2 * Copyright (C) 2000,2001,2002 Nikos Mavroyanopoulos
4 * This file is part of GNUTLS.
6 * The GNUTLS library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
22 #include "gnutls_int.h"
23 #include "gnutls_errors.h"
24 #include "gnutls_dh.h"
26 #include "gnutls_algorithms.h"
27 #include "gnutls_compress.h"
28 #include "gnutls_cipher.h"
29 #include "gnutls_buffers.h"
30 #include "gnutls_kx.h"
31 #include "gnutls_handshake.h"
32 #include "gnutls_num.h"
33 #include "gnutls_hash_int.h"
34 #include "gnutls_db.h"
35 #include "gnutls_extensions.h"
36 #include "gnutls_random.h"
37 #include "gnutls_auth_int.h"
38 #include "gnutls_v2_compat.h"
39 #include "auth_cert.h"
40 #include "gnutls_cert.h"
41 #include "gnutls_constate.h"
42 #include <gnutls_record.h>
43 #include <gnutls_alert.h>
44 #include <gnutls_state.h>
46 #ifdef HANDSHAKE_DEBUG
47 #define ERR(x, y) _gnutls_handshake_log( "HSK: %s (%d)\n", x,y)
55 int _gnutls_server_select_comp_method(GNUTLS_STATE state
,
56 opaque
* data
, int datalen
);
59 /* Clears the handshake hash buffers and handles.
62 void _gnutls_handshake_hash_buffers_clear( GNUTLS_STATE state
) {
63 _gnutls_hash_deinit( state
->gnutls_internals
.handshake_mac_handle_md5
, NULL
);
64 _gnutls_hash_deinit( state
->gnutls_internals
.handshake_mac_handle_sha
, NULL
);
65 state
->gnutls_internals
.handshake_mac_handle_md5
= NULL
;
66 state
->gnutls_internals
.handshake_mac_handle_sha
= NULL
;
67 _gnutls_handshake_buffer_clear( state
);
70 /* this will copy the required values for resuming to
71 * gnutls_internals, and to security_parameters.
72 * this will keep as less data to security_parameters.
74 static void resume_copy_required_values(GNUTLS_STATE state
)
76 /* get the new random values */
77 memcpy(state
->gnutls_internals
.resumed_security_parameters
.
79 state
->security_parameters
.server_random
, TLS_RANDOM_SIZE
);
80 memcpy(state
->gnutls_internals
.resumed_security_parameters
.
82 state
->security_parameters
.client_random
, TLS_RANDOM_SIZE
);
84 /* keep the ciphersuite and compression
85 * That is because the client must see these in our
88 memcpy(state
->security_parameters
.current_cipher_suite
.
90 state
->gnutls_internals
.resumed_security_parameters
.
91 current_cipher_suite
.CipherSuite
, 2);
93 state
->gnutls_internals
.compression_method
= state
->gnutls_internals
.resumed_security_parameters
.read_compression_algorithm
; /* or write_compression_algorithm
97 state
->security_parameters
.entity
=
98 state
->gnutls_internals
.resumed_security_parameters
.entity
;
100 _gnutls_set_current_version( state
, state
->gnutls_internals
.resumed_security_parameters
.version
);
102 state
->security_parameters
.cert_type
=
103 state
->gnutls_internals
.resumed_security_parameters
.cert_type
;
105 memcpy(state
->security_parameters
.session_id
,
106 state
->gnutls_internals
.resumed_security_parameters
.
107 session_id
, sizeof(state
->security_parameters
.session_id
));
108 state
->security_parameters
.session_id_size
=
109 state
->gnutls_internals
.resumed_security_parameters
.
115 void _gnutls_set_server_random(GNUTLS_STATE state
, uint8
* random
)
117 memcpy(state
->security_parameters
.server_random
, random
,
121 void _gnutls_set_client_random(GNUTLS_STATE state
, uint8
* random
)
123 memcpy(state
->security_parameters
.client_random
, random
,
127 /* Calculate The SSL3 Finished message */
128 #define SSL3_CLIENT_MSG "CLNT"
129 #define SSL3_SERVER_MSG "SRVR"
130 #define SSL_MSG_LEN 4
131 static int _gnutls_ssl3_finished(GNUTLS_STATE state
, int type
, opaque
* ret
)
133 const int siz
= SSL_MSG_LEN
;
134 GNUTLS_MAC_HANDLE td_md5
;
135 GNUTLS_MAC_HANDLE td_sha
;
138 td_md5
= _gnutls_hash_copy( state
->gnutls_internals
.handshake_mac_handle_md5
);
139 if (td_md5
== NULL
) {
141 return GNUTLS_E_HASH_FAILED
;
144 td_sha
= _gnutls_hash_copy( state
->gnutls_internals
.handshake_mac_handle_sha
);
145 if (td_sha
== NULL
) {
147 _gnutls_hash_deinit( td_md5
, NULL
);
148 return GNUTLS_E_HASH_FAILED
;
151 if (type
== GNUTLS_SERVER
) {
152 mesg
= SSL3_SERVER_MSG
;
154 mesg
= SSL3_CLIENT_MSG
;
157 _gnutls_hash(td_md5
, mesg
, siz
);
158 _gnutls_hash(td_sha
, mesg
, siz
);
160 _gnutls_mac_deinit_ssl3_handshake(td_md5
, ret
, state
->security_parameters
.master_secret
, TLS_MASTER_SIZE
);
161 _gnutls_mac_deinit_ssl3_handshake(td_sha
, &ret
[16], state
->security_parameters
.master_secret
, TLS_MASTER_SIZE
);
166 /* Hash the handshake messages as required by TLS 1.0 */
167 #define SERVER_MSG "server finished"
168 #define CLIENT_MSG "client finished"
169 #define TLS_MSG_LEN 15
170 int _gnutls_finished(GNUTLS_STATE state
, int type
, void *ret
)
172 const int siz
= TLS_MSG_LEN
;
175 GNUTLS_MAC_HANDLE td_md5
;
176 GNUTLS_MAC_HANDLE td_sha
;
179 td_md5
= _gnutls_hash_copy( state
->gnutls_internals
.handshake_mac_handle_md5
);
180 if (td_md5
== NULL
) {
182 return GNUTLS_E_HASH_FAILED
;
185 td_sha
= _gnutls_hash_copy( state
->gnutls_internals
.handshake_mac_handle_sha
);
186 if (td_sha
== NULL
) {
188 _gnutls_hash_deinit( td_md5
, NULL
);
189 return GNUTLS_E_HASH_FAILED
;
193 _gnutls_hash_deinit(td_md5
, concat
);
194 _gnutls_hash_deinit(td_sha
, &concat
[16]);
196 if (type
== GNUTLS_SERVER
) {
202 return _gnutls_PRF(state
->security_parameters
.master_secret
,
203 TLS_MASTER_SIZE
, mesg
, siz
, concat
, 36,
207 /* this function will produce TLS_RANDOM_SIZE bytes of random data
210 int _gnutls_create_random(opaque
* dst
)
213 opaque rand
[TLS_RANDOM_SIZE
- 4];
216 /* generate server random value */
217 _gnutls_write_uint32(tim
, dst
);
219 if (_gnutls_get_random
220 (rand
, TLS_RANDOM_SIZE
- 4, GNUTLS_STRONG_RANDOM
) < 0) {
222 return GNUTLS_E_MEMORY_ERROR
;
224 memcpy(&dst
[4], rand
, 28);
229 /* Read a client hello
230 * client hello must be a known version client hello
231 * or version 2.0 client hello (only for compatibility
232 * since SSL version 2.0 is not supported).
