PolarSSL v1.1.5
ssl_tls.c
Go to the documentation of this file.
1 /*
2  * SSLv3/TLSv1 shared functions
3  *
4  * Copyright (C) 2006-2010, Brainspark B.V.
5  *
6  * This file is part of PolarSSL (http://www.polarssl.org)
7  * Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
8  *
9  * All rights reserved.
10  *
11  * This program is free software; you can redistribute it and/or modify
12  * it under the terms of the GNU General Public License as published by
13  * the Free Software Foundation; either version 2 of the License, or
14  * (at your option) any later version.
15  *
16  * This program is distributed in the hope that it will be useful,
17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19  * GNU General Public License for more details.
20  *
21  * You should have received a copy of the GNU General Public License along
22  * with this program; if not, write to the Free Software Foundation, Inc.,
23  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
24  */
25 /*
26  * The SSL 3.0 specification was drafted by Netscape in 1996,
27  * and became an IETF standard in 1999.
28  *
29  * http://wp.netscape.com/eng/ssl3/
30  * http://www.ietf.org/rfc/rfc2246.txt
31  * http://www.ietf.org/rfc/rfc4346.txt
32  */
33 
34 #include "polarssl/config.h"
35 
36 #if defined(POLARSSL_SSL_TLS_C)
37 
38 #include "polarssl/aes.h"
39 #include "polarssl/arc4.h"
40 #include "polarssl/camellia.h"
41 #include "polarssl/des.h"
42 #include "polarssl/debug.h"
43 #include "polarssl/ssl.h"
44 
45 #include <stdlib.h>
46 #include <time.h>
47 
48 #if defined _MSC_VER && !defined strcasecmp
49 #define strcasecmp _stricmp
50 #endif
51 
52 /*
53  * Key material generation
54  */
55 static int tls1_prf( unsigned char *secret, size_t slen, char *label,
56  unsigned char *random, size_t rlen,
57  unsigned char *dstbuf, size_t dlen )
58 {
59  size_t nb, hs;
60  size_t i, j, k;
61  unsigned char *S1, *S2;
62  unsigned char tmp[128];
63  unsigned char h_i[20];
64 
65  if( sizeof( tmp ) < 20 + strlen( label ) + rlen )
67 
68  hs = ( slen + 1 ) / 2;
69  S1 = secret;
70  S2 = secret + slen - hs;
71 
72  nb = strlen( label );
73  memcpy( tmp + 20, label, nb );
74  memcpy( tmp + 20 + nb, random, rlen );
75  nb += rlen;
76 
77  /*
78  * First compute P_md5(secret,label+random)[0..dlen]
79  */
80  md5_hmac( S1, hs, tmp + 20, nb, 4 + tmp );
81 
82  for( i = 0; i < dlen; i += 16 )
83  {
84  md5_hmac( S1, hs, 4 + tmp, 16 + nb, h_i );
85  md5_hmac( S1, hs, 4 + tmp, 16, 4 + tmp );
86 
87  k = ( i + 16 > dlen ) ? dlen % 16 : 16;
88 
89  for( j = 0; j < k; j++ )
90  dstbuf[i + j] = h_i[j];
91  }
92 
93  /*
94  * XOR out with P_sha1(secret,label+random)[0..dlen]
95  */
96  sha1_hmac( S2, hs, tmp + 20, nb, tmp );
97 
98  for( i = 0; i < dlen; i += 20 )
99  {
100  sha1_hmac( S2, hs, tmp, 20 + nb, h_i );
101  sha1_hmac( S2, hs, tmp, 20, tmp );
102 
103  k = ( i + 20 > dlen ) ? dlen % 20 : 20;
104 
105  for( j = 0; j < k; j++ )
106  dstbuf[i + j] = (unsigned char)( dstbuf[i + j] ^ h_i[j] );
107  }
108 
109  memset( tmp, 0, sizeof( tmp ) );
110  memset( h_i, 0, sizeof( h_i ) );
111 
112  return( 0 );
113 }
114 
115 int ssl_derive_keys( ssl_context *ssl )
116 {
117  int i;
120  unsigned char tmp[64];
121  unsigned char padding[16];
122  unsigned char sha1sum[20];
123  unsigned char keyblk[256];
124  unsigned char *key1;
125  unsigned char *key2;
126 
127  SSL_DEBUG_MSG( 2, ( "=> derive keys" ) );
128 
129  /*
130  * SSLv3:
131  * master =
132  * MD5( premaster + SHA1( 'A' + premaster + randbytes ) ) +
133  * MD5( premaster + SHA1( 'BB' + premaster + randbytes ) ) +
134  * MD5( premaster + SHA1( 'CCC' + premaster + randbytes ) )
135  *
136  * TLSv1:
137  * master = PRF( premaster, "master secret", randbytes )[0..47]
138  */
139  if( ssl->resume == 0 )
140  {
141  size_t len = ssl->pmslen;
142 
143  SSL_DEBUG_BUF( 3, "premaster secret", ssl->premaster, len );
144 
145  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
146  {
147  for( i = 0; i < 3; i++ )
148  {
149  memset( padding, 'A' + i, 1 + i );
150 
151  sha1_starts( &sha1 );
152  sha1_update( &sha1, padding, 1 + i );
153  sha1_update( &sha1, ssl->premaster, len );
154  sha1_update( &sha1, ssl->randbytes, 64 );
155  sha1_finish( &sha1, sha1sum );
156 
157  md5_starts( &md5 );
158  md5_update( &md5, ssl->premaster, len );
159  md5_update( &md5, sha1sum, 20 );
160  md5_finish( &md5, ssl->session->master + i * 16 );
161  }
162  }
163  else
164  tls1_prf( ssl->premaster, len, "master secret",
165  ssl->randbytes, 64, ssl->session->master, 48 );
166 
167  memset( ssl->premaster, 0, sizeof( ssl->premaster ) );
168  }
169  else
170  SSL_DEBUG_MSG( 3, ( "no premaster (session resumed)" ) );
171 
172  /*
173  * Swap the client and server random values.
174  */
175  memcpy( tmp, ssl->randbytes, 64 );
176  memcpy( ssl->randbytes, tmp + 32, 32 );
177  memcpy( ssl->randbytes + 32, tmp, 32 );
178  memset( tmp, 0, sizeof( tmp ) );
179 
180  /*
181  * SSLv3:
182  * key block =
183  * MD5( master + SHA1( 'A' + master + randbytes ) ) +
184  * MD5( master + SHA1( 'BB' + master + randbytes ) ) +
185  * MD5( master + SHA1( 'CCC' + master + randbytes ) ) +
186  * MD5( master + SHA1( 'DDDD' + master + randbytes ) ) +
187  * ...
188  *
189  * TLSv1:
190  * key block = PRF( master, "key expansion", randbytes )
191  */
192  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
193  {
194  for( i = 0; i < 16; i++ )
195  {
196  memset( padding, 'A' + i, 1 + i );
197 
198  sha1_starts( &sha1 );
199  sha1_update( &sha1, padding, 1 + i );
200  sha1_update( &sha1, ssl->session->master, 48 );
201  sha1_update( &sha1, ssl->randbytes, 64 );
202  sha1_finish( &sha1, sha1sum );
203 
204  md5_starts( &md5 );
205  md5_update( &md5, ssl->session->master, 48 );
206  md5_update( &md5, sha1sum, 20 );
207  md5_finish( &md5, keyblk + i * 16 );
208  }
209 
210  memset( &md5, 0, sizeof( md5 ) );
211  memset( &sha1, 0, sizeof( sha1 ) );
212 
213  memset( padding, 0, sizeof( padding ) );
214  memset( sha1sum, 0, sizeof( sha1sum ) );
215  }
216  else
217  tls1_prf( ssl->session->master, 48, "key expansion",
218  ssl->randbytes, 64, keyblk, 256 );
219 
220  SSL_DEBUG_MSG( 3, ( "ciphersuite = %s", ssl_get_ciphersuite( ssl ) ) );
221  SSL_DEBUG_BUF( 3, "master secret", ssl->session->master, 48 );
222  SSL_DEBUG_BUF( 4, "random bytes", ssl->randbytes, 64 );
223  SSL_DEBUG_BUF( 4, "key block", keyblk, 256 );
224 
225  memset( ssl->randbytes, 0, sizeof( ssl->randbytes ) );
226 
227  /*
228  * Determine the appropriate key, IV and MAC length.
229  */
230  switch( ssl->session->ciphersuite )
231  {
232 #if defined(POLARSSL_ARC4_C)
233  case SSL_RSA_RC4_128_MD5:
234  ssl->keylen = 16; ssl->minlen = 16;
235  ssl->ivlen = 0; ssl->maclen = 16;
236  break;
237 
238  case SSL_RSA_RC4_128_SHA:
239  ssl->keylen = 16; ssl->minlen = 20;
240  ssl->ivlen = 0; ssl->maclen = 20;
241  break;
242 #endif
243 
244 #if defined(POLARSSL_DES_C)
245  case SSL_RSA_DES_168_SHA:
247  ssl->keylen = 24; ssl->minlen = 24;
248  ssl->ivlen = 8; ssl->maclen = 20;
249  break;
250 #endif
251 
252 #if defined(POLARSSL_AES_C)
253  case SSL_RSA_AES_128_SHA:
255  ssl->keylen = 16; ssl->minlen = 32;
256  ssl->ivlen = 16; ssl->maclen = 20;
257  break;
258 
259  case SSL_RSA_AES_256_SHA:
261  ssl->keylen = 32; ssl->minlen = 32;
262  ssl->ivlen = 16; ssl->maclen = 20;
263  break;
264 #endif
265 
266 #if defined(POLARSSL_CAMELLIA_C)
269  ssl->keylen = 16; ssl->minlen = 32;
270  ssl->ivlen = 16; ssl->maclen = 20;
271  break;
272 
275  ssl->keylen = 32; ssl->minlen = 32;
276  ssl->ivlen = 16; ssl->maclen = 20;
277  break;
278 #endif
279 
280  default:
281  SSL_DEBUG_MSG( 1, ( "ciphersuite %s is not available",
282  ssl_get_ciphersuite( ssl ) ) );
284  }
285 
286  SSL_DEBUG_MSG( 3, ( "keylen: %d, minlen: %d, ivlen: %d, maclen: %d",
287  ssl->keylen, ssl->minlen, ssl->ivlen, ssl->maclen ) );
288 
289  /*
290  * Finally setup the cipher contexts, IVs and MAC secrets.
