_ Git - BearSSL/blob - src/ssl/ssl_hs_client.t0

   1 \ Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
   2 \
   3 \ Permission is hereby granted, free of charge, to any person obtaining
   4 \ a copy of this software and associated documentation files (the
   5 \ "Software"), to deal in the Software without restriction, including
   6 \ without limitation the rights to use, copy, modify, merge, publish,
   7 \ distribute, sublicense, and/or sell copies of the Software, and to
   8 \ permit persons to whom the Software is furnished to do so, subject to
   9 \ the following conditions:
  10 \
  11 \ The above copyright notice and this permission notice shall be
  12 \ included in all copies or substantial portions of the Software.
  13 \
  14 \ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  15 \ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  16 \ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  17 \ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
  18 \ BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
  19 \ ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  20 \ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  21 \ SOFTWARE.
  22
  23 \ ----------------------------------------------------------------------
  24 \ Handshake processing code, for the client.
  25 \ The common T0 code (ssl_hs_common.t0) shall be read first.
  26
  27 preamble {
  28
  29 /*
  30  * This macro evaluates to a pointer to the client context, under that
  31  * specific name. It must be noted that since the engine context is the
  32  * first field of the br_ssl_client_context structure ('eng'), then
  33  * pointers values of both types are interchangeable, modulo an
  34  * appropriate cast. This also means that "adresses" computed as offsets
  35  * within the structure work for both kinds of context.
  36  */
  37 #define CTX  ((br_ssl_client_context *)ENG)
  38
  39 /*
  40  * Generate the pre-master secret for RSA key exchange, and encrypt it
  41  * with the server's public key. Returned value is either the encrypted
  42  * data length (in bytes), or -x on error, with 'x' being an error code.
  43  *
  44  * This code assumes that the public key has been already verified (it
  45  * was properly obtained by the X.509 engine, and it has the right type,
  46  * i.e. it is of type RSA and suitable for encryption).
  47  */
  48 static int
  49 make_pms_rsa(br_ssl_client_context *ctx, int prf_id)
  50 {
  51         const br_x509_class **xc;
  52         const br_x509_pkey *pk;
  53         const unsigned char *n;
  54         unsigned char *pms;
  55         size_t nlen, u;
  56
  57         xc = ctx->eng.x509ctx;
  58         pk = (*xc)->get_pkey(xc);
  59
  60         /*
  61          * Compute actual RSA key length, in case there are leading zeros.
  62          */
  63         n = pk->key.rsa.n;
  64         nlen = pk->key.rsa.nlen;
  65         while (nlen > 0 && *n == 0) {
  66                 n ++;
  67                 nlen --;
  68         }
  69
  70         /*
  71          * We need at least 59 bytes (48 bytes for pre-master secret, and
  72          * 11 bytes for the PKCS#1 type 2 padding). Note that the X.509
  73          * minimal engine normally blocks RSA keys shorter than 128 bytes,
  74          * so this is mostly for public keys provided explicitly by the
  75          * caller.
  76          */
  77         if (nlen < 59) {
  78                 return -BR_ERR_X509_WEAK_PUBLIC_KEY;
  79         }
  80         if (nlen > sizeof ctx->eng.pad) {
  81                 return -BR_ERR_LIMIT_EXCEEDED;
  82         }
  83
  84         /*
  85          * Make PMS.
  86          */
  87         pms = ctx->eng.pad + nlen - 48;
  88         br_enc16be(pms, ctx->eng.version_max);
  89         br_hmac_drbg_generate(&ctx->eng.rng, pms + 2, 46);
  90         br_ssl_engine_compute_master(&ctx->eng, prf_id, pms, 48);
  91
  92         /*
  93          * Apply PKCS#1 type 2 padding.
  94          */
  95         ctx->eng.pad[0] = 0x00;
  96         ctx->eng.pad[1] = 0x02;
  97         ctx->eng.pad[nlen - 49] = 0x00;
  98         br_hmac_drbg_generate(&ctx->eng.rng, ctx->eng.pad + 2, nlen - 51);
  99         for (u = 2; u < nlen - 49; u ++) {
 100                 while (ctx->eng.pad[u] == 0) {
 101                         br_hmac_drbg_generate(&ctx->eng.rng,
 102                                 &ctx->eng.pad[u], 1);
 103                 }
 104         }
 105
 106         /*
 107          * Compute RSA encryption.
 108          */
 109         if (!ctx->irsapub(ctx->eng.pad, nlen, &pk->key.rsa)) {
 110                 return -BR_ERR_LIMIT_EXCEEDED;
 111         }
 112         return (int)nlen;
 113 }
 114
 115 /*
 116  * OID for hash functions in RSA signatures.
