aboutsummaryrefslogtreecommitdiff
path: root/src/daemon/https/tls/gnutls_handshake.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/daemon/https/tls/gnutls_handshake.c')
-rw-r--r--src/daemon/https/tls/gnutls_handshake.c247
1 files changed, 125 insertions, 122 deletions
diff --git a/src/daemon/https/tls/gnutls_handshake.c b/src/daemon/https/tls/gnutls_handshake.c
index 084e0477..52473c27 100644
--- a/src/daemon/https/tls/gnutls_handshake.c
+++ b/src/daemon/https/tls/gnutls_handshake.c
@@ -59,7 +59,7 @@
59#define FALSE 0 59#define FALSE 0
60 60
61static int _gnutls_server_select_comp_method (mhd_gtls_session_t session, 61static int _gnutls_server_select_comp_method (mhd_gtls_session_t session,
62 opaque * data, int datalen); 62 opaque * data, int datalen);
63 63
64 64
65/* Clears the handshake hash buffers and handles. 65/* Clears the handshake hash buffers and handles.
@@ -82,19 +82,16 @@ static void
82resume_copy_required_values (mhd_gtls_session_t session) 82resume_copy_required_values (mhd_gtls_session_t session)
83{ 83{
84 /* get the new random values */ 84 /* get the new random values */
85 memcpy (session->internals.resumed_security_parameters. 85 memcpy (session->internals.resumed_security_parameters.server_random,
86 server_random,
87 session->security_parameters.server_random, TLS_RANDOM_SIZE); 86 session->security_parameters.server_random, TLS_RANDOM_SIZE);
88 memcpy (session->internals.resumed_security_parameters. 87 memcpy (session->internals.resumed_security_parameters.client_random,
89 client_random,
90 session->security_parameters.client_random, TLS_RANDOM_SIZE); 88 session->security_parameters.client_random, TLS_RANDOM_SIZE);
91 89
92 /* keep the ciphersuite and compression 90 /* keep the ciphersuite and compression
93 * That is because the client must see these in our 91 * That is because the client must see these in our
94 * hello message. 92 * hello message.
95 */ 93 */
96 memcpy (session->security_parameters.current_cipher_suite. 94 memcpy (session->security_parameters.current_cipher_suite.suite,
97 suite,
98 session->internals.resumed_security_parameters. 95 session->internals.resumed_security_parameters.
99 current_cipher_suite.suite, 2); 96 current_cipher_suite.suite, 2);
100 97
@@ -108,15 +105,15 @@ resume_copy_required_values (mhd_gtls_session_t session)
108 session->internals.resumed_security_parameters.entity; 105 session->internals.resumed_security_parameters.entity;
109 106
110 mhd_gtls_set_current_version (session, 107 mhd_gtls_set_current_version (session,
111 session->internals. 108 session->internals.
112 resumed_security_parameters.version); 109 resumed_security_parameters.version);
113 110
114 session->security_parameters.cert_type = 111 session->security_parameters.cert_type =
115 session->internals.resumed_security_parameters.cert_type; 112 session->internals.resumed_security_parameters.cert_type;
116 113
117 memcpy (session->security_parameters.session_id, 114 memcpy (session->security_parameters.session_id,
118 session->internals.resumed_security_parameters. 115 session->internals.resumed_security_parameters.session_id,
119 session_id, sizeof (session->security_parameters.session_id)); 116 sizeof (session->security_parameters.session_id));
120 session->security_parameters.session_id_size = 117 session->security_parameters.session_id_size =
121 session->internals.resumed_security_parameters.session_id_size; 118 session->internals.resumed_security_parameters.session_id_size;
122} 119}
@@ -173,11 +170,11 @@ _gnutls_ssl3_finished (mhd_gtls_session_t session, int type, opaque * ret)
173 mhd_gnutls_hash (td_sha, mesg, siz); 170 mhd_gnutls_hash (td_sha, mesg, siz);
174 171
175 mhd_gnutls_mac_deinit_ssl3_handshake (td_md5, ret, 172 mhd_gnutls_mac_deinit_ssl3_handshake (td_md5, ret,
176 session->security_parameters. 173 session->security_parameters.
177 master_secret, TLS_MASTER_SIZE); 174 master_secret, TLS_MASTER_SIZE);
178 mhd_gnutls_mac_deinit_ssl3_handshake (td_sha, &ret[16], 175 mhd_gnutls_mac_deinit_ssl3_handshake (td_sha, &ret[16],
179 session->security_parameters. 176 session->security_parameters.
180 master_secret, TLS_MASTER_SIZE); 177 master_secret, TLS_MASTER_SIZE);
181 178
182 return 0; 179 return 0;
183} 180}
@@ -238,7 +235,7 @@ _gnutls_finished (mhd_gtls_session_t session, int type, void *ret)
238 } 235 }
239 236
240 return mhd_gtls_PRF (session, session->security_parameters.master_secret, 237 return mhd_gtls_PRF (session, session->security_parameters.master_secret,
241 TLS_MASTER_SIZE, mesg, siz, concat, len, 12, ret); 238 TLS_MASTER_SIZE, mesg, siz, concat, len, 12, ret);
242} 239}
243 240
244/* this function will produce TLS_RANDOM_SIZE==32 bytes of random data 241/* this function will produce TLS_RANDOM_SIZE==32 bytes of random data
@@ -271,7 +268,7 @@ mhd_gtls_tls_create_random (opaque * dst)
271 */ 268 */
272int 269int
273mhd_gtls_negotiate_version (mhd_gtls_session_t session, 270mhd_gtls_negotiate_version (mhd_gtls_session_t session,
274 enum MHD_GNUTLS_Protocol adv_version) 271 enum MHD_GNUTLS_Protocol adv_version)
275{ 272{
276 int ret; 273 int ret;
277 274
@@ -302,7 +299,7 @@ mhd_gtls_negotiate_version (mhd_gtls_session_t session,
302 299
303int 300int
304mhd_gtls_user_hello_func (mhd_gtls_session_t session, 301mhd_gtls_user_hello_func (mhd_gtls_session_t session,
305 enum MHD_GNUTLS_Protocol adv_version) 302 enum MHD_GNUTLS_Protocol adv_version)
306{ 303{
307 int ret; 304 int ret;
308 305
@@ -393,10 +390,9 @@ _gnutls_read_client_hello (mhd_gtls_session_t session, opaque * data,
393 } 390 }
394 else 391 else
395 { 392 {
396 mhd_gtls_generate_session_id (session->security_parameters. 393 mhd_gtls_generate_session_id (session->security_parameters.session_id,
397 session_id, 394 &session->security_parameters.