235 int _gnutls_read_client_hello(GNUTLS_STATE state
, opaque
* data
,
238 uint8 session_id_len
= 0, z
;
242 GNUTLS_Version version
;
244 opaque random
[TLS_RANDOM_SIZE
], *suite_ptr
;
247 if (state
->gnutls_internals
.v2_hello
!= 0) { /* version 2.0 */
248 return _gnutls_read_client_hello_v2(state
, data
, datalen
);
252 _gnutls_handshake_log("HSK: Client's version: %d.%d\n", data
[pos
], data
[pos
+ 1]);
254 version
= _gnutls_version_get(data
[pos
], data
[pos
+ 1]);
255 set_adv_version(state
, data
[pos
], data
[pos
+ 1]);
258 /* if we do not support that version */
259 if (_gnutls_version_is_supported(state
, version
) == 0) {
260 /* If he requested something we do not support
261 * then we send him the lowest we support.
263 ver
= _gnutls_version_lowest(state
);
268 /* he should have send us the highest version
271 if (ver
== GNUTLS_VERSION_UNKNOWN
|| ver
> version
) {
273 return GNUTLS_E_UNSUPPORTED_VERSION_PACKET
;
275 _gnutls_set_current_version(state
, ver
);
277 /* Read client random value.
279 DECR_LEN(len
, TLS_RANDOM_SIZE
);
280 _gnutls_set_client_random(state
, &data
[pos
]);
281 pos
+= TLS_RANDOM_SIZE
;
283 _gnutls_create_random(random
);
284 _gnutls_set_server_random(state
, random
);
286 state
->security_parameters
.timestamp
= time(NULL
);
289 session_id_len
= data
[pos
++];
293 if (session_id_len
> TLS_MAX_SESSION_ID_SIZE
) {
295 return GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
297 DECR_LEN(len
, session_id_len
);
298 ret
= _gnutls_server_restore_session(state
, &data
[pos
], session_id_len
);
299 pos
+= session_id_len
;
301 if (ret
== 0) { /* resumed! */
302 resume_copy_required_values(state
);
304 state
->gnutls_internals
.resumed
= RESUME_TRUE
;
307 _gnutls_generate_session_id(state
->security_parameters
.
309 &state
->security_parameters
.
312 state
->gnutls_internals
.resumed
= RESUME_FALSE
;
315 /* Select a ciphersuite
318 sizeOfSuites
= _gnutls_read_uint16(&data
[pos
]);
321 DECR_LEN(len
, sizeOfSuites
);
322 suite_ptr
= &data
[pos
];
325 /* Select an appropriate compression method
328 z
= data
[pos
++]; /* z is the number of compression methods */
331 ret
= _gnutls_server_select_comp_method(state
, &data
[pos
], z
);
339 /* Parse the extensions (if any)
341 if (ver
>= GNUTLS_TLS1
) {
342 ret
= _gnutls_parse_extensions(state
, &data
[pos
], len
); /* len is the rest of the parsed length */
349 /* select an appropriate cipher suite
351 ret
= _gnutls_server_select_suite(state
, suite_ptr
, sizeOfSuites
);
360 /* here we hash all pending data.
363 _gnutls_handshake_hash_pending( GNUTLS_STATE state
) {
367 if (state
->gnutls_internals
.handshake_mac_handle_sha
==NULL
||
368 state
->gnutls_internals
.handshake_mac_handle_md5
==NULL
) {
370 return GNUTLS_E_INTERNAL_ERROR
;
373 /* We check if there are pending data to hash.
375 if ((ret
=_gnutls_handshake_buffer_get_ptr(state
, &data
, &siz
)) < 0) {
381 _gnutls_hash( state
->gnutls_internals
.handshake_mac_handle_sha
, data
, siz
);
382 _gnutls_hash( state
->gnutls_internals
.handshake_mac_handle_md5
, data
, siz
);
385 _gnutls_handshake_buffer_empty( state
);
391 /* This is to be called after sending CHANGE CIPHER SPEC packet
392 * and initializing encryption. This is the first encrypted message
395 int _gnutls_send_finished(GNUTLS_STATE state
, int again
)
404 /* This needed in order to hash all the required
407 if ((ret
=_gnutls_handshake_hash_pending(state
)) < 0) {
412 if (gnutls_protocol_get_version( state
) == GNUTLS_SSL3
) {
414 _gnutls_ssl3_finished(state
,
419 } else { /* TLS 1.0 */
421 _gnutls_finished(state
,
422 state
->security_parameters
.
434 _gnutls_send_handshake(state
, data
, data_size
,
440 /* This is to be called after sending our finished message. If everything
441 * went fine we have negotiated a secure connection
443 int _gnutls_recv_finished(GNUTLS_STATE state
)
445 uint8 data
[36], *vrfy
;
453 _gnutls_recv_handshake(state
, &vrfy
, &vrfysize
,
454 GNUTLS_FINISHED
, MANDATORY_PACKET
);
456 ERR("recv finished int", ret
);
462 if ( gnutls_protocol_get_version( state
) == GNUTLS_SSL3
) {
468 if (vrfysize
!= data_size
) {
470 return GNUTLS_E_ERROR_IN_FINISHED_PACKET
;
473 if (gnutls_protocol_get_version( state
) == GNUTLS_SSL3
) {
475 _gnutls_ssl3_finished(state
,
476 (state
->security_parameters
.
477 entity
+ 1) % 2, data
);
478 } else { /* TLS 1.0 */
480 _gnutls_finished(state
,
481 (state
->security_parameters
.entity
+
490 if (memcmp(vrfy
, data
, data_size
) != 0) {
492 ret
= GNUTLS_E_ERROR_IN_FINISHED_PACKET
;
499 /* returns PK_RSA if the given cipher suite list only supports,
500 * RSA algorithms, PK_DSA if DSS, and -1 if both or none.
502 int _gnutls_find_pk_algos_in_ciphersuites( opaque
* data
, int datalen
) {
504 PKAlgorithm algo
=-1, prev_algo
= 0;
507 for (j
= 0; j
< datalen
; j
+= 2) {
508 kx
= _gnutls_cipher_suite_get_kx_algo(*((GNUTLS_CipherSuite
*) & data
[j
]));
510 if ( _gnutls_map_kx_get_cred( kx
) == GNUTLS_CRD_CERTIFICATE
) {
511 algo
= _gnutls_map_pk_get_pk( kx
);
513 if (algo
!=prev_algo
&& prev_algo
!=0) return -1;
522 /* This selects the best supported ciphersuite from the ones supported. Then
523 * it adds the suite into the state and performs some checks.
525 int _gnutls_server_select_suite(GNUTLS_STATE state
, opaque
*data
, int datalen
)
528 GNUTLS_CipherSuite
*ciphers
;
530 PKAlgorithm pk_algo
; /* will hold the pk algorithms
531 * supported by the peer.
534 pk_algo
= _gnutls_find_pk_algos_in_ciphersuites( data
, datalen
);
536 x
= _gnutls_supported_ciphersuites(state
, &ciphers
);
540 else return GNUTLS_E_INVALID_REQUEST
;
543 /* Here we remove any ciphersuite that does not conform
544 * the certificate requested, or to the
545 * authentication requested (eg SRP).
