_ Git - BearSSL/blob - src/ssl/ssl_hs_client.t0

   1 \ Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
   2 \
   3 \ Permission is hereby granted, free of charge, to any person obtaining
   4 \ a copy of this software and associated documentation files (the
   5 \ "Software"), to deal in the Software without restriction, including
   6 \ without limitation the rights to use, copy, modify, merge, publish,
   7 \ distribute, sublicense, and/or sell copies of the Software, and to
   8 \ permit persons to whom the Software is furnished to do so, subject to
   9 \ the following conditions:
  10 \
  11 \ The above copyright notice and this permission notice shall be
  12 \ included in all copies or substantial portions of the Software.
  13 \
  14 \ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  15 \ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  16 \ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  17 \ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  18 \ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  19 \ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  20 \ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  21 \ SOFTWARE.
  22
  23 \ ----------------------------------------------------------------------
  24 \ Handshake processing code, for the client.
  25 \ The common T0 code (ssl_hs_common.t0) shall be read first.
  26
  27 preamble {
  28
  29 /*
  30  * This macro evaluates to a pointer to the client context, under that
  31  * specific name. It must be noted that since the engine context is the
  32  * first field of the br_ssl_client_context structure ('eng'), then
  33  * pointers values of both types are interchangeable, modulo an
  34  * appropriate cast. This also means that "adresses" computed as offsets
  35  * within the structure work for both kinds of context.
  36  */
  37 #define CTX  ((br_ssl_client_context *)ENG)
  38
  39 /*
  40  * Generate the pre-master secret for RSA key exchange, and encrypt it
  41  * with the server's public key. Returned value is either the encrypted
  42  * data length (in bytes), or -x on error, with 'x' being an error code.
  43  *
  44  * This code assumes that the public key has been already verified (it
  45  * was properly obtained by the X.509 engine, and it has the right type,
  46  * i.e. it is of type RSA and suitable for encryption).
  47  */
  48 static int
  49 make_pms_rsa(br_ssl_client_context *ctx, int prf_id)
  50 {
  51         const br_x509_class **xc;
  52         const br_x509_pkey *pk;
  53         const unsigned char *n;
  54         unsigned char *pms;
  55         size_t nlen, u;
  56
  57         xc = ctx->eng.x509ctx;
  58         pk = (*xc)->get_pkey(xc);
  59
  60         /*
  61          * Compute actual RSA key length, in case there are leading zeros.
  62          */
  63         n = pk->key.rsa.n;
  64         nlen = pk->key.rsa.nlen;
  65         while (nlen > 0 && *n == 0) {
  66                 n ++;
  67                 nlen --;
  68         }
  69
  70         /*
  71          * We need at least 59 bytes (48 bytes for pre-master secret, and
  72          * 11 bytes for the PKCS#1 type 2 padding). Note that the X.509
  73          * minimal engine normally blocks RSA keys shorter than 128 bytes,
  74          * so this is mostly for public keys provided explicitly by the
  75          * caller.
  76          */
  77         if (nlen < 59) {
  78                 return -BR_ERR_X509_WEAK_PUBLIC_KEY;
  79         }
  80         if (nlen > sizeof ctx->eng.pad) {
  81                 return -BR_ERR_LIMIT_EXCEEDED;
  82         }
  83
  84         /*
  85          * Make PMS.
  86          */
  87         pms = ctx->eng.pad + nlen - 48;
  88         br_enc16be(pms, ctx->eng.version_max);
  89         br_hmac_drbg_generate(&ctx->eng.rng, pms + 2, 46);
  90         br_ssl_engine_compute_master(&ctx->eng, prf_id, pms, 48);
  91
  92         /*
  93          * Apply PKCS#1 type 2 padding.
  94          */
  95         ctx->eng.pad[0] = 0x00;
  96         ctx->eng.pad[1] = 0x02;
  97         ctx->eng.pad[nlen - 49] = 0x00;
  98         br_hmac_drbg_generate(&ctx->eng.rng, ctx->eng.pad + 2, nlen - 51);
  99         for (u = 2; u < nlen - 49; u ++) {
 100                 while (ctx->eng.pad[u] == 0) {
 101                         br_hmac_drbg_generate(&ctx->eng.rng,
 102                                 &ctx->eng.pad[u], 1);
 103                 }
 104         }
 105
 106         /*
 107          * Compute RSA encryption.
 108          */
 109         if (!ctx->irsapub(ctx->eng.pad, nlen, &pk->key.rsa)) {
 110                 return -BR_ERR_LIMIT_EXCEEDED;
 111         }
 112         return (int)nlen;
 113 }
 114
 115 /*
 116  * OID for hash functions in RSA signatures.