398 &session->security_parameters. 395 session_id_size);
399 session_id_size);
400 396
401 session->internals.resumed = RESUME_FALSE; 397 session->internals.resumed = RESUME_FALSE;
402 } 398 }
@@ -424,7 +420,7 @@ _gnutls_read_client_hello (mhd_gtls_session_t session, opaque * data,
424 */ 420 */
425 if (neg_version >= MHD_GNUTLS_TLS1_0) 421 if (neg_version >= MHD_GNUTLS_TLS1_0)
426 { 422 {
427 ret = mhd_gtls_parse_extensions (session, EXTENSION_APPLICATION, &data[pos], len); /* len is the rest of the parsed length */ 423 ret = mhd_gtls_parse_extensions (session, EXTENSION_APPLICATION, &data[pos], len); /* len is the rest of the parsed length */
428 if (ret < 0) 424 if (ret < 0)
429 { 425 {
430 gnutls_assert (); 426 gnutls_assert ();
@@ -441,7 +437,7 @@ _gnutls_read_client_hello (mhd_gtls_session_t session, opaque * data,
441 437
442 if (neg_version >= MHD_GNUTLS_TLS1_0) 438 if (neg_version >= MHD_GNUTLS_TLS1_0)
443 { 439 {
444 ret = mhd_gtls_parse_extensions (session, EXTENSION_TLS, &data[pos], len); /* len is the rest of the parsed length */ 440 ret = mhd_gtls_parse_extensions (session, EXTENSION_TLS, &data[pos], len); /* len is the rest of the parsed length */
445 if (ret < 0) 441 if (ret < 0)
446 { 442 {
447 gnutls_assert (); 443 gnutls_assert ();
@@ -495,8 +491,10 @@ _gnutls_handshake_hash_pending (mhd_gtls_session_t session)
495 491
496 if (siz > 0) 492 if (siz > 0)
497 { 493 {
498 mhd_gnutls_hash (session->internals.handshake_mac_handle_sha, data, siz); 494 mhd_gnutls_hash (session->internals.handshake_mac_handle_sha, data,
499 mhd_gnutls_hash (session->internals.handshake_mac_handle_md5, data, siz); 495 siz);
496 mhd_gnutls_hash (session->internals.handshake_mac_handle_md5, data,
497 siz);
500 } 498 }
501 499
502 mhd_gtls_handshake_buffer_empty (session); 500 mhd_gtls_handshake_buffer_empty (session);
@@ -554,7 +552,7 @@ _gnutls_send_finished (mhd_gtls_session_t session, int again)
554 552
555 ret = 553 ret =
556 mhd_gtls_send_handshake (session, data, data_size, 554 mhd_gtls_send_handshake (session, data, data_size,
557 GNUTLS_HANDSHAKE_FINISHED); 555 GNUTLS_HANDSHAKE_FINISHED);
558 556
559 return ret; 557 return ret;
560} 558}
@@ -572,7 +570,7 @@ _gnutls_recv_finished (mhd_gtls_session_t session)
572 570
573 ret = 571 ret =
574 mhd_gtls_recv_handshake (session, &vrfy, &vrfysize, 572 mhd_gtls_recv_handshake (session, &vrfy, &vrfysize,
575 GNUTLS_HANDSHAKE_FINISHED, MANDATORY_PACKET); 573 GNUTLS_HANDSHAKE_FINISHED, MANDATORY_PACKET);
576 if (ret < 0) 574 if (ret < 0)
577 { 575 {
578 ERR ("recv finished int", ret); 576 ERR ("recv finished int", ret);
@@ -601,8 +599,8 @@ _gnutls_recv_finished (mhd_gtls_session_t session)
601 { 599 {
602 ret = 600 ret =
603 _gnutls_ssl3_finished (session, 601 _gnutls_ssl3_finished (session,
604 (session->security_parameters. 602 (session->security_parameters.entity + 1) % 2,
605 entity + 1) % 2, data); 603 data);
606 } 604 }
607 else 605 else
608 { /* TLS 1.0 */ 606 { /* TLS 1.0 */
@@ -671,14 +669,14 @@ _gnutls_server_find_pk_algos_in_ciphersuites (const opaque *
671 */ 669 */
672int 670int
673mhd_gtls_server_select_suite (mhd_gtls_session_t session, opaque * data, 671mhd_gtls_server_select_suite (mhd_gtls_session_t session, opaque * data,
674 int datalen) 672 int datalen)
675{ 673{
676 int x, i, j; 674 int x, i, j;
677 cipher_suite_st *ciphers, cs; 675 cipher_suite_st *ciphers, cs;
678 int retval, err; 676 int retval, err;
679 enum MHD_GNUTLS_PublicKeyAlgorithm pk_algo; /* will hold the pk algorithms 677 enum MHD_GNUTLS_PublicKeyAlgorithm pk_algo; /* will hold the pk algorithms
680 * supported by the peer. 678 * supported by the peer.