291  */
292  if( ssl->endpoint == SSL_IS_CLIENT )
293  {
294  key1 = keyblk + ssl->maclen * 2;
295  key2 = keyblk + ssl->maclen * 2 + ssl->keylen;
296 
297  memcpy( ssl->mac_enc, keyblk, ssl->maclen );
298  memcpy( ssl->mac_dec, keyblk + ssl->maclen, ssl->maclen );
299 
300  /*
301  * This is not used in TLS v1.1.
302  */
303  memcpy( ssl->iv_enc, key2 + ssl->keylen, ssl->ivlen );
304  memcpy( ssl->iv_dec, key2 + ssl->keylen + ssl->ivlen,
305  ssl->ivlen );
306  }
307  else
308  {
309  key1 = keyblk + ssl->maclen * 2 + ssl->keylen;
310  key2 = keyblk + ssl->maclen * 2;
311 
312  memcpy( ssl->mac_dec, keyblk, ssl->maclen );
313  memcpy( ssl->mac_enc, keyblk + ssl->maclen, ssl->maclen );
314 
315  /*
316  * This is not used in TLS v1.1.
317  */
318  memcpy( ssl->iv_dec, key1 + ssl->keylen, ssl->ivlen );
319  memcpy( ssl->iv_enc, key1 + ssl->keylen + ssl->ivlen,
320  ssl->ivlen );
321  }
322 
323  switch( ssl->session->ciphersuite )
324  {
325 #if defined(POLARSSL_ARC4_C)
326  case SSL_RSA_RC4_128_MD5:
327  case SSL_RSA_RC4_128_SHA:
328  arc4_setup( (arc4_context *) ssl->ctx_enc, key1, ssl->keylen );
329  arc4_setup( (arc4_context *) ssl->ctx_dec, key2, ssl->keylen );
330  break;
331 #endif
332 
333 #if defined(POLARSSL_DES_C)
334  case SSL_RSA_DES_168_SHA:
336  des3_set3key_enc( (des3_context *) ssl->ctx_enc, key1 );
337  des3_set3key_dec( (des3_context *) ssl->ctx_dec, key2 );
338  break;
339 #endif
340 
341 #if defined(POLARSSL_AES_C)
342  case SSL_RSA_AES_128_SHA:
344  aes_setkey_enc( (aes_context *) ssl->ctx_enc, key1, 128 );
345  aes_setkey_dec( (aes_context *) ssl->ctx_dec, key2, 128 );
346  break;
347 
348  case SSL_RSA_AES_256_SHA:
350  aes_setkey_enc( (aes_context *) ssl->ctx_enc, key1, 256 );
351  aes_setkey_dec( (aes_context *) ssl->ctx_dec, key2, 256 );
352  break;
353 #endif
354 
355 #if defined(POLARSSL_CAMELLIA_C)
358  camellia_setkey_enc( (camellia_context *) ssl->ctx_enc, key1, 128 );
359  camellia_setkey_dec( (camellia_context *) ssl->ctx_dec, key2, 128 );
360  break;
361 
364  camellia_setkey_enc( (camellia_context *) ssl->ctx_enc, key1, 256 );
365  camellia_setkey_dec( (camellia_context *) ssl->ctx_dec, key2, 256 );
366  break;
367 #endif
368 
369  default:
371  }
372 
373  memset( keyblk, 0, sizeof( keyblk ) );
374 
375  SSL_DEBUG_MSG( 2, ( "<= derive keys" ) );
376 
377  return( 0 );
378 }
379 
380 void ssl_calc_verify( ssl_context *ssl, unsigned char hash[36] )
381 {
384  unsigned char pad_1[48];
385  unsigned char pad_2[48];
386 
387  SSL_DEBUG_MSG( 2, ( "=> calc verify" ) );
388 
389  memcpy( &md5 , &ssl->fin_md5 , sizeof( md5_context ) );
390  memcpy( &sha1, &ssl->fin_sha1, sizeof( sha1_context ) );
391 
392  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
393  {
394  memset( pad_1, 0x36, 48 );
395  memset( pad_2, 0x5C, 48 );
396 
397  md5_update( &md5, ssl->session->master, 48 );
398  md5_update( &md5, pad_1, 48 );
399  md5_finish( &md5, hash );
400 
401  md5_starts( &md5 );
402  md5_update( &md5, ssl->session->master, 48 );
403  md5_update( &md5, pad_2, 48 );
404  md5_update( &md5, hash, 16 );
405  md5_finish( &md5, hash );
406 
407  sha1_update( &sha1, ssl->session->master, 48 );
408  sha1_update( &sha1, pad_1, 40 );
409  sha1_finish( &sha1, hash + 16 );
410 
411  sha1_starts( &sha1 );
412  sha1_update( &sha1, ssl->session->master, 48 );
413  sha1_update( &sha1, pad_2, 40 );
414  sha1_update( &sha1, hash + 16, 20 );
415  sha1_finish( &sha1, hash + 16 );
416  }
417  else /* TLSv1 */
418  {
419  md5_finish( &md5, hash );
420  sha1_finish( &sha1, hash + 16 );
421  }
422 
423  SSL_DEBUG_BUF( 3, "calculated verify result", hash, 36 );
424  SSL_DEBUG_MSG( 2, ( "<= calc verify" ) );
425 
426  return;
427 }
428 
429 /*
430  * SSLv3.0 MAC functions
431  */
432 static void ssl_mac_md5( unsigned char *secret,
433  unsigned char *buf, size_t len,
434  unsigned char *ctr, int type )
435 {
436  unsigned char header[11];
437  unsigned char padding[48];
439 
440  memcpy( header, ctr, 8 );
441  header[ 8] = (unsigned char) type;
442  header[ 9] = (unsigned char)( len >> 8 );
443  header[10] = (unsigned char)( len );
444 
445  memset( padding, 0x36, 48 );
446  md5_starts( &md5 );
447  md5_update( &md5, secret, 16 );
448  md5_update( &md5, padding, 48 );
449  md5_update( &md5, header, 11 );
450  md5_update( &md5, buf, len );
451  md5_finish( &md5, buf + len );
452 
453  memset( padding, 0x5C, 48 );
454  md5_starts( &md5 );
455  md5_update( &md5, secret, 16 );
456  md5_update( &md5, padding, 48 );
457  md5_update( &md5, buf + len, 16 );
458  md5_finish( &md5, buf + len );
459 }
460 
461 static void ssl_mac_sha1( unsigned char *secret,
462  unsigned char *buf, size_t len,
463  unsigned char *ctr, int type )
464 {
465  unsigned char header[11];
466  unsigned char padding[40];
468 
469  memcpy( header, ctr, 8 );
470  header[ 8] = (unsigned char) type;
471  header[ 9] = (unsigned char)( len >> 8 );
472  header[10] = (unsigned char)( len );
473 
474  memset( padding, 0x36, 40 );
475  sha1_starts( &sha1 );
476  sha1_update( &sha1, secret, 20 );
477  sha1_update( &sha1, padding, 40 );
478  sha1_update( &sha1, header, 11 );
479  sha1_update( &sha1, buf, len );
480  sha1_finish( &sha1, buf + len );
481 
482  memset( padding, 0x5C, 40 );
483  sha1_starts( &sha1 );
484  sha1_update( &sha1, secret, 20 );
485  sha1_update( &sha1, padding, 40 );
486  sha1_update( &sha1, buf + len, 20 );
487  sha1_finish( &sha1, buf + len );
488 }
489 
490 /*
491  * Encryption/decryption functions
492  */
493 static int ssl_encrypt_buf( ssl_context *ssl )
494 {
495  size_t i, padlen;
496 
497  SSL_DEBUG_MSG( 2, ( "=> encrypt buf" ) );
498 
499  /*
500  * Add MAC then encrypt
501  */
502  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
503  {
504  if( ssl->maclen == 16 )
505  ssl_mac_md5( ssl->mac_enc,
506  ssl->out_msg, ssl->out_msglen,
507  ssl->out_ctr, ssl->out_msgtype );
508 
509  if( ssl->maclen == 20 )
510  ssl_mac_sha1( ssl->mac_enc,
511  ssl->out_msg, ssl->out_msglen,
512  ssl->out_ctr, ssl->out_msgtype );
513  }
514  else
515  {
516  if( ssl->maclen == 16 )
517  md5_hmac( ssl->mac_enc, 16,
518  ssl->out_ctr, ssl->out_msglen + 13,
519  ssl->out_msg + ssl->out_msglen );
520 
521  if( ssl->maclen == 20 )
522  sha1_hmac( ssl->mac_enc, 20,
523  ssl->out_ctr, ssl->out_msglen + 13,
524  ssl->out_msg + ssl->out_msglen );
525  }
526 
527  SSL_DEBUG_BUF( 4, "computed mac",
528  ssl->out_msg + ssl->out_msglen, ssl->maclen );
529 
530  ssl->out_msglen += ssl->maclen;
531 
532  for( i = 8; i > 0; i-- )
533  if( ++ssl->out_ctr[i - 1] != 0 )
534  break;
535 
536  if( ssl->ivlen == 0 )
537  {
538 #if defined(POLARSSL_ARC4_C)
539  padlen = 0;
540 
541  SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