 117  */
 118 static const unsigned char HASH_OID_SHA1[] = {
 119         0x05, 0x2B, 0x0E, 0x03, 0x02, 0x1A
 120 };
 121
 122 static const unsigned char HASH_OID_SHA224[] = {
 123         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x04
 124 };
 125
 126 static const unsigned char HASH_OID_SHA256[] = {
 127         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01
 128 };
 129
 130 static const unsigned char HASH_OID_SHA384[] = {
 131         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x02
 132 };
 133
 134 static const unsigned char HASH_OID_SHA512[] = {
 135         0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x03
 136 };
 137
 138 static const unsigned char *HASH_OID[] = {
 139         HASH_OID_SHA1,
 140         HASH_OID_SHA224,
 141         HASH_OID_SHA256,
 142         HASH_OID_SHA384,
 143         HASH_OID_SHA512
 144 };
 145
 146 /*
 147  * Check the RSA signature on the ServerKeyExchange message.
 148  *   hash      hash function ID (2 to 6), or 0 for MD5+SHA-1 (with RSA only)
 149  *   use_rsa   non-zero for RSA signature, zero for ECDSA
 150  *   sig_len   signature length (in bytes); signature value is in the pad
 151  * Returned value is 0 on success, or an error code.
 152  */
 153 static int
 154 verify_SKE_sig(br_ssl_client_context *ctx,
 155         int hash, int use_rsa, size_t sig_len)
 156 {
 157         const br_x509_class **xc;
 158         const br_x509_pkey *pk;
 159         br_multihash_context mhc;
 160         unsigned char hv[64], head[4];
 161         size_t hv_len;
 162
 163         xc = ctx->eng.x509ctx;
 164         pk = (*xc)->get_pkey(xc);
 165         br_multihash_zero(&mhc);
 166         br_multihash_copyimpl(&mhc, &ctx->eng.mhash);
 167         br_multihash_init(&mhc);
 168         br_multihash_update(&mhc,
 169                 ctx->eng.client_random, sizeof ctx->eng.client_random);
 170         br_multihash_update(&mhc,
 171                 ctx->eng.server_random, sizeof ctx->eng.server_random);
 172         head[0] = 3;
 173         head[1] = 0;
 174         head[2] = ctx->eng.ecdhe_curve;
 175         head[3] = ctx->eng.ecdhe_point_len;
 176         br_multihash_update(&mhc, head, sizeof head);
 177         br_multihash_update(&mhc,
 178                 ctx->eng.ecdhe_point, ctx->eng.ecdhe_point_len);
 179         if (hash) {
 180                 hv_len = br_multihash_out(&mhc, hash, hv);
 181                 if (hv_len == 0) {
 182                         return BR_ERR_INVALID_ALGORITHM;
 183                 }
 184         } else {
 185                 if (!br_multihash_out(&mhc, br_md5_ID, hv)
 186                         || !br_multihash_out(&mhc, br_sha1_ID, hv + 16))
 187                 {
 188                         return BR_ERR_INVALID_ALGORITHM;
 189                 }
 190                 hv_len = 36;
 191         }
 192         if (use_rsa) {
 193                 unsigned char tmp[64];
 194                 const unsigned char *hash_oid;
 195
 196                 if (hash) {
 197                         hash_oid = HASH_OID[hash - 2];
 198                 } else {
 199                         hash_oid = NULL;
 200                 }
 201                 if (!ctx->irsavrfy(ctx->eng.pad, sig_len,
 202                         hash_oid, hv_len, &pk->key.rsa, tmp)
 203                         || memcmp(tmp, hv, hv_len) != 0)
 204                 {
 205                         return BR_ERR_BAD_SIGNATURE;
 206                 }
 207         } else {
 208                 if (!ctx->iecdsa(ctx->eng.iec, hv, hv_len, &pk->key.ec,
 209                         ctx->eng.pad, sig_len))
 210                 {
 211                         return BR_ERR_BAD_SIGNATURE;
 212                 }
 213         }
 214         return 0;
 215 }
 216
 217 /*
 218  * Perform client-size ECDH (or ECDHE). The point that should be sent to
 219  * the server is written in the pad; returned value is either the point
 220  * length (in bytes), or -x on error, with 'x' being an error code.
 221  *
 222  * The point _from_ the server is taken from ecdhe_point[] if 'ecdhe'
 223  * is non-zero, or from the X.509 engine context if 'ecdhe' is zero
 224  * (for static ECDH).