 117  */
 118 static const unsigned char HASH_OID_SHA1[] = {
 119         0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A
 120 };
 121
 122 static const unsigned char HASH_OID_SHA224[] = {
 123         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
 124 };
 125
 126 static const unsigned char HASH_OID_SHA256[] = {
 127         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
 128 };
 129
 130 static const unsigned char HASH_OID_SHA384[] = {
 131         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
 132 };
 133
 134 static const unsigned char HASH_OID_SHA512[] = {
 135         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
 136 };
 137
 138 static const unsigned char *HASH_OID[] = {
 139         HASH_OID_SHA1,
 140         HASH_OID_SHA224,
 141         HASH_OID_SHA256,
 142         HASH_OID_SHA384,
 143         HASH_OID_SHA512
 144 };
 145
 146 /*
 147  * Check the RSA signature on the ServerKeyExchange message.
 148  *   hash      hash function ID (2 to 6), or 0 for MD5+SHA-1 (with RSA only)
 149  *   use_rsa   non-zero for RSA signature, zero for ECDSA
 150  *   sig_len   signature length (in bytes); signature value is in the pad
 151  * Returned value is 0 on success, or an error code.
 152  */
 153 static int
 154 verify_SKE_sig(br_ssl_client_context *ctx,
 155         int hash, int use_rsa, size_t sig_len)
 156 {
 157         const br_x509_class **xc;
 158         const br_x509_pkey *pk;
 159         br_multihash_context mhc;
 160         unsigned char hv[64], head[4];
 161         size_t hv_len;
 162
 163         xc = ctx->eng.x509ctx;
 164         pk = (*xc)->get_pkey(xc);
 165         br_multihash_zero(&mhc);
 166         br_multihash_copyimpl(&mhc, &ctx->eng.mhash);
 167         br_multihash_init(&mhc);
 168         br_multihash_update(&mhc,
 169                 ctx->eng.client_random, sizeof ctx->eng.client_random);
 170         br_multihash_update(&mhc,
 171                 ctx->eng.server_random, sizeof ctx->eng.server_random);
 172         head[0] = 3;
 173         head[1] = 0;
 174         head[2] = ctx->eng.ecdhe_curve;
 175         head[3] = ctx->eng.ecdhe_point_len;
 176         br_multihash_update(&mhc, head, sizeof head);
 177         br_multihash_update(&mhc,
 178                 ctx->eng.ecdhe_point, ctx->eng.ecdhe_point_len);
 179         if (hash) {
 180                 hv_len = br_multihash_out(&mhc, hash, hv);
 181                 if (hv_len == 0) {
 182                         return BR_ERR_INVALID_ALGORITHM;
 183                 }
 184         } else {
 185                 if (!br_multihash_out(&mhc, br_md5_ID, hv)
 186                         || !br_multihash_out(&mhc, br_sha1_ID, hv + 16))
 187                 {
 188                         return BR_ERR_INVALID_ALGORITHM;
 189                 }
 190                 hv_len = 36;
 191         }
 192         if (use_rsa) {
 193                 unsigned char tmp[64];
 194                 const unsigned char *hash_oid;
 195
 196                 if (hash) {
 197                         hash_oid = HASH_OID[hash - 2];
 198                 } else {
 199                         hash_oid = NULL;
 200                 }
 201                 if (!ctx->irsavrfy(ctx->eng.pad, sig_len,
 202                         hash_oid, hv_len, &pk->key.rsa, tmp)
 203                         || memcmp(tmp, hv, hv_len) != 0)
 204                 {
 205                         return BR_ERR_BAD_SIGNATURE;
 206                 }
 207         } else {
 208                 if (!ctx->iecdsa(ctx->eng.iec, hv, hv_len, &pk->key.ec,
 209                         ctx->eng.pad, sig_len))
 210                 {
 211                         return BR_ERR_BAD_SIGNATURE;
 212                 }
 213         }
 214         return 0;
 215 }
 216
 217 /*
 218  * Perform client-size ECDH (or ECDHE). The point that should be sent to
 219  * the server is written in the pad; returned value is either the point
 220  * length (in bytes), or -x on error, with 'x' being an error code.
 221  *
 222  * The point _from_ the server is taken from ecdhe_point[] if 'ecdhe'
 223  * is non-zero, or from the X.509 engine context if 'ecdhe' is zero
 224  * (for static ECDH).
 225  */
 226 static int
 227 make_pms_ecdh(br_ssl_client_context *ctx, unsigned ecdhe, int prf_id)
 228 {
 229         int curve;
 230         unsigned char key[66], point[133];
 231         const unsigned char *generator, *order, *point_src;
 232         size_t glen, olen, point_len;
 233         unsigned char mask;
 234
 235         if (ecdhe) {
 236                 curve = ctx->eng.ecdhe_curve;
 237                 point_src = ctx->eng.ecdhe_point;
 238                 point_len = ctx->eng.ecdhe_point_len;
 239         } else {
 240                 const br_x509_class **xc;
 241                 const br_x509_pkey *pk;
 242
 243                 xc = ctx->eng.x509ctx;
 244                 pk = (*xc)->get_pkey(xc);
 245                 curve = pk->key.ec.curve;
 246                 point_src = pk->key.ec.q;
 247                 point_len = pk->key.ec.qlen;
 248         }
 249         if ((ctx->eng.iec->supported_curves & ((uint32_t)1 << curve)) == 0) {
 250                 return -BR_ERR_INVALID_ALGORITHM;
 251         }
 252
 253         /*
 254          * We need to generate our key, as a non-zero random value which
 255          * is lower than the curve order, in a "large enough" range. We
 256          * force top bit to 0 and bottom bit to 1, which guarantees that
 257          * the value is in the proper range.