681 */ 679 */
682 680
683 pk_algo = _gnutls_server_find_pk_algos_in_ciphersuites (data, datalen); 681 pk_algo = _gnutls_server_find_pk_algos_in_ciphersuites (data, datalen);
684 682
@@ -741,8 +739,8 @@ mhd_gtls_server_select_suite (mhd_gtls_session_t session, opaque * data,
741 _gnutls_handshake_log 739 _gnutls_handshake_log
742 ("HSK[%x]: Selected cipher suite: %s\n", session, 740 ("HSK[%x]: Selected cipher suite: %s\n", session,
743 mhd_gtls_cipher_suite_get_name (&cs)); 741 mhd_gtls_cipher_suite_get_name (&cs));
744 memcpy (session->security_parameters.current_cipher_suite. 742 memcpy (session->security_parameters.current_cipher_suite.suite,
745 suite, ciphers[i].suite, 2); 743 ciphers[i].suite, 2);
746 retval = 0; 744 retval = 0;
747 goto finish; 745 goto finish;
748 } 746 }
@@ -763,8 +761,8 @@ finish:
763 if (mhd_gtls_get_kx_cred 761 if (mhd_gtls_get_kx_cred
764 (session, 762 (session,
765 mhd_gtls_cipher_suite_get_kx_algo (&session->security_parameters. 763 mhd_gtls_cipher_suite_get_kx_algo (&session->security_parameters.
766 current_cipher_suite), 764 current_cipher_suite), &err) == NULL
767 &err) == NULL && err != 0) 765 && err != 0)
768 { 766 {
769 gnutls_assert (); 767 gnutls_assert ();
770 return GNUTLS_E_INSUFFICIENT_CREDENTIALS; 768 return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
@@ -777,8 +775,8 @@ finish:
777 */ 775 */
778 session->internals.auth_struct = 776 session->internals.auth_struct =
779 mhd_gtls_kx_auth_struct (mhd_gtls_cipher_suite_get_kx_algo 777 mhd_gtls_kx_auth_struct (mhd_gtls_cipher_suite_get_kx_algo
780 (&session->security_parameters. 778 (&session->security_parameters.
781 current_cipher_suite)); 779 current_cipher_suite));
782 if (session->internals.auth_struct == NULL) 780 if (session->internals.auth_struct == NULL)
783 { 781 {
784 782
@@ -828,7 +826,7 @@ _gnutls_server_select_comp_method (mhd_gtls_session_t session,
828 _gnutls_handshake_log 826 _gnutls_handshake_log
829 ("HSK[%x]: Selected Compression Method: %s\n", session, 827 ("HSK[%x]: Selected Compression Method: %s\n", session,
830 MHD_gnutls_compression_get_name (session->internals. 828 MHD_gnutls_compression_get_name (session->internals.
831 compression_method)); 829 compression_method));
832 830
833 831
834 return 0; 832 return 0;
@@ -883,9 +881,9 @@ _gnutls_handshake_hash_add_sent (mhd_gtls_session_t session,
883 if (type != GNUTLS_HANDSHAKE_HELLO_REQUEST) 881 if (type != GNUTLS_HANDSHAKE_HELLO_REQUEST)
884 { 882 {
885 mhd_gnutls_hash (session->internals.handshake_mac_handle_sha, dataptr, 883 mhd_gnutls_hash (session->internals.handshake_mac_handle_sha, dataptr,
886 datalen); 884 datalen);
887 mhd_gnutls_hash (session->internals.handshake_mac_handle_md5, dataptr, 885 mhd_gnutls_hash (session->internals.handshake_mac_handle_md5, dataptr,
888 datalen); 886 datalen);
889 } 887 }
890 888
891 return 0; 889 return 0;
@@ -899,8 +897,8 @@ _gnutls_handshake_hash_add_sent (mhd_gtls_session_t session,
899 */ 897 */
900int 898int
901mhd_gtls_send_handshake (mhd_gtls_session_t session, void *i_data, 899mhd_gtls_send_handshake (mhd_gtls_session_t session, void *i_data,
902 uint32_t i_datasize, 900 uint32_t i_datasize,
903 gnutls_handshake_description_t type) 901 gnutls_handshake_description_t type)
904{ 902{
905 int ret; 903 int ret;
906 uint8_t *data; 904 uint8_t *data;
@@ -954,7 +952,7 @@ mhd_gtls_send_handshake (mhd_gtls_session_t session, void *i_data,
954 952
955 ret = 953 ret =
956 mhd_gtls_handshake_io_send_int (session, GNUTLS_HANDSHAKE, type, 954 mhd_gtls_handshake_io_send_int (session, GNUTLS_HANDSHAKE, type,
957 data, datasize); 955 data, datasize);
958 956
959 _gnutls_handshake_log ("HSK[%x]: %s was sent [%ld bytes]\n", 957 _gnutls_handshake_log ("HSK[%x]: %s was sent [%ld bytes]\n",
960 session, _gnutls_handshake2str (type), datasize); 958 session, _gnutls_handshake2str (type), datasize);
@@ -1007,7 +1005,7 @@ _gnutls_recv_handshake_header (mhd_gtls_session_t session,
1007 { 1005 {
1008 ret = 1006 ret =
1009 mhd_gtls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE, 1007 mhd_gtls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE,
1010 type, dataptr, SSL2_HEADERS); 1008 type, dataptr, SSL2_HEADERS);
1011 1009
1012 if (ret < 0) 1010 if (ret < 0)
1013 { 1011 {
@@ -1030,14 +1028,13 @@ _gnutls_recv_handshake_header (mhd_gtls_session_t session,
1030 { 1028 {
1031 ret = 1029 ret =
1032 mhd_gtls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE, 1030 mhd_gtls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE,
1033 type, 1031 type,
1034 &dataptr[session-> 1032 &dataptr
1035 internals. 1033 [session->internals.
