PolarSSL v1.2.7
ssl_tls.c
Go to the documentation of this file.
1 /*
2  * SSLv3/TLSv1 shared functions
3  *
4  * Copyright (C) 2006-2012, Brainspark B.V.
5  *
6  * This file is part of PolarSSL (http://www.polarssl.org)
7  * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
8  *
9  * All rights reserved.
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, write to the Free Software Foundation, Inc.,
23  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24  */
25 /*
26  * The SSL 3.0 specification was drafted by Netscape in 1996,
27  * and became an IETF standard in 1999.
28  *
29  * http://wp.netscape.com/eng/ssl3/
30  * http://www.ietf.org/rfc/rfc2246.txt
31  * http://www.ietf.org/rfc/rfc4346.txt
32  */
33 
34 #include "polarssl/config.h"
35 
36 #if defined(POLARSSL_SSL_TLS_C)
37 
38 #include "polarssl/aes.h"
39 #include "polarssl/arc4.h"
40 #include "polarssl/camellia.h"
41 #include "polarssl/des.h"
42 #include "polarssl/debug.h"
43 #include "polarssl/ssl.h"
44 #include "polarssl/sha2.h"
45 
46 #if defined(POLARSSL_GCM_C)
47 #include "polarssl/gcm.h"
48 #endif
49 
50 #include <stdlib.h>
51 #include <time.h>
52 
53 #if defined _MSC_VER && !defined strcasecmp
54 #define strcasecmp _stricmp
55 #endif
56 
57 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
58 int (*ssl_hw_record_init)(ssl_context *ssl,
59  const unsigned char *key_enc, const unsigned char *key_dec,
60  const unsigned char *iv_enc, const unsigned char *iv_dec,
61  const unsigned char *mac_enc, const unsigned char *mac_dec) = NULL;
62 int (*ssl_hw_record_reset)(ssl_context *ssl) = NULL;
63 int (*ssl_hw_record_write)(ssl_context *ssl) = NULL;
64 int (*ssl_hw_record_read)(ssl_context *ssl) = NULL;
65 int (*ssl_hw_record_finish)(ssl_context *ssl) = NULL;
66 #endif
67 
68 static int ssl_rsa_decrypt( void *ctx, int mode, size_t *olen,
69  const unsigned char *input, unsigned char *output,
70  size_t output_max_len )
71 {
72  return rsa_pkcs1_decrypt( (rsa_context *) ctx, mode, olen, input, output,
73  output_max_len );
74 }
75 
76 static int ssl_rsa_sign( void *ctx,
77  int (*f_rng)(void *, unsigned char *, size_t), void *p_rng,
78  int mode, int hash_id, unsigned int hashlen,
79  const unsigned char *hash, unsigned char *sig )
80 {
81  return rsa_pkcs1_sign( (rsa_context *) ctx, f_rng, p_rng, mode, hash_id,
82  hashlen, hash, sig );
83 }
84 
85 static size_t ssl_rsa_key_len( void *ctx )
86 {
87  return ( (rsa_context *) ctx )->len;
88 }
89 
90 /*
91  * Key material generation
92  */
93 static int ssl3_prf( unsigned char *secret, size_t slen, char *label,
94  unsigned char *random, size_t rlen,
95  unsigned char *dstbuf, size_t dlen )
96 {
97  size_t i;
100  unsigned char padding[16];
101  unsigned char sha1sum[20];
102  ((void)label);
103 
104  /*
105  * SSLv3:
106  * block =
107  * MD5( secret + SHA1( 'A' + secret + random ) ) +
108  * MD5( secret + SHA1( 'BB' + secret + random ) ) +
109  * MD5( secret + SHA1( 'CCC' + secret + random ) ) +
110  * ...
111  */
112  for( i = 0; i < dlen / 16; i++ )
113  {
114  memset( padding, 'A' + i, 1 + i );
115 
116  sha1_starts( &sha1 );
117  sha1_update( &sha1, padding, 1 + i );
118  sha1_update( &sha1, secret, slen );
119  sha1_update( &sha1, random, rlen );
120  sha1_finish( &sha1, sha1sum );
121 
122  md5_starts( &md5 );
123  md5_update( &md5, secret, slen );
124  md5_update( &md5, sha1sum, 20 );
125  md5_finish( &md5, dstbuf + i * 16 );
126  }
127 
128  memset( &md5, 0, sizeof( md5 ) );
129  memset( &sha1, 0, sizeof( sha1 ) );
130 
131  memset( padding, 0, sizeof( padding ) );
132  memset( sha1sum, 0, sizeof( sha1sum ) );
133 
134  return( 0 );
135 }
136 
137 static int tls1_prf( unsigned char *secret, size_t slen, char *label,
138  unsigned char *random, size_t rlen,
139  unsigned char *dstbuf, size_t dlen )
140 {
141  size_t nb, hs;
142  size_t i, j, k;
143  unsigned char *S1, *S2;
144  unsigned char tmp[128];
145  unsigned char h_i[20];
146 
147  if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
149 
150  hs = ( slen + 1 ) / 2;
151  S1 = secret;
152  S2 = secret + slen - hs;
153 
154  nb = strlen( label );
155  memcpy( tmp + 20, label, nb );
156  memcpy( tmp + 20 + nb, random, rlen );
157  nb += rlen;
158 
159  /*
160  * First compute P_md5(secret,label+random)[0..dlen]
161  */
162  md5_hmac( S1, hs, tmp + 20, nb, 4 + tmp );
163 
164  for( i = 0; i < dlen; i += 16 )
165  {
166  md5_hmac( S1, hs, 4 + tmp, 16 + nb, h_i );
167  md5_hmac( S1, hs, 4 + tmp, 16, 4 + tmp );
168 
169  k = ( i + 16 > dlen ) ? dlen % 16 : 16;
170 
171  for( j = 0; j < k; j++ )
172  dstbuf[i + j] = h_i[j];
173  }
174 
175  /*
176  * XOR out with P_sha1(secret,label+random)[0..dlen]
177  */
178  sha1_hmac( S2, hs, tmp + 20, nb, tmp );
179 
180  for( i = 0; i < dlen; i += 20 )
181  {
182  sha1_hmac( S2, hs, tmp, 20 + nb, h_i );
183  sha1_hmac( S2, hs, tmp, 20, tmp );
184 
185  k = ( i + 20 > dlen ) ? dlen % 20 : 20;
186 
187  for( j = 0; j < k; j++ )
188  dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
189  }
190 
191  memset( tmp, 0, sizeof( tmp ) );
192  memset( h_i, 0, sizeof( h_i ) );
193 
194  return( 0 );
195 }
196 
197 static int tls_prf_sha256( unsigned char *secret, size_t slen, char *label,
198  unsigned char *random, size_t rlen,
199  unsigned char *dstbuf, size_t dlen )
200 {
201  size_t nb;
202  size_t i, j, k;
203  unsigned char tmp[128];
204  unsigned char h_i[32];
205 
206  if( sizeof( tmp ) < 32 + strlen( label ) + rlen )
208 
209  nb = strlen( label );
210  memcpy( tmp + 32, label, nb );
211  memcpy( tmp + 32 + nb, random, rlen );
212  nb += rlen;
213 
214  /*
215  * Compute P_<hash>(secret, label + random)[0..dlen]
216  */
217  sha2_hmac( secret, slen, tmp + 32, nb, tmp, 0 );
218 
219  for( i = 0; i < dlen; i += 32 )
220  {
221  sha2_hmac( secret, slen, tmp, 32 + nb, h_i, 0 );
222  sha2_hmac( secret, slen, tmp, 32, tmp, 0 );
223 
224  k = ( i + 32 > dlen ) ? dlen % 32 : 32;
225 
226  for( j = 0; j < k; j++ )
227  dstbuf[i + j] = h_i[j];
228  }
229 
230  memset( tmp, 0, sizeof( tmp ) );
231  memset( h_i, 0, sizeof( h_i ) );
232 
233  return( 0 );
234 }
235 
236 #if defined(POLARSSL_SHA4_C)
237 static int tls_prf_sha384( unsigned char *secret, size_t slen, char *label,
238  unsigned char *random, size_t rlen,
239  unsigned char *dstbuf, size_t dlen )
240 {
241  size_t nb;
242  size_t i, j, k;
243  unsigned char tmp[128];
244  unsigned char h_i[48];
245 
246  if( sizeof( tmp ) < 48 + strlen( label ) + rlen )
248 
249  nb = strlen( label );
250  memcpy( tmp + 48, label, nb );
251  memcpy( tmp + 48 + nb, random, rlen );
252  nb += rlen;
253 
254  /*
255  * Compute P_<hash>(secret, label + random)[0..dlen]
256  */
257  sha4_hmac( secret, slen, tmp + 48, nb, tmp, 1 );
258 
259  for( i = 0; i < dlen; i += 48 )
260  {
261  sha4_hmac( secret, slen, tmp, 48 + nb, h_i, 1 );
262  sha4_hmac( secret, slen, tmp, 48, tmp, 1 );
263 
264  k = ( i + 48 > dlen ) ? dlen % 48 : 48;
265 
266  for( j = 0; j < k; j++ )
267  dstbuf[i + j] = h_i[j];
268  }
269 
270  memset( tmp, 0, sizeof( tmp ) );
271  memset( h_i, 0, sizeof( h_i ) );
272 
273  return( 0 );
274 }
275 #endif
276 
277 static void ssl_update_checksum_start(ssl_context *, unsigned char *, size_t);
278 static void ssl_update_checksum_md5sha1(ssl_context *, unsigned char *, size_t);
279 static void ssl_update_checksum_sha256(ssl_context *, unsigned char *, size_t);
280 
281 static void ssl_calc_verify_ssl(ssl_context *,unsigned char *);
282 static void ssl_calc_verify_tls(ssl_context *,unsigned char *);
283 static void ssl_calc_verify_tls_sha256(ssl_context *,unsigned char *);
284 
285 static void ssl_calc_finished_ssl(ssl_context *,unsigned char *,int);
286 static void ssl_calc_finished_tls(ssl_context *,unsigned char *,int);
287 static void ssl_calc_finished_tls_sha256(ssl_context *,unsigned char *,int);
288 
289 #if defined(POLARSSL_SHA4_C)
290 static void ssl_update_checksum_sha384(ssl_context *, unsigned char *, size_t);
291 static void ssl_calc_verify_tls_sha384(ssl_context *,unsigned char *);
292 static void ssl_calc_finished_tls_sha384(ssl_context *,unsigned char *,int);
293 #endif
294 
295 int ssl_derive_keys( ssl_context *ssl )
296 {
297  unsigned char tmp[64];
298  unsigned char keyblk[256];
299  unsigned char *key1;
300  unsigned char *key2;
301  unsigned int iv_copy_len;
302  ssl_session *session = ssl->session_negotiate;
303  ssl_transform *transform = ssl->transform_negotiate;
304  ssl_handshake_params *handshake = ssl->handshake;
305 
306  SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
307 
308  /*
309  * Set appropriate PRF function and other SSL / TLS / TLS1.2 functions
310  */
311  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
312  {
313  handshake->tls_prf = ssl3_prf;
314  handshake->calc_verify = ssl_calc_verify_ssl;
315  handshake->calc_finished = ssl_calc_finished_ssl;
316  }
317  else if( ssl->minor_ver < SSL_MINOR_VERSION_3 )
318  {
319  handshake->tls_prf = tls1_prf;
320  handshake->calc_verify = ssl_calc_verify_tls;
321  handshake->calc_finished = ssl_calc_finished_tls;
322  }
323 #if defined(POLARSSL_SHA4_C)
324  else if( session->ciphersuite == TLS_RSA_WITH_AES_256_GCM_SHA384 ||
326  {
327  handshake->tls_prf = tls_prf_sha384;
328  handshake->calc_verify = ssl_calc_verify_tls_sha384;
329  handshake->calc_finished = ssl_calc_finished_tls_sha384;
330  }
331 #endif
332  else
333  {
334  handshake->tls_prf = tls_prf_sha256;
335  handshake->calc_verify = ssl_calc_verify_tls_sha256;
336  handshake->calc_finished = ssl_calc_finished_tls_sha256;
337  }
338 
339  /*
340  * SSLv3:
341  * master =
342  * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
343  * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
344  * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
345  *
346  * TLSv1:
347  * master = PRF( premaster, "master secret", randbytes )[0..47]
348  */
349  if( handshake->resume == 0 )
350  {
351  SSL_DEBUG_BUF( 3, "premaster secret", handshake->premaster,
352  handshake->pmslen );
353 
354  handshake->tls_prf( handshake->premaster, handshake->pmslen,
355  "master secret",
356  handshake->randbytes, 64, session->master, 48 );
357 
358  memset( handshake->premaster, 0, sizeof( handshake->premaster ) );
359  }
360  else
361  SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
362 
363  /*
364  * Swap the client and server random values.
365  */
366  memcpy( tmp, handshake->randbytes, 64 );
367  memcpy( handshake->randbytes, tmp + 32, 32 );
368  memcpy( handshake->randbytes + 32, tmp, 32 );
369  memset( tmp, 0, sizeof( tmp ) );
370 
371  /*
372  * SSLv3:
373  * key block =
374  * MD5( master + SHA1( 'A' + master + randbytes ) ) +
375  * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
376  * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
377  * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
378  * ...
379  *
380  * TLSv1:
381  * key block = PRF( master, "key expansion", randbytes )
382  */
383  handshake->tls_prf( session->master, 48, "key expansion",
384  handshake->randbytes, 64, keyblk, 256 );
385 
386  SSL_DEBUG_MSG( 3, ( "ciphersuite = %s",
387  ssl_get_ciphersuite_name( session->ciphersuite ) ) );
388  SSL_DEBUG_BUF( 3, "master secret", session->master, 48 );
389  SSL_DEBUG_BUF( 4, "random bytes", handshake->randbytes, 64 );
390  SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
391 
392  memset( handshake->randbytes, 0, sizeof( handshake->randbytes ) );
393 
394  /*
395  * Determine the appropriate key, IV and MAC length.
396  */
397  switch( session->ciphersuite )
398  {
399 #if defined(POLARSSL_ARC4_C)
401  transform->keylen = 16; transform->minlen = 16;
402  transform->ivlen = 0; transform->maclen = 16;
403  break;
404 
406  transform->keylen = 16; transform->minlen = 20;
407  transform->ivlen = 0; transform->maclen = 20;
408  break;
409 #endif
410 
411 #if defined(POLARSSL_DES_C)
414  transform->keylen = 24; transform->minlen = 24;
415  transform->ivlen = 8; transform->maclen = 20;
416  break;
417 #endif
418 
419 #if defined(POLARSSL_AES_C)
422  transform->keylen = 16; transform->minlen = 32;
423  transform->ivlen = 16; transform->maclen = 20;
424  break;
425 
428  transform->keylen = 32; transform->minlen = 32;
429  transform->ivlen = 16; transform->maclen = 20;
430  break;
431 
432 #if defined(POLARSSL_SHA2_C)
435  transform->keylen = 16; transform->minlen = 32;
436  transform->ivlen = 16; transform->maclen = 32;
437  break;
438 
441  transform->keylen = 32; transform->minlen = 32;
442  transform->ivlen = 16; transform->maclen = 32;
443  break;
444 #endif
445 #if defined(POLARSSL_GCM_C)
448  transform->keylen = 16; transform->minlen = 1;
449  transform->ivlen = 12; transform->maclen = 0;
450  transform->fixed_ivlen = 4;
451  break;
452 
455  transform->keylen = 32; transform->minlen = 1;
456  transform->ivlen = 12; transform->maclen = 0;
457  transform->fixed_ivlen = 4;
458  break;
459 #endif
460 #endif
461 
462 #if defined(POLARSSL_CAMELLIA_C)
465  transform->keylen = 16; transform->minlen = 32;
466  transform->ivlen = 16; transform->maclen = 20;
467  break;
468 
471  transform->keylen = 32; transform->minlen = 32;
472  transform->ivlen = 16; transform->maclen = 20;
473  break;
474 
475 #if defined(POLARSSL_SHA2_C)
478  transform->keylen = 16; transform->minlen = 32;
479  transform->ivlen = 16; transform->maclen = 32;
480  break;
481 
484  transform->keylen = 32; transform->minlen = 32;
485  transform->ivlen = 16; transform->maclen = 32;
486  break;
487 #endif
488 #endif
489 
490 #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
491 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
493  transform->keylen = 0; transform->minlen = 0;
494  transform->ivlen = 0; transform->maclen = 16;
495  break;
496 
498  transform->keylen = 0; transform->minlen = 0;
499  transform->ivlen = 0; transform->maclen = 20;
500  break;
501 
503  transform->keylen = 0; transform->minlen = 0;
504  transform->ivlen = 0; transform->maclen = 32;
505  break;
506 #endif /* defined(POLARSSL_CIPHER_NULL_CIPHER) */
507 
508 #if defined(POLARSSL_DES_C)
511  transform->keylen = 8; transform->minlen = 8;
512  transform->ivlen = 8; transform->maclen = 20;
513  break;
514 #endif
515 #endif /* defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) */
516 
517  default:
518  SSL_DEBUG_MSG( 1, ( "ciphersuite %s is not available",
519  ssl_get_ciphersuite_name( session->ciphersuite ) ) );
521  }
522 
523  SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d",
524  transform->keylen, transform->minlen, transform->ivlen,
525  transform->maclen ) );
526 
527  /*
528  * Finally setup the cipher contexts, IVs and MAC secrets.