 225  */
 226 static int
 227 make_pms_ecdh(br_ssl_client_context *ctx, unsigned ecdhe, int prf_id)
 228 {
 229         int curve;
 230         unsigned char key[66], point[133];
 231         const unsigned char *generator, *order, *point_src;
 232         size_t glen, olen, point_len;
 233         unsigned char mask;
 234
 235         if (ecdhe) {
 236                 curve = ctx->eng.ecdhe_curve;
 237                 point_src = ctx->eng.ecdhe_point;
 238                 point_len = ctx->eng.ecdhe_point_len;
 239         } else {
 240                 const br_x509_class **xc;
 241                 const br_x509_pkey *pk;
 242
 243                 xc = ctx->eng.x509ctx;
 244                 pk = (*xc)->get_pkey(xc);
 245                 curve = pk->key.ec.curve;
 246                 point_src = pk->key.ec.q;
 247                 point_len = pk->key.ec.qlen;
 248         }
 249         if ((ctx->eng.iec->supported_curves & ((uint32_t)1 << curve)) == 0) {
 250                 return -BR_ERR_INVALID_ALGORITHM;
 251         }
 252
 253         /*
 254          * We need to generate our key, as a non-zero random value which
 255          * is lower than the curve order, in a "large enough" range. We
 256          * force top bit to 0 and bottom bit to 1, which guarantees that
 257          * the value is in the proper range.
 258          */
 259         order = ctx->eng.iec->order(curve, &olen);
 260         mask = 0xFF;
 261         while (mask >= order[0]) {
 262                 mask >>= 1;
 263         }
 264         br_hmac_drbg_generate(&ctx->eng.rng, key, olen);
 265         key[0] &= mask;
 266         key[olen - 1] |= 0x01;
 267
 268         /*
 269          * Compute the common ECDH point, whose X coordinate is the
 270          * pre-master secret.
 271          */
 272         generator = ctx->eng.iec->generator(curve, &glen);
 273         if (glen != point_len) {
 274                 return -BR_ERR_INVALID_ALGORITHM;
 275         }
 276
 277         memcpy(point, point_src, glen);
 278         if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
 279                 return -BR_ERR_INVALID_ALGORITHM;
 280         }
 281
 282         /*
 283          * The pre-master secret is the X coordinate.
 284          */
 285         br_ssl_engine_compute_master(&ctx->eng, prf_id, point + 1, glen >> 1);
 286
 287         memcpy(point, generator, glen);
 288         if (!ctx->eng.iec->mul(point, glen, key, olen, curve)) {
 289                 return -BR_ERR_INVALID_ALGORITHM;
 290         }
 291         memcpy(ctx->eng.pad, point, glen);
 292         return (int)glen;
 293 }
 294
 295 }
 296
 297 \ =======================================================================
 298
 299 : addr-ctx:
 300         next-word { field }
 301         "addr-" field + 0 1 define-word
 302         0 8191 "offsetof(br_ssl_client_context, " field + ")" + make-CX
 303         postpone literal postpone ; ;
 304
 305 \ Length of the Secure Renegotiation extension. This is 5 for the
 306 \ first handshake, 17 for a renegotiation (if the server supports the
 307 \ extension), or 0 if we know that the server does not support the
 308 \ extension.
 309 : ext-reneg-length ( -- n )
 310         addr-reneg get8 dup if 1 - 17 * else drop 5 then ;
 311
 312 \ Length of SNI extension.
 313 : ext-sni-length ( -- len )
 314         addr-server_name strlen dup if 9 + then ;
 315
 316 \ Length of Maximum Fragment Length extension.
 317 : ext-frag-length ( -- len )
 318         addr-log_max_frag_len get8 14 = if 0 else 5 then ;
 319
 320 \ Test support for RSA signatures.
 321 cc: supports-rsa-sign? ( -- bool ) {
 322         T0_PUSHi(-(CTX->irsavrfy != 0));
 323 }
 324
 325 \ Test support for ECDSA signatures.
 326 cc: supports-ecdsa? ( -- bool ) {
 327         T0_PUSHi(-(CTX->iecdsa != 0));
 328 }
 329
 330 \ Length of Signatures extension.
 331 : ext-signatures-length ( -- len )
 332         supported-hash-functions { x } drop
 333         0
 334         supports-rsa-sign? if x + then
 335         supports-ecdsa? if x + then
 336         dup if 1 << 6 + then ;
 337
 338 \ Write supported hash functions ( sign -- )
 339 : write-hashes
 340         { sign }
 341         supported-hash-functions drop
 342         \ We advertise hash functions in the following preference order:
 343         \   SHA-256 SHA-224 SHA-384 SHA-512 SHA-1
 344         \ Rationale:
 345         \ -- SHA-256 and SHA-224 are more efficient on 32-bit architectures
 346         \ -- SHA-1 is less than ideally collision-resistant
 347         dup 0x10 and if 4 write8 sign write8 then
 348         dup 0x08 and if 3 write8 sign write8 then
 349         dup 0x20 and if 5 write8 sign write8 then
 350         dup 0x40 and if 6 write8 sign write8 then
 351         0x04 and if 2 write8 sign write8 then ;
 352
 353 \ Length of Supported Curves extension.