 258          */
 259         order = ctx->eng.iec->order(curve, &olen);
 260         mask = 0xFF;
 261         while (mask >= order[0]) {
 262                 mask >>= 1;
 263         }
 264         br_hmac_drbg_generate(&ctx->eng.rng, key, olen);
 265         key[0] &= mask;
 266         key[olen - 1] |= 0x01;
 267
 268         /*
 269          * Compute the common ECDH point, whose X coordinate is the
 270          * pre-master secret.
 271          */
 272         generator = ctx->eng.iec->generator(curve, &glen);
 273         if (glen != point_len) {
 274                 return -BR_ERR_INVALID_ALGORITHM;
 275         }
 276
 277         memcpy(point, point_src, glen);
 278         if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
 279                 return -BR_ERR_INVALID_ALGORITHM;
 280         }
 281
 282         /*
 283          * The pre-master secret is the X coordinate.
 284          */
 285         br_ssl_engine_compute_master(&ctx->eng, prf_id, point + 1, glen >> 1);
 286
 287         memcpy(point, generator, glen);
 288         if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
 289                 return -BR_ERR_INVALID_ALGORITHM;
 290         }
 291         memcpy(ctx->eng.pad, point, glen);
 292         return (int)glen;
 293 }
 294
 295 }
 296
 297 \ =======================================================================
 298
 299 : addr-ctx:
 300         next-word { field }
 301         "addr-" field + 0 1 define-word
 302         0 8191 "offsetof(br_ssl_client_context, " field + ")" + make-CX
 303         postpone literal postpone ; ;
 304
 305 addr-ctx: min_clienthello_len
 306
 307 \ Length of the Secure Renegotiation extension. This is 5 for the
 308 \ first handshake, 17 for a renegotiation (if the server supports the
 309 \ extension), or 0 if we know that the server does not support the
 310 \ extension.
 311 : ext-reneg-length ( -- n )
 312         addr-reneg get8 dup if 1 - 17 * else drop 5 then ;
 313
 314 \ Length of SNI extension.
 315 : ext-sni-length ( -- len )
 316         addr-server_name strlen dup if 9 + then ;
 317
 318 \ Length of Maximum Fragment Length extension.
 319 : ext-frag-length ( -- len )
 320         addr-log_max_frag_len get8 14 = if 0 else 5 then ;
 321
 322 \ Test support for RSA signatures.
 323 cc: supports-rsa-sign? ( -- bool ) {
 324         T0_PUSHi(-(CTX->irsavrfy != 0));
 325 }
 326
 327 \ Test support for ECDSA signatures.
 328 cc: supports-ecdsa? ( -- bool ) {
 329         T0_PUSHi(-(CTX->iecdsa != 0));
 330 }
 331
 332 \ Length of Signatures extension.
 333 : ext-signatures-length ( -- len )
 334         supported-hash-functions { x } drop
 335         0
 336         supports-rsa-sign? if x + then
 337         supports-ecdsa? if x + then
 338         dup if 1 << 6 + then ;
 339
 340 \ Write supported hash functions ( sign -- )
 341 : write-hashes
 342         { sign }
 343         supported-hash-functions drop
 344         \ We advertise hash functions in the following preference order:
 345         \   SHA-256 SHA-224 SHA-384 SHA-512 SHA-1
 346         \ Rationale:
 347         \ -- SHA-256 and SHA-224 are more efficient on 32-bit architectures
 348         \ -- SHA-1 is less than ideally collision-resistant
 349         dup 0x10 and if 4 write8 sign write8 then
 350         dup 0x08 and if 3 write8 sign write8 then
 351         dup 0x20 and if 5 write8 sign write8 then
 352         dup 0x40 and if 6 write8 sign write8 then
 353         0x04 and if 2 write8 sign write8 then ;
 354
 355 \ Length of Supported Curves extension.
 356 : ext-supported-curves-length ( -- len )
 357         supported-curves dup if
 358                 0 { x }
 359                 begin dup while
 360                         dup 1 and x + >x
 361                         1 >>
 362                 repeat
 363                 drop x 1 << 6 +
 364         then ;
 365
 366 \ Length of Supported Point Formats extension.