529  */
530  if( ssl->endpoint == SSL_IS_CLIENT )
531  {
532  key1 = keyblk + transform->maclen * 2;
533  key2 = keyblk + transform->maclen * 2 + transform->keylen;
534 
535  memcpy( transform->mac_enc, keyblk, transform->maclen );
536  memcpy( transform->mac_dec, keyblk + transform->maclen,
537  transform->maclen );
538 
539  /*
540  * This is not used in TLS v1.1.
541  */
542  iv_copy_len = ( transform->fixed_ivlen ) ?
543  transform->fixed_ivlen : transform->ivlen;
544  memcpy( transform->iv_enc, key2 + transform->keylen, iv_copy_len );
545  memcpy( transform->iv_dec, key2 + transform->keylen + iv_copy_len,
546  iv_copy_len );
547  }
548  else
549  {
550  key1 = keyblk + transform->maclen * 2 + transform->keylen;
551  key2 = keyblk + transform->maclen * 2;
552 
553  memcpy( transform->mac_dec, keyblk, transform->maclen );
554  memcpy( transform->mac_enc, keyblk + transform->maclen,
555  transform->maclen );
556 
557  /*
558  * This is not used in TLS v1.1.
559  */
560  iv_copy_len = ( transform->fixed_ivlen ) ?
561  transform->fixed_ivlen : transform->ivlen;
562  memcpy( transform->iv_dec, key1 + transform->keylen, iv_copy_len );
563  memcpy( transform->iv_enc, key1 + transform->keylen + iv_copy_len,
564  iv_copy_len );
565  }
566 
567 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
568  if( ssl_hw_record_init != NULL)
569  {
570  int ret = 0;
571 
572  SSL_DEBUG_MSG( 2, ( "going for ssl_hw_record_init()" ) );
573 
574  if( ( ret = ssl_hw_record_init( ssl, key1, key2, transform->iv_enc,
575  transform->iv_dec, transform->mac_enc,
576  transform->mac_dec ) ) != 0 )
577  {
578  SSL_DEBUG_RET( 1, "ssl_hw_record_init", ret );
580  }
581  }
582 #endif
583 
584  switch( session->ciphersuite )
585  {
586 #if defined(POLARSSL_ARC4_C)
589  arc4_setup( (arc4_context *) transform->ctx_enc, key1,
590  transform->keylen );
591  arc4_setup( (arc4_context *) transform->ctx_dec, key2,
592  transform->keylen );
593  break;
594 #endif
595 
596 #if defined(POLARSSL_DES_C)
599  des3_set3key_enc( (des3_context *) transform->ctx_enc, key1 );
600  des3_set3key_dec( (des3_context *) transform->ctx_dec, key2 );
601  break;
602 #endif
603 
604 #if defined(POLARSSL_AES_C)
609  aes_setkey_enc( (aes_context *) transform->ctx_enc, key1, 128 );
610  aes_setkey_dec( (aes_context *) transform->ctx_dec, key2, 128 );
611  break;
612 
617  aes_setkey_enc( (aes_context *) transform->ctx_enc, key1, 256 );
618  aes_setkey_dec( (aes_context *) transform->ctx_dec, key2, 256 );
619  break;
620 
621 #if defined(POLARSSL_GCM_C)
624  gcm_init( (gcm_context *) transform->ctx_enc, key1, 128 );
625  gcm_init( (gcm_context *) transform->ctx_dec, key2, 128 );
626  break;
627 
630  gcm_init( (gcm_context *) transform->ctx_enc, key1, 256 );
631  gcm_init( (gcm_context *) transform->ctx_dec, key2, 256 );
632  break;
633 #endif
634 #endif
635 
636 #if defined(POLARSSL_CAMELLIA_C)
641  camellia_setkey_enc( (camellia_context *) transform->ctx_enc, key1, 128 );
642  camellia_setkey_dec( (camellia_context *) transform->ctx_dec, key2, 128 );
643  break;
644 
649  camellia_setkey_enc( (camellia_context *) transform->ctx_enc, key1, 256 );
650  camellia_setkey_dec( (camellia_context *) transform->ctx_dec, key2, 256 );
651  break;
652 #endif
653 
654 #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
655 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
659  break;
660 #endif /* defined(POLARSSL_CIPHER_NULL_CIPHER) */
661 
662 #if defined(POLARSSL_DES_C)
665  des_setkey_enc( (des_context *) transform->ctx_enc, key1 );
666  des_setkey_dec( (des_context *) transform->ctx_dec, key2 );
667  break;
668 #endif
669 #endif /* defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) */
670 
671  default:
673  }
674 
675  memset( keyblk, 0, sizeof( keyblk ) );
676 
677 #if defined(POLARSSL_ZLIB_SUPPORT)
678  // Initialize compression
679  //
680  if( session->compression == SSL_COMPRESS_DEFLATE )
681  {
682  SSL_DEBUG_MSG( 3, ( "Initializing zlib states" ) );
683 
684  memset( &transform->ctx_deflate, 0, sizeof( transform->ctx_deflate ) );
685  memset( &transform->ctx_inflate, 0, sizeof( transform->ctx_inflate ) );
686 
687  if( deflateInit( &transform->ctx_deflate, Z_DEFAULT_COMPRESSION ) != Z_OK ||
688  inflateInit( &transform->ctx_inflate ) != Z_OK )
689  {
690  SSL_DEBUG_MSG( 1, ( "Failed to initialize compression" ) );
692  }
693  }
694 #endif /* POLARSSL_ZLIB_SUPPORT */
695 
696  SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
697 
698  return( 0 );
699 }
700 
701 void ssl_calc_verify_ssl( ssl_context *ssl, unsigned char hash[36] )
702 {
705  unsigned char pad_1[48];
706  unsigned char pad_2[48];
707 
708  SSL_DEBUG_MSG( 2, ( "=> calc verify ssl" ) );
709 
710  memcpy( &md5 , &ssl->handshake->fin_md5 , sizeof(md5_context) );
711  memcpy( &sha1, &ssl->handshake->fin_sha1, sizeof(sha1_context) );
712 
713  memset( pad_1, 0x36, 48 );
714  memset( pad_2, 0x5C, 48 );
715 
716  md5_update( &md5, ssl->session_negotiate->master, 48 );
717  md5_update( &md5, pad_1, 48 );
718  md5_finish( &md5, hash );
719 
720  md5_starts( &md5 );
721  md5_update( &md5, ssl->session_negotiate->master, 48 );
722  md5_update( &md5, pad_2, 48 );
723  md5_update( &md5, hash, 16 );
724  md5_finish( &md5, hash );
725 
726  sha1_update( &sha1, ssl->session_negotiate->master, 48 );
727  sha1_update( &sha1, pad_1, 40 );
728  sha1_finish( &sha1, hash + 16 );
729 
730  sha1_starts( &sha1 );
731  sha1_update( &sha1, ssl->session_negotiate->master, 48 );
732  sha1_update( &sha1, pad_2, 40 );
733  sha1_update( &sha1, hash + 16, 20 );
734  sha1_finish( &sha1, hash + 16 );
735 
736  SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
737  SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
738 
739  return;
740 }
741 
742 void ssl_calc_verify_tls( ssl_context *ssl, unsigned char hash[36] )
743 {
746 
747  SSL_DEBUG_MSG( 2, ( "=> calc verify tls" ) );
748 
749  memcpy( &md5 , &ssl->handshake->fin_md5 , sizeof(md5_context) );
750  memcpy( &sha1, &ssl->handshake->fin_sha1, sizeof(sha1_context) );
751 
752  md5_finish( &md5, hash );
753  sha1_finish( &sha1, hash + 16 );
754 
755  SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
756  SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
757 
758  return;
759 }
760 
761 void ssl_calc_verify_tls_sha256( ssl_context *ssl, unsigned char hash[32] )
762 {
764 
765  SSL_DEBUG_MSG( 2, ( "=> calc verify sha256" ) );
766 
767  memcpy( &sha2, &ssl->handshake->fin_sha2, sizeof(sha2_context) );
768  sha2_finish( &sha2, hash );
769 
770  SSL_DEBUG_BUF( 3, "calculated verify result", hash, 32 );
771  SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
772 
773  return;
774 }
775 
776 #if defined(POLARSSL_SHA4_C)
777 void ssl_calc_verify_tls_sha384( ssl_context *ssl, unsigned char hash[48] )
778 {
780 
781  SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
782 
783  memcpy( &sha4, &ssl->handshake->fin_sha4, sizeof(sha4_context) );
784  sha4_finish( &sha4, hash );
785 
786  SSL_DEBUG_BUF( 3, "calculated verify result", hash, 48 );
787  SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
788 
789  return;
790 }
791 #endif
792 
793 /*
794  * SSLv3.0 MAC functions
795  */
796 static void ssl_mac_md5( unsigned char *secret,
797  unsigned char *buf, size_t len,
798  unsigned char *ctr, int type )
799 {
800  unsigned char header[11];
801  unsigned char padding[48];
803 
804  memcpy( header, ctr, 8 );
805  header[ 8] = (unsigned char) type;
806  header[ 9] = (unsigned char)( len >> 8 );
807  header[10] = (unsigned char)( len );
808 
809  memset( padding, 0x36, 48 );
810  md5_starts( &md5 );
811  md5_update( &md5, secret, 16 );
812  md5_update( &md5, padding, 48 );
813  md5_update( &md5, header, 11 );
814  md5_update( &md5, buf, len );
815  md5_finish( &md5, buf + len );
816 
817  memset( padding, 0x5C, 48 );
818  md5_starts( &md5 );
819  md5_update( &md5, secret, 16 );
820  md5_update( &md5, padding, 48 );
821  md5_update( &md5, buf + len, 16 );
822  md5_finish( &md5, buf + len );
823 }
824 
825 static void ssl_mac_sha1( unsigned char *secret,
826  unsigned char *buf, size_t len,
827  unsigned char *ctr, int type )
828 {
829  unsigned char header[11];
830  unsigned char padding[40];
832 
833  memcpy( header, ctr, 8 );
834  header[ 8] = (unsigned char) type;
835  header[ 9] = (unsigned char)( len >> 8 );
836  header[10] = (unsigned char)( len );
837 
838  memset( padding, 0x36, 40 );
839  sha1_starts( &sha1 );
840  sha1_update( &sha1, secret, 20 );
841  sha1_update( &sha1, padding, 40 );
842  sha1_update( &sha1, header, 11 );
843  sha1_update( &sha1, buf, len );
844  sha1_finish( &sha1, buf + len );
845 
846  memset( padding, 0x5C, 40 );
847  sha1_starts( &sha1 );
848  sha1_update( &sha1, secret, 20 );
849  sha1_update( &sha1, padding, 40 );
850  sha1_update( &sha1, buf + len, 20 );
851  sha1_finish( &sha1, buf + len );
852 }
853 
854 static void ssl_mac_sha2( unsigned char *secret,
855  unsigned char *buf, size_t len,
856  unsigned char *ctr, int type )
857 {
858  unsigned char header[11];
859  unsigned char padding[32];
861 
862  memcpy( header, ctr, 8 );
863  header[ 8] = (unsigned char) type;
864  header[ 9] = (unsigned char)( len >> 8 );
865  header[10] = (unsigned char)( len );
866 
867  memset( padding, 0x36, 32 );
868  sha2_starts( &sha2, 0 );
869  sha2_update( &sha2, secret, 32 );
870  sha2_update( &sha2, padding, 32 );
871  sha2_update( &sha2, header, 11 );
872  sha2_update( &sha2, buf, len );
873  sha2_finish( &sha2, buf + len );
874 
875  memset( padding, 0x5C, 32 );
876  sha2_starts( &sha2, 0 );
877  sha2_update( &sha2, secret, 32 );
878  sha2_update( &sha2, padding, 32 );
879  sha2_update( &sha2, buf + len, 32 );
880  sha2_finish( &sha2, buf + len );
881 }
882 
883 /*
884  * Encryption/decryption functions
885  */
886 static int ssl_encrypt_buf( ssl_context *ssl )
887 {
888  size_t i, padlen;
889 
890  SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
891 
892  /*
893  * Add MAC then encrypt
894  */
895  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
896  {
897  if( ssl->transform_out->maclen == 16 )
898  ssl_mac_md5( ssl->transform_out->mac_enc,
899  ssl->out_msg, ssl->out_msglen,
900  ssl->out_ctr, ssl->out_msgtype );
901  else if( ssl->transform_out->maclen == 20 )
902  ssl_mac_sha1( ssl->transform_out->mac_enc,
903  ssl->out_msg, ssl->out_msglen,
904  ssl->out_ctr, ssl->out_msgtype );
905  else if( ssl->transform_out->maclen == 32 )
906  ssl_mac_sha2( ssl->transform_out->mac_enc,
907  ssl->out_msg, ssl->out_msglen,
908  ssl->out_ctr, ssl->out_msgtype );
909  else if( ssl->transform_out->maclen != 0 )
910  {
911  SSL_DEBUG_MSG( 1, ( "invalid MAC len: %d",
912  ssl->transform_out->maclen ) );
914  }
915  }
916  else
917  {
918  if( ssl->transform_out->maclen == 16 )
919  {
920  md5_context ctx;
921  md5_hmac_starts( &ctx, ssl->transform_out->mac_enc, 16 );
922  md5_hmac_update( &ctx, ssl->out_ctr, 13 );
923  md5_hmac_update( &ctx, ssl->out_msg, ssl->out_msglen );
924  md5_hmac_finish( &ctx, ssl->out_msg + ssl->out_msglen );
925  memset( &ctx, 0, sizeof(md5_context));
926  }
927  else if( ssl->transform_out->maclen == 20 )
928  {
929  sha1_context ctx;
930  sha1_hmac_starts( &ctx, ssl->transform_out->mac_enc, 20 );
931  sha1_hmac_update( &ctx, ssl->out_ctr, 13 );
932  sha1_hmac_update( &ctx, ssl->out_msg, ssl->out_msglen );
933  sha1_hmac_finish( &ctx, ssl->out_msg + ssl->out_msglen );
934  memset( &ctx, 0, sizeof(sha1_context));
935  }
936  else if( ssl->transform_out->maclen == 32 )
937  {
938  sha2_context ctx;
939  sha2_hmac_starts( &ctx, ssl->transform_out->mac_enc, 32, 0 );
940  sha2_hmac_update( &ctx, ssl->out_ctr, 13 );
941  sha2_hmac_update( &ctx, ssl->out_msg, ssl->out_msglen );
942  sha2_hmac_finish( &ctx, ssl->out_msg + ssl->out_msglen );
943  memset( &ctx, 0, sizeof(sha2_context));
944  }
945  else if( ssl->transform_out->maclen != 0 )
946  {
947  SSL_DEBUG_MSG( 1, ( "invalid MAC len: %d",
948  ssl->transform_out->maclen ) );
950  }
951  }
952 
953  SSL_DEBUG_BUF( 4, "computed mac",