547 x
= _gnutls_remove_unwanted_ciphersuites(state
, &ciphers
, x
, pk_algo
);
551 else return GNUTLS_E_INSUFICIENT_CRED
;
554 #ifdef HANDSHAKE_DEBUG
555 _gnutls_handshake_log("HSK: Requested cipher suites: \n");
556 for (j
= 0; j
< datalen
; j
+= 2)
557 _gnutls_handshake_log("\t%s\n",
558 _gnutls_cipher_suite_get_name(*
559 ((GNUTLS_CipherSuite
*) & data
[j
])));
560 _gnutls_handshake_log("HSK: Supported cipher suites: \n");
561 for (j
= 0; j
< x
; j
++)
562 _gnutls_handshake_log("\t%s\n",
563 _gnutls_cipher_suite_get_name(ciphers
[j
]));
565 memset(state
->security_parameters
.current_cipher_suite
.CipherSuite
, '\0', 2);
567 retval
= GNUTLS_E_UNKNOWN_CIPHER_SUITE
;
569 for (j
= 0; j
< datalen
; j
+= 2) {
570 for (i
= 0; i
< x
; i
++) {
571 if (memcmp(ciphers
[i
].CipherSuite
, &data
[j
], 2) ==
573 _gnutls_handshake_log("HSK: Selected cipher suite: ");
574 _gnutls_handshake_log("%s\n",
575 _gnutls_cipher_suite_get_name(*
576 ((GNUTLS_CipherSuite
*) & data
[j
])));
577 memcpy(state
->security_parameters
.current_cipher_suite
.CipherSuite
, ciphers
[i
].CipherSuite
, 2);
585 gnutls_free(ciphers
);
592 /* check if the credentials (username, public key etc. are ok)
594 if (_gnutls_get_kx_cred
596 _gnutls_cipher_suite_get_kx_algo(state
->security_parameters
.
597 current_cipher_suite
),
598 &err
) == NULL
&& err
!= 0) {
600 return GNUTLS_E_INSUFICIENT_CRED
;
604 /* set the MOD_AUTH_STRUCT to the appropriate struct
605 * according to the KX algorithm. This is needed since all the
606 * handshake functions are read from there;
608 state
->gnutls_internals
.auth_struct
=
609 _gnutls_kx_auth_struct(_gnutls_cipher_suite_get_kx_algo
610 (state
->security_parameters
.
611 current_cipher_suite
));
612 if (state
->gnutls_internals
.auth_struct
== NULL
) {
614 _gnutls_handshake_log
615 ("HSK: Cannot find the appropriate handler for the KX algorithm\n");
617 return GNUTLS_E_UNKNOWN_CIPHER_TYPE
;
625 /* This selects the best supported compression method from the ones provided */
626 int _gnutls_server_select_comp_method(GNUTLS_STATE state
, opaque
* data
,
632 x
= _gnutls_supported_compression_methods(state
, &ciphers
);
633 memset( &state
->gnutls_internals
.compression_method
, '\0', sizeof(CompressionMethod
));
635 for (j
= 0; j
< datalen
; j
++) {
636 for (i
= 0; i
< x
; i
++) {
637 if (ciphers
[i
] == data
[j
]) {
638 state
->gnutls_internals
.compression_method
=
639 _gnutls_compression_get_id(ciphers
[i
]);
640 gnutls_free(ciphers
);
642 _gnutls_handshake_log("HSK: Selected Compression Method: %s\n",
643 gnutls_compression_get_name(state
->gnutls_internals
.
644 compression_method
));
652 /* we were not able to find a compatible compression
655 gnutls_free(ciphers
);
657 return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM
;
661 /* This function sends an empty handshake packet. (like hello request).
662 * If the previous _gnutls_send_empty_handshake() returned
663 * GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED, then it must be called again
664 * (until it returns ok), with NULL parameters.
666 int _gnutls_send_empty_handshake(GNUTLS_STATE state
, HandshakeType type
,
677 return _gnutls_send_handshake(state
, ptr
, 0, type
);
681 /* This function will hash the handshake message we sent.
684 int _gnutls_handshake_hash_add_sent( GNUTLS_STATE state
, HandshakeType type
,
685 opaque
* dataptr
, uint32 datalen
) {
688 if ( (ret
=_gnutls_handshake_hash_pending( state
)) < 0) {
693 if ( type
!= GNUTLS_HELLO_REQUEST
) {
694 _gnutls_hash( state
->gnutls_internals
.handshake_mac_handle_sha
, dataptr
, datalen
);
695 _gnutls_hash( state
->gnutls_internals
.handshake_mac_handle_md5
, dataptr
, datalen
);
702 /* This function sends a handshake message of type 'type' containing the
703 * data specified here. If the previous _gnutls_send_handshake() returned
704 * GNUTLS_E_AGAIN or GNUTLS_E_INTERRUPTED, then it must be called again
705 * (until it returns ok), with NULL parameters.
707 int _gnutls_send_handshake(GNUTLS_STATE state
, void *i_data
,
708 uint32 i_datasize
, HandshakeType type
)
715 if (i_data
== NULL
&& i_datasize
== 0) {
716 /* we are resuming a previously interrupted
719 ret
= _gnutls_handshake_io_write_flush(state
);
724 if (i_data
== NULL
&& i_datasize
> 0) {
726 return GNUTLS_E_INVALID_PARAMETERS
;
730 datasize
= i_datasize
+ HANDSHAKE_HEADER_SIZE
;
731 data
= gnutls_alloca(datasize
);
734 return GNUTLS_E_MEMORY_ERROR
;
737 data
[pos
++] = (uint8
) type
;
738 _gnutls_write_uint24(i_datasize
, &data
[pos
]);
742 memcpy(&data
[pos
], i_data
, i_datasize
);
744 _gnutls_handshake_log("HSK: %s was send [%ld bytes]\n",
745 _gnutls_handshake2str(type
), datasize
);
748 /* Here we keep the handshake messages in order to hash them...
750 if ( type
!= GNUTLS_HELLO_REQUEST
)
751 if ( (ret
= _gnutls_handshake_hash_add_sent( state
, type
, data
, datasize
)) < 0) {
758 _gnutls_handshake_io_send_int(state
, GNUTLS_HANDSHAKE
, type
,
766 /* This function will read the handshake header, and return it to the called. If the
767 * received handshake packet is not the one expected then it buffers the header, and
768 * returns UNEXPECTED_HANDSHAKE_PACKET.
770 * FIXME: This function is complex.
772 #define SSL2_HEADERS 1
773 static int _gnutls_recv_handshake_header(GNUTLS_STATE state
,
775 HandshakeType
* recv_type
)
779 uint8
*dataptr
= NULL
; /* for realloc */
780 int handshake_header_size
= HANDSHAKE_HEADER_SIZE
;
782 /* if we have data into the buffer then return them, do not read the next packet.
783 * In order to return we need a full TLS handshake header, or in case of a version 2
784 * packet, then we return the first byte.
786 if (state
->gnutls_internals
.handshake_header_buffer
.header_size
==
787 handshake_header_size
|| (state
->gnutls_internals
.v2_hello
!= 0
788 && type
== GNUTLS_CLIENT_HELLO
789 && state
->gnutls_internals
.
790 handshake_header_buffer
.
791 packet_length
> 0)) {
794 state
->gnutls_internals
.handshake_header_buffer
.
797 return state
->gnutls_internals
.handshake_header_buffer
.
801 /* Note: SSL2_HEADERS == 1 */
803 dataptr
= state
->gnutls_internals
.handshake_header_buffer
.header
;
805 /* If we haven't already read the handshake headers.
807 if (state
->gnutls_internals
.handshake_header_buffer
.header_size
<
810 _gnutls_handshake_io_recv_int(state
, GNUTLS_HANDSHAKE
,
818 GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
821 if (ret
!= SSL2_HEADERS
) {
823 return GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
825 state
->gnutls_internals
.handshake_header_buffer
.
826 header_size
= SSL2_HEADERS
;
829 if (state
->gnutls_internals
.v2_hello
== 0
830 || type
!= GNUTLS_CLIENT_HELLO
) {
832 _gnutls_handshake_io_recv_int(state
, GNUTLS_HANDSHAKE
,
836 handshake_header_buffer
.
838 HANDSHAKE_HEADER_SIZE
-
839 state
->gnutls_internals
.
840 handshake_header_buffer
.
846 GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
849 HANDSHAKE_HEADER_SIZE
-
850 state
->gnutls_internals
.handshake_header_buffer
.
853 return GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
855 *recv_type
= dataptr
[0];
857 /* we do not use DECR_LEN because we know
858 * that the packet has enough data.