 367 : ext-point-format-length ( -- len )
 368         supported-curves if 6 else 0 then ;
 369
 370 \ Write handshake message: ClientHello
 371 : write-ClientHello ( -- )
 372         { ; total-ext-length }
 373
 374         \ Compute length for extensions (without the general two-byte header).
 375         \ This does not take padding extension into account.
 376         ext-reneg-length ext-sni-length + ext-frag-length +
 377         ext-signatures-length +
 378         ext-supported-curves-length + ext-point-format-length +
 379         >total-ext-length
 380
 381         \ ClientHello type
 382         1 write8
 383
 384         \ Compute and write length
 385         39 addr-session_id_len get8 + addr-suites_num get8 1 << +
 386         total-ext-length if 2+ total-ext-length + then
 387         \ Compute padding (if requested).
 388         addr-min_clienthello_len get16 over - dup 0> if
 389                 \ We well add a Pad ClientHello extension, which has its
 390                 \ own header (4 bytes) and might be the only extension
 391                 \ (2 extra bytes for the extension list header).
 392                 total-ext-length ifnot swap 2+ swap 2- then
 393                 \ Account for the extension header.
 394                 4 - dup 0< if drop 0 then
 395                 \ Adjust total extension length.
 396                 dup 4 + total-ext-length + >total-ext-length
 397                 \ Adjust ClientHello length.
 398                 swap 4 + over + swap
 399         else
 400                 drop
 401                 -1
 402         then
 403         { ext-padding-amount }
 404         write24
 405
 406         \ Protocol version
 407         addr-version_max get16 write16
 408
 409         \ Client random
 410         addr-client_random 4 bzero
 411         addr-client_random 4 + 28 mkrand
 412         addr-client_random 32 write-blob
 413
 414         \ Session ID
 415         addr-session_id addr-session_id_len get8 write-blob-head8
 416
 417         \ Supported cipher suites. We also check here that we indeed
 418         \ support all these suites.
 419         addr-suites_num get8 dup 1 << write16
 420         addr-suites_buf swap
 421         begin
 422                 dup while 1-
 423                 over get16
 424                 dup suite-supported? ifnot ERR_BAD_CIPHER_SUITE fail then
 425                 write16
 426                 swap 2+ swap
 427         repeat
 428         2drop
 429
 430         \ Compression methods (only "null" compression)
 431         1 write8 0 write8
 432
 433         \ Extensions
 434         total-ext-length if
 435                 total-ext-length write16
 436                 ext-reneg-length if
 437                         0xFF01 write16          \ extension type (0xFF01)
 438                         addr-saved_finished
 439                         ext-reneg-length 4 - dup write16 \ extension length
 440                         1- write-blob-head8              \ verify data
 441                 then
 442                 ext-sni-length if
 443                         0x0000 write16          \ extension type (0)
 444                         addr-server_name
 445                         ext-sni-length 4 - dup write16 \ extension length
 446                         2 - dup write16                \ ServerNameList length
 447                         0 write8                       \ name type: host_name
 448                         3 - write-blob-head16          \ the name itself
 449                 then
 450                 ext-frag-length if
 451                         0x0001 write16          \ extension type (1)
 452                         0x0001 write16          \ extension length
 453                         addr-log_max_frag_len get8 8 - write8
 454                 then
 455                 ext-signatures-length if
 456                         0x000D write16          \ extension type (13)
 457                         ext-signatures-length 4 - dup write16 \ extension length
 458                         2 - write16             \ list length
 459                         supports-ecdsa? if 3 write-hashes then
 460                         supports-rsa-sign? if 1 write-hashes then
 461                 then
 462                 \ TODO: add an API to specify preference order for curves.
 463                 \ Right now we use increasing id order, which makes P-256
 464                 \ the preferred curve.
 465                 ext-supported-curves-length dup if
 466                         0x000A write16          \ extension type (10)
 467                         4 - dup write16         \ extension length
 468                         2- write16              \ list length
 469                         supported-curves 0
 470                         begin dup 32 < while
 471                                 dup2 >> 1 and if dup write16 then
 472                                 1+
 473                         repeat
 474                         2drop
 475                 else
 476                         drop
 477                 then
 478                 ext-point-format-length if
 479                         0x000B write16          \ extension type (11)
 480                         0x0002 write16          \ extension length
 481                         0x0100 write16          \ value: 1 format: uncompressed
 482                 then
 483                 ext-padding-amount 0< ifnot
 484                         0x0015 write16          \ extension value (21)
 485                         ext-padding-amount
 486                         dup write16             \ extension length
 487                         begin dup while
 488                         1- 0 write8 repeat      \ value (only zeros)
 489                         drop
 490                 then
 491         then
 492         ;
 493
 494 \ =======================================================================
 495
 496 \ Parse server SNI extension. If present, then it should be empty.