954  ssl->out_msg + ssl->out_msglen, ssl->transform_out->maclen );
955 
956  ssl->out_msglen += ssl->transform_out->maclen;
957 
958  if( ssl->transform_out->ivlen == 0 )
959  {
960  padlen = 0;
961 
962  SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
963  "including %d bytes of padding",
964  ssl->out_msglen, 0 ) );
965 
966  SSL_DEBUG_BUF( 4, "before encrypt: output payload",
967  ssl->out_msg, ssl->out_msglen );
968 
969 #if defined(POLARSSL_ARC4_C)
972  {
974  ssl->out_msglen, ssl->out_msg,
975  ssl->out_msg );
976  } else
977 #endif
978 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
982  {
983  } else
984 #endif
986  }
987  else if( ssl->transform_out->ivlen == 12 )
988  {
989  size_t enc_msglen;
990  unsigned char *enc_msg;
991  unsigned char add_data[13];
993 
994  padlen = 0;
995  enc_msglen = ssl->out_msglen;
996 
997  memcpy( add_data, ssl->out_ctr, 8 );
998  add_data[8] = ssl->out_msgtype;
999  add_data[9] = ssl->major_ver;
1000  add_data[10] = ssl->minor_ver;
1001  add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF;
1002  add_data[12] = ssl->out_msglen & 0xFF;
1003 
1004  SSL_DEBUG_BUF( 4, "additional data used for AEAD",
1005  add_data, 13 );
1006 
1007 #if defined(POLARSSL_AES_C) && defined(POLARSSL_GCM_C)
1008 
1013  {
1014  /*
1015  * Generate IV
1016  */
1017  ret = ssl->f_rng( ssl->p_rng,
1019  ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen );
1020  if( ret != 0 )
1021  return( ret );
1022 
1023  /*
1024  * Shift message for ivlen bytes and prepend IV
1025  */
1026  memmove( ssl->out_msg + ssl->transform_out->ivlen -
1027  ssl->transform_out->fixed_ivlen,
1028  ssl->out_msg, ssl->out_msglen );
1029  memcpy( ssl->out_msg,
1031  ssl->transform_out->ivlen - ssl->transform_out->fixed_ivlen );
1032 
1033  /*
1034  * Fix pointer positions and message length with added IV
1035  */
1036  enc_msg = ssl->out_msg + ssl->transform_out->ivlen -
1037  ssl->transform_out->fixed_ivlen;
1038  enc_msglen = ssl->out_msglen;
1039  ssl->out_msglen += ssl->transform_out->ivlen -
1040  ssl->transform_out->fixed_ivlen;
1041 
1042  SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
1043  "including %d bytes of padding",
1044  ssl->out_msglen, 0 ) );
1045 
1046  SSL_DEBUG_BUF( 4, "before encrypt: output payload",
1047  ssl->out_msg, ssl->out_msglen );
1048 
1049  /*
1050  * Adjust for tag
1051  */
1052  ssl->out_msglen += 16;
1053 
1055  GCM_ENCRYPT, enc_msglen,
1056  ssl->transform_out->iv_enc, ssl->transform_out->ivlen,
1057  add_data, 13,
1058  enc_msg, enc_msg,
1059  16, enc_msg + enc_msglen );
1060 
1061  SSL_DEBUG_BUF( 4, "after encrypt: tag",
1062  enc_msg + enc_msglen, 16 );
1063 
1064  } else
1065 #endif
1066  return( ret );
1067  }
1068  else
1069  {
1070  unsigned char *enc_msg;
1071  size_t enc_msglen;
1072 
1073  padlen = ssl->transform_out->ivlen - ( ssl->out_msglen + 1 ) %
1074  ssl->transform_out->ivlen;
1075  if( padlen == ssl->transform_out->ivlen )
1076  padlen = 0;
1077 
1078  for( i = 0; i <= padlen; i++ )
1079  ssl->out_msg[ssl->out_msglen + i] = (unsigned char) padlen;
1080 
1081  ssl->out_msglen += padlen + 1;
1082 
1083  enc_msglen = ssl->out_msglen;
1084  enc_msg = ssl->out_msg;
1085 
1086  /*
1087  * Prepend per-record IV for block cipher in TLS v1.1 and up as per
1088  * Method 1 (6.2.3.2. in RFC4346 and RFC5246)
1089  */
1090  if( ssl->minor_ver >= SSL_MINOR_VERSION_2 )
1091  {
1092  /*
1093  * Generate IV
1094  */
1095  int ret = ssl->f_rng( ssl->p_rng, ssl->transform_out->iv_enc,
1096  ssl->transform_out->ivlen );
1097  if( ret != 0 )
1098  return( ret );
1099 
1100  /*
1101  * Shift message for ivlen bytes and prepend IV
1102  */
1103  memmove( ssl->out_msg + ssl->transform_out->ivlen, ssl->out_msg,
1104  ssl->out_msglen );
1105  memcpy( ssl->out_msg, ssl->transform_out->iv_enc,
1106  ssl->transform_out->ivlen );
1107 
1108  /*
1109  * Fix pointer positions and message length with added IV
1110  */
1111  enc_msg = ssl->out_msg + ssl->transform_out->ivlen;
1112  enc_msglen = ssl->out_msglen;
1113  ssl->out_msglen += ssl->transform_out->ivlen;
1114  }
1115 
1116  SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
1117  "including %d bytes of IV and %d bytes of padding",
1118  ssl->out_msglen, ssl->transform_out->ivlen, padlen + 1 ) );
1119 
1120  SSL_DEBUG_BUF( 4, "before encrypt: output payload",
1121  ssl->out_msg, ssl->out_msglen );
1122 
1123  switch( ssl->transform_out->ivlen )
1124  {
1125 #if defined(POLARSSL_DES_C)
1126  case 8:
1127 #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
1130  {
1132  DES_ENCRYPT, enc_msglen,
1133  ssl->transform_out->iv_enc, enc_msg, enc_msg );
1134  }
1135  else
1136 #endif
1138  DES_ENCRYPT, enc_msglen,
1139  ssl->transform_out->iv_enc, enc_msg, enc_msg );
1140  break;
1141 #endif
1142 
1143  case 16:
1144 #if defined(POLARSSL_AES_C)
1153  {
1155  AES_ENCRYPT, enc_msglen,
1156  ssl->transform_out->iv_enc, enc_msg, enc_msg);
1157  break;
1158  }
1159 #endif
1160 
1161 #if defined(POLARSSL_CAMELLIA_C)
1170  {
1172  CAMELLIA_ENCRYPT, enc_msglen,
1173  ssl->transform_out->iv_enc, enc_msg, enc_msg );
1174  break;
1175  }
1176 #endif
1177 
1178  default:
1180  }
1181  }
1182 
1183  for( i = 8; i > 0; i-- )
1184  if( ++ssl->out_ctr[i - 1] != 0 )
1185  break;
1186 
1187  SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
1188 
1189  return( 0 );
1190 }
1191 
1192 /*
1193  * TODO: Use digest version when integrated!
1194  */
1195 #define POLARSSL_SSL_MAX_MAC_SIZE 32
1196 
1197 static int ssl_decrypt_buf( ssl_context *ssl )
1198 {
1199  size_t i, padlen = 0, correct = 1;
1200  unsigned char tmp[POLARSSL_SSL_MAX_MAC_SIZE];
1201 
1202  SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
1203 
1204  if( ssl->in_msglen < ssl->transform_in->minlen )
1205  {
1206  SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)",
1207  ssl->in_msglen, ssl->transform_in->minlen ) );
1208  return( POLARSSL_ERR_SSL_INVALID_MAC );
1209  }
1210 
1211  if( ssl->transform_in->ivlen == 0 )
1212  {
1213 #if defined(POLARSSL_ARC4_C)
1216  {
1218  ssl->in_msglen, ssl->in_msg,
1219  ssl->in_msg );
1220  } else
1221 #endif
1222 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
1226  {
1227  } else
1228 #endif
1230  }
1231  else if( ssl->transform_in->ivlen == 12 )
1232  {
1233  unsigned char *dec_msg;
1234  unsigned char *dec_msg_result;
1235  size_t dec_msglen;
1236  unsigned char add_data[13];
1238 
1239 #if defined(POLARSSL_AES_C) && defined(POLARSSL_GCM_C)
1244  {
1245  dec_msglen = ssl->in_msglen - ( ssl->transform_in->ivlen -
1246  ssl->transform_in->fixed_ivlen );
1247  dec_msglen -= 16;
1248  dec_msg = ssl->in_msg + ( ssl->transform_in->ivlen -
1249  ssl->transform_in->fixed_ivlen );
1250  dec_msg_result = ssl->in_msg;
1251  ssl->in_msglen = dec_msglen;
1252 
1253  memcpy( add_data, ssl->in_ctr, 8 );
1254  add_data[8] = ssl->in_msgtype;
1255  add_data[9] = ssl->major_ver;
1256  add_data[10] = ssl->minor_ver;
1257  add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF;
1258  add_data[12] = ssl->in_msglen & 0xFF;
1259 
1260  SSL_DEBUG_BUF( 4, "additional data used for AEAD",
1261  add_data, 13 );
1262 
1263  memcpy( ssl->transform_in->iv_dec + ssl->transform_in->fixed_ivlen,
1264  ssl->in_msg,
1265  ssl->transform_in->ivlen - ssl->transform_in->fixed_ivlen );
1266 
1267  SSL_DEBUG_BUF( 4, "IV used", ssl->transform_in->iv_dec,
1268  ssl->transform_in->ivlen );
1269  SSL_DEBUG_BUF( 4, "TAG used", dec_msg + dec_msglen, 16 );
1270 
1271  memcpy( ssl->transform_in->iv_dec + ssl->transform_in->fixed_ivlen,
1272  ssl->in_msg,
1273  ssl->transform_in->ivlen - ssl->transform_in->fixed_ivlen );
1274 
1276  dec_msglen,
1277  ssl->transform_in->iv_dec,
1278  ssl->transform_in->ivlen,
1279  add_data, 13,
1280  dec_msg + dec_msglen, 16,
1281  dec_msg, dec_msg_result );
1282 
1283  if( ret != 0 )
1284  {
1285  SSL_DEBUG_MSG( 1, ( "AEAD decrypt failed on validation (ret = -0x%02x)",
1286  -ret ) );
1287 
1288  return( POLARSSL_ERR_SSL_INVALID_MAC );
1289  }
1290  } else
1291 #endif
1292  return( ret );
1293  }
1294  else
1295  {
1296  /*
1297  * Decrypt and check the padding
1298  */
1299  unsigned char *dec_msg;
1300  unsigned char *dec_msg_result;
1301  size_t dec_msglen;
1302  size_t minlen = 0;
1303 
1304  /*
1305  * Check immediate ciphertext sanity
1306  */
1307  if( ssl->in_msglen % ssl->transform_in->ivlen != 0 )
1308  {
1309  SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
1310  ssl->in_msglen, ssl->transform_in->ivlen ) );
1311  return( POLARSSL_ERR_SSL_INVALID_MAC );
1312  }
1313 
1314  if( ssl->minor_ver >= SSL_MINOR_VERSION_2 )
1315  minlen += ssl->transform_in->ivlen;
1316 
1317  if( ssl->in_msglen < minlen + ssl->transform_in->ivlen ||
1318  ssl->in_msglen < minlen + ssl->transform_in->maclen + 1 )
1319  {
1320  SSL_DEBUG_MSG( 1, ( "msglen (%d) < max( ivlen(%d), maclen (%d) + 1 ) ( + expl IV )",
1321  ssl->in_msglen, ssl->transform_in->ivlen, ssl->transform_in->maclen ) );
1322  return( POLARSSL_ERR_SSL_INVALID_MAC );
1323  }
1324 
1325  dec_msglen = ssl->in_msglen;
1326  dec_msg = ssl->in_msg;
1327  dec_msg_result = ssl->in_msg;
1328 
1329  /*
1330  * Initialize for prepended IV for block cipher in TLS v1.1 and up
1331  */
1332  if( ssl->minor_ver >= SSL_MINOR_VERSION_2 )
1333  {
1334  dec_msg += ssl->transform_in->ivlen;
1335  dec_msglen -= ssl->transform_in->ivlen;
1336  ssl->in_msglen -= ssl->transform_in->ivlen;
1337 
1338  for( i = 0; i < ssl->transform_in->ivlen; i++ )
1339  ssl->transform_in->iv_dec[i] = ssl->in_msg[i];
1340  }
1341 
1342  switch( ssl->transform_in->ivlen )
1343  {
1344 #if defined(POLARSSL_DES_C)
1345  case 8:
1346 #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
1349  {
1351  DES_DECRYPT, dec_msglen,
1352  ssl->transform_in->iv_dec, dec_msg, dec_msg_result );
1353  }
1354  else
1355 #endif
1357  DES_DECRYPT, dec_msglen,
1358  ssl->transform_in->iv_dec, dec_msg, dec_msg_result );
1359  break;
1360 #endif
1361 
1362  case 16:
1363 #if defined(POLARSSL_AES_C)
1372  {
1374  AES_DECRYPT, dec_msglen,
1375  ssl->transform_in->iv_dec, dec_msg, dec_msg_result );
1376  break;
1377  }
1378 #endif
1379 
1380 #if defined(POLARSSL_CAMELLIA_C)
1389  {
1391  CAMELLIA_DECRYPT, dec_msglen,
1392  ssl->transform_in->iv_dec, dec_msg, dec_msg_result );
1393  break;
1394  }
1395 #endif
1396 
1397  default:
1399  }
1400 
1401  padlen = 1 + ssl->in_msg[ssl->in_msglen - 1];
1402 
1403  if( ssl->in_msglen < ssl->transform_in->maclen + padlen )
1404  {
1405 #if defined(POLARSSL_SSL_DEBUG_ALL)
1406  SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
1407  ssl->in_msglen, ssl->transform_in->maclen, padlen ) );
1408 #endif
1409  padlen = 0;
1410  correct = 0;
1411  }
1412 
1413  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
1414  {
1415  if( padlen > ssl->transform_in->ivlen )
1416  {
1417 #if defined(POLARSSL_SSL_DEBUG_ALL)
1418  SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
1419  "should be no more than %d",
1420  padlen, ssl->transform_in->ivlen ) );
1421 #endif
1422  correct = 0;
1423  }
1424  }
1425  else
1426  {
1427  /*
1428  * TLSv1+: always check the padding up to the first failure
1429  * and fake check up to 256 bytes of padding
1430  */
1431  size_t pad_count = 0, fake_pad_count = 0;
1432  size_t padding_idx = ssl->in_msglen - padlen - 1;
1433 
1434  for( i = 1; i <= padlen; i++ )
1435  pad_count += ( ssl->in_msg[padding_idx + i] == padlen - 1 );
1436 
1437  for( ; i <= 256; i++ )
1438  fake_pad_count += ( ssl->in_msg[padding_idx + i] == padlen - 1 );
1439 
1440  correct &= ( pad_count == padlen ); /* Only 1 on correct padding */
1441  correct &= ( pad_count + fake_pad_count < 512 ); /* Always 1 */
1442 
1443 #if defined(POLARSSL_SSL_DEBUG_ALL)
1444  if( padlen > 0 && correct == 0)
1445  SSL_DEBUG_MSG( 1, ( "bad padding byte detected" ) );
1446 #endif
1447  padlen &= correct * 0x1FF;
1448  }
1449  }
1450 
1451  SSL_DEBUG_BUF( 4, "raw buffer after decryption",
1452  ssl->in_msg, ssl->in_msglen );
1453 
1454  /*
1455  * Always compute the MAC (RFC4346, CBCTIME).