 354 : ext-supported-curves-length ( -- len )
 355         supported-curves dup if
 356                 0 { x }
 357                 begin dup while
 358                         dup 1 and x + >x
 359                         1 >>
 360                 repeat
 361                 drop x 1 << 6 +
 362         then ;
 363
 364 \ Length of Supported Point Formats extension.
 365 : ext-point-format-length ( -- len )
 366         supported-curves if 6 else 0 then ;
 367
 368 \ Write handshake message: ClientHello
 369 : write-ClientHello ( -- )
 370         { ; total-ext-length }
 371
 372         \ Compute length for extensions (without the general two-byte header)
 373         ext-reneg-length ext-sni-length + ext-frag-length +
 374         ext-signatures-length +
 375         ext-supported-curves-length + ext-point-format-length +
 376         >total-ext-length
 377
 378         \ ClientHello type
 379         1 write8
 380
 381         \ Compute and write length
 382         39 addr-session_id_len get8 + addr-suites_num get8 1 << +
 383         total-ext-length if 2+ total-ext-length + then
 384         write24
 385
 386         \ Protocol version
 387         addr-version_max get16 write16
 388
 389         \ Client random
 390         addr-client_random 4 bzero
 391         addr-client_random 4 + 28 mkrand
 392         addr-client_random 32 write-blob
 393
 394         \ Session ID
 395         addr-session_id addr-session_id_len get8 write-blob-head8
 396
 397         \ Supported cipher suites. We also check here that we indeed
 398         \ support all these suites.
 399         addr-suites_num get8 dup 1 << write16
 400         addr-suites_buf swap
 401         begin
 402                 dup while 1-
 403                 over get16
 404                 dup suite-supported? ifnot ERR_BAD_CIPHER_SUITE fail then
 405                 write16
 406                 swap 2+ swap
 407         repeat
 408         2drop
 409
 410         \ Compression methods (only "null" compression)
 411         1 write8 0 write8
 412
 413         \ Extensions
 414         total-ext-length if
 415                 total-ext-length write16
 416                 ext-reneg-length if
 417                         0xFF01 write16          \ extension type (0xFF01)
 418                         addr-saved_finished
 419                         ext-reneg-length 4 - dup write16 \ extension length
 420                         1- write-blob-head8              \ verify data
 421                 then
 422                 ext-sni-length if
 423                         0x0000 write16          \ extension type (0)
 424                         addr-server_name
 425                         ext-sni-length 4 - dup write16 \ extension length
 426                         2 - dup write16                \ ServerNameList length
 427                         0 write8                       \ name type: host_name
 428                         3 - write-blob-head16          \ the name itself
 429                 then
 430                 ext-frag-length if
 431                         0x0001 write16          \ extension type (1)
 432                         0x0001 write16          \ extension length
 433                         addr-log_max_frag_len get8 8 - write8
 434                 then
 435                 ext-signatures-length if
 436                         0x000D write16          \ extension type (13)
 437                         ext-signatures-length 4 - dup write16 \ extension length
 438                         2 - write16             \ list length
 439                         supports-ecdsa? if 3 write-hashes then
 440                         supports-rsa-sign? if 1 write-hashes then
 441                 then
 442                 \ TODO: add an API to specify preference order for curves.
 443                 \ Right now we use increasing id order, which makes P-256
 444                 \ the preferred curve.
 445                 ext-supported-curves-length dup if
 446                         0x000A write16          \ extension type (10)
 447                         4 - dup write16         \ extension length
 448                         2- write16              \ list length
 449                         supported-curves 0
 450                         begin dup 32 < while
 451                                 dup2 >> 1 and if dup write16 then
 452                                 1+
 453                         repeat
 454                         2drop
 455                 else
 456                         drop
 457                 then
 458                 ext-point-format-length if
 459                         0x000B write16          \ extension type (11)
 460                         0x0002 write16          \ extension length
 461                         0x0100 write16          \ value: 1 format: uncompressed
 462                 then
 463         then
 464         ;
 465
 466 \ =======================================================================
 467
 468 \ Parse server SNI extension. If present, then it should be empty.
 469 : read-server-sni ( lim -- lim )
 470         read16 if ERR_BAD_SNI fail then ;
 471
 472 \ Parse server Max Fragment Length extension. If present, then it should
 473 \ advertise the same length as the client. Note that whether the server
 474 \ sends it or not changes nothing for us: we won't send any record larger
 475 \ than the advertised value anyway, and we will accept incoming records
 476 \ up to our input buffer length.