1036 handshake_header_buffer. 1034 handshake_header_buffer.header_size],
1037 header_size], 1035 HANDSHAKE_HEADER_SIZE -
1038 HANDSHAKE_HEADER_SIZE - 1036 session->internals.
1039 session->internals. 1037 handshake_header_buffer.header_size);
1040 handshake_header_buffer.header_size);
1041 if (ret <= 0) 1038 if (ret <= 0)
1042 { 1039 {
1043 gnutls_assert (); 1040 gnutls_assert ();
@@ -1155,8 +1152,8 @@ _gnutls_handshake_hash_add_recvd (mhd_gtls_session_t session,
1155 */ 1152 */
1156int 1153int
1157mhd_gtls_recv_handshake (mhd_gtls_session_t session, uint8_t ** data, 1154mhd_gtls_recv_handshake (mhd_gtls_session_t session, uint8_t ** data,
1158 int *datalen, gnutls_handshake_description_t type, 1155 int *datalen, gnutls_handshake_description_t type,
1159 Optional optional) 1156 Optional optional)
1160{ 1157{
1161 int ret; 1158 int ret;
1162 uint32_t length32 = 0; 1159 uint32_t length32 = 0;
@@ -1205,7 +1202,7 @@ mhd_gtls_recv_handshake (mhd_gtls_session_t session, uint8_t ** data,
1205 { 1202 {
1206 ret = 1203 ret =
1207 mhd_gtls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE, 1204 mhd_gtls_handshake_io_recv_int (session, GNUTLS_HANDSHAKE,
1208 type, dataptr, length32); 1205 type, dataptr, length32);
1209 if (ret <= 0) 1206 if (ret <= 0)
1210 { 1207 {
1211 gnutls_assert (); 1208 gnutls_assert ();
@@ -1222,8 +1219,8 @@ mhd_gtls_recv_handshake (mhd_gtls_session_t session, uint8_t ** data,
1222 session->internals. 1219 session->internals.
1223 handshake_header_buffer.header, 1220 handshake_header_buffer.header,
1224 session->internals. 1221 session->internals.
1225 handshake_header_buffer. 1222 handshake_header_buffer.header_size,
1226 header_size, dataptr, length32); 1223 dataptr, length32);
1227 if (ret < 0) 1224 if (ret < 0)
1228 { 1225 {
1229 gnutls_assert (); 1226 gnutls_assert ();
@@ -1286,7 +1283,8 @@ _gnutls_client_set_ciphersuite (mhd_gtls_session_t session, opaque suite[2])
1286 int i, err; 1283 int i, err;
1287 1284
1288 z = 1; 1285 z = 1;
1289 cipher_suite_num = mhd_gtls_supported_ciphersuites (session, &cipher_suites); 1286 cipher_suite_num =
1287 mhd_gtls_supported_ciphersuites (session, &cipher_suites);
1290 if (cipher_suite_num < 0) 1288 if (cipher_suite_num < 0)
1291 { 1289 {
1292 gnutls_assert (); 1290 gnutls_assert ();
@@ -1313,19 +1311,19 @@ _gnutls_client_set_ciphersuite (mhd_gtls_session_t session, opaque suite[2])
1313 memcpy (session->security_parameters.current_cipher_suite.suite, suite, 2); 1311 memcpy (session->security_parameters.current_cipher_suite.suite, suite, 2);
1314 1312
1315 _gnutls_handshake_log ("HSK[%x]: Selected cipher suite: %s\n", session, 1313 _gnutls_handshake_log ("HSK[%x]: Selected cipher suite: %s\n", session,
1316 mhd_gtls_cipher_suite_get_name (&session-> 1314 mhd_gtls_cipher_suite_get_name
1317 security_parameters. 1315 (&session->security_parameters.
1318 current_cipher_suite)); 1316 current_cipher_suite));
1319 1317
1320 1318
1321 /* check if the credentials (username, public key etc.) are ok. 1319 /* check if the credentials (username, public key etc.) are ok.
1322 * Actually checks if they exist. 1320 * Actually checks if they exist.
1323 */ 1321 */
1324 if (mhd_gtls_get_kx_cred 1322 if (mhd_gtls_get_kx_cred
1325 (session, mhd_gtls_cipher_suite_get_kx_algo (&session-> 1323 (session,
1326 security_parameters. 1324 mhd_gtls_cipher_suite_get_kx_algo
1327 current_cipher_suite), 1325 (&session->security_parameters.current_cipher_suite), &err) == NULL
1328 &err) == NULL && err != 0) 1326 && err != 0)
1329 { 1327 {
1330 gnutls_assert (); 1328 gnutls_assert ();
1331 return GNUTLS_E_INSUFFICIENT_CREDENTIALS; 1329 return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
@@ -1338,8 +1336,8 @@ _gnutls_client_set_ciphersuite (mhd_gtls_session_t session, opaque suite[2])
1338 */ 1336 */
1339 session->internals.auth_struct = 1337 session->internals.auth_struct =
1340 mhd_gtls_kx_auth_struct (mhd_gtls_cipher_suite_get_kx_algo 1338 mhd_gtls_kx_auth_struct (mhd_gtls_cipher_suite_get_kx_algo
1341 (&session->security_parameters. 1339 (&session->security_parameters.