1456  */
1457  ssl->in_msglen -= ( ssl->transform_in->maclen + padlen );
1458 
1459  ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );
1460  ssl->in_hdr[4] = (unsigned char)( ssl->in_msglen );
1461 
1462  memcpy( tmp, ssl->in_msg + ssl->in_msglen, ssl->transform_in->maclen );
1463 
1464  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
1465  {
1466  if( ssl->transform_in->maclen == 16 )
1467  ssl_mac_md5( ssl->transform_in->mac_dec,
1468  ssl->in_msg, ssl->in_msglen,
1469  ssl->in_ctr, ssl->in_msgtype );
1470  else if( ssl->transform_in->maclen == 20 )
1471  ssl_mac_sha1( ssl->transform_in->mac_dec,
1472  ssl->in_msg, ssl->in_msglen,
1473  ssl->in_ctr, ssl->in_msgtype );
1474  else if( ssl->transform_in->maclen == 32 )
1475  ssl_mac_sha2( ssl->transform_in->mac_dec,
1476  ssl->in_msg, ssl->in_msglen,
1477  ssl->in_ctr, ssl->in_msgtype );
1478  else if( ssl->transform_in->maclen != 0 )
1479  {
1480  SSL_DEBUG_MSG( 1, ( "invalid MAC len: %d",
1481  ssl->transform_in->maclen ) );
1483  }
1484  }
1485  else
1486  {
1487  /*
1488  * Process MAC and always update for padlen afterwards to make
1489  * total time independent of padlen
1490  *
1491  * extra_run compensates MAC check for padlen
1492  *
1493  * Known timing attacks:
1494  * - Lucky Thirteen (http://www.isg.rhul.ac.uk/tls/TLStiming.pdf)
1495  *
1496  * We use ( ( Lx + 8 ) / 64 ) to handle 'negative Lx' values
1497  * correctly. (We round down instead of up, so -56 is the correct
1498  * value for our calculations instead of -55)
1499  */
1500  int j, extra_run = 0;
1501  extra_run = ( 13 + ssl->in_msglen + padlen + 8 ) / 64 -
1502  ( 13 + ssl->in_msglen + 8 ) / 64;
1503 
1504  extra_run &= correct * 0xFF;
1505 
1506  if( ssl->transform_in->maclen == 16 )
1507  {
1508  md5_context ctx;
1509  md5_hmac_starts( &ctx, ssl->transform_in->mac_dec, 16 );
1510  md5_hmac_update( &ctx, ssl->in_ctr, ssl->in_msglen + 13 );
1511  md5_hmac_finish( &ctx, ssl->in_msg + ssl->in_msglen );
1512 
1513  for( j = 0; j < extra_run; j++ )
1514  md5_process( &ctx, ssl->in_msg );
1515  }
1516  else if( ssl->transform_in->maclen == 20 )
1517  {
1518  sha1_context ctx;
1519  sha1_hmac_starts( &ctx, ssl->transform_in->mac_dec, 20 );
1520  sha1_hmac_update( &ctx, ssl->in_ctr, ssl->in_msglen + 13 );
1521  sha1_hmac_finish( &ctx, ssl->in_msg + ssl->in_msglen );
1522 
1523  for( j = 0; j < extra_run; j++ )
1524  sha1_process( &ctx, ssl->in_msg );
1525  }
1526  else if( ssl->transform_in->maclen == 32 )
1527  {
1528  sha2_context ctx;
1529  sha2_hmac_starts( &ctx, ssl->transform_in->mac_dec, 32, 0 );
1530  sha2_hmac_update( &ctx, ssl->in_ctr, ssl->in_msglen + 13 );
1531  sha2_hmac_finish( &ctx, ssl->in_msg + ssl->in_msglen );
1532 
1533  for( j = 0; j < extra_run; j++ )
1534  sha2_process( &ctx, ssl->in_msg );
1535  }
1536  else if( ssl->transform_in->maclen != 0 )
1537  {
1538  SSL_DEBUG_MSG( 1, ( "invalid MAC len: %d",
1539  ssl->transform_in->maclen ) );
1541  }
1542  }
1543 
1544  SSL_DEBUG_BUF( 4, "message mac", tmp, ssl->transform_in->maclen );
1545  SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen,
1546  ssl->transform_in->maclen );
1547 
1548  if( memcmp( tmp, ssl->in_msg + ssl->in_msglen,
1549  ssl->transform_in->maclen ) != 0 )
1550  {
1551 #if defined(POLARSSL_SSL_DEBUG_ALL)
1552  SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
1553 #endif
1554  correct = 0;
1555  }
1556 
1557  /*
1558  * Finally check the correct flag
1559  */
1560  if( correct == 0 )
1561  return( POLARSSL_ERR_SSL_INVALID_MAC );
1562 
1563  if( ssl->in_msglen == 0 )
1564  {
1565  ssl->nb_zero++;
1566 
1567  /*
1568  * Three or more empty messages may be a DoS attack
1569  * (excessive CPU consumption).
1570  */
1571  if( ssl->nb_zero > 3 )
1572  {
1573  SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
1574  "messages, possible DoS attack" ) );
1575  return( POLARSSL_ERR_SSL_INVALID_MAC );
1576  }
1577  }
1578  else
1579  ssl->nb_zero = 0;
1580 
1581  for( i = 8; i > 0; i-- )
1582  if( ++ssl->in_ctr[i - 1] != 0 )
1583  break;
1584 
1585  SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
1586 
1587  return( 0 );
1588 }
1589 
1590 #if defined(POLARSSL_ZLIB_SUPPORT)
1591 /*
1592  * Compression/decompression functions
1593  */
1594 static int ssl_compress_buf( ssl_context *ssl )
1595 {
1596  int ret;
1597  unsigned char *msg_post = ssl->out_msg;
1598  size_t len_pre = ssl->out_msglen;
1599  unsigned char *msg_pre;
1600 
1601  SSL_DEBUG_MSG( 2, ( "=> compress buf" ) );
1602 
1603  msg_pre = (unsigned char*) malloc( len_pre );
1604  if( msg_pre == NULL )
1605  {
1606  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len_pre ) );
1608  }
1609 
1610  memcpy( msg_pre, ssl->out_msg, len_pre );
1611 
1612  SSL_DEBUG_MSG( 3, ( "before compression: msglen = %d, ",
1613  ssl->out_msglen ) );
1614 
1615  SSL_DEBUG_BUF( 4, "before compression: output payload",
1616  ssl->out_msg, ssl->out_msglen );
1617 
1618  ssl->transform_out->ctx_deflate.next_in = msg_pre;
1619  ssl->transform_out->ctx_deflate.avail_in = len_pre;
1620  ssl->transform_out->ctx_deflate.next_out = msg_post;
1621  ssl->transform_out->ctx_deflate.avail_out = SSL_BUFFER_LEN;
1622 
1623  ret = deflate( &ssl->transform_out->ctx_deflate, Z_SYNC_FLUSH );
1624  if( ret != Z_OK )
1625  {
1626  SSL_DEBUG_MSG( 1, ( "failed to perform compression (%d)", ret ) );
1628  }
1629 
1630  ssl->out_msglen = SSL_BUFFER_LEN - ssl->transform_out->ctx_deflate.avail_out;
1631 
1632  free( msg_pre );
1633 
1634  SSL_DEBUG_MSG( 3, ( "after compression: msglen = %d, ",
1635  ssl->out_msglen ) );
1636 
1637  SSL_DEBUG_BUF( 4, "after compression: output payload",
1638  ssl->out_msg, ssl->out_msglen );
1639 
1640  SSL_DEBUG_MSG( 2, ( "<= compress buf" ) );
1641 
1642  return( 0 );
1643 }
1644 
1645 static int ssl_decompress_buf( ssl_context *ssl )
1646 {
1647  int ret;
1648  unsigned char *msg_post = ssl->in_msg;
1649  size_t len_pre = ssl->in_msglen;
1650  unsigned char *msg_pre;
1651 
1652  SSL_DEBUG_MSG( 2, ( "=> decompress buf" ) );
1653 
1654  msg_pre = (unsigned char*) malloc( len_pre );
1655  if( msg_pre == NULL )
1656  {
1657  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len_pre ) );
1659  }
1660 
1661  memcpy( msg_pre, ssl->in_msg, len_pre );
1662 
1663  SSL_DEBUG_MSG( 3, ( "before decompression: msglen = %d, ",
1664  ssl->in_msglen ) );
1665 
1666  SSL_DEBUG_BUF( 4, "before decompression: input payload",
1667  ssl->in_msg, ssl->in_msglen );
1668 
1669  ssl->transform_in->ctx_inflate.next_in = msg_pre;
1670  ssl->transform_in->ctx_inflate.avail_in = len_pre;
1671  ssl->transform_in->ctx_inflate.next_out = msg_post;
1672  ssl->transform_in->ctx_inflate.avail_out = SSL_MAX_CONTENT_LEN;
1673 
1674  ret = inflate( &ssl->transform_in->ctx_inflate, Z_SYNC_FLUSH );
1675  if( ret != Z_OK )
1676  {
1677  SSL_DEBUG_MSG( 1, ( "failed to perform decompression (%d)", ret ) );
1679  }
1680 
1681  ssl->in_msglen = SSL_MAX_CONTENT_LEN - ssl->transform_in->ctx_inflate.avail_out;
1682 
1683  free( msg_pre );
1684 
1685  SSL_DEBUG_MSG( 3, ( "after decompression: msglen = %d, ",
1686  ssl->in_msglen ) );
1687 
1688  SSL_DEBUG_BUF( 4, "after decompression: input payload",
1689  ssl->in_msg, ssl->in_msglen );
1690 
1691  SSL_DEBUG_MSG( 2, ( "<= decompress buf" ) );
1692 
1693  return( 0 );
1694 }
1695 #endif /* POLARSSL_ZLIB_SUPPORT */
1696 
1697 /*
1698  * Fill the input message buffer
1699  */
1700 int ssl_fetch_input( ssl_context *ssl, size_t nb_want )
1701 {
1702  int ret;
1703  size_t len;
1704 
1705  SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
1706 
1707  while( ssl->in_left < nb_want )
1708  {
1709  len = nb_want - ssl->in_left;
1710  ret = ssl->f_recv( ssl->p_recv, ssl->in_hdr + ssl->in_left, len );
1711 
1712  SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
1713  ssl->in_left, nb_want ) );
1714  SSL_DEBUG_RET( 2, "ssl->f_recv", ret );
1715 
1716  if( ret == 0 )
1717  return( POLARSSL_ERR_SSL_CONN_EOF );
1718 
1719  if( ret < 0 )
1720  return( ret );
1721 
1722  ssl->in_left += ret;
1723  }
1724 
1725  SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
1726 
1727  return( 0 );
1728 }
1729 
1730 /*
1731  * Flush any data not yet written
1732  */
1733 int ssl_flush_output( ssl_context *ssl )
1734 {
1735  int ret;
1736  unsigned char *buf;
1737 
1738  SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
1739 
1740  while( ssl->out_left > 0 )
1741  {
1742  SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
1743  5 + ssl->out_msglen, ssl->out_left ) );
1744 
1745  if( ssl->out_msglen < ssl->out_left )
1746  {
1747  size_t header_left = ssl->out_left - ssl->out_msglen;
1748 
1749  buf = ssl->out_hdr + 5 - header_left;
1750  ret = ssl->f_send( ssl->p_send, buf, header_left );
1751 
1752  SSL_DEBUG_RET( 2, "ssl->f_send (header)", ret );
1753 
1754  if( ret <= 0 )
1755  return( ret );
1756 
1757  ssl->out_left -= ret;
1758  }
1759 
1760  buf = ssl->out_msg + ssl->out_msglen - ssl->out_left;
1761  ret = ssl->f_send( ssl->p_send, buf, ssl->out_left );
1762 
1763  SSL_DEBUG_RET( 2, "ssl->f_send", ret );
1764 
1765  if( ret <= 0 )
1766  return( ret );
1767 
1768  ssl->out_left -= ret;
1769  }
1770 
1771  SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
1772 
1773  return( 0 );
1774 }
1775 
1776 /*
1777  * Record layer functions
1778  */
1779 int ssl_write_record( ssl_context *ssl )
1780 {
1781  int ret, done = 0;
1782  size_t len = ssl->out_msglen;
1783 
1784  SSL_DEBUG_MSG( 2, ( "=> write record" ) );
1785 
1786  if( ssl->out_msgtype == SSL_MSG_HANDSHAKE )
1787  {
1788  ssl->out_msg[1] = (unsigned char)( ( len - 4 ) >> 16 );
1789  ssl->out_msg[2] = (unsigned char)( ( len - 4 ) >> 8 );
1790  ssl->out_msg[3] = (unsigned char)( ( len - 4 ) );
1791 
1792  ssl->handshake->update_checksum( ssl, ssl->out_msg, len );
1793  }
1794 
1795 #if defined(POLARSSL_ZLIB_SUPPORT)
1796  if( ssl->transform_out != NULL &&
1798  {
1799  if( ( ret = ssl_compress_buf( ssl ) ) != 0 )
1800  {
1801  SSL_DEBUG_RET( 1, "ssl_compress_buf", ret );
1802  return( ret );
1803  }
1804 
1805  len = ssl->out_msglen;
1806  }
1807 #endif /*POLARSSL_ZLIB_SUPPORT */
1808 
1809 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
1810  if( ssl_hw_record_write != NULL)
1811  {
1812  SSL_DEBUG_MSG( 2, ( "going for ssl_hw_record_write()" ) );
1813 
1814  ret = ssl_hw_record_write( ssl );
1815  if( ret != 0 && ret != POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH )
1816  {
1817  SSL_DEBUG_RET( 1, "ssl_hw_record_write", ret );
1819  }
1820  done = 1;
1821  }
1822 #endif
1823  if( !done )
1824  {
1825  ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
1826  ssl->out_hdr[1] = (unsigned char) ssl->major_ver;
1827  ssl->out_hdr[2] = (unsigned char) ssl->minor_ver;
1828  ssl->out_hdr[3] = (unsigned char)( len >> 8 );
1829  ssl->out_hdr[4] = (unsigned char)( len );
1830 
1831  if( ssl->transform_out != NULL )
1832  {
1833  if( ( ret = ssl_encrypt_buf( ssl ) ) != 0 )
1834  {
1835  SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
1836  return( ret );
1837  }
1838 
1839  len = ssl->out_msglen;
1840  ssl->out_hdr[3] = (unsigned char)( len >> 8 );
1841  ssl->out_hdr[4] = (unsigned char)( len );
1842  }
1843 
1844  ssl->out_left = 5 + ssl->out_msglen;
1845 
1846  SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
1847  "version = [%d:%d], msglen = %d",
1848  ssl->out_hdr[0], ssl->out_hdr[1], ssl->out_hdr[2],
1849  ( ssl->out_hdr[3] << 8 ) | ssl->out_hdr[4] ) );
1850 
1851  SSL_DEBUG_BUF( 4, "output record header sent to network",
1852  ssl->out_hdr, 5 );
1853  SSL_DEBUG_BUF( 4, "output record sent to network",
1854  ssl->out_hdr + 32, ssl->out_msglen );
1855  }
1856 
1857  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
1858  {
1859  SSL_DEBUG_RET( 1, "ssl_flush_output", ret );
1860  return( ret );
1861  }
1862 
1863  SSL_DEBUG_MSG( 2, ( "<= write record" ) );
1864 
1865  return( 0 );
1866 }
1867 
1868 int ssl_read_record( ssl_context *ssl )
1869 {
1870  int ret, done = 0;
1871 
1872  SSL_DEBUG_MSG( 2, ( "=> read record" ) );
1873 
1874  if( ssl->in_hslen != 0 &&
1875  ssl->in_hslen < ssl->in_msglen )
1876  {
1877  /*
1878  * Get next Handshake message in the current record
1879  */
1880  ssl->in_msglen -= ssl->in_hslen;
1881 
1882  memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
1883  ssl->in_msglen );
1884 
1885  ssl->in_hslen = 4;
1886  ssl->in_hslen += ( ssl->in_msg[2] << 8 ) | ssl->in_msg[3];
1887 
1888  SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
1889  " %d, type = %d, hslen = %d",
1890  ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
1891 
1892  if( ssl->in_msglen < 4 || ssl->in_msg[1] != 0 )
1893  {
1894  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
1896  }
1897 
1898  if( ssl->in_msglen < ssl->in_hslen )
1899  {
1900  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
1902  }
1903 
1904  ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
1905 
1906  return( 0 );
1907  }
1908 
1909  ssl->in_hslen = 0;
1910 
1911  /*
1912  * Read the record header and validate it
1913  */
1914  if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
1915  {
1916  SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1917  return( ret );
1918  }
1919 
1920  ssl->in_msgtype = ssl->in_hdr[0];
1921  ssl->in_msglen = ( ssl->in_hdr[3] << 8 ) | ssl->in_hdr[4];
1922 
1923  SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
1924  "version = [%d:%d], msglen = %d",
1925  ssl->in_hdr[0], ssl->in_hdr[1], ssl->in_hdr[2],
1926  ( ssl->in_hdr[3] << 8 ) | ssl->in_hdr[4] ) );
1927 
1928  if( ssl->in_hdr[1] != ssl->major_ver )
1929  {
1930  SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
1932  }
1933 
1934  if( ssl->in_hdr[2] > ssl->max_minor_ver )