542  "including %d bytes of padding",
543  ssl->out_msglen, 0 ) );
544 
545  SSL_DEBUG_BUF( 4, "before encrypt: output payload",
546  ssl->out_msg, ssl->out_msglen );
547 
548  arc4_crypt( (arc4_context *) ssl->ctx_enc,
549  ssl->out_msglen, ssl->out_msg,
550  ssl->out_msg );
551 #else
553 #endif
554  }
555  else
556  {
557  unsigned char *enc_msg;
558  size_t enc_msglen;
559 
560  padlen = ssl->ivlen - ( ssl->out_msglen + 1 ) % ssl->ivlen;
561  if( padlen == ssl->ivlen )
562  padlen = 0;
563 
564  for( i = 0; i <= padlen; i++ )
565  ssl->out_msg[ssl->out_msglen + i] = (unsigned char) padlen;
566 
567  ssl->out_msglen += padlen + 1;
568 
569  enc_msglen = ssl->out_msglen;
570  enc_msg = ssl->out_msg;
571 
572  /*
573  * Prepend per-record IV for block cipher in TLS v1.1 as per
574  * Method 1 (6.2.3.2. in RFC4346)
575  */
576  if( ssl->minor_ver == SSL_MINOR_VERSION_2 )
577  {
578  /*
579  * Generate IV
580  */
581  int ret = ssl->f_rng( ssl->p_rng, ssl->iv_enc, ssl->ivlen );
582  if( ret != 0 )
583  return( ret );
584 
585  /*
586  * Shift message for ivlen bytes and prepend IV
587  */
588  memmove( ssl->out_msg + ssl->ivlen, ssl->out_msg, ssl->out_msglen );
589  memcpy( ssl->out_msg, ssl->iv_enc, ssl->ivlen );
590 
591  /*
592  * Fix pointer positions and message length with added IV
593  */
594  enc_msg = ssl->out_msg + ssl->ivlen;
595  enc_msglen = ssl->out_msglen;
596  ssl->out_msglen += ssl->ivlen;
597  }
598 
599  SSL_DEBUG_MSG( 3, ( "before encrypt: msglen = %d, "
600  "including %d bytes of IV and %d bytes of padding",
601  ssl->out_msglen, ssl->ivlen, padlen + 1 ) );
602 
603  SSL_DEBUG_BUF( 4, "before encrypt: output payload",
604  ssl->out_msg, ssl->out_msglen );
605 
606  switch( ssl->ivlen )
607  {
608  case 8:
609 #if defined(POLARSSL_DES_C)
611  DES_ENCRYPT, enc_msglen,
612  ssl->iv_enc, enc_msg, enc_msg );
613  break;
614 #endif
615 
616  case 16:
617 #if defined(POLARSSL_AES_C)
618  if ( ssl->session->ciphersuite == SSL_RSA_AES_128_SHA ||
622  {
624  AES_ENCRYPT, enc_msglen,
625  ssl->iv_enc, enc_msg, enc_msg);
626  break;
627  }
628 #endif
629 
630 #if defined(POLARSSL_CAMELLIA_C)
635  {
637  CAMELLIA_ENCRYPT, enc_msglen,
638  ssl->iv_enc, enc_msg, enc_msg );
639  break;
640  }
641 #endif
642 
643  default:
645  }
646  }
647 
648  SSL_DEBUG_MSG( 2, ( "<= encrypt buf" ) );
649 
650  return( 0 );
651 }
652 
653 static int ssl_decrypt_buf( ssl_context *ssl )
654 {
655  size_t i, padlen;
656  unsigned char tmp[20];
657 
658  SSL_DEBUG_MSG( 2, ( "=> decrypt buf" ) );
659 
660  if( ssl->in_msglen < ssl->minlen )
661  {
662  SSL_DEBUG_MSG( 1, ( "in_msglen (%d) < minlen (%d)",
663  ssl->in_msglen, ssl->minlen ) );
665  }
666 
667  if( ssl->ivlen == 0 )
668  {
669 #if defined(POLARSSL_ARC4_C)
670  padlen = 0;
671  arc4_crypt( (arc4_context *) ssl->ctx_dec,
672  ssl->in_msglen, ssl->in_msg,
673  ssl->in_msg );
674 #else
676 #endif
677  }
678  else
679  {
680  unsigned char *dec_msg;
681  unsigned char *dec_msg_result;
682  size_t dec_msglen;
683 
684  /*
685  * Decrypt and check the padding
686  */
687  if( ssl->in_msglen % ssl->ivlen != 0 )
688  {
689  SSL_DEBUG_MSG( 1, ( "msglen (%d) %% ivlen (%d) != 0",
690  ssl->in_msglen, ssl->ivlen ) );
692  }
693 
694  dec_msglen = ssl->in_msglen;
695  dec_msg = ssl->in_msg;
696  dec_msg_result = ssl->in_msg;
697 
698  /*
699  * Initialize for prepended IV for block cipher in TLS v1.1
700  */
701  if( ssl->minor_ver == SSL_MINOR_VERSION_2 )
702  {
703  dec_msg += ssl->ivlen;
704  dec_msglen -= ssl->ivlen;
705  ssl->in_msglen -= ssl->ivlen;
706 
707  for( i = 0; i < ssl->ivlen; i++ )
708  ssl->iv_dec[i] = ssl->in_msg[i];
709  }
710 
711  switch( ssl->ivlen )
712  {
713 #if defined(POLARSSL_DES_C)
714  case 8:
716  DES_DECRYPT, dec_msglen,
717  ssl->iv_dec, dec_msg, dec_msg_result );
718  break;
719 #endif
720 
721  case 16:
722 #if defined(POLARSSL_AES_C)
723  if ( ssl->session->ciphersuite == SSL_RSA_AES_128_SHA ||
727  {
729  AES_DECRYPT, dec_msglen,
730  ssl->iv_dec, dec_msg, dec_msg_result );
731  break;
732  }
733 #endif
734 
735 #if defined(POLARSSL_CAMELLIA_C)
740  {
742  CAMELLIA_DECRYPT, dec_msglen,
743  ssl->iv_dec, dec_msg, dec_msg_result );
744  break;
745  }
746 #endif
747 
748  default:
750  }
751 
752  padlen = 1 + ssl->in_msg[ssl->in_msglen - 1];
753 
754  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
755  {
756  if( padlen > ssl->ivlen )
757  {
758  SSL_DEBUG_MSG( 1, ( "bad padding length: is %d, "
759  "should be no more than %d",
760  padlen, ssl->ivlen ) );
761  padlen = 0;
762  }
763  }
764  else
765  {
766  /*
767  * TLSv1: always check the padding
768  */
769  for( i = 1; i <= padlen; i++ )
770  {
771  if( ssl->in_msg[ssl->in_msglen - i] != padlen - 1 )
772  {
773  SSL_DEBUG_MSG( 1, ( "bad padding byte: should be "
774  "%02x, but is %02x", padlen - 1,
775  ssl->in_msg[ssl->in_msglen - i] ) );
776  padlen = 0;
777  }
778  }
779  }
780  }
781 
782  SSL_DEBUG_BUF( 4, "raw buffer after decryption",
783  ssl->in_msg, ssl->in_msglen );
784 
785  /*
786  * Always compute the MAC (RFC4346, CBCTIME).
787  */
788  if( ssl->in_msglen < ssl->maclen + padlen )
789  {
790  SSL_DEBUG_MSG( 1, ( "msglen (%d) < maclen (%d) + padlen (%d)",
791  ssl->in_msglen, ssl->maclen, padlen ) );
793  }
794 
795  ssl->in_msglen -= ( ssl->maclen + padlen );
796 
797  ssl->in_hdr[3] = (unsigned char)( ssl->in_msglen >> 8 );
798  ssl->in_hdr[4] = (unsigned char)( ssl->in_msglen );
799 
800  memcpy( tmp, ssl->in_msg + ssl->in_msglen, 20 );
801 
802  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
803  {
804  if( ssl->maclen == 16 )
805  ssl_mac_md5( ssl->mac_dec,
806  ssl->in_msg, ssl->in_msglen,
807  ssl->in_ctr, ssl->in_msgtype );
808  else
809  ssl_mac_sha1( ssl->mac_dec,
810  ssl->in_msg, ssl->in_msglen,
811  ssl->in_ctr, ssl->in_msgtype );
812  }
813  else
814  {
815  if( ssl->maclen == 16 )
816  md5_hmac( ssl->mac_dec, 16,
817  ssl->in_ctr, ssl->in_msglen + 13,
818  ssl->in_msg + ssl->in_msglen );
819  else
820  sha1_hmac( ssl->mac_dec, 20,
821  ssl->in_ctr, ssl->in_msglen + 13,
822  ssl->in_msg + ssl->in_msglen );
823  }
824 
825  SSL_DEBUG_BUF( 4, "message mac", tmp, ssl->maclen );
826  SSL_DEBUG_BUF( 4, "computed mac", ssl->in_msg + ssl->in_msglen,
827  ssl->maclen );
828 
829  if( memcmp( tmp, ssl->in_msg + ssl->in_msglen,
830  ssl->maclen ) != 0 )
831  {
832  SSL_DEBUG_MSG( 1, ( "message mac does not match" ) );
834  }
835 
836  /*
837  * Finally check the padding length; bad padding
838  * will produce the same error as an invalid MAC.
839  */
840  if( ssl->ivlen != 0 && padlen == 0 )
842 
843  if( ssl->in_msglen == 0 )
844  {
845  ssl->nb_zero++;
846 
847  /*
848  * Three or more empty messages may be a DoS attack
849  * (excessive CPU consumption).