1342 current_cipher_suite)); 1340 current_cipher_suite));
1343 1341
1344 if (session->internals.auth_struct == NULL) 1342 if (session->internals.auth_struct == NULL)
1345 { 1343 {
@@ -1358,14 +1356,15 @@ _gnutls_client_set_ciphersuite (mhd_gtls_session_t session, opaque suite[2])
1358/* This function sets the given comp method to the session. 1356/* This function sets the given comp method to the session.
1359 */ 1357 */
1360static int 1358static int
1361_gnutls_client_set_comp_method (mhd_gtls_session_t session, opaque comp_method) 1359_gnutls_client_set_comp_method (mhd_gtls_session_t session,
1360 opaque comp_method)
1362{ 1361{
1363 int comp_methods_num; 1362 int comp_methods_num;
1364 uint8_t *compression_methods; 1363 uint8_t *compression_methods;
1365 int i; 1364 int i;
1366 1365
1367 comp_methods_num = mhd_gtls_supported_compression_methods (session, 1366 comp_methods_num = mhd_gtls_supported_compression_methods (session,
1368 &compression_methods); 1367 &compression_methods);
1369 if (comp_methods_num < 0) 1368 if (comp_methods_num < 0)
1370 { 1369 {
1371 gnutls_assert (); 1370 gnutls_assert ();
@@ -1410,21 +1409,19 @@ _gnutls_client_check_if_resuming (mhd_gtls_session_t session,
1410 session_id_len); 1409 session_id_len);
1411 _gnutls_handshake_log ("HSK[%x]: SessionID: %s\n", session, 1410 _gnutls_handshake_log ("HSK[%x]: SessionID: %s\n", session,
1412 mhd_gtls_bin2hex (session_id, session_id_len, buf, 1411 mhd_gtls_bin2hex (session_id, session_id_len, buf,
1413 sizeof (buf))); 1412 sizeof (buf)));
1414 1413
1415 if (session_id_len > 0 && 1414 if (session_id_len > 0 &&
1416 session->internals.resumed_security_parameters.session_id_size == 1415 session->internals.resumed_security_parameters.session_id_size ==
1417 session_id_len 1416 session_id_len
1418 && memcmp (session_id, 1417 && memcmp (session_id,
1419 session->internals.resumed_security_parameters. 1418 session->internals.resumed_security_parameters.session_id,
1420 session_id, session_id_len) == 0) 1419 session_id_len) == 0)
1421 { 1420 {
1422 /* resume session */ 1421 /* resume session */
1423 memcpy (session->internals. 1422 memcpy (session->internals.resumed_security_parameters.server_random,
1424 resumed_security_parameters.server_random,
1425 session->security_parameters.server_random, TLS_RANDOM_SIZE); 1423 session->security_parameters.server_random, TLS_RANDOM_SIZE);
1426 memcpy (session->internals. 1424 memcpy (session->internals.resumed_security_parameters.client_random,
1427 resumed_security_parameters.client_random,
1428 session->security_parameters.client_random, TLS_RANDOM_SIZE); 1425 session->security_parameters.client_random, TLS_RANDOM_SIZE);
1429 session->internals.resumed = RESUME_TRUE; /* we are resuming */ 1426 session->internals.resumed = RESUME_TRUE; /* we are resuming */
1430 1427
@@ -1536,7 +1533,7 @@ _gnutls_read_server_hello (mhd_gtls_session_t session,
1536 */ 1533 */
1537 if (version >= MHD_GNUTLS_TLS1_0) 1534 if (version >= MHD_GNUTLS_TLS1_0)
1538 { 1535 {
1539 ret = mhd_gtls_parse_extensions (session, EXTENSION_ANY, &data[pos], len); /* len is the rest of the parsed length */ 1536 ret = mhd_gtls_parse_extensions (session, EXTENSION_ANY, &data[pos], len); /* len is the rest of the parsed length */
1540 if (ret < 0) 1537 if (ret < 0)
1541 { 1538 {
1542 gnutls_assert (); 1539 gnutls_assert ();
@@ -1627,7 +1624,8 @@ _gnutls_copy_comp_methods (mhd_gtls_session_t session,
1627 uint8_t *compression_methods, comp_num; 1624 uint8_t *compression_methods, comp_num;
1628 int datalen, pos; 1625 int datalen, pos;
1629 1626
1630 ret = mhd_gtls_supported_compression_methods (session, &compression_methods); 1627 ret =
1628 mhd_gtls_supported_compression_methods (session, &compression_methods);
1631 if (ret < 0) 1629 if (ret < 0)
1632 { 1630 {
1633 gnutls_assert (); 1631 gnutls_assert ();
@@ -1841,7 +1839,7 @@ _gnutls_send_client_hello (mhd_gtls_session_t session, int again)
1841 1839
1842 ret = 1840 ret =
1843 mhd_gtls_send_handshake (session, data, datalen, 1841 mhd_gtls_send_handshake (session, data, datalen,