860 length32
= _gnutls_read_uint24(&dataptr
[1]);
861 handshake_header_size
= HANDSHAKE_HEADER_SIZE
;
863 _gnutls_handshake_log("HSK: %s was received [%ld bytes]\n",
864 _gnutls_handshake2str(dataptr
[0]),
865 length32
+ HANDSHAKE_HEADER_SIZE
);
867 } else { /* v2 hello */
868 length32
= state
->gnutls_internals
.v2_hello
- SSL2_HEADERS
; /* we've read the first byte */
870 handshake_header_size
= SSL2_HEADERS
; /* we've already read one byte */
872 *recv_type
= dataptr
[0];
874 _gnutls_handshake_log("HSK: %s(v2) was received [%ld bytes]\n",
875 _gnutls_handshake2str(*recv_type
),
876 length32
+ handshake_header_size
);
878 if (*recv_type
!= GNUTLS_CLIENT_HELLO
) { /* it should be one or nothing */
880 return GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET
;
884 /* put the packet into the buffer */
885 state
->gnutls_internals
.handshake_header_buffer
.header_size
=
886 handshake_header_size
;
887 state
->gnutls_internals
.handshake_header_buffer
.packet_length
=
889 state
->gnutls_internals
.handshake_header_buffer
.recv_type
=
892 if (*recv_type
!= type
) {
894 return GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET
;
900 #define _gnutls_handshake_header_buffer_clear( state) state->gnutls_internals.handshake_header_buffer.header_size = 0
904 /* This function will hash the handshake headers and the
908 int _gnutls_handshake_hash_add_recvd( GNUTLS_STATE state
, HandshakeType recv_type
,
909 opaque
* header
, uint16 header_size
, opaque
* dataptr
, uint32 datalen
) {
912 /* The idea here is to hash the previous message we received,
913 * and add the one we just received into the handshake_hash_buffer.
916 if ( (ret
=_gnutls_handshake_hash_pending( state
)) < 0) {
921 /* here we buffer the handshake messages - needed at Finished message */
922 if ( recv_type
!= GNUTLS_HELLO_REQUEST
) {
925 _gnutls_handshake_buffer_put(state
,
926 header
, header_size
)) < 0) {
933 _gnutls_handshake_buffer_put(state
, dataptr
,
945 /* This function will receive handshake messages of the given types,
946 * and will pass the message to the right place in order to be processed.
947 * Eg. for the SERVER_HELLO message (if it is expected), it will be
948 * send to _gnutls_recv_hello().
950 int _gnutls_recv_handshake(GNUTLS_STATE state
, uint8
** data
,
951 int *datalen
, HandshakeType type
,
956 opaque
*dataptr
= NULL
;
957 HandshakeType recv_type
;
959 ret
= _gnutls_recv_handshake_header(state
, type
, &recv_type
);
961 if (ret
== GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET
962 && optional
== OPTIONAL_PACKET
) {
966 return 0; /* ok just ignore the packet */
976 dataptr
= gnutls_malloc(length32
);
977 else if (recv_type
!= GNUTLS_SERVER_HELLO_DONE
) {
979 return GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
982 if (dataptr
== NULL
&& length32
> 0) {
984 return GNUTLS_E_MEMORY_ERROR
;
992 _gnutls_handshake_io_recv_int(state
, GNUTLS_HANDSHAKE
,
993 type
, dataptr
, length32
);
996 gnutls_free(dataptr
);
998 0) ? GNUTLS_E_UNEXPECTED_PACKET_LENGTH
:
1004 ret
= GNUTLS_E_UNKNOWN_ERROR
;
1006 if (data
!= NULL
&& length32
> 0)
1010 if ( (ret
=_gnutls_handshake_hash_add_recvd( state
, recv_type
,
1011 state
->gnutls_internals
.handshake_header_buffer
.header
,
1012 state
->gnutls_internals
.handshake_header_buffer
.header_size
,
1013 dataptr
, length32
)) < 0) {
1015 _gnutls_handshake_header_buffer_clear(state
);
1019 /* If we fail before this then we will reuse the handshake header
1020 * have have received above. if we get here the we clear the handshake
1021 * header we received.
1023 _gnutls_handshake_header_buffer_clear(state
);
1025 switch (recv_type
) {
1026 case GNUTLS_CLIENT_HELLO
:
1027 case GNUTLS_SERVER_HELLO
:
1028 ret
= _gnutls_recv_hello(state
, dataptr
, length32
);
1029 /* dataptr is freed because the called does not
1031 gnutls_free(dataptr
);
1033 case GNUTLS_CERTIFICATE_PKT
:
1036 case GNUTLS_SERVER_HELLO_DONE
:
1037 if (length32
==0) ret
= 0;
1038 else ret
= GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
1040 case GNUTLS_FINISHED
:
1043 case GNUTLS_SERVER_KEY_EXCHANGE
:
1046 case GNUTLS_CLIENT_KEY_EXCHANGE
:
1049 case GNUTLS_CERTIFICATE_REQUEST
:
1052 case GNUTLS_CERTIFICATE_VERIFY
:
1057 gnutls_free(dataptr
);
1058 ret
= GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET
;
1064 /* This function checks if the given cipher suite is supported, and sets it
1067 static int _gnutls_client_set_ciphersuite(GNUTLS_STATE state
,
1071 GNUTLS_CipherSuite
*cipher_suites
;
1076 x
= _gnutls_supported_ciphersuites(state
, &cipher_suites
);
1077 for (i
= 0; i
< x
; i
++) {
1078 if (memcmp(&cipher_suites
[i
], suite
, 2) == 0) {
1083 gnutls_free(cipher_suites
);
1087 return GNUTLS_E_UNKNOWN_CIPHER_TYPE
;
1090 memcpy(state
->security_parameters
.
1091 current_cipher_suite
.CipherSuite
, suite
, 2);
1093 _gnutls_handshake_log("HSK: Selected cipher suite: ");
1094 _gnutls_handshake_log("%s\n",
1095 _gnutls_cipher_suite_get_name(state
->
1096 security_parameters
.
1097 current_cipher_suite
));
1100 /* check if the credentials (username, public key etc. are ok).
1101 * Actually checks if they exist.
1103 if (_gnutls_get_kx_cred
1105 _gnutls_cipher_suite_get_kx_algo(state
->
1106 security_parameters
.
1107 current_cipher_suite
),
1108 &err
) == NULL
&& err
!= 0) {
1110 return GNUTLS_E_INSUFICIENT_CRED
;
1114 /* set the MOD_AUTH_STRUCT to the appropriate struct
1115 * according to the KX algorithm. This is needed since all the
1116 * handshake functions are read from there;
1118 state
->gnutls_internals
.auth_struct
=
1119 _gnutls_kx_auth_struct(_gnutls_cipher_suite_get_kx_algo
1120 (state
->security_parameters
.
1121 current_cipher_suite
));
1123 if (state
->gnutls_internals
.auth_struct
== NULL
) {
1125 _gnutls_handshake_log
1126 ("HSK: Cannot find the appropriate handler for the KX algorithm\n");
1128 return GNUTLS_E_UNKNOWN_CIPHER_TYPE
;
1135 /* This function sets the given comp method to the state.
1137 static int _gnutls_client_set_comp_method(GNUTLS_STATE state
,
1141 uint8
*compression_methods
;
1144 z
= _gnutls_supported_compression_methods(state
,
1145 &compression_methods
);
1146 for (i
= 0; i
< z
; i
++) {
1147 if (compression_methods
[i
] == comp_method
) {
1152 gnutls_free(compression_methods
);
1156 return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM
;
1159 state
->gnutls_internals
.compression_method
=
1160 _gnutls_compression_get_id(comp_method
);
1166 /* This function returns 0 if we are resuming a session or -1 otherwise.