850  */
851  if( ssl->nb_zero > 3 )
852  {
853  SSL_DEBUG_MSG( 1, ( "received four consecutive empty "
854  "messages, possible DoS attack" ) );
856  }
857  }
858  else
859  ssl->nb_zero = 0;
860 
861  for( i = 8; i > 0; i-- )
862  if( ++ssl->in_ctr[i - 1] != 0 )
863  break;
864 
865  SSL_DEBUG_MSG( 2, ( "<= decrypt buf" ) );
866 
867  return( 0 );
868 }
869 
870 /*
871  * Fill the input message buffer
872  */
873 int ssl_fetch_input( ssl_context *ssl, size_t nb_want )
874 {
875  int ret;
876  size_t len;
877 
878  SSL_DEBUG_MSG( 2, ( "=> fetch input" ) );
879 
880  while( ssl->in_left < nb_want )
881  {
882  len = nb_want - ssl->in_left;
883  ret = ssl->f_recv( ssl->p_recv, ssl->in_hdr + ssl->in_left, len );
884 
885  SSL_DEBUG_MSG( 2, ( "in_left: %d, nb_want: %d",
886  ssl->in_left, nb_want ) );
887  SSL_DEBUG_RET( 2, "ssl->f_recv", ret );
888 
889  if( ret == 0 )
890  return( POLARSSL_ERR_SSL_CONN_EOF );
891 
892  if( ret < 0 )
893  return( ret );
894 
895  ssl->in_left += ret;
896  }
897 
898  SSL_DEBUG_MSG( 2, ( "<= fetch input" ) );
899 
900  return( 0 );
901 }
902 
903 /*
904  * Flush any data not yet written
905  */
906 int ssl_flush_output( ssl_context *ssl )
907 {
908  int ret;
909  unsigned char *buf;
910 
911  SSL_DEBUG_MSG( 2, ( "=> flush output" ) );
912 
913  while( ssl->out_left > 0 )
914  {
915  SSL_DEBUG_MSG( 2, ( "message length: %d, out_left: %d",
916  5 + ssl->out_msglen, ssl->out_left ) );
917 
918  buf = ssl->out_hdr + 5 + ssl->out_msglen - ssl->out_left;
919  ret = ssl->f_send( ssl->p_send, buf, ssl->out_left );
920  SSL_DEBUG_RET( 2, "ssl->f_send", ret );
921 
922  if( ret <= 0 )
923  return( ret );
924 
925  ssl->out_left -= ret;
926  }
927 
928  SSL_DEBUG_MSG( 2, ( "<= flush output" ) );
929 
930  return( 0 );
931 }
932 
933 /*
934  * Record layer functions
935  */
936 int ssl_write_record( ssl_context *ssl )
937 {
938  int ret;
939  size_t len = ssl->out_msglen;
940 
941  SSL_DEBUG_MSG( 2, ( "=> write record" ) );
942 
943  ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
944  ssl->out_hdr[1] = (unsigned char) ssl->major_ver;
945  ssl->out_hdr[2] = (unsigned char) ssl->minor_ver;
946  ssl->out_hdr[3] = (unsigned char)( len >> 8 );
947  ssl->out_hdr[4] = (unsigned char)( len );
948 
949  if( ssl->out_msgtype == SSL_MSG_HANDSHAKE )
950  {
951  ssl->out_msg[1] = (unsigned char)( ( len - 4 ) >> 16 );
952  ssl->out_msg[2] = (unsigned char)( ( len - 4 ) >> 8 );
953  ssl->out_msg[3] = (unsigned char)( ( len - 4 ) );
954 
955  md5_update( &ssl->fin_md5 , ssl->out_msg, len );
956  sha1_update( &ssl->fin_sha1, ssl->out_msg, len );
957  }
958 
959  if( ssl->do_crypt != 0 )
960  {
961  if( ( ret = ssl_encrypt_buf( ssl ) ) != 0 )
962  {
963  SSL_DEBUG_RET( 1, "ssl_encrypt_buf", ret );
964  return( ret );
965  }
966 
967  len = ssl->out_msglen;
968  ssl->out_hdr[3] = (unsigned char)( len >> 8 );
969  ssl->out_hdr[4] = (unsigned char)( len );
970  }
971 
972  ssl->out_left = 5 + ssl->out_msglen;
973 
974  SSL_DEBUG_MSG( 3, ( "output record: msgtype = %d, "
975  "version = [%d:%d], msglen = %d",
976  ssl->out_hdr[0], ssl->out_hdr[1], ssl->out_hdr[2],
977  ( ssl->out_hdr[3] << 8 ) | ssl->out_hdr[4] ) );
978 
979  SSL_DEBUG_BUF( 4, "output record sent to network",
980  ssl->out_hdr, 5 + ssl->out_msglen );
981 
982  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
983  {
984  SSL_DEBUG_RET( 1, "ssl_flush_output", ret );
985  return( ret );
986  }
987 
988  SSL_DEBUG_MSG( 2, ( "<= write record" ) );
989 
990  return( 0 );
991 }
992 
993 int ssl_read_record( ssl_context *ssl )
994 {
995  int ret;
996 
997  SSL_DEBUG_MSG( 2, ( "=> read record" ) );
998 
999  if( ssl->in_hslen != 0 &&
1000  ssl->in_hslen < ssl->in_msglen )
1001  {
1002  /*
1003  * Get next Handshake message in the current record
1004  */
1005  ssl->in_msglen -= ssl->in_hslen;
1006 
1007  memmove( ssl->in_msg, ssl->in_msg + ssl->in_hslen,
1008  ssl->in_msglen );
1009 
1010  ssl->in_hslen = 4;
1011  ssl->in_hslen += ( ssl->in_msg[2] << 8 ) | ssl->in_msg[3];
1012 
1013  SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
1014  " %d, type = %d, hslen = %d",
1015  ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
1016 
1017  if( ssl->in_msglen < 4 || ssl->in_msg[1] != 0 )
1018  {
1019  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
1021  }
1022 
1023  if( ssl->in_msglen < ssl->in_hslen )
1024  {
1025  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
1027  }
1028 
1029  md5_update( &ssl->fin_md5 , ssl->in_msg, ssl->in_hslen );
1030  sha1_update( &ssl->fin_sha1, ssl->in_msg, ssl->in_hslen );
1031 
1032  return( 0 );
1033  }
1034 
1035  ssl->in_hslen = 0;
1036 
1037  /*
1038  * Read the record header and validate it
1039  */
1040  if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
1041  {
1042  SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1043  return( ret );
1044  }
1045 
1046  ssl->in_msgtype = ssl->in_hdr[0];
1047  ssl->in_msglen = ( ssl->in_hdr[3] << 8 ) | ssl->in_hdr[4];
1048 
1049  SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
1050  "version = [%d:%d], msglen = %d",
1051  ssl->in_hdr[0], ssl->in_hdr[1], ssl->in_hdr[2],
1052  ( ssl->in_hdr[3] << 8 ) | ssl->in_hdr[4] ) );
1053 
1054  if( ssl->in_hdr[1] != ssl->major_ver )
1055  {
1056  SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
1058  }
1059 
1060  if( ssl->in_hdr[2] > ssl->max_minor_ver )
1061  {
1062  SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
1064  }
1065 
1066  /*
1067  * Make sure the message length is acceptable
1068  */
1069  if( ssl->do_crypt == 0 )
1070  {
1071  if( ssl->in_msglen < 1 ||
1073  {
1074  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1076  }
1077  }
1078  else
1079  {
1080  if( ssl->in_msglen < ssl->minlen )
1081  {
1082  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1084  }
1085 
1086  if( ssl->minor_ver == SSL_MINOR_VERSION_0 &&
1087  ssl->in_msglen > ssl->minlen + SSL_MAX_CONTENT_LEN )
1088  {
1089  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1091  }
1092 
1093  /*
1094  * TLS encrypted messages can have up to 256 bytes of padding
1095  */
1096  if( ssl->minor_ver == SSL_MINOR_VERSION_1 &&
1097  ssl->in_msglen > ssl->minlen + SSL_MAX_CONTENT_LEN + 256 )
1098  {
1099  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1101  }
1102  }
1103 
1104  /*
1105  * Read and optionally decrypt the message contents
1106  */
1107  if( ( ret = ssl_fetch_input( ssl, 5 + ssl->in_msglen ) ) != 0 )
1108  {
1109  SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
1110  return( ret );
1111  }
1112 
1113  SSL_DEBUG_BUF( 4, "input record from network",
1114  ssl->in_hdr, 5 + ssl->in_msglen );
1115 
1116  if( ssl->do_crypt != 0 )
1117  {
1118  if( ( ret = ssl_decrypt_buf( ssl ) ) != 0 )
1119  {
1120  SSL_DEBUG_RET( 1, "ssl_decrypt_buf", ret );
1121  return( ret );
1122  }
1123 
1124  SSL_DEBUG_BUF( 4, "input payload after decrypt",
1125  ssl->in_msg, ssl->in_msglen );
1126 
1127  if( ssl->in_msglen > SSL_MAX_CONTENT_LEN )
1128  {
1129  SSL_DEBUG_MSG( 1, ( "bad message length" ) );
1131  }
1132  }
1133 
1134  if( ssl->in_msgtype == SSL_MSG_HANDSHAKE )
1135  {
1136  ssl->in_hslen = 4;
1137  ssl->in_hslen += ( ssl->in_msg[2] << 8 ) | ssl->in_msg[3];
1138 
1139  SSL_DEBUG_MSG( 3, ( "handshake message: msglen ="
1140  " %d, type = %d, hslen = %d",
1141  ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
1142 
1143  /*
1144  * Additional checks to validate the handshake header
1145  */
1146  if( ssl->in_msglen < 4 || ssl->in_msg[1] != 0 )
1147  {
1148  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
1150  }
1151 
1152  if( ssl->in_msglen < ssl->in_hslen )
1153  {
1154  SSL_DEBUG_MSG( 1, ( "bad handshake length" ) );
1156  }
1157 
1158  md5_update( &ssl->fin_md5 , ssl->in_msg, ssl->in_hslen );
1159  sha1_update( &ssl->fin_sha1, ssl->in_msg, ssl->in_hslen );
1160  }
1161 
1162  if( ssl->in_msgtype == SSL_MSG_ALERT )
1163  {
1164  SSL_DEBUG_MSG( 2, ( "got an alert message, type: [%d:%d]",
1165  ssl->in_msg[0], ssl->in_msg[1] ) );
1166 
1167  /*
1168  * Ignore non-fatal alerts, except close_notify
1169  */
1170  if( ssl->in_msg[0] == SSL_ALERT_LEVEL_FATAL )
1171  {
1172  SSL_DEBUG_MSG( 1, ( "is a fatal alert message" ) );
1177  return( POLARSSL_ERR_SSL_FATAL_ALERT_MESSAGE - ssl->in_msg[1] );
1178  }
1179 
1180  if( ssl->in_msg[0] == SSL_ALERT_LEVEL_WARNING &&
1181  ssl->in_msg[1] == SSL_ALERT_MSG_CLOSE_NOTIFY )
1182  {
1183  SSL_DEBUG_MSG( 2, ( "is a close notify message" ) );
1185  }
1186  }
1187 
1188  ssl->in_left = 0;
1189 
1190  SSL_DEBUG_MSG( 2, ( "<= read record" ) );
1191 
1192  return( 0 );
1193 }
1194 
1195 /*
1196  * Handshake functions
1197  */
1199 {
1200  int ret;
1201  size_t i, n;
1202  const x509_cert *crt;
1203 
1204  SSL_DEBUG_MSG( 2, ( "=> write certificate" ) );
1205 
1206  if( ssl->endpoint == SSL_IS_CLIENT )
1207  {
1208  if( ssl->client_auth == 0 )
1209  {
1210  SSL_DEBUG_MSG( 2, ( "<= skip write certificate" ) );
1211  ssl->state++;
1212  return( 0 );
1213  }
1214 
1215  /*
1216  * If using SSLv3 and got no cert, send an Alert message
1217  * (otherwise an empty Certificate message will be sent).