 477 : read-server-frag ( lim -- lim )
 478         read16 1 = ifnot ERR_BAD_FRAGLEN fail then
 479         read8 8 + addr-log_max_frag_len get8 = ifnot ERR_BAD_FRAGLEN fail then ;
 480
 481 \ Parse server Secure Renegotiation extension. This is called only if
 482 \ the client sent that extension, so we only have two cases to
 483 \ distinguish: first handshake, and renegotiation; in the latter case,
 484 \ we know that the server supports the extension, otherwise the client
 485 \ would not have sent it.
 486 : read-server-reneg ( lim -- lim )
 487         read16
 488         addr-reneg get8 ifnot
 489                 \ "reneg" is 0, so this is a first handshake. The server's
 490                 \ extension MUST be empty. We also learn that the server
 491                 \ supports the extension.
 492                 1 = ifnot ERR_BAD_SECRENEG fail then
 493                 read8 0 = ifnot ERR_BAD_SECRENEG fail then
 494                 2 addr-reneg set8
 495         else
 496                 \ "reneg" is non-zero, and we sent an extension, so it must
 497                 \ be 2 and this is a renegotiation. We must verify that
 498                 \ the extension contents have length exactly 24 bytes and
 499                 \ match the saved client and server "Finished".
 500                 25 = ifnot ERR_BAD_SECRENEG fail then
 501                 read8 24 = ifnot ERR_BAD_SECRENEG fail then
 502                 addr-pad 24 read-blob
 503                 addr-saved_finished addr-pad 24 memcmp ifnot
 504                         ERR_BAD_SECRENEG fail
 505                 then
 506         then ;
 507
 508 \ Save a value in a 16-bit field, or check it in case of session resumption.
 509 : check-resume ( val addr resume -- )
 510         if get16 = ifnot ERR_RESUME_MISMATCH fail then else set16 then ;
 511
 512 cc: DEBUG-BLOB ( addr len -- ) {
 513         extern int printf(const char *fmt, ...);
 514
 515         size_t len = T0_POP();
 516         unsigned char *buf = (unsigned char *)CTX + T0_POP();
 517         size_t u;
 518
 519         printf("BLOB:");
 520         for (u = 0; u < len; u ++) {
 521                 if (u % 16 == 0) {
 522                         printf("\n    ");
 523                 }
 524                 printf(" %02x", buf[u]);
 525         }
 526         printf("\n");
 527 }
 528
 529 \ Parse incoming ServerHello. Returned value is true (-1) on session
 530 \ resumption.
 531 : read-ServerHello ( -- bool )
 532         \ Get header, and check message type.
 533         read-handshake-header 2 = ifnot ERR_UNEXPECTED fail then
 534
 535         \ Get protocol version.
 536         read16 { version }
 537         version addr-version_min get16 < version addr-version_max get16 > or if
 538                 ERR_UNSUPPORTED_VERSION fail
 539         then
 540
 541         \ Enforce chosen version for subsequent records in both directions.
 542         version addr-version_in get16 <> if ERR_BAD_VERSION fail then
 543         version addr-version_out set16
 544
 545         \ Server random.
 546         addr-server_random 32 read-blob
 547
 548         \ The "session resumption" flag.
 549         0 { resume }
 550
 551         \ Session ID.
 552         read8 { idlen }
 553         idlen 32 > if ERR_OVERSIZED_ID fail then
 554         addr-pad idlen read-blob
 555         idlen addr-session_id_len get8 = idlen 0 > and if
 556                 addr-session_id addr-pad idlen memcmp if
 557                         \ Server session ID is non-empty and matches what
 558                         \ we sent, so this is a session resumption.
 559                         -1 >resume
 560                 then
 561         then
 562         addr-session_id addr-pad idlen memcpy
 563         idlen addr-session_id_len set8
 564
 565         \ Record version.
 566         version addr-version resume check-resume
 567
 568         \ Cipher suite. We check that it is part of the list of cipher
 569         \ suites that we advertised.
 570         \ read16 { suite ; found }
 571         \ 0 >found
 572         \ addr-suites_buf dup addr-suites_num get8 1 << +
 573         \ begin dup2 < while
 574         \       2 - dup get16
 575         \       suite = found or >found
 576         \ repeat
 577         \ 2drop found ifnot ERR_BAD_CIPHER_SUITE fail then
 578         read16
 579         dup scan-suite 0< if ERR_BAD_CIPHER_SUITE fail then
 580         addr-cipher_suite resume check-resume
 581
 582         \ Compression method. Should be 0 (no compression).
 583         read8 if ERR_BAD_COMPRESSION fail then
 584
 585         \ Parse extensions (if any). If there is no extension, then the
 586         \ read limit (on the TOS) should be 0 at that point.
 587         dup if
 588                 \ Length of extension list.
 589                 \ message size.
 590                 read16 open-elt
 591
 592                 \ Enumerate extensions. For each of them, check that we
 593                 \ sent an extension of that type, and did not see it
 594                 \ yet; and then process it.