1167 * This also sets the variables in the state. Used only while reading a server
1170 static int _gnutls_client_check_if_resuming(GNUTLS_STATE state
,
1171 opaque
* session_id
,
1175 _gnutls_handshake_log("HSK: SessionID length: %d\n", session_id_len
);
1176 _gnutls_handshake_log("HSK: SessionID: %s\n",
1177 _gnutls_bin2hex(session_id
, session_id_len
));
1179 if ((state
->gnutls_internals
.resumed_security_parameters
.
1180 session_id_size
> 0)
1181 && memcmp(session_id
,
1182 state
->gnutls_internals
.
1183 resumed_security_parameters
.session_id
,
1184 session_id_len
) == 0) {
1185 /* resume session */
1186 memcpy(state
->gnutls_internals
.
1187 resumed_security_parameters
.server_random
,
1188 state
->security_parameters
.server_random
,
1190 memcpy(state
->gnutls_internals
.
1191 resumed_security_parameters
.client_random
,
1192 state
->security_parameters
.client_random
,
1194 state
->gnutls_internals
.resumed
= RESUME_TRUE
; /* we are resuming */
1198 /* keep the new session id */
1199 state
->gnutls_internals
.resumed
= RESUME_FALSE
; /* we are not resuming */
1200 state
->security_parameters
.session_id_size
=
1202 memcpy(state
->security_parameters
.session_id
,
1203 session_id
, session_id_len
);
1210 /* This function read and parse the server hello handshake message.
1211 * This function also restores resumed parameters if we are resuming a
1214 static int _gnutls_read_server_hello(GNUTLS_STATE state
, char *data
,
1217 uint8 session_id_len
= 0;
1220 GNUTLS_Version version
;
1225 return GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
1228 _gnutls_handshake_log("HSK: Server's version: %d.%d\n", data
[pos
], data
[pos
+ 1]);
1231 version
= _gnutls_version_get(data
[pos
], data
[pos
+ 1]);
1232 if (_gnutls_version_is_supported(state
, version
) == 0) {
1234 return GNUTLS_E_UNSUPPORTED_VERSION_PACKET
;
1236 _gnutls_set_current_version(state
, version
);
1241 DECR_LEN(len
, TLS_RANDOM_SIZE
);
1242 _gnutls_set_server_random(state
, &data
[pos
]);
1243 pos
+= TLS_RANDOM_SIZE
;
1249 session_id_len
= data
[pos
++];
1251 if (len
< session_id_len
) {
1253 return GNUTLS_E_UNSUPPORTED_VERSION_PACKET
;
1255 DECR_LEN(len
, session_id_len
);
1258 /* check if we are resuming and set the appropriate
1261 if (_gnutls_client_check_if_resuming
1262 (state
, &data
[pos
], session_id_len
) == 0)
1264 pos
+= session_id_len
;
1267 /* Check if the given cipher suite is supported and copy
1272 ret
= _gnutls_client_set_ciphersuite(state
, &data
[pos
]);
1281 /* move to compression
1285 ret
= _gnutls_client_set_comp_method(state
, data
[pos
++]);
1288 return GNUTLS_E_UNKNOWN_COMPRESSION_ALGORITHM
;
1291 /* Parse extensions.
1293 if (version
>= GNUTLS_TLS1
) {
1294 ret
= _gnutls_parse_extensions(state
, &data
[pos
], len
); /* len is the rest of the parsed length */
1303 /* This function copies the appropriate ciphersuites, to a localy allocated buffer
1304 * Needed in client hello messages. Returns the new data length.
1306 static int _gnutls_copy_ciphersuites(GNUTLS_STATE state
,
1310 GNUTLS_CipherSuite
*cipher_suites
;
1314 ret
= _gnutls_supported_ciphersuites_sorted(state
, &cipher_suites
);
1317 if (ret
==0) return GNUTLS_E_INVALID_REQUEST
;
1321 /* Here we remove any ciphersuite that does not conform
1322 * the certificate requested, or to the
1323 * authentication requested (eg SRP).
1326 _gnutls_remove_unwanted_ciphersuites(state
, &cipher_suites
,
1334 return GNUTLS_E_INSUFICIENT_CRED
;
1339 x
*= sizeof(uint16
); /* in order to get bytes */
1343 datalen
+= sizeof(uint16
) + x
;
1345 *ret_data
= gnutls_malloc(datalen
);
1348 if (*ret_data
== NULL
) {
1350 return GNUTLS_E_MEMORY_ERROR
;
1354 _gnutls_write_uint16(x
, *ret_data
);
1357 for (i
= 0; i
< x
/ 2; i
++) {
1358 memcpy(&(*ret_data
)[pos
], cipher_suites
[i
].CipherSuite
, 2);
1361 gnutls_free(cipher_suites
);
1367 /* This function copies the appropriate compression methods, to a localy allocated buffer
1368 * Needed in hello messages. Returns the new data length.
1370 static int _gnutls_copy_comp_methods(GNUTLS_STATE state
,
1374 uint8
*compression_methods
, z
;
1378 _gnutls_supported_compression_methods(state
,
1379 &compression_methods
);
1390 *ret_data
= gnutls_malloc(datalen
);
1391 if (*ret_data
== NULL
) {
1393 return GNUTLS_E_MEMORY_ERROR
;
1396 (*ret_data
)[pos
++] = z
; /* put the number of compression methods */
1398 for (i
= 0; i
< z
; i
++) {
1399 (*ret_data
)[pos
++] = compression_methods
[i
];
1402 gnutls_free(compression_methods
);
1407 /* This function sends the client hello handshake message.
1409 static int _gnutls_send_client_hello(GNUTLS_STATE state
, int again
)
1411 opaque
*data
= NULL
;
1415 int datalen
, ret
= 0;
1416 opaque random
[TLS_RANDOM_SIZE
];
1417 GNUTLS_Version hver
;
1420 state
->gnutls_internals
.resumed_security_parameters
.session_id
;
1421 uint8 session_id_len
=
1422 state
->gnutls_internals
.resumed_security_parameters
.
1425 if (SessionID
== NULL
|| session_id_len
== 0) {
1434 datalen
= 2 + (session_id_len
+ 1) + TLS_RANDOM_SIZE
;
1435 /* 2 for version, (4 for unix time + 28 for random bytes==TLS_RANDOM_SIZE)
1438 data
= gnutls_malloc(datalen
+ 16); /* 16 is added to avoid realloc
1439 * if no much data are added.
1443 return GNUTLS_E_MEMORY_ERROR
;
1446 /* if we are resuming a session then we set the
1447 * version number to the previously established.
1449 if (SessionID
== NULL
)
1450 hver
= _gnutls_version_max(state
);
1451 else { /* we are resuming a session */
1453 state
->gnutls_internals
.
1454 resumed_security_parameters
.version
;
1459 hver
= GNUTLS_E_UNKNOWN_ERROR
;
1464 data
[pos
++] = _gnutls_version_get_major(hver
);
1465 data
[pos
++] = _gnutls_version_get_minor(hver
);
1467 /* Set the version we advertized as maximum
1470 _gnutls_set_adv_version( state
, hver
);
1472 /* Some implementations do not interoperate if we send a
1473 * different version in the record layer.
1474 * It seems they prefer to read the record's version
1475 * as the one we actually requested.
1476 * The proper behaviour is to use the one in the client hello
1477 * handshake packet and ignore the one in the packet's record
1480 if (state
->gnutls_internals
.default_record_version
==0)
1481 _gnutls_set_current_version(state
, hver
);
1482 else _gnutls_set_current_version(state
,
1483 state
->gnutls_internals
.default_record_version
);
1485 /* In order to know when this session was initiated.
1487 state
->security_parameters
.timestamp
= time(NULL
);
1489 /* Generate random data
1491 _gnutls_create_random(random
);
1492 _gnutls_set_client_random(state
, random
);
1494 memcpy(&data
[pos
], random
, TLS_RANDOM_SIZE
);
1495 pos
+= TLS_RANDOM_SIZE
;
1497 /* Copy the Session ID
1499 data
[pos
++] = session_id_len
;
1501 if (session_id_len
> 0) {
1502 memcpy(&data
[pos
], SessionID
, session_id_len
);
1504 pos
+= session_id_len
;
1507 /* Copy the ciphersuites.