1218  */
1219  if( ssl->own_cert == NULL &&
1220  ssl->minor_ver == SSL_MINOR_VERSION_0 )
1221  {
1222  ssl->out_msglen = 2;
1223  ssl->out_msgtype = SSL_MSG_ALERT;
1224  ssl->out_msg[0] = SSL_ALERT_LEVEL_WARNING;
1225  ssl->out_msg[1] = SSL_ALERT_MSG_NO_CERT;
1226 
1227  SSL_DEBUG_MSG( 2, ( "got no certificate to send" ) );
1228  goto write_msg;
1229  }
1230  }
1231  else /* SSL_IS_SERVER */
1232  {
1233  if( ssl->own_cert == NULL )
1234  {
1235  SSL_DEBUG_MSG( 1, ( "got no certificate to send" ) );
1237  }
1238  }
1239 
1240  SSL_DEBUG_CRT( 3, "own certificate", ssl->own_cert );
1241 
1242  /*
1243  * 0 . 0 handshake type
1244  * 1 . 3 handshake length
1245  * 4 . 6 length of all certs
1246  * 7 . 9 length of cert. 1
1247  * 10 . n-1 peer certificate
1248  * n . n+2 length of cert. 2
1249  * n+3 . ... upper level cert, etc.
1250  */
1251  i = 7;
1252  crt = ssl->own_cert;
1253 
1254  while( crt != NULL )
1255  {
1256  n = crt->raw.len;
1257  if( i + 3 + n > SSL_MAX_CONTENT_LEN )
1258  {
1259  SSL_DEBUG_MSG( 1, ( "certificate too large, %d > %d",
1260  i + 3 + n, SSL_MAX_CONTENT_LEN ) );
1262  }
1263 
1264  ssl->out_msg[i ] = (unsigned char)( n >> 16 );
1265  ssl->out_msg[i + 1] = (unsigned char)( n >> 8 );
1266  ssl->out_msg[i + 2] = (unsigned char)( n );
1267 
1268  i += 3; memcpy( ssl->out_msg + i, crt->raw.p, n );
1269  i += n; crt = crt->next;
1270  }
1271 
1272  ssl->out_msg[4] = (unsigned char)( ( i - 7 ) >> 16 );
1273  ssl->out_msg[5] = (unsigned char)( ( i - 7 ) >> 8 );
1274  ssl->out_msg[6] = (unsigned char)( ( i - 7 ) );
1275 
1276  ssl->out_msglen = i;
1278  ssl->out_msg[0] = SSL_HS_CERTIFICATE;
1279 
1280 write_msg:
1281 
1282  ssl->state++;
1283 
1284  if( ( ret = ssl_write_record( ssl ) ) != 0 )
1285  {
1286  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
1287  return( ret );
1288  }
1289 
1290  SSL_DEBUG_MSG( 2, ( "<= write certificate" ) );
1291 
1292  return( 0 );
1293 }
1294 
1296 {
1297  int ret;
1298  size_t i, n;
1299 
1300  SSL_DEBUG_MSG( 2, ( "=> parse certificate" ) );
1301 
1302  if( ssl->endpoint == SSL_IS_SERVER &&
1303  ssl->authmode == SSL_VERIFY_NONE )
1304  {
1306  SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
1307  ssl->state++;
1308  return( 0 );
1309  }
1310 
1311  if( ( ret = ssl_read_record( ssl ) ) != 0 )
1312  {
1313  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
1314  return( ret );
1315  }
1316 
1317  ssl->state++;
1318 
1319  /*
1320  * Check if the client sent an empty certificate
1321  */
1322  if( ssl->endpoint == SSL_IS_SERVER &&
1323  ssl->minor_ver == SSL_MINOR_VERSION_0 )
1324  {
1325  if( ssl->in_msglen == 2 &&
1326  ssl->in_msgtype == SSL_MSG_ALERT &&
1327  ssl->in_msg[0] == SSL_ALERT_LEVEL_WARNING &&
1328  ssl->in_msg[1] == SSL_ALERT_MSG_NO_CERT )
1329  {
1330  SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
1331 
1333  if( ssl->authmode == SSL_VERIFY_OPTIONAL )
1334  return( 0 );
1335  else
1337  }
1338  }
1339 
1340  if( ssl->endpoint == SSL_IS_SERVER &&
1341  ssl->minor_ver != SSL_MINOR_VERSION_0 )
1342  {
1343  if( ssl->in_hslen == 7 &&
1344  ssl->in_msgtype == SSL_MSG_HANDSHAKE &&
1345  ssl->in_msg[0] == SSL_HS_CERTIFICATE &&
1346  memcmp( ssl->in_msg + 4, "\0\0\0", 3 ) == 0 )
1347  {
1348  SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
1349 
1351  if( ssl->authmode == SSL_VERIFY_REQUIRED )
1353  else
1354  return( 0 );
1355  }
1356  }
1357 
1358  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
1359  {
1360  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1362  }
1363 
1364  if( ssl->in_msg[0] != SSL_HS_CERTIFICATE || ssl->in_hslen < 10 )
1365  {
1366  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1368  }
1369 
1370  /*
1371  * Same message structure as in ssl_write_certificate()
1372  */
1373  n = ( ssl->in_msg[5] << 8 ) | ssl->in_msg[6];
1374 
1375  if( ssl->in_msg[4] != 0 || ssl->in_hslen != 7 + n )
1376  {
1377  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1379  }
1380 
1381  if( ( ssl->peer_cert = (x509_cert *) malloc(
1382  sizeof( x509_cert ) ) ) == NULL )
1383  {
1384  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
1385  sizeof( x509_cert ) ) );
1387  }
1388 
1389  memset( ssl->peer_cert, 0, sizeof( x509_cert ) );
1390 
1391  i = 7;
1392 
1393  while( i < ssl->in_hslen )
1394  {
1395  if( ssl->in_msg[i] != 0 )
1396  {
1397  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1399  }
1400 
1401  n = ( (unsigned int) ssl->in_msg[i + 1] << 8 )
1402  | (unsigned int) ssl->in_msg[i + 2];
1403  i += 3;
1404 
1405  if( n < 128 || i + n > ssl->in_hslen )
1406  {
1407  SSL_DEBUG_MSG( 1, ( "bad certificate message" ) );
1409  }
1410 
1411  ret = x509parse_crt( ssl->peer_cert, ssl->in_msg + i, n );
1412  if( ret != 0 )
1413  {
1414  SSL_DEBUG_RET( 1, " x509parse_crt", ret );
1415  return( ret );
1416  }
1417 
1418  i += n;
1419  }
1420 
1421  SSL_DEBUG_CRT( 3, "peer certificate", ssl->peer_cert );
1422 
1423  if( ssl->authmode != SSL_VERIFY_NONE )
1424  {
1425  if( ssl->ca_chain == NULL )
1426  {
1427  SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
1429  }
1430 
1431  ret = x509parse_verify( ssl->peer_cert, ssl->ca_chain, ssl->ca_crl,
1432  ssl->peer_cn, &ssl->verify_result,
1433  ssl->f_vrfy, ssl->p_vrfy );
1434 
1435  if( ret != 0 )
1436  SSL_DEBUG_RET( 1, "x509_verify_cert", ret );
1437 
1438  if( ssl->authmode != SSL_VERIFY_REQUIRED )
1439  ret = 0;
1440  }
1441 
1442  SSL_DEBUG_MSG( 2, ( "<= parse certificate" ) );
1443 
1444  return( ret );
1445 }
1446 
1448 {
1449  int ret;
1450 
1451  SSL_DEBUG_MSG( 2, ( "=> write change cipher spec" ) );
1452 
1454  ssl->out_msglen = 1;
1455  ssl->out_msg[0] = 1;
1456 
1457  ssl->do_crypt = 0;
1458  ssl->state++;
1459 
1460  if( ( ret = ssl_write_record( ssl ) ) != 0 )
1461  {
1462  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
1463  return( ret );
1464  }
1465 
1466  SSL_DEBUG_MSG( 2, ( "<= write change cipher spec" ) );
1467 
1468  return( 0 );
1469 }
1470 
1472 {
1473  int ret;
1474 
1475  SSL_DEBUG_MSG( 2, ( "=> parse change cipher spec" ) );
1476 
1477  ssl->do_crypt = 0;
1478 
1479  if( ( ret = ssl_read_record( ssl ) ) != 0 )
1480  {
1481  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
1482  return( ret );
1483  }
1484 
1486  {
1487  SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
1489  }
1490 
1491  if( ssl->in_msglen != 1 || ssl->in_msg[0] != 1 )
1492  {
1493  SSL_DEBUG_MSG( 1, ( "bad change cipher spec message" ) );
1495  }