1844 GNUTLS_HANDSHAKE_CLIENT_HELLO); 1842 GNUTLS_HANDSHAKE_CLIENT_HELLO);
1845 gnutls_free (data); 1843 gnutls_free (data);
1846 1844
1847 return ret; 1845 return ret;
@@ -1883,7 +1881,7 @@ _gnutls_send_server_hello (mhd_gtls_session_t session, int again)
1883 */ 1881 */
1884 gnutls_assert (); 1882 gnutls_assert ();
1885 ret = MHD_gnutls_alert_send (session, GNUTLS_AL_FATAL, 1883 ret = MHD_gnutls_alert_send (session, GNUTLS_AL_FATAL,
1886 GNUTLS_A_UNKNOWN_PSK_IDENTITY); 1884 GNUTLS_A_UNKNOWN_PSK_IDENTITY);
1887 if (ret < 0) 1885 if (ret < 0)
1888 { 1886 {
1889 gnutls_assert (); 1887 gnutls_assert ();
@@ -1932,7 +1930,7 @@ _gnutls_send_server_hello (mhd_gtls_session_t session, int again)
1932 1930
1933 _gnutls_handshake_log ("HSK[%x]: SessionID: %s\n", session, 1931 _gnutls_handshake_log ("HSK[%x]: SessionID: %s\n", session,
1934 mhd_gtls_bin2hex (SessionID, session_id_len, 1932 mhd_gtls_bin2hex (SessionID, session_id_len,
1935 buf, sizeof (buf))); 1933 buf, sizeof (buf)));
1936 1934
1937 memcpy (&data[pos], 1935 memcpy (&data[pos],
1938 session->security_parameters.current_cipher_suite.suite, 2); 1936 session->security_parameters.current_cipher_suite.suite, 2);
@@ -1940,7 +1938,7 @@ _gnutls_send_server_hello (mhd_gtls_session_t session, int again)
1940 1938
1941 comp = 1939 comp =
1942 (uint8_t) mhd_gtls_compression_get_num (session-> 1940 (uint8_t) mhd_gtls_compression_get_num (session->
1943 internals.compression_method); 1941 internals.compression_method);
1944 data[pos++] = comp; 1942 data[pos++] = comp;
1945 1943
1946 1944
@@ -1954,7 +1952,7 @@ _gnutls_send_server_hello (mhd_gtls_session_t session, int again)
1954 1952
1955 ret = 1953 ret =
1956 mhd_gtls_send_handshake (session, data, datalen, 1954 mhd_gtls_send_handshake (session, data, datalen,
1957 GNUTLS_HANDSHAKE_SERVER_HELLO); 1955 GNUTLS_HANDSHAKE_SERVER_HELLO);
1958 gnutls_afree (data); 1956 gnutls_afree (data);
1959 1957
1960 return ret; 1958 return ret;
@@ -2137,7 +2135,7 @@ _gnutls_send_supplemental (mhd_gtls_session_t session, int again)
2137 2135
2138 if (again) 2136 if (again)
2139 ret = mhd_gtls_send_handshake (session, NULL, 0, 2137 ret = mhd_gtls_send_handshake (session, NULL, 0,
2140 GNUTLS_HANDSHAKE_SUPPLEMENTAL); 2138 GNUTLS_HANDSHAKE_SUPPLEMENTAL);
2141 else 2139 else
2142 { 2140 {
2143 mhd_gtls_buffer buf; 2141 mhd_gtls_buffer buf;
@@ -2151,7 +2149,7 @@ _gnutls_send_supplemental (mhd_gtls_session_t session, int again)
2151 } 2149 }
2152 2150
2153 ret = mhd_gtls_send_handshake (session, buf.data, buf.length, 2151 ret = mhd_gtls_send_handshake (session, buf.data, buf.length,
2154 GNUTLS_HANDSHAKE_SUPPLEMENTAL); 2152 GNUTLS_HANDSHAKE_SUPPLEMENTAL);
2155 mhd_gtls_buffer_clear (&buf); 2153 mhd_gtls_buffer_clear (&buf);
2156 } 2154 }
2157 2155
@@ -2168,8 +2166,8 @@ _gnutls_recv_supplemental (mhd_gtls_session_t session)
2168 _gnutls_debug_log ("EXT[%x]: Expecting supplemental data\n", session); 2166 _gnutls_debug_log ("EXT[%x]: Expecting supplemental data\n", session);
2169 2167
2170 ret = mhd_gtls_recv_handshake (session, &data, &datalen, 2168 ret = mhd_gtls_recv_handshake (session, &data, &datalen,
2171 GNUTLS_HANDSHAKE_SUPPLEMENTAL, 2169 GNUTLS_HANDSHAKE_SUPPLEMENTAL,
2172 OPTIONAL_PACKET); 2170 OPTIONAL_PACKET);
2173 if (ret < 0) 2171 if (ret < 0)
2174 { 2172 {
2175 gnutls_assert (); 2173 gnutls_assert ();
@@ -2290,12 +2288,12 @@ mhd_gtls_handshake_client (mhd_gtls_session_t session)
2290 if (session->internals.resumed_security_parameters.session_id_size > 0) 2288 if (session->internals.resumed_security_parameters.session_id_size > 0)
2291 _gnutls_handshake_log ("HSK[%x]: Ask to resume: %s\n", session, 2289 _gnutls_handshake_log ("HSK[%x]: Ask to resume: %s\n", session,
2292 mhd_gtls_bin2hex (session->internals. 2290 mhd_gtls_bin2hex (session->internals.
2293 resumed_security_parameters. 2291 resumed_security_parameters.
2294 session_id, 2292 session_id,
2295 session->internals. 2293 session->internals.
2296 resumed_security_parameters. 2294 resumed_security_parameters.