1509 extdatalen
= _gnutls_copy_ciphersuites(state
, &extdata
);
1510 if (extdatalen
> 0) {
1511 datalen
+= extdatalen
;
1512 data
= gnutls_realloc(data
, datalen
);
1515 gnutls_free(extdata
);
1516 return GNUTLS_E_MEMORY_ERROR
;
1519 memcpy(&data
[pos
], extdata
, extdatalen
);
1520 gnutls_free(extdata
);
1524 if (extdatalen
== 0)
1525 extdatalen
= GNUTLS_E_UNKNOWN_ERROR
;
1532 /* Copy the compression methods.
1534 extdatalen
= _gnutls_copy_comp_methods(state
, &extdata
);
1535 if (extdatalen
> 0) {
1536 datalen
+= extdatalen
;
1537 data
= gnutls_realloc(data
, datalen
);
1540 gnutls_free(extdata
);
1541 return GNUTLS_E_MEMORY_ERROR
;
1544 memcpy(&data
[pos
], extdata
, extdatalen
);
1545 gnutls_free(extdata
);
1549 if (extdatalen
== 0)
1550 extdatalen
= GNUTLS_E_UNKNOWN_ERROR
;
1556 /* Generate and copy TLS extensions.
1558 if (hver
>= GNUTLS_TLS1
) {
1559 extdatalen
= _gnutls_gen_extensions(state
, &extdata
);
1560 if (extdatalen
> 0) {
1561 datalen
+= extdatalen
;
1562 data
= gnutls_realloc(data
, datalen
);
1565 gnutls_free(extdata
);
1566 return GNUTLS_E_MEMORY_ERROR
;
1569 memcpy(&data
[pos
], extdata
, extdatalen
);
1570 gnutls_free(extdata
);
1576 _gnutls_send_handshake(state
, data
, datalen
,
1577 GNUTLS_CLIENT_HELLO
);
1583 static int _gnutls_send_server_hello(GNUTLS_STATE state
, int again
)
1589 int datalen
, ret
= 0;
1591 opaque
*SessionID
= state
->security_parameters
.session_id
;
1592 uint8 session_id_len
= state
->security_parameters
.session_id_size
;
1594 if (SessionID
== NULL
)
1601 datalen
= 2 + session_id_len
+ 1 + TLS_RANDOM_SIZE
+ 3;
1602 extdatalen
= _gnutls_gen_extensions(state
, &extdata
);
1604 data
= gnutls_alloca(datalen
+ extdatalen
);
1607 gnutls_free(extdata
);
1608 return GNUTLS_E_MEMORY_ERROR
;
1612 _gnutls_version_get_major(state
->security_parameters
.
1615 _gnutls_version_get_minor(state
->security_parameters
.
1619 state
->security_parameters
.server_random
,
1621 pos
+= TLS_RANDOM_SIZE
;
1623 data
[pos
++] = session_id_len
;
1624 if (session_id_len
> 0) {
1625 memcpy(&data
[pos
], SessionID
, session_id_len
);
1627 pos
+= session_id_len
;
1629 _gnutls_handshake_log("HSK: SessionID: %s\n",
1630 _gnutls_bin2hex(SessionID
, session_id_len
));
1633 state
->security_parameters
.
1634 current_cipher_suite
.CipherSuite
, 2);
1638 (uint8
) _gnutls_compression_get_num(state
->
1640 compression_method
);
1644 if (extdatalen
> 0) {
1645 datalen
+= extdatalen
;
1647 memcpy(&data
[pos
], extdata
, extdatalen
);
1648 gnutls_free(extdata
);
1653 _gnutls_send_handshake(state
, data
, datalen
,
1654 GNUTLS_SERVER_HELLO
);
1660 int _gnutls_send_hello(GNUTLS_STATE state
, int again
)
1664 if (state
->security_parameters
.entity
== GNUTLS_CLIENT
) {
1665 ret
= _gnutls_send_client_hello(state
, again
);
1667 } else { /* SERVER */
1668 ret
= _gnutls_send_server_hello(state
, again
);
1674 /* RECEIVE A HELLO MESSAGE. This should be called from gnutls_recv_handshake_int only if a
1675 * hello message is expected. It uses the security_parameters.current_cipher_suite
1676 * and gnutls_internals.compression_method.
1678 int _gnutls_recv_hello(GNUTLS_STATE state
, char *data
, int datalen
)
1682 if (state
->security_parameters
.entity
== GNUTLS_CLIENT
) {
1683 ret
= _gnutls_read_server_hello(state
, data
, datalen
);
1688 } else { /* Server side reading a client hello */
1690 ret
= _gnutls_read_client_hello(state
, data
, datalen
);
1700 /* The packets in gnutls_handshake (it's more broad than original TLS handshake)
1704 * ClientHello -------->
1705 * <-------- ServerHello
1708 * ServerKeyExchange*
1709 * Client Key Exchange0 -------->
1710 * <-------- CertificateRequest*
1712 * <-------- Server Key Exchange2
1713 * <-------- ServerHelloDone
1716 * CertificateVerify*
1717 * [ChangeCipherSpec]
1718 * Finished -------->
1719 * [ChangeCipherSpec]
1720 * <-------- Finished
1722 * (*): means optional packet.
1726 * gnutls_rehandshake - This function will renegotiate security parameters
1727 * @state: is a a &GNUTLS_STATE structure.
1729 * This function will renegotiate security parameters with the
1730 * client. This should only be called in case of a server.
1732 * This message informs the peer that we want to renegotiate
1733 * parameters (perform a handshake).
1735 * If this function succeeds (returns 0), you must call
1736 * the gnutls_handshake() function in order to negotiate
1737 * the new parameters.
1739 * If the client does not wish to renegotiate parameters he
1740 * will reply with an alert message, thus the return code will be
1741 * GNUTLS_E_WARNING_ALERT_RECEIVED and the alert will be
1742 * GNUTLS_A_NO_RENEGOTIATION.
1744 int gnutls_rehandshake(GNUTLS_STATE state
)
1748 /* only server sends that handshake packet */
1749 if (state
->security_parameters
.entity
== GNUTLS_CLIENT
)
1750 return GNUTLS_E_INVALID_REQUEST
;
1753 _gnutls_send_empty_handshake(state
, GNUTLS_HELLO_REQUEST
,
1766 static int _gnutls_abort_handshake( GNUTLS_STATE state
, int ret
) {
1767 if ( ((ret
==GNUTLS_E_WARNING_ALERT_RECEIVED
) &&
1768 ( gnutls_alert_get(state
) == GNUTLS_A_NO_RENEGOTIATION
))
1769 || ret
==GNUTLS_E_GOT_APPLICATION_DATA
)
1772 /* this doesn't matter */
1773 return GNUTLS_E_UNKNOWN_ERROR
;
1777 /* This function initialized the handshake hash state.
1778 * required for finished messages.
1781 static int _gnutls_handshake_hash_init( GNUTLS_STATE state
) {
1783 if ( state
->gnutls_internals
.handshake_mac_handle_md5
==NULL
) {
1784 state
->gnutls_internals
.handshake_mac_handle_md5
= _gnutls_hash_init( GNUTLS_MAC_MD5
);
1786 if (state
->gnutls_internals
.handshake_mac_handle_md5
==GNUTLS_HASH_FAILED
) {
1788 return GNUTLS_E_MEMORY_ERROR
;
1792 if ( state
->gnutls_internals
.handshake_mac_handle_sha
==NULL
) {
1793 state
->gnutls_internals
.handshake_mac_handle_sha
= _gnutls_hash_init( GNUTLS_MAC_SHA
);
1794 if (state
->gnutls_internals
.handshake_mac_handle_sha
==GNUTLS_HASH_FAILED
) {
1796 return GNUTLS_E_MEMORY_ERROR
;
1804 * gnutls_handshake - This the main function in the handshake protocol.
