_negotiate->ticket_len = 0;
  3485.  
  3486.     if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
  3487.     {
  3488.         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
  3489.         mbedtls_ssl_send_alert_message( ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
  3490.                                         MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
  3491.         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
  3492.     }
  3493.  
  3494.     memcpy( ticket, msg + 6, ticket_len );
  3495.  
  3496.     ssl->session_negotiate->ticket = ticket;
  3497.     ssl->session_negotiate->ticket_len = ticket_len;
  3498.     ssl->session_negotiate->ticket_lifetime = lifetime;
  3499.  
  3500.     /*
  3501.      * RFC 5077 section 3.4:
  3502.      * "If the client receives a session ticket from the server, then it
  3503.      * discards any Session ID that was sent in the ServerHello."
  3504.      */
  3505.     MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket in use, discarding session id" ) );
  3506.     ssl->session_negotiate->id_len = 0;
  3507.  
  3508.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse new session ticket" ) );
  3509.  
  3510.     return( 0 );
  3511. }
  3512. #endif /* MBEDTLS_SSL_SESSION_TICKETS */
  3513.  
  3514. /*
  3515.  * SSL handshake -- client side -- single step
  3516.  */
  3517. int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl )
  3518. {
  3519.     int ret = 0;
  3520.  
  3521.     if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL )
  3522.         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  3523.  
  3524.     MBEDTLS_SSL_DEBUG_MSG( 2, ( "client state: %d", ssl->state ) );
  3525.  
  3526.     if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
  3527.         return( ret );
  3528.  
  3529. #if defined(MBEDTLS_SSL_PROTO_DTLS)
  3530.     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
  3531.         ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
  3532.     {
  3533.         if( ( ret = mbedtls_ssl_flight_transmit( ssl ) ) != 0 )
  3534.             return( ret );
  3535.     }
  3536. #endif /* MBEDTLS_SSL_PROTO_DTLS */
  3537.  
  3538.     /* Change state now, so that it is right in mbedtls_ssl_read_record(), used
  3539.      * by DTLS for dropping out-of-sequence ChangeCipherSpec records */
  3540. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  3541.     if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC &&
  3542.         ssl->handshake->new_session_ticket != 0 )
  3543.     {
  3544.         ssl->state = MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET;
  3545.     }
  3546. #endif
  3547.  
  3548.     switch( ssl->state )
  3549.     {
  3550.         case MBEDTLS_SSL_HELLO_REQUEST:
  3551.             ssl->state = MBEDTLS_SSL_CLIENT_HELLO;
  3552.             break;
  3553.  
  3554.        /*
  3555.         *  ==>   ClientHello
  3556.         */
  3557.        case MBEDTLS_SSL_CLIENT_HELLO:
  3558.            ret = ssl_write_client_hello( ssl );
  3559.            break;
  3560.  
  3561.        /*
  3562.         *  <==   ServerHello
  3563.         *        Certificate
  3564.         *      ( ServerKeyExchange  )
  3565.         *      ( CertificateRequest )
  3566.         *        ServerHelloDone
  3567.         */
  3568.        case MBEDTLS_SSL_SERVER_HELLO:
  3569.            ret = ssl_parse_server_hello( ssl );
  3570.            break;
  3571.  
  3572.        case MBEDTLS_SSL_SERVER_CERTIFICATE:
  3573.            ret = mbedtls_ssl_parse_certificate( ssl );
  3574.            break;
  3575.  
  3576.        case MBEDTLS_SSL_SERVER_KEY_EXCHANGE:
  3577.            ret = ssl_parse_server_key_exchange( ssl );
  3578.            break;
  3579.  
  3580.        case MBEDTLS_SSL_CERTIFICATE_REQUEST:
  3581.            ret = ssl_parse_certificate_request( ssl );
  3582.            break;
  3583.  
  3584.        case MBEDTLS_SSL_SERVER_HELLO_DONE:
  3585.            ret = ssl_parse_server_hello_done( ssl );
  3586.            break;
  3587.  
  3588.        /*
  3589.         *  ==> ( Certificate/Alert  )
  3590.         *        ClientKeyExchange
  3591.         *      ( CertificateVerify  )
  3592.         *        ChangeCipherSpec
  3593.         *        Finished
  3594.         */
  3595.        case MBEDTLS_SSL_CLIENT_CERTIFICATE:
  3596.            ret = mbedtls_ssl_write_certificate( ssl );
  3597.            break;
  3598.  
  3599.        case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:
  3600.            ret = ssl_write_client_key_exchange( ssl );
  3601.            break;
  3602.  
  3603.        case MBEDTLS_SSL_CERTIFICATE_VERIFY:
  3604.            ret = ssl_write_certificate_verify( ssl );
  3605.            break;
  3606.  
  3607.        case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC:
  3608.            ret = mbedtls_ssl_write_change_cipher_spec( ssl );
  3609.            break;
  3610.  
  3611.        case MBEDTLS_SSL_CLIENT_FINISHED:
  3612.            ret = mbedtls_ssl_write_finished( ssl );
  3613.            break;
  3614.  
  3615.        /*
  3616.         *  <==   ( NewSessionTicket )
  3617.         *        ChangeCipherSpec
  3618.         *        Finished
  3619.         */
  3620. #if defined(MBEDTLS_SSL_SESSION_TICKETS)
  3621.        case MBEDTLS_SSL_SERVER_NEW_SESSION_TICKET:
  3622.            ret = ssl_parse_new_session_ticket( ssl );
  3623.            break;
  3624. #endif
  3625.  
  3626.        case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC:
  3627.            ret = mbedtls_ssl_parse_change_cipher_spec( ssl );
  3628.            break;
  3629.  
  3630.        case MBEDTLS_SSL_SERVER_FINISHED:
  3631.            ret = mbedtls_ssl_parse_finished( ssl );
  3632.            break;
  3633.  
  3634.        case MBEDTLS_SSL_FLUSH_BUFFERS:
  3635.            MBEDTLS_SSL_DEBUG_MSG( 2, ( "handshake: done" ) );
  3636.            ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
  3637.            break;
  3638.  
  3639.        case MBEDTLS_SSL_HANDSHAKE_WRAPUP:
  3640.            mbedtls_ssl_handshake_wrapup( ssl );
  3641.            break;
  3642.  
  3643.        default:
  3644.            MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
  3645.            return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
  3646.    }
  3647.  
  3648.     return( ret );
  3649. }
  3650. #endif /* MBEDTLS_SSL_CLI_C */
  3651.