 497 : read-server-sni ( lim -- lim )
 498         read16 if ERR_BAD_SNI fail then ;
 499
 500 \ Parse server Max Fragment Length extension. If present, then it should
 501 \ advertise the same length as the client. Note that whether the server
 502 \ sends it or not changes nothing for us: we won't send any record larger
 503 \ than the advertised value anyway, and we will accept incoming records
 504 \ up to our input buffer length.
 505 : read-server-frag ( lim -- lim )
 506         read16 1 = ifnot ERR_BAD_FRAGLEN fail then
 507         read8 8 + addr-log_max_frag_len get8 = ifnot ERR_BAD_FRAGLEN fail then ;
 508
 509 \ Parse server Secure Renegotiation extension. This is called only if
 510 \ the client sent that extension, so we only have two cases to
 511 \ distinguish: first handshake, and renegotiation; in the latter case,
 512 \ we know that the server supports the extension, otherwise the client
 513 \ would not have sent it.
 514 : read-server-reneg ( lim -- lim )
 515         read16
 516         addr-reneg get8 ifnot
 517                 \ "reneg" is 0, so this is a first handshake. The server's
 518                 \ extension MUST be empty. We also learn that the server
 519                 \ supports the extension.
 520                 1 = ifnot ERR_BAD_SECRENEG fail then
 521                 read8 0 = ifnot ERR_BAD_SECRENEG fail then
 522                 2 addr-reneg set8
 523         else
 524                 \ "reneg" is non-zero, and we sent an extension, so it must
 525                 \ be 2 and this is a renegotiation. We must verify that
 526                 \ the extension contents have length exactly 24 bytes and
 527                 \ match the saved client and server "Finished".
 528                 25 = ifnot ERR_BAD_SECRENEG fail then
 529                 read8 24 = ifnot ERR_BAD_SECRENEG fail then
 530                 addr-pad 24 read-blob
 531                 addr-saved_finished addr-pad 24 memcmp ifnot
 532                         ERR_BAD_SECRENEG fail
 533                 then
 534         then ;
 535
 536 \ Save a value in a 16-bit field, or check it in case of session resumption.
 537 : check-resume ( val addr resume -- )
 538         if get16 = ifnot ERR_RESUME_MISMATCH fail then else set16 then ;
 539
 540 cc: DEBUG-BLOB ( addr len -- ) {
 541         extern int printf(const char *fmt, ...);
 542
 543         size_t len = T0_POP();
 544         unsigned char *buf = (unsigned char *)CTX + T0_POP();
 545         size_t u;
 546
 547         printf("BLOB:");
 548         for (u = 0; u < len; u ++) {
 549                 if (u % 16 == 0) {
 550                         printf("\n    ");
 551                 }
 552                 printf(" %02x", buf[u]);
 553         }
 554         printf("\n");
 555 }
 556
 557 \ Parse incoming ServerHello. Returned value is true (-1) on session
 558 \ resumption.
 559 : read-ServerHello ( -- bool )
 560         \ Get header, and check message type.
 561         read-handshake-header 2 = ifnot ERR_UNEXPECTED fail then
 562
 563         \ Get protocol version.
 564         read16 { version }
 565         version addr-version_min get16 < version addr-version_max get16 > or if
 566                 ERR_UNSUPPORTED_VERSION fail
 567         then
 568
 569         \ Enforce chosen version for subsequent records in both directions.
 570         version addr-version_in get16 <> if ERR_BAD_VERSION fail then
 571         version addr-version_out set16
 572
 573         \ Server random.
 574         addr-server_random 32 read-blob
 575
 576         \ The "session resumption" flag.
 577         0 { resume }
 578
 579         \ Session ID.
 580         read8 { idlen }
 581         idlen 32 > if ERR_OVERSIZED_ID fail then
 582         addr-pad idlen read-blob
 583         idlen addr-session_id_len get8 = idlen 0 > and if
 584                 addr-session_id addr-pad idlen memcmp if
 585                         \ Server session ID is non-empty and matches what
 586                         \ we sent, so this is a session resumption.
 587                         -1 >resume
 588                 then
 589         then
 590         addr-session_id addr-pad idlen memcpy
 591         idlen addr-session_id_len set8
 592
 593         \ Record version.
 594         version addr-version resume check-resume
 595
 596         \ Cipher suite. We check that it is part of the list of cipher
 597         \ suites that we advertised.
 598         \ read16 { suite ; found }
 599         \ 0 >found
 600         \ addr-suites_buf dup addr-suites_num get8 1 << +
 601         \ begin dup2 < while
 602         \       2 - dup get16
 603         \       suite = found or >found
 604         \ repeat
 605         \ 2drop found ifnot ERR_BAD_CIPHER_SUITE fail then
 606         read16
 607         dup scan-suite 0< if ERR_BAD_CIPHER_SUITE fail then
 608         addr-cipher_suite resume check-resume
 609
 610         \ Compression method. Should be 0 (no compression).