1805 * @state: is a a &GNUTLS_STATE structure.
1807 * This function does the handshake of the TLS/SSL protocol,
1808 * and initializes the TLS connection.
1810 * This function will fail if any problem is encountered,
1811 * and will return a negative error code. In case of a client,
1812 * if it has been asked to resume a session, but the server didn't, then
1813 * a full handshake will be performed.
1815 * This function may also return the non-fatal errors GNUTLS_E_AGAIN, or
1816 * GNUTLS_E_INTERRUPTED. In that case you may resume the handshake
1817 * (call this function again, until it returns ok)
1819 * If this function is called by a server after a rehandshake request then
1820 * GNUTLS_E_GOT_APPLICATION_DATA or GNUTLS_E_WARNING_ALERT_RECEIVED
1821 * may be returned. Note that these are non fatal errors, only in the
1822 * case of a rehandshake. In that case they mean that the client
1823 * rejected the rehandshake request.
1826 int gnutls_handshake(GNUTLS_STATE state
)
1830 if ( (ret
=_gnutls_handshake_hash_init( state
)) < 0) {
1835 if (state
->security_parameters
.entity
== GNUTLS_CLIENT
) {
1836 ret
= gnutls_handshake_client(state
);
1838 ret
= gnutls_handshake_server(state
);
1841 /* In the case of a rehandshake abort
1842 * we should reset the handshake's state
1844 if (_gnutls_abort_handshake( state
, ret
) == 0)
1849 ret
= gnutls_handshake_common(state
);
1852 if (_gnutls_abort_handshake( state
, ret
) == 0)
1859 _gnutls_handshake_io_buffer_clear(state
);
1860 _gnutls_handshake_internal_state_clear(state
);
1865 #define IMED_RET( str, ret) \
1867 if (gnutls_error_is_fatal(ret)==0) return ret; \
1870 _gnutls_handshake_hash_buffers_clear(state); \
1877 * gnutls_handshake_client
1878 * This function performs the client side of the handshake of the TLS/SSL protocol.
1880 int gnutls_handshake_client(GNUTLS_STATE state
)
1884 #ifdef HANDSHAKE_DEBUG
1885 if (state
->gnutls_internals
.resumed_security_parameters
.
1886 session_id_size
> 0)
1887 _gnutls_handshake_log("HSK: Ask to resume: %s\n",
1888 _gnutls_bin2hex(state
->gnutls_internals
.
1889 resumed_security_parameters
.
1891 state
->gnutls_internals
.
1892 resumed_security_parameters
.
1899 ret
= _gnutls_send_hello(state
, AGAIN(STATE1
));
1901 IMED_RET("send hello", ret
);
1904 /* receive the server hello */
1906 _gnutls_recv_handshake(state
, NULL
, NULL
,
1907 GNUTLS_SERVER_HELLO
,
1910 IMED_RET("recv hello", ret
);
1913 /* RECV CERTIFICATE */
1914 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1915 ret
= _gnutls_recv_server_certificate(state
);
1917 IMED_RET("recv server certificate", ret
);
1920 /* receive the server key exchange */
1921 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1922 ret
= _gnutls_recv_server_kx_message(state
);
1924 IMED_RET("recv server kx message", ret
);
1928 * send the client key exchange for SRP
1930 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1932 _gnutls_send_client_kx_message0(state
,
1935 IMED_RET("send client kx0", ret
);
1938 /* receive the server certificate request - if any
1941 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1943 _gnutls_recv_server_certificate_request(state
);
1945 IMED_RET("recv server certificate request message", ret
);
1948 /* receive the server key exchange (B) (SRP only)
1951 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1952 ret
= _gnutls_recv_server_kx_message2(state
);
1954 IMED_RET("recv server kx message2", ret
);
1957 /* receive the server hello done */
1958 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1960 _gnutls_recv_handshake(state
, NULL
, NULL
,
1961 GNUTLS_SERVER_HELLO_DONE
,
1964 IMED_RET("recv server hello done", ret
);
1967 /* send our certificate - if any and if requested
1969 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1971 _gnutls_send_client_certificate(state
,
1974 IMED_RET("send client certificate", ret
);
1977 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1979 _gnutls_send_client_kx_message(state
,
1982 IMED_RET("send client kx", ret
);
1985 /* send client certificate verify */
1986 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
1988 _gnutls_send_client_certificate_verify(state
,
1992 IMED_RET("send client certificate verify", ret
);
2001 /* This function sends the final handshake packets and initializes connection
2003 static int _gnutls_send_handshake_final(GNUTLS_STATE state
, int init
)
2007 /* Send the CHANGE CIPHER SPEC PACKET */
2013 _gnutls_send_change_cipher_spec(state
, AGAIN(STATE20
));
2016 ERR("send ChangeCipherSpec", ret
);
2021 /* Initialize the connection state (start encryption) - in case of client
2024 ret
= _gnutls_connection_state_init(state
);
2031 ret
= _gnutls_write_connection_state_init(state
);
2038 /* send the finished message */
2039 ret
= _gnutls_send_finished(state
, AGAIN(STATE21
));
2042 ERR("send Finished", ret
);
2053 /* This function receives the final handshake packets
2054 * And executes the appropriate function to initialize the
2057 static int _gnutls_recv_handshake_final(GNUTLS_STATE state
, int init
)
2066 gnutls_recv_int(state
, GNUTLS_CHANGE_CIPHER_SPEC
, -1,
2070 ERR("recv ChangeCipherSpec", ret
);
2074 GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
2077 /* Initialize the connection state (start encryption) - in case of server */
2079 ret
= _gnutls_connection_state_init(state
);
2086 ret
= _gnutls_read_connection_state_init(state
);
2093 ret
= _gnutls_recv_finished(state
);
2096 ERR("recv finished", ret
);
2108 * gnutls_handshake_server
2109 * This function does the server stuff of the handshake protocol.