1496 
1497  ssl->state++;
1498 
1499  SSL_DEBUG_MSG( 2, ( "<= parse change cipher spec" ) );
1500 
1501  return( 0 );
1502 }
1503 
1504 static void ssl_calc_finished(
1505  ssl_context *ssl, unsigned char *buf, int from,
1506  md5_context *md5, sha1_context *sha1 )
1507 {
1508  int len = 12;
1509  char *sender;
1510  unsigned char padbuf[48];
1511  unsigned char md5sum[16];
1512  unsigned char sha1sum[20];
1513 
1514  SSL_DEBUG_MSG( 2, ( "=> calc finished" ) );
1515 
1516  /*
1517  * SSLv3:
1518  * hash =
1519  * MD5( master + pad2 +
1520  * MD5( handshake + sender + master + pad1 ) )
1521  * + SHA1( master + pad2 +
1522  * SHA1( handshake + sender + master + pad1 ) )
1523  *
1524  * TLSv1:
1525  * hash = PRF( master, finished_label,
1526  * MD5( handshake ) + SHA1( handshake ) )[0..11]
1527  */
1528 
1529  SSL_DEBUG_BUF( 4, "finished md5 state", (unsigned char *)
1530  md5->state, sizeof( md5->state ) );
1531 
1532  SSL_DEBUG_BUF( 4, "finished sha1 state", (unsigned char *)
1533  sha1->state, sizeof( sha1->state ) );
1534 
1535  if( ssl->minor_ver == SSL_MINOR_VERSION_0 )
1536  {
1537  sender = ( from == SSL_IS_CLIENT ) ? (char *) "CLNT"
1538  : (char *) "SRVR";
1539 
1540  memset( padbuf, 0x36, 48 );
1541 
1542  md5_update( md5, (unsigned char *) sender, 4 );
1543  md5_update( md5, ssl->session->master, 48 );
1544  md5_update( md5, padbuf, 48 );
1545  md5_finish( md5, md5sum );
1546 
1547  sha1_update( sha1, (unsigned char *) sender, 4 );
1548  sha1_update( sha1, ssl->session->master, 48 );
1549  sha1_update( sha1, padbuf, 40 );
1550  sha1_finish( sha1, sha1sum );
1551 
1552  memset( padbuf, 0x5C, 48 );
1553 
1554  md5_starts( md5 );
1555  md5_update( md5, ssl->session->master, 48 );
1556  md5_update( md5, padbuf, 48 );
1557  md5_update( md5, md5sum, 16 );
1558  md5_finish( md5, buf );
1559 
1560  sha1_starts( sha1 );
1561  sha1_update( sha1, ssl->session->master, 48 );
1562  sha1_update( sha1, padbuf , 40 );
1563  sha1_update( sha1, sha1sum, 20 );
1564  sha1_finish( sha1, buf + 16 );
1565 
1566  len += 24;
1567  }
1568  else
1569  {
1570  sender = ( from == SSL_IS_CLIENT )
1571  ? (char *) "client finished"
1572  : (char *) "server finished";
1573 
1574  md5_finish( md5, padbuf );
1575  sha1_finish( sha1, padbuf + 16 );
1576 
1577  tls1_prf( ssl->session->master, 48, sender,
1578  padbuf, 36, buf, len );
1579  }
1580 
1581  SSL_DEBUG_BUF( 3, "calc finished result", buf, len );
1582 
1583  memset( md5, 0, sizeof( md5_context ) );
1584  memset( sha1, 0, sizeof( sha1_context ) );
1585 
1586  memset( padbuf, 0, sizeof( padbuf ) );
1587  memset( md5sum, 0, sizeof( md5sum ) );
1588  memset( sha1sum, 0, sizeof( sha1sum ) );
1589 
1590  SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
1591 }
1592 
1593 int ssl_write_finished( ssl_context *ssl )
1594 {
1595  int ret, hash_len;
1596  md5_context md5;
1598 
1599  SSL_DEBUG_MSG( 2, ( "=> write finished" ) );
1600 
1601  memcpy( &md5 , &ssl->fin_md5 , sizeof( md5_context ) );
1602  memcpy( &sha1, &ssl->fin_sha1, sizeof( sha1_context ) );
1603 
1604  ssl_calc_finished( ssl, ssl->out_msg + 4,
1605  ssl->endpoint, &md5, &sha1 );
1606 
1607  hash_len = ( ssl->minor_ver == SSL_MINOR_VERSION_0 ) ? 36 : 12;
1608 
1609  ssl->out_msglen = 4 + hash_len;
1611  ssl->out_msg[0] = SSL_HS_FINISHED;
1612 
1613  /*
1614  * In case of session resuming, invert the client and server
1615  * ChangeCipherSpec messages order.
1616  */
1617  if( ssl->resume != 0 )
1618  {
1619  if( ssl->endpoint == SSL_IS_CLIENT )
1620  ssl->state = SSL_HANDSHAKE_OVER;
1621  else
1623  }
1624  else
1625  ssl->state++;
1626 
1627  ssl->do_crypt = 1;
1628 
1629  if( ( ret = ssl_write_record( ssl ) ) != 0 )
1630  {
1631  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
1632  return( ret );
1633  }
1634 
1635  SSL_DEBUG_MSG( 2, ( "<= write finished" ) );
1636 
1637  return( 0 );
1638 }
1639 
1640 int ssl_parse_finished( ssl_context *ssl )
1641 {
1642  int ret;
1643  unsigned int hash_len;
1644  unsigned char buf[36];
1645  md5_context md5;
1647 
1648  SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
1649 
1650  memcpy( &md5 , &ssl->fin_md5 , sizeof( md5_context ) );
1651  memcpy( &sha1, &ssl->fin_sha1, sizeof( sha1_context ) );
1652 
1653  ssl->do_crypt = 1;
1654 
1655  if( ( ret = ssl_read_record( ssl ) ) != 0 )
1656  {
1657  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
1658  return( ret );
1659  }
1660 
1661  if( ssl->in_msgtype != SSL_MSG_HANDSHAKE )
1662  {
1663  SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
1665  }
1666 
1667  hash_len = ( ssl->minor_ver == SSL_MINOR_VERSION_0 ) ? 36 : 12;
1668 
1669  if( ssl->in_msg[0] != SSL_HS_FINISHED ||
1670  ssl->in_hslen != 4 + hash_len )
1671  {
1672  SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
1674  }
1675 
1676  ssl_calc_finished( ssl, buf, ssl->endpoint ^ 1, &md5, &sha1 );
1677 
1678  if( memcmp( ssl->in_msg + 4, buf, hash_len ) != 0 )
1679  {
1680  SSL_DEBUG_MSG( 1, ( "bad finished message" ) );
1682  }
1683 
1684  if( ssl->resume != 0 )
1685  {
1686  if( ssl->endpoint == SSL_IS_CLIENT )
1688 
1689  if( ssl->endpoint == SSL_IS_SERVER )
1690  ssl->state = SSL_HANDSHAKE_OVER;
1691  }
1692  else
1693  ssl->state++;
1694 
1695  SSL_DEBUG_MSG( 2, ( "<= parse finished" ) );
1696 
1697  return( 0 );
1698 }
1699 
1700 /*
1701  * Initialize an SSL context
1702  */
1703 int ssl_init( ssl_context *ssl )
1704 {
1705  int len = SSL_BUFFER_LEN;
1706 
1707  memset( ssl, 0, sizeof( ssl_context ) );
1708 
1709  ssl->in_ctr = (unsigned char *) malloc( len );
1710  ssl->in_hdr = ssl->in_ctr + 8;
1711  ssl->in_msg = ssl->in_ctr + 13;
1712 
1713  if( ssl->in_ctr == NULL )
1714  {
1715  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
1717  }
1718 
1719  ssl->out_ctr = (unsigned char *) malloc( len );
1720  ssl->out_hdr = ssl->out_ctr + 8;
1721  ssl->out_msg = ssl->out_ctr + 13;
1722 
1723  if( ssl->out_ctr == NULL )
1724  {
1725  SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
1726  free( ssl-> in_ctr );
1728  }
1729 
1730  memset( ssl-> in_ctr, 0, SSL_BUFFER_LEN );
1731  memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
1732 
1733  ssl->hostname = NULL;
1734  ssl->hostname_len = 0;
1735 
1736  md5_starts( &ssl->fin_md5 );
1737  sha1_starts( &ssl->fin_sha1 );
1738 
1739  return( 0 );
1740 }
1741 
1742 /*
1743  * Reset an initialized and used SSL context for re-use while retaining
1744  * all application-set variables, function pointers and data.