 595                 ext-sni-length { ok-sni }
 596                 ext-reneg-length { ok-reneg }
 597                 ext-frag-length { ok-frag }
 598                 ext-signatures-length { ok-signatures }
 599                 ext-supported-curves-length { ok-curves }
 600                 ext-point-format-length { ok-points }
 601                 begin dup while
 602                         read16
 603                         case
 604                                 \ Server Name Indication. The server may
 605                                 \ send such an extension if it uses the SNI
 606                                 \ from the client, but that "response
 607                                 \ extension" is supposed to be empty.
 608                                 0x0000 of
 609                                         ok-sni ifnot
 610                                                 ERR_EXTRA_EXTENSION fail
 611                                         then
 612                                         0 >ok-sni
 613                                         read-server-sni
 614                                 endof
 615
 616                                 \ Max Frag Length. The contents shall be
 617                                 \ a single byte whose value matches the one
 618                                 \ sent by the client.
 619                                 0x0001 of
 620                                         ok-frag ifnot
 621                                                 ERR_EXTRA_EXTENSION fail
 622                                         then
 623                                         0 >ok-frag
 624                                         read-server-frag
 625                                 endof
 626
 627                                 \ Secure Renegotiation.
 628                                 0xFF01 of
 629                                         ok-reneg ifnot
 630                                                 ERR_EXTRA_EXTENSION fail
 631                                         then
 632                                         0 >ok-reneg
 633                                         read-server-reneg
 634                                 endof
 635
 636                                 \ Signature Algorithms.
 637                                 \ Normally, the server should never send this
 638                                 \ extension (so says RFC 5246 #7.4.1.4.1),
 639                                 \ but some existing servers do.
 640                                 0x000D of
 641                                         ok-signatures ifnot
 642                                                 ERR_EXTRA_EXTENSION fail
 643                                         then
 644                                         0 >ok-signatures
 645                                         read-ignore-16
 646                                 endof
 647
 648                                 \ Supported Curves.
 649                                 0x000A of
 650                                         ok-curves ifnot
 651                                                 ERR_EXTRA_EXTENSION fail
 652                                         then
 653                                         0 >ok-curves
 654                                         read-ignore-16
 655                                 endof
 656
 657                                 \ Supported Point Formats.
 658                                 0x000B of
 659                                         ok-points ifnot
 660                                                 ERR_EXTRA_EXTENSION fail
 661                                         then
 662                                         0 >ok-points
 663                                         read-ignore-16
 664                                 endof
 665
 666                                 ERR_EXTRA_EXTENSION fail
 667                         endcase
 668                 repeat
 669
 670                 \ If we sent a secure renegotiation extension but did not
 671                 \ receive a response, then the server does not support
 672                 \ secure renegotiation. This is a hard failure if this
 673                 \ is a renegotiation.
 674                 ok-reneg if
 675                         ok-reneg 5 > if ERR_BAD_SECRENEG fail then
 676                         1 addr-reneg set8
 677                 then
 678                 close-elt
 679         then
 680         close-elt
 681         resume
 682         ;
 683
 684 cc: x509-start-chain ( expected-key-type -- ) {
 685         const br_x509_class *xc;
 686
 687         xc = *(ENG->x509ctx);
 688         xc->start_chain(ENG->x509ctx, T0_POP(), ENG->server_name);
 689 }
 690
 691 cc: x509-start-cert ( length -- ) {
 692         const br_x509_class *xc;
 693
 694         xc = *(ENG->x509ctx);
 695         xc->start_cert(ENG->x509ctx, T0_POP());
 696 }
 697
 698 cc: x509-append ( length -- ) {
 699         const br_x509_class *xc;
 700         size_t len;
 701
 702         xc = *(ENG->x509ctx);
 703         len = T0_POP();
 704         xc->append(ENG->x509ctx, ENG->pad, len);
 705 }
 706
 707 cc: x509-end-cert ( -- ) {
 708         const br_x509_class *xc;
 709
 710         xc = *(ENG->x509ctx);
 711         xc->end_cert(ENG->x509ctx);
 712 }
 713
 714 cc: x509-end-chain ( -- err ) {
 715         const br_x509_class *xc;
 716
 717         xc = *(ENG->x509ctx);
 718         T0_PUSH(xc->end_chain(ENG->x509ctx));
 719 }
 720
 721 \ Parse Certificate
 722 : read-Certificate ( -- )
 723         \ Get header, and check message type.
 724         read-handshake-header 11 = ifnot ERR_UNEXPECTED fail then
 725
 726         \ Start processing the chain through the X.509 engine.
 727         addr-cipher_suite get16 expected-key-type
 728         x509-start-chain
 729
 730         \ Total chain length is a 24-bit integer.