2297 session_id_size, buf, 2295 session_id_size, buf,
2298 sizeof (buf))); 2296 sizeof (buf)));
2299#endif 2297#endif
2300 2298
2301 switch (STATE) 2299 switch (STATE)
@@ -2310,8 +2308,8 @@ mhd_gtls_handshake_client (mhd_gtls_session_t session)
2310 /* receive the server hello */ 2308 /* receive the server hello */
2311 ret = 2309 ret =
2312 mhd_gtls_recv_handshake (session, NULL, NULL, 2310 mhd_gtls_recv_handshake (session, NULL, NULL,
2313 GNUTLS_HANDSHAKE_SERVER_HELLO, 2311 GNUTLS_HANDSHAKE_SERVER_HELLO,
2314 MANDATORY_PACKET); 2312 MANDATORY_PACKET);
2315 STATE = STATE2; 2313 STATE = STATE2;
2316 IMED_RET ("recv hello", ret); 2314 IMED_RET ("recv hello", ret);
2317 2315
@@ -2351,8 +2349,8 @@ mhd_gtls_handshake_client (mhd_gtls_session_t session)
2351 if (session->internals.resumed == RESUME_FALSE) /* if we are not resuming */ 2349 if (session->internals.resumed == RESUME_FALSE) /* if we are not resuming */
2352 ret = 2350 ret =
2353 mhd_gtls_recv_handshake (session, NULL, NULL, 2351 mhd_gtls_recv_handshake (session, NULL, NULL,
2354 GNUTLS_HANDSHAKE_SERVER_HELLO_DONE, 2352 GNUTLS_HANDSHAKE_SERVER_HELLO_DONE,
2355 MANDATORY_PACKET); 2353 MANDATORY_PACKET);
2356 STATE = STATE6; 2354 STATE = STATE6;
2357 IMED_RET ("recv server hello done", ret); 2355 IMED_RET ("recv server hello done", ret);
2358 2356
@@ -2469,7 +2467,8 @@ _gnutls_recv_handshake_final (mhd_gtls_session_t session, int init)
2469 { 2467 {
2470 case STATE0: 2468 case STATE0:
2471 case STATE30: 2469 case STATE30:
2472 ret = mhd_gtls_recv_int (session, GNUTLS_CHANGE_CIPHER_SPEC, -1, &ch, 1); 2470 ret =
2471 mhd_gtls_recv_int (session, GNUTLS_CHANGE_CIPHER_SPEC, -1, &ch, 1);
2473 STATE = STATE30; 2472 STATE = STATE30;
2474 if (ret <= 0) 2473 if (ret <= 0)
2475 { 2474 {
@@ -2530,8 +2529,8 @@ mhd_gtls_handshake_server (mhd_gtls_session_t session)
2530 case STATE1: 2529 case STATE1:
2531 ret = 2530 ret =
2532 mhd_gtls_recv_handshake (session, NULL, NULL, 2531 mhd_gtls_recv_handshake (session, NULL, NULL,
2533 GNUTLS_HANDSHAKE_CLIENT_HELLO, 2532 GNUTLS_HANDSHAKE_CLIENT_HELLO,
2534 MANDATORY_PACKET); 2533 MANDATORY_PACKET);
2535 STATE = STATE1; 2534 STATE = STATE1;
2536 IMED_RET ("recv hello", ret); 2535 IMED_RET ("recv hello", ret);
2537 2536
@@ -2671,7 +2670,7 @@ mhd_gtls_generate_session_id (opaque * session_id, uint8_t * len)
2671 2670
2672int 2671int
2673mhd_gtls_recv_hello_request (mhd_gtls_session_t session, void *data, 2672mhd_gtls_recv_hello_request (mhd_gtls_session_t session, void *data,
2674 uint32_t data_size) 2673 uint32_t data_size)
2675{ 2674{
2676 uint8_t type; 2675 uint8_t type;
2677 2676
@@ -2701,7 +2700,7 @@ mhd_gtls_recv_hello_request (mhd_gtls_session_t session, void *data,
2701inline static int 2700inline static int
2702check_server_params (mhd_gtls_session_t session, 2701check_server_params (mhd_gtls_session_t session,
2703 enum MHD_GNUTLS_KeyExchangeAlgorithm kx, 2702 enum MHD_GNUTLS_KeyExchangeAlgorithm kx,
2704 enum MHD_GNUTLS_KeyExchangeAlgorithm * alg, int alg_size) 2703 enum MHD_GNUTLS_KeyExchangeAlgorithm *alg, int alg_size)
2705{ 2704{
2706 int cred_type; 2705 int cred_type;
2707 mhd_gtls_dh_params_t dh_params = NULL; 2706 mhd_gtls_dh_params_t dh_params = NULL;
@@ -2717,17 +2716,17 @@ check_server_params (mhd_gtls_session_t session,
2717 int delete; 2716 int delete;
2718 mhd_gtls_cert_credentials_t x509_cred = 2717 mhd_gtls_cert_credentials_t x509_cred =
2719 (mhd_gtls_cert_credentials_t) mhd_gtls_get_cred (session->key, 2718 (mhd_gtls_cert_credentials_t) mhd_gtls_get_cred (session->key,
2720 cred_type, NULL); 2719 cred_type, NULL);
2721 2720
2722 if (x509_cred != NULL) 2721 if (x509_cred != NULL)
2723 { 2722 {
2724 dh_params = 2723 dh_params =
2725 mhd_gtls_get_dh_params (x509_cred->dh_params, 2724 mhd_gtls_get_dh_params (x509_cred->dh_params,
2726 x509_cred->params_func, session); 2725 x509_cred->params_func, session);
2727 rsa_params = 2726 rsa_params =
2728 mhd_gtls_certificate_get_rsa_params (x509_cred->rsa_params, 2727 mhd_gtls_certificate_get_rsa_params (x509_cred->rsa_params,
2729 x509_cred->params_func, 2728 x509_cred->params_func,