1745  */
1746 void ssl_session_reset( ssl_context *ssl )
1747 {
1748  ssl->state = SSL_HELLO_REQUEST;
1749 
1750  ssl->in_offt = NULL;
1751 
1752  ssl->in_msgtype = 0;
1753  ssl->in_msglen = 0;
1754  ssl->in_left = 0;
1755 
1756  ssl->in_hslen = 0;
1757  ssl->nb_zero = 0;
1758 
1759  ssl->out_msgtype = 0;
1760  ssl->out_msglen = 0;
1761  ssl->out_left = 0;
1762 
1763  ssl->do_crypt = 0;
1764  ssl->pmslen = 0;
1765  ssl->keylen = 0;
1766  ssl->minlen = 0;
1767  ssl->ivlen = 0;
1768  ssl->maclen = 0;
1769 
1770  memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
1771  memset( ssl->in_ctr, 0, SSL_BUFFER_LEN );
1772  memset( ssl->randbytes, 0, 64 );
1773  memset( ssl->premaster, 0, 256 );
1774  memset( ssl->iv_enc, 0, 16 );
1775  memset( ssl->iv_dec, 0, 16 );
1776  memset( ssl->mac_enc, 0, 32 );
1777  memset( ssl->mac_dec, 0, 32 );
1778  memset( ssl->ctx_enc, 0, 128 );
1779  memset( ssl->ctx_dec, 0, 128 );
1780 
1781  md5_starts( &ssl->fin_md5 );
1782  sha1_starts( &ssl->fin_sha1 );
1783 }
1784 
1785 /*
1786  * SSL set accessors
1787  */
1788 void ssl_set_endpoint( ssl_context *ssl, int endpoint )
1789 {
1790  ssl->endpoint = endpoint;
1791 }
1792 
1793 void ssl_set_authmode( ssl_context *ssl, int authmode )
1794 {
1795  ssl->authmode = authmode;
1796 }
1797 
1798 void ssl_set_verify( ssl_context *ssl,
1799  int (*f_vrfy)(void *, x509_cert *, int, int),
1800  void *p_vrfy )
1801 {
1802  ssl->f_vrfy = f_vrfy;
1803  ssl->p_vrfy = p_vrfy;
1804 }
1805 
1806 void ssl_set_rng( ssl_context *ssl,
1807  int (*f_rng)(void *, unsigned char *, size_t),
1808  void *p_rng )
1809 {
1810  ssl->f_rng = f_rng;
1811  ssl->p_rng = p_rng;
1812 }
1813 
1814 void ssl_set_dbg( ssl_context *ssl,
1815  void (*f_dbg)(void *, int, const char *),
1816  void *p_dbg )
1817 {
1818  ssl->f_dbg = f_dbg;
1819  ssl->p_dbg = p_dbg;
1820 }
1821 
1822 void ssl_set_bio( ssl_context *ssl,
1823  int (*f_recv)(void *, unsigned char *, size_t), void *p_recv,
1824  int (*f_send)(void *, const unsigned char *, size_t), void *p_send )
1825 {
1826  ssl->f_recv = f_recv;
1827  ssl->f_send = f_send;
1828  ssl->p_recv = p_recv;
1829  ssl->p_send = p_send;
1830 }
1831 
1832 void ssl_set_scb( ssl_context *ssl,
1833  int (*s_get)(ssl_context *),
1834  int (*s_set)(ssl_context *) )
1835 {
1836  ssl->s_get = s_get;
1837  ssl->s_set = s_set;
1838 }
1839 
1840 void ssl_set_session( ssl_context *ssl, int resume, int timeout,
1841  ssl_session *session )
1842 {
1843  ssl->resume = resume;
1844  ssl->timeout = timeout;
1845  ssl->session = session;
1846 }
1847 
1848 void ssl_set_ciphersuites( ssl_context *ssl, int *ciphersuites )
1849 {
1850  ssl->ciphersuites = ciphersuites;
1851 }
1852 
1853 void ssl_set_ca_chain( ssl_context *ssl, x509_cert *ca_chain,
1854  x509_crl *ca_crl, const char *peer_cn )
1855 {
1856  ssl->ca_chain = ca_chain;
1857  ssl->ca_crl = ca_crl;
1858  ssl->peer_cn = peer_cn;
1859 }
1860 
1861 void ssl_set_own_cert( ssl_context *ssl, x509_cert *own_cert,
1862  rsa_context *rsa_key )
1863 {
1864  ssl->own_cert = own_cert;
1865  ssl->rsa_key = rsa_key;
1866 }
1867 
1868 #if defined(POLARSSL_PKCS11_C)
1869 void ssl_set_own_cert_pkcs11( ssl_context *ssl, x509_cert *own_cert,
1870  pkcs11_context *pkcs11_key )
1871 {
1872  ssl->own_cert = own_cert;
1873  ssl->pkcs11_key = pkcs11_key;
1874 }
1875 #endif
1876 
1877 int ssl_set_dh_param( ssl_context *ssl, const char *dhm_P, const char *dhm_G )
1878 {
1879  int ret;
1880 
1881  if( ( ret = mpi_read_string( &ssl->dhm_ctx.P, 16, dhm_P ) ) != 0 )
1882  {
1883  SSL_DEBUG_RET( 1, "mpi_read_string", ret );
1884  return( ret );
1885  }
1886 
1887  if( ( ret = mpi_read_string( &ssl->dhm_ctx.G, 16, dhm_G ) ) != 0 )
1888  {
1889  SSL_DEBUG_RET( 1, "mpi_read_string", ret );
1890  return( ret );
1891  }
1892 
1893  return( 0 );
1894 }
1895 
1896 int ssl_set_dh_param_ctx( ssl_context *ssl, dhm_context *dhm_ctx )
1897 {
1898  int ret;
1899 
1900  if( ( ret = mpi_copy(&ssl->dhm_ctx.P, &dhm_ctx->P) ) != 0 )
1901  {
1902  SSL_DEBUG_RET( 1, "mpi_copy", ret );
1903  return( ret );
1904  }
1905 
1906  if( ( ret = mpi_copy(&ssl->dhm_ctx.G, &dhm_ctx->G) ) != 0 )
1907  {
1908  SSL_DEBUG_RET( 1, "mpi_copy", ret );
1909  return( ret );
1910  }
1911 
1912  return( 0 );
1913 }
1914 
1915 int ssl_set_hostname( ssl_context *ssl, const char *hostname )
1916 {
1917  if( hostname == NULL )
1919 
1920  ssl->hostname_len = strlen( hostname );
1921  ssl->hostname = (unsigned char *) malloc( ssl->hostname_len + 1 );
1922 
1923  if( ssl->hostname == NULL )
1925 
1926  memcpy( ssl->hostname, (unsigned char *) hostname,
1927  ssl->hostname_len );
1928 
1929  ssl->hostname[ssl->hostname_len] = '\0';
1930 
1931  return( 0 );
1932 }
1933 
1934 void ssl_set_max_version( ssl_context *ssl, int major, int minor )
1935 {
1936  ssl->max_major_ver = major;
1937  ssl->max_minor_ver = minor;
1938 }
1939 
1940 /*
1941  * SSL get accessors
1942  */
1943 size_t ssl_get_bytes_avail( const ssl_context *ssl )
1944 {
1945  return( ssl->in_offt == NULL ? 0 : ssl->in_msglen );
1946 }
1947 
1948 int ssl_get_verify_result( const ssl_context *ssl )
1949 {
1950  return( ssl->verify_result );
1951 }
1952 
1953 const char *ssl_get_ciphersuite_name( const int ciphersuite_id )
1954 {
1955  switch( ciphersuite_id )
1956  {
1957 #if defined(POLARSSL_ARC4_C)
1958  case SSL_RSA_RC4_128_MD5:
1959  return( "SSL-RSA-RC4-128-MD5" );
1960 
1961  case SSL_RSA_RC4_128_SHA:
1962  return( "SSL-RSA-RC4-128-SHA" );
1963 #endif
1964 
1965 #if defined(POLARSSL_DES_C)
1966  case SSL_RSA_DES_168_SHA:
1967  return( "SSL-RSA-DES-168-SHA" );
1968 
1970  return( "SSL-EDH-RSA-DES-168-SHA" );
1971 #endif
1972 
1973 #if defined(POLARSSL_AES_C)
1974  case SSL_RSA_AES_128_SHA:
1975  return( "SSL-RSA-AES-128-SHA" );
1976 
1978  return( "SSL-EDH-RSA-AES-128-SHA" );
1979 
1980  case SSL_RSA_AES_256_SHA:
1981  return( "SSL-RSA-AES-256-SHA" );
1982 
1984  return( "SSL-EDH-RSA-AES-256-SHA" );
1985 #endif
1986 
1987 #if defined(POLARSSL_CAMELLIA_C)
1989  return( "SSL-RSA-CAMELLIA-128-SHA" );
1990 
1992  return( "SSL-EDH-RSA-CAMELLIA-128-SHA" );
1993 
1995  return( "SSL-RSA-CAMELLIA-256-SHA" );
1996 
1998  return( "SSL-EDH-RSA-CAMELLIA-256-SHA" );
1999 #endif
2000 
2001  default:
2002  break;
2003  }
2004 
2005  return( "unknown" );
2006 }
2007 
2008 int ssl_get_ciphersuite_id( const char *ciphersuite_name )
2009 {
2010 #if defined(POLARSSL_ARC4_C)
2011  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-RC4-128-MD5"))
2012  return( SSL_RSA_RC4_128_MD5 );
2013  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-RC4-128-SHA"))
2014  return( SSL_RSA_RC4_128_SHA );
2015 #endif
2016 
2017 #if defined(POLARSSL_DES_C)
2018  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-DES-168-SHA"))
2019  return( SSL_RSA_DES_168_SHA );
2020  if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-DES-168-SHA"))
2021  return( SSL_EDH_RSA_DES_168_SHA );
2022 #endif
2023 
2024 #if defined(POLARSSL_AES_C)