1935  {
1936  SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
1938  }
1939 
1940  /*
1941  * Make sure the message length is acceptable
1942  */
1943  if( ssl->transform_in == NULL )
1944  {
1945  if( ssl->in_msglen < 1 ||
1947  {
1948  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1950  }
1951  }
1952  else
1953  {
1954  if( ssl->in_msglen < ssl->transform_in->minlen )
1955  {
1956  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1958  }
1959 
1960  if( ssl->minor_ver == SSL_MINOR_VERSION_0 &&
1962  {
1963  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1965  }
1966 
1967  /*
1968  * TLS encrypted messages can have up to 256 bytes of padding
1969  */
1970  if( ssl->minor_ver >= SSL_MINOR_VERSION_1 &&
1971  ssl->in_msglen > ssl->transform_in->minlen + SSL_MAX_CONTENT_LEN + 256 )
1972  {
1973  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1975  }
1976  }
1977 
1978  /*
1979  * Read and optionally decrypt the message contents
1980  */
1981  if( ( ret = ssl_fetch_input( ssl, 5 + ssl->in_msglen ) ) != 0 )
1982  {
1983  SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1984  return( ret );
1985  }
1986 
1987  SSL_DEBUG_BUF( 4, "input record from network",
1988  ssl->in_hdr, 5 + ssl->in_msglen );
1989 
1990 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
1991  if( ssl_hw_record_read != NULL)
1992  {
1993  SSL_DEBUG_MSG( 2, ( "going for ssl_hw_record_read()" ) );
1994 
1995  ret = ssl_hw_record_read( ssl );
1996  if( ret != 0 && ret != POLARSSL_ERR_SSL_HW_ACCEL_FALLTHROUGH )
1997  {
1998  SSL_DEBUG_RET( 1, "ssl_hw_record_read", ret );
2000  }
2001  done = 1;
2002  }
2003 #endif
2004  if( !done && ssl->transform_in != NULL )
2005  {
2006  if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 )
2007  {
2008 #if defined(POLARSSL_SSL_ALERT_MESSAGES)
2009  if( ret == POLARSSL_ERR_SSL_INVALID_MAC )
2010  {
2014  }
2015 #endif
2016  SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
2017  return( ret );
2018  }
2019 
2020  SSL_DEBUG_BUF( 4, "input payload after decrypt",
2021  ssl->in_msg, ssl->in_msglen );
2022 
2023  if( ssl->in_msglen > SSL_MAX_CONTENT_LEN )
2024  {
2025  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
2027  }
2028  }
2029 
2030 #if defined(POLARSSL_ZLIB_SUPPORT)
2031  if( ssl->transform_in != NULL &&
2033  {
2034  if( ( ret = ssl_decompress_buf( ssl ) ) != 0 )
2035  {
2036  SSL_DEBUG_RET( 1, "ssl_decompress_buf", ret );
2037  return( ret );
2038  }
2039 
2040  ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );
2041  ssl->in_hdr[4] = (unsigned char)( ssl->in_msglen );
2042  }
2043 #endif /* POLARSSL_ZLIB_SUPPORT */
2044 
2045  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE &&
2046  ssl->in_msgtype != SSL_MSG_ALERT &&
2049  {
2050  SSL_DEBUG_MSG( 1, ( "unknown record type" ) );
2051 
2052  if( ( ret = ssl_send_alert_message( ssl,
2055  {
2056  return( ret );
2057  }
2058 
2060  }
2061 
2062  if( ssl->in_msgtype == SSL_MSG_HANDSHAKE )
2063  {
2064  ssl->in_hslen = 4;
2065  ssl->in_hslen += ( ssl->in_msg[2] << 8 ) | ssl->in_msg[3];
2066 
2067  SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
2068  " %d, type = %d, hslen = %d",
2069  ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
2070 
2071  /*
2072  * Additional checks to validate the handshake header
2073  */
2074  if( ssl->in_msglen < 4 || ssl->in_msg[1] != 0 )
2075  {
2076  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
2078  }
2079 
2080  if( ssl->in_msglen < ssl->in_hslen )
2081  {
2082  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
2084  }
2085 
2086  if( ssl->state != SSL_HANDSHAKE_OVER )
2087  ssl->handshake->update_checksum( ssl, ssl->in_msg, ssl->in_hslen );
2088  }
2089 
2090  if( ssl->in_msgtype == SSL_MSG_ALERT )
2091  {
2092  SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
2093  ssl->in_msg[0], ssl->in_msg[1] ) );
2094 
2095  /*
2096  * Ignore non-fatal alerts, except close_notify
2097  */
2098  if( ssl->in_msg[0] == SSL_ALERT_LEVEL_FATAL )
2099  {
2100  SSL_DEBUG_MSG( 1, ( "is a fatal alert message (msg %d)",
2101  ssl->in_msg[1] ) );
2107  }
2108 
2109  if( ssl->in_msg[0] == SSL_ALERT_LEVEL_WARNING &&
2110  ssl->in_msg[1] == SSL_ALERT_MSG_CLOSE_NOTIFY )
2111  {
2112  SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
2114  }
2115  }
2116 
2117  ssl->in_left = 0;
2118 
2119  SSL_DEBUG_MSG( 2, ( "<= read record" ) );
2120 
2121  return( 0 );
2122 }
2123 
2125 {
2126  int ret;
2127 
2128  if( ( ret = ssl_send_alert_message( ssl,
2131  {
2132  return( ret );
2133  }
2134 
2135  return( 0 );
2136 }
2137 
2139  unsigned char level,
2140  unsigned char message )
2141 {
2142  int ret;
2143 
2144  SSL_DEBUG_MSG( 2, ( "=> send alert message" ) );
2145 
2146  ssl->out_msgtype = SSL_MSG_ALERT;
2147  ssl->out_msglen = 2;
2148  ssl->out_msg[0] = level;
2149  ssl->out_msg[1] = message;
2150 
2151  if( ( ret = ssl_write_record( ssl ) ) != 0 )
2152  {
2153  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2154  return( ret );
2155  }
2156 
2157  SSL_DEBUG_MSG( 2, ( "<= send alert message" ) );
2158 
2159  return( 0 );
2160 }
2161 
2162 /*
2163  * Handshake functions
2164  */
2166 {
2167  int ret;
2168  size_t i, n;
2169  const x509_cert *crt;
2170 
2171  SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
2172 
2173  if( ssl->endpoint == SSL_IS_CLIENT )
2174  {
2175  if( ssl->client_auth == 0 )
2176  {
2177  SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
2178  ssl->state++;
2179  return( 0 );
2180  }
2181 
2182  /*
2183  * If using SSLv3 and got no cert, send an Alert message
2184  * (otherwise an empty Certificate message will be sent).
2185  */
2186  if( ssl->own_cert == NULL &&
2187  ssl->minor_ver == SSL_MINOR_VERSION_0 )
2188  {
2189  ssl->out_msglen = 2;
2190  ssl->out_msgtype = SSL_MSG_ALERT;
2191  ssl->out_msg[0] = SSL_ALERT_LEVEL_WARNING;
2192  ssl->out_msg[1] = SSL_ALERT_MSG_NO_CERT;
2193 
2194  SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
2195  goto write_msg;
2196  }
2197  }
2198  else /* SSL_IS_SERVER */
2199  {
2200  if( ssl->own_cert == NULL )
2201  {
2202  SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
2204  }
2205  }
2206 
2207  SSL_DEBUG_CRT( 3, "own certificate", ssl->own_cert );
2208 
2209  /*
2210  * 0 . 0 handshake type
2211  * 1 . 3 handshake length
2212  * 4 . 6 length of all certs
2213  * 7 . 9 length of cert. 1
2214  * 10 . n-1 peer certificate
2215  * n . n+2 length of cert. 2
2216  * n+3 . ... upper level cert, etc.
2217  */
2218  i = 7;
2219  crt = ssl->own_cert;
2220 
2221  while( crt != NULL )
2222  {
2223  n = crt->raw.len;
2224  if( i + 3 + n > SSL_MAX_CONTENT_LEN )
2225  {
2226  SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
2227  i + 3 + n, SSL_MAX_CONTENT_LEN ) );
2229  }
2230 
2231  ssl->out_msg[i ] = (unsigned char)( n >> 16 );
2232  ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
2233  ssl->out_msg[i + 2] = (unsigned char)( n );
2234 
2235  i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
2236  i += n; crt = crt->next;
2237  }
2238 
2239  ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
2240  ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
2241  ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
2242 
2243  ssl->out_msglen = i;
2245  ssl->out_msg[0] = SSL_HS_CERTIFICATE;
2246 
2247 write_msg:
2248 
2249  ssl->state++;
2250 
2251  if( ( ret = ssl_write_record( ssl ) ) != 0 )
2252  {
2253  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2254  return( ret );
2255  }
2256 
2257  SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
2258 
2259  return( 0 );
2260 }
2261 
2263 {
2264  int ret;
2265  size_t i, n;
2266 
2267  SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
2268 
2269  if( ssl->endpoint == SSL_IS_SERVER &&
2270  ssl->authmode == SSL_VERIFY_NONE )
2271  {
2273  SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
2274  ssl->state++;
2275  return( 0 );
2276  }
2277 
2278  if( ( ret = ssl_read_record( ssl ) ) != 0 )
2279  {
2280  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2281  return( ret );
2282  }
2283 
2284  ssl->state++;
2285 
2286  /*
2287  * Check if the client sent an empty certificate
2288  */
2289  if( ssl->endpoint == SSL_IS_SERVER &&
2290  ssl->minor_ver == SSL_MINOR_VERSION_0 )
2291  {
2292  if( ssl->in_msglen == 2 &&
2293  ssl->in_msgtype == SSL_MSG_ALERT &&
2294  ssl->in_msg[0] == SSL_ALERT_LEVEL_WARNING &&
2295  ssl->in_msg[1] == SSL_ALERT_MSG_NO_CERT )
2296  {
2297  SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
2298 
2300  if( ssl->authmode == SSL_VERIFY_OPTIONAL )
2301  return( 0 );
2302  else
2304  }
2305  }
2306 
2307  if( ssl->endpoint == SSL_IS_SERVER &&
2308  ssl->minor_ver != SSL_MINOR_VERSION_0 )
2309  {
2310  if( ssl->in_hslen == 7 &&
2311  ssl->in_msgtype == SSL_MSG_HANDSHAKE &&
2312  ssl->in_msg[0] == SSL_HS_CERTIFICATE &&
2313  memcmp( ssl->in_msg + 4, "\0\0\0", 3 ) == 0 )
2314  {
2315  SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
2316 
2318  if( ssl->authmode == SSL_VERIFY_REQUIRED )
2320  else
2321  return( 0 );
2322  }
2323  }
2324 
2325  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
2326  {
2327  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2329  }
2330 
2331  if( ssl->in_msg[0] != SSL_HS_CERTIFICATE || ssl->in_hslen < 10 )
2332  {
2333  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2335  }
2336 
2337  /*
2338  * Same message structure as in ssl_write_certificate()
2339  */
2340  n = ( ssl->in_msg[5] << 8 ) | ssl->in_msg[6];
2341 
2342  if( ssl->in_msg[4] != 0 || ssl->in_hslen != 7 + n )
2343  {
2344  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2346  }
2347 
2348  if( ( ssl->session_negotiate->peer_cert = (x509_cert *) malloc(
2349  sizeof( x509_cert ) ) ) == NULL )
2350  {
2351  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
2352  sizeof( x509_cert ) ) );
2354  }
2355 
2356  memset( ssl->session_negotiate->peer_cert, 0, sizeof( x509_cert ) );
2357 
2358  i = 7;
2359 
2360  while( i < ssl->in_hslen )
2361  {
2362  if( ssl->in_msg[i] != 0 )
2363  {
2364  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2366  }
2367 
2368  n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
2369  | (unsigned int) ssl->in_msg[i + 2];
2370  i += 3;
2371 
2372  if( n < 128 || i + n > ssl->in_hslen )
2373  {
2374  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
2376  }
2377 
2378  ret = x509parse_crt( ssl->session_negotiate->peer_cert, ssl->in_msg + i,
2379  n );
2380  if( ret != 0 )
2381  {
2382  SSL_DEBUG_RET( 1, " x509parse_crt", ret );
2383  return( ret );
2384  }
2385 
2386  i += n;
2387  }
2388 
2389  SSL_DEBUG_CRT( 3, "peer certificate", ssl->session_negotiate->peer_cert );
2390 
2391  if( ssl->authmode != SSL_VERIFY_NONE )
2392  {
2393  if( ssl->ca_chain == NULL )
2394  {
2395  SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
2397  }
2398 
2400  ssl->ca_chain, ssl->ca_crl,
2401  ssl->peer_cn, &ssl->verify_result,
2402  ssl->f_vrfy, ssl->p_vrfy );
2403 
2404  if( ret != 0 )
2405  SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
2406 
2407  if( ssl->authmode != SSL_VERIFY_REQUIRED )
2408  ret = 0;
2409  }
2410 
2411  SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
2412 
2413  return( ret );
2414 }
2415 
2417 {
2418  int ret;
2419 
2420  SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
2421 
2423  ssl->out_msglen = 1;
2424  ssl->out_msg[0] = 1;
2425 
2426  ssl->state++;
2427 
2428  if( ( ret = ssl_write_record( ssl ) ) != 0 )
2429  {
2430  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2431  return( ret );
2432  }
2433 
2434  SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
2435 
2436  return( 0 );
2437 }
2438 
2440 {
2441  int ret;
2442 
2443  SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
2444 
2445  if( ( ret = ssl_read_record( ssl ) ) != 0 )
2446  {
2447  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2448  return( ret );
2449  }
2450 
2452  {
2453  SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
2455  }
2456 
2457  if( ssl->in_msglen != 1 || ssl->in_msg[0] != 1 )
2458  {
2459  SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
2461  }
2462 
2463  ssl->state++;
2464 
2465  SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
2466 
2467  return( 0 );
2468 }
2469 
2470 void ssl_optimize_checksum( ssl_context *ssl, int ciphersuite )
2471 {
2472 #if !defined(POLARSSL_SHA4_C)
2473  ((void) ciphersuite);
2474 #endif
2475 
2476  if( ssl->minor_ver < SSL_MINOR_VERSION_3 )
2477  ssl->handshake->update_checksum = ssl_update_checksum_md5sha1;
2478 #if defined(POLARSSL_SHA4_C)
2479  else if ( ciphersuite == TLS_RSA_WITH_AES_256_GCM_SHA384 ||
2480  ciphersuite == TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 )
2481  {
2482  ssl->handshake->update_checksum = ssl_update_checksum_sha384;
2483  }
2484 #endif
2485  else
2486  ssl->handshake->update_checksum = ssl_update_checksum_sha256;
2487 }
2488 
2489 static void ssl_update_checksum_start( ssl_context *ssl, unsigned char *buf,
2490  size_t len )
2491 {
2492  md5_update( &ssl->handshake->fin_md5 , buf, len );
2493  sha1_update( &ssl->handshake->fin_sha1, buf, len );
2494  sha2_update( &ssl->handshake->fin_sha2, buf, len );
2495 #if defined(POLARSSL_SHA4_C)
2496  sha4_update( &ssl->handshake->fin_sha4, buf, len );
2497 #endif
2498 }
2499 
2500 static void ssl_update_checksum_md5sha1( ssl_context *ssl, unsigned char *buf,
2501  size_t len )
2502 {
2503  md5_update( &ssl->handshake->fin_md5 , buf, len );
2504  sha1_update( &ssl->handshake->fin_sha1, buf, len );
2505 }
2506 
2507 static void ssl_update_checksum_sha256( ssl_context *ssl, unsigned char *buf,
2508  size_t len )
2509 {
2510  sha2_update( &ssl->handshake->fin_sha2, buf, len );
2511 }