 611         read8 if ERR_BAD_COMPRESSION fail then
 612
 613         \ Parse extensions (if any). If there is no extension, then the
 614         \ read limit (on the TOS) should be 0 at that point.
 615         dup if
 616                 \ Length of extension list.
 617                 \ message size.
 618                 read16 open-elt
 619
 620                 \ Enumerate extensions. For each of them, check that we
 621                 \ sent an extension of that type, and did not see it
 622                 \ yet; and then process it.
 623                 ext-sni-length { ok-sni }
 624                 ext-reneg-length { ok-reneg }
 625                 ext-frag-length { ok-frag }
 626                 ext-signatures-length { ok-signatures }
 627                 ext-supported-curves-length { ok-curves }
 628                 ext-point-format-length { ok-points }
 629                 begin dup while
 630                         read16
 631                         case
 632                                 \ Server Name Indication. The server may
 633                                 \ send such an extension if it uses the SNI
 634                                 \ from the client, but that "response
 635                                 \ extension" is supposed to be empty.
 636                                 0x0000 of
 637                                         ok-sni ifnot
 638                                                 ERR_EXTRA_EXTENSION fail
 639                                         then
 640                                         0 >ok-sni
 641                                         read-server-sni
 642                                 endof
 643
 644                                 \ Max Frag Length. The contents shall be
 645                                 \ a single byte whose value matches the one
 646                                 \ sent by the client.
 647                                 0x0001 of
 648                                         ok-frag ifnot
 649                                                 ERR_EXTRA_EXTENSION fail
 650                                         then
 651                                         0 >ok-frag
 652                                         read-server-frag
 653                                 endof
 654
 655                                 \ Secure Renegotiation.
 656                                 0xFF01 of
 657                                         ok-reneg ifnot
 658                                                 ERR_EXTRA_EXTENSION fail
 659                                         then
 660                                         0 >ok-reneg
 661                                         read-server-reneg
 662                                 endof
 663
 664                                 \ Signature Algorithms.
 665                                 \ Normally, the server should never send this
 666                                 \ extension (so says RFC 5246 #7.4.1.4.1),
 667                                 \ but some existing servers do.
 668                                 0x000D of
 669                                         ok-signatures ifnot
 670                                                 ERR_EXTRA_EXTENSION fail
 671                                         then
 672                                         0 >ok-signatures
 673                                         read-ignore-16
 674                                 endof
 675
 676                                 \ Supported Curves.
 677                                 0x000A of
 678                                         ok-curves ifnot
 679                                                 ERR_EXTRA_EXTENSION fail
 680                                         then
 681                                         0 >ok-curves
 682                                         read-ignore-16
 683                                 endof
 684
 685                                 \ Supported Point Formats.
 686                                 0x000B of
 687                                         ok-points ifnot
 688                                                 ERR_EXTRA_EXTENSION fail
 689                                         then
 690                                         0 >ok-points
 691                                         read-ignore-16
 692                                 endof
 693
 694                                 ERR_EXTRA_EXTENSION fail
 695                         endcase
 696                 repeat
 697
 698                 \ If we sent a secure renegotiation extension but did not
 699                 \ receive a response, then the server does not support
 700                 \ secure renegotiation. This is a hard failure if this
 701                 \ is a renegotiation.
 702                 ok-reneg if
 703                         ok-reneg 5 > if ERR_BAD_SECRENEG fail then
 704                         1 addr-reneg set8
 705                 then
 706                 close-elt
 707         then
 708         close-elt
 709         resume
 710         ;
 711
 712 cc: x509-start-chain ( expected-key-type -- ) {
 713         const br_x509_class *xc;
 714
 715         xc = *(ENG->x509ctx);
 716         xc->start_chain(ENG->x509ctx, T0_POP(), ENG->server_name);
 717 }
 718
 719 cc: x509-start-cert ( length -- ) {
 720         const br_x509_class *xc;
 721
 722         xc = *(ENG->x509ctx);
 723         xc->start_cert(ENG->x509ctx, T0_POP());
 724 }
 725
 726 cc: x509-append ( length -- ) {
 727         const br_x509_class *xc;
 728         size_t len;
 729
 730         xc = *(ENG->x509ctx);
 731         len = T0_POP();
 732         xc->append(ENG->x509ctx, ENG->pad, len);
 733 }
 734
 735 cc: x509-end-cert ( -- ) {
 736         const br_x509_class *xc;
 737
 738         xc = *(ENG->x509ctx);
 739         xc->end_cert(ENG->x509ctx);
 740 }
 741
 742 cc: x509-end-chain ( -- err ) {
 743         const br_x509_class *xc;
 744
 745         xc = *(ENG->x509ctx);
 746         T0_PUSH(xc->end_chain(ENG->x509ctx));
 747 }
 748
 749 \ Parse Certificate
 750 : read-Certificate ( -- )
 751         \ Get header, and check message type.