2025  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-AES-128-SHA"))
2026  return( SSL_RSA_AES_128_SHA );
2027  if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-AES-128-SHA"))
2028  return( SSL_EDH_RSA_AES_128_SHA );
2029  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-AES-256-SHA"))
2030  return( SSL_RSA_AES_256_SHA );
2031  if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-AES-256-SHA"))
2032  return( SSL_EDH_RSA_AES_256_SHA );
2033 #endif
2034 
2035 #if defined(POLARSSL_CAMELLIA_C)
2036  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-CAMELLIA-128-SHA"))
2037  return( SSL_RSA_CAMELLIA_128_SHA );
2038  if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-CAMELLIA-128-SHA"))
2039  return( SSL_EDH_RSA_CAMELLIA_128_SHA );
2040  if (0 == strcasecmp(ciphersuite_name, "SSL-RSA-CAMELLIA-256-SHA"))
2041  return( SSL_RSA_CAMELLIA_256_SHA );
2042  if (0 == strcasecmp(ciphersuite_name, "SSL-EDH-RSA-CAMELLIA-256-SHA"))
2043  return( SSL_EDH_RSA_CAMELLIA_256_SHA );
2044 #endif
2045 
2046  return( 0 );
2047 }
2048 
2049 const char *ssl_get_ciphersuite( const ssl_context *ssl )
2050 {
2052 }
2053 
2054 const char *ssl_get_version( const ssl_context *ssl )
2055 {
2056  switch( ssl->minor_ver )
2057  {
2058  case SSL_MINOR_VERSION_0:
2059  return( "SSLv3.0" );
2060 
2061  case SSL_MINOR_VERSION_1:
2062  return( "TLSv1.0" );
2063 
2064  case SSL_MINOR_VERSION_2:
2065  return( "TLSv1.1" );
2066 
2067  default:
2068  break;
2069  }
2070  return( "unknown" );
2071 }
2072 
2074 {
2075 #if defined(POLARSSL_DHM_C)
2076 #if defined(POLARSSL_AES_C)
2079 #endif
2080 #if defined(POLARSSL_CAMELLIA_C)
2083 #endif
2084 #if defined(POLARSSL_DES_C)
2086 #endif
2087 #endif
2088 
2089 #if defined(POLARSSL_AES_C)
2091 #endif
2092 #if defined(POLARSSL_CAMELLIA_C)
2094 #endif
2095 #if defined(POLARSSL_AES_C)
2097 #endif
2098 #if defined(POLARSSL_CAMELLIA_C)
2100 #endif
2101 #if defined(POLARSSL_DES_C)
2103 #endif
2104 #if defined(POLARSSL_ARC4_C)
2107 #endif
2108  0
2109 };
2110 
2111 /*
2112  * Perform the SSL handshake
2113  */
2114 int ssl_handshake( ssl_context *ssl )
2115 {
2117 
2118  SSL_DEBUG_MSG( 2, ( "=> handshake" ) );
2119 
2120 #if defined(POLARSSL_SSL_CLI_C)
2121  if( ssl->endpoint == SSL_IS_CLIENT )
2122  ret = ssl_handshake_client( ssl );
2123 #endif
2124 
2125 #if defined(POLARSSL_SSL_SRV_C)
2126  if( ssl->endpoint == SSL_IS_SERVER )
2127  ret = ssl_handshake_server( ssl );
2128 #endif
2129 
2130  SSL_DEBUG_MSG( 2, ( "<= handshake" ) );
2131 
2132  return( ret );
2133 }
2134 
2135 /*
2136  * Receive application data decrypted from the SSL layer
2137  */
2138 int ssl_read( ssl_context *ssl, unsigned char *buf, size_t len )
2139 {
2140  int ret;
2141  size_t n;
2142 
2143  SSL_DEBUG_MSG( 2, ( "=> read" ) );
2144 
2145  if( ssl->state != SSL_HANDSHAKE_OVER )
2146  {
2147  if( ( ret = ssl_handshake( ssl ) ) != 0 )
2148  {
2149  SSL_DEBUG_RET( 1, "ssl_handshake", ret );
2150  return( ret );
2151  }
2152  }
2153 
2154  if( ssl->in_offt == NULL )
2155  {
2156  if( ( ret = ssl_read_record( ssl ) ) != 0 )
2157  {
2158  if( ret == POLARSSL_ERR_SSL_CONN_EOF )
2159  return( 0 );
2160 
2161  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2162  return( ret );
2163  }
2164 
2165  if( ssl->in_msglen == 0 &&
2167  {
2168  /*
2169  * OpenSSL sends empty messages to randomize the IV
2170  */
2171  if( ( ret = ssl_read_record( ssl ) ) != 0 )
2172  {
2173  if( ret == POLARSSL_ERR_SSL_CONN_EOF )
2174  return( 0 );
2175 
2176  SSL_DEBUG_RET( 1, "ssl_read_record", ret );
2177  return( ret );
2178  }
2179  }
2180 
2181  if( ssl->in_msgtype != SSL_MSG_APPLICATION_DATA )
2182  {
2183  SSL_DEBUG_MSG( 1, ( "bad application data message" ) );
2185  }
2186 
2187  ssl->in_offt = ssl->in_msg;
2188  }
2189 
2190  n = ( len < ssl->in_msglen )
2191  ? len : ssl->in_msglen;
2192 
2193  memcpy( buf, ssl->in_offt, n );
2194  ssl->in_msglen -= n;
2195 
2196  if( ssl->in_msglen == 0 )
2197  /* all bytes consumed */
2198  ssl->in_offt = NULL;
2199  else
2200  /* more data available */
2201  ssl->in_offt += n;
2202 
2203  SSL_DEBUG_MSG( 2, ( "<= read" ) );
2204 
2205  return( (int) n );
2206 }
2207 
2208 /*
2209  * Send application data to be encrypted by the SSL layer
2210  */
2211 int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len )
2212 {
2213  int ret;
2214  size_t n;
2215 
2216  SSL_DEBUG_MSG( 2, ( "=> write" ) );
2217 
2218  if( ssl->state != SSL_HANDSHAKE_OVER )
2219  {
2220  if( ( ret = ssl_handshake( ssl ) ) != 0 )
2221  {
2222  SSL_DEBUG_RET( 1, "ssl_handshake", ret );
2223  return( ret );
2224  }
2225  }
2226 
2227  n = ( len < SSL_MAX_CONTENT_LEN )
2228  ? len : SSL_MAX_CONTENT_LEN;
2229 
2230  if( ssl->out_left != 0 )
2231  {
2232  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
2233  {
2234  SSL_DEBUG_RET( 1, "ssl_flush_output", ret );
2235  return( ret );
2236  }
2237  }
2238  else
2239  {
2240  ssl->out_msglen = n;
2242  memcpy( ssl->out_msg, buf, n );
2243 
2244  if( ( ret = ssl_write_record( ssl ) ) != 0 )
2245  {
2246  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2247  return( ret );
2248  }
2249  }
2250 
2251  SSL_DEBUG_MSG( 2, ( "<= write" ) );
2252 
2253  return( (int) n );
2254 }
2255 
2256 /*
2257  * Notify the peer that the connection is being closed
2258  */
2259 int ssl_close_notify( ssl_context *ssl )
2260 {
2261  int ret;
2262 
2263  SSL_DEBUG_MSG( 2, ( "=> write close notify" ) );
2264 
2265  if( ( ret = ssl_flush_output( ssl ) ) != 0 )
2266  {
2267  SSL_DEBUG_RET( 1, "ssl_flush_output", ret );
2268  return( ret );
2269  }
2270 
2271  if( ssl->state == SSL_HANDSHAKE_OVER )
2272  {
2273  ssl->out_msgtype = SSL_MSG_ALERT;
2274  ssl->out_msglen = 2;
2275  ssl->out_msg[0] = SSL_ALERT_LEVEL_WARNING;
2277 
2278  if( ( ret = ssl_write_record( ssl ) ) != 0 )
2279  {
2280  SSL_DEBUG_RET( 1, "ssl_write_record", ret );
2281  return( ret );
2282  }
2283  }
2284 
2285  SSL_DEBUG_MSG( 2, ( "<= write close notify" ) );
2286 
2287  return( ret );
2288 }
2289 
2290 /*
2291  * Free an SSL context
2292  */
2293 void ssl_free( ssl_context *ssl )
2294 {
2295  SSL_DEBUG_MSG( 2, ( "=> free" ) );
2296 
2297  if( ssl->peer_cert != NULL )
2298  {
2299  x509_free( ssl->peer_cert );
2300  memset( ssl->peer_cert, 0, sizeof( x509_cert ) );
2301  free( ssl->peer_cert );
2302  }
2303 
2304  if( ssl->out_ctr != NULL )
2305  {
2306  memset( ssl->out_ctr, 0, SSL_BUFFER_LEN );
2307  free( ssl->out_ctr );
2308  }
2309 
2310  if( ssl->in_ctr != NULL )
2311  {
2312  memset( ssl->in_ctr, 0, SSL_BUFFER_LEN );
2313  free( ssl->in_ctr );
2314  }
2315 
2316 #if defined(POLARSSL_DHM_C)
2317  dhm_free( &ssl->dhm_ctx );
2318 #endif
2319 
2320  if ( ssl->hostname != NULL)
2321  {
2322  memset( ssl->hostname, 0, ssl->hostname_len );
2323  free( ssl->hostname );
2324  ssl->hostname_len = 0;
2325  }
2326 
2327  SSL_DEBUG_MSG( 2, ( "<= free" ) );
2328 
2329  /* Actually free after last debug message */
2330  memset( ssl, 0, sizeof( ssl_context ) );
2331 }
2332 
2333 #endif