2512 
2513 #if defined(POLARSSL_SHA4_C)
2514 static void ssl_update_checksum_sha384( ssl_context *ssl, unsigned char *buf,
2515  size_t len )
2516 {
2517  sha4_update( &ssl->handshake->fin_sha4, buf, len );
2518 }
2519 #endif
2520 
2521 static void ssl_calc_finished_ssl(
2522  ssl_context *ssl, unsigned char *buf, int from )
2523 {
2524  char *sender;
2525  md5_context md5;
2527 
2528  unsigned char padbuf[48];
2529  unsigned char md5sum[16];
2530  unsigned char sha1sum[20];
2531 
2532  ssl_session *session = ssl->session_negotiate;
2533  if( !session )
2534  session = ssl->session;
2535 
2536  SSL_DEBUG_MSG( 2, ( "=> calc finished ssl" ) );
2537 
2538  memcpy( &md5 , &ssl->handshake->fin_md5 , sizeof(md5_context) );
2539  memcpy( &sha1, &ssl->handshake->fin_sha1, sizeof(sha1_context) );
2540 
2541  /*
2542  * SSLv3:
2543  * hash =
2544  * MD5( master + pad2 +
2545  * MD5( handshake + sender + master + pad1 ) )
2546  * + SHA1( master + pad2 +
2547  * SHA1( handshake + sender + master + pad1 ) )
2548  */
2549 
2550  SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
2551  md5.state, sizeof( md5.state ) );
2552 
2553  SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
2554  sha1.state, sizeof( sha1.state ) );
2555 
2556  sender = ( from == SSL_IS_CLIENT ) ? (char *) "CLNT"
2557  : (char *) "SRVR";
2558 
2559  memset( padbuf, 0x36, 48 );
2560 
2561  md5_update( &md5, (unsigned char *) sender, 4 );
2562  md5_update( &md5, session->master, 48 );
2563  md5_update( &md5, padbuf, 48 );
2564  md5_finish( &md5, md5sum );
2565 
2566  sha1_update( &sha1, (unsigned char *) sender, 4 );
2567  sha1_update( &sha1, session->master, 48 );
2568  sha1_update( &sha1, padbuf, 40 );
2569  sha1_finish( &sha1, sha1sum );
2570 
2571  memset( padbuf, 0x5C, 48 );
2572 
2573  md5_starts( &md5 );
2574  md5_update( &md5, session->master, 48 );
2575  md5_update( &md5, padbuf, 48 );
2576  md5_update( &md5, md5sum, 16 );
2577  md5_finish( &md5, buf );
2578 
2579  sha1_starts( &sha1 );
2580  sha1_update( &sha1, session->master, 48 );
2581  sha1_update( &sha1, padbuf , 40 );
2582  sha1_update( &sha1, sha1sum, 20 );
2583  sha1_finish( &sha1, buf + 16 );
2584 
2585  SSL_DEBUG_BUF( 3, "calc finished result", buf, 36 );
2586 
2587  memset( &md5, 0, sizeof( md5_context ) );
2588  memset( &sha1, 0, sizeof( sha1_context ) );
2589 
2590  memset( padbuf, 0, sizeof( padbuf ) );
2591  memset( md5sum, 0, sizeof( md5sum ) );
2592  memset( sha1sum, 0, sizeof( sha1sum ) );
2593 
2594  SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2595 }
2596 
2597 static void ssl_calc_finished_tls(
2598  ssl_context *ssl, unsigned char *buf, int from )
2599 {
2600  int len = 12;
2601  char *sender;
2602  md5_context md5;
2604  unsigned char padbuf[36];
2605 
2606  ssl_session *session = ssl->session_negotiate;
2607  if( !session )
2608  session = ssl->session;
2609 
2610  SSL_DEBUG_MSG( 2, ( "=> calc finished tls" ) );
2611 
2612  memcpy( &md5 , &ssl->handshake->fin_md5 , sizeof(md5_context) );
2613  memcpy( &sha1, &ssl->handshake->fin_sha1, sizeof(sha1_context) );
2614 
2615  /*
2616  * TLSv1:
2617  * hash = PRF( master, finished_label,
2618  * MD5( handshake ) + SHA1( handshake ) )[0..11]
2619  */
2620 
2621  SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
2622  md5.state, sizeof( md5.state ) );
2623 
2624  SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
2625  sha1.state, sizeof( sha1.state ) );
2626 
2627  sender = ( from == SSL_IS_CLIENT )
2628  ? (char *) "client finished"
2629  : (char *) "server finished";
2630 
2631  md5_finish( &md5, padbuf );
2632  sha1_finish( &sha1, padbuf + 16 );
2633 
2634  ssl->handshake->tls_prf( session->master, 48, sender,
2635  padbuf, 36, buf, len );
2636 
2637  SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2638 
2639  memset( &md5, 0, sizeof( md5_context ) );
2640  memset( &sha1, 0, sizeof( sha1_context ) );
2641 
2642  memset( padbuf, 0, sizeof( padbuf ) );
2643 
2644  SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2645 }
2646 
2647 static void ssl_calc_finished_tls_sha256(
2648  ssl_context *ssl, unsigned char *buf, int from )
2649 {
2650  int len = 12;
2651  char *sender;
2653  unsigned char padbuf[32];
2654 
2655  ssl_session *session = ssl->session_negotiate;
2656  if( !session )
2657  session = ssl->session;
2658 
2659  SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha256" ) );
2660 
2661  memcpy( &sha2, &ssl->handshake->fin_sha2, sizeof(sha2_context) );
2662 
2663  /*
2664  * TLSv1.2:
2665  * hash = PRF( master, finished_label,
2666  * Hash( handshake ) )[0.11]
2667  */
2668 
2669  SSL_DEBUG_BUF( 4, "finished sha2 state", (unsigned char *)
2670  sha2.state, sizeof( sha2.state ) );
2671 
2672  sender = ( from == SSL_IS_CLIENT )
2673  ? (char *) "client finished"
2674  : (char *) "server finished";
2675 
2676  sha2_finish( &sha2, padbuf );
2677 
2678  ssl->handshake->tls_prf( session->master, 48, sender,
2679  padbuf, 32, buf, len );
2680 
2681  SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2682 
2683  memset( &sha2, 0, sizeof( sha2_context ) );
2684 
2685  memset( padbuf, 0, sizeof( padbuf ) );
2686 
2687  SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2688 }
2689 
2690 #if defined(POLARSSL_SHA4_C)
2691 static void ssl_calc_finished_tls_sha384(
2692  ssl_context *ssl, unsigned char *buf, int from )
2693 {
2694  int len = 12;
2695  char *sender;
2697  unsigned char padbuf[48];
2698 
2699  ssl_session *session = ssl->session_negotiate;
2700  if( !session )
2701  session = ssl->session;
2702 
2703  SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
2704 
2705  memcpy( &sha4, &ssl->handshake->fin_sha4, sizeof(sha4_context) );
2706 
2707  /*
2708  * TLSv1.2:
2709  * hash = PRF( master, finished_label,
2710  * Hash( handshake ) )[0.11]
2711  */
2712 
2713  SSL_DEBUG_BUF( 4, "finished sha4 state", (unsigned char *)
2714  sha4.state, sizeof( sha4.state ) );
2715 
2716  sender = ( from == SSL_IS_CLIENT )
2717  ? (char *) "client finished"
2718  : (char *) "server finished";
2719 
2720  sha4_finish( &sha4, padbuf );
2721 
2722  ssl->handshake->tls_prf( session->master, 48, sender,
2723  padbuf, 48, buf, len );
2724 
2725  SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
2726 
2727  memset( &sha4, 0, sizeof( sha4_context ) );
2728 
2729  memset( padbuf, 0, sizeof( padbuf ) );
2730 
2731  SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
2732 }
2733 #endif
2734 
2735 void ssl_handshake_wrapup( ssl_context *ssl )
2736 {
2737  SSL_DEBUG_MSG( 3, ( "=> handshake wrapup" ) );
2738 
2739  /*
2740  * Free our handshake params
2741  */
2742  ssl_handshake_free( ssl->handshake );
2743  free( ssl->handshake );
2744  ssl->handshake = NULL;
2745 
2746  /*
2747  * Switch in our now active transform context
2748  */
2749  if( ssl->transform )
2750  {
2751  ssl_transform_free( ssl->transform );
2752  free( ssl->transform );
2753  }
2754  ssl->transform = ssl->transform_negotiate;
2755  ssl->transform_negotiate = NULL;
2756 
2757  if( ssl->session )
2758  {
2759  ssl_session_free( ssl->session );
2760  free( ssl->session );
2761  }
2762  ssl->session = ssl->session_negotiate;
2763  ssl->session_negotiate = NULL;
2764 
2765  /*
2766  * Add cache entry
2767  */
2768  if( ssl->f_set_cache != NULL )
2769  if( ssl->f_set_cache( ssl->p_set_cache, ssl->session ) != 0 )
2770  SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
2771 
2772  ssl->state++;
2773 
2774  SSL_DEBUG_MSG( 3, ( "<= handshake wrapup" ) );
2775 }
2776 
2777 int ssl_write_finished( ssl_context *ssl )
2778 {
2779  int ret, hash_len;
2780 
2781  SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
2782 
2783  ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->endpoint );
2784 
2785  // TODO TLS/1.2 Hash length is determined by cipher suite (Page 63)
2786  hash_len = ( ssl->minor_ver == SSL_MINOR_VERSION_0 ) ? 36 : 12;
2787 
2788  ssl->verify_data_len = hash_len;
2789  memcpy( ssl->own_verify_data, ssl->out_msg + 4, hash_len );
2790 
2791  ssl->out_msglen = 4 + hash_len;
2793  ssl->out_msg[0] = SSL_HS_FINISHED;
2794 
2795  /*
2796  * In case of session resuming, invert the client and server
2797  * ChangeCipherSpec messages order.
2798  */
2799  if( ssl->handshake->resume != 0 )
2800  {
2801  if( ssl->endpoint == SSL_IS_CLIENT )
2802  ssl->state = SSL_HANDSHAKE_WRAPUP;
2803  else
2805  }
2806  else
2807  ssl->state++;
2808 
2809  /*
2810  * Switch to our negotiated transform and session parameters for outbound data.
2811  */
2812  SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
2813  ssl->transform_out = ssl->transform_negotiate;
2814  ssl->session_out = ssl->session_negotiate;
2815  memset( ssl->out_ctr, 0, 8 );
2816 
2817  if( ( ret = ssl_write_record( ssl ) ) != 0 )
2818  {
2819  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2820  return( ret );
2821  }
2822 
2823  SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
2824 
2825  return( 0 );
2826 }
2827 
2828 int ssl_parse_finished( ssl_context *ssl )
2829 {
2830  int ret;
2831  unsigned int hash_len;
2832  unsigned char buf[36];
2833 
2834  SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
2835 
2836  ssl->handshake->calc_finished( ssl, buf, ssl->endpoint ^ 1 );
2837 
2838  /*
2839  * Switch to our negotiated transform and session parameters for inbound data.
2840  */
2841  SSL_DEBUG_MSG( 3, ( "switching to new transform spec for inbound data" ) );
2842  ssl->transform_in = ssl->transform_negotiate;
2843  ssl->session_in = ssl->session_negotiate;
2844  memset( ssl->in_ctr, 0, 8 );
2845 
2846  if( ( ret = ssl_read_record( ssl ) ) != 0 )
2847  {
2848  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2849  return( ret );
2850  }
2851 
2852  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
2853  {
2854  SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2856  }
2857 
2858  // TODO TLS/1.2 Hash length is determined by cipher suite (Page 63)
2859  hash_len = ( ssl->minor_ver == SSL_MINOR_VERSION_0 ) ? 36 : 12;
2860 
2861  if( ssl->in_msg[0] != SSL_HS_FINISHED ||
2862  ssl->in_hslen != 4 + hash_len )
2863  {
2864  SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2866  }
2867 
2868  if( memcmp( ssl->in_msg + 4, buf, hash_len ) != 0 )
2869  {
2870  SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
2872  }
2873 
2874  ssl->verify_data_len = hash_len;
2875  memcpy( ssl->peer_verify_data, buf, hash_len );
2876 
2877  if( ssl->handshake->resume != 0 )
2878  {
2879  if( ssl->endpoint == SSL_IS_CLIENT )
2881 
2882  if( ssl->endpoint == SSL_IS_SERVER )
2883  ssl->state = SSL_HANDSHAKE_WRAPUP;
2884  }
2885  else
2886  ssl->state++;
2887 
2888  SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
2889 
2890  return( 0 );
2891 }
2892 
2893 int ssl_handshake_init( ssl_context *ssl )
2894 {
2895  if( ssl->transform_negotiate )
2897  else
2898  ssl->transform_negotiate = malloc( sizeof(ssl_transform) );
2899 
2900  if( ssl->session_negotiate )
2902  else
2903  ssl->session_negotiate = malloc( sizeof(ssl_session) );
2904 
2905  if( ssl->handshake )
2906  ssl_handshake_free( ssl->handshake );
2907  else
2908  ssl->handshake = malloc( sizeof(ssl_handshake_params) );
2909 
2910  if( ssl->handshake == NULL ||
2911  ssl->transform_negotiate == NULL ||
2912  ssl->session_negotiate == NULL )
2913  {
2914  SSL_DEBUG_MSG( 1, ( "malloc() of ssl sub-contexts failed" ) );
2916  }
2917 
2918  memset( ssl->handshake, 0, sizeof(ssl_handshake_params) );
2919  memset( ssl->transform_negotiate, 0, sizeof(ssl_transform) );
2920  memset( ssl->session_negotiate, 0, sizeof(ssl_session) );
2921 
2922  md5_starts( &ssl->handshake->fin_md5 );
2923  sha1_starts( &ssl->handshake->fin_sha1 );
2924  sha2_starts( &ssl->handshake->fin_sha2, 0 );
2925 #if defined(POLARSSL_SHA4_C)
2926  sha4_starts( &ssl->handshake->fin_sha4, 1 );
2927 #endif
2928 
2929  ssl->handshake->update_checksum = ssl_update_checksum_start;
2931 
2932  return( 0 );
2933 }
2934 
2935 /*
2936  * Initialize an SSL context
2937  */
2938 int ssl_init( ssl_context *ssl )
2939 {
2940  int ret;
2941  int len = SSL_BUFFER_LEN;
2942 
2943  memset( ssl, 0, sizeof( ssl_context ) );
2944 
2945  /*
2946  * Sane defaults
2947  */
2948  ssl->rsa_decrypt = ssl_rsa_decrypt;
2949  ssl->rsa_sign = ssl_rsa_sign;
2950  ssl->rsa_key_len = ssl_rsa_key_len;
2951 
2954 
2955  ssl->ciphersuites = malloc( sizeof(int *) * 4 );
2956  ssl_set_ciphersuites( ssl, ssl_default_ciphersuites );
2957 
2958 #if defined(POLARSSL_DHM_C)
2959  if( ( ret = mpi_read_string( &ssl->dhm_P, 16,
2961  ( ret = mpi_read_string( &ssl->dhm_G, 16,
2963  {
2964  SSL_DEBUG_RET( 1, "mpi_read_string", ret );
2965  return( ret );
2966  }
2967 #endif
2968 
2969  /*
2970  * Prepare base structures
2971  */
2972  ssl->in_ctr = (unsigned char *) malloc( len );
2973  ssl->in_hdr = ssl->in_ctr + 8;
2974  ssl->in_msg = ssl->in_ctr + 13;
2975 
2976  if( ssl->in_ctr == NULL )
2977  {
2978  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
2980  }
2981 
2982  ssl->out_ctr = (unsigned char *) malloc( len );
2983  ssl->out_hdr = ssl->out_ctr + 8;
2984  ssl->out_msg = ssl->out_ctr + 40;
2985 
2986  if( ssl->out_ctr == NULL )
2987  {
2988  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
2989  free( ssl-> in_ctr );
2991  }
2992 
2993  memset( ssl-> in_ctr, 0, SSL_BUFFER_LEN );
2994  memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
2995 
2996  ssl->hostname = NULL;
2997  ssl->hostname_len = 0;
2998 
2999  if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3000  return( ret );
3001 
3002  return( 0 );
3003 }
3004 
3005 /*
3006  * Reset an initialized and used SSL context for re-use while retaining
3007  * all application-set variables, function pointers and data.