 752         read-handshake-header 11 = ifnot ERR_UNEXPECTED fail then
 753
 754         \ Start processing the chain through the X.509 engine.
 755         addr-cipher_suite get16 expected-key-type
 756         x509-start-chain
 757
 758         \ Total chain length is a 24-bit integer.
 759         read24 open-elt
 760         begin
 761                 dup while
 762                 read24 open-elt
 763                 dup x509-start-cert
 764
 765                 \ We read the certificate by chunks through the pad, so
 766                 \ as to use the existing reading function (read-blob)
 767                 \ that also ensures proper hashing.
 768                 begin
 769                         dup while
 770                         dup 256 > if 256 else dup then { len }
 771                         addr-pad len read-blob
 772                         len x509-append
 773                 repeat
 774                 close-elt
 775                 x509-end-cert
 776         repeat
 777
 778         \ We must close the chain AND the handshake message.
 779         close-elt
 780         close-elt
 781
 782         \ Chain processing is finished; get the error code.
 783         x509-end-chain
 784         dup if fail then drop
 785         ;
 786
 787 \ Verify signature on ECDHE point sent by the server.
 788 \   'hash' is the hash function to use (1 to 6, or 0 for RSA with MD5+SHA-1)
 789 \   'use-rsa' is 0 for ECDSA, -1 for for RSA
 790 \   'sig-len' is the signature length (in bytes)
 791 \ The signature itself is in the pad.
 792 cc: verify-SKE-sig ( hash use-rsa sig-len -- err ) {
 793         size_t sig_len = T0_POP();
 794         int use_rsa = T0_POPi();
 795         int hash = T0_POPi();
 796
 797         T0_PUSH(verify_SKE_sig(CTX, hash, use_rsa, sig_len));
 798 }
 799
 800 \ Parse ServerKeyExchange
 801 : read-ServerKeyExchange ( -- )
 802         \ Get header, and check message type.
 803         read-handshake-header 12 = ifnot ERR_UNEXPECTED fail then
 804
 805         \ We expect a named curve, and we must support it.
 806         read8 3 = ifnot ERR_INVALID_ALGORITHM fail then
 807         read16 dup addr-ecdhe_curve set8
 808         dup 32 >= if ERR_INVALID_ALGORITHM fail then
 809         supported-curves swap >> 1 and ifnot ERR_INVALID_ALGORITHM fail then
 810
 811         \ Read the server point.
 812         read8
 813         dup 133 > if ERR_INVALID_ALGORITHM fail then
 814         dup addr-ecdhe_point_len set8
 815         addr-ecdhe_point swap read-blob
 816
 817         \ If using TLS-1.2+, then the hash function and signature algorithm
 818         \ are explicitly provided; the signature algorithm must match what
 819         \ the cipher suite specifies. With TLS-1.0 and 1.1, the signature
 820         \ algorithm is inferred from the cipher suite, and the hash is
 821         \ either MD5+SHA-1 (for RSA signatures) or SHA-1 (for ECDSA).
 822         addr-version get16 0x0303 >= { tls1.2+ }
 823         addr-cipher_suite get16 use-rsa-ecdhe? { use-rsa }
 824         2 { hash }
 825         tls1.2+ if
 826                 \ Read hash function; accept only the SHA-* identifiers
 827                 \ (from SHA-1 to SHA-512, no MD5 here).
 828                 read8
 829                 dup dup 2 < swap 6 > or if ERR_INVALID_ALGORITHM fail then
 830                 >hash
 831                 read8
 832                 \ Get expected signature algorithm and compare with what
 833                 \ the server just sent. Expected value is 1 for RSA, 3
 834                 \ for ECDSA. Note that 'use-rsa' evaluates to -1 for RSA,
 835                 \ 0 for ECDSA.
 836                 use-rsa 1 << 3 + = ifnot ERR_INVALID_ALGORITHM fail then
 837         else
 838                 \ For MD5+SHA-1, we set 'hash' to 0.
 839                 use-rsa if 0 >hash then
 840         then
 841
 842         \ Read signature into the pad.
 843         read16 dup { sig-len }
 844
 845         dup 512 > if ERR_LIMIT_EXCEEDED fail then
 846         addr-pad swap read-blob
 847
 848         \ Verify signature.
 849         hash use-rsa sig-len verify-SKE-sig
 850         dup if fail then drop
 851
 852         close-elt ;
 853
 854 \ Parse CertificateRequest. Header has already been read.
 855 : read-contents-CertificateRequest ( lim -- )
 856         \ TODO: implement client certificates. Right now, we simply
 857         \ drop the complete message.
 858         begin dup while read8 drop repeat drop ;
 859
 860 \ Write an empty Certificate message.