2730 session); 2729 session);
2731 } 2730 }
2732 2731
2733 /* Check also if the certificate supports the 2732 /* Check also if the certificate supports the
@@ -2752,13 +2751,14 @@ check_server_params (mhd_gtls_session_t session,
2752 { 2751 {
2753 mhd_gtls_anon_server_credentials_t anon_cred = 2752 mhd_gtls_anon_server_credentials_t anon_cred =
2754 (mhd_gtls_anon_server_credentials_t) mhd_gtls_get_cred (session->key, 2753 (mhd_gtls_anon_server_credentials_t) mhd_gtls_get_cred (session->key,
2755 cred_type, NULL); 2754 cred_type,
2755 NULL);
2756 2756
2757 if (anon_cred != NULL) 2757 if (anon_cred != NULL)
2758 { 2758 {
2759 dh_params = 2759 dh_params =
2760 mhd_gtls_get_dh_params (anon_cred->dh_params, 2760 mhd_gtls_get_dh_params (anon_cred->dh_params,
2761 anon_cred->params_func, session); 2761 anon_cred->params_func, session);
2762 } 2762 }
2763#endif 2763#endif
2764#ifdef ENABLE_PSK 2764#ifdef ENABLE_PSK
@@ -2767,13 +2767,13 @@ check_server_params (mhd_gtls_session_t session,
2767 { 2767 {
2768 gnutls_psk_server_credentials_t psk_cred = 2768 gnutls_psk_server_credentials_t psk_cred =
2769 (gnutls_psk_server_credentials_t) mhd_gtls_get_cred (session->key, 2769 (gnutls_psk_server_credentials_t) mhd_gtls_get_cred (session->key,
2770 cred_type, NULL); 2770 cred_type, NULL);
2771 2771
2772 if (psk_cred != NULL) 2772 if (psk_cred != NULL)
2773 { 2773 {
2774 dh_params = 2774 dh_params =
2775 mhd_gtls_get_dh_params (psk_cred->dh_params, psk_cred->params_func, 2775 mhd_gtls_get_dh_params (psk_cred->dh_params,
2776 session); 2776 psk_cred->params_func, session);
2777 } 2777 }
2778#endif 2778#endif
2779 } 2779 }
@@ -2816,9 +2816,10 @@ check_server_params (mhd_gtls_session_t session,
2816 */ 2816 */
2817int 2817int
2818mhd_gtls_remove_unwanted_ciphersuites (mhd_gtls_session_t session, 2818mhd_gtls_remove_unwanted_ciphersuites (mhd_gtls_session_t session,
2819 cipher_suite_st ** cipherSuites, 2819 cipher_suite_st ** cipherSuites,
2820 int numCipherSuites, 2820 int numCipherSuites,
2821 enum MHD_GNUTLS_PublicKeyAlgorithm requested_pk_algo) 2821 enum MHD_GNUTLS_PublicKeyAlgorithm
2822 requested_pk_algo)
2822{ 2823{
2823 2824
2824 int ret = 0; 2825 int ret = 0;
@@ -2838,8 +2839,8 @@ mhd_gtls_remove_unwanted_ciphersuites (mhd_gtls_session_t session,
2838 2839
2839 cert_cred = 2840 cert_cred =
2840 (mhd_gtls_cert_credentials_t) mhd_gtls_get_cred (session->key, 2841 (mhd_gtls_cert_credentials_t) mhd_gtls_get_cred (session->key,
2841 MHD_GNUTLS_CRD_CERTIFICATE, 2842 MHD_GNUTLS_CRD_CERTIFICATE,
2842 NULL); 2843 NULL);
2843 2844
2844 /* If there are certificate credentials, find an appropriate certificate 2845 /* If there are certificate credentials, find an appropriate certificate
2845 * or disable them; 2846 * or disable them;
@@ -2953,13 +2954,15 @@ mhd_gtls_remove_unwanted_ciphersuites (mhd_gtls_session_t session,
2953 * 2954 *
2954 **/ 2955 **/
2955void 2956void
2956MHD_gnutls_handshake_set_max_packet_length (mhd_gtls_session_t session, size_t max) 2957MHD_gnutls_handshake_set_max_packet_length (mhd_gtls_session_t session,
2958 size_t max)
2957{ 2959{
2958 session->internals.max_handshake_data_buffer_size = max; 2960 session->internals.max_handshake_data_buffer_size = max;
2959} 2961}
2960 2962
2961void 2963void
2962mhd_gtls_set_adv_version (mhd_gtls_session_t session, enum MHD_GNUTLS_Protocol ver) 2964mhd_gtls_set_adv_version (mhd_gtls_session_t session,
2965 enum MHD_GNUTLS_Protocol ver)
2963{ 2966{
2964 set_adv_version (session, mhd_gtls_version_get_major (ver), 2967 set_adv_version (session, mhd_gtls_version_get_major (ver),
2965 mhd_gtls_version_get_minor (ver)); 2968 mhd_gtls_version_get_minor (ver));
@@ -2969,7 +2972,7 @@ enum MHD_GNUTLS_Protocol
2969mhd_gtls_get_adv_version (mhd_gtls_session_t session) 2972mhd_gtls_get_adv_version (mhd_gtls_session_t session)
2970{ 2973{
2971 return mhd_gtls_version_get (_gnutls_get_adv_version_major (session), 2974 return mhd_gtls_version_get (_gnutls_get_adv_version_major (session),
2972 _gnutls_get_adv_version_minor (session)); 2975 _gnutls_get_adv_version_minor (session));
2973} 2976}
2974 2977
2975/** 2978/**