3008  */
3009 int ssl_session_reset( ssl_context *ssl )
3010 {
3011  int ret;
3012 
3013  ssl->state = SSL_HELLO_REQUEST;
3016 
3017  ssl->verify_data_len = 0;
3018  memset( ssl->own_verify_data, 0, 36 );
3019  memset( ssl->peer_verify_data, 0, 36 );
3020 
3021  ssl->in_offt = NULL;
3022 
3023  ssl->in_msgtype = 0;
3024  ssl->in_msglen = 0;
3025  ssl->in_left = 0;
3026 
3027  ssl->in_hslen = 0;
3028  ssl->nb_zero = 0;
3029 
3030  ssl->out_msgtype = 0;
3031  ssl->out_msglen = 0;
3032  ssl->out_left = 0;
3033 
3034  ssl->transform_in = NULL;
3035  ssl->transform_out = NULL;
3036 
3037  memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
3038  memset( ssl->in_ctr, 0, SSL_BUFFER_LEN );
3039 
3040 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
3041  if( ssl_hw_record_reset != NULL)
3042  {
3043  SSL_DEBUG_MSG( 2, ( "going for ssl_hw_record_reset()" ) );
3044  if( ssl_hw_record_reset( ssl ) != 0 )
3045  {
3046  SSL_DEBUG_RET( 1, "ssl_hw_record_reset", ret );
3048  }
3049  }
3050 #endif
3051 
3052  if( ssl->transform )
3053  {
3054  ssl_transform_free( ssl->transform );
3055  free( ssl->transform );
3056  ssl->transform = NULL;
3057  }
3058 
3059  if( ssl->session )
3060  {
3061  ssl_session_free( ssl->session );
3062  free( ssl->session );
3063  ssl->session = NULL;
3064  }
3065 
3066  if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3067  return( ret );
3068 
3069  return( 0 );
3070 }
3071 
3072 /*
3073  * SSL set accessors
3074  */
3075 void ssl_set_endpoint( ssl_context *ssl, int endpoint )
3076 {
3077  ssl->endpoint = endpoint;
3078 }
3079 
3080 void ssl_set_authmode( ssl_context *ssl, int authmode )
3081 {
3082  ssl->authmode = authmode;
3083 }
3084 
3085 void ssl_set_verify( ssl_context *ssl,
3086  int (*f_vrfy)(void *, x509_cert *, int, int *),
3087  void *p_vrfy )
3088 {
3089  ssl->f_vrfy = f_vrfy;
3090  ssl->p_vrfy = p_vrfy;
3091 }
3092 
3093 void ssl_set_rng( ssl_context *ssl,
3094  int (*f_rng)(void *, unsigned char *, size_t),
3095  void *p_rng )
3096 {
3097  ssl->f_rng = f_rng;
3098  ssl->p_rng = p_rng;
3099 }
3100 
3101 void ssl_set_dbg( ssl_context *ssl,
3102  void (*f_dbg)(void *, int, const char *),
3103  void *p_dbg )
3104 {
3105  ssl->f_dbg = f_dbg;
3106  ssl->p_dbg = p_dbg;
3107 }
3108 
3109 void ssl_set_bio( ssl_context *ssl,
3110  int (*f_recv)(void *, unsigned char *, size_t), void *p_recv,
3111  int (*f_send)(void *, const unsigned char *, size_t), void *p_send )
3112 {
3113  ssl->f_recv = f_recv;
3114  ssl->f_send = f_send;
3115  ssl->p_recv = p_recv;
3116  ssl->p_send = p_send;
3117 }
3118 
3120  int (*f_get_cache)(void *, ssl_session *), void *p_get_cache,
3121  int (*f_set_cache)(void *, const ssl_session *), void *p_set_cache )
3122 {
3123  ssl->f_get_cache = f_get_cache;
3124  ssl->p_get_cache = p_get_cache;
3125  ssl->f_set_cache = f_set_cache;
3126  ssl->p_set_cache = p_set_cache;
3127 }
3128 
3129 void ssl_set_session( ssl_context *ssl, const ssl_session *session )
3130 {
3131  memcpy( ssl->session_negotiate, session, sizeof(ssl_session) );
3132  ssl->handshake->resume = 1;
3133 }
3134 
3135 void ssl_set_ciphersuites( ssl_context *ssl, const int *ciphersuites )
3136 {
3137  ssl->ciphersuites[SSL_MINOR_VERSION_0] = ciphersuites;
3138  ssl->ciphersuites[SSL_MINOR_VERSION_1] = ciphersuites;
3139  ssl->ciphersuites[SSL_MINOR_VERSION_2] = ciphersuites;
3140  ssl->ciphersuites[SSL_MINOR_VERSION_3] = ciphersuites;
3141 }
3142 
3143 void ssl_set_ciphersuites_for_version( ssl_context *ssl, const int *ciphersuites,
3144  int major, int minor )
3145 {
3146  if( major != SSL_MAJOR_VERSION_3 )
3147  return;
3148 
3149  if( minor < SSL_MINOR_VERSION_0 || minor > SSL_MINOR_VERSION_3 )
3150  return;
3151 
3152  ssl->ciphersuites[minor] = ciphersuites;
3153 }
3154 
3155 void ssl_set_ca_chain( ssl_context *ssl, x509_cert *ca_chain,
3156  x509_crl *ca_crl, const char *peer_cn )
3157 {
3158  ssl->ca_chain = ca_chain;
3159  ssl->ca_crl = ca_crl;
3160  ssl->peer_cn = peer_cn;
3161 }
3162 
3163 void ssl_set_own_cert( ssl_context *ssl, x509_cert *own_cert,
3164  rsa_context *rsa_key )
3165 {
3166  ssl->own_cert = own_cert;
3167  ssl->rsa_key = rsa_key;
3168 }
3169 
3170 void ssl_set_own_cert_alt( ssl_context *ssl, x509_cert *own_cert,
3171  void *rsa_key,
3172  rsa_decrypt_func rsa_decrypt,
3173  rsa_sign_func rsa_sign,
3174  rsa_key_len_func rsa_key_len )
3175 {
3176  ssl->own_cert = own_cert;
3177  ssl->rsa_key = rsa_key;
3178  ssl->rsa_decrypt = rsa_decrypt;
3179  ssl->rsa_sign = rsa_sign;
3180  ssl->rsa_key_len = rsa_key_len;
3181 }
3182 
3183 
3184 #if defined(POLARSSL_DHM_C)
3185 int ssl_set_dh_param( ssl_context *ssl, const char *dhm_P, const char *dhm_G )
3186 {
3187  int ret;
3188 
3189  if( ( ret = mpi_read_string( &ssl->dhm_P, 16, dhm_P ) ) != 0 )
3190  {
3191  SSL_DEBUG_RET( 1, "mpi_read_string", ret );
3192  return( ret );
3193  }
3194 
3195  if( ( ret = mpi_read_string( &ssl->dhm_G, 16, dhm_G ) ) != 0 )
3196  {
3197  SSL_DEBUG_RET( 1, "mpi_read_string", ret );
3198  return( ret );
3199  }
3200 
3201  return( 0 );
3202 }
3203 
3204 int ssl_set_dh_param_ctx( ssl_context *ssl, dhm_context *dhm_ctx )
3205 {
3206  int ret;
3207 
3208  if( ( ret = mpi_copy(&ssl->dhm_P, &dhm_ctx->P) ) != 0 )
3209  {
3210  SSL_DEBUG_RET( 1, "mpi_copy", ret );
3211  return( ret );
3212  }
3213 
3214  if( ( ret = mpi_copy(&ssl->dhm_G, &dhm_ctx->G) ) != 0 )
3215  {
3216  SSL_DEBUG_RET( 1, "mpi_copy", ret );
3217  return( ret );
3218  }
3219 
3220  return( 0 );
3221 }
3222 #endif /* POLARSSL_DHM_C */
3223 
3224 int ssl_set_hostname( ssl_context *ssl, const char *hostname )
3225 {
3226  if( hostname == NULL )
3228 
3229  ssl->hostname_len = strlen( hostname );
3230  ssl->hostname = (unsigned char *) malloc( ssl->hostname_len + 1 );
3231 
3232  if( ssl->hostname == NULL )
3234 
3235  memcpy( ssl->hostname, (unsigned char *) hostname,
3236  ssl->hostname_len );
3237 
3238  ssl->hostname[ssl->hostname_len] = '\0';
3239 
3240  return( 0 );
3241 }
3242 
3243 void ssl_set_sni( ssl_context *ssl,
3244  int (*f_sni)(void *, ssl_context *,
3245  const unsigned char *, size_t),
3246  void *p_sni )
3247 {
3248  ssl->f_sni = f_sni;
3249  ssl->p_sni = p_sni;
3250 }
3251 
3252 void ssl_set_max_version( ssl_context *ssl, int major, int minor )
3253 {
3254  ssl->max_major_ver = major;
3255  ssl->max_minor_ver = minor;
3256 }
3257 
3258 void ssl_set_min_version( ssl_context *ssl, int major, int minor )
3259 {
3260  ssl->min_major_ver = major;
3261  ssl->min_minor_ver = minor;
3262 }
3263 
3264 void ssl_set_renegotiation( ssl_context *ssl, int renegotiation )
3265 {
3266  ssl->disable_renegotiation = renegotiation;
3267 }
3268 
3269 void ssl_legacy_renegotiation( ssl_context *ssl, int allow_legacy )
3270 {
3271  ssl->allow_legacy_renegotiation = allow_legacy;
3272 }
3273 
3274 /*
3275  * SSL get accessors
3276  */
3277 size_t ssl_get_bytes_avail( const ssl_context *ssl )
3278 {
3279  return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
3280 }
3281 
3282 int ssl_get_verify_result( const ssl_context *ssl )
3283 {
3284  return( ssl->verify_result );
3285 }
3286 
3287 const char *ssl_get_ciphersuite_name( const int ciphersuite_id )
3288 {
3289  switch( ciphersuite_id )
3290  {
3291 #if defined(POLARSSL_ARC4_C)
3293  return( "TLS-RSA-WITH-RC4-128-MD5" );
3294 
3296  return( "TLS-RSA-WITH-RC4-128-SHA" );
3297 #endif
3298 
3299 #if defined(POLARSSL_DES_C)
3301  return( "TLS-RSA-WITH-3DES-EDE-CBC-SHA" );
3302 
3304  return( "TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA" );
3305 #endif
3306 
3307 #if defined(POLARSSL_AES_C)
3309  return( "TLS-RSA-WITH-AES-128-CBC-SHA" );
3310 
3312  return( "TLS-DHE-RSA-WITH-AES-128-CBC-SHA" );
3313 
3315  return( "TLS-RSA-WITH-AES-256-CBC-SHA" );
3316 
3318  return( "TLS-DHE-RSA-WITH-AES-256-CBC-SHA" );
3319 
3320 #if defined(POLARSSL_SHA2_C)
3322  return( "TLS-RSA-WITH-AES-128-CBC-SHA256" );
3323 
3325  return( "TLS-RSA-WITH-AES-256-CBC-SHA256" );
3326 
3328  return( "TLS-DHE-RSA-WITH-AES-128-CBC-SHA256" );
3329 
3331  return( "TLS-DHE-RSA-WITH-AES-256-CBC-SHA256" );
3332 #endif
3333 
3334 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
3336  return( "TLS-RSA-WITH-AES-128-GCM-SHA256" );
3337 
3339  return( "TLS-RSA-WITH-AES-256-GCM-SHA384" );
3340 #endif
3341 
3342 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C)
3344  return( "TLS-DHE-RSA-WITH-AES-128-GCM-SHA256" );
3345 
3347  return( "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" );
3348 #endif
3349 #endif /* POLARSSL_AES_C */
3350 
3351 #if defined(POLARSSL_CAMELLIA_C)
3353  return( "TLS-RSA-WITH-CAMELLIA-128-CBC-SHA" );
3354 
3356  return( "TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA" );
3357 
3359  return( "TLS-RSA-WITH-CAMELLIA-256-CBC-SHA" );
3360 
3362  return( "TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA" );
3363 
3364 #if defined(POLARSSL_SHA2_C)
3366  return( "TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256" );
3367 
3369  return( "TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256" );
3370 
3372  return( "TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256" );
3373 
3375  return( "TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256" );
3376 #endif
3377 #endif
3378 
3379 #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
3380 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
3381  case TLS_RSA_WITH_NULL_MD5:
3382  return( "TLS-RSA-WITH-NULL-MD5" );
3383  case TLS_RSA_WITH_NULL_SHA:
3384  return( "TLS-RSA-WITH-NULL-SHA" );
3386  return( "TLS-RSA-WITH-NULL-SHA256" );
3387 #endif /* defined(POLARSSL_CIPHER_NULL_CIPHER) */
3388 
3389 #if defined(POLARSSL_DES_C)
3391  return( "TLS-RSA-WITH-DES-CBC-SHA" );
3393  return( "TLS-DHE-RSA-WITH-DES-CBC-SHA" );
3394 #endif
3395 #endif /* defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) */
3396 
3397  default:
3398  break;
3399  }
3400 
3401  return( "unknown" );
3402 }
3403 
3404 int ssl_get_ciphersuite_id( const char *ciphersuite_name )
3405 {
3406 #if defined(POLARSSL_ARC4_C)
3407  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-RC4-128-MD5"))
3408  return( TLS_RSA_WITH_RC4_128_MD5 );
3409  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-RC4-128-SHA"))
3410  return( TLS_RSA_WITH_RC4_128_SHA );
3411 #endif
3412 
3413 #if defined(POLARSSL_DES_C)
3414  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-3DES-EDE-CBC-SHA"))
3416  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA"))
3418 #endif
3419 
3420 #if defined(POLARSSL_AES_C)
3421  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-AES-128-CBC-SHA"))
3422  return( TLS_RSA_WITH_AES_128_CBC_SHA );
3423  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-AES-128-CBC-SHA"))
3425  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-AES-256-CBC-SHA"))
3426  return( TLS_RSA_WITH_AES_256_CBC_SHA );
3427  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-AES-256-CBC-SHA"))
3429 
3430 #if defined(POLARSSL_SHA2_C)
3431  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-AES-128-CBC-SHA256"))
3433  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-AES-256-CBC-SHA256"))
3435  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-AES-128-CBC-SHA256"))
3437  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-AES-256-CBC-SHA256"))
3439 #endif
3440 
3441 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
3442  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-AES-128-GCM-SHA256"))
3444  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-AES-256-GCM-SHA384"))
3446 #endif
3447 
3448 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
3449  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-AES-128-GCM-SHA256"))
3451  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-AES-256-GCM-SHA384"))
3453 #endif
3454 #endif
3455 
3456 #if defined(POLARSSL_CAMELLIA_C)
3457  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-CAMELLIA-128-CBC-SHA"))