2112 int gnutls_handshake_server(GNUTLS_STATE state
)
2120 _gnutls_recv_handshake(state
, NULL
, NULL
,
2121 GNUTLS_CLIENT_HELLO
,
2124 IMED_RET("recv hello", ret
);
2127 ret
= _gnutls_send_hello(state
, AGAIN(STATE2
));
2129 IMED_RET("send hello", ret
);
2131 /* SEND CERTIFICATE + KEYEXCHANGE + CERTIFICATE_REQUEST */
2133 /* NOTE: these should not be send if we are resuming */
2135 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
)
2137 _gnutls_send_server_certificate(state
,
2140 IMED_RET("send server certificate", ret
);
2143 /* send server key exchange (A) */
2144 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
)
2146 _gnutls_send_server_kx_message(state
,
2149 IMED_RET("send server kx", ret
);
2152 /* Send certificate request - if requested to */
2153 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
)
2155 _gnutls_send_server_certificate_request(state
,
2159 IMED_RET("send server cert request", ret
);
2162 /* Added for SRP which uses a different handshake */
2163 /* receive the client key exchange message */
2165 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
2166 ret
= _gnutls_recv_client_kx_message0(state
);
2168 IMED_RET("recv client kx0", ret
);
2171 /* send server key exchange (B) */
2172 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
)
2174 _gnutls_send_server_kx_message2(state
,
2177 IMED_RET("send server kx2", ret
);
2180 /* send the server hello done */
2181 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
2183 _gnutls_send_empty_handshake(state
,
2184 GNUTLS_SERVER_HELLO_DONE
,
2187 IMED_RET("send server hello done", ret
);
2190 /* RECV CERTIFICATE + KEYEXCHANGE + CERTIFICATE_VERIFY */
2192 /* receive the client certificate message */
2193 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
2194 ret
= _gnutls_recv_client_certificate(state
);
2196 IMED_RET("recv client certificate", ret
);
2199 /* receive the client key exchange message */
2200 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
2201 ret
= _gnutls_recv_client_kx_message(state
);
2203 IMED_RET("recv client kx", ret
);
2206 /* receive the client certificate verify message */
2207 if (state
->gnutls_internals
.resumed
== RESUME_FALSE
) /* if we are not resuming */
2209 _gnutls_recv_client_certificate_verify_message
2212 IMED_RET("recv client certificate verify", ret
);
2214 STATE
= STATE0
; /* finished thus clear state */
2220 int gnutls_handshake_common(GNUTLS_STATE state
)
2225 /* send and recv the change cipher spec and finished messages */
2226 if ((state
->gnutls_internals
.resumed
== RESUME_TRUE
2227 && state
->security_parameters
.entity
== GNUTLS_CLIENT
)
2228 || (state
->gnutls_internals
.resumed
== RESUME_FALSE
2229 && state
->security_parameters
.entity
== GNUTLS_SERVER
)) {
2230 /* if we are a client resuming - or we are a server not resuming */
2232 ret
= _gnutls_recv_handshake_final(state
, TRUE
);
2233 IMED_RET("recv handshake final", ret
);
2235 ret
= _gnutls_send_handshake_final(state
, FALSE
);
2236 IMED_RET("send handshake final", ret
);
2237 } else { /* if we are a client not resuming - or we are a server resuming */
2239 ret
= _gnutls_send_handshake_final(state
, TRUE
);
2240 IMED_RET("send handshake final 2", ret
);
2242 ret
= _gnutls_recv_handshake_final(state
, FALSE
);
2243 IMED_RET("recv handshake final 2", ret
);
2246 if (state
->security_parameters
.entity
== GNUTLS_SERVER
) {
2247 /* in order to support session resuming */
2248 _gnutls_server_register_current_session(state
);
2251 /* clear handshake buffer */
2252 _gnutls_handshake_hash_buffers_clear(state
);
2257 int _gnutls_generate_session_id(char *session_id
, uint8
* len
)
2259 opaque rand
[TLS_RANDOM_SIZE
];
2260 if (_gnutls_get_random(rand
, TLS_RANDOM_SIZE
, GNUTLS_WEAK_RANDOM
) <
2263 return GNUTLS_E_MEMORY_ERROR
;
2265 memcpy(session_id
, rand
, TLS_RANDOM_SIZE
);
2266 *len
= TLS_RANDOM_SIZE
;
2268 _gnutls_handshake_log("HSK: Generated SessionID: %s\n",
2269 _gnutls_bin2hex(session_id
, TLS_RANDOM_SIZE
));
2274 int _gnutls_recv_hello_request(GNUTLS_STATE state
, void *data
,
2279 if (state
->security_parameters
.entity
== GNUTLS_SERVER
) {
2281 return GNUTLS_E_UNEXPECTED_PACKET
;
2283 if (data_size
< 1) {
2285 return GNUTLS_E_UNEXPECTED_PACKET_LENGTH
;
2287 type
= ((uint8
*) data
)[0];
2288 if (type
== GNUTLS_HELLO_REQUEST
)
2289 return GNUTLS_E_REHANDSHAKE
;
2292 return GNUTLS_E_UNEXPECTED_PACKET
;
2296 /* This function will remove algorithms that are not supported by
2297 * the requested authentication method. We remove algorithm if
2298 * we have a certificate with keyUsage bits set.
2300 * This does a more high level check than gnutls_supported_ciphersuites(),
2301 * by checking certificates etc.
2303 int _gnutls_remove_unwanted_ciphersuites(GNUTLS_STATE state
,
2304 GNUTLS_CipherSuite
**
2305 cipherSuites
, int numCipherSuites
,
2306 PKAlgorithm requested_pk_algo
)
2310 GNUTLS_CipherSuite
*newSuite
;
2311 int newSuiteSize
= 0, i
, j
, keep
;
2312 const GNUTLS_CERTIFICATE_CREDENTIALS x509_cred
;
2313 const gnutls_cert
*cert
= NULL
;
2319 /* if we should use a specific certificate,
2320 * we should remove all algorithms that are not supported
2321 * by that certificate and are on the same authentication
2322 * method (CERTIFICATE).
2326 _gnutls_get_cred(state
->gnutls_key
, GNUTLS_CRD_CERTIFICATE
, NULL
);
2328 /* if x509_cred==NULL we should remove all X509 ciphersuites
2332 if (state
->security_parameters
.entity
== GNUTLS_SERVER
)
2333 cert
= _gnutls_server_find_cert(state
, requested_pk_algo
);
2336 /* No certificate was found
2342 /* get all the key exchange algorithms that are
2343 * supported by the X509 certificate parameters.
2346 _gnutls_cert_supported_kx(cert
, &alg
,
2354 gnutls_malloc(numCipherSuites
* sizeof(GNUTLS_CipherSuite
));
2355 if (newSuite
== NULL
) {
2358 return GNUTLS_E_MEMORY_ERROR
;
2361 /* now removes ciphersuites based on the KX algorithm
2363 for (i
= 0; i
< numCipherSuites
; i
++) {
2364 /* finds the key exchange algorithm in
2367 kx
= _gnutls_cipher_suite_get_kx_algo((*cipherSuites
)[i
]);
2371 /* if it is defined but had no credentials
2373 if (_gnutls_get_kx_cred
2374 (state
->gnutls_key
, kx
, NULL
) == NULL
) {
2377 /* If there was no credentials to use with the specified
2378 * key exchange method, then just remove it.
2380 if (_gnutls_map_kx_get_cred(kx
) == GNUTLS_CRD_CERTIFICATE
) {
2381 keep
= 1; /* do not keep */
2382 if (x509_cred
!= NULL
) {
2383 if (state
->security_parameters
.entity
==
2385 /* here we check if the KX algorithm
2386 * is compatible with the certificate.
2388 for (j
= 0; j
< alg_size
; j
++) {
2401 _gnutls_handshake_log("HSK: Keeping ciphersuite: ");
2402 _gnutls_handshake_log("%s\n",
2403 _gnutls_cipher_suite_get_name(*
2404 ((GNUTLS_CipherSuite
*) & (*cipherSuites
)[i
].CipherSuite
)));
2406 memcpy(newSuite
[newSuiteSize
].CipherSuite
,
2407 (*cipherSuites
)[i
].CipherSuite
, 2);
2410 _gnutls_handshake_log("HSK: Removing ciphersuite: ");
2411 _gnutls_handshake_log("%s\n",
2412 _gnutls_cipher_suite_get_name(*
2413 ((GNUTLS_CipherSuite
*) & (*cipherSuites
)[i
].CipherSuite
)));
2419 gnutls_free(*cipherSuites
);
2420 *cipherSuites
= newSuite
;
2429 * gnutls_handshake_set_max_packet_length - This function will set the maximum length of a handshake message
2430 * @state: is a a &GNUTLS_STATE structure.
2431 * @max: is the maximum number.
2433 * This function will set the maximum size of a handshake message.
2434 * Handshake messages over this size are rejected.
2435 * The default value is 16kb which is large enough. Set this to 0 if you do not want
2436 * to set an upper limit.
2439 void gnutls_handshake_set_max_packet_length(GNUTLS_STATE state
, int max
)
2441 state
->gnutls_internals
.max_handshake_data_buffer_size
= max
;
2444 void _gnutls_set_adv_version( GNUTLS_STATE state
, GNUTLS_Version ver
) {
2445 set_adv_version( state
, _gnutls_version_get_major(ver
), _gnutls_version_get_minor(ver
));
2448 GNUTLS_Version
_gnutls_get_adv_version( GNUTLS_STATE state
) {
2449 return _gnutls_version_get( _gnutls_get_adv_version_major( state
),
2450 _gnutls_get_adv_version_minor( state
));