 861 : write-empty-Certificate ( -- )
 862         11 write8 3 write24 0 write24 ;
 863
 864 cc: do-rsa-encrypt ( prf_id -- nlen ) {
 865         int x;
 866
 867         x = make_pms_rsa(CTX, T0_POP());
 868         if (x < 0) {
 869                 br_ssl_engine_fail(ENG, -x);
 870                 T0_CO();
 871         } else {
 872                 T0_PUSH(x);
 873         }
 874 }
 875
 876 cc: do-ecdh ( echde prf_id -- ulen ) {
 877         unsigned prf_id = T0_POP();
 878         unsigned ecdhe = T0_POP();
 879         int x;
 880
 881         x = make_pms_ecdh(CTX, ecdhe, prf_id);
 882         if (x < 0) {
 883                 br_ssl_engine_fail(ENG, -x);
 884                 T0_CO();
 885         } else {
 886                 T0_PUSH(x);
 887         }
 888 }
 889
 890 \ Write ClientKeyExchange
 891 : write-ClientKeyExchange ( -- )
 892         16 write8
 893         addr-cipher_suite get16
 894         dup use-rsa-keyx? if
 895                 prf-id do-rsa-encrypt
 896                 dup 2+ write24
 897                 dup write16
 898                 addr-pad swap write-blob
 899         else
 900                 dup use-ecdhe? swap prf-id do-ecdh
 901                 dup 1+ write24
 902                 dup write8
 903                 addr-pad swap write-blob
 904         then ;
 905
 906 \ =======================================================================
 907
 908 \ Perform a handshake.
 909 : do-handshake ( -- )
 910         0 addr-application_data set8
 911         22 addr-record_type_out set8
 912         multihash-init
 913
 914         write-ClientHello
 915         flush-record
 916         read-ServerHello
 917
 918         if
 919                 \ Session resumption.
 920                 -1 read-CCS-Finished
 921                 -1 write-CCS-Finished
 922
 923         else
 924
 925                 \ Not a session resumption.
 926
 927                 read-Certificate
 928
 929                 \ Depending on cipher suite, we may now expect a
 930                 \ ServerKeyExchange.
 931                 addr-cipher_suite get16 expected-key-type
 932                 CX 0 63 { BR_KEYTYPE_SIGN } and if
 933                         read-ServerKeyExchange
 934                 then
 935
 936                 \ Get next header.
 937                 read-handshake-header
 938
 939                 \ If this is a CertificateRequest, parse it, then read
 940                 \ next header.
 941                 dup 13 = if
 942                         drop read-contents-CertificateRequest
 943                         read-handshake-header
 944                         -1
 945                 else
 946                         0
 947                 then
 948                 { seen-CR }
 949
 950                 \ At that point, we should have a ServerHelloDone,
 951                 \ whose length must be 0.
 952                 14 = ifnot ERR_UNEXPECTED fail then
 953                 if ERR_BAD_HELLO_DONE fail then
 954
 955                 \ There should not be more bytes in the record at that point.
 956                 more-incoming-bytes? if ERR_UNEXPECTED fail then
 957
 958                 seen-CR if
 959                         \ TODO: client certificate support.
 960                         write-empty-Certificate
 961                 then
 962                 write-ClientKeyExchange
 963
 964                 \ TODO: CertificateVerify
 965
 966                 -1 write-CCS-Finished
 967                 -1 read-CCS-Finished
 968         then
 969
 970         \ Now we should be invoked only in case of renegotiation.
 971         1 addr-application_data set8
 972         23 addr-record_type_out set8 ;
 973
 974 \ Read a HelloRequest message.
 975 : read-HelloRequest ( -- )
 976         \ A HelloRequest has length 0 and type 0.
 977         read-handshake-header-core
 978         if ERR_UNEXPECTED fail then
 979         if ERR_BAD_HANDSHAKE fail then ;
 980
 981 \ Entry point.
 982 : main ( -- ! )
 983         \ Perform initial handshake.
 984         do-handshake
 985
 986         begin
 987                 \ Wait for further invocation. At that point, we should
 988                 \ get either an explicit call for renegotiation, or
 989                 \ an incoming HelloRequest handshake message.
 990                 wait-co
 991                 dup 0x07 and case
 992                         0x00 of
 993                                 0x10 and if
 994                                         do-handshake
 995                                 then
 996                         endof
 997                         0x01 of
 998                                 drop
 999                                 0 addr-application_data set8
1000                                 read-HelloRequest
1001                                 \ Reject renegotiations if the peer does not
1002                                 \ support secure renegotiation, or if the
1003                                 \ "no renegotiation" flag is set.
1004                                 addr-reneg get8 1 = 1 flag? or if
1005                                         flush-record
1006                                         begin can-output? not while
1007                                                 wait-co drop
1008                                         repeat
1009                                         100 send-warning
1010                                 else
1011                                         do-handshake
1012                                 then
1013                         endof
1014                         ERR_UNEXPECTED fail
1015                 endcase
1016         again
1017         ;