 731         read24 open-elt
 732         begin
 733                 dup while
 734                 read24 open-elt
 735                 dup x509-start-cert
 736
 737                 \ We read the certificate by chunks through the pad, so
 738                 \ as to use the existing reading function (read-blob)
 739                 \ that also ensures proper hashing.
 740                 begin
 741                         dup while
 742                         dup 256 > if 256 else dup then { len }
 743                         addr-pad len read-blob
 744                         len x509-append
 745                 repeat
 746                 close-elt
 747                 x509-end-cert
 748         repeat
 749
 750         \ We must close the chain AND the handshake message.
 751         close-elt
 752         close-elt
 753
 754         \ Chain processing is finished; get the error code.
 755         x509-end-chain
 756         dup if fail then drop
 757         ;
 758
 759 \ Verify signature on ECDHE point sent by the server.
 760 \   'hash' is the hash function to use (1 to 6, or 0 for RSA with MD5+SHA-1)
 761 \   'use-rsa' is 0 for ECDSA, -1 for for RSA
 762 \   'sig-len' is the signature length (in bytes)
 763 \ The signature itself is in the pad.
 764 cc: verify-SKE-sig ( hash use-rsa sig-len -- err ) {
 765         size_t sig_len = T0_POP();
 766         int use_rsa = T0_POPi();
 767         int hash = T0_POPi();
 768
 769         T0_PUSH(verify_SKE_sig(CTX, hash, use_rsa, sig_len));
 770 }
 771
 772 \ Parse ServerKeyExchange
 773 : read-ServerKeyExchange ( -- )
 774         \ Get header, and check message type.
 775         read-handshake-header 12 = ifnot ERR_UNEXPECTED fail then
 776
 777         \ We expect a named curve, and we must support it.
 778         read8 3 = ifnot ERR_INVALID_ALGORITHM fail then
 779         read16 dup addr-ecdhe_curve set8
 780         dup 32 >= if ERR_INVALID_ALGORITHM fail then
 781         supported-curves swap >> 1 and ifnot ERR_INVALID_ALGORITHM fail then
 782
 783         \ Read the server point.
 784         read8
 785         dup 133 > if ERR_INVALID_ALGORITHM fail then
 786         dup addr-ecdhe_point_len set8
 787         addr-ecdhe_point swap read-blob
 788
 789         \ If using TLS-1.2+, then the hash function and signature algorithm
 790         \ are explicitly provided; the signature algorithm must match what
 791         \ the cipher suite specifies. With TLS-1.0 and 1.1, the signature
 792         \ algorithm is inferred from the cipher suite, and the hash is
 793         \ either MD5+SHA-1 (for RSA signatures) or SHA-1 (for ECDSA).
 794         addr-version get16 0x0303 >= { tls1.2+ }
 795         addr-cipher_suite get16 use-rsa-ecdhe? { use-rsa }
 796         2 { hash }
 797         tls1.2+ if
 798                 \ Read hash function; accept only the SHA-* identifiers
 799                 \ (from SHA-1 to SHA-512, no MD5 here).
 800                 read8
 801                 dup dup 2 < swap 6 > or if ERR_INVALID_ALGORITHM fail then
 802                 >hash
 803                 read8
 804                 \ Get expected signature algorithm and compare with what
 805                 \ the server just sent. Expected value is 1 for RSA, 3
 806                 \ for ECDSA. Note that 'use-rsa' evaluates to -1 for RSA,
 807                 \ 0 for ECDSA.
 808                 use-rsa 1 << 3 + = ifnot ERR_INVALID_ALGORITHM fail then
 809         else
 810                 \ For MD5+SHA-1, we set 'hash' to 0.
 811                 use-rsa if 0 >hash then
 812         then
 813
 814         \ Read signature into the pad.
 815         read16 dup { sig-len }
 816
 817         dup 512 > if ERR_LIMIT_EXCEEDED fail then
 818         addr-pad swap read-blob
 819
 820         \ Verify signature.
 821         hash use-rsa sig-len verify-SKE-sig
 822         dup if fail then drop
 823
 824         close-elt ;
 825
 826 \ Parse CertificateRequest. Header has already been read.
 827 : read-contents-CertificateRequest ( lim -- )
 828         \ TODO: implement client certificates. Right now, we simply
 829         \ drop the complete message.
 830         begin dup while read8 drop repeat drop ;
 831
 832 \ Write an empty Certificate message.