3459  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA"))
3461  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-CAMELLIA-256-CBC-SHA"))
3463  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA"))
3465 
3466 #if defined(POLARSSL_SHA2_C)
3467  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-CAMELLIA-128-CBC-SHA256"))
3469  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA256"))
3471  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-CAMELLIA-256-CBC-SHA256"))
3473  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA256"))
3475 #endif
3476 #endif
3477 
3478 #if defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES)
3479 #if defined(POLARSSL_CIPHER_NULL_CIPHER)
3480  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-NULL-MD5"))
3481  return( TLS_RSA_WITH_NULL_MD5 );
3482  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-NULL-SHA"))
3483  return( TLS_RSA_WITH_NULL_SHA );
3484  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-NULL-SHA256"))
3485  return( TLS_RSA_WITH_NULL_SHA256 );
3486 #endif /* defined(POLARSSL_CIPHER_NULL_CIPHER) */
3487 
3488 #if defined(POLARSSL_DES_C)
3489  if (0 == strcasecmp(ciphersuite_name, "TLS-RSA-WITH-DES-CBC-SHA"))
3490  return( TLS_RSA_WITH_DES_CBC_SHA );
3491  if (0 == strcasecmp(ciphersuite_name, "TLS-DHE-RSA-WITH-DES-CBC-SHA"))
3492  return( TLS_DHE_RSA_WITH_DES_CBC_SHA );
3493 #endif
3494 #endif /* defined(POLARSSL_ENABLE_WEAK_CIPHERSUITES) */
3495 
3496  return( 0 );
3497 }
3498 
3499 const char *ssl_get_ciphersuite( const ssl_context *ssl )
3500 {
3501  if( ssl == NULL || ssl->session == NULL )
3502  return NULL;
3503 
3505 }
3506 
3507 const char *ssl_get_version( const ssl_context *ssl )
3508 {
3509  switch( ssl->minor_ver )
3510  {
3511  case SSL_MINOR_VERSION_0:
3512  return( "SSLv3.0" );
3513 
3514  case SSL_MINOR_VERSION_1:
3515  return( "TLSv1.0" );
3516 
3517  case SSL_MINOR_VERSION_2:
3518  return( "TLSv1.1" );
3519 
3520  case SSL_MINOR_VERSION_3:
3521  return( "TLSv1.2" );
3522 
3523  default:
3524  break;
3525  }
3526  return( "unknown" );
3527 }
3528 
3529 const x509_cert *ssl_get_peer_cert( const ssl_context *ssl )
3530 {
3531  if( ssl == NULL || ssl->session == NULL )
3532  return NULL;
3533 
3534  return ssl->session->peer_cert;
3535 }
3536 
3537 const int ssl_default_ciphersuites[] =
3538 {
3539 #if defined(POLARSSL_DHM_C)
3540 #if defined(POLARSSL_AES_C)
3541 #if defined(POLARSSL_SHA2_C)
3543 #endif /* POLARSSL_SHA2_C */
3544 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C)
3546 #endif
3548 #if defined(POLARSSL_SHA2_C)
3550 #endif
3551 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
3553 #endif
3555 #endif
3556 #if defined(POLARSSL_CAMELLIA_C)
3557 #if defined(POLARSSL_SHA2_C)
3559 #endif /* POLARSSL_SHA2_C */
3561 #if defined(POLARSSL_SHA2_C)
3563 #endif /* POLARSSL_SHA2_C */
3565 #endif
3566 #if defined(POLARSSL_DES_C)
3568 #endif
3569 #endif
3570 
3571 #if defined(POLARSSL_AES_C)
3572 #if defined(POLARSSL_SHA2_C)
3574 #endif /* POLARSSL_SHA2_C */
3575 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA4_C)
3577 #endif /* POLARSSL_SHA2_C */
3579 #endif
3580 #if defined(POLARSSL_CAMELLIA_C)
3581 #if defined(POLARSSL_SHA2_C)
3583 #endif /* POLARSSL_SHA2_C */
3585 #endif
3586 #if defined(POLARSSL_AES_C)
3587 #if defined(POLARSSL_SHA2_C)
3589 #endif /* POLARSSL_SHA2_C */
3590 #if defined(POLARSSL_GCM_C) && defined(POLARSSL_SHA2_C)
3592 #endif /* POLARSSL_SHA2_C */
3594 #endif
3595 #if defined(POLARSSL_CAMELLIA_C)
3596 #if defined(POLARSSL_SHA2_C)
3598 #endif /* POLARSSL_SHA2_C */
3600 #endif
3601 #if defined(POLARSSL_DES_C)
3603 #endif
3604 #if defined(POLARSSL_ARC4_C)
3607 #endif
3608  0
3609 };
3610 
3611 /*
3612  * Perform a single step of the SSL handshake
3613  */
3614 int ssl_handshake_step( ssl_context *ssl )
3615 {
3617 
3618 #if defined(POLARSSL_SSL_CLI_C)
3619  if( ssl->endpoint == SSL_IS_CLIENT )
3620  ret = ssl_handshake_client_step( ssl );
3621 #endif
3622 
3623 #if defined(POLARSSL_SSL_SRV_C)
3624  if( ssl->endpoint == SSL_IS_SERVER )
3625  ret = ssl_handshake_server_step( ssl );
3626 #endif
3627 
3628  return( ret );
3629 }
3630 
3631 /*
3632  * Perform the SSL handshake
3633  */
3634 int ssl_handshake( ssl_context *ssl )
3635 {
3636  int ret = 0;
3637 
3638  SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
3639 
3640  while( ssl->state != SSL_HANDSHAKE_OVER )
3641  {
3642  ret = ssl_handshake_step( ssl );
3643 
3644  if( ret != 0 )
3645  break;
3646  }
3647 
3648  SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
3649 
3650  return( ret );
3651 }
3652 
3653 /*
3654  * Renegotiate current connection
3655  */
3656 int ssl_renegotiate( ssl_context *ssl )
3657 {
3658  int ret;
3659 
3660  SSL_DEBUG_MSG( 2, ( "=> renegotiate" ) );
3661 
3662  if( ssl->state != SSL_HANDSHAKE_OVER )
3664 
3665  ssl->state = SSL_HELLO_REQUEST;
3667 
3668  if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
3669  return( ret );
3670 
3671  if( ( ret = ssl_handshake( ssl ) ) != 0 )
3672  {
3673  SSL_DEBUG_RET( 1, "ssl_handshake", ret );
3674  return( ret );
3675  }
3676 
3677  SSL_DEBUG_MSG( 2, ( "<= renegotiate" ) );
3678 
3679  return( 0 );
3680 }
3681 
3682 /*
3683  * Receive application data decrypted from the SSL layer
3684  */
3685 int ssl_read( ssl_context *ssl, unsigned char *buf, size_t len )
3686 {
3687  int ret;
3688  size_t n;
3689 
3690  SSL_DEBUG_MSG( 2, ( "=> read" ) );
3691 
3692  if( ssl->state != SSL_HANDSHAKE_OVER )
3693  {
3694  if( ( ret = ssl_handshake( ssl ) ) != 0 )
3695  {
3696  SSL_DEBUG_RET( 1, "ssl_handshake", ret );
3697  return( ret );
3698  }
3699  }
3700 
3701  if( ssl->in_offt == NULL )
3702  {
3703  if( ( ret = ssl_read_record( ssl ) ) != 0 )
3704  {
3705  if( ret == POLARSSL_ERR_SSL_CONN_EOF )
3706  return( 0 );
3707 
3708  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
3709  return( ret );
3710  }
3711 
3712  if( ssl->in_msglen == 0 &&
3714  {
3715  /*
3716  * OpenSSL sends empty messages to randomize the IV
3717  */
3718  if( ( ret = ssl_read_record( ssl ) ) != 0 )
3719  {
3720  if( ret == POLARSSL_ERR_SSL_CONN_EOF )
3721  return( 0 );
3722 
3723  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
3724  return( ret );
3725  }
3726  }
3727 
3728  if( ssl->in_msgtype == SSL_MSG_HANDSHAKE )
3729  {
3730  SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
3731 
3732  if( ssl->endpoint == SSL_IS_CLIENT &&
3733  ( ssl->in_msg[0] != SSL_HS_HELLO_REQUEST ||
3734  ssl->in_hslen != 4 ) )
3735  {
3736  SSL_DEBUG_MSG( 1, ( "handshake received (not HelloRequest)" ) );
3738  }
3739 
3743  {
3744  SSL_DEBUG_MSG( 3, ( "ignoring renegotiation, sending alert" ) );
3745 
3746  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
3747  {
3748  /*
3749  * SSLv3 does not have a "no_renegotiation" alert
3750  */
3751  if( ( ret = ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
3752  return( ret );
3753  }
3754  else
3755  {
3756  if( ( ret = ssl_send_alert_message( ssl,
3759  {
3760  return( ret );
3761  }
3762  }
3763  }
3764  else
3765  {
3766  if( ( ret = ssl_renegotiate( ssl ) ) != 0 )
3767  {
3768  SSL_DEBUG_RET( 1, "ssl_renegotiate", ret );
3769  return( ret );
3770  }
3771 
3772  return( POLARSSL_ERR_NET_WANT_READ );
3773  }
3774  }
3775  else if( ssl->in_msgtype != SSL_MSG_APPLICATION_DATA )
3776  {
3777  SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
3779  }
3780 
3781  ssl->in_offt = ssl->in_msg;
3782  }
3783 
3784  n = ( len < ssl->in_msglen )
3785  ? len : ssl->in_msglen;
3786 
3787  memcpy( buf, ssl->in_offt, n );
3788  ssl->in_msglen -= n;
3789 
3790  if( ssl->in_msglen == 0 )
3791  /* all bytes consumed */
3792  ssl->in_offt = NULL;
3793  else
3794  /* more data available */
3795  ssl->in_offt += n;
3796 
3797  SSL_DEBUG_MSG( 2, ( "<= read" ) );
3798 
3799  return( (int) n );
3800 }
3801 
3802 /*
3803  * Send application data to be encrypted by the SSL layer
3804  */
3805 int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len )
3806 {
3807  int ret;
3808  size_t n;
3809 
3810  SSL_DEBUG_MSG( 2, ( "=> write" ) );
3811 
3812  if( ssl->state != SSL_HANDSHAKE_OVER )
3813  {
3814  if( ( ret = ssl_handshake( ssl ) ) != 0 )
3815  {
3816  SSL_DEBUG_RET( 1, "ssl_handshake", ret );
3817  return( ret );
3818  }
3819  }
3820 
3821  n = ( len < SSL_MAX_CONTENT_LEN )
3822  ? len : SSL_MAX_CONTENT_LEN;
3823 
3824  if( ssl->out_left != 0 )
3825  {
3826  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
3827  {
3828  SSL_DEBUG_RET( 1, "ssl_flush_output", ret );
3829  return( ret );
3830  }
3831  }
3832  else
3833  {
3834  ssl->out_msglen = n;
3836  memcpy( ssl->out_msg, buf, n );
3837 
3838  if( ( ret = ssl_write_record( ssl ) ) != 0 )
3839  {
3840  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
3841  return( ret );
3842  }
3843  }
3844 
3845  SSL_DEBUG_MSG( 2, ( "<= write" ) );
3846 
3847  return( (int) n );
3848 }
3849 
3850 /*
3851  * Notify the peer that the connection is being closed
3852  */
3853 int ssl_close_notify( ssl_context *ssl )
3854 {
3855  int ret;
3856 
3857  SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
3858 
3859  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
3860  {
3861  SSL_DEBUG_RET( 1, "ssl_flush_output", ret );
3862  return( ret );
3863  }
3864 
3865  if( ssl->state == SSL_HANDSHAKE_OVER )
3866  {
3867  if( ( ret = ssl_send_alert_message( ssl,
3869  SSL_ALERT_MSG_CLOSE_NOTIFY ) ) != 0 )
3870  {
3871  return( ret );
3872  }
3873  }
3874 
3875  SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
3876 
3877  return( ret );
3878 }
3879 
3880 void ssl_transform_free( ssl_transform *transform )
3881 {
3882 #if defined(POLARSSL_ZLIB_SUPPORT)
3883  deflateEnd( &transform->ctx_deflate );
3884  inflateEnd( &transform->ctx_inflate );
3885 #endif
3886 
3887  memset( transform, 0, sizeof( ssl_transform ) );
3888 }
3889 
3890 void ssl_handshake_free( ssl_handshake_params *handshake )
3891 {
3892 #if defined(POLARSSL_DHM_C)
3893  dhm_free( &handshake->dhm_ctx );
3894 #endif
3895  memset( handshake, 0, sizeof( ssl_handshake_params ) );
3896 }
3897 
3898 void ssl_session_free( ssl_session *session )
3899 {
3900  if( session->peer_cert != NULL )
3901  {
3902  x509_free( session->peer_cert );
3903  free( session->peer_cert );
3904  }
3905 
3906  memset( session, 0, sizeof( ssl_session ) );
3907 }
3908 
3909 /*
3910  * Free an SSL context
3911  */
3912 void ssl_free( ssl_context *ssl )
3913 {
3914  SSL_DEBUG_MSG( 2, ( "=> free" ) );
3915 
3916  free( ssl->ciphersuites );
3917 
3918  if( ssl->out_ctr != NULL )
3919  {
3920  memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
3921  free( ssl->out_ctr );
3922  }
3923 
3924  if( ssl->in_ctr != NULL )
3925  {
3926  memset( ssl->in_ctr, 0, SSL_BUFFER_LEN );
3927  free( ssl->in_ctr );
3928  }
3929 
3930 #if defined(POLARSSL_DHM_C)
3931  mpi_free( &ssl->dhm_P );
3932  mpi_free( &ssl->dhm_G );
3933 #endif
3934 
3935  if( ssl->transform )
3936  {
3937  ssl_transform_free( ssl->transform );
3938  free( ssl->transform );
3939  }
3940 
3941  if( ssl->handshake )
3942  {
3943  ssl_handshake_free( ssl->handshake );
3946 
3947  free( ssl->handshake );
3948  free( ssl->transform_negotiate );
3949  free( ssl->session_negotiate );
3950  }
3951 
3952  if( ssl->session )
3953  {
3954  ssl_session_free( ssl->session );
3955  free( ssl->session );
3956  }
3957 
3958  if ( ssl->hostname != NULL)
3959  {
3960  memset( ssl->hostname, 0, ssl->hostname_len );
3961  free( ssl->hostname );
3962  ssl->hostname_len = 0;
3963  }
3964 
3965 #if defined(POLARSSL_SSL_HW_RECORD_ACCEL)
3966  if( ssl_hw_record_finish != NULL )
3967  {
3968  SSL_DEBUG_MSG( 2, ( "going for ssl_hw_record_finish()" ) );
3969  ssl_hw_record_finish( ssl );
3970  }
3971 #endif
3972 
3973  SSL_DEBUG_MSG( 2, ( "<= free" ) );
3974 
3975  /* Actually clear after last debug message */
3976  memset( ssl, 0, sizeof( ssl_context ) );
3977 }
3978 
3979 #endif