 833 : write-empty-Certificate ( -- )
 834         11 write8 3 write24 0 write24 ;
 835
 836 cc: do-rsa-encrypt ( prf_id -- nlen ) {
 837         int x;
 838
 839         x = make_pms_rsa(CTX, T0_POP());
 840         if (x < 0) {
 841                 br_ssl_engine_fail(ENG, -x);
 842                 T0_CO();
 843         } else {
 844                 T0_PUSH(x);
 845         }
 846 }
 847
 848 cc: do-ecdh ( echde prf_id -- ulen ) {
 849         unsigned prf_id = T0_POP();
 850         unsigned ecdhe = T0_POP();
 851         int x;
 852
 853         x = make_pms_ecdh(CTX, ecdhe, prf_id);
 854         if (x < 0) {
 855                 br_ssl_engine_fail(ENG, -x);
 856                 T0_CO();
 857         } else {
 858                 T0_PUSH(x);
 859         }
 860 }
 861
 862 \ Write ClientKeyExchange
 863 : write-ClientKeyExchange ( -- )
 864         16 write8
 865         addr-cipher_suite get16
 866         dup use-rsa-keyx? if
 867                 prf-id do-rsa-encrypt
 868                 dup 2+ write24
 869                 dup write16
 870                 addr-pad swap write-blob
 871         else
 872                 dup use-ecdhe? swap prf-id do-ecdh
 873                 dup 1+ write24
 874                 dup write8
 875                 addr-pad swap write-blob
 876         then ;
 877
 878 \ =======================================================================
 879
 880 \ Perform a handshake.
 881 : do-handshake ( -- )
 882         0 addr-application_data set8
 883         22 addr-record_type_out set8
 884         multihash-init
 885
 886         write-ClientHello
 887         flush-record
 888         read-ServerHello
 889
 890         if
 891                 \ Session resumption.
 892                 -1 read-CCS-Finished
 893                 -1 write-CCS-Finished
 894
 895         else
 896
 897                 \ Not a session resumption.
 898
 899                 read-Certificate
 900
 901                 \ Depending on cipher suite, we may now expect a
 902                 \ ServerKeyExchange.
 903                 addr-cipher_suite get16 expected-key-type
 904                 CX 0 63 { BR_KEYTYPE_SIGN } and if
 905                         read-ServerKeyExchange
 906                 then
 907
 908                 \ Get next header.
 909                 read-handshake-header
 910
 911                 \ If this is a CertificateRequest, parse it, then read
 912                 \ next header.
 913                 dup 13 = if
 914                         drop read-contents-CertificateRequest
 915                         read-handshake-header
 916                         -1
 917                 else
 918                         0
 919                 then
 920                 { seen-CR }
 921
 922                 \ At that point, we should have a ServerHelloDone,
 923                 \ whose length must be 0.
 924                 14 = ifnot ERR_UNEXPECTED fail then
 925                 if ERR_BAD_HELLO_DONE fail then
 926
 927                 \ There should not be more bytes in the record at that point.
 928                 more-incoming-bytes? if ERR_UNEXPECTED fail then
 929
 930                 seen-CR if
 931                         \ TODO: client certificate support.
 932                         write-empty-Certificate
 933                 then
 934                 write-ClientKeyExchange
 935
 936                 \ TODO: CertificateVerify
 937
 938                 -1 write-CCS-Finished
 939                 -1 read-CCS-Finished
 940         then
 941
 942         \ Now we should be invoked only in case of renegotiation.
 943         1 addr-application_data set8
 944         23 addr-record_type_out set8 ;
 945
 946 \ Read a HelloRequest message.
 947 : read-HelloRequest ( -- )
 948         \ A HelloRequest has length 0 and type 0.
 949         read-handshake-header-core
 950         if ERR_UNEXPECTED fail then
 951         if ERR_BAD_HANDSHAKE fail then ;
 952
 953 \ Entry point.
 954 : main ( -- ! )
 955         \ Perform initial handshake.
 956         do-handshake
 957
 958         begin
 959                 \ Wait for further invocation. At that point, we should
 960                 \ get either an explicit call for renegotiation, or
 961                 \ an incoming HelloRequest handshake message.
 962                 wait-co
 963                 dup 0x07 and case
 964                         0x00 of
 965                                 0x10 and if
 966                                         do-handshake
 967                                 then
 968                         endof
 969                         0x01 of
 970                                 drop
 971                                 0 addr-application_data set8
 972                                 read-HelloRequest
 973                                 \ Reject renegotiations if the peer does not
 974                                 \ support secure renegotiation. Theoretically
 975                                 \ we could just ignore that, however if the
 976                                 \ server sent an HelloRequest then it is
 977                                 \ expecting a handshake and will wait for our
 978                                 \ ClientHello.
 979                                 addr-reneg get8 1 = if
 980                                         flush-record
 981                                         begin can-output? not while
 982                                                 wait-co drop
 983                                         repeat
 984                                         100 send-warning
 985                                 else
 986                                         do-handshake
 987                                 then
 988                         endof
 989                         ERR_UNEXPECTED fail
 990                 endcase
 991         again
 992         ;